From nobody Sun Jun 2 03:33:37 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EF3291200B9 for ; Sun, 2 Jun 2019 03:33:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.397 X-Spam-Level: X-Spam-Status: No, score=-0.397 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_SORBS_WEB=1.5, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oehG2P9dBo01 for ; Sun, 2 Jun 2019 03:33:34 -0700 (PDT) Received: from p3plsmtpa12-08.prod.phx3.secureserver.net (p3plsmtpa12-08.prod.phx3.secureserver.net [68.178.252.237]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0E0B61200F9 for ; Sun, 2 Jun 2019 03:33:33 -0700 (PDT) Received: from [192.168.1.108] ([188.4.94.123]) by :SMTPAUTH: with ESMTPSA id XNnrh22fIypiQXNnthHpwO; Sun, 02 Jun 2019 03:33:32 -0700 From: Laurence Lundblade Message-Id: <4A0EA92C-80B3-471A-B61D-D9433BE81346@island-resort.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_0F9F37E2-8DD3-4987-8E05-48515259E842" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Sun, 2 Jun 2019 03:33:26 -0700 In-Reply-To: Cc: Hannes Tschofenig , "Eric Voit (evoit)" , "rats@ietf.org" , Giridhar Mandyam To: Henk Birkholz References: <82b0a75e5b5645d1a43d240373bca6dc@NASANEXM01C.na.qualcomm.com> <50ddca72a9074e229976ca88f78e340a@NASANEXM01C.na.qualcomm.com> <175ea22d1a1948d48f8180424cc89ec0@NASANEXM01C.na.qualcomm.com> X-Mailer: Apple Mail (2.3445.9.1) X-CMAE-Envelope: MS4wfHsgKoISvh6MWNxELxKQZogF/UzA/aZtpXa0Lm/SxI7PPEU86dNuRGtQeQwjdyMozEAQuvBldY/apdM/MyIsMA5ppi6F58yg+z7hr77pWRkggv+8cfje XIIAvJF7ttSp3BvQDc17E0OYUYDPTu6tRhi6VYb0/cj7+42yNLxTcTQMgvQatL1IlLgmX/SseZVfj2UI8fPP5GOfV+A9+uyKfYCKUQ10lqKliHuKqIjHTKuk /yU4V1DVS2DM+BE6feEtwnp/NuzrkhjRdEXKbHw/Z+nvLZEvMRaxfiwqDGl46wy79XkdAxTuWVGYjIK5FNG6cA== Archived-At: Subject: Re: [Rats] Call for Adoption: EAT draft X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 02 Jun 2019 10:33:36 -0000 --Apple-Mail=_0F9F37E2-8DD3-4987-8E05-48515259E842 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I think it makes sense to separate into two: 1) New rules and advice for registering CWT/JWT claims 2) A basic set of attestation-related claims this WG will define To go on about 1), it seems we are expanding CWT/JWT from just being = auth tokens to also being attestation tokens and also identity certs = (draft-birkholz-core-coid-01) and maybe X.509 replacements. This seems = like mostly a good idea to me. It will be super cool that code can be = shared by all of these for example. Lots of claims will overlap which is = good too. So I don=E2=80=99t think it makes sense to talk about "expert review of = EAT claims". Rather we should talk about "expert review of CWT/JWT = claims" and how it should be different than it is now. Also, if you haven=E2=80=99t looked at the register JWT claims, it=E2=80=99= s worth checking out: https://www.iana.org/assignments/jwt/jwt.xhtml. Am = also curious what people think of bringing them into CWT and especially = how we avoid conflicting duplication between CWT and JWT. To say more about 2), it seems we should really work to come up with a = nice, well-thought-out, medium-sized, coherent set of claims for = attestation and put them in an RFC. This is roughly what the EAT draft = is. LL --Apple-Mail=_0F9F37E2-8DD3-4987-8E05-48515259E842 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
I think it makes sense to separate into two:

1) New rules and = advice for registering CWT/JWT claims
2) A basic set of attestation-related claims this WG will = define

To go on about 1), it seems we are expanding CWT/JWT from = just being auth tokens to also being attestation tokens and also = identity certs (draft-birkholz-core-coid-01) and maybe X.509 = replacements. This seems like mostly a good idea to me. It will be super = cool that code can be shared by all of these for example. Lots of claims = will overlap which is good too.

So I don=E2=80=99t think it makes sense = to talk about "expert review of EAT claims". Rather we should talk about = "expert review of CWT/JWT claims" and how it should be different than it = is now.

Also, = if you haven=E2=80=99t looked at the register JWT claims, it=E2=80=99s = worth checking out: https://www.iana.org/assignments/jwt/jwt.xhtml. Am also = curious what people think of bringing them into CWT and especially how = we avoid conflicting duplication between CWT and JWT.


To say more about 2), it seems we should really work to come = up with a nice, well-thought-out, medium-sized, coherent set of claims = for attestation and put them in an RFC. This is roughly what the EAT = draft is.

LL


= --Apple-Mail=_0F9F37E2-8DD3-4987-8E05-48515259E842-- From nobody Sun Jun 2 11:51:11 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DB15312003F for ; Sun, 2 Jun 2019 11:51:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hJ2N8AktlLX4 for ; Sun, 2 Jun 2019 11:51:04 -0700 (PDT) Received: from mailext.sit.fraunhofer.de (mailext.sit.fraunhofer.de [141.12.72.89]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 795BD120098 for ; Sun, 2 Jun 2019 11:51:02 -0700 (PDT) Received: from mail.sit.fraunhofer.de (mail.sit.fraunhofer.de [141.12.84.171]) by mailext.sit.fraunhofer.de (8.14.4/8.14.4/Debian-4.1ubuntu1.1) with ESMTP id x52IopU2028986 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sun, 2 Jun 2019 20:50:52 +0200 Received: from [192.168.0.3] (31.17.248.68) by mail.sit.fraunhofer.de (141.12.84.171) with Microsoft SMTP Server (TLS) id 14.3.439.0; Sun, 2 Jun 2019 20:50:46 +0200 To: "Smith, Ned" , Hannes Tschofenig , Laurence Lundblade , "Eric Voit (evoit)" CC: "rats@ietf.org" , Giridhar Mandyam References: From: Henk Birkholz Message-ID: Date: Sun, 2 Jun 2019 20:50:45 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset="utf-8"; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit X-Originating-IP: [31.17.248.68] Archived-At: Subject: Re: [Rats] Call for Adoption: EAT draft X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 02 Jun 2019 18:51:08 -0000 Hi list, there is a lot to unpack here, but I am under time constraints, so I will only address a single topic for now. On 6/1/19 1:46 AM, Smith, Ned wrote: > I don't believe I'm connecting the dots regarding YANG and EAT/CWT defined claims. YANG is a data definition model (captures semantics) and can be used to generate data formats (syntax) (e.g. https://tools.ietf.org/html/draft-ietf-core-yang-cbor-10). EAT wasn't trying to be a data model AFAIK but seemed to include some semantics in the explanation of claims. However, CBOR/CWT syntax seems to be the context in which the semantic discussion takes place. Although, Laurence seems to agree that these could be separated - and possibly looking to CDDL as a way to express claims logically. > > YANG and CDDL seem to be competing for the same role - that of being a language for capturing information model semantics precisely. Does this make sense to use both? YANG is a modeling language for 'data at rest' that comes with a well-defined number of operations on how operate on this 'data at rest', including queries that return instances of the 'data at rest' data model via protocol messages. CDDL is a data modeling language for 'data in motion' or documents encoded in JSON/CBOR. Operations are of course also often represented via CDDL as they are part of protocol messages. API, though, are typical not in the scope of CDDL. In essence, Ned is correct wrt to semantics of information elements in so far that both YANG and CDDL can define them - and effectively represent the same semantics (most obviously in coreconf). Therefore, there is a requirement for mutual references between CWT and YANG semantics (everything else would be super confusing), or aligned registration. But please let me highlight, in general, YANG and CDDL are most certainly not competing for the same role: prominent example, you do not need the overhead of YANG to define how protocol messages look like in CDDL. The CDDL authors are working on a simple solution in the form of an informative RFC for guidance in this domain right now. Viele Grüße, Henk > > If there are other WGs / RFCs that already capture claims semantics that RATS determines is relevant for describing trustworthiness, then the RATS information model could simply reference these other works. > > Nevertheless, there may still be additional work ensuring the data model bindings can be realized for whatever formats the RATS WG determines are necessary (e.g. CBOR, CWT, other?). > > Some discipline may be required to qualify discussion threads in terms of information model (semantics) and relevance to trustworthiness from discussion about formatting and the namespaces that are formatting specific (and therefore potentially semantically overlapping). Maybe consider making better use of the subject to better focus thread discussion? Just a suggestion. > > Thx, > Ned > > > > On 5/31/19, 3:52 PM, "RATS on behalf of Henk Birkholz" wrote: > > Hi Hannes, > > just thoughts from the top of my head: > > 1.) Expert review of course is helpful (feasibility, no overlap in claim > semantics, etc.) and a quite straight forward procedure, but the > qualifying criteria for CWT claims for EAT review might be defined in > the EAT draft? > > 2.) in order to not make this a shopping list, I like the SUIT approach > Hannes proposed, I think (not sure, if it is entirely applicable). In a > nutshell, going from user story, to requirement, to claims. > > But maybe that is on the information model level and should not burden > the EAT I-D which is at a nice scope right now? > > 3.) Additionally, the semantics of a new CWT claim for EAT should be > checked against existing YANG statement semantics. If there is semantic > equivalence (or superset) defined in YANG already, the claim must > reference that one. > > I though this can be done via > > > https://yangcatalog.org/yang-search/ > > But it seem not work for me right now... > > > That said, this would probably mitigate the issue, I assume. I might be > missing something important here, of course. > > Viele Grüße, > > Henk > > > > On 5/31/19 4:10 PM, Hannes Tschofenig wrote: > > Hi Eric, Hi Laurence, > > > > I thought about this a bit more. > > > > If I understand it correctly then your main concern is that we duplicate information in the CWT claims registry that is already available in other registries. Is my understanding correct? > > I also hear a second concern, which is more about whether the existing CWT / JWT registry contains claims that are not suitable for use in an EAT token. > > > > Underlying both concerns is the question about what makes for a good claim for use within an EAT token. Do we know the answer? > > > > Ciao > > Hannes > > > > -----Original Message----- > > From: Hannes Tschofenig > > Sent: Freitag, 31. Mai 2019 09:55 > > To: 'Laurence Lundblade' ; Eric Voit (evoit) > > Cc: rats@ietf.org; Giridhar Mandyam > > Subject: RE: [Rats] Call for Adoption: EAT draft > > > > Hi Laurence, Hi Eric, > > > >> So if an EAT is a CWT, then the proposal is to change the IANA registry rules for CWT in the EAT draft. Is that allowed? This is really a change to CWT and even JWT. Seems like it is saying that if a YANG-defined claim exists for a possible CWT or JWT claim, the YANG-based claim MUST be used. > > > > IMHO everything can be changed. > > > >> I think Eric’s thought about harmonizing is a good one. Learn from past efforts. Improve interop. > > > > Learning from past efforts sounds always good. Let me pick on the example from below about draft-ietf-netmod-geo-location-01. It appears to me that the netmod group has either not looked at the work from the IETF GEOPRIV working group or ignored it. (I have not been involved in the netmod group and so I cannot say.) GEOPRIV published a number of RFCs that provide details about how to encode different geodetic location shapes (based on a mapping from GML), civic location, relative location, talks about uncertainty and confidence, how to encode moving objects, etc. While there is no need to use the info 1:1 there is a lot that can be learned from the work in that group. Of course, the content for the location encoding in draft-mandyam-eat-01 isn't much better. > > > > For me the biggest question is whether location is actually a good source of information conveyed in an EAT token. > > > > Eric, I understand that you do not want to duplicate information. I don’t want to do that either. I have been wondering about this aspect myself (particularly when I read the location claim). For example, in the LwM2M context we have a (pretty naive) location object as part of the data model as well. The data model we use with LwM2M is different to how data is modelled in the EAT token. Is this unavoidable? In some sense the situation is similar to the Yang-defined data model. The source of information comes from a different part of the system and is conveyed differently. Maybe you could call it a different layering where a device with Yang objects has to treat the EAT token as opaque (particularly since it is digitally signed and potentially encrypted). I am currently leaning towards seeing it that way from a LwM2M perspective. > > > > Ciao > > Hannes > > > > ~ snip ~ > > > > However, IANA registry rules revising aside, making it a MUST seems too much. I think the YANG-defined claims should be very much seriously considered, just like any other previous data structure definition, but that there be no blanket requirement. > > > > To go a little further and to be clear. When a YANG-defined claim is used the CBOR encoding of it will be used with CWT and the JSON encoding of it will be used with JWT. This hinges on draft-ietf-core-yang-cbor-10 producing satisfying, compact and sensible CBOR encodings (binary data is really CBOR binary, claim keys are small integers…). > > > > LL > > > > > >> On May 30, 2019, at 12:19 PM, Eric Voit (evoit) wrote: > >> > >> Hi Hannes, > >> > >> I do like EAT. I am hoping that it gets adopted. > >> > >> At the same time, I am trying to avoid unnecessary mapping of claims from a chipmakers domain into system integrator /network operator domains. I believe much pain can be avoided with a little planning up front. That is what I am trying to facilitate with this discussion. > >> > >> Specific details/examples in-line... > >> > >>> From: Hannes Tschofenig, May 30, 2019 1:18 PM > >>> > >>> Hi Giri, Hi Eric, > >>> > >>> (a) some principles/guidance to CWT claims registry people on avoiding the mass registration of lightly-used or unused claims > >>> > >>> Why is this a requirement? When a claim is registered then it is most likely done with the anticipation that it will be used. I have not seen other IETF registries that have raised the bar to a similar level, at least the JWT claims registry does not work that way. Furthermore, what is the harm in registering claims that later turn out to be less frequently used? > >> > >> Let me provide a *best* case example. In the NETMOD WG, there is a draft-ietf-netmod-geo-location. Both that draft and this have definitions of latitude, longitude, altitude, accuracy, etc. The *good* news is that both drafts are based on WGS84. So at least our experts have lucked in to using a consistent resource. But are these the same objects? How does a reader know? In one of the documents the latitude/longitude attributes are "FloatOrNumber", in the other they are "decimal64 {fraction-digits 16}". > >> > >> It of course gets harder for other objects. The velocity objects in draft-mandyam-rats-eat are "heading" and "speed". And draft-ietf-netmod-geo-location has this information "v-north", " v-east", and " v-up". Here we have different formats, the first of which cannot be easily upgraded to serve three dimensions. > >> > >> And then we get into other harder objects where we will have timestamping, explicit domains of allowed entries, etc. And is there is no boundaries on what might be claimed as an EAT, in theory we could create a parallel domain of objects without description on how to map between the two, placing the heavy lifting onto the implementer. > >> > >> Now I am not trying to solve world hunger in this thread. I am just trying to have the draft consider minimizing inter-ecosystem friction where we can see it coming. I believe with a little foresight we can ensure a consistent population and data typing for a subset of claims. Without foresight, I see that people will create new CWT to avoid some later mapping. And more/redundant CWT tags will harm interoperability. > >> > >>> (b) a requirement to map claims to existing YANG objects, if these YANG objects exist > >>> > >>> I also don’t understand this requirement. Is there some design rational why this would be needed/useful? > >> > >> Per above, EAT claim instances need to be integrated with other work/ecosystems in the IETF after the information comes off of a hardware chip. A claim registry shouldn't create redundant info/formats to other work/ecosystems when it can be avoided, at least without broad discussion and consensus. (I.e., lets avoid unconscious object definition and object domain overlaps wherever possible.) > >> > >> Eric > >> > >>> Cia > >>> Hannes > >> _______________________________________________ > >> RATS mailing list > >> RATS@ietf.org > >> https://www.ietf.org/mailman/listinfo/rats > > > > IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you. > > _______________________________________________ > > RATS mailing list > > RATS@ietf.org > > https://www.ietf.org/mailman/listinfo/rats > > > > _______________________________________________ > RATS mailing list > RATS@ietf.org > https://www.ietf.org/mailman/listinfo/rats > > From nobody Mon Jun 3 08:01:08 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 833F61202D2 for ; Mon, 3 Jun 2019 08:01:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.499 X-Spam-Level: X-Spam-Status: No, score=-14.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=RoK7BwRi; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=lQnTtk8Q Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wRZdPmXbat3K for ; Mon, 3 Jun 2019 08:01:05 -0700 (PDT) Received: from alln-iport-2.cisco.com (alln-iport-2.cisco.com [173.37.142.89]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 256171202C2 for ; Mon, 3 Jun 2019 08:01:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=9870; q=dns/txt; s=iport; t=1559574061; x=1560783661; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=IS5Vsh7KUzmRhofkb564dzasjHU6u+ANRzEizVsn4VM=; b=RoK7BwRi4jRKOq8hAHNnKXhwcc/mJymQSxGVSnV7nUozefdJ3laQbSUN nzrisxRvFoNRqbGIAcKThmDjh4Bbj6w1d3du6FS4RktuYMmHhxeHJ8lbn kKyRATQiUYdpQDKX2xWaJ0JOwgd/L3STR6jNOnATcPVG4ZNgiD1aUHOok o=; IronPort-PHdr: =?us-ascii?q?9a23=3A6OQFxR8LRCk3DP9uRHGN82YQeigqvan1NQcJ65?= =?us-ascii?q?0hzqhDabmn44+/bB7E/fs4iljPUM2b8P9Ch+fM+4HYEW0bqdfk0jgZdYBUER?= =?us-ascii?q?oMiMEYhQslVcObDkznBPXrdCc9Ws9FUQwt8g=3D=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0B7AgD8NPVc/5pdJa1dCRwBAQEEAQE?= =?us-ascii?q?HBAEBgVQEAQELAYEOL1ADalUgBAsoCoQKg0cDjnKCV5JdhFKCUgNUCQEBAQw?= =?us-ascii?q?BASMKAgEBgUuCdQIXgnsjNwYOAQMBAQQBAQIBBG0cDIVKAQEBAQMSCwYKEwE?= =?us-ascii?q?BKQUJAQ8CAQgOBy0CAgIwJQIEAQ0NGoMBgR1NAx0BAgyeXgKBOIhfcYExgnk?= =?us-ascii?q?BAQWEehiCDwMGgTQBi1kXgUA/gVeCTD6CSIFSLCuCXTKCJostgm2EaJURagk?= =?us-ascii?q?Cgg2TTZZujQCWHgIEAgQFAg4BAQWBZSKBWHAVO4Jsgg8MF4NNhRSFP3IBgSi?= =?us-ascii?q?PCwGBIAEB?= X-IronPort-AV: E=Sophos;i="5.60,547,1549929600"; d="scan'208,217";a="282132063" Received: from rcdn-core-3.cisco.com ([173.37.93.154]) by alln-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 03 Jun 2019 15:00:59 +0000 Received: from XCH-RCD-003.cisco.com (xch-rcd-003.cisco.com [173.37.102.13]) by rcdn-core-3.cisco.com (8.15.2/8.15.2) with ESMTPS id x53F0xsp001834 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Mon, 3 Jun 2019 15:00:59 GMT Received: from xhs-aln-002.cisco.com (173.37.135.119) by XCH-RCD-003.cisco.com (173.37.102.13) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Mon, 3 Jun 2019 10:00:58 -0500 Received: from xhs-aln-001.cisco.com (173.37.135.118) by xhs-aln-002.cisco.com (173.37.135.119) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Mon, 3 Jun 2019 10:00:57 -0500 Received: from NAM03-CO1-obe.outbound.protection.outlook.com (173.37.151.57) by xhs-aln-001.cisco.com (173.37.135.118) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Mon, 3 Jun 2019 10:00:57 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=IS5Vsh7KUzmRhofkb564dzasjHU6u+ANRzEizVsn4VM=; b=lQnTtk8Q4ueYAIJwGx678Hic4xa1B/1reU0CigAOQN3pNQXbsFvkIkqCPggBPMzSBr+p2B1H2Mbm4ktItHZo3f6Ym8FQHUxK5/IBjkJ+1WvqSaVpHdCMYx0n9qSJlZuqWOZ0vLAXQdopzRSIhE+JYUS9srB7DSuHcJQ7/TQe12w= Received: from DM6PR11MB4089.namprd11.prod.outlook.com (20.176.126.30) by DM6PR11MB3785.namprd11.prod.outlook.com (20.179.16.160) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1943.18; Mon, 3 Jun 2019 15:00:56 +0000 Received: from DM6PR11MB4089.namprd11.prod.outlook.com ([fe80::d014:d7a3:270:e5a9]) by DM6PR11MB4089.namprd11.prod.outlook.com ([fe80::d014:d7a3:270:e5a9%3]) with mapi id 15.20.1943.018; Mon, 3 Jun 2019 15:00:56 +0000 From: "Eric Voit (evoit)" To: Laurence Lundblade , Henk Birkholz CC: Hannes Tschofenig , "rats@ietf.org" , Giridhar Mandyam Thread-Topic: [Rats] Call for Adoption: EAT draft Thread-Index: AQHVB0JFcFAs6WTeOkGyPcUokje8h6Z3f+WAgAkvdwCAAAQPAIAAQeOAgAAaP4CAAAwUgIAADicAgAAZOwCAAAfHAIACt1gAgAAFvJCAAA1BIIAAVb6AgACS14CAAGj3AIAAkaWAgAJWZACAAc3CMA== Date: Mon, 3 Jun 2019 15:00:56 +0000 Message-ID: References: <82b0a75e5b5645d1a43d240373bca6dc@NASANEXM01C.na.qualcomm.com> <50ddca72a9074e229976ca88f78e340a@NASANEXM01C.na.qualcomm.com> <175ea22d1a1948d48f8180424cc89ec0@NASANEXM01C.na.qualcomm.com> <4A0EA92C-80B3-471A-B61D-D9433BE81346@island-resort.com> In-Reply-To: <4A0EA92C-80B3-471A-B61D-D9433BE81346@island-resort.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=evoit@cisco.com; x-originating-ip: [173.38.117.65] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: cb34d12a-8f18-487c-824d-08d6e8344805 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600148)(711020)(4605104)(1401327)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7193020); SRVR:DM6PR11MB3785; x-ms-traffictypediagnostic: DM6PR11MB3785: x-ms-exchange-purlcount: 3 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:4303; x-forefront-prvs: 0057EE387C x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(346002)(136003)(376002)(366004)(39860400002)(189003)(199004)(86362001)(52536014)(76176011)(186003)(25786009)(229853002)(102836004)(6506007)(6436002)(256004)(99286004)(4326008)(446003)(5660300002)(26005)(6246003)(71200400001)(71190400001)(790700001)(6116002)(316002)(7696005)(3846002)(66066001)(53936002)(76116006)(54896002)(486006)(9686003)(8936002)(11346002)(966005)(478600001)(2906002)(6306002)(68736007)(8676002)(236005)(33656002)(81166006)(81156014)(55016002)(66556008)(73956011)(476003)(66946007)(66476007)(66446008)(14454004)(7736002)(110136005)(54906003)(74316002)(606006)(64756008); DIR:OUT; SFP:1101; SCL:1; SRVR:DM6PR11MB3785; H:DM6PR11MB4089.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: FqaELk+B3bxh3BK//EhwrHh6CckNOIRO4EPRljau7SDIhfAH5gpYsip6dqqWJJqDM7bA7udYsG/OtuBoYf+wUjwKaizJIxLF+d64PCFox5QjFZPtPjC6A7p2UnQI5z4hUVQcDaoC+u1Z8ix+FO2QMYTVn/8kktRTX0fXoGej+fjbGbYMfTZwbnz7xj/6ZioX5t7pFKcQ4oebOkmAAHY+GvG1D4j7NAyr5NybJmisOwsdLanyeu/vg2GXf/xHKcHRfIhTAOBXd9PJVhMIckf2Cs1mu3dfwfkqil3KMd/F+VhOceATJzVLe3YYzSqLKr3JKej0QNwxqU577qsr5/NKySHzQC9UAvsikfqI+bGfZD4SzCH4fiQREjrpOBeCkN0+VaCB4eJ6Xf3uXfdYgGry2a8MiEQnyAe9UKMAkmsBUdI= Content-Type: multipart/alternative; boundary="_000_DM6PR11MB408961522D9B290A8BBEF3FBA1140DM6PR11MB4089namp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: cb34d12a-8f18-487c-824d-08d6e8344805 X-MS-Exchange-CrossTenant-originalarrivaltime: 03 Jun 2019 15:00:56.2058 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: evoit@cisco.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR11MB3785 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.102.13, xch-rcd-003.cisco.com X-Outbound-Node: rcdn-core-3.cisco.com Archived-At: Subject: Re: [Rats] Call for Adoption: EAT draft X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 03 Jun 2019 15:01:07 -0000 --_000_DM6PR11MB408961522D9B290A8BBEF3FBA1140DM6PR11MB4089namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 RnJvbTogTGF1cmVuY2UgTHVuZGJsYWRlLCBKdW5lIDIsIDIwMTkgNjozMyBBTQ0KDQpJIHRoaW5r IGl0IG1ha2VzIHNlbnNlIHRvIHNlcGFyYXRlIGludG8gdHdvOg0KDQoxKSBOZXcgcnVsZXMgYW5k IGFkdmljZSBmb3IgcmVnaXN0ZXJpbmcgQ1dUL0pXVCBjbGFpbXMNCjIpIEEgYmFzaWMgc2V0IG9m IGF0dGVzdGF0aW9uLXJlbGF0ZWQgY2xhaW1zIHRoaXMgV0cgd2lsbCBkZWZpbmUNCg0KVG8gZ28g b24gYWJvdXQgMSksIGl0IHNlZW1zIHdlIGFyZSBleHBhbmRpbmcgQ1dUL0pXVCBmcm9tIGp1c3Qg YmVpbmcgYXV0aCB0b2tlbnMgdG8gYWxzbyBiZWluZyBhdHRlc3RhdGlvbiB0b2tlbnMgYW5kIGFs c28gaWRlbnRpdHkgY2VydHMgKGRyYWZ0LWJpcmtob2x6LWNvcmUtY29pZC0wMSkgYW5kIG1heWJl IFguNTA5IHJlcGxhY2VtZW50cy4gVGhpcyBzZWVtcyBsaWtlIG1vc3RseSBhIGdvb2QgaWRlYSB0 byBtZS4gSXQgd2lsbCBiZSBzdXBlciBjb29sIHRoYXQgY29kZSBjYW4gYmUgc2hhcmVkIGJ5IGFs bCBvZiB0aGVzZSBmb3IgZXhhbXBsZS4gTG90cyBvZiBjbGFpbXMgd2lsbCBvdmVybGFwIHdoaWNo IGlzIGdvb2QgdG9vLg0KDQpTbyBJIGRvbuKAmXQgdGhpbmsgaXQgbWFrZXMgc2Vuc2UgdG8gdGFs ayBhYm91dCAiZXhwZXJ0IHJldmlldyBvZiBFQVQgY2xhaW1zIi4gUmF0aGVyIHdlIHNob3VsZCB0 YWxrIGFib3V0ICJleHBlcnQgcmV2aWV3IG9mIENXVC9KV1QgY2xhaW1zIiBhbmQgaG93IGl0IHNo b3VsZCBiZSBkaWZmZXJlbnQgdGhhbiBpdCBpcyBub3cuDQoNCjxlcmljPiBPbmUgdGhpbmcgdG8g Y29uc2lkZXIgaXMgdGhhdCBjbGFpbXMgZnJvbSBoYXJkd2FyZSBhcmUgcGVyY2VpdmVkIGFzIG1v cmUgdHJ1c3R3b3J0aHksIHdpdGggZGVmaW5pdGlvbnMgY2hhbmdpbmcgbGVzcyBmcmVxdWVudGx5 IHRoYW4gZnJvbSBzb2Z0d2FyZS4gKFdoZXRoZXIgdGhpcyBpcyB0cnVlIGlzIG9mIGNvdXJzZSBk ZWJhdGFibGUuKQ0KDQpJZiBub3RoaW5nIGVsc2UsIGlmIGhhcmR3YXJlIGFuZCBzb2Z0d2FyZSBn ZW5lcmF0ZWQgY2xhaW1zIGFyZSB0byBiZSBjb25zb2xpZGF0ZWQgaW50byBjb21tb24gbGlzdChz KSwgdGhlbiBhIHJldmlzZWQgZXhwZXJ0IHJldmlldyBwcm9jZXNzIHdpbGwgbmVlZCB0byByZWNv bmNpbGUgdGhlIHZhcnlpbmcgdGltZXNjYWxlcyBhbmQgZmxleGliaWxpdGllcyBvZiBkaWZmZXJl bnQgaW1wbGVtZW50ZXJzLg0KDQpFcmljDQoNCkFsc28sIGlmIHlvdSBoYXZlbuKAmXQgbG9va2Vk IGF0IHRoZSByZWdpc3RlciBKV1QgY2xhaW1zLCBpdOKAmXMgd29ydGggY2hlY2tpbmcgb3V0OiBo dHRwczovL3d3dy5pYW5hLm9yZy9hc3NpZ25tZW50cy9qd3Qvand0LnhodG1sLiBBbSBhbHNvIGN1 cmlvdXMgd2hhdCBwZW9wbGUgdGhpbmsgb2YgYnJpbmdpbmcgdGhlbSBpbnRvIENXVCBhbmQgZXNw ZWNpYWxseSBob3cgd2UgYXZvaWQgY29uZmxpY3RpbmcgZHVwbGljYXRpb24gYmV0d2VlbiBDV1Qg YW5kIEpXVC4NCg0KDQpUbyBzYXkgbW9yZSBhYm91dCAyKSwgaXQgc2VlbXMgd2Ugc2hvdWxkIHJl YWxseSB3b3JrIHRvIGNvbWUgdXAgd2l0aCBhIG5pY2UsIHdlbGwtdGhvdWdodC1vdXQsIG1lZGl1 bS1zaXplZCwgY29oZXJlbnQgc2V0IG9mIGNsYWltcyBmb3IgYXR0ZXN0YXRpb24gYW5kIHB1dCB0 aGVtIGluIGFuIFJGQy4gVGhpcyBpcyByb3VnaGx5IHdoYXQgdGhlIEVBVCBkcmFmdCBpcy4NCg0K TEwNCg0KDQo= --_000_DM6PR11MB408961522D9B290A8BBEF3FBA1140DM6PR11MB4089namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25v cm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21z by1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlm Ow0KCWNvbG9yOndpbmRvd3RleHQ7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTkNCgl7bXNvLXN0eWxlLXR5 cGU6cGVyc29uYWwtY29tcG9zZTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsN Cgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4 cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3Np emU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYu V29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBn dGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIx MDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpz aGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIg Lz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxh bmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRT ZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5Gcm9tOjwvYj4gTGF1cmVuY2UgTHVu ZGJsYWRlLCBKdW5lIDIsIDIwMTkgNjozMyBBTTxicj4NCjxicj4NCjwvcD4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5JIHRoaW5rIGl0IG1ha2VzIHNlbnNlIHRvIHNlcGFyYXRlIGludG8g dHdvOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4t bGVmdDozMC4wcHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+MSkgTmV3IHJ1bGVzIGFuZCBhZHZpY2UgZm9yIHJlZ2lzdGVyaW5nIDxpPkNXVC9KV1QgY2xh aW1zPC9pPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+MikgQSBiYXNpYyBzZXQgb2YgYXR0ZXN0YXRpb24tcmVsYXRlZCBjbGFpbXMgdGhpcyBXRyB3 aWxsIGRlZmluZTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UbyBnbyBvbiBhYm91dCAxKSwgaXQgc2VlbXMgd2UgYXJl IGV4cGFuZGluZyBDV1QvSldUIGZyb20ganVzdCBiZWluZyBhdXRoIHRva2VucyB0byBhbHNvIGJl aW5nIGF0dGVzdGF0aW9uIHRva2VucyBhbmQgYWxzbyBpZGVudGl0eSBjZXJ0cyAoZHJhZnQtYmly a2hvbHotY29yZS1jb2lkLTAxKSBhbmQgbWF5YmUgWC41MDkgcmVwbGFjZW1lbnRzLiBUaGlzIHNl ZW1zIGxpa2UgbW9zdGx5IGEgZ29vZCBpZGVhIHRvDQogbWUuIEl0IHdpbGwgYmUgc3VwZXIgY29v bCB0aGF0IGNvZGUgY2FuIGJlIHNoYXJlZCBieSBhbGwgb2YgdGhlc2UgZm9yIGV4YW1wbGUuIExv dHMgb2YgY2xhaW1zIHdpbGwgb3ZlcmxhcCB3aGljaCBpcyBnb29kIHRvby48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U28gSSBkb27igJl0IHRo aW5rIGl0IG1ha2VzIHNlbnNlIHRvIHRhbGsgYWJvdXQgJnF1b3Q7ZXhwZXJ0IHJldmlldyBvZiBF QVQgY2xhaW1zJnF1b3Q7LiBSYXRoZXIgd2Ugc2hvdWxkIHRhbGsgYWJvdXQgJnF1b3Q7ZXhwZXJ0 IHJldmlldyBvZiBDV1QvSldUIGNsYWltcyZxdW90OyBhbmQgaG93IGl0IHNob3VsZCBiZSBkaWZm ZXJlbnQgdGhhbiBpdCBpcyBub3cuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJjb2xvcjojNDQ3MkM0Ij4mbHQ7ZXJpYyZndDsgT25lIHRoaW5nIHRvIGNvbnNpZGVyIGlzIHRo YXQgY2xhaW1zIGZyb20gaGFyZHdhcmUgYXJlIHBlcmNlaXZlZCBhcyBtb3JlIHRydXN0d29ydGh5 LCB3aXRoIGRlZmluaXRpb25zIGNoYW5naW5nIGxlc3MgZnJlcXVlbnRseSB0aGFuIGZyb20gc29m dHdhcmUuIChXaGV0aGVyIHRoaXMgaXMgdHJ1ZSBpcyBvZiBjb3Vyc2UgZGViYXRhYmxlLikgJm5i c3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiM0NDcyQzQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojNDQ3MkM0Ij5J ZiBub3RoaW5nIGVsc2UsIGlmIGhhcmR3YXJlIGFuZCBzb2Z0d2FyZSBnZW5lcmF0ZWQgY2xhaW1z IGFyZSB0byBiZSBjb25zb2xpZGF0ZWQgaW50byBjb21tb24gbGlzdChzKSwgdGhlbiBhIHJldmlz ZWQgZXhwZXJ0IHJldmlldyBwcm9jZXNzIHdpbGwgbmVlZCB0byByZWNvbmNpbGUgdGhlIHZhcnlp bmcgdGltZXNjYWxlcyBhbmQgZmxleGliaWxpdGllcyBvZiBkaWZmZXJlbnQNCiBpbXBsZW1lbnRl cnMuIDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJjb2xvcjojNDQ3MkM0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzQ0NzJDNCI+RXJpYzxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojNDQ3 MkM0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5BbHNvLCBpZiB5b3UgaGF2ZW7igJl0IGxvb2tlZCBhdCB0aGUgcmVnaXN0 ZXIgSldUIGNsYWltcywgaXTigJlzIHdvcnRoIGNoZWNraW5nIG91dDombmJzcDs8YSBocmVmPSJo dHRwczovL3d3dy5pYW5hLm9yZy9hc3NpZ25tZW50cy9qd3Qvand0LnhodG1sIj5odHRwczovL3d3 dy5pYW5hLm9yZy9hc3NpZ25tZW50cy9qd3Qvand0LnhodG1sPC9hPi4gQW0gYWxzbyBjdXJpb3Vz IHdoYXQgcGVvcGxlIHRoaW5rIG9mIGJyaW5naW5nDQogdGhlbSBpbnRvIENXVCBhbmQgZXNwZWNp YWxseSBob3cgd2UgYXZvaWQgY29uZmxpY3RpbmcgZHVwbGljYXRpb24gYmV0d2VlbiBDV1QgYW5k IEpXVC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5UbyBzYXkgbW9yZSBhYm91dCAyKSwgaXQgc2VlbXMgd2Ugc2hvdWxkIHJlYWxseSB3b3Jr IHRvIGNvbWUgdXAgd2l0aCBhIG5pY2UsIHdlbGwtdGhvdWdodC1vdXQsIG1lZGl1bS1zaXplZCwg Y29oZXJlbnQgc2V0IG9mIGNsYWltcyBmb3IgYXR0ZXN0YXRpb24gYW5kIHB1dCB0aGVtIGluIGFu IFJGQy4gVGhpcyBpcyByb3VnaGx5IHdoYXQgdGhlIEVBVCBkcmFmdCBpcy48bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+TEw8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_DM6PR11MB408961522D9B290A8BBEF3FBA1140DM6PR11MB4089namp_-- From nobody Mon Jun 3 09:23:59 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 62E6412049C for ; Mon, 3 Jun 2019 09:23:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z8JuKE0Zl5oK for ; Mon, 3 Jun 2019 09:23:54 -0700 (PDT) Received: from EUR02-VE1-obe.outbound.protection.outlook.com (mail-eopbgr20080.outbound.protection.outlook.com [40.107.2.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AC3B7120444 for ; Mon, 3 Jun 2019 09:23:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=YGZ93tipRVUx7lIuwOFStUlOKz9UnZAoIqadKTUA1pE=; b=zgHeiK+Mz+4ArMVmx4jtwuAJlxMjUNH26FSVWCD7+MxwuoM37FnWLTX4EkYABezm8noBwIOQBnQOJUdbCgpYDYB0FNk/Ft7JVtNWvo+FFNDrgywbJLwd6UMf9rxGVTFtNFHXuXViKD3dfd0uz//DJUgLqTYYZYSgwm0gjXBvOyQ= Received: from HE1PR0801MB1643.eurprd08.prod.outlook.com (10.168.147.136) by HE1PR0801MB2028.eurprd08.prod.outlook.com (10.168.98.22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1943.22; Mon, 3 Jun 2019 16:23:49 +0000 Received: from HE1PR0801MB1643.eurprd08.prod.outlook.com ([fe80::74ab:8351:482e:102e]) by HE1PR0801MB1643.eurprd08.prod.outlook.com ([fe80::74ab:8351:482e:102e%2]) with mapi id 15.20.1943.018; Mon, 3 Jun 2019 16:23:49 +0000 From: Simon Frost To: Laurence Lundblade , Henk Birkholz CC: Hannes Tschofenig , "Eric Voit (evoit)" , "rats@ietf.org" , Giridhar Mandyam Thread-Topic: [Rats] Call for Adoption: EAT draft Thread-Index: AQHVGii4LOcmRmM7REq+/VWKhsku3g== Date: Mon, 3 Jun 2019 16:23:49 +0000 Message-ID: References: <82b0a75e5b5645d1a43d240373bca6dc@NASANEXM01C.na.qualcomm.com> <50ddca72a9074e229976ca88f78e340a@NASANEXM01C.na.qualcomm.com> <175ea22d1a1948d48f8180424cc89ec0@NASANEXM01C.na.qualcomm.com> <4A0EA92C-80B3-471A-B61D-D9433BE81346@island-resort.com> In-Reply-To: <4A0EA92C-80B3-471A-B61D-D9433BE81346@island-resort.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Simon.Frost@arm.com; x-originating-ip: [217.140.106.54] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: f0fa73cc-9c9e-4e9c-f00b-08d6e83fdc1f x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600148)(711020)(4605104)(1401327)(4618075)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7193020); SRVR:HE1PR0801MB2028; x-ms-traffictypediagnostic: HE1PR0801MB2028: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 0057EE387C x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(396003)(136003)(39860400002)(366004)(346002)(40434004)(189003)(199004)(476003)(53936002)(8936002)(66556008)(66446008)(66946007)(6436002)(66066001)(6306002)(73956011)(76116006)(64756008)(55016002)(486006)(7736002)(71190400001)(236005)(9686003)(71200400001)(66476007)(8676002)(11346002)(74316002)(81156014)(26005)(81166006)(5660300002)(2906002)(110136005)(54906003)(316002)(446003)(54896002)(68736007)(186003)(4326008)(6246003)(52536014)(102836004)(478600001)(256004)(99286004)(606006)(3846002)(33656002)(72206003)(6506007)(5024004)(14444005)(7696005)(76176011)(86362001)(25786009)(229853002)(6116002)(790700001)(53546011)(966005)(14454004); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR0801MB2028; H:HE1PR0801MB1643.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: TLifdjUZ5VKDLB66RNukL6VHDIsWGyxuH02PFs5XaFWHC3QLV/hdLlZMKGhvgaMyP728tpeUyCmT+0zmUBEKbsXcxh99FdP4YRNNbIWyQBamGHZwlN2AE++hD7CHdTA7qceT7SPcP6V5cXyIP6NzF68Qpa8PaWRD/LUnVfGlFxTpFzit4Tk4bV+hC7j7fzcEoVUekgyPD5Y7gtbTdej0MXMcLdcTVWkZlBHwubMVt+AMgMsqQw1MecM694ka3Um6g8ZU2XlhO4tWH+wgZ3gHcT3tIZWXMXZrhwUTZeXL+dq5j69tN0VmGYvFg52yYf/i7U01j1HhwBGMb77E2TVsngAcs20xmZZHOPrYavMNj0a8KDPOPRrbRdNPnR6eS7BIWZrurnUqPsI2Y5qOk83gHcPkJQAlspR2Ulz2WVfXHMU= Content-Type: multipart/alternative; boundary="_000_HE1PR0801MB16436E72BBD6D691A84BAE2EEF140HE1PR0801MB1643_" MIME-Version: 1.0 X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-Network-Message-Id: f0fa73cc-9c9e-4e9c-f00b-08d6e83fdc1f X-MS-Exchange-CrossTenant-originalarrivaltime: 03 Jun 2019 16:23:49.1366 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: Simon.Frost@arm.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0801MB2028 Archived-At: Subject: Re: [Rats] Call for Adoption: EAT draft X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 03 Jun 2019 16:23:57 -0000 --_000_HE1PR0801MB16436E72BBD6D691A84BAE2EEF140HE1PR0801MB1643_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 PiBBbHNvLCBpZiB5b3UgaGF2ZW7igJl0IGxvb2tlZCBhdCB0aGUgcmVnaXN0ZXIgSldUIGNsYWlt cywgaXTigJlzIHdvcnRoIGNoZWNraW5nIG91dDogaHR0cHM6Ly93d3cuaWFuYS5vcmcvYXNzaWdu bWVudHMvand0L2p3dC54aHRtbC4gQW0gYWxzbyBjdXJpb3VzIHdoYXQgcGVvcGxlIHRoaW5rIG9m IGJyaW5naW5nIHRoZW0gaW50byBDV1QgYW5kIGVzcGVjaWFsbHkgaG93IHdlIGF2b2lkIGNvbmZs aWN0aW5nIGR1cGxpY2F0aW9uIGJldHdlZW4gQ1dUIGFuZCBKV1QuDQoNCldoZW4gSSBsb29rIGF0 IHRoZSBKV1QgcmVnaXN0cnksIGl0IGxvb2tzIGxpa2UgYW4gb3Bwb3J0dW5pdHkgbG9zdC4gSXTi gJlzIGEgbWl4IG9mIGNsYWltcyB0aGF0IGNvdWxkIGJlIGdlbmVyYWxpc2VkIGZvciByZXVzZSwg ZS5nLiB0aGVyZSBhcmUgbXVsdGlwbGUgY2xhaW1zIGlhdCAvIGF1dGhfdGltZSBhbmQgbWF5YmUg YWxzbyB0b2UgZm9yIHRpbWUtc29tZXRoaW5nLWhhcHBlbmVkLCB3aGlsZSBvdGhlciBjbGFpbXMg d2lsbCBhbHdheXMgYmUgc3BlY2lmaWMgdG8gYSBzaW5nbGUgdXNlIGNhc2UuIE9uZSBvZiB0aGUg Z3JlYXQgYXBwZWFscyBvZiBFQVQgaXMgdGhhdCBpdCBvZmZlcnMgYSBzdGFuZGFyZCBzZXQgb2Yg Y2xhaW1zIHdoaWxlIGV2ZXJ5dGhpbmcgZWxzZSBpcyBjdXN0b20gdG8gYSB1c2UgY2FzZS4gQXMg c2V2ZXJhbCBkaXNjdXNzaW9ucyBoYXZlIGluZGljYXRlZCwgdGhlcmUgYXJlIHNldmVyYWwgaW5m b3JtYXRpb24gc2V0cyB0aGF0IGxlbmQgdGhlbXNlbHZlcyB0byBuZXcgc3RhbmRhcmQgY2xhaW1z LiBGb3IgZXhhbXBsZSwgYSBjaHVuayBvZiB0aGUgSldUIE9wZW5JRCBjbGFpbXMgd291bGQgbWFr ZSBhIHZlcnkgdXNlZnVsIOKAmFBlcnNvbuKAmSBzdGFuZGFyZCBzZXQuIEkga25vdyBub3QgYWxs IGNhc2VzIGNhbiBiZSBjYXB0dXJlZCBpbiBzdGFuZGFyZCBzZXRzIGJ1dCBub3QgaGF2aW5nIHRo ZW0gZW5jb3VyYWdlcyBkdXBsaWNhdGlvbiB3aXRob3V0IHJldXNlLg0KDQpJZiB0aGUgcmVnaXN0 cnkgaW5jbHVkZWQgdGhlIGluZm9ybWF0aW9uIGZvciBhIHNwZWNpZmljIHVzZSBjYXNlIHRvIHJl Z2lzdGVyIGEgY3VzdG9tIGNsYWltIGtleSByYW5nZSBhbmQgYSByZWZlcmVuY2UgLyBhdXRob3Jp dHkgVVJMIHdoZXJlIHRob3NlIGRlZmluaXRpb25zIGNhbiBiZSB0cmFja2VkLCB0aGF0IG1pZ2h0 IGVuY291cmFnZSBpbXBsZW1lbnRhdGlvbnMgdG8gdXNlIGJvdGggdGhlIHN0YW5kYXJkICYgc3Bl Y2lmaWMgY2xhaW0gc2V0cy4NCg0KVGhhbmtzDQpTaW1vbg0KDQpGcm9tOiBMYXVyZW5jZSBMdW5k YmxhZGUgPGxnbEBpc2xhbmQtcmVzb3J0LmNvbT4NClNlbnQ6IDAyIEp1bmUgMjAxOSAxMTozMw0K VG86IEhlbmsgQmlya2hvbHogPGhlbmsuYmlya2hvbHpAc2l0LmZyYXVuaG9mZXIuZGU+DQpDYzog SGFubmVzIFRzY2hvZmVuaWcgPEhhbm5lcy5Uc2Nob2ZlbmlnQGFybS5jb20+OyBFcmljIFZvaXQg KGV2b2l0KSA8ZXZvaXRAY2lzY28uY29tPjsgcmF0c0BpZXRmLm9yZzsgR2lyaWRoYXIgTWFuZHlh bSA8bWFuZHlhbUBxdGkucXVhbGNvbW0uY29tPg0KU3ViamVjdDogUmU6IFtSYXRzXSBDYWxsIGZv ciBBZG9wdGlvbjogRUFUIGRyYWZ0DQoNCkkgdGhpbmsgaXQgbWFrZXMgc2Vuc2UgdG8gc2VwYXJh dGUgaW50byB0d286DQoNCjEpIE5ldyBydWxlcyBhbmQgYWR2aWNlIGZvciByZWdpc3RlcmluZyBD V1QvSldUIGNsYWltcw0KMikgQSBiYXNpYyBzZXQgb2YgYXR0ZXN0YXRpb24tcmVsYXRlZCBjbGFp bXMgdGhpcyBXRyB3aWxsIGRlZmluZQ0KDQpUbyBnbyBvbiBhYm91dCAxKSwgaXQgc2VlbXMgd2Ug YXJlIGV4cGFuZGluZyBDV1QvSldUIGZyb20ganVzdCBiZWluZyBhdXRoIHRva2VucyB0byBhbHNv IGJlaW5nIGF0dGVzdGF0aW9uIHRva2VucyBhbmQgYWxzbyBpZGVudGl0eSBjZXJ0cyAoZHJhZnQt Ymlya2hvbHotY29yZS1jb2lkLTAxKSBhbmQgbWF5YmUgWC41MDkgcmVwbGFjZW1lbnRzLiBUaGlz IHNlZW1zIGxpa2UgbW9zdGx5IGEgZ29vZCBpZGVhIHRvIG1lLiBJdCB3aWxsIGJlIHN1cGVyIGNv b2wgdGhhdCBjb2RlIGNhbiBiZSBzaGFyZWQgYnkgYWxsIG9mIHRoZXNlIGZvciBleGFtcGxlLiBM b3RzIG9mIGNsYWltcyB3aWxsIG92ZXJsYXAgd2hpY2ggaXMgZ29vZCB0b28uDQoNClNvIEkgZG9u 4oCZdCB0aGluayBpdCBtYWtlcyBzZW5zZSB0byB0YWxrIGFib3V0ICJleHBlcnQgcmV2aWV3IG9m IEVBVCBjbGFpbXMiLiBSYXRoZXIgd2Ugc2hvdWxkIHRhbGsgYWJvdXQgImV4cGVydCByZXZpZXcg b2YgQ1dUL0pXVCBjbGFpbXMiIGFuZCBob3cgaXQgc2hvdWxkIGJlIGRpZmZlcmVudCB0aGFuIGl0 IGlzIG5vdy4NCg0KQWxzbywgaWYgeW91IGhhdmVu4oCZdCBsb29rZWQgYXQgdGhlIHJlZ2lzdGVy IEpXVCBjbGFpbXMsIGl04oCZcyB3b3J0aCBjaGVja2luZyBvdXQ6IGh0dHBzOi8vd3d3LmlhbmEu b3JnL2Fzc2lnbm1lbnRzL2p3dC9qd3QueGh0bWwuIEFtIGFsc28gY3VyaW91cyB3aGF0IHBlb3Bs ZSB0aGluayBvZiBicmluZ2luZyB0aGVtIGludG8gQ1dUIGFuZCBlc3BlY2lhbGx5IGhvdyB3ZSBh dm9pZCBjb25mbGljdGluZyBkdXBsaWNhdGlvbiBiZXR3ZWVuIENXVCBhbmQgSldULg0KDQoNClRv IHNheSBtb3JlIGFib3V0IDIpLCBpdCBzZWVtcyB3ZSBzaG91bGQgcmVhbGx5IHdvcmsgdG8gY29t ZSB1cCB3aXRoIGEgbmljZSwgd2VsbC10aG91Z2h0LW91dCwgbWVkaXVtLXNpemVkLCBjb2hlcmVu dCBzZXQgb2YgY2xhaW1zIGZvciBhdHRlc3RhdGlvbiBhbmQgcHV0IHRoZW0gaW4gYW4gUkZDLiBU aGlzIGlzIHJvdWdobHkgd2hhdCB0aGUgRUFUIGRyYWZ0IGlzLg0KDQpMTA0KDQoNCklNUE9SVEFO VCBOT1RJQ0U6IFRoZSBjb250ZW50cyBvZiB0aGlzIGVtYWlsIGFuZCBhbnkgYXR0YWNobWVudHMg YXJlIGNvbmZpZGVudGlhbCBhbmQgbWF5IGFsc28gYmUgcHJpdmlsZWdlZC4gSWYgeW91IGFyZSBu b3QgdGhlIGludGVuZGVkIHJlY2lwaWVudCwgcGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyIGltbWVk aWF0ZWx5IGFuZCBkbyBub3QgZGlzY2xvc2UgdGhlIGNvbnRlbnRzIHRvIGFueSBvdGhlciBwZXJz b24sIHVzZSBpdCBmb3IgYW55IHB1cnBvc2UsIG9yIHN0b3JlIG9yIGNvcHkgdGhlIGluZm9ybWF0 aW9uIGluIGFueSBtZWRpdW0uIFRoYW5rIHlvdS4NCg== --_000_HE1PR0801MB16436E72BBD6D691A84BAE2EEF140HE1PR0801MB1643_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6ZHQ9InV1aWQ6QzJGNDEwMTAtNjVC My0xMWQxLUEyOUYtMDBBQTAwQzE0ODgyIiB4bWxuczptPSJodHRwOi8vc2NoZW1hcy5taWNyb3Nv ZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy9UUi9S RUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVpdj0iQ29udGVudC1UeXBlIiBjb250 ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1ldGEgbmFtZT0iR2VuZXJhdG9yIiBj b250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQgbWVkaXVtKSI+DQo8c3R5bGU+PCEt LQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpXaW5n ZGluZ3M7DQoJcGFub3NlLTE6NSAwIDAgMCAwIDAgMCAwIDAgMDt9DQpAZm9udC1mYWNlDQoJe2Zv bnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0xOjIgNCA1IDMgNSA0IDYgMyAyIDQ7 fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpEZW5nWGlhbjsNCglwYW5vc2UtMToyIDEgNiAw IDMgMSAxIDEgMSAxO30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5v c2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJc QERlbmdYaWFuIjsNCglwYW5vc2UtMToyIDEgNiAwIDMgMSAxIDEgMSAxO30NCi8qIFN0eWxlIERl ZmluaXRpb25zICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJ e21hcmdpbjowY207DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7 DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5 cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRl Y29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dl ZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0KCXRleHQtZGVjb3Jh dGlvbjp1bmRlcmxpbmU7fQ0KcC5Nc29MaXN0UGFyYWdyYXBoLCBsaS5Nc29MaXN0UGFyYWdyYXBo LCBkaXYuTXNvTGlzdFBhcmFncmFwaA0KCXttc28tc3R5bGUtcHJpb3JpdHk6MzQ7DQoJbWFyZ2lu LXRvcDowY207DQoJbWFyZ2luLXJpZ2h0OjBjbTsNCgltYXJnaW4tYm90dG9tOjBjbTsNCgltYXJn aW4tbGVmdDozNi4wcHQ7DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4w cHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KcC5tc29ub3JtYWwwLCBs aS5tc29ub3JtYWwwLCBkaXYubXNvbm9ybWFsMA0KCXttc28tc3R5bGUtbmFtZTptc29ub3JtYWw7 DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBjbTsNCgltc28tbWFy Z2luLWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowY207DQoJZm9udC1zaXplOjExLjBw dDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFuLkVtYWlsU3R5bGUx OA0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJy aSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21z by1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29y ZFNlY3Rpb24xDQoJe3NpemU6NjEyLjBwdCA3OTIuMHB0Ow0KCW1hcmdpbjo3Mi4wcHQgNzIuMHB0 IDcyLjBwdCA3Mi4wcHQ7fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9 DQovKiBMaXN0IERlZmluaXRpb25zICovDQpAbGlzdCBsMA0KCXttc28tbGlzdC1pZDoxMTI5Nzg2 MzUwOw0KCW1zby1saXN0LXR5cGU6aHlicmlkOw0KCW1zby1saXN0LXRlbXBsYXRlLWlkczotNDA2 MTMyODIyIC0xOTIyOTE5MjQwIDI2ODQzNTQ1OSAyNjg0MzU0NjEgMjY4NDM1NDU3IDI2ODQzNTQ1 OSAyNjg0MzU0NjEgMjY4NDM1NDU3IDI2ODQzNTQ1OSAyNjg0MzU0NjE7fQ0KQGxpc3QgbDA6bGV2 ZWwxDQoJe21zby1sZXZlbC1zdGFydC1hdDowOw0KCW1zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1 bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvg5g7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJ bXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJ Zm9udC1mYW1pbHk6V2luZ2RpbmdzOw0KCW1zby1mYXJlYXN0LWZvbnQtZmFtaWx5OkRlbmdYaWFu Ow0KCW1zby1iaWRpLWZvbnQtZmFtaWx5OkFyaWFsO30NCkBsaXN0IGwwOmxldmVsMg0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2 ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4 dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGww OmxldmVsMw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRl eHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5n czt9DQpAbGlzdCBsMDpsZXZlbDQNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0K CW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZh bWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0 OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0K CWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWw2DQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVs LXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwwOmxldmVs Nw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3 Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlz dCBsMDpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZl bC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1w b3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJp ZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVs bGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglm b250LWZhbWlseTpXaW5nZGluZ3M7fQ0Kb2wNCgl7bWFyZ2luLWJvdHRvbTowY207fQ0KdWwNCgl7 bWFyZ2luLWJvdHRvbTowY207fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4N CjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48 IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0 PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5 b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGluaz0iYmx1ZSIgdmxpbms9 InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gbGFuZz0iRU4tR0IiPiZndDsgPC9zcGFuPkFsc28sIGlmIHlvdSBoYXZlbuKAmXQg bG9va2VkIGF0IHRoZSByZWdpc3RlciBKV1QgY2xhaW1zLCBpdOKAmXMgd29ydGggY2hlY2tpbmcg b3V0OiZuYnNwOzxhIGhyZWY9Imh0dHBzOi8vd3d3LmlhbmEub3JnL2Fzc2lnbm1lbnRzL2p3dC9q d3QueGh0bWwiPmh0dHBzOi8vd3d3LmlhbmEub3JnL2Fzc2lnbm1lbnRzL2p3dC9qd3QueGh0bWw8 L2E+LiBBbSBhbHNvIGN1cmlvdXMgd2hhdA0KIHBlb3BsZSB0aGluayBvZiBicmluZ2luZyB0aGVt IGludG8gQ1dUIGFuZCBlc3BlY2lhbGx5IGhvdyB3ZSBhdm9pZCBjb25mbGljdGluZyBkdXBsaWNh dGlvbiBiZXR3ZWVuIENXVCBhbmQgSldULjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBs YW5nPSJFTi1HQiI+V2hlbiBJIGxvb2sgYXQgdGhlIEpXVCByZWdpc3RyeSwgaXQgbG9va3MgbGlr ZSBhbiBvcHBvcnR1bml0eSBsb3N0LiBJdOKAmXMgYSBtaXggb2YgY2xhaW1zIHRoYXQgY291bGQg YmUgZ2VuZXJhbGlzZWQgZm9yIHJldXNlLCBlLmcuIHRoZXJlIGFyZSBtdWx0aXBsZSBjbGFpbXMg aWF0IC8gYXV0aF90aW1lIGFuZCBtYXliZSBhbHNvIHRvZSBmb3IgdGltZS1zb21ldGhpbmctaGFw cGVuZWQsDQogd2hpbGUgb3RoZXIgY2xhaW1zIHdpbGwgYWx3YXlzIGJlIHNwZWNpZmljIHRvIGEg c2luZ2xlIHVzZSBjYXNlLiBPbmUgb2YgdGhlIGdyZWF0IGFwcGVhbHMgb2YgRUFUIGlzIHRoYXQg aXQgb2ZmZXJzIGEgc3RhbmRhcmQgc2V0IG9mIGNsYWltcyB3aGlsZSBldmVyeXRoaW5nIGVsc2Ug aXMgY3VzdG9tIHRvIGEgdXNlIGNhc2UuIEFzIHNldmVyYWwgZGlzY3Vzc2lvbnMgaGF2ZSBpbmRp Y2F0ZWQsIHRoZXJlIGFyZSBzZXZlcmFsIGluZm9ybWF0aW9uDQogc2V0cyB0aGF0IGxlbmQgdGhl bXNlbHZlcyB0byBuZXcgc3RhbmRhcmQgY2xhaW1zLiBGb3IgZXhhbXBsZSwgYSBjaHVuayBvZiB0 aGUgSldUIE9wZW5JRCBjbGFpbXMgd291bGQgbWFrZSBhIHZlcnkgdXNlZnVsIOKAmFBlcnNvbuKA mSBzdGFuZGFyZCBzZXQuIEkga25vdyBub3QgYWxsIGNhc2VzIGNhbiBiZSBjYXB0dXJlZCBpbiBz dGFuZGFyZCBzZXRzIGJ1dCBub3QgaGF2aW5nIHRoZW0gZW5jb3VyYWdlcyBkdXBsaWNhdGlvbiB3 aXRob3V0IHJldXNlLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIGxhbmc9IkVOLUdCIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+SWYgdGhlIHJlZ2lzdHJ5IGluY2x1ZGVk IHRoZSBpbmZvcm1hdGlvbiBmb3IgYSBzcGVjaWZpYyB1c2UgY2FzZSB0byByZWdpc3RlciBhIGN1 c3RvbSBjbGFpbSBrZXkgcmFuZ2UgYW5kIGEgcmVmZXJlbmNlIC8gYXV0aG9yaXR5IFVSTCB3aGVy ZSB0aG9zZSBkZWZpbml0aW9ucyBjYW4gYmUgdHJhY2tlZCwgdGhhdCBtaWdodCBlbmNvdXJhZ2Ug aW1wbGVtZW50YXRpb25zIHRvIHVzZQ0KIGJvdGggdGhlIHN0YW5kYXJkICZhbXA7IHNwZWNpZmlj IGNsYWltIHNldHMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gbGFuZz0iRU4tR0IiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj5UaGFua3M8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+U2ltb248bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpu b25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBjbSAwY20g MGNtIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIGxhbmc9IkVOLVVTIj5Gcm9tOjwv c3Bhbj48L2I+PHNwYW4gbGFuZz0iRU4tVVMiPiBMYXVyZW5jZSBMdW5kYmxhZGUgJmx0O2xnbEBp c2xhbmQtcmVzb3J0LmNvbSZndDsNCjxicj4NCjxiPlNlbnQ6PC9iPiAwMiBKdW5lIDIwMTkgMTE6 MzM8YnI+DQo8Yj5Ubzo8L2I+IEhlbmsgQmlya2hvbHogJmx0O2hlbmsuYmlya2hvbHpAc2l0LmZy YXVuaG9mZXIuZGUmZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBIYW5uZXMgVHNjaG9mZW5pZyAmbHQ7SGFu bmVzLlRzY2hvZmVuaWdAYXJtLmNvbSZndDs7IEVyaWMgVm9pdCAoZXZvaXQpICZsdDtldm9pdEBj aXNjby5jb20mZ3Q7OyByYXRzQGlldGYub3JnOyBHaXJpZGhhciBNYW5keWFtICZsdDttYW5keWFt QHF0aS5xdWFsY29tbS5jb20mZ3Q7PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbUmF0c10gQ2Fs bCBmb3IgQWRvcHRpb246IEVBVCBkcmFmdDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIHRoaW5rIGl0IG1ha2VzIHNlbnNlIHRvIHNlcGFyYXRl IGludG8gdHdvOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJt YXJnaW4tbGVmdDozMC4wcHQ7bWFyZ2luLXJpZ2h0OjBjbSI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+MSkgTmV3IHJ1bGVzIGFuZCBhZHZpY2UgZm9yIHJlZ2lzdGVyaW5nIDxpPkNXVC9K V1QgY2xhaW1zPC9pPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+MikgQSBiYXNpYyBzZXQgb2YgYXR0ZXN0YXRpb24tcmVsYXRlZCBjbGFpbXMgdGhp cyBXRyB3aWxsIGRlZmluZTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UbyBnbyBvbiBhYm91dCAxKSwgaXQgc2VlbXMg d2UgYXJlIGV4cGFuZGluZyBDV1QvSldUIGZyb20ganVzdCBiZWluZyBhdXRoIHRva2VucyB0byBh bHNvIGJlaW5nIGF0dGVzdGF0aW9uIHRva2VucyBhbmQgYWxzbyBpZGVudGl0eSBjZXJ0cyAoZHJh ZnQtYmlya2hvbHotY29yZS1jb2lkLTAxKSBhbmQgbWF5YmUgWC41MDkgcmVwbGFjZW1lbnRzLiBU aGlzIHNlZW1zIGxpa2UgbW9zdGx5IGEgZ29vZCBpZGVhIHRvDQogbWUuIEl0IHdpbGwgYmUgc3Vw ZXIgY29vbCB0aGF0IGNvZGUgY2FuIGJlIHNoYXJlZCBieSBhbGwgb2YgdGhlc2UgZm9yIGV4YW1w bGUuIExvdHMgb2YgY2xhaW1zIHdpbGwgb3ZlcmxhcCB3aGljaCBpcyBnb29kIHRvby48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U28gSSBkb27i gJl0IHRoaW5rIGl0IG1ha2VzIHNlbnNlIHRvIHRhbGsgYWJvdXQgJnF1b3Q7ZXhwZXJ0IHJldmll dyBvZiBFQVQgY2xhaW1zJnF1b3Q7LiBSYXRoZXIgd2Ugc2hvdWxkIHRhbGsgYWJvdXQgJnF1b3Q7 ZXhwZXJ0IHJldmlldyBvZiBDV1QvSldUIGNsYWltcyZxdW90OyBhbmQgaG93IGl0IHNob3VsZCBi ZSBkaWZmZXJlbnQgdGhhbiBpdCBpcyBub3cuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFsc28sIGlmIHlvdSBoYXZlbuKAmXQgbG9va2VkIGF0 IHRoZSByZWdpc3RlciBKV1QgY2xhaW1zLCBpdOKAmXMgd29ydGggY2hlY2tpbmcgb3V0OiZuYnNw OzxhIGhyZWY9Imh0dHBzOi8vd3d3LmlhbmEub3JnL2Fzc2lnbm1lbnRzL2p3dC9qd3QueGh0bWwi Pmh0dHBzOi8vd3d3LmlhbmEub3JnL2Fzc2lnbm1lbnRzL2p3dC9qd3QueGh0bWw8L2E+LiBBbSBh bHNvIGN1cmlvdXMgd2hhdCBwZW9wbGUgdGhpbmsgb2YgYnJpbmdpbmcNCiB0aGVtIGludG8gQ1dU IGFuZCBlc3BlY2lhbGx5IGhvdyB3ZSBhdm9pZCBjb25mbGljdGluZyBkdXBsaWNhdGlvbiBiZXR3 ZWVuIENXVCBhbmQgSldULjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPlRvIHNheSBtb3JlIGFib3V0IDIpLCBpdCBzZWVtcyB3ZSBzaG91bGQg cmVhbGx5IHdvcmsgdG8gY29tZSB1cCB3aXRoIGEgbmljZSwgd2VsbC10aG91Z2h0LW91dCwgbWVk aXVtLXNpemVkLCBjb2hlcmVudCBzZXQgb2YgY2xhaW1zIGZvciBhdHRlc3RhdGlvbiBhbmQgcHV0 IHRoZW0gaW4gYW4gUkZDLiBUaGlzIGlzIHJvdWdobHkgd2hhdCB0aGUgRUFUIGRyYWZ0IGlzLjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5MTDxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQpJTVBPUlRBTlQgTk9USUNFOiBUaGUg Y29udGVudHMgb2YgdGhpcyBlbWFpbCBhbmQgYW55IGF0dGFjaG1lbnRzIGFyZSBjb25maWRlbnRp YWwgYW5kIG1heSBhbHNvIGJlIHByaXZpbGVnZWQuIElmIHlvdSBhcmUgbm90IHRoZSBpbnRlbmRl ZCByZWNpcGllbnQsIHBsZWFzZSBub3RpZnkgdGhlIHNlbmRlciBpbW1lZGlhdGVseSBhbmQgZG8g bm90IGRpc2Nsb3NlIHRoZSBjb250ZW50cyB0byBhbnkgb3RoZXIgcGVyc29uLCB1c2UgaXQgZm9y IGFueSBwdXJwb3NlLA0KIG9yIHN0b3JlIG9yIGNvcHkgdGhlIGluZm9ybWF0aW9uIGluIGFueSBt ZWRpdW0uIFRoYW5rIHlvdS4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_HE1PR0801MB16436E72BBD6D691A84BAE2EEF140HE1PR0801MB1643_-- From nobody Tue Jun 4 13:00:00 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EFEC11205D9 for ; Tue, 4 Jun 2019 12:59:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gCVMF6_Qpkou for ; Tue, 4 Jun 2019 12:59:56 -0700 (PDT) Received: from p3plsmtpa11-05.prod.phx3.secureserver.net (p3plsmtpa11-05.prod.phx3.secureserver.net [68.178.252.106]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5B8981205F3 for ; Tue, 4 Jun 2019 12:59:56 -0700 (PDT) Received: from [192.168.1.82] ([76.192.164.238]) by :SMTPAUTH: with ESMTPA id YFb8habtf7f7HYFb8hzqTN; Tue, 04 Jun 2019 12:59:55 -0700 From: Laurence Lundblade Content-Type: multipart/alternative; boundary="Apple-Mail=_7D22F249-2DF3-4BE3-8D95-5D01FB0425CF" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Message-Id: Date: Tue, 4 Jun 2019 12:59:54 -0700 To: rats@ietf.org X-Mailer: Apple Mail (2.3445.9.1) X-CMAE-Envelope: MS4wfGUEHRetEFM62QSvknBFYMa0zMCyyIFvBDcD51/Oth/mxCdKmXgUWFVt772RL57zVcy/uES8+6DizXYm6XJFcY1qkLVsyQPlcxRt3B6z0Ifoh8sudoCT H77axVkaLFecNWhkV5yqrOddTOWkE9XCRMRDLKL5ti3DN/AtgQ8F1MKd Archived-At: Subject: [Rats] Vetting claim definitions X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Jun 2019 19:59:59 -0000 --Apple-Mail=_7D22F249-2DF3-4BE3-8D95-5D01FB0425CF Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 RFC 8126 gives guidelines for = writing IANA considerations and is useful background here. =E2=80=94 Today CWT allocates about 512 slots for claims that are = standards. These require a standards track RFC like the EAT draft might = become. There can be other standards RFCs for attestation claims. They = don=E2=80=99t all have to be defined in the one and only standard we are = working on now. Seems that standardization is the path to really high = quality claims that a lot of us want.=20 =E2=80=94 Today CWT allocates about 130,000 slots for = specification-required. To get one of these slots also requires expert = review and to publish a hopefully formal specification. =E2=80=94 Today CWT allocates millions of slots for expert review. No = specification is required, but some information should be provided.=20 JWT doesn=E2=80=99t seem to have this, which is maybe why it is messier. = It kind of seems bad and wrong that it doesn=E2=80=99t to me. COSE is like CWT for algorithms and headers and such.=20 Anyone know if there are any YANG-based protocols that have IANA = registries? Where are all the YANG data formats defined and registered = that we are interested in making into attestation claims? Seems to me the three tiers that CWT (and COSE) define are at least a = very good start for our purposes. All the better claims are ones we run = through a standards process.=20 When we make them standard we=E2=80=99ll deal with how they line up with = existing similar definitions in YANG, ASN.1, XML, JSON and such. Maybe = the standard just says =E2=80=9Cuse this YANG-defined format=E2=80=9D in = some particular way. If we want something that is not as time-consuming and difficult as = creating a standard, RFC 8126 defines a few more options between = Standards Action and Specification Required.=20 At any rate, we ought to be more familiar with 8126 and bring it in here = more. LL --Apple-Mail=_7D22F249-2DF3-4BE3-8D95-5D01FB0425CF Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 RFC = 8126 gives guidelines for writing IANA considerations and is = useful background here.

=E2=80=94 Today CWT allocates about 512 slots for claims that = are standards. These require a standards track RFC = like the EAT draft might become. There can be other standards RFCs for = attestation claims. They don=E2=80=99t all have to be defined in the one = and only standard we are working on now. Seems that standardization is = the path to really high quality claims that a lot of us = want. 

=E2=80= =94 Today CWT allocates about 130,000 slots for = specification-required. To get one of these slots also requires = expert review and to publish a hopefully formal specification.

=E2=80=94 Today CWT = allocates millions of slots for expert review. No = specification is required, but some information should be = provided. 

JWT doesn=E2=80=99t seem to have this, which is maybe why it = is messier. It kind of seems bad and wrong that it doesn=E2=80=99t to = me.

COSE is = like CWT for algorithms and headers and such. 

Anyone know if there are = any YANG-based protocols that have IANA registries? Where are all the = YANG data formats defined and registered that we are interested in = making into attestation claims?



Seems to me the three tiers that CWT = (and COSE) define are at least a very good start for our purposes. All = the better claims are ones we run through a standards = process. 

When we make them standard we=E2=80=99ll deal with how they = line up with existing similar definitions in YANG, ASN.1, XML, JSON and = such. Maybe the standard just says =E2=80=9Cuse this YANG-defined = format=E2=80=9D in some particular way.

If we want something that is not as = time-consuming and difficult as creating a standard, RFC 8126 defines a = few more options between Standards Action and Specification = Required. 

At any rate, we ought to be more familiar with 8126 and bring = it in here more.

LL





= --Apple-Mail=_7D22F249-2DF3-4BE3-8D95-5D01FB0425CF-- From nobody Tue Jun 4 14:55:32 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 705CC1200F8 for ; Tue, 4 Jun 2019 14:55:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.501 X-Spam-Level: X-Spam-Status: No, score=-14.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=MnVrKNUB; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=rasTUpyp Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VhbpiWmedHey for ; Tue, 4 Jun 2019 14:55:28 -0700 (PDT) Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D307F1200A4 for ; Tue, 4 Jun 2019 14:55:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=4524; q=dns/txt; s=iport; t=1559685327; x=1560894927; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=muWzqcvHUu6Kl6CKnmZvYg5a4P5qH0QKTe86lkvhjeg=; b=MnVrKNUBFn6Nql+Z9IeXJouJORK3YtywXOwclTQ3Z0P4aFxfmRwK9N8Q QtGJiONZILCDNaER8pcUlxFwG6k+8pRYBn7og19s6oB8BO65xStzlwY5P t5QQpAdiZaDnJ97GKN47l37qyOKVloCxKXWUI5I3UcVpQ1HgAdKeu9qv/ o=; IronPort-PHdr: =?us-ascii?q?9a23=3AOEjKgh+g/Azw9f9uRHGN82YQeigqvan1NQcJ65?= =?us-ascii?q?0hzqhDabmn44+/bB7E/fs4iljPUM2b8P9Ch+fM+4HYEW0bqdfk0jgZdYBUER?= =?us-ascii?q?oMiMEYhQslVcObDkznBPXrdCc9Ws9FUQwt8g=3D=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BIAADG5/Zc/5pdJa1mHAEBAQQBAQc?= =?us-ascii?q?EAQGBUQcBAQsBgT1QA2pVIAQLKAqECoNHA4RSiiGCV5cvgS6BJANUCQEBAQw?= =?us-ascii?q?BASUIAgEBhEACF4I7IzQJDgEDAQEEAQECAQRtHAyFSgEBAQECARIREQwBASk?= =?us-ascii?q?OAQQLAgEIDgcFAiYCAgIwFRACBA4FCBqDAYFqAw4PAQIMnAgCgTiIX3GBMYJ?= =?us-ascii?q?5AQEFgTYDCwJAAYJ8GIIPAwaBDCgBi1oXgUA/gRFGgkw+gmEBAQIBAYFfgwg?= =?us-ascii?q?ygiaLYiKCGo0djU4JAoIOhkGNEJZ3lBiPFgIEAgQFAg4BAQWBTziBWHAVgye?= =?us-ascii?q?CDwsYg02FFIU/cgGBKI8GAYEgAQE?= X-IronPort-AV: E=Sophos;i="5.60,550,1549929600"; d="scan'208";a="569799289" Received: from rcdn-core-3.cisco.com ([173.37.93.154]) by rcdn-iport-6.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 04 Jun 2019 21:55:26 +0000 Received: from XCH-ALN-016.cisco.com (xch-aln-016.cisco.com [173.36.7.26]) by rcdn-core-3.cisco.com (8.15.2/8.15.2) with ESMTPS id x54LtQKA001299 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 4 Jun 2019 21:55:26 GMT Received: from xhs-aln-001.cisco.com (173.37.135.118) by XCH-ALN-016.cisco.com (173.36.7.26) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 4 Jun 2019 16:55:25 -0500 Received: from xhs-rtp-001.cisco.com (64.101.210.228) by xhs-aln-001.cisco.com (173.37.135.118) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 4 Jun 2019 16:55:25 -0500 Received: from NAM03-BY2-obe.outbound.protection.outlook.com (64.101.32.56) by xhs-rtp-001.cisco.com (64.101.210.228) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Tue, 4 Jun 2019 17:55:25 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=muWzqcvHUu6Kl6CKnmZvYg5a4P5qH0QKTe86lkvhjeg=; b=rasTUpyp8AEfT0IN7u5GSQrAzl7cWS/QK4cvGWoW79DnA524xrh8Byh/FPsR9kQauAfzDk7PPl/pGCkkIj4qHHOJQCJwW0nZAwGEbD5htlDCAc30/RYgZhI2nzwZ5Sv28KfZh899AO1ad/TqqZ6aXjfWUdL40/2qKQ3hXyBUxOc= Received: from DM6PR11MB4089.namprd11.prod.outlook.com (20.176.126.30) by DM6PR11MB3818.namprd11.prod.outlook.com (20.179.17.26) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1943.22; Tue, 4 Jun 2019 21:55:23 +0000 Received: from DM6PR11MB4089.namprd11.prod.outlook.com ([fe80::d014:d7a3:270:e5a9]) by DM6PR11MB4089.namprd11.prod.outlook.com ([fe80::d014:d7a3:270:e5a9%3]) with mapi id 15.20.1943.018; Tue, 4 Jun 2019 21:55:23 +0000 From: "Eric Voit (evoit)" To: Laurence Lundblade CC: "rats@ietf.org" Thread-Topic: [Rats] Vetting claim definitions Thread-Index: AQHVGxAnNP3gSrcbuEuedIL4RWxi86aL+EkwgAABTGA= Date: Tue, 4 Jun 2019 21:55:22 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=evoit@cisco.com; x-originating-ip: [173.38.117.81] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 2881b5a8-c6fc-4c55-5b30-08d6e9375834 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:DM6PR11MB3818; x-ms-traffictypediagnostic: DM6PR11MB3818: x-ms-exchange-purlcount: 8 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 0058ABBBC7 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(39860400002)(346002)(366004)(136003)(376002)(189003)(199004)(124014002)(5660300002)(6246003)(81156014)(8936002)(6436002)(2906002)(81166006)(256004)(52536014)(74316002)(229853002)(8676002)(102836004)(71190400001)(7736002)(53936002)(71200400001)(86362001)(316002)(9686003)(2940100002)(6306002)(99286004)(11346002)(486006)(6506007)(26005)(66066001)(68736007)(966005)(305945005)(478600001)(476003)(14454004)(66946007)(66556008)(7696005)(64756008)(25786009)(76176011)(55016002)(6116002)(66446008)(76116006)(3846002)(73956011)(66476007)(446003)(6916009)(186003)(33656002)(4326008); DIR:OUT; SFP:1101; SCL:1; SRVR:DM6PR11MB3818; H:DM6PR11MB4089.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 7JZJIz9VXECAkGBg8wO/CjsLf0GjC6DX6LN1ZC/MTcpeGxpsPHU4wCaML9tHosAA0mv/XnLeM70HFUJCDU3lvBrfzHqWcu7QlHacKYfrwkrghX1H/wNWZuZ1EEOK5CifNcuhN0Icj84V3x7sw98qtCdkKkYT7vNBZ0YN8zW1DI80ecXjo8s6AO+XcR9oc04UMN7p0gYs4HQKj3nTXVJY+bMeRsxhoR3AGr+LnEAzVOA6g0URCB/CBMlcqIJ+PsxPQp+N16w8A1vaI8Prjnhq7LTWRbS9k3jbD/CTOgpLmIRrmNktlQ7tBc2f2ijW14ZTb2daSve85AoL8ga6SeVhJIvIBOttPBZE30Xl27FpC9tjogl2O+b26NCkUMXzZT2FbylG+z0iWPSGAkrCAq9Ot/BcbrE6Vi/GoSyV6XuExVU= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 2881b5a8-c6fc-4c55-5b30-08d6e9375834 X-MS-Exchange-CrossTenant-originalarrivaltime: 04 Jun 2019 21:55:23.0044 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: evoit@cisco.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR11MB3818 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.36.7.26, xch-aln-016.cisco.com X-Outbound-Node: rcdn-core-3.cisco.com Archived-At: Subject: Re: [Rats] Vetting claim definitions X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Jun 2019 21:55:31 -0000 PiBGcm9tOiBMYXVyZW5jZSBMdW5kYmxhZGUsIEp1bmUgNCwgMjAxOSA0OjAwIFBNDQo+IA0KPiBo dHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjODEyNsKgZ2l2ZXMgZ3VpZGVsaW5lcyBmb3Ig d3JpdGluZyBJQU5BDQo+IGNvbnNpZGVyYXRpb25zIGFuZCBpcyB1c2VmdWwgYmFja2dyb3VuZCBo ZXJlLg0KPiANCj4g4oCUIFRvZGF5IENXVCBhbGxvY2F0ZXMgYWJvdXQgNTEyIHNsb3RzIGZvciBj bGFpbXMgdGhhdCBhcmUgc3RhbmRhcmRzLiBUaGVzZQ0KPiByZXF1aXJlIGEgc3RhbmRhcmRzIHRy YWNrIFJGQyBsaWtlIHRoZSBFQVQgZHJhZnQgbWlnaHQgYmVjb21lLiBUaGVyZSBjYW4gYmUNCj4g b3RoZXIgc3RhbmRhcmRzIFJGQ3MgZm9yIGF0dGVzdGF0aW9uIGNsYWltcy4gVGhleSBkb27igJl0 IGFsbCBoYXZlIHRvIGJlIGRlZmluZWQgaW4NCj4gdGhlIG9uZSBhbmQgb25seSBzdGFuZGFyZCB3 ZSBhcmUgd29ya2luZyBvbiBub3cuIFNlZW1zIHRoYXQgc3RhbmRhcmRpemF0aW9uIGlzDQo+IHRo ZSBwYXRoIHRvIHJlYWxseSBoaWdoIHF1YWxpdHkgY2xhaW1zIHRoYXQgYSBsb3Qgb2YgdXMgd2Fu dC4NCg0KWWVzLCB0aGlzIGlzIHdoYXQgd2Ugc2hvdWxkIGNvbmNlbnRyYXRlIG9uIGZpcnN0LiAg IEkuZS4sIFNlY3Rpb24gNC45IG9yIFJGQyA4MTI2Lg0KDQo+IOKAlCBUb2RheSBDV1QgYWxsb2Nh dGVzIGFib3V0IDEzMCwwMDAgc2xvdHMgZm9yIHNwZWNpZmljYXRpb24tcmVxdWlyZWQuwqBUbyBn ZXQNCj4gb25lIG9mIHRoZXNlIHNsb3RzIGFsc28gcmVxdWlyZXMgZXhwZXJ0IHJldmlldyBhbmQg dG8gcHVibGlzaCBhIGhvcGVmdWxseSBmb3JtYWwNCj4gc3BlY2lmaWNhdGlvbi4NCj4gDQo+IOKA lCBUb2RheSBDV1QgYWxsb2NhdGVzIG1pbGxpb25zIG9mIHNsb3RzIGZvciBleHBlcnQgcmV2aWV3 LiBObyBzcGVjaWZpY2F0aW9uIGlzDQo+IHJlcXVpcmVkLCBidXQgc29tZSBpbmZvcm1hdGlvbiBz aG91bGQgYmUgcHJvdmlkZWQuDQo+IA0KPiBKV1QgZG9lc27igJl0IHNlZW0gdG8gaGF2ZSB0aGlz LCB3aGljaCBpcyBtYXliZSB3aHkgaXQgaXMgbWVzc2llci4gSXQga2luZCBvZg0KPiBzZWVtcyBi YWQgYW5kIHdyb25nIHRoYXQgaXQgZG9lc27igJl0IHRvIG1lLg0KPiANCj4gQ09TRSBpcyBsaWtl IENXVCBmb3IgYWxnb3JpdGhtcyBhbmQgaGVhZGVycyBhbmQgc3VjaC4NCj4gDQo+IEFueW9uZSBr bm93IGlmIHRoZXJlIGFyZSBhbnkgWUFORy1iYXNlZCBwcm90b2NvbHMgdGhhdCBoYXZlIElBTkEg cmVnaXN0cmllcz8NCj4gV2hlcmUgYXJlIGFsbCB0aGUgWUFORyBkYXRhIGZvcm1hdHMgZGVmaW5l ZCBhbmQgcmVnaXN0ZXJlZCB0aGF0IHdlIGFyZQ0KPiBpbnRlcmVzdGVkIGluIG1ha2luZyBpbnRv IGF0dGVzdGF0aW9uIGNsYWltcz8NCg0KVGhlcmUgaXMgYW4gSUFOQSByZWdpc3RyeSBmb3IgWUFO RyBtb2RlbHMuDQpodHRwczovL3d3dy5pYW5hLm9yZy9hc3NpZ25tZW50cy95YW5nLXBhcmFtZXRl cnMveWFuZy1wYXJhbWV0ZXJzLnhodG1sDQoNCkluIHRoZSBwYXN0IEkgaGF2ZSBsb29rZWQgdGhy b3VnaCBhYm91dCBhIGRvemVuIG9mIHRoZSBodW5kcmVkIG9yIHNvIG1vZGVscyBoZXJlLiAgIEkg c3VzcGVjdCwgc29tZSBnb29kIHN0YXJ0aW5nIHBsYWNlcyBmb3IgcGVvcGxlIHRvIGxvb2sgZm9y IG9iamVjdHMvZGVmaW5pdGlvbnMgd2hpY2ggY291bGQgYmUgcmV1c2VkIChvciBwZXJoYXBzIG1h cHBlZCkgbWlnaHQgYmUgZnJvbToNCmh0dHBzOi8vd3d3LmlhbmEub3JnL2Fzc2lnbm1lbnRzL3lh bmctcGFyYW1ldGVycy9pZXRmLWhhcmR3YXJlQDIwMTgtMDMtMTMueWFuZw0KaHR0cHM6Ly93d3cu aWFuYS5vcmcvYXNzaWdubWVudHMveWFuZy1wYXJhbWV0ZXJzL2lldGYta2V5LWNoYWluQDIwMTct MDYtMTUueWFuZyANCmh0dHBzOi8vd3d3LmlhbmEub3JnL2Fzc2lnbm1lbnRzL3lhbmctcGFyYW1l dGVycy9pYW5hLWhhcmR3YXJlQDIwMTgtMDMtMTMueWFuZw0KaHR0cHM6Ly93d3cuaWFuYS5vcmcv YXNzaWdubWVudHMveWFuZy1wYXJhbWV0ZXJzL2lhbmEtY3J5cHQtaGFzaEAyMDE0LTA4LTA2Lnlh bmcNCk5vdGU6IHRoZSBsb2NhdGlvbiBtb2RlbCByZWZlcmVuY2VkIGluIGVhcmxpZXIgdGhyZWFk cyBpcyBvbmx5IGEgV0cgZHJhZnQsIHdoaWNoIGl0IGlzIHdoeSBpdCBpcyBub3QgaW4gdGhlIHJl Z2lzdHJ5IHlldC4uLg0KaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtaWV0 Zi1uZXRtb2QtZ2VvLWxvY2F0aW9uLyANCg0KQXMgYW4gRllJOiBiZXlvbmQgSUFOQSwgdGhlcmUg d2FzIGEgc2VhcmNoIHRvb2wgdG8gZmluZCBzcGVjaWZpYyBvYmplY3RzLCBidXQgSSBhbSBub3Qg c3VyZSBpdCBpcyBiZWluZyBtYWludGFpbmVkDQpodHRwczovL3lhbmdjYXRhbG9nLm9yZy95YW5n LXNlYXJjaC8gDQpBbmQgdGhlcmUgYXJlIGxhcmdlciBZQU5HIHJlcG9zaXRvcmllcyBpbiBvdGhl ciBwbGFjZXMgKGUuZy4sIElFRUUsIE9wZW5Db25maWcsIE1FRikgLiAgQnV0IGFzIHRoZXkgYXJl IG5vdCBJRVRGLCBsaWtlbHkgd2Ugc2hvdWxkbid0IHdvcnJ5IGFib3V0IHRoZW0uDQoNCj4gU2Vl bXMgdG8gbWUgdGhlIHRocmVlIHRpZXJzIHRoYXQgQ1dUIChhbmQgQ09TRSkgZGVmaW5lIGFyZSBh dCBsZWFzdCBhIHZlcnkgZ29vZA0KPiBzdGFydCBmb3Igb3VyIHB1cnBvc2VzLiBBbGwgdGhlIGJl dHRlciBjbGFpbXMgYXJlIG9uZXMgd2UgcnVuIHRocm91Z2ggYSBzdGFuZGFyZHMNCj4gcHJvY2Vz cy4NCj4NCj4gV2hlbiB3ZSBtYWtlIHRoZW0gc3RhbmRhcmQgd2XigJlsbCBkZWFsIHdpdGggaG93 IHRoZXkgbGluZSB1cCB3aXRoIGV4aXN0aW5nDQo+IHNpbWlsYXIgZGVmaW5pdGlvbnMgaW4gWUFO RywgQVNOLjEsIFhNTCwgSlNPTiBhbmQgc3VjaC4gTWF5YmUgdGhlIHN0YW5kYXJkIGp1c3QNCj4g c2F5cyDigJx1c2UgdGhpcyBZQU5HLWRlZmluZWQgZm9ybWF04oCdIGluIHNvbWUgcGFydGljdWxh ciB3YXkuDQoNClRoaXMgbWFrZXMgc2Vuc2UuDQoNCkVyaWMNCiANCj4gSWYgd2Ugd2FudCBzb21l dGhpbmcgdGhhdCBpcyBub3QgYXMgdGltZS1jb25zdW1pbmcgYW5kIGRpZmZpY3VsdCBhcyBjcmVh dGluZyBhDQo+IHN0YW5kYXJkLCBSRkMgODEyNiBkZWZpbmVzIGEgZmV3IG1vcmUgb3B0aW9ucyBi ZXR3ZWVuIFN0YW5kYXJkcyBBY3Rpb24gYW5kDQo+IFNwZWNpZmljYXRpb24gUmVxdWlyZWQuDQo+ IA0KPiBBdCBhbnkgcmF0ZSwgd2Ugb3VnaHQgdG8gYmUgbW9yZSBmYW1pbGlhciB3aXRoIDgxMjYg YW5kIGJyaW5nIGl0IGluIGhlcmUgbW9yZS4NCj4gDQo+IExMDQo+IA0KPiANCj4gDQo+IA0KDQo= From nobody Wed Jun 5 06:05:32 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AFF0D12004A for ; Wed, 5 Jun 2019 06:05:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.44 X-Spam-Level: X-Spam-Status: No, score=-0.44 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RDNS_NONE=0.793, SPF_HELO_NONE=0.001, SPF_SOFTFAIL=0.665, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id q6RZqZ-d3-OP for ; Wed, 5 Jun 2019 06:05:29 -0700 (PDT) Received: from tuna.sandelman.ca (unknown [209.87.249.16]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EEC4C120020 for ; Wed, 5 Jun 2019 06:05:28 -0700 (PDT) Received: from sandelman.ca (unknown [IPv6:2607:f0b0:f:2:56b2:3ff:fe0b:d84]) by tuna.sandelman.ca (Postfix) with ESMTP id 6867B380BE; Wed, 5 Jun 2019 09:04:13 -0400 (EDT) Received: by sandelman.ca (Postfix, from userid 179) id 01A96113E; Wed, 5 Jun 2019 09:05:26 -0400 (EDT) Received: from sandelman.ca (localhost [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id F203BDC4; Wed, 5 Jun 2019 09:05:26 -0400 (EDT) From: Michael Richardson To: Laurence Lundblade cc: rats@ietf.org In-Reply-To: References: X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Rats] Vetting claim definitions X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Jun 2019 13:05:31 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Laurence Lundblade wrote: > =E2=80=94 Today CWT allocates millions of slots for expert review. No > specification is required, but some information should be provided. > JWT doesn=E2=80=99t seem to have this, which is maybe why it is messi= er. It > kind of seems bad and wrong that it doesn=E2=80=99t to me. JWT doesn't have this because the claims are "unlimited" length strings, so one can always make up a unique string in lieu of registration. org.island-resort.lgl.whateverstringyouwant is probably completely yours :-) Of course, if you want to interoperate you need to agree about how, so there are some advantages of a forcing function that demands you write things down first :-) > COSE is like CWT for algorithms and headers and such. > Anyone know if there are any YANG-based protocols that have IANA > registries? Where are all the YANG data formats defined and registered > that we are interested in making into attestation claims? A number of YANG modules have imported IANA registries with mixed results, and then wondered if they can be automatically extended when IANA extends things. Up until recently, YANG has been largely used to describe the management of existing (non-YANG) protocols, so I think that the issue you bring up is something we have yet to properly tackle. > Seems to me the three tiers that CWT (and COSE) define are at least a > very good start for our purposes. All the better claims are ones we r= un > through a standards process. I agree. > When we make them standard we=E2=80=99ll deal with how they line up w= ith > existing similar definitions in YANG, ASN.1, XML, JSON and such. Maybe > the standard just says =E2=80=9Cuse this YANG-defined format=E2=80=9D= in some > particular way. YANG is to ASN.1 what CBOR is to DER. So, it's important to remember that YANG doesn't define a format, but rather an information model. > At any rate, we ought to be more familiar with 8126 and bring it in > here more. It's definitely worth knowing well :-) I seem to think that there was a Sunday EDU session about IANA Considerations, but I can't trivially find a video. I did find: https://www.youtube.com/watch?v=3DD__mAX-2sXo https://youtu.be/Lk5j25nmZKY?t=3D223 but it isn't about IANA Considerations. =2D- Michael Richardson , Sandelman Software Works -=3D IPv6 IoT consulting =3D- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAlz3vhYACgkQgItw+93Q 3WVSkQgAlVo247HYdiO0VOzvuTvWUwJCf5adC5I0MOkesmTpY+L9a3FdRIeKHIK/ rUR7e/8KxrL7lvEUaOcrT9Z+K0GVeEYzSSXHSpfjfEpb6xWwsHcDKTS7NXKNwQff 32OBjbyTMD5ytA6KQP2l+SL4TXt3A+SjfBfTDTwjKQZ+7VJ5GfWTp2PdHXliVWL2 V/Nxz3jSE9qOY5ya7CVeGu7QNWxmTmWleWDOM4bz2OIqsIppC8RJoY0bgEfNxY0w LIB0EBJtEdhtsp3O1ergOwa3SOwmdDR/3xzOTutvXcLhS7WchaYhRKGGoy2CmNOz cwW0K/RS9eP9/Rc0n3976f5iBH5rYQ== =uIew -----END PGP SIGNATURE----- --=-=-=-- From nobody Wed Jun 5 08:46:27 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AB508120169 for ; Wed, 5 Jun 2019 08:46:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0GXO2v9OzIae for ; Wed, 5 Jun 2019 08:46:23 -0700 (PDT) Received: from p3plsmtpa06-08.prod.phx3.secureserver.net (p3plsmtpa06-08.prod.phx3.secureserver.net [173.201.192.109]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 95B4112012C for ; Wed, 5 Jun 2019 08:46:23 -0700 (PDT) Received: from [192.168.1.82] ([76.192.164.238]) by :SMTPAUTH: with ESMTPA id YY7GhwnhnmARFYY7KhHBJB; Wed, 05 Jun 2019 08:46:22 -0700 From: Laurence Lundblade Message-Id: <30754CD8-98AB-4080-952E-880BC630EC69@island-resort.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_615FEB15-B6DA-47E3-9BF6-1B022B440513" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Wed, 5 Jun 2019 08:46:18 -0700 In-Reply-To: <12913.1559739926@localhost> Cc: rats@ietf.org, Michael.Jones@microsoft.com To: Michael Richardson References: <12913.1559739926@localhost> X-Mailer: Apple Mail (2.3445.9.1) X-CMAE-Envelope: MS4wfMYVGJB0YlGRpb63kSbdTBN49Z6TnCbkBQTA4dsvqOcmR6o0uHZcF82ftA2QCDJYbjLM2z/EaYwgf6qcSE/Hy7ZLNu9vwYqB754He00vq/6+/hqbLCuq vnkXRrOypJgib5G2tnCDl1hyA2MIEefe1zfFHH28kcULsHqjCMVkUZKg7A3nKMgOJOaOZLtabfW4zBdeGpF4nhbFB+wcrFaoLFSCujPqdVt6yr6cb0lZlhln u2nLlxAybp47BexVvJcwwA== Archived-At: Subject: Re: [Rats] Vetting claim definitions X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Jun 2019 15:46:26 -0000 --Apple-Mail=_615FEB15-B6DA-47E3-9BF6-1B022B440513 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Below=E2=80=A6 + Mike Jones, co-author of CWT > On Jun 5, 2019, at 6:05 AM, Michael Richardson = wrote: >=20 >=20 > Laurence Lundblade wrote: >> =E2=80=94 Today CWT allocates millions of slots for expert review. No >> specification is required, but some information should be provided. >=20 >> JWT doesn=E2=80=99t seem to have this, which is maybe why it is = messier. It >> kind of seems bad and wrong that it doesn=E2=80=99t to me. >=20 > JWT doesn't have this because the claims are "unlimited" length = strings, so > one can always make up a unique string in lieu of registration. > org.island-resort.lgl.whateverstringyouwant >=20 > is probably completely yours :-) > Of course, if you want to interoperate you need to agree about how, so = there > are some advantages of a forcing function that demands you write = things down > first :-) Unlimited length string claim names are fully part of CWT. Also, COSE = allows them for headers, algorithm names and such too. So from a syntax = view CWT and COSE are the same as JWT in allowing long string names. However, COSE and CWT are different in the management of the string name = space: Strings of length 1 Standards Action Strings of length 2 Specification Required Strings of length greater than 2 Expert Review These, along with the integer names space rules, then imply: Integer values less than -65536 are the only ones free for use with no = review or processing by IANA and experts. JWT also has this notion of Collision-Resistant Name based on OIDs or = UUIDs, which is essentially some rules to make up names that don=E2=80=99t= go into an IANA registry and are still unique and won=E2=80=99t = collide. JWT could have done what CWT does. Seems to me that CWT has taken a = radically more managed approach to the super-open JWT approach. Maybe = the CWT folks realized the JWT design was poor. At any rate, there seems to be some consensus here that the CWT approach = is what we want for attestation. It is also the more recent and thus = maybe more advanced thinking. I=E2=80=99m hoping we can find our way to just accept the CWT claim = naming management scheme as is for attestation. If other CWT-based = efforts did the same (draft-birkholz-core-coid) did the same then the = world would be much simpler.=20 However that still leaves open some issue with JWT namespace management. = (We do want JSON based attestation to be JWT=E2=80=99s, right? Just the = same as CBOR-based attestation are CWT=E2=80=99s). LL --Apple-Mail=_615FEB15-B6DA-47E3-9BF6-1B022B440513 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Below=E2=80=A6
+ Mike Jones, co-author of = CWT

On Jun 5, 2019, at 6:05 AM, Michael = Richardson <mcr+ietf@sandelman.ca> wrote:


Laurence Lundblade <lgl@island-resort.com> wrote:
=E2=80=94 Today CWT allocates millions of = slots for expert review. No
specification is required, but = some information should be provided.

JWT doesn=E2=80=99t seem = to have this, which is maybe why it is messier. It
kind of = seems bad and wrong that it doesn=E2=80=99t to me.

JWT doesn't have this because the = claims are "unlimited" length strings, so
one can always = make up a unique string in lieu of registration.
=  org.island-resort.lgl.whateverstringyouwant

is probably completely yours :-)
Of course, if = you want to interoperate you need to agree about how, so there
are some advantages of a forcing function that demands you = write things down
first :-)

Unlimited length string claim names are fully part = of CWT. Also, COSE allows them for headers, algorithm names and such = too. So from a syntax view CWT and COSE are the same as JWT in allowing = long string names.

However, COSE and = CWT are different in the management of the string name = space:

Strings of = length 1 = Standards Action
Strings of length 2 = Specification Required
Strings of length = greater than 2 = Expert Review

These, along with the = integer names space rules, then imply:

Integer values less than = -65536 are the only ones free for use with no review or processing by = IANA and experts.

JWT also has this notion = of Collision-Resistant Name based on OIDs or UUIDs, which is = essentially some rules to make up names that don=E2=80=99t go into an = IANA registry and are still unique and won=E2=80=99t = collide.

JWT could have done what = CWT does. Seems to me that CWT has taken a radically more managed = approach to the super-open JWT approach. Maybe the CWT folks realized = the JWT design was poor.


At any rate, there seems to be some consensus here = that the CWT approach is what we want for attestation. It is also the = more recent and thus maybe more advanced thinking.

I=E2=80=99m hoping we can find our way to just = accept the CWT claim naming management scheme as is for attestation. If = other CWT-based efforts did the same (draft-birkholz-core-coid) did the = same then the world would be much simpler. 

However that still leaves open some issue with JWT = namespace management. (We do want JSON based attestation to be JWT=E2=80=99= s, right? Just the same as CBOR-based attestation are = CWT=E2=80=99s).

LL

= --Apple-Mail=_615FEB15-B6DA-47E3-9BF6-1B022B440513-- From nobody Wed Jun 5 10:31:05 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C54E12011B for ; Wed, 5 Jun 2019 10:31:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.009 X-Spam-Level: X-Spam-Status: No, score=-2.009 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0iTBZ4BXF9zy for ; Wed, 5 Jun 2019 10:31:01 -0700 (PDT) Received: from NAM06-BL2-obe.outbound.protection.outlook.com (mail-eopbgr650101.outbound.protection.outlook.com [40.107.65.101]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7567712006E for ; Wed, 5 Jun 2019 10:31:01 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=testarcselector01; d=microsoft.com; cv=none; b=qvDTD4qwvPLBAB7L958vGjPlg/F8WX+FkyZR3PzSttlQByVspDI9UD6IKHctSUVnxjowcd4kl9uxpCDn04P+WhbXaCrjwiRhq83zovP0UA0FTrP0lRVVhqMRuTLbWorW+RevlHdq3JBZO68hVq1wdoaWkRTEqQS3hetGpb/GQBw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=testarcselector01; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=K1I3DVk7QNSZmW6128Mr48Kupr+AfU3iHlCU5BLAvaE=; b=LC8x/smzNjdawpfAxBYW6nYfTYWTAygqWQ/h/ApRJEUfQskReDfYZCmU0/426yWix8NL+ce9h57rE4m3Oz6XzlgJ6jUUk9FTrgbUxiCFNzUywoRKLNiaIHg5ot3EwStvgDY9pW5/X1z6NUqEwykjvyvEYN8SZTm5pAH9JBUDogU= ARC-Authentication-Results: i=1; test.office365.com 1;spf=none;dmarc=none;dkim=none;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=K1I3DVk7QNSZmW6128Mr48Kupr+AfU3iHlCU5BLAvaE=; b=l96FS86IJSniNRFqd4v3Ug+GIIyJoHR2cx0ATYnnknwiOzvUypm+uk64YlY1YdwDVr0zWj396MAytRstYixMVYyyGravLIyAS8I2dp3Gf+0uUfNOXSiPfLPcBLrS2yFZPBwxRsf+wp5OgtlXLKgVJLVcgk7CvVMGzmShtT8GOLM= Received: from BL0PR00MB0292.namprd00.prod.outlook.com (52.132.19.158) by BL0PR00MB0385.namprd00.prod.outlook.com (52.132.20.27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2004.0; Wed, 5 Jun 2019 17:30:59 +0000 Received: from BL0PR00MB0292.namprd00.prod.outlook.com ([fe80::c8e1:6022:9bc3:5b73]) by BL0PR00MB0292.namprd00.prod.outlook.com ([fe80::c8e1:6022:9bc3:5b73%5]) with mapi id 15.20.2005.000; Wed, 5 Jun 2019 17:30:59 +0000 From: Mike Jones To: Laurence Lundblade , Michael Richardson CC: "rats@ietf.org" Thread-Topic: [Rats] Vetting claim definitions Thread-Index: AQHVG7XVbraN3V8Gs0WRMkd4jETRWqaNUNhQ Date: Wed, 5 Jun 2019 17:30:58 +0000 Message-ID: References: <12913.1559739926@localhost> <30754CD8-98AB-4080-952E-880BC630EC69@island-resort.com> In-Reply-To: <30754CD8-98AB-4080-952E-880BC630EC69@island-resort.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ActionId=b1ecc555-a57b-4de2-ba4c-0000e243b876; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=true; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=Internal; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2019-06-05T17:28:48-0800; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; authentication-results: spf=none (sender IP is ) smtp.mailfrom=Michael.Jones@microsoft.com; x-originating-ip: [50.47.93.218] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: ab6889cf-c142-4a18-e0aa-08d6e9db92d4 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600148)(711020)(4605104)(1401327)(4618075)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7193020); SRVR:BL0PR00MB0385; x-ms-traffictypediagnostic: BL0PR00MB0385: x-ms-exchange-purlcount: 2 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 00594E8DBA x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(376002)(346002)(396003)(366004)(136003)(39860400002)(124014002)(199004)(189003)(476003)(73956011)(66476007)(66446008)(64756008)(71190400001)(71200400001)(22452003)(66946007)(76116006)(33656002)(6436002)(316002)(8676002)(99286004)(10090500001)(8990500004)(8936002)(486006)(6506007)(81156014)(102836004)(9686003)(81166006)(236005)(53546011)(76176011)(606006)(6246003)(7696005)(256004)(66066001)(7736002)(25786009)(86362001)(68736007)(4326008)(790700001)(14454004)(6306002)(54896002)(55016002)(66556008)(72206003)(53936002)(2906002)(5660300002)(11346002)(110136005)(26005)(446003)(74316002)(52536014)(10290500003)(478600001)(966005)(229853002)(186003)(3846002)(6116002); DIR:OUT; SFP:1102; SCL:1; SRVR:BL0PR00MB0385; H:BL0PR00MB0292.namprd00.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: bKp1DkKcSS8MY+AzLI6JdPpRmmmGvop8qS1MJd4Rxcxtj5NSiiC6GqDzDY27N37GyWEwZl00chpPrCxxnbodJBVDyw1rBor8mzI65YiRsZI2e1cfh25k217MW16iXwO/TReStcYHSmoT3hgZawlBLgHUFcmZTqBNN1doYucQlc7j+bqrhNMZ2Ar9BpW6C3nl0TYWTyZVvMaIo3uop1R1eR6sUlOsAv0fWAm7CqBIIQB5XQTDi2lPaFsLQ4sl8Rqzwvkg3iG4v6tKXy/bDguN0NFBSAMxot8e+7K/7WkFSXK+AftC1Rgu42ZERkh4lVCZkNZmwnR/lKORdxCotBH/dURRFD5tZNO/RzZELID0EwvYKNsey2SEWnQce/eVISBU8jqMldLYoA6ht++IbO6uzYIM5Ga6XPp14zkqT7Dy00w= Content-Type: multipart/alternative; boundary="_000_BL0PR00MB029274A33B44A0B8CE310C0BF5160BL0PR00MB0292namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: ab6889cf-c142-4a18-e0aa-08d6e9db92d4 X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Jun 2019 17:30:58.8139 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: mbj@microsoft.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL0PR00MB0385 Archived-At: Subject: Re: [Rats] Vetting claim definitions X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Jun 2019 17:31:04 -0000 --_000_BL0PR00MB029274A33B44A0B8CE310C0BF5160BL0PR00MB0292namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 QWN0dWFsbHksIG5vcm1hbCAobm9uLWNvbGxpc2lvbi1yZXNpc3RhbnQpIEpXVCBjbGFpbXMgKmFy ZSogYWxsb2NhdGVkIG9uIGEgc3BlY2lmaWNhdGlvbiByZXF1aXJlZCBiYXNpcyB3aXRoIGV4cGVy dCByZXZpZXcuICBTZWUgdGhpcyB0ZXh0IGF0IGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9y ZmM3NTE5I3NlY3Rpb24tMTAuMToNCg0KICAgVmFsdWVzIGFyZSByZWdpc3RlcmVkIG9uIGEgU3Bl Y2lmaWNhdGlvbiBSZXF1aXJlZCBbUkZDNTIyNjxodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwv cmZjNTIyNj5dIGJhc2lzDQogICBhZnRlciBhIHRocmVlLXdlZWsgcmV2aWV3IHBlcmlvZCBvbiB0 aGUgand0LXJlZy1yZXZpZXdAaWV0Zi5vcmcNCiAgIG1haWxpbmcgbGlzdCwgb24gdGhlIGFkdmlj ZSBvZiBvbmUgb3IgbW9yZSBEZXNpZ25hdGVkIEV4cGVydHMuDQogICBIb3dldmVyLCB0byBhbGxv dyBmb3IgdGhlIGFsbG9jYXRpb24gb2YgdmFsdWVzIHByaW9yIHRvIHB1YmxpY2F0aW9uLA0KICAg dGhlIERlc2lnbmF0ZWQgRXhwZXJ0cyBtYXkgYXBwcm92ZSByZWdpc3RyYXRpb24gb25jZSB0aGV5 IGFyZQ0KICAgc2F0aXNmaWVkIHRoYXQgc3VjaCBhIHNwZWNpZmljYXRpb24gd2lsbCBiZSBwdWJs aXNoZWQuDQoNClNvIGEgc3BlY2lmaWNhdGlvbiBjYW4gZWFzaWx5IHJlZ2lzdGVyIGJvdGggSldU IGFuZCBDV1QgY2xhaW1zLg0KDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgLS0gTWlrZQ0KDQpGcm9tOiBMYXVyZW5jZSBMdW5kYmxhZGUgPGxn bEBpc2xhbmQtcmVzb3J0LmNvbT4NClNlbnQ6IFdlZG5lc2RheSwgSnVuZSA1LCAyMDE5IDg6NDYg QU0NClRvOiBNaWNoYWVsIFJpY2hhcmRzb24gPG1jcitpZXRmQHNhbmRlbG1hbi5jYT4NCkNjOiBy YXRzQGlldGYub3JnOyBNaWtlIEpvbmVzIDxNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20+DQpT dWJqZWN0OiBSZTogW1JhdHNdIFZldHRpbmcgY2xhaW0gZGVmaW5pdGlvbnMNCg0KQmVsb3figKYN CisgTWlrZSBKb25lcywgY28tYXV0aG9yIG9mIENXVA0KDQoNCk9uIEp1biA1LCAyMDE5LCBhdCA2 OjA1IEFNLCBNaWNoYWVsIFJpY2hhcmRzb24gPG1jcitpZXRmQHNhbmRlbG1hbi5jYTxtYWlsdG86 bWNyK2lldGZAc2FuZGVsbWFuLmNhPj4gd3JvdGU6DQoNCg0KTGF1cmVuY2UgTHVuZGJsYWRlIDxs Z2xAaXNsYW5kLXJlc29ydC5jb208bWFpbHRvOmxnbEBpc2xhbmQtcmVzb3J0LmNvbT4+IHdyb3Rl Og0KDQrigJQgVG9kYXkgQ1dUIGFsbG9jYXRlcyBtaWxsaW9ucyBvZiBzbG90cyBmb3IgZXhwZXJ0 IHJldmlldy4gTm8NCnNwZWNpZmljYXRpb24gaXMgcmVxdWlyZWQsIGJ1dCBzb21lIGluZm9ybWF0 aW9uIHNob3VsZCBiZSBwcm92aWRlZC4NCg0KDQpKV1QgZG9lc27igJl0IHNlZW0gdG8gaGF2ZSB0 aGlzLCB3aGljaCBpcyBtYXliZSB3aHkgaXQgaXMgbWVzc2llci4gSXQNCmtpbmQgb2Ygc2VlbXMg YmFkIGFuZCB3cm9uZyB0aGF0IGl0IGRvZXNu4oCZdCB0byBtZS4NCg0KSldUIGRvZXNuJ3QgaGF2 ZSB0aGlzIGJlY2F1c2UgdGhlIGNsYWltcyBhcmUgInVubGltaXRlZCIgbGVuZ3RoIHN0cmluZ3Ms IHNvDQpvbmUgY2FuIGFsd2F5cyBtYWtlIHVwIGEgdW5pcXVlIHN0cmluZyBpbiBsaWV1IG9mIHJl Z2lzdHJhdGlvbi4NCiBvcmcuaXNsYW5kLXJlc29ydC5sZ2wud2hhdGV2ZXJzdHJpbmd5b3V3YW50 DQoNCmlzIHByb2JhYmx5IGNvbXBsZXRlbHkgeW91cnMgOi0pDQpPZiBjb3Vyc2UsIGlmIHlvdSB3 YW50IHRvIGludGVyb3BlcmF0ZSB5b3UgbmVlZCB0byBhZ3JlZSBhYm91dCBob3csIHNvIHRoZXJl DQphcmUgc29tZSBhZHZhbnRhZ2VzIG9mIGEgZm9yY2luZyBmdW5jdGlvbiB0aGF0IGRlbWFuZHMg eW91IHdyaXRlIHRoaW5ncyBkb3duDQpmaXJzdCA6LSkNCg0KVW5saW1pdGVkIGxlbmd0aCBzdHJp bmcgY2xhaW0gbmFtZXMgYXJlIGZ1bGx5IHBhcnQgb2YgQ1dULiBBbHNvLCBDT1NFIGFsbG93cyB0 aGVtIGZvciBoZWFkZXJzLCBhbGdvcml0aG0gbmFtZXMgYW5kIHN1Y2ggdG9vLiBTbyBmcm9tIGEg c3ludGF4IHZpZXcgQ1dUIGFuZCBDT1NFIGFyZSB0aGUgc2FtZSBhcyBKV1QgaW4gYWxsb3dpbmcg bG9uZyBzdHJpbmcgbmFtZXMuDQoNCkhvd2V2ZXIsIENPU0UgYW5kIENXVCBhcmUgZGlmZmVyZW50 IGluIHRoZSBtYW5hZ2VtZW50IG9mIHRoZSBzdHJpbmcgbmFtZSBzcGFjZToNCg0KU3RyaW5ncyBv ZiBsZW5ndGggMSAgICAgICAgICAgIFN0YW5kYXJkcyBBY3Rpb24NClN0cmluZ3Mgb2YgbGVuZ3Ro IDIgICAgICAgICAgICBTcGVjaWZpY2F0aW9uIFJlcXVpcmVkDQpTdHJpbmdzIG9mIGxlbmd0aCBn cmVhdGVyIHRoYW4gMiAgICBFeHBlcnQgUmV2aWV3DQoNClRoZXNlLCBhbG9uZyB3aXRoIHRoZSBp bnRlZ2VyIG5hbWVzIHNwYWNlIHJ1bGVzLCB0aGVuIGltcGx5Og0KDQpJbnRlZ2VyIHZhbHVlcyBs ZXNzIHRoYW4gLTY1NTM2IGFyZSB0aGUgb25seSBvbmVzIGZyZWUgZm9yIHVzZSB3aXRoIG5vIHJl dmlldyBvciBwcm9jZXNzaW5nIGJ5IElBTkEgYW5kIGV4cGVydHMuDQoNCkpXVCBhbHNvIGhhcyB0 aGlzIG5vdGlvbiBvZiBDb2xsaXNpb24tUmVzaXN0YW50IE5hbWUgYmFzZWQgb24gT0lEcyBvciBV VUlEcywgd2hpY2ggaXMgZXNzZW50aWFsbHkgc29tZSBydWxlcyB0byBtYWtlIHVwIG5hbWVzIHRo YXQgZG9u4oCZdCBnbyBpbnRvIGFuIElBTkEgcmVnaXN0cnkgYW5kIGFyZSBzdGlsbCB1bmlxdWUg YW5kIHdvbuKAmXQgY29sbGlkZS4NCg0KSldUIGNvdWxkIGhhdmUgZG9uZSB3aGF0IENXVCBkb2Vz LiBTZWVtcyB0byBtZSB0aGF0IENXVCBoYXMgdGFrZW4gYSByYWRpY2FsbHkgbW9yZSBtYW5hZ2Vk IGFwcHJvYWNoIHRvIHRoZSBzdXBlci1vcGVuIEpXVCBhcHByb2FjaC4gTWF5YmUgdGhlIENXVCBm b2xrcyByZWFsaXplZCB0aGUgSldUIGRlc2lnbiB3YXMgcG9vci4NCg0KDQpBdCBhbnkgcmF0ZSwg dGhlcmUgc2VlbXMgdG8gYmUgc29tZSBjb25zZW5zdXMgaGVyZSB0aGF0IHRoZSBDV1QgYXBwcm9h Y2ggaXMgd2hhdCB3ZSB3YW50IGZvciBhdHRlc3RhdGlvbi4gSXQgaXMgYWxzbyB0aGUgbW9yZSBy ZWNlbnQgYW5kIHRodXMgbWF5YmUgbW9yZSBhZHZhbmNlZCB0aGlua2luZy4NCg0KSeKAmW0gaG9w aW5nIHdlIGNhbiBmaW5kIG91ciB3YXkgdG8ganVzdCBhY2NlcHQgdGhlIENXVCBjbGFpbSBuYW1p bmcgbWFuYWdlbWVudCBzY2hlbWUgYXMgaXMgZm9yIGF0dGVzdGF0aW9uLiBJZiBvdGhlciBDV1Qt YmFzZWQgZWZmb3J0cyBkaWQgdGhlIHNhbWUgKGRyYWZ0LWJpcmtob2x6LWNvcmUtY29pZCkgZGlk IHRoZSBzYW1lIHRoZW4gdGhlIHdvcmxkIHdvdWxkIGJlIG11Y2ggc2ltcGxlci4NCg0KSG93ZXZl ciB0aGF0IHN0aWxsIGxlYXZlcyBvcGVuIHNvbWUgaXNzdWUgd2l0aCBKV1QgbmFtZXNwYWNlIG1h bmFnZW1lbnQuIChXZSBkbyB3YW50IEpTT04gYmFzZWQgYXR0ZXN0YXRpb24gdG8gYmUgSldU4oCZ cywgcmlnaHQ/IEp1c3QgdGhlIHNhbWUgYXMgQ0JPUi1iYXNlZCBhdHRlc3RhdGlvbiBhcmUgQ1dU 4oCZcykuDQoNCkxMDQoNCg== --_000_BL0PR00MB029274A33B44A0B8CE310C0BF5160BL0PR00MB0292namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDEx IDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZp c2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5 Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAubXNvbm9y bWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6bXNv bm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJ bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6 ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5hcHBs ZS10YWItc3Bhbg0KCXttc28tc3R5bGUtbmFtZTphcHBsZS10YWItc3Bhbjt9DQpzcGFuLkVtYWls U3R5bGUxOQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToi Q2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMDAyMDYwO30NCi5Nc29DaHBEZWZhdWx0DQoJ e21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2Ug V29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAx LjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0t Pjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0 PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUg bXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4 dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4N CjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4N CjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iY29sb3I6IzAwMjA2MCI+QWN0dWFsbHksIG5vcm1hbCAobm9uLWNvbGxpc2lvbi1yZXNp c3RhbnQpIEpXVCBjbGFpbXMgKjxiPmFyZTwvYj4qIGFsbG9jYXRlZCBvbiBhIHNwZWNpZmljYXRp b24gcmVxdWlyZWQgYmFzaXMgd2l0aCBleHBlcnQgcmV2aWV3LiZuYnNwOyBTZWUgdGhpcyB0ZXh0 IGF0DQo8YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNzUxOSNzZWN0aW9u LTEwLjEiPmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM3NTE5I3NlY3Rpb24tMTAuMTwv YT46PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImNvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjpibGFj aztiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDsmbmJzcDsgVmFsdWVzIGFyZSByZWdpc3RlcmVkIG9u IGEgU3BlY2lmaWNhdGlvbiBSZXF1aXJlZCBbPC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8vdG9vbHMu aWV0Zi5vcmcvaHRtbC9yZmM1MjI2IiB0aXRsZT0iJnF1b3Q7R3VpZGVsaW5lcyBmb3IgV3JpdGlu ZyBhbiBJQU5BIENvbnNpZGVyYXRpb25zIFNlY3Rpb24gaW4gUkZDcyZxdW90OyI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6IzAwNjZDQyI+ UkZDNTIyNjwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9y OmJsYWNrO2JhY2tncm91bmQ6d2hpdGUiPl0NCiBiYXNpczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpDb25zb2xhcztj b2xvcjpibGFjaztiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDsmbmJzcDsgYWZ0ZXIgYSB0aHJlZS13 ZWVrIHJldmlldyBwZXJpb2Qgb24gdGhlIGp3dC1yZWctcmV2aWV3QGlldGYub3JnPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFt aWx5OkNvbnNvbGFzO2NvbG9yOmJsYWNrO2JhY2tncm91bmQ6d2hpdGUiPiZuYnNwOyZuYnNwOyBt YWlsaW5nIGxpc3QsIG9uIHRoZSBhZHZpY2Ugb2Ygb25lIG9yIG1vcmUgRGVzaWduYXRlZCBFeHBl cnRzLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjpibGFjaztiYWNrZ3JvdW5kOndoaXRlIj4m bmJzcDsmbmJzcDsgSG93ZXZlciwgdG8gYWxsb3cgZm9yIHRoZSBhbGxvY2F0aW9uIG9mIHZhbHVl cyBwcmlvciB0byBwdWJsaWNhdGlvbiw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6YmxhY2s7 YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7Jm5ic3A7IHRoZSBEZXNpZ25hdGVkIEV4cGVydHMgbWF5 IGFwcHJvdmUgcmVnaXN0cmF0aW9uIG9uY2UgdGhleSBhcmU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6Q29uc29sYXM7 Y29sb3I6YmxhY2s7YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7Jm5ic3A7IHNhdGlzZmllZCB0aGF0 IHN1Y2ggYSBzcGVjaWZpY2F0aW9uIHdpbGwgYmUgcHVibGlzaGVkLjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iY29sb3I6IzAwMjA2MCI+U28gYSBzcGVjaWZpY2F0aW9uIGNhbiBlYXNpbHkgcmVnaXN0 ZXIgYm90aCBKV1QgYW5kIENXVCBjbGFpbXMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjoj MDAyMDYwIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsgJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC0tIE1pa2U8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6 IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9 ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0 IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZyb206PC9iPiBMYXVyZW5j ZSBMdW5kYmxhZGUgJmx0O2xnbEBpc2xhbmQtcmVzb3J0LmNvbSZndDsgPGJyPg0KPGI+U2VudDo8 L2I+IFdlZG5lc2RheSwgSnVuZSA1LCAyMDE5IDg6NDYgQU08YnI+DQo8Yj5Ubzo8L2I+IE1pY2hh ZWwgUmljaGFyZHNvbiAmbHQ7bWNyJiM0MztpZXRmQHNhbmRlbG1hbi5jYSZndDs8YnI+DQo8Yj5D Yzo8L2I+IHJhdHNAaWV0Zi5vcmc7IE1pa2UgSm9uZXMgJmx0O01pY2hhZWwuSm9uZXNAbWljcm9z b2Z0LmNvbSZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtSYXRzXSBWZXR0aW5nIGNsYWlt IGRlZmluaXRpb25zPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5CZWxv d+KApjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiYjNDM7IE1p a2UgSm9uZXMsIGNvLWF1dGhvciBvZiBDV1Q8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48YnI+DQo8YnI+DQo8bzpwPjwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0 eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPk9uIEp1biA1LCAyMDE5LCBhdCA2OjA1IEFNLCBNaWNoYWVsIFJpY2hh cmRzb24gJmx0OzxhIGhyZWY9Im1haWx0bzptY3ImIzQzO2lldGZAc2FuZGVsbWFuLmNhIj5tY3Im IzQzO2lldGZAc2FuZGVsbWFuLmNhPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YnI+DQpMYXVyZW5jZSBMdW5kYmxhZGUgJmx0Ozxh IGhyZWY9Im1haWx0bzpsZ2xAaXNsYW5kLXJlc29ydC5jb20iPmxnbEBpc2xhbmQtcmVzb3J0LmNv bTwvYT4mZ3Q7IHdyb3RlOjxicj4NCjxicj4NCjxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUg c3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj7igJQgVG9kYXkgQ1dUIGFsbG9jYXRlcyBtaWxsaW9ucyBvZiBzbG90cyBmb3Ig ZXhwZXJ0IHJldmlldy4gTm88YnI+DQpzcGVjaWZpY2F0aW9uIGlzIHJlcXVpcmVkLCBidXQgc29t ZSBpbmZvcm1hdGlvbiBzaG91bGQgYmUgcHJvdmlkZWQuPG86cD48L286cD48L3A+DQo8L2Jsb2Nr cXVvdGU+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YnI+DQo8YnI+DQo8bzpwPjwvbzpwPjwvcD4N CjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQi Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SldUIGRvZXNu4oCZdCBzZWVtIHRvIGhhdmUgdGhpcywg d2hpY2ggaXMgbWF5YmUgd2h5IGl0IGlzIG1lc3NpZXIuIEl0PGJyPg0Ka2luZCBvZiBzZWVtcyBi YWQgYW5kIHdyb25nIHRoYXQgaXQgZG9lc27igJl0IHRvIG1lLjxvOnA+PC9vOnA+PC9wPg0KPC9i bG9ja3F1b3RlPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGJyPg0KSldUIGRvZXNuJ3QgaGF2ZSB0 aGlzIGJlY2F1c2UgdGhlIGNsYWltcyBhcmUgJnF1b3Q7dW5saW1pdGVkJnF1b3Q7IGxlbmd0aCBz dHJpbmdzLCBzbzxicj4NCm9uZSBjYW4gYWx3YXlzIG1ha2UgdXAgYSB1bmlxdWUgc3RyaW5nIGlu IGxpZXUgb2YgcmVnaXN0cmF0aW9uLjxicj4NCiZuYnNwO29yZy5pc2xhbmQtcmVzb3J0LmxnbC53 aGF0ZXZlcnN0cmluZ3lvdXdhbnQ8YnI+DQo8YnI+DQppcyBwcm9iYWJseSBjb21wbGV0ZWx5IHlv dXJzIDotKTxicj4NCk9mIGNvdXJzZSwgaWYgeW91IHdhbnQgdG8gaW50ZXJvcGVyYXRlIHlvdSBu ZWVkIHRvIGFncmVlIGFib3V0IGhvdywgc28gdGhlcmU8YnI+DQphcmUgc29tZSBhZHZhbnRhZ2Vz IG9mIGEgZm9yY2luZyBmdW5jdGlvbiB0aGF0IGRlbWFuZHMgeW91IHdyaXRlIHRoaW5ncyBkb3du PGJyPg0KZmlyc3QgOi0pPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1 b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VW5saW1pdGVkIGxlbmd0aCBzdHJp bmcgY2xhaW0gbmFtZXMgYXJlIGZ1bGx5IHBhcnQgb2YgQ1dULiBBbHNvLCBDT1NFIGFsbG93cyB0 aGVtIGZvciBoZWFkZXJzLCBhbGdvcml0aG0gbmFtZXMgYW5kIHN1Y2ggdG9vLiBTbyBmcm9tIGEg c3ludGF4IHZpZXcgQ1dUIGFuZCBDT1NFIGFyZSB0aGUgc2FtZSBhcyBKV1QgaW4gYWxsb3dpbmcg bG9uZyBzdHJpbmcgbmFtZXMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPkhvd2V2ZXIsIENPU0UgYW5kIENXVCBhcmUgZGlmZmVyZW50IGluIHRo ZSBtYW5hZ2VtZW50IG9mIHRoZSBzdHJpbmcgbmFtZSBzcGFjZTo8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tbGVmdDozMC4wcHQ7bWFy Z2luLXJpZ2h0OjBpbiI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlN0cmlu Z3Mgb2YgbGVuZ3RoIDE8c3BhbiBjbGFzcz0iYXBwbGUtdGFiLXNwYW4iPiZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyA8L3Nw YW4+DQpTdGFuZGFyZHMgQWN0aW9uPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5TdHJpbmdzIG9mIGxlbmd0aCAyPHNwYW4g Y2xhc3M9ImFwcGxlLXRhYi1zcGFuIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgPC9zcGFuPg0KU3BlY2lmaWNhdGlvbiBS ZXF1aXJlZDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+U3RyaW5ncyBvZiBsZW5ndGggZ3JlYXRlciB0aGFuIDI8c3BhbiBj bGFzcz0iYXBwbGUtdGFiLXNwYW4iPiZuYnNwOyZuYnNwOyZuYnNwOw0KPC9zcGFuPkV4cGVydCBS ZXZpZXc8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhlc2UsIGFsb25nIHdpdGggdGhlIGlu dGVnZXIgbmFtZXMgc3BhY2UgcnVsZXMsIHRoZW4gaW1wbHk6PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLWxlZnQ6MzAuMHB0O21hcmdp bi1yaWdodDowaW4iPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JbnRlZ2Vy IHZhbHVlcyBsZXNzIHRoYW4gLTY1NTM2IGFyZSB0aGUgb25seSBvbmVzIGZyZWUgZm9yIHVzZSB3 aXRoIG5vIHJldmlldyBvciBwcm9jZXNzaW5nIGJ5IElBTkEgYW5kIGV4cGVydHMuPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPkpXVCBhbHNvIGhhcyB0aGlzIG5vdGlvbiBvZiZuYnNwO0NvbGxp c2lvbi1SZXNpc3RhbnQgTmFtZSBiYXNlZCBvbiBPSURzIG9yIFVVSURzLCB3aGljaCBpcyBlc3Nl bnRpYWxseSBzb21lIHJ1bGVzIHRvIG1ha2UgdXAgbmFtZXMgdGhhdCBkb27igJl0IGdvIGludG8g YW4gSUFOQSByZWdpc3RyeSBhbmQgYXJlIHN0aWxsIHVuaXF1ZSBhbmQgd29u4oCZdCBjb2xsaWRl LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5K V1QgY291bGQgaGF2ZSBkb25lIHdoYXQgQ1dUIGRvZXMuIFNlZW1zIHRvIG1lIHRoYXQgQ1dUIGhh cyB0YWtlbiBhIHJhZGljYWxseSBtb3JlIG1hbmFnZWQgYXBwcm9hY2ggdG8gdGhlIHN1cGVyLW9w ZW4gSldUIGFwcHJvYWNoLiBNYXliZSB0aGUgQ1dUIGZvbGtzIHJlYWxpemVkIHRoZSBKV1QgZGVz aWduIHdhcyBwb29yLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPkF0IGFueSByYXRlLCB0aGVyZSBzZWVtcyB0byBiZSBzb21lIGNvbnNlbnN1 cyBoZXJlIHRoYXQgdGhlIENXVCBhcHByb2FjaCBpcyB3aGF0IHdlIHdhbnQgZm9yIGF0dGVzdGF0 aW9uLiBJdCBpcyBhbHNvIHRoZSBtb3JlIHJlY2VudCBhbmQgdGh1cyBtYXliZSBtb3JlIGFkdmFu Y2VkIHRoaW5raW5nLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5J4oCZbSBob3Bpbmcgd2UgY2FuIGZpbmQgb3VyIHdheSB0byBqdXN0IGFjY2Vw dCB0aGUgQ1dUIGNsYWltIG5hbWluZyBtYW5hZ2VtZW50IHNjaGVtZSBhcyBpcyBmb3IgYXR0ZXN0 YXRpb24uIElmIG90aGVyIENXVC1iYXNlZCBlZmZvcnRzIGRpZCB0aGUgc2FtZSAoZHJhZnQtYmly a2hvbHotY29yZS1jb2lkKSBkaWQgdGhlIHNhbWUgdGhlbiB0aGUgd29ybGQgd291bGQgYmUgbXVj aCBzaW1wbGVyLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5Ib3dldmVyIHRoYXQgc3RpbGwgbGVhdmVzIG9wZW4gc29tZSBpc3N1ZSB3 aXRoIEpXVCBuYW1lc3BhY2UgbWFuYWdlbWVudC4gKFdlIGRvIHdhbnQgSlNPTiBiYXNlZCBhdHRl c3RhdGlvbiB0byBiZSBKV1TigJlzLCByaWdodD8gSnVzdCB0aGUgc2FtZSBhcyBDQk9SLWJhc2Vk IGF0dGVzdGF0aW9uIGFyZSBDV1TigJlzKS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+TEw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_BL0PR00MB029274A33B44A0B8CE310C0BF5160BL0PR00MB0292namp_-- From nobody Thu Jun 6 12:02:11 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 283151200C3 for ; Thu, 6 Jun 2019 12:02:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fXISooVw28Xn for ; Thu, 6 Jun 2019 12:02:07 -0700 (PDT) Received: from p3plsmtpa08-09.prod.phx3.secureserver.net (p3plsmtpa08-09.prod.phx3.secureserver.net [173.201.193.110]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 097FC120094 for ; Thu, 6 Jun 2019 12:02:06 -0700 (PDT) Received: from [192.168.1.82] ([76.192.164.238]) by :SMTPAUTH: with ESMTPA id YxeGhAnwPS6fYYxeHhdGSi; Thu, 06 Jun 2019 12:02:06 -0700 From: Laurence Lundblade Message-Id: <8741CC22-09C5-448B-A153-75F871E29CD9@island-resort.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_23198A51-18AE-4943-B32F-D300600822C8" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Thu, 6 Jun 2019 12:02:04 -0700 In-Reply-To: Cc: Michael Richardson To: Mike Jones , "rats@ietf.org" References: <12913.1559739926@localhost> <30754CD8-98AB-4080-952E-880BC630EC69@island-resort.com> X-Mailer: Apple Mail (2.3445.9.1) X-CMAE-Envelope: MS4wfB6EwuS8Wrcec5qQyL94pSOrbmj5IyDV0stpyzYa218N77vNUBya41UzGf6CVX3iuL0cXwHHjg3G+txfo9NS6uyWab5k3cdu1dLtZcPpRr2FxS8WV55l lGD+gKYcNjTxfNBCgy8Jgze1A/C4VH/+nhQCx9DxNheYn/yUMEW+i+DsLu6rplb6QQJvmCxRe92uCEfJRyto6pQBJzxL4OWU8UDOCAAcQmh/Kn/e6Ljcf73o ZY4XmWMglAwcm4gzhyvO1QwIToXi5R/n7I3oJuvDeOQ= Archived-At: Subject: Re: [Rats] Vetting claim definitions X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 06 Jun 2019 19:02:10 -0000 --Apple-Mail=_23198A51-18AE-4943-B32F-D300600822C8 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 So in conclusion, all claims for JWT are: Specification Required and CWT claims are in 4 categories: Standards Action Specification Required Expert Review Private Use Rather than trying to further refine or control or restrict or manage = what claims can be registered, I propose a different approach. We do the = two following work: 1) Do the work here and up front to define lots of good claims in a = standards-track RFCs. Maybe over time it is several RFCs. When we do = this work we should consider previous work on JWT, CWT, YANG, ASN.1 and = such claims and try to avoid duplication. 2) We create profiles that list recommended claims for different use = cases (router, small IoT consumer IoT device, mobile phone=E2=80=A6). = Maybe some are standard track RFCs or maybe some are just informational. = Also we know other organizations will do some of this work = (GlobalPlatform, FIDO).=20 So registration of new claims related to attestation is just the same as = it is for CWT and JWT claims today. LL > On Jun 5, 2019, at 10:30 AM, Mike Jones = wrote: >=20 > Actually, normal (non-collision-resistant) JWT claims *are* allocated = on a specification required basis with expert review. See this text at = https://tools.ietf.org/html/rfc7519#section-10.1 = : > =20 > Values are registered on a Specification Required [RFC5226 = ] basis > after a three-week review period on the jwt-reg-review@ietf.org > mailing list, on the advice of one or more Designated Experts. > However, to allow for the allocation of values prior to = publication, > the Designated Experts may approve registration once they are > satisfied that such a specification will be published. > =20 > So a specification can easily register both JWT and CWT claims. > =20 > -- Mike > =20 > From: Laurence Lundblade =20 > Sent: Wednesday, June 5, 2019 8:46 AM > To: Michael Richardson > Cc: rats@ietf.org; Mike Jones > Subject: Re: [Rats] Vetting claim definitions > =20 > Below=E2=80=A6 > + Mike Jones, co-author of CWT >=20 >=20 > On Jun 5, 2019, at 6:05 AM, Michael Richardson > wrote: > =20 >=20 > Laurence Lundblade > wrote: >=20 > =E2=80=94 Today CWT allocates millions of slots for expert review. No > specification is required, but some information should be provided. >=20 >=20 > JWT doesn=E2=80=99t seem to have this, which is maybe why it is = messier. It > kind of seems bad and wrong that it doesn=E2=80=99t to me. >=20 > JWT doesn't have this because the claims are "unlimited" length = strings, so > one can always make up a unique string in lieu of registration. > org.island-resort.lgl.whateverstringyouwant >=20 > is probably completely yours :-) > Of course, if you want to interoperate you need to agree about how, so = there > are some advantages of a forcing function that demands you write = things down > first :-) > =20 > Unlimited length string claim names are fully part of CWT. Also, COSE = allows them for headers, algorithm names and such too. So from a syntax = view CWT and COSE are the same as JWT in allowing long string names. > =20 > However, COSE and CWT are different in the management of the string = name space: > =20 > Strings of length 1 Standards Action > Strings of length 2 Specification Required > Strings of length greater than 2 Expert Review > =20 > These, along with the integer names space rules, then imply: > =20 > Integer values less than -65536 are the only ones free for use with no = review or processing by IANA and experts. > =20 > JWT also has this notion of Collision-Resistant Name based on OIDs or = UUIDs, which is essentially some rules to make up names that don=E2=80=99t= go into an IANA registry and are still unique and won=E2=80=99t = collide. > =20 > JWT could have done what CWT does. Seems to me that CWT has taken a = radically more managed approach to the super-open JWT approach. Maybe = the CWT folks realized the JWT design was poor. > =20 > =20 > At any rate, there seems to be some consensus here that the CWT = approach is what we want for attestation. It is also the more recent and = thus maybe more advanced thinking. > =20 > I=E2=80=99m hoping we can find our way to just accept the CWT claim = naming management scheme as is for attestation. If other CWT-based = efforts did the same (draft-birkholz-core-coid) did the same then the = world would be much simpler.=20 > =20 > However that still leaves open some issue with JWT namespace = management. (We do want JSON based attestation to be JWT=E2=80=99s, = right? Just the same as CBOR-based attestation are CWT=E2=80=99s). > =20 > LL > =20 > _______________________________________________ > RATS mailing list > RATS@ietf.org > https://www.ietf.org/mailman/listinfo/rats --Apple-Mail=_23198A51-18AE-4943-B32F-D300600822C8 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
So in conclusion, all claims for JWT are:

Specification = Required

and CWT claims are in 4 categories:

Standards Action
Specification = Required
Expert Review
Private = Use


Rather than trying to = further refine or control or restrict or manage what claims can be = registered, I propose a different approach. We do the two following = work:

1) Do the work here and up front to define lots of good = claims in a standards-track RFCs. Maybe over time it is several RFCs. = When we do this work we should consider previous work on JWT, CWT, YANG, = ASN.1 and such claims and try to avoid duplication.

2) We create profiles = that list recommended claims for different use cases (router, small IoT = consumer IoT device, mobile phone=E2=80=A6). Maybe some are standard = track RFCs or maybe some are just informational. Also we know other = organizations will do some of this work (GlobalPlatform, = FIDO). 

So registration of new claims related to attestation is just = the same as it is for CWT and JWT claims today.

LL



On Jun 5, 2019, at 10:30 AM, = Mike Jones <Michael.Jones=3D40microsoft.com@dmarc.ietf.org> = wrote:

Actually, normal = (non-collision-resistant) JWT claims *are* allocated = on a specification required basis with expert review.  See this = text at https://tools.ietf.org/html/rfc7519#section-10.1:

 

   Values are registered on a = Specification Required [RFC5226] basis

   after a three-week review period on = the jwt-reg-review@ietf.org

   mailing = list, on the advice of one or more Designated Experts.

   However, to allow for the allocation = of values prior to publication,

   the = Designated Experts may approve registration once they are

   satisfied that such a specification = will be published.

 

So a specification can easily = register both JWT and CWT claims.

 

          &nb= sp;            = ;            &= nbsp;     =             &n= bsp; -- Mike

 

=

From: = Laurence Lundblade <lgl@island-resort.com>
Sent: Wednesday, June 5, 2019 8:46 AM
To: Michael Richardson <mcr+ietf@sandelman.ca>
Cc: rats@ietf.org; Mike Jones <Michael.Jones@microsoft.com>
Subject: Re: [Rats] Vetting claim definitions

 

Below=E2=80=A6

+ Mike Jones, co-author of = CWT



On Jun 5, 2019, at 6:05 AM, = Michael Richardson <mcr+ietf@sandelman.ca> wrote:

 


Laurence Lundblade <lgl@island-resort.com> wrote:

=E2=80=94 Today CWT allocates millions of slots for = expert review. No
specification is required, but some information should be provided.



JWT doesn=E2=80=99t seem to have this, which is = maybe why it is messier. It
kind of seems bad and wrong that it doesn=E2=80=99t to me.


JWT doesn't have this because the claims are "unlimited" length strings, = so
one can always make up a unique string in lieu of registration.
 org.island-resort.lgl.whateverstringyouwant

is probably completely yours :-)
Of course, if you want to interoperate you need to agree about how, so = there
are some advantages of a forcing function that demands you write things = down
first :-)

 

Unlimited length string claim = names are fully part of CWT. Also, COSE allows them for headers, = algorithm names and such too. So from a syntax view CWT and COSE are the = same as JWT in allowing long string names.

 

However, COSE and CWT are = different in the management of the string name space:

 

Strings of length 1        &= nbsp;   Standards Action

Strings of length 2        &= nbsp;   Specification Required

Strings of length greater than = 2    Expert Review

 

These, along with the integer = names space rules, then imply:

 

Integer values less than -65536 = are the only ones free for use with no review or processing by IANA and = experts.

 

JWT also has this notion = of Collision-Resistant Name based on OIDs or UUIDs, which is = essentially some rules to make up names that don=E2=80=99t go into an = IANA registry and are still unique and won=E2=80=99t collide.

 

JWT could have done what CWT = does. Seems to me that CWT has taken a radically more managed approach = to the super-open JWT approach. Maybe the CWT folks realized the JWT = design was poor.

 

 

At any rate, there seems to be = some consensus here that the CWT approach is what we want for = attestation. It is also the more recent and thus maybe more advanced = thinking.

 

I=E2=80=99m hoping we can find = our way to just accept the CWT claim naming management scheme as is for = attestation. If other CWT-based efforts did the same = (draft-birkholz-core-coid) did the same then the world would be much = simpler. 

 

However that still leaves open = some issue with JWT namespace management. (We do want JSON based = attestation to be JWT=E2=80=99s, right? Just the same as CBOR-based = attestation are CWT=E2=80=99s).

 

LL

 

_______________________________________________
RATS = mailing list
RATS@ietf.org
https://www.ietf.org/mailman/listinfo/rats

= --Apple-Mail=_23198A51-18AE-4943-B32F-D300600822C8-- From nobody Fri Jun 7 04:28:57 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 62ABE12008A for ; Fri, 7 Jun 2019 04:28:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aiutbM66RL10 for ; Fri, 7 Jun 2019 04:28:50 -0700 (PDT) Received: from EUR01-HE1-obe.outbound.protection.outlook.com (mail-eopbgr130078.outbound.protection.outlook.com [40.107.13.78]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0BB4812001A for ; Fri, 7 Jun 2019 04:28:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=JU1Cq4Z+caV6NmrubYQLQvVfcqRxz5b+UaDmN0zjnO4=; b=HxoA4v3+7/XGyGuHDzoHutTLy/uQghSwI0lOLHEme6ntyvJxgRaGXu8Y3z4OQFfc/sJu5m/kQhdTLL8PZEAza3v1x2UcibLAv9uZBB7WyZ8aYSbpr3u1/xemRfj/ZseIOVnduQgchLhUVXFsSmTglqUOW75wOa8Nr0oa/CU3umQ= Received: from VI1PR08MB5360.eurprd08.prod.outlook.com (52.133.244.88) by VI1PR08MB3040.eurprd08.prod.outlook.com (52.133.14.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1943.22; Fri, 7 Jun 2019 11:28:46 +0000 Received: from VI1PR08MB5360.eurprd08.prod.outlook.com ([fe80::4014:31c8:2ea3:7afd]) by VI1PR08MB5360.eurprd08.prod.outlook.com ([fe80::4014:31c8:2ea3:7afd%2]) with mapi id 15.20.1965.011; Fri, 7 Jun 2019 11:28:46 +0000 From: Hannes Tschofenig To: Mike Jones , Laurence Lundblade , Michael Richardson CC: "rats@ietf.org" Thread-Topic: [Rats] Vetting claim definitions Thread-Index: AQHVGxAckwBFHzwCtkGJuRwO7P2ipaaNCI4AgAAs8gCAAB0/AIAAC71w Date: Fri, 7 Jun 2019 11:28:46 +0000 Message-ID: References: <12913.1559739926@localhost> <30754CD8-98AB-4080-952E-880BC630EC69@island-resort.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ActionId=b1ecc555-a57b-4de2-ba4c-0000e243b876; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=true; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=Internal; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2019-06-05T17:28:48-0800; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; x-ts-tracking-id: 5393488c-8c30-4e44-b992-8bff2a39479f.1 x-checkrecipientchecked: true authentication-results: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; x-originating-ip: [217.140.96.140] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: af9cbbe3-72db-4b38-1d47-08d6eb3b4e39 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:VI1PR08MB3040; x-ms-traffictypediagnostic: VI1PR08MB3040: x-ms-exchange-purlcount: 2 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0061C35778 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39860400002)(136003)(346002)(366004)(376002)(396003)(124014002)(199004)(189003)(40434004)(66556008)(229853002)(66476007)(76116006)(52536014)(73956011)(64756008)(53936002)(71200400001)(66066001)(606006)(2906002)(33656002)(5660300002)(110136005)(99286004)(478600001)(486006)(6116002)(54896002)(66446008)(476003)(26005)(236005)(81156014)(8676002)(81166006)(68736007)(316002)(25786009)(76176011)(966005)(3846002)(86362001)(4326008)(55016002)(5024004)(6246003)(6306002)(14444005)(74316002)(6436002)(256004)(6506007)(102836004)(790700001)(53546011)(446003)(45080400002)(71190400001)(14454004)(11346002)(8936002)(72206003)(9686003)(7736002)(7696005)(186003)(66946007); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1PR08MB3040; H:VI1PR08MB5360.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: Q8yhSvm8L2se+BgPUt843ONUhnPMIuohHyTLmSdiTSN1+FcRHsrS0J3HVyTDSCPoUebdiGesl4t7DN5BYCc5XRUbKZiL6i236U7zXdl2T5as5dIwlxS1JQsYqiIBxQ7UmJL9Km1XzcmWEAP7h+UmLPrKourA15p75hB2+MDlBX3dfDkI1gLI30+sglbKoi9BmNiLl54mKP/FGshSJaTZIbbTmX/Dpl7vYR7w/OpgkdrJeF9HA6DXOoEVeEPypNEdvMRtG7ez6M3GRnCvoUbLQ4HhDSLA9bWWXiNvimw7GSbHX2ijgG+X2mragS+TDfq6WOnYnN2wAr6m9+PXR0ndXT4cPFi+KKH9gR830itwa6fKKN0RVdlJG0pUScziiKPRsLhOkUKAoN6SSqS14IjECMJswrHTbGkjkwEQw4WEpyE= Content-Type: multipart/alternative; boundary="_000_VI1PR08MB536061869B7BE623F861B821FA100VI1PR08MB5360eurp_" MIME-Version: 1.0 X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-Network-Message-Id: af9cbbe3-72db-4b38-1d47-08d6eb3b4e39 X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Jun 2019 11:28:46.6256 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: Hannes.Tschofenig@arm.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR08MB3040 Archived-At: Subject: Re: [Rats] Vetting claim definitions X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Jun 2019 11:28:54 -0000 --_000_VI1PR08MB536061869B7BE623F861B821FA100VI1PR08MB5360eurp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 RldJVzogV2hpbGUgdGhlIEpXVCByZWdpc3RyeSBsb29rcyBtb3JlIG1peGVkIGluIHRlcm1zIG9m IGNsYWltIHR5cGVzLiBUaGlzIGlzLCBob3dldmVyLCBvbmx5IGEgcmVzdWx0IG9mIHRoZSB3aWRl c3ByZWFkIGFkb3B0aW9uLg0KVGhlcmUgYXJlIG5vIHByb2JsZW1zLCBhcyBmYXIgYXMgSSBrbm93 LCB3aXRoIHRoZSBkaXZlcnNpdHkgb2YgdGhlIGNsYWltcyBhbmQgdGhhdCB0aGV5IGFyZSBub3Qg YWxsIHVzZWZ1bCBpbiBldmVyeSBjb250ZXh0LiBEaWZmZXJlbnQgZGVwbG95bWVudHMgdXNlIHRo ZSBjbGFpbXMgdGhleSBmaW5kIHVzZWZ1bC4NCg0KSSBhbSB3b25kZXJpbmcgd2hldGhlciB3ZSBh cmUgdHJ5aW5nIHRvIGZpeCBhIHByb2JsZW0gd2l0aCB0aGUgcmVnaXN0cnkgb2YgY2xhaW1zIHRo YXQgZG9lc27igJl0IG9jY3VyIGluIHByYWN0aWNlLg0KDQpDaWFvDQpIYW5uZXMNCg0KRnJvbTog UkFUUyA8cmF0cy1ib3VuY2VzQGlldGYub3JnPiBPbiBCZWhhbGYgT2YgTWlrZSBKb25lcw0KU2Vu dDogTWl0dHdvY2gsIDUuIEp1bmkgMjAxOSAxOTozMQ0KVG86IExhdXJlbmNlIEx1bmRibGFkZSA8 bGdsQGlzbGFuZC1yZXNvcnQuY29tPjsgTWljaGFlbCBSaWNoYXJkc29uIDxtY3IraWV0ZkBzYW5k ZWxtYW4uY2E+DQpDYzogcmF0c0BpZXRmLm9yZw0KU3ViamVjdDogUmU6IFtSYXRzXSBWZXR0aW5n IGNsYWltIGRlZmluaXRpb25zDQoNCkFjdHVhbGx5LCBub3JtYWwgKG5vbi1jb2xsaXNpb24tcmVz aXN0YW50KSBKV1QgY2xhaW1zICphcmUqIGFsbG9jYXRlZCBvbiBhIHNwZWNpZmljYXRpb24gcmVx dWlyZWQgYmFzaXMgd2l0aCBleHBlcnQgcmV2aWV3LiAgU2VlIHRoaXMgdGV4dCBhdCBodHRwczov L3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNzUxOSNzZWN0aW9uLTEwLjE6DQoNCiAgIFZhbHVlcyBh cmUgcmVnaXN0ZXJlZCBvbiBhIFNwZWNpZmljYXRpb24gUmVxdWlyZWQgW1JGQzUyMjY8aHR0cHM6 Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzUyMjY+XSBiYXNpcw0KICAgYWZ0ZXIgYSB0aHJlZS13 ZWVrIHJldmlldyBwZXJpb2Qgb24gdGhlIGp3dC1yZWctcmV2aWV3QGlldGYub3JnPG1haWx0bzpq d3QtcmVnLXJldmlld0BpZXRmLm9yZz4NCiAgIG1haWxpbmcgbGlzdCwgb24gdGhlIGFkdmljZSBv ZiBvbmUgb3IgbW9yZSBEZXNpZ25hdGVkIEV4cGVydHMuDQogICBIb3dldmVyLCB0byBhbGxvdyBm b3IgdGhlIGFsbG9jYXRpb24gb2YgdmFsdWVzIHByaW9yIHRvIHB1YmxpY2F0aW9uLA0KICAgdGhl IERlc2lnbmF0ZWQgRXhwZXJ0cyBtYXkgYXBwcm92ZSByZWdpc3RyYXRpb24gb25jZSB0aGV5IGFy ZQ0KICAgc2F0aXNmaWVkIHRoYXQgc3VjaCBhIHNwZWNpZmljYXRpb24gd2lsbCBiZSBwdWJsaXNo ZWQuDQoNClNvIGEgc3BlY2lmaWNhdGlvbiBjYW4gZWFzaWx5IHJlZ2lzdGVyIGJvdGggSldUIGFu ZCBDV1QgY2xhaW1zLg0KDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgLS0gTWlrZQ0KDQpGcm9tOiBMYXVyZW5jZSBMdW5kYmxhZGUgPGxnbEBp c2xhbmQtcmVzb3J0LmNvbTxtYWlsdG86bGdsQGlzbGFuZC1yZXNvcnQuY29tPj4NClNlbnQ6IFdl ZG5lc2RheSwgSnVuZSA1LCAyMDE5IDg6NDYgQU0NClRvOiBNaWNoYWVsIFJpY2hhcmRzb24gPG1j citpZXRmQHNhbmRlbG1hbi5jYTxtYWlsdG86bWNyK2lldGZAc2FuZGVsbWFuLmNhPj4NCkNjOiBy YXRzQGlldGYub3JnPG1haWx0bzpyYXRzQGlldGYub3JnPjsgTWlrZSBKb25lcyA8TWljaGFlbC5K b25lc0BtaWNyb3NvZnQuY29tPG1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20+Pg0K U3ViamVjdDogUmU6IFtSYXRzXSBWZXR0aW5nIGNsYWltIGRlZmluaXRpb25zDQoNCkJlbG934oCm DQorIE1pa2UgSm9uZXMsIGNvLWF1dGhvciBvZiBDV1QNCg0KT24gSnVuIDUsIDIwMTksIGF0IDY6 MDUgQU0sIE1pY2hhZWwgUmljaGFyZHNvbiA8bWNyK2lldGZAc2FuZGVsbWFuLmNhPG1haWx0bzpt Y3IraWV0ZkBzYW5kZWxtYW4uY2E+PiB3cm90ZToNCg0KDQpMYXVyZW5jZSBMdW5kYmxhZGUgPGxn bEBpc2xhbmQtcmVzb3J0LmNvbTxtYWlsdG86bGdsQGlzbGFuZC1yZXNvcnQuY29tPj4gd3JvdGU6 DQrigJQgVG9kYXkgQ1dUIGFsbG9jYXRlcyBtaWxsaW9ucyBvZiBzbG90cyBmb3IgZXhwZXJ0IHJl dmlldy4gTm8NCnNwZWNpZmljYXRpb24gaXMgcmVxdWlyZWQsIGJ1dCBzb21lIGluZm9ybWF0aW9u IHNob3VsZCBiZSBwcm92aWRlZC4NCg0KSldUIGRvZXNu4oCZdCBzZWVtIHRvIGhhdmUgdGhpcywg d2hpY2ggaXMgbWF5YmUgd2h5IGl0IGlzIG1lc3NpZXIuIEl0DQpraW5kIG9mIHNlZW1zIGJhZCBh bmQgd3JvbmcgdGhhdCBpdCBkb2VzbuKAmXQgdG8gbWUuDQoNCkpXVCBkb2Vzbid0IGhhdmUgdGhp cyBiZWNhdXNlIHRoZSBjbGFpbXMgYXJlICJ1bmxpbWl0ZWQiIGxlbmd0aCBzdHJpbmdzLCBzbw0K b25lIGNhbiBhbHdheXMgbWFrZSB1cCBhIHVuaXF1ZSBzdHJpbmcgaW4gbGlldSBvZiByZWdpc3Ry YXRpb24uDQogb3JnLmlzbGFuZC1yZXNvcnQubGdsLndoYXRldmVyc3RyaW5neW91d2FudA0KDQpp cyBwcm9iYWJseSBjb21wbGV0ZWx5IHlvdXJzIDotKQ0KT2YgY291cnNlLCBpZiB5b3Ugd2FudCB0 byBpbnRlcm9wZXJhdGUgeW91IG5lZWQgdG8gYWdyZWUgYWJvdXQgaG93LCBzbyB0aGVyZQ0KYXJl IHNvbWUgYWR2YW50YWdlcyBvZiBhIGZvcmNpbmcgZnVuY3Rpb24gdGhhdCBkZW1hbmRzIHlvdSB3 cml0ZSB0aGluZ3MgZG93bg0KZmlyc3QgOi0pDQoNClVubGltaXRlZCBsZW5ndGggc3RyaW5nIGNs YWltIG5hbWVzIGFyZSBmdWxseSBwYXJ0IG9mIENXVC4gQWxzbywgQ09TRSBhbGxvd3MgdGhlbSBm b3IgaGVhZGVycywgYWxnb3JpdGhtIG5hbWVzIGFuZCBzdWNoIHRvby4gU28gZnJvbSBhIHN5bnRh eCB2aWV3IENXVCBhbmQgQ09TRSBhcmUgdGhlIHNhbWUgYXMgSldUIGluIGFsbG93aW5nIGxvbmcg c3RyaW5nIG5hbWVzLg0KDQpIb3dldmVyLCBDT1NFIGFuZCBDV1QgYXJlIGRpZmZlcmVudCBpbiB0 aGUgbWFuYWdlbWVudCBvZiB0aGUgc3RyaW5nIG5hbWUgc3BhY2U6DQoNClN0cmluZ3Mgb2YgbGVu Z3RoIDEgICAgICAgICAgICBTdGFuZGFyZHMgQWN0aW9uDQpTdHJpbmdzIG9mIGxlbmd0aCAyICAg ICAgICAgICAgU3BlY2lmaWNhdGlvbiBSZXF1aXJlZA0KU3RyaW5ncyBvZiBsZW5ndGggZ3JlYXRl ciB0aGFuIDIgICAgRXhwZXJ0IFJldmlldw0KDQpUaGVzZSwgYWxvbmcgd2l0aCB0aGUgaW50ZWdl ciBuYW1lcyBzcGFjZSBydWxlcywgdGhlbiBpbXBseToNCg0KSW50ZWdlciB2YWx1ZXMgbGVzcyB0 aGFuIC02NTUzNiBhcmUgdGhlIG9ubHkgb25lcyBmcmVlIGZvciB1c2Ugd2l0aCBubyByZXZpZXcg b3IgcHJvY2Vzc2luZyBieSBJQU5BIGFuZCBleHBlcnRzLg0KDQpKV1QgYWxzbyBoYXMgdGhpcyBu b3Rpb24gb2YgQ29sbGlzaW9uLVJlc2lzdGFudCBOYW1lIGJhc2VkIG9uIE9JRHMgb3IgVVVJRHMs IHdoaWNoIGlzIGVzc2VudGlhbGx5IHNvbWUgcnVsZXMgdG8gbWFrZSB1cCBuYW1lcyB0aGF0IGRv buKAmXQgZ28gaW50byBhbiBJQU5BIHJlZ2lzdHJ5IGFuZCBhcmUgc3RpbGwgdW5pcXVlIGFuZCB3 b27igJl0IGNvbGxpZGUuDQoNCkpXVCBjb3VsZCBoYXZlIGRvbmUgd2hhdCBDV1QgZG9lcy4gU2Vl bXMgdG8gbWUgdGhhdCBDV1QgaGFzIHRha2VuIGEgcmFkaWNhbGx5IG1vcmUgbWFuYWdlZCBhcHBy b2FjaCB0byB0aGUgc3VwZXItb3BlbiBKV1QgYXBwcm9hY2guIE1heWJlIHRoZSBDV1QgZm9sa3Mg cmVhbGl6ZWQgdGhlIEpXVCBkZXNpZ24gd2FzIHBvb3IuDQoNCg0KQXQgYW55IHJhdGUsIHRoZXJl IHNlZW1zIHRvIGJlIHNvbWUgY29uc2Vuc3VzIGhlcmUgdGhhdCB0aGUgQ1dUIGFwcHJvYWNoIGlz IHdoYXQgd2Ugd2FudCBmb3IgYXR0ZXN0YXRpb24uIEl0IGlzIGFsc28gdGhlIG1vcmUgcmVjZW50 IGFuZCB0aHVzIG1heWJlIG1vcmUgYWR2YW5jZWQgdGhpbmtpbmcuDQoNCknigJltIGhvcGluZyB3 ZSBjYW4gZmluZCBvdXIgd2F5IHRvIGp1c3QgYWNjZXB0IHRoZSBDV1QgY2xhaW0gbmFtaW5nIG1h bmFnZW1lbnQgc2NoZW1lIGFzIGlzIGZvciBhdHRlc3RhdGlvbi4gSWYgb3RoZXIgQ1dULWJhc2Vk IGVmZm9ydHMgZGlkIHRoZSBzYW1lIChkcmFmdC1iaXJraG9sei1jb3JlLWNvaWQpIGRpZCB0aGUg c2FtZSB0aGVuIHRoZSB3b3JsZCB3b3VsZCBiZSBtdWNoIHNpbXBsZXIuDQoNCkhvd2V2ZXIgdGhh dCBzdGlsbCBsZWF2ZXMgb3BlbiBzb21lIGlzc3VlIHdpdGggSldUIG5hbWVzcGFjZSBtYW5hZ2Vt ZW50LiAoV2UgZG8gd2FudCBKU09OIGJhc2VkIGF0dGVzdGF0aW9uIHRvIGJlIEpXVOKAmXMsIHJp Z2h0PyBKdXN0IHRoZSBzYW1lIGFzIENCT1ItYmFzZWQgYXR0ZXN0YXRpb24gYXJlIENXVOKAmXMp Lg0KDQpMTA0KDQpJTVBPUlRBTlQgTk9USUNFOiBUaGUgY29udGVudHMgb2YgdGhpcyBlbWFpbCBh bmQgYW55IGF0dGFjaG1lbnRzIGFyZSBjb25maWRlbnRpYWwgYW5kIG1heSBhbHNvIGJlIHByaXZp bGVnZWQuIElmIHlvdSBhcmUgbm90IHRoZSBpbnRlbmRlZCByZWNpcGllbnQsIHBsZWFzZSBub3Rp ZnkgdGhlIHNlbmRlciBpbW1lZGlhdGVseSBhbmQgZG8gbm90IGRpc2Nsb3NlIHRoZSBjb250ZW50 cyB0byBhbnkgb3RoZXIgcGVyc29uLCB1c2UgaXQgZm9yIGFueSBwdXJwb3NlLCBvciBzdG9yZSBv ciBjb3B5IHRoZSBpbmZvcm1hdGlvbiBpbiBhbnkgbWVkaXVtLiBUaGFuayB5b3UuDQo= --_000_VI1PR08MB536061869B7BE623F861B821FA100VI1PR08MB5360eurp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkRlbmdYaWFuOw0KCXBhbm9zZS0xOjIgMSA2IDAgMyAxIDEgMSAx IDE7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJpOw0KCXBhbm9zZS0xOjIgMTUg NSAyIDIgMiA0IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IlxARGVuZ1hpYW4i Ow0KCXBhbm9zZS0xOjIgMSA2IDAgMyAxIDEgMSAxIDE7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZh bWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDExIDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHls ZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1h bA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEu MHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5N c29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4 dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9s bG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRl Y29yYXRpb246dW5kZXJsaW5lO30NCnAubXNvbm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1z b25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFs dDphdXRvOw0KCW1hcmdpbi1yaWdodDowY207DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87 DQoJbWFyZ2luLWxlZnQ6MGNtOw0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNh bGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5hcHBsZS10YWItc3Bhbg0KCXttc28tc3R5bGUtbmFt ZTphcHBsZS10YWItc3Bhbjt9DQpzcGFuLkVtYWlsU3R5bGUxOQ0KCXttc28tc3R5bGUtdHlwZTpw ZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMDAy MDYwO30NCnNwYW4uRW1haWxTdHlsZTIxDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0Kc3Bh bi5FbWFpbFN0eWxlMjINCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtY29tcG9zZTsNCglmb250 LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29D aHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4w cHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6NjEyLjBwdCA3OTIuMHB0Ow0KCW1hcmdp bjo3Mi4wcHQgNzIuMHB0IDcyLjBwdCA3Mi4wcHQ7fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdl OldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86 c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2Vu ZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVk aXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+ PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1HQiIgbGluaz0iYmx1 ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+RldJVzogV2hpbGUgdGhlIEpXVCByZWdpc3RyeSBsb29rcyBtb3JlIG1peGVk IGluIHRlcm1zIG9mIGNsYWltIHR5cGVzLiBUaGlzIGlzLCBob3dldmVyLCBvbmx5IGEgcmVzdWx0 IG9mIHRoZSB3aWRlc3ByZWFkIGFkb3B0aW9uLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+VGhlcmUgYXJlIG5vIHByb2JsZW1zLCBhcyBmYXIgYXMgSSBrbm93LCB3aXRoIHRo ZSBkaXZlcnNpdHkgb2YgdGhlIGNsYWltcyBhbmQgdGhhdCB0aGV5IGFyZSBub3QgYWxsIHVzZWZ1 bCBpbiBldmVyeSBjb250ZXh0LiBEaWZmZXJlbnQgZGVwbG95bWVudHMgdXNlIHRoZSBjbGFpbXMg dGhleSBmaW5kIHVzZWZ1bC4NCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIGFtIHdvbmRlcmlu ZyB3aGV0aGVyIHdlIGFyZSB0cnlpbmcgdG8gZml4IGEgcHJvYmxlbSB3aXRoIHRoZSByZWdpc3Ry eSBvZiBjbGFpbXMgdGhhdCBkb2VzbuKAmXQgb2NjdXIgaW4gcHJhY3RpY2UuDQo8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+Q2lhbzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ SGFubmVzPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlk ICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwY20gMGNtIDBjbSI+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48Yj48c3BhbiBsYW5nPSJFTi1VUyI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIGxhbmc9 IkVOLVVTIj4gUkFUUyAmbHQ7cmF0cy1ib3VuY2VzQGlldGYub3JnJmd0Ow0KPGI+T24gQmVoYWxm IE9mIDwvYj5NaWtlIEpvbmVzPGJyPg0KPGI+U2VudDo8L2I+IE1pdHR3b2NoLCA1LiBKdW5pIDIw MTkgMTk6MzE8YnI+DQo8Yj5Ubzo8L2I+IExhdXJlbmNlIEx1bmRibGFkZSAmbHQ7bGdsQGlzbGFu ZC1yZXNvcnQuY29tJmd0OzsgTWljaGFlbCBSaWNoYXJkc29uICZsdDttY3ImIzQzO2lldGZAc2Fu ZGVsbWFuLmNhJmd0Ozxicj4NCjxiPkNjOjwvYj4gcmF0c0BpZXRmLm9yZzxicj4NCjxiPlN1Ympl Y3Q6PC9iPiBSZTogW1JhdHNdIFZldHRpbmcgY2xhaW0gZGVmaW5pdGlvbnM8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5 bGU9ImNvbG9yOiMwMDIwNjAiPkFjdHVhbGx5LCBub3JtYWwgKG5vbi1jb2xsaXNpb24tcmVzaXN0 YW50KSBKV1QgY2xhaW1zICo8Yj5hcmU8L2I+KiBhbGxvY2F0ZWQgb24gYSBzcGVjaWZpY2F0aW9u IHJlcXVpcmVkIGJhc2lzIHdpdGggZXhwZXJ0IHJldmlldy4mbmJzcDsgU2VlIHRoaXMgdGV4dCBh dA0KPGEgaHJlZj0iaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzc1MTkjc2VjdGlvbi0x MC4xIj5odHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNzUxOSNzZWN0aW9uLTEwLjE8L2E+ OjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9 IkVOLVVTIiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LWZh bWlseTpDb25zb2xhcztjb2xvcjpibGFjaztiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDsmbmJzcDsg VmFsdWVzIGFyZSByZWdpc3RlcmVkIG9uIGEgU3BlY2lmaWNhdGlvbiBSZXF1aXJlZCBbPC9zcGFu PjxzcGFuIGxhbmc9IkVOLVVTIj48YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwv cmZjNTIyNiIgdGl0bGU9IiZxdW90O0d1aWRlbGluZXMgZm9yIFdyaXRpbmcgYW4gSUFOQSBDb25z aWRlcmF0aW9ucyBTZWN0aW9uIGluIFJGQ3MmcXVvdDsiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTAuMHB0O2ZvbnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOiMwMDY2Q0MiPlJGQzUyMjY8L3NwYW4+ PC9hPjwvc3Bhbj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtZmFtaWx5OkNvbnNvbGFz O2NvbG9yOmJsYWNrO2JhY2tncm91bmQ6d2hpdGUiPl0NCiBiYXNpczxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9u dC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6YmxhY2s7YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7Jm5i c3A7IGFmdGVyIGEgdGhyZWUtd2VlayByZXZpZXcgcGVyaW9kIG9uIHRoZQ0KPGEgaHJlZj0ibWFp bHRvOmp3dC1yZWctcmV2aWV3QGlldGYub3JnIj5qd3QtcmVnLXJldmlld0BpZXRmLm9yZzwvYT48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJF Ti1VUyIgc3R5bGU9ImZvbnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOmJsYWNrO2JhY2tncm91bmQ6 d2hpdGUiPiZuYnNwOyZuYnNwOyBtYWlsaW5nIGxpc3QsIG9uIHRoZSBhZHZpY2Ugb2Ygb25lIG9y IG1vcmUgRGVzaWduYXRlZCBFeHBlcnRzLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1mYW1pbHk6Q29uc29s YXM7Y29sb3I6YmxhY2s7YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7Jm5ic3A7IEhvd2V2ZXIsIHRv IGFsbG93IGZvciB0aGUgYWxsb2NhdGlvbiBvZiB2YWx1ZXMgcHJpb3IgdG8gcHVibGljYXRpb24s PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0i RU4tVVMiIHN0eWxlPSJmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjpibGFjaztiYWNrZ3JvdW5k OndoaXRlIj4mbmJzcDsmbmJzcDsgdGhlIERlc2lnbmF0ZWQgRXhwZXJ0cyBtYXkgYXBwcm92ZSBy ZWdpc3RyYXRpb24gb25jZSB0aGV5IGFyZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1mYW1pbHk6Q29uc29s YXM7Y29sb3I6YmxhY2s7YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7Jm5ic3A7IHNhdGlzZmllZCB0 aGF0IHN1Y2ggYSBzcGVjaWZpY2F0aW9uIHdpbGwgYmUgcHVibGlzaGVkLjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0i Y29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5TbyBhIHNw ZWNpZmljYXRpb24gY2FuIGVhc2lseSByZWdpc3RlciBib3RoIEpXVCBhbmQgQ1dUIGNsYWltcy48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJF Ti1VUyIgc3R5bGU9ImNvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iY29sb3I6IzAw MjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAtLSBNaWtlPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0 eWxlPSJjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0K PGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3Bh ZGRpbmc6My4wcHQgMGNtIDBjbSAwY20iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4g bGFuZz0iRU4tVVMiPkZyb206PC9zcGFuPjwvYj48c3BhbiBsYW5nPSJFTi1VUyI+IExhdXJlbmNl IEx1bmRibGFkZSAmbHQ7PGEgaHJlZj0ibWFpbHRvOmxnbEBpc2xhbmQtcmVzb3J0LmNvbSI+bGds QGlzbGFuZC1yZXNvcnQuY29tPC9hPiZndDsNCjxicj4NCjxiPlNlbnQ6PC9iPiBXZWRuZXNkYXks IEp1bmUgNSwgMjAxOSA4OjQ2IEFNPGJyPg0KPGI+VG86PC9iPiBNaWNoYWVsIFJpY2hhcmRzb24g Jmx0OzxhIGhyZWY9Im1haWx0bzptY3ImIzQzO2lldGZAc2FuZGVsbWFuLmNhIj5tY3ImIzQzO2ll dGZAc2FuZGVsbWFuLmNhPC9hPiZndDs8YnI+DQo8Yj5DYzo8L2I+IDxhIGhyZWY9Im1haWx0bzpy YXRzQGlldGYub3JnIj5yYXRzQGlldGYub3JnPC9hPjsgTWlrZSBKb25lcyAmbHQ7PGEgaHJlZj0i bWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSI+TWljaGFlbC5Kb25lc0BtaWNyb3Nv ZnQuY29tPC9hPiZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtSYXRzXSBWZXR0aW5nIGNs YWltIGRlZmluaXRpb25zPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyI+QmVsb3fi gKY8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gbGFuZz0iRU4tVVMiPiYjNDM7IE1pa2UgSm9uZXMsIGNvLWF1dGhvciBvZiBDV1Q8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1ib3R0b206MTIuMHB0Ij48c3BhbiBsYW5nPSJFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRv bTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMi Pk9uIEp1biA1LCAyMDE5LCBhdCA2OjA1IEFNLCBNaWNoYWVsIFJpY2hhcmRzb24gJmx0OzxhIGhy ZWY9Im1haWx0bzptY3ImIzQzO2lldGZAc2FuZGVsbWFuLmNhIj5tY3ImIzQzO2lldGZAc2FuZGVs bWFuLmNhPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWJvdHRvbToxMi4wcHQiPjxzcGFuIGxhbmc9IkVOLVVTIj48YnI+DQpMYXVyZW5jZSBMdW5kYmxh ZGUgJmx0OzxhIGhyZWY9Im1haWx0bzpsZ2xAaXNsYW5kLXJlc29ydC5jb20iPmxnbEBpc2xhbmQt cmVzb3J0LmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxibG9ja3F1 b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiPuKAlCBUb2RheSBDV1QgYWxsb2NhdGVz IG1pbGxpb25zIG9mIHNsb3RzIGZvciBleHBlcnQgcmV2aWV3LiBObzxicj4NCnNwZWNpZmljYXRp b24gaXMgcmVxdWlyZWQsIGJ1dCBzb21lIGluZm9ybWF0aW9uIHNob3VsZCBiZSBwcm92aWRlZC48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxzcGFuIGxhbmc9IkVOLVVTIj48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBw dDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9 IkVOLVVTIj5KV1QgZG9lc27igJl0IHNlZW0gdG8gaGF2ZSB0aGlzLCB3aGljaCBpcyBtYXliZSB3 aHkgaXQgaXMgbWVzc2llci4gSXQ8YnI+DQpraW5kIG9mIHNlZW1zIGJhZCBhbmQgd3JvbmcgdGhh dCBpdCBkb2VzbuKAmXQgdG8gbWUuPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9ibG9ja3F1b3Rl Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiPjxicj4NCkpXVCBkb2Vz bid0IGhhdmUgdGhpcyBiZWNhdXNlIHRoZSBjbGFpbXMgYXJlICZxdW90O3VubGltaXRlZCZxdW90 OyBsZW5ndGggc3RyaW5ncywgc288YnI+DQpvbmUgY2FuIGFsd2F5cyBtYWtlIHVwIGEgdW5pcXVl IHN0cmluZyBpbiBsaWV1IG9mIHJlZ2lzdHJhdGlvbi48YnI+DQombmJzcDtvcmcuaXNsYW5kLXJl c29ydC5sZ2wud2hhdGV2ZXJzdHJpbmd5b3V3YW50PGJyPg0KPGJyPg0KaXMgcHJvYmFibHkgY29t cGxldGVseSB5b3VycyA6LSk8YnI+DQpPZiBjb3Vyc2UsIGlmIHlvdSB3YW50IHRvIGludGVyb3Bl cmF0ZSB5b3UgbmVlZCB0byBhZ3JlZSBhYm91dCBob3csIHNvIHRoZXJlPGJyPg0KYXJlIHNvbWUg YWR2YW50YWdlcyBvZiBhIGZvcmNpbmcgZnVuY3Rpb24gdGhhdCBkZW1hbmRzIHlvdSB3cml0ZSB0 aGluZ3MgZG93bjxicj4NCmZpcnN0IDotKTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g bGFuZz0iRU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIj5VbmxpbWl0ZWQgbGVuZ3Ro IHN0cmluZyBjbGFpbSBuYW1lcyBhcmUgZnVsbHkgcGFydCBvZiBDV1QuIEFsc28sIENPU0UgYWxs b3dzIHRoZW0gZm9yIGhlYWRlcnMsIGFsZ29yaXRobSBuYW1lcyBhbmQgc3VjaCB0b28uIFNvIGZy b20gYSBzeW50YXggdmlldyBDV1QgYW5kIENPU0UgYXJlIHRoZSBzYW1lIGFzIEpXVCBpbiBhbGxv d2luZyBsb25nIHN0cmluZyBuYW1lcy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gbGFuZz0iRU4tVVMiPkhvd2V2ZXIsIENPU0UgYW5kIENXVCBhcmUgZGlmZmVyZW50IGluIHRo ZSBtYW5hZ2VtZW50IG9mIHRoZSBzdHJpbmcgbmFtZSBzcGFjZTo8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1V UyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxibG9ja3F1 b3RlIHN0eWxlPSJtYXJnaW4tbGVmdDozMC4wcHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmln aHQ6MGNtO21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyI+U3RyaW5ncyBvZiBsZW5ndGggMTxzcGFuIGNsYXNz PSJhcHBsZS10YWItc3BhbiI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+U3RhbmRhcmRzIEFjdGlvbjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIj5TdHJpbmdzIG9mIGxlbmd0aCAyPHNwYW4g Y2xhc3M9ImFwcGxlLXRhYi1zcGFuIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsNCjwvc3Bhbj5TcGVjaWZpY2F0aW9uIFJl cXVpcmVkPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiPlN0cmluZ3Mgb2YgbGVu Z3RoIGdyZWF0ZXIgdGhhbiAyPHNwYW4gY2xhc3M9ImFwcGxlLXRhYi1zcGFuIj4mbmJzcDsmbmJz cDsmbmJzcDsNCjwvc3Bhbj5FeHBlcnQgUmV2aWV3PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIj5UaGVz ZSwgYWxvbmcgd2l0aCB0aGUgaW50ZWdlciBuYW1lcyBzcGFjZSBydWxlcywgdGhlbiBpbXBseTo8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBsYW5nPSJFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tbGVmdDozMC4wcHQ7bWFyZ2luLXRv cDo1LjBwdDttYXJnaW4tcmlnaHQ6MGNtO21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyI+SW50ZWdlciB2YWx1 ZXMgbGVzcyB0aGFuIC02NTUzNiBhcmUgdGhlIG9ubHkgb25lcyBmcmVlIGZvciB1c2Ugd2l0aCBu byByZXZpZXcgb3IgcHJvY2Vzc2luZyBieSBJQU5BIGFuZCBleHBlcnRzLjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5n PSJFTi1VUyI+SldUIGFsc28gaGFzIHRoaXMgbm90aW9uIG9mJm5ic3A7Q29sbGlzaW9uLVJlc2lz dGFudCBOYW1lIGJhc2VkIG9uIE9JRHMgb3IgVVVJRHMsIHdoaWNoIGlzIGVzc2VudGlhbGx5IHNv bWUgcnVsZXMgdG8gbWFrZSB1cCBuYW1lcyB0aGF0IGRvbuKAmXQgZ28gaW50byBhbiBJQU5BIHJl Z2lzdHJ5IGFuZCBhcmUgc3RpbGwgdW5pcXVlIGFuZCB3b27igJl0IGNvbGxpZGUuPG86cD48L286 cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g bGFuZz0iRU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIj5KV1QgY291bGQgaGF2ZSBk b25lIHdoYXQgQ1dUIGRvZXMuIFNlZW1zIHRvIG1lIHRoYXQgQ1dUIGhhcyB0YWtlbiBhIHJhZGlj YWxseSBtb3JlIG1hbmFnZWQgYXBwcm9hY2ggdG8gdGhlIHN1cGVyLW9wZW4gSldUIGFwcHJvYWNo LiBNYXliZSB0aGUgQ1dUIGZvbGtzIHJlYWxpemVkIHRoZSBKV1QgZGVzaWduIHdhcyBwb29yLjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIGxhbmc9IkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gbGFuZz0iRU4tVVMiPkF0IGFueSByYXRlLCB0aGVyZSBzZWVtcyB0byBiZSBzb21lIGNv bnNlbnN1cyBoZXJlIHRoYXQgdGhlIENXVCBhcHByb2FjaCBpcyB3aGF0IHdlIHdhbnQgZm9yIGF0 dGVzdGF0aW9uLiBJdCBpcyBhbHNvIHRoZSBtb3JlIHJlY2VudCBhbmQgdGh1cyBtYXliZSBtb3Jl IGFkdmFuY2VkIHRoaW5raW5nLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBs YW5nPSJFTi1VUyI+SeKAmW0gaG9waW5nIHdlIGNhbiBmaW5kIG91ciB3YXkgdG8ganVzdCBhY2Nl cHQgdGhlIENXVCBjbGFpbSBuYW1pbmcgbWFuYWdlbWVudCBzY2hlbWUgYXMgaXMgZm9yIGF0dGVz dGF0aW9uLiBJZiBvdGhlciBDV1QtYmFzZWQgZWZmb3J0cyBkaWQgdGhlIHNhbWUgKGRyYWZ0LWJp cmtob2x6LWNvcmUtY29pZCkgZGlkIHRoZSBzYW1lIHRoZW4gdGhlIHdvcmxkIHdvdWxkIGJlIG11 Y2gNCiBzaW1wbGVyLiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBs YW5nPSJFTi1VUyI+SG93ZXZlciB0aGF0IHN0aWxsIGxlYXZlcyBvcGVuIHNvbWUgaXNzdWUgd2l0 aCBKV1QgbmFtZXNwYWNlIG1hbmFnZW1lbnQuIChXZSBkbyB3YW50IEpTT04gYmFzZWQgYXR0ZXN0 YXRpb24gdG8gYmUgSldU4oCZcywgcmlnaHQ/IEp1c3QgdGhlIHNhbWUgYXMgQ0JPUi1iYXNlZCBh dHRlc3RhdGlvbiBhcmUgQ1dU4oCZcykuPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIGxhbmc9IkVOLVVTIj5MTDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCklNUE9SVEFOVCBO T1RJQ0U6IFRoZSBjb250ZW50cyBvZiB0aGlzIGVtYWlsIGFuZCBhbnkgYXR0YWNobWVudHMgYXJl IGNvbmZpZGVudGlhbCBhbmQgbWF5IGFsc28gYmUgcHJpdmlsZWdlZC4gSWYgeW91IGFyZSBub3Qg dGhlIGludGVuZGVkIHJlY2lwaWVudCwgcGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyIGltbWVkaWF0 ZWx5IGFuZCBkbyBub3QgZGlzY2xvc2UgdGhlIGNvbnRlbnRzIHRvIGFueSBvdGhlciBwZXJzb24s IHVzZSBpdCBmb3IgYW55IHB1cnBvc2UsDQogb3Igc3RvcmUgb3IgY29weSB0aGUgaW5mb3JtYXRp b24gaW4gYW55IG1lZGl1bS4gVGhhbmsgeW91Lg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_VI1PR08MB536061869B7BE623F861B821FA100VI1PR08MB5360eurp_-- From nobody Fri Jun 7 09:00:52 2019 Return-Path: X-Original-To: rats@ietf.org Delivered-To: rats@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id F30A212025D; Fri, 7 Jun 2019 09:00:45 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IETF Meeting Session Request Tool To: Cc: rdd@cert.org, rats@ietf.org, Kathleen.Moriarty.ietf@gmail.com, rats-chairs@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.97.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <155992324598.19484.2796051057271629935.idtracker@ietfa.amsl.com> Date: Fri, 07 Jun 2019 09:00:45 -0700 Archived-At: Subject: [Rats] rats - New Meeting Session Request for IETF 105 X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Jun 2019 16:00:49 -0000 A new meeting session request has just been submitted by Kathleen Moriarty, a Chair of the rats working group. --------------------------------------------------------- Working Group Name: Remote ATtestation ProcedureS Area Name: Security Area Session Requester: Kathleen Moriarty Number of Sessions: 2 Length of Session(s): 1.5 Hours, 1.5 Hours Number of Attendees: 40 Conflicts to Avoid: First Priority: SecDispatch, SAAG, mile, acme, tls, SACM, TEEP, SUIT, NetConf People who must be present: Ned Smith Kathleen Moriarty Nancy Cam-Winget Roman Danyliw Resources Requested: Special Requests: If 2 sessions at 1.5 hours is not possible, 1 session at 2.5 hours is the minimum we'll need to sort through items unless the interim goes swimmingly. --------------------------------------------------------- From nobody Fri Jun 7 10:15:19 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E26FB120229 for ; Fri, 7 Jun 2019 10:15:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.499 X-Spam-Level: X-Spam-Status: No, score=-14.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=O2gqRHMI; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=bVHtZUBW Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5yTW2Ru_0GZ8 for ; Fri, 7 Jun 2019 10:15:06 -0700 (PDT) Received: from alln-iport-3.cisco.com (alln-iport-3.cisco.com [173.37.142.90]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3D362120260 for ; Fri, 7 Jun 2019 10:15:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=30274; q=dns/txt; s=iport; t=1559927706; x=1561137306; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=rS1K0Q9fSet3BezTvqiaJrJnguQcSxut6wlMVTyb33c=; b=O2gqRHMIwkew7X+4mRyKdQ/YXUqt/k089MzB3XT6wyYk2JabsRelM90D bk95fmhQ5Iyi5S/8XEvMRyftfEvcWyE4bR0X6++G3bSBy0G9e9VjMc5NP FlfZRsLGG4lUQXFDTHcZpCokSvCd5ddPL5VPvJVTi6NTXv62x2UEBWtoU k=; IronPort-PHdr: =?us-ascii?q?9a23=3AoCEDJBJ60wPyNGyjGtmcpTVXNCE6p7X5OBIU4Z?= =?us-ascii?q?M7irVIN76u5InmIFeCtad2lFGcW4Ld5roEkOfQv636EU04qZea+DFnEtRXUg?= =?us-ascii?q?Mdz8AfngguGsmAXEDlK//2Ryc7B89FElRi+iLzPA=3D=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AdAAA0m/pc/4kNJK1mGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAQGBVAEBAQEBAQsBgQ4vKScDalUgBAsoCoQLg0cDjmGCV5c?= =?us-ascii?q?xgUKBEANUCQEBAQwBASMKAgEBhEACF4JTIzcGDgEDAQEEAQECAQRtHAyFSgE?= =?us-ascii?q?BAQEDEhEKEwEBKQMCAgcBDwIBCBEEAQEhBwMCAgIwFAkIAgQBDQUIFwODAYE?= =?us-ascii?q?dTQMdAQIMnGECgTiIX3GBMYJ5AQEFhQYYgg8DBoE0AYo8gR4XgUA/JmtGgkw?= =?us-ascii?q?+gmEBAQIBgSsBDAYBIQwfCQKCUjKCJos/SwOCGIRsIpULagkCgg6GQ4hFhFS?= =?us-ascii?q?CJC+GSY11jQ+HE48jAgQCBAUCDgEBBYFlImdxcBU7gmyCDwsBF4ECAQKCSIU?= =?us-ascii?q?UhT9yAYEojDsBDRcHgQQBgSABAQ?= X-IronPort-AV: E=Sophos;i="5.63,563,1557187200"; d="scan'208,217";a="287752026" Received: from alln-core-4.cisco.com ([173.36.13.137]) by alln-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 07 Jun 2019 17:14:57 +0000 Received: from XCH-ALN-006.cisco.com (xch-aln-006.cisco.com [173.36.7.16]) by alln-core-4.cisco.com (8.15.2/8.15.2) with ESMTPS id x57HEvHE023920 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 7 Jun 2019 17:14:57 GMT Received: from xhs-rcd-002.cisco.com (173.37.227.247) by XCH-ALN-006.cisco.com (173.36.7.16) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 7 Jun 2019 12:14:56 -0500 Received: from xhs-rcd-002.cisco.com (173.37.227.247) by xhs-rcd-002.cisco.com (173.37.227.247) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 7 Jun 2019 12:14:56 -0500 Received: from NAM02-BL2-obe.outbound.protection.outlook.com (72.163.14.9) by xhs-rcd-002.cisco.com (173.37.227.247) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Fri, 7 Jun 2019 12:14:56 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=rS1K0Q9fSet3BezTvqiaJrJnguQcSxut6wlMVTyb33c=; b=bVHtZUBW4WqjQ4DkRkm0I+XZ7lpdgmBO6B6yJpG4kgqAcPZwR5kVfz/oUQQIJEv62ibhrVzCWH3naHyYkfcN2Y2gYhhZOxvsgCjfQmp8idqz5APZDd+gDkT7NdI+XKUqcuKvCKlFTf/k5nErNh112GhHhxZoWgwGGn9Rw+aFY1M= Received: from DM6PR11MB4089.namprd11.prod.outlook.com (20.176.126.30) by DM6PR11MB3356.namprd11.prod.outlook.com (20.176.122.154) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1965.14; Fri, 7 Jun 2019 17:14:55 +0000 Received: from DM6PR11MB4089.namprd11.prod.outlook.com ([fe80::d014:d7a3:270:e5a9]) by DM6PR11MB4089.namprd11.prod.outlook.com ([fe80::d014:d7a3:270:e5a9%3]) with mapi id 15.20.1965.011; Fri, 7 Jun 2019 17:14:54 +0000 From: "Eric Voit (evoit)" To: Hannes Tschofenig , Mike Jones , Laurence Lundblade , Michael Richardson CC: "rats@ietf.org" Thread-Topic: [Rats] Vetting claim definitions Thread-Index: AQHVHSQrNP3gSrcbuEuedIL4RWxi86aQLzAw Date: Fri, 7 Jun 2019 17:14:54 +0000 Message-ID: References: <12913.1559739926@localhost> <30754CD8-98AB-4080-952E-880BC630EC69@island-resort.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=evoit@cisco.com; x-originating-ip: [173.38.117.68] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 212d6944-5929-463d-fe5f-08d6eb6ba910 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:DM6PR11MB3356; x-ms-traffictypediagnostic: DM6PR11MB3356: x-ms-exchange-purlcount: 4 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 0061C35778 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39860400002)(396003)(136003)(376002)(346002)(366004)(124014002)(199004)(189003)(40434004)(7736002)(14444005)(64756008)(66446008)(966005)(256004)(5024004)(66476007)(33656002)(236005)(316002)(110136005)(74316002)(9326002)(71190400001)(86362001)(5660300002)(45080400002)(3846002)(790700001)(52536014)(6116002)(2906002)(71200400001)(73956011)(76116006)(66946007)(66066001)(76176011)(6306002)(4326008)(9686003)(66556008)(606006)(25786009)(53936002)(55016002)(8936002)(229853002)(14454004)(81156014)(81166006)(8676002)(478600001)(53546011)(6506007)(11346002)(186003)(486006)(26005)(99286004)(102836004)(7696005)(68736007)(446003)(476003)(54896002)(6436002)(6246003); DIR:OUT; SFP:1101; SCL:1; SRVR:DM6PR11MB3356; H:DM6PR11MB4089.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 7vwQd1CM72JqqsjFTdYIq8CdRH3OSC//yRORLor9TIQwYm08YgrVD7bGV9k2rcRvU3KtFEAR04LZd1RC+YJ35+aeBuNVckZUy0Krmy8mNlCjqLC0I91pZrGyVQKU2A5sOD6k0TlUqKBC3qVS5x2h7ikMPaAtZjVCVk0A98hJxOBUDdUKjnAhmNpb1B95VroL+W/Ec3mL3x1akHmwQsQ4fi5nnxdhEm8RD67mQ8YP2r1t+u5S1TGutIS7+09k2O1e2PfJ/tJ2KDcIM3tNb0sGQJeBkBXa7aepU/Gv+bh+yLGcPsJgw6uO96Xha8bBjb1VKzevmhs7O322kyTIw9rHHN8PmqXwy+DLyLIIUY6HS3DdSJ4RPupQxLU5XqRzfebhvwLCwgmgJBGSyJ2tA3FP8Sr6cgTVygh1cZDlNikpNCY= Content-Type: multipart/alternative; boundary="_000_DM6PR11MB408908B0F071051FEC0B090BA1100DM6PR11MB4089namp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 212d6944-5929-463d-fe5f-08d6eb6ba910 X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Jun 2019 17:14:54.8515 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: evoit@cisco.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR11MB3356 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.36.7.16, xch-aln-006.cisco.com X-Outbound-Node: alln-core-4.cisco.com Archived-At: Subject: Re: [Rats] Vetting claim definitions X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Jun 2019 17:15:18 -0000 --_000_DM6PR11MB408908B0F071051FEC0B090BA1100DM6PR11MB4089namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgSGFubmVzLA0KDQpJZiB3ZSB3ZXJlIHN1cmUgd2UgY291bGQgbGltaXQgRUFUIGNsYWltcyB0 byBqdXN0IGEgZmV3IHRoaW5ncyB3aGljaCBjb21lIG91dCBvZiBoYXJkd2FyZSwgdGhpcyB3b3Vs ZG4ndCBjb25jZXJuIG1lIGFzIG11Y2ggYXMgaXQgZG9lcy4gIEhvd2V2ZXIgdGhlIGRvbWFpbiBv ZiBhdHRlc3RhYmxlIG9iamVjdHMgd2FzIGxlZnQgZmFpcmx5IG9wZW4gd2l0aGluIHRoZSBFQVQg ZHJhZnQuICAgQW5kIHdlIG5lZWQgdG8gZGV0ZXJtaW5lIHdoYXQgbGV2ZWwgb2YgaW50ZXJvcGVy YWJpbGl0eSBhcmUgd2UgdHJ5aW5nIHRvIHNoZXBoZXJkIHZpYSBSQVRTLg0KDQpJbiB0aGUgZW5k LCBSQVRTIChhbmQgRUFUKSBuZWVkIHRvIGRldGVybWluZSB0aGUgbGV2ZWwgb2YgaW50ZXJvcGVy YWJpbGl0eSBkZXNpcmVkIGZvciBzcGVjaWZpYyBjbGFpbXMuICAgSSBkb24ndCBjbGFpbSBkZWVw IGZhbWlsaWFyaXR5IHdpdGggSldULiAgQnV0IGxvb2tpbmcgYXQgUkZDLTc1MTksIFNlY3Rpb24g NC4xLCBJIHNlZSB0aGF0IEkgd291bGQgaGF2ZSBxdWVzdGlvbnMgYXMgYW4gaW1wbGVtZW50ZXIu ICBGb3IgZXhhbXBsZSwgdGhlIGNsYWltcyAiaXNzIiwgInN1YiIsIGFuZCAiYXVkIiBsb29rIHRv IGhhdmUgcG9wdWxhdGlvbi9wcm9jZXNzaW5nIHdoaWNoIGlzIGFwcGxpY2F0aW9uIHNwZWNpZmlj LiAgVGhlcmVmb3JlIHdpdGggdGhlc2UgY2xhaW1zLCBpdCBpcyB1cCB0byBhcHBsaWNhdGlvbnMg b24gZWl0aGVyIHNpZGUgb2YgdGhlIEpXVCBtdXN0IGNvbWUgdG8gYW4gYWdyZWVtZW50IG9uIHdo YXQgdGhlIHBvcHVsYXRlZCBpbnN0YW5jZXMgbWVhbi4gIChJLmUuLCBub3QgdGhlIFdHLikNCg0K Q29tbW9uIG9mIG9iamVjdCBkZWZpbml0aW9ucy9jbGFpbXMgZnJvbSBpbnRlcm5hbCBoYXJkd2Fy ZSBhcmUgaW1wb3J0YW50IGlmIHRoZSBOZXR3b3JrIEVsZW1lbnQgbmVlZHMgdG8gYWN0IG9uIHNw ZWNpZmljIHZhbHVlcy4gIEFuZCBhcyBhIHZlbmRvciwgSSBrbm93IHRoYXQgSSBkbyB3YW50IHRv IGFjdCBvbiBpbmZvcm1hdGlvbiBjb21pbmcgb3V0IG9mIGhhcmR3YXJlIGV2ZW4gaWYgdGhlIGlu Zm9ybWF0aW9uIGlzIGJlaW5nIHB1c2hlZCB0byBhIHJlbW90ZSB2YWxpZGF0b3IgKGUuZy4sIGlt bWVkaWF0ZWx5IHB1c2ggYW4gRUFUIHRva2VuIGRvd25zdHJlYW0gaWYgYSBzcGVjaWZpYyBoYXNo IHZhbHVlIGNoYW5nZXMpLiAgQXMgYSByZXN1bHQgSSB3YW50IG1vcmUgZXhwbGljaXQgYW5kIHN0 YWJsZSBjbGFpbSBkZWZpbml0aW9ucy4NCg0KTW9yZSBoaWdobHkgc3BlY2lmaWVkIGNsYWltcyBv ZiBjb3Vyc2UgZXhwb3NlcyBwb3NzaWJsZSBjbGFpbSByZWR1bmRhbmN5LCBmb3JlaWduIGtleSBy ZWxhdGlvbnNoaXBzLCBhbmQgY3Jvc3MtbWFwcGluZyB3aXRoIGRvd25zdHJlYW0gaW5mb3JtYXRp b24gbW9kZWxzLiBJIGFzc2VydCB0aGlzIGlzIGEgZ29vZCB0aGluZyBiZWNhdXNlIHdlIGV4cG9z ZSAoYW5kIGhvcGVmdWxseSBtaW5pbWl6ZSkgY29zdHMgd2hpY2ggYXJlIGJvcm5lIGJ5IGRvd25z dHJlYW0gZGV2ZWxvcGVycy4NCg0KRXJpYw0KDQpIYW5uZXMgVHNjaG9mZW5pZywgSnVuZSA3LCAy MDE5IDc6MjkgQU0NCg0KRldJVzogV2hpbGUgdGhlIEpXVCByZWdpc3RyeSBsb29rcyBtb3JlIG1p eGVkIGluIHRlcm1zIG9mIGNsYWltIHR5cGVzLiBUaGlzIGlzLCBob3dldmVyLCBvbmx5IGEgcmVz dWx0IG9mIHRoZSB3aWRlc3ByZWFkIGFkb3B0aW9uLg0KVGhlcmUgYXJlIG5vIHByb2JsZW1zLCBh cyBmYXIgYXMgSSBrbm93LCB3aXRoIHRoZSBkaXZlcnNpdHkgb2YgdGhlIGNsYWltcyBhbmQgdGhh dCB0aGV5IGFyZSBub3QgYWxsIHVzZWZ1bCBpbiBldmVyeSBjb250ZXh0LiBEaWZmZXJlbnQgZGVw bG95bWVudHMgdXNlIHRoZSBjbGFpbXMgdGhleSBmaW5kIHVzZWZ1bC4NCg0KSSBhbSB3b25kZXJp bmcgd2hldGhlciB3ZSBhcmUgdHJ5aW5nIHRvIGZpeCBhIHByb2JsZW0gd2l0aCB0aGUgcmVnaXN0 cnkgb2YgY2xhaW1zIHRoYXQgZG9lc27igJl0IG9jY3VyIGluIHByYWN0aWNlLg0KDQpDaWFvDQpI YW5uZXMNCg0KRnJvbTogUkFUUyA8cmF0cy1ib3VuY2VzQGlldGYub3JnPG1haWx0bzpyYXRzLWJv dW5jZXNAaWV0Zi5vcmc+PiBPbiBCZWhhbGYgT2YgTWlrZSBKb25lcw0KU2VudDogTWl0dHdvY2gs IDUuIEp1bmkgMjAxOSAxOTozMQ0KVG86IExhdXJlbmNlIEx1bmRibGFkZSA8bGdsQGlzbGFuZC1y ZXNvcnQuY29tPG1haWx0bzpsZ2xAaXNsYW5kLXJlc29ydC5jb20+PjsgTWljaGFlbCBSaWNoYXJk c29uIDxtY3IraWV0ZkBzYW5kZWxtYW4uY2E8bWFpbHRvOm1jcitpZXRmQHNhbmRlbG1hbi5jYT4+ DQpDYzogcmF0c0BpZXRmLm9yZzxtYWlsdG86cmF0c0BpZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBb UmF0c10gVmV0dGluZyBjbGFpbSBkZWZpbml0aW9ucw0KDQpBY3R1YWxseSwgbm9ybWFsIChub24t Y29sbGlzaW9uLXJlc2lzdGFudCkgSldUIGNsYWltcyAqYXJlKiBhbGxvY2F0ZWQgb24gYSBzcGVj aWZpY2F0aW9uIHJlcXVpcmVkIGJhc2lzIHdpdGggZXhwZXJ0IHJldmlldy4gIFNlZSB0aGlzIHRl eHQgYXQgaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzc1MTkjc2VjdGlvbi0xMC4xOg0K DQogICBWYWx1ZXMgYXJlIHJlZ2lzdGVyZWQgb24gYSBTcGVjaWZpY2F0aW9uIFJlcXVpcmVkIFtS RkM1MjI2PGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM1MjI2Pl0gYmFzaXMNCiAgIGFm dGVyIGEgdGhyZWUtd2VlayByZXZpZXcgcGVyaW9kIG9uIHRoZSBqd3QtcmVnLXJldmlld0BpZXRm Lm9yZzxtYWlsdG86and0LXJlZy1yZXZpZXdAaWV0Zi5vcmc+DQogICBtYWlsaW5nIGxpc3QsIG9u IHRoZSBhZHZpY2Ugb2Ygb25lIG9yIG1vcmUgRGVzaWduYXRlZCBFeHBlcnRzLg0KICAgSG93ZXZl ciwgdG8gYWxsb3cgZm9yIHRoZSBhbGxvY2F0aW9uIG9mIHZhbHVlcyBwcmlvciB0byBwdWJsaWNh dGlvbiwNCiAgIHRoZSBEZXNpZ25hdGVkIEV4cGVydHMgbWF5IGFwcHJvdmUgcmVnaXN0cmF0aW9u IG9uY2UgdGhleSBhcmUNCiAgIHNhdGlzZmllZCB0aGF0IHN1Y2ggYSBzcGVjaWZpY2F0aW9uIHdp bGwgYmUgcHVibGlzaGVkLg0KDQpTbyBhIHNwZWNpZmljYXRpb24gY2FuIGVhc2lseSByZWdpc3Rl ciBib3RoIEpXVCBhbmQgQ1dUIGNsYWltcy4NCg0KICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIC0tIE1pa2UNCg0KRnJvbTogTGF1cmVuY2UgTHVu ZGJsYWRlIDxsZ2xAaXNsYW5kLXJlc29ydC5jb208bWFpbHRvOmxnbEBpc2xhbmQtcmVzb3J0LmNv bT4+DQpTZW50OiBXZWRuZXNkYXksIEp1bmUgNSwgMjAxOSA4OjQ2IEFNDQpUbzogTWljaGFlbCBS aWNoYXJkc29uIDxtY3IraWV0ZkBzYW5kZWxtYW4uY2E8bWFpbHRvOm1jcitpZXRmQHNhbmRlbG1h bi5jYT4+DQpDYzogcmF0c0BpZXRmLm9yZzxtYWlsdG86cmF0c0BpZXRmLm9yZz47IE1pa2UgSm9u ZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNy b3NvZnQuY29tPj4NClN1YmplY3Q6IFJlOiBbUmF0c10gVmV0dGluZyBjbGFpbSBkZWZpbml0aW9u cw0KDQpCZWxvd+KApg0KKyBNaWtlIEpvbmVzLCBjby1hdXRob3Igb2YgQ1dUDQoNCk9uIEp1biA1 LCAyMDE5LCBhdCA2OjA1IEFNLCBNaWNoYWVsIFJpY2hhcmRzb24gPG1jcitpZXRmQHNhbmRlbG1h bi5jYTxtYWlsdG86bWNyK2lldGZAc2FuZGVsbWFuLmNhPj4gd3JvdGU6DQoNCg0KTGF1cmVuY2Ug THVuZGJsYWRlIDxsZ2xAaXNsYW5kLXJlc29ydC5jb208bWFpbHRvOmxnbEBpc2xhbmQtcmVzb3J0 LmNvbT4+IHdyb3RlOg0K4oCUIFRvZGF5IENXVCBhbGxvY2F0ZXMgbWlsbGlvbnMgb2Ygc2xvdHMg Zm9yIGV4cGVydCByZXZpZXcuIE5vDQpzcGVjaWZpY2F0aW9uIGlzIHJlcXVpcmVkLCBidXQgc29t ZSBpbmZvcm1hdGlvbiBzaG91bGQgYmUgcHJvdmlkZWQuDQoNCkpXVCBkb2VzbuKAmXQgc2VlbSB0 byBoYXZlIHRoaXMsIHdoaWNoIGlzIG1heWJlIHdoeSBpdCBpcyBtZXNzaWVyLiBJdA0Ka2luZCBv ZiBzZWVtcyBiYWQgYW5kIHdyb25nIHRoYXQgaXQgZG9lc27igJl0IHRvIG1lLg0KDQpKV1QgZG9l c24ndCBoYXZlIHRoaXMgYmVjYXVzZSB0aGUgY2xhaW1zIGFyZSAidW5saW1pdGVkIiBsZW5ndGgg c3RyaW5ncywgc28NCm9uZSBjYW4gYWx3YXlzIG1ha2UgdXAgYSB1bmlxdWUgc3RyaW5nIGluIGxp ZXUgb2YgcmVnaXN0cmF0aW9uLg0KIG9yZy5pc2xhbmQtcmVzb3J0LmxnbC53aGF0ZXZlcnN0cmlu Z3lvdXdhbnQNCg0KaXMgcHJvYmFibHkgY29tcGxldGVseSB5b3VycyA6LSkNCk9mIGNvdXJzZSwg aWYgeW91IHdhbnQgdG8gaW50ZXJvcGVyYXRlIHlvdSBuZWVkIHRvIGFncmVlIGFib3V0IGhvdywg c28gdGhlcmUNCmFyZSBzb21lIGFkdmFudGFnZXMgb2YgYSBmb3JjaW5nIGZ1bmN0aW9uIHRoYXQg ZGVtYW5kcyB5b3Ugd3JpdGUgdGhpbmdzIGRvd24NCmZpcnN0IDotKQ0KDQpVbmxpbWl0ZWQgbGVu Z3RoIHN0cmluZyBjbGFpbSBuYW1lcyBhcmUgZnVsbHkgcGFydCBvZiBDV1QuIEFsc28sIENPU0Ug YWxsb3dzIHRoZW0gZm9yIGhlYWRlcnMsIGFsZ29yaXRobSBuYW1lcyBhbmQgc3VjaCB0b28uIFNv IGZyb20gYSBzeW50YXggdmlldyBDV1QgYW5kIENPU0UgYXJlIHRoZSBzYW1lIGFzIEpXVCBpbiBh bGxvd2luZyBsb25nIHN0cmluZyBuYW1lcy4NCg0KSG93ZXZlciwgQ09TRSBhbmQgQ1dUIGFyZSBk aWZmZXJlbnQgaW4gdGhlIG1hbmFnZW1lbnQgb2YgdGhlIHN0cmluZyBuYW1lIHNwYWNlOg0KDQpT dHJpbmdzIG9mIGxlbmd0aCAxICAgICAgICAgICAgU3RhbmRhcmRzIEFjdGlvbg0KU3RyaW5ncyBv ZiBsZW5ndGggMiAgICAgICAgICAgIFNwZWNpZmljYXRpb24gUmVxdWlyZWQNClN0cmluZ3Mgb2Yg bGVuZ3RoIGdyZWF0ZXIgdGhhbiAyICAgIEV4cGVydCBSZXZpZXcNCg0KVGhlc2UsIGFsb25nIHdp dGggdGhlIGludGVnZXIgbmFtZXMgc3BhY2UgcnVsZXMsIHRoZW4gaW1wbHk6DQoNCkludGVnZXIg dmFsdWVzIGxlc3MgdGhhbiAtNjU1MzYgYXJlIHRoZSBvbmx5IG9uZXMgZnJlZSBmb3IgdXNlIHdp dGggbm8gcmV2aWV3IG9yIHByb2Nlc3NpbmcgYnkgSUFOQSBhbmQgZXhwZXJ0cy4NCg0KSldUIGFs c28gaGFzIHRoaXMgbm90aW9uIG9mIENvbGxpc2lvbi1SZXNpc3RhbnQgTmFtZSBiYXNlZCBvbiBP SURzIG9yIFVVSURzLCB3aGljaCBpcyBlc3NlbnRpYWxseSBzb21lIHJ1bGVzIHRvIG1ha2UgdXAg bmFtZXMgdGhhdCBkb27igJl0IGdvIGludG8gYW4gSUFOQSByZWdpc3RyeSBhbmQgYXJlIHN0aWxs IHVuaXF1ZSBhbmQgd29u4oCZdCBjb2xsaWRlLg0KDQpKV1QgY291bGQgaGF2ZSBkb25lIHdoYXQg Q1dUIGRvZXMuIFNlZW1zIHRvIG1lIHRoYXQgQ1dUIGhhcyB0YWtlbiBhIHJhZGljYWxseSBtb3Jl IG1hbmFnZWQgYXBwcm9hY2ggdG8gdGhlIHN1cGVyLW9wZW4gSldUIGFwcHJvYWNoLiBNYXliZSB0 aGUgQ1dUIGZvbGtzIHJlYWxpemVkIHRoZSBKV1QgZGVzaWduIHdhcyBwb29yLg0KDQoNCkF0IGFu eSByYXRlLCB0aGVyZSBzZWVtcyB0byBiZSBzb21lIGNvbnNlbnN1cyBoZXJlIHRoYXQgdGhlIENX VCBhcHByb2FjaCBpcyB3aGF0IHdlIHdhbnQgZm9yIGF0dGVzdGF0aW9uLiBJdCBpcyBhbHNvIHRo ZSBtb3JlIHJlY2VudCBhbmQgdGh1cyBtYXliZSBtb3JlIGFkdmFuY2VkIHRoaW5raW5nLg0KDQpJ 4oCZbSBob3Bpbmcgd2UgY2FuIGZpbmQgb3VyIHdheSB0byBqdXN0IGFjY2VwdCB0aGUgQ1dUIGNs YWltIG5hbWluZyBtYW5hZ2VtZW50IHNjaGVtZSBhcyBpcyBmb3IgYXR0ZXN0YXRpb24uIElmIG90 aGVyIENXVC1iYXNlZCBlZmZvcnRzIGRpZCB0aGUgc2FtZSAoZHJhZnQtYmlya2hvbHotY29yZS1j b2lkKSBkaWQgdGhlIHNhbWUgdGhlbiB0aGUgd29ybGQgd291bGQgYmUgbXVjaCBzaW1wbGVyLg0K DQpIb3dldmVyIHRoYXQgc3RpbGwgbGVhdmVzIG9wZW4gc29tZSBpc3N1ZSB3aXRoIEpXVCBuYW1l c3BhY2UgbWFuYWdlbWVudC4gKFdlIGRvIHdhbnQgSlNPTiBiYXNlZCBhdHRlc3RhdGlvbiB0byBi ZSBKV1TigJlzLCByaWdodD8gSnVzdCB0aGUgc2FtZSBhcyBDQk9SLWJhc2VkIGF0dGVzdGF0aW9u IGFyZSBDV1TigJlzKS4NCg0KTEwNCg0KSU1QT1JUQU5UIE5PVElDRTogVGhlIGNvbnRlbnRzIG9m IHRoaXMgZW1haWwgYW5kIGFueSBhdHRhY2htZW50cyBhcmUgY29uZmlkZW50aWFsIGFuZCBtYXkg YWxzbyBiZSBwcml2aWxlZ2VkLiBJZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQgcmVjaXBpZW50 LCBwbGVhc2Ugbm90aWZ5IHRoZSBzZW5kZXIgaW1tZWRpYXRlbHkgYW5kIGRvIG5vdCBkaXNjbG9z ZSB0aGUgY29udGVudHMgdG8gYW55IG90aGVyIHBlcnNvbiwgdXNlIGl0IGZvciBhbnkgcHVycG9z ZSwgb3Igc3RvcmUgb3IgY29weSB0aGUgaW5mb3JtYXRpb24gaW4gYW55IG1lZGl1bS4gVGhhbmsg eW91Lg0K --_000_DM6PR11MB408908B0F071051FEC0B090BA1100DM6PR11MB4089namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDEx IDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZp c2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5 Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAubXNvbm9y bWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6bXNv bm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJ bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6 ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5hcHBs ZS10YWItc3Bhbg0KCXttc28tc3R5bGUtbmFtZTphcHBsZS10YWItc3Bhbjt9DQpzcGFuLkVtYWls U3R5bGUxOQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJy aSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMDAyMDYwO30NCnNwYW4uRW1haWxTdHlsZTIwDQoJe21z by1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlm Ow0KCWNvbG9yOndpbmRvd3RleHQ7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjENCgl7bXNvLXN0eWxlLXR5 cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6 d2luZG93dGV4dDt9DQpzcGFuLkVtYWlsU3R5bGUyMw0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25h bDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0 O30NCnNwYW4uRW1haWxTdHlsZTI0DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLWNvbXBvc2U7 DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9 DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNp emU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCglt YXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdl OldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86 c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2Vu ZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVk aXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+ PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1 ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+SGkgSGFubmVzLDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JZiB3ZSB3ZXJl IHN1cmUgd2UgY291bGQgbGltaXQgRUFUIGNsYWltcyB0byBqdXN0IGEgZmV3IHRoaW5ncyB3aGlj aCBjb21lIG91dCBvZiBoYXJkd2FyZSwgdGhpcyB3b3VsZG4ndCBjb25jZXJuIG1lIGFzIG11Y2gg YXMgaXQgZG9lcy4mbmJzcDsgSG93ZXZlciB0aGUgZG9tYWluIG9mIGF0dGVzdGFibGUgb2JqZWN0 cyB3YXMgbGVmdCBmYWlybHkgb3BlbiB3aXRoaW4gdGhlIEVBVCBkcmFmdC4mbmJzcDsgJm5ic3A7 QW5kIHdlIG5lZWQgdG8NCiBkZXRlcm1pbmUgd2hhdCBsZXZlbCBvZiBpbnRlcm9wZXJhYmlsaXR5 IGFyZSB3ZSB0cnlpbmcgdG8gc2hlcGhlcmQgdmlhIFJBVFMuPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPkluIHRoZSBlbmQsIFJBVFMgKGFuZCBFQVQpIG5lZWQgdG8gZGV0ZXJtaW5lIHRoZSBsZXZl bCBvZiBpbnRlcm9wZXJhYmlsaXR5IGRlc2lyZWQgZm9yIHNwZWNpZmljIGNsYWltcy4mbmJzcDsm bmJzcDsgSSBkb24ndCBjbGFpbSBkZWVwIGZhbWlsaWFyaXR5IHdpdGggSldULiZuYnNwOyBCdXQg bG9va2luZyBhdCBSRkMtNzUxOSwgU2VjdGlvbiA0LjEsIEkgc2VlIHRoYXQgSSB3b3VsZCBoYXZl IHF1ZXN0aW9ucyBhcyBhbiBpbXBsZW1lbnRlci4mbmJzcDsNCiBGb3IgZXhhbXBsZSwgdGhlIGNs YWltcyAmcXVvdDtpc3MmcXVvdDssICZxdW90O3N1YiZxdW90OywgYW5kICZxdW90O2F1ZCZxdW90 OyBsb29rIHRvIGhhdmUgcG9wdWxhdGlvbi9wcm9jZXNzaW5nIHdoaWNoIGlzIGFwcGxpY2F0aW9u IHNwZWNpZmljLiZuYnNwOyBUaGVyZWZvcmUgd2l0aCB0aGVzZSBjbGFpbXMsIGl0IGlzIHVwIHRv IGFwcGxpY2F0aW9ucyBvbiBlaXRoZXIgc2lkZSBvZiB0aGUgSldUIG11c3QgY29tZSB0byBhbiBh Z3JlZW1lbnQgb24gd2hhdCB0aGUgcG9wdWxhdGVkIGluc3RhbmNlcyBtZWFuLiZuYnNwOw0KIChJ LmUuLCBub3QgdGhlIFdHLikmbmJzcDsmbmJzcDsgPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkNv bW1vbiBvZiBvYmplY3QgZGVmaW5pdGlvbnMvY2xhaW1zIGZyb20gaW50ZXJuYWwgaGFyZHdhcmUg YXJlIGltcG9ydGFudCBpZiB0aGUgTmV0d29yayBFbGVtZW50IG5lZWRzIHRvIGFjdCBvbiBzcGVj aWZpYyB2YWx1ZXMuJm5ic3A7IEFuZCBhcyBhIHZlbmRvciwgSSBrbm93IHRoYXQgSSBkbyB3YW50 IHRvIGFjdCBvbiBpbmZvcm1hdGlvbiBjb21pbmcgb3V0IG9mIGhhcmR3YXJlIGV2ZW4gaWYgdGhl IGluZm9ybWF0aW9uDQogaXMgYmVpbmcgcHVzaGVkIHRvIGEgcmVtb3RlIHZhbGlkYXRvciAoZS5n LiwgaW1tZWRpYXRlbHkgcHVzaCBhbiBFQVQgdG9rZW4gZG93bnN0cmVhbSBpZiBhIHNwZWNpZmlj IGhhc2ggdmFsdWUgY2hhbmdlcykuJm5ic3A7IEFzIGEgcmVzdWx0IEkgd2FudCBtb3JlIGV4cGxp Y2l0IGFuZCBzdGFibGUgY2xhaW0gZGVmaW5pdGlvbnMuPG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi Pk1vcmUgaGlnaGx5IHNwZWNpZmllZCBjbGFpbXMgb2YgY291cnNlIGV4cG9zZXMgcG9zc2libGUg Y2xhaW0gcmVkdW5kYW5jeSwgZm9yZWlnbiBrZXkgcmVsYXRpb25zaGlwcywgYW5kIGNyb3NzLW1h cHBpbmcgd2l0aCBkb3duc3RyZWFtIGluZm9ybWF0aW9uIG1vZGVscy4gSSBhc3NlcnQgdGhpcyBp cyBhIGdvb2QgdGhpbmcgYmVjYXVzZSB3ZSBleHBvc2UgKGFuZCBob3BlZnVsbHkgbWluaW1pemUp IGNvc3RzIHdoaWNoDQogYXJlIGJvcm5lIGJ5IGRvd25zdHJlYW0gZGV2ZWxvcGVycy4mbmJzcDsg PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkVyaWM8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7 Ym9yZGVyLWxlZnQ6c29saWQgYmx1ZSAxLjVwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDQuMHB0Ij4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhhbm5lcyBUc2Nob2ZlbmlnLCBKdW5lIDcsIDIwMTkgNzoy OSBBTTxicj4NCjxicj4NCjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVO LUdCIj5GV0lXOiBXaGlsZSB0aGUgSldUIHJlZ2lzdHJ5IGxvb2tzIG1vcmUgbWl4ZWQgaW4gdGVy bXMgb2YgY2xhaW0gdHlwZXMuIFRoaXMgaXMsIGhvd2V2ZXIsIG9ubHkgYSByZXN1bHQgb2YgdGhl IHdpZGVzcHJlYWQgYWRvcHRpb24uPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPlRoZXJlIGFyZSBubyBwcm9ibGVtcywgYXMgZmFy IGFzIEkga25vdywgd2l0aCB0aGUgZGl2ZXJzaXR5IG9mIHRoZSBjbGFpbXMgYW5kIHRoYXQgdGhl eSBhcmUgbm90IGFsbCB1c2VmdWwgaW4gZXZlcnkgY29udGV4dC4gRGlmZmVyZW50IGRlcGxveW1l bnRzIHVzZSB0aGUgY2xhaW1zIHRoZXkgZmluZCB1c2VmdWwuDQo8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0Ii PkkgYW0gd29uZGVyaW5nIHdoZXRoZXIgd2UgYXJlIHRyeWluZyB0byBmaXggYSBwcm9ibGVtIHdp dGggdGhlIHJlZ2lzdHJ5IG9mIGNsYWltcyB0aGF0IGRvZXNu4oCZdCBvY2N1ciBpbiBwcmFjdGlj ZS4NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxh bmc9IkVOLUdCIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+Q2lhbzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj5IYW5uZXM8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRl ci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZyb206PC9iPiBSQVRTICZsdDs8YSBocmVmPSJtYWlsdG86 cmF0cy1ib3VuY2VzQGlldGYub3JnIj5yYXRzLWJvdW5jZXNAaWV0Zi5vcmc8L2E+Jmd0Ow0KPGI+ T24gQmVoYWxmIE9mIDwvYj5NaWtlIEpvbmVzPGJyPg0KPGI+U2VudDo8L2I+IE1pdHR3b2NoLCA1 LiBKdW5pIDIwMTkgMTk6MzE8YnI+DQo8Yj5Ubzo8L2I+IExhdXJlbmNlIEx1bmRibGFkZSAmbHQ7 PGEgaHJlZj0ibWFpbHRvOmxnbEBpc2xhbmQtcmVzb3J0LmNvbSI+bGdsQGlzbGFuZC1yZXNvcnQu Y29tPC9hPiZndDs7IE1pY2hhZWwgUmljaGFyZHNvbiAmbHQ7PGEgaHJlZj0ibWFpbHRvOm1jciYj NDM7aWV0ZkBzYW5kZWxtYW4uY2EiPm1jciYjNDM7aWV0ZkBzYW5kZWxtYW4uY2E8L2E+Jmd0Ozxi cj4NCjxiPkNjOjwvYj4gPGEgaHJlZj0ibWFpbHRvOnJhdHNAaWV0Zi5vcmciPnJhdHNAaWV0Zi5v cmc8L2E+PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbUmF0c10gVmV0dGluZyBjbGFpbSBkZWZp bml0aW9uczxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIGxhbmc9IkVOLUdCIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+QWN0dWFsbHksIG5v cm1hbCAobm9uLWNvbGxpc2lvbi1yZXNpc3RhbnQpIEpXVCBjbGFpbXMgKjxiPmFyZTwvYj4qIGFs bG9jYXRlZCBvbiBhIHNwZWNpZmljYXRpb24gcmVxdWlyZWQgYmFzaXMgd2l0aCBleHBlcnQgcmV2 aWV3LiZuYnNwOyBTZWUgdGhpcyB0ZXh0IGF0DQo8YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYu b3JnL2h0bWwvcmZjNzUxOSNzZWN0aW9uLTEwLjEiPmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRt bC9yZmM3NTE5I3NlY3Rpb24tMTAuMTwvYT46PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZh bWlseTpDb25zb2xhcztjb2xvcjpibGFjaztiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDsmbmJzcDsg VmFsdWVzIGFyZSByZWdpc3RlcmVkIG9uIGEgU3BlY2lmaWNhdGlvbiBSZXF1aXJlZCBbPC9zcGFu PjxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM1MjI2IiB0aXRsZT0iJnF1 b3Q7R3VpZGVsaW5lcyBmb3IgV3JpdGluZyBhbiBJQU5BIENvbnNpZGVyYXRpb25zIFNlY3Rpb24g aW4gUkZDcyZxdW90OyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6 Q29uc29sYXM7Y29sb3I6IzAwNjZDQyI+UkZDNTIyNjwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9ImZv bnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOmJsYWNrO2JhY2tncm91bmQ6d2hpdGUiPl0NCiBiYXNp czxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxl PSJmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjpibGFjaztiYWNrZ3JvdW5kOndoaXRlIj4mbmJz cDsmbmJzcDsgYWZ0ZXIgYSB0aHJlZS13ZWVrIHJldmlldyBwZXJpb2Qgb24gdGhlDQo8YSBocmVm PSJtYWlsdG86and0LXJlZy1yZXZpZXdAaWV0Zi5vcmciPmp3dC1yZWctcmV2aWV3QGlldGYub3Jn PC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjpibGFjaztiYWNrZ3JvdW5kOndoaXRlIj4m bmJzcDsmbmJzcDsgbWFpbGluZyBsaXN0LCBvbiB0aGUgYWR2aWNlIG9mIG9uZSBvciBtb3JlIERl c2lnbmF0ZWQgRXhwZXJ0cy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6YmxhY2s7YmFja2dy b3VuZDp3aGl0ZSI+Jm5ic3A7Jm5ic3A7IEhvd2V2ZXIsIHRvIGFsbG93IGZvciB0aGUgYWxsb2Nh dGlvbiBvZiB2YWx1ZXMgcHJpb3IgdG8gcHVibGljYXRpb24sPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkNvbnNvbGFz O2NvbG9yOmJsYWNrO2JhY2tncm91bmQ6d2hpdGUiPiZuYnNwOyZuYnNwOyB0aGUgRGVzaWduYXRl ZCBFeHBlcnRzIG1heSBhcHByb3ZlIHJlZ2lzdHJhdGlvbiBvbmNlIHRoZXkgYXJlPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFt aWx5OkNvbnNvbGFzO2NvbG9yOmJsYWNrO2JhY2tncm91bmQ6d2hpdGUiPiZuYnNwOyZuYnNwOyBz YXRpc2ZpZWQgdGhhdCBzdWNoIGEgc3BlY2lmaWNhdGlvbiB3aWxsIGJlIHB1Ymxpc2hlZC48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29s b3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPlNvIGEgc3BlY2lmaWNhdGlvbiBjYW4g ZWFzaWx5IHJlZ2lzdGVyIGJvdGggSldUIGFuZCBDV1QgY2xhaW1zLjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAt LSBNaWtlPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImNvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+ DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7 cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5Gcm9t OjwvYj4gTGF1cmVuY2UgTHVuZGJsYWRlICZsdDs8YSBocmVmPSJtYWlsdG86bGdsQGlzbGFuZC1y ZXNvcnQuY29tIj5sZ2xAaXNsYW5kLXJlc29ydC5jb208L2E+Jmd0Ow0KPGJyPg0KPGI+U2VudDo8 L2I+IFdlZG5lc2RheSwgSnVuZSA1LCAyMDE5IDg6NDYgQU08YnI+DQo8Yj5Ubzo8L2I+IE1pY2hh ZWwgUmljaGFyZHNvbiAmbHQ7PGEgaHJlZj0ibWFpbHRvOm1jciYjNDM7aWV0ZkBzYW5kZWxtYW4u Y2EiPm1jciYjNDM7aWV0ZkBzYW5kZWxtYW4uY2E8L2E+Jmd0Ozxicj4NCjxiPkNjOjwvYj4gPGEg aHJlZj0ibWFpbHRvOnJhdHNAaWV0Zi5vcmciPnJhdHNAaWV0Zi5vcmc8L2E+OyBNaWtlIEpvbmVz ICZsdDs8YSBocmVmPSJtYWlsdG86TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tIj5NaWNoYWVs LkpvbmVzQG1pY3Jvc29mdC5jb208L2E+Jmd0Ozxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW1Jh dHNdIFZldHRpbmcgY2xhaW0gZGVmaW5pdGlvbnM8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPkJlbG934oCmPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+JiM0MzsgTWlrZSBKb25lcywgY28tYXV0aG9yIG9mIENXVDxvOnA+PC9vOnA+PC9w Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBw dCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1 LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5P biBKdW4gNSwgMjAxOSwgYXQgNjowNSBBTSwgTWljaGFlbCBSaWNoYXJkc29uICZsdDs8YSBocmVm PSJtYWlsdG86bWNyJiM0MztpZXRmQHNhbmRlbG1hbi5jYSI+bWNyJiM0MztpZXRmQHNhbmRlbG1h bi5jYTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij48YnI+DQpMYXVyZW5jZSBMdW5k YmxhZGUgJmx0OzxhIGhyZWY9Im1haWx0bzpsZ2xAaXNsYW5kLXJlc29ydC5jb20iPmxnbEBpc2xh bmQtcmVzb3J0LmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUg c3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj7igJQgVG9kYXkgQ1dUIGFsbG9jYXRlcyBtaWxsaW9ucyBvZiBzbG90cyBmb3Ig ZXhwZXJ0IHJldmlldy4gTm88YnI+DQpzcGVjaWZpY2F0aW9uIGlzIHJlcXVpcmVkLCBidXQgc29t ZSBpbmZvcm1hdGlvbiBzaG91bGQgYmUgcHJvdmlkZWQuPG86cD48L286cD48L3A+DQo8L2Jsb2Nr cXVvdGU+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4w cHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5KV1QgZG9lc27i gJl0IHNlZW0gdG8gaGF2ZSB0aGlzLCB3aGljaCBpcyBtYXliZSB3aHkgaXQgaXMgbWVzc2llci4g SXQ8YnI+DQpraW5kIG9mIHNlZW1zIGJhZCBhbmQgd3JvbmcgdGhhdCBpdCBkb2VzbuKAmXQgdG8g bWUuPG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 YnI+DQpKV1QgZG9lc24ndCBoYXZlIHRoaXMgYmVjYXVzZSB0aGUgY2xhaW1zIGFyZSAmcXVvdDt1 bmxpbWl0ZWQmcXVvdDsgbGVuZ3RoIHN0cmluZ3MsIHNvPGJyPg0Kb25lIGNhbiBhbHdheXMgbWFr ZSB1cCBhIHVuaXF1ZSBzdHJpbmcgaW4gbGlldSBvZiByZWdpc3RyYXRpb24uPGJyPg0KJm5ic3A7 b3JnLmlzbGFuZC1yZXNvcnQubGdsLndoYXRldmVyc3RyaW5neW91d2FudDxicj4NCjxicj4NCmlz IHByb2JhYmx5IGNvbXBsZXRlbHkgeW91cnMgOi0pPGJyPg0KT2YgY291cnNlLCBpZiB5b3Ugd2Fu dCB0byBpbnRlcm9wZXJhdGUgeW91IG5lZWQgdG8gYWdyZWUgYWJvdXQgaG93LCBzbyB0aGVyZTxi cj4NCmFyZSBzb21lIGFkdmFudGFnZXMgb2YgYSBmb3JjaW5nIGZ1bmN0aW9uIHRoYXQgZGVtYW5k cyB5b3Ugd3JpdGUgdGhpbmdzIGRvd248YnI+DQpmaXJzdCA6LSk8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5VbmxpbWl0ZWQgbGVuZ3RoIHN0cmluZyBjbGFpbSBuYW1lcyBhcmUgZnVsbHkgcGFydCBvZiBD V1QuIEFsc28sIENPU0UgYWxsb3dzIHRoZW0gZm9yIGhlYWRlcnMsIGFsZ29yaXRobSBuYW1lcyBh bmQgc3VjaCB0b28uIFNvIGZyb20gYSBzeW50YXggdmlldyBDV1QgYW5kIENPU0UgYXJlIHRoZSBz YW1lIGFzIEpXVCBpbiBhbGxvd2luZyBsb25nIHN0cmluZyBuYW1lcy48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SG93ZXZlciwgQ09TRSBhbmQg Q1dUIGFyZSBkaWZmZXJlbnQgaW4gdGhlIG1hbmFnZW1lbnQgb2YgdGhlIHN0cmluZyBuYW1lIHNw YWNlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9 Im1hcmdpbi1sZWZ0OjMwLjBwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFy Z2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlN0 cmluZ3Mgb2YgbGVuZ3RoIDE8c3BhbiBjbGFzcz0iYXBwbGUtdGFiLXNwYW4iPiZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyA8 L3NwYW4+DQpTdGFuZGFyZHMgQWN0aW9uPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5TdHJpbmdzIG9mIGxlbmd0aCAyPHNw YW4gY2xhc3M9ImFwcGxlLXRhYi1zcGFuIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgPC9zcGFuPg0KU3BlY2lmaWNhdGlv biBSZXF1aXJlZDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+U3RyaW5ncyBvZiBsZW5ndGggZ3JlYXRlciB0aGFuIDI8c3Bh biBjbGFzcz0iYXBwbGUtdGFiLXNwYW4iPiZuYnNwOyZuYnNwOyZuYnNwOw0KPC9zcGFuPkV4cGVy dCBSZXZpZXc8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhlc2UsIGFsb25nIHdpdGggdGhl IGludGVnZXIgbmFtZXMgc3BhY2UgcnVsZXMsIHRoZW4gaW1wbHk6PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLWxlZnQ6MzAuMHB0O21h cmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SW50ZWdlciB2YWx1ZXMgbGVzcyB0aGFu IC02NTUzNiBhcmUgdGhlIG9ubHkgb25lcyBmcmVlIGZvciB1c2Ugd2l0aCBubyByZXZpZXcgb3Ig cHJvY2Vzc2luZyBieSBJQU5BIGFuZCBleHBlcnRzLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5KV1QgYWxzbyBoYXMgdGhpcyBub3Rpb24gb2YmbmJzcDtDb2xsaXNpb24tUmVzaXN0YW50IE5h bWUgYmFzZWQgb24gT0lEcyBvciBVVUlEcywgd2hpY2ggaXMgZXNzZW50aWFsbHkgc29tZSBydWxl cyB0byBtYWtlIHVwIG5hbWVzIHRoYXQgZG9u4oCZdCBnbyBpbnRvIGFuIElBTkEgcmVnaXN0cnkg YW5kIGFyZSBzdGlsbCB1bmlxdWUgYW5kIHdvbuKAmXQgY29sbGlkZS48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SldUIGNvdWxkIGhhdmUgZG9u ZSB3aGF0IENXVCBkb2VzLiBTZWVtcyB0byBtZSB0aGF0IENXVCBoYXMgdGFrZW4gYSByYWRpY2Fs bHkgbW9yZSBtYW5hZ2VkIGFwcHJvYWNoIHRvIHRoZSBzdXBlci1vcGVuIEpXVCBhcHByb2FjaC4g TWF5YmUgdGhlIENXVCBmb2xrcyByZWFsaXplZCB0aGUgSldUIGRlc2lnbiB3YXMgcG9vci48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5BdCBh bnkgcmF0ZSwgdGhlcmUgc2VlbXMgdG8gYmUgc29tZSBjb25zZW5zdXMgaGVyZSB0aGF0IHRoZSBD V1QgYXBwcm9hY2ggaXMgd2hhdCB3ZSB3YW50IGZvciBhdHRlc3RhdGlvbi4gSXQgaXMgYWxzbyB0 aGUgbW9yZSByZWNlbnQgYW5kIHRodXMgbWF5YmUgbW9yZSBhZHZhbmNlZCB0aGlua2luZy48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SeKAmW0g aG9waW5nIHdlIGNhbiBmaW5kIG91ciB3YXkgdG8ganVzdCBhY2NlcHQgdGhlIENXVCBjbGFpbSBu YW1pbmcgbWFuYWdlbWVudCBzY2hlbWUgYXMgaXMgZm9yIGF0dGVzdGF0aW9uLiBJZiBvdGhlciBD V1QtYmFzZWQgZWZmb3J0cyBkaWQgdGhlIHNhbWUgKGRyYWZ0LWJpcmtob2x6LWNvcmUtY29pZCkg ZGlkIHRoZSBzYW1lIHRoZW4gdGhlIHdvcmxkIHdvdWxkIGJlIG11Y2ggc2ltcGxlci4mbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SG93 ZXZlciB0aGF0IHN0aWxsIGxlYXZlcyBvcGVuIHNvbWUgaXNzdWUgd2l0aCBKV1QgbmFtZXNwYWNl IG1hbmFnZW1lbnQuIChXZSBkbyB3YW50IEpTT04gYmFzZWQgYXR0ZXN0YXRpb24gdG8gYmUgSldU 4oCZcywgcmlnaHQ/IEp1c3QgdGhlIHNhbWUgYXMgQ0JPUi1iYXNlZCBhdHRlc3RhdGlvbiBhcmUg Q1dU4oCZcykuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPkxMPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj5JTVBPUlRBTlQgTk9USUNFOiBUaGUg Y29udGVudHMgb2YgdGhpcyBlbWFpbCBhbmQgYW55IGF0dGFjaG1lbnRzIGFyZSBjb25maWRlbnRp YWwgYW5kIG1heSBhbHNvIGJlIHByaXZpbGVnZWQuIElmIHlvdSBhcmUgbm90IHRoZSBpbnRlbmRl ZCByZWNpcGllbnQsIHBsZWFzZSBub3RpZnkgdGhlIHNlbmRlciBpbW1lZGlhdGVseSBhbmQgZG8g bm90IGRpc2Nsb3NlIHRoZSBjb250ZW50cw0KIHRvIGFueSBvdGhlciBwZXJzb24sIHVzZSBpdCBm b3IgYW55IHB1cnBvc2UsIG9yIHN0b3JlIG9yIGNvcHkgdGhlIGluZm9ybWF0aW9uIGluIGFueSBt ZWRpdW0uIFRoYW5rIHlvdS4NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_DM6PR11MB408908B0F071051FEC0B090BA1100DM6PR11MB4089namp_-- From nobody Fri Jun 7 11:53:58 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6D94F12006A for ; Fri, 7 Jun 2019 11:53:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dHoVoNuEmir4 for ; Fri, 7 Jun 2019 11:53:52 -0700 (PDT) Received: from p3plsmtpa08-01.prod.phx3.secureserver.net (p3plsmtpa08-01.prod.phx3.secureserver.net [173.201.193.102]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 11F43120052 for ; Fri, 7 Jun 2019 11:53:51 -0700 (PDT) Received: from [10.40.0.122] ([104.238.46.179]) by :SMTPAUTH: with ESMTPA id ZJzqh00xfvXcJZJzqhw8mD; Fri, 07 Jun 2019 11:53:51 -0700 From: Laurence Lundblade Message-Id: <902E75D8-D8AC-403B-A295-0EC3034E44B2@island-resort.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_EFEC58CD-4BF1-4ECA-88F3-58417D7684EB" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Fri, 7 Jun 2019 11:52:50 -0700 In-Reply-To: Cc: Hannes Tschofenig , Mike Jones , Michael Richardson , "rats@ietf.org" To: "Eric Voit (evoit)" References: <12913.1559739926@localhost> <30754CD8-98AB-4080-952E-880BC630EC69@island-resort.com> X-Mailer: Apple Mail (2.3445.9.1) X-CMAE-Envelope: MS4wfEzImripoRjHdL15FF+kYBYl9/tyQT8HORJ+sSNdeSqfesZfq4hIo4c0tBAMf6eKfmvKBRseWnI40zHQl07gpnPIe1tR1Zui2McoIL+ja5UEIKoTA1uT Hd/RF7UQEtjMNysgUG+yUe8Bw0f1ommbjGeEFFvCTcPzB61QPYt1MYBzr6ycR8mfp2IpMc1+iSp6+v6YXXHQbQt9ggkHXC5DwFE4ney+PUM5PTLmQwiIjeYx 6j2ZejHE1Eqy95ZHdGfGTbnm+FLWWKkPVnhFxjrIqB2cjyGDc8kGEIsZ24D5p669zMD/9vGYiYevOQ5f/rp3hXIhDxY89S1Cm83CsGUtIzo= Archived-At: Subject: Re: [Rats] Vetting claim definitions X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Jun 2019 18:53:57 -0000 --Apple-Mail=_EFEC58CD-4BF1-4ECA-88F3-58417D7684EB Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Eric, Feels like there=E2=80=99s opposing views: 1) Carsten, Kathleen, myself and maybe Henk and others want an EAT to be = a CWT/JWT.This really does make the claim set open-ended. CWT is a bit = more carefully managed than JWT, but we=E2=80=99ll still end up with a = lot of claims registered.=20 2) You want a very well-defined concise claim set, a controlled policy = for allowing new claims and maximal interoperability. I think both objectives are good and desirable. I think the way to have both is to leave the CWT/JWT registration open = as they are AND ALSO define a profile / subset in an IETF standard for = your use case. This profile / subset can: - Make clear normative references to extant claims that are considered = well-enough formed and interoperable - Define some new claims where none are extant - Define a policy for adding new claims=20 - Labelling to distinguish the profile from a general open-ended CWT/JWT So one way forward is for this WG to adopt another document. Maybe call = it =E2=80=9CRouter Attestation Profile=E2=80=9D. This would be in = addition to EAT. It makes normative references to the EAT claims it = likes. Another way forward is for the EAT draft to change direction some and = become the more tight and limited attestation definition. It would = probably address more than just the router use case, but it would retain = the main characteristics you want. If we do this, then we can expect = other attestation use cases to write documents and maybe run them = through this WG or maybe not. LL > On Jun 7, 2019, at 10:14 AM, Eric Voit (evoit) = wrote: >=20 > Hi Hannes, > =20 > If we were sure we could limit EAT claims to just a few things which = come out of hardware, this wouldn't concern me as much as it does. = However the domain of attestable objects was left fairly open within the = EAT draft. And we need to determine what level of interoperability are = we trying to shepherd via RATS. > =20 > In the end, RATS (and EAT) need to determine the level of = interoperability desired for specific claims. I don't claim deep = familiarity with JWT. But looking at RFC-7519, Section 4.1, I see that = I would have questions as an implementer. For example, the claims = "iss", "sub", and "aud" look to have population/processing which is = application specific. Therefore with these claims, it is up to = applications on either side of the JWT must come to an agreement on what = the populated instances mean. (I.e., not the WG.) =20 > =20 > Common of object definitions/claims from internal hardware are = important if the Network Element needs to act on specific values. And = as a vendor, I know that I do want to act on information coming out of = hardware even if the information is being pushed to a remote validator = (e.g., immediately push an EAT token downstream if a specific hash value = changes). As a result I want more explicit and stable claim = definitions. > =20 > More highly specified claims of course exposes possible claim = redundancy, foreign key relationships, and cross-mapping with downstream = information models. I assert this is a good thing because we expose (and = hopefully minimize) costs which are borne by downstream developers. =20 > =20 > Eric > =20 > Hannes Tschofenig, June 7, 2019 7:29 AM >=20 > FWIW: While the JWT registry looks more mixed in terms of claim types. = This is, however, only a result of the widespread adoption. > There are no problems, as far as I know, with the diversity of the = claims and that they are not all useful in every context. Different = deployments use the claims they find useful. > =20 > I am wondering whether we are trying to fix a problem with the = registry of claims that doesn=E2=80=99t occur in practice. > =20 > Ciao > Hannes > =20 > From: RATS > On = Behalf Of Mike Jones > Sent: Mittwoch, 5. Juni 2019 19:31 > To: Laurence Lundblade >; Michael Richardson = > > Cc: rats@ietf.org > Subject: Re: [Rats] Vetting claim definitions > =20 > Actually, normal (non-collision-resistant) JWT claims *are* allocated = on a specification required basis with expert review. See this text at = https://tools.ietf.org/html/rfc7519#section-10.1 = : > =20 > Values are registered on a Specification Required [RFC5226 = ] basis > after a three-week review period on the jwt-reg-review@ietf.org = > mailing list, on the advice of one or more Designated Experts. > However, to allow for the allocation of values prior to = publication, > the Designated Experts may approve registration once they are > satisfied that such a specification will be published. > =20 > So a specification can easily register both JWT and CWT claims. > =20 > -- Mike > =20 > From: Laurence Lundblade >=20 > Sent: Wednesday, June 5, 2019 8:46 AM > To: Michael Richardson > > Cc: rats@ietf.org ; Mike Jones = > > Subject: Re: [Rats] Vetting claim definitions > =20 > Below=E2=80=A6 > + Mike Jones, co-author of CWT > =20 >=20 > On Jun 5, 2019, at 6:05 AM, Michael Richardson > wrote: > =20 >=20 > Laurence Lundblade > wrote: >=20 > =E2=80=94 Today CWT allocates millions of slots for expert review. No > specification is required, but some information should be provided. > =20 >=20 > JWT doesn=E2=80=99t seem to have this, which is maybe why it is = messier. It > kind of seems bad and wrong that it doesn=E2=80=99t to me. >=20 > JWT doesn't have this because the claims are "unlimited" length = strings, so > one can always make up a unique string in lieu of registration. > org.island-resort.lgl.whateverstringyouwant >=20 > is probably completely yours :-) > Of course, if you want to interoperate you need to agree about how, so = there > are some advantages of a forcing function that demands you write = things down > first :-) > =20 > Unlimited length string claim names are fully part of CWT. Also, COSE = allows them for headers, algorithm names and such too. So from a syntax = view CWT and COSE are the same as JWT in allowing long string names. > =20 > However, COSE and CWT are different in the management of the string = name space: > =20 > Strings of length 1 Standards Action > Strings of length 2 Specification Required > Strings of length greater than 2 Expert Review > =20 > These, along with the integer names space rules, then imply: > =20 > Integer values less than -65536 are the only ones free for use with no = review or processing by IANA and experts. > =20 > JWT also has this notion of Collision-Resistant Name based on OIDs or = UUIDs, which is essentially some rules to make up names that don=E2=80=99t= go into an IANA registry and are still unique and won=E2=80=99t = collide. > =20 > JWT could have done what CWT does. Seems to me that CWT has taken a = radically more managed approach to the super-open JWT approach. Maybe = the CWT folks realized the JWT design was poor. > =20 > =20 > At any rate, there seems to be some consensus here that the CWT = approach is what we want for attestation. It is also the more recent and = thus maybe more advanced thinking. > =20 > I=E2=80=99m hoping we can find our way to just accept the CWT claim = naming management scheme as is for attestation. If other CWT-based = efforts did the same (draft-birkholz-core-coid) did the same then the = world would be much simpler.=20 > =20 > However that still leaves open some issue with JWT namespace = management. (We do want JSON based attestation to be JWT=E2=80=99s, = right? Just the same as CBOR-based attestation are CWT=E2=80=99s). > =20 > LL > =20 > IMPORTANT NOTICE: The contents of this email and any attachments are = confidential and may also be privileged. If you are not the intended = recipient, please notify the sender immediately and do not disclose the = contents to any other person, use it for any purpose, or store or copy = the information in any medium. Thank you. --Apple-Mail=_EFEC58CD-4BF1-4ECA-88F3-58417D7684EB Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi = Eric,

Feels like = there=E2=80=99s opposing views:

1) Carsten, Kathleen, myself = and maybe Henk and others want an EAT to be a CWT/JWT.This really does = make the claim set open-ended. CWT is a bit more carefully managed than = JWT, but we=E2=80=99ll still end up with a lot of claims = registered. 

2) You want a very well-defined concise claim set, a = controlled policy for allowing new claims and maximal = interoperability.

I think both objectives = are good and desirable.

I think the way to have both is to leave the CWT/JWT = registration open as they are AND ALSO define a profile / subset in an = IETF standard for your use case. This profile / subset can:

- Make clear = normative references to extant claims that are considered well-enough = formed and interoperable
- Define some new claims = where none are extant
- Define a policy for adding = new claims 
- Labelling to distinguish the = profile from a general open-ended CWT/JWT

So one way forward is for this WG to adopt = another document. Maybe call it =E2=80=9CRouter Attestation Profile=E2=80=9D= .  This would be in addition to EAT. It makes normative references = to the EAT claims it likes.

Another way forward is for the EAT draft to change direction = some and become the more tight and limited attestation definition. It = would probably address more than just the router use case, but it would = retain the main characteristics you want. If we do this, then we can = expect other attestation use cases to write documents and maybe run them = through this WG or maybe not.

LL


On Jun 7, 2019, at 10:14 AM, Eric Voit (evoit) <evoit@cisco.com> = wrote:

Hi = Hannes,
 
If we were sure we could limit EAT claims to just a few = things which come out of hardware, this wouldn't concern me as much as = it does.  However the domain of attestable objects was left fairly = open within the EAT draft.   And we need to determine what = level of interoperability are we trying to shepherd via RATS.
 
In the = end, RATS (and EAT) need to determine the level of interoperability = desired for specific claims.   I don't claim deep familiarity = with JWT.  But looking at RFC-7519, Section 4.1, I see that I would = have questions as an implementer.  For example, the claims "iss", = "sub", and "aud" look to have population/processing which is application = specific.  Therefore with these claims, it is up to applications on = either side of the JWT must come to an agreement on what the populated = instances mean.  (I.e., not the WG.)   
 
Common of = object definitions/claims from internal hardware are important if the = Network Element needs to act on specific values.  And as a vendor, = I know that I do want to act on information coming out of hardware even = if the information is being pushed to a remote validator (e.g., = immediately push an EAT token downstream if a specific hash value = changes).  As a result I want more explicit and stable claim = definitions.
 
More highly specified claims of course exposes possible claim = redundancy, foreign key relationships, and cross-mapping with downstream = information models. I assert this is a good thing because we expose (and = hopefully minimize) costs which are borne by downstream = developers.  
 
Eric
 
Hannes = Tschofenig, June 7, 2019 7:29 AM

FWIW: = While the JWT registry looks more mixed in terms of claim types. This = is, however, only a result of the widespread adoption.
There are no problems, as far as I know, with = the diversity of the claims and that they are not all useful in every = context. Different deployments use the claims they find useful.
 
I am = wondering whether we are trying to fix a problem with the registry of = claims that doesn=E2=80=99t occur in practice.
 
Ciao
Hannes
 
From: RATS <rats-bounces@ietf.org> On Behalf = Of Mike Jones
Sent: Mittwoch, 5. Juni 2019 = 19:31
To: Laurence Lundblade <lgl@island-resort.com>; = Michael Richardson <mcr+ietf@sandelman.ca>
Cc: rats@ietf.org
Subject: Re: [Rats] Vetting claim = definitions
 
Actually, = normal (non-collision-resistant) JWT claims *are* = allocated on a specification required basis with expert review.  = See this text at https://tools.ietf.org/html/rfc7519#section-10.1:
 
   Values are registered on a Specification = Required [RFC5226] = basis
   after a three-week review period on = the jwt-reg-review@ietf.org
   mailing list, on the advice of one or more = Designated Experts.
   However, to allow for = the allocation of values prior to publication,
   the Designated Experts may approve registration = once they are
   satisfied that such a specification will = be published.
 
So a = specification can easily register both JWT and CWT claims.
 
          &nb= sp;            = ;            &= nbsp;     =             &n= bsp; -- Mike
 
From: Laurence Lundblade <lgl@island-resort.com> 
Sent: Wednesday, June 5, 2019 = 8:46 AM
To: Michael Richardson <mcr+ietf@sandelman.ca>
Cc: rats@ietf.org; Mike Jones <Michael.Jones@microsoft.com>
Subject: Re: [Rats] Vetting claim = definitions
 
Below=E2=80=A6
+ Mike Jones, co-author of CWT

 

On Jun 5, 2019, at 6:05 = AM, Michael Richardson <mcr+ietf@sandelman.ca> wrote:
 


Laurence Lundblade = <lgl@island-resort.com> = wrote:

=E2=80=94 = Today CWT allocates millions of slots for expert review. No
specification is required, but some information should be = provided.

 

JWT doesn=E2=80=99t seem to have this, = which is maybe why it is messier. It
kind of seems bad and = wrong that it doesn=E2=80=99t to me.

JWT doesn't have this because the claims are = "unlimited" length strings, so
one can always make up a = unique string in lieu of registration.
 org.island-resort.lgl.whateverstringyouwant

is probably completely yours :-)
Of course, if you want to interoperate you need to agree = about how, so there
are some advantages of a forcing = function that demands you write things down
first :-)
 
Unlimited length string claim names are fully part of CWT. = Also, COSE allows them for headers, algorithm names and such too. So = from a syntax view CWT and COSE are the same as JWT in allowing long = string names.
 
However, COSE and CWT are different in the management of the = string name space:
 
Strings of length 1        &= nbsp;   Standards Action
Strings of length 2        &= nbsp;   Specification = Required
Strings of length greater = than 2    Expert Review
 
These, = along with the integer names space rules, then imply:
 
Integer values less than = -65536 are the only ones free for use with no review or processing by = IANA and experts.
 
JWT also has this notion of Collision-Resistant Name = based on OIDs or UUIDs, which is essentially some rules to make up names = that don=E2=80=99t go into an IANA registry and are still unique and = won=E2=80=99t collide.
 
JWT could have done what CWT does. Seems to me that CWT has = taken a radically more managed approach to the super-open JWT approach. = Maybe the CWT folks realized the JWT design was poor.
 
 
At any rate, there seems to be some consensus here that the = CWT approach is what we want for attestation. It is also the more recent = and thus maybe more advanced thinking.
 
I=E2=80=99m hoping we can find our way = to just accept the CWT claim naming management scheme as is for = attestation. If other CWT-based efforts did the same = (draft-birkholz-core-coid) did the same then the world would be much = simpler. 
 
However that still leaves open some issue with JWT namespace = management. (We do want JSON based attestation to be JWT=E2=80=99s, = right? Just the same as CBOR-based attestation are CWT=E2=80=99s).
 
LL
 
IMPORTANT NOTICE: The = contents of this email and any attachments are confidential and may also = be privileged. If you are not the intended recipient, please notify the = sender immediately and do not disclose the contents to any other person, = use it for any purpose, or store or copy the information in any medium. = Thank you.

= --Apple-Mail=_EFEC58CD-4BF1-4ECA-88F3-58417D7684EB-- From nobody Fri Jun 7 12:25:23 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 016B01200F3 for ; Fri, 7 Jun 2019 12:25:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.009 X-Spam-Level: X-Spam-Status: No, score=-2.009 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5mofQPH7Pbrp for ; Fri, 7 Jun 2019 12:25:15 -0700 (PDT) Received: from NAM06-DM3-obe.outbound.protection.outlook.com (mail-eopbgr640122.outbound.protection.outlook.com [40.107.64.122]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BA04D1200C7 for ; Fri, 7 Jun 2019 12:25:14 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=testarcselector01; d=microsoft.com; cv=none; b=mMp2JoR90b92xQQgf2C7XJH8ybeKXu7fYM3gzjcR38zE6JUbHNfwkNQzxwiXdJyOKtoKsXK3OhKY3qSoLgFVKjNXmw+wi8YyDIUMxfbaWFmhAsazpWzQxDW15Sa7GxxV53KIKFDknuiDi4rK/AfmV4ceHSLoA2fOvSbhrlFkYFBQMJULvuHWleidokYFYUg6c+GJhyxws4nRW1yR7u+nqxw7hXNcZz/Dr9ll83YwJxHukV5oyaKmW2uz+9QctK5DBqmoBhoahBPPpWOvdVJrstqY4J6RdSxKgt7EInOJY/THBGD8PUXfZ4qFVVMSvGnRUEJuHX0boGp3WuqOQiBLog== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=testarcselector01; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=DQfjFDeZEELToEw3uDfMRllGdruwlN2YkQHFrSodwqo=; b=n3eUCugoGCrVBZWtp01itQyewx0enBbx+IYIN3zJ41pd+xYQYDYC7KUxIn1+lzwnAoO6/AWUkGVChblo3LJArnkdOMimoofh8TiIZLQeIWNSY9mGZ/G4NhnilRZKVlGOprvgq8CahEFHhaVJqaUNL1QqM10WyDGpi9oitvL2kK6ltqLaqBXDZgcoU32ixuFuM+q/EUozqC2JPYVGTaOG+UIuMRSvwTfZlYQxw/vguXHF1XfYsgGgYoGUWXXutPagSIxdC1/eK3n406Z1ew8H7h540J45Eu4009TFvBu5ZvY22u3wCV+94jnjr7MHddxw1qsX2lK28I3E47jqUkUd7w== ARC-Authentication-Results: i=1; test.office365.com 1;spf=none;dmarc=none;dkim=none;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=DQfjFDeZEELToEw3uDfMRllGdruwlN2YkQHFrSodwqo=; b=Pwn0A4fTyfjrVliqy9P91ucngt/FnfCSKU+82lS+S78m6pxNE+4+MMLmPC6uf+HmjB3qUFuYE5dlC0cR2be78vU8g66Ss1+Mbzmti+GThWFOds2KSgsC5ESSZ1ZeMlecl6DQc7Rg4KMQTyWBtB696XI0PZQrqMHyLrikgnKmnSw= Received: from MW2PR00MB0298.namprd00.prod.outlook.com (52.132.148.29) by MW2PR00MB0330.namprd00.prod.outlook.com (52.132.148.141) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2006.0; Fri, 7 Jun 2019 19:25:07 +0000 Received: from MW2PR00MB0298.namprd00.prod.outlook.com ([fe80::e4e2:b272:8153:c183]) by MW2PR00MB0298.namprd00.prod.outlook.com ([fe80::e4e2:b272:8153:c183%4]) with mapi id 15.20.2006.000; Fri, 7 Jun 2019 19:25:07 +0000 From: Mike Jones To: Laurence Lundblade , "Eric Voit (evoit)" CC: Michael Richardson , Hannes Tschofenig , Mike Jones , "rats@ietf.org" Thread-Topic: [Rats] Vetting claim definitions Thread-Index: AQHVG7XVbraN3V8Gs0WRMkd4jETRWqaNUNhQgALAEgCAAGC2AIAAG10AgAAGxyA= Date: Fri, 7 Jun 2019 19:25:07 +0000 Message-ID: References: <12913.1559739926@localhost> <30754CD8-98AB-4080-952E-880BC630EC69@island-resort.com> <902E75D8-D8AC-403B-A295-0EC3034E44B2@island-resort.com> In-Reply-To: <902E75D8-D8AC-403B-A295-0EC3034E44B2@island-resort.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ActionId=0e7ea0e0-f8f3-4407-8e94-0000c4a5ab88; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=true; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=Internal; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2019-06-07T19:17:06-0800; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; authentication-results: spf=none (sender IP is ) smtp.mailfrom=Michael.Jones@microsoft.com; x-originating-ip: [50.47.93.218] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: d9ac5293-749e-4414-9c43-08d6eb7dd994 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:MW2PR00MB0330; x-ms-traffictypediagnostic: MW2PR00MB0330: x-ms-exchange-purlcount: 4 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:7691; x-forefront-prvs: 0061C35778 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(136003)(396003)(366004)(39860400002)(376002)(346002)(124014002)(189003)(199004)(40434004)(5024004)(26005)(66574012)(256004)(14444005)(74316002)(81166006)(73956011)(8936002)(8990500004)(72206003)(66446008)(6436002)(66946007)(76116006)(14454004)(966005)(66476007)(66556008)(64756008)(6506007)(5660300002)(52536014)(102836004)(33656002)(81156014)(2906002)(71190400001)(71200400001)(10090500001)(8676002)(186003)(86362001)(7736002)(53546011)(446003)(6246003)(25786009)(55016002)(22452003)(110136005)(606006)(54906003)(53936002)(99286004)(76176011)(68736007)(7696005)(66066001)(3846002)(478600001)(10290500003)(229853002)(486006)(11346002)(54896002)(236005)(6306002)(9686003)(476003)(316002)(790700001)(6116002)(4326008); DIR:OUT; SFP:1102; SCL:1; SRVR:MW2PR00MB0330; H:MW2PR00MB0298.namprd00.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: efO2rE8De5NtZT2eT6wBmtUnSmDdURr3Cue+Th3ZGA7AlEXzGd+uptOGURxoGwYR+YxIi5bP0oEUcX5swkoTNCiZAO9hhIMzlMEVC1BuN5+1jeZGD8ff433WcPcT79BiF+BOiNP6M4gbXkH69twHciTfGy7wombw73Ord/WJMCG6rfdIQC/WbUGKKbwEBfJ4aY1yDfzgbC3cpeT4alW52EsIi5Tgs6EzsH2vyhUzfch+DNO95U9XFlCp6E3DhPwYwLq0UAh4G0cdoEBpHCx6+/1ha87W1+zf+ZTHD7+SwIkjedhzGYA1FM9TaQd1uAZML805eY7xEExNK+hexq0gPV6hdQaSreZePG6CSXHhlf5DFuIdG7KJWJGTjU+fUQ7GX6F6acqDPwe1UMsa6CoZOPLI+arSr7aNSuHkY4A7aos= Content-Type: multipart/alternative; boundary="_000_MW2PR00MB0298D282632D828F2BCB16F5F5100MW2PR00MB0298namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: d9ac5293-749e-4414-9c43-08d6eb7dd994 X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Jun 2019 19:25:07.2758 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: mbj@microsoft.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW2PR00MB0330 Archived-At: Subject: Re: [Rats] Vetting claim definitions X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Jun 2019 19:25:21 -0000 --_000_MW2PR00MB0298D282632D828F2BCB16F5F5100MW2PR00MB0298namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhpcyBpcyBleGFjdGx5IHRoZSBhcHByb2FjaCBJ4oCZZCBhZHZvY2F0ZS4gIFRvIGJlIGZ1bGx5 IGludGVyb3BlcmFibGUsIGJvdGggSldUcyBhbmQgQ1dUcyBieSBkZXNpZ24gcmVxdWlyZSBhbiBh cHBsaWNhdGlvbiBwcm9maWxlIHRoYXQgZGVmaW5lcyB0aGUgcHJvY2Vzc2luZyBydWxlcyBmb3Ig ZWFjaCBvZiB0aGUgY2xhaW1zLiAgRm9yIGluc3RhbmNlLCBPcGVuSUQgQ29ubmVjdCBkZWZpbmVz IHNvbWV0aGluZyBjYWxsZWQgYW4gSUQgVG9rZW48aHR0cHM6Ly9vcGVuaWQubmV0L3NwZWNzL29w ZW5pZC1jb25uZWN0LWNvcmUtMV8wLmh0bWwjSURUb2tlbj4sIHdoaWNoIGlzIGEgSldUIHdpdGgg c3BlY2lmaWMgcHJvY2Vzc2luZyBydWxlczxodHRwczovL29wZW5pZC5uZXQvc3BlY3Mvb3Blbmlk LWNvbm5lY3QtY29yZS0xXzAuaHRtbCNJRFRva2VuVmFsaWRhdGlvbj4gZm9yIHRoZSBjbGFpbXMu ICBGb3IgaW5zdGFuY2UsIGl0IHNheXMgaG93IHRvIHVzZSB0aGUg4oCcaXNz4oCdIChpc3N1ZXIp IGNsYWltIHRvIHJldHJpZXZlIHB1YmxpYyBrZXlzIHRvIHZhbGlkYXRlIHRoZSBKV1Qgc2lnbmF0 dXJlLg0KDQpGb3IgRUFUcywganVzdCBsaWtlIG90aGVyIGFwcGxpY2F0aW9ucyBvZiBKV1RzIGFu ZCBDV1RzLCBhcHBsaWNhdGlvbiBwcm9maWxlcyB3aWxsIGJlIHJlcXVpcmVkIHRvIGRlZmluZSB0 aGUgaG93IHRvIHVzZSB0aGUgY2xhaW1zIGluIHRoZSBFQVQuICBUaGlzIGlzIGFzIGl0IHNob3Vs ZCBiZS4gIElmIHdlIGFsc28gd2FudCB0byBjcmVhdGUgc3VjaCBhIHByb2ZpbGUgKG9yIG11bHRp cGxlIHN1Y2ggcHJvZmlsZXMpIGluIGFkZGl0aW9uIHRvIHRoZSBnZW5lcmFsIEVBVCBzcGVjaWZp Y2F0aW9uLCB3ZSBjYW4gZG8gdGhhdC4NCg0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIC0tIE1pa2UNCg0KRnJvbTogUkFUUyA8cmF0cy1ib3Vu Y2VzQGlldGYub3JnPiBPbiBCZWhhbGYgT2YgTGF1cmVuY2UgTHVuZGJsYWRlDQpTZW50OiBGcmlk YXksIEp1bmUgNywgMjAxOSAxMTo1MyBBTQ0KVG86IEVyaWMgVm9pdCAoZXZvaXQpIDxldm9pdEBj aXNjby5jb20+DQpDYzogTWljaGFlbCBSaWNoYXJkc29uIDxtY3IraWV0ZkBzYW5kZWxtYW4uY2E+ OyBIYW5uZXMgVHNjaG9mZW5pZyA8SGFubmVzLlRzY2hvZmVuaWdAYXJtLmNvbT47IE1pa2UgSm9u ZXMgPE1pY2hhZWwuSm9uZXM9NDBtaWNyb3NvZnQuY29tQGRtYXJjLmlldGYub3JnPjsgcmF0c0Bp ZXRmLm9yZw0KU3ViamVjdDogUmU6IFtSYXRzXSBWZXR0aW5nIGNsYWltIGRlZmluaXRpb25zDQoN CkhpIEVyaWMsDQoNCkZlZWxzIGxpa2UgdGhlcmXigJlzIG9wcG9zaW5nIHZpZXdzOg0KDQoxKSBD YXJzdGVuLCBLYXRobGVlbiwgbXlzZWxmIGFuZCBtYXliZSBIZW5rIGFuZCBvdGhlcnMgd2FudCBh biBFQVQgdG8gYmUgYSBDV1QvSldULlRoaXMgcmVhbGx5IGRvZXMgbWFrZSB0aGUgY2xhaW0gc2V0 IG9wZW4tZW5kZWQuIENXVCBpcyBhIGJpdCBtb3JlIGNhcmVmdWxseSBtYW5hZ2VkIHRoYW4gSldU LCBidXQgd2XigJlsbCBzdGlsbCBlbmQgdXAgd2l0aCBhIGxvdCBvZiBjbGFpbXMgcmVnaXN0ZXJl ZC4NCg0KMikgWW91IHdhbnQgYSB2ZXJ5IHdlbGwtZGVmaW5lZCBjb25jaXNlIGNsYWltIHNldCwg YSBjb250cm9sbGVkIHBvbGljeSBmb3IgYWxsb3dpbmcgbmV3IGNsYWltcyBhbmQgbWF4aW1hbCBp bnRlcm9wZXJhYmlsaXR5Lg0KDQpJIHRoaW5rIGJvdGggb2JqZWN0aXZlcyBhcmUgZ29vZCBhbmQg ZGVzaXJhYmxlLg0KDQpJIHRoaW5rIHRoZSB3YXkgdG8gaGF2ZSBib3RoIGlzIHRvIGxlYXZlIHRo ZSBDV1QvSldUIHJlZ2lzdHJhdGlvbiBvcGVuIGFzIHRoZXkgYXJlIEFORCBBTFNPIGRlZmluZSBh IHByb2ZpbGUgLyBzdWJzZXQgaW4gYW4gSUVURiBzdGFuZGFyZCBmb3IgeW91ciB1c2UgY2FzZS4g VGhpcyBwcm9maWxlIC8gc3Vic2V0IGNhbjoNCg0KLSBNYWtlIGNsZWFyIG5vcm1hdGl2ZSByZWZl cmVuY2VzIHRvIGV4dGFudCBjbGFpbXMgdGhhdCBhcmUgY29uc2lkZXJlZCB3ZWxsLWVub3VnaCBm b3JtZWQgYW5kIGludGVyb3BlcmFibGUNCi0gRGVmaW5lIHNvbWUgbmV3IGNsYWltcyB3aGVyZSBu b25lIGFyZSBleHRhbnQNCi0gRGVmaW5lIGEgcG9saWN5IGZvciBhZGRpbmcgbmV3IGNsYWltcw0K LSBMYWJlbGxpbmcgdG8gZGlzdGluZ3Vpc2ggdGhlIHByb2ZpbGUgZnJvbSBhIGdlbmVyYWwgb3Bl bi1lbmRlZCBDV1QvSldUDQoNClNvIG9uZSB3YXkgZm9yd2FyZCBpcyBmb3IgdGhpcyBXRyB0byBh ZG9wdCBhbm90aGVyIGRvY3VtZW50LiBNYXliZSBjYWxsIGl0IOKAnFJvdXRlciBBdHRlc3RhdGlv biBQcm9maWxl4oCdLi4gIFRoaXMgd291bGQgYmUgaW4gYWRkaXRpb24gdG8gRUFULiBJdCBtYWtl cyBub3JtYXRpdmUgcmVmZXJlbmNlcyB0byB0aGUgRUFUIGNsYWltcyBpdCBsaWtlcy4NCg0KQW5v dGhlciB3YXkgZm9yd2FyZCBpcyBmb3IgdGhlIEVBVCBkcmFmdCB0byBjaGFuZ2UgZGlyZWN0aW9u IHNvbWUgYW5kIGJlY29tZSB0aGUgbW9yZSB0aWdodCBhbmQgbGltaXRlZCBhdHRlc3RhdGlvbiBk ZWZpbml0aW9uLiBJdCB3b3VsZCBwcm9iYWJseSBhZGRyZXNzIG1vcmUgdGhhbiBqdXN0IHRoZSBy b3V0ZXIgdXNlIGNhc2UsIGJ1dCBpdCB3b3VsZCByZXRhaW4gdGhlIG1haW4gY2hhcmFjdGVyaXN0 aWNzIHlvdSB3YW50LiBJZiB3ZSBkbyB0aGlzLCB0aGVuIHdlIGNhbiBleHBlY3Qgb3RoZXIgYXR0 ZXN0YXRpb24gdXNlIGNhc2VzIHRvIHdyaXRlIGRvY3VtZW50cyBhbmQgbWF5YmUgcnVuIHRoZW0g dGhyb3VnaCB0aGlzIFdHIG9yIG1heWJlIG5vdC4NCg0KTEwNCg0KDQpPbiBKdW4gNywgMjAxOSwg YXQgMTA6MTQgQU0sIEVyaWMgVm9pdCAoZXZvaXQpIDxldm9pdEBjaXNjby5jb208bWFpbHRvOmV2 b2l0QGNpc2NvLmNvbT4+IHdyb3RlOg0KDQpIaSBIYW5uZXMsDQoNCklmIHdlIHdlcmUgc3VyZSB3 ZSBjb3VsZCBsaW1pdCBFQVQgY2xhaW1zIHRvIGp1c3QgYSBmZXcgdGhpbmdzIHdoaWNoIGNvbWUg b3V0IG9mIGhhcmR3YXJlLCB0aGlzIHdvdWxkbid0IGNvbmNlcm4gbWUgYXMgbXVjaCBhcyBpdCBk b2VzLiAgSG93ZXZlciB0aGUgZG9tYWluIG9mIGF0dGVzdGFibGUgb2JqZWN0cyB3YXMgbGVmdCBm YWlybHkgb3BlbiB3aXRoaW4gdGhlIEVBVCBkcmFmdC4gICBBbmQgd2UgbmVlZCB0byBkZXRlcm1p bmUgd2hhdCBsZXZlbCBvZiBpbnRlcm9wZXJhYmlsaXR5IGFyZSB3ZSB0cnlpbmcgdG8gc2hlcGhl cmQgdmlhIFJBVFMuDQoNCkluIHRoZSBlbmQsIFJBVFMgKGFuZCBFQVQpIG5lZWQgdG8gZGV0ZXJt aW5lIHRoZSBsZXZlbCBvZiBpbnRlcm9wZXJhYmlsaXR5IGRlc2lyZWQgZm9yIHNwZWNpZmljIGNs YWltcy4gICBJIGRvbid0IGNsYWltIGRlZXAgZmFtaWxpYXJpdHkgd2l0aCBKV1QuICBCdXQgbG9v a2luZyBhdCBSRkMtNzUxOSwgU2VjdGlvbiA0LjEsIEkgc2VlIHRoYXQgSSB3b3VsZCBoYXZlIHF1 ZXN0aW9ucyBhcyBhbiBpbXBsZW1lbnRlci4gIEZvciBleGFtcGxlLCB0aGUgY2xhaW1zICJpc3Mi LCAic3ViIiwgYW5kICJhdWQiIGxvb2sgdG8gaGF2ZSBwb3B1bGF0aW9uL3Byb2Nlc3Npbmcgd2hp Y2ggaXMgYXBwbGljYXRpb24gc3BlY2lmaWMuICBUaGVyZWZvcmUgd2l0aCB0aGVzZSBjbGFpbXMs IGl0IGlzIHVwIHRvIGFwcGxpY2F0aW9ucyBvbiBlaXRoZXIgc2lkZSBvZiB0aGUgSldUIG11c3Qg Y29tZSB0byBhbiBhZ3JlZW1lbnQgb24gd2hhdCB0aGUgcG9wdWxhdGVkIGluc3RhbmNlcyBtZWFu LiAgKEkuZS4sIG5vdCB0aGUgV0cuKQ0KDQpDb21tb24gb2Ygb2JqZWN0IGRlZmluaXRpb25zL2Ns YWltcyBmcm9tIGludGVybmFsIGhhcmR3YXJlIGFyZSBpbXBvcnRhbnQgaWYgdGhlIE5ldHdvcmsg RWxlbWVudCBuZWVkcyB0byBhY3Qgb24gc3BlY2lmaWMgdmFsdWVzLiAgQW5kIGFzIGEgdmVuZG9y LCBJIGtub3cgdGhhdCBJIGRvIHdhbnQgdG8gYWN0IG9uIGluZm9ybWF0aW9uIGNvbWluZyBvdXQg b2YgaGFyZHdhcmUgZXZlbiBpZiB0aGUgaW5mb3JtYXRpb24gaXMgYmVpbmcgcHVzaGVkIHRvIGEg cmVtb3RlIHZhbGlkYXRvciAoZS5nLiwgaW1tZWRpYXRlbHkgcHVzaCBhbiBFQVQgdG9rZW4gZG93 bnN0cmVhbSBpZiBhIHNwZWNpZmljIGhhc2ggdmFsdWUgY2hhbmdlcykuICBBcyBhIHJlc3VsdCBJ IHdhbnQgbW9yZSBleHBsaWNpdCBhbmQgc3RhYmxlIGNsYWltIGRlZmluaXRpb25zLg0KDQpNb3Jl IGhpZ2hseSBzcGVjaWZpZWQgY2xhaW1zIG9mIGNvdXJzZSBleHBvc2VzIHBvc3NpYmxlIGNsYWlt IHJlZHVuZGFuY3ksIGZvcmVpZ24ga2V5IHJlbGF0aW9uc2hpcHMsIGFuZCBjcm9zcy1tYXBwaW5n IHdpdGggZG93bnN0cmVhbSBpbmZvcm1hdGlvbiBtb2RlbHMuIEkgYXNzZXJ0IHRoaXMgaXMgYSBn b29kIHRoaW5nIGJlY2F1c2Ugd2UgZXhwb3NlIChhbmQgaG9wZWZ1bGx5IG1pbmltaXplKSBjb3N0 cyB3aGljaCBhcmUgYm9ybmUgYnkgZG93bnN0cmVhbSBkZXZlbG9wZXJzLg0KDQpFcmljDQoNCkhh bm5lcyBUc2Nob2ZlbmlnLCBKdW5lIDcsIDIwMTkgNzoyOSBBTQ0KRldJVzogV2hpbGUgdGhlIEpX VCByZWdpc3RyeSBsb29rcyBtb3JlIG1peGVkIGluIHRlcm1zIG9mIGNsYWltIHR5cGVzLiBUaGlz IGlzLCBob3dldmVyLCBvbmx5IGEgcmVzdWx0IG9mIHRoZSB3aWRlc3ByZWFkIGFkb3B0aW9uLg0K VGhlcmUgYXJlIG5vIHByb2JsZW1zLCBhcyBmYXIgYXMgSSBrbm93LCB3aXRoIHRoZSBkaXZlcnNp dHkgb2YgdGhlIGNsYWltcyBhbmQgdGhhdCB0aGV5IGFyZSBub3QgYWxsIHVzZWZ1bCBpbiBldmVy eSBjb250ZXh0LiBEaWZmZXJlbnQgZGVwbG95bWVudHMgdXNlIHRoZSBjbGFpbXMgdGhleSBmaW5k IHVzZWZ1bC4NCg0KSSBhbSB3b25kZXJpbmcgd2hldGhlciB3ZSBhcmUgdHJ5aW5nIHRvIGZpeCBh IHByb2JsZW0gd2l0aCB0aGUgcmVnaXN0cnkgb2YgY2xhaW1zIHRoYXQgZG9lc27igJl0IG9jY3Vy IGluIHByYWN0aWNlLg0KDQpDaWFvDQpIYW5uZXMNCg0KRnJvbTogUkFUUyA8cmF0cy1ib3VuY2Vz QGlldGYub3JnPG1haWx0bzpyYXRzLWJvdW5jZXNAaWV0Zi5vcmc+PiBPbiBCZWhhbGYgT2YgTWlr ZSBKb25lcw0KU2VudDogTWl0dHdvY2gsIDUuIEp1bmkgMjAxOSAxOTozMQ0KVG86IExhdXJlbmNl IEx1bmRibGFkZSA8bGdsQGlzbGFuZC1yZXNvcnQuY29tPG1haWx0bzpsZ2xAaXNsYW5kLXJlc29y dC5jb20+PjsgTWljaGFlbCBSaWNoYXJkc29uIDxtY3IraWV0ZkBzYW5kZWxtYW4uY2E8bWFpbHRv Om1jcitpZXRmQHNhbmRlbG1hbi5jYT4+DQpDYzogcmF0c0BpZXRmLm9yZzxtYWlsdG86cmF0c0Bp ZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBbUmF0c10gVmV0dGluZyBjbGFpbSBkZWZpbml0aW9ucw0K DQpBY3R1YWxseSwgbm9ybWFsIChub24tY29sbGlzaW9uLXJlc2lzdGFudCkgSldUIGNsYWltcyAq YXJlKiBhbGxvY2F0ZWQgb24gYSBzcGVjaWZpY2F0aW9uIHJlcXVpcmVkIGJhc2lzIHdpdGggZXhw ZXJ0IHJldmlldy4gIFNlZSB0aGlzIHRleHQgYXQgaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1s L3JmYzc1MTkjc2VjdGlvbi0xMC4xPGh0dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rpb24u b3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnRvb2xzLmlldGYub3JnJTJGaHRtbCUyRnJm Yzc1MTklMjNzZWN0aW9uLTEwLjEmZGF0YT0wMiU3QzAxJTdDTWljaGFlbC5Kb25lcyU0MG1pY3Jv c29mdC5jb20lN0M2OThlMGQwYTgzM2U0MTIyN2UyOTA4ZDZlYjc5ODI1YiU3QzcyZjk4OGJmODZm MTQxYWY5MWFiMmQ3Y2QwMTFkYjQ3JTdDMSU3QzAlN0M2MzY5NTUzMDQ0NTc4MTU3MDgmc2RhdGE9 VTVTb3FFRXFhazZiOFhEYkR3eXpBTk5wTVJaY2NINHdrdER5dHNqYm01TSUzRCZyZXNlcnZlZD0w PjoNCg0KICAgVmFsdWVzIGFyZSByZWdpc3RlcmVkIG9uIGEgU3BlY2lmaWNhdGlvbiBSZXF1aXJl ZCBbUkZDNTIyNjxodHRwczovL25hbTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29t Lz91cmw9aHR0cHMlM0ElMkYlMkZ0b29scy5pZXRmLm9yZyUyRmh0bWwlMkZyZmM1MjI2JmRhdGE9 MDIlN0MwMSU3Q01pY2hhZWwuSm9uZXMlNDBtaWNyb3NvZnQuY29tJTdDNjk4ZTBkMGE4MzNlNDEy MjdlMjkwOGQ2ZWI3OTgyNWIlN0M3MmY5ODhiZjg2ZjE0MWFmOTFhYjJkN2NkMDExZGI0NyU3QzEl N0MwJTdDNjM2OTU1MzA0NDU3ODI1OTEwJnNkYXRhPXNkSWlWJTJCam1UdG1adGQlMkJHRnJpTVox JTJCeCUyRnRSOGglMkZnUVJZVmpwaFQ1JTJGRTQlM0QmcmVzZXJ2ZWQ9MD5dIGJhc2lzDQogICBh ZnRlciBhIHRocmVlLXdlZWsgcmV2aWV3IHBlcmlvZCBvbiB0aGUgand0LXJlZy1yZXZpZXdAaWV0 Zi5vcmc8bWFpbHRvOmp3dC1yZWctcmV2aWV3QGlldGYub3JnPg0KICAgbWFpbGluZyBsaXN0LCBv biB0aGUgYWR2aWNlIG9mIG9uZSBvciBtb3JlIERlc2lnbmF0ZWQgRXhwZXJ0cy4NCiAgIEhvd2V2 ZXIsIHRvIGFsbG93IGZvciB0aGUgYWxsb2NhdGlvbiBvZiB2YWx1ZXMgcHJpb3IgdG8gcHVibGlj YXRpb24sDQogICB0aGUgRGVzaWduYXRlZCBFeHBlcnRzIG1heSBhcHByb3ZlIHJlZ2lzdHJhdGlv biBvbmNlIHRoZXkgYXJlDQogICBzYXRpc2ZpZWQgdGhhdCBzdWNoIGEgc3BlY2lmaWNhdGlvbiB3 aWxsIGJlIHB1Ymxpc2hlZC4NCg0KU28gYSBzcGVjaWZpY2F0aW9uIGNhbiBlYXNpbHkgcmVnaXN0 ZXIgYm90aCBKV1QgYW5kIENXVCBjbGFpbXMuDQoNCiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtLSBNaWtlDQoNCkZyb206IExhdXJlbmNlIEx1 bmRibGFkZSA8bGdsQGlzbGFuZC1yZXNvcnQuY29tPG1haWx0bzpsZ2xAaXNsYW5kLXJlc29ydC5j b20+Pg0KU2VudDogV2VkbmVzZGF5LCBKdW5lIDUsIDIwMTkgODo0NiBBTQ0KVG86IE1pY2hhZWwg UmljaGFyZHNvbiA8bWNyK2lldGZAc2FuZGVsbWFuLmNhPG1haWx0bzptY3IraWV0ZkBzYW5kZWxt YW4uY2E+Pg0KQ2M6IHJhdHNAaWV0Zi5vcmc8bWFpbHRvOnJhdHNAaWV0Zi5vcmc+OyBNaWtlIEpv bmVzIDxNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb208bWFpbHRvOk1pY2hhZWwuSm9uZXNAbWlj cm9zb2Z0LmNvbT4+DQpTdWJqZWN0OiBSZTogW1JhdHNdIFZldHRpbmcgY2xhaW0gZGVmaW5pdGlv bnMNCg0KQmVsb3figKYNCisgTWlrZSBKb25lcywgY28tYXV0aG9yIG9mIENXVA0KDQpPbiBKdW4g NSwgMjAxOSwgYXQgNjowNSBBTSwgTWljaGFlbCBSaWNoYXJkc29uIDxtY3IraWV0ZkBzYW5kZWxt YW4uY2E8bWFpbHRvOm1jcitpZXRmQHNhbmRlbG1hbi5jYT4+IHdyb3RlOg0KDQoNCkxhdXJlbmNl IEx1bmRibGFkZSA8bGdsQGlzbGFuZC1yZXNvcnQuY29tPG1haWx0bzpsZ2xAaXNsYW5kLXJlc29y dC5jb20+PiB3cm90ZToNCuKAlCBUb2RheSBDV1QgYWxsb2NhdGVzIG1pbGxpb25zIG9mIHNsb3Rz IGZvciBleHBlcnQgcmV2aWV3LiBObw0Kc3BlY2lmaWNhdGlvbiBpcyByZXF1aXJlZCwgYnV0IHNv bWUgaW5mb3JtYXRpb24gc2hvdWxkIGJlIHByb3ZpZGVkLg0KDQpKV1QgZG9lc27igJl0IHNlZW0g dG8gaGF2ZSB0aGlzLCB3aGljaCBpcyBtYXliZSB3aHkgaXQgaXMgbWVzc2llci4gSXQNCmtpbmQg b2Ygc2VlbXMgYmFkIGFuZCB3cm9uZyB0aGF0IGl0IGRvZXNu4oCZdCB0byBtZS4NCg0KSldUIGRv ZXNuJ3QgaGF2ZSB0aGlzIGJlY2F1c2UgdGhlIGNsYWltcyBhcmUgInVubGltaXRlZCIgbGVuZ3Ro IHN0cmluZ3MsIHNvDQpvbmUgY2FuIGFsd2F5cyBtYWtlIHVwIGEgdW5pcXVlIHN0cmluZyBpbiBs aWV1IG9mIHJlZ2lzdHJhdGlvbi4NCiBvcmcuaXNsYW5kLXJlc29ydC5sZ2wud2hhdGV2ZXJzdHJp bmd5b3V3YW50DQoNCmlzIHByb2JhYmx5IGNvbXBsZXRlbHkgeW91cnMgOi0pDQpPZiBjb3Vyc2Us IGlmIHlvdSB3YW50IHRvIGludGVyb3BlcmF0ZSB5b3UgbmVlZCB0byBhZ3JlZSBhYm91dCBob3cs IHNvIHRoZXJlDQphcmUgc29tZSBhZHZhbnRhZ2VzIG9mIGEgZm9yY2luZyBmdW5jdGlvbiB0aGF0 IGRlbWFuZHMgeW91IHdyaXRlIHRoaW5ncyBkb3duDQpmaXJzdCA6LSkNCg0KVW5saW1pdGVkIGxl bmd0aCBzdHJpbmcgY2xhaW0gbmFtZXMgYXJlIGZ1bGx5IHBhcnQgb2YgQ1dULiBBbHNvLCBDT1NF IGFsbG93cyB0aGVtIGZvciBoZWFkZXJzLCBhbGdvcml0aG0gbmFtZXMgYW5kIHN1Y2ggdG9vLiBT byBmcm9tIGEgc3ludGF4IHZpZXcgQ1dUIGFuZCBDT1NFIGFyZSB0aGUgc2FtZSBhcyBKV1QgaW4g YWxsb3dpbmcgbG9uZyBzdHJpbmcgbmFtZXMuDQoNCkhvd2V2ZXIsIENPU0UgYW5kIENXVCBhcmUg ZGlmZmVyZW50IGluIHRoZSBtYW5hZ2VtZW50IG9mIHRoZSBzdHJpbmcgbmFtZSBzcGFjZToNCg0K U3RyaW5ncyBvZiBsZW5ndGggMSAgICAgICAgICAgIFN0YW5kYXJkcyBBY3Rpb24NClN0cmluZ3Mg b2YgbGVuZ3RoIDIgICAgICAgICAgICBTcGVjaWZpY2F0aW9uIFJlcXVpcmVkDQpTdHJpbmdzIG9m IGxlbmd0aCBncmVhdGVyIHRoYW4gMiAgICBFeHBlcnQgUmV2aWV3DQoNClRoZXNlLCBhbG9uZyB3 aXRoIHRoZSBpbnRlZ2VyIG5hbWVzIHNwYWNlIHJ1bGVzLCB0aGVuIGltcGx5Og0KDQpJbnRlZ2Vy IHZhbHVlcyBsZXNzIHRoYW4gLTY1NTM2IGFyZSB0aGUgb25seSBvbmVzIGZyZWUgZm9yIHVzZSB3 aXRoIG5vIHJldmlldyBvciBwcm9jZXNzaW5nIGJ5IElBTkEgYW5kIGV4cGVydHMuDQoNCkpXVCBh bHNvIGhhcyB0aGlzIG5vdGlvbiBvZiBDb2xsaXNpb24tUmVzaXN0YW50IE5hbWUgYmFzZWQgb24g T0lEcyBvciBVVUlEcywgd2hpY2ggaXMgZXNzZW50aWFsbHkgc29tZSBydWxlcyB0byBtYWtlIHVw IG5hbWVzIHRoYXQgZG9u4oCZdCBnbyBpbnRvIGFuIElBTkEgcmVnaXN0cnkgYW5kIGFyZSBzdGls bCB1bmlxdWUgYW5kIHdvbuKAmXQgY29sbGlkZS4NCg0KSldUIGNvdWxkIGhhdmUgZG9uZSB3aGF0 IENXVCBkb2VzLiBTZWVtcyB0byBtZSB0aGF0IENXVCBoYXMgdGFrZW4gYSByYWRpY2FsbHkgbW9y ZSBtYW5hZ2VkIGFwcHJvYWNoIHRvIHRoZSBzdXBlci1vcGVuIEpXVCBhcHByb2FjaC4gTWF5YmUg dGhlIENXVCBmb2xrcyByZWFsaXplZCB0aGUgSldUIGRlc2lnbiB3YXMgcG9vci4NCg0KDQpBdCBh bnkgcmF0ZSwgdGhlcmUgc2VlbXMgdG8gYmUgc29tZSBjb25zZW5zdXMgaGVyZSB0aGF0IHRoZSBD V1QgYXBwcm9hY2ggaXMgd2hhdCB3ZSB3YW50IGZvciBhdHRlc3RhdGlvbi4gSXQgaXMgYWxzbyB0 aGUgbW9yZSByZWNlbnQgYW5kIHRodXMgbWF5YmUgbW9yZSBhZHZhbmNlZCB0aGlua2luZy4NCg0K SeKAmW0gaG9waW5nIHdlIGNhbiBmaW5kIG91ciB3YXkgdG8ganVzdCBhY2NlcHQgdGhlIENXVCBj bGFpbSBuYW1pbmcgbWFuYWdlbWVudCBzY2hlbWUgYXMgaXMgZm9yIGF0dGVzdGF0aW9uLiBJZiBv dGhlciBDV1QtYmFzZWQgZWZmb3J0cyBkaWQgdGhlIHNhbWUgKGRyYWZ0LWJpcmtob2x6LWNvcmUt Y29pZCkgZGlkIHRoZSBzYW1lIHRoZW4gdGhlIHdvcmxkIHdvdWxkIGJlIG11Y2ggc2ltcGxlci4N Cg0KSG93ZXZlciB0aGF0IHN0aWxsIGxlYXZlcyBvcGVuIHNvbWUgaXNzdWUgd2l0aCBKV1QgbmFt ZXNwYWNlIG1hbmFnZW1lbnQuIChXZSBkbyB3YW50IEpTT04gYmFzZWQgYXR0ZXN0YXRpb24gdG8g YmUgSldU4oCZcywgcmlnaHQ/IEp1c3QgdGhlIHNhbWUgYXMgQ0JPUi1iYXNlZCBhdHRlc3RhdGlv biBhcmUgQ1dU4oCZcykuDQoNCkxMDQoNCklNUE9SVEFOVCBOT1RJQ0U6IFRoZSBjb250ZW50cyBv ZiB0aGlzIGVtYWlsIGFuZCBhbnkgYXR0YWNobWVudHMgYXJlIGNvbmZpZGVudGlhbCBhbmQgbWF5 IGFsc28gYmUgcHJpdmlsZWdlZC4gSWYgeW91IGFyZSBub3QgdGhlIGludGVuZGVkIHJlY2lwaWVu dCwgcGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyIGltbWVkaWF0ZWx5IGFuZCBkbyBub3QgZGlzY2xv c2UgdGhlIGNvbnRlbnRzIHRvIGFueSBvdGhlciBwZXJzb24sIHVzZSBpdCBmb3IgYW55IHB1cnBv c2UsIG9yIHN0b3JlIG9yIGNvcHkgdGhlIGluZm9ybWF0aW9uIGluIGFueSBtZWRpdW0uIFRoYW5r IHlvdS4NCg0K --_000_MW2PR00MB0298D282632D828F2BCB16F5F5100MW2PR00MB0298namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDEx IDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZp c2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5 Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAubXNvbm9y bWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6bXNv bm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJ bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6 ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5hcHBs ZS1jb252ZXJ0ZWQtc3BhY2UNCgl7bXNvLXN0eWxlLW5hbWU6YXBwbGUtY29udmVydGVkLXNwYWNl O30NCnNwYW4uYXBwbGUtdGFiLXNwYW4NCgl7bXNvLXN0eWxlLW5hbWU6YXBwbGUtdGFiLXNwYW47 fQ0Kc3Bhbi5FbWFpbFN0eWxlMjANCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJ Zm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6IzAwMjA2MDt9DQouTXNv Q2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAu MHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46 MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRT ZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVk ZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0t PjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0K PG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+ PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxp bms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPlRoaXMgaXMgZXhhY3RseSB0aGUgYXBw cm9hY2ggSeKAmWQgYWR2b2NhdGUuJm5ic3A7IFRvIGJlIGZ1bGx5IGludGVyb3BlcmFibGUsIGJv dGggSldUcyBhbmQgQ1dUcw0KPGI+PGk+YnkgZGVzaWduPC9pPjwvYj4gcmVxdWlyZSBhbiBhcHBs aWNhdGlvbiBwcm9maWxlIHRoYXQgZGVmaW5lcyB0aGUgcHJvY2Vzc2luZyBydWxlcyBmb3IgZWFj aCBvZiB0aGUgY2xhaW1zLiZuYnNwOyBGb3IgaW5zdGFuY2UsIE9wZW5JRCBDb25uZWN0IGRlZmlu ZXMgc29tZXRoaW5nIGNhbGxlZCBhbg0KPGEgaHJlZj0iaHR0cHM6Ly9vcGVuaWQubmV0L3NwZWNz L29wZW5pZC1jb25uZWN0LWNvcmUtMV8wLmh0bWwjSURUb2tlbiI+SUQgVG9rZW48L2E+LCB3aGlj aCBpcyBhIEpXVCB3aXRoDQo8YSBocmVmPSJodHRwczovL29wZW5pZC5uZXQvc3BlY3Mvb3Blbmlk LWNvbm5lY3QtY29yZS0xXzAuaHRtbCNJRFRva2VuVmFsaWRhdGlvbiI+DQpzcGVjaWZpYyBwcm9j ZXNzaW5nIHJ1bGVzPC9hPiBmb3IgdGhlIGNsYWltcy4mbmJzcDsgRm9yIGluc3RhbmNlLCBpdCBz YXlzIGhvdyB0byB1c2UgdGhlIOKAnGlzc+KAnSAoaXNzdWVyKSBjbGFpbSB0byByZXRyaWV2ZSBw dWJsaWMga2V5cyB0byB2YWxpZGF0ZSB0aGUgSldUIHNpZ25hdHVyZS48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImNvbG9yOiMwMDIwNjAiPkZvciBFQVRzLCBqdXN0IGxpa2Ugb3RoZXIgYXBwbGljYXRp b25zIG9mIEpXVHMgYW5kIENXVHMsIGFwcGxpY2F0aW9uIHByb2ZpbGVzIHdpbGwgYmUgcmVxdWly ZWQgdG8gZGVmaW5lIHRoZSBob3cgdG8gdXNlIHRoZSBjbGFpbXMgaW4gdGhlIEVBVC4mbmJzcDsg VGhpcyBpcyBhcyBpdCBzaG91bGQgYmUuJm5ic3A7IElmIHdlIGFsc28gd2FudCB0byBjcmVhdGUg c3VjaCBhIHByb2ZpbGUNCiAob3IgbXVsdGlwbGUgc3VjaCBwcm9maWxlcykgaW4gYWRkaXRpb24g dG8gdGhlIGdlbmVyYWwgRUFUIHNwZWNpZmljYXRpb24sIHdlIGNhbiBkbyB0aGF0LjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjoj MDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7IC0tIE1pa2U8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQg I0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxiPkZyb206PC9iPiBSQVRTICZsdDtyYXRzLWJvdW5jZXNAaWV0Zi5vcmcmZ3Q7IDxi Pk9uIEJlaGFsZiBPZiA8L2I+DQpMYXVyZW5jZSBMdW5kYmxhZGU8YnI+DQo8Yj5TZW50OjwvYj4g RnJpZGF5LCBKdW5lIDcsIDIwMTkgMTE6NTMgQU08YnI+DQo8Yj5Ubzo8L2I+IEVyaWMgVm9pdCAo ZXZvaXQpICZsdDtldm9pdEBjaXNjby5jb20mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBNaWNoYWVsIFJp Y2hhcmRzb24gJmx0O21jciYjNDM7aWV0ZkBzYW5kZWxtYW4uY2EmZ3Q7OyBIYW5uZXMgVHNjaG9m ZW5pZyAmbHQ7SGFubmVzLlRzY2hvZmVuaWdAYXJtLmNvbSZndDs7IE1pa2UgSm9uZXMgJmx0O01p Y2hhZWwuSm9uZXM9NDBtaWNyb3NvZnQuY29tQGRtYXJjLmlldGYub3JnJmd0OzsgcmF0c0BpZXRm Lm9yZzxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW1JhdHNdIFZldHRpbmcgY2xhaW0gZGVmaW5p dGlvbnM8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhpIEVyaWMsPG86 cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5GZWVscyBsaWtlIHRo ZXJl4oCZcyBvcHBvc2luZyB2aWV3czo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2tx dW90ZSBzdHlsZT0ibWFyZ2luLWxlZnQ6MzAuMHB0O21hcmdpbi1yaWdodDowaW4iPg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjEpIENhcnN0ZW4sIEthdGhsZWVuLCBteXNlbGYgYW5kIG1h eWJlIEhlbmsgYW5kIG90aGVycyB3YW50IGFuIEVBVCB0byBiZSBhIENXVC9KV1QuVGhpcyByZWFs bHkgZG9lcyBtYWtlIHRoZSBjbGFpbSBzZXQgb3Blbi1lbmRlZC4gQ1dUIGlzIGEgYml0IG1vcmUg Y2FyZWZ1bGx5IG1hbmFnZWQgdGhhbiBKV1QsIGJ1dCB3ZeKAmWxsIHN0aWxsIGVuZCB1cCB3aXRo IGEgbG90IG9mIGNsYWltcyByZWdpc3RlcmVkLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4yKSBZb3Ugd2FudCBhIHZlcnkgd2VsbC1k ZWZpbmVkIGNvbmNpc2UgY2xhaW0gc2V0LCBhIGNvbnRyb2xsZWQgcG9saWN5IGZvciBhbGxvd2lu ZyBuZXcgY2xhaW1zIGFuZCBtYXhpbWFsIGludGVyb3BlcmFiaWxpdHkuPG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkg dGhpbmsgYm90aCBvYmplY3RpdmVzIGFyZSBnb29kIGFuZCBkZXNpcmFibGUuPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgdGhpbmsgdGhlIHdh eSB0byBoYXZlIGJvdGggaXMgdG8gbGVhdmUgdGhlIENXVC9KV1QgcmVnaXN0cmF0aW9uIG9wZW4g YXMgdGhleSBhcmUgQU5EIEFMU08gZGVmaW5lIGEgcHJvZmlsZSAvIHN1YnNldCBpbiBhbiBJRVRG IHN0YW5kYXJkIGZvciB5b3VyIHVzZSBjYXNlLiBUaGlzIHByb2ZpbGUgLyBzdWJzZXQgY2FuOjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tbGVmdDoz MC4wcHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+LSBN YWtlIGNsZWFyIG5vcm1hdGl2ZSByZWZlcmVuY2VzIHRvIGV4dGFudCBjbGFpbXMgdGhhdCBhcmUg Y29uc2lkZXJlZCB3ZWxsLWVub3VnaCBmb3JtZWQgYW5kIGludGVyb3BlcmFibGU8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPi0gRGVmaW5lIHNvbWUg bmV3IGNsYWltcyB3aGVyZSBub25lIGFyZSBleHRhbnQ8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPi0gRGVmaW5lIGEgcG9saWN5IGZvciBhZGRpbmcg bmV3IGNsYWltcyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+LSBMYWJlbGxpbmcgdG8gZGlzdGluZ3Vpc2ggdGhlIHByb2ZpbGUgZnJvbSBh IGdlbmVyYWwgb3Blbi1lbmRlZCBDV1QvSldUPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9i bG9ja3F1b3RlPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U28gb25lIHdheSBmb3J3YXJkIGlzIGZv ciB0aGlzIFdHIHRvIGFkb3B0IGFub3RoZXIgZG9jdW1lbnQuIE1heWJlIGNhbGwgaXQg4oCcUm91 dGVyIEF0dGVzdGF0aW9uIFByb2ZpbGXigJ0uLiAmbmJzcDtUaGlzIHdvdWxkIGJlIGluIGFkZGl0 aW9uIHRvIEVBVC4gSXQgbWFrZXMgbm9ybWF0aXZlIHJlZmVyZW5jZXMgdG8gdGhlIEVBVCBjbGFp bXMgaXQgbGlrZXMuPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5Bbm90aGVyIHdheSBmb3J3YXJkIGlzIGZvciB0aGUgRUFUIGRyYWZ0IHRvIGNoYW5nZSBkaXJl Y3Rpb24gc29tZSBhbmQgYmVjb21lIHRoZSBtb3JlIHRpZ2h0IGFuZCBsaW1pdGVkIGF0dGVzdGF0 aW9uIGRlZmluaXRpb24uIEl0IHdvdWxkIHByb2JhYmx5IGFkZHJlc3MgbW9yZSB0aGFuIGp1c3Qg dGhlIHJvdXRlciB1c2UgY2FzZSwgYnV0IGl0IHdvdWxkIHJldGFpbiB0aGUgbWFpbiBjaGFyYWN0 ZXJpc3RpY3MgeW91DQogd2FudC4gSWYgd2UgZG8gdGhpcywgdGhlbiB3ZSBjYW4gZXhwZWN0IG90 aGVyIGF0dGVzdGF0aW9uIHVzZSBjYXNlcyB0byB3cml0ZSBkb2N1bWVudHMgYW5kIG1heWJlIHJ1 biB0aGVtIHRocm91Z2ggdGhpcyBXRyBvciBtYXliZSBub3QuPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEy LjBwdCI+TEw8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PGJyPg0KPGJyPg0KPG86cD48L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2lu LXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5PbiBKdW4gNywgMjAxOSwgYXQgMTA6MTQgQU0sIEVyaWMgVm9pdCAoZXZvaXQpICZsdDs8 YSBocmVmPSJtYWlsdG86ZXZvaXRAY2lzY28uY29tIj5ldm9pdEBjaXNjby5jb208L2E+Jmd0OyB3 cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhpIEhh bm5lcyw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+SWYgd2Ugd2VyZSBzdXJlIHdlIGNvdWxkIGxpbWl0IEVBVCBjbGFpbXMgdG8ganVzdCBhIGZl dyB0aGluZ3Mgd2hpY2ggY29tZSBvdXQgb2YgaGFyZHdhcmUsIHRoaXMgd291bGRuJ3QgY29uY2Vy biBtZSBhcyBtdWNoIGFzIGl0IGRvZXMuJm5ic3A7IEhvd2V2ZXIgdGhlIGRvbWFpbiBvZiBhdHRl c3RhYmxlIG9iamVjdHMgd2FzIGxlZnQgZmFpcmx5IG9wZW4gd2l0aGluIHRoZSBFQVQgZHJhZnQu Jm5ic3A7ICZuYnNwO0FuZCB3ZSBuZWVkIHRvDQogZGV0ZXJtaW5lIHdoYXQgbGV2ZWwgb2YgaW50 ZXJvcGVyYWJpbGl0eSBhcmUgd2UgdHJ5aW5nIHRvIHNoZXBoZXJkIHZpYSBSQVRTLjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JbiB0aGUgZW5k LCBSQVRTIChhbmQgRUFUKSBuZWVkIHRvIGRldGVybWluZSB0aGUgbGV2ZWwgb2YgaW50ZXJvcGVy YWJpbGl0eSBkZXNpcmVkIGZvciBzcGVjaWZpYyBjbGFpbXMuJm5ic3A7Jm5ic3A7IEkgZG9uJ3Qg Y2xhaW0gZGVlcCBmYW1pbGlhcml0eSB3aXRoIEpXVC4mbmJzcDsgQnV0IGxvb2tpbmcgYXQgUkZD LTc1MTksIFNlY3Rpb24gNC4xLCBJIHNlZSB0aGF0IEkgd291bGQgaGF2ZSBxdWVzdGlvbnMgYXMg YW4gaW1wbGVtZW50ZXIuJm5ic3A7DQogRm9yIGV4YW1wbGUsIHRoZSBjbGFpbXMgJnF1b3Q7aXNz JnF1b3Q7LCAmcXVvdDtzdWImcXVvdDssIGFuZCAmcXVvdDthdWQmcXVvdDsgbG9vayB0byBoYXZl IHBvcHVsYXRpb24vcHJvY2Vzc2luZyB3aGljaCBpcyBhcHBsaWNhdGlvbiBzcGVjaWZpYy4mbmJz cDsgVGhlcmVmb3JlIHdpdGggdGhlc2UgY2xhaW1zLCBpdCBpcyB1cCB0byBhcHBsaWNhdGlvbnMg b24gZWl0aGVyIHNpZGUgb2YgdGhlIEpXVCBtdXN0IGNvbWUgdG8gYW4gYWdyZWVtZW50IG9uIHdo YXQgdGhlIHBvcHVsYXRlZCBpbnN0YW5jZXMgbWVhbi4mbmJzcDsNCiAoSS5lLiwgbm90IHRoZSBX Ry4pJm5ic3A7Jm5ic3A7PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7 PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5Db21tb24gb2Ygb2JqZWN0IGRlZmluaXRpb25zL2NsYWltcyBmcm9tIGludGVybmFsIGhh cmR3YXJlIGFyZSBpbXBvcnRhbnQgaWYgdGhlIE5ldHdvcmsgRWxlbWVudCBuZWVkcyB0byBhY3Qg b24gc3BlY2lmaWMgdmFsdWVzLiZuYnNwOyBBbmQgYXMgYSB2ZW5kb3IsIEkga25vdyB0aGF0IEkg ZG8gd2FudCB0byBhY3Qgb24gaW5mb3JtYXRpb24gY29taW5nIG91dCBvZiBoYXJkd2FyZSBldmVu IGlmIHRoZSBpbmZvcm1hdGlvbg0KIGlzIGJlaW5nIHB1c2hlZCB0byBhIHJlbW90ZSB2YWxpZGF0 b3IgKGUuZy4sIGltbWVkaWF0ZWx5IHB1c2ggYW4gRUFUIHRva2VuIGRvd25zdHJlYW0gaWYgYSBz cGVjaWZpYyBoYXNoIHZhbHVlIGNoYW5nZXMpLiZuYnNwOyBBcyBhIHJlc3VsdCBJIHdhbnQgbW9y ZSBleHBsaWNpdCBhbmQgc3RhYmxlIGNsYWltIGRlZmluaXRpb25zLjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Nb3JlIGhpZ2hseSBzcGVjaWZp ZWQgY2xhaW1zIG9mIGNvdXJzZSBleHBvc2VzIHBvc3NpYmxlIGNsYWltIHJlZHVuZGFuY3ksIGZv cmVpZ24ga2V5IHJlbGF0aW9uc2hpcHMsIGFuZCBjcm9zcy1tYXBwaW5nIHdpdGggZG93bnN0cmVh bSBpbmZvcm1hdGlvbiBtb2RlbHMuIEkgYXNzZXJ0IHRoaXMgaXMgYSBnb29kIHRoaW5nIGJlY2F1 c2Ugd2UgZXhwb3NlIChhbmQgaG9wZWZ1bGx5IG1pbmltaXplKSBjb3N0cyB3aGljaA0KIGFyZSBi b3JuZSBieSBkb3duc3RyZWFtIGRldmVsb3BlcnMuJm5ic3A7PHNwYW4gY2xhc3M9ImFwcGxlLWNv bnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5FcmljPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgYmx1ZSAxLjVwdDtwYWRk aW5nOjBpbiAwaW4gMGluIDQuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPkhhbm5lcyBUc2Nob2ZlbmlnLCBKdW5lIDcsIDIwMTkg NzoyOSBBTTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gbGFuZz0iRU4tR0IiPkZXSVc6IFdoaWxlIHRoZSBKV1QgcmVnaXN0cnkgbG9va3Mg bW9yZSBtaXhlZCBpbiB0ZXJtcyBvZiBjbGFpbSB0eXBlcy4gVGhpcyBpcywgaG93ZXZlciwgb25s eSBhIHJlc3VsdCBvZiB0aGUgd2lkZXNwcmVhZCBhZG9wdGlvbi48L3NwYW4+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1H QiI+VGhlcmUgYXJlIG5vIHByb2JsZW1zLCBhcyBmYXIgYXMgSSBrbm93LCB3aXRoIHRoZSBkaXZl cnNpdHkgb2YgdGhlIGNsYWltcyBhbmQgdGhhdCB0aGV5IGFyZSBub3QgYWxsIHVzZWZ1bCBpbiBl dmVyeSBjb250ZXh0LiBEaWZmZXJlbnQgZGVwbG95bWVudHMgdXNlIHRoZSBjbGFpbXMgdGhleSBm aW5kIHVzZWZ1bC48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4t R0IiPkkgYW0gd29uZGVyaW5nIHdoZXRoZXIgd2UgYXJlIHRyeWluZyB0byBmaXggYSBwcm9ibGVt IHdpdGggdGhlIHJlZ2lzdHJ5IG9mIGNsYWltcyB0aGF0IGRvZXNu4oCZdCBvY2N1ciBpbiBwcmFj dGljZS48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPkNp YW88L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+SGFubmVzPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPiZuYnNw Ozwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRl cjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAw aW4gMGluIj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5Gcm9tOjwvYj48c3BhbiBj bGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+UkFUUyAmbHQ7PGEgaHJl Zj0ibWFpbHRvOnJhdHMtYm91bmNlc0BpZXRmLm9yZyI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBs ZSI+cmF0cy1ib3VuY2VzQGlldGYub3JnPC9zcGFuPjwvYT4mZ3Q7PHNwYW4gY2xhc3M9ImFwcGxl LWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxiPk9uIEJlaGFsZiBPZjxzcGFuIGNsYXNz PSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L2I+TWlrZQ0KIEpvbmVzPGJy Pg0KPGI+U2VudDo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7 PC9zcGFuPk1pdHR3b2NoLCA1LiBKdW5pIDIwMTkgMTk6MzE8YnI+DQo8Yj5Ubzo8L2I+PHNwYW4g Y2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPkxhdXJlbmNlIEx1bmRi bGFkZSAmbHQ7PGEgaHJlZj0ibWFpbHRvOmxnbEBpc2xhbmQtcmVzb3J0LmNvbSI+PHNwYW4gc3R5 bGU9ImNvbG9yOnB1cnBsZSI+bGdsQGlzbGFuZC1yZXNvcnQuY29tPC9zcGFuPjwvYT4mZ3Q7OyBN aWNoYWVsIFJpY2hhcmRzb24gJmx0OzxhIGhyZWY9Im1haWx0bzptY3ImIzQzO2lldGZAc2FuZGVs bWFuLmNhIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5tY3ImIzQzO2lldGZAc2FuZGVsbWFu LmNhPC9zcGFuPjwvYT4mZ3Q7PGJyPg0KPGI+Q2M6PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252 ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YSBocmVmPSJtYWlsdG86cmF0c0BpZXRmLm9yZyI+ PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+cmF0c0BpZXRmLm9yZzwvc3Bhbj48L2E+PGJyPg0K PGI+U3ViamVjdDo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7 PC9zcGFuPlJlOiBbUmF0c10gVmV0dGluZyBjbGFpbSBkZWZpbml0aW9uczxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIGxhbmc9IkVOLUdCIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+QWN0 dWFsbHksIG5vcm1hbCAobm9uLWNvbGxpc2lvbi1yZXNpc3RhbnQpIEpXVCBjbGFpbXMgKjxiPmFy ZTwvYj4qIGFsbG9jYXRlZCBvbiBhIHNwZWNpZmljYXRpb24gcmVxdWlyZWQgYmFzaXMgd2l0aCBl eHBlcnQgcmV2aWV3LiZuYnNwOyBTZWUgdGhpcyB0ZXh0IGF0PHNwYW4gY2xhc3M9ImFwcGxlLWNv bnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8vbmFtMDYuc2FmZWxp bmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnRvb2xzLmlldGYu b3JnJTJGaHRtbCUyRnJmYzc1MTklMjNzZWN0aW9uLTEwLjEmYW1wO2RhdGE9MDIlN0MwMSU3Q01p Y2hhZWwuSm9uZXMlNDBtaWNyb3NvZnQuY29tJTdDNjk4ZTBkMGE4MzNlNDEyMjdlMjkwOGQ2ZWI3 OTgyNWIlN0M3MmY5ODhiZjg2ZjE0MWFmOTFhYjJkN2NkMDExZGI0NyU3QzElN0MwJTdDNjM2OTU1 MzA0NDU3ODE1NzA4JmFtcDtzZGF0YT1VNVNvcUVFcWFrNmI4WERiRHd5ekFOTnBNUlpjY0g0d2t0 RHl0c2pibTVNJTNEJmFtcDtyZXNlcnZlZD0wIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5o dHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNzUxOSNzZWN0aW9uLTEwLjE8L3NwYW4+PC9h Pjo8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOmJsYWNrO2JhY2tncm91bmQ6d2hpdGUiPiZuYnNwOyZu YnNwOyBWYWx1ZXMgYXJlIHJlZ2lzdGVyZWQgb24gYSBTcGVjaWZpY2F0aW9uIFJlcXVpcmVkIFs8 L3NwYW4+PGEgaHJlZj0iaHR0cHM6Ly9uYW0wNi5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29r LmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGdG9vbHMuaWV0Zi5vcmclMkZodG1sJTJGcmZjNTIyNiZh bXA7ZGF0YT0wMiU3QzAxJTdDTWljaGFlbC5Kb25lcyU0MG1pY3Jvc29mdC5jb20lN0M2OThlMGQw YTgzM2U0MTIyN2UyOTA4ZDZlYjc5ODI1YiU3QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3Y2QwMTFk YjQ3JTdDMSU3QzAlN0M2MzY5NTUzMDQ0NTc4MjU5MTAmYW1wO3NkYXRhPXNkSWlWJTJCam1UdG1a dGQlMkJHRnJpTVoxJTJCeCUyRnRSOGglMkZnUVJZVmpwaFQ1JTJGRTQlM0QmYW1wO3Jlc2VydmVk PTAiIHRpdGxlPSImcXVvdDtHdWlkZWxpbmVzIGZvciBXcml0aW5nIGFuIElBTkEgQ29uc2lkZXJh dGlvbnMgU2VjdGlvbiBpbiBSRkNzJnF1b3Q7Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBw dDtmb250LWZhbWlseTpDb25zb2xhcztjb2xvcjojMDA2NkNDIj5SRkM1MjI2PC9zcGFuPjwvYT48 c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6YmxhY2s7YmFja2dyb3VuZDp3 aGl0ZSI+XQ0KIGJhc2lzPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9y OmJsYWNrO2JhY2tncm91bmQ6d2hpdGUiPiZuYnNwOyZuYnNwOyBhZnRlciBhIHRocmVlLXdlZWsg cmV2aWV3IHBlcmlvZCBvbiB0aGU8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4m bmJzcDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOmp3dC1yZWctcmV2aWV3QGlldGYub3JnIj48c3Bh biBzdHlsZT0iY29sb3I6cHVycGxlIj5qd3QtcmVnLXJldmlld0BpZXRmLm9yZzwvc3Bhbj48L2E+ PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9yOmJsYWNrO2JhY2tncm91 bmQ6d2hpdGUiPiZuYnNwOyZuYnNwOyBtYWlsaW5nIGxpc3QsIG9uIHRoZSBhZHZpY2Ugb2Ygb25l IG9yIG1vcmUgRGVzaWduYXRlZCBFeHBlcnRzLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpD b25zb2xhcztjb2xvcjpibGFjaztiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDsmbmJzcDsgSG93ZXZl ciwgdG8gYWxsb3cgZm9yIHRoZSBhbGxvY2F0aW9uIG9mIHZhbHVlcyBwcmlvciB0byBwdWJsaWNh dGlvbiw8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6Q29uc29sYXM7Y29sb3I6YmxhY2s7YmFj a2dyb3VuZDp3aGl0ZSI+Jm5ic3A7Jm5ic3A7IHRoZSBEZXNpZ25hdGVkIEV4cGVydHMgbWF5IGFw cHJvdmUgcmVnaXN0cmF0aW9uIG9uY2UgdGhleSBhcmU8L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1p bHk6Q29uc29sYXM7Y29sb3I6YmxhY2s7YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7Jm5ic3A7IHNh dGlzZmllZCB0aGF0IHN1Y2ggYSBzcGVjaWZpY2F0aW9uIHdpbGwgYmUgcHVibGlzaGVkLjwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAw MjA2MCI+U28gYSBzcGVjaWZpY2F0aW9uIGNhbiBlYXNpbHkgcmVnaXN0ZXIgYm90aCBKV1QgYW5k IENXVCBjbGFpbXMuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPiZuYnNwOzwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 IC0tIE1pa2U8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVy LXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4iPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZyb206PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1j b252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5MYXVyZW5jZSBMdW5kYmxhZGUgJmx0OzxhIGhy ZWY9Im1haWx0bzpsZ2xAaXNsYW5kLXJlc29ydC5jb20iPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJw bGUiPmxnbEBpc2xhbmQtcmVzb3J0LmNvbTwvc3Bhbj48L2E+Jmd0OzxzcGFuIGNsYXNzPSJhcHBs ZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YnI+DQo8Yj5TZW50OjwvYj48c3BhbiBj bGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+V2VkbmVzZGF5LCBKdW5l IDUsIDIwMTkgODo0NiBBTTxicj4NCjxiPlRvOjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVy dGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+TWljaGFlbCBSaWNoYXJkc29uICZsdDs8YSBocmVmPSJt YWlsdG86bWNyJiM0MztpZXRmQHNhbmRlbG1hbi5jYSI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBs ZSI+bWNyJiM0MztpZXRmQHNhbmRlbG1hbi5jYTwvc3Bhbj48L2E+Jmd0Ozxicj4NCjxiPkNjOjwv Yj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGEgaHJl Zj0ibWFpbHRvOnJhdHNAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPnJhdHNA aWV0Zi5vcmc8L3NwYW4+PC9hPjsgTWlrZSBKb25lcyAmbHQ7PGEgaHJlZj0ibWFpbHRvOk1pY2hh ZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+TWljaGFl bC5Kb25lc0BtaWNyb3NvZnQuY29tPC9zcGFuPjwvYT4mZ3Q7PGJyPg0KPGI+U3ViamVjdDo8L2I+ PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPlJlOiBbUmF0 c10gVmV0dGluZyBjbGFpbSBkZWZpbml0aW9uczxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QmVsb3figKY8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mIzQz OyBNaWtlIEpvbmVzLCBjby1hdXRob3Igb2YgQ1dUPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7 bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi Pk9uIEp1biA1LCAyMDE5LCBhdCA2OjA1IEFNLCBNaWNoYWVsIFJpY2hhcmRzb24gJmx0OzxhIGhy ZWY9Im1haWx0bzptY3ImIzQzO2lldGZAc2FuZGVsbWFuLmNhIj48c3BhbiBzdHlsZT0iY29sb3I6 cHVycGxlIj5tY3ImIzQzO2lldGZAc2FuZGVsbWFuLmNhPC9zcGFuPjwvYT4mZ3Q7IHdyb3RlOjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxicj4NCkxhdXJlbmNlIEx1 bmRibGFkZSAmbHQ7PGEgaHJlZj0ibWFpbHRvOmxnbEBpc2xhbmQtcmVzb3J0LmNvbSI+PHNwYW4g c3R5bGU9ImNvbG9yOnB1cnBsZSI+bGdsQGlzbGFuZC1yZXNvcnQuY29tPC9zcGFuPjwvYT4mZ3Q7 IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4w cHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+4oCU IFRvZGF5IENXVCBhbGxvY2F0ZXMgbWlsbGlvbnMgb2Ygc2xvdHMgZm9yIGV4cGVydCByZXZpZXcu IE5vPGJyPg0Kc3BlY2lmaWNhdGlvbiBpcyByZXF1aXJlZCwgYnV0IHNvbWUgaW5mb3JtYXRpb24g c2hvdWxkIGJlIHByb3ZpZGVkLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPiZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFy Z2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SldUIGRvZXNu 4oCZdCBzZWVtIHRvIGhhdmUgdGhpcywgd2hpY2ggaXMgbWF5YmUgd2h5IGl0IGlzIG1lc3NpZXIu IEl0PGJyPg0Ka2luZCBvZiBzZWVtcyBiYWQgYW5kIHdyb25nIHRoYXQgaXQgZG9lc27igJl0IHRv IG1lLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PGJyPg0KSldUIGRvZXNuJ3QgaGF2ZSB0aGlzIGJlY2F1c2UgdGhlIGNs YWltcyBhcmUgJnF1b3Q7dW5saW1pdGVkJnF1b3Q7IGxlbmd0aCBzdHJpbmdzLCBzbzxicj4NCm9u ZSBjYW4gYWx3YXlzIG1ha2UgdXAgYSB1bmlxdWUgc3RyaW5nIGluIGxpZXUgb2YgcmVnaXN0cmF0 aW9uLjxicj4NCiZuYnNwO29yZy5pc2xhbmQtcmVzb3J0LmxnbC53aGF0ZXZlcnN0cmluZ3lvdXdh bnQ8YnI+DQo8YnI+DQppcyBwcm9iYWJseSBjb21wbGV0ZWx5IHlvdXJzIDotKTxicj4NCk9mIGNv dXJzZSwgaWYgeW91IHdhbnQgdG8gaW50ZXJvcGVyYXRlIHlvdSBuZWVkIHRvIGFncmVlIGFib3V0 IGhvdywgc28gdGhlcmU8YnI+DQphcmUgc29tZSBhZHZhbnRhZ2VzIG9mIGEgZm9yY2luZyBmdW5j dGlvbiB0aGF0IGRlbWFuZHMgeW91IHdyaXRlIHRoaW5ncyBkb3duPGJyPg0KZmlyc3QgOi0pPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VW5saW1pdGVk IGxlbmd0aCBzdHJpbmcgY2xhaW0gbmFtZXMgYXJlIGZ1bGx5IHBhcnQgb2YgQ1dULiBBbHNvLCBD T1NFIGFsbG93cyB0aGVtIGZvciBoZWFkZXJzLCBhbGdvcml0aG0gbmFtZXMgYW5kIHN1Y2ggdG9v LiBTbyBmcm9tIGEgc3ludGF4IHZpZXcgQ1dUIGFuZCBDT1NFIGFyZSB0aGUgc2FtZSBhcyBKV1Qg aW4gYWxsb3dpbmcgbG9uZyBzdHJpbmcgbmFtZXMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi Pkhvd2V2ZXIsIENPU0UgYW5kIENXVCBhcmUgZGlmZmVyZW50IGluIHRoZSBtYW5hZ2VtZW50IG9m IHRoZSBzdHJpbmcgbmFtZSBzcGFjZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi1sZWZ0OjMw LjBwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBw dCI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5TdHJpbmdzIG9m IGxlbmd0aCAxPHNwYW4gY2xhc3M9ImFwcGxlLXRhYi1zcGFuIj4mbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDs8L3NwYW4+PHNw YW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPlN0YW5kYXJkcyBB Y3Rpb248bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlN0cmluZ3Mgb2YgbGVuZ3RoIDI8c3BhbiBj bGFzcz0iYXBwbGUtdGFiLXNwYW4iPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOzwvc3Bhbj48c3BhbiBjbGFzcz0iYXBwbGUt Y29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+U3BlY2lmaWNhdGlvbiBSZXF1aXJlZDxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+U3RyaW5ncyBvZiBsZW5ndGggZ3JlYXRlciB0aGFuIDI8c3Bh biBjbGFzcz0iYXBwbGUtdGFiLXNwYW4iPiZuYnNwOyZuYnNwOyZuYnNwOzwvc3Bhbj48c3BhbiBj bGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+RXhwZXJ0IFJldmlldzxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5U aGVzZSwgYWxvbmcgd2l0aCB0aGUgaW50ZWdlciBuYW1lcyBzcGFjZSBydWxlcywgdGhlbiBpbXBs eTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi1sZWZ0OjMwLjBwdDttYXJnaW4tdG9wOjUuMHB0 O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JbnRlZ2VyIHZhbHVlcyBsZXNzIHRoYW4gLTY1NTM2 IGFyZSB0aGUgb25seSBvbmVzIGZyZWUgZm9yIHVzZSB3aXRoIG5vIHJldmlldyBvciBwcm9jZXNz aW5nIGJ5IElBTkEgYW5kIGV4cGVydHMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkpXVCBhbHNvIGhhcyB0aGlzIG5vdGlvbiBvZiZuYnNw O0NvbGxpc2lvbi1SZXNpc3RhbnQgTmFtZSBiYXNlZCBvbiBPSURzIG9yIFVVSURzLCB3aGljaCBp cyBlc3NlbnRpYWxseSBzb21lIHJ1bGVzIHRvIG1ha2UgdXAgbmFtZXMgdGhhdCBkb27igJl0IGdv IGludG8gYW4gSUFOQSByZWdpc3RyeSBhbmQgYXJlIHN0aWxsIHVuaXF1ZSBhbmQgd29u4oCZdCBj b2xsaWRlLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5KV1QgY291bGQgaGF2ZSBkb25lIHdo YXQgQ1dUIGRvZXMuIFNlZW1zIHRvIG1lIHRoYXQgQ1dUIGhhcyB0YWtlbiBhIHJhZGljYWxseSBt b3JlIG1hbmFnZWQgYXBwcm9hY2ggdG8gdGhlIHN1cGVyLW9wZW4gSldUIGFwcHJvYWNoLiBNYXli ZSB0aGUgQ1dUIGZvbGtzIHJlYWxpemVkIHRoZSBKV1QgZGVzaWduIHdhcyBwb29yLjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkF0IGFueSByYXRlLCB0aGVyZSBz ZWVtcyB0byBiZSBzb21lIGNvbnNlbnN1cyBoZXJlIHRoYXQgdGhlIENXVCBhcHByb2FjaCBpcyB3 aGF0IHdlIHdhbnQgZm9yIGF0dGVzdGF0aW9uLiBJdCBpcyBhbHNvIHRoZSBtb3JlIHJlY2VudCBh bmQgdGh1cyBtYXliZSBtb3JlIGFkdmFuY2VkIHRoaW5raW5nLjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5J4oCZbSBob3Bpbmcgd2UgY2FuIGZpbmQgb3VyIHdheSB0byBqdXN0IGFjY2VwdCB0 aGUgQ1dUIGNsYWltIG5hbWluZyBtYW5hZ2VtZW50IHNjaGVtZSBhcyBpcyBmb3IgYXR0ZXN0YXRp b24uIElmIG90aGVyIENXVC1iYXNlZCBlZmZvcnRzIGRpZCB0aGUgc2FtZSAoZHJhZnQtYmlya2hv bHotY29yZS1jb2lkKSBkaWQgdGhlIHNhbWUgdGhlbiB0aGUgd29ybGQgd291bGQgYmUgbXVjaCBz aW1wbGVyLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Ib3dldmVyIHRoYXQgc3Rp bGwgbGVhdmVzIG9wZW4gc29tZSBpc3N1ZSB3aXRoIEpXVCBuYW1lc3BhY2UgbWFuYWdlbWVudC4g KFdlIGRvIHdhbnQgSlNPTiBiYXNlZCBhdHRlc3RhdGlvbiB0byBiZSBKV1TigJlzLCByaWdodD8g SnVzdCB0aGUgc2FtZSBhcyBDQk9SLWJhc2VkIGF0dGVzdGF0aW9uIGFyZSBDV1TigJlzKS48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+TEw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPklNUE9SVEFOVCBOT1RJQ0U6IFRoZSBjb250ZW50cyBv ZiB0aGlzIGVtYWlsIGFuZCBhbnkgYXR0YWNobWVudHMgYXJlIGNvbmZpZGVudGlhbCBhbmQgbWF5 IGFsc28gYmUgcHJpdmlsZWdlZC4gSWYgeW91IGFyZSBub3QgdGhlIGludGVuZGVkIHJlY2lwaWVu dCwgcGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyIGltbWVkaWF0ZWx5IGFuZCBkbyBub3QgZGlzY2xv c2UgdGhlIGNvbnRlbnRzDQogdG8gYW55IG90aGVyIHBlcnNvbiwgdXNlIGl0IGZvciBhbnkgcHVy cG9zZSwgb3Igc3RvcmUgb3IgY29weSB0aGUgaW5mb3JtYXRpb24gaW4gYW55IG1lZGl1bS4gVGhh bmsgeW91Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwv YmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_MW2PR00MB0298D282632D828F2BCB16F5F5100MW2PR00MB0298namp_-- From nobody Fri Jun 7 13:31:14 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AF1B712009C for ; Fri, 7 Jun 2019 13:31:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.499 X-Spam-Level: X-Spam-Status: No, score=-14.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=WkiI9WQo; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=NdhUbKCD Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RfM-P7q8X-Eu for ; Fri, 7 Jun 2019 13:31:09 -0700 (PDT) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B50841200C7 for ; Fri, 7 Jun 2019 13:31:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=45886; q=dns/txt; s=iport; t=1559939468; x=1561149068; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=NszWJSgqzccqnfCc19jbE/YxR1eWaDE8DXGObS4qrGM=; b=WkiI9WQoJaAoWaBrCwfsiANfpqucSDsmsHRlCvIaE52+lSBuJg+s/qia 7RHVe0sEQ8U1TClKcJ93IFz3DaB3Y+O+NgneesmZ0mH20luTKeD7B8eav S9C9wwrEmJNCNluJE2glKci1VMkTg7DbQv2AZAKxBupdZpOwusDBSVcg1 g=; IronPort-PHdr: =?us-ascii?q?9a23=3AZDRiNBCDzWEeV+tyxMmoUyQJPHJ1sqjoPgMT9p?= =?us-ascii?q?ssgq5PdaLm5Zn5IUjD/qg93kTRU9Dd7PRJw6rNvqbsVHZIwK7JsWtKMfkuHw?= =?us-ascii?q?QAld1QmgUhBMCfDkiuIeDtbjASF8VZX1gj9Ha+YgBY?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AoAAB0yPpc/5ldJa1mGgEBAQEBAgE?= =?us-ascii?q?BAQEHAgEBAQGBVAIBAQEBCwGBDi8pJwNqVSAECygKhAuDRwOOYYJXlzGBQoE?= =?us-ascii?q?QA1QJAQEBDAEBIwoCAQGEQAIXglMjNwYOAQMBAQQBAQIBBG0cDIVKAQEBAQM?= =?us-ascii?q?SEQoTAQEpAwICBwEPAgEIDgMEAQEhAQYDAgICMBQJCAIEDgUIFwODAYEdTQM?= =?us-ascii?q?dAQIMnQsCgTiITxBxgTGCeQEBBYUFGIIPAwaBNAGKPIEeF4FAPyZrRoJMPoJ?= =?us-ascii?q?hAQECAYErAQsBBgEhDB8JAoJSMoImiz9LA4IYhGwilQtqCQKCDoZDiEWEVII?= =?us-ascii?q?kL4ZJjXWUIo8jAgQCBAUCDgEBBYFlImdxcBU7gmyCDwsBF4ECAQKCSIUUhT9?= =?us-ascii?q?yAYEojDoBAQ0XB4EEAYEgAQE?= X-IronPort-AV: E=Sophos;i="5.63,564,1557187200"; d="scan'208,217";a="559324399" Received: from rcdn-core-2.cisco.com ([173.37.93.153]) by rcdn-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 07 Jun 2019 20:31:07 +0000 Received: from XCH-ALN-008.cisco.com (xch-aln-008.cisco.com [173.36.7.18]) by rcdn-core-2.cisco.com (8.15.2/8.15.2) with ESMTPS id x57KV7kL022443 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 7 Jun 2019 20:31:07 GMT Received: from xhs-rtp-001.cisco.com (64.101.210.228) by XCH-ALN-008.cisco.com (173.36.7.18) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 7 Jun 2019 15:31:06 -0500 Received: from xhs-rtp-003.cisco.com (64.101.210.230) by xhs-rtp-001.cisco.com (64.101.210.228) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 7 Jun 2019 16:31:05 -0400 Received: from NAM05-CO1-obe.outbound.protection.outlook.com (64.101.32.56) by xhs-rtp-003.cisco.com (64.101.210.230) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Fri, 7 Jun 2019 16:31:05 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=NszWJSgqzccqnfCc19jbE/YxR1eWaDE8DXGObS4qrGM=; b=NdhUbKCDE0qzrNxhXq6soxcB8OdOk+gmG+ka3ZK2e1rIZx+ZleEcKwxUW6K4gCeOtAIdTgB3Z+u2jPct68M9mvS+/UmfL2/CkFKvQ+RqTIsx7fIl8Sr5MyN95U77WClhDcBuUMIgoVzcYIdgCp72NHZpoSjH0fgq22vhauw+zsg= Received: from DM6PR11MB4089.namprd11.prod.outlook.com (20.176.126.30) by DM6PR11MB2988.namprd11.prod.outlook.com (20.177.217.149) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1943.22; Fri, 7 Jun 2019 20:31:02 +0000 Received: from DM6PR11MB4089.namprd11.prod.outlook.com ([fe80::d014:d7a3:270:e5a9]) by DM6PR11MB4089.namprd11.prod.outlook.com ([fe80::d014:d7a3:270:e5a9%3]) with mapi id 15.20.1965.011; Fri, 7 Jun 2019 20:31:02 +0000 From: "Eric Voit (evoit)" To: Laurence Lundblade CC: Hannes Tschofenig , Mike Jones , Michael Richardson , "rats@ietf.org" Thread-Topic: [Rats] Vetting claim definitions Thread-Index: AQHVHSQrNP3gSrcbuEuedIL4RWxi86aQLzAwgABa8ACAABflIA== Date: Fri, 7 Jun 2019 20:31:02 +0000 Message-ID: References: <12913.1559739926@localhost> <30754CD8-98AB-4080-952E-880BC630EC69@island-resort.com> <902E75D8-D8AC-403B-A295-0EC3034E44B2@island-resort.com> In-Reply-To: <902E75D8-D8AC-403B-A295-0EC3034E44B2@island-resort.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=evoit@cisco.com; x-originating-ip: [173.38.117.68] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 2a3413ab-7bfc-4ba7-4216-08d6eb870f26 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:DM6PR11MB2988; x-ms-traffictypediagnostic: DM6PR11MB2988: x-ms-exchange-purlcount: 4 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:7691; x-forefront-prvs: 0061C35778 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39860400002)(376002)(366004)(136003)(346002)(396003)(124014002)(40434004)(199004)(189003)(66574012)(14454004)(478600001)(68736007)(26005)(52536014)(8676002)(186003)(45080400002)(33656002)(9326002)(966005)(99286004)(54906003)(102836004)(6506007)(53546011)(606006)(74316002)(446003)(11346002)(476003)(5660300002)(7696005)(76176011)(8936002)(6916009)(76116006)(4326008)(486006)(66556008)(66476007)(66446008)(316002)(236005)(9686003)(66066001)(81156014)(81166006)(55016002)(64756008)(54896002)(6306002)(5024004)(53936002)(6436002)(25786009)(7736002)(6246003)(229853002)(71200400001)(2906002)(256004)(14444005)(71190400001)(3846002)(790700001)(6116002)(73956011)(66946007)(86362001); DIR:OUT; SFP:1101; SCL:1; SRVR:DM6PR11MB2988; H:DM6PR11MB4089.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: qhDPE7PUuq6CfwJ8fkkiU37eGnEmx0BoAzeCSYYharvvPXiATGMMcduEcLshP+zG+7wwkrlH3tXGp5Kp2bXHVc5LqjUpToeSVpD5vsQ7Pyobrbze67nDr2wCvGD4ixc8y63+W5bFwHttTG2wH+zURpSbKfFM12pgtBgVfm/cdE0tUX5bbET/UVzaeQk37yrhIM5tnC/GjanXASJt4CFw2FPLmfS6Ed2SLDFg7eS+0fLAQ72Uvf7HZpY+79jZVBajUua6ThZb1oQUZYBn+v5BcJZHRFc6VKlmJnnr13Z991B3fo/aU13f44c8AS6meRA/qjQrl0LKm3RhYKzTQ+67e+Y5avy61H3xsKi/14cpxFljIOf0djq7XmrLAJHAdELzfTnfE1oVbZUal7au6Kn2loI28r3OC1kCtEuN+f4TS+I= Content-Type: multipart/alternative; boundary="_000_DM6PR11MB4089C31F977DD496B5CC49D7A1100DM6PR11MB4089namp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 2a3413ab-7bfc-4ba7-4216-08d6eb870f26 X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Jun 2019 20:31:02.3543 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: evoit@cisco.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR11MB2988 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.36.7.18, xch-aln-008.cisco.com X-Outbound-Node: rcdn-core-2.cisco.com Archived-At: Subject: Re: [Rats] Vetting claim definitions X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Jun 2019 20:31:12 -0000 --_000_DM6PR11MB4089C31F977DD496B5CC49D7A1100DM6PR11MB4089namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgTGF1cmVuY2UsDQoNCkVmZmVjdGl2ZWx5IHRoaXMg4oCcUm91dGVyIEF0dGVzdGF0aW9uIFBy b2ZpbGXigJ0gZHJhZnQgeW91IGFyZSBwcm9wb3Npbmcgd291bGQgY29uc2lzdCBvZiB3ZWxsLWRl ZmluZWQgY2xhaW1zIHdoaWNoIGFyZSBhbHNvIFlBTkcgb2JqZWN0cy4gIEFuZCB0aGVzZSBZQU5H IG9iamVjdHMgd291bGQgYXVnbWVudCB0aGUgbW9kZWwgZGVmaW5pdGlvbiB3aXRoaW4gZHJhZnQt Ymlya2hvbHotcmF0cy1iYXNpYy15YW5nLW1vZHVsZS4NCg0KSWYgeW91IGFncmVlLCB0aGlzIGlz IGV4YWN0bHkgd2hhdCBJIHdhcyBob3BpbmcgdG8gaGVhci4gIEdvb2QgdGhpbmdzIHdoaWNoIGNh biBjb21lIGZyb20gdGhpcyBhcHByb2FjaDoNCg0KICAqICAgTmV0d29yayBFbGVtZW50cyB3b3Vs ZCBiZSBjYXBhYmxlIG9mIHJlYWRpbmcgc29tZSBzdWJzZXQgb2Ygd2hhdCBpcyBjb21pbmcgb2Zm IG9mIEVBVCBjYXBhYmxlIGhhcmR3YXJlIGNoaXBzLg0KICAqICAgV2hlcmUgYnJhbmQgbmV3IGNs YWltcyBhcmUgYmVpbmcgZXhwbG9yZWQsIGEgc2VhcmNoIG9mIGV4aXN0aW5nIFlBTkcgb2JqZWN0 cyBjb3VsZCBiZSBkb25lLiAgQWRvcHRpb24gb24gWUFORyBkZWZpbml0aW9ucyB3aGVyZSBwb3Nz aWJsZSB3b3VsZCBtaW5pbWl6ZSBkb3duc3RyZWFtIG1hcHBpbmcuDQoNCkVyaWMNCg0KRnJvbTog TGF1cmVuY2UgTHVuZGJsYWRlLCBKdW5lIDcsIDIwMTkgMjo1MyBQTQ0KDQpIaSBFcmljLA0KDQpG ZWVscyBsaWtlIHRoZXJl4oCZcyBvcHBvc2luZyB2aWV3czoNCg0KMSkgQ2Fyc3RlbiwgS2F0aGxl ZW4sIG15c2VsZiBhbmQgbWF5YmUgSGVuayBhbmQgb3RoZXJzIHdhbnQgYW4gRUFUIHRvIGJlIGEg Q1dUL0pXVC5UaGlzIHJlYWxseSBkb2VzIG1ha2UgdGhlIGNsYWltIHNldCBvcGVuLWVuZGVkLiBD V1QgaXMgYSBiaXQgbW9yZSBjYXJlZnVsbHkgbWFuYWdlZCB0aGFuIEpXVCwgYnV0IHdl4oCZbGwg c3RpbGwgZW5kIHVwIHdpdGggYSBsb3Qgb2YgY2xhaW1zIHJlZ2lzdGVyZWQuDQoNCjIpIFlvdSB3 YW50IGEgdmVyeSB3ZWxsLWRlZmluZWQgY29uY2lzZSBjbGFpbSBzZXQsIGEgY29udHJvbGxlZCBw b2xpY3kgZm9yIGFsbG93aW5nIG5ldyBjbGFpbXMgYW5kIG1heGltYWwgaW50ZXJvcGVyYWJpbGl0 eS4NCg0KSSB0aGluayBib3RoIG9iamVjdGl2ZXMgYXJlIGdvb2QgYW5kIGRlc2lyYWJsZS4NCg0K SSB0aGluayB0aGUgd2F5IHRvIGhhdmUgYm90aCBpcyB0byBsZWF2ZSB0aGUgQ1dUL0pXVCByZWdp c3RyYXRpb24gb3BlbiBhcyB0aGV5IGFyZSBBTkQgQUxTTyBkZWZpbmUgYSBwcm9maWxlIC8gc3Vi c2V0IGluIGFuIElFVEYgc3RhbmRhcmQgZm9yIHlvdXIgdXNlIGNhc2UuIFRoaXMgcHJvZmlsZSAv IHN1YnNldCBjYW46DQoNCi0gTWFrZSBjbGVhciBub3JtYXRpdmUgcmVmZXJlbmNlcyB0byBleHRh bnQgY2xhaW1zIHRoYXQgYXJlIGNvbnNpZGVyZWQgd2VsbC1lbm91Z2ggZm9ybWVkIGFuZCBpbnRl cm9wZXJhYmxlDQotIERlZmluZSBzb21lIG5ldyBjbGFpbXMgd2hlcmUgbm9uZSBhcmUgZXh0YW50 DQotIERlZmluZSBhIHBvbGljeSBmb3IgYWRkaW5nIG5ldyBjbGFpbXMNCi0gTGFiZWxsaW5nIHRv IGRpc3Rpbmd1aXNoIHRoZSBwcm9maWxlIGZyb20gYSBnZW5lcmFsIG9wZW4tZW5kZWQgQ1dUL0pX VA0KDQpTbyBvbmUgd2F5IGZvcndhcmQgaXMgZm9yIHRoaXMgV0cgdG8gYWRvcHQgYW5vdGhlciBk b2N1bWVudC4gTWF5YmUgY2FsbCBpdCDigJxSb3V0ZXIgQXR0ZXN0YXRpb24gUHJvZmlsZeKAnS4g IFRoaXMgd291bGQgYmUgaW4gYWRkaXRpb24gdG8gRUFULiBJdCBtYWtlcyBub3JtYXRpdmUgcmVm ZXJlbmNlcyB0byB0aGUgRUFUIGNsYWltcyBpdCBsaWtlcy4NCg0KQW5vdGhlciB3YXkgZm9yd2Fy ZCBpcyBmb3IgdGhlIEVBVCBkcmFmdCB0byBjaGFuZ2UgZGlyZWN0aW9uIHNvbWUgYW5kIGJlY29t ZSB0aGUgbW9yZSB0aWdodCBhbmQgbGltaXRlZCBhdHRlc3RhdGlvbiBkZWZpbml0aW9uLiBJdCB3 b3VsZCBwcm9iYWJseSBhZGRyZXNzIG1vcmUgdGhhbiBqdXN0IHRoZSByb3V0ZXIgdXNlIGNhc2Us IGJ1dCBpdCB3b3VsZCByZXRhaW4gdGhlIG1haW4gY2hhcmFjdGVyaXN0aWNzIHlvdSB3YW50LiBJ ZiB3ZSBkbyB0aGlzLCB0aGVuIHdlIGNhbiBleHBlY3Qgb3RoZXIgYXR0ZXN0YXRpb24gdXNlIGNh c2VzIHRvIHdyaXRlIGRvY3VtZW50cyBhbmQgbWF5YmUgcnVuIHRoZW0gdGhyb3VnaCB0aGlzIFdH IG9yIG1heWJlIG5vdC4NCg0KTEwNCg0KDQpPbiBKdW4gNywgMjAxOSwgYXQgMTA6MTQgQU0sIEVy aWMgVm9pdCAoZXZvaXQpIDxldm9pdEBjaXNjby5jb208bWFpbHRvOmV2b2l0QGNpc2NvLmNvbT4+ IHdyb3RlOg0KDQpIaSBIYW5uZXMsDQoNCklmIHdlIHdlcmUgc3VyZSB3ZSBjb3VsZCBsaW1pdCBF QVQgY2xhaW1zIHRvIGp1c3QgYSBmZXcgdGhpbmdzIHdoaWNoIGNvbWUgb3V0IG9mIGhhcmR3YXJl LCB0aGlzIHdvdWxkbid0IGNvbmNlcm4gbWUgYXMgbXVjaCBhcyBpdCBkb2VzLiAgSG93ZXZlciB0 aGUgZG9tYWluIG9mIGF0dGVzdGFibGUgb2JqZWN0cyB3YXMgbGVmdCBmYWlybHkgb3BlbiB3aXRo aW4gdGhlIEVBVCBkcmFmdC4gICBBbmQgd2UgbmVlZCB0byBkZXRlcm1pbmUgd2hhdCBsZXZlbCBv ZiBpbnRlcm9wZXJhYmlsaXR5IGFyZSB3ZSB0cnlpbmcgdG8gc2hlcGhlcmQgdmlhIFJBVFMuDQoN CkluIHRoZSBlbmQsIFJBVFMgKGFuZCBFQVQpIG5lZWQgdG8gZGV0ZXJtaW5lIHRoZSBsZXZlbCBv ZiBpbnRlcm9wZXJhYmlsaXR5IGRlc2lyZWQgZm9yIHNwZWNpZmljIGNsYWltcy4gICBJIGRvbid0 IGNsYWltIGRlZXAgZmFtaWxpYXJpdHkgd2l0aCBKV1QuICBCdXQgbG9va2luZyBhdCBSRkMtNzUx OSwgU2VjdGlvbiA0LjEsIEkgc2VlIHRoYXQgSSB3b3VsZCBoYXZlIHF1ZXN0aW9ucyBhcyBhbiBp bXBsZW1lbnRlci4gIEZvciBleGFtcGxlLCB0aGUgY2xhaW1zICJpc3MiLCAic3ViIiwgYW5kICJh dWQiIGxvb2sgdG8gaGF2ZSBwb3B1bGF0aW9uL3Byb2Nlc3Npbmcgd2hpY2ggaXMgYXBwbGljYXRp b24gc3BlY2lmaWMuICBUaGVyZWZvcmUgd2l0aCB0aGVzZSBjbGFpbXMsIGl0IGlzIHVwIHRvIGFw cGxpY2F0aW9ucyBvbiBlaXRoZXIgc2lkZSBvZiB0aGUgSldUIG11c3QgY29tZSB0byBhbiBhZ3Jl ZW1lbnQgb24gd2hhdCB0aGUgcG9wdWxhdGVkIGluc3RhbmNlcyBtZWFuLiAgKEkuZS4sIG5vdCB0 aGUgV0cuKQ0KDQpDb21tb24gb2Ygb2JqZWN0IGRlZmluaXRpb25zL2NsYWltcyBmcm9tIGludGVy bmFsIGhhcmR3YXJlIGFyZSBpbXBvcnRhbnQgaWYgdGhlIE5ldHdvcmsgRWxlbWVudCBuZWVkcyB0 byBhY3Qgb24gc3BlY2lmaWMgdmFsdWVzLiAgQW5kIGFzIGEgdmVuZG9yLCBJIGtub3cgdGhhdCBJ IGRvIHdhbnQgdG8gYWN0IG9uIGluZm9ybWF0aW9uIGNvbWluZyBvdXQgb2YgaGFyZHdhcmUgZXZl biBpZiB0aGUgaW5mb3JtYXRpb24gaXMgYmVpbmcgcHVzaGVkIHRvIGEgcmVtb3RlIHZhbGlkYXRv ciAoZS5nLiwgaW1tZWRpYXRlbHkgcHVzaCBhbiBFQVQgdG9rZW4gZG93bnN0cmVhbSBpZiBhIHNw ZWNpZmljIGhhc2ggdmFsdWUgY2hhbmdlcykuICBBcyBhIHJlc3VsdCBJIHdhbnQgbW9yZSBleHBs aWNpdCBhbmQgc3RhYmxlIGNsYWltIGRlZmluaXRpb25zLg0KDQpNb3JlIGhpZ2hseSBzcGVjaWZp ZWQgY2xhaW1zIG9mIGNvdXJzZSBleHBvc2VzIHBvc3NpYmxlIGNsYWltIHJlZHVuZGFuY3ksIGZv cmVpZ24ga2V5IHJlbGF0aW9uc2hpcHMsIGFuZCBjcm9zcy1tYXBwaW5nIHdpdGggZG93bnN0cmVh bSBpbmZvcm1hdGlvbiBtb2RlbHMuIEkgYXNzZXJ0IHRoaXMgaXMgYSBnb29kIHRoaW5nIGJlY2F1 c2Ugd2UgZXhwb3NlIChhbmQgaG9wZWZ1bGx5IG1pbmltaXplKSBjb3N0cyB3aGljaCBhcmUgYm9y bmUgYnkgZG93bnN0cmVhbSBkZXZlbG9wZXJzLg0KDQpFcmljDQoNCkhhbm5lcyBUc2Nob2Zlbmln LCBKdW5lIDcsIDIwMTkgNzoyOSBBTQ0KRldJVzogV2hpbGUgdGhlIEpXVCByZWdpc3RyeSBsb29r cyBtb3JlIG1peGVkIGluIHRlcm1zIG9mIGNsYWltIHR5cGVzLiBUaGlzIGlzLCBob3dldmVyLCBv bmx5IGEgcmVzdWx0IG9mIHRoZSB3aWRlc3ByZWFkIGFkb3B0aW9uLg0KVGhlcmUgYXJlIG5vIHBy b2JsZW1zLCBhcyBmYXIgYXMgSSBrbm93LCB3aXRoIHRoZSBkaXZlcnNpdHkgb2YgdGhlIGNsYWlt cyBhbmQgdGhhdCB0aGV5IGFyZSBub3QgYWxsIHVzZWZ1bCBpbiBldmVyeSBjb250ZXh0LiBEaWZm ZXJlbnQgZGVwbG95bWVudHMgdXNlIHRoZSBjbGFpbXMgdGhleSBmaW5kIHVzZWZ1bC4NCg0KSSBh bSB3b25kZXJpbmcgd2hldGhlciB3ZSBhcmUgdHJ5aW5nIHRvIGZpeCBhIHByb2JsZW0gd2l0aCB0 aGUgcmVnaXN0cnkgb2YgY2xhaW1zIHRoYXQgZG9lc27igJl0IG9jY3VyIGluIHByYWN0aWNlLg0K DQpDaWFvDQpIYW5uZXMNCg0KRnJvbTogUkFUUyA8cmF0cy1ib3VuY2VzQGlldGYub3JnPG1haWx0 bzpyYXRzLWJvdW5jZXNAaWV0Zi5vcmc+PiBPbiBCZWhhbGYgT2YgTWlrZSBKb25lcw0KU2VudDog TWl0dHdvY2gsIDUuIEp1bmkgMjAxOSAxOTozMQ0KVG86IExhdXJlbmNlIEx1bmRibGFkZSA8bGds QGlzbGFuZC1yZXNvcnQuY29tPG1haWx0bzpsZ2xAaXNsYW5kLXJlc29ydC5jb20+PjsgTWljaGFl bCBSaWNoYXJkc29uIDxtY3IraWV0ZkBzYW5kZWxtYW4uY2E8bWFpbHRvOm1jcitpZXRmQHNhbmRl bG1hbi5jYT4+DQpDYzogcmF0c0BpZXRmLm9yZzxtYWlsdG86cmF0c0BpZXRmLm9yZz4NClN1Ympl Y3Q6IFJlOiBbUmF0c10gVmV0dGluZyBjbGFpbSBkZWZpbml0aW9ucw0KDQpBY3R1YWxseSwgbm9y bWFsIChub24tY29sbGlzaW9uLXJlc2lzdGFudCkgSldUIGNsYWltcyAqYXJlKiBhbGxvY2F0ZWQg b24gYSBzcGVjaWZpY2F0aW9uIHJlcXVpcmVkIGJhc2lzIHdpdGggZXhwZXJ0IHJldmlldy4gIFNl ZSB0aGlzIHRleHQgYXQgaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzc1MTkjc2VjdGlv bi0xMC4xOg0KDQogICBWYWx1ZXMgYXJlIHJlZ2lzdGVyZWQgb24gYSBTcGVjaWZpY2F0aW9uIFJl cXVpcmVkIFtSRkM1MjI2PGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM1MjI2Pl0gYmFz aXMNCiAgIGFmdGVyIGEgdGhyZWUtd2VlayByZXZpZXcgcGVyaW9kIG9uIHRoZSBqd3QtcmVnLXJl dmlld0BpZXRmLm9yZzxtYWlsdG86and0LXJlZy1yZXZpZXdAaWV0Zi5vcmc+DQogICBtYWlsaW5n IGxpc3QsIG9uIHRoZSBhZHZpY2Ugb2Ygb25lIG9yIG1vcmUgRGVzaWduYXRlZCBFeHBlcnRzLg0K ICAgSG93ZXZlciwgdG8gYWxsb3cgZm9yIHRoZSBhbGxvY2F0aW9uIG9mIHZhbHVlcyBwcmlvciB0 byBwdWJsaWNhdGlvbiwNCiAgIHRoZSBEZXNpZ25hdGVkIEV4cGVydHMgbWF5IGFwcHJvdmUgcmVn aXN0cmF0aW9uIG9uY2UgdGhleSBhcmUNCiAgIHNhdGlzZmllZCB0aGF0IHN1Y2ggYSBzcGVjaWZp Y2F0aW9uIHdpbGwgYmUgcHVibGlzaGVkLg0KDQpTbyBhIHNwZWNpZmljYXRpb24gY2FuIGVhc2ls eSByZWdpc3RlciBib3RoIEpXVCBhbmQgQ1dUIGNsYWltcy4NCg0KICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC0tIE1pa2UNCg0KRnJvbTogTGF1 cmVuY2UgTHVuZGJsYWRlIDxsZ2xAaXNsYW5kLXJlc29ydC5jb208bWFpbHRvOmxnbEBpc2xhbmQt cmVzb3J0LmNvbT4+DQpTZW50OiBXZWRuZXNkYXksIEp1bmUgNSwgMjAxOSA4OjQ2IEFNDQpUbzog TWljaGFlbCBSaWNoYXJkc29uIDxtY3IraWV0ZkBzYW5kZWxtYW4uY2E8bWFpbHRvOm1jcitpZXRm QHNhbmRlbG1hbi5jYT4+DQpDYzogcmF0c0BpZXRmLm9yZzxtYWlsdG86cmF0c0BpZXRmLm9yZz47 IE1pa2UgSm9uZXMgPE1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbTxtYWlsdG86TWljaGFlbC5K b25lc0BtaWNyb3NvZnQuY29tPj4NClN1YmplY3Q6IFJlOiBbUmF0c10gVmV0dGluZyBjbGFpbSBk ZWZpbml0aW9ucw0KDQpCZWxvd+KApg0KKyBNaWtlIEpvbmVzLCBjby1hdXRob3Igb2YgQ1dUDQoN Ck9uIEp1biA1LCAyMDE5LCBhdCA2OjA1IEFNLCBNaWNoYWVsIFJpY2hhcmRzb24gPG1jcitpZXRm QHNhbmRlbG1hbi5jYTxtYWlsdG86bWNyK2lldGZAc2FuZGVsbWFuLmNhPj4gd3JvdGU6DQoNCg0K TGF1cmVuY2UgTHVuZGJsYWRlIDxsZ2xAaXNsYW5kLXJlc29ydC5jb208bWFpbHRvOmxnbEBpc2xh bmQtcmVzb3J0LmNvbT4+IHdyb3RlOg0K4oCUIFRvZGF5IENXVCBhbGxvY2F0ZXMgbWlsbGlvbnMg b2Ygc2xvdHMgZm9yIGV4cGVydCByZXZpZXcuIE5vDQpzcGVjaWZpY2F0aW9uIGlzIHJlcXVpcmVk LCBidXQgc29tZSBpbmZvcm1hdGlvbiBzaG91bGQgYmUgcHJvdmlkZWQuDQoNCkpXVCBkb2VzbuKA mXQgc2VlbSB0byBoYXZlIHRoaXMsIHdoaWNoIGlzIG1heWJlIHdoeSBpdCBpcyBtZXNzaWVyLiBJ dA0Ka2luZCBvZiBzZWVtcyBiYWQgYW5kIHdyb25nIHRoYXQgaXQgZG9lc27igJl0IHRvIG1lLg0K DQpKV1QgZG9lc24ndCBoYXZlIHRoaXMgYmVjYXVzZSB0aGUgY2xhaW1zIGFyZSAidW5saW1pdGVk IiBsZW5ndGggc3RyaW5ncywgc28NCm9uZSBjYW4gYWx3YXlzIG1ha2UgdXAgYSB1bmlxdWUgc3Ry aW5nIGluIGxpZXUgb2YgcmVnaXN0cmF0aW9uLg0KIG9yZy5pc2xhbmQtcmVzb3J0LmxnbC53aGF0 ZXZlcnN0cmluZ3lvdXdhbnQNCg0KaXMgcHJvYmFibHkgY29tcGxldGVseSB5b3VycyA6LSkNCk9m IGNvdXJzZSwgaWYgeW91IHdhbnQgdG8gaW50ZXJvcGVyYXRlIHlvdSBuZWVkIHRvIGFncmVlIGFi b3V0IGhvdywgc28gdGhlcmUNCmFyZSBzb21lIGFkdmFudGFnZXMgb2YgYSBmb3JjaW5nIGZ1bmN0 aW9uIHRoYXQgZGVtYW5kcyB5b3Ugd3JpdGUgdGhpbmdzIGRvd24NCmZpcnN0IDotKQ0KDQpVbmxp bWl0ZWQgbGVuZ3RoIHN0cmluZyBjbGFpbSBuYW1lcyBhcmUgZnVsbHkgcGFydCBvZiBDV1QuIEFs c28sIENPU0UgYWxsb3dzIHRoZW0gZm9yIGhlYWRlcnMsIGFsZ29yaXRobSBuYW1lcyBhbmQgc3Vj aCB0b28uIFNvIGZyb20gYSBzeW50YXggdmlldyBDV1QgYW5kIENPU0UgYXJlIHRoZSBzYW1lIGFz IEpXVCBpbiBhbGxvd2luZyBsb25nIHN0cmluZyBuYW1lcy4NCg0KSG93ZXZlciwgQ09TRSBhbmQg Q1dUIGFyZSBkaWZmZXJlbnQgaW4gdGhlIG1hbmFnZW1lbnQgb2YgdGhlIHN0cmluZyBuYW1lIHNw YWNlOg0KDQpTdHJpbmdzIG9mIGxlbmd0aCAxICAgICAgICAgICAgU3RhbmRhcmRzIEFjdGlvbg0K U3RyaW5ncyBvZiBsZW5ndGggMiAgICAgICAgICAgIFNwZWNpZmljYXRpb24gUmVxdWlyZWQNClN0 cmluZ3Mgb2YgbGVuZ3RoIGdyZWF0ZXIgdGhhbiAyICAgIEV4cGVydCBSZXZpZXcNCg0KVGhlc2Us IGFsb25nIHdpdGggdGhlIGludGVnZXIgbmFtZXMgc3BhY2UgcnVsZXMsIHRoZW4gaW1wbHk6DQoN CkludGVnZXIgdmFsdWVzIGxlc3MgdGhhbiAtNjU1MzYgYXJlIHRoZSBvbmx5IG9uZXMgZnJlZSBm b3IgdXNlIHdpdGggbm8gcmV2aWV3IG9yIHByb2Nlc3NpbmcgYnkgSUFOQSBhbmQgZXhwZXJ0cy4N Cg0KSldUIGFsc28gaGFzIHRoaXMgbm90aW9uIG9mIENvbGxpc2lvbi1SZXNpc3RhbnQgTmFtZSBi YXNlZCBvbiBPSURzIG9yIFVVSURzLCB3aGljaCBpcyBlc3NlbnRpYWxseSBzb21lIHJ1bGVzIHRv IG1ha2UgdXAgbmFtZXMgdGhhdCBkb27igJl0IGdvIGludG8gYW4gSUFOQSByZWdpc3RyeSBhbmQg YXJlIHN0aWxsIHVuaXF1ZSBhbmQgd29u4oCZdCBjb2xsaWRlLg0KDQpKV1QgY291bGQgaGF2ZSBk b25lIHdoYXQgQ1dUIGRvZXMuIFNlZW1zIHRvIG1lIHRoYXQgQ1dUIGhhcyB0YWtlbiBhIHJhZGlj YWxseSBtb3JlIG1hbmFnZWQgYXBwcm9hY2ggdG8gdGhlIHN1cGVyLW9wZW4gSldUIGFwcHJvYWNo LiBNYXliZSB0aGUgQ1dUIGZvbGtzIHJlYWxpemVkIHRoZSBKV1QgZGVzaWduIHdhcyBwb29yLg0K DQoNCkF0IGFueSByYXRlLCB0aGVyZSBzZWVtcyB0byBiZSBzb21lIGNvbnNlbnN1cyBoZXJlIHRo YXQgdGhlIENXVCBhcHByb2FjaCBpcyB3aGF0IHdlIHdhbnQgZm9yIGF0dGVzdGF0aW9uLiBJdCBp cyBhbHNvIHRoZSBtb3JlIHJlY2VudCBhbmQgdGh1cyBtYXliZSBtb3JlIGFkdmFuY2VkIHRoaW5r aW5nLg0KDQpJ4oCZbSBob3Bpbmcgd2UgY2FuIGZpbmQgb3VyIHdheSB0byBqdXN0IGFjY2VwdCB0 aGUgQ1dUIGNsYWltIG5hbWluZyBtYW5hZ2VtZW50IHNjaGVtZSBhcyBpcyBmb3IgYXR0ZXN0YXRp b24uIElmIG90aGVyIENXVC1iYXNlZCBlZmZvcnRzIGRpZCB0aGUgc2FtZSAoZHJhZnQtYmlya2hv bHotY29yZS1jb2lkKSBkaWQgdGhlIHNhbWUgdGhlbiB0aGUgd29ybGQgd291bGQgYmUgbXVjaCBz aW1wbGVyLg0KDQpIb3dldmVyIHRoYXQgc3RpbGwgbGVhdmVzIG9wZW4gc29tZSBpc3N1ZSB3aXRo IEpXVCBuYW1lc3BhY2UgbWFuYWdlbWVudC4gKFdlIGRvIHdhbnQgSlNPTiBiYXNlZCBhdHRlc3Rh dGlvbiB0byBiZSBKV1TigJlzLCByaWdodD8gSnVzdCB0aGUgc2FtZSBhcyBDQk9SLWJhc2VkIGF0 dGVzdGF0aW9uIGFyZSBDV1TigJlzKS4NCg0KTEwNCg0KSU1QT1JUQU5UIE5PVElDRTogVGhlIGNv bnRlbnRzIG9mIHRoaXMgZW1haWwgYW5kIGFueSBhdHRhY2htZW50cyBhcmUgY29uZmlkZW50aWFs IGFuZCBtYXkgYWxzbyBiZSBwcml2aWxlZ2VkLiBJZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5kZWQg cmVjaXBpZW50LCBwbGVhc2Ugbm90aWZ5IHRoZSBzZW5kZXIgaW1tZWRpYXRlbHkgYW5kIGRvIG5v dCBkaXNjbG9zZSB0aGUgY29udGVudHMgdG8gYW55IG90aGVyIHBlcnNvbiwgdXNlIGl0IGZvciBh bnkgcHVycG9zZSwgb3Igc3RvcmUgb3IgY29weSB0aGUgaW5mb3JtYXRpb24gaW4gYW55IG1lZGl1 bS4gVGhhbmsgeW91Lg0KDQo= --_000_DM6PR11MB4089C31F977DD496B5CC49D7A1100DM6PR11MB4089namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNvbnNvbGFzOw0K CXBhbm9zZS0xOjIgMTEgNiA5IDIgMiA0IDMgMiA0O30NCi8qIFN0eWxlIERlZmluaXRpb25zICov DQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjowaW47 DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1p bHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0KCXtt c28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5k ZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXttc28tc3R5 bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxp bmU7fQ0KcC5Nc29MaXN0UGFyYWdyYXBoLCBsaS5Nc29MaXN0UGFyYWdyYXBoLCBkaXYuTXNvTGlz dFBhcmFncmFwaA0KCXttc28tc3R5bGUtcHJpb3JpdHk6MzQ7DQoJbWFyZ2luLXRvcDowaW47DQoJ bWFyZ2luLXJpZ2h0OjBpbjsNCgltYXJnaW4tYm90dG9tOjBpbjsNCgltYXJnaW4tbGVmdDouNWlu Ow0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFt aWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnAubXNvbm9ybWFsMCwgbGkubXNvbm9ybWFsMCwg ZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4t dG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1p bHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5hcHBsZS1jb252ZXJ0ZWQtc3BhY2UNCgl7 bXNvLXN0eWxlLW5hbWU6YXBwbGUtY29udmVydGVkLXNwYWNlO30NCnNwYW4uYXBwbGUtdGFiLXNw YW4NCgl7bXNvLXN0eWxlLW5hbWU6YXBwbGUtdGFiLXNwYW47fQ0Kc3Bhbi5FbWFpbFN0eWxlMjAN Cgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWw7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMt c2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQpzcGFuLkVtYWlsU3R5bGUyMQ0KCXttc28tc3R5 bGUtdHlwZTpwZXJzb25hbC1jb21wb3NlOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNl cmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5 cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjEN Cgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30N CmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLyogTGlzdCBEZWZpbml0 aW9ucyAqLw0KQGxpc3QgbDANCgl7bXNvLWxpc3QtaWQ6MTY2NzQ5NDU0Ow0KCW1zby1saXN0LXR5 cGU6aHlicmlkOw0KCW1zby1saXN0LXRlbXBsYXRlLWlkczoxMzg5MTYwNzUwIDY3Njk4Njg5IDY3 Njk4NjkxIDY3Njk4NjkzIDY3Njk4Njg5IDY3Njk4NjkxIDY3Njk4NjkzIDY3Njk4Njg5IDY3Njk4 NjkxIDY3Njk4NjkzO30NCkBsaXN0IGwwOmxldmVsMQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1h dDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25l Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47 DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsMg0KCXttc28tbGV2ZWwtbnVt YmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWwzDQoJ e21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJ bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0 Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3Qg bDA6bGV2ZWw0DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwt dGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1w b3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpTeW1ib2w7 fQ0KQGxpc3QgbDA6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCglt c28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1u dW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6 IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9u ZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWlu Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDcNCgl7bXNvLWxldmVs LW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwt dGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1p bmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDgNCgl7 bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0 IGwwOmxldmVsOQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVs LXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXIt cG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2Rp bmdzO30NCm9sDQoJe21hcmdpbi1ib3R0b206MGluO30NCnVsDQoJe21hcmdpbi1ib3R0b206MGlu O30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRz IHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtp ZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1h cCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRp Zl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVy cGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5I aSBMYXVyZW5jZSw8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+RWZmZWN0aXZlbHkgdGhpcyDigJxS b3V0ZXIgQXR0ZXN0YXRpb24gUHJvZmlsZeKAnSBkcmFmdCB5b3UgYXJlIHByb3Bvc2luZyB3b3Vs ZCBjb25zaXN0IG9mIHdlbGwtZGVmaW5lZCBjbGFpbXMgd2hpY2ggYXJlIGFsc28gWUFORyBvYmpl Y3RzLiZuYnNwOyBBbmQgdGhlc2UgWUFORyBvYmplY3RzIHdvdWxkIGF1Z21lbnQgdGhlIG1vZGVs IGRlZmluaXRpb24gd2l0aGluIGRyYWZ0LWJpcmtob2x6LXJhdHMtYmFzaWMteWFuZy1tb2R1bGUu Jm5ic3A7Jm5ic3A7DQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SWYgeW91IGFncmVlLCB0aGlz IGlzIGV4YWN0bHkgd2hhdCBJIHdhcyBob3BpbmcgdG8gaGVhci4mbmJzcDsgR29vZCB0aGluZ3Mg d2hpY2ggY2FuIGNvbWUgZnJvbSB0aGlzIGFwcHJvYWNoOjxvOnA+PC9vOnA+PC9wPg0KPHVsIHN0 eWxlPSJtYXJnaW4tdG9wOjBpbiIgdHlwZT0iZGlzYyI+DQo8bGkgY2xhc3M9Ik1zb0xpc3RQYXJh Z3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDowaW47bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEiPk5l dHdvcmsgRWxlbWVudHMgd291bGQgYmUgY2FwYWJsZSBvZiByZWFkaW5nIHNvbWUgc3Vic2V0IG9m IHdoYXQgaXMgY29taW5nIG9mZiBvZiBFQVQgY2FwYWJsZSBoYXJkd2FyZSBjaGlwcy48bzpwPjwv bzpwPjwvbGk+PGxpIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 MGluO21zby1saXN0OmwwIGxldmVsMSBsZm8xIj5XaGVyZSBicmFuZCBuZXcgY2xhaW1zIGFyZSBi ZWluZyBleHBsb3JlZCwgYSBzZWFyY2ggb2YgZXhpc3RpbmcgWUFORyBvYmplY3RzIGNvdWxkIGJl IGRvbmUuJm5ic3A7IEFkb3B0aW9uIG9uIFlBTkcgZGVmaW5pdGlvbnMgd2hlcmUgcG9zc2libGUg d291bGQgbWluaW1pemUgZG93bnN0cmVhbSBtYXBwaW5nLjxvOnA+PC9vOnA+PC9saT48L3VsPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5FcmljPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlk IGJsdWUgMS41cHQ7cGFkZGluZzowaW4gMGluIDBpbiA0LjBwdCI+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48Yj5Gcm9tOjwvYj4gTGF1cmVuY2UgTHVuZGJsYWRlLCBKdW5lIDcsIDIwMTkgMjo1MyBQ TTxicj4NCjxicj4NCjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhpIEVyaWMsPG86cD48L286 cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5GZWVscyBsaWtlIHRoZXJl4oCZ cyBvcHBvc2luZyB2aWV3czo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBz dHlsZT0ibWFyZ2luLWxlZnQ6MzAuMHB0O21hcmdpbi1yaWdodDowaW4iPg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjEpIENhcnN0ZW4sIEthdGhsZWVuLCBteXNlbGYgYW5kIG1heWJlIEhl bmsgYW5kIG90aGVycyB3YW50IGFuIEVBVCB0byBiZSBhIENXVC9KV1QuVGhpcyByZWFsbHkgZG9l cyBtYWtlIHRoZSBjbGFpbSBzZXQgb3Blbi1lbmRlZC4gQ1dUIGlzIGEgYml0IG1vcmUgY2FyZWZ1 bGx5IG1hbmFnZWQgdGhhbiBKV1QsIGJ1dCB3ZeKAmWxsIHN0aWxsIGVuZCB1cCB3aXRoIGEgbG90 IG9mIGNsYWltcyByZWdpc3RlcmVkLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4yKSBZb3Ugd2FudCBhIHZlcnkgd2VsbC1kZWZpbmVk IGNvbmNpc2UgY2xhaW0gc2V0LCBhIGNvbnRyb2xsZWQgcG9saWN5IGZvciBhbGxvd2luZyBuZXcg Y2xhaW1zIGFuZCBtYXhpbWFsIGludGVyb3BlcmFiaWxpdHkuPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgdGhpbmsg Ym90aCBvYmplY3RpdmVzIGFyZSBnb29kIGFuZCBkZXNpcmFibGUuPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgdGhpbmsgdGhlIHdheSB0byBo YXZlIGJvdGggaXMgdG8gbGVhdmUgdGhlIENXVC9KV1QgcmVnaXN0cmF0aW9uIG9wZW4gYXMgdGhl eSBhcmUgQU5EIEFMU08gZGVmaW5lIGEgcHJvZmlsZSAvIHN1YnNldCBpbiBhbiBJRVRGIHN0YW5k YXJkIGZvciB5b3VyIHVzZSBjYXNlLiBUaGlzIHByb2ZpbGUgLyBzdWJzZXQgY2FuOjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tbGVmdDozMC4wcHQ7 bWFyZ2luLXJpZ2h0OjBpbiI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+LSBNYWtlIGNs ZWFyIG5vcm1hdGl2ZSByZWZlcmVuY2VzIHRvIGV4dGFudCBjbGFpbXMgdGhhdCBhcmUgY29uc2lk ZXJlZCB3ZWxsLWVub3VnaCBmb3JtZWQgYW5kIGludGVyb3BlcmFibGU8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPi0gRGVmaW5lIHNvbWUgbmV3IGNs YWltcyB3aGVyZSBub25lIGFyZSBleHRhbnQ8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPi0gRGVmaW5lIGEgcG9saWN5IGZvciBhZGRpbmcgbmV3IGNs YWltcyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+LSBMYWJlbGxpbmcgdG8gZGlzdGluZ3Vpc2ggdGhlIHByb2ZpbGUgZnJvbSBhIGdlbmVy YWwgb3Blbi1lbmRlZCBDV1QvSldUPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1 b3RlPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U28gb25lIHdheSBmb3J3YXJkIGlzIGZvciB0aGlz IFdHIHRvIGFkb3B0IGFub3RoZXIgZG9jdW1lbnQuIE1heWJlIGNhbGwgaXQg4oCcUm91dGVyIEF0 dGVzdGF0aW9uIFByb2ZpbGXigJ0uICZuYnNwO1RoaXMgd291bGQgYmUgaW4gYWRkaXRpb24gdG8g RUFULiBJdCBtYWtlcyBub3JtYXRpdmUgcmVmZXJlbmNlcyB0byB0aGUgRUFUIGNsYWltcyBpdCBs aWtlcy48bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFub3Ro ZXIgd2F5IGZvcndhcmQgaXMgZm9yIHRoZSBFQVQgZHJhZnQgdG8gY2hhbmdlIGRpcmVjdGlvbiBz b21lIGFuZCBiZWNvbWUgdGhlIG1vcmUgdGlnaHQgYW5kIGxpbWl0ZWQgYXR0ZXN0YXRpb24gZGVm aW5pdGlvbi4gSXQgd291bGQgcHJvYmFibHkgYWRkcmVzcyBtb3JlIHRoYW4ganVzdCB0aGUgcm91 dGVyIHVzZSBjYXNlLCBidXQgaXQgd291bGQgcmV0YWluIHRoZSBtYWluIGNoYXJhY3RlcmlzdGlj cyB5b3UNCiB3YW50LiBJZiB3ZSBkbyB0aGlzLCB0aGVuIHdlIGNhbiBleHBlY3Qgb3RoZXIgYXR0 ZXN0YXRpb24gdXNlIGNhc2VzIHRvIHdyaXRlIGRvY3VtZW50cyBhbmQgbWF5YmUgcnVuIHRoZW0g dGhyb3VnaCB0aGlzIFdHIG9yIG1heWJlIG5vdC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij5M TDxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YnI+ DQo8YnI+DQo8bzpwPjwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUu MHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9u IEp1biA3LCAyMDE5LCBhdCAxMDoxNCBBTSwgRXJpYyBWb2l0IChldm9pdCkgJmx0OzxhIGhyZWY9 Im1haWx0bzpldm9pdEBjaXNjby5jb20iPmV2b2l0QGNpc2NvLmNvbTwvYT4mZ3Q7IHdyb3RlOjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SGkgSGFubmVzLDxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JZiB3 ZSB3ZXJlIHN1cmUgd2UgY291bGQgbGltaXQgRUFUIGNsYWltcyB0byBqdXN0IGEgZmV3IHRoaW5n cyB3aGljaCBjb21lIG91dCBvZiBoYXJkd2FyZSwgdGhpcyB3b3VsZG4ndCBjb25jZXJuIG1lIGFz IG11Y2ggYXMgaXQgZG9lcy4mbmJzcDsgSG93ZXZlciB0aGUgZG9tYWluIG9mIGF0dGVzdGFibGUg b2JqZWN0cyB3YXMgbGVmdCBmYWlybHkgb3BlbiB3aXRoaW4gdGhlIEVBVCBkcmFmdC4mbmJzcDsg Jm5ic3A7QW5kIHdlIG5lZWQgdG8NCiBkZXRlcm1pbmUgd2hhdCBsZXZlbCBvZiBpbnRlcm9wZXJh YmlsaXR5IGFyZSB3ZSB0cnlpbmcgdG8gc2hlcGhlcmQgdmlhIFJBVFMuPG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkluIHRoZSBlbmQsIFJBVFMg KGFuZCBFQVQpIG5lZWQgdG8gZGV0ZXJtaW5lIHRoZSBsZXZlbCBvZiBpbnRlcm9wZXJhYmlsaXR5 IGRlc2lyZWQgZm9yIHNwZWNpZmljIGNsYWltcy4mbmJzcDsmbmJzcDsgSSBkb24ndCBjbGFpbSBk ZWVwIGZhbWlsaWFyaXR5IHdpdGggSldULiZuYnNwOyBCdXQgbG9va2luZyBhdCBSRkMtNzUxOSwg U2VjdGlvbiA0LjEsIEkgc2VlIHRoYXQgSSB3b3VsZCBoYXZlIHF1ZXN0aW9ucyBhcyBhbiBpbXBs ZW1lbnRlci4mbmJzcDsNCiBGb3IgZXhhbXBsZSwgdGhlIGNsYWltcyAmcXVvdDtpc3MmcXVvdDss ICZxdW90O3N1YiZxdW90OywgYW5kICZxdW90O2F1ZCZxdW90OyBsb29rIHRvIGhhdmUgcG9wdWxh dGlvbi9wcm9jZXNzaW5nIHdoaWNoIGlzIGFwcGxpY2F0aW9uIHNwZWNpZmljLiZuYnNwOyBUaGVy ZWZvcmUgd2l0aCB0aGVzZSBjbGFpbXMsIGl0IGlzIHVwIHRvIGFwcGxpY2F0aW9ucyBvbiBlaXRo ZXIgc2lkZSBvZiB0aGUgSldUIG11c3QgY29tZSB0byBhbiBhZ3JlZW1lbnQgb24gd2hhdCB0aGUg cG9wdWxhdGVkIGluc3RhbmNlcyBtZWFuLiZuYnNwOw0KIChJLmUuLCBub3QgdGhlIFdHLikmbmJz cDsmbmJzcDs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+ PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkNv bW1vbiBvZiBvYmplY3QgZGVmaW5pdGlvbnMvY2xhaW1zIGZyb20gaW50ZXJuYWwgaGFyZHdhcmUg YXJlIGltcG9ydGFudCBpZiB0aGUgTmV0d29yayBFbGVtZW50IG5lZWRzIHRvIGFjdCBvbiBzcGVj aWZpYyB2YWx1ZXMuJm5ic3A7IEFuZCBhcyBhIHZlbmRvciwgSSBrbm93IHRoYXQgSSBkbyB3YW50 IHRvIGFjdCBvbiBpbmZvcm1hdGlvbiBjb21pbmcgb3V0IG9mIGhhcmR3YXJlIGV2ZW4gaWYgdGhl IGluZm9ybWF0aW9uDQogaXMgYmVpbmcgcHVzaGVkIHRvIGEgcmVtb3RlIHZhbGlkYXRvciAoZS5n LiwgaW1tZWRpYXRlbHkgcHVzaCBhbiBFQVQgdG9rZW4gZG93bnN0cmVhbSBpZiBhIHNwZWNpZmlj IGhhc2ggdmFsdWUgY2hhbmdlcykuJm5ic3A7IEFzIGEgcmVzdWx0IEkgd2FudCBtb3JlIGV4cGxp Y2l0IGFuZCBzdGFibGUgY2xhaW0gZGVmaW5pdGlvbnMuPG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk1vcmUgaGlnaGx5IHNwZWNpZmllZCBjbGFp bXMgb2YgY291cnNlIGV4cG9zZXMgcG9zc2libGUgY2xhaW0gcmVkdW5kYW5jeSwgZm9yZWlnbiBr ZXkgcmVsYXRpb25zaGlwcywgYW5kIGNyb3NzLW1hcHBpbmcgd2l0aCBkb3duc3RyZWFtIGluZm9y bWF0aW9uIG1vZGVscy4gSSBhc3NlcnQgdGhpcyBpcyBhIGdvb2QgdGhpbmcgYmVjYXVzZSB3ZSBl eHBvc2UgKGFuZCBob3BlZnVsbHkgbWluaW1pemUpIGNvc3RzIHdoaWNoDQogYXJlIGJvcm5lIGJ5 IGRvd25zdHJlYW0gZGV2ZWxvcGVycy4mbmJzcDs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVk LXNwYWNlIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPkVyaWM8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0 eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCBibHVlIDEuNXB0O3BhZGRpbmc6MGlu IDBpbiAwaW4gNC4wcHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tYm90dG9tOjEyLjBwdCI+SGFubmVzIFRzY2hvZmVuaWcsIEp1bmUgNywgMjAxOSA3OjI5IEFN PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBsYW5nPSJFTi1HQiI+RldJVzogV2hpbGUgdGhlIEpXVCByZWdpc3RyeSBsb29rcyBtb3JlIG1p eGVkIGluIHRlcm1zIG9mIGNsYWltIHR5cGVzLiBUaGlzIGlzLCBob3dldmVyLCBvbmx5IGEgcmVz dWx0IG9mIHRoZSB3aWRlc3ByZWFkIGFkb3B0aW9uLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj5UaGVy ZSBhcmUgbm8gcHJvYmxlbXMsIGFzIGZhciBhcyBJIGtub3csIHdpdGggdGhlIGRpdmVyc2l0eSBv ZiB0aGUgY2xhaW1zIGFuZCB0aGF0IHRoZXkgYXJlIG5vdCBhbGwgdXNlZnVsIGluIGV2ZXJ5IGNv bnRleHQuIERpZmZlcmVudCBkZXBsb3ltZW50cyB1c2UgdGhlIGNsYWltcyB0aGV5IGZpbmQgdXNl ZnVsLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+SSBh bSB3b25kZXJpbmcgd2hldGhlciB3ZSBhcmUgdHJ5aW5nIHRvIGZpeCBhIHByb2JsZW0gd2l0aCB0 aGUgcmVnaXN0cnkgb2YgY2xhaW1zIHRoYXQgZG9lc27igJl0IG9jY3VyIGluIHByYWN0aWNlLjwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIGxhbmc9IkVOLUdCIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+Q2lhbzwvc3Bh bj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIGxhbmc9IkVOLUdCIj5IYW5uZXM8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+Jm5ic3A7PC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7 Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGluIDBpbiAwaW4i Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZyb206PC9iPjxzcGFuIGNsYXNzPSJh cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5SQVRTICZsdDs8YSBocmVmPSJtYWls dG86cmF0cy1ib3VuY2VzQGlldGYub3JnIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5yYXRz LWJvdW5jZXNAaWV0Zi5vcmc8L3NwYW4+PC9hPiZndDs8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVy dGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGI+T24gQmVoYWxmIE9mPHNwYW4gY2xhc3M9ImFwcGxl LWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvYj5NaWtlDQogSm9uZXM8YnI+DQo8Yj5T ZW50OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+ TWl0dHdvY2gsIDUuIEp1bmkgMjAxOSAxOTozMTxicj4NCjxiPlRvOjwvYj48c3BhbiBjbGFzcz0i YXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+TGF1cmVuY2UgTHVuZGJsYWRlICZs dDs8YSBocmVmPSJtYWlsdG86bGdsQGlzbGFuZC1yZXNvcnQuY29tIj48c3BhbiBzdHlsZT0iY29s b3I6cHVycGxlIj5sZ2xAaXNsYW5kLXJlc29ydC5jb208L3NwYW4+PC9hPiZndDs7IE1pY2hhZWwg UmljaGFyZHNvbiAmbHQ7PGEgaHJlZj0ibWFpbHRvOm1jciYjNDM7aWV0ZkBzYW5kZWxtYW4uY2Ei PjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPm1jciYjNDM7aWV0ZkBzYW5kZWxtYW4uY2E8L3Nw YW4+PC9hPiZndDs8YnI+DQo8Yj5DYzo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1z cGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzpyYXRzQGlldGYub3JnIj48c3BhbiBz dHlsZT0iY29sb3I6cHVycGxlIj5yYXRzQGlldGYub3JnPC9zcGFuPjwvYT48YnI+DQo8Yj5TdWJq ZWN0OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+ UmU6IFtSYXRzXSBWZXR0aW5nIGNsYWltIGRlZmluaXRpb25zPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFu Zz0iRU4tR0IiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj5BY3R1YWxseSwg bm9ybWFsIChub24tY29sbGlzaW9uLXJlc2lzdGFudCkgSldUIGNsYWltcyAqPGI+YXJlPC9iPiog YWxsb2NhdGVkIG9uIGEgc3BlY2lmaWNhdGlvbiByZXF1aXJlZCBiYXNpcyB3aXRoIGV4cGVydCBy ZXZpZXcuJm5ic3A7IFNlZSB0aGlzIHRleHQgYXQ8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVk LXNwYWNlIj4mbmJzcDs8L3NwYW4+PGEgaHJlZj0iaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1s L3JmYzc1MTkjc2VjdGlvbi0xMC4xIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5odHRwczov L3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNzUxOSNzZWN0aW9uLTEwLjE8L3NwYW4+PC9hPjo8L3Nw YW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFt aWx5OkNvbnNvbGFzO2JhY2tncm91bmQ6d2hpdGUiPiZuYnNwOyZuYnNwOyBWYWx1ZXMgYXJlIHJl Z2lzdGVyZWQgb24gYSBTcGVjaWZpY2F0aW9uIFJlcXVpcmVkIFs8L3NwYW4+PGEgaHJlZj0iaHR0 cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL3JmYzUyMjYiIHRpdGxlPSImcXVvdDtHdWlkZWxpbmVz IGZvciBXcml0aW5nIGFuIElBTkEgQ29uc2lkZXJhdGlvbnMgU2VjdGlvbiBpbiBSRkNzJnF1b3Q7 Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpDb25zb2xhcztjb2xv cjojMDA2NkNDIj5SRkM1MjI2PC9zcGFuPjwvYT48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6Q29u c29sYXM7YmFja2dyb3VuZDp3aGl0ZSI+XQ0KIGJhc2lzPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFt aWx5OkNvbnNvbGFzO2JhY2tncm91bmQ6d2hpdGUiPiZuYnNwOyZuYnNwOyBhZnRlciBhIHRocmVl LXdlZWsgcmV2aWV3IHBlcmlvZCBvbiB0aGU8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNw YWNlIj4mbmJzcDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOmp3dC1yZWctcmV2aWV3QGlldGYub3Jn Ij48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5qd3QtcmVnLXJldmlld0BpZXRmLm9yZzwvc3Bh bj48L2E+PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkNvbnNvbGFzO2JhY2tncm91bmQ6d2hp dGUiPiZuYnNwOyZuYnNwOyBtYWlsaW5nIGxpc3QsIG9uIHRoZSBhZHZpY2Ugb2Ygb25lIG9yIG1v cmUgRGVzaWduYXRlZCBFeHBlcnRzLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpDb25zb2xh cztiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDsmbmJzcDsgSG93ZXZlciwgdG8gYWxsb3cgZm9yIHRo ZSBhbGxvY2F0aW9uIG9mIHZhbHVlcyBwcmlvciB0byBwdWJsaWNhdGlvbiw8L3NwYW4+PG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk6Q29uc29sYXM7YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7Jm5ic3A7IHRo ZSBEZXNpZ25hdGVkIEV4cGVydHMgbWF5IGFwcHJvdmUgcmVnaXN0cmF0aW9uIG9uY2UgdGhleSBh cmU8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6Q29uc29sYXM7YmFja2dyb3VuZDp3aGl0ZSI+ Jm5ic3A7Jm5ic3A7IHNhdGlzZmllZCB0aGF0IHN1Y2ggYSBzcGVjaWZpY2F0aW9uIHdpbGwgYmUg cHVibGlzaGVkLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJzcDs8L3NwYW4+PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iY29sb3I6IzAwMjA2MCI+U28gYSBzcGVjaWZpY2F0aW9uIGNhbiBlYXNpbHkgcmVnaXN0 ZXIgYm90aCBKV1QgYW5kIENXVCBjbGFpbXMuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAi PiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4mbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgJm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7IC0tIE1pa2U8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5i c3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9y ZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGlu IDBpbiAwaW4iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZyb206PC9iPjxzcGFu IGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5MYXVyZW5jZSBMdW5k YmxhZGUgJmx0OzxhIGhyZWY9Im1haWx0bzpsZ2xAaXNsYW5kLXJlc29ydC5jb20iPjxzcGFuIHN0 eWxlPSJjb2xvcjpwdXJwbGUiPmxnbEBpc2xhbmQtcmVzb3J0LmNvbTwvc3Bhbj48L2E+Jmd0Ozxz cGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YnI+DQo8Yj5T ZW50OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+ V2VkbmVzZGF5LCBKdW5lIDUsIDIwMTkgODo0NiBBTTxicj4NCjxiPlRvOjwvYj48c3BhbiBjbGFz cz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+TWljaGFlbCBSaWNoYXJkc29u ICZsdDs8YSBocmVmPSJtYWlsdG86bWNyJiM0MztpZXRmQHNhbmRlbG1hbi5jYSI+PHNwYW4gc3R5 bGU9ImNvbG9yOnB1cnBsZSI+bWNyJiM0MztpZXRmQHNhbmRlbG1hbi5jYTwvc3Bhbj48L2E+Jmd0 Ozxicj4NCjxiPkNjOjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJz cDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOnJhdHNAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJjb2xv cjpwdXJwbGUiPnJhdHNAaWV0Zi5vcmc8L3NwYW4+PC9hPjsgTWlrZSBKb25lcyAmbHQ7PGEgaHJl Zj0ibWFpbHRvOk1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSI+PHNwYW4gc3R5bGU9ImNvbG9y OnB1cnBsZSI+TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPC9zcGFuPjwvYT4mZ3Q7PGJyPg0K PGI+U3ViamVjdDo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7 PC9zcGFuPlJlOiBbUmF0c10gVmV0dGluZyBjbGFpbSBkZWZpbml0aW9uczxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ QmVsb3figKY8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj4mIzQzOyBNaWtlIEpvbmVzLCBjby1hdXRob3Igb2YgQ1dUPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJv dHRvbToxMi4wcHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1h cmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPk9uIEp1biA1LCAyMDE5LCBhdCA2OjA1IEFNLCBNaWNoYWVsIFJpY2hh cmRzb24gJmx0OzxhIGhyZWY9Im1haWx0bzptY3ImIzQzO2lldGZAc2FuZGVsbWFuLmNhIj48c3Bh biBzdHlsZT0iY29sb3I6cHVycGxlIj5tY3ImIzQzO2lldGZAc2FuZGVsbWFuLmNhPC9zcGFuPjwv YT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPjxi cj4NCkxhdXJlbmNlIEx1bmRibGFkZSAmbHQ7PGEgaHJlZj0ibWFpbHRvOmxnbEBpc2xhbmQtcmVz b3J0LmNvbSI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+bGdsQGlzbGFuZC1yZXNvcnQuY29t PC9zcGFuPjwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9 Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+4oCUIFRvZGF5IENXVCBhbGxvY2F0ZXMgbWlsbGlvbnMgb2Ygc2xvdHMgZm9y IGV4cGVydCByZXZpZXcuIE5vPGJyPg0Kc3BlY2lmaWNhdGlvbiBpcyByZXF1aXJlZCwgYnV0IHNv bWUgaW5mb3JtYXRpb24gc2hvdWxkIGJlIHByb3ZpZGVkLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Jsb2NrcXVvdGU+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRv bToxMi4wcHQiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdp bi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+SldUIGRvZXNu4oCZdCBzZWVtIHRvIGhhdmUgdGhpcywgd2hpY2ggaXMgbWF5YmUgd2h5 IGl0IGlzIG1lc3NpZXIuIEl0PGJyPg0Ka2luZCBvZiBzZWVtcyBiYWQgYW5kIHdyb25nIHRoYXQg aXQgZG9lc27igJl0IHRvIG1lLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGJyPg0KSldUIGRvZXNuJ3QgaGF2ZSB0aGlz IGJlY2F1c2UgdGhlIGNsYWltcyBhcmUgJnF1b3Q7dW5saW1pdGVkJnF1b3Q7IGxlbmd0aCBzdHJp bmdzLCBzbzxicj4NCm9uZSBjYW4gYWx3YXlzIG1ha2UgdXAgYSB1bmlxdWUgc3RyaW5nIGluIGxp ZXUgb2YgcmVnaXN0cmF0aW9uLjxicj4NCiZuYnNwO29yZy5pc2xhbmQtcmVzb3J0LmxnbC53aGF0 ZXZlcnN0cmluZ3lvdXdhbnQ8YnI+DQo8YnI+DQppcyBwcm9iYWJseSBjb21wbGV0ZWx5IHlvdXJz IDotKTxicj4NCk9mIGNvdXJzZSwgaWYgeW91IHdhbnQgdG8gaW50ZXJvcGVyYXRlIHlvdSBuZWVk IHRvIGFncmVlIGFib3V0IGhvdywgc28gdGhlcmU8YnI+DQphcmUgc29tZSBhZHZhbnRhZ2VzIG9m IGEgZm9yY2luZyBmdW5jdGlvbiB0aGF0IGRlbWFuZHMgeW91IHdyaXRlIHRoaW5ncyBkb3duPGJy Pg0KZmlyc3QgOi0pPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Js b2NrcXVvdGU+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+VW5saW1pdGVkIGxlbmd0aCBzdHJpbmcgY2xhaW0gbmFtZXMgYXJlIGZ1bGx5IHBhcnQg b2YgQ1dULiBBbHNvLCBDT1NFIGFsbG93cyB0aGVtIGZvciBoZWFkZXJzLCBhbGdvcml0aG0gbmFt ZXMgYW5kIHN1Y2ggdG9vLiBTbyBmcm9tIGEgc3ludGF4IHZpZXcgQ1dUIGFuZCBDT1NFIGFyZSB0 aGUgc2FtZSBhcyBKV1QgaW4gYWxsb3dpbmcgbG9uZyBzdHJpbmcgbmFtZXMuPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4m bmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPkhvd2V2ZXIsIENPU0UgYW5kIENXVCBhcmUgZGlmZmVyZW50IGluIHRo ZSBtYW5hZ2VtZW50IG9mIHRoZSBzdHJpbmcgbmFtZSBzcGFjZTo8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9 Im1hcmdpbi1sZWZ0OjMwLjBwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFy Z2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5TdHJpbmdzIG9mIGxlbmd0aCAxPHNwYW4gY2xhc3M9ImFwcGxlLXRhYi1zcGFuIj4mbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDs8L3NwYW4+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9z cGFuPlN0YW5kYXJkcyBBY3Rpb248bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlN0cmluZ3Mgb2Yg bGVuZ3RoIDI8c3BhbiBjbGFzcz0iYXBwbGUtdGFiLXNwYW4iPiZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOzwvc3Bhbj48c3Bh biBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+U3BlY2lmaWNhdGlv biBSZXF1aXJlZDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U3RyaW5ncyBvZiBsZW5ndGggZ3Jl YXRlciB0aGFuIDI8c3BhbiBjbGFzcz0iYXBwbGUtdGFiLXNwYW4iPiZuYnNwOyZuYnNwOyZuYnNw Ozwvc3Bhbj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+ RXhwZXJ0IFJldmlldzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5UaGVzZSwgYWxvbmcgd2l0aCB0aGUgaW50ZWdlciBuYW1lcyBzcGFjZSBy dWxlcywgdGhlbiBpbXBseTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi1sZWZ0OjMwLjBwdDtt YXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8 ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JbnRlZ2VyIHZhbHVlcyBs ZXNzIHRoYW4gLTY1NTM2IGFyZSB0aGUgb25seSBvbmVzIGZyZWUgZm9yIHVzZSB3aXRoIG5vIHJl dmlldyBvciBwcm9jZXNzaW5nIGJ5IElBTkEgYW5kIGV4cGVydHMuPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkpXVCBhbHNvIGhhcyB0aGlz IG5vdGlvbiBvZiZuYnNwO0NvbGxpc2lvbi1SZXNpc3RhbnQgTmFtZSBiYXNlZCBvbiBPSURzIG9y IFVVSURzLCB3aGljaCBpcyBlc3NlbnRpYWxseSBzb21lIHJ1bGVzIHRvIG1ha2UgdXAgbmFtZXMg dGhhdCBkb27igJl0IGdvIGludG8gYW4gSUFOQSByZWdpc3RyeSBhbmQgYXJlIHN0aWxsIHVuaXF1 ZSBhbmQgd29u4oCZdCBjb2xsaWRlLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5KV1QgY291 bGQgaGF2ZSBkb25lIHdoYXQgQ1dUIGRvZXMuIFNlZW1zIHRvIG1lIHRoYXQgQ1dUIGhhcyB0YWtl biBhIHJhZGljYWxseSBtb3JlIG1hbmFnZWQgYXBwcm9hY2ggdG8gdGhlIHN1cGVyLW9wZW4gSldU IGFwcHJvYWNoLiBNYXliZSB0aGUgQ1dUIGZvbGtzIHJlYWxpemVkIHRoZSBKV1QgZGVzaWduIHdh cyBwb29yLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkF0IGFu eSByYXRlLCB0aGVyZSBzZWVtcyB0byBiZSBzb21lIGNvbnNlbnN1cyBoZXJlIHRoYXQgdGhlIENX VCBhcHByb2FjaCBpcyB3aGF0IHdlIHdhbnQgZm9yIGF0dGVzdGF0aW9uLiBJdCBpcyBhbHNvIHRo ZSBtb3JlIHJlY2VudCBhbmQgdGh1cyBtYXliZSBtb3JlIGFkdmFuY2VkIHRoaW5raW5nLjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5J4oCZbSBob3Bpbmcgd2UgY2FuIGZpbmQgb3VyIHdheSB0 byBqdXN0IGFjY2VwdCB0aGUgQ1dUIGNsYWltIG5hbWluZyBtYW5hZ2VtZW50IHNjaGVtZSBhcyBp cyBmb3IgYXR0ZXN0YXRpb24uIElmIG90aGVyIENXVC1iYXNlZCBlZmZvcnRzIGRpZCB0aGUgc2Ft ZSAoZHJhZnQtYmlya2hvbHotY29yZS1jb2lkKSBkaWQgdGhlIHNhbWUgdGhlbiB0aGUgd29ybGQg d291bGQgYmUgbXVjaCBzaW1wbGVyLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5I b3dldmVyIHRoYXQgc3RpbGwgbGVhdmVzIG9wZW4gc29tZSBpc3N1ZSB3aXRoIEpXVCBuYW1lc3Bh Y2UgbWFuYWdlbWVudC4gKFdlIGRvIHdhbnQgSlNPTiBiYXNlZCBhdHRlc3RhdGlvbiB0byBiZSBK V1TigJlzLCByaWdodD8gSnVzdCB0aGUgc2FtZSBhcyBDQk9SLWJhc2VkIGF0dGVzdGF0aW9uIGFy ZSBDV1TigJlzKS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+TEw8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPklNUE9SVEFOVCBOT1RJQ0U6 IFRoZSBjb250ZW50cyBvZiB0aGlzIGVtYWlsIGFuZCBhbnkgYXR0YWNobWVudHMgYXJlIGNvbmZp ZGVudGlhbCBhbmQgbWF5IGFsc28gYmUgcHJpdmlsZWdlZC4gSWYgeW91IGFyZSBub3QgdGhlIGlu dGVuZGVkIHJlY2lwaWVudCwgcGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyIGltbWVkaWF0ZWx5IGFu ZCBkbyBub3QgZGlzY2xvc2UgdGhlIGNvbnRlbnRzDQogdG8gYW55IG90aGVyIHBlcnNvbiwgdXNl IGl0IGZvciBhbnkgcHVycG9zZSwgb3Igc3RvcmUgb3IgY29weSB0aGUgaW5mb3JtYXRpb24gaW4g YW55IG1lZGl1bS4gVGhhbmsgeW91Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwv Ym9keT4NCjwvaHRtbD4NCg== --_000_DM6PR11MB4089C31F977DD496B5CC49D7A1100DM6PR11MB4089namp_-- From nobody Mon Jun 10 11:57:46 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2B59D1200CD for ; Mon, 10 Jun 2019 11:57:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.888 X-Spam-Level: X-Spam-Status: No, score=-1.888 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, T_SPF_TEMPERROR=0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9GYuHse4dUGn for ; Mon, 10 Jun 2019 11:57:40 -0700 (PDT) Received: from p3plsmtpa08-01.prod.phx3.secureserver.net (p3plsmtpa08-01.prod.phx3.secureserver.net [173.201.193.102]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F1C3C1200B5 for ; Mon, 10 Jun 2019 11:57:38 -0700 (PDT) Received: from [172.20.10.4] ([174.213.15.178]) by :SMTPAUTH: with ESMTPSA id aPTthEon4vXcJaPTyhyFzj; Mon, 10 Jun 2019 11:57:37 -0700 From: Laurence Lundblade Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_8BF31DF4-8716-455A-B01C-A4FC50A9E374" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Mon, 10 Jun 2019 11:57:13 -0700 In-Reply-To: Cc: Michael Richardson , Hannes Tschofenig , Mike Jones , "rats@ietf.org" , Henk Birkholz To: "Eric Voit (evoit)" References: <12913.1559739926@localhost> <30754CD8-98AB-4080-952E-880BC630EC69@island-resort.com> <902E75D8-D8AC-403B-A295-0EC3034E44B2@island-resort.com> X-Mailer: Apple Mail (2.3445.9.1) X-CMAE-Envelope: MS4wfIQUcYRWkHWCdgVUxGfzkhbBG8Mu2A/kg/hVe6FCOKHBtptRYUjZj2By/+8SlqWJSWH91Vjax7HrVGNHn7XBGYXXZGR+XgCdOaAa7wEaas0ZN+1mcJn3 aRsTjqMDBzGJbLW40xJ+zVQtrglal1qbXU6V6gWFlyuZJtUr8R5Rf2pCylO6usD5gSbSmrewlh0nGPtmOFrdKErpI+2LwmuCJZ9QLMCLsEK2u/NhHntQN2gB xaJZcPlIC9NNIROgGytDKrHjL1x+OI2cVYd+HJFy1dm+s+u9HdSSwWJrEugRYRvc+SSc065rXcbwB2rumpmfs34pRrCxmwdsBQF/0M+TWMUlwCD/iY8Q/Fn/ h0jspESpJL6lJ2MeLg2bcRQBpPYm5Q== Archived-At: Subject: Re: [Rats] Vetting claim definitions X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Jun 2019 18:57:44 -0000 --Apple-Mail=_8BF31DF4-8716-455A-B01C-A4FC50A9E374 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Eric, So I think we have some agreement on general principles for how to = structure the documents this work group produces so we can have both = flexibility in the definition of new claims and well-defined concise = sets claims for particular use cases.=20 In particular I appreciate the confirmation of this from Mike Jones. = Hopefully lack of objection implies a lot of agreement.=20 Eric, I think you are now digging into the next level of detail on how = to deal with TPM-based implementations and claims specified in YANG and = how that will interoperate with CWT/COSE and JWT/JOSE based tokens. I don=E2=80=99t really understand YANG and how to fully read = draft-birkholz-rats-basic-yang-module yet. Working on it (but I should = be working on the new EAT draft=E2=80=A6) draft-birkholz-rats-basic-yang-module REQUIRES a TPM to implement it. = That implies to me that neither CWT/COSE and JWT/JOSE signed container = formats can be used because I don=E2=80=99t think TPM=E2=80=99s can = produce either format. Pretty sure we agree that EAT will always be = CWT/COSE or JWT/JOSE.=20 (It is also odd to me that an IETF standard would require particular HW. = It should just be about bits on the wire. EAT will have some means to = indicate the security of the HW and SW that produced a given token, but = will not require any particular security from the HW or SW) But let=E2=80=99s assume that a relying party (I think you call this the = Network Element) can unpack and verify signature that in the format of = CWT and JWT and the TPM-style sig that I think is implied by = draft-birkholz-rats-basic-yang-module. The result will be a set of = claims in some syntax. It will be CBOR or JSON in the case of CWT or = JWT.=20 What will it be for draft-birkholz-rats-basic-yang-module??? = YANG-described stuff an be lots of different syntaxes by my = understanding. How many of them will a relying party be expected to = support so there is interop? I=E2=80=99m going to stop here for the answer to that question. LL > On Jun 7, 2019, at 1:31 PM, Eric Voit (evoit) wrote: >=20 > Hi Laurence, > =20 > Effectively this =E2=80=9CRouter Attestation Profile=E2=80=9D draft = you are proposing would consist of well-defined claims which are also = YANG objects. And these YANG objects would augment the model definition = within draft-birkholz-rats-basic-yang-module. =20 > =20 > If you agree, this is exactly what I was hoping to hear. Good things = which can come from this approach: > Network Elements would be capable of reading some subset of what is = coming off of EAT capable hardware chips. > Where brand new claims are being explored, a search of existing YANG = objects could be done. Adoption on YANG definitions where possible = would minimize downstream mapping. > =20 > Eric > =20 > From: Laurence Lundblade, June 7, 2019 2:53 PM >=20 > Hi Eric, > =20 > Feels like there=E2=80=99s opposing views: > =20 > 1) Carsten, Kathleen, myself and maybe Henk and others want an EAT to = be a CWT/JWT.This really does make the claim set open-ended. CWT is a = bit more carefully managed than JWT, but we=E2=80=99ll still end up with = a lot of claims registered.=20 > =20 > 2) You want a very well-defined concise claim set, a controlled policy = for allowing new claims and maximal interoperability. > =20 > I think both objectives are good and desirable. > =20 > I think the way to have both is to leave the CWT/JWT registration open = as they are AND ALSO define a profile / subset in an IETF standard for = your use case. This profile / subset can: > =20 > - Make clear normative references to extant claims that are considered = well-enough formed and interoperable > - Define some new claims where none are extant > - Define a policy for adding new claims=20 > - Labelling to distinguish the profile from a general open-ended = CWT/JWT > =20 > So one way forward is for this WG to adopt another document. Maybe = call it =E2=80=9CRouter Attestation Profile=E2=80=9D. This would be in = addition to EAT. It makes normative references to the EAT claims it = likes. > =20 > Another way forward is for the EAT draft to change direction some and = become the more tight and limited attestation definition. It would = probably address more than just the router use case, but it would retain = the main characteristics you want. If we do this, then we can expect = other attestation use cases to write documents and maybe run them = through this WG or maybe not. > =20 > LL >=20 >=20 >=20 > On Jun 7, 2019, at 10:14 AM, Eric Voit (evoit) > wrote: > =20 > Hi Hannes, > =20 > If we were sure we could limit EAT claims to just a few things which = come out of hardware, this wouldn't concern me as much as it does. = However the domain of attestable objects was left fairly open within the = EAT draft. And we need to determine what level of interoperability are = we trying to shepherd via RATS. > =20 > In the end, RATS (and EAT) need to determine the level of = interoperability desired for specific claims. I don't claim deep = familiarity with JWT. But looking at RFC-7519, Section 4.1, I see that = I would have questions as an implementer. For example, the claims = "iss", "sub", and "aud" look to have population/processing which is = application specific. Therefore with these claims, it is up to = applications on either side of the JWT must come to an agreement on what = the populated instances mean. (I.e., not the WG.) =20 > =20 > Common of object definitions/claims from internal hardware are = important if the Network Element needs to act on specific values. And = as a vendor, I know that I do want to act on information coming out of = hardware even if the information is being pushed to a remote validator = (e.g., immediately push an EAT token downstream if a specific hash value = changes). As a result I want more explicit and stable claim = definitions. > =20 > More highly specified claims of course exposes possible claim = redundancy, foreign key relationships, and cross-mapping with downstream = information models. I assert this is a good thing because we expose (and = hopefully minimize) costs which are borne by downstream developers. =20 > =20 > Eric > =20 > Hannes Tschofenig, June 7, 2019 7:29 AM >=20 > FWIW: While the JWT registry looks more mixed in terms of claim types. = This is, however, only a result of the widespread adoption. > There are no problems, as far as I know, with the diversity of the = claims and that they are not all useful in every context. Different = deployments use the claims they find useful. > =20 > I am wondering whether we are trying to fix a problem with the = registry of claims that doesn=E2=80=99t occur in practice. > =20 > Ciao > Hannes > =20 > From: RATS > On = Behalf Of Mike Jones > Sent: Mittwoch, 5. Juni 2019 19:31 > To: Laurence Lundblade >; Michael Richardson = > > Cc: rats@ietf.org > Subject: Re: [Rats] Vetting claim definitions > =20 > Actually, normal (non-collision-resistant) JWT claims *are* allocated = on a specification required basis with expert review. See this text at = https://tools.ietf.org/html/rfc7519#section-10.1 = : > =20 > Values are registered on a Specification Required [RFC5226 = ] basis > after a three-week review period on the jwt-reg-review@ietf.org = > mailing list, on the advice of one or more Designated Experts. > However, to allow for the allocation of values prior to = publication, > the Designated Experts may approve registration once they are > satisfied that such a specification will be published. > =20 > So a specification can easily register both JWT and CWT claims. > =20 > -- Mike > =20 > From: Laurence Lundblade >=20 > Sent: Wednesday, June 5, 2019 8:46 AM > To: Michael Richardson > > Cc: rats@ietf.org ; Mike Jones = > > Subject: Re: [Rats] Vetting claim definitions > =20 > Below=E2=80=A6 > + Mike Jones, co-author of CWT > =20 >=20 > On Jun 5, 2019, at 6:05 AM, Michael Richardson > wrote: > =20 >=20 > Laurence Lundblade > wrote: >=20 > =E2=80=94 Today CWT allocates millions of slots for expert review. No > specification is required, but some information should be provided. > =20 >=20 > JWT doesn=E2=80=99t seem to have this, which is maybe why it is = messier. It > kind of seems bad and wrong that it doesn=E2=80=99t to me. >=20 > JWT doesn't have this because the claims are "unlimited" length = strings, so > one can always make up a unique string in lieu of registration. > org.island-resort.lgl.whateverstringyouwant >=20 > is probably completely yours :-) > Of course, if you want to interoperate you need to agree about how, so = there > are some advantages of a forcing function that demands you write = things down > first :-) > =20 > Unlimited length string claim names are fully part of CWT. Also, COSE = allows them for headers, algorithm names and such too. So from a syntax = view CWT and COSE are the same as JWT in allowing long string names. > =20 > However, COSE and CWT are different in the management of the string = name space: > =20 > Strings of length 1 Standards Action > Strings of length 2 Specification Required > Strings of length greater than 2 Expert Review > =20 > These, along with the integer names space rules, then imply: > =20 > Integer values less than -65536 are the only ones free for use with no = review or processing by IANA and experts. > =20 > JWT also has this notion of Collision-Resistant Name based on OIDs or = UUIDs, which is essentially some rules to make up names that don=E2=80=99t= go into an IANA registry and are still unique and won=E2=80=99t = collide. > =20 > JWT could have done what CWT does. Seems to me that CWT has taken a = radically more managed approach to the super-open JWT approach. Maybe = the CWT folks realized the JWT design was poor. > =20 > =20 > At any rate, there seems to be some consensus here that the CWT = approach is what we want for attestation. It is also the more recent and = thus maybe more advanced thinking. > =20 > I=E2=80=99m hoping we can find our way to just accept the CWT claim = naming management scheme as is for attestation. If other CWT-based = efforts did the same (draft-birkholz-core-coid) did the same then the = world would be much simpler.=20 > =20 > However that still leaves open some issue with JWT namespace = management. (We do want JSON based attestation to be JWT=E2=80=99s, = right? Just the same as CBOR-based attestation are CWT=E2=80=99s). > =20 > LL > =20 > IMPORTANT NOTICE: The contents of this email and any attachments are = confidential and may also be privileged. If you are not the intended = recipient, please notify the sender immediately and do not disclose the = contents to any other person, use it for any purpose, or store or copy = the information in any medium. Thank you. > =20 > _______________________________________________ > RATS mailing list > RATS@ietf.org > https://www.ietf.org/mailman/listinfo/rats = --Apple-Mail=_8BF31DF4-8716-455A-B01C-A4FC50A9E374 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
Hi Eric,

So I think we have some agreement on general principles for = how to structure the documents this work group produces so we can have = both flexibility in the definition of new claims and well-defined concise sets claims for particular = use cases. 

In particular I appreciate the confirmation of this from Mike = Jones. Hopefully lack of objection implies a lot of = agreement. 


Eric, I think you are = now digging into the next level of detail on how to deal with TPM-based = implementations and claims specified in YANG and how that will = interoperate with CWT/COSE and JWT/JOSE based tokens.

I don=E2=80=99t really = understand YANG and how to fully read = draft-birkholz-rats-basic-yang-module yet. Working on it (but I should = be working on the new EAT draft=E2=80=A6)

draft-birkholz-rats-basic-yang-module REQUIRES a TPM to = implement it. That implies to me that neither CWT/COSE and JWT/JOSE = signed container formats can be used because I don=E2=80=99t think = TPM=E2=80=99s can produce either format. Pretty sure we agree that EAT = will always be CWT/COSE or JWT/JOSE. 

(It is also odd to me that an IETF = standard would require particular HW. It should just be about bits on = the wire. EAT will have some means to indicate the security of the HW = and SW that produced a given token, but will not require any particular = security from the HW or SW)

But let=E2=80=99s assume that a relying party (I think you = call this the Network Element) can unpack and verify signature that in = the format of CWT and JWT and the TPM-style sig that I think is implied = by draft-birkholz-rats-basic-yang-module. The result will be a set of = claims in some syntax. It will be CBOR or JSON in the case of CWT or = JWT. 

What = will it be for draft-birkholz-rats-basic-yang-module??? YANG-described = stuff an be lots of different syntaxes by my understanding. How many of = them will a relying party be expected to support so there is = interop?

I=E2=80= =99m going to stop here for the answer to that question.

LL






On Jun 7, 2019, at 1:31 PM, Eric Voit (evoit) <evoit@cisco.com> = wrote:

Hi = Laurence,
 
Effectively this =E2=80=9CRouter Attestation Profile=E2=80=9D = draft you are proposing would consist of well-defined claims which are = also YANG objects.  And these YANG objects would augment the model = definition within draft-birkholz-rats-basic-yang-module.  
 
If you = agree, this is exactly what I was hoping to hear.  Good things = which can come from this approach:
  • Network = Elements would be capable of reading some subset of what is coming off = of EAT capable hardware chips.
  • Where brand new claims are = being explored, a search of existing YANG objects could be done.  = Adoption on YANG definitions where possible would minimize downstream = mapping.
 
Eric
 
From: Laurence Lundblade, June 7, = 2019 2:53 PM

Hi Eric,
 
Feels like there=E2=80=99s opposing views:
 
1) Carsten, Kathleen, = myself and maybe Henk and others want an EAT to be a CWT/JWT.This really = does make the claim set open-ended. CWT is a bit more carefully managed = than JWT, but we=E2=80=99ll still end up with a lot of claims = registered. 
 
2) You want a very well-defined concise claim set, a = controlled policy for allowing new claims and maximal = interoperability.
 
I think both objectives are good and = desirable.
 
I think the way to have both is to leave the CWT/JWT = registration open as they are AND ALSO define a profile / subset in an = IETF standard for your use case. This profile / subset can:
 
- Make clear normative = references to extant claims that are considered well-enough formed and = interoperable
- Define some new claims where none are = extant
- Define a policy for adding new = claims 
- Labelling to distinguish the profile = from a general open-ended CWT/JWT
 
So one way forward is for this WG to adopt another document. = Maybe call it =E2=80=9CRouter Attestation Profile=E2=80=9D.  This = would be in addition to EAT. It makes normative references to the EAT = claims it likes.
 
Another way forward is for the EAT draft to change direction = some and become the more tight and limited attestation definition. It = would probably address more than just the router use case, but it would = retain the main characteristics you want. If we do this, then we can = expect other attestation use cases to write documents and maybe run them = through this WG or maybe not.
 

LL



On Jun 7, 2019, at 10:14 AM, Eric Voit (evoit) <evoit@cisco.com> wrote:
 
Hi Hannes,
 
If we were sure we could limit EAT = claims to just a few things which come out of hardware, this wouldn't = concern me as much as it does.  However the domain of attestable = objects was left fairly open within the EAT draft.   And we = need to determine what level of interoperability are we trying to = shepherd via RATS.
 
In the end, RATS (and EAT) need to determine the level of = interoperability desired for specific claims.   I don't claim = deep familiarity with JWT.  But looking at RFC-7519, Section 4.1, I = see that I would have questions as an implementer.  For example, = the claims "iss", "sub", and "aud" look to have population/processing = which is application specific.  Therefore with these claims, it is = up to applications on either side of the JWT must come to an agreement = on what the populated instances mean.  (I.e., not the = WG.)   
 
Common of object definitions/claims = from internal hardware are important if the Network Element needs to act = on specific values.  And as a vendor, I know that I do want to act = on information coming out of hardware even if the information is being = pushed to a remote validator (e.g., immediately push an EAT token = downstream if a specific hash value changes).  As a result I want = more explicit and stable claim definitions.
 
More highly specified claims of course = exposes possible claim redundancy, foreign key relationships, and = cross-mapping with downstream information models. I assert this is a = good thing because we expose (and hopefully minimize) costs which are = borne by downstream developers.  
 
Eric
 

Hannes Tschofenig, = June 7, 2019 7:29 AM

FWIW: = While the JWT registry looks more mixed in terms of claim types. This = is, however, only a result of the widespread adoption.
There are no problems, as far = as I know, with the diversity of the claims and that they are not all = useful in every context. Different deployments use the claims they find = useful.
 
I am wondering whether we are trying to fix a problem with = the registry of claims that doesn=E2=80=99t occur in = practice.
 
Ciao
Hannes
 
From: RATS <rats-bounces@ietf.org> On Behalf = Of Mike Jones
Sent: Mittwoch, 5. Juni 2019 = 19:31
To: Laurence Lundblade <lgl@island-resort.com>; Michael Richardson = <mcr+ietf@sandelman.ca>
Cc: rats@ietf.org
Subject: Re: [Rats] Vetting claim = definitions
 
Actually, normal (non-collision-resistant) = JWT claims *are* allocated on a specification required = basis with expert review.  See this text at https://tools.ietf.org/html/rfc7519#section-10.1:
 
   Values are = registered on a Specification Required [RFC5226] basis
   after a three-week review period on = the jwt-reg-review@ietf.org
   mailing list, on the advice of one or = more Designated Experts.
   However, to = allow for the allocation of values prior to publication,
   the Designated Experts may approve = registration once they are
   satisfied = that such a specification will be published.
 
So a specification can easily register both = JWT and CWT claims.
 
          &nb= sp;            = ;            &= nbsp;     =             &n= bsp; -- Mike
 
From: Laurence Lundblade <lgl@island-resort.com> 
Sent: Wednesday, June 5, 2019 = 8:46 AM
To: Michael Richardson <mcr+ietf@sandelman.ca>
Cc: rats@ietf.org; Mike Jones <Michael.Jones@microsoft.com>
Subject: Re: [Rats] Vetting claim = definitions
 
Below=E2=80=A6
+ Mike = Jones, co-author of CWT

 

On Jun 5, 2019, at 6:05 AM, Michael = Richardson <mcr+ietf@sandelman.ca> wrote:
 


Laurence Lundblade <lgl@island-resort.com> = wrote:

=E2=80=94 Today CWT allocates millions of slots for expert = review. No
specification is required, but some information = should be provided.

 

JWT doesn=E2=80=99t seem to have this, which is maybe why it = is messier. It
kind of seems bad and wrong that it = doesn=E2=80=99t to me.

JWT doesn't = have this because the claims are "unlimited" length strings, so
one can always make up a unique string in lieu of = registration.
 org.island-resort.lgl.whateverstringyouwant

is probably completely yours :-)
Of course, if you want to interoperate you need to agree = about how, so there
are some advantages of a forcing = function that demands you write things down
first :-)
 
Unlimited length string claim names are = fully part of CWT. Also, COSE allows them for headers, algorithm names = and such too. So from a syntax view CWT and COSE are the same as JWT in = allowing long string names.
 
However, COSE and CWT are different in = the management of the string name space:
 
Strings of length 1        &= nbsp;   Standards Action
Strings = of length 2        &= nbsp;   Specification Required
Strings = of length greater than 2    Expert Review
 
These, = along with the integer names space rules, then imply:
 
Integer values less than = -65536 are the only ones free for use with no review or processing by = IANA and experts.
 
JWT also has this notion = of Collision-Resistant Name based on OIDs or UUIDs, which is = essentially some rules to make up names that don=E2=80=99t go into an = IANA registry and are still unique and won=E2=80=99t collide.
 
JWT could have done what CWT does. = Seems to me that CWT has taken a radically more managed approach to the = super-open JWT approach. Maybe the CWT folks realized the JWT design was = poor.
 
 
At any rate, there seems to be some = consensus here that the CWT approach is what we want for attestation. It = is also the more recent and thus maybe more advanced thinking.
 
I=E2=80=99m hoping we can find our way = to just accept the CWT claim naming management scheme as is for = attestation. If other CWT-based efforts did the same = (draft-birkholz-core-coid) did the same then the world would be much = simpler. 
 
However that still leaves open some = issue with JWT namespace management. (We do want JSON based attestation = to be JWT=E2=80=99s, right? Just the same as CBOR-based attestation are = CWT=E2=80=99s).
 
LL
 
IMPORTANT= NOTICE: The contents of this email and any attachments are confidential = and may also be privileged. If you are not the intended recipient, = please notify the sender immediately and do not disclose the contents to = any other person, use it for any purpose, or store or copy the = information in any medium. Thank you.
 
_______________________________________________
RATS mailing list
RATS@ietf.org
https://www.ietf.org/mailman/listinfo/rats
= --Apple-Mail=_8BF31DF4-8716-455A-B01C-A4FC50A9E374-- From nobody Mon Jun 10 14:24:15 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 26C0812011D for ; Mon, 10 Jun 2019 14:24:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=in+NZkR2; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=s/+skSWg Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jxFuYvb0gAHl for ; Mon, 10 Jun 2019 14:23:59 -0700 (PDT) Received: from alln-iport-1.cisco.com (alln-iport-1.cisco.com [173.37.142.88]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A7F031201CB for ; Mon, 10 Jun 2019 14:23:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=66228; q=dns/txt; s=iport; t=1560201838; x=1561411438; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=K0t87aKiQhxPz8yE70h6kNNFELtisUFwqHM7dNYsDCU=; b=in+NZkR2MYIX03pnJk3x/MK3dQCzk9qpQYmPv287pyOMCFuLm5ZJwE6k zFy0G926JBgHEWEFm5yg4V43LQV5Uk+tijX66dsqTG6IUs4K50xwjgDQg yNNGp8wI7UZLuwhlwUMI2WtipeoI7a6FWlQYmJg6bixesf0l5S+vVRc14 Y=; IronPort-PHdr: =?us-ascii?q?9a23=3AOsByoRa9cxHb24GxaxzsaET/LSx94ef9IxIV55?= =?us-ascii?q?w7irlHbqWk+dH4MVfC4el20Q+bRp3VvvRDjeee87vtX2AN+96giDgDa9QNMn?= =?us-ascii?q?1NksAKh0olCc+BB1f8KavncSs7AOxJVURu+DewNk0GUMs=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AdAADdyP5c/4gNJK1mGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAQGBVAEBAQEBAQsBgQ4vJAUnA2pVIAQLKAqEC4NHA45fgle?= =?us-ascii?q?XMoFCgRADUAQJAQEBDAEBGAEKCgIBAYRAAheCXSM3Bg4BAwEBBAEBAgEEbRw?= =?us-ascii?q?MhUoBAQEBAwEBEAgJChMBASkDAgIHAQ8CAQgOAwQBASEBBgMCAgIlCxQJCAI?= =?us-ascii?q?EDgUIFwODAYEdTQMdAQIMnW4CgTiITxBxgTGCeQEBBYUFGIIPAwaBNAGKPoE?= =?us-ascii?q?eF4FAPyZrRoJMPoJhAQECAYErAQsBBgEhDB8JAoJSMoImi0IjKAOCGIRsIpU?= =?us-ascii?q?LagkCgg+GRIhFhFSCJS+GTYQEiXaUJo8nAgQCBAUCDgEBBYFlImdxcBU7gmy?= =?us-ascii?q?CDwsBF4ECAQKCSIUUhT9yAYEojDgBAQ0XB4EEAYEgAQE?= X-IronPort-AV: E=Sophos;i="5.63,576,1557187200"; d="scan'208,217";a="282899624" Received: from alln-core-3.cisco.com ([173.36.13.136]) by alln-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 10 Jun 2019 21:23:57 +0000 Received: from XCH-RCD-015.cisco.com (xch-rcd-015.cisco.com [173.37.102.25]) by alln-core-3.cisco.com (8.15.2/8.15.2) with ESMTPS id x5ALNvYa014703 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Mon, 10 Jun 2019 21:23:57 GMT Received: from xhs-rtp-002.cisco.com (64.101.210.229) by XCH-RCD-015.cisco.com (173.37.102.25) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Mon, 10 Jun 2019 16:23:56 -0500 Received: from xhs-aln-001.cisco.com (173.37.135.118) by xhs-rtp-002.cisco.com (64.101.210.229) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Mon, 10 Jun 2019 17:23:55 -0400 Received: from NAM05-DM3-obe.outbound.protection.outlook.com (173.37.151.57) by xhs-aln-001.cisco.com (173.37.135.118) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Mon, 10 Jun 2019 16:23:55 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=K0t87aKiQhxPz8yE70h6kNNFELtisUFwqHM7dNYsDCU=; b=s/+skSWg64Pad8DV21ZXG/OHb2/lEBKkE/qonVw/HRCNHohwNkk62DNN+v9J97drUczFbXNvMFxZZSE6fN1BEiW467mcJsb2xkNLTnUk6ZAfuguKw1mRO5btt0u1EUqzYG/rZNxQOx2ri7+pae/0R4IiXkq73QZQNvFNQiPMIzo= Received: from DM6PR11MB4089.namprd11.prod.outlook.com (20.176.126.30) by DM6PR11MB3785.namprd11.prod.outlook.com (20.179.16.160) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1965.12; Mon, 10 Jun 2019 21:23:54 +0000 Received: from DM6PR11MB4089.namprd11.prod.outlook.com ([fe80::d014:d7a3:270:e5a9]) by DM6PR11MB4089.namprd11.prod.outlook.com ([fe80::d014:d7a3:270:e5a9%3]) with mapi id 15.20.1965.017; Mon, 10 Jun 2019 21:23:54 +0000 From: "Eric Voit (evoit)" To: Laurence Lundblade CC: Michael Richardson , Hannes Tschofenig , Henk Birkholz , Mike Jones , "rats@ietf.org" Thread-Topic: [Rats] Vetting claim definitions Thread-Index: AQHVHSQrNP3gSrcbuEuedIL4RWxi86aQLzAwgABa8ACAABflIIAEoFOAgAAVAQA= Date: Mon, 10 Jun 2019 21:23:53 +0000 Message-ID: References: <12913.1559739926@localhost> <30754CD8-98AB-4080-952E-880BC630EC69@island-resort.com> <902E75D8-D8AC-403B-A295-0EC3034E44B2@island-resort.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=evoit@cisco.com; x-originating-ip: [173.38.117.84] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: a28011b2-3b92-401e-f982-08d6ede9f0c2 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:DM6PR11MB3785; x-ms-traffictypediagnostic: DM6PR11MB3785: x-ms-exchange-purlcount: 5 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:6790; x-forefront-prvs: 0064B3273C x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(346002)(136003)(39860400002)(376002)(396003)(366004)(189003)(40434004)(199004)(124014002)(66446008)(66946007)(8936002)(66476007)(66556008)(68736007)(26005)(25786009)(476003)(5660300002)(66574012)(71200400001)(66066001)(9326002)(186003)(76116006)(64756008)(256004)(14444005)(6916009)(76176011)(102836004)(73956011)(7696005)(6116002)(5024004)(3846002)(11346002)(446003)(6506007)(53546011)(790700001)(4326008)(53936002)(478600001)(74316002)(45080400002)(966005)(52536014)(316002)(99286004)(606006)(14454004)(33656002)(6246003)(54906003)(55016002)(236005)(53946003)(86362001)(6306002)(6436002)(81156014)(8676002)(71190400001)(81166006)(9686003)(486006)(229853002)(2906002)(54896002)(30864003)(7736002); DIR:OUT; SFP:1101; SCL:1; SRVR:DM6PR11MB3785; H:DM6PR11MB4089.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 2W4kAAXuUMitdWJgvO0bHdncYBmE2zPnEU+QnwNyuctkX4XAPBcjpoCoV3G5qZObVT9+7K1qha+pVqtOEAOwt91zqbonlGck2raUSnPOpvJiann+nwXl4Xtp6z/bfhODQSlz8r2e98ApIqWq4V4Sl9jnj7++KHMgNwItGw3ksK8ubN+33U5VHqt7QhAMTzY804EsODmOvsSkWeSqb+6yIuADEYoXJuHJ4i0fR0UTbfFotX0hCCclpOCz99leFBxjHKgukrufVVsrbA7iMgTkuS+U8Izkk0HSZUiYDwWdb2pZxRGcl3qdKX3MxlI1F/oaFa+x4h/p+VzO0h2UahM3OCPK22iHh9YPLh3Ks4+hQnLYrXM6c9XgU3Q4Hfn9zM6oo7+hzE8TkryVlZUZJh1VFZR2YkUp43hp66aT8DJCMg8= Content-Type: multipart/alternative; boundary="_000_DM6PR11MB4089D8274D816949BAC5215DA1130DM6PR11MB4089namp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: a28011b2-3b92-401e-f982-08d6ede9f0c2 X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Jun 2019 21:23:54.0287 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: evoit@cisco.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR11MB3785 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.102.25, xch-rcd-015.cisco.com X-Outbound-Node: alln-core-3.cisco.com Archived-At: Subject: Re: [Rats] Vetting claim definitions X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Jun 2019 21:24:09 -0000 --_000_DM6PR11MB4089D8274D816949BAC5215DA1130DM6PR11MB4089namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgTGF1cmVuY2UsDQoNCkl0IGlzIHRydWUgdGhhdCB0aGUgWUFORyBvZiBkcmFmdC1iaXJraG9s ei1yYXRzLWJhc2ljLXlhbmctbW9kdWxlIGlzIGN1cnJlbnRseSBUUE0yIHNwZWNpZmljLiAgQnV0 IG92ZXIgdGhlIHBhc3QgbW9udGggd2UgaGF2ZSBiZWVuIGhhdmluZyBkaXNjdXNzaW9ucyBvbiBo b3cgdG8gYXVnbWVudCBpbnRvIHRoaXMgbW9kZWwgY2FzZSBzdGF0ZW1lbnRzIGFuZCBhIHRyZWUg c3RydWN0dXJlIHdoaWNoIGFsbG93cyBleHBvc3VyZSBvZiBpbmZvcm1hdGlvbiBmcm9tIGFsdGVy bmF0aXZlIGhhcmR3YXJlIHR5cGVzIHN1Y2ggYXMgdGhlIFRQTTEuMi4NCg0KUGVyIHlvdXIgbm90 ZSBiZWxvdywgSSBhbSBndWVzc2luZyB0aGF0IGRyYWZ0LWJpcmtob2x6LXJhdHMtYmFzaWMteWFu Zy1tb2R1bGUgY291bGQgcHJvdmlkZSBhIHF1ZXJ5L3Jlc3BvbnNlIGludGVyZmFjZSB0byBhY2Nl c3MgRUFUIGluZm9ybWF0aW9uLiAgVGhlIE5ldHdvcmsgRWxlbWVudCdzIFlBTkcgbW9kZWwgdGhl b3JldGljYWxseSBjb3VsZCBhbGxvdyBhY2Nlc3MgYmFzZWQgb24gd2hhdGV2ZXIgY2hvaWNlIG9m IHByb3RvY29scyB0aGUgTmV0d29yayBFbGVtZW50IHN1cHBvcnRzIChlLmcuLCBORVRDT05GL1hN TC4gUkVTVENPTkYvSlNPTiwgQ29NSS9DQk9SKS4gIEJ1dCB0aGUgY2hvaWNlIGFuZCBwcm90b2Nv bHMgb2YgdXNlZCB0byBhY2Nlc3MgRUFUIG9iamVjdHMgb3ZlciBhIFlBTkcgaW50ZXJmYWNlIGlz IHNvbWV0aGluZyBlYWNoIHBsYXRmb3JtIHdvdWxkIG5lZWQgdG8gZGVmaW5lLiAgIFRoZSBiYXNl bGluZSBjaG9pY2UgZm9yIEludGVyb3BlcmFiaWxpdHkgaGVyZSBpcyB0YmQuDQoNCldoZXRoZXIg aXQgaXMgZXZlbiBtZWFuaW5nZnVsL3JlbGV2YW50IHRvIHN1cHBvcnQgc3VjaCBZQU5HLUVBVCBp bnRlcm9wZXJhYmlsaXR5IGlzIHNvbWV0aGluZyBJIGRvbid0IGtub3cgeWV0LiAgRm9yIG1lIHRv IGNvbnNpZGVyIEVBVCBmb3IgaW1wbGVtZW50YXRpb24gd291bGQgbWVhbiBFQVQgaGFzIGJlZW4g YWRvcHRlZCB3aXRoaW4gcm91dGVycy9zd2l0Y2hlcy4gICBBcyB0aGlzIGlzIHBvc3NpYmxlLCBJ IGZlZWwgdGhlcmUgaXMgbGl0dGxlIGZvciB0aGUgV0cgdG8gbG9zZSBpZiB3ZSB0cnkgdG8gc2Vs ZWN0L2RlZmluZSBzb21lIGNvbW1vbiBvYmplY3RzIHdoaWNoIHNwYW4gb3VyIGRpZmZlcmVudCBk b21haW5zLg0KDQpQbGVhc2UgdW5kZXJzdGFuZCB0aGF0IGluIG5vIHdheSBkbyBJIGNsYWltIHRo YXQgWUFORyBpcyBwZXJmZWN0LiAgQW5kIFlBTkcgbW9kZWxzIGNhbiB0YWtlIHllYXJzIHRvIGNv bXBsZXRlLiAgIEJ1dCBvbiB0aGUgcGx1cyBzaWRlIGZvciBZQU5HLCBJIGFtIHN1cmUgaXQgaXMg cG9zc2libGUgdG8gY29uc3RydWN0IFlBTkcgbW9kZWxzIHNvIHRoYXQgbmV3IGhhcmR3YXJlIHR5 cGVzIGNhbiBiZSBpbnNlcnRlZC4gIElmIHlvdSB3YW50IGEgcHJldmlldyBvZiB0aGUgdHlwZXMg b2Ygc3RydWN0dXJlIHdoaWNoIG1pZ2h0IGJlIHVzZWQgZm9yIHRoaXMgdHlwZSBvZiBleHRlbnNp YmlsaXR5LCBjaGVjayBvdXQgYXQgaG93IGRyYWZ0LWlldGYtbmV0Y29uZi15YW5nLXB1c2ggYXVn bWVudHMgbmV3IGNhc2UgdHlwZXMgaW50byBhIHRoZSBZQU5HIG1vZGVsIGRlc2NyaWJlZCB3aXRo aW4gZHJhZnQtaWV0Zi1uZXRjb25mLXN1YnNjcmliZWQtbm90aWZpY2F0aW9ucy4NCg0KRXJpYw0K DQpGcm9tOiBMYXVyZW5jZSBMdW5kYmxhZGUsIEp1bmUgMTAsIDIwMTkgMjo1NyBQTQ0KDQpIaSBF cmljLA0KDQpTbyBJIHRoaW5rIHdlIGhhdmUgc29tZSBhZ3JlZW1lbnQgb24gZ2VuZXJhbCBwcmlu Y2lwbGVzIGZvciBob3cgdG8gc3RydWN0dXJlIHRoZSBkb2N1bWVudHMgdGhpcyB3b3JrIGdyb3Vw IHByb2R1Y2VzIHNvIHdlIGNhbiBoYXZlIGJvdGggZmxleGliaWxpdHkgaW4gdGhlIGRlZmluaXRp b24gb2YgbmV3IGNsYWltcyBhbmQgd2VsbC1kZWZpbmVkIGNvbmNpc2Ugc2V0cyBjbGFpbXMgZm9y IHBhcnRpY3VsYXIgdXNlIGNhc2VzLg0KDQpJbiBwYXJ0aWN1bGFyIEkgYXBwcmVjaWF0ZSB0aGUg Y29uZmlybWF0aW9uIG9mIHRoaXMgZnJvbSBNaWtlIEpvbmVzLiBIb3BlZnVsbHkgbGFjayBvZiBv YmplY3Rpb24gaW1wbGllcyBhIGxvdCBvZiBhZ3JlZW1lbnQuDQoNCg0KRXJpYywgSSB0aGluayB5 b3UgYXJlIG5vdyBkaWdnaW5nIGludG8gdGhlIG5leHQgbGV2ZWwgb2YgZGV0YWlsIG9uIGhvdyB0 byBkZWFsIHdpdGggVFBNLWJhc2VkIGltcGxlbWVudGF0aW9ucyBhbmQgY2xhaW1zIHNwZWNpZmll ZCBpbiBZQU5HIGFuZCBob3cgdGhhdCB3aWxsIGludGVyb3BlcmF0ZSB3aXRoIENXVC9DT1NFIGFu ZCBKV1QvSk9TRSBiYXNlZCB0b2tlbnMuDQoNCkkgZG9u4oCZdCByZWFsbHkgdW5kZXJzdGFuZCBZ QU5HIGFuZCBob3cgdG8gZnVsbHkgcmVhZCBkcmFmdC1iaXJraG9sei1yYXRzLWJhc2ljLXlhbmct bW9kdWxlIHlldC4gV29ya2luZyBvbiBpdCAoYnV0IEkgc2hvdWxkIGJlIHdvcmtpbmcgb24gdGhl IG5ldyBFQVQgZHJhZnTigKYpDQoNCmRyYWZ0LWJpcmtob2x6LXJhdHMtYmFzaWMteWFuZy1tb2R1 bGUgUkVRVUlSRVMgYSBUUE0gdG8gaW1wbGVtZW50IGl0LiBUaGF0IGltcGxpZXMgdG8gbWUgdGhh dCBuZWl0aGVyIENXVC9DT1NFIGFuZCBKV1QvSk9TRSBzaWduZWQgY29udGFpbmVyIGZvcm1hdHMg Y2FuIGJlIHVzZWQgYmVjYXVzZSBJIGRvbuKAmXQgdGhpbmsgVFBN4oCZcyBjYW4gcHJvZHVjZSBl aXRoZXIgZm9ybWF0LiBQcmV0dHkgc3VyZSB3ZSBhZ3JlZSB0aGF0IEVBVCB3aWxsIGFsd2F5cyBi ZSBDV1QvQ09TRSBvciBKV1QvSk9TRS4NCg0KKEl0IGlzIGFsc28gb2RkIHRvIG1lIHRoYXQgYW4g SUVURiBzdGFuZGFyZCB3b3VsZCByZXF1aXJlIHBhcnRpY3VsYXIgSFcuIEl0IHNob3VsZCBqdXN0 IGJlIGFib3V0IGJpdHMgb24gdGhlIHdpcmUuIEVBVCB3aWxsIGhhdmUgc29tZSBtZWFucyB0byBp bmRpY2F0ZSB0aGUgc2VjdXJpdHkgb2YgdGhlIEhXIGFuZCBTVyB0aGF0IHByb2R1Y2VkIGEgZ2l2 ZW4gdG9rZW4sIGJ1dCB3aWxsIG5vdCByZXF1aXJlIGFueSBwYXJ0aWN1bGFyIHNlY3VyaXR5IGZy b20gdGhlIEhXIG9yIFNXKQ0KDQpCdXQgbGV04oCZcyBhc3N1bWUgdGhhdCBhIHJlbHlpbmcgcGFy dHkgKEkgdGhpbmsgeW91IGNhbGwgdGhpcyB0aGUgTmV0d29yayBFbGVtZW50KSBjYW4gdW5wYWNr IGFuZCB2ZXJpZnkgc2lnbmF0dXJlIHRoYXQgaW4gdGhlIGZvcm1hdCBvZiBDV1QgYW5kIEpXVCBh bmQgdGhlIFRQTS1zdHlsZSBzaWcgdGhhdCBJIHRoaW5rIGlzIGltcGxpZWQgYnkgZHJhZnQtYmly a2hvbHotcmF0cy1iYXNpYy15YW5nLW1vZHVsZS4gVGhlIHJlc3VsdCB3aWxsIGJlIGEgc2V0IG9m IGNsYWltcyBpbiBzb21lIHN5bnRheC4gSXQgd2lsbCBiZSBDQk9SIG9yIEpTT04gaW4gdGhlIGNh c2Ugb2YgQ1dUIG9yIEpXVC4NCg0KV2hhdCB3aWxsIGl0IGJlIGZvciBkcmFmdC1iaXJraG9sei1y YXRzLWJhc2ljLXlhbmctbW9kdWxlPz8/IFlBTkctZGVzY3JpYmVkIHN0dWZmIGFuIGJlIGxvdHMg b2YgZGlmZmVyZW50IHN5bnRheGVzIGJ5IG15IHVuZGVyc3RhbmRpbmcuIEhvdyBtYW55IG9mIHRo ZW0gd2lsbCBhIHJlbHlpbmcgcGFydHkgYmUgZXhwZWN0ZWQgdG8gc3VwcG9ydCBzbyB0aGVyZSBp cyBpbnRlcm9wPw0KDQpJ4oCZbSBnb2luZyB0byBzdG9wIGhlcmUgZm9yIHRoZSBhbnN3ZXIgdG8g dGhhdCBxdWVzdGlvbi4NCg0KTEwNCg0KDQoNCg0KDQoNCg0KT24gSnVuIDcsIDIwMTksIGF0IDE6 MzEgUE0sIEVyaWMgVm9pdCAoZXZvaXQpIDxldm9pdEBjaXNjby5jb208bWFpbHRvOmV2b2l0QGNp c2NvLmNvbT4+IHdyb3RlOg0KDQpIaSBMYXVyZW5jZSwNCg0KRWZmZWN0aXZlbHkgdGhpcyDigJxS b3V0ZXIgQXR0ZXN0YXRpb24gUHJvZmlsZeKAnSBkcmFmdCB5b3UgYXJlIHByb3Bvc2luZyB3b3Vs ZCBjb25zaXN0IG9mIHdlbGwtZGVmaW5lZCBjbGFpbXMgd2hpY2ggYXJlIGFsc28gWUFORyBvYmpl Y3RzLiAgQW5kIHRoZXNlIFlBTkcgb2JqZWN0cyB3b3VsZCBhdWdtZW50IHRoZSBtb2RlbCBkZWZp bml0aW9uIHdpdGhpbiBkcmFmdC1iaXJraG9sei1yYXRzLWJhc2ljLXlhbmctbW9kdWxlLg0KDQpJ ZiB5b3UgYWdyZWUsIHRoaXMgaXMgZXhhY3RseSB3aGF0IEkgd2FzIGhvcGluZyB0byBoZWFyLiAg R29vZCB0aGluZ3Mgd2hpY2ggY2FuIGNvbWUgZnJvbSB0aGlzIGFwcHJvYWNoOg0KDQogICogICBO ZXR3b3JrIEVsZW1lbnRzIHdvdWxkIGJlIGNhcGFibGUgb2YgcmVhZGluZyBzb21lIHN1YnNldCBv ZiB3aGF0IGlzIGNvbWluZyBvZmYgb2YgRUFUIGNhcGFibGUgaGFyZHdhcmUgY2hpcHMuDQogICog ICBXaGVyZSBicmFuZCBuZXcgY2xhaW1zIGFyZSBiZWluZyBleHBsb3JlZCwgYSBzZWFyY2ggb2Yg ZXhpc3RpbmcgWUFORyBvYmplY3RzIGNvdWxkIGJlIGRvbmUuICBBZG9wdGlvbiBvbiBZQU5HIGRl ZmluaXRpb25zIHdoZXJlIHBvc3NpYmxlIHdvdWxkIG1pbmltaXplIGRvd25zdHJlYW0gbWFwcGlu Zy4NCg0KRXJpYw0KDQpGcm9tOiBMYXVyZW5jZSBMdW5kYmxhZGUsIEp1bmUgNywgMjAxOSAyOjUz IFBNDQpIaSBFcmljLA0KDQpGZWVscyBsaWtlIHRoZXJl4oCZcyBvcHBvc2luZyB2aWV3czoNCg0K MSkgQ2Fyc3RlbiwgS2F0aGxlZW4sIG15c2VsZiBhbmQgbWF5YmUgSGVuayBhbmQgb3RoZXJzIHdh bnQgYW4gRUFUIHRvIGJlIGEgQ1dUL0pXVC5UaGlzIHJlYWxseSBkb2VzIG1ha2UgdGhlIGNsYWlt IHNldCBvcGVuLWVuZGVkLiBDV1QgaXMgYSBiaXQgbW9yZSBjYXJlZnVsbHkgbWFuYWdlZCB0aGFu IEpXVCwgYnV0IHdl4oCZbGwgc3RpbGwgZW5kIHVwIHdpdGggYSBsb3Qgb2YgY2xhaW1zIHJlZ2lz dGVyZWQuDQoNCjIpIFlvdSB3YW50IGEgdmVyeSB3ZWxsLWRlZmluZWQgY29uY2lzZSBjbGFpbSBz ZXQsIGEgY29udHJvbGxlZCBwb2xpY3kgZm9yIGFsbG93aW5nIG5ldyBjbGFpbXMgYW5kIG1heGlt YWwgaW50ZXJvcGVyYWJpbGl0eS4NCg0KSSB0aGluayBib3RoIG9iamVjdGl2ZXMgYXJlIGdvb2Qg YW5kIGRlc2lyYWJsZS4NCg0KSSB0aGluayB0aGUgd2F5IHRvIGhhdmUgYm90aCBpcyB0byBsZWF2 ZSB0aGUgQ1dUL0pXVCByZWdpc3RyYXRpb24gb3BlbiBhcyB0aGV5IGFyZSBBTkQgQUxTTyBkZWZp bmUgYSBwcm9maWxlIC8gc3Vic2V0IGluIGFuIElFVEYgc3RhbmRhcmQgZm9yIHlvdXIgdXNlIGNh c2UuIFRoaXMgcHJvZmlsZSAvIHN1YnNldCBjYW46DQoNCi0gTWFrZSBjbGVhciBub3JtYXRpdmUg cmVmZXJlbmNlcyB0byBleHRhbnQgY2xhaW1zIHRoYXQgYXJlIGNvbnNpZGVyZWQgd2VsbC1lbm91 Z2ggZm9ybWVkIGFuZCBpbnRlcm9wZXJhYmxlDQotIERlZmluZSBzb21lIG5ldyBjbGFpbXMgd2hl cmUgbm9uZSBhcmUgZXh0YW50DQotIERlZmluZSBhIHBvbGljeSBmb3IgYWRkaW5nIG5ldyBjbGFp bXMNCi0gTGFiZWxsaW5nIHRvIGRpc3Rpbmd1aXNoIHRoZSBwcm9maWxlIGZyb20gYSBnZW5lcmFs IG9wZW4tZW5kZWQgQ1dUL0pXVA0KDQpTbyBvbmUgd2F5IGZvcndhcmQgaXMgZm9yIHRoaXMgV0cg dG8gYWRvcHQgYW5vdGhlciBkb2N1bWVudC4gTWF5YmUgY2FsbCBpdCDigJxSb3V0ZXIgQXR0ZXN0 YXRpb24gUHJvZmlsZeKAnS4gIFRoaXMgd291bGQgYmUgaW4gYWRkaXRpb24gdG8gRUFULiBJdCBt YWtlcyBub3JtYXRpdmUgcmVmZXJlbmNlcyB0byB0aGUgRUFUIGNsYWltcyBpdCBsaWtlcy4NCg0K QW5vdGhlciB3YXkgZm9yd2FyZCBpcyBmb3IgdGhlIEVBVCBkcmFmdCB0byBjaGFuZ2UgZGlyZWN0 aW9uIHNvbWUgYW5kIGJlY29tZSB0aGUgbW9yZSB0aWdodCBhbmQgbGltaXRlZCBhdHRlc3RhdGlv biBkZWZpbml0aW9uLiBJdCB3b3VsZCBwcm9iYWJseSBhZGRyZXNzIG1vcmUgdGhhbiBqdXN0IHRo ZSByb3V0ZXIgdXNlIGNhc2UsIGJ1dCBpdCB3b3VsZCByZXRhaW4gdGhlIG1haW4gY2hhcmFjdGVy aXN0aWNzIHlvdSB3YW50LiBJZiB3ZSBkbyB0aGlzLCB0aGVuIHdlIGNhbiBleHBlY3Qgb3RoZXIg YXR0ZXN0YXRpb24gdXNlIGNhc2VzIHRvIHdyaXRlIGRvY3VtZW50cyBhbmQgbWF5YmUgcnVuIHRo ZW0gdGhyb3VnaCB0aGlzIFdHIG9yIG1heWJlIG5vdC4NCg0KTEwNCg0KDQoNCk9uIEp1biA3LCAy MDE5LCBhdCAxMDoxNCBBTSwgRXJpYyBWb2l0IChldm9pdCkgPGV2b2l0QGNpc2NvLmNvbTxtYWls dG86ZXZvaXRAY2lzY28uY29tPj4gd3JvdGU6DQoNCkhpIEhhbm5lcywNCg0KSWYgd2Ugd2VyZSBz dXJlIHdlIGNvdWxkIGxpbWl0IEVBVCBjbGFpbXMgdG8ganVzdCBhIGZldyB0aGluZ3Mgd2hpY2gg Y29tZSBvdXQgb2YgaGFyZHdhcmUsIHRoaXMgd291bGRuJ3QgY29uY2VybiBtZSBhcyBtdWNoIGFz IGl0IGRvZXMuICBIb3dldmVyIHRoZSBkb21haW4gb2YgYXR0ZXN0YWJsZSBvYmplY3RzIHdhcyBs ZWZ0IGZhaXJseSBvcGVuIHdpdGhpbiB0aGUgRUFUIGRyYWZ0LiAgIEFuZCB3ZSBuZWVkIHRvIGRl dGVybWluZSB3aGF0IGxldmVsIG9mIGludGVyb3BlcmFiaWxpdHkgYXJlIHdlIHRyeWluZyB0byBz aGVwaGVyZCB2aWEgUkFUUy4NCg0KSW4gdGhlIGVuZCwgUkFUUyAoYW5kIEVBVCkgbmVlZCB0byBk ZXRlcm1pbmUgdGhlIGxldmVsIG9mIGludGVyb3BlcmFiaWxpdHkgZGVzaXJlZCBmb3Igc3BlY2lm aWMgY2xhaW1zLiAgIEkgZG9uJ3QgY2xhaW0gZGVlcCBmYW1pbGlhcml0eSB3aXRoIEpXVC4gIEJ1 dCBsb29raW5nIGF0IFJGQy03NTE5LCBTZWN0aW9uIDQuMSwgSSBzZWUgdGhhdCBJIHdvdWxkIGhh dmUgcXVlc3Rpb25zIGFzIGFuIGltcGxlbWVudGVyLiAgRm9yIGV4YW1wbGUsIHRoZSBjbGFpbXMg ImlzcyIsICJzdWIiLCBhbmQgImF1ZCIgbG9vayB0byBoYXZlIHBvcHVsYXRpb24vcHJvY2Vzc2lu ZyB3aGljaCBpcyBhcHBsaWNhdGlvbiBzcGVjaWZpYy4gIFRoZXJlZm9yZSB3aXRoIHRoZXNlIGNs YWltcywgaXQgaXMgdXAgdG8gYXBwbGljYXRpb25zIG9uIGVpdGhlciBzaWRlIG9mIHRoZSBKV1Qg bXVzdCBjb21lIHRvIGFuIGFncmVlbWVudCBvbiB3aGF0IHRoZSBwb3B1bGF0ZWQgaW5zdGFuY2Vz IG1lYW4uICAoSS5lLiwgbm90IHRoZSBXRy4pDQoNCkNvbW1vbiBvZiBvYmplY3QgZGVmaW5pdGlv bnMvY2xhaW1zIGZyb20gaW50ZXJuYWwgaGFyZHdhcmUgYXJlIGltcG9ydGFudCBpZiB0aGUgTmV0 d29yayBFbGVtZW50IG5lZWRzIHRvIGFjdCBvbiBzcGVjaWZpYyB2YWx1ZXMuICBBbmQgYXMgYSB2 ZW5kb3IsIEkga25vdyB0aGF0IEkgZG8gd2FudCB0byBhY3Qgb24gaW5mb3JtYXRpb24gY29taW5n IG91dCBvZiBoYXJkd2FyZSBldmVuIGlmIHRoZSBpbmZvcm1hdGlvbiBpcyBiZWluZyBwdXNoZWQg dG8gYSByZW1vdGUgdmFsaWRhdG9yIChlLmcuLCBpbW1lZGlhdGVseSBwdXNoIGFuIEVBVCB0b2tl biBkb3duc3RyZWFtIGlmIGEgc3BlY2lmaWMgaGFzaCB2YWx1ZSBjaGFuZ2VzKS4gIEFzIGEgcmVz dWx0IEkgd2FudCBtb3JlIGV4cGxpY2l0IGFuZCBzdGFibGUgY2xhaW0gZGVmaW5pdGlvbnMuDQoN Ck1vcmUgaGlnaGx5IHNwZWNpZmllZCBjbGFpbXMgb2YgY291cnNlIGV4cG9zZXMgcG9zc2libGUg Y2xhaW0gcmVkdW5kYW5jeSwgZm9yZWlnbiBrZXkgcmVsYXRpb25zaGlwcywgYW5kIGNyb3NzLW1h cHBpbmcgd2l0aCBkb3duc3RyZWFtIGluZm9ybWF0aW9uIG1vZGVscy4gSSBhc3NlcnQgdGhpcyBp cyBhIGdvb2QgdGhpbmcgYmVjYXVzZSB3ZSBleHBvc2UgKGFuZCBob3BlZnVsbHkgbWluaW1pemUp IGNvc3RzIHdoaWNoIGFyZSBib3JuZSBieSBkb3duc3RyZWFtIGRldmVsb3BlcnMuDQoNCkVyaWMN Cg0KSGFubmVzIFRzY2hvZmVuaWcsIEp1bmUgNywgMjAxOSA3OjI5IEFNDQpGV0lXOiBXaGlsZSB0 aGUgSldUIHJlZ2lzdHJ5IGxvb2tzIG1vcmUgbWl4ZWQgaW4gdGVybXMgb2YgY2xhaW0gdHlwZXMu IFRoaXMgaXMsIGhvd2V2ZXIsIG9ubHkgYSByZXN1bHQgb2YgdGhlIHdpZGVzcHJlYWQgYWRvcHRp b24uDQpUaGVyZSBhcmUgbm8gcHJvYmxlbXMsIGFzIGZhciBhcyBJIGtub3csIHdpdGggdGhlIGRp dmVyc2l0eSBvZiB0aGUgY2xhaW1zIGFuZCB0aGF0IHRoZXkgYXJlIG5vdCBhbGwgdXNlZnVsIGlu IGV2ZXJ5IGNvbnRleHQuIERpZmZlcmVudCBkZXBsb3ltZW50cyB1c2UgdGhlIGNsYWltcyB0aGV5 IGZpbmQgdXNlZnVsLg0KDQpJIGFtIHdvbmRlcmluZyB3aGV0aGVyIHdlIGFyZSB0cnlpbmcgdG8g Zml4IGEgcHJvYmxlbSB3aXRoIHRoZSByZWdpc3RyeSBvZiBjbGFpbXMgdGhhdCBkb2VzbuKAmXQg b2NjdXIgaW4gcHJhY3RpY2UuDQoNCkNpYW8NCkhhbm5lcw0KDQpGcm9tOiBSQVRTIDxyYXRzLWJv dW5jZXNAaWV0Zi5vcmc8bWFpbHRvOnJhdHMtYm91bmNlc0BpZXRmLm9yZz4+IE9uIEJlaGFsZiBP ZiBNaWtlIEpvbmVzDQpTZW50OiBNaXR0d29jaCwgNS4gSnVuaSAyMDE5IDE5OjMxDQpUbzogTGF1 cmVuY2UgTHVuZGJsYWRlIDxsZ2xAaXNsYW5kLXJlc29ydC5jb208bWFpbHRvOmxnbEBpc2xhbmQt cmVzb3J0LmNvbT4+OyBNaWNoYWVsIFJpY2hhcmRzb24gPG1jcitpZXRmQHNhbmRlbG1hbi5jYTxt YWlsdG86bWNyK2lldGZAc2FuZGVsbWFuLmNhPj4NCkNjOiByYXRzQGlldGYub3JnPG1haWx0bzpy YXRzQGlldGYub3JnPg0KU3ViamVjdDogUmU6IFtSYXRzXSBWZXR0aW5nIGNsYWltIGRlZmluaXRp b25zDQoNCkFjdHVhbGx5LCBub3JtYWwgKG5vbi1jb2xsaXNpb24tcmVzaXN0YW50KSBKV1QgY2xh aW1zICphcmUqIGFsbG9jYXRlZCBvbiBhIHNwZWNpZmljYXRpb24gcmVxdWlyZWQgYmFzaXMgd2l0 aCBleHBlcnQgcmV2aWV3LiAgU2VlIHRoaXMgdGV4dCBhdCBodHRwczovL3Rvb2xzLmlldGYub3Jn L2h0bWwvcmZjNzUxOSNzZWN0aW9uLTEwLjE6DQoNCiAgIFZhbHVlcyBhcmUgcmVnaXN0ZXJlZCBv biBhIFNwZWNpZmljYXRpb24gUmVxdWlyZWQgW1JGQzUyMjY8aHR0cHM6Ly90b29scy5pZXRmLm9y Zy9odG1sL3JmYzUyMjY+XSBiYXNpcw0KICAgYWZ0ZXIgYSB0aHJlZS13ZWVrIHJldmlldyBwZXJp b2Qgb24gdGhlIGp3dC1yZWctcmV2aWV3QGlldGYub3JnPG1haWx0bzpqd3QtcmVnLXJldmlld0Bp ZXRmLm9yZz4NCiAgIG1haWxpbmcgbGlzdCwgb24gdGhlIGFkdmljZSBvZiBvbmUgb3IgbW9yZSBE ZXNpZ25hdGVkIEV4cGVydHMuDQogICBIb3dldmVyLCB0byBhbGxvdyBmb3IgdGhlIGFsbG9jYXRp b24gb2YgdmFsdWVzIHByaW9yIHRvIHB1YmxpY2F0aW9uLA0KICAgdGhlIERlc2lnbmF0ZWQgRXhw ZXJ0cyBtYXkgYXBwcm92ZSByZWdpc3RyYXRpb24gb25jZSB0aGV5IGFyZQ0KICAgc2F0aXNmaWVk IHRoYXQgc3VjaCBhIHNwZWNpZmljYXRpb24gd2lsbCBiZSBwdWJsaXNoZWQuDQoNClNvIGEgc3Bl Y2lmaWNhdGlvbiBjYW4gZWFzaWx5IHJlZ2lzdGVyIGJvdGggSldUIGFuZCBDV1QgY2xhaW1zLg0K DQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg LS0gTWlrZQ0KDQpGcm9tOiBMYXVyZW5jZSBMdW5kYmxhZGUgPGxnbEBpc2xhbmQtcmVzb3J0LmNv bTxtYWlsdG86bGdsQGlzbGFuZC1yZXNvcnQuY29tPj4NClNlbnQ6IFdlZG5lc2RheSwgSnVuZSA1 LCAyMDE5IDg6NDYgQU0NClRvOiBNaWNoYWVsIFJpY2hhcmRzb24gPG1jcitpZXRmQHNhbmRlbG1h bi5jYTxtYWlsdG86bWNyK2lldGZAc2FuZGVsbWFuLmNhPj4NCkNjOiByYXRzQGlldGYub3JnPG1h aWx0bzpyYXRzQGlldGYub3JnPjsgTWlrZSBKb25lcyA8TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQu Y29tPG1haWx0bzpNaWNoYWVsLkpvbmVzQG1pY3Jvc29mdC5jb20+Pg0KU3ViamVjdDogUmU6IFtS YXRzXSBWZXR0aW5nIGNsYWltIGRlZmluaXRpb25zDQoNCkJlbG934oCmDQorIE1pa2UgSm9uZXMs IGNvLWF1dGhvciBvZiBDV1QNCg0KT24gSnVuIDUsIDIwMTksIGF0IDY6MDUgQU0sIE1pY2hhZWwg UmljaGFyZHNvbiA8bWNyK2lldGZAc2FuZGVsbWFuLmNhPG1haWx0bzptY3IraWV0ZkBzYW5kZWxt YW4uY2E+PiB3cm90ZToNCg0KDQpMYXVyZW5jZSBMdW5kYmxhZGUgPGxnbEBpc2xhbmQtcmVzb3J0 LmNvbTxtYWlsdG86bGdsQGlzbGFuZC1yZXNvcnQuY29tPj4gd3JvdGU6DQrigJQgVG9kYXkgQ1dU IGFsbG9jYXRlcyBtaWxsaW9ucyBvZiBzbG90cyBmb3IgZXhwZXJ0IHJldmlldy4gTm8NCnNwZWNp ZmljYXRpb24gaXMgcmVxdWlyZWQsIGJ1dCBzb21lIGluZm9ybWF0aW9uIHNob3VsZCBiZSBwcm92 aWRlZC4NCg0KSldUIGRvZXNu4oCZdCBzZWVtIHRvIGhhdmUgdGhpcywgd2hpY2ggaXMgbWF5YmUg d2h5IGl0IGlzIG1lc3NpZXIuIEl0DQpraW5kIG9mIHNlZW1zIGJhZCBhbmQgd3JvbmcgdGhhdCBp dCBkb2VzbuKAmXQgdG8gbWUuDQoNCkpXVCBkb2Vzbid0IGhhdmUgdGhpcyBiZWNhdXNlIHRoZSBj bGFpbXMgYXJlICJ1bmxpbWl0ZWQiIGxlbmd0aCBzdHJpbmdzLCBzbw0Kb25lIGNhbiBhbHdheXMg bWFrZSB1cCBhIHVuaXF1ZSBzdHJpbmcgaW4gbGlldSBvZiByZWdpc3RyYXRpb24uDQogb3JnLmlz bGFuZC1yZXNvcnQubGdsLndoYXRldmVyc3RyaW5neW91d2FudA0KDQppcyBwcm9iYWJseSBjb21w bGV0ZWx5IHlvdXJzIDotKQ0KT2YgY291cnNlLCBpZiB5b3Ugd2FudCB0byBpbnRlcm9wZXJhdGUg eW91IG5lZWQgdG8gYWdyZWUgYWJvdXQgaG93LCBzbyB0aGVyZQ0KYXJlIHNvbWUgYWR2YW50YWdl cyBvZiBhIGZvcmNpbmcgZnVuY3Rpb24gdGhhdCBkZW1hbmRzIHlvdSB3cml0ZSB0aGluZ3MgZG93 bg0KZmlyc3QgOi0pDQoNClVubGltaXRlZCBsZW5ndGggc3RyaW5nIGNsYWltIG5hbWVzIGFyZSBm dWxseSBwYXJ0IG9mIENXVC4gQWxzbywgQ09TRSBhbGxvd3MgdGhlbSBmb3IgaGVhZGVycywgYWxn b3JpdGhtIG5hbWVzIGFuZCBzdWNoIHRvby4gU28gZnJvbSBhIHN5bnRheCB2aWV3IENXVCBhbmQg Q09TRSBhcmUgdGhlIHNhbWUgYXMgSldUIGluIGFsbG93aW5nIGxvbmcgc3RyaW5nIG5hbWVzLg0K DQpIb3dldmVyLCBDT1NFIGFuZCBDV1QgYXJlIGRpZmZlcmVudCBpbiB0aGUgbWFuYWdlbWVudCBv ZiB0aGUgc3RyaW5nIG5hbWUgc3BhY2U6DQoNClN0cmluZ3Mgb2YgbGVuZ3RoIDEgICAgICAgICAg ICBTdGFuZGFyZHMgQWN0aW9uDQpTdHJpbmdzIG9mIGxlbmd0aCAyICAgICAgICAgICAgU3BlY2lm aWNhdGlvbiBSZXF1aXJlZA0KU3RyaW5ncyBvZiBsZW5ndGggZ3JlYXRlciB0aGFuIDIgICAgRXhw ZXJ0IFJldmlldw0KDQpUaGVzZSwgYWxvbmcgd2l0aCB0aGUgaW50ZWdlciBuYW1lcyBzcGFjZSBy dWxlcywgdGhlbiBpbXBseToNCg0KSW50ZWdlciB2YWx1ZXMgbGVzcyB0aGFuIC02NTUzNiBhcmUg dGhlIG9ubHkgb25lcyBmcmVlIGZvciB1c2Ugd2l0aCBubyByZXZpZXcgb3IgcHJvY2Vzc2luZyBi eSBJQU5BIGFuZCBleHBlcnRzLg0KDQpKV1QgYWxzbyBoYXMgdGhpcyBub3Rpb24gb2YgQ29sbGlz aW9uLVJlc2lzdGFudCBOYW1lIGJhc2VkIG9uIE9JRHMgb3IgVVVJRHMsIHdoaWNoIGlzIGVzc2Vu dGlhbGx5IHNvbWUgcnVsZXMgdG8gbWFrZSB1cCBuYW1lcyB0aGF0IGRvbuKAmXQgZ28gaW50byBh biBJQU5BIHJlZ2lzdHJ5IGFuZCBhcmUgc3RpbGwgdW5pcXVlIGFuZCB3b27igJl0IGNvbGxpZGUu DQoNCkpXVCBjb3VsZCBoYXZlIGRvbmUgd2hhdCBDV1QgZG9lcy4gU2VlbXMgdG8gbWUgdGhhdCBD V1QgaGFzIHRha2VuIGEgcmFkaWNhbGx5IG1vcmUgbWFuYWdlZCBhcHByb2FjaCB0byB0aGUgc3Vw ZXItb3BlbiBKV1QgYXBwcm9hY2guIE1heWJlIHRoZSBDV1QgZm9sa3MgcmVhbGl6ZWQgdGhlIEpX VCBkZXNpZ24gd2FzIHBvb3IuDQoNCg0KQXQgYW55IHJhdGUsIHRoZXJlIHNlZW1zIHRvIGJlIHNv bWUgY29uc2Vuc3VzIGhlcmUgdGhhdCB0aGUgQ1dUIGFwcHJvYWNoIGlzIHdoYXQgd2Ugd2FudCBm b3IgYXR0ZXN0YXRpb24uIEl0IGlzIGFsc28gdGhlIG1vcmUgcmVjZW50IGFuZCB0aHVzIG1heWJl IG1vcmUgYWR2YW5jZWQgdGhpbmtpbmcuDQoNCknigJltIGhvcGluZyB3ZSBjYW4gZmluZCBvdXIg d2F5IHRvIGp1c3QgYWNjZXB0IHRoZSBDV1QgY2xhaW0gbmFtaW5nIG1hbmFnZW1lbnQgc2NoZW1l IGFzIGlzIGZvciBhdHRlc3RhdGlvbi4gSWYgb3RoZXIgQ1dULWJhc2VkIGVmZm9ydHMgZGlkIHRo ZSBzYW1lIChkcmFmdC1iaXJraG9sei1jb3JlLWNvaWQpIGRpZCB0aGUgc2FtZSB0aGVuIHRoZSB3 b3JsZCB3b3VsZCBiZSBtdWNoIHNpbXBsZXIuDQoNCkhvd2V2ZXIgdGhhdCBzdGlsbCBsZWF2ZXMg b3BlbiBzb21lIGlzc3VlIHdpdGggSldUIG5hbWVzcGFjZSBtYW5hZ2VtZW50LiAoV2UgZG8gd2Fu dCBKU09OIGJhc2VkIGF0dGVzdGF0aW9uIHRvIGJlIEpXVOKAmXMsIHJpZ2h0PyBKdXN0IHRoZSBz YW1lIGFzIENCT1ItYmFzZWQgYXR0ZXN0YXRpb24gYXJlIENXVOKAmXMpLg0KDQpMTA0KDQpJTVBP UlRBTlQgTk9USUNFOiBUaGUgY29udGVudHMgb2YgdGhpcyBlbWFpbCBhbmQgYW55IGF0dGFjaG1l bnRzIGFyZSBjb25maWRlbnRpYWwgYW5kIG1heSBhbHNvIGJlIHByaXZpbGVnZWQuIElmIHlvdSBh cmUgbm90IHRoZSBpbnRlbmRlZCByZWNpcGllbnQsIHBsZWFzZSBub3RpZnkgdGhlIHNlbmRlciBp bW1lZGlhdGVseSBhbmQgZG8gbm90IGRpc2Nsb3NlIHRoZSBjb250ZW50cyB0byBhbnkgb3RoZXIg cGVyc29uLCB1c2UgaXQgZm9yIGFueSBwdXJwb3NlLCBvciBzdG9yZSBvciBjb3B5IHRoZSBpbmZv cm1hdGlvbiBpbiBhbnkgbWVkaXVtLiBUaGFuayB5b3UuDQoNCl9fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fDQpSQVRTIG1haWxpbmcgbGlzdA0KUkFUU0BpZXRm Lm9yZzxtYWlsdG86UkFUU0BpZXRmLm9yZz4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4v bGlzdGluZm8vcmF0cw0KDQo= --_000_DM6PR11MB4089D8274D816949BAC5215DA1130DM6PR11MB4089namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30NCkBmb250LWZhY2UN Cgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAz IDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAx NSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsN CglwYW5vc2UtMToyIDExIDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAq Lw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGlu Ow0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFt aWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7 bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVu ZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0 eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJs aW5lO30NCnAuTXNvTGlzdFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xp c3RQYXJhZ3JhcGgNCgl7bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1zby1tYXJnaW4tdG9wLWFs dDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87 DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNh bGlicmkiLHNhbnMtc2VyaWY7fQ0KcC5tc29ub3JtYWwwLCBsaS5tc29ub3JtYWwwLCBkaXYubXNv bm9ybWFsMA0KCXttc28tc3R5bGUtbmFtZTptc29ub3JtYWw7DQoJbXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsN CgltYXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2Fs aWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFuLmFwcGxlLWNvbnZlcnRlZC1zcGFjZQ0KCXttc28tc3R5 bGUtbmFtZTphcHBsZS1jb252ZXJ0ZWQtc3BhY2U7fQ0Kc3Bhbi5hcHBsZS10YWItc3Bhbg0KCXtt c28tc3R5bGUtbmFtZTphcHBsZS10YWItc3Bhbjt9DQpzcGFuLkVtYWlsU3R5bGUyMQ0KCXttc28t c3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1z ZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10 eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24x DQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9 DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi8qIExpc3QgRGVmaW5p dGlvbnMgKi8NCkBsaXN0IGwwDQoJe21zby1saXN0LWlkOjM3MjE5MzMwNzsNCgltc28tbGlzdC10 ZW1wbGF0ZS1pZHM6NjA4ODc0NDc4O30NCkBsaXN0IGwwOmxldmVsMQ0KCXttc28tbGV2ZWwtbnVt YmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWIt c3RvcDouNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVu dDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1i b2w7fQ0KQGxpc3QgbDA6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsN Cgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjEuMGluOw0KCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFu c2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2 ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrv grc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjEuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRp b246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBw dDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw0DQoJe21zby1sZXZlbC1u dW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRh Yi1zdG9wOjIuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWlu ZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpT eW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxl dDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjIuNWluOw0KCW1z by1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNv LWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6 bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4 dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjMuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEw LjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw3DQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVs LXRhYi1zdG9wOjMuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0 LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWls eTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw4DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1 bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjQuMGluOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJ bXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3Qg bDA6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwt dGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjQuNWluOw0KCW1zby1sZXZlbC1udW1iZXIt cG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXpl OjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDENCgl7bXNvLWxpc3QtaWQ6 MTM2MzI0MTI5MDsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6NTQ4NTgzNTkwO30NCkBsaXN0IGwx OmxldmVsMQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRl eHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDouNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEw LjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDE6bGV2ZWwyDQoJe21zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVs LXRhYi1zdG9wOjEuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0 LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWls eTpTeW1ib2w7fQ0KQGxpc3QgbDE6bGV2ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1 bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjEuNWluOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJ bXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3Qg bDE6bGV2ZWw0DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwt dGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjIuMGluOw0KCW1zby1sZXZlbC1udW1iZXIt cG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXpl OjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDE6bGV2ZWw1DQoJe21zby1s ZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxl dmVsLXRhYi1zdG9wOjIuNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0 ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZh bWlseTpTeW1ib2w7fQ0KQGxpc3QgbDE6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0 OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjMuMGlu Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47 DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxp c3QgbDE6bGV2ZWw3DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2 ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjMuNWluOw0KCW1zby1sZXZlbC1udW1i ZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1z aXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDE6bGV2ZWw4DQoJe21z by1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNv LWxldmVsLXRhYi1zdG9wOjQuMGluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsN Cgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250 LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDE6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9y bWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOjQu NWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1 aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0K b2wNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KdWwNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KLS0+ PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9 ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBt c28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0 PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0K PC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0K PGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhpIExhdXJl bmNlLDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JdCBpcyB0cnVlIHRoYXQgdGhlIFlBTkcgb2Yg ZHJhZnQtYmlya2hvbHotcmF0cy1iYXNpYy15YW5nLW1vZHVsZSBpcyBjdXJyZW50bHkgVFBNMiBz cGVjaWZpYy4mbmJzcDsgQnV0IG92ZXIgdGhlIHBhc3QgbW9udGggd2UgaGF2ZSBiZWVuIGhhdmlu ZyBkaXNjdXNzaW9ucyBvbiBob3cgdG8gYXVnbWVudCBpbnRvIHRoaXMgbW9kZWwgY2FzZSBzdGF0 ZW1lbnRzIGFuZCBhIHRyZWUgc3RydWN0dXJlIHdoaWNoIGFsbG93cyBleHBvc3VyZQ0KIG9mIGlu Zm9ybWF0aW9uIGZyb20gYWx0ZXJuYXRpdmUgaGFyZHdhcmUgdHlwZXMgc3VjaCBhcyB0aGUgVFBN MS4yLiZuYnNwOyA8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+UGVyIHlvdXIgbm90ZSBiZWxvdywg SSBhbSBndWVzc2luZyB0aGF0IGRyYWZ0LWJpcmtob2x6LXJhdHMtYmFzaWMteWFuZy1tb2R1bGUg Y291bGQgcHJvdmlkZSBhIHF1ZXJ5L3Jlc3BvbnNlIGludGVyZmFjZSB0byBhY2Nlc3MgRUFUIGlu Zm9ybWF0aW9uLiZuYnNwOyBUaGUgTmV0d29yayBFbGVtZW50J3MgWUFORyBtb2RlbCB0aGVvcmV0 aWNhbGx5IGNvdWxkIGFsbG93IGFjY2VzcyBiYXNlZCBvbiB3aGF0ZXZlciBjaG9pY2UNCiBvZiBw cm90b2NvbHMgdGhlIE5ldHdvcmsgRWxlbWVudCBzdXBwb3J0cyAoZS5nLiwgTkVUQ09ORi9YTUwu IFJFU1RDT05GL0pTT04sIENvTUkvQ0JPUikuICZuYnNwO0J1dCB0aGUgY2hvaWNlIGFuZCBwcm90 b2NvbHMgb2YgdXNlZCB0byBhY2Nlc3MgRUFUIG9iamVjdHMgb3ZlciBhIFlBTkcgaW50ZXJmYWNl IGlzIHNvbWV0aGluZyBlYWNoIHBsYXRmb3JtIHdvdWxkIG5lZWQgdG8gZGVmaW5lLiAmbmJzcDsm bmJzcDtUaGUgYmFzZWxpbmUgY2hvaWNlIGZvciBJbnRlcm9wZXJhYmlsaXR5DQogaGVyZSBpcyB0 YmQuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPldoZXRoZXIgaXQgaXMgZXZlbiBtZWFuaW5nZnVs L3JlbGV2YW50IHRvIHN1cHBvcnQgc3VjaCBZQU5HLUVBVCBpbnRlcm9wZXJhYmlsaXR5IGlzIHNv bWV0aGluZyBJIGRvbid0IGtub3cgeWV0LiZuYnNwOyBGb3IgbWUgdG8gY29uc2lkZXIgRUFUIGZv ciBpbXBsZW1lbnRhdGlvbiB3b3VsZCBtZWFuIEVBVCBoYXMgYmVlbiBhZG9wdGVkIHdpdGhpbiBy b3V0ZXJzL3N3aXRjaGVzLiAmbmJzcDsmbmJzcDtBcyB0aGlzIGlzIHBvc3NpYmxlLCBJDQogZmVl bCB0aGVyZSBpcyBsaXR0bGUgZm9yIHRoZSBXRyB0byBsb3NlIGlmIHdlIHRyeSB0byBzZWxlY3Qv ZGVmaW5lIHNvbWUgY29tbW9uIG9iamVjdHMgd2hpY2ggc3BhbiBvdXIgZGlmZmVyZW50IGRvbWFp bnMuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlBsZWFzZSB1bmRlcnN0YW5kIHRoYXQgaW4gbm8g d2F5IGRvIEkgY2xhaW0gdGhhdCBZQU5HIGlzIHBlcmZlY3QuICZuYnNwO0FuZCBZQU5HIG1vZGVs cyBjYW4gdGFrZSB5ZWFycyB0byBjb21wbGV0ZS4mbmJzcDsmbmJzcDsgQnV0IG9uIHRoZSBwbHVz IHNpZGUgZm9yIFlBTkcsIEkgYW0gc3VyZSBpdCBpcyBwb3NzaWJsZSB0byBjb25zdHJ1Y3QgWUFO RyBtb2RlbHMgc28gdGhhdCBuZXcgaGFyZHdhcmUgdHlwZXMgY2FuIGJlIGluc2VydGVkLiZuYnNw Ow0KIElmIHlvdSB3YW50IGEgcHJldmlldyBvZiB0aGUgdHlwZXMgb2Ygc3RydWN0dXJlIHdoaWNo IG1pZ2h0IGJlIHVzZWQgZm9yIHRoaXMgdHlwZSBvZiBleHRlbnNpYmlsaXR5LCBjaGVjayBvdXQg YXQgaG93IGRyYWZ0LWlldGYtbmV0Y29uZi15YW5nLXB1c2ggYXVnbWVudHMgbmV3IGNhc2UgdHlw ZXMgaW50byBhIHRoZSBZQU5HIG1vZGVsIGRlc2NyaWJlZCB3aXRoaW4gZHJhZnQtaWV0Zi1uZXRj b25mLXN1YnNjcmliZWQtbm90aWZpY2F0aW9ucy48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+RXJp YzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCBibHVlIDEuNXB0 O3BhZGRpbmc6MGluIDBpbiAwaW4gNC4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+RnJv bTo8L2I+IExhdXJlbmNlIEx1bmRibGFkZSwgSnVuZSAxMCwgMjAxOSAyOjU3IFBNPGJyPg0KPGJy Pg0KPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SGkgRXJpYyw8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U28g SSB0aGluayB3ZSBoYXZlIHNvbWUgYWdyZWVtZW50IG9uIGdlbmVyYWwgcHJpbmNpcGxlcyBmb3Ig aG93IHRvIHN0cnVjdHVyZSB0aGUgZG9jdW1lbnRzIHRoaXMgd29yayBncm91cCBwcm9kdWNlcyBz byB3ZSBjYW4gaGF2ZSBib3RoIGZsZXhpYmlsaXR5IGluIHRoZSBkZWZpbml0aW9uIG9mIG5ldyBj bGFpbXMNCjxpPmFuZDwvaT4mbmJzcDt3ZWxsLWRlZmluZWQgY29uY2lzZSBzZXRzIGNsYWltcyBm b3IgcGFydGljdWxhciB1c2UgY2FzZXMuJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkluIHBhcnRpY3VsYXIgSSBhcHByZWNpYXRlIHRo ZSBjb25maXJtYXRpb24gb2YgdGhpcyBmcm9tIE1pa2UgSm9uZXMuIEhvcGVmdWxseSBsYWNrIG9m IG9iamVjdGlvbiBpbXBsaWVzIGEgbG90IG9mIGFncmVlbWVudC4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5FcmljLCBJIHRoaW5r IHlvdSBhcmUgbm93IGRpZ2dpbmcgaW50byB0aGUgbmV4dCBsZXZlbCBvZiBkZXRhaWwgb24gaG93 IHRvIGRlYWwgd2l0aCBUUE0tYmFzZWQgaW1wbGVtZW50YXRpb25zIGFuZCBjbGFpbXMgc3BlY2lm aWVkIGluIFlBTkcgYW5kIGhvdyB0aGF0IHdpbGwgaW50ZXJvcGVyYXRlIHdpdGggQ1dUL0NPU0Ug YW5kIEpXVC9KT1NFIGJhc2VkIHRva2Vucy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSBkb27igJl0IHJlYWxseSB1bmRlcnN0YW5kIFlBTkcg YW5kIGhvdyB0byBmdWxseSByZWFkIGRyYWZ0LWJpcmtob2x6LXJhdHMtYmFzaWMteWFuZy1tb2R1 bGUgeWV0LiBXb3JraW5nIG9uIGl0IChidXQgSSBzaG91bGQgYmUgd29ya2luZyBvbiB0aGUgbmV3 IEVBVCBkcmFmdOKApik8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPmRyYWZ0LWJpcmtob2x6LXJhdHMtYmFzaWMteWFuZy1tb2R1bGUg UkVRVUlSRVMgYSBUUE0gdG8gaW1wbGVtZW50IGl0LiBUaGF0IGltcGxpZXMgdG8gbWUgdGhhdCBu ZWl0aGVyIENXVC9DT1NFIGFuZCBKV1QvSk9TRSBzaWduZWQgY29udGFpbmVyIGZvcm1hdHMgY2Fu IGJlIHVzZWQgYmVjYXVzZSBJIGRvbuKAmXQgdGhpbmsgVFBN4oCZcyBjYW4gcHJvZHVjZSBlaXRo ZXIgZm9ybWF0LiBQcmV0dHkgc3VyZSB3ZSBhZ3JlZQ0KIHRoYXQgRUFUIHdpbGwgYWx3YXlzIGJl IENXVC9DT1NFIG9yIEpXVC9KT1NFLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPihJdCBpcyBhbHNvIG9kZCB0byBtZSB0 aGF0IGFuIElFVEYgc3RhbmRhcmQgd291bGQgcmVxdWlyZSBwYXJ0aWN1bGFyIEhXLiBJdCBzaG91 bGQganVzdCBiZSBhYm91dCBiaXRzIG9uIHRoZSB3aXJlLiBFQVQgd2lsbCBoYXZlIHNvbWUgbWVh bnMgdG8gaW5kaWNhdGUgdGhlIHNlY3VyaXR5IG9mIHRoZSBIVyBhbmQgU1cgdGhhdCBwcm9kdWNl ZCBhIGdpdmVuIHRva2VuLCBidXQgd2lsbCBub3QgcmVxdWlyZSBhbnkNCiBwYXJ0aWN1bGFyIHNl Y3VyaXR5IGZyb20gdGhlIEhXIG9yIFNXKTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5CdXQgbGV04oCZcyBhc3N1bWUgdGhhdCBhIHJlbHlpbmcg cGFydHkgKEkgdGhpbmsgeW91IGNhbGwgdGhpcyB0aGUgTmV0d29yayBFbGVtZW50KSBjYW4gdW5w YWNrIGFuZCB2ZXJpZnkgc2lnbmF0dXJlIHRoYXQgaW4gdGhlIGZvcm1hdCBvZiBDV1QgYW5kIEpX VCBhbmQgdGhlIFRQTS1zdHlsZSBzaWcgdGhhdCBJIHRoaW5rIGlzIGltcGxpZWQgYnkgZHJhZnQt Ymlya2hvbHotcmF0cy1iYXNpYy15YW5nLW1vZHVsZS4NCiBUaGUgcmVzdWx0IHdpbGwgYmUgYSBz ZXQgb2YgY2xhaW1zIGluIHNvbWUgc3ludGF4LiBJdCB3aWxsIGJlIENCT1Igb3IgSlNPTiBpbiB0 aGUgY2FzZSBvZiBDV1Qgb3IgSldULiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5XaGF0IHdpbGwgaXQgYmUgZm9yIGRyYWZ0LWJpcmto b2x6LXJhdHMtYmFzaWMteWFuZy1tb2R1bGU/Pz8gWUFORy1kZXNjcmliZWQgc3R1ZmYgYW4gYmUg bG90cyBvZiBkaWZmZXJlbnQgc3ludGF4ZXMgYnkgbXkgdW5kZXJzdGFuZGluZy4gSG93IG1hbnkg b2YgdGhlbSB3aWxsIGEgcmVseWluZyBwYXJ0eSBiZSBleHBlY3RlZCB0byBzdXBwb3J0IHNvIHRo ZXJlIGlzIGludGVyb3A/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPknigJltIGdvaW5nIHRvIHN0b3AgaGVyZSBmb3IgdGhlIGFuc3dlciB0byB0 aGF0IHF1ZXN0aW9uLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5MTDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxicj4NCjxicj4NCjxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdp bi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+T24gSnVuIDcsIDIwMTksIGF0IDE6MzEgUE0sIEVyaWMgVm9pdCAoZXZvaXQpICZsdDs8 YSBocmVmPSJtYWlsdG86ZXZvaXRAY2lzY28uY29tIj5ldm9pdEBjaXNjby5jb208L2E+Jmd0OyB3 cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhpIExh dXJlbmNlLDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5FZmZlY3RpdmVseSB0aGlzIOKAnFJvdXRlciBBdHRlc3RhdGlvbiBQcm9maWxl4oCdIGRy YWZ0IHlvdSBhcmUgcHJvcG9zaW5nIHdvdWxkIGNvbnNpc3Qgb2Ygd2VsbC1kZWZpbmVkIGNsYWlt cyB3aGljaCBhcmUgYWxzbyBZQU5HIG9iamVjdHMuJm5ic3A7IEFuZCB0aGVzZSBZQU5HIG9iamVj dHMgd291bGQgYXVnbWVudCB0aGUgbW9kZWwgZGVmaW5pdGlvbiB3aXRoaW4gZHJhZnQtYmlya2hv bHotcmF0cy1iYXNpYy15YW5nLW1vZHVsZS4mbmJzcDsmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SWYgeW91IGFncmVlLCB0aGlzIGlz IGV4YWN0bHkgd2hhdCBJIHdhcyBob3BpbmcgdG8gaGVhci4mbmJzcDsgR29vZCB0aGluZ3Mgd2hp Y2ggY2FuIGNvbWUgZnJvbSB0aGlzIGFwcHJvYWNoOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 dWwgc3R5bGU9Im1hcmdpbi10b3A6MGluIiB0eXBlPSJkaXNjIj4NCjxsaSBjbGFzcz0iTXNvTGlz dFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi10b3A6MGluO21hcmdpbi1ib3R0b206MGluO21hcmdp bi1ib3R0b206LjAwMDFwdDttc28tbGlzdDpsMCBsZXZlbDEgbGZvMyI+DQpOZXR3b3JrIEVsZW1l bnRzIHdvdWxkIGJlIGNhcGFibGUgb2YgcmVhZGluZyBzb21lIHN1YnNldCBvZiB3aGF0IGlzIGNv bWluZyBvZmYgb2YgRUFUIGNhcGFibGUgaGFyZHdhcmUgY2hpcHMuPG86cD48L286cD48L2xpPjxs aSBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi10b3A6MGluO21hcmdpbi1i b3R0b206MGluO21hcmdpbi1ib3R0b206LjAwMDFwdDttc28tbGlzdDpsMCBsZXZlbDEgbGZvMyI+ DQpXaGVyZSBicmFuZCBuZXcgY2xhaW1zIGFyZSBiZWluZyBleHBsb3JlZCwgYSBzZWFyY2ggb2Yg ZXhpc3RpbmcgWUFORyBvYmplY3RzIGNvdWxkIGJlIGRvbmUuJm5ic3A7IEFkb3B0aW9uIG9uIFlB TkcgZGVmaW5pdGlvbnMgd2hlcmUgcG9zc2libGUgd291bGQgbWluaW1pemUgZG93bnN0cmVhbSBt YXBwaW5nLjxvOnA+PC9vOnA+PC9saT48L3VsPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+RXJpYzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25l O2JvcmRlci1sZWZ0OnNvbGlkIGJsdWUgMS41cHQ7cGFkZGluZzowaW4gMGluIDBpbiA0LjBwdCI+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0 Ij48Yj5Gcm9tOjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8 L3NwYW4+TGF1cmVuY2UgTHVuZGJsYWRlLCBKdW5lIDcsIDIwMTkgMjo1MyBQTTxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SGkgRXJpYyw8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPkZlZWxzIGxpa2UgdGhlcmXigJlzIG9wcG9zaW5nIHZpZXdzOjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5 bGU9Im1hcmdpbi1sZWZ0OjMwLjBwdDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47 bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjEpIENhcnN0ZW4sIEthdGhsZWVuLCBteXNlbGYgYW5kIG1heWJlIEhlbmsgYW5kIG90aGVycyB3 YW50IGFuIEVBVCB0byBiZSBhIENXVC9KV1QuVGhpcyByZWFsbHkgZG9lcyBtYWtlIHRoZSBjbGFp bSBzZXQgb3Blbi1lbmRlZC4gQ1dUIGlzIGEgYml0IG1vcmUgY2FyZWZ1bGx5IG1hbmFnZWQgdGhh biBKV1QsIGJ1dCB3ZeKAmWxsIHN0aWxsIGVuZCB1cCB3aXRoIGEgbG90IG9mIGNsYWltcyByZWdp c3RlcmVkLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4yKSBZb3Ugd2FudCBhIHZl cnkgd2VsbC1kZWZpbmVkIGNvbmNpc2UgY2xhaW0gc2V0LCBhIGNvbnRyb2xsZWQgcG9saWN5IGZv ciBhbGxvd2luZyBuZXcgY2xhaW1zIGFuZCBtYXhpbWFsIGludGVyb3BlcmFiaWxpdHkuPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgdGhpbmsgYm90aCBvYmplY3Rp dmVzIGFyZSBnb29kIGFuZCBkZXNpcmFibGUuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkg dGhpbmsgdGhlIHdheSB0byBoYXZlIGJvdGggaXMgdG8gbGVhdmUgdGhlIENXVC9KV1QgcmVnaXN0 cmF0aW9uIG9wZW4gYXMgdGhleSBhcmUgQU5EIEFMU08gZGVmaW5lIGEgcHJvZmlsZSAvIHN1YnNl dCBpbiBhbiBJRVRGIHN0YW5kYXJkIGZvciB5b3VyIHVzZSBjYXNlLiBUaGlzIHByb2ZpbGUgLyBz dWJzZXQgY2FuOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi1sZWZ0OjMwLjBwdDttYXJnaW4tdG9wOjUuMHB0 O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPi0gTWFrZSBjbGVhciBub3JtYXRpdmUgcmVmZXJlbmNlcyB0byBl eHRhbnQgY2xhaW1zIHRoYXQgYXJlIGNvbnNpZGVyZWQgd2VsbC1lbm91Z2ggZm9ybWVkIGFuZCBp bnRlcm9wZXJhYmxlPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4tIERlZmluZSBzb21lIG5ldyBjbGFpbXMgd2hlcmUgbm9u ZSBhcmUgZXh0YW50PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4tIERlZmluZSBhIHBvbGljeSBmb3IgYWRkaW5nIG5ldyBj bGFpbXMmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPi0gTGFiZWxsaW5nIHRvIGRpc3Rpbmd1aXNoIHRoZSBwcm9m aWxlIGZyb20gYSBnZW5lcmFsIG9wZW4tZW5kZWQgQ1dUL0pXVDxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPlNvIG9uZSB3YXkgZm9yd2FyZCBpcyBmb3IgdGhpcyBXRyB0byBhZG9w dCBhbm90aGVyIGRvY3VtZW50LiBNYXliZSBjYWxsIGl0IOKAnFJvdXRlciBBdHRlc3RhdGlvbiBQ cm9maWxl4oCdLiAmbmJzcDtUaGlzIHdvdWxkIGJlIGluIGFkZGl0aW9uIHRvIEVBVC4gSXQgbWFr ZXMgbm9ybWF0aXZlIHJlZmVyZW5jZXMgdG8gdGhlIEVBVCBjbGFpbXMgaXQgbGlrZXMuPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5i c3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5Bbm90aGVyIHdheSBmb3J3YXJkIGlzIGZvciB0aGUgRUFUIGRyYWZ0IHRv IGNoYW5nZSBkaXJlY3Rpb24gc29tZSBhbmQgYmVjb21lIHRoZSBtb3JlIHRpZ2h0IGFuZCBsaW1p dGVkIGF0dGVzdGF0aW9uIGRlZmluaXRpb24uIEl0IHdvdWxkIHByb2JhYmx5IGFkZHJlc3MgbW9y ZSB0aGFuIGp1c3QgdGhlIHJvdXRlciB1c2UgY2FzZSwgYnV0IGl0IHdvdWxkIHJldGFpbiB0aGUg bWFpbiBjaGFyYWN0ZXJpc3RpY3MgeW91DQogd2FudC4gSWYgd2UgZG8gdGhpcywgdGhlbiB3ZSBj YW4gZXhwZWN0IG90aGVyIGF0dGVzdGF0aW9uIHVzZSBjYXNlcyB0byB3cml0ZSBkb2N1bWVudHMg YW5kIG1heWJlIHJ1biB0aGVtIHRocm91Z2ggdGhpcyBXRyBvciBtYXliZSBub3QuPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij5MTDxvOnA+PC9vOnA+PC9w Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGJyPg0KPGJyPg0K PGJyPg0KPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4t dG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5PbiBKdW4gNywgMjAxOSwgYXQgMTA6MTQgQU0sIEVyaWMgVm9pdCAoZXZvaXQp ICZsdDs8YSBocmVmPSJtYWlsdG86ZXZvaXRAY2lzY28uY29tIj48c3BhbiBzdHlsZT0iY29sb3I6 cHVycGxlIj5ldm9pdEBjaXNjby5jb208L3NwYW4+PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5IaSBIYW5uZXMsPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPklmIHdlIHdlcmUg c3VyZSB3ZSBjb3VsZCBsaW1pdCBFQVQgY2xhaW1zIHRvIGp1c3QgYSBmZXcgdGhpbmdzIHdoaWNo IGNvbWUgb3V0IG9mIGhhcmR3YXJlLCB0aGlzIHdvdWxkbid0IGNvbmNlcm4gbWUgYXMgbXVjaCBh cyBpdCBkb2VzLiZuYnNwOyBIb3dldmVyIHRoZSBkb21haW4gb2YgYXR0ZXN0YWJsZSBvYmplY3Rz IHdhcyBsZWZ0IGZhaXJseSBvcGVuIHdpdGhpbiB0aGUgRUFUIGRyYWZ0LiZuYnNwOyAmbmJzcDtB bmQgd2UgbmVlZCB0bw0KIGRldGVybWluZSB3aGF0IGxldmVsIG9mIGludGVyb3BlcmFiaWxpdHkg YXJlIHdlIHRyeWluZyB0byBzaGVwaGVyZCB2aWEgUkFUUy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+SW4gdGhlIGVuZCwgUkFUUyAoYW5kIEVBVCkgbmVlZCB0byBkZXRlcm1pbmUgdGhlIGxl dmVsIG9mIGludGVyb3BlcmFiaWxpdHkgZGVzaXJlZCBmb3Igc3BlY2lmaWMgY2xhaW1zLiZuYnNw OyZuYnNwOyBJIGRvbid0IGNsYWltIGRlZXAgZmFtaWxpYXJpdHkgd2l0aCBKV1QuJm5ic3A7IEJ1 dCBsb29raW5nIGF0IFJGQy03NTE5LCBTZWN0aW9uIDQuMSwgSSBzZWUgdGhhdCBJIHdvdWxkIGhh dmUgcXVlc3Rpb25zIGFzIGFuIGltcGxlbWVudGVyLiZuYnNwOw0KIEZvciBleGFtcGxlLCB0aGUg Y2xhaW1zICZxdW90O2lzcyZxdW90OywgJnF1b3Q7c3ViJnF1b3Q7LCBhbmQgJnF1b3Q7YXVkJnF1 b3Q7IGxvb2sgdG8gaGF2ZSBwb3B1bGF0aW9uL3Byb2Nlc3Npbmcgd2hpY2ggaXMgYXBwbGljYXRp b24gc3BlY2lmaWMuJm5ic3A7IFRoZXJlZm9yZSB3aXRoIHRoZXNlIGNsYWltcywgaXQgaXMgdXAg dG8gYXBwbGljYXRpb25zIG9uIGVpdGhlciBzaWRlIG9mIHRoZSBKV1QgbXVzdCBjb21lIHRvIGFu IGFncmVlbWVudCBvbiB3aGF0IHRoZSBwb3B1bGF0ZWQgaW5zdGFuY2VzIG1lYW4uJm5ic3A7DQog KEkuZS4sIG5vdCB0aGUgV0cuKSZuYnNwOyZuYnNwOzxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0 ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Q29tbW9u IG9mIG9iamVjdCBkZWZpbml0aW9ucy9jbGFpbXMgZnJvbSBpbnRlcm5hbCBoYXJkd2FyZSBhcmUg aW1wb3J0YW50IGlmIHRoZSBOZXR3b3JrIEVsZW1lbnQgbmVlZHMgdG8gYWN0IG9uIHNwZWNpZmlj IHZhbHVlcy4mbmJzcDsgQW5kIGFzIGEgdmVuZG9yLCBJIGtub3cgdGhhdCBJIGRvIHdhbnQgdG8g YWN0IG9uIGluZm9ybWF0aW9uIGNvbWluZyBvdXQgb2YgaGFyZHdhcmUgZXZlbiBpZiB0aGUgaW5m b3JtYXRpb24NCiBpcyBiZWluZyBwdXNoZWQgdG8gYSByZW1vdGUgdmFsaWRhdG9yIChlLmcuLCBp bW1lZGlhdGVseSBwdXNoIGFuIEVBVCB0b2tlbiBkb3duc3RyZWFtIGlmIGEgc3BlY2lmaWMgaGFz aCB2YWx1ZSBjaGFuZ2VzKS4mbmJzcDsgQXMgYSByZXN1bHQgSSB3YW50IG1vcmUgZXhwbGljaXQg YW5kIHN0YWJsZSBjbGFpbSBkZWZpbml0aW9ucy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ TW9yZSBoaWdobHkgc3BlY2lmaWVkIGNsYWltcyBvZiBjb3Vyc2UgZXhwb3NlcyBwb3NzaWJsZSBj bGFpbSByZWR1bmRhbmN5LCBmb3JlaWduIGtleSByZWxhdGlvbnNoaXBzLCBhbmQgY3Jvc3MtbWFw cGluZyB3aXRoIGRvd25zdHJlYW0gaW5mb3JtYXRpb24gbW9kZWxzLiBJIGFzc2VydCB0aGlzIGlz IGEgZ29vZCB0aGluZyBiZWNhdXNlIHdlIGV4cG9zZSAoYW5kIGhvcGVmdWxseSBtaW5pbWl6ZSkg Y29zdHMgd2hpY2gNCiBhcmUgYm9ybmUgYnkgZG93bnN0cmVhbSBkZXZlbG9wZXJzLiZuYnNwOzxz cGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+RXJpYzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQg Ymx1ZSAxLjVwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDQuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWJvdHRvbToxMi4wcHQiPkhhbm5lcyBUc2Nob2Zlbmln LCBKdW5lIDcsIDIwMTkgNzoyOSBBTTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj5GV0lXOiBXaGlsZSB0 aGUgSldUIHJlZ2lzdHJ5IGxvb2tzIG1vcmUgbWl4ZWQgaW4gdGVybXMgb2YgY2xhaW0gdHlwZXMu IFRoaXMgaXMsIGhvd2V2ZXIsIG9ubHkgYSByZXN1bHQgb2YgdGhlIHdpZGVzcHJlYWQgYWRvcHRp b24uPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPlRoZXJlIGFyZSBubyBwcm9i bGVtcywgYXMgZmFyIGFzIEkga25vdywgd2l0aCB0aGUgZGl2ZXJzaXR5IG9mIHRoZSBjbGFpbXMg YW5kIHRoYXQgdGhleSBhcmUgbm90IGFsbCB1c2VmdWwgaW4gZXZlcnkgY29udGV4dC4gRGlmZmVy ZW50IGRlcGxveW1lbnRzIHVzZSB0aGUgY2xhaW1zIHRoZXkgZmluZCB1c2VmdWwuPC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IGxhbmc9IkVOLUdCIj5JIGFtIHdvbmRlcmluZyB3aGV0aGVyIHdlIGFyZSB0cnlpbmcgdG8gZml4 IGEgcHJvYmxlbSB3aXRoIHRoZSByZWdpc3RyeSBvZiBjbGFpbXMgdGhhdCBkb2VzbuKAmXQgb2Nj dXIgaW4gcHJhY3RpY2UuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPiZuYnNw Ozwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLUdCIj5DaWFvPC9zcGFuPjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gbGFuZz0iRU4tR0IiPkhhbm5lczwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9 IkVOLUdCIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBw dDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PGI+RnJvbTo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+ Jm5ic3A7PC9zcGFuPlJBVFMgJmx0OzxhIGhyZWY9Im1haWx0bzpyYXRzLWJvdW5jZXNAaWV0Zi5v cmciPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPnJhdHMtYm91bmNlc0BpZXRmLm9yZzwvc3Bh bj48L2E+Jmd0OzxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bh bj48Yj5PbiBCZWhhbGYgT2Y8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJz cDs8L3NwYW4+PC9iPk1pa2UNCiBKb25lczxicj4NCjxiPlNlbnQ6PC9iPjxzcGFuIGNsYXNzPSJh cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5NaXR0d29jaCwgNS4gSnVuaSAyMDE5 IDE5OjMxPGJyPg0KPGI+VG86PC9iPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2Ui PiZuYnNwOzwvc3Bhbj5MYXVyZW5jZSBMdW5kYmxhZGUgJmx0OzxhIGhyZWY9Im1haWx0bzpsZ2xA aXNsYW5kLXJlc29ydC5jb20iPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPmxnbEBpc2xhbmQt cmVzb3J0LmNvbTwvc3Bhbj48L2E+Jmd0OzsgTWljaGFlbCBSaWNoYXJkc29uICZsdDs8YSBocmVm PSJtYWlsdG86bWNyJiM0MztpZXRmQHNhbmRlbG1hbi5jYSI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1 cnBsZSI+bWNyJiM0MztpZXRmQHNhbmRlbG1hbi5jYTwvc3Bhbj48L2E+Jmd0Ozxicj4NCjxiPkNj OjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGEg aHJlZj0ibWFpbHRvOnJhdHNAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUiPnJh dHNAaWV0Zi5vcmc8L3NwYW4+PC9hPjxicj4NCjxiPlN1YmplY3Q6PC9iPjxzcGFuIGNsYXNzPSJh cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5SZTogW1JhdHNdIFZldHRpbmcgY2xh aW0gZGVmaW5pdGlvbnM8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1H QiI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPkFj dHVhbGx5LCBub3JtYWwgKG5vbi1jb2xsaXNpb24tcmVzaXN0YW50KSBKV1QgY2xhaW1zICo8Yj5h cmU8L2I+KiBhbGxvY2F0ZWQgb24gYSBzcGVjaWZpY2F0aW9uIHJlcXVpcmVkIGJhc2lzIHdpdGgg ZXhwZXJ0IHJldmlldy4mbmJzcDsgU2VlIHRoaXMgdGV4dCBhdDxzcGFuIGNsYXNzPSJhcHBsZS1j b252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PGEgaHJlZj0iaHR0cHM6Ly90b29s cy5pZXRmLm9yZy9odG1sL3JmYzc1MTkjc2VjdGlvbi0xMC4xIj48c3BhbiBzdHlsZT0iY29sb3I6 cHVycGxlIj5odHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvcmZjNzUxOSNzZWN0aW9uLTEwLjE8 L3NwYW4+PC9hPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj46PC9zcGFuPjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIwNjAiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LWZhbWlseTpDb25zb2xhcztiYWNrZ3JvdW5kOndoaXRlIj4mbmJzcDsmbmJz cDsgVmFsdWVzIGFyZSByZWdpc3RlcmVkIG9uIGEgU3BlY2lmaWNhdGlvbiBSZXF1aXJlZCBbPC9z cGFuPjxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9yZmM1MjI2IiB0aXRsZT0i JnF1b3Q7R3VpZGVsaW5lcyBmb3IgV3JpdGluZyBhbiBJQU5BIENvbnNpZGVyYXRpb25zIFNlY3Rp b24gaW4gUkZDcyZxdW90OyI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC4wcHQ7Zm9udC1mYW1p bHk6Q29uc29sYXM7Y29sb3I6IzAwNjZDQyI+UkZDNTIyNjwvc3Bhbj48L2E+PHNwYW4gc3R5bGU9 ImZvbnQtZmFtaWx5OkNvbnNvbGFzO2JhY2tncm91bmQ6d2hpdGUiPl0NCiBiYXNpczwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpDb25zb2xhcztiYWNrZ3JvdW5kOndo aXRlIj4mbmJzcDsmbmJzcDsgYWZ0ZXIgYSB0aHJlZS13ZWVrIHJldmlldyBwZXJpb2Qgb24gdGhl PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48 YSBocmVmPSJtYWlsdG86and0LXJlZy1yZXZpZXdAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJmb250 LWZhbWlseTpDb25zb2xhcztjb2xvcjpwdXJwbGU7YmFja2dyb3VuZDp3aGl0ZSI+and0LXJlZy1y ZXZpZXdAaWV0Zi5vcmc8L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFt aWx5OkNvbnNvbGFzO2JhY2tncm91bmQ6d2hpdGUiPiZuYnNwOyZuYnNwOyBtYWlsaW5nIGxpc3Qs IG9uIHRoZSBhZHZpY2Ugb2Ygb25lIG9yIG1vcmUgRGVzaWduYXRlZCBFeHBlcnRzLjwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpDb25zb2xhcztiYWNrZ3JvdW5kOndo aXRlIj4mbmJzcDsmbmJzcDsgSG93ZXZlciwgdG8gYWxsb3cgZm9yIHRoZSBhbGxvY2F0aW9uIG9m IHZhbHVlcyBwcmlvciB0byBwdWJsaWNhdGlvbiw8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk6Q29uc29sYXM7YmFja2dyb3VuZDp3aGl0ZSI+Jm5ic3A7Jm5ic3A7IHRo ZSBEZXNpZ25hdGVkIEV4cGVydHMgbWF5IGFwcHJvdmUgcmVnaXN0cmF0aW9uIG9uY2UgdGhleSBh cmU8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6Q29uc29sYXM7YmFj a2dyb3VuZDp3aGl0ZSI+Jm5ic3A7Jm5ic3A7IHNhdGlzZmllZCB0aGF0IHN1Y2ggYSBzcGVjaWZp Y2F0aW9uIHdpbGwgYmUgcHVibGlzaGVkLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJj b2xvcjojMDAyMDYwIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2 Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6 IzAwMjA2MCI+U28gYSBzcGVjaWZpY2F0aW9uIGNhbiBlYXNpbHkgcmVnaXN0ZXIgYm90aCBKV1Qg YW5kIENXVCBjbGFpbXMuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMwMDIw NjAiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMDAyMDYwIj4m bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsgJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IC0tIE1pa2U8L3NwYW4+PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iY29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXIt dG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZyb206PC9iPjxzcGFuIGNsYXNzPSJh cHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5MYXVyZW5jZSBMdW5kYmxhZGUgJmx0 OzxhIGhyZWY9Im1haWx0bzpsZ2xAaXNsYW5kLXJlc29ydC5jb20iPjxzcGFuIHN0eWxlPSJjb2xv cjpwdXJwbGUiPmxnbEBpc2xhbmQtcmVzb3J0LmNvbTwvc3Bhbj48L2E+Jmd0OzxzcGFuIGNsYXNz PSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48YnI+DQo8Yj5TZW50OjwvYj48 c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+V2VkbmVzZGF5 LCBKdW5lIDUsIDIwMTkgODo0NiBBTTxicj4NCjxiPlRvOjwvYj48c3BhbiBjbGFzcz0iYXBwbGUt Y29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+TWljaGFlbCBSaWNoYXJkc29uICZsdDs8YSBo cmVmPSJtYWlsdG86bWNyJiM0MztpZXRmQHNhbmRlbG1hbi5jYSI+PHNwYW4gc3R5bGU9ImNvbG9y OnB1cnBsZSI+bWNyJiM0MztpZXRmQHNhbmRlbG1hbi5jYTwvc3Bhbj48L2E+Jmd0Ozxicj4NCjxi PkNjOjwvYj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+ PGEgaHJlZj0ibWFpbHRvOnJhdHNAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJjb2xvcjpwdXJwbGUi PnJhdHNAaWV0Zi5vcmc8L3NwYW4+PC9hPjsgTWlrZSBKb25lcyAmbHQ7PGEgaHJlZj0ibWFpbHRv Ok1pY2hhZWwuSm9uZXNAbWljcm9zb2Z0LmNvbSI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+ TWljaGFlbC5Kb25lc0BtaWNyb3NvZnQuY29tPC9zcGFuPjwvYT4mZ3Q7PGJyPg0KPGI+U3ViamVj dDo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPlJl OiBbUmF0c10gVmV0dGluZyBjbGFpbSBkZWZpbml0aW9uczxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+QmVsb3figKY8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mIzQzOyBNaWtl IEpvbmVzLCBjby1hdXRob3Igb2YgQ1dUPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+ Jm5ic3A7PG86cD48L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBw dDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPk9uIEp1biA1LCAyMDE5LCBhdCA2OjA1IEFNLCBNaWNoYWVsIFJpY2hhcmRzb24g Jmx0OzxhIGhyZWY9Im1haWx0bzptY3ImIzQzO2lldGZAc2FuZGVsbWFuLmNhIj48c3BhbiBzdHls ZT0iY29sb3I6cHVycGxlIj5tY3ImIzQzO2lldGZAc2FuZGVsbWFuLmNhPC9zcGFuPjwvYT4mZ3Q7 IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4t Ym90dG9tOjEyLjBwdCI+PGJyPg0KTGF1cmVuY2UgTHVuZGJsYWRlICZsdDs8YSBocmVmPSJtYWls dG86bGdsQGlzbGFuZC1yZXNvcnQuY29tIj48c3BhbiBzdHlsZT0iY29sb3I6cHVycGxlIj5sZ2xA aXNsYW5kLXJlc29ydC5jb208L3NwYW4+PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8 YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+4oCUIFRvZGF5IENXVCBhbGxvY2F0 ZXMgbWlsbGlvbnMgb2Ygc2xvdHMgZm9yIGV4cGVydCByZXZpZXcuIE5vPGJyPg0Kc3BlY2lmaWNh dGlvbiBpcyByZXF1aXJlZCwgYnV0IHNvbWUgaW5mb3JtYXRpb24gc2hvdWxkIGJlIHByb3ZpZGVk LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tYm90dG9tOjEyLjBwdCI+Jm5ic3A7PG86cD48L286 cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9t OjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SldUIGRvZXNu4oCZ dCBzZWVtIHRvIGhhdmUgdGhpcywgd2hpY2ggaXMgbWF5YmUgd2h5IGl0IGlzIG1lc3NpZXIuIEl0 PGJyPg0Ka2luZCBvZiBzZWVtcyBiYWQgYW5kIHdyb25nIHRoYXQgaXQgZG9lc27igJl0IHRvIG1l LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGJyPg0KSldUIGRvZXNuJ3QgaGF2ZSB0aGlzIGJl Y2F1c2UgdGhlIGNsYWltcyBhcmUgJnF1b3Q7dW5saW1pdGVkJnF1b3Q7IGxlbmd0aCBzdHJpbmdz LCBzbzxicj4NCm9uZSBjYW4gYWx3YXlzIG1ha2UgdXAgYSB1bmlxdWUgc3RyaW5nIGluIGxpZXUg b2YgcmVnaXN0cmF0aW9uLjxicj4NCiZuYnNwO29yZy5pc2xhbmQtcmVzb3J0LmxnbC53aGF0ZXZl cnN0cmluZ3lvdXdhbnQ8YnI+DQo8YnI+DQppcyBwcm9iYWJseSBjb21wbGV0ZWx5IHlvdXJzIDot KTxicj4NCk9mIGNvdXJzZSwgaWYgeW91IHdhbnQgdG8gaW50ZXJvcGVyYXRlIHlvdSBuZWVkIHRv IGFncmVlIGFib3V0IGhvdywgc28gdGhlcmU8YnI+DQphcmUgc29tZSBhZHZhbnRhZ2VzIG9mIGEg Zm9yY2luZyBmdW5jdGlvbiB0aGF0IGRlbWFuZHMgeW91IHdyaXRlIHRoaW5ncyBkb3duPGJyPg0K Zmlyc3QgOi0pPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VW5saW1pdGVkIGxlbmd0aCBzdHJpbmcg Y2xhaW0gbmFtZXMgYXJlIGZ1bGx5IHBhcnQgb2YgQ1dULiBBbHNvLCBDT1NFIGFsbG93cyB0aGVt IGZvciBoZWFkZXJzLCBhbGdvcml0aG0gbmFtZXMgYW5kIHN1Y2ggdG9vLiBTbyBmcm9tIGEgc3lu dGF4IHZpZXcgQ1dUIGFuZCBDT1NFIGFyZSB0aGUgc2FtZSBhcyBKV1QgaW4gYWxsb3dpbmcgbG9u ZyBzdHJpbmcgbmFtZXMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPkhvd2V2ZXIsIENPU0UgYW5kIENXVCBhcmUgZGlmZmVyZW50IGluIHRo ZSBtYW5hZ2VtZW50IG9mIHRoZSBzdHJpbmcgbmFtZSBzcGFjZTo8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLWxlZnQ6MzAuMHB0O21hcmdpbi10b3A6NS4w cHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8ZGl2Pg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5TdHJpbmdzIG9mIGxlbmd0aCAxPHNw YW4gY2xhc3M9ImFwcGxlLXRhYi1zcGFuIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDs8L3NwYW4+PHNwYW4gY2xhc3M9ImFw cGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPlN0YW5kYXJkcyBBY3Rpb248bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlN0cmluZ3Mgb2YgbGVuZ3RoIDI8c3Bh biBjbGFzcz0iYXBwbGUtdGFiLXNwYW4iPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOzwvc3Bhbj48c3BhbiBjbGFzcz0iYXBw bGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+U3BlY2lmaWNhdGlvbiBSZXF1aXJlZDxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRp dj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U3RyaW5ncyBvZiBsZW5ndGgg Z3JlYXRlciB0aGFuIDI8c3BhbiBjbGFzcz0iYXBwbGUtdGFiLXNwYW4iPiZuYnNwOyZuYnNwOyZu YnNwOzwvc3Bhbj48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3Nw YW4+RXhwZXJ0IFJldmlldzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxk aXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGVzZSwgYWxv bmcgd2l0aCB0aGUgaW50ZWdlciBuYW1lcyBzcGFjZSBydWxlcywgdGhlbiBpbXBseTo8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLWxlZnQ6MzAuMHB0O21h cmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxk aXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JbnRlZ2VyIHZh bHVlcyBsZXNzIHRoYW4gLTY1NTM2IGFyZSB0aGUgb25seSBvbmVzIGZyZWUgZm9yIHVzZSB3aXRo IG5vIHJldmlldyBvciBwcm9jZXNzaW5nIGJ5IElBTkEgYW5kIGV4cGVydHMuPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPkpXVCBhbHNvIGhhcyB0aGlzIG5vdGlvbiBvZiZuYnNwO0NvbGxp c2lvbi1SZXNpc3RhbnQgTmFtZSBiYXNlZCBvbiBPSURzIG9yIFVVSURzLCB3aGljaCBpcyBlc3Nl bnRpYWxseSBzb21lIHJ1bGVzIHRvIG1ha2UgdXAgbmFtZXMgdGhhdCBkb27igJl0IGdvIGludG8g YW4gSUFOQSByZWdpc3RyeSBhbmQgYXJlIHN0aWxsIHVuaXF1ZSBhbmQgd29u4oCZdCBjb2xsaWRl LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5KV1QgY291bGQgaGF2ZSBkb25lIHdoYXQgQ1dUIGRvZXMuIFNlZW1zIHRvIG1lIHRoYXQgQ1dU IGhhcyB0YWtlbiBhIHJhZGljYWxseSBtb3JlIG1hbmFnZWQgYXBwcm9hY2ggdG8gdGhlIHN1cGVy LW9wZW4gSldUIGFwcHJvYWNoLiBNYXliZSB0aGUgQ1dUIGZvbGtzIHJlYWxpemVkIHRoZSBKV1Qg ZGVzaWduIHdhcyBwb29yLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0K PGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkF0IGFueSBy YXRlLCB0aGVyZSBzZWVtcyB0byBiZSBzb21lIGNvbnNlbnN1cyBoZXJlIHRoYXQgdGhlIENXVCBh cHByb2FjaCBpcyB3aGF0IHdlIHdhbnQgZm9yIGF0dGVzdGF0aW9uLiBJdCBpcyBhbHNvIHRoZSBt b3JlIHJlY2VudCBhbmQgdGh1cyBtYXliZSBtb3JlIGFkdmFuY2VkIHRoaW5raW5nLjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5J4oCZbSBo b3Bpbmcgd2UgY2FuIGZpbmQgb3VyIHdheSB0byBqdXN0IGFjY2VwdCB0aGUgQ1dUIGNsYWltIG5h bWluZyBtYW5hZ2VtZW50IHNjaGVtZSBhcyBpcyBmb3IgYXR0ZXN0YXRpb24uIElmIG90aGVyIENX VC1iYXNlZCBlZmZvcnRzIGRpZCB0aGUgc2FtZSAoZHJhZnQtYmlya2hvbHotY29yZS1jb2lkKSBk aWQgdGhlIHNhbWUgdGhlbiB0aGUgd29ybGQgd291bGQgYmUgbXVjaCBzaW1wbGVyLiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5I b3dldmVyIHRoYXQgc3RpbGwgbGVhdmVzIG9wZW4gc29tZSBpc3N1ZSB3aXRoIEpXVCBuYW1lc3Bh Y2UgbWFuYWdlbWVudC4gKFdlIGRvIHdhbnQgSlNPTiBiYXNlZCBhdHRlc3RhdGlvbiB0byBiZSBK V1TigJlzLCByaWdodD8gSnVzdCB0aGUgc2FtZSBhcyBDQk9SLWJhc2VkIGF0dGVzdGF0aW9uIGFy ZSBDV1TigJlzKS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+TEw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tR0IiPklNUE9SVEFOVCBOT1RJ Q0U6IFRoZSBjb250ZW50cyBvZiB0aGlzIGVtYWlsIGFuZCBhbnkgYXR0YWNobWVudHMgYXJlIGNv bmZpZGVudGlhbCBhbmQgbWF5IGFsc28gYmUgcHJpdmlsZWdlZC4gSWYgeW91IGFyZSBub3QgdGhl IGludGVuZGVkIHJlY2lwaWVudCwgcGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyIGltbWVkaWF0ZWx5 IGFuZCBkbyBub3QgZGlzY2xvc2UgdGhlIGNvbnRlbnRzDQogdG8gYW55IG90aGVyIHBlcnNvbiwg dXNlIGl0IGZvciBhbnkgcHVycG9zZSwgb3Igc3RvcmUgb3IgY29weSB0aGUgaW5mb3JtYXRpb24g aW4gYW55IG1lZGl1bS4gVGhhbmsgeW91Ljwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPl9f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KUkFUUyBt YWlsaW5nIGxpc3Q8YnI+DQo8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOlJBVFNAaWV0Zi5vcmciPjxz cGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1 b3Q7LHNhbnMtc2VyaWY7Y29sb3I6cHVycGxlIj5SQVRTQGlldGYub3JnPC9zcGFuPjwvYT48c3Bh biBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90 OyxzYW5zLXNlcmlmIj48YnI+DQo8L3NwYW4+PGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcv bWFpbG1hbi9saXN0aW5mby9yYXRzIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOnB1cnBsZSI+aHR0 cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9yYXRzPC9zcGFuPjwvYT48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0 bWw+DQo= --_000_DM6PR11MB4089D8274D816949BAC5215DA1130DM6PR11MB4089namp_-- From nobody Tue Jun 11 08:21:28 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E81B7120276 for ; Tue, 11 Jun 2019 08:21:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.888 X-Spam-Level: X-Spam-Status: No, score=-1.888 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, T_SPF_TEMPERROR=0.01] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rpnpYmjLqCrz for ; Tue, 11 Jun 2019 08:21:23 -0700 (PDT) Received: from p3plsmtpa08-02.prod.phx3.secureserver.net (p3plsmtpa08-02.prod.phx3.secureserver.net [173.201.193.103]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C501612028A for ; Tue, 11 Jun 2019 08:21:15 -0700 (PDT) Received: from [10.172.0.26] ([104.238.46.239]) by :SMTPAUTH: with ESMTPA id aiaHhh8NNd9U0aiaIhBJVe; Tue, 11 Jun 2019 08:21:14 -0700 From: Laurence Lundblade Message-Id: <8AA62B47-28EA-4D9D-B103-DBD1F3964BAF@island-resort.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_F99B834B-EB64-47E1-A578-49D4F9176C7A" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Tue, 11 Jun 2019 08:21:13 -0700 In-Reply-To: Cc: Michael Richardson , Hannes Tschofenig , "rats@ietf.org" , Henk Birkholz , Mike Jones To: "Eric Voit (evoit)" References: <12913.1559739926@localhost> <30754CD8-98AB-4080-952E-880BC630EC69@island-resort.com> <902E75D8-D8AC-403B-A295-0EC3034E44B2@island-resort.com> X-Mailer: Apple Mail (2.3445.9.1) X-CMAE-Envelope: MS4wfPeOOyOAZ03iNHwFRM+XuQn9HAjWpxETIAZv8zw8JCP2nT/4YLbwvj/+eNXwqr3m5W7aSGl7/8Zcfc690tKlVPTGcGeX/r0OWGv7seBkLoeREc693/UZ izQw7jg+e3mtHfOv6jjUNnnqo3E7icLgTm79p7VuGqeJNi1oGgeen6HvyZKdMqt+DeEksqBsEYKAtWr0ra3nog2OOdQKhM/j0ReflEu/7y/oVsyIsKjRh4bi qqH9B1IHlXd4TTW+wM//TjjF1J/Zcer1QvpzsSn+vVfLocF4Eq53nMHro/bGt1yjbw9+7jnGxQ1foWCLHfRe3rCGBO/LDsGKJYz+vA6hON4BB0A7lUsnQg26 VzPwQ/sApkCPj22eT+EvLRLp1VEA3w== Archived-At: Subject: Re: [Rats] Vetting claim definitions X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Jun 2019 15:21:26 -0000 --Apple-Mail=_F99B834B-EB64-47E1-A578-49D4F9176C7A Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Eric, What I=E2=80=99m trying to figure out here is where there can be real = practical interoperability with extant YANG-defined objects and how we = go about it as I assume this is your current objection to adoption. > On Jun 10, 2019, at 2:23 PM, Eric Voit (evoit) = wrote: >=20 > Hi Laurence, > =20 > It is true that the YANG of draft-birkholz-rats-basic-yang-module is = currently TPM2 specific. But over the past month we have been having = discussions on how to augment into this model case statements and a tree = structure which allows exposure of information from alternative hardware = types such as the TPM1.2. =20 > =20 > Per your note below, I am guessing that = draft-birkholz-rats-basic-yang-module could provide a query/response = interface to access EAT information. The Network Element's YANG model = theoretically could allow access based on whatever choice of protocols = the Network Element supports (e.g., NETCONF/XML. RESTCONF/JSON, = CoMI/CBOR). But the choice and protocols of used to access EAT objects = over a YANG interface is something each platform would need to define. = The baseline choice for Interoperability here is tbd. You mentioned a YANG interface. Seems like a point where there might be = interoperability. Is this an interface on the router that is used to = collect the claims data before signing? Or is it an interface on the = back end / server / relying party that is involved in validating the = data? Or maybe it is the rpc interaction defined in = draft-birkholz-rats-basic-yang-module? I=E2=80=99m not sure what the = intended endpoints of that RPC are. Router and Relying Party?=20 Now that we are generally agreeing that an EAT is a CWT or JWT, the = interaction model between device and relying party is inherited from = them. Mostly we=E2=80=99re defining the format of a signed message and = leaving the transport of the message open-ended so it can be embedded in = HTTP headers, protocol extensions and such. If YANG is used to define = interaction on routers, then some YANG RPC could be used (if that is = what YANG RPC is) to define transport of CWTs (if CWTs are used on = routers). There=E2=80=99s also = draft-birkholz-reference-ra-interaction-model. > =20 > Whether it is even meaningful/relevant to support such YANG-EAT = interoperability is something I don't know yet. For me to consider EAT = for implementation would mean EAT has been adopted within = routers/switches. As this is possible, I feel there is little for the = WG to lose if we try to select/define some common objects which span our = different domains. Here=E2=80=99s comments on a pass through = draft-birkholz-rats-basic-yang-module grouping nonce {... Seems essentially compatible with nonce / cti / jai = in CWT / JWT grouping pcr-selection {... TPM-specific so we probably go with the = YANG definition grouping pcr-selector {... TPM-specific so we probably go with the = YANG definition grouping signature-scheme {=E2=80=A6 EAT will use COSE for this grouping attestation-key-identifier {=E2=80=A6 EAT will use COSE for = this grouping tpm-name {=E2=80=A6 TPM-specific so we probably go with the = YANG definition grouping compute-node {=E2=80=A6 I think this one needs work to figure = out what it is and if EAT=E2=80=99s UEID is similar grouping node-uptime {=E2=80=A6 Seems simple to make exactly the same = for EAT grouping log-identifier {=E2=80=A6 and grouping boot-event-log {=E2=80=A6 = and other log stuff=E2=80=A6 Maybe TPM specific; maybe needs work to = understand grouping ima-event {=E2=80=A6 and related. We do want some IMA claims in = CWT format. Maybe they are part of EAT. Maybe they are separate. Maybe = they use the YANG definition.=20 > =20 > Please understand that in no way do I claim that YANG is perfect. And = YANG models can take years to complete. But on the plus side for YANG, = I am sure it is possible to construct YANG models so that new hardware = types can be inserted. If you want a preview of the types of structure = which might be used for this type of extensibility, check out at how = draft-ietf-netconf-yang-push augments new case types into a the YANG = model described within draft-ietf-netconf-subscribed-notifications. YANG not perfect?? Huh? What? :-) I wish some YANG experts would chime in more here. I=E2=80=99m trying to = learn on the fly and really should be updating the EAT draft instead. LL > =20 > Eric > =20 > From: Laurence Lundblade, June 10, 2019 2:57 PM >=20 > Hi Eric, > =20 > So I think we have some agreement on general principles for how to = structure the documents this work group produces so we can have both = flexibility in the definition of new claims and well-defined concise = sets claims for particular use cases.=20 > =20 > In particular I appreciate the confirmation of this from Mike Jones. = Hopefully lack of objection implies a lot of agreement.=20 > =20 > =20 > Eric, I think you are now digging into the next level of detail on how = to deal with TPM-based implementations and claims specified in YANG and = how that will interoperate with CWT/COSE and JWT/JOSE based tokens. > =20 > I don=E2=80=99t really understand YANG and how to fully read = draft-birkholz-rats-basic-yang-module yet. Working on it (but I should = be working on the new EAT draft=E2=80=A6) > =20 > draft-birkholz-rats-basic-yang-module REQUIRES a TPM to implement it. = That implies to me that neither CWT/COSE and JWT/JOSE signed container = formats can be used because I don=E2=80=99t think TPM=E2=80=99s can = produce either format. Pretty sure we agree that EAT will always be = CWT/COSE or JWT/JOSE.=20 > =20 > (It is also odd to me that an IETF standard would require particular = HW. It should just be about bits on the wire. EAT will have some means = to indicate the security of the HW and SW that produced a given token, = but will not require any particular security from the HW or SW) > =20 > But let=E2=80=99s assume that a relying party (I think you call this = the Network Element) can unpack and verify signature that in the format = of CWT and JWT and the TPM-style sig that I think is implied by = draft-birkholz-rats-basic-yang-module. The result will be a set of = claims in some syntax. It will be CBOR or JSON in the case of CWT or = JWT.=20 > =20 > What will it be for draft-birkholz-rats-basic-yang-module??? = YANG-described stuff an be lots of different syntaxes by my = understanding. How many of them will a relying party be expected to = support so there is interop? > =20 > I=E2=80=99m going to stop here for the answer to that question. > =20 > LL > =20 --Apple-Mail=_F99B834B-EB64-47E1-A578-49D4F9176C7A Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi = Eric,

What I=E2=80=99m= trying to figure out here is where there can be real practical = interoperability with extant YANG-defined objects and how we go about it = as I assume this is your current objection to adoption.


On Jun = 10, 2019, at 2:23 PM, Eric Voit (evoit) <evoit@cisco.com> = wrote:

Hi = Laurence,
 
It is true that the YANG of = draft-birkholz-rats-basic-yang-module is currently TPM2 specific.  = But over the past month we have been having discussions on how to = augment into this model case statements and a tree structure which = allows exposure of information from alternative hardware types such as = the TPM1.2.  
 
Per your = note below, I am guessing that draft-birkholz-rats-basic-yang-module = could provide a query/response interface to access EAT = information.  The Network Element's YANG model theoretically could = allow access based on whatever choice of protocols the Network Element = supports (e.g., NETCONF/XML. RESTCONF/JSON, CoMI/CBOR).  But the = choice and protocols of used to access EAT objects over a YANG interface = is something each platform would need to define.   The = baseline choice for Interoperability here is = tbd.

You = mentioned a YANG interface. Seems like a point where there might be = interoperability. Is this an interface on the router that is used to = collect the claims data before signing? Or is it an interface on the = back end / server / relying party that is involved in validating the = data? Or maybe it is the rpc interaction defined = in draft-birkholz-rats-basic-yang-module? I=E2=80=99m not sure what = the intended endpoints of that RPC are. Router and Relying = Party? 

Now that we are = generally agreeing that an EAT is a CWT or JWT, the interaction model = between device and relying party is inherited from them. Mostly we=E2=80=99= re defining the format of a signed message and leaving the transport of = the message open-ended so it can be embedded in HTTP headers, protocol = extensions and such. If YANG is used to define interaction on routers, = then some YANG RPC could be used (if that is what YANG RPC is) to define = transport of CWTs (if CWTs are used on routers). There=E2=80=99s = also draft-birkholz-reference-ra-interaction-model.

 
Whether = it is even meaningful/relevant to support such YANG-EAT interoperability = is something I don't know yet.  For me to consider EAT for = implementation would mean EAT has been adopted within routers/switches. =   As this is possible, I feel there is little for the WG to = lose if we try to select/define some common objects which span our = different domains.


Here=E2=80=99s comments = on a pass = through draft-birkholz-rats-basic-yang-module

grouping nonce {... Seems = essentially compatible with nonce / cti / jai in CWT / JWT
grouping pcr-selection {... =   TPM-specific so we probably go with the YANG = definition
grouping pcr-selector {... =   TPM-specific so we probably go with the YANG definition
grouping signature-scheme {=E2=80=A6 = EAT will use COSE for this
grouping = attestation-key-identifier {=E2=80=A6 EAT will use COSE for = this
grouping tpm-name {=E2=80=A6 TPM-specific so we = probably go with the YANG definition
grouping compute-node = {=E2=80=A6 I think this one needs work to figure out what it is and if = EAT=E2=80=99s UEID is similar
grouping node-uptime {=E2=80=A6 = Seems simple to make exactly the same for EAT
grouping = log-identifier {=E2=80=A6 and grouping boot-event-log {=E2=80=A6 and = other log stuff=E2=80=A6 Maybe TPM specific; maybe needs work to = understand
grouping ima-event {=E2=80=A6 and related. We do = want some IMA claims in CWT format. Maybe they are part of EAT. Maybe = they are separate. Maybe they use the YANG = definition. 

 
Please understand that in no way do I = claim that YANG is perfect.  And YANG models can take years to = complete.   But on the plus side for YANG, I am sure it is = possible to construct YANG models so that new hardware types can be = inserted.  If you want a preview of the types of structure which = might be used for this type of extensibility, check out at how = draft-ietf-netconf-yang-push augments new case types into a the YANG = model described within = draft-ietf-netconf-subscribed-notifications.
=
YANG not perfect?? Huh? What? =  :-)

I wish some YANG experts = would chime in more here. I=E2=80=99m trying to learn on the fly and = really should be updating the EAT draft instead.

LL


 
Eric
 
From: Laurence Lundblade, June = 10, 2019 2:57 PM

Hi Eric,
 
So I think we have some agreement on general principles for = how to structure the documents this work group produces so we can have = both flexibility in the definition of new claims and well-defined concise sets claims for particular = use cases. 
 
In particular I appreciate the confirmation of this from Mike = Jones. Hopefully lack of objection implies a lot of agreement. 
 
 
Eric, I think you are now digging into the next level of = detail on how to deal with TPM-based implementations and claims = specified in YANG and how that will interoperate with CWT/COSE and = JWT/JOSE based tokens.
 
I don=E2=80=99t really understand YANG and how to fully read = draft-birkholz-rats-basic-yang-module yet. Working on it (but I should = be working on the new EAT draft=E2=80=A6)
 
draft-birkholz-rats-basic-yang-module REQUIRES a TPM to = implement it. That implies to me that neither CWT/COSE and JWT/JOSE = signed container formats can be used because I don=E2=80=99t think = TPM=E2=80=99s can produce either format. Pretty sure we agree that EAT = will always be CWT/COSE or JWT/JOSE. 
 
(It is also odd to me that an IETF = standard would require particular HW. It should just be about bits on = the wire. EAT will have some means to indicate the security of the HW = and SW that produced a given token, but will not require any particular = security from the HW or SW)
 
But let=E2=80=99s assume that a relying party (I think you = call this the Network Element) can unpack and verify signature that in = the format of CWT and JWT and the TPM-style sig that I think is implied = by draft-birkholz-rats-basic-yang-module. The result will be a set of = claims in some syntax. It will be CBOR or JSON in the case of CWT or = JWT. 
 
What will it be for draft-birkholz-rats-basic-yang-module??? = YANG-described stuff an be lots of different syntaxes by my = understanding. How many of them will a relying party be expected to = support so there is interop?
 
I=E2=80=99m going to stop here for the answer to that = question.
 
LL
 

= --Apple-Mail=_F99B834B-EB64-47E1-A578-49D4F9176C7A-- From nobody Tue Jun 11 08:25:04 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A22261202AF for ; Tue, 11 Jun 2019 08:25:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H_KYBMCNW-0o for ; Tue, 11 Jun 2019 08:24:59 -0700 (PDT) Received: from mail-oi1-x233.google.com (mail-oi1-x233.google.com [IPv6:2607:f8b0:4864:20::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B86011202A7 for ; Tue, 11 Jun 2019 08:24:59 -0700 (PDT) Received: by mail-oi1-x233.google.com with SMTP id 203so9243693oid.13 for ; Tue, 11 Jun 2019 08:24:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=+b4kW7qI+eDuphU/3UHfpbR2ARjk4FktCJ/EqeeCtmw=; b=gd/O4cEBsb7suYjOisJNL4ni5LzYxzVCBVsM/Pr0X2tihWQgTBLAwnM3/SWkHSce1g g4CEX1rUqzEMNWMOVt5oZlcxtOWjLoLQB0tRh+UfSEOLgBsvn6tmlCP4o2btPYZVdstU 7U7gB/S6sUgAiHg0cbb82kb6KjsXUnYskcETZEvxZM3uUkVjxHqyP0QVAT0Z87TfLN5Q SO6eKc4A6iQsh+BhPvfX29IjeJrfNBmOQOMpA22VqmA2fNqG4Dwe2Naoi1YaxwFPpgKf dbDNn2l31iCxsAZ/nyAWJSy1hHXVXSFT3IcvIzXm3YGLruqUtirZAKh5D3UQcCfYbi4a wwyw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=+b4kW7qI+eDuphU/3UHfpbR2ARjk4FktCJ/EqeeCtmw=; b=fxgv5HQMWVF39b8hTi6VRK45BqdzBdQNB9dHbF2AeWzO/qjtfVyOR1+2Cfm8NV02C8 5xEsBLQjuhQs5MDrxOZmHFrxp5r1FDI0Ij4Go/bfPC+BHh98dcp272SJ7TkRml9dKTJj OeKnhysv7OMf5EH2U5NVjOeGIFOsSI4wfYDpSrWLoQqEu/F/6HmOPk0tPCj067xs+hV+ rwh/GMlDGHQvYgLuLIARRoiDSprUI0MDPAym4UMw8e0RCnL6w7Vn73Q34Mvr2CiGBRsJ QrfqsJQtZKDsZZz+nEnbZX9+93PSPF29VLFri1dQ5eICsYhG5W+AqMo57PmAfdszKWKZ 84ow== X-Gm-Message-State: APjAAAU/4Hqp7oVddCJZ4IPUoA5DsN8bNmTJ/OJYMM09Rp0tn4yiR8HV +JV+gpBkCwd0YnqfBQW787Cr0u9q6Qw0Auvg1fb+urQb5fU= X-Google-Smtp-Source: APXvYqxPfC6iZt5t2/3QjmmlYi20ydT38hxsp7IdzOVTQU3jdV7WI3c6zmJ4V7cLO9mbn5dwugkHD+b8dbKocxeAQnk= X-Received: by 2002:aca:3d54:: with SMTP id k81mr14967322oia.111.1560266698811; Tue, 11 Jun 2019 08:24:58 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Kathleen Moriarty Date: Tue, 11 Jun 2019 11:24:42 -0400 Message-ID: To: rats@ietf.org Content-Type: multipart/alternative; boundary="000000000000566e0b058b0de615" Archived-At: Subject: Re: [Rats] Call for Adoption: EAT draft X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Jun 2019 15:25:03 -0000 --000000000000566e0b058b0de615 Content-Type: text/plain; charset="UTF-8" Greetings! A month later, my assessment of the status of this last call is as follows: The EAT draft is adopted with identified issues that need to be resolved through the WG consensus process. I am listing the identified issues in this message. If any issues have been left out, please do correct me and we'll make sure the WG runs through the full list. Additional decision points can be added at any time for WG discussion, as with any WG adopted draft. If details within any of the identified issues require clarification, we can figure that out in an issue tracking format and ensure we have consensus on each identified item. 1. Clearly define EAT (token, structured format, protocol message, etc.) 2. CWT or CWT-like? My take from the thread is that we move to CWT and we use the CWT or JWT registry as appropriate with updated instructions. Instructions should account for unused or barely used claims. 3. Process for review of claims entered into CWT/JWT registry 4. A basic set of attestation related claims and what makes a good claim for use within EAT. Define claims profile for network equipment. Determine which other profiles (if any) should be considered. 5. Limits to what can be populated in an EAT claim Related work in other drafts may influence this draft in time as well, such as an information model. Additional questions came up that I trust will be addressed in the draft update, such as the ability to create a custom claim to carry the entire TPM attestation as a payload and relationships to FIDO/Webauthn. Examples may be helpful. Ensuring clean interoperation with other drafts will be important as well. If the authors could post a new version with the name formatted as a WG draft, that can serve as a next step. If they have felt there is agreement on some of the items discussed, this new version can include their proposed text to address those points for WG review. If the draft is in github, then a pull request may be used to suggest corrections, but proposed text should also go to the list. draft-ietf-rats-eat-00.txt Thank you, Kathleen On Fri, May 10, 2019 at 11:06 AM Kathleen Moriarty < kathleen.moriarty.ietf@gmail.com> wrote: > Greetings! > > At IETF 104, a poll was taken to determine interest in the RATS WG > adopting: > > The Entity Attestation Token (EAT) > https://datatracker.ietf.org/doc/draft-mandyam-rats-eat/ > > This begins a 2 week period to determine interest in adopting this draft > as a working group item. The poll will close on May 24th EOD PDT. > > Minutes from IETF 104: > https://datatracker.ietf.org/doc/minutes-104-rats/ > -- > > Best regards, > Kathleen > -- Best regards, Kathleen --000000000000566e0b058b0de615 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Greetings!

A month later, my assess= ment of the status of this last call is as follows:

The EAT draft is adopted with identified issues that need to be resolved = through the WG consensus process.=C2=A0 I am listing the identified issues = in this message.=C2=A0 If any issues have been left out, please do correct = me and we'll make sure the WG runs through the full list.=C2=A0 Additio= nal decision points can be added at any time for WG discussion, as with any= WG adopted draft.=C2=A0 If details within any of the identified issues req= uire clarification, we can figure that out in an issue tracking format and = ensure we have consensus on each identified item.

=
  1. Clearly define EAT (token, structured format, protocol message, etc= .)
  2. CWT or CWT-like?=C2=A0 My take from the thread is that we move t= o CWT and we use the CWT or JWT registry as appropriate with updated instru= ctions.=C2=A0 Instructions should account for unused or barely used claims.=
  3. Process for review of claims entered into CWT/JWT registry
    4. A basic set of attestation related claims and what makes a good claim for = use within EAT. Define claims profile for network equipment. Determine whic= h other profiles (if any) should be considered.
  4. Limits to what can = be populated in an EAT claim
Related work in other drafts may= influence this draft in time as well, such as an information model.=C2=A0 = Additional questions came up that I trust will be addressed in the draft up= date, such as the ability to create a custom claim to carry the entire TPM = attestation as a payload and relationships to FIDO/Webauthn.=C2=A0 Examples= may be helpful.=C2=A0 Ensuring clean interoperation with other drafts will= be important as well.

If the authors could = post a new version with the name formatted as a WG draft, that can serve as= a next step.=C2=A0 If they have felt there is agreement on some of the ite= ms discussed, this new version can include their proposed text to address t= hose points for WG review.=C2=A0 If the draft is in github, then a pull req= uest may be used to suggest corrections, but proposed text should also go t= o the list.

draft-ietf-rats-eat-00.txt
<= br>
Thank you,
Kathleen

On Fri, May 10, 2019 at 11= :06 AM Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com> wrote:
Greetings!

At IETF 104, a poll was taken t= o determine interest in the RATS WG adopting:=C2=A0

The Entity Attestation Token (EAT)

This begins a 2 week period to determine interest in adopting this= draft as a working group item.=C2=A0 The poll will close on May 24th EOD P= DT.

Minutes from IETF 104:
--

Best regards,
Kathleen


--

Best regards,
Kathleen
--000000000000566e0b058b0de615-- From nobody Tue Jun 11 14:03:40 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 57510120090 for ; Tue, 11 Jun 2019 14:03:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=GEkBmbEz; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=aQs8nnvZ Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1YbGL3wy7Mzx for ; Tue, 11 Jun 2019 14:03:34 -0700 (PDT) Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3E80612006B for ; Tue, 11 Jun 2019 14:03:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=40220; q=dns/txt; s=iport; t=1560287014; x=1561496614; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=sYCKYQy2FyTnn6Tvd+ovrCfeE4hVPhXDF+Fyswzw6tQ=; b=GEkBmbEzicrAC821OPD5j2g6qpM0HmhGktRWYgmrN+pk/+pe5J6MyA3a dCBCqaFjvo7c6mwkA1B7T77DDoZAzBEXjbsRZASVzP89qHtROR/Apm4dG LlWEjzb1BqFyuyaZhuO1dtgOlo1zH00frgwa7BgDkYTjUAwkMRSaJagiJ 8=; IronPort-PHdr: =?us-ascii?q?9a23=3Ab3rHoRER9KvIng3t1F2zDZ1GYnJ96bzpIg4Y7I?= =?us-ascii?q?YmgLtSc6Oluo7vJ1Hb+e4w3A3SRYuO7fVChqKWqK3mVWEaqbe5+HEZON0pNV?= =?us-ascii?q?cejNkO2QkpAcqLE0r+efP0aC0mNM9DT1RiuXq8NBsdFQ=3D=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BtAAAWFgBd/49dJa1mGwEBAQEDAQE?= =?us-ascii?q?BBwMBAQGBVAMBAQELAYEOLyQFJwNqVSAECygKhAuDRwOOXoJXfpY1glIDVAk?= =?us-ascii?q?BAQEMAQEnBgIBAYRAAheCZyM3Bg4BAwEBBAEBAgEEbRwMhUoBAQEBAxIRChM?= =?us-ascii?q?BASkOAQ8CAQgOByMHAwICAjAUEQIEDgUIGoI1TIEdTQMdAQIMnkcCgTiIX3G?= =?us-ascii?q?BMYJ5AQEFgTIBg1AYgg8DBoE0AYtcF4FAP4ERRoIXNT6CYQKBSxgVFgmCVDK?= =?us-ascii?q?CJotnK4IYhHAilXkJAoIQhkWNG4Ilhn2EB4l5lCqPKwIEAgQFAg4BAQWBZSK?= =?us-ascii?q?BWHAVgyeCDwwXg02KU3KBKYx6K4EEAYEgAQE?= X-IronPort-AV: E=Sophos;i="5.63,363,1557187200"; d="scan'208,217";a="576404151" Received: from rcdn-core-7.cisco.com ([173.37.93.143]) by rcdn-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 11 Jun 2019 21:03:32 +0000 Received: from XCH-RCD-017.cisco.com (xch-rcd-017.cisco.com [173.37.102.27]) by rcdn-core-7.cisco.com (8.15.2/8.15.2) with ESMTPS id x5BL3WiJ024932 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 11 Jun 2019 21:03:32 GMT Received: from xhs-aln-003.cisco.com (173.37.135.120) by XCH-RCD-017.cisco.com (173.37.102.27) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 11 Jun 2019 16:03:31 -0500 Received: from xhs-aln-002.cisco.com (173.37.135.119) by xhs-aln-003.cisco.com (173.37.135.120) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 11 Jun 2019 16:03:30 -0500 Received: from NAM02-SN1-obe.outbound.protection.outlook.com (173.37.151.57) by xhs-aln-002.cisco.com (173.37.135.119) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Tue, 11 Jun 2019 16:03:30 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=sYCKYQy2FyTnn6Tvd+ovrCfeE4hVPhXDF+Fyswzw6tQ=; b=aQs8nnvZNtHmZOvt5Zlp+bvad3QaviZYKpYX4atDELJrL9d8/LNQD2Nwy7jtc7n7FQAQKahpekJTBNwYJZTqkjCKawbVwAf+2ohnzwGqfPpc45A+h6yJjO2s78zcWyXxAW1oxEYeakieI8PrvTCDnUzK4ZzeohFkh4baD//7U3I= Received: from DM6PR11MB4089.namprd11.prod.outlook.com (20.176.126.30) by DM6PR11MB3145.namprd11.prod.outlook.com (20.177.219.154) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1987.11; Tue, 11 Jun 2019 21:03:28 +0000 Received: from DM6PR11MB4089.namprd11.prod.outlook.com ([fe80::d014:d7a3:270:e5a9]) by DM6PR11MB4089.namprd11.prod.outlook.com ([fe80::d014:d7a3:270:e5a9%3]) with mapi id 15.20.1965.017; Tue, 11 Jun 2019 21:03:28 +0000 From: "Eric Voit (evoit)" To: Laurence Lundblade CC: Michael Richardson , Hannes Tschofenig , "rats@ietf.org" , Henk Birkholz , Mike Jones Thread-Topic: [Rats] Vetting claim definitions Thread-Index: AQHVHSQrNP3gSrcbuEuedIL4RWxi86aQLzAwgABa8ACAABflIIAEoFOAgAAVAQCAAUD6gIAATHJw Date: Tue, 11 Jun 2019 21:03:28 +0000 Message-ID: References: <12913.1559739926@localhost> <30754CD8-98AB-4080-952E-880BC630EC69@island-resort.com> <902E75D8-D8AC-403B-A295-0EC3034E44B2@island-resort.com> <8AA62B47-28EA-4D9D-B103-DBD1F3964BAF@island-resort.com> In-Reply-To: <8AA62B47-28EA-4D9D-B103-DBD1F3964BAF@island-resort.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=evoit@cisco.com; x-originating-ip: [173.38.117.75] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: cd75d675-6715-44b4-e46c-08d6eeb040b1 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:DM6PR11MB3145; x-ms-traffictypediagnostic: DM6PR11MB3145: x-ms-exchange-purlcount: 4 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:7219; x-forefront-prvs: 006546F32A x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(39860400002)(376002)(136003)(346002)(366004)(199004)(189003)(446003)(11346002)(66946007)(790700001)(606006)(71200400001)(73956011)(71190400001)(26005)(186003)(9326002)(316002)(68736007)(8936002)(66066001)(76116006)(66574012)(476003)(14444005)(256004)(8676002)(81156014)(81166006)(5660300002)(486006)(7696005)(52536014)(99286004)(6246003)(33656002)(2906002)(102836004)(86362001)(25786009)(6916009)(54906003)(6116002)(3846002)(54896002)(6306002)(55016002)(74316002)(4326008)(7736002)(14454004)(478600001)(66476007)(66556008)(966005)(64756008)(9686003)(6436002)(66446008)(229853002)(53936002)(53546011)(6506007)(236005)(76176011); DIR:OUT; SFP:1101; SCL:1; SRVR:DM6PR11MB3145; H:DM6PR11MB4089.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: asmhFV99s4fQGq0rvur1OXhrjD0F4rGPZ5Yai6Y1oRaUbwlA0MLW08RbwHbawMUMZicNHOCcB+BwBrPs8aKSHEzZ+wAPFYoHeLp2AHUUUYJo3Uy6gndGNvQHYW6LP9HGa3OL4i8oVCbUdSkuBTFdMai+y1G/a2ABXbzQmWDv8SDoOA4uGtS7iAdFhLO3u++1TdgYz0DmlneENwT5fnS8i/wrB4K1uJi92ijzQVRUPkBUqYeHOepLo7U6Fb+qyFMBaHM9LJSwu1a89BRGiRAKyJpCpTWlnOBW5ZNNeyJTUsS8l1CZpA39kV/iqHCIJ9QnyMm0PYzLhzyTXaYqDr95tfweVrtmTf3MPirHP7JK5s2oSe4gPFFDo8ccEH41KBtQlKjeQIgmjAsxYz5DESMf5WnHhGUX4I4HrZywQKd5mD0= Content-Type: multipart/alternative; boundary="_000_DM6PR11MB4089B664568293A03AD6FD40A1ED0DM6PR11MB4089namp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: cd75d675-6715-44b4-e46c-08d6eeb040b1 X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Jun 2019 21:03:28.4230 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: evoit@cisco.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR11MB3145 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.102.27, xch-rcd-017.cisco.com X-Outbound-Node: rcdn-core-7.cisco.com Archived-At: Subject: Re: [Rats] Vetting claim definitions X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Jun 2019 21:03:39 -0000 --_000_DM6PR11MB4089B664568293A03AD6FD40A1ED0DM6PR11MB4089namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgTGF1cmVuY2UsDQoNCkZyb206IExhdXJlbmNlIEx1bmRibGFkZSwgSnVuZSAxMSwgMjAxOSAx MToyMSBBTQ0KDQpIaSBFcmljLA0KDQpXaGF0IEnigJltIHRyeWluZyB0byBmaWd1cmUgb3V0IGhl cmUgaXMgd2hlcmUgdGhlcmUgY2FuIGJlIHJlYWwgcHJhY3RpY2FsIGludGVyb3BlcmFiaWxpdHkg d2l0aCBleHRhbnQgWUFORy1kZWZpbmVkIG9iamVjdHMgYW5kIGhvdyB3ZSBnbyBhYm91dCBpdCBh cyBJIGFzc3VtZSB0aGlzIGlzIHlvdXIgY3VycmVudCBvYmplY3Rpb24gdG8gYWRvcHRpb24uDQoN CjxlcmljPiBJIGNlcnRhaW5seSBpbnRlbmRlZCBubyBhcmd1bWVudCBhZ2FpbnN0IGFkb3B0aW9u LiAgSSBkaWQgdm90ZSBpbiBmYXZvciBvZiBhZG9wdGlvbi4gIEl0IHdhcyBqdXN0IHRoYXQgSSB3 YW50IHRvIHNlZSB0aGlzIHRvcGljIGFkZHJlc3NlZCBhcyBwYXJ0IG9mIHRoZSBkcmFmdCdzIHBy b2dyZXNzaW9uLiAgSSB0aGluayB0aGUgdm90ZSBzdW1tYXJ5IGZyb20gS2F0aGxlZW4gY292ZXJz IG15IGRlc2lyZSBqdXN0IGZpbmUuDQoNCk9uIEp1biAxMCwgMjAxOSwgYXQgMjoyMyBQTSwgRXJp YyBWb2l0IChldm9pdCkgPGV2b2l0QGNpc2NvLmNvbTxtYWlsdG86ZXZvaXRAY2lzY28uY29tPj4g d3JvdGU6DQoNCkhpIExhdXJlbmNlLA0KDQpJdCBpcyB0cnVlIHRoYXQgdGhlIFlBTkcgb2YgZHJh ZnQtYmlya2hvbHotcmF0cy1iYXNpYy15YW5nLW1vZHVsZSBpcyBjdXJyZW50bHkgVFBNMiBzcGVj aWZpYy4gIEJ1dCBvdmVyIHRoZSBwYXN0IG1vbnRoIHdlIGhhdmUgYmVlbiBoYXZpbmcgZGlzY3Vz c2lvbnMgb24gaG93IHRvIGF1Z21lbnQgaW50byB0aGlzIG1vZGVsIGNhc2Ugc3RhdGVtZW50cyBh bmQgYSB0cmVlIHN0cnVjdHVyZSB3aGljaCBhbGxvd3MgZXhwb3N1cmUgb2YgaW5mb3JtYXRpb24g ZnJvbSBhbHRlcm5hdGl2ZSBoYXJkd2FyZSB0eXBlcyBzdWNoIGFzIHRoZSBUUE0xLjIuDQoNClBl ciB5b3VyIG5vdGUgYmVsb3csIEkgYW0gZ3Vlc3NpbmcgdGhhdCBkcmFmdC1iaXJraG9sei1yYXRz LWJhc2ljLXlhbmctbW9kdWxlIGNvdWxkIHByb3ZpZGUgYSBxdWVyeS9yZXNwb25zZSBpbnRlcmZh Y2UgdG8gYWNjZXNzIEVBVCBpbmZvcm1hdGlvbi4gIFRoZSBOZXR3b3JrIEVsZW1lbnQncyBZQU5H IG1vZGVsIHRoZW9yZXRpY2FsbHkgY291bGQgYWxsb3cgYWNjZXNzIGJhc2VkIG9uIHdoYXRldmVy IGNob2ljZSBvZiBwcm90b2NvbHMgdGhlIE5ldHdvcmsgRWxlbWVudCBzdXBwb3J0cyAoZS5nLiwg TkVUQ09ORi9YTUwuIFJFU1RDT05GL0pTT04sIENvTUkvQ0JPUikuICBCdXQgdGhlIGNob2ljZSBh bmQgcHJvdG9jb2xzIG9mIHVzZWQgdG8gYWNjZXNzIEVBVCBvYmplY3RzIG92ZXIgYSBZQU5HIGlu dGVyZmFjZSBpcyBzb21ldGhpbmcgZWFjaCBwbGF0Zm9ybSB3b3VsZCBuZWVkIHRvIGRlZmluZS4g ICBUaGUgYmFzZWxpbmUgY2hvaWNlIGZvciBJbnRlcm9wZXJhYmlsaXR5IGhlcmUgaXMgdGJkLg0K DQpZb3UgbWVudGlvbmVkIGEgWUFORyBpbnRlcmZhY2UuIFNlZW1zIGxpa2UgYSBwb2ludCB3aGVy ZSB0aGVyZSBtaWdodCBiZSBpbnRlcm9wZXJhYmlsaXR5LiBJcyB0aGlzIGFuIGludGVyZmFjZSBv biB0aGUgcm91dGVyIHRoYXQgaXMgdXNlZCB0byBjb2xsZWN0IHRoZSBjbGFpbXMgZGF0YSBiZWZv cmUgc2lnbmluZz8gT3IgaXMgaXQgYW4gaW50ZXJmYWNlIG9uIHRoZSBiYWNrIGVuZCAvIHNlcnZl ciAvIHJlbHlpbmcgcGFydHkgdGhhdCBpcyBpbnZvbHZlZCBpbiB2YWxpZGF0aW5nIHRoZSBkYXRh PyBPciBtYXliZSBpdCBpcyB0aGUgcnBjIGludGVyYWN0aW9uIGRlZmluZWQgaW4gZHJhZnQtYmly a2hvbHotcmF0cy1iYXNpYy15YW5nLW1vZHVsZT8gSeKAmW0gbm90IHN1cmUgd2hhdCB0aGUgaW50 ZW5kZWQgZW5kcG9pbnRzIG9mIHRoYXQgUlBDIGFyZS4gUm91dGVyIGFuZCBSZWx5aW5nIFBhcnR5 Pw0KDQo8ZXJpYz4gIEl0IGlzIHRoZSBSUEMgbWVjaGFuaXNtLiAgVGhlIFJQQyBtZWNoYW5pc21z IGFsbG93IGEgcmVseWluZyBwYXJ0eSB0byBmZXRjaCBpbnRlcm5hbCBkYXRhc3RvcmUgb2JqZWN0 cyB3aXRoaW4gdGhlIFJvdXRlci4NCg0KT25lIHZlbmRvciBzcGVjaWZpYyBleGFtcGxlIG9mIGEg ZG9tYWluIHJlbGV2YW50IFlBTkcgbW9kZWwgaXMgaGVyZToNCmh0dHBzOi8vZ2l0aHViLmNvbS9Z YW5nTW9kZWxzL3lhbmcvYmxvYi9tYXN0ZXIvdmVuZG9yL2Npc2NvL3hlLzE2MTAxL0Npc2NvLUlP Uy1YRS1ib290LWludGVncml0eS1vcGVyLnlhbmcNClRoaXMgbW9kZWwgYWxsb3dzIGluZm9ybWF0 aW9uIGZyb20gd2l0aGluIGEgY3J5cHRvcHJvY2Vzc29yIHRvIGJlIGluc3BlY3RlZCBieSBib3Ro IHRoZSByb3V0ZXIgYW5kIHRoZSByZWx5aW5nIHBhcnR5ICphZnRlciogaXQgaGFzIGJlZW4gc2ln bmVkIGJ5IHRoZSBvbmUgb2YgdGhlIHJvdXRlcidzIGNyeXB0b3Byb2Nlc3NvcnMuDQoNCk5vdGU6 IHRoaXMgbW9kZWwgaXMganVzdCBvbmUgb2YgYWxtb3N0IDQwMCBZQU5HIG1vZGVscyBzdXBwb3J0 ZWQgb24gdGhhdCB0eXBlIG9mIGRldmljZToNCmh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5nTW9kZWxz L3lhbmcvdHJlZS9tYXN0ZXIvdmVuZG9yL2Npc2NvL3hlLzE2MTAxDQpMb29raW5nIGF0IHRoaXMg c2Vjb25kIGxpbmssIHlvdSBjYW4gZ2V0IGFuIGlkZWEgb2YgdGhlIGxldmVsIG9mIGludmVzdG1l bnQgcGxhY2VkIGludG8gWUFORyBieSBSb3V0ZXIgdmVuZG9ycyBhdHRlbXB0aW5nIHRvIHVuaWZ5 IHRoZSBleHBvc3VyZSBvZiBpbmZvcm1hdGlvbi4NCg0KDQpOb3cgdGhhdCB3ZSBhcmUgZ2VuZXJh bGx5IGFncmVlaW5nIHRoYXQgYW4gRUFUIGlzIGEgQ1dUIG9yIEpXVCwgdGhlIGludGVyYWN0aW9u IG1vZGVsIGJldHdlZW4gZGV2aWNlIGFuZCByZWx5aW5nIHBhcnR5IGlzIGluaGVyaXRlZCBmcm9t IHRoZW0uIE1vc3RseSB3ZeKAmXJlIGRlZmluaW5nIHRoZSBmb3JtYXQgb2YgYSBzaWduZWQgbWVz c2FnZSBhbmQgbGVhdmluZyB0aGUgdHJhbnNwb3J0IG9mIHRoZSBtZXNzYWdlIG9wZW4tZW5kZWQg c28gaXQgY2FuIGJlIGVtYmVkZGVkIGluIEhUVFAgaGVhZGVycywgcHJvdG9jb2wgZXh0ZW5zaW9u cyBhbmQgc3VjaC4gSWYgWUFORyBpcyB1c2VkIHRvIGRlZmluZSBpbnRlcmFjdGlvbiBvbiByb3V0 ZXJzLCB0aGVuIHNvbWUgWUFORyBSUEMgY291bGQgYmUgdXNlZCAoaWYgdGhhdCBpcyB3aGF0IFlB TkcgUlBDIGlzKSB0byBkZWZpbmUgdHJhbnNwb3J0IG9mIENXVHMgKGlmIENXVHMgYXJlIHVzZWQg b24gcm91dGVycykuIFRoZXJl4oCZcyBhbHNvIGRyYWZ0LWJpcmtob2x6LXJlZmVyZW5jZS1yYS1p bnRlcmFjdGlvbi1tb2RlbC4NCg0KPGVyaWM+IEkgaGF2ZSBiZWVuIHNlZWluZyBFQVQgYXMgYSB1 c2VmdWwgd2F5IHRvIGRlZmluZSB3aGF0IGNvbWVzIG91dCBvZiBjcnlwdG9wcm9jZXNzb3IgaGFy ZHdhcmUgd2hpY2ggbWlnaHQgYmUgbG9jYXRlZCBvbiBhIHJvdXRlci4gIEZvciByZWx5aW5nIHBh cnRpZXMgb3V0c2lkZSB0aGUgcm91dGVyLCB0aGUgRUFUIHJhdyBwYXlsb2FkIG1pZ2h0IGJlIGZl dGNoZWQgdGhyb3VnaCBSUEMuICBPciBwZXJoYXBzIHNvbWUgb3IgYWxsIG9mIHRoZSBjb3JyZXNw b25kaW5nIFlBTkcgb2JqZWN0cyBtaWdodCBiZSBmZXRjaGVkLiAgQWRkaXRpb25hbGx5LCBzcGVj aWZpYyBvYmplY3RzIGNvdWxkIGJlIHJlZmVyZW5jZWQgc28gdGhhdCBsb2dpYyBvbiB0aGUgcm91 dGVyIG1pZ2h0IGJlIGFwcGxpZWQgYmFzZWQgb24gdGhlIHZhbHVlIG9mIHRoYXQgb2JqZWN0LiAg IEEgZ29vZCBleGFtcGxlIHdlIGhhdmUgdGVzdGVkIGhlcmUgaXMgd2hlbiB3ZSBzZW5kIGEgbm90 aWZpY2F0aW9uIG1lc3NhZ2UgdG8gYSByZWx5aW5nIHBhcnR5IG9ubHkgd2hlbiBhIHNwZWNpZmlj IFBDUiBoYXMgY2hhbmdlZC4gIFRoaXMgbGV2ZWwgb2YgZ3JhbnVsYXJpdHkgbWVhbnMgdGhlIHJl bHlpbmcgcGFydHkgZG9lc24ndCBoYXZlIHRvIGNvbnRpbnVvdXNseSBwb2xsIGZvciB0aGUgcm91 dGVyIHRvIHNlZSBpZiB0aGUgUENSIGhhcyBjaGFuZ2VkLg0KDQoNCldoZXRoZXIgaXQgaXMgZXZl biBtZWFuaW5nZnVsL3JlbGV2YW50IHRvIHN1cHBvcnQgc3VjaCBZQU5HLUVBVCBpbnRlcm9wZXJh YmlsaXR5IGlzIHNvbWV0aGluZyBJIGRvbid0IGtub3cgeWV0LiAgRm9yIG1lIHRvIGNvbnNpZGVy IEVBVCBmb3IgaW1wbGVtZW50YXRpb24gd291bGQgbWVhbiBFQVQgaGFzIGJlZW4gYWRvcHRlZCB3 aXRoaW4gcm91dGVycy9zd2l0Y2hlcy4gICBBcyB0aGlzIGlzIHBvc3NpYmxlLCBJIGZlZWwgdGhl cmUgaXMgbGl0dGxlIGZvciB0aGUgV0cgdG8gbG9zZSBpZiB3ZSB0cnkgdG8gc2VsZWN0L2RlZmlu ZSBzb21lIGNvbW1vbiBvYmplY3RzIHdoaWNoIHNwYW4gb3VyIGRpZmZlcmVudCBkb21haW5zLg0K DQoNCkhlcmXigJlzIGNvbW1lbnRzIG9uIGEgcGFzcyB0aHJvdWdoIGRyYWZ0LWJpcmtob2x6LXJh dHMtYmFzaWMteWFuZy1tb2R1bGUNCg0KZ3JvdXBpbmcgbm9uY2Ugey4uLiBTZWVtcyBlc3NlbnRp YWxseSBjb21wYXRpYmxlIHdpdGggbm9uY2UgLyBjdGkgLyBqYWkgaW4gQ1dUIC8gSldUDQpncm91 cGluZyBwY3Itc2VsZWN0aW9uIHsuLi4gICBUUE0tc3BlY2lmaWMgc28gd2UgcHJvYmFibHkgZ28g d2l0aCB0aGUgWUFORyBkZWZpbml0aW9uDQpncm91cGluZyBwY3Itc2VsZWN0b3Igey4uLiAgIFRQ TS1zcGVjaWZpYyBzbyB3ZSBwcm9iYWJseSBnbyB3aXRoIHRoZSBZQU5HIGRlZmluaXRpb24NCmdy b3VwaW5nIHNpZ25hdHVyZS1zY2hlbWUge+KApiBFQVQgd2lsbCB1c2UgQ09TRSBmb3IgdGhpcw0K Z3JvdXBpbmcgYXR0ZXN0YXRpb24ta2V5LWlkZW50aWZpZXIge+KApiBFQVQgd2lsbCB1c2UgQ09T RSBmb3IgdGhpcw0KZ3JvdXBpbmcgdHBtLW5hbWUge+KApiBUUE0tc3BlY2lmaWMgc28gd2UgcHJv YmFibHkgZ28gd2l0aCB0aGUgWUFORyBkZWZpbml0aW9uDQpncm91cGluZyBjb21wdXRlLW5vZGUg e+KApiBJIHRoaW5rIHRoaXMgb25lIG5lZWRzIHdvcmsgdG8gZmlndXJlIG91dCB3aGF0IGl0IGlz IGFuZCBpZiBFQVTigJlzIFVFSUQgaXMgc2ltaWxhcg0KZ3JvdXBpbmcgbm9kZS11cHRpbWUge+KA piBTZWVtcyBzaW1wbGUgdG8gbWFrZSBleGFjdGx5IHRoZSBzYW1lIGZvciBFQVQNCmdyb3VwaW5n IGxvZy1pZGVudGlmaWVyIHvigKYgYW5kIGdyb3VwaW5nIGJvb3QtZXZlbnQtbG9nIHvigKYgYW5k IG90aGVyIGxvZyBzdHVmZuKApiBNYXliZSBUUE0gc3BlY2lmaWM7IG1heWJlIG5lZWRzIHdvcmsg dG8gdW5kZXJzdGFuZA0KZ3JvdXBpbmcgaW1hLWV2ZW50IHvigKYgYW5kIHJlbGF0ZWQuIFdlIGRv IHdhbnQgc29tZSBJTUEgY2xhaW1zIGluIENXVCBmb3JtYXQuIE1heWJlIHRoZXkgYXJlIHBhcnQg b2YgRUFULiBNYXliZSB0aGV5IGFyZSBzZXBhcmF0ZS4gTWF5YmUgdGhleSB1c2UgdGhlIFlBTkcg ZGVmaW5pdGlvbi4NCg0KPGVyaWM+IFRoaXMgaXMgYSBuaWNlIHN0YXJ0IG9uIHRoZSB0eXBlIG9m IGFuYWx5c2lzIEkgYW0gaG9waW5nIHRvIHNlZS4gICBJIHRoaW5rIGFzIHdlIHdvcmsgdGhpcyB0 aHJvdWdoLCB3ZSBjYW4gc2F2ZSBtYXBwaW5nIGN5Y2xlcyBmb3IgZnV0dXJlIGRldmVsb3BlcnMu DQoNClBsZWFzZSB1bmRlcnN0YW5kIHRoYXQgaW4gbm8gd2F5IGRvIEkgY2xhaW0gdGhhdCBZQU5H IGlzIHBlcmZlY3QuICBBbmQgWUFORyBtb2RlbHMgY2FuIHRha2UgeWVhcnMgdG8gY29tcGxldGUu ICAgQnV0IG9uIHRoZSBwbHVzIHNpZGUgZm9yIFlBTkcsIEkgYW0gc3VyZSBpdCBpcyBwb3NzaWJs ZSB0byBjb25zdHJ1Y3QgWUFORyBtb2RlbHMgc28gdGhhdCBuZXcgaGFyZHdhcmUgdHlwZXMgY2Fu IGJlIGluc2VydGVkLiAgSWYgeW91IHdhbnQgYSBwcmV2aWV3IG9mIHRoZSB0eXBlcyBvZiBzdHJ1 Y3R1cmUgd2hpY2ggbWlnaHQgYmUgdXNlZCBmb3IgdGhpcyB0eXBlIG9mIGV4dGVuc2liaWxpdHks IGNoZWNrIG91dCBhdCBob3cgZHJhZnQtaWV0Zi1uZXRjb25mLXlhbmctcHVzaCBhdWdtZW50cyBu ZXcgY2FzZSB0eXBlcyBpbnRvIGEgdGhlIFlBTkcgbW9kZWwgZGVzY3JpYmVkIHdpdGhpbiBkcmFm dC1pZXRmLW5ldGNvbmYtc3Vic2NyaWJlZC1ub3RpZmljYXRpb25zLg0KDQpZQU5HIG5vdCBwZXJm ZWN0Pz8gSHVoPyBXaGF0PyAgOi0pDQoNCkkgd2lzaCBzb21lIFlBTkcgZXhwZXJ0cyB3b3VsZCBj aGltZSBpbiBtb3JlIGhlcmUuIEnigJltIHRyeWluZyB0byBsZWFybiBvbiB0aGUgZmx5IGFuZCBy ZWFsbHkgc2hvdWxkIGJlIHVwZGF0aW5nIHRoZSBFQVQgZHJhZnQgaW5zdGVhZC4NCg0KPGVyaWM+ ICBJIGVuY291cmFnZSBvdGhlciBZQU5HIHZpZXdlcnMgb3V0IHRoZXJlIHRvIGNoaW1lIGluIGFz IHdlbGwuDQoNCkVyaWMNCg0KTEwNCg0KDQoNCg0KRXJpYw0KDQpGcm9tOiBMYXVyZW5jZSBMdW5k YmxhZGUsIEp1bmUgMTAsIDIwMTkgMjo1NyBQTQ0KDQoNCkhpIEVyaWMsDQoNClNvIEkgdGhpbmsg d2UgaGF2ZSBzb21lIGFncmVlbWVudCBvbiBnZW5lcmFsIHByaW5jaXBsZXMgZm9yIGhvdyB0byBz dHJ1Y3R1cmUgdGhlIGRvY3VtZW50cyB0aGlzIHdvcmsgZ3JvdXAgcHJvZHVjZXMgc28gd2UgY2Fu IGhhdmUgYm90aCBmbGV4aWJpbGl0eSBpbiB0aGUgZGVmaW5pdGlvbiBvZiBuZXcgY2xhaW1zIGFu ZCB3ZWxsLWRlZmluZWQgY29uY2lzZSBzZXRzIGNsYWltcyBmb3IgcGFydGljdWxhciB1c2UgY2Fz ZXMuDQoNCkluIHBhcnRpY3VsYXIgSSBhcHByZWNpYXRlIHRoZSBjb25maXJtYXRpb24gb2YgdGhp cyBmcm9tIE1pa2UgSm9uZXMuIEhvcGVmdWxseSBsYWNrIG9mIG9iamVjdGlvbiBpbXBsaWVzIGEg bG90IG9mIGFncmVlbWVudC4NCg0KDQpFcmljLCBJIHRoaW5rIHlvdSBhcmUgbm93IGRpZ2dpbmcg aW50byB0aGUgbmV4dCBsZXZlbCBvZiBkZXRhaWwgb24gaG93IHRvIGRlYWwgd2l0aCBUUE0tYmFz ZWQgaW1wbGVtZW50YXRpb25zIGFuZCBjbGFpbXMgc3BlY2lmaWVkIGluIFlBTkcgYW5kIGhvdyB0 aGF0IHdpbGwgaW50ZXJvcGVyYXRlIHdpdGggQ1dUL0NPU0UgYW5kIEpXVC9KT1NFIGJhc2VkIHRv a2Vucy4NCg0KSSBkb27igJl0IHJlYWxseSB1bmRlcnN0YW5kIFlBTkcgYW5kIGhvdyB0byBmdWxs eSByZWFkIGRyYWZ0LWJpcmtob2x6LXJhdHMtYmFzaWMteWFuZy1tb2R1bGUgeWV0LiBXb3JraW5n IG9uIGl0IChidXQgSSBzaG91bGQgYmUgd29ya2luZyBvbiB0aGUgbmV3IEVBVCBkcmFmdOKApikN Cg0KZHJhZnQtYmlya2hvbHotcmF0cy1iYXNpYy15YW5nLW1vZHVsZSBSRVFVSVJFUyBhIFRQTSB0 byBpbXBsZW1lbnQgaXQuIFRoYXQgaW1wbGllcyB0byBtZSB0aGF0IG5laXRoZXIgQ1dUL0NPU0Ug YW5kIEpXVC9KT1NFIHNpZ25lZCBjb250YWluZXIgZm9ybWF0cyBjYW4gYmUgdXNlZCBiZWNhdXNl IEkgZG9u4oCZdCB0aGluayBUUE3igJlzIGNhbiBwcm9kdWNlIGVpdGhlciBmb3JtYXQuIFByZXR0 eSBzdXJlIHdlIGFncmVlIHRoYXQgRUFUIHdpbGwgYWx3YXlzIGJlIENXVC9DT1NFIG9yIEpXVC9K T1NFLg0KDQooSXQgaXMgYWxzbyBvZGQgdG8gbWUgdGhhdCBhbiBJRVRGIHN0YW5kYXJkIHdvdWxk IHJlcXVpcmUgcGFydGljdWxhciBIVy4gSXQgc2hvdWxkIGp1c3QgYmUgYWJvdXQgYml0cyBvbiB0 aGUgd2lyZS4gRUFUIHdpbGwgaGF2ZSBzb21lIG1lYW5zIHRvIGluZGljYXRlIHRoZSBzZWN1cml0 eSBvZiB0aGUgSFcgYW5kIFNXIHRoYXQgcHJvZHVjZWQgYSBnaXZlbiB0b2tlbiwgYnV0IHdpbGwg bm90IHJlcXVpcmUgYW55IHBhcnRpY3VsYXIgc2VjdXJpdHkgZnJvbSB0aGUgSFcgb3IgU1cpDQoN CkJ1dCBsZXTigJlzIGFzc3VtZSB0aGF0IGEgcmVseWluZyBwYXJ0eSAoSSB0aGluayB5b3UgY2Fs bCB0aGlzIHRoZSBOZXR3b3JrIEVsZW1lbnQpIGNhbiB1bnBhY2sgYW5kIHZlcmlmeSBzaWduYXR1 cmUgdGhhdCBpbiB0aGUgZm9ybWF0IG9mIENXVCBhbmQgSldUIGFuZCB0aGUgVFBNLXN0eWxlIHNp ZyB0aGF0IEkgdGhpbmsgaXMgaW1wbGllZCBieSBkcmFmdC1iaXJraG9sei1yYXRzLWJhc2ljLXlh bmctbW9kdWxlLiBUaGUgcmVzdWx0IHdpbGwgYmUgYSBzZXQgb2YgY2xhaW1zIGluIHNvbWUgc3lu dGF4LiBJdCB3aWxsIGJlIENCT1Igb3IgSlNPTiBpbiB0aGUgY2FzZSBvZiBDV1Qgb3IgSldULg0K DQpXaGF0IHdpbGwgaXQgYmUgZm9yIGRyYWZ0LWJpcmtob2x6LXJhdHMtYmFzaWMteWFuZy1tb2R1 bGU/Pz8gWUFORy1kZXNjcmliZWQgc3R1ZmYgYW4gYmUgbG90cyBvZiBkaWZmZXJlbnQgc3ludGF4 ZXMgYnkgbXkgdW5kZXJzdGFuZGluZy4gSG93IG1hbnkgb2YgdGhlbSB3aWxsIGEgcmVseWluZyBw YXJ0eSBiZSBleHBlY3RlZCB0byBzdXBwb3J0IHNvIHRoZXJlIGlzIGludGVyb3A/DQoNCknigJlt IGdvaW5nIHRvIHN0b3AgaGVyZSBmb3IgdGhlIGFuc3dlciB0byB0aGF0IHF1ZXN0aW9uLg0KDQpM TA0KDQoNCg== --_000_DM6PR11MB4089B664568293A03AD6FD40A1ED0DM6PR11MB4089namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZp c2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5 Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAuTXNvTGlz dFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgNCgl7 bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6MGluOw0KCW1hcmdpbi1yaWdodDow aW47DQoJbWFyZ2luLWJvdHRvbTowaW47DQoJbWFyZ2luLWxlZnQ6LjVpbjsNCgltYXJnaW4tYm90 dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIs c2Fucy1zZXJpZjt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWww DQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsN CgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdp bi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmO30NCnNwYW4uYXBwbGUtY29udmVydGVkLXNwYWNlDQoJe21zby1zdHlsZS1uYW1l OmFwcGxlLWNvbnZlcnRlZC1zcGFjZTt9DQpzcGFuLkVtYWlsU3R5bGUxOQ0KCXttc28tc3R5bGUt dHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xv cjp3aW5kb3d0ZXh0O30NCnNwYW4uRW1haWxTdHlsZTIwDQoJe21zby1zdHlsZS10eXBlOnBlcnNv bmFsLWNvbXBvc2U7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6 d2luZG93dGV4dDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25s eTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWlu IDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0 aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQovKiBMaXN0IERlZmluaXRpb25zICovDQpAbGlz dCBsMA0KCXttc28tbGlzdC1pZDoxNjEwMzU1NzE5Ow0KCW1zby1saXN0LXR5cGU6aHlicmlkOw0K CW1zby1saXN0LXRlbXBsYXRlLWlkczo3NzkzODk4NTYgNjc2OTg2ODkgNjc2OTg2OTEgNjc2OTg2 OTMgNjc2OTg2ODkgNjc2OTg2OTEgNjc2OTg2OTMgNjc2OTg2ODkgNjc2OTg2OTEgNjc2OTg2OTM7 fQ0KQGxpc3QgbDA6bGV2ZWwxDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCglt c28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWls eTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1 bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1z by1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9u dC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDMNCgl7bXNvLWxldmVsLW51 bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFi LXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRl bnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDQNCgl7 bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCglt c28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDps ZXZlbDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0 Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlv bjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseToiQ291cmllciBOZXci O30NCkBsaXN0IGwwOmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJ bXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZl bC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1p bHk6V2luZ2RpbmdzO30NCkBsaXN0IGwwOmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1h dDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25l Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47 DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsOA0KCXttc28tbGV2ZWwtbnVt YmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWw5DQoJ e21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJ bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0 Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0Kb2wNCgl7 bWFyZ2luLWJvdHRvbTowaW47fQ0KdWwNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KLS0+PC9zdHls ZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQi IHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+ PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0 IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFk Pg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBj bGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJj b2xvcjojNTQ4MjM1O21zby1zdHlsZS10ZXh0ZmlsbC1maWxsLWNvbG9yOiM1NDgyMzU7bXNvLXN0 eWxlLXRleHRmaWxsLWZpbGwtYWxwaGE6MTAwLjAlIj5IaSBMYXVyZW5jZSw8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48bzpwPiZuYnNwOzwvbzpwPjwvYj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5Gcm9tOjwvYj4gTGF1cmVuY2UgTHVuZGJsYWRl LCBKdW5lIDExLCAyMDE5IDExOjIxIEFNPGJyPg0KPGJyPg0KPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5IaSBFcmljLDxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+V2hhdCBJ4oCZbSB0cnlpbmcgdG8gZmlndXJlIG91dCBoZXJlIGlzIHdo ZXJlIHRoZXJlIGNhbiBiZSByZWFsIHByYWN0aWNhbCBpbnRlcm9wZXJhYmlsaXR5IHdpdGggZXh0 YW50IFlBTkctZGVmaW5lZCBvYmplY3RzIGFuZCBob3cgd2UgZ28gYWJvdXQgaXQgYXMgSSBhc3N1 bWUgdGhpcyBpcyB5b3VyIGN1cnJlbnQgb2JqZWN0aW9uIHRvIGFkb3B0aW9uLjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzU0ODIzNTtt c28tc3R5bGUtdGV4dGZpbGwtZmlsbC1jb2xvcjojNTQ4MjM1O21zby1zdHlsZS10ZXh0ZmlsbC1m aWxsLWFscGhhOjEwMC4wJSI+Jmx0O2VyaWMmZ3Q7IEkgY2VydGFpbmx5IGludGVuZGVkIG5vIGFy Z3VtZW50IGFnYWluc3QgYWRvcHRpb24uJm5ic3A7IEkgZGlkIHZvdGUgaW4gZmF2b3Igb2YgYWRv cHRpb24uJm5ic3A7IEl0IHdhcyBqdXN0IHRoYXQgSSB3YW50IHRvIHNlZSB0aGlzIHRvcGljDQog YWRkcmVzc2VkIGFzIHBhcnQgb2YgdGhlIGRyYWZ0J3MgcHJvZ3Jlc3Npb24uJm5ic3A7IEkgdGhp bmsgdGhlIHZvdGUgc3VtbWFyeSBmcm9tIEthdGhsZWVuIGNvdmVycyBteSBkZXNpcmUganVzdCBm aW5lLjwvc3Bhbj48YnI+DQo8YnI+DQo8c3BhbiBzdHlsZT0iY29sb3I6IzU0ODIzNTttc28tc3R5 bGUtdGV4dGZpbGwtZmlsbC1jb2xvcjojNTQ4MjM1O21zby1zdHlsZS10ZXh0ZmlsbC1maWxsLWFs cGhhOjEwMC4wJSI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4N CjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQi Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIEp1biAxMCwgMjAxOSwgYXQgMjoyMyBQ TSwgRXJpYyBWb2l0IChldm9pdCkgJmx0OzxhIGhyZWY9Im1haWx0bzpldm9pdEBjaXNjby5jb20i PmV2b2l0QGNpc2NvLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+SGkgTGF1cmVuY2UsPG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkl0IGlzIHRydWUgdGhhdCB0aGUgWUFORyBv ZiBkcmFmdC1iaXJraG9sei1yYXRzLWJhc2ljLXlhbmctbW9kdWxlIGlzIGN1cnJlbnRseSBUUE0y IHNwZWNpZmljLiZuYnNwOyBCdXQgb3ZlciB0aGUgcGFzdCBtb250aCB3ZSBoYXZlIGJlZW4gaGF2 aW5nIGRpc2N1c3Npb25zIG9uIGhvdyB0byBhdWdtZW50IGludG8gdGhpcyBtb2RlbCBjYXNlIHN0 YXRlbWVudHMgYW5kIGEgdHJlZSBzdHJ1Y3R1cmUgd2hpY2ggYWxsb3dzIGV4cG9zdXJlDQogb2Yg aW5mb3JtYXRpb24gZnJvbSBhbHRlcm5hdGl2ZSBoYXJkd2FyZSB0eXBlcyBzdWNoIGFzIHRoZSBU UE0xLjIuJm5ic3A7PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxibG9j a3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+UGVyIHlvdXIgbm90ZSBiZWxvdywgSSBhbSBndWVz c2luZyB0aGF0IGRyYWZ0LWJpcmtob2x6LXJhdHMtYmFzaWMteWFuZy1tb2R1bGUgY291bGQgcHJv dmlkZSBhIHF1ZXJ5L3Jlc3BvbnNlIGludGVyZmFjZSB0byBhY2Nlc3MgRUFUIGluZm9ybWF0aW9u LiZuYnNwOyBUaGUgTmV0d29yayBFbGVtZW50J3MgWUFORyBtb2RlbCB0aGVvcmV0aWNhbGx5IGNv dWxkIGFsbG93IGFjY2VzcyBiYXNlZCBvbiB3aGF0ZXZlciBjaG9pY2UNCiBvZiBwcm90b2NvbHMg dGhlIE5ldHdvcmsgRWxlbWVudCBzdXBwb3J0cyAoZS5nLiwgTkVUQ09ORi9YTUwuIFJFU1RDT05G L0pTT04sIENvTUkvQ0JPUikuICZuYnNwO0J1dCB0aGUgY2hvaWNlIGFuZCBwcm90b2NvbHMgb2Yg dXNlZCB0byBhY2Nlc3MgRUFUIG9iamVjdHMgb3ZlciBhIFlBTkcgaW50ZXJmYWNlIGlzIHNvbWV0 aGluZyBlYWNoIHBsYXRmb3JtIHdvdWxkIG5lZWQgdG8gZGVmaW5lLiAmbmJzcDsmbmJzcDtUaGUg YmFzZWxpbmUgY2hvaWNlIGZvciBJbnRlcm9wZXJhYmlsaXR5DQogaGVyZSBpcyB0YmQuPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPllvdSBtZW50aW9uZWQgYSBZQU5HIGludGVyZmFjZS4gU2VlbXMgbGlrZSBhIHBvaW50 IHdoZXJlIHRoZXJlIG1pZ2h0IGJlIGludGVyb3BlcmFiaWxpdHkuIElzIHRoaXMgYW4gaW50ZXJm YWNlIG9uIHRoZSByb3V0ZXIgdGhhdCBpcyB1c2VkIHRvIGNvbGxlY3QgdGhlIGNsYWltcyBkYXRh IGJlZm9yZSBzaWduaW5nPyBPciBpcyBpdCBhbiBpbnRlcmZhY2Ugb24gdGhlIGJhY2sgZW5kIC8g c2VydmVyIC8gcmVseWluZw0KIHBhcnR5IHRoYXQgaXMgaW52b2x2ZWQgaW4gdmFsaWRhdGluZyB0 aGUgZGF0YT8gT3IgbWF5YmUgaXQgaXMgdGhlIHJwYyBpbnRlcmFjdGlvbiBkZWZpbmVkIGluJm5i c3A7ZHJhZnQtYmlya2hvbHotcmF0cy1iYXNpYy15YW5nLW1vZHVsZT8gSeKAmW0gbm90IHN1cmUg d2hhdCB0aGUgaW50ZW5kZWQgZW5kcG9pbnRzIG9mIHRoYXQgUlBDIGFyZS4gUm91dGVyIGFuZCBS ZWx5aW5nIFBhcnR5PyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Y29sb3I6IzU0ODIzNTttc28tc3R5bGUtdGV4dGZpbGwtZmlsbC1jb2xvcjojNTQ4MjM1O21zby1z dHlsZS10ZXh0ZmlsbC1maWxsLWFscGhhOjEwMC4wJSI+Jmx0O2VyaWMmZ3Q7Jm5ic3A7IEl0IGlz IHRoZSBSUEMgbWVjaGFuaXNtLiZuYnNwOyBUaGUgUlBDIG1lY2hhbmlzbXMgYWxsb3cgYSByZWx5 aW5nIHBhcnR5IHRvIGZldGNoIGludGVybmFsIGRhdGFzdG9yZSBvYmplY3RzIHdpdGhpbiB0aGUg Um91dGVyLiZuYnNwOyZuYnNwOyZuYnNwOw0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiM1NDgyMzU7bXNvLXN0eWxlLXRleHRm aWxsLWZpbGwtY29sb3I6IzU0ODIzNTttc28tc3R5bGUtdGV4dGZpbGwtZmlsbC1hbHBoYToxMDAu MCUiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJjb2xvcjojNTQ4MjM1O21zby1zdHlsZS10ZXh0ZmlsbC1maWxsLWNvbG9yOiM1 NDgyMzU7bXNvLXN0eWxlLXRleHRmaWxsLWZpbGwtYWxwaGE6MTAwLjAlIj5PbmUgdmVuZG9yIHNw ZWNpZmljIGV4YW1wbGUgb2YgYSBkb21haW4gcmVsZXZhbnQgWUFORyBtb2RlbCBpcyBoZXJlOjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxhIGhyZWY9Imh0dHBz Oi8vZ2l0aHViLmNvbS9ZYW5nTW9kZWxzL3lhbmcvYmxvYi9tYXN0ZXIvdmVuZG9yL2Npc2NvL3hl LzE2MTAxL0Npc2NvLUlPUy1YRS1ib290LWludGVncml0eS1vcGVyLnlhbmciPmh0dHBzOi8vZ2l0 aHViLmNvbS9ZYW5nTW9kZWxzL3lhbmcvYmxvYi9tYXN0ZXIvdmVuZG9yL2Npc2NvL3hlLzE2MTAx L0Npc2NvLUlPUy1YRS1ib290LWludGVncml0eS1vcGVyLnlhbmc8L2E+DQo8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojNTQ4MjM1O21zby1z dHlsZS10ZXh0ZmlsbC1maWxsLWNvbG9yOiM1NDgyMzU7bXNvLXN0eWxlLXRleHRmaWxsLWZpbGwt YWxwaGE6MTAwLjAlIj5UaGlzIG1vZGVsIGFsbG93cyBpbmZvcm1hdGlvbiBmcm9tIHdpdGhpbiBh IGNyeXB0b3Byb2Nlc3NvciB0byBiZSBpbnNwZWN0ZWQgYnkgYm90aCB0aGUgcm91dGVyIGFuZCB0 aGUgcmVseWluZyBwYXJ0eSAqYWZ0ZXIqIGl0IGhhcyBiZWVuDQogc2lnbmVkIGJ5IHRoZSBvbmUg b2YgdGhlIHJvdXRlcidzIGNyeXB0b3Byb2Nlc3NvcnMuPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiM1NDgyMzU7bXNvLXN0eWxl LXRleHRmaWxsLWZpbGwtY29sb3I6IzU0ODIzNTttc28tc3R5bGUtdGV4dGZpbGwtZmlsbC1hbHBo YToxMDAuMCUiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojNTQ4MjM1O21zby1zdHlsZS10ZXh0ZmlsbC1maWxsLWNv bG9yOiM1NDgyMzU7bXNvLXN0eWxlLXRleHRmaWxsLWZpbGwtYWxwaGE6MTAwLjAlIj5Ob3RlOiB0 aGlzIG1vZGVsIGlzIGp1c3Qgb25lIG9mIGFsbW9zdCA0MDAgWUFORyBtb2RlbHMgc3VwcG9ydGVk IG9uIHRoYXQgdHlwZSBvZiBkZXZpY2U6PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PGEgaHJlZj0iaHR0cHM6Ly9naXRodWIuY29tL1lhbmdNb2RlbHMveWFuZy90 cmVlL21hc3Rlci92ZW5kb3IvY2lzY28veGUvMTYxMDEiPmh0dHBzOi8vZ2l0aHViLmNvbS9ZYW5n TW9kZWxzL3lhbmcvdHJlZS9tYXN0ZXIvdmVuZG9yL2Npc2NvL3hlLzE2MTAxPC9hPg0KPHNwYW4g c3R5bGU9ImNvbG9yOiM1NDgyMzU7bXNvLXN0eWxlLXRleHRmaWxsLWZpbGwtY29sb3I6IzU0ODIz NTttc28tc3R5bGUtdGV4dGZpbGwtZmlsbC1hbHBoYToxMDAuMCUiPg0KPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiM1NDgyMzU7 bXNvLXN0eWxlLXRleHRmaWxsLWZpbGwtY29sb3I6IzU0ODIzNTttc28tc3R5bGUtdGV4dGZpbGwt ZmlsbC1hbHBoYToxMDAuMCUiPkxvb2tpbmcgYXQgdGhpcyBzZWNvbmQgbGluaywgeW91IGNhbiBn ZXQgYW4gaWRlYSBvZiB0aGUgbGV2ZWwgb2YgaW52ZXN0bWVudCBwbGFjZWQgaW50byBZQU5HIGJ5 IFJvdXRlciB2ZW5kb3JzIGF0dGVtcHRpbmcgdG8gdW5pZnkgdGhlDQogZXhwb3N1cmUgb2YgaW5m b3JtYXRpb24uPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi Pk5vdyB0aGF0IHdlIGFyZSBnZW5lcmFsbHkgYWdyZWVpbmcgdGhhdCBhbiBFQVQgaXMgYSBDV1Qg b3IgSldULCB0aGUgaW50ZXJhY3Rpb24gbW9kZWwgYmV0d2VlbiBkZXZpY2UgYW5kIHJlbHlpbmcg cGFydHkgaXMgaW5oZXJpdGVkIGZyb20gdGhlbS4gTW9zdGx5IHdl4oCZcmUgZGVmaW5pbmcgdGhl IGZvcm1hdCBvZiBhIHNpZ25lZCBtZXNzYWdlIGFuZCBsZWF2aW5nIHRoZSB0cmFuc3BvcnQgb2Yg dGhlIG1lc3NhZ2UNCiBvcGVuLWVuZGVkIHNvIGl0IGNhbiBiZSBlbWJlZGRlZCBpbiBIVFRQIGhl YWRlcnMsIHByb3RvY29sIGV4dGVuc2lvbnMgYW5kIHN1Y2guIElmIFlBTkcgaXMgdXNlZCB0byBk ZWZpbmUgaW50ZXJhY3Rpb24gb24gcm91dGVycywgdGhlbiBzb21lIFlBTkcgUlBDIGNvdWxkIGJl IHVzZWQgKGlmIHRoYXQgaXMgd2hhdCBZQU5HIFJQQyBpcykgdG8gZGVmaW5lIHRyYW5zcG9ydCBv ZiBDV1RzIChpZiBDV1RzIGFyZSB1c2VkIG9uIHJvdXRlcnMpLiBUaGVyZeKAmXMNCiBhbHNvJm5i c3A7ZHJhZnQtYmlya2hvbHotcmVmZXJlbmNlLXJhLWludGVyYWN0aW9uLW1vZGVsLjxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiM1NDgyMzU7 bXNvLXN0eWxlLXRleHRmaWxsLWZpbGwtY29sb3I6IzU0ODIzNTttc28tc3R5bGUtdGV4dGZpbGwt ZmlsbC1hbHBoYToxMDAuMCUiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojNTQ4MjM1O21zby1zdHlsZS10ZXh0Zmls bC1maWxsLWNvbG9yOiM1NDgyMzU7bXNvLXN0eWxlLXRleHRmaWxsLWZpbGwtYWxwaGE6MTAwLjAl Ij4mbHQ7ZXJpYyZndDsgSSBoYXZlIGJlZW4gc2VlaW5nIEVBVCBhcyBhIHVzZWZ1bCB3YXkgdG8g ZGVmaW5lIHdoYXQgY29tZXMgb3V0IG9mIGNyeXB0b3Byb2Nlc3NvciBoYXJkd2FyZSB3aGljaCBt aWdodCBiZSBsb2NhdGVkIG9uIGEgcm91dGVyLiZuYnNwOw0KIEZvciByZWx5aW5nIHBhcnRpZXMg b3V0c2lkZSB0aGUgcm91dGVyLCB0aGUgRUFUIHJhdyBwYXlsb2FkIG1pZ2h0IGJlIGZldGNoZWQg dGhyb3VnaCBSUEMuJm5ic3A7IE9yIHBlcmhhcHMgc29tZSBvciBhbGwgb2YgdGhlIGNvcnJlc3Bv bmRpbmcgWUFORyBvYmplY3RzIG1pZ2h0IGJlIGZldGNoZWQuICZuYnNwO0FkZGl0aW9uYWxseSwg c3BlY2lmaWMgb2JqZWN0cyBjb3VsZCBiZSByZWZlcmVuY2VkIHNvIHRoYXQgbG9naWMgb24gdGhl IHJvdXRlciBtaWdodCBiZSBhcHBsaWVkDQogYmFzZWQgb24gdGhlIHZhbHVlIG9mIHRoYXQgb2Jq ZWN0LiZuYnNwOyZuYnNwOyBBIGdvb2QgZXhhbXBsZSB3ZSBoYXZlIHRlc3RlZCBoZXJlIGlzIHdo ZW4gd2Ugc2VuZCBhIG5vdGlmaWNhdGlvbiBtZXNzYWdlIHRvIGEgcmVseWluZyBwYXJ0eSBvbmx5 IHdoZW4gYSBzcGVjaWZpYyBQQ1IgaGFzIGNoYW5nZWQuJm5ic3A7IFRoaXMgbGV2ZWwgb2YgZ3Jh bnVsYXJpdHkgbWVhbnMgdGhlIHJlbHlpbmcgcGFydHkgZG9lc24ndCBoYXZlIHRvIGNvbnRpbnVv dXNseSBwb2xsIGZvcg0KIHRoZSByb3V0ZXIgdG8gc2VlIGlmIHRoZSBQQ1IgaGFzIGNoYW5nZWQu IDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9t OjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPldoZXRoZXIgaXQgaXMgZXZl biBtZWFuaW5nZnVsL3JlbGV2YW50IHRvIHN1cHBvcnQgc3VjaCBZQU5HLUVBVCBpbnRlcm9wZXJh YmlsaXR5IGlzIHNvbWV0aGluZyBJIGRvbid0IGtub3cgeWV0LiZuYnNwOyBGb3IgbWUgdG8gY29u c2lkZXIgRUFUIGZvciBpbXBsZW1lbnRhdGlvbiB3b3VsZCBtZWFuIEVBVCBoYXMgYmVlbiBhZG9w dGVkIHdpdGhpbiByb3V0ZXJzL3N3aXRjaGVzLiAmbmJzcDsmbmJzcDtBcyB0aGlzIGlzIHBvc3Np YmxlLCBJDQogZmVlbCB0aGVyZSBpcyBsaXR0bGUgZm9yIHRoZSBXRyB0byBsb3NlIGlmIHdlIHRy eSB0byBzZWxlY3QvZGVmaW5lIHNvbWUgY29tbW9uIG9iamVjdHMgd2hpY2ggc3BhbiBvdXIgZGlm ZmVyZW50IGRvbWFpbnMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SGVyZeKAmXMgY29tbWVudHMgb24gYSBwYXNz IHRocm91Z2gmbmJzcDtkcmFmdC1iaXJraG9sei1yYXRzLWJhc2ljLXlhbmctbW9kdWxlPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5n cm91cGluZyBub25jZSB7Li4uJm5ic3A7U2VlbXMgZXNzZW50aWFsbHkgY29tcGF0aWJsZSB3aXRo IG5vbmNlIC8gY3RpIC8gamFpIGluIENXVCAvIEpXVDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Z3JvdXBpbmcgcGNyLXNlbGVjdGlvbiB7Li4uICZu YnNwOyZuYnNwO1RQTS1zcGVjaWZpYyBzbyB3ZSBwcm9iYWJseSBnbyB3aXRoIHRoZSBZQU5HIGRl ZmluaXRpb248bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPmdyb3VwaW5nIHBjci1zZWxlY3RvciB7Li4uICZuYnNwOyZuYnNwO1RQTS1zcGVjaWZpYyBz byB3ZSBwcm9iYWJseSBnbyB3aXRoIHRoZSBZQU5HIGRlZmluaXRpb248bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPmdyb3VwaW5nIHNpZ25hdHVyZS1z Y2hlbWUge+KApiBFQVQgd2lsbCB1c2UgQ09TRSBmb3IgdGhpczxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Z3JvdXBpbmcgYXR0ZXN0YXRpb24ta2V5 LWlkZW50aWZpZXIge+KApiBFQVQgd2lsbCB1c2UgQ09TRSBmb3IgdGhpczxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5ncm91cGluZyB0 cG0tbmFtZSB74oCmIFRQTS1zcGVjaWZpYyBzbyB3ZSBwcm9iYWJseSBnbyB3aXRoIHRoZSBZQU5H IGRlZmluaXRpb248bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPmdyb3VwaW5nIGNvbXB1dGUtbm9kZSB74oCmIEkgdGhpbmsgdGhpcyBvbmUgbmVlZHMg d29yayB0byBmaWd1cmUgb3V0IHdoYXQgaXQgaXMgYW5kIGlmIEVBVOKAmXMgVUVJRCBpcyBzaW1p bGFyPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5n cm91cGluZyBub2RlLXVwdGltZSB74oCmIFNlZW1zIHNpbXBsZSB0byBtYWtlIGV4YWN0bHkgdGhl IHNhbWUgZm9yIEVBVDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+Z3JvdXBpbmcgbG9nLWlkZW50aWZpZXIge+KApiBhbmQgZ3JvdXBpbmcgYm9vdC1l dmVudC1sb2cge+KApiBhbmQgb3RoZXIgbG9nIHN0dWZm4oCmIE1heWJlIFRQTSBzcGVjaWZpYzsg bWF5YmUgbmVlZHMgd29yayB0byB1bmRlcnN0YW5kPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5ncm91cGluZyBpbWEtZXZlbnQge+KApiBhbmQgcmVs YXRlZC4gV2UgZG8gd2FudCBzb21lIElNQSBjbGFpbXMgaW4gQ1dUIGZvcm1hdC4gTWF5YmUgdGhl eSBhcmUgcGFydCBvZiBFQVQuIE1heWJlIHRoZXkgYXJlIHNlcGFyYXRlLiBNYXliZSB0aGV5IHVz ZSB0aGUgWUFORyBkZWZpbml0aW9uLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6IzU0ODIzNTttc28tc3R5bGUtdGV4dGZpbGwt ZmlsbC1jb2xvcjojNTQ4MjM1O21zby1zdHlsZS10ZXh0ZmlsbC1maWxsLWFscGhhOjEwMC4wJSI+ Jmx0O2VyaWMmZ3Q7IFRoaXMgaXMgYSBuaWNlIHN0YXJ0IG9uIHRoZSB0eXBlIG9mIGFuYWx5c2lz IEkgYW0gaG9waW5nIHRvIHNlZS4mbmJzcDsgJm5ic3A7SSB0aGluayBhcyB3ZSB3b3JrIHRoaXMg dGhyb3VnaCwgd2UgY2FuIHNhdmUgbWFwcGluZyBjeWNsZXMNCiBmb3IgZnV0dXJlIGRldmVsb3Bl cnMuJm5ic3A7IDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5 bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5QbGVhc2UgdW5kZXJzdGFuZCB0aGF0IGluIG5vIHdheSBkbyBJIGNs YWltIHRoYXQgWUFORyBpcyBwZXJmZWN0LiAmbmJzcDtBbmQgWUFORyBtb2RlbHMgY2FuIHRha2Ug eWVhcnMgdG8gY29tcGxldGUuJm5ic3A7Jm5ic3A7IEJ1dCBvbiB0aGUgcGx1cyBzaWRlIGZvciBZ QU5HLCBJIGFtIHN1cmUgaXQgaXMgcG9zc2libGUgdG8gY29uc3RydWN0IFlBTkcgbW9kZWxzIHNv IHRoYXQgbmV3IGhhcmR3YXJlIHR5cGVzIGNhbiBiZSBpbnNlcnRlZC4mbmJzcDsNCiBJZiB5b3Ug d2FudCBhIHByZXZpZXcgb2YgdGhlIHR5cGVzIG9mIHN0cnVjdHVyZSB3aGljaCBtaWdodCBiZSB1 c2VkIGZvciB0aGlzIHR5cGUgb2YgZXh0ZW5zaWJpbGl0eSwgY2hlY2sgb3V0IGF0IGhvdyBkcmFm dC1pZXRmLW5ldGNvbmYteWFuZy1wdXNoIGF1Z21lbnRzIG5ldyBjYXNlIHR5cGVzIGludG8gYSB0 aGUgWUFORyBtb2RlbCBkZXNjcmliZWQgd2l0aGluIGRyYWZ0LWlldGYtbmV0Y29uZi1zdWJzY3Jp YmVkLW5vdGlmaWNhdGlvbnMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPllBTkcgbm90IHBlcmZlY3Q/PyBIdWg/IFdo YXQ/ICZuYnNwOzotKTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5JIHdpc2ggc29tZSBZQU5HIGV4cGVydHMgd291bGQgY2hpbWUgaW4gbW9yZSBo ZXJlLiBJ4oCZbSB0cnlpbmcgdG8gbGVhcm4gb24gdGhlIGZseSBhbmQgcmVhbGx5IHNob3VsZCBi ZSB1cGRhdGluZyB0aGUgRUFUIGRyYWZ0IGluc3RlYWQuPG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJjb2xvcjojNTQ4MjM1O21zby1zdHlsZS10ZXh0ZmlsbC1maWxsLWNvbG9y OiM1NDgyMzU7bXNvLXN0eWxlLXRleHRmaWxsLWZpbGwtYWxwaGE6MTAwLjAlIj4mbHQ7ZXJpYyZn dDsmbmJzcDsgSSBlbmNvdXJhZ2Ugb3RoZXIgWUFORyB2aWV3ZXJzIG91dCB0aGVyZSB0byBjaGlt ZSBpbiBhcyB3ZWxsLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIHN0eWxlPSJjb2xvcjojNTQ4MjM1O21zby1zdHlsZS10ZXh0ZmlsbC1maWxsLWNvbG9y OiM1NDgyMzU7bXNvLXN0eWxlLXRleHRmaWxsLWZpbGwtYWxwaGE6MTAwLjAlIj48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29s b3I6IzU0ODIzNTttc28tc3R5bGUtdGV4dGZpbGwtZmlsbC1jb2xvcjojNTQ4MjM1O21zby1zdHls ZS10ZXh0ZmlsbC1maWxsLWFscGhhOjEwMC4wJSI+RXJpYzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+TEw8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YnI+DQo8YnI+DQo8bzpwPjwvbzpwPjwv cD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4w cHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+RXJpYzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkIGJsdWUg MS41cHQ7cGFkZGluZzowaW4gMGluIDBpbiA0LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PGI+RnJvbTo8L2I+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5i c3A7PC9zcGFuPkxhdXJlbmNlIEx1bmRibGFkZSwgSnVuZSAxMCwgMjAxOSAyOjU3IFBNPGJyPg0K PGJyPg0KPGJyPg0KPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+SGkgRXJpYyw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U28gSSB0 aGluayB3ZSBoYXZlIHNvbWUgYWdyZWVtZW50IG9uIGdlbmVyYWwgcHJpbmNpcGxlcyBmb3IgaG93 IHRvIHN0cnVjdHVyZSB0aGUgZG9jdW1lbnRzIHRoaXMgd29yayBncm91cCBwcm9kdWNlcyBzbyB3 ZSBjYW4gaGF2ZSBib3RoIGZsZXhpYmlsaXR5IGluIHRoZSBkZWZpbml0aW9uIG9mIG5ldyBjbGFp bXM8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGk+YW5k PC9pPiZuYnNwO3dlbGwtZGVmaW5lZA0KIGNvbmNpc2Ugc2V0cyBjbGFpbXMgZm9yIHBhcnRpY3Vs YXIgdXNlIGNhc2VzLiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JbiBwYXJ0aWN1 bGFyIEkgYXBwcmVjaWF0ZSB0aGUgY29uZmlybWF0aW9uIG9mIHRoaXMgZnJvbSBNaWtlIEpvbmVz LiBIb3BlZnVsbHkgbGFjayBvZiBvYmplY3Rpb24gaW1wbGllcyBhIGxvdCBvZiBhZ3JlZW1lbnQu Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+RXJpYywg SSB0aGluayB5b3UgYXJlIG5vdyBkaWdnaW5nIGludG8gdGhlIG5leHQgbGV2ZWwgb2YgZGV0YWls IG9uIGhvdyB0byBkZWFsIHdpdGggVFBNLWJhc2VkIGltcGxlbWVudGF0aW9ucyBhbmQgY2xhaW1z IHNwZWNpZmllZCBpbiBZQU5HIGFuZCBob3cgdGhhdCB3aWxsIGludGVyb3BlcmF0ZSB3aXRoIENX VC9DT1NFIGFuZCBKV1QvSk9TRSBiYXNlZCB0b2tlbnMuPG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPkkgZG9u4oCZdCByZWFsbHkgdW5kZXJzdGFuZCBZQU5HIGFuZCBob3cgdG8gZnVsbHkgcmVh ZCBkcmFmdC1iaXJraG9sei1yYXRzLWJhc2ljLXlhbmctbW9kdWxlIHlldC4gV29ya2luZyBvbiBp dCAoYnV0IEkgc2hvdWxkIGJlIHdvcmtpbmcgb24gdGhlIG5ldyBFQVQgZHJhZnTigKYpPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5kcmFmdC1iaXJraG9sei1yYXRzLWJhc2ljLXlh bmctbW9kdWxlIFJFUVVJUkVTIGEgVFBNIHRvIGltcGxlbWVudCBpdC4gVGhhdCBpbXBsaWVzIHRv IG1lIHRoYXQgbmVpdGhlciBDV1QvQ09TRSBhbmQgSldUL0pPU0Ugc2lnbmVkIGNvbnRhaW5lciBm b3JtYXRzIGNhbiBiZSB1c2VkIGJlY2F1c2UgSSBkb27igJl0IHRoaW5rIFRQTeKAmXMgY2FuIHBy b2R1Y2UgZWl0aGVyIGZvcm1hdC4gUHJldHR5IHN1cmUgd2UgYWdyZWUNCiB0aGF0IEVBVCB3aWxs IGFsd2F5cyBiZSBDV1QvQ09TRSBvciBKV1QvSk9TRS4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj4oSXQgaXMgYWxzbyBvZGQgdG8gbWUgdGhhdCBhbiBJRVRGIHN0YW5k YXJkIHdvdWxkIHJlcXVpcmUgcGFydGljdWxhciBIVy4gSXQgc2hvdWxkIGp1c3QgYmUgYWJvdXQg Yml0cyBvbiB0aGUgd2lyZS4gRUFUIHdpbGwgaGF2ZSBzb21lIG1lYW5zIHRvIGluZGljYXRlIHRo ZSBzZWN1cml0eSBvZiB0aGUgSFcgYW5kIFNXIHRoYXQgcHJvZHVjZWQgYSBnaXZlbiB0b2tlbiwg YnV0IHdpbGwgbm90IHJlcXVpcmUgYW55DQogcGFydGljdWxhciBzZWN1cml0eSBmcm9tIHRoZSBI VyBvciBTVyk8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QnV0IGxldOKAmXMgYXNzdW1lIHRo YXQgYSByZWx5aW5nIHBhcnR5IChJIHRoaW5rIHlvdSBjYWxsIHRoaXMgdGhlIE5ldHdvcmsgRWxl bWVudCkgY2FuIHVucGFjayBhbmQgdmVyaWZ5IHNpZ25hdHVyZSB0aGF0IGluIHRoZSBmb3JtYXQg b2YgQ1dUIGFuZCBKV1QgYW5kIHRoZSBUUE0tc3R5bGUgc2lnIHRoYXQgSSB0aGluayBpcyBpbXBs aWVkIGJ5IGRyYWZ0LWJpcmtob2x6LXJhdHMtYmFzaWMteWFuZy1tb2R1bGUuDQogVGhlIHJlc3Vs dCB3aWxsIGJlIGEgc2V0IG9mIGNsYWltcyBpbiBzb21lIHN5bnRheC4gSXQgd2lsbCBiZSBDQk9S IG9yIEpTT04gaW4gdGhlIGNhc2Ugb2YgQ1dUIG9yIEpXVC4mbmJzcDs8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+V2hhdCB3aWxsIGl0IGJlIGZvciBkcmFmdC1iaXJraG9sei1yYXRzLWJhc2lj LXlhbmctbW9kdWxlPz8/IFlBTkctZGVzY3JpYmVkIHN0dWZmIGFuIGJlIGxvdHMgb2YgZGlmZmVy ZW50IHN5bnRheGVzIGJ5IG15IHVuZGVyc3RhbmRpbmcuIEhvdyBtYW55IG9mIHRoZW0gd2lsbCBh IHJlbHlpbmcgcGFydHkgYmUgZXhwZWN0ZWQgdG8gc3VwcG9ydCBzbyB0aGVyZSBpcyBpbnRlcm9w PzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5J4oCZbSBnb2luZyB0byBzdG9wIGhlcmUgZm9y IHRoZSBhbnN3ZXIgdG8gdGhhdCBxdWVzdGlvbi48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9k aXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ TEw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2 Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_DM6PR11MB4089B664568293A03AD6FD40A1ED0DM6PR11MB4089namp_-- From nobody Wed Jun 12 10:18:26 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E43D712022C for ; Wed, 12 Jun 2019 10:18:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.888 X-Spam-Level: X-Spam-Status: No, score=-1.888 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, T_SPF_TEMPERROR=0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YwFsSZpCWizn for ; Wed, 12 Jun 2019 10:18:13 -0700 (PDT) Received: from p3plsmtpa12-10.prod.phx3.secureserver.net (p3plsmtpa12-10.prod.phx3.secureserver.net [68.178.252.239]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 35D2012021B for ; Wed, 12 Jun 2019 10:18:12 -0700 (PDT) Received: from [192.168.1.82] ([76.192.164.238]) by :SMTPAUTH: with ESMTPA id b6t0hn87T3F4bb6t1hiCkB; Wed, 12 Jun 2019 10:18:12 -0700 From: Laurence Lundblade Message-Id: <8A8FF2AF-C5CA-471A-ABA2-A3E630448A75@island-resort.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_3150D9F5-A161-4346-9349-250BDD0531E4" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Wed, 12 Jun 2019 10:18:10 -0700 In-Reply-To: Cc: Michael Richardson , Hannes Tschofenig , "rats@ietf.org" , Henk Birkholz , Mike Jones To: "Eric Voit (evoit)" References: <12913.1559739926@localhost> <30754CD8-98AB-4080-952E-880BC630EC69@island-resort.com> <902E75D8-D8AC-403B-A295-0EC3034E44B2@island-resort.com> <8AA62B47-28EA-4D9D-B103-DBD1F3964BAF@island-resort.com> X-Mailer: Apple Mail (2.3445.9.1) X-CMAE-Envelope: MS4wfJoU9RJ/0QHsTzl7GbTGrWfW/8otrOytnagV7U+Jzipg4nCwQ9BT6Q9AAW6qjvo9wpzAWJks2SHNA1dKlESBGevdz76wMjO2n7aSu273Vzus8m4c2jmb H6HDVYTGMf5+3z3RJTLE/Jia6WODJln1iDBNZFptP1d+m+RrRR8qX1RS5xldYiYM2e7AevC6b86EroE8vllmTvrS9mtr9+F6q58rUmkJe+cpUwp3T6Gr4ZBk 1xO0q46JTK3LFYzGRNYvbZVBMJWf6Op8uq4ZqXXUntlItMzyGtU5xeojPdGLGjNI0pKiUQGnJwogttSaX+nwfZ1hTk1azHsKxUBTPonbUBU1m6yODqnNitqX qZRhyhIqeE4OXFMwIhBbq/gjdaNX+Q== Archived-At: Subject: Re: [Rats] Vetting claim definitions X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 12 Jun 2019 17:18:25 -0000 --Apple-Mail=_3150D9F5-A161-4346-9349-250BDD0531E4 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 This exchange was really helpful for me. So an EAT / CWT / JWT remain as a signed self-secured message that can = be moved in lots of different ways. That can include the RPC mechanisms = defined using YANG that seem to be the main means of moving management = data in/out of routers. I hope we get to writing a little bit of YANG to = define that. As with CWT and JWT the means of moving the messages around = include HTTP headers, extension points in other protocols and so on. = Seems like draft-birkholz-reference-ra-interaction-model holds for most = of them. Additionally, we always consider YANG-defined objects when we defined = EAT / CWT / JWT claims. I=E2=80=99m going back to working on the EAT draft now. LL > On Jun 11, 2019, at 2:03 PM, Eric Voit (evoit) = wrote: >=20 > Hi Laurence, > =20 > From: Laurence Lundblade, June 11, 2019 11:21 AM >=20 > Hi Eric, > =20 > What I=E2=80=99m trying to figure out here is where there can be real = practical interoperability with extant YANG-defined objects and how we = go about it as I assume this is your current objection to adoption. > =20 > I certainly intended no argument against adoption. I did vote = in favor of adoption. It was just that I want to see this topic = addressed as part of the draft's progression. I think the vote summary = from Kathleen covers my desire just fine. >=20 > On Jun 10, 2019, at 2:23 PM, Eric Voit (evoit) > wrote: > =20 > Hi Laurence, > =20 > It is true that the YANG of draft-birkholz-rats-basic-yang-module is = currently TPM2 specific. But over the past month we have been having = discussions on how to augment into this model case statements and a tree = structure which allows exposure of information from alternative hardware = types such as the TPM1.2. =20 > =20 > Per your note below, I am guessing that = draft-birkholz-rats-basic-yang-module could provide a query/response = interface to access EAT information. The Network Element's YANG model = theoretically could allow access based on whatever choice of protocols = the Network Element supports (e.g., NETCONF/XML. RESTCONF/JSON, = CoMI/CBOR). But the choice and protocols of used to access EAT objects = over a YANG interface is something each platform would need to define. = The baseline choice for Interoperability here is tbd. > =20 > You mentioned a YANG interface. Seems like a point where there might = be interoperability. Is this an interface on the router that is used to = collect the claims data before signing? Or is it an interface on the = back end / server / relying party that is involved in validating the = data? Or maybe it is the rpc interaction defined in = draft-birkholz-rats-basic-yang-module? I=E2=80=99m not sure what the = intended endpoints of that RPC are. Router and Relying Party?=20 > =20 > It is the RPC mechanism. The RPC mechanisms allow a relying = party to fetch internal datastore objects within the Router. =20 > =20 > One vendor specific example of a domain relevant YANG model is here: > = https://github.com/YangModels/yang/blob/master/vendor/cisco/xe/16101/Cisco= -IOS-XE-boot-integrity-oper.yang = > This model allows information from within a cryptoprocessor to be = inspected by both the router and the relying party *after* it has been = signed by the one of the router's cryptoprocessors. > =20 > Note: this model is just one of almost 400 YANG models supported on = that type of device: > https://github.com/YangModels/yang/tree/master/vendor/cisco/xe/16101 = > Looking at this second link, you can get an idea of the level of = investment placed into YANG by Router vendors attempting to unify the = exposure of information. > =20 > =20 > Now that we are generally agreeing that an EAT is a CWT or JWT, the = interaction model between device and relying party is inherited from = them. Mostly we=E2=80=99re defining the format of a signed message and = leaving the transport of the message open-ended so it can be embedded in = HTTP headers, protocol extensions and such. If YANG is used to define = interaction on routers, then some YANG RPC could be used (if that is = what YANG RPC is) to define transport of CWTs (if CWTs are used on = routers). There=E2=80=99s also = draft-birkholz-reference-ra-interaction-model. > =20 > I have been seeing EAT as a useful way to define what comes out = of cryptoprocessor hardware which might be located on a router. For = relying parties outside the router, the EAT raw payload might be fetched = through RPC. Or perhaps some or all of the corresponding YANG objects = might be fetched. Additionally, specific objects could be referenced so = that logic on the router might be applied based on the value of that = object. A good example we have tested here is when we send a = notification message to a relying party only when a specific PCR has = changed. This level of granularity means the relying party doesn't have = to continuously poll for the router to see if the PCR has changed.=20 > =20 > =20 > Whether it is even meaningful/relevant to support such YANG-EAT = interoperability is something I don't know yet. For me to consider EAT = for implementation would mean EAT has been adopted within = routers/switches. As this is possible, I feel there is little for the = WG to lose if we try to select/define some common objects which span our = different domains. > =20 > =20 > Here=E2=80=99s comments on a pass through = draft-birkholz-rats-basic-yang-module > =20 > grouping nonce {... Seems essentially compatible with nonce / cti / = jai in CWT / JWT > grouping pcr-selection {... TPM-specific so we probably go with the = YANG definition > grouping pcr-selector {... TPM-specific so we probably go with the = YANG definition > grouping signature-scheme {=E2=80=A6 EAT will use COSE for this > grouping attestation-key-identifier {=E2=80=A6 EAT will use COSE for = this > grouping tpm-name {=E2=80=A6 TPM-specific so we probably go with the = YANG definition > grouping compute-node {=E2=80=A6 I think this one needs work to figure = out what it is and if EAT=E2=80=99s UEID is similar > grouping node-uptime {=E2=80=A6 Seems simple to make exactly the same = for EAT > grouping log-identifier {=E2=80=A6 and grouping boot-event-log {=E2=80=A6= and other log stuff=E2=80=A6 Maybe TPM specific; maybe needs work to = understand > grouping ima-event {=E2=80=A6 and related. We do want some IMA claims = in CWT format. Maybe they are part of EAT. Maybe they are separate. = Maybe they use the YANG definition.=20 > =20 > This is a nice start on the type of analysis I am hoping to = see. I think as we work this through, we can save mapping cycles for = future developers. =20 > =20 > Please understand that in no way do I claim that YANG is perfect. And = YANG models can take years to complete. But on the plus side for YANG, = I am sure it is possible to construct YANG models so that new hardware = types can be inserted. If you want a preview of the types of structure = which might be used for this type of extensibility, check out at how = draft-ietf-netconf-yang-push augments new case types into a the YANG = model described within draft-ietf-netconf-subscribed-notifications. > =20 > YANG not perfect?? Huh? What? :-) > =20 > I wish some YANG experts would chime in more here. I=E2=80=99m trying = to learn on the fly and really should be updating the EAT draft instead. > =20 > I encourage other YANG viewers out there to chime in as well. > =20 > Eric > =20 > LL > =20 >=20 >=20 > =20 > Eric > =20 > From: Laurence Lundblade, June 10, 2019 2:57 PM >=20 >=20 > Hi Eric, > =20 > So I think we have some agreement on general principles for how to = structure the documents this work group produces so we can have both = flexibility in the definition of new claims and well-defined concise = sets claims for particular use cases.=20 > =20 > In particular I appreciate the confirmation of this from Mike Jones. = Hopefully lack of objection implies a lot of agreement.=20 > =20 > =20 > Eric, I think you are now digging into the next level of detail on how = to deal with TPM-based implementations and claims specified in YANG and = how that will interoperate with CWT/COSE and JWT/JOSE based tokens. > =20 > I don=E2=80=99t really understand YANG and how to fully read = draft-birkholz-rats-basic-yang-module yet. Working on it (but I should = be working on the new EAT draft=E2=80=A6) > =20 > draft-birkholz-rats-basic-yang-module REQUIRES a TPM to implement it. = That implies to me that neither CWT/COSE and JWT/JOSE signed container = formats can be used because I don=E2=80=99t think TPM=E2=80=99s can = produce either format. Pretty sure we agree that EAT will always be = CWT/COSE or JWT/JOSE.=20 > =20 > (It is also odd to me that an IETF standard would require particular = HW. It should just be about bits on the wire. EAT will have some means = to indicate the security of the HW and SW that produced a given token, = but will not require any particular security from the HW or SW) > =20 > But let=E2=80=99s assume that a relying party (I think you call this = the Network Element) can unpack and verify signature that in the format = of CWT and JWT and the TPM-style sig that I think is implied by = draft-birkholz-rats-basic-yang-module. The result will be a set of = claims in some syntax. It will be CBOR or JSON in the case of CWT or = JWT.=20 > =20 > What will it be for draft-birkholz-rats-basic-yang-module??? = YANG-described stuff an be lots of different syntaxes by my = understanding. How many of them will a relying party be expected to = support so there is interop? > =20 > I=E2=80=99m going to stop here for the answer to that question. > =20 > LL --Apple-Mail=_3150D9F5-A161-4346-9349-250BDD0531E4 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 This = exchange was really helpful for me.

So an EAT / CWT / JWT remain as a = signed self-secured message that can be moved in lots of different ways. = That can include the RPC mechanisms defined using YANG that seem to be = the main means of moving management data in/out of routers. I hope we = get to writing a little bit of YANG to define that. As with CWT and JWT = the means of moving the messages around include HTTP headers, extension = points in other protocols and so on. Seems = like draft-birkholz-reference-ra-interaction-model holds for most = of them.

Additionally, we always consider YANG-defined objects when we = defined EAT / CWT / JWT claims.

I=E2=80=99m going back to working on = the EAT draft now.

LL

On Jun = 11, 2019, at 2:03 PM, Eric Voit (evoit) <evoit@cisco.com> = wrote:

Hi Laurence,
 
From: Laurence Lundblade, June = 11, 2019 11:21 AM

Hi = Eric,
 
What I=E2=80=99m trying to figure out = here is where there can be real practical interoperability with extant = YANG-defined objects and how we go about it as I assume this is your = current objection to adoption.
 
<eric> I certainly = intended no argument against adoption.  I did vote in favor of = adoption.  It was just that I want to see this topic addressed as = part of the draft's progression.  I think the vote summary from = Kathleen covers my desire just fine.

On Jun = 10, 2019, at 2:23 PM, Eric Voit (evoit) <evoit@cisco.com> wrote:
 
Hi Laurence,
 
It is true that the YANG of = draft-birkholz-rats-basic-yang-module is currently TPM2 specific.  = But over the past month we have been having discussions on how to = augment into this model case statements and a tree structure which = allows exposure of information from alternative hardware types such as = the TPM1.2.  
 
Per your note below, I am guessing that = draft-birkholz-rats-basic-yang-module could provide a query/response = interface to access EAT information.  The Network Element's YANG = model theoretically could allow access based on whatever choice of = protocols the Network Element supports (e.g., NETCONF/XML. = RESTCONF/JSON, CoMI/CBOR).  But the choice and protocols of used to = access EAT objects over a YANG interface is something each platform = would need to define.   The baseline choice for = Interoperability here is tbd.
 
You mentioned a YANG interface. Seems like a point where = there might be interoperability. Is this an interface on the router that = is used to collect the claims data before signing? Or is it an interface = on the back end / server / relying party that is involved in validating = the data? Or maybe it is the rpc interaction defined = in draft-birkholz-rats-basic-yang-module? I=E2=80=99m not sure what = the intended endpoints of that RPC are. Router and Relying = Party? 
 
<eric>  It is the RPC mechanism.  The RPC = mechanisms allow a relying party to fetch internal datastore objects = within the Router.   
 
One = vendor specific example of a domain relevant YANG model is here:
https://github.com/YangModels/yang/blob/master/vendor/cisco/xe/= 16101/Cisco-IOS-XE-boot-integrity-oper.yang
This model allows = information from within a cryptoprocessor to be inspected by both the = router and the relying party *after* it has been signed by the one of = the router's cryptoprocessors.
 
Note: this model is just one of almost 400 YANG models = supported on that type of device:
https://github.com/YangModels/yang/tree/master/vendor/cisco/xe/= 16101
Looking at this second = link, you can get an idea of the level of investment placed into YANG by = Router vendors attempting to unify the exposure of information.
 
 
Now that we are generally agreeing that = an EAT is a CWT or JWT, the interaction model between device and relying = party is inherited from them. Mostly we=E2=80=99re defining the format = of a signed message and leaving the transport of the message open-ended = so it can be embedded in HTTP headers, protocol extensions and such. If = YANG is used to define interaction on routers, then some YANG RPC could = be used (if that is what YANG RPC is) to define transport of CWTs (if = CWTs are used on routers). There=E2=80=99s = also draft-birkholz-reference-ra-interaction-model.
 
<eric> I have been seeing EAT as a useful way to define = what comes out of cryptoprocessor hardware which might be located on a = router.  For relying parties outside the router, the EAT raw = payload might be fetched through RPC.  Or perhaps some or all of = the corresponding YANG objects might be fetched.  Additionally, = specific objects could be referenced so that logic on the router might = be applied based on the value of that object.   A good example = we have tested here is when we send a notification message to a relying = party only when a specific PCR has changed.  This level of = granularity means the relying party doesn't have to continuously poll = for the router to see if the PCR has changed. 
 
 
Whether it is even meaningful/relevant = to support such YANG-EAT interoperability is something I don't know = yet.  For me to consider EAT for implementation would mean EAT has = been adopted within routers/switches.   As this is possible, I = feel there is little for the WG to lose if we try to select/define some = common objects which span our different domains.
 
 
Here=E2=80=99s comments on a pass = through draft-birkholz-rats-basic-yang-module
 
grouping nonce = {... Seems essentially compatible with nonce / cti / jai in CWT / = JWT
grouping pcr-selection {...   TPM-specific so we = probably go with the YANG definition
grouping pcr-selector {... =   TPM-specific so we probably go with the YANG definition
grouping signature-scheme {=E2=80=A6 EAT will use COSE for = this
grouping attestation-key-identifier = {=E2=80=A6 EAT will use COSE for this
grouping tpm-name {=E2=80=A6 TPM-specific so we probably go = with the YANG definition
grouping compute-node {=E2=80= =A6 I think this one needs work to figure out what it is and if EAT=E2=80=99= s UEID is similar
grouping node-uptime {=E2=80=A6 Seems = simple to make exactly the same for EAT
grouping log-identifier {=E2=80=A6 and grouping = boot-event-log {=E2=80=A6 and other log stuff=E2=80=A6 Maybe TPM = specific; maybe needs work to understand
grouping ima-event {=E2=80=A6 and related. We do want some = IMA claims in CWT format. Maybe they are part of EAT. Maybe they are = separate. Maybe they use the YANG definition. 
 
<eric> This is a nice start on the type of analysis I = am hoping to see.   I think as we work this through, we can = save mapping cycles for future developers.  
 
Please understand that in no way do I = claim that YANG is perfect.  And YANG models can take years to = complete.   But on the plus side for YANG, I am sure it is = possible to construct YANG models so that new hardware types can be = inserted.  If you want a preview of the types of structure which = might be used for this type of extensibility, check out at how = draft-ietf-netconf-yang-push augments new case types into a the YANG = model described within draft-ietf-netconf-subscribed-notifications.
 
YANG not perfect?? Huh? What?  :-)
 
I wish some YANG experts would chime in = more here. I=E2=80=99m trying to learn on the fly and really should be = updating the EAT draft instead.
 
<eric>  I encourage other YANG viewers out = there to chime in as well.
 
Eric
 
LL
 


 
Eric
 
From: Laurence Lundblade, June = 10, 2019 2:57 PM


Hi Eric,
 
So I think we have some agreement on = general principles for how to structure the documents this work group = produces so we can have both flexibility in the definition of new = claims and well-defined concise sets claims for particular = use cases. 
 
In particular I appreciate the = confirmation of this from Mike Jones. Hopefully lack of objection = implies a lot of agreement. 
 
 
Eric, I think you are now digging into = the next level of detail on how to deal with TPM-based implementations = and claims specified in YANG and how that will interoperate with = CWT/COSE and JWT/JOSE based tokens.
 
I don=E2=80=99t really understand YANG = and how to fully read draft-birkholz-rats-basic-yang-module yet. Working = on it (but I should be working on the new EAT draft=E2=80=A6)
 
draft-birkholz-rats-basic-yang-module REQUIRES a TPM to = implement it. That implies to me that neither CWT/COSE and JWT/JOSE = signed container formats can be used because I don=E2=80=99t think = TPM=E2=80=99s can produce either format. Pretty sure we agree that EAT = will always be CWT/COSE or JWT/JOSE. 
 
(It is also odd to me that an IETF = standard would require particular HW. It should just be about bits on = the wire. EAT will have some means to indicate the security of the HW = and SW that produced a given token, but will not require any particular = security from the HW or SW)
 
But let=E2=80=99s assume that a relying = party (I think you call this the Network Element) can unpack and verify = signature that in the format of CWT and JWT and the TPM-style sig that I = think is implied by draft-birkholz-rats-basic-yang-module. The result = will be a set of claims in some syntax. It will be CBOR or JSON in the = case of CWT or JWT. 
 
What will it be for = draft-birkholz-rats-basic-yang-module??? YANG-described stuff an be lots = of different syntaxes by my understanding. How many of them will a = relying party be expected to support so there is interop?
 
I=E2=80=99m going to stop here for the = answer to that question.
 
LL
=

= --Apple-Mail=_3150D9F5-A161-4346-9349-250BDD0531E4-- From nobody Wed Jun 12 10:28:26 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CE951120234 for ; Wed, 12 Jun 2019 10:28:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.888 X-Spam-Level: X-Spam-Status: No, score=-1.888 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, T_SPF_TEMPERROR=0.01] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8Is8VCG8a-IB for ; Wed, 12 Jun 2019 10:28:17 -0700 (PDT) Received: from p3plsmtpa08-06.prod.phx3.secureserver.net (p3plsmtpa08-06.prod.phx3.secureserver.net [173.201.193.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 421061201E4 for ; Wed, 12 Jun 2019 10:28:14 -0700 (PDT) Received: from [192.168.1.108] ([76.192.164.238]) by :SMTPAUTH: with ESMTPSA id b72jhkslzZQLZb72jh6UZx; Wed, 12 Jun 2019 10:28:13 -0700 From: Laurence Lundblade Content-Type: multipart/alternative; boundary="Apple-Mail=_2B7F547F-86AA-43B2-B2AB-1C604892A921" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Wed, 12 Jun 2019 10:28:12 -0700 References: <52FF65B5-EF11-4F10-BBB0-922F32D950BB@island-resort.com> To: rats@ietf.org, Mike Jones In-Reply-To: <52FF65B5-EF11-4F10-BBB0-922F32D950BB@island-resort.com> Message-Id: <083C52DB-F91C-42F0-AFF5-AF6FF3FD093A@island-resort.com> X-Mailer: Apple Mail (2.3445.9.1) X-CMAE-Envelope: MS4wfOfTY32JXnqPcBLUYmA0TJ09PBa/s8iZVRln/q7rWVROieuj5mnlEkHBWEgMQV9bSkf8t5EUADTPhmDxgfBFp2Xb0iSZlL/zUnb+5U8qX6HBBQtkT61A pkoyx3+LGRmlEM21TgZ6NfJRoFOybbY5SVL0NAhFwNGbBQs6OADOc5x5vkbmbZnsm+/gbhpRIV8Ub6gxSMaV58u9Kg1xLKMHKnjb+B7B8qjR+4BypqtxkhoW Archived-At: Subject: Re: [Rats] EAT as a JWT/CWT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 12 Jun 2019 17:28:26 -0000 --Apple-Mail=_2B7F547F-86AA-43B2-B2AB-1C604892A921 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 + Mike for CWT-related comments I=E2=80=99m planning to put tokenType in the next EAT draft. I will = definitely not define the =E2=80=9CCert=E2=80=9D and =E2=80=9CCoID=E2=80=9D= types. That will be up to those standards. I will define =E2=80=9CEAT=E2= =80=9D for certain. I=E2=80=99m not sure what to do about =E2=80=9COAuth=E2= =80=9D and/or other traditional uses of CWT/JWT. Comments? Note that this is going inside the token so it is signed rather than = outside as a content type or a CBOR tag. LL > On May 26, 2019, at 12:38 PM, Laurence Lundblade = wrote: >=20 > Seems like we would want an option claim that indicates the purpose = of the token. To write my first CDDL: >=20 > tokenType =3D =E2=80=9CEAT" / =E2=80=9COAuth" / =E2=80=9CCert=E2=80=9D = / =E2=80=9CCoID" >=20 > I suspect it will be hard to tell which it is by the make up of the = claims and it will matter for some use cases. I=E2=80=99m not sure = =E2=80=9COAuth=E2=80=9D, =E2=80=9CCert=E2=80=9D and =E2=80=9CCoID=E2=80=9D= are right. The writing does seem to be on the wall that we will = eventually replace X.509 cert hierarchies with CWT/JWT hierarchies and = I=E2=80=99m not sure if that is a =E2=80=9CCoID=E2=80=9D or =E2=80=9CCert=E2= =80=9D. --Apple-Mail=_2B7F547F-86AA-43B2-B2AB-1C604892A921 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
+ Mike for CWT-related comments

I=E2=80=99m planning to put tokenType in the next EAT = draft. I will definitely not define the =E2=80=9CCert=E2=80=9D and = =E2=80=9CCoID=E2=80=9D types. That will be up to those standards. =  I will define =E2=80=9CEAT=E2=80=9D for certain. I=E2=80=99m not = sure what to do about =E2=80=9COAuth=E2=80=9D and/or other traditional = uses of CWT/JWT. Comments?

Note that this is going inside the token so it is signed = rather than outside as a content type or a CBOR tag.

LL


On May 26, 2019, at 12:38 PM, Laurence = Lundblade <lgl@island-resort.com> wrote:

Seems like we = would  want an option claim that indicates the purpose of the = token. To write my first CDDL:

tokenType =3D =E2=80=9CEAT" =
/ =E2=80=9COAuth" / =E2=80=9CCert=E2=80=9D / =
=E2=80=9CCoID"

I suspect it = will be hard to tell which it is by the make up of the claims and it = will matter for some use cases. I=E2=80=99m not sure =E2=80=9COAuth=E2=80=9D= , =E2=80=9CCert=E2=80=9D and =E2=80=9CCoID=E2=80=9D are right.  The = writing does seem to be on the wall that we will eventually replace = X.509 cert hierarchies with CWT/JWT hierarchies and I=E2=80=99m not sure = if that is a =E2=80=9CCoID=E2=80=9D or = =E2=80=9CCert=E2=80=9D.

= --Apple-Mail=_2B7F547F-86AA-43B2-B2AB-1C604892A921-- From nobody Fri Jun 14 11:12:15 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2CDC2120715 for ; Fri, 14 Jun 2019 11:12:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id b2Y6LUdUnqvo for ; Fri, 14 Jun 2019 11:12:11 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4F7FD12070D for ; Fri, 14 Jun 2019 11:12:11 -0700 (PDT) Received: from sandelman.ca (obiwan.sandelman.ca [209.87.249.21]) by tuna.sandelman.ca (Postfix) with ESMTP id 000ED380BE for ; Fri, 14 Jun 2019 14:10:41 -0400 (EDT) Received: by sandelman.ca (Postfix, from userid 179) id 7683DF59; Fri, 14 Jun 2019 14:12:08 -0400 (EDT) Received: from sandelman.ca (localhost [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id 741975BE for ; Fri, 14 Jun 2019 14:12:08 -0400 (EDT) From: Michael Richardson To: rats@ietf.org X-Attribution: mcr X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: [Rats] agenda request for next week -- use cases X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Jun 2019 18:12:13 -0000 --=-=-= Content-Type: text/plain RATS Chairs: I would like to propose two slots for the use cases for next week: 1) <5 minute update on document progress, what we need more of, and whether we are going in the right direction. Given no intent to publish, should the WG adopt this document so that it can say it is allocating time to WG documents first? 2) 10-15 minutes at the VERY END of the time period for discussion about details in the document, and how to best make this document most useful as we go forward. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl0D43gACgkQgItw+93Q 3WUW7Qf/dqEBoREwDVc/Qnbk3if0Tn4s4Z+S7MMe5KSjb7dsP8INvsURFrlIIf8W Gq3NLktDLkjHrmwCo++UAvoZjmpZO5ZzT0c8j4GlX7mA5yYEvVVikD1VOYB+tQS3 gPriHnE24fega8k6aaCNIXjGAkysonL30aATr1VvwWuuooGb8N9pAwMt9DMkiaEl uflxtIDJ2tkQwlKDURUjllpm0V2ENC1YidHUhI5KAzklKfqN1qPNGXcFbI4I2tLz +iH/oAJ8ljS/6r4L/lK4sT92NOUyqy73MC+wiInkssql6hh9s9MnJ0LseuIDM/Rp +ie96MByvhIFO6N7DX8SWHoJYedKQQ== =aOdH -----END PGP SIGNATURE----- --=-=-=-- From nobody Fri Jun 14 11:16:01 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 097A2120718 for ; Fri, 14 Jun 2019 11:15:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wrlsOj0ePHvR for ; Fri, 14 Jun 2019 11:15:54 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 76BBC120717 for ; Fri, 14 Jun 2019 11:15:54 -0700 (PDT) Received: from sandelman.ca (unknown [IPv6:2607:f0b0:f:2:56b2:3ff:fe0b:d84]) by tuna.sandelman.ca (Postfix) with ESMTP id 50600380BE; Fri, 14 Jun 2019 14:14:26 -0400 (EDT) Received: by sandelman.ca (Postfix, from userid 179) id E0012F59; Fri, 14 Jun 2019 14:15:52 -0400 (EDT) Received: from sandelman.ca (localhost [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id DD90B5BE; Fri, 14 Jun 2019 14:15:52 -0400 (EDT) From: Michael Richardson To: Anders Rundgren cc: Carl Wallace , "rats\@ietf.org" In-Reply-To: <79ccb2d7-09a3-913d-f47d-1e702a23b341@gmail.com> References: <12503.1552447661@localhost> <58E37DB5-098C-4387-9A52-4AECD0F69F25@island-resort.com> <6495.1553219901@dooku.sandelman.ca> <507.1553725386@dooku.sandelman.ca> <24C0968B-32B0-4EF1-99C8-61D3F0955BA1@intel.com> <793F9A34-050F-4914-AF4B-08C072730A06@island-resort.com> <19652.1553943890@dooku.sandelman.ca> <79ccb2d7-09a3-913d-f47d-1e702a23b341@gmail.com> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Rats] More use cases for draft-richardson-rats-usecases-00 X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Jun 2019 18:15:58 -0000 --=-=-= Content-Type: text/plain Anders Rundgren wrote: >> Makes sense to me to capture current artifacts. Maybe in an appendix >> to the use cases draft. > For completeness you should consider mentioning that there are two > quite different platform attestation concepts: - Static: FIDO, Android, > and current TEEP architecture - Session based: Used by some smart card > schemes and SKS/KeyGen2 > (https://github.com/ietf-teep/architecture/issues/52) I have added the following text. I read through the link above, and I found it really interesting, but I wasn't really sure if I could pin down some clear details about session attestions. Are there things that could never be in one category or another? ---- Platform attestions generally come in two categories. This document will attempt to indicate for a particular attestion technology falls into this. ## Static attestions A static attestion says something about the platform on which the code is running. ## Session attestions A session attestion says something about how the shared session key was created. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl0D5FgACgkQgItw+93Q 3WUo3Qf8CH+ZAtxtOhUoxSIaK/PbAM9dFwDg4eVIkZcaRtljbxalpfUqhkMFzu4i w6+p8N7f59MJo9XnI6pRovUH6lqsNs+Z0W5c8XoDRpbMwtBmuy/OPKNLVs4q93+o JXDJfx5R2rJinL/Qkwbxw5H8AauMl86TBHbMwI425jflkQfhaSQdX7iV2JDLxXwH 9PEPiaag11yZ8th9ZEOwSAJwfJZuCL/AELaAapJOyQpCyvl/4LlBSAo6Otov80z7 TDmKg8RSi7+ETCxH7mujjo0hc3hjjFpl/CLko9PK//H/YtnBq76irXAdx2PEuO/5 /XarW3QisrXpSZ/GQaTaWpeQu/O0SA== =UAFN -----END PGP SIGNATURE----- --=-=-=-- From nobody Fri Jun 14 11:46:09 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A1B88120151 for ; Fri, 14 Jun 2019 11:46:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mkIkuOkl55mI for ; Fri, 14 Jun 2019 11:46:04 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CD89B12011C for ; Fri, 14 Jun 2019 11:46:04 -0700 (PDT) Received: from sandelman.ca (obiwan.sandelman.ca [209.87.249.21]) by tuna.sandelman.ca (Postfix) with ESMTP id A363D380BE; Fri, 14 Jun 2019 14:44:35 -0400 (EDT) Received: by sandelman.ca (Postfix, from userid 179) id 2958DF59; Fri, 14 Jun 2019 14:46:02 -0400 (EDT) Received: from sandelman.ca (localhost [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id 26E565BE; Fri, 14 Jun 2019 14:46:02 -0400 (EDT) From: Michael Richardson To: "Smith\, Ned" cc: Anders Rundgren , Carl Wallace , "rats\@ietf.org" In-Reply-To: <7B05ABC3-FE60-4879-9DEE-B896DD15507D@intel.com> References: <12503.1552447661@localhost> <58E37DB5-098C-4387-9A52-4AECD0F69F25@island-resort.com> <6495.1553219901@dooku.sandelman.ca> <507.1553725386@dooku.sandelman.ca> <24C0968B-32B0-4EF1-99C8-61D3F0955BA1@intel.com> <793F9A34-050F-4914-AF4B-08C072730A06@island-resort.com> <19652.1553943890@dooku.sandelman.ca> <79ccb2d7-09a3-913d-f47d-1e702a23b341@gmail.com> <7B05ABC3-FE60-4879-9DEE-B896DD15507D@intel.com> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Rats] More use cases for draft-richardson-rats-usecases-00 X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Jun 2019 18:46:08 -0000 --=-=-= Content-Type: text/plain Smith, Ned wrote: > Anders refers to session-based attestation in the TEEP archive which > points to several sources including a TCG source. This may be referring > to a public specification known as DICE - Device Identifier Composition > Engine. > https://trustedcomputinggroup.org/wp-content/uploads/Hardware-Requirements-for-Device-Identifier-Composition-Engine-r78_For-Publication.pdf > TCG terminology for TEEP's "Static" attestation is "Explicit > Attestation" and TEEP's term "Session Based" attestation is "Implicit > Attestation" by TCG. I have included these translations into the document. > The EAT draft defines an attestation approach that seems close to (i) > if you ignore the nonce that is returned as a static claim / assertion > and if you rule out of scope the definition of how the signing key is > created / persisted. > The tokbind draft seems closely resemble (ii). I want to be sure you mean: draft-mandyam-tokbind-attest-07 ? > The TUDA draft seems to > resemble (i). (Henk can correct me). > The yang draft seems to resemble > (ii). (Henk can correct me). I'm trying to figure out what to do this statement. -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works | IoT architect [ ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on rails [ -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl0D62kACgkQgItw+93Q 3WVR6wgAjHEK/f2eykktuw6x4HiRCqlQeoeldN+VhaHfHnPqMLMBwzf5CMZs978s nnQsdDtqBM/pHExsorOXbXHuUxV4vdcxYdeyY7liW5rm10ocgucfEiz4VWij85xr 2/5wxN6yj/mH+x5KAZTAIm+yxY5EH1i8KH0Vc7hQkKvekCYWKtYHNxXZvGEWwVV5 m5e3F9YeGVu28ITD7OWj/4eEhl4/z9wIoG6OT6yFLwdN4c5+Fb5gY8oByxH56ZEW BKxa9uDAChXo3H6/hVBrDs+D5kn3uzVIFUQ5Mrf7uSgbReYrpGAY/hOgTsdZGwo/ IHdRH5yNhls7VB9wcKq7ZH3tep4Z2A== =1AOV -----END PGP SIGNATURE----- --=-=-=-- From nobody Fri Jun 14 13:46:22 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C6D741201E2 for ; Fri, 14 Jun 2019 13:46:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SF7gXmcL_mZO for ; Fri, 14 Jun 2019 13:46:18 -0700 (PDT) Received: from mail-wm1-x32f.google.com (mail-wm1-x32f.google.com [IPv6:2a00:1450:4864:20::32f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A5F87120047 for ; Fri, 14 Jun 2019 13:46:18 -0700 (PDT) Received: by mail-wm1-x32f.google.com with SMTP id s15so3541336wmj.3 for ; Fri, 14 Jun 2019 13:46:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=gr01DhPxowcg+t8NmtG3IMSiW6o/ujHBiupODj87rds=; b=X0A3jTKDFyvGVaILIpsvahbnUKn1NetGTa1dhMSCT/e2qu8TqnnMIU+mq1+1JLMqGn X+n3yHkVN456QV/TuEhgCPoS9qkjzjllcDtQ0ISvbd190p52WhCPhGsxNdUG8V63qQKL eN8Le3ynZj4ECiJXlCW03pHs7DplUTMHmj0n5VjlF/F/TjTCCDMzbI8ocnzKYGUpf33R x+CRpp+g3BmN39OXN5NnHW3aQFG81St738Y6n1kGtVZ6I2BpEPOOeVPLeXHNQ3WSJF9S YE0sDT7JnemOefAKQqcHTG5KLwKBWBN6mqq7yFYSB/CjqynFZwD22exLMgUNDxJ7nwd0 9uwQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=gr01DhPxowcg+t8NmtG3IMSiW6o/ujHBiupODj87rds=; b=ajSfqLdf8bnjHsWzitMF8AA6x+H9lzT+O7Sp0ZUmX77ZDxZy3uKw6dCAnMtwxzWN9B t9a43T0ZJQV9Q1SUy8O5GC1xHWTxhqPakG1APQx/csroHpL0aPvH/0Nrll8jbgr35AAe qitT3Nw7MCeEfQburNjvXQp3S5twH54DJw/le20cehEW0ufNLbQpmxMoTn5YMoMK2RxO KPHDeyis1lp7QMxUQxnamMq1a4actnRiq6pZUMdwLb/6USZaYCwbpd18tMAuN4jVHNPe mwR8ZOO1Q0miUF7EG/oOxMWiY0OJIa0VsTuBXFSiEhM5Ok1iD//KOIVtSEPPbusbrtyZ dfCg== X-Gm-Message-State: APjAAAV+M0LKC9qmNqC4QCvHH8AbDVtb5Q4Ynt9LsfMtvKe/Dq+L4H9Z X7KEs9z/ztZe9H0YWqsuG79dy9f/v0g= X-Google-Smtp-Source: APXvYqwkrQlhGiTUxj3DiTyEm6h6y2aiiBGR+WiwMrYeCQAFHJWZ8Bi1ANRhsAUXUUzNmR3KOc1nyA== X-Received: by 2002:a1c:1947:: with SMTP id 68mr9265183wmz.171.1560545176751; Fri, 14 Jun 2019 13:46:16 -0700 (PDT) Received: from [192.168.1.79] (25.131.146.77.rev.sfr.net. [77.146.131.25]) by smtp.googlemail.com with ESMTPSA id l8sm10434228wrg.40.2019.06.14.13.46.15 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 14 Jun 2019 13:46:16 -0700 (PDT) To: Michael Richardson Cc: Carl Wallace , "rats@ietf.org" References: <12503.1552447661@localhost> <58E37DB5-098C-4387-9A52-4AECD0F69F25@island-resort.com> <6495.1553219901@dooku.sandelman.ca> <507.1553725386@dooku.sandelman.ca> <24C0968B-32B0-4EF1-99C8-61D3F0955BA1@intel.com> <793F9A34-050F-4914-AF4B-08C072730A06@island-resort.com> <19652.1553943890@dooku.sandelman.ca> <79ccb2d7-09a3-913d-f47d-1e702a23b341@gmail.com> <29183.1560536152@localhost> From: Anders Rundgren Message-ID: <9a7e3efe-b021-f255-4afd-649ea0d5772d@gmail.com> Date: Fri, 14 Jun 2019 22:46:13 +0200 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.7.0 MIME-Version: 1.0 In-Reply-To: <29183.1560536152@localhost> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Rats] More use cases for draft-richardson-rats-usecases-00 X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 14 Jun 2019 20:46:22 -0000 On 2019-06-14 20:15, Michael Richardson wrote: > > Anders Rundgren wrote: > >> Makes sense to me to capture current artifacts. Maybe in an appendix > >> to the use cases draft. > > > For completeness you should consider mentioning that there are two > > quite different platform attestation concepts: - Static: FIDO, Android, > > and current TEEP architecture - Session based: Used by some smart card > > schemes and SKS/KeyGen2 > > (https://github.com/ietf-teep/architecture/issues/52) > > I have added the following text. > I read through the link above, and I found it really interesting, but I > wasn't really sure if I could pin down some clear details about > session attestions. Hi Michael, A session based attestation is the combination of a static attestation and the creation of a shared session key. That is, possible subsequent operations using the shared session key "inherit" the initial attestation. Such operations use MAC signatures and symmetric encryption (using keys derived from the session key) in order to form a protected API. Ideally a session based attestation scheme also provides "atomic" operation, terminated by a "commit" call. > > Are there things that could never be in one category or another? To me they appear pretty distinct, including the code. Regards, Anders > > ---- > > Platform attestions generally come in two categories. This document will > attempt to indicate for a particular attestion technology falls into this. > > ## Static attestions > > A static attestion says something about the platform on which the code is > running. > > ## Session attestions > > A session attestion says something about how the shared session key was > created. See text above. > > -- > Michael Richardson , Sandelman Software Works > -= IPv6 IoT consulting =- > > > From nobody Mon Jun 17 10:07:27 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D6FB21201C8 for ; Mon, 17 Jun 2019 10:07:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FoDLZrQkRrN0 for ; Mon, 17 Jun 2019 10:07:23 -0700 (PDT) Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6DF001201C7 for ; Mon, 17 Jun 2019 10:07:23 -0700 (PDT) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga005.fm.intel.com ([10.253.24.32]) by fmsmga102.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 17 Jun 2019 10:07:22 -0700 X-ExtLoop1: 1 Received: from orsmsx102.amr.corp.intel.com ([10.22.225.129]) by fmsmga005.fm.intel.com with ESMTP; 17 Jun 2019 10:07:22 -0700 Received: from orsmsx158.amr.corp.intel.com (10.22.240.20) by ORSMSX102.amr.corp.intel.com (10.22.225.129) with Microsoft SMTP Server (TLS) id 14.3.439.0; Mon, 17 Jun 2019 10:07:21 -0700 Received: from orsmsx109.amr.corp.intel.com ([169.254.11.17]) by ORSMSX158.amr.corp.intel.com ([169.254.10.128]) with mapi id 14.03.0439.000; Mon, 17 Jun 2019 10:07:21 -0700 From: "Smith, Ned" To: Michael Richardson CC: Anders Rundgren , Carl Wallace , "rats@ietf.org" Thread-Topic: [Rats] More use cases for draft-richardson-rats-usecases-00 Thread-Index: AQHVIuFqWQBd9YaaOUe/YohgH2bb7KagGH2A Date: Mon, 17 Jun 2019 17:07:21 +0000 Message-ID: <6744BE53-4071-4349-ACB5-23FDE107F16E@intel.com> References: <12503.1552447661@localhost> <58E37DB5-098C-4387-9A52-4AECD0F69F25@island-resort.com> <6495.1553219901@dooku.sandelman.ca> <507.1553725386@dooku.sandelman.ca> <24C0968B-32B0-4EF1-99C8-61D3F0955BA1@intel.com> <793F9A34-050F-4914-AF4B-08C072730A06@island-resort.com> <19652.1553943890@dooku.sandelman.ca> <79ccb2d7-09a3-913d-f47d-1e702a23b341@gmail.com> <7B05ABC3-FE60-4879-9DEE-B896DD15507D@intel.com> <4607.1560537962@localhost> In-Reply-To: <4607.1560537962@localhost> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.19.0.190512 x-originating-ip: [10.24.14.38] Content-Type: text/plain; charset="utf-8" Content-ID: <0E41257AAD0C4A4890773BF43001A375@intel.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [Rats] More use cases for draft-richardson-rats-usecases-00 X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Jun 2019 17:07:26 -0000 U2VlIGlubGluZSBbbm1zXQ0KDQrvu79PbiA2LzE0LzE5LCAxMTo0NiBBTSwgIk1pY2hhZWwgUmlj aGFyZHNvbiIgPG1jcitpZXRmQHNhbmRlbG1hbi5jYT4gd3JvdGU6DQoNCiAgICANCiAgICBTbWl0 aCwgTmVkIDxuZWQuc21pdGhAaW50ZWwuY29tPiB3cm90ZToNCiAgICAgICAgPiBBbmRlcnMgcmVm ZXJzIHRvIHNlc3Npb24tYmFzZWQgYXR0ZXN0YXRpb24gaW4gdGhlIFRFRVAgYXJjaGl2ZSB3aGlj aA0KICAgICAgICA+IHBvaW50cyB0byBzZXZlcmFsIHNvdXJjZXMgaW5jbHVkaW5nIGEgVENHIHNv dXJjZS4gVGhpcyBtYXkgYmUgcmVmZXJyaW5nDQogICAgICAgID4gdG8gYSBwdWJsaWMgc3BlY2lm aWNhdGlvbiBrbm93biBhcyBESUNFIC0gRGV2aWNlIElkZW50aWZpZXIgQ29tcG9zaXRpb24NCiAg ICAgICAgPiBFbmdpbmUuDQogICAgICAgID4gaHR0cHM6Ly90cnVzdGVkY29tcHV0aW5nZ3JvdXAu b3JnL3dwLWNvbnRlbnQvdXBsb2Fkcy9IYXJkd2FyZS1SZXF1aXJlbWVudHMtZm9yLURldmljZS1J ZGVudGlmaWVyLUNvbXBvc2l0aW9uLUVuZ2luZS1yNzhfRm9yLVB1YmxpY2F0aW9uLnBkZg0KICAg IA0KICAgICAgICA+IFRDRyB0ZXJtaW5vbG9neSBmb3IgVEVFUCdzICJTdGF0aWMiIGF0dGVzdGF0 aW9uIGlzICJFeHBsaWNpdA0KICAgICAgICA+IEF0dGVzdGF0aW9uIiBhbmQgVEVFUCdzIHRlcm0g IlNlc3Npb24gQmFzZWQiIGF0dGVzdGF0aW9uIGlzICJJbXBsaWNpdA0KICAgICAgICA+IEF0dGVz dGF0aW9uIiBieSBUQ0cuDQogICAgDQogICAgSSBoYXZlIGluY2x1ZGVkIHRoZXNlIHRyYW5zbGF0 aW9ucyBpbnRvIHRoZSBkb2N1bWVudC4NCiAgICANCiAgICAgICAgPiBUaGUgRUFUIGRyYWZ0IGRl ZmluZXMgYW4gYXR0ZXN0YXRpb24gYXBwcm9hY2ggdGhhdCBzZWVtcyBjbG9zZSB0byAoaSkNCiAg ICAgICAgPiBpZiB5b3UgaWdub3JlIHRoZSBub25jZSB0aGF0IGlzIHJldHVybmVkIGFzIGEgc3Rh dGljIGNsYWltIC8gYXNzZXJ0aW9uDQogICAgICAgID4gYW5kIGlmIHlvdSBydWxlIG91dCBvZiBz Y29wZSB0aGUgZGVmaW5pdGlvbiBvZiBob3cgdGhlIHNpZ25pbmcga2V5IGlzDQogICAgICAgID4g Y3JlYXRlZCAvIHBlcnNpc3RlZC4NCiAgICANCiAgICAgICAgPiBUaGUgdG9rYmluZCBkcmFmdCBz ZWVtcyBjbG9zZWx5IHJlc2VtYmxlIChpaSkuDQogICAgDQogICAgSSB3YW50IHRvIGJlIHN1cmUg eW91IG1lYW46IGRyYWZ0LW1hbmR5YW0tdG9rYmluZC1hdHRlc3QtMDcgPw0KW25tc10gWWVzLg0K ICAgIA0KICAgICAgICA+IFRoZSBUVURBIGRyYWZ0IHNlZW1zIHRvDQogICAgICAgID4gcmVzZW1i bGUgKGkpLiAoSGVuayBjYW4gY29ycmVjdCBtZSkuDQogICAgDQogICAgICAgID4gVGhlIHlhbmcg ZHJhZnQgc2VlbXMgdG8gcmVzZW1ibGUNCiAgICAgICAgPiAoaWkpLiAoSGVuayBjYW4gY29ycmVj dCBtZSkuDQogICAgDQogICAgSSdtIHRyeWluZyB0byBmaWd1cmUgb3V0IHdoYXQgdG8gZG8gdGhp cyBzdGF0ZW1lbnQuDQpbbm1zXSBJZiB0aGVyZSBpcyB2YWx1ZSBpbiBjYXRlZ29yaXppbmcgdGhl IGF0dGVzdGF0aW9uIGFwcHJvYWNoIHRha2VuIGJ5IHZhcmlvdXMgcHJvcG9zZWQgUkFUUyBkcmFm dHMgaW4gdGVybXMgb2YgKGkpIGltcGxpY2l0IGF0dGVzdGF0aW9uIGFuZCAoaWkpIGV4cGxpY2l0 IGF0dGVzdGF0aW9uIHRoZW4gaXQgc2VlbXMgVFVEQSAoaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRm Lm9yZy9kb2MvZHJhZnQtYmlya2hvbHotcmF0cy10dWRhLyApIG1heSBiZSBjbGFzc2lmaWVkIGFz IGltcGxpY2l0IGF0dGVzdGF0aW9uLiBTaW5jZSBUVURBIGlzIGFsc28gdXNpbmcgdGltZS1iYXNl ZCBleGNoYW5nZXMgSGVuayBtYXkgdGhpbmsgaXQgZG9lc24ndCBmaXQgd2VsbCBpbnRvIHRoaXMg Y2F0ZWdvcml6YXRpb24uIFRoZSBZQU5HIG1vZHVsZSBkcmFmdCBodHRwczovL2RhdGF0cmFja2Vy LmlldGYub3JnL2RvYy9kcmFmdC1iaXJraG9sei1yYXRzLWJhc2ljLXlhbmctbW9kdWxlLyBhcHBl YXJzIHRvIG1lIHRvIGJlIGEgY2FzZSBvZiBleHBsaWNpdCBhdHRlc3RhdGlvbi4NCg0KVGhlIGJh c2ljIGRlZmluaXRpb24gb2YgaW1wbGljaXQgYXR0ZXN0YXRpb24gaXMgdGhhdCBldmlkZW5jZSBp c24ndCBleGNoYW5nZWQgZGlyZWN0bHkgYmV0d2VlbiBhdHRlc3RlciB0byB2ZXJpZmllci4gUmF0 aGVyIG9ubHkgYSBoYW5kbGUsIGtleWlkIG9yIHVzZSBvZiB0aGUgYXR0ZXN0YXRpb24ga2V5IGlz IHN1ZmZpY2llbnQgdG8gc2lnbmFsIHRoZSB2ZXJpZmllciB3aGljaCBjb250ZXh0IHRvIHJlZmVy ZW5jZSBmb3IgZXZhbHVhdGluZyB0cnVzdCBwcm9wZXJ0aWVzLiBUaGUgZGV0YWlscyBvZiB0aGUg dHJ1c3QgcHJvcGVydGllcyBpcyBjb21tdW5pY2F0ZWQgb3V0LW9mLWJhbmQgKHRoZSBvdXQtb2Yt YmFuZCBwYXRoIGlzIG91dCBvZiBzY29wZSBmb3IgUkFUUyBjdXJyZW50bHkpLiANCg0KRXhwbGlj aXQgYXR0ZXN0YXRpb24gY29udmV5cyB0aGUgZXZpZGVuY2UgZGlyZWN0bHkgZnJvbSBhdHRlc3Rl ciB0byB2ZXJpZmllci4gDQoNCk9idmlvdXNseSwgcmVhbCB3b3JsZCBhdHRlc3RhdGlvbiBkZXBs b3ltZW50cyBsaWtlbHkgd2lsbCB1c2UgYSBoeWJyaWQgb2YgaW1wbGljaXQgYW5kIGV4cGxpY2l0 IGF0dGVzdGF0aW9uIGFwcHJvYWNoZXMuDQotTmVkDQogICAgDQogICAgLS0NCiAgICBdICAgICAg ICAgICAgICAgTmV2ZXIgdGVsbCBtZSB0aGUgb2RkcyEgICAgICAgICAgICAgICAgIHwgaXB2NiBt ZXNoIG5ldHdvcmtzIFsNCiAgICBdICAgTWljaGFlbCBSaWNoYXJkc29uLCBTYW5kZWxtYW4gU29m dHdhcmUgV29ya3MgICAgICAgIHwgICAgSW9UIGFyY2hpdGVjdCAgIFsNCiAgICBdICAgICBtY3JA c2FuZGVsbWFuLmNhICBodHRwOi8vd3d3LnNhbmRlbG1hbi5jYS8gICAgICAgIHwgICBydWJ5IG9u IHJhaWxzICAgIFsNCiAgICANCiAgICANCiAgICAtLQ0KICAgIE1pY2hhZWwgUmljaGFyZHNvbiA8 bWNyK0lFVEZAc2FuZGVsbWFuLmNhPiwgU2FuZGVsbWFuIFNvZnR3YXJlIFdvcmtzDQogICAgIC09 IElQdjYgSW9UIGNvbnN1bHRpbmcgPS0NCiAgICANCiAgICANCiAgICANCiAgICANCg0K From nobody Tue Jun 18 19:30:33 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0E4A11204A3 for ; Tue, 18 Jun 2019 19:30:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.399 X-Spam-Level: X-Spam-Status: No, score=-0.399 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_SORBS_WEB=1.5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CLD446S9x_uZ for ; Tue, 18 Jun 2019 19:30:24 -0700 (PDT) Received: from relay.sandelman.ca (relay.cooperix.net [IPv6:2a01:7e00::f03c:91ff:feae:de77]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4D148120451 for ; Tue, 18 Jun 2019 19:30:23 -0700 (PDT) Received: from dooku.sandelman.ca (unknown [75.98.19.132]) by relay.sandelman.ca (Postfix) with ESMTPS id BA7C61F450; Wed, 19 Jun 2019 02:30:19 +0000 (UTC) Received: by dooku.sandelman.ca (Postfix, from userid 179) id 0361A1328; Tue, 18 Jun 2019 22:30:28 -0400 (EDT) From: Michael Richardson To: Thomas Fossati cc: Laurence Lundblade , "rats\@ietf.org" , Anthony Nadalin In-reply-to: <4EB6FF13-2DAF-4BDC-AC90-C46720D61AF0@arm.com> References: <12503.1552447661@localhost> <219648D6-188A-429D-A13F-ED6155DE9016@island-resort.com> <14288.1553710783@dooku.sandelman.ca> <4EB6FF13-2DAF-4BDC-AC90-C46720D61AF0@arm.com> Comments: In-reply-to Thomas Fossati message dated "Thu, 18 Apr 2019 13:06:40 -0000." X-Mailer: MH-E 8.6; nmh 1.6; GNU Emacs 24.5.1 MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha256; protocol="application/pgp-signature" Date: Tue, 18 Jun 2019 22:30:27 -0400 Message-ID: <21349.1560911427@dooku.sandelman.ca> Archived-At: Subject: Re: [Rats] draft-richardson-rats-usecases-00 comments X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Jun 2019 02:30:31 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Thomas Fossati wrote: > =EF=BB=BFOn 27/03/2019, 18:25, "RATS on behalf of Michael Richardson" > wrote: >> (Still looking for some pointers to *attestion* parts of the Android >> KeyStore.) > Maybe you want to take a look at [1] > Cheers, t > [1] https://arxiv.org/pdf/1904.05572.pdf Thank you. It was a really interesting read. What I learnt is that Android mostly attests to the location of a device signing key. I think that this is an implementation of the device-type attestation that FIDO cares about. The paper and the referenced info at: https://developer.android.com/training/articles/security-key-attestation does not give me additional use case, but I have other reading that I have not yet finished. =2D- Michael Richardson , Sandelman Software Works -=3D IPv6 IoT consulting =3D- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEERK+9HEcJHTJ9UqTMlUzhVv38QpAFAl0JnkMACgkQlUzhVv38 QpAMlgf/eT4FbnLKkgLlf1Ez20EN17vZlnZJKUU3b3ai6O3O0fUJFRrYa49/aex/ mDOD8d4QnMiNQO02hdmgug42R+oy8Ek2xZ0ZMWKS/7qeRkk7tjgHcGwJDItNtE3G CDcfxfkyL0szEOU+mlkTj5OGqI8zM0TNtKagqJ0I4r5FbfYYHu42LVvAzQhZ7v4x iseOXaJ9OXMvAC/K/m/34RBraK9hXqSPDJ6xCnodXQ9VicBRYfm2GvlDtUopnW7Z oNMbMdyHf4LwvkBga2mSqGRn45zsxgbTEHIvl1tpeC2PFSqq7luCUcrxAUHT4wIS Xnk/mCCw56oQWFMrZIH+QxSLZb5SKA== =ePaM -----END PGP SIGNATURE----- --=-=-=-- From nobody Tue Jun 18 19:31:54 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A45F412047A for ; Tue, 18 Jun 2019 19:31:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.399 X-Spam-Level: X-Spam-Status: No, score=-0.399 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_SORBS_WEB=1.5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KGyE3APKQNqE for ; Tue, 18 Jun 2019 19:31:44 -0700 (PDT) Received: from relay.sandelman.ca (relay.cooperix.net [IPv6:2a01:7e00::f03c:91ff:feae:de77]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D6CDB12043E for ; Tue, 18 Jun 2019 19:31:43 -0700 (PDT) Received: from dooku.sandelman.ca (unknown [75.98.19.132]) by relay.sandelman.ca (Postfix) with ESMTPS id 4C1931F450; Wed, 19 Jun 2019 02:31:38 +0000 (UTC) Received: by dooku.sandelman.ca (Postfix, from userid 179) id AD9F61328; Tue, 18 Jun 2019 22:31:42 -0400 (EDT) From: Michael Richardson To: Anders Rundgren cc: Thomas Fossati , Laurence Lundblade , "rats\@ietf.org" , Anthony Nadalin In-reply-to: References: <12503.1552447661@localhost> <219648D6-188A-429D-A13F-ED6155DE9016@island-resort.com> <14288.1553710783@dooku.sandelman.ca> <4EB6FF13-2DAF-4BDC-AC90-C46720D61AF0@arm.com> Comments: In-reply-to Anders Rundgren message dated "Fri, 19 Apr 2019 08:08:10 +0200." X-Mailer: MH-E 8.6; nmh 1.6; GNU Emacs 24.5.1 MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha256; protocol="application/pgp-signature" Date: Tue, 18 Jun 2019 22:31:42 -0400 Message-ID: <21417.1560911502@dooku.sandelman.ca> Archived-At: Subject: Re: [Rats] Android attestations: Re: draft-richardson-rats-usecases-00 comments X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Jun 2019 02:31:52 -0000 --=-=-= Content-Type: text/plain Anders Rundgren wrote: > Here you have another link: > https://developer.android.com/training/articles/security-key-attestation > As an application developer I find this scheme and the associated > "AndroidKeyStore" quite impractical. The recent addition of > "StrongBox" makes it worse. Interesting. What is it that you find that you can not do? > With a two-level TEE/SE session-key based scheme you only need to > attest the session permitting you to perform any number of secure > operations and close the session with a "commit" which in turn responds > with a (session signed) message to the SP that everything went right. Or is this what you wish you had? -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEERK+9HEcJHTJ9UqTMlUzhVv38QpAFAl0Jno4ACgkQlUzhVv38 QpD0xwgAg+8bGCPTQmf/u4aFJc6U4ewelzxmYGQAaH9sqfoGJoIgESiO2n56ySvi RFhy2hocy4HYVquBpUMHbZsx77Ko7yA914Cz9rRkraLONmWdDZSrHDsxTUUCQJPm gNZoRiLbvPpL8OgEvDVdcOvq0be0mM2oBnyfdMqQ4EQ5QJnzq1H6tVUzMIPzVI5F bRUvRawRfPRigTNkfRGZixbz4EoZteulbQqaa0H0jxxh/Tt2v0nGaukAMlaCxNI5 rKsC+nSFfYY2F7PqYyW4/TH8ssr6IBzozWquiBpkUt7CZL6cUYaFzhen4WrFr57J VhEtn4WJN9JMWxl+olRHnYYhc9Ul0w== =rmMO -----END PGP SIGNATURE----- --=-=-=-- From nobody Tue Jun 18 23:03:00 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 65A6F1203BA for ; Tue, 18 Jun 2019 23:02:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bEAGZoB8jJne for ; Tue, 18 Jun 2019 23:02:57 -0700 (PDT) Received: from mail-wr1-x429.google.com (mail-wr1-x429.google.com [IPv6:2a00:1450:4864:20::429]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E2C73120089 for ; Tue, 18 Jun 2019 23:02:56 -0700 (PDT) Received: by mail-wr1-x429.google.com with SMTP id c2so1891431wrm.8 for ; Tue, 18 Jun 2019 23:02:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=NDSpR/d2zEiGWNfVfVnRqUEKQjpOdqrhuh58K2xY2fQ=; b=WX4U6aXPyEV2BPdNQVy0tVxpRxbwfxahwpOgEHH1EO/zUPX9vNNIyFEhExF+UDJaL3 K3D2a6EyNm3SkuTGyME9w7ARVZD/nZp1XZ+DkvhNPzIYaptFs2I6UslPhEFQ0UD0xb86 q9g7aAO7zvIk64txW5rEu/VHHrTid3lZP6HCq72qta4rvO+49qnQzD9WrVWFXwxRu6cK IKLkOLTKEbPgSvkY8DlG9rE1DVwTt++uS5JND+HxuATcdbiOxWl0FompyHg1p0byzEe3 S9PhA97HLDMTz988r3hZAFxbupPdaxrHhfsaFecamUdPwzvzxHEv2YozG3uFJMFJPs+R eJwQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=NDSpR/d2zEiGWNfVfVnRqUEKQjpOdqrhuh58K2xY2fQ=; b=MgQ20L8ZMdcXpc6oHJCQwQDQxNc7hvn8hayNTlraCjUQwuAUNCuLjG1Dw/CYMqPk7S 4YM/yYd0Sbr0r+MGNikuDviymf1Th/4UgHEqRFV/sKSvTW4mNnd/IXfiAdk+Jtb4N9wI BYIPCldNtFqaCx38s1ufpizVXjMnUgVutUAdDbQWEjho1diZmEL4AePkj6BzZcAPb0cx 0fPjQxd8JBrX8JmfbvOTsHZpDD375sgSrXOQznS1Wm67yv3QhTyv9+9QeQpsbIYpS8Jh jG57w6DLXigcx4EaonfaIymsdT9Y+0w25CbaUTXOMvGYRV4u/VA16KYqxk+W3yL0847F wxmQ== X-Gm-Message-State: APjAAAUo7rqXjKUq7dMiNv9WU3YqMq1LZ5VJ/Ecl0qb3E3tWg7SXWXE5 JH5q765wljwfcGx0OzwSfkU= X-Google-Smtp-Source: APXvYqz/jUK3yV3ezpcq3lIp4cqULfwJEbn3uB6GZon93EyJNamBgcKote7fyvbOD3EINJCNvmTN1Q== X-Received: by 2002:a5d:6389:: with SMTP id p9mr72822171wru.297.1560924175420; Tue, 18 Jun 2019 23:02:55 -0700 (PDT) Received: from [192.168.1.79] (25.131.146.77.rev.sfr.net. [77.146.131.25]) by smtp.googlemail.com with ESMTPSA id w23sm345489wmc.38.2019.06.18.23.02.54 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 18 Jun 2019 23:02:54 -0700 (PDT) To: Michael Richardson Cc: "rats@ietf.org" , Anthony Nadalin , Laurence Lundblade , Thomas Fossati References: <12503.1552447661@localhost> <219648D6-188A-429D-A13F-ED6155DE9016@island-resort.com> <14288.1553710783@dooku.sandelman.ca> <4EB6FF13-2DAF-4BDC-AC90-C46720D61AF0@arm.com> <21417.1560911502@dooku.sandelman.ca> From: Anders Rundgren Message-ID: Date: Wed, 19 Jun 2019 08:02:53 +0200 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.7.1 MIME-Version: 1.0 In-Reply-To: <21417.1560911502@dooku.sandelman.ca> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Rats] Android attestations: Re: draft-richardson-rats-usecases-00 comments X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Jun 2019 06:03:00 -0000 On 2019-06-19 04:31, Michael Richardson wrote: > > Anders Rundgren wrote: > > Here you have another link: > > https://developer.android.com/training/articles/security-key-attestation > > > As an application developer I find this scheme and the associated > > "AndroidKeyStore" quite impractical. The recent addition of > > "StrongBox" makes it worse. > > Interesting. What is it that you find that you can not do? A mechanism that only attests keys cannot (securely) be used for provisioning anything but keys. > > > With a two-level TEE/SE session-key based scheme you only need to > > attest the session permitting you to perform any number of secure > > operations and close the session with a "commit" which in turn responds > > with a (session signed) message to the SP that everything went right. > > Or is this what you wish you had? In the absence of installable TA support, I have implemented this in Android as a SW emulator [1]. It is a part of the Saturn [3] payment authorization system I'm working on. As I have tried to describe [2], this concept also relieves you from (IMO) unwanted/unnecessary dependencies on provisioning protocol formats. Anders 1] https://github.com/cyberphone/webpkisuite-4-android/blob/master/app/src/main/java/org/webpki/mobile/android/sks/AndroidSKSImplementation.java 2] https://github.com/ietf-teep/architecture/issues/52 3] https://cyberphone.github.io/doc/two-visions-4-mobile-payments.pdf > > > -- > Michael Richardson , Sandelman Software Works > -= IPv6 IoT consulting =- > > > > > _______________________________________________ > RATS mailing list > RATS@ietf.org > https://www.ietf.org/mailman/listinfo/rats > From nobody Wed Jun 19 03:35:10 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3989B120130 for ; Wed, 19 Jun 2019 03:35:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0vh7rBoz3lOW for ; Wed, 19 Jun 2019 03:35:05 -0700 (PDT) Received: from huawei.com (lhrrgout.huawei.com [185.176.76.210]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 492831200C1 for ; Wed, 19 Jun 2019 03:35:05 -0700 (PDT) Received: from lhreml709-cah.china.huawei.com (unknown [172.18.7.107]) by Forcepoint Email with ESMTP id 82BAAF16E1FFF76A8C22 for ; Wed, 19 Jun 2019 11:35:03 +0100 (IST) Received: from DGGEMM405-HUB.china.huawei.com (10.3.20.213) by lhreml709-cah.china.huawei.com (10.201.108.32) with Microsoft SMTP Server (TLS) id 14.3.408.0; Wed, 19 Jun 2019 11:35:02 +0100 Received: from DGGEMM511-MBX.china.huawei.com ([169.254.1.140]) by DGGEMM405-HUB.china.huawei.com ([10.3.20.213]) with mapi id 14.03.0439.000; Wed, 19 Jun 2019 18:34:45 +0800 From: "Xialiang (Frank, Network Standard & Patent Dept)" To: "rats@ietf.org" Thread-Topic: comments on draft-birkholz-rats-basic-yang-module-00: Thread-Index: AdUmiOaxGoPbkJyaTlSfBTzX97dF9g== Date: Wed, 19 Jun 2019 10:34:45 +0000 Message-ID: Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.134.159.76] Content-Type: multipart/alternative; boundary="_000_C02846B1344F344EB4FAA6FA7AF481F13E7A743Cdggemm511mbxchi_" MIME-Version: 1.0 X-CFilter-Loop: Reflected Archived-At: Subject: [Rats] comments on draft-birkholz-rats-basic-yang-module-00: X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Jun 2019 10:35:08 -0000 --_000_C02846B1344F344EB4FAA6FA7AF481F13E7A743Cdggemm511mbxchi_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi authors, please find below an proposed addition to the module from Henk and me, also= a set of summarized comments for this draft to review: module: ietf-basic-remote-attestation +--ro rats-support-structures +--ro supported-algos* uint16 +--ro tpms* [tpm_name] //is version info needed here? | +--ro tpm_name string | +--ro tpm-physical-index? int32 {ietfhw:entity-mib}? +--ro compute-nodes* [node-name] | +--ro node-name string | +--ro node-physical-index? int32 {ietfhw:entity-mib}? +--ro endorsement-certificates //Is this the TCG specified EK ce= rtificate, or AK used here for RA, or a unified one? Is it better to move t= his under the respective tpm_name in tpms above, and delete this structure? +--ro certificate* [tpm_name] +--ro tpm_name string +--ro tpm-physical-index? int32 {ietfhw:entity-mib}? +--ro endorsement-certificate binary rpcs: +---x tpm12-challenge-response-attestation | +---w input | | +---w tpm1-attestation-challenge | | +---w pcr-indices* uint8 | | +---w nonce-value binary | | +---w TPM_SIG_SCHEME-value uint8 | | +---w (key-identifier)? | | | +--:(public-key) | | | | +---w pub-key-id? binary | | | +--:(TSS_UUID) | | | +---w TSS_UUID-value | | | +---w ulTimeLow? uint32 | | | +---w usTimeMid? uint16 | | | +---w usTimeHigh? uint16 | | | +---w bClockSeqHigh? uint8 | | | +---w bClockSeqLow? uint8 | | | +---w rgbNode* uint8 | | +---w add-version? boolean | | +---w tpm_name? string | | +---w tpm-physical-index? int32 {ietfhw:entity-mib}? | +--ro output | +--ro tpm12-attestation-response* [tpm_name] | +--ro tpm_name string | +--ro tpm-physical-index? int32 {ietfhw:entity-mib}? | +--ro up-time? uint32 | +--ro node-name? string | +--ro node-physical-index? int32 {ietfhw:entity-mib}? | +--ro (tpm12-quote) | +--:(tpm12-quote) | | +--ro version* [] | | | +--ro major? uint8 | | | +--ro minor? uint8 | | | +--ro revMajor? uint8 | | | +--ro revMinor? uint8 | | +--ro fixed? binary | | +--ro digest-value? binary | | +--ro external-data? binary | | +--ro TPM_PCR_COMPOSITE* [] | | | +--ro pcr-indices* uint8 | | | +--ro value-size? uint32 | | | +--ro tpm12-pcr-value* binary | | +--ro signature-size? uint32 | | +--ro signature? binary | +--:(tpm12-quote2) | +--ro tag? uint8 | +--ro fixed? binary | +--ro external-data? binary | +--ro pcr-indices* uint8 | +--ro locality-at-release? uint8 | +--ro digest-at-release? binary | +--ro signature-size? uint32 | +--ro signature? binary +---x tpm2-challenge-response-attestation | +---w input | | +---w tpm2-attestation-challenge //should we consider supporti= ng multiple tpms in one challenge-response interaction? And the output belo= w has already multiple tpms~~ | | | +---w pcr-list* [] //this is an array of array of PCRs, why= do you design in this way? | | | | +---w pcr | | | | +---w pcr-indices* uint8 | | | | +---w (algo-registry-type) | | | | +--:(tcg) | | | | | +---w tcg-hash-algo-id? uint16 | | | | +--:(ietf) | | | | +---w ietf-ni-hash-algo-id? uint8 | | | +---w nonce-value binary | | | +---w (signature-identifier-type) | | | | +--:(TPM_ALG_ID) | | | | | +---w TPM_ALG_ID-value? uint16 | | | | +--:(COSE_Algorithm) | | | | +---w COSE_Algorithm-value? int32 | | | +---w (key-identifier)? | | | +--:(public-key) | | | | +---w pub-key-id? binary | | | +--:(uuid) | | | +---w uuid-value? binary | | +---w tpm_name? string | | +---w tpm-physical-index? int32 {ietfhw:entity-mib}? | +--ro output | +--ro tpm2-attestation-response* [tpm_name] | +--ro tpm_name string | +--ro tpm-physical-index? int32 {ietfhw:entity-mib}? | +--ro up-time? uint32 | +--ro node-name? string | +--ro node-physical-index? int32 {ietfhw:entity-mib}? | +--ro tpms-attest | | +--ro pcrdigest? binary | | +--ro tpms-attest-result? binary | | +--ro tpms-attest-result-length? uint32 | +--ro tpmt-signature? binary //is signature-length m= issed here? +---x basic-trust-establishment //So, this rpc is used once be= fore the attestation process for trust establishment and certificate & key-= identifier exchange? If so, it is still tpm2.0 specific, I assume we need o= ne for tpm1.2, too. | +---w input | | +---w nonce-value binary | | +---w (signature-identifier-type) | | | +--:(TPM_ALG_ID) | | | | +---w TPM_ALG_ID-value? uint16 | | | +--:(COSE_Algorithm) | | | +---w COSE_Algorithm-value? int32 | | +---w tpm_name? string | | +---w tpm-physical-index? int32 {ietfhw:entity-mib}? | | +---w certificate-name? string //how does th= e verifier know the existing certificate names in advance? The "rats-suppor= t-structures" above only provides the EK certificate, not AK. | +--ro output | +--ro attestation-certificates* [tpm_name] // challenge messag= e has only one tpm_name, why are there multiple tpm's response here? | +--ro tpm_name string | +--ro tpm-physical-index? int32 {ietfhw:entity-mib}? | +--ro up-time? uint32 | +--ro node-name? string | +--ro node-physical-index? int32 {ietfhw:entity-mib}? | +--ro certificate-name? string | +--ro attestation-certificate? ietfct:end-entity-cert-cms = //Same problem, what and where is AK certificate? | +--ro (key-identifier)? //should here consider the T= PM 1.2 TSS_UUID option? If we can use this RPC for TPM2.0 and TPM1.2 both, = that should be added here. If not, it goes in an corresponding TPM1.2 RPC, = analogously. | +--:(public-key) | | +--ro pub-key-id? binary | +--:(uuid) | +--ro uuid-value? binary +---x log-retrieval +---w input | +---w log-selector* [node-name] | | +---w node-name string | | +---w node-physical-index? int32 {ietfhw:entity-mib}? | | +---w (index-type)? | | +--:(last-entry) | | | +---w last-entry-value? binary | | +--:(index) | | | +---w index-number? uint64 | | +--:(timestamp) | | +---w timestamp? yang:date-and-time | +---w log-type identityref | +---w pcr-list* [] //this is an array of array of PCRs, why = do you design in this way? | | +---w pcr | | +---w pcr-indices* uint8 | | +---w (algo-registry-type) | | +--:(tcg) | | | +---w tcg-hash-algo-id? uint16 | | +--:(ietf) | | +---w ietf-ni-hash-algo-id? uint8 | +---w log-entry-quantity? uint16 +--ro output +--ro system-event-logs +--ro node-data* [node-name] +--ro node-name string +--ro node-physical-index? int32 {ietfhw:entity-mib}? +--ro up-time? uint32 +--ro tpm-updated* [tpm_name] //so, does it mean th= at there are possibly multiple tpms in one node? If so, how to use the PCR = values of them together to verify the log integrity? | +--ro tpm_name string | +--ro tpm-physical-index? int32 {ietfhw:entity-mib}? +--ro log-result +--ro (log-type) +--:(bios) | +--ro bios-event-logs | +--ro bios-event-entry* [event-number] | +--ro event-number uint32 | +--ro event-type? uint32 | +--ro pcr-index? uint16 //shoul= d this be the pcr-value? | +--ro digest-list* [] | | +--ro (algo-registry-type) | | | +--:(tcg) | | | | +--ro tcg-hash-algo-id? uint1= 6 | | | +--:(ietf) | | | +--ro ietf-ni-hash-algo-id? uint8 | | +--ro digest* binar= y | +--ro event-size? uint32 | +--ro event-data* uint8 +--:(ima) +--ro ima-event-logs +--ro ima-event-entry* [event-number] +--ro event-number uint64 +--ro ima-template? string +--ro filename-hint? string +--ro filedata-hash? binary +--ro template-hash-algorithm? string +--ro template-hash? binary +--ro pcr-index? uint16 /= /should this be the pcr-value? +--ro signature? binary Thanks a lot! B.R. Frank --_000_C02846B1344F344EB4FAA6FA7AF481F13E7A743Cdggemm511mbxchi_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi authors,

please find below an proposed a= ddition to the module from Henk and me, also a set of summarized comments f= or this draft to review:

 

module: ietf-basic-remote-attes= tation

  +--ro rats-support-s= tructures

     +-= -ro supported-algos*         &= nbsp;  uint16

     +-= -ro tpms* [tpm_name]      //is version info needed= here?

     | = ; +--ro tpm_name         &= nbsp;    string

     | = ; +--ro tpm-physical-index?   int32 {ietfhw:entity-mib}?=

     +-= -ro compute-nodes* [node-name] 

     |=   +--ro node-name        &= nbsp;     string

     | = ; +--ro node-physical-index?   int32 {ietfhw:entity-mib}?

     +-= -ro endorsement-certificates       //Is this = the TCG specified EK certificate, or AK used here for RA, or a unified one?= Is it better to move this under the respective tpm_name in tpms above, and= delete this structure?

     &= nbsp;  +--ro certificate* [tpm_name]

     &= nbsp;     +--ro tpm_name    &nb= sp;             = ; string

     &= nbsp;     +--ro tpm-physical-index?  &nbs= p;     int32 {ietfhw:entity-mib}?

     &= nbsp;     +--ro endorsement-certificate  =   binary

 

  rpcs:<= /p>

    +---x tp= m12-challenge-response-attestation

    |  += ;---w input

    |  |&nb= sp; +---w tpm1-attestation-challenge

    |  |&nb= sp;    +---w pcr-indices*     &= nbsp;      uint8

    | = |     +---w nonce-value    &nb= sp;        binary

    |  |&nb= sp;    +---w TPM_SIG_SCHEME-value    uint= 8      

    | = |     +---w (key-identifier)?

    |  |&nb= sp;    |  +--:(public-key)

    |  |&nb= sp;    |  |  +---w pub-key-id?  &nbs= p;    binary

    |  |&nb= sp;    |  +--:(TSS_UUID)

    |  |&nb= sp;    |     +---w TSS_UUID-value

    |  |&nb= sp;    |        +---w= ulTimeLow?       uint32

    |  |&nb= sp;    |        +---w= usTimeMid?       uint16

    |  |&nb= sp;    |        +---w= usTimeHigh?      uint16

    |  |&nb= sp;    |        +---w= bClockSeqHigh?   uint8

    |  |&nb= sp;    |        +---w= bClockSeqLow?    uint8

    |  |&nb= sp;    |        +---w= rgbNode*         uint8<= /span>

    |  |&nb= sp;    +---w add-version?     &= nbsp;      boolean

    |  |&nb= sp;    +---w tpm_name?     &nbs= p;         string=

    |  |&nb= sp;    +---w tpm-physical-index?    = int32 {ietfhw:entity-mib}?

    |  += ;--ro output

    |  = ;   +--ro tpm12-attestation-response* [tpm_name]

    |  = ;      +--ro tpm_name    &= nbsp;           &nbs= p;    string

    |  = ;      +--ro tpm-physical-index?  &n= bsp;       int32 {ietfhw:entity-mib}?

    |  = ;      +--ro up-time?    &= nbsp;           &nbs= p;    uint32

    |  = ;      +--ro node-name?    = ;            &n= bsp;  string

    |  = ;      +--ro node-physical-index?  &= nbsp;      int32 {ietfhw:entity-mib}?

    |  = ;      +--ro (tpm12-quote)

    |  = ;         +--:(tpm12-quote)

    | =           |  +--ro ve= rsion* []

    |  = ;         |  |  +--ro= major?      uint8

    |  = ;         |  |  +--ro= minor?      uint8

    |  = ;         |  |  +--ro= revMajor?   uint8

    |  = ;         |  |  +--ro= revMinor?   uint8

    |  = ;         |  +--ro fixed?&= nbsp;           &nbs= p;    binary

    |  = ;         |  +--ro digest-= value?          binary

    |  = ;         |  +--ro externa= l-data?         binary

    |  = ;         |  +--ro TPM_PCR= _COMPOSITE* []

    |  = ;         |  |  +--ro= pcr-indices*       uint8

    |  = ;         |  |  +--ro= value-size?        uint32

    |  = ;         |  |  +--ro= tpm12-pcr-value*   binary

    |  = ;         |  +--ro signatu= re-size?        uint32=

    |  = ;         |  +--ro signatu= re?            = binary

    |  = ;         +--:(tpm12-quote2)

    | =              &#= 43;--ro tag?          &nb= sp;        uint8

    |  = ;            +--= ro fixed?           =       binary

    |  = ;            +--= ro external-data?         binary

    |  = ;            +--= ro pcr-indices*          = uint8

    |  = ;            +--= ro locality-at-release?   uint8

    |  = ;            +--= ro digest-at-release?     binary

    |  = ;            +--= ro signature-size?        uint32

    |  = ;            +--= ro signature?          &n= bsp;  binary

    +---x tp= m2-challenge-response-attestation

    |  += ;---w input

    |  |&nb= sp; +---w tpm2-attestation-challenge    //should we cons= ider supporting multiple tpms in one challenge-response interaction? And th= e output below has already multiple tpms~~

    |  |&nb= sp; |  +---w pcr-list* []    //this is an array of = array of PCRs, why do you design in this way?

    |  |&nb= sp; |  |  +---w pcr

    |  |&nb= sp; |  |     +---w pcr-indices*  &nb= sp;             = ;  uint8

    |  |&nb= sp; |  |     +---w (algo-registry-type)

    |  |&nb= sp; |  |        +--:(tcg)<= /o:p>

    |  |&nb= sp; |  |        |  +---w t= cg-hash-algo-id?       uint16

    |  |&nb= sp; |  |        +--:(ietf)=

    |  |&nb= sp; |  |           &= #43;---w ietf-ni-hash-algo-id?   uint8

    |  |&nb= sp; |  +---w nonce-value       =             binary

    |  |&nb= sp; |  +---w (signature-identifier-type) 

    | = |  |  |  +--:(TPM_ALG_ID)

    |  |&nb= sp; |  |  |  +---w TPM_ALG_ID-value?   &n= bsp;   uint16

    |  |&nb= sp; |  |  +--:(COSE_Algorithm)

    |  |&nb= sp; |  |     +---w COSE_Algorithm-value? =   int32

    |  |&nb= sp; |  +---w (key-identifier)?  

    | = |  |     +--:(public-key)

    |  |&nb= sp; |     |  +---w pub-key-id?  &nbs= p;          binary<= /span>

    |  |&nb= sp; |     +--:(uuid)

    |  |&nb= sp; |        +---w uuid-value? =             binary&n= bsp;      

    | = |  +---w tpm_name?        = ;             s= tring           &nbs= p;

    | = |  +---w tpm-physical-index?      &= nbsp;    int32 {ietfhw:entity-mib}?    &= nbsp;

    |  = ;+--ro output

    |  = ;   +--ro tpm2-attestation-response* [tpm_name] 

    |  = ;      +--ro tpm_name    &= nbsp;          string

    |  = ;      +--ro tpm-physical-index?  &n= bsp; int32 {ietfhw:entity-mib}?

    |  = ;      +--ro up-time?    &= nbsp;          uint32

    |  = ;      +--ro node-name?    = ;         string<= /p>

    |  = ;      +--ro node-physical-index?   = int32 {ietfhw:entity-mib}?

    |  = ;      +--ro tpms-attest   &nbs= p;        

    | =        |  +--ro pcrdigest? &nbs= p;            &= nbsp;    binary

    |  = ;      |  +--ro tpms-attest-result? =          binary

    |  = ;      |  +--ro tpms-attest-result-length= ?   uint32

    |  = ;      +--ro tpmt-signature?   =      binary    //is signature-length mis= sed here?

    +---x ba= sic-trust-establishment        &nbs= p; //So, this rpc is used once before the attestation process for trust est= ablishment and certificate & key-identifier exchange? If so, it is stil= l tpm2.0 specific, I assume we need one for tpm1.2, too.

    |  += ;---w input

    |  |&nb= sp; +---w nonce-value        &n= bsp;          binary &nbs= p;  

    | = |  +---w (signature-identifier-type)

    | = |  |  +--:(TPM_ALG_ID)

    |  |&nb= sp; |  |  +---w TPM_ALG_ID-value?    &nbs= p;  uint16

    |  |&nb= sp; |  +--:(COSE_Algorithm)

    |  |&nb= sp; |     +---w COSE_Algorithm-value?   i= nt32

    |  |&nb= sp; +---w tpm_name?        &nbs= p;            string=

    |  |&nb= sp; +---w tpm-physical-index?       =     int32 {ietfhw:entity-mib}?

    |  |&nb= sp; +---w certificate-name?       &n= bsp;     string      &nbs= p;   //how does the verifier know the existing certificate names = in advance? The "rats-support-structures" above only provides the= EK certificate, not AK.

    |  += ;--ro output

    |  = ;   +--ro attestation-certificates* [tpm_name]  &nb= sp; // challenge message has only one tpm_name, why are there multiple tpm&= #8217;s response here?

    |  = ;      +--ro tpm_name    &= nbsp;           &nbs= p;  string

    |  = ;      +--ro tpm-physical-index?  &n= bsp;     int32 {ietfhw:entity-mib}?

    |  = ;      +--ro up-time?    &= nbsp;           &nbs= p;  uint32

    |  = ;      +--ro node-name?    = ;             s= tring

    |  = ;      +--ro node-physical-index?  &= nbsp;    int32 {ietfhw:entity-mib}?

    |  = ;      +--ro certificate-name?  &nbs= p;       string

    |  = ;      +--ro attestation-certificate? &nb= sp; ietfct:end-entity-cert-cms     //Same problem, what= and where is AK certificate?

    |  = ;      +--ro (key-identifier)?  &nbs= p;        //should here consider the TPM= 1.2 TSS_UUID option? If we can use this RPC for TPM2.0 and TPM1.2 both, th= at should be added here. If not, it goes in an corresponding TPM1.2 RPC, analogously.

    |  = ;         +--:(public-key)=

    |  = ;         |  +--ro pub-key= -id?          binary

    |  = ;         +--:(uuid)=

    |  = ;            +--= ro uuid-value?          binary=

    +---x lo= g-retrieval

     &= nbsp; +---w input

     &= nbsp; |  +---w log-selector* [node-name]

     &= nbsp; |  |  +---w node-name     &nbs= p;           string<= /o:p>

     &= nbsp; |  |  +---w node-physical-index?    = ;  int32 {ietfhw:entity-mib}?

     &= nbsp; |  |  +---w (index-type)?

     &= nbsp; |  |     +--:(last-entry)

     &= nbsp; |  |     |  +---w last-entry-value?=    binary

     &= nbsp; |  |     +--:(index)

     &= nbsp; |  |     |  +---w index-number?&nbs= p;      uint64

     &= nbsp; |  |     +--:(timestamp)

     &= nbsp; |  |        +---w timesta= mp?          yang:date-and-tim= e

     &= nbsp; |  +---w log-type       &= nbsp;      identityref

     &= nbsp; |  +---w pcr-list* []      //this i= s an array of array of PCRs, why do you design in this way?

     &= nbsp; |  |  +---w pcr

     &= nbsp; |  |     +---w pcr-indices*  &= nbsp;           &nbs= p;   uint8

     &= nbsp; |  |     +---w (algo-registry-type)=

     &= nbsp; |  |        +--:(tcg)

     &= nbsp; |  |        |  +---w= tcg-hash-algo-id?       uint16

     &= nbsp; |  |        +--:(ietf)

     &= nbsp; |  |          = +---w ietf-ni-hash-algo-id?   uint8

     &= nbsp; |  +---w log-entry-quantity?   uint16

     &= nbsp; +--ro output

     &= nbsp;    +--ro system-event-logs

     &= nbsp;       +--ro node-data* [node-name]<= o:p>

     &= nbsp;          +--ro node-= name            = ;  string

     &= nbsp;          +--ro node-= physical-index?   int32 {ietfhw:entity-mib}?

     &= nbsp;          +--ro up-ti= me?            =    uint32

     &= nbsp;          +--ro tpm-u= pdated* [tpm_name]         //so, do= es it mean that there are possibly multiple tpms in one node? If so, how to= use the PCR values of them together to verify the log integrity?

     &= nbsp;          |  +--= ro tpm_name          &nbs= p;   string

     &= nbsp;          |  +--= ro tpm-physical-index?   int32 {ietfhw:entity-mib}?

     &= nbsp;          +--ro log-r= esult

     &= nbsp;           &nbs= p; +--ro (log-type)

     &= nbsp;            &nb= sp;   +--:(bios)

     &= nbsp;           &nbs= p;    |  +--ro bios-event-logs

     &= nbsp;           &nbs= p;    |     +--ro bios-event-entry* = [event-number]

     &= nbsp;           &nbs= p;    |        +--ro = event-number    uint32

     &= nbsp;           &nbs= p;    |        +--ro = event-type?     uint32

     &= nbsp;           &nbs= p;    |        +--ro = pcr-index?      uint16    &nbs= p;    //should this be the pcr-value?

     &= nbsp;           &nbs= p;    |        +--ro = digest-list* []   

     &= nbsp;           &nbs= p;    |        |  &#= 43;--ro (algo-registry-type)

     &= nbsp;           &nbs= p;    |        |  |&= nbsp; +--:(tcg)

     &= nbsp;           &nbs= p;    |        |  |&= nbsp; |  +--ro tcg-hash-algo-id?     &nbs= p; uint16

     &= nbsp;           &nbs= p;    |        |  |&= nbsp; +--:(ietf)

     &= nbsp;           &nbs= p;    |        |  |&= nbsp;    +--ro ietf-ni-hash-algo-id?   uint8

     &= nbsp;           &nbs= p;    |        |  &#= 43;--ro digest*          =              bi= nary

     &= nbsp;           &nbs= p;    |        +--ro = event-size?     uint32

     &= nbsp;           &nbs= p;    |        +--ro = event-data*     uint8

     &= nbsp;           &nbs= p;    +--:(ima)

     &= nbsp;           &nbs= p;       +--ro ima-event-logs<= /span>

     &= nbsp;           &nbs= p;          +--ro ima-even= t-entry* [event-number]

     &= nbsp;           &nbs= p;             = +--ro event-number         = ;      uint64

     &= nbsp;           &nbs= p;             = +--ro ima-template?        &nbs= p;     string

     &= nbsp;           &nbs= p;             = +--ro filename-hint?        &nb= sp;    string

     &= nbsp;           &nbs= p;             = +--ro filedata-hash?        &nb= sp;    binary

     &= nbsp;           &nbs= p;             = +--ro template-hash-algorithm?   string

     &= nbsp;           &nbs= p;             = +--ro template-hash?        &nb= sp;    binary

      =             &nb= sp;            = +--ro pcr-index?         &= nbsp;       uint16    //should= this be the pcr-value?

     &= nbsp;           &nbs= p;             = +--ro signature?         &= nbsp;       binary

 

 

Thanks a lot!=

 

B.R.

Frank

 

--_000_C02846B1344F344EB4FAA6FA7AF481F13E7A743Cdggemm511mbxchi_-- From nobody Wed Jun 19 09:02:46 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C3BA1120140 for ; Wed, 19 Jun 2019 09:02:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Kq0NyhKn-Szw for ; Wed, 19 Jun 2019 09:02:40 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 874BF120026 for ; Wed, 19 Jun 2019 09:02:39 -0700 (PDT) Received: from sandelman.ca (unknown [IPv6:2607:f0b0:f:2:56b2:3ff:fe0b:d84]) by tuna.sandelman.ca (Postfix) with ESMTP id 75DDC380BE for ; Wed, 19 Jun 2019 12:01:03 -0400 (EDT) Received: by sandelman.ca (Postfix, from userid 179) id E7816E9E; Wed, 19 Jun 2019 12:02:36 -0400 (EDT) Received: from sandelman.ca (localhost [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id E508EE47 for ; Wed, 19 Jun 2019 12:02:36 -0400 (EDT) From: Michael Richardson To: "rats@ietf.org" In-Reply-To: <79ccb2d7-09a3-913d-f47d-1e702a23b341@gmail.com> References: <12503.1552447661@localhost> <58E37DB5-098C-4387-9A52-4AECD0F69F25@island-resort.com> <6495.1553219901@dooku.sandelman.ca> <507.1553725386@dooku.sandelman.ca> <24C0968B-32B0-4EF1-99C8-61D3F0955BA1@intel.com> <793F9A34-050F-4914-AF4B-08C072730A06@island-resort.com> <19652.1553943890@dooku.sandelman.ca> <79ccb2d7-09a3-913d-f47d-1e702a23b341@gmail.com> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Date: Wed, 19 Jun 2019 12:02:36 -0400 Message-ID: <25581.1560960156@localhost> Archived-At: Subject: [Rats] aligning the use case documents appropriately X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Jun 2019 16:02:45 -0000 "I am editing the usecase document prior to next Thursday's virtual interim" This has taken longer than I would have liked, and Thursday is now tomorrow, and you might want time to read it, so I have mostly failed here. I am putting out a -02 document anyway. I realized as I was processing the various comments that I and many others are perhaps confused about what we need here. I kept thinking that this document was going to collect *end user* use cases, and of course some people were wondering why I was talking about specific verticals. Let me propose the following text: +This document exists as place to collect use cases for the common RATS +technologies in support of the IETF RATS charter point 1. This document is +not expected to be published as an RFC, but remain open as a working +document. It could become an appendix to provide motivation for a protocol +standards document. + +This document will probably not deal with use cases from an end-user +point of +view, but rather on the technology verticals that wish to use RATS concepts +(such as EAT) in their deployments. + +End-user use cases that would either directly leverage RATS technology, or +would serve to inform technology choices are welcome, however. I would be very happy if it turned out that we only discussed this point at the virtual interim! That we wind up with a strong consensus. ==== From nobody Wed Jun 19 09:08:47 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F132912011C for ; Wed, 19 Jun 2019 09:08:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yZfPCsqG8B-Q for ; Wed, 19 Jun 2019 09:08:43 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2D0661200FF for ; Wed, 19 Jun 2019 09:08:43 -0700 (PDT) Received: from sandelman.ca (unknown [IPv6:2607:f0b0:f:2:56b2:3ff:fe0b:d84]) by tuna.sandelman.ca (Postfix) with ESMTP id DBBA0380BE; Wed, 19 Jun 2019 12:07:07 -0400 (EDT) Received: by sandelman.ca (Postfix, from userid 179) id 79716E9E; Wed, 19 Jun 2019 12:08:41 -0400 (EDT) Received: from sandelman.ca (localhost [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id 76E8FE97; Wed, 19 Jun 2019 12:08:41 -0400 (EDT) From: Michael Richardson To: Kathleen Moriarty cc: rats@ietf.org In-Reply-To: References: X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Rats] RATS Use case edits X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Jun 2019 16:08:45 -0000 --=-=-= Content-Type: text/plain Kathleen Moriarty wrote: > I was reading through your document, so I figured I'd provide the edits > I see... I took your edits. > If a biometric is being used to identify the human, don't you mean > identity proofing of the manager? How is that attestation? this has become: + A FIDO use case involves a relying party that having a attestion on + the biometric system that identifies a human. It is the state of the + biometric system that is being attested to, not the identity of the human. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl0KXgkACgkQgItw+93Q 3WWmJwf+Ji2t8EmSnSKHWhV2GQKLn/laKELAwfT+3Ryll5LSbJ0YfP3IAVcg+2EJ 4qj02eX811hzMZVuKc0lbcE0PqLbfhD/8NABLHSZyIwldh6nhDBGV+N3b78MXGdQ zJJ9zw1Qb6HC2/cC7YgzeTFwGxreMWRDcQW8Cfhlmg7JE7Mne2oFRoIDpb3Dc1ar /tCaseJphY504eqWrsCqv9fZsm2x5afPNCg9nmmuL6h2CDkVVIZjpOFFC9zc0pl2 PJLjm+u7GgL+abz5GgWbr1gytvChJtjKkDiQ8CfvhQEnOCRyOraMxCWtGsmAAHeA 57FQ4pn8AxWmllzae3OZ7EHyE4WwBg== =hdnJ -----END PGP SIGNATURE----- --=-=-=-- From nobody Wed Jun 19 12:45:11 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C6F50120AC4 for ; Wed, 19 Jun 2019 12:45:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KZt19TwFimTK for ; Wed, 19 Jun 2019 12:45:07 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B8042120AC3 for ; Wed, 19 Jun 2019 12:45:07 -0700 (PDT) Received: from sandelman.ca (unknown [IPv6:2607:f0b0:f:2:56b2:3ff:fe0b:d84]) by tuna.sandelman.ca (Postfix) with ESMTP id 70CD638185; Wed, 19 Jun 2019 15:43:30 -0400 (EDT) Received: by sandelman.ca (Postfix, from userid 179) id 48F76E9E; Wed, 19 Jun 2019 15:45:04 -0400 (EDT) Received: from sandelman.ca (localhost [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id 45E64E97; Wed, 19 Jun 2019 15:45:04 -0400 (EDT) From: Michael Richardson To: Anders Rundgren cc: Carl Wallace , "rats\@ietf.org" In-Reply-To: <9a7e3efe-b021-f255-4afd-649ea0d5772d@gmail.com> References: <12503.1552447661@localhost> <58E37DB5-098C-4387-9A52-4AECD0F69F25@island-resort.com> <6495.1553219901@dooku.sandelman.ca> <507.1553725386@dooku.sandelman.ca> <24C0968B-32B0-4EF1-99C8-61D3F0955BA1@intel.com> <793F9A34-050F-4914-AF4B-08C072730A06@island-resort.com> <19652.1553943890@dooku.sandelman.ca> <79ccb2d7-09a3-913d-f47d-1e702a23b341@gmail.com> <29183.1560536152@localhost> <9a7e3efe-b021-f255-4afd-649ea0d5772d@gmail.com> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Rats] More use cases for draft-richardson-rats-usecases-00 X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Jun 2019 19:45:10 -0000 --=-=-= Content-Type: text/plain Anders Rundgren wrote: > Hi Michael, > A session based attestation is the combination of a static attestation > and the creation of a shared session key. That is, possible subsequent > operations using the shared session key "inherit" the initial > attestation. Such operations use MAC signatures and symmetric > encryption (using keys derived from the session key) in order to form a > protected API. Ideally a session based attestation scheme also > provides "atomic" operation, terminated by a "commit" call. I understand. I'm not sure what to change, if anything, based upon your comments. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl0KkMAACgkQgItw+93Q 3WV/xQf+IRlp58FpDUqYT0akYnnT7CC+WkL5EhCSVPJ4hWQc5LHbVOtSkgQAfle2 kWe/FrgaeQOLg/72jQ4w3cY3Sbu0wkHRQGyEZ3sNH1GTQTtKcodLmgOCux5/ak1K bpBOp+qIiBqlnmxcRgnrc8En87M1VqsO76X/l9BwSCnviQsynYCv2k4y9IqLX0qo iJpetRnRLTWnxHyz5nHDdRnF867YvpFndWmF871edtR4k/lv6rgKdovQIGaPk+xA VEX/YLZKLKdBbrPeJ2ul0VePRX+I7RoDoQ61/lQw4mR5wyMxdtz3YAFo8X5KoWe9 FICb74MCHd3Oyj7E7EBif7BGxnU2ww== =QHYL -----END PGP SIGNATURE----- --=-=-=-- From nobody Wed Jun 19 12:47:30 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3AF8C120A8A for ; Wed, 19 Jun 2019 12:47:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JvY448gNYQbG for ; Wed, 19 Jun 2019 12:47:26 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5EEA212008F for ; Wed, 19 Jun 2019 12:47:25 -0700 (PDT) Received: from sandelman.ca (unknown [IPv6:2607:f0b0:f:2:56b2:3ff:fe0b:d84]) by tuna.sandelman.ca (Postfix) with ESMTP id 8529438185; Wed, 19 Jun 2019 15:45:50 -0400 (EDT) Received: by sandelman.ca (Postfix, from userid 179) id 49894E9E; Wed, 19 Jun 2019 15:47:24 -0400 (EDT) Received: from sandelman.ca (localhost [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id 464BAE97; Wed, 19 Jun 2019 15:47:24 -0400 (EDT) From: Michael Richardson To: "Smith\, Ned" cc: Anders Rundgren , Carl Wallace , "rats\@ietf.org" In-Reply-To: <6744BE53-4071-4349-ACB5-23FDE107F16E@intel.com> References: <12503.1552447661@localhost> <58E37DB5-098C-4387-9A52-4AECD0F69F25@island-resort.com> <6495.1553219901@dooku.sandelman.ca> <507.1553725386@dooku.sandelman.ca> <24C0968B-32B0-4EF1-99C8-61D3F0955BA1@intel.com> <793F9A34-050F-4914-AF4B-08C072730A06@island-resort.com> <19652.1553943890@dooku.sandelman.ca> <79ccb2d7-09a3-913d-f47d-1e702a23b341@gmail.com> <7B05ABC3-FE60-4879-9DEE-B896DD15507D@intel.com> <4607.1560537962@localhost> <6744BE53-4071-4349-ACB5-23FDE107F16E@intel.com> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Rats] More use cases for draft-richardson-rats-usecases-00 X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Jun 2019 19:47:29 -0000 --=-=-= Content-Type: text/plain Smith, Ned wrote: >> The TUDA draft seems to resemble (i). (Henk can correct me). >> The yang draft seems to resemble (ii). (Henk can correct me). mcr> I'm trying to figure out what to do this statement. nms> If there is value in categorizing the attestation approach taken by nms> various proposed RATS drafts in terms of (i) implicit attestation nms> and (ii) explicit attestation then it seems TUDA nms> (https://datatracker.ietf.org/doc/draft-birkholz-rats-tuda/ ) may be nms> classified as implicit attestation. Since TUDA is also using nms> time-based exchanges Henk may think it doesn't fit well into this nms> categorization. The YANG module draft nms> https://datatracker.ietf.org/doc/draft-birkholz-rats-basic-yang-module/ nms> appears to me to be a case of explicit attestation. okay, but this is an analysis what the implementations/protocols provide, whereas the usecase document is trying to categorize what the users need :-) I'm violently agreeing that the terms are useful, but I don't think they belong here. -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl0KkUsACgkQgItw+93Q 3WUpHggAwrZyQ/Z1ayTeUgLQFt6obpyxyI7JqkRr2+RUI0wKED75YAEiMt/D5VMR fXhp1oDm6iWcYoWm1DejFjBqcGfQNAqB/yovQsIm77XkDp4EqQL44B9YIIp3GQ1f hUg9uMzve+MD47t8MojZA9U2wY+Z7pR/FlqukW+G+h7awHkBhRUV/drvi7wAh/Hd caCmOOUQs4k9tqdSew5fB5qpMv0D00uREz+NR3DWWxRXwJBW+i/tlxxURzLwJk0u fSDE19nNMHhnTUbQqhcSQn3j5V6lB1GIp2dv70Io4a7EymslzYxlrjvb7+1XK/ZT 1O70dYxZLnibHoFTFs9ymOCBUVdjhw== =BLmC -----END PGP SIGNATURE----- --=-=-=-- From nobody Wed Jun 19 13:34:14 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 20AFE12093C for ; Wed, 19 Jun 2019 13:34:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id peIdLpSxYRwP for ; Wed, 19 Jun 2019 13:34:11 -0700 (PDT) Received: from mga06.intel.com (mga06.intel.com [134.134.136.31]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E2D211201F8 for ; Wed, 19 Jun 2019 13:34:10 -0700 (PDT) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga001.jf.intel.com ([10.7.209.18]) by orsmga104.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 19 Jun 2019 13:34:10 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.63,394,1557212400"; d="scan'208";a="243422156" Received: from orsmsx105.amr.corp.intel.com ([10.22.225.132]) by orsmga001.jf.intel.com with ESMTP; 19 Jun 2019 13:34:09 -0700 Received: from orsmsx153.amr.corp.intel.com (10.22.226.247) by ORSMSX105.amr.corp.intel.com (10.22.225.132) with Microsoft SMTP Server (TLS) id 14.3.439.0; Wed, 19 Jun 2019 13:34:09 -0700 Received: from orsmsx109.amr.corp.intel.com ([169.254.11.17]) by ORSMSX153.amr.corp.intel.com ([169.254.12.252]) with mapi id 14.03.0439.000; Wed, 19 Jun 2019 13:34:09 -0700 From: "Smith, Ned" To: Michael Richardson CC: "rats@ietf.org" , Carl Wallace , Anders Rundgren Thread-Topic: [Rats] More use cases for draft-richardson-rats-usecases-00 Thread-Index: AQHVIuFqWQBd9YaaOUe/YohgH2bb7KagGH2AgAPGugD//5e2AA== Date: Wed, 19 Jun 2019 20:34:09 +0000 Message-ID: <44F9F5E6-EBE6-4571-8B4D-3E2474FDAAA2@intel.com> References: <12503.1552447661@localhost> <58E37DB5-098C-4387-9A52-4AECD0F69F25@island-resort.com> <6495.1553219901@dooku.sandelman.ca> <507.1553725386@dooku.sandelman.ca> <24C0968B-32B0-4EF1-99C8-61D3F0955BA1@intel.com> <793F9A34-050F-4914-AF4B-08C072730A06@island-resort.com> <19652.1553943890@dooku.sandelman.ca> <79ccb2d7-09a3-913d-f47d-1e702a23b341@gmail.com> <7B05ABC3-FE60-4879-9DEE-B896DD15507D@intel.com> <4607.1560537962@localhost> <6744BE53-4071-4349-ACB5-23FDE107F16E@intel.com> <20112.1560973644@localhost> In-Reply-To: <20112.1560973644@localhost> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1a.0.190609 x-originating-ip: [10.24.14.73] Content-Type: text/plain; charset="utf-8" Content-ID: <958B6F396A2A4B4DA29F523DE6E288D8@intel.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [Rats] More use cases for draft-richardson-rats-usecases-00 X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Jun 2019 20:34:13 -0000 VGhlIHVzZSBjYXNlIGNvbnRleHQgZm9yIGltcGxpY2l0IGF0dGVzdGF0aW9uIGlzIHRoYXQgZm9y IGV4YW1wbGUsIHRoZSBwcm90b2NvbCBiZXR3ZWVuIGF0dGVzdGVyIGFuZCB2ZXJpZmllciBkb2Vz bid0IGFsbG93IGV4cGxpY2l0IGluY2x1c2lvbiBvZiBhdHRlc3RhdGF0aW9uIGV2aWRlbmNlIGJ1 dCB0aGUgdmVyaWZpZXIgcmVxdWlyZXMgdGhlIGF0dGVzdGVyIHRvIG1lZXQgdmFyaW91cyB0cnVz dHdvcnRoaW5lc3MgY3JpdGVyaWEuIFVzZSBvZiB0aGUgYXR0ZXN0YXRpb24ga2V5IHByb3ZpZGVz IHRoZSB2ZXJpZmllciB3aXRoIGVub3VnaCBjb250ZXh0IHRvIGxvY2F0ZSBhdHRlc3RhdGlvbiBl dmlkZW5jZSB0aGF0IHdhcyBjb252ZXllZCBvdXQtb2YtYmFuZCAoYnkgc29tZSBvdGhlciBwYXRo KS4gRm9yIGV4YW1wbGUsIGl0IGNvdWxkIGJlIHN1cHBsaWVkIGluIGEgY2VydGlmaWNhdGUgZm9y IHRoZSBzaWduaW5nIGtleS4NCi1OZWQNCg0K77u/T24gNi8xOS8xOSwgMTI6NDcgUE0sICJSQVRT IG9uIGJlaGFsZiBvZiBNaWNoYWVsIFJpY2hhcmRzb24iIDxyYXRzLWJvdW5jZXNAaWV0Zi5vcmcg b24gYmVoYWxmIG9mIG1jcitpZXRmQHNhbmRlbG1hbi5jYT4gd3JvdGU6DQoNCiAgICANCiAgICBT bWl0aCwgTmVkIDxuZWQuc21pdGhAaW50ZWwuY29tPiB3cm90ZToNCiAgICAgICAgPj4gVGhlIFRV REEgZHJhZnQgc2VlbXMgdG8gcmVzZW1ibGUgKGkpLiAoSGVuayBjYW4gY29ycmVjdCBtZSkuDQog ICAgDQogICAgICAgID4+IFRoZSB5YW5nIGRyYWZ0IHNlZW1zIHRvIHJlc2VtYmxlIChpaSkuIChI ZW5rIGNhbiBjb3JyZWN0IG1lKS4NCiAgICANCiAgICAgICAgbWNyPiAgICAgSSdtIHRyeWluZyB0 byBmaWd1cmUgb3V0IHdoYXQgdG8gZG8gdGhpcyBzdGF0ZW1lbnQuDQogICAgDQogICAgICAgIG5t cz4gSWYgdGhlcmUgaXMgdmFsdWUgaW4gY2F0ZWdvcml6aW5nIHRoZSBhdHRlc3RhdGlvbiBhcHBy b2FjaCB0YWtlbiBieQ0KICAgICAgICBubXM+IHZhcmlvdXMgcHJvcG9zZWQgUkFUUyBkcmFmdHMg aW4gdGVybXMgb2YgKGkpIGltcGxpY2l0IGF0dGVzdGF0aW9uDQogICAgICAgIG5tcz4gYW5kIChp aSkgZXhwbGljaXQgYXR0ZXN0YXRpb24gdGhlbiBpdCBzZWVtcyBUVURBDQogICAgICAgIG5tcz4g KGh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0LWJpcmtob2x6LXJhdHMtdHVk YS8gKSBtYXkgYmUNCiAgICAgICAgbm1zPiBjbGFzc2lmaWVkIGFzIGltcGxpY2l0IGF0dGVzdGF0 aW9uLiBTaW5jZSBUVURBIGlzIGFsc28gdXNpbmcNCiAgICAgICAgbm1zPiB0aW1lLWJhc2VkIGV4 Y2hhbmdlcyBIZW5rIG1heSB0aGluayBpdCBkb2Vzbid0IGZpdCB3ZWxsIGludG8gdGhpcw0KICAg ICAgICBubXM+IGNhdGVnb3JpemF0aW9uLiBUaGUgWUFORyBtb2R1bGUgZHJhZnQNCiAgICAgICAg bm1zPiBodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC1iaXJraG9sei1yYXRz LWJhc2ljLXlhbmctbW9kdWxlLw0KICAgICAgICBubXM+IGFwcGVhcnMgdG8gbWUgdG8gYmUgYSBj YXNlIG9mIGV4cGxpY2l0IGF0dGVzdGF0aW9uLg0KICAgIA0KICAgIG9rYXksIGJ1dCB0aGlzIGlz IGFuIGFuYWx5c2lzIHdoYXQgdGhlIGltcGxlbWVudGF0aW9ucy9wcm90b2NvbHMgcHJvdmlkZSwN CiAgICB3aGVyZWFzIHRoZSB1c2VjYXNlIGRvY3VtZW50IGlzIHRyeWluZyB0byBjYXRlZ29yaXpl IHdoYXQgdGhlIHVzZXJzIG5lZWQgOi0pDQogICAgDQogICAgSSdtIHZpb2xlbnRseSBhZ3JlZWlu ZyB0aGF0IHRoZSB0ZXJtcyBhcmUgdXNlZnVsLCBidXQgSSBkb24ndCB0aGluayB0aGV5DQogICAg YmVsb25nIGhlcmUuDQogICAgDQogICAgLS0NCiAgICBNaWNoYWVsIFJpY2hhcmRzb24gPG1jcitJ RVRGQHNhbmRlbG1hbi5jYT4sIFNhbmRlbG1hbiBTb2Z0d2FyZSBXb3Jrcw0KICAgICAtPSBJUHY2 IElvVCBjb25zdWx0aW5nID0tDQogICAgDQoNCg== From nobody Wed Jun 19 22:28:15 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2C3C6120471 for ; Wed, 19 Jun 2019 22:28:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ky8UDHzc8MgL for ; Wed, 19 Jun 2019 22:28:12 -0700 (PDT) Received: from mail-wm1-x32c.google.com (mail-wm1-x32c.google.com [IPv6:2a00:1450:4864:20::32c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D790F12008D for ; Wed, 19 Jun 2019 22:28:11 -0700 (PDT) Received: by mail-wm1-x32c.google.com with SMTP id f17so1719238wme.2 for ; Wed, 19 Jun 2019 22:28:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=maLfA8XZeQLMIR2L8+n4LdlJacsEvk3DNH/fkawc1W4=; b=AAinqx3FS2P9DZkDzkccUpHHa07GnSop0tzA8xSvkKknqhFsaL3/q+8UaCisBUv6V0 Xh//HqZ1+c/Vqs2TsM6r/ZmraTlOKw95xti7g32TvH0tZo4oJlhARfsvFVExwd9sXha9 cdQm/euux/RulQQqDQB0u7j6OOv/5/phMKW8CGFUxAQO7zqF9N3++YrRwyGPEGJWICCJ wl1kJppNMmdcTUHqxTUeMZFlpM9MgFBxh5HLGyjYrgSFSHMln1ja/N0ucOCJr83fULKD 2Z3D83GNX9RzWYNziCRWX7gIkJdroZONoY9qGo1NLMTR8sRe0TGhwuCPWN8/85kVa8sq LTHg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=maLfA8XZeQLMIR2L8+n4LdlJacsEvk3DNH/fkawc1W4=; b=oczyy9+cB2NpBKMogy+PYlGLdlm3jXTqoeaPTePEgBK8cLjF2GkQhWbJsWoKS5EGrM 2yR2gQWp9dH+2g4G7YVp7jLKPpUB2lhASh5UeGQXMWhtVhmoLq9rBKWm+dy7rd5qFdsA 2pKsLWd9o8RX0PDRQokTy2WyLRMYh2JjkxFwoPkHQRB54t8jTXY2mYDQzYz2K3EvkT+z NVmUFMuuikCyQbM8q94m7qW812KqSKKP7Gw5JT4gSY5f8pMpyeAaIZ7OreMJuhBnNlca jxVT9RyMtI14942ozBhPi+BbuevFiromrPmumoktCdsw6J2rpykXadpx4k7sWJAZwS0w uIMg== X-Gm-Message-State: APjAAAUB2LL46TpLVG0Hu7jNpWnEzXwO5AyCU2FEcqD8VXUpwuDMCmZi xt5sjOUeMdH3/yfdZMK99GUjD/DLSCs= X-Google-Smtp-Source: APXvYqxp6CxBZ2xDt2/KPke3MCppQ1ZKAlP0I6IO8BvDREydVoBnMjfrYdUj1r3fxeadRuq/FqCcOg== X-Received: by 2002:a1c:a019:: with SMTP id j25mr958364wme.95.1561008490014; Wed, 19 Jun 2019 22:28:10 -0700 (PDT) Received: from [192.168.1.79] (25.131.146.77.rev.sfr.net. [77.146.131.25]) by smtp.googlemail.com with ESMTPSA id m9sm17694999wrr.14.2019.06.19.22.28.08 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 19 Jun 2019 22:28:08 -0700 (PDT) To: Michael Richardson Cc: Carl Wallace , "rats@ietf.org" References: <12503.1552447661@localhost> <58E37DB5-098C-4387-9A52-4AECD0F69F25@island-resort.com> <6495.1553219901@dooku.sandelman.ca> <507.1553725386@dooku.sandelman.ca> <24C0968B-32B0-4EF1-99C8-61D3F0955BA1@intel.com> <793F9A34-050F-4914-AF4B-08C072730A06@island-resort.com> <19652.1553943890@dooku.sandelman.ca> <79ccb2d7-09a3-913d-f47d-1e702a23b341@gmail.com> <29183.1560536152@localhost> <9a7e3efe-b021-f255-4afd-649ea0d5772d@gmail.com> <19489.1560973504@localhost> From: Anders Rundgren Message-ID: Date: Thu, 20 Jun 2019 07:28:06 +0200 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.7.1 MIME-Version: 1.0 In-Reply-To: <19489.1560973504@localhost> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Rats] More use cases for draft-richardson-rats-usecases-00 X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Jun 2019 05:28:14 -0000 On 2019-06-19 21:45, Michael Richardson wrote: > > Anders Rundgren wrote: > > Hi Michael, > > > A session based attestation is the combination of a static attestation > > and the creation of a shared session key. That is, possible subsequent > > operations using the shared session key "inherit" the initial > > attestation. Such operations use MAC signatures and symmetric > > encryption (using keys derived from the session key) in order to form a > > protected API. Ideally a session based attestation scheme also > > provides "atomic" operation, terminated by a "commit" call. > > I understand. I'm not sure what to change, if anything, based upon your > comments. Doesn't TEEP represent yet another attestation concept where each operation is attested? To me it looks that most if not all attestation schemes provide platform-related data but they also combine that with application-specific data like keys in Android, arbitrary operations like in TEEP, or the creation of a shared session key like in SKS/KeyGen2. I would consider splitting these topics since they appear to be fairly independent. Anders > > -- > Michael Richardson , Sandelman Software Works > -= IPv6 IoT consulting =- > > > From nobody Wed Jun 19 22:55:15 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BF07B120436 for ; Wed, 19 Jun 2019 22:55:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.011 X-Spam-Level: X-Spam-Status: No, score=-2.011 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GXaVQk3KPBcy for ; Wed, 19 Jun 2019 22:55:11 -0700 (PDT) Received: from NAM02-SN1-obe.outbound.protection.outlook.com (mail-eopbgr770091.outbound.protection.outlook.com [40.107.77.91]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 089161200F7 for ; Wed, 19 Jun 2019 22:55:10 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=f264WOtTYZ2wAoR/MH5laFnZGYEuSG9Mcb6IaNwAgI2d5BC6BPHsOjlJBXEjKAsEVnBue4w6DzNwMi11C6jNB664Vct5xkMKHJ7Czl1ROIL12l+pcRXWIV6SP18MSalYqlNTQ4goIMrjk/zBwl+koiORdaDNtgdBFRJESlaCnrGiP4+wU1rJeR0Ssy55boe7Znqio8bLLWnZj0BcqIAhZxW+r5BXnEJxIkuVSzvsGvlLt+UtZoXsoJwPlScBp3FITii9ApSRYxcJLms/yDrUCbcGILwWkhkOKNGy4EbD4/kdWBl1NlT/0KHesvy54ELVQ97xBi3bwE0aR27AggiTFg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=95dg4MuLsyHIbUoLuo750hKLobp8gVRl3lLF7fbS4yM=; b=U4PTj9k5zrS3ymlBOArHKSsnDes8KVdQx0dEoUzgiMXmzetxxe24riOlhDPcU09bz7xmjpVZm6HmoTLIbKmGWGtnyF5hI+vcJGmEqPyaBMh1R5VWRL6shOL0KprlyeXAqE4p2eqD8/l7ueDvQUU/oyZVPZ2MdEHqWSk3rnfkMEPoVi4PDVmwuE+HB+/x1qnprdYP11mvpltH8BPFQhAIGd0Dolq72b9HnEZNY89EBirJHS5T4KnCbxM02puuIvfyae53mQCQvB9iFzKekjB81z9UfPdsEsIGK3hWtHvsmfp+xz3rEP+XCHMqbGEMA52KY6yFYxG+WPOqbThemWo2hw== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=microsoft.com;dmarc=pass action=none header.from=microsoft.com;dkim=pass header.d=microsoft.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=95dg4MuLsyHIbUoLuo750hKLobp8gVRl3lLF7fbS4yM=; b=ZWfUlAg2ndMUKtqGIMjH14o9zC8FMdyNXwqM4EzKV8bSTMVOUt5TP4fj01eLZaJlOCE/ZtllCNjo24EmY8S3U1jsZfn+RBIVi0cid0lReIlX89XF+9ah45ZwLp7pDB7Rf4pbuIBDNMTXhaxI+WmZrSIS3zR2r5q2JMexE7pJP0Y= Received: from BN6PR21MB0497.namprd21.prod.outlook.com (2603:10b6:404:b3::7) by BN6PR21MB0835.namprd21.prod.outlook.com (2603:10b6:404:9e::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2032.6; Thu, 20 Jun 2019 05:55:09 +0000 Received: from BN6PR21MB0497.namprd21.prod.outlook.com ([fe80::8dec:7b59:4889:a0ae]) by BN6PR21MB0497.namprd21.prod.outlook.com ([fe80::8dec:7b59:4889:a0ae%4]) with mapi id 15.20.2008.007; Thu, 20 Jun 2019 05:55:09 +0000 From: Dave Thaler To: "rats@ietf.org" Thread-Topic: agenda? Thread-Index: AdUnLHYqQQ7jxdWRTtKcI3RYTNFeLg== Date: Thu, 20 Jun 2019 05:55:09 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Owner=dthaler@ntdev.microsoft.com; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2019-06-20T05:55:07.8940128Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Application=Microsoft Azure Information Protection; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ActionId=675a700b-f1fc-4b43-b97f-8aa3adbd1d4d; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Extended_MSFT_Method=Automatic authentication-results: spf=none (sender IP is ) smtp.mailfrom=dthaler@microsoft.com; x-originating-ip: [73.59.106.235] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 01e825d4-cdd1-4bd2-5e7b-08d6f543da44 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:BN6PR21MB0835; x-ms-traffictypediagnostic: BN6PR21MB0835: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:6790; x-forefront-prvs: 0074BBE012 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(376002)(136003)(366004)(396003)(39860400002)(346002)(13464003)(189003)(199004)(14454004)(8990500004)(10090500001)(7736002)(53936002)(316002)(81166006)(81156014)(66556008)(478600001)(8676002)(7696005)(6506007)(86362001)(25786009)(66066001)(14444005)(76116006)(305945005)(71200400001)(71190400001)(99286004)(66946007)(66476007)(22452003)(53546011)(102836004)(256004)(1730700003)(6116002)(3846002)(6436002)(26005)(52396003)(486006)(186003)(74316002)(9686003)(5640700003)(6306002)(2501003)(3480700005)(52536014)(5660300002)(8936002)(2906002)(6916009)(64756008)(66446008)(33656002)(73956011)(68736007)(10290500003)(476003)(55016002)(7116003)(2351001); DIR:OUT; SFP:1102; SCL:1; SRVR:BN6PR21MB0835; H:BN6PR21MB0497.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: OvXoUOyzR6duoXcxE4CET+TSzPEXfo6cvGrEfOjxUGt1enNioeBd0nN82hCF8qGB8TRmay21sPmvoCWO2EfBJWp2aPmrdZLwNmiwIPnGeBzMPs+Gw/4DdiP4VRx548A1UoFOw8TPLBhDyS66V5IKEK3GIuiMey+QhepnL+oIvlw7E+mvK4pVCjrzFlGfUe5w4lXbuG8EPv4EZR8slNZzk/8hOJJhp4IjeeT9Q8C34zqVx55g2MNnBCMH907UvRDNVDgcScmuVyRPuHobIEt/11zj6/lxBuWJwNPZwbzC0n7kEZdur6lLA6G7QtdyQ0/j4Oeo5ZSZtGjIyfZfQiawrLKM55jrM20QwW2cl7yKRHRroV3XsD2Ntw3Ij4BAahJTlU9uYp97jybSVEnfHuGQEt6FGO9Ie0/ulSnzXJ0MuWo= Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 01e825d4-cdd1-4bd2-5e7b-08d6f543da44 X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Jun 2019 05:55:09.1152 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: dthaler@ntdev.microsoft.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR21MB0835 Archived-At: Subject: [Rats] agenda? X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Jun 2019 05:55:14 -0000 Where can I find the agenda? All I see is Michael's request below, and the= notice that "The agenda will be distributed on the WG email list prior to the meeting." The IESG rules for virtual interims (https://ietf.org/blog/guidance-face-fa= ce-and-virtual-interim-meetings/) say: > The meetings must be announced and the draft agenda published at least on= e week (ideally two) before the call or session. But I'm having a hard time finding where it was published. Can someone poi= nt me to it? Thanks, Dave -----Original Message----- From: RATS On Behalf Of Michael Richardson Sent: Friday, June 14, 2019 11:12 AM To: rats@ietf.org Subject: [Rats] agenda request for next week -- use cases RATS Chairs: I would like to propose two slots for the use cases for next week: 1) <5 minute update on document progress, what we need more of, and whether we are going in the right direction. Given no intent to publish, should the WG adopt this document so that it can say it is allocating time to WG documents first? 2) 10-15 minutes at the VERY END of the time period for discussion about details in the document, and how to best make this document most useful as we go forward. -- Michael Richardson , Sandelman Software Works -=3D = IPv6 IoT consulting =3D- From nobody Thu Jun 20 04:55:38 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 875F512008B for ; Thu, 20 Jun 2019 04:55:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.501 X-Spam-Level: X-Spam-Status: No, score=-14.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=ZKwVzhei; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=lwrdJqWf Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id O0Qu1QeGqP3W for ; Thu, 20 Jun 2019 04:55:33 -0700 (PDT) Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 974BD12002F for ; Thu, 20 Jun 2019 04:55:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2788; q=dns/txt; s=iport; t=1561031733; x=1562241333; h=from:to:subject:date:message-id:content-id: content-transfer-encoding:mime-version; bh=TvqF0iEyZa4+qjQ85bgTJNY63WbMecd+ltsdqMWSQp0=; b=ZKwVzheiFIrj2cRddSqlhrGIjthcz2+q+CTvOp/VYXJML5iKB/0hpT0P sMm32dyXZBfyKIcyu84ZiFmvU5uv6H1kknLEmGwkLID1RqAG5mfm3H6IH 85j2ZkXvRyAWMXCJON4rWaf5ifvMLNTqv3R2dpfxw6e4x/QhTiBV0mPcK I=; IronPort-PHdr: =?us-ascii?q?9a23=3AbRsw+hPnWFf8bugLFYkl6mtXPHoupqn0MwgJ65?= =?us-ascii?q?Eul7NJdOG58o//OFDEu6w/l0fHCIPc7f8My/HbtaztQyQh2d6AqzhDFf4ETB?= =?us-ascii?q?oZkYMTlg0kDtSCDBj9J/fvcC08E+xJVURu+DewNk0GUMs=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BpAABicwtd/5NdJa1mHQEBBQEHBQG?= =?us-ascii?q?BUwgBCwGBQ1ADalUgBAsohBaDRwOEUooOTIINlzeBLhSBEANUCQEBAQwBARg?= =?us-ascii?q?LCgIBAYFLgnUCF4JHIzQJDgEDAQEEAQECAQVtijcMhUoBAQEEAQEQCwYRDAE?= =?us-ascii?q?BLAwLBgEIEQQBAQMCJgIEJQsVCAoEARIigwABgWoDHQEOnAQCgTiIX3GBMYJ?= =?us-ascii?q?5AQEFgkeCNhiCEAMGgQwoAYtdF4F/gREnH4JMPoJhAQECgSwBEgEfF4JzMoI?= =?us-ascii?q?mi2SCX5swCQKCEYZKiFWEOxQHgicvjSqHO40hgSyFe49KAgQCBAUCDgEBBYF?= =?us-ascii?q?QOGddDAhwFTsqAYJBH4Iig3CFFIU/cgGBKItVgkMBAQ?= X-IronPort-AV: E=Sophos;i="5.63,396,1557187200"; d="scan'208";a="581394991" Received: from rcdn-core-11.cisco.com ([173.37.93.147]) by rcdn-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 20 Jun 2019 11:55:32 +0000 Received: from XCH-RCD-013.cisco.com (xch-rcd-013.cisco.com [173.37.102.23]) by rcdn-core-11.cisco.com (8.15.2/8.15.2) with ESMTPS id x5KBtWtA026727 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Thu, 20 Jun 2019 11:55:32 GMT Received: from xhs-rcd-001.cisco.com (173.37.227.246) by XCH-RCD-013.cisco.com (173.37.102.23) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Thu, 20 Jun 2019 06:55:31 -0500 Received: from xhs-rtp-001.cisco.com (64.101.210.228) by xhs-rcd-001.cisco.com (173.37.227.246) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Thu, 20 Jun 2019 06:55:31 -0500 Received: from NAM04-CO1-obe.outbound.protection.outlook.com (64.101.32.56) by xhs-rtp-001.cisco.com (64.101.210.228) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Thu, 20 Jun 2019 07:55:31 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=TvqF0iEyZa4+qjQ85bgTJNY63WbMecd+ltsdqMWSQp0=; b=lwrdJqWfj6d4iWs1NGGJmYDFo6jPYjlXIx2cGESWc2b5LPwYDmFph4X7pIAPo4p4uO+cfuMmogbF69b37ra10UAOEL4/lclMi63MzPDH4W9aOFGzBGjPQU7FtAKhgZrQERiRiPCHv8vYGT5Ybq8SLw3jGWx4p2exPTaD6u7E/hU= Received: from MWHPR11MB1791.namprd11.prod.outlook.com (10.175.53.138) by MWHPR11MB1454.namprd11.prod.outlook.com (10.172.54.139) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1987.11; Thu, 20 Jun 2019 11:55:30 +0000 Received: from MWHPR11MB1791.namprd11.prod.outlook.com ([fe80::1c5:a33f:e151:4f85]) by MWHPR11MB1791.namprd11.prod.outlook.com ([fe80::1c5:a33f:e151:4f85%6]) with mapi id 15.20.1987.014; Thu, 20 Jun 2019 11:55:30 +0000 From: "Nancy Cam-Winget (ncamwing)" To: Dave Thaler , "rats@ietf.org" Thread-Topic: [Rats] agenda? Thread-Index: AQHVJ18OLupqZffe70KpBoL2jP1u1w== Date: Thu, 20 Jun 2019 11:55:29 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.10.b.190609 authentication-results: spf=none (sender IP is ) smtp.mailfrom=ncamwing@cisco.com; x-originating-ip: [2001:420:c0c8:1003::17c] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 37f1b0e5-273d-4caf-d00f-08d6f576313b x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:MWHPR11MB1454; x-ms-traffictypediagnostic: MWHPR11MB1454: x-ms-exchange-purlcount: 2 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:7219; x-forefront-prvs: 0074BBE012 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(136003)(346002)(376002)(39860400002)(366004)(396003)(13464003)(189003)(199004)(110136005)(486006)(53936002)(2616005)(71190400001)(99286004)(25786009)(81166006)(71200400001)(76116006)(46003)(91956017)(6436002)(476003)(66446008)(68736007)(14444005)(66946007)(66556008)(102836004)(6246003)(8676002)(8936002)(73956011)(81156014)(66476007)(86362001)(6512007)(5660300002)(6306002)(316002)(229853002)(186003)(305945005)(6116002)(33656002)(6506007)(2906002)(6486002)(53546011)(256004)(64756008)(58126008)(478600001)(2501003)(14454004)(966005)(36756003)(7736002); DIR:OUT; SFP:1101; SCL:1; SRVR:MWHPR11MB1454; H:MWHPR11MB1791.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: u7G7n44eGFv5oNeIY5/aQTgOENwVSXCdq6BXIxT3MLed6m2pjjfWDktQs6nX+vYlvRGpZXWLPawvqXQOde6QlbHzSMoJtptkI4pSNgclb/3FmGZIjIhtxG6pU6Og5iTLOkdEFRtkr9OjBqhGawAxkaCPDwve8t/ZO8NqzjwosoV0Ph6kjtN1CLwd6crrLIPLFu+HvZiwmSMw0IQ9cA6KwV5VwBuJ1BP9z3sHq3ztmpGPnHcS5gyWfRam+/wGRlu0/xrV1YDKfJGCeZj9ttkl9pDP8+yZIZAqflQoQH7VHDS5s9YqYztCXPEcbMm2cYcYXN+xXranVu3SQ6R5DyCo07vKVlW6hBbXcqfmVoHQ4aN9GhH0lgl+pwFsNwQRs93g52bJiCsYHruIKmiLf29dKNx86mUfRxv3szigTqvFTp8= Content-Type: text/plain; charset="utf-8" Content-ID: <7540B8991545DB4197E1A03D243663A7@namprd11.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 37f1b0e5-273d-4caf-d00f-08d6f576313b X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Jun 2019 11:55:29.9072 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: ncamwing@cisco.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR11MB1454 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.102.23, xch-rcd-013.cisco.com X-Outbound-Node: rcdn-core-11.cisco.com Archived-At: Subject: Re: [Rats] agenda? X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Jun 2019 11:55:37 -0000 TXkgYXBvbG9naWVzIGZvciBub3QgaGF2aW5nIGRvbmUgdGhlIGZ1bGwgY2FsbCBmb3IgYWdlbmRh IGFuZCBwb3N0ZWQgYmVmb3JlIHRoZSBtZWV0aW5nLCB3ZSB3aWxsIGJhc2ggaXQgYXQgdGhlIGJl Z2lubmluZyBvZiB0aGUgY2FsbCB0byBzZXR0bGUgb24gdGhlIGl0ZW1zLi4uLi5JIGhvcGUgYW5k IGV4cGVjdCB0aGF0IHRoZSBkcmFmdCBhdXRob3JzIGNhbiBhbHNvIHByZXNlbnQgYW4gdXBkYXRl Lg0KQmVzdCwgTmFuY3kNCg0K77u/T24gNi8xOS8xOSwgMjI6NTUsICJSQVRTIG9uIGJlaGFsZiBv ZiBEYXZlIFRoYWxlciIgPHJhdHMtYm91bmNlc0BpZXRmLm9yZyBvbiBiZWhhbGYgb2YgZHRoYWxl cj00MG1pY3Jvc29mdC5jb21AZG1hcmMuaWV0Zi5vcmc+IHdyb3RlOg0KDQogICAgV2hlcmUgY2Fu IEkgZmluZCB0aGUgYWdlbmRhPyAgQWxsIEkgc2VlIGlzIE1pY2hhZWwncyByZXF1ZXN0IGJlbG93 LCBhbmQgdGhlIG5vdGljZSB0aGF0DQogICAgIlRoZSBhZ2VuZGEgd2lsbCBiZSBkaXN0cmlidXRl ZCBvbiB0aGUgV0cgZW1haWwgbGlzdCBwcmlvciB0byB0aGUgbWVldGluZy4iDQogICAgDQogICAg VGhlIElFU0cgcnVsZXMgZm9yIHZpcnR1YWwgaW50ZXJpbXMgKGh0dHBzOi8vaWV0Zi5vcmcvYmxv Zy9ndWlkYW5jZS1mYWNlLWZhY2UtYW5kLXZpcnR1YWwtaW50ZXJpbS1tZWV0aW5ncy8pIHNheToN CiAgICA+IFRoZSBtZWV0aW5ncyBtdXN0IGJlIGFubm91bmNlZCBhbmQgdGhlIGRyYWZ0IGFnZW5k YSBwdWJsaXNoZWQgYXQgbGVhc3Qgb25lIHdlZWsgKGlkZWFsbHkgdHdvKSBiZWZvcmUgdGhlIGNh bGwgb3Igc2Vzc2lvbi4NCiAgICANCiAgICBCdXQgSSdtIGhhdmluZyBhIGhhcmQgdGltZSBmaW5k aW5nIHdoZXJlIGl0IHdhcyBwdWJsaXNoZWQuICBDYW4gc29tZW9uZSBwb2ludCBtZSB0byBpdD8N CiAgICANCiAgICBUaGFua3MsDQogICAgRGF2ZQ0KICAgIA0KICAgIC0tLS0tT3JpZ2luYWwgTWVz c2FnZS0tLS0tDQogICAgRnJvbTogUkFUUyA8cmF0cy1ib3VuY2VzQGlldGYub3JnPiBPbiBCZWhh bGYgT2YgTWljaGFlbCBSaWNoYXJkc29uDQogICAgU2VudDogRnJpZGF5LCBKdW5lIDE0LCAyMDE5 IDExOjEyIEFNDQogICAgVG86IHJhdHNAaWV0Zi5vcmcNCiAgICBTdWJqZWN0OiBbUmF0c10gYWdl bmRhIHJlcXVlc3QgZm9yIG5leHQgd2VlayAtLSB1c2UgY2FzZXMNCiAgICANCiAgICANCiAgICBS QVRTIENoYWlyczoNCiAgICANCiAgICBJIHdvdWxkIGxpa2UgdG8gcHJvcG9zZSB0d28gc2xvdHMg Zm9yIHRoZSB1c2UgY2FzZXMgZm9yIG5leHQgd2VlazoNCiAgICAxKSA8NSBtaW51dGUgdXBkYXRl IG9uIGRvY3VtZW50IHByb2dyZXNzLCB3aGF0IHdlIG5lZWQgbW9yZSBvZiwgYW5kDQogICAgICAg d2hldGhlciB3ZSBhcmUgZ29pbmcgaW4gdGhlIHJpZ2h0IGRpcmVjdGlvbi4NCiAgICANCiAgICAg ICBHaXZlbiBubyBpbnRlbnQgdG8gcHVibGlzaCwgc2hvdWxkIHRoZSBXRyBhZG9wdCB0aGlzIGRv Y3VtZW50IHNvIHRoYXQNCiAgICAgICBpdCBjYW4gc2F5IGl0IGlzIGFsbG9jYXRpbmcgdGltZSB0 byBXRyBkb2N1bWVudHMgZmlyc3Q/DQogICAgDQogICAgMikgMTAtMTUgbWludXRlcyBhdCB0aGUg VkVSWSBFTkQgb2YgdGhlIHRpbWUgcGVyaW9kIGZvciBkaXNjdXNzaW9uIGFib3V0DQogICAgICAg ZGV0YWlscyBpbiB0aGUgZG9jdW1lbnQsIGFuZCBob3cgdG8gYmVzdCBtYWtlIHRoaXMgZG9jdW1l bnQgbW9zdCB1c2VmdWwNCiAgICAgICBhcyB3ZSBnbyBmb3J3YXJkLg0KICAgIA0KICAgIC0tDQog ICAgTWljaGFlbCBSaWNoYXJkc29uIDxtY3IrSUVURkBzYW5kZWxtYW4uY2E+LCBTYW5kZWxtYW4g U29mdHdhcmUgV29ya3MgIC09IElQdjYgSW9UIGNvbnN1bHRpbmcgPS0NCiAgICANCiAgICANCiAg ICANCiAgICBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0K ICAgIFJBVFMgbWFpbGluZyBsaXN0DQogICAgUkFUU0BpZXRmLm9yZw0KICAgIGh0dHBzOi8vd3d3 LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vcmF0cw0KICAgIA0KDQo= From nobody Thu Jun 20 05:12:27 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7BDD212009C for ; Thu, 20 Jun 2019 05:12:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=KCd9Dc0N; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=UsZttRNB Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rOh9GaW2UC3d for ; Thu, 20 Jun 2019 05:12:23 -0700 (PDT) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5A5E212002F for ; Thu, 20 Jun 2019 05:12:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=7269; q=dns/txt; s=iport; t=1561032743; x=1562242343; h=from:to:cc:subject:date:message-id:mime-version; bh=SIk0oo+4lMw/kczuztx0zYOEpj+h8uLt2ze6T5Q5QxU=; b=KCd9Dc0NAzkTiBdNICkIVhJ0NXsdGyKyhsQGJrZyUiVDL76XFDlVeuhs vDPYT8wOleuqkkBkb9Ws8ljd6Gp0rLDdkTc9W3iGkqUSbIyiKUa3P9GG6 h4it0pqGW3LZRet9Nr57+Gm58pv0RtZxLYXJrI3kAuNo330lof/GLwg5N o=; IronPort-PHdr: =?us-ascii?q?9a23=3ADpLpTR173frbx+/IsmDT+zVfbzU7u7jyIg8e44?= =?us-ascii?q?YmjLQLaKm44pD+JxKGt+51ggrPWoPWo7JfhuzavrqoeFRI4I3J8RVgOIdJSw?= =?us-ascii?q?dDjMwXmwI6B8vQD0byKeHraSMSF8VZX1gj9Ha+YgBY?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BfAgBydgtd/49dJa1mHgEGBwaBVgY?= =?us-ascii?q?LAYEUL1ADalUgBAsohBaDRwOOYJU9hFOCUgNUCQEBAQwBASMKAgEBhEAZgkc?= =?us-ascii?q?jNwYOAQMBAQQBAQIBBW2KNwELhU0WER0BATcBEQEaMAIEMBcQBA4ngwABgR1?= =?us-ascii?q?NAx0BDpwLAoE4iF9xgTGCeQEBBYJHgjYYghADBoE0i14XgX+BEScfhWsCgg6?= =?us-ascii?q?CXTKCJowlgh6EeJY4CQKCEYZKjRAblzuNIYcnj0oCBAIEBQIOAQEFgWYigVh?= =?us-ascii?q?wFWUBgkGCQYNwhRSFP3IBgSiOGAEB?= X-IronPort-AV: E=Sophos;i="5.63,396,1557187200"; d="scan'208,217";a="566066651" Received: from rcdn-core-7.cisco.com ([173.37.93.143]) by rcdn-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 20 Jun 2019 12:12:21 +0000 Received: from XCH-ALN-012.cisco.com (xch-aln-012.cisco.com [173.36.7.22]) by rcdn-core-7.cisco.com (8.15.2/8.15.2) with ESMTPS id x5KCCLY1026433 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Thu, 20 Jun 2019 12:12:21 GMT Received: from xhs-rtp-002.cisco.com (64.101.210.229) by XCH-ALN-012.cisco.com (173.36.7.22) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Thu, 20 Jun 2019 07:12:21 -0500 Received: from xhs-aln-001.cisco.com (173.37.135.118) by xhs-rtp-002.cisco.com (64.101.210.229) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Thu, 20 Jun 2019 08:12:20 -0400 Received: from NAM05-CO1-obe.outbound.protection.outlook.com (173.37.151.57) by xhs-aln-001.cisco.com (173.37.135.118) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Thu, 20 Jun 2019 07:12:20 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=SIk0oo+4lMw/kczuztx0zYOEpj+h8uLt2ze6T5Q5QxU=; b=UsZttRNBRUJWY3791xbZLQVxgNUc6+98t6zRQLc5iB5kW3nrYJqlUgRzmlf33BBlwBFSfk7DhpJaefuvcuWmG2dreBhJPkvTCiyVRnTEpCH4AyPqiOKratCBvdUtlmouo6vfuJxNZuooOdWAOcN5Y4GjyGLDQeO+XBtHjL9u0tw= Received: from MWHPR11MB1791.namprd11.prod.outlook.com (10.175.53.138) by MWHPR11MB1568.namprd11.prod.outlook.com (10.172.55.148) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1987.12; Thu, 20 Jun 2019 12:12:19 +0000 Received: from MWHPR11MB1791.namprd11.prod.outlook.com ([fe80::1c5:a33f:e151:4f85]) by MWHPR11MB1791.namprd11.prod.outlook.com ([fe80::1c5:a33f:e151:4f85%6]) with mapi id 15.20.1987.014; Thu, 20 Jun 2019 12:12:19 +0000 From: "Nancy Cam-Winget (ncamwing)" To: "rats@ietf.org" CC: Dave Thaler Thread-Topic: Preliminary Agenda for today Thread-Index: AQHVJ2Fogj4b2DdODU2qERTlNGNs/g== Date: Thu, 20 Jun 2019 12:12:18 +0000 Message-ID: <27666F7D-7B3D-4DCF-BCDB-1212EE4E9FA2@cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.10.b.190609 authentication-results: spf=none (sender IP is ) smtp.mailfrom=ncamwing@cisco.com; x-originating-ip: [2001:420:c0c8:1003::17c] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 4cfe24ae-a674-4660-40e0-08d6f5788ab2 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:MWHPR11MB1568; x-ms-traffictypediagnostic: MWHPR11MB1568: x-ms-exchange-purlcount: 3 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:4303; x-forefront-prvs: 0074BBE012 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(366004)(346002)(376002)(136003)(396003)(39860400002)(189003)(199004)(33656002)(256004)(966005)(476003)(2616005)(14454004)(186003)(5660300002)(606006)(68736007)(6916009)(486006)(8936002)(2351001)(81166006)(81156014)(86362001)(8676002)(7736002)(1730700003)(6506007)(236005)(316002)(25786009)(54896002)(6512007)(6306002)(5640700003)(71190400001)(71200400001)(46003)(102836004)(4744005)(3480700005)(36756003)(6486002)(4326008)(99286004)(53936002)(6436002)(58126008)(2906002)(66446008)(64756008)(66556008)(66476007)(2501003)(73956011)(478600001)(6116002)(91956017)(76116006)(66946007); DIR:OUT; SFP:1101; SCL:1; SRVR:MWHPR11MB1568; H:MWHPR11MB1791.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: oobTaJHiugfW5YOF5gi1f0L6CQv5Eo2ZNwVrPvOiSttdloFwYlb6iXmykKNVUIMPmNV6AyQFj/75DbbVC7e8ZkNrnY7Xkbsh/ipTX8jrZnozfizaltJuFxCc1KO82jb1zotbJHT+Ww0h+Xsjx5GVMhpjAnewBLzsU3NEzuGwIksDe/ZNCnVjgtkTv/c267v9Ni5mjm3OqLOdcVHOAE7PbEvxu+wiE2q3Ev4IyUaZjrSK2zJkg6Ke1jxBdlBHkzY4/mLYh7YyFyZks/4DY2mEJo/itjO16p9j0dWT3M0WchgnNxpQwTzNBl2niJjRpyXJuRuxVJptfR+hdi+QgE5tDfJwyezJ3q3u6tCi4HATdP56Z7iqGn9kva4rbbQ0VpE3473VKy/9S/XUseodfUH8tJx1RLJE/KMprYIeR0S5f9k= Content-Type: multipart/alternative; boundary="_000_27666F7D7B3D4DCFBCDB1212EE4E9FA2ciscocom_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 4cfe24ae-a674-4660-40e0-08d6f5788ab2 X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Jun 2019 12:12:18.9380 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: ncamwing@cisco.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR11MB1568 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.36.7.22, xch-aln-012.cisco.com X-Outbound-Node: rcdn-core-7.cisco.com Archived-At: Subject: [Rats] Preliminary Agenda for today X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Jun 2019 12:12:26 -0000 --_000_27666F7D7B3D4DCFBCDB1212EE4E9FA2ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 QWxsLA0KV2Ugd2lsbCBuZWVkIHRvIGJhc2ggYW5kIGNvbXBsZXRlIHRoZSBhZ2VuZGEgYXQgdGhl IGJlZ2lubmluZyBvZiB0aGUgY2FsbCwgYnV0IGhlcmUgaXMgYSBwcmVsaW1pbmFyeSBhZ2VuZGEg Zm9yIHRvZGF5Og0KDQoNCiAgMS4gIEFnZW5kYSBiYXNoaW5nLCBMb2dpc3RpY3MgLS0gQ2hhaXJz ICAgKDw1bWluKQ0KICAyLiAgQ2hhaXLigJlzIHJldmlldyBvZiBkb2N1bWVudCBzdGF0dXMgYW5k IGxvZ2lzdGljcyAtIDw1bWluDQogIDMuICBVc2UgQ2FzZXMgLSA8NW1pbg0KICA0LiAgRG9jdW1l bnQgdXBkYXRlczoNCiAgICAgKiAgIEVBVCAtID9taW4NCiAgICAgKiAgIEFyY2hpdGVjdHVyZSAg LSA1bWluDQogICAgICogICBDdXJyZW50IGRhdGEgbW9kZWxzICYgc2VyaWFsaXphdGlvbnMgKEVB VCwgUFNBLCBUVURBIGFuZCBSZWZlcmVuY2UgSW50ZXJhY3Rpb24gbW9kZWwpICAtIDI1bWluDQog ICAgICogICBJbmZvcm1hdGlvbiBNb2RlbCBzdGFydCDigJMgMTBtaW4NCiAgNS4gIFVzZSBDYXNl cyDigJMgMTAtMjBtaW4NCiAgNi4gIE5leHQgU3RlcHMg4oCTIGFkb3B0aW9uIHJlYWRpbmVzcyBh bmQgQU9CICh+NS0xMG1pbikNCg0KV2UgYWxzbyBuZWVkIGEgdm9sdW50ZWVyIHRvIGJlIGEgbm90 ZXRha2VyIHdoaWNoIGNhbiBiZSB0YWtlbiBpbiBodHRwczovL2V0aGVycGFkLnRvb2xzLmlldGYu b3JnL3Avbm90ZXMtaWV0Zi1qdW5lMjAxOS12aXJ0dWFsDQoNClRoYW5rcywNCiAgICBOYW5jeQ0K DQo= --_000_27666F7D7B3D4DCFBCDB1212EE4E9FA2ciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: <88BBBC9F214CA4468543B1D634FC19B3@namprd11.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3Jt YWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOiMwNTYzQzE7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9 DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOiM5NTRGNzI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpz cGFuLkVtYWlsU3R5bGUxNw0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1jb21wb3NlOw0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1z b0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6 IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4g MTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rp b24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi8qIExpc3QgRGVmaW5pdGlvbnMgKi8NCkBsaXN0 IGwwDQoJe21zby1saXN0LWlkOjE3NzM0MzU1MTc7DQoJbXNvLWxpc3QtdHlwZTpoeWJyaWQ7DQoJ bXNvLWxpc3QtdGVtcGxhdGUtaWRzOi0xMjc5MDc5NTUyIC0xOTE2NTE4MzA2IC00OTg0MjI4NjIg MTM4ODMyMjU2OCAtMjAwMzg1MjU2IC02NTE4MjAwNTIgLTQ3MzI4MTY3NiA3MzkxNDk2ODAgMTU4 Mjk2MDQ0NiA2ODg1NzUxNjt9DQpvbA0KCXttYXJnaW4tYm90dG9tOjBpbjt9DQp1bA0KCXttYXJn aW4tYm90dG9tOjBpbjt9DQotLT48L3N0eWxlPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMi IGxpbms9IiMwNTYzQzEiIHZsaW5rPSIjOTU0RjcyIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9u MSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+ QWxsLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0Ij5XZSB3aWxsIG5lZWQgdG8gYmFzaCBhbmQgY29tcGxldGUg dGhlIGFnZW5kYSBhdCB0aGUgYmVnaW5uaW5nIG9mIHRoZSBjYWxsLCBidXQgaGVyZSBpcyBhIHBy ZWxpbWluYXJ5IGFnZW5kYSBmb3IgdG9kYXk6PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjxvbCBzdHlsZT0ibWFyZ2luLXRvcDowaW4iIHN0YXJ0PSIxIiB0 eXBlPSIxIj4NCjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLWxpc3Q6bDAgbGV2ZWwx IGxmbzEiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5BZ2VuZGEgYmFzaGluZywgTG9n aXN0aWNzIC0tIENoYWlycyZuYnNwOyZuYnNwOyAoJmx0OzVtaW4pPG86cD48L286cD48L3NwYW4+ PC9saT48bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1saXN0OmwwIGxldmVsMSBsZm8x Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+Q2hhaXLigJlzIHJldmlldyBvZiBkb2N1 bWVudCBzdGF0dXMgYW5kIGxvZ2lzdGljcyAtICZsdDs1bWluPG86cD48L286cD48L3NwYW4+PC9s aT48bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1saXN0OmwwIGxldmVsMSBsZm8xIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+VXNlIENhc2VzIC0gJmx0OzVtaW48bzpwPjwv bzpwPjwvc3Bhbj48L2xpPjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLWxpc3Q6bDAg bGV2ZWwxIGxmbzEiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5Eb2N1bWVudCB1cGRh dGVzOjxvOnA+PC9vOnA+PC9zcGFuPjwvbGk+PG9sIHN0eWxlPSJtYXJnaW4tdG9wOjBpbiIgc3Rh cnQ9IjEiIHR5cGU9IjEiPg0KPGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbGlzdDps MCBsZXZlbDIgbGZvMSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPkVBVCAtID9taW48 bzpwPjwvbzpwPjwvc3Bhbj48L2xpPjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLWxp c3Q6bDAgbGV2ZWwyIGxmbzEiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5BcmNoaXRl Y3R1cmUmbmJzcDsgLSA1bWluPG86cD48L286cD48L3NwYW4+PC9saT48bGkgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1saXN0OmwwIGxldmVsMiBsZm8xIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjExLjBwdCI+Q3VycmVudCBkYXRhIG1vZGVscyAmYW1wOyBzZXJpYWxpemF0aW9ucyAoRUFU LCBQU0EsIFRVREEgYW5kIFJlZmVyZW5jZSBJbnRlcmFjdGlvbiBtb2RlbCkmbmJzcDsgLSAyNW1p bjxvOnA+PC9vOnA+PC9zcGFuPjwvbGk+PGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bGlzdDpsMCBsZXZlbDIgbGZvMSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPkluZm9y bWF0aW9uIE1vZGVsIHN0YXJ0IOKAkyAxMG1pbjxvOnA+PC9vOnA+PC9zcGFuPjwvbGk+PC9vbD4N CjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5Vc2UgQ2FzZXMg4oCTIDEwLTIwbWluPG86cD48 L286cD48L3NwYW4+PC9saT48bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1saXN0Omww IGxldmVsMSBsZm8xIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+TmV4dCBTdGVwcyDi gJMgYWRvcHRpb24gcmVhZGluZXNzIGFuZCBBT0IgKH41LTEwbWluKTxvOnA+PC9vOnA+PC9zcGFu PjwvbGk+PC9vbD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+V2UgYWxzbyBuZWVkIGEgdm9sdW50ZWVy IHRvIGJlIGEgbm90ZXRha2VyIHdoaWNoIGNhbiBiZSB0YWtlbiBpbg0KPC9zcGFuPjxhIGhyZWY9 Imh0dHBzOi8vZXRoZXJwYWQudG9vbHMuaWV0Zi5vcmcvcC9ub3Rlcy1pZXRmLWp1bmUyMDE5LXZp cnR1YWwiPmh0dHBzOi8vZXRoZXJwYWQudG9vbHMuaWV0Zi5vcmcvcC9ub3Rlcy1pZXRmLWp1bmUy MDE5LXZpcnR1YWw8L2E+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPlRoYW5r cyw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7IE5hbmN5PG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9o dG1sPg0K --_000_27666F7D7B3D4DCFBCDB1212EE4E9FA2ciscocom_-- From nobody Thu Jun 20 05:53:00 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CB324120046 for ; Thu, 20 Jun 2019 05:52:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.509 X-Spam-Level: X-Spam-Status: No, score=-17.509 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2nZoi9zc6Uj6 for ; Thu, 20 Jun 2019 05:52:56 -0700 (PDT) Received: from mail-yw1-xc2e.google.com (mail-yw1-xc2e.google.com [IPv6:2607:f8b0:4864:20::c2e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3A97A12000E for ; Thu, 20 Jun 2019 05:52:56 -0700 (PDT) Received: by mail-yw1-xc2e.google.com with SMTP id x75so721988ywd.1 for ; Thu, 20 Jun 2019 05:52:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=vEj83Ch84pRZSp4pMvHRsSdfvzgrJfBb7tCQ5FNwn8A=; b=pTE9ddjF9KpG12egwT0gYhVwNIlASXyqEuQZsnvtDBZj8x/uXRwD3xznKvtOt24ga/ SJOY9/SN+osZ+7u7GNkr5GOQ9RWeAkzsdgi9YyEgCjDXTIXX8sFpNEpXOGX6IzM/R7uD t0s+E8+h6q4JWHhml3kUf5VdZ2x1hd13lx3abSnb7Wq9tiu6z5a1sisffYJLPw6pH7nY x5cLZB+UUjSUe+SvE8IOUrlZtcOPkjn7qcWrcECl4BM4hnQ1EiTStGju2a+gfV1JsOCo Q9BhwUQfOdG93wm1BkiTryxairtPoaO+wKHVdSxNoZ/vKvv8AY2J74yStGr3/8FMO8HG xAlA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=vEj83Ch84pRZSp4pMvHRsSdfvzgrJfBb7tCQ5FNwn8A=; b=bzZKF/dwBHf5GH7t0FksjsTjDh2ttqmmSyoiNB9F7qUTS9WqfRBwkWkS8ORg8BcXNL 7nsiHf4J8Rq5PdTh9AzwDL5SaSOw5+n6cs5R8Dvl6H4nzHe4yS2EXH5qAleRjaGYIWG8 s9Jj9cLN4iwXC3StMN9N2Fk5lCaJpVm08njVL6NkzEBcgJ8o0yurLUOz7QLc0cnu3D+L j0Gm9aOa1ZOQN7UHAKjep9l9Y8/tA3ywm/RVxENauSTdr+NvPV/0PGGYnX/3z87zms+w AI92dMmWCDyZxJVpAFXJOs+ZEhMsMUixtoyxdC65GfsOBoq/gGjLSX3XISd+DEetIhEI K1bQ== X-Gm-Message-State: APjAAAUiVwaxJwW64IOJxobisBbl6vrj2+dxHvwn5h+FJjAfVGI/Sl7X qn9Nb50qv41hUVWqMEQ4+0ZS5HAspH6ylQmr6wmcSg== X-Google-Smtp-Source: APXvYqzsa8IyBLzFdOIRGM7XgG76IB8PiH01EefDLG+K3ylFRViZ4QjrGiIT2xCq3b/2zm+rELyO4VCj9/kSseEIEdU= X-Received: by 2002:a81:9b07:: with SMTP id s7mr60414679ywg.203.1561035174940; Thu, 20 Jun 2019 05:52:54 -0700 (PDT) MIME-Version: 1.0 References: <12503.1552447661@localhost> <219648D6-188A-429D-A13F-ED6155DE9016@island-resort.com> <14288.1553710783@dooku.sandelman.ca> <4EB6FF13-2DAF-4BDC-AC90-C46720D61AF0@arm.com> <21349.1560911427@dooku.sandelman.ca> In-Reply-To: <21349.1560911427@dooku.sandelman.ca> From: Shawn Willden Date: Thu, 20 Jun 2019 14:52:42 +0200 Message-ID: To: Michael Richardson Cc: Thomas Fossati , "rats@ietf.org" , Anthony Nadalin , Laurence Lundblade Content-Type: multipart/alternative; boundary="00000000000015f16c058bc0d325" Archived-At: Subject: Re: [Rats] draft-richardson-rats-usecases-00 comments X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Jun 2019 12:52:59 -0000 --00000000000015f16c058bc0d325 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Jun 19, 2019 at 4:30 AM Michael Richardson wrote: > > Thomas Fossati wrote: > > =EF=BB=BFOn 27/03/2019, 18:25, "RATS on behalf of Michael Richardso= n" > > wrote: > >> (Still looking for some pointers to *attestion* parts of the Andro= id > >> KeyStore.) > > > Maybe you want to take a look at [1] > > > Cheers, t > > > [1] https://arxiv.org/pdf/1904.05572.pdf > > Thank you. It was a really interesting read. > What I learnt is that Android mostly attests to the location of a device > signing key. This is correct. Originally, keystore attestation was intended *only* to prove that a key (a) lived in a thought-to-be-secure environment and (b) that the key had a certain set of properties. The scope has expanded a bit to also attest to some bits of information about the device state, at least as it was at boot time. > I think that this is an implementation of the device-type attestation tha= t > FIDO cares about. > It can serve that purpose, yes. > ]The paper and the referenced info at: > https://developer.android.com/training/articles/security-key-attestatio= n > > does not give me additional use case, but I have other reading that I hav= e > not yet finished. > > -- > Michael Richardson , Sandelman Software Works > -=3D IPv6 IoT consulting =3D- > > > _______________________________________________ > RATS mailing list > RATS@ietf.org > https://www.ietf.org/mailman/listinfo/rats > --=20 Shawn Willden | Staff Software Engineer | swillden@google.com | 720-924-664= 5 --00000000000015f16c058bc0d325 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Jun 19, 2019 at 4:30 AM Michael R= ichardson <mcr+ietf@sandelman= .ca> wrote:

Thomas Fossati <Thomas.Fossati@arm.com> wrote:
=C2=A0 =C2=A0 > =EF=BB=BFOn 27/03/2019, 18:25, "RATS on behalf of M= ichael Richardson"
=C2=A0 =C2=A0 > <rats-bounces@ietf.org on behalf of mcr+ietf@sandelman.ca> wrote:
=C2=A0 =C2=A0 >> (Still looking for some pointers to *attestion* part= s of the Android
=C2=A0 =C2=A0 >> KeyStore.)

=C2=A0 =C2=A0 > Maybe you want to take a look at [1]

=C2=A0 =C2=A0 > Cheers, t

=C2=A0 =C2=A0 > [1] https://arxiv.org/pdf/1904.05572.pdf<= br>
Thank you. It was a really interesting read.
What I learnt is that Android mostly attests to the location of a device signing key.

This is correct.=C2=A0 Origina= lly, keystore attestation was intended *only* to prove that a key (a) lived= in a thought-to-be-secure environment and (b) that the key had a certain s= et of properties.=C2=A0 The scope has expanded a bit to also attest to some= bits of information about the device state, at least as it was at boot tim= e.

=C2=A0
I think that this is an implementation of the device-type at= testation that FIDO cares about.

It can= serve that purpose, yes.
=C2=A0
=C2=A0 ]The paper and the referenced info at:
=C2=A0 https://developer.and= roid.com/training/articles/security-key-attestation

does not give me additional use case, but I have other reading that I have<= br> not yet finished.

--
Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works
=C2=A0-=3D IPv6 IoT consulting =3D-


_______________________________________________
RATS mailing list
RATS@ietf.org
https://www.ietf.org/mailman/listinfo/rats


--
Shawn Willden=C2=A0|=C2=A0Staff Software Engineer=C2=A0|=C2=A0swillden@google.com=C2=A0|=C2=A0720-924-6645
<= /div>
--00000000000015f16c058bc0d325-- From nobody Thu Jun 20 06:17:12 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A0865120113 for ; Thu, 20 Jun 2019 06:17:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.509 X-Spam-Level: X-Spam-Status: No, score=-17.509 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4mA-xFLcVygO for ; Thu, 20 Jun 2019 06:17:01 -0700 (PDT) Received: from mail-yb1-xb35.google.com (mail-yb1-xb35.google.com [IPv6:2607:f8b0:4864:20::b35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C21F212015C for ; Thu, 20 Jun 2019 06:17:01 -0700 (PDT) Received: by mail-yb1-xb35.google.com with SMTP id i14so1213878ybp.7 for ; Thu, 20 Jun 2019 06:17:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=05TCb3yzqiRz0SieMyfovvcSQiJrnLK8TbRw2dXQfu8=; b=iMvrSd8PRGfL2HntiXmaR6hbRqEgzkmXi/UixXY2L94XnkejnCtlf54yapXXqxXgD4 LxCtYQqxz0jGFpLfD9MwxHxotxXA8JSt/cqdGNH72AtYoJ268sEBycf8ZsU5HnB4BJLm shST4VXDVih0xoAg6/YeF2wSdI+yFzIZJnfDTV8RU/sokqszlk2y/rcmiCObwT8KU1ZE EywUXT857Z3pCYPCBubcIT0LuEo0zuARRbtGTX294qToNBzq0LZ5uLzqoTfNdYw5HG4r BkRUAUr2u18TQtSxZSJfKPMLyqXX10F44LZNMBNB0DuF3+7ejbzDiwwf+XC8v9qHIhZs JK4w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=05TCb3yzqiRz0SieMyfovvcSQiJrnLK8TbRw2dXQfu8=; b=RXAcEQX26FMQNgMsNyYn6sEaM/S3y1wrsoOb1umb3je5+nx61ePdDAh8lCKO4Y92ao ImJ5ROFJuZb+6D2pOiuFPPyDpbirJsneqEZCK4GwJv4yMQVcxq3dDRvjXS7B4/QHgdvH b5rgAzjgV5kDUQ4S1H5mpY2lTfNb+lmnLv26MW1Sv0llPkoTAJXIqWAEpsy2QfX/IGpy l2xBHc0vphZ9rmDtqTUVP4LU37VU/t/i14O7Pdcuni8fnBl0+6rlaH2PpBfidkjV9hLn J4tC22N7qGqvcxsxi1VMi8yYVR7PqJmJUTBIBIKScQ3xcrI4IlWtS+0azc/gf170w60p 0RBw== X-Gm-Message-State: APjAAAVNgO5n53dZ4Oc01awAEmcTAmtu+HrOyx3H1X16jsliZPtpVaDw +QlxSkEvbvGqoSH9CzFXmmx3+p4K1bXwvJJMwXwnYw== X-Google-Smtp-Source: APXvYqx9RvWCX+QjVvRLQmfZaF0DdRLYxt2VBQTKFzcGkraLZvbZkTJrAqOLIRUOYFlDwOdtNM07Ng/NP2G9ByGktX0= X-Received: by 2002:a5b:44:: with SMTP id e4mr67881094ybp.257.1561036620465; Thu, 20 Jun 2019 06:17:00 -0700 (PDT) MIME-Version: 1.0 References: <12503.1552447661@localhost> <219648D6-188A-429D-A13F-ED6155DE9016@island-resort.com> <14288.1553710783@dooku.sandelman.ca> <4EB6FF13-2DAF-4BDC-AC90-C46720D61AF0@arm.com> <21417.1560911502@dooku.sandelman.ca> In-Reply-To: From: Shawn Willden Date: Thu, 20 Jun 2019 15:16:48 +0200 Message-ID: To: Anders Rundgren Cc: Michael Richardson , "rats@ietf.org" , Anthony Nadalin , Thomas Fossati , Laurence Lundblade Content-Type: multipart/alternative; boundary="0000000000003f2ac4058bc12991" Archived-At: Subject: Re: [Rats] Android attestations: Re: draft-richardson-rats-usecases-00 comments X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Jun 2019 13:17:11 -0000 --0000000000003f2ac4058bc12991 Content-Type: text/plain; charset="UTF-8" On Wed, Jun 19, 2019 at 8:03 AM Anders Rundgren < anders.rundgren.net@gmail.com> wrote: > On 2019-06-19 04:31, Michael Richardson wrote: > > > > Anders Rundgren wrote: > > > Here you have another link: > > > > https://developer.android.com/training/articles/security-key-attestation > > > > > As an application developer I find this scheme and the associated > > > "AndroidKeyStore" quite impractical. The recent addition of > > > "StrongBox" makes it worse. > > > > Interesting. What is it that you find that you can not do? > > A mechanism that only attests keys cannot (securely) be used for > provisioning anything but keys. > What else do you wish to provision? Anything other than TAs (addressed below)? And how does the addition of StrongBox make keystore worse? > > > With a two-level TEE/SE session-key based scheme you only need to > > > attest the session permitting you to perform any number of secure > > > operations and close the session with a "commit" which in turn > responds > > > with a (session signed) message to the SP that everything went > right. > > > > Or is this what you wish you had? > > In the absence of installable TA support, I have implemented this in > Android as a SW emulator [1]. It is a part of the Saturn [3] payment > authorization system I'm working on. > The Android platform security team considers this an anti-goal. We're very concerned that the scope of functionality being installed in TEEs is exploding to a degree that the TEEs are becoming less trustworthy, not more (and they haven't been particularly good). Not only do we not want to enable field-installation of TAs, we'd like to constrain factory/OTA installation to smaller sets (some devices ship with upwards of 40 TAs today), though our ability to do that is very limited. There's a tension here between enabling more use cases and maintaining / increasing the security of existing use cases. We recognize that GP and many others disagree with us on how to balance the issues, and that perhaps we're wrong, but we have to respond to the Android ecosystem as we see it. > As I have tried to describe [2], this concept also relieves you from (IMO) > unwanted/unnecessary dependencies on provisioning protocol formats. > Anders > 1] > https://github.com/cyberphone/webpkisuite-4-android/blob/master/app/src/main/java/org/webpki/mobile/android/sks/AndroidSKSImplementation.java > 2] https://github.com/ietf-teep/architecture/issues/52 > 3] https://cyberphone.github.io/doc/two-visions-4-mobile-payments.pdf -- Shawn Willden | Staff Software Engineer | swillden@google.com | 720-924-6645 --0000000000003f2ac4058bc12991 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, Jun 19, 2019 at 8:03 AM Anders Ru= ndgren <anders.rundgren= .net@gmail.com> wrote:
On 2019-06-19 04:31, Michael Richa= rdson wrote:
>
> Anders Rundgren <anders.rundgren.net@gmail.com> wrote:
>=C2=A0 =C2=A0 =C2=A0 > Here you have another link:
>=C2=A0 =C2=A0 =C2=A0 > https://developer.android.com/training/articles/security-key-attestation<= /a>
>
>=C2=A0 =C2=A0 =C2=A0 > As an application developer I find this schem= e and the associated
>=C2=A0 =C2=A0 =C2=A0 > "AndroidKeyStore" quite impractical= .=C2=A0 The recent addition of
>=C2=A0 =C2=A0 =C2=A0 > "StrongBox" makes it worse.
>
> Interesting. What is it that you find that you can not do?

A mechanism that only attests keys cannot (securely) be used for provisioni= ng anything but keys.

What else do you = wish to provision? Anything other than TAs (addressed below)?=C2=A0 And how= does the addition of StrongBox make keystore worse?
=C2=A0
=
>=C2=A0 =C2=A0 =C2=A0 > With a two-level TEE/SE session-key based sch= eme you only need to
>=C2=A0 =C2=A0 =C2=A0 > attest the session permitting you to perform = any number of secure
>=C2=A0 =C2=A0 =C2=A0 > operations and close the session with a "= ;commit" which in turn responds
>=C2=A0 =C2=A0 =C2=A0 > with a (session signed) message to the SP tha= t everything went right.
>
> Or is this what you wish you had?

In the absence of installable TA support, I have implemented this in Androi= d as a SW emulator [1]. It is a part of the Saturn [3] payment authorizatio= n system I'm working on.

The Androi= d platform security team considers this an anti-goal.=C2=A0 We're very = concerned that the scope of functionality being installed in TEEs is explod= ing to a degree that the TEEs are becoming less trustworthy, not more (and = they haven't been particularly good).=C2=A0 Not only do we not want to = enable field-installation of TAs, we'd like to constrain factory/OTA in= stallation to smaller sets (some devices ship with upwards of 40 TAs today)= , though our ability to do that is very limited.

T= here's a tension here between enabling more use cases and maintaining /= increasing the security of existing use cases. We recognize that GP and ma= ny others disagree with us on how to balance the issues, and that perhaps w= e're wrong, but we have to respond to the Android ecosystem as we see i= t.
=C2=A0
= As I have tried to describe [2], this concept also relieves you from (IMO) = unwanted/unnecessary dependencies on provisioning protocol formats.=C2=A0

Anders
1] https://github.com/cyberphone/w= ebpkisuite-4-android/blob/master/app/src/main/java/org/webpki/mobile/androi= d/sks/AndroidSKSImplementation.java
2] https://github.com/ietf-teep/architecture/issu= es/52
3] https://cyberphone.github.io/do= c/two-visions-4-mobile-payments.pdf
=C2=A0
= --
Shawn Willden=C2=A0|=C2=A0Staff Software Engineer=C2=A0|=C2=A0swillden@google.com=C2=A0|=C2=A0720-924-6645
<= /div>
--0000000000003f2ac4058bc12991-- From nobody Thu Jun 20 06:31:54 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C1AF412004E for ; Thu, 20 Jun 2019 06:31:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=redhoundsoftware.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nNpd8Un0zHAO for ; Thu, 20 Jun 2019 06:31:51 -0700 (PDT) Received: from mail-qt1-x834.google.com (mail-qt1-x834.google.com [IPv6:2607:f8b0:4864:20::834]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1636F120045 for ; Thu, 20 Jun 2019 06:31:51 -0700 (PDT) Received: by mail-qt1-x834.google.com with SMTP id h21so3125233qtn.13 for ; Thu, 20 Jun 2019 06:31:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhoundsoftware.com; s=google; h=user-agent:date:subject:from:to:cc:message-id:thread-topic :references:in-reply-to:mime-version; bh=Eb4zWZKLsO6t8ObFqUf1yuwtJlln//qRFdd0QptS844=; b=J1YBuq3HR1FL/fjl8Ff4hz5J/Kx3ePrMVaEbFK7THaJ/IJqNKd2k4C9oKCUtcKkkBw UZ8l+K/koAwoRFHPULHYrbV4gJtmnnK9scvUQiwAJ9csAmEGqb3Lky/qqyUdL6Sfwh13 m69X74AVWbt/3wvbepEpUQcdhxD0C6kRDqEj4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:user-agent:date:subject:from:to:cc:message-id :thread-topic:references:in-reply-to:mime-version; bh=Eb4zWZKLsO6t8ObFqUf1yuwtJlln//qRFdd0QptS844=; b=cOPyW9YYx/r/1xM8Hf6a5/1FdrsIowzz+1s5DlYKSqsySM/5j5T8dccDVHAfHkx8N8 B3GM6P+en5P/E12zH4NMKbtgA/j7t4U9O+Ys22GsM5R54q4lpmNXhMilLyS4vjHsbnwB 7OPORLNBoV2SVp8mXE8T8K2FnSSwlGHN3M7jcIgmDxed33zvPU1xVIBNogG5WA009AdN UaWl/kVrZOZrrvUch9KPhNOyIuzsEocJVJq9XhijZvfYVK6l3YEOb+CzTGAeWVZFeq4i 6/EBoaRmbY8sydSAWqvY+6H3ABoSv2/yeBysFGgfkqmwjDyuS4a9Kd3YeLO/w1pcbVgt m7Rg== X-Gm-Message-State: APjAAAWbrM7CnPyGTutGL1q2qzpo7Fylqkqp9GqdtN4bWHpzFKVj8s8g Vfw08me8qYXms3gUAdfpHhCErw== X-Google-Smtp-Source: APXvYqzV/q2Pgl1YogIfzQ0jCfPtk16fSx9mPih80NMSjbKsCaA8axQTlAovdZj2tItcNrMPIPGiJA== X-Received: by 2002:ac8:28e2:: with SMTP id j31mr71940982qtj.274.1561037510099; Thu, 20 Jun 2019 06:31:50 -0700 (PDT) Received: from [192.168.2.105] (pool-96-255-231-27.washdc.fios.verizon.net. [96.255.231.27]) by smtp.googlemail.com with ESMTPSA id 47sm11799619qtw.90.2019.06.20.06.31.46 (version=TLS1 cipher=AES128-SHA bits=128/128); Thu, 20 Jun 2019 06:31:49 -0700 (PDT) User-Agent: Microsoft-MacOutlook/14.7.6.170621 Date: Thu, 20 Jun 2019 09:31:40 -0400 From: Carl Wallace To: Shawn Willden , Anders Rundgren CC: Michael Richardson , Anthony Nadalin , Laurence Lundblade , Thomas Fossati , "rats@ietf.org" Message-ID: Thread-Topic: [Rats] Android attestations: Re: draft-richardson-rats-usecases-00 comments References: <12503.1552447661@localhost> <219648D6-188A-429D-A13F-ED6155DE9016@island-resort.com> <14288.1553710783@dooku.sandelman.ca> <4EB6FF13-2DAF-4BDC-AC90-C46720D61AF0@arm.com> <21417.1560911502@dooku.sandelman.ca> In-Reply-To: Mime-version: 1.0 Content-type: multipart/alternative; boundary="B_3643867908_3983767" Archived-At: Subject: Re: [Rats] Android attestations: Re: draft-richardson-rats-usecases-00 comments X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Jun 2019 13:31:54 -0000 > This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --B_3643867908_3983767 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: 7bit >> > The Android platform security team considers this an anti-goal. We're very > concerned that the scope of functionality being installed in TEEs is exploding > to a degree that the TEEs are becoming less trustworthy, not more (and they > haven't been particularly good). Not only do we not want to enable > field-installation of TAs, we'd like to constrain factory/OTA installation to > smaller sets (some devices ship with upwards of 40 TAs today), though our > ability to do that is very limited. +1 > > There's a tension here between enabling more use cases and maintaining / > increasing the security of existing use cases. We recognize that GP and many > others disagree with us on how to balance the issues, and that perhaps we're > wrong, but we have to respond to the Android ecosystem as we see it. Re: more use cases, the ability to encrypt a key attestation in TEE/SE for a specific provisioning end point would be nice to have (to conceal a challenge password while in transit, for example). > --B_3643867908_3983767 Content-type: text/html; charset="UTF-8" Content-transfer-encoding: quoted-printable

<= div class=3D"gmail_quote">
<sni= p>
The Android platform security team considers this= an anti-goal.  We're very concerned that the scope of functionality be= ing installed in TEEs is exploding to a degree that the TEEs are becoming le= ss trustworthy, not more (and they haven't been particularly good).  No= t only do we not want to enable field-installation of TAs, we'd like to cons= train factory/OTA installation to smaller sets (some devices ship with upwar= ds of 40 TAs today), though our ability to do that is very limited.

+1
<= div class=3D"gmail_quote">

There's a tension here between e= nabling more use cases and maintaining / increasing the security of existing= use cases. We recognize that GP and many others disagree with us on how to = balance the issues, and that perhaps we're wrong, but we have to respond to = the Android ecosystem as we see it.

Re: more use cases, the ability to encrypt a key attestatio= n in TEE/SE for a specific provisioning end point would be nice to have (to = conceal a challenge password while in transit, for example).  
=

= --B_3643867908_3983767-- From nobody Thu Jun 20 08:15:24 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 243281200DE for ; Thu, 20 Jun 2019 08:15:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FUYlaMoNFp_0 for ; Thu, 20 Jun 2019 08:15:20 -0700 (PDT) Received: from mail-wm1-x32a.google.com (mail-wm1-x32a.google.com [IPv6:2a00:1450:4864:20::32a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5EB6F1200CE for ; Thu, 20 Jun 2019 08:15:19 -0700 (PDT) Received: by mail-wm1-x32a.google.com with SMTP id c6so3587166wml.0 for ; Thu, 20 Jun 2019 08:15:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=7FRYBh+5evKYl8jsGacSJItoJxv7LsIXtN0X9qiKEpM=; b=n0JiMdLgQl252Qu0rwOFDLoZp1XI/FKUVUaazZbuPXCaNSrHfJlbCyL0Ar0lI41Dbl pdc8AcV+Dz0HccS+GlYLzUGeTcVuTSiIxosRdO7rGvVPyzX3X/t/oJG5R6m0TZEDgas0 GEI/t8hC7bKkIPiBN8HAFt3mxVePYMAEJ+oW/z232PUEN9c5wCPtwZ2gC/SCooaZrJIC fjYyxHNZZ1alvR/eaJmdOim9CZZ1wCf75DE0euZuglQHCaP/ITuOH/vSAah0ajiOH5ez V3qTHbCjpggszjo9MAn+eZbxD7BQCg57owt3LudmHMtZIxZLbAZkoOJPfbs3WbTFiN9Z 53zA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=7FRYBh+5evKYl8jsGacSJItoJxv7LsIXtN0X9qiKEpM=; b=ZLAeVbMc8SP8djXBO2DRWeRvvfU4Uj7PGRT+qvBJR1t0XsXDMpzx5lP+xr3eW+2m6E 6AgqUrUmBTk5xyaIUgtg+hkg1KuW2CGsVhwhjgLA82OCFcMHS/GjgxDRRdTZaMpP4kJG bSh9QA2Zz/zJas3odRZp0+g8obBVZihNVmnhIsKugn+FgD6o9M9zpw7R2gizw5N7TclX vJBBjxwwcCik4UyiMtdeDxhl9tZkO2aVwU47nKb8YjGlsDB1ziF/KuUb2IZ7LFA7U9fp g63G68YyntnCvTyDj9QNYGQiEvZ5EUV31TR5Y/Nq3ofV7po1xble6XLcHAQXj5y8esBj NmIg== X-Gm-Message-State: APjAAAVCRlFHK7CbaXAmaiyub9sDM9KpFkVbtqNVQfxb6mKsK35gYQyM GL9mzE6KGO6ZoUwbw7G6iPg= X-Google-Smtp-Source: APXvYqwqaSmFDJxVBLFySuhRxmtv4xltrm2XL7R8XVye+4/+JvCdlSFynEr57kOblT8nWycDDf+6jA== X-Received: by 2002:a1c:23c4:: with SMTP id j187mr107238wmj.176.1561043717751; Thu, 20 Jun 2019 08:15:17 -0700 (PDT) Received: from [192.168.1.79] (25.131.146.77.rev.sfr.net. [77.146.131.25]) by smtp.googlemail.com with ESMTPSA id h14sm17827020wrs.66.2019.06.20.08.15.16 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 20 Jun 2019 08:15:17 -0700 (PDT) To: Shawn Willden Cc: Michael Richardson , "rats@ietf.org" , Anthony Nadalin , Thomas Fossati , Laurence Lundblade References: <12503.1552447661@localhost> <219648D6-188A-429D-A13F-ED6155DE9016@island-resort.com> <14288.1553710783@dooku.sandelman.ca> <4EB6FF13-2DAF-4BDC-AC90-C46720D61AF0@arm.com> <21417.1560911502@dooku.sandelman.ca> From: Anders Rundgren Message-ID: <50dc4fad-2a57-0daa-6c13-87557ebb050b@gmail.com> Date: Thu, 20 Jun 2019 17:15:15 +0200 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.7.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Rats] Android attestations: Re: draft-richardson-rats-usecases-00 comments X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Jun 2019 15:15:22 -0000 On 2019-06-20 15:16, Shawn Willden wrote: > On Wed, Jun 19, 2019 at 8:03 AM Anders Rundgren > wrote: > > On 2019-06-19 04:31, Michael Richardson wrote: > > > > Anders Rundgren > wrote: > >      > Here you have another link: > >      > https://developer.android.com/training/articles/security-key-attestation > > > >      > As an application developer I find this scheme and the associated > >      > "AndroidKeyStore" quite impractical.  The recent addition of > >      > "StrongBox" makes it worse. > > > > Interesting. What is it that you find that you can not do? > > A mechanism that only attests keys cannot (securely) be used for provisioning anything but keys. > > > What else do you wish to provision? Anything other than TAs (addressed below)? Most of all I wanted to provision "stuff" in an *atomic fashion* which was the initial motive for the session based attestation scheme. In my particular case "stuff" also includes various key meta data like payment credential images. And how does the addition of StrongBox make keystore worse? I don't have much data on StrongBox so maybe I was out of line there, but the idea I had was that keys would not be stored in secure silicon, but rather encrypted in the TEE or RE environment. In that case StrongBox would be a crypto processor with embedded keys which also would be used for provisioning/attestation: https://github.com/ietf-teep/architecture/issues/52#issuecomment-486929941 Anders > > >      > With a two-level TEE/SE session-key based scheme you only need to > >      > attest the session permitting you to perform any number of secure > >      > operations and close the session with a "commit" which in turn responds > >      > with a (session signed) message to the SP that everything went right. > > > > Or is this what you wish you had? > > In the absence of installable TA support, I have implemented this in Android as a SW emulator [1]. It is a part of the Saturn [3] payment authorization system I'm working on. > > > The Android platform security team considers this an anti-goal.  We're very concerned that the scope of functionality being installed in TEEs is exploding to a degree that the TEEs are becoming less trustworthy, not more (and they haven't been particularly good).  Not only do we not want to enable field-installation of TAs, we'd like to constrain factory/OTA installation to smaller sets (some devices ship with upwards of 40 TAs today), though our ability to do that is very limited. > > There's a tension here between enabling more use cases and maintaining / increasing the security of existing use cases. We recognize that GP and many others disagree with us on how to balance the issues, and that perhaps we're wrong, but we have to respond to the Android ecosystem as we see it. > > As I have tried to describe [2], this concept also relieves you from (IMO) unwanted/unnecessary dependencies on provisioning protocol formats. > > > Anders > 1] https://github.com/cyberphone/webpkisuite-4-android/blob/master/app/src/main/java/org/webpki/mobile/android/sks/AndroidSKSImplementation.java > 2] https://github.com/ietf-teep/architecture/issues/52 > 3] https://cyberphone.github.io/doc/two-visions-4-mobile-payments.pdf > > -- > Shawn Willden | Staff Software Engineer |swillden@google.com  | 720-924-6645 From nobody Thu Jun 20 10:25:22 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6D7DC12000E for ; Thu, 20 Jun 2019 10:25:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id O2H3Y-NrQerX for ; Thu, 20 Jun 2019 10:25:18 -0700 (PDT) Received: from p3plsmtpa12-04.prod.phx3.secureserver.net (p3plsmtpa12-04.prod.phx3.secureserver.net [68.178.252.233]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3951C1200E5 for ; Thu, 20 Jun 2019 10:25:18 -0700 (PDT) Received: from [172.20.10.4] ([174.212.24.188]) by :SMTPAUTH: with ESMTPSA id e0oGhaxIkoaPAe0oGhq3B3; Thu, 20 Jun 2019 10:25:17 -0700 From: Laurence Lundblade Message-Id: <2978E05F-2269-4196-9C86-A69914F21404@island-resort.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_9EED007E-52BF-488D-BD0B-ADBB63B93297" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Thu, 20 Jun 2019 10:25:15 -0700 In-Reply-To: Cc: Michael Richardson , Thomas Fossati , "rats@ietf.org" , Anthony Nadalin To: Shawn Willden References: <12503.1552447661@localhost> <219648D6-188A-429D-A13F-ED6155DE9016@island-resort.com> <14288.1553710783@dooku.sandelman.ca> <4EB6FF13-2DAF-4BDC-AC90-C46720D61AF0@arm.com> <21349.1560911427@dooku.sandelman.ca> X-Mailer: Apple Mail (2.3445.9.1) X-CMAE-Envelope: MS4wfF9OzbDN4Jw9KAPEbd16YvD8+BQKTewEcqLBB812NeROcBz+2jOdkL16APAXCE9SxQJEm7zESOsK4xNgLe3NMYMFOB91zUJrEZZGS6vck6V4EBo/0eaM sa8LeE3TrNrQPeGmWNeg/noQdwODsmTC7fw4kCbhLsCrMddRDBLw8fwQAmrU8hmvuRWuxddmrZOSBGxN3pP84Oql2wSnl8/l5CpEI+nNj3w7iIqxxGmCstOh EyukT7xYwrdufoQwwaSnnjzlaR45KYiRulJqIhzK/33JcQH3w/JTq8t8dAi/4uzctAAZbAmnLu9/9LXQu9VnYg== Archived-At: Subject: Re: [Rats] draft-richardson-rats-usecases-00 comments X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Jun 2019 17:25:21 -0000 --Apple-Mail=_9EED007E-52BF-488D-BD0B-ADBB63B93297 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii > On Jun 20, 2019, at 5:52 AM, Shawn Willden = wrote: >=20 > Thank you. It was a really interesting read. > What I learnt is that Android mostly attests to the location of a = device > signing key. >=20 > This is correct. Originally, keystore attestation was intended *only* = to prove that a key (a) lived in a thought-to-be-secure environment and = (b) that the key had a certain set of properties. The scope has = expanded a bit to also attest to some bits of information about the = device state, at least as it was at boot time. A few other things that seem useful and may be implemented in some = cases: That the key use is gated by user verification like a fingerprint match. = This is immensely valuable IMO. That there are timer throttles that govern the rate of key use. Knowing which application (e.g. Android app) requested the attestation. Allowing the application to include custom data in the attestation (it = must be marked as as less secure than other data in the attestation).=20 Inventory of some or or all of the SW on the device. A lot of these are useful as risk signals or cross-checks for payments = and such. LL= --Apple-Mail=_9EED007E-52BF-488D-BD0B-ADBB63B93297 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii
On = Jun 20, 2019, at 5:52 AM, Shawn Willden <swillden@google.com>= wrote:

Thank you. It was a really interesting read.
What I learnt is that Android mostly attests to the location = of a device
signing key.

This is correct.  Originally, keystore = attestation was intended *only* to prove that a key (a) lived in a = thought-to-be-secure environment and (b) that the key had a certain set = of properties.  The scope has expanded a bit to also attest to some = bits of information about the device state, at least as it was at boot = time.

A few = other things that seem useful and may be implemented in some = cases:
  • That = the key use is gated by user verification like a fingerprint match. This = is immensely valuable IMO.
  • That there are timer = throttles that govern the rate of key use.
  • Knowing = which application (e.g. Android app) requested the attestation.
  • Allowing the application to include custom data in the = attestation (it must be marked as as less secure than other data in the = attestation). 
  • Inventory of some or or all of = the SW on the device.

A lot of these are useful as risk = signals or cross-checks for payments and such.

LL
= --Apple-Mail=_9EED007E-52BF-488D-BD0B-ADBB63B93297-- From nobody Fri Jun 21 15:48:17 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ECA3C12025F; Fri, 21 Jun 2019 15:48:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.197 X-Spam-Level: X-Spam-Status: No, score=-4.197 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RdTencrwKDPg; Fri, 21 Jun 2019 15:48:02 -0700 (PDT) Received: from smtp.uni-bremen.de (gabriel-vm-2.zfn.uni-bremen.de [134.102.50.17]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C1B2E1201CA; Fri, 21 Jun 2019 15:47:58 -0700 (PDT) Received: from [192.168.217.113] (p54A6CA4C.dip0.t-ipconnect.de [84.166.202.76]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.uni-bremen.de (Postfix) with ESMTPSA id 45Vv3K1S6RzyQG; Sat, 22 Jun 2019 00:47:57 +0200 (CEST) From: Carsten Bormann Content-Type: text/plain; charset=utf-8 X-Mao-Original-Outgoing-Id: 582850069.8317569-c2cd306dac1f450f7937a01941199677 Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Message-Id: <39E6E4DA-4A67-4B62-86A3-B45B6C68045F@tzi.org> Date: Sat, 22 Jun 2019 00:47:57 +0200 To: suit , teep@ietf.org, din@irtf.org, rats@ietf.org, lake@ietf.org X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: [Rats] [Ace] Constrained Node/Network Cluster @ IETF105: DRAFT AGENDA X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 Jun 2019 22:48:06 -0000 Here is my usual eclectic condensed agenda based on the DRAFT AGENDA for IETF105. Remember that there is still quite some potential for changes. Conflicts that meet the eye: COSE/TEEP again! ROLL/SUIT/DINRG and 6TISCH/ACE are maybe slightly less annoying. (The poor TEEP people get to both start and end the week, too.) LAKE and LOOPS -- two BOFs at the same time? All times are EDT (Eastern Daylight Time) =3D=3D UTC -4 hours. (Pure UTC times at https://datatracker.ietf.org/meeting/agenda-utc are useful for those who want to listen from remote.) Gr=C3=BC=C3=9Fe, Carsten FRIDAY, March 22, 2019 -- OMA/T2TRG Work Meeting - @ Ericsson Montreal Office (St-Laurent) SATURDAY/SUNDAY, March 23/24. 2019 -- Hackathon (including various interops) - Centre Ville -- Sun 1700-1900 Welcome Reception - Place du Canada -- Sun 1800-2000 Hot RFC Lightning Talks - Viger MONDAY, July 22, 2019 1000-1200 Morning Session I Laurier ART dispatch Dispatch WG Van Horne SEC *** teep Trusted Execution Environment = Provisioning WG 1330-1530 Afternoon Session I Van Horne INT *** 6lo IPv6 over Networks of = Resource-constrained Nodes WG Place du Canada SEC secdispatch Security Dispatch WG Duluth TSV taps Transport Services WG 1550-1750 Afternoon Session II Laurier ART httpbis Hypertext Transfer Protocol WG St-Catherine OPS v6ops IPv6 Operations WG Van Horne SEC *** lake Lightweight Authenticated Key Exchange = BOF Place du Canada TSV loops Local Optimizations on Path Segments BOF 1810-1910 Afternoon Session III Laurier TSV tsvwg Transport Area Working Group WG TUESDAY, July 23, 2019 1000-1200 Morning Session I St-Catherine ART *** cbor 1000-1130 Concise Binary Object = Representation Maintenance and Extensions WG St-Catherine INT ipwave 1130-1200 IP Wireless Access in = Vehicular Environments WG Notre Dame IRTF icnrg Information-Centric Networking Duluth OPS anima Autonomic Networking Integrated Model = and Approach WG Van Horne SEC cacao Collaborative Automated Course of Action = Operations for Cyber Security BOF Place du Canada TSV quic QUIC WG 1330-1500 Afternoon Session I Duluth OPS anima Autonomic Networking Integrated Model = and Approach WG 1520-1650 Afternoon Session II Duluth INT intarea Internet Area Working Group WG Place du Canada IRTF irtfopen IRTF Open Meeting Van Horne SEC oauth Web Authorization Protocol WG 1710-1810 Afternoon Session III Duluth ART *** core Constrained RESTful Environments WG Laurier INT 6man IPv6 Maintenance WG Place du Canada SEC tls Transport Layer Security WG WEDNESDAY, July 24, 2019 1000-1200 Morning Session I Van Horne IRTF*** dinrg Decentralized Internet Infrastructure St-Catherine RTG *** roll Routing Over Low power and Lossy = networks WG Viger SEC *** suit Software Updates for Internet of Things = WG Place du Canada TSV quic QUIC WG 1330-1530 Afternoon Session I Place du Canada GEN netrqmts IETF Meeting Network = Requirements BOF Laurier IRTF pearg Privacy Enhancements and Assessments = Research Group Viger IRTF*** t2trg Thing-to-Thing St-Catherine RTG bier Bit Indexed Explicit Replication WG Centre Ville RTG detnet Deterministic Networking WG 1550-1650 Afternoon Session II St-Catherine RTG babel Babel routing protocol WG Centre Ville RTG detnet Deterministic Networking WG Van Horne SEC *** rats Remote ATtestation ProcedureS WG THURSDAY, July 25, 2019 1000-1200 Morning Session I Centre Ville ART *** core Constrained RESTful Environments WG St-Catherine RTG rift Routing In Fat Trees WG Place du Canada SEC tls Transport Layer Security WG Laurier TSV tsvwg Transport Area Working Group WG 1330-1530 Afternoon Session I Duluth INT dnssd Extensions for Scalable DNS Service = Discovery WG Viger IRTF coinrg Computing in the Network Proposed = Research Group Laurier IRTF panrg Path Aware Networking RG Place du Canada SEC saag Security Area Open Meeting 1550-1720 Afternoon Session II Laurier ART httpbis Hypertext Transfer Protocol WG Duluth INT 6man IPv6 Maintenance WG Place du Canada IRTF cfrg Crypto Forum St-Catherine SEC *** rats Remote ATtestation ProcedureS WG Centre Ville TSV tsvarea Transport Area Open Meeting 1740-1910 Afternoon Session III Duluth INT *** 6tisch IPv6 over the TSCH mode of IEEE = 802.15.4e WG Centre Ville SEC *** ace Authentication and Authorization for = Constrained Environments WG Place du Canada SEC mls Messaging Layer Security WG Notre Dame TSV rmcat RTP Media Congestion Avoidance = Techniques WG FRIDAY, July 26, 2019 1000-1200 Morning Session I Notre Dame ART ice Interactive Connectivity Establishment = WG Centre Ville INT *** lpwan IPv6 over Low Power Wide-Area Networks = WG Place du Canada IRTF maprg Measurement and Analysis for Protocols Laurier SEC mls Messaging Layer Security WG Duluth SEC oauth Web Authorization Protocol WG 1220-1350 Afternoon Session I Centre Ville SEC acme Automated Certificate Management = Environment WG Van Horne SEC *** cose CBOR Object Signing and Encryption WG St-Catherine SEC *** teep Trusted Execution Environment = Provisioning WG _______________________________________________ Ace mailing list Ace@ietf.org https://www.ietf.org/mailman/listinfo/ace From nobody Fri Jun 21 16:10:36 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F21ED1201CA; Fri, 21 Jun 2019 16:10:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.01 X-Spam-Level: X-Spam-Status: No, score=-2.01 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_HIGH=-0.01, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id x3ZHo0-YtPur; Fri, 21 Jun 2019 16:10:26 -0700 (PDT) Received: from NAM02-BL2-obe.outbound.protection.outlook.com (mail-eopbgr750127.outbound.protection.outlook.com [40.107.75.127]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BE0491201E0; Fri, 21 Jun 2019 16:10:25 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=nnXuIMbwcmuiwpApe8Y1DYJCqpAoDOclmUwN8HfJJYgjlav0JMaXjXNQ6kQSzQ/FSOcG6fW1ZP2A8wn3L7DZBWs3Y2nd+wRkNwJsjq/xQ1WR99uJ8Yxzf2tlWS/jqVwSXrgLBslGe6sUJH3is8znJ5MBjutdvXIqqpDBs4c1LNBHhWuHW2aFc0Q5qbFyKlBBCSXRWtIwIdkMw8ShfnwkNm0TZrEiwq5OVjee5tB480EVzjaq0LtU/TNbikA+tUIS45nKF9zK0PR3ir1CbPm/fkaB94umG2WPob/QEshntREoC7WwwCl/edGW1N6OM8CuhRCojqQTOI/KQG+bQEDtjQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=lAMNvhFYktLk4FUDn6TJa1UUY71hKqSKLizsElfqz4s=; b=i8+WTYCpxSXINEK6Tji+ezB21pa7taMaHjyeW31bxr9NI40Fq3Hsf91XeFrov86dARSlWAHslaSrhBRhO0jPvrZzXymGKuC6k4CwrS4kN9DO3hLWuXhGfB/6lqgUa/+/JL/V34MzCkC008kLvn2xS5bFV6m48xjj/TlAdq/OjMiV1zchxrgVeYS7zj7NSBSQcaVC9Jss9rH0PaVAmxlt4fShejnfXgcVltugmCGZ4HX95UnnwbBbH/F/Lj0yeyY4ytT4/hZ/zerppto/Ink4g1AH1mEmX/2WxqN0G2eb9ZdYuUht3178XtnsPWL4KGoEe/9Sq2uyZr4V5cIS5IlEww== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=microsoft.com;dmarc=pass action=none header.from=microsoft.com;dkim=pass header.d=microsoft.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=lAMNvhFYktLk4FUDn6TJa1UUY71hKqSKLizsElfqz4s=; b=oKUsb17g3kRwZXlNIbKwhlg1kELB3RB6F+g1+jzYiNDYdCpWOprmQ6kLbHOeVkZazRf+J+QwGbCo3kp26720D6F+s+JdmFm4UOgwRjsytDAy7cHgm98ZcoZvzif+r6Dd9hMxr3GoPMD7Fu3MTrdBOgNyl2JZGWBTwnpxNlfYIYM= Received: from BN6PR21MB0497.namprd21.prod.outlook.com (10.172.112.7) by BN6PR21MB0772.namprd21.prod.outlook.com (10.173.205.7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2032.9; Fri, 21 Jun 2019 23:10:22 +0000 Received: from BN6PR21MB0497.namprd21.prod.outlook.com ([fe80::8dec:7b59:4889:a0ae]) by BN6PR21MB0497.namprd21.prod.outlook.com ([fe80::8dec:7b59:4889:a0ae%4]) with mapi id 15.20.2032.008; Fri, 21 Jun 2019 23:10:22 +0000 From: Dave Thaler To: Carsten Bormann , suit , "teep@ietf.org" , "din@irtf.org" , "rats@ietf.org" , "lake@ietf.org" Thread-Topic: [Teep] [Ace] Constrained Node/Network Cluster @ IETF105: DRAFT AGENDA Thread-Index: AQHVKINrpCm5GI+0ck6mJgWQnh/1o6amu7pQ Importance: low X-Priority: 5 Date: Fri, 21 Jun 2019 23:10:22 +0000 Message-ID: References: <39E6E4DA-4A67-4B62-86A3-B45B6C68045F@tzi.org> In-Reply-To: <39E6E4DA-4A67-4B62-86A3-B45B6C68045F@tzi.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Owner=dthaler@ntdev.microsoft.com; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2019-06-21T23:10:21.0387210Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Application=Microsoft Azure Information Protection; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ActionId=521a1182-e5a5-4d4f-86be-77916a139804; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Extended_MSFT_Method=Automatic authentication-results: spf=none (sender IP is ) smtp.mailfrom=dthaler@microsoft.com; x-originating-ip: [2001:4898:80e8:a:24a5:3df2:76b6:b657] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 3b0e588e-4f90-42eb-7a41-08d6f69da318 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:BN6PR21MB0772; x-ms-traffictypediagnostic: BN6PR21MB0772: x-ms-exchange-purlcount: 3 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:883; x-forefront-prvs: 0075CB064E x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(39860400002)(396003)(346002)(366004)(136003)(376002)(199004)(189003)(13464003)(2501003)(86362001)(66946007)(74316002)(110136005)(316002)(6116002)(68736007)(22452003)(966005)(99286004)(52536014)(5660300002)(2201001)(25786009)(7736002)(73956011)(71200400001)(71190400001)(8936002)(478600001)(76116006)(33656002)(64756008)(66556008)(66476007)(66446008)(10090500001)(6436002)(446003)(486006)(8990500004)(19627235002)(6246003)(46003)(10290500003)(476003)(55016002)(11346002)(81686011)(14454004)(76176011)(81156014)(53936002)(6306002)(81166006)(102836004)(9686003)(8676002)(305945005)(2906002)(7696005)(256004)(53546011)(186003)(66574012)(229853002)(14444005)(6506007); DIR:OUT; SFP:1102; SCL:1; SRVR:BN6PR21MB0772; H:BN6PR21MB0497.namprd21.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: microsoft.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: carN1+h4l7XZYTh60ZwsAZ9rQPtS9ye4BkTwhuC0IX/+N88CV2zHMZucDcw7lR/uOZ5U/wczHjc20nvV7CTTWAh0UfGCe6g/tJHm99tM8fcIFhsSfjj/30r9YHPpT7ldQKJyakp57xuYk0u6utjW2hRzZD/JZnj+ZcmKi9xBGXYEpwUXcQiB6pxJ+6GNGEAx5ZsAA0W6JH5sK1kS4St1Xht/BY1iObqTfVbet7080zavX96k/NsNwnwHzz/vS3EkLfRt6JkbYwMVJbdLs4eOu4cIeoXDXs3l95E+hDEpRp23VOrGtLUdxI1/56W/eLUg8Ci3NyEBkwvhDtxXuzYQ7hMlck9fUzda1dYS25WyM6O7mZcftol0po8bCtMJ4YGGNHnw4O5L/ycpI7YY2BwSdoGFD26lvlL45m50hdoRQpg= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 3b0e588e-4f90-42eb-7a41-08d6f69da318 X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Jun 2019 23:10:22.4143 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: dthaler@ntdev.microsoft.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR21MB0772 Archived-At: Subject: Re: [Rats] [Teep] [Ace] Constrained Node/Network Cluster @ IETF105: DRAFT AGENDA X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 Jun 2019 23:10:28 -0000 PiBUaGUgcG9vciBURUVQIHBlb3BsZSBnZXQgdG8gYm90aCBzdGFydCBhbmQgZW5kIHRoZSB3ZWVr LCB0b28uDQoNClllYWgsIHdlIGRpc2N1c3Mgc2VjdXJpdHkgZW5kLXRvLWVuZCA6KQ0KDQpEYXZl DQoNCi0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQpGcm9tOiBURUVQIDx0ZWVwLWJvdW5jZXNA aWV0Zi5vcmc+IE9uIEJlaGFsZiBPZiBDYXJzdGVuIEJvcm1hbm4NClNlbnQ6IEZyaWRheSwgSnVu ZSAyMSwgMjAxOSAzOjQ4IFBNDQpUbzogc3VpdCA8c3VpdEBpZXRmLm9yZz47IHRlZXBAaWV0Zi5v cmc7IGRpbkBpcnRmLm9yZzsgcmF0c0BpZXRmLm9yZzsgbGFrZUBpZXRmLm9yZw0KU3ViamVjdDog W1RlZXBdIFtBY2VdIENvbnN0cmFpbmVkIE5vZGUvTmV0d29yayBDbHVzdGVyIEAgSUVURjEwNTog RFJBRlQgQUdFTkRBDQoNCkhlcmUgaXMgbXkgdXN1YWwgZWNsZWN0aWMgY29uZGVuc2VkIGFnZW5k YSBiYXNlZCBvbiB0aGUgRFJBRlQgQUdFTkRBIGZvciBJRVRGMTA1LiAgUmVtZW1iZXIgdGhhdCB0 aGVyZSBpcyBzdGlsbCBxdWl0ZSBzb21lIHBvdGVudGlhbCBmb3IgY2hhbmdlcy4NCg0KQ29uZmxp Y3RzIHRoYXQgbWVldCB0aGUgZXllOiAgQ09TRS9URUVQIGFnYWluIQ0KUk9MTC9TVUlUL0RJTlJH IGFuZCA2VElTQ0gvQUNFIGFyZSBtYXliZSBzbGlnaHRseSBsZXNzIGFubm95aW5nLg0KKFRoZSBw b29yIFRFRVAgcGVvcGxlIGdldCB0byBib3RoIHN0YXJ0IGFuZCBlbmQgdGhlIHdlZWssIHRvby4p IExBS0UgYW5kIExPT1BTIC0tIHR3byBCT0ZzIGF0IHRoZSBzYW1lIHRpbWU/DQoNCkFsbCB0aW1l cyBhcmUgRURUIChFYXN0ZXJuIERheWxpZ2h0IFRpbWUpID09IFVUQyAtNCBob3Vycy4NCihQdXJl IFVUQyB0aW1lcyBhdCBodHRwczovL25hbTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2su Y29tLz91cmw9aHR0cHMlM0ElMkYlMkZkYXRhdHJhY2tlci5pZXRmLm9yZyUyRm1lZXRpbmclMkZh Z2VuZGEtdXRjJmFtcDtkYXRhPTAyJTdDMDElN0NkdGhhbGVyJTQwbWljcm9zb2Z0LmNvbSU3Qzk4 ZDFjY2Y2YTk1ODRhZGJmMDlhMDhkNmY2OWE4Yzc2JTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdj ZDAxMWRiNDclN0MxJTdDMCU3QzYzNjk2NzU0MDk4MDEzNDU0MCZhbXA7c2RhdGE9eGUwMDlVOTJW aWQ1YjJTRk0wJTJGWGQ2YzRmZGZPamc4dnRGZDV3JTJCaUk0OTAlM0QmYW1wO3Jlc2VydmVkPTAg YXJlIHVzZWZ1bCBmb3IgdGhvc2Ugd2hvIHdhbnQgdG8gbGlzdGVuIGZyb20gcmVtb3RlLikNCg0K R3LDvMOfZSwgQ2Fyc3Rlbg0KDQpGUklEQVksIE1hcmNoIDIyLCAyMDE5DQotLSBPTUEvVDJUUkcg V29yayBNZWV0aW5nIC0gQCBFcmljc3NvbiBNb250cmVhbCBPZmZpY2UgKFN0LUxhdXJlbnQpDQoN ClNBVFVSREFZL1NVTkRBWSwgTWFyY2ggMjMvMjQuIDIwMTkNCi0tIEhhY2thdGhvbiAoaW5jbHVk aW5nIHZhcmlvdXMgaW50ZXJvcHMpIC0gQ2VudHJlIFZpbGxlDQotLSBTdW4gMTcwMC0xOTAwICBX ZWxjb21lIFJlY2VwdGlvbiAtIFBsYWNlIGR1IENhbmFkYQ0KLS0gU3VuIDE4MDAtMjAwMCAgSG90 IFJGQyBMaWdodG5pbmcgVGFsa3MgLSBWaWdlcg0KDQpNT05EQVksIEp1bHkgMjIsIDIwMTkNCg0K MTAwMC0xMjAwICBNb3JuaW5nIFNlc3Npb24gSQ0KTGF1cmllciAJQVJUCWRpc3BhdGNoCURpc3Bh dGNoIFdHDQpWYW4gSG9ybmUJU0VDICoqKgl0ZWVwCVRydXN0ZWQgRXhlY3V0aW9uIEVudmlyb25t ZW50IFByb3Zpc2lvbmluZyBXRw0KDQoxMzMwLTE1MzAgIEFmdGVybm9vbiBTZXNzaW9uIEkNClZh biBIb3JuZQlJTlQgKioqCTZsbwlJUHY2IG92ZXIgTmV0d29ya3Mgb2YgUmVzb3VyY2UtY29uc3Ry YWluZWQgTm9kZXMgV0cNClBsYWNlIGR1IENhbmFkYQlTRUMJc2VjZGlzcGF0Y2gJU2VjdXJpdHkg RGlzcGF0Y2ggV0cNCkR1bHV0aCAgCVRTVgl0YXBzCVRyYW5zcG9ydCBTZXJ2aWNlcyBXRw0KDQox NTUwLTE3NTAgIEFmdGVybm9vbiBTZXNzaW9uIElJDQpMYXVyaWVyIAlBUlQJaHR0cGJpcwlIeXBl cnRleHQgVHJhbnNmZXIgUHJvdG9jb2wgV0cNClN0LUNhdGhlcmluZQlPUFMJdjZvcHMJSVB2NiBP cGVyYXRpb25zIFdHDQpWYW4gSG9ybmUJU0VDICoqKglsYWtlCUxpZ2h0d2VpZ2h0IEF1dGhlbnRp Y2F0ZWQgS2V5IEV4Y2hhbmdlIEJPRg0KUGxhY2UgZHUgQ2FuYWRhCVRTVglsb29wcwlMb2NhbCBP cHRpbWl6YXRpb25zIG9uIFBhdGggU2VnbWVudHMgQk9GDQoNCjE4MTAtMTkxMCAgQWZ0ZXJub29u IFNlc3Npb24gSUlJDQpMYXVyaWVyIAlUU1YJdHN2d2cJVHJhbnNwb3J0IEFyZWEgV29ya2luZyBH cm91cCBXRw0KDQpUVUVTREFZLCBKdWx5IDIzLCAyMDE5DQoNCjEwMDAtMTIwMCAgTW9ybmluZyBT ZXNzaW9uIEkNClN0LUNhdGhlcmluZQlBUlQgKioqCWNib3IJMTAwMC0xMTMwIENvbmNpc2UgQmlu YXJ5IE9iamVjdCBSZXByZXNlbnRhdGlvbiBNYWludGVuYW5jZSBhbmQgRXh0ZW5zaW9ucyBXRw0K U3QtQ2F0aGVyaW5lCUlOVAlpcHdhdmUJMTEzMC0xMjAwIElQIFdpcmVsZXNzIEFjY2VzcyBpbiBW ZWhpY3VsYXIgRW52aXJvbm1lbnRzIFdHDQpOb3RyZSBEYW1lCUlSVEYJaWNucmcJSW5mb3JtYXRp b24tQ2VudHJpYyBOZXR3b3JraW5nDQpEdWx1dGggIAlPUFMJYW5pbWEJQXV0b25vbWljIE5ldHdv cmtpbmcgSW50ZWdyYXRlZCBNb2RlbCBhbmQgQXBwcm9hY2ggV0cNClZhbiBIb3JuZQlTRUMJY2Fj YW8JQ29sbGFib3JhdGl2ZSBBdXRvbWF0ZWQgQ291cnNlIG9mIEFjdGlvbiBPcGVyYXRpb25zIGZv ciBDeWJlciBTZWN1cml0eSBCT0YNClBsYWNlIGR1IENhbmFkYQlUU1YJcXVpYwlRVUlDIFdHDQoN CjEzMzAtMTUwMCAgQWZ0ZXJub29uIFNlc3Npb24gSQ0KRHVsdXRoICAJT1BTCWFuaW1hCUF1dG9u b21pYyBOZXR3b3JraW5nIEludGVncmF0ZWQgTW9kZWwgYW5kIEFwcHJvYWNoIFdHDQoNCjE1MjAt MTY1MCAgQWZ0ZXJub29uIFNlc3Npb24gSUkNCkR1bHV0aCAgCUlOVAlpbnRhcmVhCUludGVybmV0 IEFyZWEgV29ya2luZyBHcm91cCBXRw0KUGxhY2UgZHUgQ2FuYWRhCUlSVEYJaXJ0Zm9wZW4JSVJU RiBPcGVuIE1lZXRpbmcNClZhbiBIb3JuZQlTRUMJb2F1dGgJV2ViIEF1dGhvcml6YXRpb24gUHJv dG9jb2wgV0cNCg0KMTcxMC0xODEwICBBZnRlcm5vb24gU2Vzc2lvbiBJSUkNCkR1bHV0aCAgCUFS VCAqKioJY29yZQlDb25zdHJhaW5lZCBSRVNUZnVsIEVudmlyb25tZW50cyBXRw0KTGF1cmllciAJ SU5UCTZtYW4JSVB2NiBNYWludGVuYW5jZSBXRw0KUGxhY2UgZHUgQ2FuYWRhCVNFQwl0bHMJVHJh bnNwb3J0IExheWVyIFNlY3VyaXR5IFdHDQoNCldFRE5FU0RBWSwgSnVseSAyNCwgMjAxOQ0KDQox MDAwLTEyMDAgIE1vcm5pbmcgU2Vzc2lvbiBJDQpWYW4gSG9ybmUJSVJURioqKglkaW5yZwlEZWNl bnRyYWxpemVkIEludGVybmV0IEluZnJhc3RydWN0dXJlDQpTdC1DYXRoZXJpbmUJUlRHICoqKgly b2xsCVJvdXRpbmcgT3ZlciBMb3cgcG93ZXIgYW5kIExvc3N5IG5ldHdvcmtzIFdHDQpWaWdlciAg IAlTRUMgKioqCXN1aXQJU29mdHdhcmUgVXBkYXRlcyBmb3IgSW50ZXJuZXQgb2YgVGhpbmdzIFdH DQpQbGFjZSBkdSBDYW5hZGEJVFNWCXF1aWMJUVVJQyBXRw0KDQoxMzMwLTE1MzAgIEFmdGVybm9v biBTZXNzaW9uIEkNClBsYWNlIGR1IENhbmFkYQlHRU4JbmV0cnFtdHMJSUVURiBNZWV0aW5nIE5l dHdvcmsgUmVxdWlyZW1lbnRzIEJPRg0KTGF1cmllciAJSVJURglwZWFyZwlQcml2YWN5IEVuaGFu Y2VtZW50cyBhbmQgQXNzZXNzbWVudHMgUmVzZWFyY2ggR3JvdXANClZpZ2VyICAgCUlSVEYqKioJ dDJ0cmcJVGhpbmctdG8tVGhpbmcNClN0LUNhdGhlcmluZQlSVEcJYmllcglCaXQgSW5kZXhlZCBF eHBsaWNpdCBSZXBsaWNhdGlvbiBXRw0KQ2VudHJlIFZpbGxlCVJURwlkZXRuZXQJRGV0ZXJtaW5p c3RpYyBOZXR3b3JraW5nIFdHDQoNCjE1NTAtMTY1MCAgQWZ0ZXJub29uIFNlc3Npb24gSUkNClN0 LUNhdGhlcmluZQlSVEcJYmFiZWwJQmFiZWwgcm91dGluZyBwcm90b2NvbCBXRw0KQ2VudHJlIFZp bGxlCVJURwlkZXRuZXQJRGV0ZXJtaW5pc3RpYyBOZXR3b3JraW5nIFdHDQpWYW4gSG9ybmUJU0VD ICoqKglyYXRzCVJlbW90ZSBBVHRlc3RhdGlvbiBQcm9jZWR1cmVTIFdHDQoNClRIVVJTREFZLCBK dWx5IDI1LCAyMDE5DQoNCjEwMDAtMTIwMCAgTW9ybmluZyBTZXNzaW9uIEkNCkNlbnRyZSBWaWxs ZQlBUlQgKioqCWNvcmUJQ29uc3RyYWluZWQgUkVTVGZ1bCBFbnZpcm9ubWVudHMgV0cNClN0LUNh dGhlcmluZQlSVEcJcmlmdAlSb3V0aW5nIEluIEZhdCBUcmVlcyBXRw0KUGxhY2UgZHUgQ2FuYWRh CVNFQwl0bHMJVHJhbnNwb3J0IExheWVyIFNlY3VyaXR5IFdHDQpMYXVyaWVyIAlUU1YJdHN2d2cJ VHJhbnNwb3J0IEFyZWEgV29ya2luZyBHcm91cCBXRw0KDQoxMzMwLTE1MzAgIEFmdGVybm9vbiBT ZXNzaW9uIEkNCkR1bHV0aCAgCUlOVAlkbnNzZAlFeHRlbnNpb25zIGZvciBTY2FsYWJsZSBETlMg U2VydmljZSBEaXNjb3ZlcnkgV0cNClZpZ2VyICAgCUlSVEYJY29pbnJnCUNvbXB1dGluZyBpbiB0 aGUgTmV0d29yayBQcm9wb3NlZCBSZXNlYXJjaCBHcm91cA0KTGF1cmllciAJSVJURglwYW5yZwlQ YXRoIEF3YXJlIE5ldHdvcmtpbmcgUkcNClBsYWNlIGR1IENhbmFkYQlTRUMJc2FhZwlTZWN1cml0 eSBBcmVhIE9wZW4gTWVldGluZw0KDQoxNTUwLTE3MjAgIEFmdGVybm9vbiBTZXNzaW9uIElJDQpM YXVyaWVyIAlBUlQJaHR0cGJpcwlIeXBlcnRleHQgVHJhbnNmZXIgUHJvdG9jb2wgV0cNCkR1bHV0 aCAgCUlOVAk2bWFuCUlQdjYgTWFpbnRlbmFuY2UgV0cNClBsYWNlIGR1IENhbmFkYQlJUlRGCWNm cmcJQ3J5cHRvIEZvcnVtDQpTdC1DYXRoZXJpbmUJU0VDICoqKglyYXRzCVJlbW90ZSBBVHRlc3Rh dGlvbiBQcm9jZWR1cmVTIFdHDQpDZW50cmUgVmlsbGUJVFNWCXRzdmFyZWEJVHJhbnNwb3J0IEFy ZWEgT3BlbiBNZWV0aW5nDQoNCjE3NDAtMTkxMCAgQWZ0ZXJub29uIFNlc3Npb24gSUlJDQpEdWx1 dGggIAlJTlQgKioqCTZ0aXNjaAlJUHY2IG92ZXIgdGhlIFRTQ0ggbW9kZSBvZiBJRUVFIDgwMi4x NS40ZSBXRw0KQ2VudHJlIFZpbGxlCVNFQyAqKioJYWNlCUF1dGhlbnRpY2F0aW9uIGFuZCBBdXRo b3JpemF0aW9uIGZvciBDb25zdHJhaW5lZCBFbnZpcm9ubWVudHMgV0cNClBsYWNlIGR1IENhbmFk YQlTRUMJbWxzCU1lc3NhZ2luZyBMYXllciBTZWN1cml0eSBXRw0KTm90cmUgRGFtZQlUU1YJcm1j YXQJUlRQIE1lZGlhIENvbmdlc3Rpb24gQXZvaWRhbmNlIFRlY2huaXF1ZXMgV0cNCg0KRlJJREFZ LCBKdWx5IDI2LCAyMDE5DQoNCjEwMDAtMTIwMCAgTW9ybmluZyBTZXNzaW9uIEkNCk5vdHJlIERh bWUJQVJUCWljZQlJbnRlcmFjdGl2ZSBDb25uZWN0aXZpdHkgRXN0YWJsaXNobWVudCBXRw0KQ2Vu dHJlIFZpbGxlCUlOVCAqKioJbHB3YW4JSVB2NiBvdmVyIExvdyBQb3dlciBXaWRlLUFyZWEgTmV0 d29ya3MgV0cNClBsYWNlIGR1IENhbmFkYQlJUlRGCW1hcHJnCU1lYXN1cmVtZW50IGFuZCBBbmFs eXNpcyBmb3IgUHJvdG9jb2xzDQpMYXVyaWVyIAlTRUMJbWxzCU1lc3NhZ2luZyBMYXllciBTZWN1 cml0eSBXRw0KRHVsdXRoICAJU0VDCW9hdXRoCVdlYiBBdXRob3JpemF0aW9uIFByb3RvY29sIFdH DQoNCjEyMjAtMTM1MCAgQWZ0ZXJub29uIFNlc3Npb24gSQ0KQ2VudHJlIFZpbGxlCVNFQwlhY21l CUF1dG9tYXRlZCBDZXJ0aWZpY2F0ZSBNYW5hZ2VtZW50IEVudmlyb25tZW50IFdHDQpWYW4gSG9y bmUJU0VDICoqKgljb3NlCUNCT1IgT2JqZWN0IFNpZ25pbmcgYW5kIEVuY3J5cHRpb24gV0cNClN0 LUNhdGhlcmluZQlTRUMgKioqCXRlZXAJVHJ1c3RlZCBFeGVjdXRpb24gRW52aXJvbm1lbnQgUHJv dmlzaW9uaW5nIFdHDQoNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX18NCkFjZSBtYWlsaW5nIGxpc3QNCkFjZUBpZXRmLm9yZw0KaHR0cHM6Ly9uYW0wNi5z YWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGd3d3Lmll dGYub3JnJTJGbWFpbG1hbiUyRmxpc3RpbmZvJTJGYWNlJmFtcDtkYXRhPTAyJTdDMDElN0NkdGhh bGVyJTQwbWljcm9zb2Z0LmNvbSU3Qzk4ZDFjY2Y2YTk1ODRhZGJmMDlhMDhkNmY2OWE4Yzc2JTdD NzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDclN0MxJTdDMCU3QzYzNjk2NzU0MDk4MDEz NDU0MCZhbXA7c2RhdGE9TDVrbUhHMU9BVDhUVGZnb2UzU2laJTJGcjFKJTJGSGZ2ekFEOW9YTFpD T0hLenclM0QmYW1wO3Jlc2VydmVkPTANCg0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fXw0KVEVFUCBtYWlsaW5nIGxpc3QNClRFRVBAaWV0Zi5vcmcNCmh0 dHBzOi8vbmFtMDYuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUz QSUyRiUyRnd3dy5pZXRmLm9yZyUyRm1haWxtYW4lMkZsaXN0aW5mbyUyRnRlZXAmYW1wO2RhdGE9 MDIlN0MwMSU3Q2R0aGFsZXIlNDBtaWNyb3NvZnQuY29tJTdDOThkMWNjZjZhOTU4NGFkYmYwOWEw OGQ2ZjY5YThjNzYlN0M3MmY5ODhiZjg2ZjE0MWFmOTFhYjJkN2NkMDExZGI0NyU3QzElN0MwJTdD NjM2OTY3NTQwOTgwMTM0NTQwJmFtcDtzZGF0YT1SN1RsNzR3cWVnUDFodTIyJTJCdWJiZmpKWlcl MkYwNTFaVXh5blU2WTJ6dXE5QSUzRCZhbXA7cmVzZXJ2ZWQ9MA0K From nobody Sat Jun 22 12:34:22 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 608391200EA for ; Sat, 22 Jun 2019 12:34:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.391 X-Spam-Level: X-Spam-Status: No, score=-0.391 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, SUBJ_ALL_CAPS=1.506] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Thvk6WfKue5W for ; Sat, 22 Jun 2019 12:34:20 -0700 (PDT) Received: from p3plsmtpa08-09.prod.phx3.secureserver.net (p3plsmtpa08-09.prod.phx3.secureserver.net [173.201.193.110]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 04240120090 for ; Sat, 22 Jun 2019 12:34:19 -0700 (PDT) Received: from [192.168.1.76] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id elmEhVMbES6fYelmEhsa6z; Sat, 22 Jun 2019 12:34:18 -0700 From: Laurence Lundblade Content-Type: multipart/alternative; boundary="Apple-Mail=_49C9F25A-E465-43BD-BA00-6E7FCF052D39" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Message-Id: <494D662B-2207-4527-9190-243AEAA1D7DB@island-resort.com> Date: Sat, 22 Jun 2019 12:34:17 -0700 To: rats@ietf.org X-Mailer: Apple Mail (2.3445.9.1) X-CMAE-Envelope: MS4wfB3FnNh8BvjUN8pRxTZ0QB5daXlttlLt0LAHMoH7p67o1vpIh9ORfPi7TfD5DMQK8298HwvT3Z41IibQJKR/+inB0hAV52lES1v4/EtCi4TCszxfGmXC 6SeAGkXbQbmUFwFw97Kk91XOoenJmhgy8e1r+SF25lqrjZbStHHXsJ3i Archived-At: Subject: [Rats] EAT / CWT / JWT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 22 Jun 2019 19:34:22 -0000 --Apple-Mail=_49C9F25A-E465-43BD-BA00-6E7FCF052D39 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Here=E2=80=99s a proposed position on EAT in relation to CWT and JWT and = claim definition. This roughly gives a position on many of the issues = identified by Kathleen. I didn=E2=80=99t attend the interim meeting and = haven=E2=80=99t seen notes from it, so don=E2=80=99t know how this lines = up with that discussion. An EAT is either a CWT or a JWT. The difference is just syntax / = encoding. When this WG defines an EAT claim we will define it for both CWT and JWT = and register it in both registries.=20 Just like with CWT and JWT, there is no formal requirement or mechanism = that requires that a claim be defined or registered for both, so folks = outside this WG may define an attestation for just CWT or just JWT, the = same as it is for the authentication use cases. We will not modify the main rules given in the CWT and JWT RFCs for for = registration of new claims. (Note that CWT and JWT have different = set-ups for claim registration. JWT is always Specification Required = (which requires expert review)). CWT has several levels. Seems a bit = weird to me that they are different.) Claims defined by this WG are standards track so they pass both = criteria. Others wishing to define a claim for both CWT and JWT that is not = standard track must meet the =E2=80=9CSpecification Required=E2=80=9D = criteria because that is the minimum set by JWT and it is higher than = that set for CWT. The primary means for use cases and implementations to settle on only = high-quality claims is through the creation of profiles, not through the = claims registration process (expert review and such). Some profiles = could be IETF standards. I believe I know how to write down the information model in CDDL and = deterministically derive the JSON and CBOR data models from it. It doesn=E2=80=99t make sense to me to not have CWTs and JWTs used for = attestation as anything but equivalent.=20 I=E2=80=99m not clear yet if we need to some how mark CWT and JWTs some = how when they are used for entity attestation. Maybe you can always tell = by context. Maybe not.=20 LL --Apple-Mail=_49C9F25A-E465-43BD-BA00-6E7FCF052D39 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Here=E2=80=99s a proposed position on EAT in relation to CWT = and JWT and claim definition. This roughly gives a position on many of = the issues identified by Kathleen. I didn=E2=80=99t attend the interim = meeting and haven=E2=80=99t seen notes from it, so don=E2=80=99t know = how this lines up with that discussion.


An EAT is either a CWT or a JWT. The difference is just = syntax / encoding.

When this WG defines an EAT claim we will define it for both = CWT and JWT and register it in both registries. 

Just like with CWT and = JWT, there is no formal requirement or mechanism that requires that a = claim be defined or registered for both, so folks outside this WG may = define an attestation for just CWT or just JWT, the same as it is for = the authentication use cases.

We will not modify the main rules given = in the CWT and JWT RFCs for for registration of new claims. (Note that = CWT and JWT have different set-ups for claim registration. JWT is always = Specification Required (which requires expert review)). CWT has several = levels. Seems a bit weird to me that they are different.)

Claims defined by this = WG are standards track so they pass both criteria.

Others wishing to define = a  claim for both CWT and JWT that is not standard track must meet = the =E2=80=9CSpecification Required=E2=80=9D criteria because that is = the minimum set by JWT and it is higher than that set for CWT.

The primary means for = use cases and implementations to settle on only high-quality claims is = through the creation of profiles, not through the claims registration = process (expert review and such). Some profiles could be IETF = standards.


I believe I know how to = write down the information model in CDDL and deterministically derive = the JSON and CBOR data models from it.

It doesn=E2=80=99t make sense to me to = not have CWTs and JWTs used for attestation as anything but = equivalent. 

I=E2=80=99m not clear yet if we need to some how mark CWT and = JWTs some how when they are used for entity attestation. Maybe you can = always tell by context. Maybe not. 

LL


= --Apple-Mail=_49C9F25A-E465-43BD-BA00-6E7FCF052D39-- From nobody Sun Jun 23 04:02:02 2019 Return-Path: X-Original-To: rats@ietf.org Delivered-To: rats@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 8AB37120025; Sun, 23 Jun 2019 04:01:59 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: rats@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.98.1 Auto-Submitted: auto-generated Precedence: bulk Reply-To: rats@ietf.org Message-ID: <156128771948.30592.17390021406800686110@ietfa.amsl.com> Date: Sun, 23 Jun 2019 04:01:59 -0700 Archived-At: Subject: [Rats] I-D Action: draft-ietf-rats-eat-00.txt X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 23 Jun 2019 11:02:00 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Remote ATtestation ProcedureS WG of the IETF. Title : The Entity Attestation Token (EAT) Authors : Giridhar Mandyam Laurence Lundblade Miguel Ballesteros Jeremy O'Donoghue Filename : draft-ietf-rats-eat-00.txt Pages : 23 Date : 2019-06-22 Abstract: An attestation format based on concise binary object representation (CBOR) is proposed that is suitable for inclusion in a CBOR Web Token (CWT), know as the Entity Attestation Token (EAT). The associated data can be used by a relying party to assess the security state of a remote device or module. Contributing TBD The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-rats-eat/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-rats-eat-00 https://datatracker.ietf.org/doc/html/draft-ietf-rats-eat-00 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Sun Jun 23 04:07:05 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CE04412014B for ; Sun, 23 Jun 2019 04:07:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y23GyKro4IDb for ; Sun, 23 Jun 2019 04:07:00 -0700 (PDT) Received: from mail-ot1-x329.google.com (mail-ot1-x329.google.com [IPv6:2607:f8b0:4864:20::329]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 84BA2120155 for ; Sun, 23 Jun 2019 04:07:00 -0700 (PDT) Received: by mail-ot1-x329.google.com with SMTP id l15so10693159otn.9 for ; Sun, 23 Jun 2019 04:07:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=U6RkAVZB/9G+dG4llzMP5mmR+q63H564pkSyKo5qAfo=; b=ZuKqAW+0IcjK30/rkiQmQJkcIQry/Sj82pZGIg3VJA4f4KWp38qwtKUp7ziAxchxZl zuxcyATSU0iH4Fgg9zme6w3MlYcp9jt1/A3wcGJ3iSFOPF7Ty1BvyX/Fg3fZlc7yPpSc nS1F2fOiK6I1XvFyKYQxeEP0hr6boLty3FXhAVHXwePKohhO5ffu+sBWWerv0NL8GKVl PORoNhjUCu6rQN9F4gn7t5Ay3Vz7cUal2p88svwYEjrcwUO4REJbPrXNF7lzw4e77Jqx so+882VBbJ5ERufisDPsIRwQ8g8JTTfI76vLotx5OH7HSQr1ERjc8FqVlJsnpNRBQkTo Z7Fw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=U6RkAVZB/9G+dG4llzMP5mmR+q63H564pkSyKo5qAfo=; b=oHqWJVNBdjlAbTDZrMZVr5IZIxBU+4wsENp19XIzTEE5l6VtMvxSyqRqG09bUmv+OQ iHxSNpCjEU7/MW6vTKRW7rS03M6iuIuyStJ3EdEKtvpL+ln6xk2HpY8c04npCreFGrWi tWdm9hSlgPF2eQROpTQYK37tk9nY6bWnjVXl5qxAUnGhxKo25bpve40MYuWyTaKmc8pt M8yhKOr0FsmpZbulb9wmRIZreDOV5zyS51H/ADOLsD1YhK2nVznnnbwCqFTXIFIxRud/ F9DvW4K345hvVZ95pnpPiINWx0LNgFPZFcV4GvpeNVdkl6vvnuhvQx42cQ4KQfE+FCoB kBLg== X-Gm-Message-State: APjAAAWVAN/ORDSxLjHGF7/lX7iERiwCmPg6sDWjaLh2sNSR4tllyUYh gtDYfFYLzO3Yexwi01qs2a4MusaBwxcnPViKCtKdcPoA X-Google-Smtp-Source: APXvYqxwYZdMTUctmy6d5TikKHOll5RuWxFXwZE+u321/OtIHnW458BqFyl3Zp4xOiua3SXrg53S5pNgfhbUPjqq8Tk= X-Received: by 2002:a05:6830:210f:: with SMTP id i15mr27306319otc.250.1561288019684; Sun, 23 Jun 2019 04:06:59 -0700 (PDT) MIME-Version: 1.0 References: <156128771948.30592.17390021406800686110@ietfa.amsl.com> In-Reply-To: <156128771948.30592.17390021406800686110@ietfa.amsl.com> From: Kathleen Moriarty Date: Sun, 23 Jun 2019 07:06:35 -0400 Message-ID: To: rats@ietf.org Content-Type: multipart/alternative; boundary="000000000000ce3061058bfbb1be" Archived-At: Subject: Re: [Rats] I-D Action: draft-ietf-rats-eat-00.txt X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 23 Jun 2019 11:07:03 -0000 --000000000000ce3061058bfbb1be Content-Type: text/plain; charset="UTF-8" Greetings! As a WG draft, the content will reflect consensus decisions. Thank you to the authors for the revision and work towards addressing the identified issues discussed to date. Best regards, Kathleen On Sun, Jun 23, 2019 at 7:02 AM wrote: > > A New Internet-Draft is available from the on-line Internet-Drafts > directories. > This draft is a work item of the Remote ATtestation ProcedureS WG of the > IETF. > > Title : The Entity Attestation Token (EAT) > Authors : Giridhar Mandyam > Laurence Lundblade > Miguel Ballesteros > Jeremy O'Donoghue > Filename : draft-ietf-rats-eat-00.txt > Pages : 23 > Date : 2019-06-22 > > Abstract: > An attestation format based on concise binary object representation > (CBOR) is proposed that is suitable for inclusion in a CBOR Web Token > (CWT), know as the Entity Attestation Token (EAT). The associated > data can be used by a relying party to assess the security state of a > remote device or module. > > Contributing > > TBD > > > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-rats-eat/ > > There are also htmlized versions available at: > https://tools.ietf.org/html/draft-ietf-rats-eat-00 > https://datatracker.ietf.org/doc/html/draft-ietf-rats-eat-00 > > > Please note that it may take a couple of minutes from the time of > submission > until the htmlized version and diff are available at tools.ietf.org. > > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ > > _______________________________________________ > RATS mailing list > RATS@ietf.org > https://www.ietf.org/mailman/listinfo/rats > -- Best regards, Kathleen --000000000000ce3061058bfbb1be Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Greetings!

As a WG draft, the conte= nt will reflect consensus decisions.=C2=A0 Thank you to the authors for the= revision and work towards addressing the identified issues discussed to da= te.

Best regards,
Kathleen
On Sun, = Jun 23, 2019 at 7:02 AM <int= ernet-drafts@ietf.org> wrote:

A New Internet-Draft is available from the on-line Internet-Drafts director= ies.
This draft is a work item of the Remote ATtestation ProcedureS WG of the IE= TF.

=C2=A0 =C2=A0 =C2=A0 =C2=A0 Title=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0:= The Entity Attestation Token (EAT)
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Authors=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0: Giri= dhar Mandyam
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 Laurence Lundblade
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 Miguel Ballesteros
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 Jeremy O'Donoghue
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Filename=C2=A0 =C2=A0 =C2=A0 =C2=A0 : draft-iet= f-rats-eat-00.txt
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Pages=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0:= 23
=C2=A0 =C2=A0 =C2=A0 =C2=A0 Date=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 := 2019-06-22

Abstract:
=C2=A0 =C2=A0An attestation format based on concise binary object represent= ation
=C2=A0 =C2=A0(CBOR) is proposed that is suitable for inclusion in a CBOR We= b Token
=C2=A0 =C2=A0(CWT), know as the Entity Attestation Token (EAT).=C2=A0 The a= ssociated
=C2=A0 =C2=A0data can be used by a relying party to assess the security sta= te of a
=C2=A0 =C2=A0remote device or module.

Contributing

=C2=A0 =C2=A0TBD


The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-rat= s-eat/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-rats-eat-00=
https://datatracker.ietf.org/doc/html/dr= aft-ietf-rats-eat-00


Please note that it may take a couple of minutes from the time of submissio= n
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
RATS mailing list
RATS@ietf.org
https://www.ietf.org/mailman/listinfo/rats


--

Best regards,
Kathleen
--000000000000ce3061058bfbb1be-- From nobody Mon Jun 24 08:04:24 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 343871201D3 for ; Mon, 24 Jun 2019 08:04:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id z0Kn-l2xdPOv for ; Mon, 24 Jun 2019 08:04:17 -0700 (PDT) Received: from outgoing-exchange-1.mit.edu (outgoing-exchange-1.mit.edu [18.9.28.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D07F4120198 for ; Mon, 24 Jun 2019 08:04:16 -0700 (PDT) Received: from oc11exedge2.exchange.mit.edu (OC11EXEDGE2.EXCHANGE.MIT.EDU [18.9.3.18]) by outgoing-exchange-1.mit.edu (8.14.7/8.12.4) with ESMTP id x5OF4AHZ004515 for ; Mon, 24 Jun 2019 11:04:15 -0400 Received: from w92expo23.exchange.mit.edu (18.7.74.77) by oc11exedge2.exchange.mit.edu (18.9.3.18) with Microsoft SMTP Server (TLS) id 15.0.1293.2; Mon, 24 Jun 2019 11:04:08 -0400 Received: from oc11expo23.exchange.mit.edu (18.9.4.88) by w92expo23.exchange.mit.edu (18.7.74.77) with Microsoft SMTP Server (TLS) id 15.0.1365.1; Mon, 24 Jun 2019 11:04:12 -0400 Received: from oc11expo23.exchange.mit.edu ([18.9.4.88]) by oc11expo23.exchange.mit.edu ([18.9.4.88]) with mapi id 15.00.1365.000; Mon, 24 Jun 2019 11:04:12 -0400 From: Thomas Hardjono To: "rats@ietf.org" Thread-Topic: [Rats] More use cases for draft-richardson-rats-usecases-00 Thread-Index: AQHVKp4J8R15cRBWg0ev3VvmxsyR5w== Date: Mon, 24 Jun 2019 15:04:12 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [73.167.220.69] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Rats] More use cases for draft-richardson-rats-usecases-00 X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 24 Jun 2019 15:04:18 -0000 Folks, What's the best way to contribute use-cases to draft-richardson-rats-usecas= es-00 ? Should I post the text on the mail-list for discussion. Best -- thomas -- From nobody Mon Jun 24 12:39:33 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AC52F120169 for ; Mon, 24 Jun 2019 12:39:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.749 X-Spam-Level: X-Spam-Status: No, score=-0.749 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, HK_RANDOM_ENVFROM=0.001, HK_RANDOM_FROM=0.999, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nvmyl9t-Q7mH for ; Mon, 24 Jun 2019 12:39:30 -0700 (PDT) Received: from mail-vs1-xe32.google.com (mail-vs1-xe32.google.com [IPv6:2607:f8b0:4864:20::e32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5192A12000F for ; Mon, 24 Jun 2019 12:39:26 -0700 (PDT) Received: by mail-vs1-xe32.google.com with SMTP id q64so9338010vsd.1 for ; Mon, 24 Jun 2019 12:39:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=+TCOp/+Cet7HaaKcQxc/2xNaa6ctWroRPUjaZQj5boU=; b=MzPXd59wLaZ+wSuFTmJaxAW4Blhkb4VxXyp8CP7yXmAU62Tc+br9+CMzkFOUQnYF4V Qv5h5RR8LOCG+Ny0FLCQaX4xhbz2FtmXtweFo8aMvdxKE99kuDzl06YX/sHFg2Q9lfKX 77MJeku969/NGMjskdvWqRH+2u0dxhYGynhk66XtfFsHJ1Z/bMKKUz13CgjmMk9v/yot zoWe00fKG3nlpD5NgEeKgqOmD8TCZSR6NT3XT2h5ZHsn8md7KQi8cBxx3JYI9K2OmSjc L9RzA6+/7KOraG9QrCuD+qM+aD00sMEjEx3JTkQe6yQM70gCcRPsSBi4Lnp+whMyLrvK U1+w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=+TCOp/+Cet7HaaKcQxc/2xNaa6ctWroRPUjaZQj5boU=; b=PlpY0o6fW7y1AqK+nQycUhXLlO1y5I8RZlzq2J09VXjdMiU3s1jAHyqYYsMkSvpfKY 0dHE62PDw4/opF+VUTv7ryoBTgufzzssBZPV/xJKlAHje6vuFrzfAubvlIPp80/hVkDv rUiyjDofBmfdkUQdm5lsUNFFUG6zXSb/dSSiTAwaxHl5Pw4W9GlYvysZ23hy+1k4AuB2 J6+z0ZbKbG4cI4Hvgo+ViF/nDXUg/K1DcVeEBYjrp0WMFG6DAinQpLB8UKPZAYLEemH+ NhyJlPW2xcUqXLRgAcGOD1RhZBPyzB5IUNIIczdjUkommcOQKrZSd+zjtTMQReJ1bVxX EFzg== X-Gm-Message-State: APjAAAVo8ZS4pm1FqWzjJuhyWjXGhkPlTkFzYqBV3r7OSn9ElBYHru1i ukxOmL1DZbriep0CU46lLd6C6v3oJKvqj8LsTnw= X-Google-Smtp-Source: APXvYqywHdXLyVHpksBpCL0KI6mQLk1OSs6ufcAR3pRL7OTdbJ07t6wV820eSOE4L9mg3H9C8UNsAK6/nvXc7gF8Sc4= X-Received: by 2002:a67:69d6:: with SMTP id e205mr23100487vsc.98.1561405165358; Mon, 24 Jun 2019 12:39:25 -0700 (PDT) MIME-Version: 1.0 References: <27666F7D-7B3D-4DCF-BCDB-1212EE4E9FA2@cisco.com> In-Reply-To: <27666F7D-7B3D-4DCF-BCDB-1212EE4E9FA2@cisco.com> From: Mike McBride Date: Mon, 24 Jun 2019 12:39:19 -0700 Message-ID: To: "Nancy Cam-Winget (ncamwing)" Cc: "rats@ietf.org" , Dave Thaler Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [Rats] Preliminary Agenda for today X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 24 Jun 2019 19:39:32 -0000 Please send the interim meeting recording link, if available, as I had to bail half way through. Thank you for setting it up. mike On Thu, Jun 20, 2019 at 5:12 AM Nancy Cam-Winget (ncamwing) wrote: > > All, > > We will need to bash and complete the agenda at the beginning of the call= , but here is a preliminary agenda for today: > > > > Agenda bashing, Logistics -- Chairs (<5min) > Chair=E2=80=99s review of document status and logistics - <5min > Use Cases - <5min > Document updates: > > EAT - ?min > Architecture - 5min > Current data models & serializations (EAT, PSA, TUDA and Reference Intera= ction model) - 25min > Information Model start =E2=80=93 10min > > Use Cases =E2=80=93 10-20min > Next Steps =E2=80=93 adoption readiness and AOB (~5-10min) > > > > We also need a volunteer to be a notetaker which can be taken in https://= etherpad.tools.ietf.org/p/notes-ietf-june2019-virtual > > > > Thanks, > > Nancy > > > > _______________________________________________ > RATS mailing list > RATS@ietf.org > https://www.ietf.org/mailman/listinfo/rats From nobody Mon Jun 24 19:20:24 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E0E1012022C for ; Mon, 24 Jun 2019 19:20:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c0QqU1w4urfC for ; Mon, 24 Jun 2019 19:20:21 -0700 (PDT) Received: from p3plsmtpa12-02.prod.phx3.secureserver.net (p3plsmtpa12-02.prod.phx3.secureserver.net [68.178.252.231]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2EF8A12000F for ; Mon, 24 Jun 2019 19:20:21 -0700 (PDT) Received: from [10.68.0.62] ([45.56.150.178]) by :SMTPAUTH: with ESMTPA id fb4FhdKBPff5Nfb4Gh6Vsj; Mon, 24 Jun 2019 19:20:20 -0700 From: Laurence Lundblade Content-Type: multipart/alternative; boundary="Apple-Mail=_CDDD8B86-14F4-44AB-8444-FA463F3D5841" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Message-Id: Date: Mon, 24 Jun 2019 19:20:19 -0700 To: rats@ietf.org X-Mailer: Apple Mail (2.3445.9.1) X-CMAE-Envelope: MS4wfMxnjyq0i0MQxpTUaOUFAizLu6tw1c/NduxnjjXuB3if5WBiqtdoVqIXpkNK6dgdZLLnATt8Yinaao6zEKpTOIFL8HcuInbs/qVd6kgg7Rz1/zzzI4hO cqGIH90v7TXXgDlHzW+nlkJr26tLzduoXglXQPxpcUFBGHdrUR8jdwkt Archived-At: Subject: [Rats] EAT CWT/JWT/CDDL Pull Request X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 25 Jun 2019 02:20:23 -0000 --Apple-Mail=_CDDD8B86-14F4-44AB-8444-FA463F3D5841 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Here=E2=80=99s a pull request = for the EAT draft that: - An EAT is now either CWT or JWT - Uses CDDL to normatively define the information model - No new claims, but some restricting of the existing ones Comments please. My first real attempt at CDDL. :-) LL --Apple-Mail=_CDDD8B86-14F4-44AB-8444-FA463F3D5841 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Here=E2=80=99s a pull = request for the EAT draft that:

 - An EAT is now either CWT or = JWT
 - Uses CDDL to normatively define the = information model
 - No new claims, but = some restricting of the existing ones

Comments please. My first real attempt = at CDDL. :-)

LL

= --Apple-Mail=_CDDD8B86-14F4-44AB-8444-FA463F3D5841-- From nobody Tue Jun 25 08:18:57 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD6101201C9 for ; Tue, 25 Jun 2019 08:18:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5VVoWS0nncyg for ; Tue, 25 Jun 2019 08:18:51 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 98FFE12018B for ; Tue, 25 Jun 2019 08:18:51 -0700 (PDT) Received: from sandelman.ca (unknown [IPv6:2607:f0b0:f:2:56b2:3ff:fe0b:d84]) by tuna.sandelman.ca (Postfix) with ESMTP id 75ECA380BE; Tue, 25 Jun 2019 11:17:07 -0400 (EDT) Received: by sandelman.ca (Postfix, from userid 179) id 7A251109C; Tue, 25 Jun 2019 11:18:49 -0400 (EDT) Received: from sandelman.ca (localhost [127.0.0.1]) by sandelman.ca (Postfix) with ESMTP id 77C9D9BC; Tue, 25 Jun 2019 11:18:49 -0400 (EDT) From: Michael Richardson To: Laurence Lundblade cc: rats@ietf.org In-Reply-To: <494D662B-2207-4527-9190-243AEAA1D7DB@island-resort.com> References: <494D662B-2207-4527-9190-243AEAA1D7DB@island-resort.com> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Rats] EAT / CWT / JWT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 25 Jun 2019 15:18:55 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Laurence Lundblade wrote: > We will not modify the main rules given in the CWT and JWT RFCs for f= or > registration of new claims. (Note that CWT and JWT have different > set-ups for claim registration. JWT is always Specification Required > (which requires expert review)). CWT has several levels. Seems a bit > weird to me that they are different.) I can not speak authoritatively for the writers, but let me try to explain: 1) JWT claims are always strings, and it's therefore always easy to come up with a unique private slug (just insert domain name, or PEN). Any claim that is worth standardizing in a public fashion (vs defacto API from example.com) should have widespread understanding, and thus a good specification. (Yes, Spec. Required requires an expert to agree that the specification is legit) 2) CWT claims can also be strings (and thus all the points in (1) apply), b= ut if you want to use the small-byte-count integers, then you want the regi= stry. There are different mechanism in CWT to reflect the fact that the different categories of CBOR integers are limited in size. The shortest items should be reserved for things that occur a lot. > Others wishing to define a claim for both CWT and JWT that is not > standard track must meet the =E2=80=9CSpecification Required=E2=80=9D= criteria because > that is the minimum set by JWT and it is higher than that set for CWT. I'm not sure that this is precisely the case. Others wishing to define non-standard claims can do so with strings. JWT calls these Collision-Resistant Name A name in a namespace that enables names to be allocated in a manner such that they are highly unlikely to collide with other names. Examples of collision-resistant namespaces include: Domain Names, Object Identifiers (OIDs) as defined in the ITU-T X.660 and X.670 Recommendation series, and Universally Unique IDentifiers (UUIDs) [RFC4122]. When using an administratively delegated namespace, the definer of a name needs to take reasonable precautions to ensure they are in control of the portion of the namespace they use to define the name. My opinion is that such claims in a RATS context may have little long-term value, but I would expect them to be used in experimental ways regularly. > It doesn=E2=80=99t make sense to me to not have CWTs and JWTs used for > attestation as anything but equivalent. Due to the signature, they are not interchangeable. While many constrained devices would prefer CWTs, and most non-constrained environments can affort to have two libraries, I wonder if we can prefer CW= T? At the same time, I've heard that some vendors have JSON libraries already and feel that CWT would require new work. I'm not convinced, because I thi= nk that the distance between JSON and JWT involves adding a crypto library, and that's significant. > I=E2=80=99m not clear yet if we need to some how mark CWT and JWTs so= me how > when they are used for entity attestation. Maybe you can always tell = by > context. Maybe not. To disguish JWT vs CWT? A JWT probably always starts with "{" :-) A CWT probably always starts with CBOR tag 61. =2D- Michael Richardson , Sandelman Software Works -=3D IPv6 IoT consulting =3D- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl0SO1kACgkQgItw+93Q 3WXYiQf+JkHgB7M+jOGQXZRiLn3wUh7uBqRuXEnfixb4z5dngIiCVtj9yu5sLsj+ /Eq2dJkio9rL0jKHEF4vIeTV9YG5dUIwz3fN/FBKa4Vf5PxrowERByiTR7qcvh8k rfUhz7F0XRTfZ0i3Pnzig5L3fBcepGDE+iVvGB9o6PdlVqTXYMvOQhXBQ2bLyXCT usiJ5/SUonky5TGnvA8iqw7tU+RA149qwCaVJX/LVyp8XzRbMoNG2cRDM2eLY+n9 KD5gVYAsWt0nXcyU5WTiL/F9RmXNg2UA4wzM2OIw4gkbJBs/Q0qe5e1MJKMwvdpj w2WDUykhAgU+zQiaPw7JCcUgIZuMiA== =A5ta -----END PGP SIGNATURE----- --=-=-=-- From nobody Tue Jun 25 09:30:26 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 521D4120830 for ; Tue, 25 Jun 2019 09:30:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OVI52Z-YaeWL for ; Tue, 25 Jun 2019 09:30:22 -0700 (PDT) Received: from p3plsmtpa11-09.prod.phx3.secureserver.net (p3plsmtpa11-09.prod.phx3.secureserver.net [68.178.252.110]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6425E120786 for ; Tue, 25 Jun 2019 09:30:22 -0700 (PDT) Received: from [192.168.1.76] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id foKrhEkrCs64sfoKrhcH8X; Tue, 25 Jun 2019 09:30:21 -0700 From: Laurence Lundblade Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_12CE0BCA-C52E-4E34-BC60-40C5433B5F35" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Tue, 25 Jun 2019 09:30:21 -0700 In-Reply-To: <23626.1561475929@localhost> Cc: rats@ietf.org To: Michael Richardson References: <494D662B-2207-4527-9190-243AEAA1D7DB@island-resort.com> <23626.1561475929@localhost> X-Mailer: Apple Mail (2.3445.9.1) X-CMAE-Envelope: MS4wfCQJ56yX73CEOEQ7yXXLkufHrpSAFIk2ynBfwvmQS9wqkdAZ5s9T6SHVy/4pwqIPpUd9VyJg5M/Jj+GxhKEkStfEjYLQi70DaIQgbUFtXXHhy/qW/17m r/gE+7GtEjW8Bz7e2NnoZPO1wbmGSp+PMcG95gWICj9ckEkwHXxHm8HkqXnp28Lpax7AAKF54+iuCiopIkFQB7FpI8x3CCFCEJU= Archived-At: Subject: Re: [Rats] EAT / CWT / JWT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 25 Jun 2019 16:30:24 -0000 --Apple-Mail=_12CE0BCA-C52E-4E34-BC60-40C5433B5F35 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Michael, > On Jun 25, 2019, at 8:18 AM, Michael Richardson = wrote: >=20 >> We will not modify the main rules given in the CWT and JWT RFCs for = for >> registration of new claims.=20 Will do even more reading on the labels / keys / registration issue and = get back. >> It doesn=E2=80=99t make sense to me to not have CWTs and JWTs used = for >> attestation as anything but equivalent. >=20 > Due to the signature, they are not interchangeable. > While many constrained devices would prefer CWTs, and most = non-constrained > environments can affort to have two libraries, I wonder if we can = prefer CWT? >=20 > At the same time, I've heard that some vendors have JSON libraries = already > and feel that CWT would require new work. I'm not convinced, because = I think > that the distance between JSON and JWT involves adding a crypto = library, and > that's significant. Here's what I meant when I used the word equivalent: - Claims in CWT and JWT have the same expressive power - Any claim we standardize for JWT is also standardized for CWT and vice = versa - A standard claim in JWT has the same semantics as a standard claim in = CWT and vice versa - The information model is the same for both (see=20 - You never run into this: =E2=80=9Cif you were using a CWT for = attestation for claim XXX it works great, but unfortunately JWT based = attestations can=E2=80=99t do that" The syntax (data model) of the claims is obviously different as is the = signature. I=E2=80=99m not saying conversion back and forth is part of equivalence = or is a goal, though it does seem like something that would be nice to = have. Obviously, the steps to do that are roughly: 1) Verify the = signature on the original, 2) parse each claim, 3) generate the new = syntax for each claim, 4) re sign in the new format. And do this is in a = secure computing environment of some sort. The main thing is that an implementor does not need to choose between = CWT and JWT because of claims that are available in one and not the = other. >=20 >> I=E2=80=99m not clear yet if we need to some how mark CWT and JWTs = some how >> when they are used for entity attestation. Maybe you can always tell = by >> context. Maybe not. >=20 > To disguish JWT vs CWT? > A JWT probably always starts with "{" :-) > A CWT probably always starts with CBOR tag 61. To distinguish the use of CWT for attestation from the use of CWT for = authentication or other. Same to distinguish the use of JWT for = attestation from the use of JWT for authentication. You might not be = able to tell by the claim set.=20 I know you can tell in some use cases by the way it is carried in the = protocol. For example if an EAT is used for attestation in FIDO, the = FIDO protocol will clearly label it as attestation. Probably in a YANG = RPC used with a router, it will also be clearly labeled as an = attestation. But maybe there are some contexts that it is not.=20 This has some similarity to X.509 extended key use. You say whether the = key is used for email encryption, server authentication, code signing=E2=80= =A6 As I said, I don=E2=80=99t have a strong opinion on this one way or = another, but it seems like part of figuring out how CWT and JWT are used = for EAT. LL --Apple-Mail=_12CE0BCA-C52E-4E34-BC60-40C5433B5F35 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi = Michael,

On Jun 25, 2019, at 8:18 AM, Michael = Richardson <mcr+ietf@sandelman.ca> wrote:

We = will not modify the main rules given in the CWT and JWT RFCs for for
registration of new = claims. 

Will do even more reading on the labels / keys / = registration issue and get back.


It = doesn=E2=80=99t make sense to me to not have CWTs and JWTs used for
attestation as anything but equivalent.

Due to the signature, they are not interchangeable.
While many constrained devices = would prefer CWTs, and most non-constrained
environments can affort to have = two libraries, I wonder if we can prefer CWT?

At the same time, I've heard = that some vendors have JSON libraries already
and feel that CWT would require = new work.  I'm not convinced, because I think
that the distance between JSON = and JWT involves adding a crypto library, and
that's significant.

Here's = what I meant when I used the word equivalent:
-  Claims = in CWT and JWT have the same expressive power
- Any claim we = standardize for JWT is also standardized for CWT and vice = versa
- A standard claim in JWT has the same semantics as a = standard claim in CWT and vice versa
- The information model = is the same for both (see 
- You never run into this: = =E2=80=9Cif you were using a CWT for attestation for claim XXX it works = great, but unfortunately JWT based attestations can=E2=80=99t do = that"

The syntax (data model) of the = claims is obviously different as is the signature.

I=E2=80=99m not saying conversion back and forth = is part of equivalence or is a goal, though it does seem like something = that would be nice to have. Obviously, the steps to do that are roughly: = 1) Verify the signature on the original, 2) parse each claim, 3) = generate the new syntax for each claim, 4) re sign in the new format. = And do this is in a secure computing environment of some = sort.

The main thing is that an = implementor does not need to choose between CWT and JWT because of = claims that are available in one and not the other.



I=E2=80=99m not clear yet if we need = to some how mark CWT and JWTs some how
when they are used = for entity attestation. Maybe you can always tell by
context. Maybe not.

To disguish JWT vs = CWT?
A JWT = probably always starts with "{" :-)
A CWT probably always starts with CBOR tag = 61.

To= distinguish the use of CWT for attestation from the use of CWT for = authentication or other. Same to distinguish the use of JWT for = attestation from the use of JWT for authentication. You might not be = able to tell by the claim set. 

I know you can tell in some use cases = by the way it is carried in the protocol. For example if an EAT is used = for attestation in FIDO, the FIDO protocol will clearly label it as = attestation. Probably in a YANG RPC used with a router, it will also be = clearly labeled as an attestation.  But maybe there are some = contexts that it is not. 

This has some similarity to X.509 = extended key use. You say whether the key is used for email encryption, = server authentication, code signing=E2=80=A6

As I said, I don=E2=80=99t have a = strong opinion on this one way or another, but it seems like part of = figuring out how CWT and JWT are used for EAT.

LL

= --Apple-Mail=_12CE0BCA-C52E-4E34-BC60-40C5433B5F35-- From nobody Wed Jun 26 10:44:13 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0C43D12035B for ; Wed, 26 Jun 2019 10:44:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1KTq8njEvStm for ; Wed, 26 Jun 2019 10:44:10 -0700 (PDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 101F412034B for ; Wed, 26 Jun 2019 10:44:09 -0700 (PDT) Received: from kduck.mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id x5QHi5Cd022679 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 26 Jun 2019 13:44:07 -0400 Date: Wed, 26 Jun 2019 12:44:04 -0500 From: Benjamin Kaduk To: Laurence Lundblade Cc: Michael Richardson , rats@ietf.org Message-ID: <20190626174336.GB18345@kduck.mit.edu> References: <494D662B-2207-4527-9190-243AEAA1D7DB@island-resort.com> <23626.1561475929@localhost> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: User-Agent: Mutt/1.10.1 (2018-07-13) Archived-At: Subject: Re: [Rats] EAT / CWT / JWT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Jun 2019 17:44:12 -0000 On Tue, Jun 25, 2019 at 09:30:21AM -0700, Laurence Lundblade wrote: > Hi Michael, > > > On Jun 25, 2019, at 8:18 AM, Michael Richardson wrote: > > > >> We will not modify the main rules given in the CWT and JWT RFCs for for > >> registration of new claims. > > Will do even more reading on the labels / keys / registration issue and get back. > > > >> It doesn’t make sense to me to not have CWTs and JWTs used for > >> attestation as anything but equivalent. > > > > Due to the signature, they are not interchangeable. > > While many constrained devices would prefer CWTs, and most non-constrained > > environments can affort to have two libraries, I wonder if we can prefer CWT? > > > > At the same time, I've heard that some vendors have JSON libraries already > > and feel that CWT would require new work. I'm not convinced, because I think > > that the distance between JSON and JWT involves adding a crypto library, and > > that's significant. > > Here's what I meant when I used the word equivalent: > - Claims in CWT and JWT have the same expressive power > - Any claim we standardize for JWT is also standardized for CWT and vice versa > - A standard claim in JWT has the same semantics as a standard claim in CWT and vice versa > - The information model is the same for both (see > - You never run into this: “if you were using a CWT for attestation for claim XXX it works great, but unfortunately JWT based attestations can’t do that" > > The syntax (data model) of the claims is obviously different as is the signature. > > I’m not saying conversion back and forth is part of equivalence or is a goal, though it does seem like something that would be nice to have. Obviously, the steps to do that are roughly: 1) Verify the signature on the original, 2) parse each claim, 3) generate the new syntax for each claim, 4) re sign in the new format. And do this is in a secure computing environment of some sort. > > The main thing is that an implementor does not need to choose between CWT and JWT because of claims that are available in one and not the other. > > > > > >> I’m not clear yet if we need to some how mark CWT and JWTs some how > >> when they are used for entity attestation. Maybe you can always tell by > >> context. Maybe not. > > > > To disguish JWT vs CWT? > > A JWT probably always starts with "{" :-) > > A CWT probably always starts with CBOR tag 61. > > To distinguish the use of CWT for attestation from the use of CWT for authentication or other. Same to distinguish the use of JWT for attestation from the use of JWT for authentication. You might not be able to tell by the claim set. > > I know you can tell in some use cases by the way it is carried in the protocol. For example if an EAT is used for attestation in FIDO, the FIDO protocol will clearly label it as attestation. Probably in a YANG RPC used with a router, it will also be clearly labeled as an attestation. But maybe there are some contexts that it is not. > > This has some similarity to X.509 extended key use. You say whether the key is used for email encryption, server authentication, code signing… > > As I said, I don’t have a strong opinion on this one way or another, but it seems like part of figuring out how CWT and JWT are used for EAT. Is this just a matter of defining a JWS "typ" parameter (i.e., media type) for our usage [https://tools.ietf.org/html/rfc7515#section-4.1.9]? (I did not check for the COSE analogue.) -Ben From nobody Wed Jun 26 11:33:23 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AB421120306 for ; Wed, 26 Jun 2019 11:33:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RDbAlAXsDN9z for ; Wed, 26 Jun 2019 11:33:18 -0700 (PDT) Received: from p3plsmtpa09-03.prod.phx3.secureserver.net (p3plsmtpa09-03.prod.phx3.secureserver.net [173.201.193.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D596612048E for ; Wed, 26 Jun 2019 11:33:17 -0700 (PDT) Received: from [192.168.1.108] ([76.192.164.238]) by :SMTPAUTH: with ESMTPSA id gCjJhYmtOP4EdgCjLh5Lhl; Wed, 26 Jun 2019 11:33:16 -0700 From: Laurence Lundblade Message-Id: <180CC9B1-0146-47DD-832B-148B495F406E@island-resort.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_9F710328-A918-4A40-9796-061E02D1FCED" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Wed, 26 Jun 2019 11:33:13 -0700 In-Reply-To: <20190626174336.GB18345@kduck.mit.edu> Cc: Michael Richardson , rats@ietf.org To: Benjamin Kaduk References: <494D662B-2207-4527-9190-243AEAA1D7DB@island-resort.com> <23626.1561475929@localhost> <20190626174336.GB18345@kduck.mit.edu> X-Mailer: Apple Mail (2.3445.9.1) X-CMAE-Envelope: MS4wfHxvsl3k/urY1V23LcWcGCbve+ve2F3mr+NyEhK3r47QA3F9Mlzno70K0K77haPrMB8LmJW0QVvDuANcH4SU1vrzpvg8SHFrvvQ8VHu1s8oePfQeVA0K /KBttocxFio/exQJY75+3Rk9DvmJLzy71IJtNjyAY3zVgIB1Bn+0uzGArKBHM3BRPf5uO38VoDhlQaDGZWrXulNxIOHfZKO7yS3w7wzM8Gzw+ht7bBACSFuI Archived-At: Subject: Re: [Rats] EAT / CWT / JWT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Jun 2019 18:33:22 -0000 --Apple-Mail=_9F710328-A918-4A40-9796-061E02D1FCED Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Comment below > On Jun 26, 2019, at 10:44 AM, Benjamin Kaduk wrote: >=20 > On Tue, Jun 25, 2019 at 09:30:21AM -0700, Laurence Lundblade wrote: >> Hi Michael, >>=20 >>> On Jun 25, 2019, at 8:18 AM, Michael Richardson = wrote: >>> ... >>>> I=E2=80=99m not clear yet if we need to some how mark CWT and JWTs = some how >>>> when they are used for entity attestation. Maybe you can always = tell by >>>> context. Maybe not. >>>=20 >>> To disguish JWT vs CWT? >>> A JWT probably always starts with "{" :-) >>> A CWT probably always starts with CBOR tag 61. >>=20 >> To distinguish the use of CWT for attestation from the use of CWT for = authentication or other. Same to distinguish the use of JWT for = attestation from the use of JWT for authentication. You might not be = able to tell by the claim set.=20 >>=20 >> I know you can tell in some use cases by the way it is carried in the = protocol. For example if an EAT is used for attestation in FIDO, the = FIDO protocol will clearly label it as attestation. Probably in a YANG = RPC used with a router, it will also be clearly labeled as an = attestation. But maybe there are some contexts that it is not.=20 >>=20 >> This has some similarity to X.509 extended key use. You say whether = the key is used for email encryption, server authentication, code = signing=E2=80=A6 >>=20 >> As I said, I don=E2=80=99t have a strong opinion on this one way or = another, but it seems like part of figuring out how CWT and JWT are used = for EAT. >=20 > Is this just a matter of defining a JWS "typ" parameter (i.e., media = type) > for our usage [https://tools.ietf.org/html/rfc7515#section-4.1.9]? = (I did > not check for the COSE analogue. Yes, there=E2=80=99s a COSE analog, the content-type header. The IANA = registry is here = . Seems pretty similar, but not the same (as often seems = to be the case with CWT and JWT). LL --Apple-Mail=_9F710328-A918-4A40-9796-061E02D1FCED Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
Comment below

On Jun 26, 2019, at 10:44 AM, = Benjamin Kaduk <kaduk@mit.edu> wrote:

On Tue, Jun 25, 2019 at = 09:30:21AM -0700, Laurence Lundblade wrote:
Hi = Michael,

On Jun 25, 2019, at 8:18 AM, Michael Richardson <mcr+ietf@sandelman.ca> wrote:
...
I=E2=80=99m not clear = yet if we need to some how mark CWT and JWTs some how
when = they are used for entity attestation. Maybe you can always tell by
context. Maybe not.

To disguish JWT vs CWT?
A JWT probably always = starts with "{" :-)
A CWT probably always starts with CBOR = tag 61.

To distinguish the use = of CWT for attestation from the use of CWT for authentication or other. = Same to distinguish the use of JWT for attestation from the use of JWT = for authentication. You might not be able to tell by the claim set. 

I know you can tell in some use cases by the way it is = carried in the protocol. For example if an EAT is used for attestation = in FIDO, the FIDO protocol will clearly label it as attestation. = Probably in a YANG RPC used with a router, it will also be clearly = labeled as an attestation.  But maybe there are some contexts that = it is not. 

This has some similarity to X.509 extended key = use. You say whether the key is used for email encryption, server = authentication, code signing=E2=80=A6

As I = said, I don=E2=80=99t have a strong opinion on this one way or another, = but it seems like part of figuring out how CWT and JWT are used for = EAT.

Is this just a matter of defining a JWS "typ" parameter = (i.e., media type)
for our usage [https://tools.ietf.org/html/rfc7515#section-4.1.9]?  (I did
not check for the COSE = analogue.

Yes, = there=E2=80=99s a COSE analog, the content-type header. The IANA = registry is here. Seems pretty similar, but not = the same (as often seems to be the case with CWT and JWT).

LL






= --Apple-Mail=_9F710328-A918-4A40-9796-061E02D1FCED-- From nobody Wed Jun 26 12:33:33 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D314F12032B for ; Wed, 26 Jun 2019 12:33:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.244 X-Spam-Level: X-Spam-Status: No, score=-0.244 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_IMAGE_ONLY_08=1.651, HTML_IMAGE_RATIO_02=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PKH-RM2yLczd for ; Wed, 26 Jun 2019 12:33:30 -0700 (PDT) Received: from p3plsmtpa11-08.prod.phx3.secureserver.net (p3plsmtpa11-08.prod.phx3.secureserver.net [68.178.252.109]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5AF0C120313 for ; Wed, 26 Jun 2019 12:33:30 -0700 (PDT) Received: from [192.168.1.108] ([76.192.164.238]) by :SMTPAUTH: with ESMTPSA id gDfahnuDUizargDfch6XKt; Wed, 26 Jun 2019 12:33:29 -0700 From: Laurence Lundblade Content-Type: multipart/alternative; boundary="Apple-Mail=_D6F09D49-832A-435A-AB85-C9D83518CC63" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Message-Id: Date: Wed, 26 Jun 2019 12:33:26 -0700 To: rats@ietf.org X-Mailer: Apple Mail (2.3445.9.1) X-CMAE-Envelope: MS4wfPbYWeSy48IJ16vpFfJfNKmMNAhm2evEcRWkXEYg/FMYDyQghz6gNOTZH1Slu4rMo1quZ4Wa4878aCkO6EpveLLYTRrcYPKX7zLd6AMWi4L8NKH49eqe d/zbmZFoe2+lIjytCajCRz6Yp+7JI6oKYD0uoY3nHU7cWO5wypv615mI Archived-At: Subject: [Rats] Claims types and registration requirements X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Jun 2019 19:33:32 -0000 --Apple-Mail=_D6F09D49-832A-435A-AB85-C9D83518CC63 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Here=E2=80=99s my infographic depicting what I understand from CWT and = JWT. Is it right? I think we=E2=80=99re primarily interested in registered claims and = their requirements. LL --Apple-Mail=_D6F09D49-832A-435A-AB85-C9D83518CC63 Content-Type: multipart/related; type="text/html"; boundary="Apple-Mail=_2A33192B-8732-499A-8657-AEAA6615BD1B" --Apple-Mail=_2A33192B-8732-499A-8657-AEAA6615BD1B Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Here=E2=80=99s my infographic depicting what I understand = from CWT and JWT. Is it right?


I = think we=E2=80=99re primarily interested in registered claims and their = requirements.

LL

= --Apple-Mail=_2A33192B-8732-499A-8657-AEAA6615BD1B Content-Transfer-Encoding: base64 Content-Disposition: inline; filename=PastedGraphic-3.png Content-Type: image/png; x-unix-mode=0666; name="PastedGraphic-3.png" Content-Id: <977D664E-21C7-425C-8032-D42570335630@attlocal.net> iVBORw0KGgoAAAANSUhEUgAABSIAAAIgCAYAAACRRxeiAAAMJ2lDQ1BJQ0MgUHJvZmlsZQAASImV lwdUk8kWgOcvSUhIaIEISAm9CVKkS68BBKSDjZAEEkoMCUHFjiwqsBZURLCiqyIqrgWQxYa9LIK9 PxRRUdbFgg2VN0kAXT3vvfPuOfP/X+7cuXPvzfxzZgBQjWaLRNmoGgA5wjxxTIg/Myk5hUnqAgjQ ByrABuixORKRX3R0BIAy/P6nvLsBraFctZX5+rn/v4o6lyfhAIBEQ07jSjg5kA8CgLtwROI8AAi9 UG8yI08EmQijBJpiGCBkUxlnKNhNxmkKjpDbxMUEQE4FQInKZoszAFCRxcXM52RAPyplkO2FXIEQ cgtkbw6fzYX8GfKYnJzpkFUtIVumfecn4x8+00Z8stkZI6zIRS5KgQKJKJs96/8sx/+WnGzp8Bwm sFH54tAYWc6yumVND5cxFfI5YVpkFGQNyNcEXLm9jJ/wpaHxQ/YfOJIAWDPAAAClctmB4ZD1IBsL syMjhvTe6YJgFmRYezROkMeKU4xFueLpMUP+0Zk8SVDsMLPF8rlkNiXSrHi/IZ8b+TzWsM/mAn5c oiJOtD1fkBAJWQXyPUlWbPiQzfMCfkDksI1YGiOLGf7nGEgXB8cobDDTHMlwXpgHX8CKHOKIPH5c qGIsNpXDlsemDTmTJ0mKGI6TywsMUuSFFfKE8UPxY+WiPP+YIfttouzoIXushZcdItMbQ26T5McO j+3Lg4tNkS8ORHnRcYrYcM1Mdli0IgbcGkSAABAImEAKWxqYDjKBoK23sRf+UvQEAzYQgwzAA7ZD muERifIeIXzGggLwFyQekIyM85f38kA+1H8Z0SqetiBd3psvH5EFnkDOAeEgG/6WykcJR2ZLAI+h RvDT7BwYazZssr6fdEzVYR0xiBhIDCUGE61wXdwb98Qj4NMXNkfcDXcfjuubPeEJoYPwiHCd0Em4 PU1QKP4hciaYADphjMFD2aV9nx1uDr064/64F/QPfeMMXBfY4uPgTH64D5zbGWq/j1U6kvG3Wg75 ItuTUfIosi/Z8scIVKxVnEe8yCr1fS0UcaWNVCtgpOfHPAK+qx8XvsN/tMSWYAews9gJ7DzWgjUC JnYMa8IuYUdkPLI2HsvXxvBsMfJ4sqAfwU/zsYfmlFVNYl9n32P/eagP5PFm5sk+loDpolliQQY/ j+kHd2sekyXk2I1hOto7uAMg2/sVW8sbhnxPRxgXvulyjwPgXgKVGd90bLgHHX4CAP3dN53Ja7js VwBwpJ0jFecrdLjsQQAUoAq/FB1gAPcuS5iRI3ABnsAXBIEwEAXiQDKYCuvMh+tUDGaAOWAhKAal YAVYA6rAJrAV7AR7wH7QCFrACXAGXATt4Dq4C9dKN3gB+sA7MIAgCAmhIXREBzFEzBAbxBFxQ7yR ICQCiUGSkVQkAxEiUmQOsggpRcqRKmQLUov8jhxGTiDnkQ7kNvIQ6UFeI59QDKWimqg+ao6ORd1Q PzQcjUOnoBloLlqAFqHL0Eq0Bt2NNqAn0IvodbQTfYH2YwBTxhiYEWaLuWEBWBSWgqVjYmweVoJV YDXYXqwZ/tNXsU6sF/uIE3E6zsRt4XoNxeNxDp6Lz8PL8Cp8J96An8Kv4g/xPvwrgUbQI9gQPAgs QhIhgzCDUEyoIGwnHCKcht9ON+EdkUhkEC2IrvDbSyZmEmcTy4gbiPXE48QOYhexn0Qi6ZBsSF6k KBKblEcqJq0j7SYdI10hdZM+KCkrGSo5KgUrpSgJlQqVKpR2KR1VuqL0VGmArEY2I3uQo8hc8izy cvI2cjP5MrmbPEBRp1hQvChxlEzKQkolZS/lNOUe5Y2ysrKxsrvyRGWB8gLlSuV9yueUHyp/pGpQ rakB1MlUKXUZdQf1OPU29Q2NRjOn+dJSaHm0ZbRa2knaA9oHFbqKnQpLhasyX6VapUHlispLVbKq maqf6lTVAtUK1QOql1V71chq5moBamy1eWrVaofVbqr1q9PVHdSj1HPUy9R3qZ9Xf6ZB0jDXCNLg ahRpbNU4qdFFx+gm9AA6h76Ivo1+mt6tSdS00GRpZmqWau7RbNPs09LQGqeVoDVTq1rriFYnA2OY M1iMbMZyxn7GDcanUfqj/EbxRi0dtXfUlVHvtUdr+2rztEu067Wva3/SYeoE6WTprNRp1Lmvi+ta 607UnaG7Ufe0bu9ozdGeozmjS0bvH31HD9Wz1ovRm623Ve+SXr++gX6Ivkh/nf5J/V4DhoGvQabB aoOjBj2GdENvQ4HhasNjhs+ZWkw/ZjazknmK2WekZxRqJDXaYtRmNGBsYRxvXGhcb3zfhGLiZpJu stqk1aTP1NB0gukc0zrTO2ZkMzczvtlas7Nm780tzBPNF5s3mj+z0LZgWRRY1Fncs6RZ+ljmWtZY XrMiWrlZZVltsGq3Rq2drfnW1daXbVAbFxuBzQabjjGEMe5jhGNqxty0pdr62ebb1tk+tGPYRdgV 2jXavRxrOjZl7MqxZ8d+tXe2z7bfZn/XQcMhzKHQodnhtaO1I8ex2vGaE80p2Gm+U5PTq3E243jj No675Ux3nuC82LnV+YuLq4vYZa9Lj6upa6rretebbppu0W5lbufcCe7+7vPdW9w/erh45Hns9/jb 09Yzy3OX57PxFuN547eN7/Iy9mJ7bfHq9GZ6p3pv9u70MfJh+9T4PPI18eX6bvd96mfll+m32++l v72/2P+Q//sAj4C5AccDscCQwJLAtiCNoPigqqAHwcbBGcF1wX0hziGzQ46HEkLDQ1eG3mTpszis WlZfmGvY3LBT4dTw2PCq8EcR1hHiiOYJ6ISwCasm3Is0ixRGNkaBKFbUqqj70RbRudF/TCROjJ5Y PfFJjEPMnJizsfTYabG7Yt/F+cctj7sbbxkvjW9NUE2YnFCb8D4xMLE8sTNpbNLcpIvJusmC5KYU UkpCyvaU/klBk9ZM6p7sPLl48o0pFlNmTjk/VXdq9tQj01SnsacdSCWkJqbuSv3MjmLXsPvTWGnr 0/o4AZy1nBdcX+5qbg/Pi1fOe5rulV6e/izDK2NVRg/fh1/B7xUECKoErzJDMzdlvs+KytqRNZid mF2fo5STmnNYqCHMEp6abjB95vQOkY2oWNSZ65G7JrdPHC7eLkEkUyRNeZrwkH1Jain9Rfow3zu/ Ov/DjIQZB2aqzxTOvDTLetbSWU8Lggt+m43P5sxunWM0Z+Gch3P95m6Zh8xLm9c632R+0fzuBSEL di6kLMxa+GehfWF54dtFiYuai/SLFhR1/RLyS12xSrG4+OZiz8WbluBLBEvaljotXbf0awm35EKp fWlF6ecyTtmFXx1+rfx1cFn6srblLss3riCuEK64sdJn5c5y9fKC8q5VE1Y1rGauLln9ds20Necr xlVsWktZK13bWRlR2bTOdN2KdZ+r+FXXq/2r69frrV+6/v0G7oYrG3037t2kv6l006fNgs23toRs aagxr6nYStyav/XJtoRtZ39z+612u+720u1fdgh3dO6M2Xmq1rW2dpferuV1aJ20rmf35N3tewL3 NO213bulnlFfug/sk+57/nvq7zf2h+9vPeB2YO9Bs4PrD9EPlTQgDbMa+hr5jZ1NyU0dh8MOtzZ7 Nh/6w+6PHS1GLdVHtI4sP0o5WnR08FjBsf7jouO9JzJOdLVOa717MunktVMTT7WdDj997kzwmZNn /c4eO+d1ruW8x/nDF9wuNF50udhwyfnSoT+d/zzU5tLWcNn1clO7e3tzx/iOo1d8rpy4Gnj1zDXW tYvXI6933Ii/cevm5Judt7i3nt3Ovv3qTv6dgbsL7hHuldxXu1/xQO9Bzb+s/lXf6dJ55GHgw0uP Yh/d7eJ0vXgsefy5u+gJ7UnFU8Ontc8cn7X0BPe0P5/0vPuF6MVAb/Ff6n+tf2n58uDfvn9f6kvq 634lfjX4uuyNzpsdb8e9be2P7n/wLufdwPuSDzofdn50+3j2U+KnpwMzPpM+V36x+tL8NfzrvcGc wUERW8yWHwUw2ND0dABe7wCAlgzPDu0AUCYp7mZyQRT3STmB/8SK+5tcXADY4QtA/AIAIuAZZSNs ZpCp8C07gsf5AtTJaaQNiSTdyVHhiwpvLIQPg4Nv9AEgNQPwRTw4OLBhcPDLNhjsbQCO5yruhDKR 3UE328movfsl+FH+Df+FcVUGcFugAAAACXBIWXMAABYlAAAWJQFJUiTwAAABYmlUWHRYTUw6Y29t LmFkb2JlLnhtcAAAAAAAPHg6eG1wbWV0YSB4bWxuczp4PSJhZG9iZTpuczptZXRhLyIgeDp4bXB0 az0iWE1QIENvcmUgNS40LjAiPgogICA8cmRmOlJERiB4bWxuczpyZGY9Imh0dHA6Ly93d3cudzMu b3JnLzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMiPgogICAgICA8cmRmOkRlc2NyaXB0aW9uIHJk ZjphYm91dD0iIgogICAgICAgICAgICB4bWxuczpleGlmPSJodHRwOi8vbnMuYWRvYmUuY29tL2V4 aWYvMS4wLyI+CiAgICAgICAgIDxleGlmOlVzZXJDb21tZW50PlNjcmVlbnNob3Q8L2V4aWY6VXNl ckNvbW1lbnQ+CiAgICAgIDwvcmRmOkRlc2NyaXB0aW9uPgogICA8L3JkZjpSREY+CjwveDp4bXBt ZXRhPgpuzN4uAABAAElEQVR4AeydB3gUxfvHv0cuDZIAoQkoJRSpoShVQEJTQUBQQAQUC2Cn6E8F G1VF/UuxIIg0EaSogIiFXgWBUEPvCEiQlgAJ5Mj9Z+9ys7vXcpdcyiXffZ5Lpr7zzmdmd+fem2Iw iwtOrri4OEtozZo1ncQyKK8RYHvntRZlfUgg8wT4XMg8Q0ogAX8nwOeAv7cg9c8IAfb7jFBjHhLw jgDvM+94MTUJ+BOB9O7vAv5UGepKAiRAAiRAAiRAAiRAAiRAAiRAAiRAAiRAAiTgnwRoiPTPdqPW JEACJEACJEACJEACJEACJEACJEACJEACJOBXBGiI9KvmorIkQAIkQAIkQAIkQAIkQAIkQAIkQAIk QAIk4J8EaIj0z3aj1iRAAiRAAiRAAiRAAiRAAiRAAiRAAiRAAiTgVwRoiPSr5qKyJEACJEACJEAC JEACJEACJEACJEACJEACJOCfBGiI9M92o9YkQAIkQAIkQAIkQAIkQAIkQAIkQAIkQAIk4FcEaIj0 q+aisiRAAiRAAiRAAiRAAiRAAiRAAiRAAiRAAiTgnwSM9mobDAb7IPpJgARIgARIgARIgARIgARI gARIgARIgARIgARIwCMCZrPZaTrOiHSKhYEkQAIkQAIkQAIkQAIkQAIkQAIkQAIkQAIkQAK+JGCM i4vzpTzKIgESIAESIAESIAESIAESIAESIAESIAESIAESyMcEXNkbOSMyH3cKVp0ESIAESIAESIAE SIAESIAESIAESIAESIAEsouAQazZ1i3att8j0i46u/RiOSRAAiRAAiRAAiRAAiRAAiRAAiRAAiRA AiRAAn5AwFN7ImdE+kFjUkUSIAESIAESIAESIAESIAESIAESIAESIAES8HcCNET6ewtSfxIgARIg ARIgARIgARIgARIgARIgARIgARLwAwI0RPpBI1FFEiABEiABEiABEiABEiABEiABEiABEiABEvB3 AjRE+nsLUn8SIAESIAESIAESIAESIAESIAESIAESIAES8AMCNET6QSNRRRIgARIgARIgARIgARIg ARIgARIgARIgARLwdwI0RPp7C1J/EiABEiABEiABEiABEiABEiABEiABEiABEvADAjRE+kEjUUUS IAESIAESIAESIAESIAESIAESIAESIAES8HcCNET6ewtSfxIgARIgARIgARIgARIgARIgARIgARIg ARLwAwJGP9CRKpIACZAACWQ3AVMizp6JR5LJiIiSZVEinK+L7GqCxLPHcOLidSAwAlWqlUdIdhXM ckggpwjweZNT5FkuCZAACZAACZAACWQ7Ac6IzHbkLJAESIAEcj+BhF3foWyFyqhcuQLaf7019yuc ZzS8hm8fqovo6GhEV6+AqTuu+rxmyZfP4sCBAzh68gJMPpdOgSTgPQE+bwDel/p+Qx56Hv7qYzv6 a8tRbxIgARLIWgKc4pK1fCmdBEhAQ+DsgQ1YsuAnzF+4Eqt377bGFKiNVh0b44GH2qJ9x4dRq0yo zJF0ZCkef/QdJBaLxOXC7fDjgrcQ5eapdWLl/+GZIb8CxS6hSJNhmDmmO8KlNEfHpe3f4bFnplvS 39lqGFrd+BUrT4egYEHHtO5Cbpw/jzovjMPrD1R0l8y/4gKDpL7lQgKl2xuH2n5AkVbDMeedRyyz +9TwvN2u3vZ3G9vCFQXvtNsDZh+bCpN2okexe7HEfNtS3DurTmNUzJ22onPB/yv4fthA/M77MBe0 RTaqkInnTcKBpfjfmHm4IR7cjo/ugrizUkXUubclmreIRlE3749srK1jUbn+vnRUOUtD8gCPPNEv M9vIeaAdM4uA+UmABEiABJwTyK1DMufaMpQESMA/CSQfw4R+3TBodqyj/ql7sGqx8vkGbz4PdP34 V8z4X3urATHlOpbs3pWWZzU2HHkVUdUcv2paEyRj44yPhIHzP6t37Wi8MqgbYkoYHMtMC9nx65ci /RaLL6ziCZyaPhtrzaku07uLCO/xgbvofBmXcvVf2X7BAeeQ9A6sy4zzertmtL9nUy8Jh3pP3LiU lE2lelhMwmFM/Wg21vA+9BAYkx3+YxamzF6QPgjxo9fkNUvQv3mF9NPmQArf35cmXDh5BgkmE0Ij y6JM0dyyyYNnevmeR/Y2al7pl5ml5u/tmNn651x+z+6znNOPJZMACeR3Alyand97AOtPAllNIDEO gwpVdzRCii+FMTExqK0xiiiq/PRGB8xMW44aWq0J3goIlhqu2nJYuh0cSUexdo5mGaswcK6MPeOQ TA04h40/7pXe/g83QpMCGZv5pwi5kZgiZdGRRsAOp+2Xrzzdrpno79nVbxJhlkWFhqkzkGVgTjoK FkNj3oc52QJ+V3ZgcJhnOot3woAWFfHF3xc9S5/NqXx9XybsnoGSFSqI7TUqo0Kbr5GYzfVxVZyn evmahyt9sio8r/TLzPLx93bMbP1zKr+n91lO6cdySYAESICGSPYBEiCBLCRwBZM634cJqbdkGSGP DMf6I+eRcns3Vq1ahd3mW4g/EYtJQ7vKNHI5qqEc2rxRR4YvWLzd5ZepJCHjm1S9MfC3P3e73APP fGYvFu6+YZFtCGiJB5q1wIfJ15CUkoIUzcdsvoDxMYWlDp+s/xdmsz5NSlIKZvRX9ZSJ6XBOIM+2 ayb7u3Navg0NrYvZ5w9h9/bt2L3/BN55IDctyxZVNUbxPvRti+craW0nbhLPZ7P1I57jCZdOYtmE F3QMBj//Bc7pQnKBJ4vvS2N59Qe9XFBbqYJLvbKYh1Qgmxx+2y8zyyePtWNmceRUfpf3WU4pxHJJ gARIQBCgIZLdgARIIMsIxK+chBdXq7MUIwZ8h/if30ezSiVhmx0nLA8oUb4env/gR5zf/iN6t+qF CsXU5de1H+wh9Utaugj7E9XZXDJCOE5sXq31Wtw7J/2BUyaHYEvAyW3rsSdtZlhQy86oryzhNhoR Ij5GzUdZTBwRESCFhBRSlrfp0xhD1NrIhHS4JZAX29UX/d0tNB9FhpeIQu369VE7t57IzfvQRy2d /8SEQzMNW/Sj8KLl8NCrX2HbtBcljNt7t+NfF+8RmSgHHL6+L0MDVeOjAcFaMjlQO7VIT/XyNQ9V g+x3+XO/zCytvNSOmWWRnfk9vc+yUyeWRQIkQAJaAvz2rKVBNwmQgA8JXMHcMWOlvAKhr2LHF73d Hh5Tsn5XfLdSMzNS5C5Ztzk6GQIsh2uYU37B3/svoWHDYlKu1XENm1f9ogtTlnzvSZqIv09+hKhK 9stPTdi15neZvkPnZigufek4fHZ4SDJOHtiNXbE7ceDoCVxR9uoLjcQd5aNQv2lLNKtd1oUiJhzZ shI7TyciKLIq2reKFmbRZOxfvxzL12zG8UtilqeQU7fx/WjfrgVKuNsWLPkcNv+5Bus278G5pCSE ht6B2i3a4OEH74F2EOtCkUwF57129U1/9xxqRvsPcDJ2NbYeE8tTg0ri/vaij+hGAs761zVs//0X LFu3B5eUfhJZAU1atsNDzatrflAw4UTsSixZ8Tf+PXdJ9EG1L7k7MMrz+tqldHMfxu/ZgHUH/xUZ glCtaVvdAVh6KaKu68W9dF4sWg26E63bNxaHmaj1Dy5VFx2bVxZZTILZevy+YgNOiroJAohq0Bwd HmqDqKIaw5deuDXfns3YuOkv7D1wVuRTbs3SqFWnMVrGNEWZcB14fe7k/7BlzXKs3SruTfFsCBX3 dPmq1dCg+f2oL37I8f7KaH9Refjz8ya6eQuB7CsLNuU9sudEAurVVme663mK9s5ouwlBF47uwNr1 G7D/tNgXNykURe4oiWpVq6BoIbWviMmaqNygCcpp+oD7+zJNQw/6ReLJHdh66hYS/1opq5X060os X18TRSBWJyiFF4lC8/oVRLxj++LCQcyfuwR7j58FRH9t0q47OjZS0mov7/uTd3ql95zS6mJl/pdg vuvQOcszStwwKF2+Jpo0bYQGtStb9ybWZXGsd4bfozq53nmys19C9J3Nfy5X3/fiOX7PfTHoIMYQ IbiGLb+vwulrt3BHrVZoVi0yrSKCk+0ZGSaekQ+KZ6STKpouH8OKlbFCCuzyp9eOju3gWf9TlMjI fepYnlFonbXvN1/p6dk4z9v7zNKcHjxXLOn4hwRIgAR8SUAsYdFdQrYy3Uh+dJH0kAAJkICHBG7s myWfI8oz5YWFhzzMaZ8s0Typc1Epq+3Hm+wTmM039pp7GYyWNAF1epn7da4r0z81J84xfcpR88AC QTLNlN1XHNPIkETztM6RMu3n2/+TMRl1HF45xdzSUEDK1D5zbe5Cfb4yn01xVkKieVx0uCWvIegJ 86rd68wDo0OcyjIEdjT/fuKGMyHm8399YxbGWqf5jHXfNC+YPVrGdZ241amM9AKv7vpGyghu85U5 QZchb7WrL/t7ev3NV/1H6WufOvRnz/tXaJdx5gtKmyYcMH/UubBsa1sfVv4rfelAUqqu5TPm8fQ+ TDLP7l1c6hL25Dyz09tIKJF6cYN6DxSobd6QoOip1j+kzVRz/KU95hEx1vtNWy+b+5PfjzmtTmr8 DvNbMWFSD1t67f9Pfnf+TDy/bZaql2Y8ZsvbdbJ396Ov+ktufd7smvS05OzqWZX6z58yjdiKw/z7 mVs+bzdzylnztP73ynJs7eXq/+e6947a75T0jvel2exZv9DfJ67KFj8Mmo9abgy1XKV9F6+c4/Bu Cqw/Tvfszlh/yrhernhYGjBhr8tnj63uhpDnzKsc3oP6emf0Peq0E6UF5pp+KfQ5v3mmy2eK8oze vH+9HEPdqxtjaTiJ+2aL5RnpWOur276U/d5VfuftqJHvYf9TSs/481Vfnrt298X7LTv01I/zvL3P PH2uOLY5Q0iABEjAFQHb+9f232U6+whbBtt/+3j6SYAESMATAofnvy4HpspAaculjBsj9k1Tv2gG 1vvQavzQKKE1eN0zarl51yK17IJdvtV9iVKy3Tr8k6qb+JJywJWlwlKGfmCXaUPkjR0OX/SU5210 tNWQanv2Kv+dGl2FocRiqBKGE21aV271C6cK7Ma+HzzKa5Pp6su9KtG5S9sujoZIszkvtavv+ns6 /c1X/SfNwOXYn73rX3V7DzT3ilaN+rY+o/0f9uR35iTnXcSL0HS4aCT9s+ID2b/dPXuOL/qfTFcg fLj5pEWGvhxtPVy5Z+oMSkLIxb/NYha3lK3kC4huae7cuZUuTAkfveq0RnOrcdT+R4qYzp3NMZrn g2IYuqTL5cbjq/6Si583nhh89k17UbJX+kSsM4NKJtrNLHr4/P4lZRmyzWPq6MK0fejzWO0PYPp+ Z39fKkZzz/pFknle7xIuy7SVr/T3s5Zuk/79rty/8kekDPenDOrl8jkllBftZfsB0lYvl/9F//1F Z4xMv95aWc7eo27uOktU7uiX4nfaTL3v1X7p8r4RtdW+6/XjBTW/wtO+Xys//KQ3ntH1P4Vspu7T 9MvTtnum3m/ZqKfaP727zzx/rli6NP+QAAmQgEcEtM9Rxe3q4h6Rgg4vEiAB3xO4cfGkFBry8EOo XlTswZjBq3LzjjKnafcf2HNB+Z6lXic2bZKeBxvURu17W0q/siTtiN1+YCfF0mbbFd63Ayq5WSFp S+ez/8qyuLRrwNjZ2K4c3CMOV9i1KwVJlw5gfG/bkihgxTtfYG+yvq62vBAnwGqv5ycswolLCULG Scwf2k5GpYrl6XM3n5d+4ApmvDRA4wc+XrwNCeLAnYT4A5j2VltdXFZ68lK7+rK/u2Xuq/7jthAR ade/Bk9ejviEJFw6sR5iBq7MvXP2BHy/23oYVZdR80QfTBL9aI+uH1+b/THWnlX7vcycRY6yTTtB GCgs0pVluPM3nHBS0jWsnv6tDH/k0w4oJ32Oji6jvsP+M2JZdtIl/LVgtC5B/yFzcFmGJGP+wA6W rSSUIPHlXRyK9Q9Mu1Zj0aKVSIqPxYjO6pLg9zp8gmOafWz3zJ+ANeZUizRjveE4kJCKVYsWYdWu JMQfWY+PetfH/V2qut3iQqqiOHzVX+z6Q6593gSry5+tHJKxe/EHqPGMdVm2Elb45WdQO9z+fZS5 dks6shjdp8RbixR/P/ltn7XNV+3E1SOrZX9UEpT4eA0uXbqE51wuDZdipMPzfhGCrl/twpETZ7Bt /usyv5j1hlgRduLICRw5cgTHDryK0jJWOOzat8uw77B993Ysm/4x3ryvtLq/ZIb7Uwb10uqocyfj +4Ht8b1mi4Yh01fgjHhGiS884j14Biu+fk3NIerXffAMx8Pu7Orteb9WRXvkyqF+mZve92452bWD y/4ntqHJzPNV6mBXnu/fb1mjZ/r907v7zPPniiRHBwmQAAn4joC9hVJI1v2Sah9PPwmQAAl4QkA7 G0CZDefxDB5nwlNPmt8KCJbPprd/184i0vziLmY9/HFGzLy0S//5Fu1yav3SzbddLK1U1dDId/qL vprSM1eS+cj2zeYj8c6XTJuvqrOpLLO5HGbu6PVRntmfrLRfHnrBLE76lry0MxRuaGaDKnmd1X/X bHVGqZJGm9+zOlpTaWdJOJsRad9O/tyuvuvv+vZ1nEHi2/7jKF9fvtL+n6/X3m9iRvFxdUaxEq98 XpizU981xMwp7Wwl/ewvfVLPfHq9HPXWS1kxtKHs/6Fd7LcFEI+I86vVGWaW2VK2pbr6cpS6jV7i uIR6l2aGHUR+21JfezZzjzi5z2/tNfcrECj1+0TzfNL2I224vnbe+HzbXxQeue15o2WmLLvuP2iQ eZD49O/9iMNyVGXm0B6HZ6pjn/a23fbNfkm2Z/0hvzo00MW1/yfjnc3SlzPD0u4n+/6traOn/eLG LnV7FGf3gFVJx/7+lNul/5ntT2KGXgb0suehXdWg9MkhLrZ+2TVbnQmrpFPb1bHe3vRrhwZ2EqBt s5zql5l/36ucsnRGZFq/V9rIXf/L7PPV/j5TysuK91tW6Olt//TkPtP2UU+fK066OoNIgARIQEdA ebZqP7pIjYczIgUlXiRAAr4moGz+vVgKDa5cTBzvkInLUA5t3qgjBfz2526xTXnalXAEi5ZYT+Yu UOhRVCsjZrrYpV+y9pAtNZB0FGvnWNOLLwdobdmwX43OelcIKtVvhEolXBCJqI1HOllnTFkO5zmS 4FYl8QUMr7eqaJemODoPfFWGnTguZmSl+Q6vmCvDlRlXLz1gnxeI7vUJ/prUV6bLModdO/lvu/q4 v7sF7tv+47YoEan0r5eb3alLFlghBsLQLcO6TtyEr3qq96clIrQWer1ZX6bZd+CMdGeHo8Hj/WQx SYsnYZPdjMyja3+VMw+DW72A+8rbz6SzZn9hThze7lhFyrI5ooV826xLZTbZnmPigB5x7f9dvb+E QQqPOxyUJRIF1sTLXz5iSa/8+XPLcelOuakc92C9hn8xH//ZPBn+79v+ktufN+bbazBl/HiMF58p sxdhj2UsbIX35Mc/459LE1DLYTakD9ot8YZsoYfaRUu3zRFeTn3O3k68aQv2+H9G+kUK1HJSEz0r KuzJb/F5/3vdJM58f8qIXvYK7V/xiwwS27Vg6KOO96iSIPqJ1yH2g5ZpFyyLk26tw9t+rc3riTun +mWuet97ACq9/pfZ56u9Cln1fssKPb0Z5yn19OQ+y8hzxZ4h/SRAAiSQUQI0RGaUHPORAAm4IWBE WKkoGZ9y/qIYFGXuqv1gDylg5+R1EOd5Wq6Ew9vkMsh6r9wnl1fWflD9or9m7lr5hT7pRCy+SbVq E9SyM+qWMEi5OeMwIfHyZZw9e9byuXDhCE4fV79AQrP0zJl+1aqWdBaMUhXVL2Zxe86pS9KCw2T6 mJ7t9MvzZAxQ5/5WGl/WOfNGu/q+v3tOPHP9J71ynPcvIyIiAmTWB1vWkG7VYUTZqjWl9/x/qqFG BmahI6J2OwwPSFtCLgyFc5cf1pR2BSu+V5dlP/N8G6cnwSoZ6tUqq8mncYZWRutOETLgzx2nLe4b N5Ufga3X/uOHsOfAHsTGxuo+ew7EYvX8P23JdMus76haT4Zf/+5FlAzqhCm/b8dl2y8JMjajjsz1 F+f9AX7xvCkeVRWl1V0FdAAz227aL/T//Ov441HSv7Y3lrVYb5sz6/uFVa8PBz2q6486SE49metP TkWmG5iMgzv2yFQtn74fxaXPzmGoiI7vx6iBwapT6/K6X2szZ9Kdlf0Suex9nx6q9PpfZu9T+/Kd t3vm32/Zo6eb5659RV34s+u54qJ4BpMACeRzAjRE5vMOwOqTQNYQCMHdjWv7VHTJus0hDoCwyEy9 PhbbjiZZ3Ic3qF/oH2pTTZZZolYLiM39Lf6UXXMQm7av5OG1q2WaDt2buTRAyERZ5IjfsxpjBz+J aEMQIiIjUbZsWcunZMnaeH/3dY9LvZni/Cut9tdwRZh1xzzxBW6z+gUuPMT5LDAlfUqKxhiqBGTR lTfa1ff9PT3cvuo/6ZXjqn9p87lMkz1dSKuK6hazbbt80VP650xYIn+MMMdvxVeLr1jilFnRT7Sq LNPZO1zWTSQMCleHUGUilHvpGnauVvefTfp5MKKrR+Oee+7RfaKr34NBq62zsu3LK/vQK5g/qIEM VmZFD3joXkQGR2PIxAU4ZrffrUyYjsNX/cUVj9zyvGkrZueKVT/ik4JLR7ZAnFwuyXz2WE18s8MZ 98y32131GstyZvUfg9Vnre8nS6DpGCYNGybjW7Sr6/V7J6v6hVTK5kjnhy9bMl/1J5s87/6bcPH8 UZmlXb0o6XbmKFGyjAxOiLfe9zIgzeFdv7bPnb4/Z/pl7nvfp0vKbf/L/H1qX76rdtemc5nG5fst +/R0/tzVau/enW3PFfdqMJYESCCfElBH0fkUAKtNAiSQNQRSEtQlhikn4jWHOWSwvIjqcsmyImHF 3/+Iv9ewdfUKi0DFoNBcM3vJEFkTj7QMt8QpSyfXxZ6xpN/0+yJrmPjbuUVV6c4+hwnrPu6GUtGt 8Nb473RLB7Neh2T8d1gzM8zF7JCs10NTQh5pV5/3dw0ivTMn+49ek9zuq92xJ2rDOuM5ZcdQrEj7 8eLA8sXyvivU61ncm6GDtEIQWUw15BcMsrqD08rzhk2p4gU1ycPQbdwmbFvwidTdEimeYeMGdkel InUwK1Y9FEWT0YUzJ/tL9j9vwuWxKkYUrdQQH/65C2J/Ycnmlf9Nd/ouymy7lWz+mFwCbL41B63K FsTzoyZg4sdvIyaoCt5arc6SfLV7XamP5w5f9wvPS9anzMn+pGqiba/ChV1Mc01LHn/wDzVjDrly pl9m//2X1Xi17e5pWfrnq6e5MpfOX/QEcstzJXO8mZsESMA/CdAQ6Z/tRq1JINcT0C75MO0YjiWx FzOpcxgad35cyvh+XRySk07ityXWL3gB0S1RW7fMughiuneV6b8U+0oiRU1vCHkOjSqrSytlwix2 nPltJO5/c6EsJeSRN7Fk3TbLKafx8fHiNNUDGBFdSMb71hGCMnW0xlfVkOLbcryRljfa1ff93TnD nO0/znXKraGGsk0wuHNRqd40y/5w1/Dnt7Nl2Ft928K9GUMmtXMk498T6pSYI/85zrS7Z9QapIiZ eUlJSW4+KWJ/Tful7Ubc89jr2J1yCbtWzsHAGM3zQBgk+zbsgQ1pM7ztlHLw5mx/yQXPG2MU/rfq A8nl5srBWLjHsa1kAuHISLsl7FmLCam3tGIw+b1BGPjmB3IvUiVy9O+H8HB5F/sD63I78/iuXziT 7klYzvYnVcObmr0/D56w7s+qxupdZaMfkAERhYtId446sqVf2t9/OVpjnxeekfvU50p4IDD365nz zxUPMDIJCZBAHiRAQ2QebFRWiQRyA4Ey0ffqZvQMnfAbkjOpWOXmbaSEazNXY9OmTXJ/yDpd73PY 77DK/ereUNdWb8WWv9T0hV/ogEpGKS6bHCbsXqfOzogY8B3if/4IHZvfg0rly6BEiRIoWrQs7qqo zuDxrWIhqHh3LSnyxMEz8hAbGWhzpOi/VNuCvfkf6OHsMP9vVyAr+rsj65zuP44a5e6QMLQb8JJU cc30FTh6YhO+TZudZgh6Ap2bON9j1ZYpONDFQ8J8CYeWqlsoWJeHhuGeBzvbsorl1EFiSwQjQkJC 3HxcyFekGIsgulVPjF91DYdXfCHlKgdfbD7u3vhiTZzT/SV7nzcSkJ0jskVP3Y87b0xfbffcy2y7 XcMvnwyRpQ4eOx5D+z+C6OhoyycmpjOGjZ2G2DM38PYDVWS6DDsy0C8KpC0OyHCZloy+708Z08uI 0hUry6qs2awu05aB0nENm1epB9skyvCcd2R9v7S7/07G2/V7DQMP3vfKNhHbTlh/+NXktDo9yO+Q x+uAzN6nXheYwQy5T0+P7rMMPFcyCIjZSIAESMBCgIZIdgQSIIEsIWAoG4NRA0tJ2ddm9cHbP+6T fqeOxGOYM3EiVp/U7K+lSRhY6R65zC41aSJat+kvY7vc57gnZWjlRuhXwDrrT5mV2fh+Nf1LD9yb tm+iFJENjmSc3K8ujR7zUkcnBwOYkJBwO8t0KRiuLgPd8dXPOJCsHq4hC02Mw+sNB0lvRh2XLuiX kDrfzVIcIuz37SoOas+C/u7IPef7j6NOuTukbMuu8nRrZXl25YoPyGXZ9V7vhVoh1qXbrmox5NMf nS7lTYj9Ex/dVmdElizuaOlZ+f4POOaq07sq0EV45dYvYdv4bmrsTefPSDWB4sr5/pKdzxt93bW+ 0uj2Rl8ZcHXiBGy+7OS5l5YiI+2WmGh9ZitbhDz+6qv4YPLP2LVrl+WzatUijHnjadQrk9GZkFJ1 B4fbfqExDqUmXNWcoe0gxsMAH/WnTOsVgqrR6g9qsZ9Oxw5n7zFRq5QTy/HM7P9k/brdV1G6c96R 9f1Sd/99lrH3vXb26cmzTn4ASYrDew0HZzvOjNyn2a6kKDDH9MzEfeb2uZITEFkmCZBAniRAQ2Se bFZWigRyAwEj2r/8lU4R5bCAFz5fhgv2UyOTL2Pzki8QU7gKeg0ciLhLLmbjiQMo2rxRRyezQO0A KF/+mtZyMrMpsBzaPqcuzVQy2tK3ru/iNFyd9Kz1TP9ho10BV7BgWA+XB1nYJc6Qt5I4Kdy2b545 eSoGj/pNN0si6eQa9C5cV54s7nkh17Bn/Xocu5ySliUZa2Z8JrMHVy4Gl1/D80S7ZkF/l/ScO3Ki /zjXJBeHhtZCrzfrO1Xw+cfucxquDbw261nc9eQknNIaOoSh/r2G6kxLY73haFvNauCv3fVJeUiW 8mNJt/fnqyfWawUL9+WTO7Bq/W5N/DX8NnE0pizZ7mT2+H9yP1yLmGCXd5NdKao3J/pL1j1v1Hp5 4qr2UE/ZLsqM0qlL9uuyZa7dAHNCqkWeIrtxWCsMGfUxJoof1SbPmIE5cxZi4ZIloq1jcfKCJwZk nWrCk7F+EX5XDVnnW2v+wB4Pl/Pbl+7Kn9H+5Au9Krd7VH2PiT05WwyYLg+jkvoq92nn3tKr3KcP 1y8m/bnBkdX9MvP3nxHh4dZDAhVeH3YZj4OaZ6HpwlYMCqvvsC1BVrHN7H2aVXrZy80NeqZ/n2Xs uWJfV/pJgARIIKMEaIjMKDnmIwESSJdAYOUu2DXtRV26r1/tgJKhBrTu0x/DxEmiA/p0gSE0Ek06 vyL30rrp5uTEeg/2kPKio43iHJrbMIo9oPT7Q9qShKBB+6dsHrFMzpo+SBjj6ur2k5RJstgRhqYP PiLLiP2gA54c/T32HDiA2FVz0b/OHej+4Z8yPiscyr55b/ZWv4ytEDqEd3kLMxYuxMRRT6FghRh8 74a/S50S9uPV+1uiUmQQ+gwYjP6PNEFvzUyUXm3qud2Lz7/b1UolK/q7nnfO9x+9Pv7gM+K+nv0c FC1Q6E08UK+wQ7izgOvfvYgKwrg0evL3mDNjtPjBJFr3xXvgiCflthCGki0xYngDKSb2gx4oWrc3 Pp+zGOu3xGLL+lWYM/kT9G5VEJEV6qNNzEDst52ELe6hjwe9jwGd70XBoE74ZMZibIndgvW/z8Wg VhXwwuLLUm5UKXVmswx0cOR8f8my541DXd0HGCLvwYv9istE3700C6ekT8xozky7iQMfOr39rpSm GCPHvfcmBoof1Z5/+mn06tUN3Tp3RusW96BCyYJoM2QaznkzUzaD/cIQXgJlYR3mKzq1bdsHk+fM wcgBXYUOszUGcKl6Og7f9Cdf6BVY9gG7FRfPoqTlnlmAVat+x/SPhyA6ojY+2n1D1unDic/L+1QG 5rAja/ulMlM/s+/7ELTtq247oPy4Uj2is3g2zbEwDizZUPcszGqcmbtPs1o7VX5u0DPd+yyDzxW1 lnSRAAmQQCYJmO0uIU5ZryI/dtH0kgAJkIDXBHbNf0c+U7TPF2fu0Ec+NB9NSnVdxtW/zZ0MATp5 bUatcZk+9Z8/zWIGoC5918lbXaZ3jEg0T+pcVOb/fPt/jkm8Cbm6w9zLYJTynDHQhjmW55k+V3d9 I8sIbvOV+ZJWx4uODLVlKu4+Q/vL/F0nesDLSbvYZIq9+MyxCW7aVNHNSX6/alcN38z193TaN8v7 TzrlW+rpSRqzedekp73rQxqGjk7PynTMJ0JST5rFyclSF6Vftp24yWlSsznRPK1zpC6trR87+19/ 2M/mJAdJZ82TehfzSIYhsKM51va8Sz1mHlggKN18T3nz/Mry/mKtfLY/bzTMPe1nF//6Qsd2yu4r GimKM4PtJnKmnv9TJ9tZX9GGhT35nf6ZLPqdy/dMhvtFinnF0IZO9VLfCW7KtaNj8Wa6PylSfKRX yknzRzERTuunZa24314YZ1cbz+rttl/bSbT35oZ+adHJg/d955YhkqPj+/6Crm/as1X8A4YOkuMs ff70OKcXb09V8Wf8PlWe7y7vM1mUJ2k8eb9ltZ5i2ORunJfefZZ61PfvG8mQDhIggfxMwP494YoF Z0QKUrxIgASylkB0t1FIOhOLaSOfl8up7Et8pP8ILNl8HAk/v4Uod/u2iVkOvQfql1p2b6/uF2Uv 11C2Hl7srDkps0BtPP1ATftkbv3apUkuD69wK0ETGVEXM87/jY96t9YEWp3CKIHJK/dh3yJ1dk1E Qesel9rEwZpDYIoXdL5EMzBQPfAmsEy4fj/MyAZYfHEnPurfRivW4g6o0wtzNv+DWWNek3vrOSRy FhBREd0HtnKICWr1KlYemop64e734oO/t6um5pnt727bNxv6j9vyLfU0olgptV+6uic0XRDhEWp6 DSqvnBm+D8XS/57/p++bz7ev61HZM7cfx1/T33FIq2wHMWrOX9g45hEnM31L4/nv/sG2BZ+jU7SL eovnUJ+h47Fyt7g3bM87Q0WMPLZK3JddHMpTApR7c8bKw5jR/16n8U4Ds6G/KOVm+/NGU9lA7TL1 YBe8RfrIRh11h9YEB9o/kzLYbjiHkWU6SY3aDPsZ4ocfmFNsJ6YnIP7EHkwb1Famuf79tzhsmwmb FuryvstwvzCi9chFunJtCtSsrW6V4bJcW2Ltfx/0J3EKk2/0MpbDm6vOYO10MUtZrHZwdrXqMwKr 9l/E6EdrOER7Um+3/dpBoj4g5/tlmj7iff/j+a1OxxyBrfphyf6rmPvNDL3yOl9xPL8wDtOGdtWF Kh7LeGHLeXw95gVEG9KWcKtDD0v69DinF+9QqJjXmqHna5qg9Mvz1fstq/VM57mb3n1miPL9+8ax sRhCAiRAAi4JGBQLpTbWYNAPzOyitUnpJgESIIEMEDAh8fJlJIqtskIDxRc1sXNgZNGiCHH+PcKl fFNysnVvQ6M4kdaDvMkivXIZxQm2HiS3K9eE5GSxls4oTsAVH19dyYkXcD7+BgoKI82NlECULVNC 6mbR12V5Nn3c193GyF2dLTpcEjqI7+83EIHyZTR7apqSYam2F8xMiZcRfykBSQJXaEQkypRwPMTD HT+bzqKh/LZd9fXLSH/3rH2zrv94Un5aGtFjQ9zcgNb7zn0aPS93Ppte3t+Hu6c/gzrPTLcID249 Dv+sGAR1oa62zGuY/kh5PLPYeijD57FX8LKyhNuUiLPxiQhEirhPCqKUuFdDtNncuBMvX8AlcY8F ivs8RawUjYgIR3hRux8H7POL8i6I8lICRZ4EkTdS3EsiT2aurOsvVq1s9252Pm9sPKxle9LPPOu3 ilxP2y1BGJML1+lnUSWw3oc4GfuWiyXA5zDUWFEeciRmu+Nl3Z6Ftv7t5tmXwX6RLJ7Ll8RzOUVo WTCiFEoU1fZeD8q11E7/J+P9SZXjO73Ec1YcjhafkCLuLyDhRiAiS5VEUTfPJnFTp73X3fAWqnrS r9Ua6V052S/1mlh9yeJZdF4wUt73KYHh8v2s7cNiRiN+fMX5jx3K+/1MfIL1WZYSKsYsReWYxSTG CyZlmOQwXkiPc3rxzmqihnl6n6o5PCkvLY0P329Zo6dn/dP9fSbIZPC5ojKliwRIgARUAp7aE2mI VJnRRQIkQAIkQAIkkNcImE9haGBVaQB6YU4cvurpOEPKWm07Q6SDsSivwWF9MktAa8S5Z9RybHun jXORCTvRu0gDyx68yozadedWoVmO7FXsXD2G5l8C2j7szhCZfwmx5iRAAiRAAp4S8NQQyaXZnhJl OhIgARIgARIgAb8jcGnLL9IIqRiAurWp7nd1oMK5mEDKLanc9nfbYow49fyyMpVcc10++jeGPtJc HgRmCIoWM1z1K5A0yekkARIgARIgARIggTxNwHdrDPM0JlaOBEiABEiABEjA/wgkY+X0kVLtQr36 oAlnoUkedGSeQETV+y376X5vthof3xGnnr8jxNaJ6YQKEQYcW7wEeyxnQKplTVjzHqI4AleB0EUC JEACJEACJJCvCHBGZL5qblaWBEiABEiABPIRgYQ9+Oqb/2SFBz7RLt29HZMTbsv0dhPbZDgdJCAJ hNfEN8eXY2BMIRmkOHatXoLFixfrjJDK4R4Lt5/Hyw2L6dLSQwI5SkAzqzfRup12jqrDwkmABEiA BPI+Ae4RmffbmDUkARIgARIggfxJwHQO33/2LY7dNCOkZDT6PtsZJdzORDNh+8Kv8eP+ywgNvhPd X+iLu9M78T1/kmWtHQiYcOHoAeyJO4DDJ44h/upNJCmHshUpjLvurIDq9e/BPdXKysM9HLIzgARy iEDK2a2Y9O3vuCr6a+X2z6Bns7I5pAmLJQESIAES8HcCnu4RSUOkv7c09ScBEiABEiABEiABEiAB EiABEiABEiABEiCBHCTgqSGSS7NzsJFYNAmQAAmQAAmQAAmQAAmQAAmQAAmQAAmQAAnkFwJuFygp EOwtmvkFDOtJAiRAAiRAAiRAAiRAAiRAAiRAAiRAAiRAAiTgOwKcEek7lpREAiRAAiRAAiRAAiRA AiRAAiRAAiRAAiRAAiTggoAxLi7ORRSDSYAESIAESIAESIAESIAESIAESIAESIAESIAESMA7Aq7s jZwR6R1HpiYBEiABEiABEiABEiABEiABEiABEiABEiABEsgAgXRPzU5ISMiAWGbxFwIRERE6Vdne Ohz0kAAJkAAJkAAJkAAJ5BMCHBfnk4ZmNUmABEiABLKEgP171Gw2Oy2HMyKdYmEgCZAACZAACZAA CZAACZAACZAACZAACZAACZCALwnQEOlLmpRFAiRAAiRAAiRAAiRAAiRAAiRAAiRAAiRAAiTglAAN kU6xMJAESIAESIAESIAESIAESIAESIAESIAESIAESMCXBGiI9CVNyiIBEiABEiABEiABEiABEiAB EiABEiABEiABEnBKgIZIp1gYSAIkQAIkQAIkQAIkQAIkQAIkQAIkQAIkQAIk4EsCNET6kiZlkQAJ kAAJkAAJkAAJkAAJkAAJkAAJkAAJkAAJOCVgdBrKQBIgARIgARIggUwTuHZ6HzbvOYFbQYVQpW5D VCkemmmZ/iEgGWsmjcQnS48jAglo/PIEDHyosn+oTi1JgARIgARIgARyJQGOqziuypUdk0p5TYCG SK+RMQMJkAAJkEBuI3A57heMnbICCLUz9Al/0cIlUbteczS9rxaKZOtb7yKmRLfE8NvJFlyBdT7E yfUvISy3wcsSfW7j6NJZWL8+wSL9RscEDMySciiUBEiABEiABPIvgVNrZ2DU7I0WAIXuaot33+uO YnY4TBc2Y/Swb3FGCTeURZ8Rb6JFabvxkl2e3OnluIrjqtzZM6mV9wSy9SuZ9+oxBwmQAAmQAAmk T+DE2gX4avoitwkNxvb4adt0tI7KpsF34hn8nZoidQqqUVy6PXZcOYwFc5fhzE0zEFEFjz/ZAXf4 yZs7OCJAVjNcuuggARIgARIgARLwFYGLcaswb551/GMIOIPeQ7qhWJhBJz7pnz34bN48GXbvi6/6 pyGS4yrZhhxXSRR0+CkBP/k646d0qTYJkAAJkEC2EAgMKZRuOWbTMjza9CPs/WcE7syOt194JXTt XgTL5l206FYgNAjeFpt4fA2effNdS35DQDM0694ed9h9wUi34kxAAiRAAiRAAiSQJwnoxj+GCAQ6 q2VgkLNQ/wvjuMr/2owak4ALAjysxgUYBpMACZAACfgpAUMNzNt5EqeOHcTW3yejmUF91aXeGIdf 915yWbHk5GRcu5aMZJPLJF5EFEL3b44j/uwpnDoVjzPjuyDESW6lTOXjrMiQgsFqDuULRjqWzIzo n5x8zWV9vZFnMmnZqbMh1QrQRQIkQAIkQAIkkPsJmJB8TYwNPBwM+WockT4XjqvSZ8QUJOAfBNRv Z/6hL7UkARIgARIgAbcEDAEVUKZMERQpXhp3N+2JqQv/5zY9cBHLp41ChyaRKFmypMhbEiUjI/Bw v+FYd+iyQ95TW3/Eqz3vQ0REhPVTuDE69HwO/fr1E58n8PATH+JwslhKDXFgy/ghaNWjF3o9FINR Sw5oZF21lNm+cBFLmUq5kULeE4PGYdcVZTn3dSwaMQDNG7wi8ygzOoc9Lcro2RP9Ry4V0m2Xp/on Y/nY59GkSRM0ffhVrNy5FeP6NRfll7HUd25cYppAT+VZkyef24aP+nVEZGQau2KNMXLaHOw5kWRT kP9JgARIgARIgARyHQH9uGDdsdNYM20YGkcUQ8kyYmxQMhJNnxiOv87Z3uf69L4aR3Bcpe8YHFfp edCXNwmkM7cib1aatSIBEiABEsjjBDTTC03X7YyJmjiYjuOj5o3xQZxtkK1yWTfvMyifietOom/d opaIo4veQb0nJ6qJFJd5H9b/uk+GGYKLwbozpDiwZfl87E07sMV49kZamuuY368unktbsi0zCsfS ae/jerX7sbiXGT98Nh/7oBg01Wv9r/MtnqDrrfGxcIV4pf9tnFq3FHFxygEycejSYoZFlu3PTaUs r+QBKWfXo2v1jthgTrWJsfD4dNAgi79AjQJI3aeJU1PRRQIkQAIkQAIkkKME9OOCh+vOcNBm79LP 8OAfp7Hu5FTUCdOn98U4guMq/TiT4yqHLsiAPEqAMyLzaMOyWiRAAiSQbwmYE3A1USx1FkuOD26a i+efmqqiEMu2q1dQt/j++/MhOiNki2dGYNLY19X0wjXooa/xrxKSsh8fPvWljAuo/RRGjn1Ht/Rb RqY5nB3YknT0D50RskWPIRg7diT6dqitZg+vgEY1NMuy1RjpUn5J9Ep/kV6rjxSU5khIMXkpz4Q/ x/bVGyE1QmvWDKARUsODThIgARIgARLIbQTcjQtsuppTFmDmqqMWr7v0Xo8jOK6yMJXjTLFJD8dV tl7H/3mdAGdE5vUWZv1IgARIIJ8RMN/egIfvLqWrtW1mXqfxE9CieNpW7kn7MWX4Gpmu46hl+H5g M4u/a/OqKNW0v8Wdev1D/B73EnqFn8TetJl/huCnsHHlRNQIMWBA81IirXUJdWCdD3F0/UsoIqU6 OkxJtiXQ1rgBI99Hx9LihMsXBuG9Y4eQXDJKRBjxyvp/8OiG8ajVaaQloXJYzS+756FhUQNMxhCE eal/X2EYtL8Caj+PhV8+hdCzJ1G4xBmM84JH33In8N0Mdb/NAiHPY+2+MagT8g++GtwSb82zm4lq Xzj9JEACJEACJEACuYpA9DNfYu7obri17RvU6/S21C3+rLKaorT02xyZGUdwXKUfZ3JcZetV/J8f CHBGZH5oZdaRBEiABPI5AWV58Cs/xWL2040kicSjf2O++bb0lyxuwLFDcWLpchxOmwqhvUE13N0U swVNSVfkUmlDQCQihBFSuUwpt6SMgHLBXp+M3btGB0xYsAanxd6QxaOq4s4w62+ERqMRJYqXkLIh DqspXDQMIWFhCAsxwlv9VUFWlyGwG5b/Ohat69ZE0/btUe5yrFc8Eo/swDINv5dmvoQ6ipE3rCJe /GYjhtUMtS+SfhIgARIgARIggVxKoODjX2Lp+D64KywElVo+g3HNI6SmJ+P/E/P19NvFZHYcwXGV fpzJcZXsbnTkAwKcEZkPGplVJAESIIH8RsDYvD2qrv9NGg6V+u+JPQZTm8ouDYXfvvAQvnUDKrRc HXQXxknFeKmcvv38oCLoF1MEc598Q+ZK1U92lOFaR3ith8W+lMPw1nprYmUG57vPio9I1HPUQowd 2E7OqNRuZ6mV4cydnv72eTqOeQn3FrEaU+3jFH+68tImllryiiXvzeuW0YgpijsriDPCney9qUlE JwmQAAmQAAmQQC4h0KZJXTn+UFTSLsPev/UwrqGpTtPMjiM4rtLhBDiusgNCb14mwBmRebl1WTcS IAESyIcEDMb22LB4Ljaf3Ywhmll5a0Y/htm7lKVF3l/BgeJ3u9CKaKyRt04cLNOnz0DdrMAx73ZC WLrii+HFeWvw0dN1HVLOffcxdPp4tUN4ZgMs+mdWiCa/vTxDgUgUDuVvmxpEdJIACZAACZBA9hIw FFJ2dnG4jHC/57TMcNN61J70ax0G71d8aLPbuzmu0hPhuErPg768T4CGyLzfxqwhCZAACeQ7AjeS RZXDquO1r5SzpdVr6Fe/QYmyXHbj7dErj+BS/FmcPav9xCM+/hL61oxAytFlGLL3mi237r+xeXdM W3kAAxqU1IW79IRVwYsT1uFU3GZMHfmsLtmujyZj2zX98idbArFCXL281F/N6MLlrTxNemVW54b9 FzSCk3EhQZNAE0MnCZAACZAACZCA7wkoh8rsOOi4NOPAlrWyMOXH2ugKRaXfpw671z7HVXq66fGA hh/HVXp29OU9AjRE5r02ZY1IgARIIN8TsK1uCa/3MEY0V+coXv9hHNacs470QoqVQg2oS5NXrI6D 2IARYcoejGmfELEQ6fI1q+ny1J5YyTXk4eFYt3Mndm7bibiDx3Bq8VQ81kC7NFkmdXRc+wdbtx4U koEid9VA90HjcHTJ+zKdwVgOhdP2n4Rm/0mzaRlWpxn7kpNN8FZ/WYALh7fylPTa65PPF+CiJeAq fh3xLN5f79xoq81DNwmQAAmQAAmQQMYJlK9XX5d5YJu38ddp1Rh5atMM3D/4ezWNmDVZWOyckhWX t+MIjqvEvt+acSbHVVnRKykztxKgITK3tgz1IgESIAES8AGBYnj0xWdUOeZ9mDR/i8UfWK4J+jUP l3FrRndGiyfexLQFC/D9tEl4q19HRJaJQq0uM3FFpIoooRrekpcOR4u6dVH33rqoeXcUykQqB8m0 x8jpaywGRinUiSPx8G9o3boB7mr6OD6eNh+LF0zHqKEfyZTm2xeRYrLOiAwrVUlnLB31YCd0aBKJ O7vPwE0v9ZcFuHB4yyOwXAOMqFlQSkteOhRRgkH7wuXR8/9WyXA6SIAESIAESIAEsoZAeO02GFIg SAo335yJB2qWRdMOj1vGC7UefFXGKY6Onw5CDduPnbqYzHu8HUdwXKUfZ3Jclfk+SAn+Q8DJLhL+ ozw1JQESIAESIAFnBDSrW1CuRXdxAvaXci/HNaPnYd+A+8RAvDC6fzYRgxv0lSL2Lp2EQUulV+co 0bCN8L+tC9N6lGU0nw7cgJUJy7B2YDNL1E27Eya16W/vXYbRg5Zpgyzujp++JL8kGMrUwIMFArEv Ne1kbmFIXS8mbhZ8XNnvyTv9FeHu9PFeXjH0/vRtvP+QysSylMhSC/4hARIgARIgARLIcgLGinht wxf4rGl/XVF71zuOL0I6foYJT9fWpXM3LrCPU3aHsQ/TCfNyXMJxlZ4ewHGVPRH68y4BzojMu23L mpEACZBAviEQGKbOzNMtbVYIhEfjlREP61jIpdt3d8WZnb9iSIdoXbzNE1CrPd4ber/lFMmDP0+1 BQPilOjXx0/Fd99+i/EjX0czg/o63TVmCY5b9nIMQHhJze99wdZSw6u3EQfVtFRl2VyKzK+XY+rT 2mVWd+C1v2cLQ2qALZXlf0DBMMt+9OFe6A8410cr2Dt5QIn7XsHWH0brZm0q8u5/6Uus/G2iKtrD ffLVDHSRAAmQAAmQAAl4QiC81uOIP7gKI57u6DS5MpYZNW0FTn3/nDB1aS9344IA3FE+SiauXvMO sYzY6HRcIxMJhzfjCI6rxMhMM85UOHJcpe1NdOdlAgazuLQVNBjU/bKU8ISEjJ0wqpVJd+4lEBER oVOO7a3DQQ8JkIAfETCZTFDsfyFGjfFPo78lXqQxGsVQ2kkS07UruHA50SLDaAxFaHgYioTZNlK6 jm873I3B663vxJhRa7B4oGowXN2vEjrPsx7WomwEv/LUXNwbZn2fmpLFHpOiQKNdoabka7giykuy 6BSKoqWLi0G+q8uEK/9dQJKY6hkYGo7iRdR9L2053OtvSwW40kdNYXV5Ks+S2nQN585dtrALDS8h 9LPWJL02sS+TfhIgARLISQIcF+ckfZbtEwLiffzfBevYQpEXGl7U6ZhBW5a7cYGzOGdhWnk2t/tx BMdV+nGmjVraf46r7IDQ6y8E7N+jduZGWQ0nX8VkHB0kQAIkQAIk4DcEFEOfu5eaJd7OGKitnDGs CEqLj8srQp31uGH5DCysa0J06UI4uXUZ3p33n8wW2KwNqqUZIZVAY4hz86JRHIxTvLSjQVEK0jmM KFK8tGVmpi5Y40lX/7S0rvTRiLI4PZWXlhil73KsS3ptYl8m/SRAAiRAAiRAApkgYPRmbGEtx924 wFmcszBnGqc7juC4yhm2tEYJ47jKNR3G5AEC7r6z5YHqsQokQAIkQAIk4AsCwShXrRLw63aLsJR1 M/CM+Di7Ph3ZGY4mOWcpGUYCJEACJEACJEAC+ZEAx1X5sdVZZxKwEVCnd9hC+J8ESIAESIAESMCO gBFt31+EuWNfdtgP0ZawRY8hWLrtJPrWLWEL4n8SIAESIAESIAESIAEHAhxXOSBhAAnkIwLcIzIf Nbazqtqv4ecekc4oMYwESIAEtARMuHblChITk8SejSliz0axv2PREggL4SIDLSW6SYAESMDfCHBc 7G8tRn3zBgGOq/JGO7IWJADYv0e5RyR7BQmQAAmQAAn4hIARYUWKi49PhFEICZAACZAACZAACeRj AhxX5ePGZ9XzKQFjXFxcPq06q+2MgL0F21kahpEACZAACZAACZAACZBAXiewfbt1X+C8Xk/WjwRy gkBMTIylWK7Iywn6LJMEsoeAK3sj94jMHv4shQRIgARIgARIgARIgARIgARIgARIgARIgATyNQFj zZo18zUAVl5P4ODBg/oA+kiABEiABEiABEiABEggHxC4++6780EtWUUSyF0EwsPDc5dC1IYESMBn BFzZGzkj0meIKYgESIAESIAESIAESIAESIAESIAESIAESIAESMAVARoiXZFhOAmQAAmQAAmQAAmQ AAmQAAmQAAmQAAmQAAmQgM8I0BDpM5QURAIkQAIkQAIkQAIkQAIkQAIkQAIkQAIkQAIk4IoADZGu yDCcBEiABEiABEiABEiABEiABEiABEiABEiABEjAZwRoiPQZSgoiARIgEcqDwQAAQABJREFUARIg ARIgARIgARIgARIgARIgARIgARJwRYCGSFdkGE4CJEACJEACJEACJEACJEACJEACJEACJEACJOAz AkafSaIgEiABEiABEiCBPEng+tnDiD1wGimBBVGhZl1ERYbkyXqyUiRAAiRAAiRAAiRAAiRAAllL gIbIrOVL6SRAAiRAAk4IXD20HF/OXg+EuDJoJSO0Uke80qMB8tOLyiUXwalwRHFUr9UI9957NyKy FcplzGn9KD5NvWlpSWONofj7574o5KRdGUQCJEACJEACJEACJEACJEAC7ghk61cZd4owjgRIgARI IP8QOL15KWbO+91thQObROFZYYiMcJsql0YmHMfSRSvx7y2hX1hFdH6sNUp48Mb1hIshoBWm/j4O zcq5MuL6mMn1fxFrTpFCA6tESjcdJEACJEACJEACJEACJEACJOANAQ++FnkjjmlJgARIgARIIH0C gUEF001kvgoEpJsqdya4dmoTXhvziVW5Ag3RsGMrYYg0pKusR1xur8JzHb/A6u2vo3R2vMULlUP7 jhFYteSKRX9DaGC+mqWabqMxAQmQAAmQAAmQAAmQAAmQgMcEsuMrjMfKMCEJkAAJkEA+JGCois+W fI0mRQJhSqu+yWSCMayYj5f/mnDzprK8OBjBwe5ff0o6oQKMwSKt+6SywW7evC4sp4Us6YNDg2S4 wRAGo4cyZCbFIbh8/eds3BN2E/8d24T3e7+Fv81mSxJz8jdYebAfetcsrMti82REf1tex/+F0PGT LWg3PAE3bwcjIiLYMUlaiG/LdVkMI0iABEiABEiABEiABEiABPyUQEa+GvlpVak2CZAACZBAbiRg CKiKiuXLIDLY+YzBo39MwOAvV6JIkSK4argbH34+DDUilLQmbJ01BqMWHkERbEeNp3/CW12qifCb WPfl+/j0j30wFG2E9z7ph9QNczBy6Nc4BKshr1rjJzHo/ZcRE6U15F3Guh9mYuqcKdhy8LZE1bhT f7z4wnNoJNNq5dfB6288hgMzhuPTJfsseXp164CtC5bJ/GYxg/GjwW+gFK7DUKUrRg1uI0yh6V+G AneiVKkIRAguEZGP4NMpp9Ci35duMnqgv+kcvhk6FEvPp6LwlStoMngiXoipoMo0ncY3r76LpddS Yb5aEm9/8yEalUzFX1M/xEfrjlny1H/5MwxqV1nNAw/KFW2y8rPXMWHNFdFWV0VbjRFtVVvK2Dlr BN6ztONVVO81BkN7qHEHfxqL/83YK9JeRdMBH+OtDkob8yIBEiABEiABEiABEiABEvBHAjRE+mOr UWcSIAESyGMEAgOcGyGVahrNN3Hw4MG0Gm/BO7Pb4qcXGyLlzGr0HjNHkogqZNsz0YQzW5aLPNdE 3EE80XyWTGNzHNg8C8+334yvV/2EmDKBwqZ5Gl90fRifH0y2JZH/Ny+ZAuUz6qe/0d0yA1Ev/7mu 82VaxbFNGCFtBk9bxJaVSyzOwBvN8I5weWKItGRQpoimJTbdsC6NtoQrf2zTRy1uT/UHEpZuw4FU 656PsTPXoFdMX7kP57UDm/Hpyr9kESevDBeGSANOrPsFB7YoPEV7nE+S8Z5zM+LKkc2iTRIsebeO WINnhSGyhMV3Gr9+OB8HU60V+vuDP/CcMERa4y5g+Yw5Ip+1XYr9a82vKkAXCZAACZAACZAACZAA CZCAPxEo4E/KUlcSIAESIIG8R8BsWopvJs/EDz/MwqxZaZ+ft4r5g9ar/IN90L+AMBamXXGff47t Cdfx18zhtiAYQvphQLsK0h8U5sHrzXwIQyavtdjzds4YoTNCNn78dXz49vNSnuJ4v9csXEgLcSe/ VHn3ZXu676XZfA2J18UScbHk+9i2RXhrkGp0VZZtV7lL3WfTc/1Lo8XLjWS9UrasxP5L1lmiSuD+ v9QDhAyB3dCgvPVsbG19rSFWEZ6XWwj3PtRRlpua/Cf2xluNoSlnjmJWmhFSSWC+uRZ7z1rjzBeP 44+D1tO6lbiGNcsp/3iRAAmQAAmQAAmQAAmQAAn4KQHOiPTThqPaJEACJJCXCCye+AEWayskDnip 224WogspMyVL47lZr2FK74+sKVL/xhMN6mtTY+CUviKV66vG42Pw5RuPIOLiFvyv3XNYZU61JE5a +BuOv1Yesz/dJDO3feM7fPFsQ4u/faMo1On0hsWdmiQOiDn0NLpXdZy9GVC9D6aM6Y6Q8/8grHZT DD8yA636jrPKFHWZtXIS6hY2wGQM9nzfS1HPJ5vXkXopjgJ3F0DqwVS0GzESjSLTjLM3D3ulf/s2 DwITN1jlijJW7zqDRjF3Cv85rPtsizVc/K3xbFtUdLFc3pLIy3K71G8hsn1vlS+MwFviziOm5J2I P/C3Ncz2V4nbe0bMVK2A+EOxcnapclr4fTVK2VLxPwmQAAmQAAmQAAmQAAmQgB8ScD9tww8rRJVJ gARIgAT8n4BywEuo5qeywg0ew/DW4U4rFthkKHo1Ku40TgkM6fw+Zo54DGUKGRFW7j68NKydmtZ8 A+cP78AvZnVPyOJFDTh17BAOHTqEs6ZQtDKor8pbKWo6mxCD8WH8MOttNKtZFfe2aoVqJUJQLLKY LRpKXcILi0NsChVCIU9PvpG59Q7FCPn01D/xeY96MuLaiZ1e6R9WqTGeLKDC/eG3WLGDI5Byci+m pC3ZVoQ/3EpvBJUFpjm8LTewbE28crdt+Twwb80Bi6QDW+wMkSJ03sb9lrhjf61MKw0IatUalSx7 g8ogOkiABEiABEiABEiABEiABPyMgPpNxM8Up7okQAIkQAJ5h8BH85ehkTAAJtv2PQwphijdbLxw dHntXQxfaZ2dqK35kP89Kvc41Ibb3C3uqa+Lr1Bfme1oXYKsHCRz/mozW1LL/7lDe2OuLsS9p+1b fRFtZyCzVcN9zvRjAxq1QqUtq+WsQCXHwT0nYGpeHq5e4Onqb7wL7V5ujFlpsyKTl/6Gox90RKHt q6VCyrLs5tW0B/nIKJeOdMsVuz426nivWAK/wSIj6efNODusJnZ+JwySYqk5xExI5aoKAw7/vB2n h92D7WusYUp4+4fqej6bVMnAiwRIgARIgARIgARIgARIINcRUKd55DrVqBAJkAAJkEB+IKDMKLy7 WhTKlItCVFTap4yjEcyUdMspjoTLtt0knUaLQOt+g7bY2ybncmzx7v4HBXq6w6M7KZ7FKUuRF0+b hF9if0H/u4Nlpk0T+uOnOOvBMTLQQ4dN/+rK8uy0SzHGbt95CNv+WmELEidXp7MsW6b0zCHLbdJK ZjDf2oJ1a9Zhp1mYbYURsnGP/ujeKNhidFXiNm3cgLhDalu1rlde5qWDBEiABEiABEiABEiABEjA Pwm4mlDhn7Wh1iRAAiRAAv5HQCyPtpwYo9ranNThMuYOG+0kHPj6xanoHPsOKrp4o505e8ki3hb9 7wF1lp1i7LszXD0IRyngzfmb8GS1ENzUTWs0wmgMQLBlaXV6hk9HNU2OK7odEzkJSbopDpIpVAUD PngXUx59R6b4YOYqdP64k/VAbb2d1QP9AdvybNshMaN7dZKyFUfH9nVczriUCTNSbpWG6GgIsC4l F8bH9199T4qr1/YR3HdgH+Zv2WAxTL73wlAZVyD0ZdRVTjfnRQIkQAIkQAIkQAIkQAIk4NcEOCPS r5uPypMACZCA/xNQTodOSsdQd2bVLHx6MNlpZc03v8PXv1j3G3SWIO7r/hg9b4fFGGm+FItvhmuO xTEURETxEpblwLa86zcehNjQEYWUPR3TPsHiDO+r4gRrj68UdSafMuNw46GLlqw39dbNdMXZjKdh tdrg9UbqKdlJS77BprRTp4OLZkD/tOXZzhTwdFl2hsoNLoc23R1nuyp61Lk7CtUbNHOmEhr3byQW dvMiARIgARIgARIgARIgARLwdwI0RPp7C1J/EiABEvB3ApZTsKvh7rvv1n3qvLFQmP/EdfO4mPU4 WdYyuO0n2L33d8vMOlvg4rcnYPd1MXvQxTX3vcdRu1MfVGvSU3ewS6HenVC94r14olEhmXPThKfx 6Etj8MPSpfjph1n44H9PoWb9Joh5dgESZCr3jkIlKuiMm+N7P40nO9XAPQPmW+vkPruT2KJo/1RP NVzMJpz1yw6LP7DsPRnSX7s827JHY5p0T5dlZ6zcYNS+v4tajzSXIbgPKpc0IKxiHTQ0OJ5K3vr+ ux3yMIAESIAESIAESIAESIAESMD/CNgmW/if5tSYBEiABEjAfwkoy7HTuQqEBlmWB++dNx7zNada v/NqKwQHhuGFTx7HL69/b5GizDocN/MvTH+xqUupqQftTmcu0BATnlXSB6Lj+6MwvP1gmffAill4 f4X0OjhuwbXRU0lsKFUVLcXJ1Idsp1ALw+EWMdEypHOQgyx3AdrV4WUbdxQneE/HKnOqJctf45bg cO8GqBIc7rX+igDd8myhn+1ytizbeX0zVm6ZuvcJI+003QE8hXo2RmlFgcJV0L5hIfy9Rd0DU9lD tFHlCJt6/E8CJEACJEACJEACJEACJODHBDgj0o8bj6qTAAmQgL8SCCkZla7qqeJwGpOYP7hn80aZ tuDj49G5apjFX+khMctQGPts19a/TzidsVi9x+t4/Sm9gbJAtY74+tdJaFbSuu9gWKX22L58Fvq3 rm4Tp/tfoForDHmlSdrp20aEFVfLRZCzvQtLYMCvXwjDof41WyC0kNu9F42FQtVyjWURrj05vFB1 PPN6WzVeuGxaeKd/mgixPLvD0I46eQHV+6FtzSK6MKUUV/XNSLmGYtHo20lvWHwuplZaXcLRsHt3 Xfk1nuuEiloOulh6SIAESIAESIAESIAESIAE/ImAwSwurcIGuyVRCQmeLkTTSqHbXwhEROi/DB48 KKbs8CIBEiCBXEXABJMyNVDsI2m0HBajVU7E3bREIUDEWQ1z1/Hjiy0xbKX1/dVu5GJ83qMarl+K x9Vkkzh0JgyRJSOkEU8rTXGbrifg0tVr1gNujCEIEftERhRyPEnHdFMUHBAg5NnMgfaSLNKQcOkS RLEwhhRCZIS6BNxZaksOUVlly8xgF3JNSvzt26LoYFG2oxRP9Zc5hTylxNu3bYfxyBidI736eluu Ug/rpRwEpCtKNEKaThA6OUTapaWXBEiABHxEQNkiRHutXr1a66WbBEjAhwRiYmIs0uzMET4sgaJI gASym4C9PdHV/W0/9M9uPVkeCZAACZAACaRDIM1Q5fSNJeKEjdBplE3qLevxzoUiSyJ9M6CQVSgC JcUnvcsY7GicdMxjRIQoN31pak7FsOmuPpZ4N8Y5T/WXJVrKc2IMlAmsjvTq6225bg24Np3sdKCX BEiABEiABEiABEiABEjAvwno14z5d12oPQmQAAmQAAmQAAmQAAmQAAmQAAmQAAmQAAmQQC4lQENk Lm0YqkUCJEACJJBxAreuWQ90USRcu5VxOcxJAiRAAiRAAiRAAiRAAiRAAiTgOwLuVn/5rhRKIgES IAESIIFsI1AI3b5ZjdYXxT6PYolvWOHIbCuZBZEACZAACZAACZAACZAACZAACbgmQEOkazaMIQES IAES8FMCxmCxz2MZb3Zm9NOKUm0SIAESIAESIAESIAESIAES8CMCxri4OD9Sl6pmNQH70wKzujzK JwESIAESIAESIAESIAESIAESIAESIAESyFsEXNkbuUdk3mpn1oYESIAESIAESIAESIAESIAESIAE SIAESIAEciUBY82aNXOlYlQqZwisXr06ZwpmqSRAAiRAAiRAArmOQExMjEUns9mc63SjQiTgawIG g8HXIimPBEiABEiABPItAVf2Rs6IzLddghUnARIgARIgARIgARIgARIgARIgARIgARIggewjQENk 9rFmSSRAAiRAAiRAAiRAAiRAAiRAAiRAAiRAAiSQbwnQEJlvm54VJwESIAESIAESIAESIAESIAES IAESIAESIIHsI0BDZPaxZkkkQAIkQAIkQAIkQAIkQAIkQAIkQAIkQAIkkG8J0BCZb5ueFScBEiAB EiABEiABEiABEiABEiABEiABEiCB7CNAQ2T2sWZJJEACJEACJEACJEACJEACJEACJEACJEACJJBv CRjzbc1ZcRIgARLwgEDS+ePYc/QcTMYQ3Fm1FsoVCdLkuoXdv8/D/AVrsPHYMRiiotC2aR+8/GxL GN3m04jIJqf7emSTEnmwmJznegvbf/wW3288g4K4gdrdXkOPJmXzIGlWiQRIgARIgARIgARIgARI IC8QoCEyL7Qi60AC/kIg6RzWLluG5Rv/wsYdRy1aR0XVQ637W+KhB9qgWqmCuawmV7HoiQGYkppi 0Sugyov4ZUo3hKZpefDHDzDwi7VSZ7MwRi4/tR29+9TFBjf5ZIZsc7ivR7apoSko4dh6fLdoKxAc rAkVTuEPDyuKylXronadSggP0EfnLl9u4HobZzb+gh07kixobjZLRI/cBYnakAAJkAAJkAAJkAAJ kAAJkIAkQEOkREEHCZBAVhIwnd+G/z3+BnbCrCvm2LEdUD6/zNqDmcvexl3aCYe6lDngSYrHXvNt WbCxYhHpxu3TWPrlBtVvc5mTkZJ0wXU+Wzpf/088jZV/bsQFxWZa6C60bX8fitmMeO7q4Ws9PJR3 bsdKLPxFNeI6zRbQFB/Peg8NytgZK50mzoHAXMI1sKC6y4rNSJ4DNFgkCZAACZAACZAACZAACZAA CaRLQP32km5SJiABEiCBjBK4hO+Hve1ghNRKM4tlpddv642U2vgccYfeiZg2hWTRhhAjbLY93ErG JY1RtfO7U7Fi9R/4aeEQRBV2k09K863jxtntGP3FZEyeLD7jF+LCLQ1Ld/XwrRoeSzMGeWAyu70J bz49E/GqLdhj+dmSMBdyzZZ6sxASIAESIAESIAESIAESIAESyCABzojMIDhmIwES8IKAmCF46LhJ Zghs9iJmDuuK0kG3ceX8Maz7+VuMX1IehYMMMo1zx23cunVLRAUhKEiaBJ0mVdLdFgasgCCR1n1S S36r3AA7uaFoM2wJWgxOxE2TWDIcrpmuGWQUe/KpV5XKdwojZRCKpE2adJlPzeKmXLtEoiK3lMqI K0jUx9kVFKIJNxREgK7ObuphJ+y24KaUFRCQPmM1q9AvSbSLV3nU3DBUxAezx6NWwRRcPr0N414d K43W5ltzsfHo4+hSNUKTQXV61c63b0FRU2Go56PK887lOVdF7q1bYvl0QKjT/uhNPW6Leii3gbVv 6xraO/WZmgRIgARIgARIgARIgARIgASymQANkdkMnMWRQH4kcOPUfmwyp8qqd2nbDKVDFQNKAIqU qYZOL30iPjJaOG5hy6zPMGXtYRiK1MOgYT2RunUxxo+djeNpsxAr1X8Uzw58Ek3KaQ1UV7Hll4WY t2gudhxTp9HVb/sEevfugXq6tKKY25ewcdE8/LjsRzV9gbro9uJj6PGIsrRZHATyw1f46u9TKHz1 Kmo+9R6ebVESG6dOwG8n4rFRU6dPn34Lu5oUwl0dXkCfJiWc5CuvVjDdchXdrmLPhpVYvnwjftkY q+YVRrtmj7bHk70eQZUiyiM8CWuEPrO+/1NNI2YSThr5IYqLWaaGig/htWcbYI9DPTT6CBm7Vy7B 0l+XY3na3p2KsAJRdfFo2854rGtLlLTYObXtUgMvvdYbqdt/wpefLVDbpdkTGDToSdQq5sVy6gKl Ubx4OMKFITq8yAN4e+xZdHtzllofB5d37Xz74gHMnjwVM5Zvl5K6vTYBPerfxNfvTsYx0aeaWtq2 dFq/ixfproqwkaK9bQe/2Opui1P6QmkX7WxLq/TfGug/oD2OLhyHKcsPW8p/69tf8UCUYsb2rh63 RD3maush+kLvwV2QdE5YJXmRAAmQAAmQAAmQAAmQAAmQgB8QoCHSDxqJKpKAvxMILn4nKsIgjVXz h7+NUp++j871y6tLnXWVvI3zO9eJvSOVAziO4ZXHftTFKp6jsT9iWN9YfDB3CpqUEo+y2+cws39f zDjmaJSJXT4Hyue1yYvxsG1m3a3T+OLBp/GjZg9ISyGpO7Hgi504bpiET7qWx5m//8SxtINAAv6z Hghy8cR6bNx4Q6+TyCdshri3fm8RHuk0nyWDR+VGYc3YPhixPFFfhuIzH8eGhV9i488HMXnZMFS5 fQrL5yyXbG0ZdmxcbnEakxvgZYgDTZzUw5JAGEUXvt8HX9rXR0SmHhMsJu/Ewm+3Y/KSIagSqm+X Ib2W2oqT/49umINX/4rH5F+EbqHpzXCV2UT7qW5Tkl29NXFet/OVOLzX7VWdIVwpacH/DcQCtUiU tbStqN+h9aLfWds28j+tHvo4W3rnXPWc3hyg52SZG+xlf719cSfefGyInClqUV30hdmffWZxGqIM MB/TLMfX1I1OEiABEiABEiABEiABEiABEsgtBLhHZG5pCepBAnmYQECxsqhv0DxuhAHl89f6ot1z Y/BH7FEx/9Hx0h7A4RibFiLkjJyz2WLD2rdgvM4IWb9jf7z5smIUVK/PXv1J7Otovbb/8IGDEbJe lLrM1baDoVYPWxhupG/wcZpPFO1ZubeQ8J+6lL1SvTZ4rNdjqCuMubbLfHsFflx9Egi9A7Uquv9N SYl1pc++BWMdjJD33XefrRjLf7NpKQbN2WJxa+XoEmk8im6/bj2jCUnHab6BazfEUnqxdPnUnj8w dvgiNYOY9VehtLoI3rt2vo2N37/jYIRUhTu6AjWMZXunJdPG2XJqeWjTa8NtaW3/r5tM8LYem2cO 1xshbcLE/6ioAjRCanjQSQIkQAIkQAIkQAIkQAIkkHsJuP/2mnv1pmYkQAJ+RaA0Hv+0P358bZJO 69SjK/DRayvwcaWH8emYl1GvlOvlvJU7vYHRz7dDxOVYjO79ljQu3fx1LU71K4ufp2yTsps/Px4j e9Sx+GPq3YUHn/3Q4jbfnIm/jnVHh9Kn8dOMQzJ9gco9MfWzfqgYbsCVU1sxe8TbMBUJkfF6Ryg6 fLQIbRP3YXS316Qez4ydix51C1v2AFSWSzu9kg56WG4oKsc8hk51S+PhDvejSrE0Q9zTnfBFW3UW 543ryaKYwug+ZRlidv6Anq9PtRYrlpd/NmcMakYYcFvs2xjq1NQrkt46ouNWoNKjmDruJQsHJB7G /3V+AUvTZowmzV2J432sTLV1s7ZLa5j2L0JvTfte+u+aNpl7t5hNOuSxB3VpbDP8mg95DfUsS9BF 9K3jOn3Tb+czWPZjgpRrCOyKyfNfQJXgC1g4rh++XH5dxmW1Q2H74RvtEfrfvyhUJB5zveqvoh5L 1dmZOVmPrOZE+SRAAiRAAiRAAiRAAiRAAnmbgGaKUt6uKGtHAiSQswSK1++Onya/h6bamZFpKqUe XYohT7yFrRfVWYBabYPaDcJngx9CKbGvZGiZBnjypeYyWjlt++KxOKzQ7NcYWdiAs6eOiSW2x3De FKIr85aYjXbj9BFpQFQEDXj1cavxTbiLlBNLmb/9E4NaVVCinF7KISGh4WG6w2qKFokQh6A4P4jE JsTzcgNQo+MzGPzkQ8IIGYzEK1dw/vx5XLySjOCKjo/tAHHyStEiRW3FAOKwmrAIoUtoKELdnNRz 48RBHbenX+olOSC8Cp4a3UvKNKcexenLN6VfcQS1+19auwShbP2OGFxPnRP47+Ur2tXWunyeeJRl xt3FnqAjH64pk984vV+nb/rtfEjXzt1GdLPuqxlaGo8Nm4a+UZoDfmQpvncYAtrgS2HgbVg1CrWb NsUdiYf8sh6+J0OJJEACJEACJEACJEACJEAC+Y0AZ0TmtxZnfUkgBwkUrRqDMasa4+CmlZj1zjid kQhiVtx7s9Zj8eAYcfa0/mpcu+b/s3ce4FEUbRz/XxpJIKF36UV6B+kSiNI7CtKbAdRPmoWmiHRB mvSOFKX3ntAEFCQgHcRQBaRDArmQdt/s7m27upu7hATefZ5kZ6e8885vZmf33p2CAIVXvjIV2NVB wYdtzPIgqqoiFNg8sT82q3wsLjzlKc7wrIlyRZXSLeJqvIyDbSOqKrmefGPvI3TDKqyat8Vq/UeV TPOFchlFW+E2/Sz0qVI0kyqaf1aFcZNNgze+VOdSvWxxVb0opyNfu3iLmYirq8JVwi0uPCvWRP5T v6vKGnH5FhKq5bWzjqjOemZTvCsUz6bINQA5cnuzJUhtLQygiOYGZ+1P2qIEG21r79DVXl9hOezp T/5EgAgQASJABIgAESACRIAIEAGtBKyH1mhNSfGIABEgAkki4Ie3azZjBsmdmD6olUpCwuNIO6Po 1Ea++IQ4VTo9Fz5e1t9f5JUh9UhyPa79fNnU3X5dMJZtriPuEu56bk4ksHUajQlqQ2P8S4upy+pq gCnWwkOVhQ+sSasiyBfMGLxg0lgs3rEIHQsz46D5CF88FDv/ttgUSAx0craqZ0NGtiu3feJOxL2y 4NelHK8MIGVMBIgAESACRIAIEAEiQASIQKoioPl3YqrSmpQhAkQgzRHgTFxqM5APyjXvh4H7d2Oq eVdqD395UxJlAe/eE6b5iukfRFyVg5kRK3eAuivrN3sD2hbxRazKruYJbgqzDzNGRUfIycFGVJ67 ZUSx4rbzVsR0r9NBvtGXj2K+YqRenR7D0btpFeQKiMX6Id0w/xS3NqTjI8GRjVBMmqDYdIeNSL1y N5qtxxgohkIlg607mSWjDx5Koe51vIxluvgVQqev+2NVn8mS8Jnrj+D9oe8Jo2SV+rIYTuv5b3X5 /rr+FGXKiqM8Y/E0WtVApDxFhzFOGe48vpjO6TmFy+FUH4pABIgAESACRIAIEAEiQASIABFIIQI0 IjKFQFM2ROBNJvDfsSUIrt8Tq8PO4KnCOvjk4l7JCMnxSYy2PfrtyoqhmLHtgjBa8ul5/Dp1j4TT wFZqTJ85Kwopdjs+foJZGtl6jX7cGonmPx82UTiK7czMHZ6+8lqG3PWc5dvxyGxzin10BctGNMaE bf9wQW49NOfrpZiczgytPboGI3/WTMyIyvZreZZoW6d4xRRjZuQ8wYxu3BGr4G2Z0DODbHTkwhZt 2g8hFZfwLtbNWiYlMXi8hWwWBl8p0A0O0cjsX7w2QirKGwW93PsLws1rh/pk1FfPXHzl8fOaUHP5 nuPIwrE2DLoJiIuW+Z5YsAqn+Lyf48DCMTbiK6Vrdyd/ObTrQjGJABEgAkSACBABIkAEiAARIAIp SUA9jCglc6a8iAAReGMIPPv3BsDWGJw7pj/mslJXrPUe/KOv4sgpZjBUHK0bV2E7PNs+tvz4KbZt rIDEq3+pIvi2aYBi+cqgFTNeiSMrwxd/iT6X26JlUEl4Rz9FxNmjWLf3JDyLfcJ2Xf4AAXkrIYRt VCKOOow7PBvt3j+K9xp4YC+Lxx0t67u/e0ynNV8Lo+LihTvxYaX02DNrNLZdtT3U0S/bW7wxVpzK vaj/YJwsdBNnM/8PWya/r2ImXqTLU5HfYEbkFrtnGtpGnMNHdTPh/JL1+AvyiMLKvRuhEDOEXhIT J9s5I4LatmRGv9VCDqzdbAg9jxpsF3SvnDrrOWdJq3pu3eAoKiSeVpVNLkoG5K1QBjj1p+DFDLqD 2r0nB7vJlfzlcJOiJIYIEAEiQASIABEgAkSACBABIuBmAjQi0s1ASRwRIALWBDIod3RmwaeO7LUy QnI7MHeumdc6scLH0ggJNl14VPsqLEYGBA/4UhETiDiyHlPGjMHEKTN5I6QqEBnR9OvP1V5sarJo hOQCLj4Q1keMUxjj1AnAxljaP2yn05avf/7SCFbsLn545Q/4fPBIu0ZITgtD1sKoYRDHFTIPZsA7 dTUBHlmFNRdt62PNLTEiFCuXrFMZ6jyKfsQMcsLu1bblCBwsw2ybTIW4lv+Vk6BzVWqg2uk8fGEo rvEDPq31dVbP733aVZ0Vq2elgVUdCJRp0NjSy+G1ZZnFyPb8hXD95WjUv7coWjg7KYc6Ml0RASJA BIgAESACRIAIEAEiQARSBwEyRKaOeiAtiMBrTSBvgxBMH9EXNQsrDGViiZkxseeIWdg6tIndHZaL Ng9Bn3aVxRT82aNIMMYtGYuqWYWRi/75g7Bj5RR0rFVUFU+88ChSEx93ryTlEVi8KTbMG4XgwtYj H2t/MBAjmrzNknrCP4scbvCR3XyYKJydM/qmU1zZT6cpX79iGLRigpVuXJl7dKoj5WNQzOAGsqDT 0tEqAx4X0YNNQ2erY9othzNuLXqOxJq5IcjNV519ORyPrLnzSboVKpwVSiJSgNnh5S9PvzZ45EJ6 H8Wu0qz87UPkcnJJRPLO9LWs52yVOmHhd70ss0eLPp+pjL1ihHR5g7BiYj/VVH8urHbnkVg0e6gY DUJbsMfDnr+UHHrLkbncB1g61lqvyh98hdkzvpAEq9uE5E0OIkAEiAARIAJEgAgQASJABIhAqiBg MLFDqYnBoPgxyAIiIyOVweR+zQgEBqrXiNu/f/9rVkIqTmojYIyKQnRsNOLZcDmvdIHIlIkzlFke Ruwc8QF+OCKMSqw7eAFGNSsK49NHiHwZDy8vf2TKGmAjnSAnwRiFp5EsD3bp5ZUOPmwTnAA/ldVO laEx6ikio1/ycf0DAuBnsbtyQiwbjsc2uuE2u1EdbJdpbglGzt8yiItnN51ZiLN8mQREPX2KaFZm BguZuXUiObkJsexP2HjHLEpxEtLwevkwTgHyZHdn+ii58fllYvlZFJnLyJEcR2EKJXlnAuPH8LE8 bGTC5cOFsz9PTx/bfPXUc4IRjx5GsjbhBf/ATKw9gLWxllIbq/O/Ofi+TQlZRSk+kM4/M+MotB9b Otsrsz1/ORPBpeTutL3q0MsyH7omAkkhEBQUxCezeF1MiihKQwRSPQHL30H0Xpzqq4wUTMME6PmS hiuPVCcCdghYPkftvT+Kg0zsiCFvIkAEiIB7Cfhxhj5pXKI22aZYYZKvX6asdteQVEry9AtAVvan 9fALyARH0T25XWJsHcyAZstQJ0a1m84cwVm+3CjDAFZmy5LYM8wJYoU0og7KszN9tHJzJMdRmFIX zs0bcC09FdeCgde2kZJPr6eePf2QNadslAWMipxsOK3iC3Fs6WyvzPb8LXPTyp1Pp0Mvy3zomggQ ASJABIgAESACRIAIEAEi8KoJ0NTsV10DlD8RIAJEgAgQASJABIgAESACRIAIEAEiQASIABF4AwiQ IfINqGQqIhFIiwTiohMltY1xkpMcRMBtBFRtzG1SSRARIAJEgAgQASJABIgAESACRIAI2CNAU7Pt kSF/IkAEXiEBPzSdsBq1nrB1Hr3Ymn5s6jQdRMC9BNRtLDAgq3vFkzQiQASIABEgAkSACBABIkAE iAARsCJAhkgrJORBBIhAaiDg6cPWecxpuTpiatCMdHhdCFAbe11qkspBBIgAESACRIAIEAEiQASI QFoh4HX+/Pm0oivpmQIExN3LUiAryoIIEAEiQASIABFIIwQsd0FMI2qTmkSACBABIkAEiAARIAKv iIA9eyOtEfmKKoSyJQJEgAgQASJABIgAESACRIAIEAEiQASIABEgAm8SAa/SpUu/SeWlsjohsGrV KicxKJgIEIE3hUDHjh35oppMpjelyFROIkAEiAAReIMJ0MjfN7jyqehEgAgQASLgdgL27I00ItLt qEkgESACRIAIEAEiQASIABEgAkSACBABIkAEiAARIAKWBMgQaUmErokAESACRIAIEAEiQASIABEg AkSACBABIkAEiAARcDsBMkS6HSkJJAJEgAgQASJABIgAESACRIAIEAEiQASIABEgAkTAkgAZIi2J 0DURIAJEgAgQASJABIgAESACRIAIEAEiQASIABEgAm4nQIZItyMlgUSACBABIkAEiAARIAJEgAgQ ASJABIgAESACRIAIWBIgQ6QlEbomAkSACBABIkAEiAARIAJEgAgQASJABIgAESACRMDtBLzcLpEE EgEi4CYCcTi3azU2nbgPf0SjeOPeaFY5l5tkaxHzqvPXoqP+ODEP/8XlG/cQ7+WL3IWKI0+gt34h lIIIEAEiQASIABEgAkSACBABIkAEiAAR0E2ADJG6kVGCNEEg5j6OHziAwydO4cSFG7zK+fOXQvFq 1fFu3Vooks0vDRQjAf+dCMOFCy95XV9WfYFmKap1SuQfhQOr1+LCoxipZCUadED9t7NI1+51RGFP /2H41RTPi/Uo2BkLxzWBr3szIWlEgAgQASJABIgAESACRIAIEAEiQASIgA0CqdAQGY8D077CsL2X kfnxY1QfugTftChhQ3XyIgK2CSQ8PINxn0/ERZhUEW7evADuL3TjZfy4+FPkFgfCvbiLo7+dwKM4 Ft0/N2rXq4LMnqqkr+zCy98g5e0H2S15JrMjufM3XjuB+ZtDVaU4+m9eVBnXEoEqXx0Xjuoz5hGu mBIkYZ75kpyLJIMcRIAIEAEiQASIABFwD4EEhP/6E2Yfv4mMz56hdLdv0atuASbanj9gvHcNZyPu 8jM93ipeBvkz+ehSxdX0ujJLg5GJTxqstNdG5XiE/fA5Bu+6hCyPHqHmt79gTNtSrHT2/IGoG+dw 5PRVxPpkwNuVa+Dt7PoG37ia/rVBb6cgxMcOmCR46zNExv+HRWMn4IzRF86btBGGLO9h+FfNkEGX Yi8RsXcNzv0WyafyuhOtKzVFftMJPMWmyZOtjJAqKqYYRCcwI6W3YNgz3j+LmT//IkQxlESpWpWZ ITLljX4qHd+Qi4jj+6xKmnh9NS4/bIqq2fR1T6Igh/XpmwvVa/sh/LDQrxjSeSGV2JxF9elMBIgA ESACRIAIpBECT2+ew28HDmH/wXCcunoVMBRCxZpFUfGdmqhXrzbyBeh9l4nF7eN7cPWUkSfg+VA4 A/b8n2FTxz6Yn8h9TQc8i32CrfM/0PA7jY/O/rmaXpTjvnPk1d+wfNOfQLp0aqHsOiBDZhQtXgFl yxdBQIq8wKU+Pmoor+9VZMQBTPjhFxj9/flC+heuhwH9WiK76paKwaF5Y7Dg8A0WJys6jxmPhgWc WymSi9r9S4exYe0GrFkXhv1nzgAeZRHUvBzqN26JDz5shbczi6NgtGoQg793rcLp/c/4BLJdxJ7/ Q8wqUg1DE4R+w7vSVDwKH4AArdnB1fSaM9Ic8fHZDRg9czcbLCS0Aymhnx+yZMqF8lXqoU7dcsis ahdSLDc7Uh8fNxcwRcXpqzLjfeydsgw7FCOKHGnr4ZsOIYOYIVJfLkgXKD9ZtN84jjShsDeGABvx dv2mPOLNq2oXTOr3PnJ6JyLy4U0c37MaS0LzIMBshOS4ePsoHgoGf3g6MkImJCAuMZHH6e2tSOcU MEsXw14SPb3h7S23b8tkCQlxiOOjsXie9uNJ6ZKoT1wcmwrt4cvykCTxDr35x3HKssODsbAQxfs7 /JdwF39suWYzypEzN1G1fmGbYaKnkLeHFU/H9emLWp8sRLWeLxCb4IP06e3XYQIrWxzj6+mkzkR9 hLO2elanoSsiQASIABEgAkQgbREw4sjPEzBiySG12qZrOHWE+9uLxVML4Ye181E1q74fQt7+8l6i SpOKTX/22+yc4neZV6FMan2cXbma3pn8JITfPRWGdVsPOk7pWRM//PwtquaxMFY6TqU/1B18om4h bM8RPOBemdPnw3tNaiGr7pdm/apLKV51/pIi+hxXtk3E+Pm7FImmYfezvTgxIljhF4/zq2dihdlQ 987Ab5JuiHxyGauWb8G/MSYYMr6Nzr1aIrfmW/c5No/ujlbfrlfoxpyJZ7F/M/e3Et98Uha7boWj YR77vz3UiYUrXzt2EZv+kf/i98RYSUy6MtkktyaHq+k1ZaIv0rV9v2La/LUOExm8m2PnxdVoWETZ YzpMkrRAd/BxqZ0lTW1Vqledv0IZzbeXmCbSYrqr6G/rbDIZ2cBhOohAyhEw3o1AuKKNNqxdBTl9 uae9JwJzFkFwl2HsT9QnBsdWL8XGzYqXyMRwrPhpNrIgBoa36qL3h1XgnRCJy+G/4/DhEwg7cV5M zL5650PVRvXQuuV7KBgo3kpx+GvDIvx6/DoMAUXRpXcrJJ7bjRWLtuOmOWWBqi3Qo3sbFM8sT52J exKBLb/8ivWHzfKZ7FY930fMfRt3kAv6dOhYDzd2LsGvhwUDYN+Ji1A3nx905Y8XOB22HVsWbVaN PK3K1nZs3aEpCqbX9nb1/Nop7DMJRl0ZquA6EXoKT5ghMrNlQMJTnNi7DbsO7MKFm+a0bBRrky6N 0fS9Mvh7nbP6LI/LW1dgxenbyPD8OYq3+R8+rJZXkUsMLh8NRdi+IzhsXluUCzTkL4nGtd5Ho0bv IBv//pC0elZkRE4iQASIABEgAkQgTRJIwLGFgzBi5SXH2jOj5L+PopkhMhmXgfF7C0HB6XF0bxSv i8FX50wPV9M7JpCkUC8fDcaEhKP4uscy/LojBDm0vXYmSRe4gU/0nXCMmTlPyN+jAioE10RWv5Sb efWq808aeDZQJF1uq6ThIwdhW5dwNCsgG/OUBjmrBDo8Iq+GoVP/r/gUBs96eLdjC+QO0FJP8dg5 tAFaTTjuODdmlLzyXyQzRGZ1HM+V0MCi+LBTZmxZ8ZCX4uHvA5mUBsGupteQhd4o3umcz601xW1F k/KjcO3pBOQXf5LrzUhLfDfwSXo706Kg8zivOn+lhvqqKqAU5v15hF9Lj2vU3ojEot4tMec8G13F DkO6bth64H9sYDT3yYf9eedFMRs5xMfEICY+Hl5s11pf9sB09xHD5DPx8PJl8jWLj0fMc1aOZNLJ 3WUkebYJ+GTKjfwsSDT6bZ82GdmGfY7g0nmtR+zF3Mbhzb9JcUWJF04c5p2eMWXRlbXjk/MGYbp5 Kq8Yhz+bbuHPncvx556rGMfWnCzI9/QJeHjhGFuLkttg5ibGDNynSsJd3PhzC747+QjjFnyCgr4G JDy5gAmfjlUZ9cBkb1q0iE9ryG+A6SabSs4fcTjmgj4Th6v14cyc+vKPwZHZ/THLBo8/w35FzFul MbRhEbOujk4JuPT7USlCwSaD0Lv4ZYyYtp33S7y+HpfuNEeNPLKxFnF38XP3L7HL0nhpuogdP1/E zbg+SOe0PtkGPKcP4aZ5AyDPJ0LfxWfKjJw7pw/E8hNc3akP002WB/vbuaY+xi7oxepNfz2rJdIV ESACRIAIEAEikBYJREfsxhALI2TtTl+hR/NqyJ4uHv9e+BMrRkzFUfa+EidP0pGKmhAby2ZlcDMu fODj46oVzQ/Bw7ag7sAovIxnU5cDFO9NUo5sYjfLkzs8fXws3oe1pefSJk3vBMQaWd5JLSub6j5u xTSU8Y/Dk1snMJWtAf+XecCBKfYXHIlgH8GL2zb0cmVmmPkyO8PsKh/76QEfX0Wd8DOvOJp2DqYw 1za4w4fVlfbDPmdd+WvP8NXEZMa8ThM24tGcD6H5J75ZU87+YGSznby9/WzaH/z8FaNrPQJYPG1F jDyzFE0sjJCthy3CqJBGeIu128u/78b4Vp9gCxu5HGNjfIkzvbRpIcbKgE7LH6Dt7Ccwxvshc2bb 23FythLu4Gwlao7a0nNpk6Y3s7dEsWnjduqAk+vwYFPdt/x9ALUDY/DfpVB88m4PHDD/Lkx8MRFb znyJzyrZNvRyZeYm8nn7ObcPucrHfnpAVztjBi3OZsYdvqyutB/2OevKX3uGSYopj/3XlNwL+YqX RoXSpVGa/RUvXRFlC8pfrXzfr4ZqpYvzYaVLV0Dp4tkVUl/gyNoZ6N20JrLkyIE8efIgR44syFSj CYZO38SGQSui2nGeWjkaTZs2ZX81UavjeFxhQ6fl4xH2LmbhNbIwuZz8HMiRJRDNPv4Oh/5+Ikdj I932TuyLGjVqoGazz3Ho6i0cWDwM1QOzIodZp5odv8Pvd8U1WRRJyZnqCXhmzolSBkWzZga9ZWO/ RNehs3Do/E3eRC4VwjcHijn5bOLJ1uSJeiy/ReYvVQuNWzZGSeXGMQlHsOv325JY5QYvkqelg6XZ f+Ye803AqQ1T1UZIRdz8+T0URkguwL36GONjdeUfe+8vlRGydO0W6Nr1IzSoUkChtQZn3C0c23Vd ilixUgkULlGONyKLnvtPyuGc37mts62MkKUYH/Hw986ioT7ZQ9fOBkBXdsy1MkJWqVJFFM+fTQn7 8P2Wv3i3Uo4qkvJCqmelJ7mJABEgAkSACBCBtEnAiIOr56hUr/O/aRjduzEK58yKgEw5UbJmM4zd uxY/jp2IOgVFI5kRZ8JWY9yg3ghu2BBNmjRBw4bBaNBrIGb/egD35dmUKtnOL2LZ5jbT0G/4SIwc 0A+LDt1QJHmOY1sXYWBQfZZXQ/4vOCgI30z5BVeiRIuIo/ScKK16x+IYm6req1cv9B78I07duYfw rXPQM+g9NDSXtfc3C3DukfXHXoXC1k6P3MiWLYBxzYr8ZRti+MQu1nFUPs/4Mg/qFcyXt0kTVu7g IAwetwCnbgr7D8jRXeXjLL0RBxZOQEj3yXKWbCTnnO/HY9yIERi/6Ah7q2dHwjOcPbgBU0YMZqNb Bb25+gqq3xPfzFqHK0/FuuIi6+GsMX9ObCo+ypp/c3mUK8drGTm3PdZd0rqHxHMcWjUZnetXYAYo PwQGBsLPzxte5YMwaNJa3ORtCc+xdlg3VC71sUSBG2E3uEMXdGnVCl2Hb2LWA3vHc6yfNFQV2GbG AWwY2xNlC+RB5uwFUL1FCDbHsun5m3eiTcks5rha9FKJ1XgRwza3+QTVW7ZF23rvYMT6C4p0bMDF vBEI8vBkDPz4P2+DAa37TsSpJ9wgMu5wlJ4L16p3DHaO7o7y5cujQoMQ7I+4gbB5X6CcwQd+5jqo 2HooDt/RZ28xeBbEW3kzM655ULJOV6zYPpxTysHxkC9z/fLefHkDA1m52fJsDboOxf5Ljy3SucrH WXqN7Sz+IQ6t+wkhrRrAwKzhYl0ZPMuh9aDpOMWv8SCqroezxvxF0SlwVhvBdWcoG2i4pAlRL21P xWab3MzuUhVDtgsLrSqzSTx/GLO+OYzZY7rh0LUZKG9n9O2D4/Pxbr9JUlIP39psRKV5uHT8NUyo Ux3jzls35kOrp4D7m8EezN0rcBM9E3Dz0DacP889jM6jWYWlkkzRcW7bFDTafQuHbixk+mgZki2m pPOrJ5ADzYZ9hF1jV6pUMd04grljj2B+gfoYNrgrSmXjvjIGoOnYxahxaSv6j10jxGfTfEdM/wLF WL0nsLUBuW8PBWo0RnCpHAgKqo5C4peldsH4uas8Oi/GaP/FqmBwCAZ1rIX4iD0YpNDr2RP2EI25 hYNh8sPU4NUIY2d2REGfx9i5eAiWH7Z89Pm6rI9HgUb4MiQIvo/vwz/9Q6zRkX9CrPoee/+j9qia md0jjZrjg3t3EJsxp4q7vYtnf5/GEfMXLHhURqXC6dmnnsJ4t5QPll8Q3sbPrw3Ho2bF2QhrdsRE YPe6q5I4jwItMGFEe7yV3oDIO2ewacZkJGTMoqE+xQetJEpwxF3Hnl/PSZ4cowkjuvDy8eI6FoaM kKaRx2w9in9bl5Tiig6H9SxGojMRIAJEgAgQASKQdgnEstk0ocr3tmb4uGV56/J4ZkGlmtUE/4TH WDeyC2YdkdOJCRKv/oW18/7CukXhmLdlEIrJ4zvEKE7OCXY2tzEidFxHZhCNskp/eOt8xBSsiElt SrAwe+m5ID16J+DeX4dw9Sr3nngVgzpts8o34vAqfP77fczbOoyVU8fvK8XPzXijRXkUYWBrjy8L 6Y6lV62tuif3rgL3N3jeZjTjR1C6ykdD+sYG7F21F9cUS0ZxULj1Q7nDK6YqPmOGxaPMuDrKRj2B Te0/vG4Wjmy8jHk7GDMfjpl2znPXtNWQPxt5yWuTev+dNfNL5DZ/MR+9hv2Kpht6Ot6EJf4uprcr hQGbn4rJpHPCmQOY+tUBTPu2N8IjPsaKCSsh5iNG4tZ15I50LxpiOjvbHI9m/AebVsoDngy+vTGu 37t8OtU/r9yo3yK34KVVr/vzUVH3Zhnxdja3eY6VXYqhs3nKtlK3TfOG4EXpBtjzvyrM2156Lkgj T17veFzfvwlnznC2nzOoX3SBMkve/demCai74ybCH65g5dTRH3A/5cyVEffcwpiotNnHX8X3lcth 5JkXVnnvWz4B3N/88If4mB9B6SofDem7mTS0sxhs6VEK7Vc8sNKZW29009QB2DzrOMKfMWZsViVX X5o5X+uvIX8JrXX+yeAjDydKBuGiyOM/9bMyQnIjG5WH6eUyNJ8idMxKf6RjOyQZw/G/976WvQ2l 8Msfo1DIbEY9/tMglRGybs9RmDPxCzk+cw1oPBf/mX2Um+GoIikuTHFrsWxfhMKHnGmFQJbSTTFn 7P9QWTlq0ax84o19GNN/Is48EXoqT7YhTMbAjHLR2JQJ/wxsExduWj+/k4snijX4ED3b1GNGSG+8 iIzEw4cP8STyJXzyOb99vOuEYHjPesjm641crJPvWUoe9v/gWSSe372mWtOySf/GwnqTbLRm408m oa3ViE3X9IFnLYxiBrbyhfLh7cqVke0FewAoXpCc5y+j4lxTPxuDbUfP4eGLBLYGZx5WTi1TjOJw 6Q/5BbVgo3f5KepsBW9UfP99KQPua+TpW4Lh03hXrWeH7s0EIyGLHZinHLpO+Bk9arDp907rUxKv chj/vSYbRllI284tJflIXxBtBrWU4yfexN1n6pdcZ/WsfE+WBZGLCBABIkAEiAARSEsETFHPEW2S Z2RV6hqMfE5efS6snWhlhKxVq5aq2Kb4bRiw6pjKT+uFrU1sXt7+Q2WErPReR3z2WR80r1XUSqyt 9FwkvXor5VhlYvYwJYRi+5+37QVb+5ui8TyaTbFmH8Jvnt2Nid9tkuOwadsFc7PfiebjwtppKiNk peYh+PqzzmIwf57y+QZwpgtX+WhK75cLZcQfqyot5AsvvGSbacrWkyIVg9GuUztUUPyG4Zit339D SqSV846zJg35S2JTtaPv3E2Y05kfmsDrGb2xF5adEgY4vVT8jlEW4o8fe1oZIVu2VLzPs8immIVo MCsCNcs6/gJgb+SW6fFTtlCd3B80GN4Zb9uLbFZOq17BE3Yqi6PZrVwzU7RjGv/ZrjJC1u8yBNOn T2QfUSpYybWVnoukV2+lHKtMzB6m2FVYsOcfe8HW/olReBrFluCLicLF39hvv/Zz5Dhs2nbpQoHS 9R8/fqoyQjboMwFLpg+TwjlH33ozcZedXeWjKX1gIQ3tLAaPbsu/McvX74QBQwegnmK2J8ds+uqL Ujk0cz6aqCF/SWyKOJzcKm7QwXgG8787IAnyLNsXR7ZPRKlMzIr79Aw+L1gPSxOFDvjZ9NW48FVN KS7nyG6KwKKvP1Pt1D0jbAcaFzZ3GMaLKvnNR+/Ayv61eRlt6hRHzpohvDvxxXjsOv8pupe2flso 13MWfhnzAWJPLEDFFsP5+Ny/+3e4UZN0pEUCGQvVwOBVFXEt/Cg2/LhIZWwDW1NwysYTWNCzOrxZ 4ZwaieIe4eiuzWwzmVCr9SSdsan4dmFmXpMP5XTem1fu4GV1xYOPbVBTsjA3alc80iNrDnaL3pRf UPgQF/Sp1rkxirBRhNKh7AE05O+Xrwq6lFomjVrkWK6ayf6YwDodv0LXZhVU5ZXyUTqY8fOwYhTm bfZSf/PWNSSwYsZYfOkOOxGB+vnKsM/GCgFsBGXJAkqqijDmdFqf6ujClYX8ctJUKiHYL4vCWM2m +xtj1bk4q+cY9kppX2NbCpEfESACRIAIEAEikNoIGB9el9Yo5HRLn1n+wGxT19h/sHH+CSnIo0hb LJz6KQpxI4CiruDHlv2wzbzrtfGXMFzrUl6K64ojIUb4kCvKaNmnN+pmZXm27YCed27iZea8YpDt sxv0LtriK4zp2wDxFzeh82DZYPD44bOqKo0AAEAASURBVHPbedryTfwLg9o1UoUYCrO106+aUGfQ YFTMZH6Bi72m4lyn7zR8315gGVQxHxr1Gs/L4Aa+/H71QwSxDVWVh14+2vh64sP5OxD016/46IuF QnZss5opq8aidCA384pNU2W+RYPaoUWF3GjW9F0Uy2o2rPZogZnv9cB6c9uIfmE5Q0rW3i7nRwb8 T0P+sqTU63rgWwwdh01EvxW9JSW/+HIJuoX2RTqF0VYKNP6FmUNDpUuvCp/j1D621ig3i+vJXwjJ Vg0LEuP48KeTt6HRo8dof2wyCgULhipus5qwiM2okcWAOLaeoWjQkwSaHVH/XZDWKOS8AnM4edvX odeTyStx7ps6llkm6TouWj2S+NMJ49AmD2Px+VcYG3EJxhxFHct1g94V+yzCpkkdEXt8FooFywPG 7t0RDMqOFRBCTQkHUD+v/PGB8/Uo68kGCyagzZx5CMrO/bJnh/G8qv7b/HAA678URqq2r1cC/uW7 8tESo77DtrMD0N7kGh9tfL0wOPwJ2h+c5LCdVWz/GfoEFUGfXm1RMY/ZsDqqHwb4lsV0847oUZHW o+v5ArF/djnf9cIMDfmLclLi7HxIl4taRF06hTXmTpQTNWz8F4IRkrvIVI4t9jyYc/GHKf48Ih6o HwyLBnyEgUsfiVHwzcaz6F4li3QdFXFcJT9HNgOu/n2eTb0+j1vx6dHEIBseX8ZZGHSYFP8Os7Bt WhfkY6PgitTrial1ZEv6jfsPbU81l3InR+om4ItCleszg+RSfNvrPZWqic+eazRYPcKWbwZhZhKM kHyGNtqcpIjB22LB8AzI4Gw1bbioj5S5LYeW/APQ+Ivx6NKgkJWA31b9gHEbz1n5W3o8uHRSZRiO +20+hn89HN8OH45x8w6qol/f8Afuqm1+fLh8V6uiu+eCfX1/aV4oXBRoOSXdqvHoqmdRKp2JABEg AkSACBCBNEXAy0elrkkevKLyFy+ir19GqLgUDfPs8WknwQjJRQgohm5jOolRYUqMwK0n9pf6kSIm wTHyw0FYHRaOe1EJyJQnP3L6OX6TclVvn/e/xJSBjVk+PshbqTkGVpQ/vP/35KnVa5SeInFGyA8n rsD3zUpLyaJvXVRxzpLRgDs3r7Kp4ldxL94XNRUjimLNmz9IiZlDLx9lWs5tLz03UydzJsUgAzbz KgNbp86HW6OPf+f3RKnmPTGwa2NmhEyHqKdPce/ePTx6GoN0hZz/THfGmU0VcpK/ZUlS57WJGV4C S3bC4payDeBl2ED8evJfZMipHE0g6B954QRWmuTf/d9NGSYYIbngzBUwcsMQqaCm+LOIeBSPnNlz SH5gm9VkyhIA3wC2PqmjnW+91f0BG+Dq8NCr19/37BugHWbkJLBd/vqYtCoMN9jakNmLlED+AGuG ShGu6p2h6yKEze3J8vFF0QZ9MDtIHuBx/b/7LtlbOCPk4J1/Y31IDUnlyCu/q+qfbR+CiEtncfbs WdyIS48WTuxDevlIGZsd9tJ7eXk5aWdeqN5nDOZ+04MZIf3x5MED3LhxA3cevIBfGcd1xGXtjDNb 19BJ/pYlSd5r5z2cq/mbDdOcGINXEwSVU25gw57BbFMZ6TBdwHOjDauDGIFNyQ6qlV+8snle1K8x KlSpwW9GU6VuJ9VISlsJgmtUQCZFgHLa9sU/r7AlWelIawSsW5A3SjTorJoWbXCw85TSBmW8Fo5f bwpfzDgOVdt9ismz5mLZsp/Qga1n6PKhVJaNLrzwr3IUbhwioxNVWbhdH/kZzeYnOM+fV8Y3Nxr3 GosFMybis4+CVfpdW78bEapNpFTB7CIG5w/utPS0e81tDnPymsVdmBiOy3e1P5iV9Wk3IwsO1+6r 5XOjNaWDrSOaKYMb6l4SSA4iQASIABEgAkQgTRBIkKdhcvqyvRccH55s1JF4eNZElaLKXx1sQERW hZGKrQlofKl8MRQT6j/7F6mFTysqVrVjIwvnjvkCHVoEY/zqY1CP/7Eh30W9q5ctrhpFppxOfO3i Ldgfz2Oti2fFmihkMeot4vIth8bMzRP7o1O3XvzmOd36jOR3MFdKdpWPnvROazT2PkLZhkPcxj4t WrdGhw4d0K5dCFZdlX9/KHVXurVwdpq/UmCqdvuiw/jZKg0/Hz0TR6Lzqvz4C6X9wbs53qugsDew CAFv5ZLTsLX3nhvj2Iam6ntbjuDAZVlFTgZI81PxzOIMGvVykLvmoMByrTBNYfzjRhZ+1SkYBbP4 oNukHXjiTFISeCpFvl+rMhQ9HZTTic8f+9t5f6QQ5h3UAuIGRqL36RNXHBoz53avh6Ily6Ec2/Co ZJW2/A7mYlru7CofPemdtrOYm1j5Qz9+Yx9ug+eCBQsib95KmHDGea+phbPT/JVgktmd/IZIZQFM kYi2+AoVH600vLDIlje0Kv0FDBy13WFDU0a3dKfztmFJfukgQ0M61YxQS3l0nfoIPDi9Dl06fc3W LbyEyDj50fvsn8NYfEH+TGWKURia4hVtgBm5zpqNgXFcei9Fz8umBH/QphbyZA4E28QKcc/VRsKk 0PAOUL+QbthxlK01wh0vcGL1TPxq3rhFku1mfXz05h/zCP/8c4ffPS59tnyoyb7izhneXlLP4JEd /mw3MrtH5DX8dkKuh9KNu2DAgAFs3aLPhD/O3bWJKvm6Py6yF335SzoXuHLTATwxV2/ck+tYP6U7 5u67KaRzVJ8qyfKFl7960sWavX+Y64HFibuPncvXS5ENbAfHLBkcjySQIpODCBABIkAEiAAReG0I +Ocrqhpdd/TAWe0/otmMC6PF19H4lxYbKSg/fLpELSPajZ2PT5sXt5KyZ+4QfLFcni5uFcHSIwl6 m2IdFcRH++8rZrxdMGksFu9YhI6F5Xfy8MVDsfNv5z/MLYvCXfuwUUGAq3xcTS9qdh+/9OuCsWwT HctNbcQYjs5u4+wok1QU5leyJdaEyEbFmE3TMX3FKX56rl012bqCLyztDy8spgPHJcEIyTIMLFZe Nbpu+5rDzo16oqKa9BIju3rOhv6bj2FaSGUrQT9/1RTvjQm18rfrkRS93WRv4Yy3J/ewTXAiz2JI OXmKdug3TbHEvGaoXb3tBAj2IVf5uJrerJzpJia+Uxqdv55rtXmSHfXV3m7irBaafFfJb4hU2HhM CYfx13X1NzilzcDgWRs5sqg/JfSc+DNGNZWnS5+e1RGLTjyWiSjkc55jwv7B4/t3cOeO8u8+7t9/ zNaHlOXIAsj1OhGIunubjey7xdYt/B59u3XBmCmzMWXMUPT7doGqmA3rlhE33IJfptxQjrNd8/04 jBnCRlBO2oeXygbKjJRrVx/A5fN/YuGQAVhvuXajKgdtF57ZiqBDfvnFKv7P5ejbaTRGdwzBlM1n rYW4WR/PbEV15W+8G45vv/0CvYb8iA1hR3H8aBjWLl8n6Wlia2wkOLDP/seWario+OLYuFkjVKtW DTVr1hT+OHejZqqH+svdx/FfxlJWen7adTRmzx6Lbp8Ow/oTsUhnnmbkqD4V5mdJZ87hnbOkasRs 3G+L0W/oLKzesByjuw3EFkVdl25fF2/JVaaSQxdEgAgQASJABIjAa0yAresn//xle5aGz8bOs7bH E8VGRSFWaeBgoxKv3FUbz1QzLtj6gVkyOhtiqYOtXz60GzQPW35djOF9WqoS/r1sIy4ZHRhflCM/ U1pvlaZsY5lYpqdfIXT6ur8qZOb6I2zPafOh1Jd59Zu9AaG7d2DHDuXfbuzeHYqmhc016AofLtsk plfWefTlo5iv2OW7To/hWLZuI9NzNUKUI1rNxXTHSZm/O+SlrAxftBq62CpLbnqu6lDYB7jRf+HX 1AOflD+nDJ71kFNcm1MhxNGqS1I0b3828lcegMFNF190+J4UrHTEPHmCl4ofItr0Ug/EUMrT7Q54 G/3nncDj62exYmJfVfKT38/A8SgH/YFunm7UW6UpEM2t4hdQGkMXT1eFDJq2lR8ow3sq9OWuJ/3x H+KMkYhkm87Kf0YY2UjYj8tmFOS4woeTkMT0ynYWeXIbhpyRZwK2Hr0cF2/fZ3rewISg5LFjKfMX QKTc/2Q3RHoFZlGVZtz8DWyVO/MRcw2zhv4gXrHRZ0WQm+1MrDweZSyBzybOVXrh6yYTcMX8oc03 a06UUnQAofvPs33H2Vp3GeQ/XzbB+slzxZ2vkkYXrxMBf+UO2KxgF04cxokLN1RF5HY4blU5l+yX OR8qKNaK4AyZF24mwoO1Rd/cxVFLsa7Mn5vnY9TYqdh30+KBJ0tzOGLX8vsw22sa7/b4UJGaOdkU aaWxThno52Z9WK+pK39RF9PNcKxbNBPTZi5SsajWo7EDI10MLh2Wv7h5FGyPotyi0VZHJlTuUkX2 TTiCv26YUL9Pd9mPczFOhw+z+918RDwyjypwUJ9cVMs6EJKnR+2efcyShJPpxhFsXrdTVRceBVqg d2NhdIFtOUJayzD7rUWVJV0QASJABIgAESACqZmATyG0DlG8ozBd5/QfjG0nb0Dcx8746BZCf56A hi1aYMd99WysRZv246lYvti7WDdrmXgFg8dbyOZkrTYpsjOH8T4uXrwJ/jd7zkII7jCAbd7YW0pl 8MiF9D623sGEKJ4Z1D96U0xvSUPZIc5B8S9eW2Wce7n3F4Sztf24wydjVtX07eNss0O2ECP8uLUY zX8+bEJ4FNuBmz9c5AM96eMlcynbUfEoTlwXWkAs12CUa46y0Z892C7s+bNmgg+zR8c+c/BlXyiF tv+O8tcmIVXF8i7YFKFDqznUyZu1B+Xx3cw1eCh6xFzF1EFjxCs2GqEo8mZh92mcXE+muK3Ye/4+ HycmxvKtXk4Kv9L4bHywwgP48t33MH/fRYjJou5cxsrR3eGXJQsW3FLbOTTppZKexIuomzh27CI/ ejtzgTLo9NUc3AsdJwkzeBVCRj/7/UGSeErS3esQCQZWbqUyzj1f8QNC7wgWSL+suVXTt3fvZYN7 fNl6n9yan+Y/P0bjcRTXQ7LDRT660jtqZ4o1R7nRn9+P6IwSebLDl43Te/nITb8mHeUv0Eix/8lu iPQrUle1AUz0r4NQtGZvjJo4FE1yVsSU8+YGwIpcj8Eu5au+CbjFab3zN8POUQ0kKIkxczF4ymH+ 2jt/DXxcR55WeWBMS9Tt+DUWr12LlYvnYMjHzZElT2GUab1MfvBLksjxuhHIVbMDRn7WEVXy22ja bG2/Dz4bhYX96lnsYJwJrSYNRGWFQZvjYkjnC0/fgug15SvUyi++BgnEDAVqoV3LqjI+sVdk28/4 ZVTEVS0H4IlM2fNIafLlzwzuu3fGt5ti0uBOqlGZXKTSTULw/cjeUnx+XRG36iOI1pO/31sV2EY1 ZWSdRBfbcbtVn1H4tH5h0cfpuXajiswMa/soWLGWKuC/e8+QoVAQ5o4daFUXXMSqjXviE7bDmHA4 qE8H9eObpzoWTx2BFlUKmuWoT8Ef9MdPYzogB1+9+utZLY2uiAARIAJEgAgQgbRIoFTTrqigfGdk azv+OLg7GgYHsXX+6qNJu64Yu2Q3X7RcBauoNmqJ3TMNbXuPxcKfZ2Fgw06qdQAr926EQtyLoRuO 6JtH8ckn3dCs93As3xqKg2FbsXjWUllyYiTiHfyuTZen4ivRW1bQlisjgtoqRnYy7htChQ/SXjnL oJViBGH44i/RZ8RMbA0Lw66t6zFr3GAEN2mN9l9t440xrvLRk94v21sqI+kiZrge1CsYTYdtg9HC SLh44U6cPXkIP/bqhKWKkZK2aGj1c5i/ViGpLF79ARNRTzFQxFI9v6JBqg1RXiz/BLkqdMaw0YMQ 5F9Mtd5e8Pc9UYbZHwJyFVMZr0Ywg2L98t7I1HwB32Ys8xCv3/l4hFoXtuZknwal4MeWqirHdAzM WwKdv13GRy9c+n3deon5uHKO/HsbqlcvxfbpaYkx81Zi3ar5GDFolCTSlPAQcfH2R0QmhackPNkc 2dC+v2IQCeM+Y+VRPjfvgrXQTzGCMPSb91Cl9QDMW7UKS+fNwIAuwfAOZOsvNlrET6V3lY+e9I7a 2fM4efkyzhj+7fDF+G3feoRUKI6RZ8wDblzk6Sh/9bxlFzPSkJyZ/107XiqmWXKSrL8ZZMSHU2Zg YNXuUkYJ59bgx3PSJe/wKjsQ0z59h7lfsA2nrG+EWp9NQvdR1bA0UcjhwJgmWN/uHtoWtpZ/btsc DNimlq+8siVfDLcMsy6PGJPOqZOAL96u2Yz/i3nxAsZYI7jleDx9MiAwkBkW7Sjtm6cS2137Z7xg Q7a5D5Se7CtqYHphkW/vnOXw6YSl6M7CjEIgMnLrRDJZLdvFITHRg60ZKUr2Rq1eC1C9K/si4+HB NqsT/bmMvVGlyxgs72AdlrdyU0xY3gBPngi7efv4ZWT5C9bN5cvfBfdN1Nssy9dt+nA6CYee/Bv3 Gob3u8bgxXMjY5XAyuiDDGYeojzbZ1/UG7QAdcwvvmo26hTeOatg1fLliEvkSi7zDSxUldXFcvR6 EckWlo7l8/bLkB6+En9BjqP6tF8/7GNZTjYFfNA4fBDzApGsfLyqrHwZA1l9K6uS1aV9OfbrWV1K uiICRIAIEAEiQATSHAE2LXDUvCFo2We8leqW6/wZ4/0QPOBLTO32vRQ3MSIUKyOkS97hUfQjDGrH 7QJttLtphr1NBuz5c4ITI45i8RThxzmfkflfnQFtJaOn7fQZ3KY3l6VlHnp+X5lfG3nNc1VqwNbo XCttPhO+MBTXWpdnZbHWN+LIekw5Yi6wnVPS+QgCtaQ3ZC2MGmzm1TVxF2dmQD11lQ3YfN8b/vmL IZgZq8Sd1Q+v/AGHV9pR1uxtyVIZ2zKM4+wof2XatOQ25KiH8ePfR40hu+yonQmdZs3DJ6U6SOEJ p1di/Gnpknd4VfgacwfW4N2GvGXQlL3zn00wG4OYYWv/GW4nYjYczcFhyFIL6/9ciqxVulrFOmth 04iK89ep13ObdhEuI0ubhZi5PX8uPOH0FnzTd4sYVTq3/mkgb4zlPGyn18vTvt628tDTHwhjHgXV CwZ1ZMt5TZE2nwn9dgXO/a8uK4u1vqfZeqJ9Nwnp7P1POh9Bopb0jtpZQLFK6GTwknb83jiuFzaO s6et4G+7vmyH8f1BEtu5Yy2SFmpj2Jg+QQGKTRtKls4qrbunlBLwdhvc/ms7BjUtp/SW3D1H/IwL B0ehEG8W9URADoV9NJ1gjOGGTY/aM1VKwzlijUKzdSbfs0wTfDv0XfPu2Hbk85I9kauAPKKrZOlc NsujUoIuUi0B3/TpkTlzNmTLlg2ZHRgh5QJ4In1gZpYms2SEtAzjZGVTGN08Pb0VRkhFbLabjT1D m6e9ME9fZObksz/RCMlJ5OSIRkhFDryu7tBHkqkjf09vXwQyTjxbBQ9Jll2HJ18ee2xUybhyM1ay kVcO9U0fKOVtaYSUY9mvT7t1YE7s6cvajrku+PpWGSEVOdirSxbFWR6yFHIRASJABIgAESACaYlA YPH3EbpxPga2e9+m2kVqtcU3s3/h1yP0zx+EHSunoGOtojbjtug5EmvmhiA3/67hCX9umqj5MPiI bn3+/oXeYRvVVBbFyGdDIXQeMgvDm5Uw+9mTy3b0doveXDaeyJo7n6RDocJZ4ci04+UvDATgElhN IfcrhvYhdSRZnEMk5ExfjyI18XH3Svxu3q7y0Z6e0zALOi0drdrkiPP18PWDJyvPoBUTEFxYLAUX wsKKBKNHJ7mc8u7s9uvLPmcH+QvZpcr/3unkdQYDRHuAQtPqg+dhWudKkg+31mMxxVqPgSXb49k/ +zGkZUUpjtLRZ/Rq3PxzAmT0uTH03DrVOvVcfA//DPzgE2VaS3eWyl3Y3pYnMWeAtTGSi1u+VX+s +uMavx6hPr28EJDTbAvhBEkc9PkHlm7ENqoJ5iSoD4+yGLb0KFZKy03Yk8s25tHF074c7o7NXaio pEfpsrkh17TkLTm8A+RVea2mkAdWwOAJraW4nEOk5Uxfz/ItMHZkfX43b1f5aE/PaeignbHyzP57 OzqV8+EiSodn+U74foiinFIHmhTODvKXckwZh8HEDmVWBoN6ajS3oKezIz6eW3/RC178LmSOY8c/ f4oHT6KEkZNefsiePRt81X0vLyCe29WYybOWGQ9x4yvrMDYiUyHfi8n3C8iATBnkB5qonX35TIbd vMXUr885kI30Uh6rVq1SXpKbCBCBN5hAx44d+dJbPCbeYCJUdCJABIgAEXidCVj+Dtq/f7/z4ibE IoptTBP9Mh5e6fzh7+8PPx/bXzATjFF4ypad4odSeKVD5kxsPUAbURNi2Xp17IOs5Ydb/f5Gpls0 23yR6cbyC+DWH7RRIntyxaiu6s3JcZaHmBcfl8244UZC+phnAynDpHDzrBxbUZT6cuX2YXUS4Gdd 8gQ2c8oVPlrTC/onIOrpU/PMK39kClCaX4Qwrg2xRoTM5npKYG0rIcGTrRmpbiSOWNoPc5S/JeGU uQ4KCuIzSu73zPioJ7j/OJKNzGUH22AmZw627p4N+4NQ6ng8ecA2CGGRvf0CkD2zvAScEO7kP7OL PHnyGJHRcSyrQGFNQjuZadXLnm1Cv38UnjxmfVUc041xyMKtP2ijOPbkilFd1ZuT4ywPMS8+Luu/ uD7T146tKZ4L5/s4X858ZHUo9eXK7cfWicwcYF3y+BjX+GhNLyjoqJ0JYVwb4turuZ44m1t8vBd8 LdqTI5b2wxzlb4VQl4flc9Te/e0WQ6QuzShyqiJAhshUVR2kDBFIVQTIEJmqqoOUIQJEgAgQgWQm YPkDSpMhMpl1IvFE4HUlkFKGyNeVH5WLCKRGApbPUXuGSJenZqfGwpNORIAIEAEiQASIABEgAkSA CBABIkAEiAARIAJEgAikLgJkiExd9UHaEAEiQASIABEgAkSACBABIkAEiAARIAJEgAgQgdeSgNOp 2a9lqalQRIAIEAEiQASIABEgAkSACBABIkAEiAARIAJEgAgkCwGamp0sWEkoESACRIAIEAEiQASI ABEgAkSACBABIkAEiAARIAJaCHidP39eSzyKQwSIABEgAkSACBABIkAEiAARIAJEgAgQASJABIgA EXBKwJ69kdaIdIqOIhABIkAEiAARIAJEgAgQASJABIgAESACRIAIEAEi4CoBp2tERkZGupoHpU/F BAIDA1Xa2ZvDr4pEF0SACBABIkAEiMAbQcBgMPDlpPeDN6K63/hCiu1dBEHtXiRBZyLgfgLi/Ub3 mfvZkkQi8KoIiPe1mL+9+5tGRIqE6EwEiAARIAJEgAgQASJABIgAESACRIAIEAEiQASIQLIRIENk sqElwUSACBABIkAEiAARIAJEgAgQASJABIgAESACRIAIiATIECmSoDMRIAJEgAgQASJABIgAESAC RIAIEAEiQASIABEgAslGgAyRyYaWBBMBIkAEiAARIAJEgAgQASJABIgAESACRIAIEAEiIBIgQ6RI gs5EgAgQASJABIgAESACRIAIEAEiQASIABEgAkSACCQbATJEJhtaEkwEiAARIAJEgAgQASJABIgA ESACRIAIEAEiQASIgEiADJEiCTq7nYDx4moEeXiiQvAoXI2Xxdvzl2OQy70E4hEV9QRRMYpKcG8G qVaa8Z9taFmhPhq0HoXLMSaHerqrXbpLjj1lk1u+vXzTuj9x01uDjvqNeISvm4yW5SvAYDDA4FkO /eYfhNDDOEqnVwd3xE9t+rijTCQjuQnY6y/s+Se3PikhX8/zMiX0oTyUBNJqP5ZW9VayJzcRIAKv O4Hkfv4lt/y0Wj9erigesfcnjFh8FAEVO2HGV83gy4RF7JiBEct/hyGgGkbNGIBivgarLI4vHo2p ey/AkLMBpkzrjVxWMYDLmyfju1/DEVCyE6YMq4DVIybjCp+DjchKL6MR/u90xLCO78ClwillkltF 4OKWHzF08V8IYL51vhiPkNpvqcLFi7i4KBwwJcJwKBwPjSYUDhDagj1/MZ298z87f8QX835Dxird MW9EK741/MN0+WLxbzAE1sCE+V/hbRvt7Y95IzBh5zkYcjXE7Ln9kNtGBhfXjcPQFccRWLo7Zo2q hJVfjsNl+NmIaeEVHQ3/mt0xqluNVNveziwJQfmeS2Dw6YjwhytQ0VwPFiV5LS/jov/DltP7YbiQ Ac/iWBG5TsrOkdR2aSnOXXIs5YrXyS1fzOd1O79SblFXsXbJIqzctB1X95+BoVxZFCoXhNadeqJN o3J8X5raeDvqN26HTUKVD4bJKieexYojtzA1BLiQyvobR+WQC0CuJBOIuYkl30/DH+wZ7+//NvoO 6YO3bTxj/tk1E6PmHkP+Jr0xKuTdVPu8FDnY6y/s+Yvp0vJZz/MyLZfTbbqnYL+eVvuxlNT7ScRx bFq/GZt3Cc/ZszChXLl6qNG0EVq3a4+GlQpaVX3cnSP48pNJuI4c6PfjdDQsYn7vj7mKud/PxGXW rykPP78syFW8BCpVrooqZQs6eqVUJtPvTmr+7uiPU7BdOwXjjvI4zYQiEAEguZ9/yS0/rdahS7Y6 480T2L59O3xeNMAPXwm/8b1N93k/YDve/aQbilXIYsHmX+wYNB3bE2OZ/3a0/bwT2ha2NPg8wo4J k7H9fDQve4rxHhbMXoIL7KGi5UgfUw9fdUSqf9HVUpZUF8d0E/NaD8Nmvv6Atc8r44PQAcjsRFFv O+H2/G1Fj75xDJs3b0a6Fw0xbYTQ3rxM93g/YDMaDOiNtytlVSdl+m7+dDI2J7xk/pvR/svu6CC+ aEgxH2LL6PHYfOY5L3tW9D3MnjYf3EuMliNDTAN8k4oNkXGRz4VimKK0FMdGnKfYuXQNrkSaUL1d V1TLY3m/2kiSCr30tDU9cR0V1V1y7OWR3PLt5ftq/V1vjynJLe72AbTLF4wtpgQZ25kzOMP+Nq+Y ji3z/sL6kPJyWCpx2e83nmPPT5N5LQ3ezbE5fApKxd3CqftZ+Weu/XTJVTDH7SHl9UmucqZOuZHn t6Hn+KmScosfZ8G9OR9a/UB/dv0QVmxei3TsneELZoh09s4gCbRyOK5vq+hu8LDXX9jzd0OWr1zE 61w2d8DV36+71m7Taj+WMnrHIGx6PwQPWGpVtWfOHGDP2gOYN34IKvZZhD1zeyKbIpbx7mlMZ78r uCP42/FoaB6AEHl+F/op+jVFEsnpWaE3tq/7kRkvAyU/dzmSmr+r/bH+du2uEtuW42p5bEt15Ova fepIMoWlHQLJ/fxLbvlph7SrtjqDv1RW0aKZr1oDlMJPvNFwx8Er6FPhHSkO54i7eQ67ErmhScKx 9+QNZogsIV4K5ydXsPdCDO9u16E2MgTkxo/LF+FOrGAY8vHxwcNLOzBw7C98nC+mLUT5rAbEcrZN dmTIW87qJVgIof+uEog8uwfTzUZITtbL/Ytx5ManaFYgJW6rDJL6YnsrUOM9lMVk3mi4JexvfFap hhSHc8TdOIvtCeaGwa53Hb/GDJGlVHFMjy9j19lo3q9D53cREJgHM9euxL/K9nZxK/p9+zMfZ9hc NqpQ0d4C8lVK1e0tV6VmCAlJB0O2+sjqZz1CWQXD1kXkFfzQsx8/unVS9XZp1hBpq2jklwYJpKn2 GIONQz6UjJCthy3CiC7vwvvZP9i4eDJGzg/FzWdC35PaasJRv/HS/JEmeOxQNC9blKleFEXMBXCU LlnK6KQ9pLg+yVLIVCzU20elXOTc9lj+SUN8XDajyt8b5ue3IZ1rH4md1LcqU7ogAslCIAn9uovt Nq32Yymh9x/TuzAj5DqppgdOX4HWtcshE6Jx6fAWfNh/HB92al4vFPPPggdTWsl9kEX/JQlR+Ddg z+0v6mRD7PPnuH7xBDaOnM6/Dyf8tRCNii7EsvCH6Go5CEISlERHUvNXpONy1tcfJ6FdJ7F4mpO5 VB7NucgRXbxPZUHkIgJEQAsB0Z6jJa6mOIbs5dC+TnqM/O05joSewKP+70A5Ru3u2cOqkY2b9vyJ ye1KiK+ofB4PLvyJw2xKL3e8V70A+++HWi3b8dfiv7gSRt4QafD+AO26foBSXkkwsIjC6KyZwJ+/ LlDHZVPyluw+jWYhVdT+KXRlyFERnYICMGR/JA7tPoaHX9ZQfe28ffqgamTj+l1/4KePSqmmQj44 d4x/qeBUblS7EPvvh7rtPlKVIO6ikTdEctObP+rVEWXSUHvLW6cr5rG/JB9+/sgLbjnZRGT0T1uj Ib1B/UKS6z21JkxL7THmBkJXPeVJVhq4EWvGij+AiqDsOw3R76tziAwUTXipC7j9fsMX7LMGr2xA RvljpKi9/XRiDDefnbSHFNfHzcVLa+LKsrbxv4FL0JrNlFCOPHJbOZzUt9vyeQMF0fNSY6UnpV93 sd2m1X4sufU23d6LkAHr+YrjRuiHXWFr0xeQ31PLVnoHsR2aoEeuelhpisfTqa2xpX8s2ugYPNH+ ow5oVEZ81nXE5998j7AfPkPw18v4fHvU/h61I6ejsNt/UQvt0ZX8dfXHSWnXGm8Zd0XTVZ6kZOri fZqULClN6iCQ3M+/5JafOijq1yIZNqvJinpNg3lN4g5vx/mHyumt8Tj722GVlsb1BxDxXBkHOH94 Hx/Hw38g3rGati0kj4njptqyw/QCccLgSeGa/icfAeN5LJlwkpc/aO3vWBGSg3dv+mI7biZfrk4k Z0Nwy4Z8nNgDm3H2gbItxeP0gQOq9C9+DcM/Uco4wNkDe/g4Hum/Rk2radtCcqPU3qIQZ1SJdHrB LVAb0qoVBrPNHB5cP4ABrRrAs5wXv4mPcgOVf35bj2F9WqN8+fL8X/0GnTFpaRie2Mgh/sE5LBk9 CPXrV2Bxg1C/VWcMHDYMw7i/gX0x/KdQiLcFl3+fVl3QddBc3LXYr+b6b79iYBc5z1ZdBmDZ7ovm TSfYdJcZY9Cn5+f8CxynxqwRA/g8BvYZiGWHb6s006p/cvAAnuPQqsnoXL++mV8Qhi87hDtx7hmp e/vsfsxgvFsp5LfuMxRbT6oZqIB45kRcFFsa4IfBqG+u0watQjB/l8hXFRta+alTqa8c16c6ruWV sl6ioi5j7rBuEsuuAyfi+B2h4RtvHMfEgV3NYeXRdfhcXH6ivqc42dfDZqFLly7oO2aT1BbFPI3X 9/Btskvf6biq2ETIsf762qOYl9U5JeslNhL3zB/VChZ6Sx6FYVYqe5EyKJJd/tHEecv18DtiYu5i LWs/rfj7vDyE9nPGfH+qS6av/cTjzK5linufrVfJ2vP6Y9clodb9RgwOsfV2Bw78FD9vEYyrGz8Z wPc7fVj7OGVuA9bpJJHM4TxfLra2+01be3CsD8vr5G6MZu1ZvEe5/rTvsOnYf+m+UnFFvRxkm39d Zf1vPylNg9YDGDsHfYFK0ut5wRkBhg5ozX/4exk2EPP2/6uroM7rQVt9O8pUW7tyJMF5mPNyANza 1mLfaLlgyplVY/mwQYpnuJjrRbZBVBf2vB48/3fRSzrru/+T93kpKfW6OnT169rardzv235PtNeP KdNp7Zf0vD9yVej4uey4kt2pt62cflspL6P0w+ElKiOkGN87Ry3MODpRvMTcNUcltxbHy1jLl/4M aPDVUoQOfZ9PnmicgcVh17SISlKcpOSfpP5YV7tOUlGSnChJ5VHk5rxf1nafKkSqnMr70F2/87S+ L3GKOC+foK5ST3e857tbnghV6/NMnb/W9zL9zz+t+gj665cvlvuNPJssDgaB+0Up/UVGRprs/R2d 1omP51NviumOIt7toz9J6b/ZdlFO/+y0qZ+HNx/W4ZMeplIw8O5Jh67LcSL/Ng0r7cf7l/9is8Jf rYeYh8Griem3O8/sxrOnO/kLPJV1zbkdHfcOjhPq1aOsaf/jRNO9Hd8I1yzd/DNPrZI+O72AD2cP ENPJyEQp3J6/FMGO4/ScHry8dMGzTZGKOKI8Tv8x+27JIYlXTf09fPg0XQaEmNiXNN79U/hDOY7p jmlUufS8f+VhexX+aqeYh2VZ1LFsX4lpLVnLsuJMoRPa8TpYxuGu0zUYb7oRJ8uOvbZbKout+Jyf b/BCk9Gc5NkJcz141jMdU9TDlTVf2MzTIMV7Yprq5W8zDpdHttFHzDno09/dPEymJ6bFnbPZ1ZPT VWYtc7R0iXpZxr2w4lOHsif99p9KlCjHXt1w/t3m/alIkzR+lno6r09FljaczvTm8pu74gebbc/D 73NThKKNcuJPTPuA58bdr48t8pPaJJMptknn+mttjxaZmS+dlc/VerGZa+INqX8B6zfnHbpmM5rS U2TjqP20mXFUkURf+zGZokxrBlS126b7rfubly3qobU/mGzuV63Tiapqy1f7/aatPdjXJ850cHp3 uxw4/oPWnReVN2lpP5Z9gZQ4jTvEtmirGCIXg29v08nbJ02dDF48U/ZhT9Un2Ht+m0xa60FbfdvS kfPT3q4ECVK5NL+/aC2HySSy4PqE3ffldyMTex/5ztOX58dmX5hOGpVhD0wTymXgwwL7blQUU+/9 757npUKB184ptnfxbFVAXf26tnYrtjcxT/EsPuft9WP20onpubOyX9L7/uj8uWxFR+XhLr1VQqWL KNOclpml/uaG5G/DERch/R5I12Cq9E6i5Kf8bWDPXyk58d5+Uz2DB59/hq7LpXduZZykupOav5gu Sf2xrnad1JJZpxPbqnWISXruJqk8vECt/bK2+9SWjpyfyF0si3gW71/uOafnd57W9zTtz09Bc3t6 KvXV857vbnl6OTnLnyuXsv/T/3tRb73R81W8R8Q2JZ5Ff8tzMoyIBALeroXuHsIY9S0H/mY6CEfc rfOYw9aHNHjWRudPQ9DIQxitxK0lKR6mOxew6bwwlqvFe6VFbzq/cgIx2LtgCq+FX8t+qJzZgOxs aiF7CPN+8zb/+co0DCxZFx+b29LG0EuSHnE3/uLXs2Q/pNFjwGdo6unDh3FrSYqH6fY5rDsjrNHW unFZ0TtZzz71P8eSlXPRv2ct+LNb4PGhGQgeIqxvk77LVJy8fg+Rj29gzfdteT1ehg3FwMWnzTqx NVy+6SxMN/coi3mHriAy8j4OLhku6Zyh6yIcn9tYXrdSuM0AjwCITsRfxcwOM/g0fq3G83nev/0P QleOQVmvPOZ4mdD62D6Erp0kye47fRMOHQpD2M4w7OtShvfXp78kSnK4xoN9Cdw5BT1XPOTlcbJ2 hV/AHzvnS21TyiiJjuiHEXzK1kOn4dCZK7h//zZO7PyJrU0qTE8dOWU7LEe1KLPybfU1dv1xGr9v ltMs69cTu+8Ia+W6yo/PS1N9KrVy7q7QZTwrbzhWDG3DRzbFbUXfzl/xbY9bMyn8zB+Y1rkSH2Zr RIB3ugxSJsLTQLqE3BDNTk36a2uPilwcOlOkXgz50arfh4IebBmLPnULIbjvNByPeGxfN+kmFaL4 1P8aW1j7+WOH3H42DOiT5PZzffMP+HCa0F9zsvddvIZ/zuzDhI8r8xn+eVW4l6Q6kvoNjv9uhIVt Qf9ywvbzXN8RdugQdob9gZ7lsgoKi/pL6QRvrflqv980tgc7+nD33bv9l/LKcUturDt0Gtev/4OD rL8T7+0pH3aQOAulkP/7tvoOYeFnEKroe0d89wvM9OSIb4or4R68c1TAd8v78CVOfDER36+94LT0 2ushvabnkb0MtbcrexIc+2svRxxKBjcXhLE+Yc8f1yXB3PvIen5jPfbrKXYVjpyR+wnT7VNYeeYF H/fzD+WlcPQ+P5L7eSkV5nV26OrXNfZTFrws34us+2OLBOZLx/2SzvdHTc9l23pIvnb6Xylck96W sc3Xxhs4ufU5f9FgZGPktxON9/bKgRLN0/NOj0AX16k152PIUQVdW2Tir+LuRMFy3KQ5WrKdHOaf lP5YV7tOtmLZFpyU8jBJ2vtl154vlkpb3r96+2mt70vayyf83rDU09X3fHfL08vJMn/H/Z/+34t6 9aHnq2WNaLi2tEyyJPzXHfHsaOSgvRGRkZGPTb/0yC58pfIfaLpgHi156ufPeT+vckNNN5nfLz0q mq+/M10zx7m0/mvejxvpuM/BSEcaEakeIeqonhyFifUsni3bg3id+Oiw9OVvkHnEjIl9/1sTkkOo LzYa4pLq6738hUj+IiRIE79gWPqLedk7i6MILEdEcl9QNobk5PXgRmGIX0XFL7leFb/jv35uCqnC x/GuON70wJzJv+ZRnZwu4sgsW/knVWdOlpiWY8yNbryjyuCJ9EXXOixO4it9wVV8sey2VB6tw9XF 7KCMfPm6zftLlYOYv4r3s+OmFgZPPv6kY8oRoqqkwkXsOWmUy/yzLywi6NSfpRb1cQsPNrprccss fDmsRpA8Om5iBmohzGJUi0Uh+EtRLxUnFmK8f8P0z+1nVkl+n9CIl821L7HNcZFEOVz5Kg1crRq9 ey90Mp+GC+u3iqu/pPNT6amnPq1KIngo9Q4etlH+us/a3BDPdJLe3eYpRuNFn5La0XszlKM85VE/ 1verzEgqgx79HbZHO4Vj3sryJUe92M85yrTp+7YSP67uub+KfSawEWTRVsnUei6XRm5wEe8d/FGS 0y1J7UceAc6NYr1kMYr1yqEtpn0XH/E6iXpIdSRpapTuuTYWfQ0XxXY67fnqvd9MTtqDbX0emKaZ +0uu37Ds+x8dnClxFssoyuHqjrs/lKPydwypxsfnWFnKkrClYYfYZm0VQeQilV0xE4Hvk82j8G0/ v/XXg7P6tqUj56e3XSnL5XxGh85yKPrUwL6rpb5WfB8ReQePPiAV59qmL6U29hubkSIcep8f7nte Soq9hg6Rv3i2XUR9/bqzdiu2Ny5P63dBe/2q7M+lc9ov6X1/1PNctg3JzvNAp952ZJueye8fbSze P2wlOfh9Q/4e4t6nxd8ASu56R0Ry72/ic8S/9SLVM8FW/nr87OmllmGdv5guaf0xJ11nu1YrlKQr R/eZa+XR2S9z2jt5n7BXQFFP2/ev3n5a6/uS/vIp9XTHe7575enlpLcf0fv806uPXvn2WtPr4S/e 1+LZXqmSZUQktxl3xWY9Wd5sewvjbpy6xVni2fqQ+4Vdrsu0qM52MwPKvi+srxF/dg1O82tJxuNU 2F4uGXwbN0WJDMKII96D/r1SAhFhm/gNXdjDDa3rFzXr4ot3Ow3g3aaYhdh6Qr2mVsop7IWqbO09 7kg07sCJG0J7OxX6M+9Xvk0tZGau8k0a89dxp1fhJL+WZDxO7NnF+/k1a4WSAcnc3tgIxi0/f43c fI7mf5HXsXNLJH+R/h2223tMFB48eMD/PYky4u26wiYzsYf24Tq3tmXUY4SfFUYMF8tvHoHEp47H y0eJvCvqpe0vX+YchZN/VhQyePLuL2sE4addZ+yP6ouX5VmtVaNXf6US7uAR+Q82bXnGSw0e8xkq +irqMEtVTD4+TZljkty+2fOjSJ5AKW18fAy/Rl+2ElV5v4Rz4fjPYt1RLoC7V+aM+kC1MVKOus3B lgvg0917yEbiusKPl2L+p6c+lelsuDm9f/impTyiln0lbzlOGMHDXuAxNUSxM71fUbRqIeyOG2BD lmYvPfo7ao8aMkzReuH1yYCW36zDtT/W4+Ny6SQNT80bgkp5/bHg2D3JT+kQ9OzE912if46araT2 E5WU9hN5T+o/uszpg7cthqoWrdMcQSWyiNnZOSsWmtXS13BSdOSr+35LSnuI/Bf7DggjaVpPHohq Fn1/lrptwKbB8uXfueuoqm8U7w9le6/10ccSK3EAkOTxBjn4shsK4cttX/Ol5kb1fT33kH0CSamH pNQ300B3u7KvtXWI3nJwferYIF5O1OLN+IdfJ1d+HxEzOLDhAO7yFzH4c8cy3sW9q5RnM1L4Q+/z IwWel4Jib8J/nf261nZr671IA05N/ZLe90c9z2UNOtqKoklvWwk5P9bhBJhnptiLovT38VG8HyoD 3OA2wbxvgRtkJUWErfx198d8xjrbdVKUTWIa3eXR2y9zemm9T+2Vwdb9q7uf1vielpTymfUW7zth bgvzdPE93y3y9HJS1IGYv8P3Mr3PP7366JWv0P9NdiaTIRLIXaEu2BqQ7BvdBew/dYedb2HfMmHb jebVS/PM81WsIcU5cvoB8/sPh+ae5cNat66q2kn7Ta6kV1/2p9g7ZwGvhsG3MvJ7PceTJ0/YXxR8 8wvT+bjA0SsP2txEISX0z1O5vjCdjk11Cj3xL9/e9i4U2lvrWmV5FQpUqSPFOXSSGU1Nd7B/hjDl +YMPqqsMRsmhs8GzILIre0kuE8WL1ONxTZHFLxA5cuTg/7IEBqJ858mCKolskxzOFSgbfsb+9Iu0 0cf9Yxuw+IzwwzpKSOH4v1dh9mPxOyEOY/Z54/II9CyH4fN24oHCzuBYCAvVq79CoFt4KPIvVyKX QrrZ6S0Y/awD9PncPrub36ClHFuKwNvbD94GA4q1Gi0J4V+QpCvZYeXvnUeaHhR64SpiFPprqn9Z tNrlrvoUpcq2Z97HP1BouO6a0iRmI53drb8k2LYjxepFkX3Bd9pg/unnuBauNkj2qfMxjtvY7IdL aqWnYnpZktqPor3VqpRXoV0yO3Xmm9T7TXMpFPo0ql3MRrIA5Cgk9B2eAbLxWIpocX9I/uTgCeRt /DnYSCHevXfI/3CAtW9/GxiVz48k1YNO3snWrpLQnko1bstrzxlrD1xkHyPZOzL/PsJ+yI6eO5F/ V4k/vR7hN9gHyLgIbF4gTNPu1qmO/K6iyFfT80MRPzmflzqrJU1HT0q/7qjANt+LHCVQhjnrl/S+ P6bUc9mZ3soyKt0sXRQ/wYB52upflHHZhoYXfz/O+3DvMU6jq9Lau/BCYKDwQZ+9or+C3z/a8tfc HyuK6e52rRDtslNzeRT9XUo8X7iC2bx/FXro7acdvqcp5CapfBb3ncvv+a7KU5RHEyfLlmSRv2Ww 8n1D0/NPrz6K+JrkWyn4ZnpYjIdwHwRD9lJoXyc9Rv72HKv3X8a3VRKxNDGeXx/ynVLZ+YwMeVic 0n4YeT4ae46cx8CSL/k1JLnAppUKuE8ZkuQSgbjbRzBnvzBqLzHqOxQI/M6mvKhFK3By3AeoJn6t txkreTwNOcqgU1AAhjA9V4ZewNjqwAJ+PdJ6qFkmB5+pIS+LUy49hjCD3a5DZ/F1mZf8GpJcYItq hZJHMR1SPcu3QK93AhHNBsqpj+cwZG/+f/bOAz6Kov3jv4NEEiBRuuL7t7dXJQFUsAKB+CooEBCx QEBRCViAWF5pvoooSFGa0lTKC4iChQSlQ2gqIEUSBZUgQV+CEEkkURJIZP8zuzd7u3u7d7uXu9Rn P59kZ6c888x36s7NzuD/5FU7dXHz/Q8BKe+g8LNkXB6ZjLi4WKSlKROqfD/MYQ/G6oNbPF3YcRiO pTfDmJEPY0oqG0WxCckxAzrhjeRB2Jc7GVdrVxdayNBa29NfG8K32ZY8zaY85zfxrFr0LdmZ6/5F L+BaMSHMgtaIiUHbBg1w4sQWpKc7mbXl8Rbh2OcapTWq2Eqvxr/RGOz8NMrnz3yw7fQyncgxEVIW +ptE67YKXb7o4wzDJS35hORvaJvcE70nrwXfe3PzgVy0atVA79X0qaR05Udb9JwWXVN9ArD0E29w 61sA+rmDFOX/7TYF58eMwDWpjCEb4tHJEzEk9gm5X3n+nZWYdan+dHi7qQpWPpR3uTKmQ+xtzccp qVsPIKnxMWVP64jWuL/nffjrqf8g4+8MrNiZhQ7XbsMiiVUcNknZ9ZZLTNHZ6j809T9U/aWpclXe srTtelkBcj5+LN9+2Q+X6Ca4oVkEUtneqav4Vz39b/RM0huDSrn46fO/ZNugTRoWHcHXy5VBUa0r GiCwFs6oqINnk/jPmAYPtD2uqOU60PR4wzG2y94+gmvjtJ0u7ex2IOkLZJzvi1Ig8mxx8hWpHzen /Z8tfah/9UPd3DlkE5FAA7S7Jx7YsgyndqzD2pVKVDWvi8d1DcXy+PNxW0/2md/L6/H96o1Yf5ky nV2jdjJaXFbmTbo5IbLF/uWfKIej+GHBX6iXbM1Cq87lManXEPFd7wLSluLUtjVYuVwpb2Exd6FZ I1HeLkDbh28H0ldh74p1WH2F8kbM9pXEjZeXU3ljRV78ojtk9DuY2PkfvikX/4RJfWbr/IhJSL45 curs0YhrxH6WsXk1bnYvJqfk4+XDOzB75EAMXbibfd4+Fc+8m4g1z3g2xLcU51R/S0FuB6fyNP6/ 3n4IMEzmhDv4bMdUtcJvMZQdIMQvfrDHtgXD0cL9mXbh/vdR+9rHTYPJli52OJAxK6RTcF3HfkFP B+KvvQwRGv1t5b91bLJLqfPTj3wnzsVsBQK/ilbtRTaratrPgMPDRZ3USywT/cshX/Sp5E/nofMD 7QE2EcmvxtHGgsIsTfXML3X5Ee3NL3/wFyhl1RrXIdSXrXhLU9+cJEBT775Mz8ITLYw/3ih9Axf5 d0EAs+9OdKmifqNjemNh72HozQ4S2/XyUIzurKwc0iW3rPIh1OUqkHSEX4Zug5rjXXZw1NYN67Cu vnLMUZ2ebXF5vcvR5pkYvMHctn+Zho3/2ypjqxXXDzc01bQVmnht9R8a/yHpL3WZWx0fbLTr5Ykl wPFjmfTLAXGph8tj2NidTUQWpi7AzpxH2fjXfGyRv3sN3nAfBHXP/TfptjwJKGoWKHP5e/KCBx6+ V5sWnu1sAhXoMJxZ/OYTkexjKjvtsWX8Fa9c20qPpr0r135eo4etdprlg63xkkZuuabPstw4dNCk xy4nRzFo5Nvq/zT+bemj8W9LviPlq67nUn2afSpf+XXJCs8VbTrITn9nzMRjyW/L5tu7tGJTlJ7r ynYd5YeSjElIfFLx0+zJdvAzHeMRQKYQEziKZTOWyHGwzZiRK0lgG47q/07uQS+XMvE3fe4q3X5a wVTuVL7vF8Ir4/4lR1fy7VT0GviWbG7b/RY01Chxlfu0ypJvx+H+fm/KLi0Gx/s+bU8TPujGyNpo wj735df0ucv9sivM3KOu9FyVdQpSYT5yc3ORX1iM0+un4K7LA1sVWO/iVnhxwSb1c7qm0bU9SdU0 rmn8s3ft5VB/bVBTs1N5taPVvS6/SP0GeTqhRzH7P8/rbAJ5EHsQvTn5P+okJJeTm3XYpzj+yV3K piydn8KMTXiZDZr5FcUnn5ymVyfN+sFnfloHC6pLgwsukeVJZ9KRrfv0+HfMHzPDZ1w+9fdVHn1K VRzLNF8KjiIjI8v0R+2CPM/S5+P5LFGGS9EzU2ebn7Gm1OVHLc/TvNubgsPfIeOwsvpdF3EQHuzG q/qzW98CKQ/sFwIRz4cL0gztBvsSNjMNT6Ype892vPtW61U2QeBSdUVEoOfoeXLyaly3Dykp33on NZB8CCS/Wcwiv522495Km9gEkg62l/oN3brJwgqXDUOn3sp4JPHulswFuOFexW33pMfQacg82d89 PeN04xnH/UcZ9JeyolX9XyDteoDlNpgoSzt+9NkvB1NR27Ii0O7hgbJv6e+NSHhpkfkYuvB7/KfV U4pUtqq4/73GH558R1grXHm/0frK3f0huvdU6iw7lAtPdrtCdS7KU/Z5L1JtSmdwGr95bDba40DK tXlkZWBrIz2BtMuhqKcBjPPV/srXOC2Q9JVBzgQcRQCcHMXltP9zqo9T+Y6Ur7qenU1EFh3C9KHj sPLbX3D04AbMfnm5TzJRV9+GR2roG/D4O67Shal3xc3o6T40Qzjcf6eyh6R4pnv5ESjcv0598R34 aJz5r4jR7JPnF1vKShamzMBX2awlD8ZV9DOmJI/G8t1ZyM5cg7eHLvMpVXzqpPV0V7trtI+of+Wt 6qSpcHiwYzNhLPt7+FVIeitBjrfwsyfRd8Iy5BS5V+OwQ1GyD+7B3NHPYsLyA7KfiCb/QDs2cckH XXf74vFTAABAAElEQVRfUhvtH0zEoEGD8OTgp5CUlIwJs1LwY55//oX7P0LsOV0xm3/O4o4ud/8a 9QCH7OPKS7gcKfv85dZm7Fdndq3e+hWOFhUh5+B3+CGbTVg41F8W4uufU3lsD6Pur8TJEk+vexJD pm1i6SlBQfYOvNr+agxJ+cNXbP7diovVXyZTPlzjHuSWYH/qm/hHp9F+w4+8+zI8N38T8phO+Ye/ xOAWjylh2GC4x53XBo2fo/z0q3VwPDS5SqlXvKx2fWkufmHluijnO4xLuAIDF+7SReJIf1/lUSfV +qGs8iX/p88QE3MporoNwSdb9iOPra4rYC8p6aveRsdOr8kK8k2221xZ30tZvgXAyLuv0pSfjXi+ xZOKP1Z+Hgqk/ERq2mrW3jwyYYXc3pQU5GDzopcQfUkzPL+arSwO9mU33kDqWyDlIfI69B+l/FB6 en0yeo5Ygmy5ISzB8R/W4KmrH1A597+X1VO6AiIQfsk9YCfVsl0/xGfu7OviKI2oQPIhkPwOpFxp 1PRrDCQdTGjj5vHoYhj/tnFvE9OoRRu5r9fGfX8H/fjZcf8b6v5Sq2wVNgfUrgdSboPM0On40VG/ HGRd7Yq78M5H1APc8mclonG3UUjLyGR9bZHS125YjN51mqvbMN0w9C3cpV1VbCOiH348gJzsbBw+ eBC7t6zGlOF90eCGh9QvxYZ//BquF1sZsdXXDzS4QN7nfcD8fTak+/fiKH4f4vy1xwGVax/xhdrJ X3oQSLscinrq9L3G7ngpkPSFOlNKI98pJ6dxOe3/nOrjVL5T/auqf+Nx2iydkvYvPz9fUv+OpEm3 u2ro3Lnfh2fu8PjR+s/PlRY/2kj176p5u7T6l5MGv0el6Q/U9/gJ6yRtyDb60ejgln/kq2lyGJdN /2oadPp5y61u/rR5zc3Ga92ouxTONdtJW3LPGp3V55M731HzsO+8b2X7k3vfVcKGd5a253vCWtmr woTh5A6JTbqpcoWufed9L3wY7sXSZ/2bqP7ZfokmOhdIc3o39Pgx6GYQqD7a1lkN4TH4DXvqO+mJ GuGqTjydMTExuucbx3/lFlgsLYg9V+cmuKj3Gs2k1MxTqgJm8WvzS4kvTCdz8f6TanhJ0nMV8fT9 4CfFjyP9JclMH01kkuRQ3tljaablROjJ72yyR1cGdfG5H8z1ypHYoQseNoxtXIyelVG2kKON32iO H73Wo4LD9Ar52nid5acnaq3JTK5w3zvjUZlBrfjpUr6wlO8F0oyu9WS37lO/0blIUrb0Ss0IDzuW D0YOIg3O9PdTHg1aiEeRPqMO2ufS5IuIR3u3E+eIVHc9cge0E6Y0evqrL/+a5bv9liTWhnZV+mzv PLeu3/bidV7f/LVPgqcoa2r+nNwjsZX8XmVSWx4GfqCw4GEs5Rjcdmv6OjWuSm4QTMySoeVimnbW j7PJNpVzrQ6TJPZlhedymA/+8tsjWGtyXq606bI1fnGcDq5fobRQMx6pETlIOlgs9M5T21bOn20h Ix0WTtq7w/7DXz3kcXnVFW181cAsyru4G5MsyoZwN7sb23V/5VbItGJv5W5lz3XWuil109n40Vm/ bKSkPGt1sFWPTPU2ly1sTx363O8YkOdRVNL7Uo4I5L4L/bj7tF2/q67GtJvlMbebsErff/Pxq+hX xLuQKtSBIdD4RXp4OXLaHouwVmnl9t7l2kGiLLyK+MychU6BpEeW57hdLt340qr+Bvu9RozTJIfp 0/LU1kfOKpBxfrDlOeXkK36tm6gLjvs/6l/NqqUtO1Gvxd0qkLMVkZH10eZ2ZWUUEyxfbZ96F68/ rF91JtzAPjBp0c29goNZ1urUHf88z7h/Rx3cktBbDVK3zwO4vq7Rj+rsbXDV8T5Z1NsX2QRE4E8c 2L1DDhn1xEDc6OMQmujYuzG0pnIO3ScbMtiRHJqrZhPU1mxrpLpY2QsPtRsgrl0d8STfOyQvwMS+ VitUwnBTz8Gq/4guPXGdl851cUePR1Q/UY/1Rox8CIxq5dvA923z7cPa1Sq97Fet2X/8gBlDlE+x uID09HRVTkL/UZjUU1klXJi5HOP3spWI7Iof/hEyj2QhM3M/9qfvwrKZI9CM74nIDp0ZtVjJN1UI N2jij47tiSWv9lWdxaErNWN74eNdx/DgNdpPvMOQMHY5BsdEqP654cr67tXODvTXCdDoo7N3KM/V uB1S9qWwg4jO0YlpkTQd+7O2g03yyva2802nV0MMTtmON3q3VGQztmnsgJqazR/HopXzlNUsrEyY le86idOxecU0JU80mg2Yuhafjoz32DhMrxpQo6ez/FQlmBs0co0edKuZ3I5RUTWN3tzPF2DE0c0Y HKevwy2SJnnlizP9/ZRHC22EdcjzRUTE7nwfo72snDwR11xjqxhj2z/B6tr/8FrnK73cuAU/eGr8 3Cleq6KSZ63F8lKUH15fVhxaj8FdW+jjZassk6d+gYX9DJ+t+SgP8vYCeimeJ0M4e/EGUt9slgeD PohujoUnvsPk/p52VyjP28F56w9g+kMGFtyDUY4cKDhnsIr4K9M9PFy7xNFE8+ibMH3tONXhnq6t 9V9WOM4Hm/mtxsgNgZQrtwDT/GZuRnvH6eDyI3Cb+9NS/tQ8+S5cpH5EdB7a3v8wt5avhLFdzbeQ cdh/BL2/FApWo3tg7brNcmssV0auVu6m9vp2yen40Vm/bFTU8GyqH/Njaq/X2yDJ6zGSrbxOO7EP c14d4DXe4p5j2/fCrJV7kTuzn35rA+ambb+0n0BHX3qT19dTXBb/UqFr78GYumgFDuaewfN36fvv wiPfKQdLMb8N6tbmQQK6Ao1fmx7TiH20x4GVa9NYgmZZmvTISjhul23WU6sUmpZn5jmAdtrWOM1x +tyKW+nJnJ2N84MszyEnd+y22xHH/Z9DfRzLVxNQfQ0uPkOpTb7LpZ8EZCsEtc6y+c8/fgf/ejQs 4jycV1cdNXn5ExYl7LNE/vVnRJi1X9kP8xQRYe1HyBP3EvbpKh/I+RArvNLdgkB0tHbCif3cpS8O LBT7nJJhtpcvit8wlociF63yyMreTE3+KaNS3uqhXpSQbOZTsauI5c12elmZzssrANvyEZGREYiM imL1xpPWXTN74saBSxHW4hX8svtlXOBxYqY/MaRmA/kTlMhu03Hs04Hq3maW8avxFSM8MgqN6vl+ qRR5ERFVD1FaxYQeqjxz/VVvduuuTXlCbkFODgrYZ3jh7EeTRvWUiVNeHviPInbaCUtOTEJRQR4K CtixaOGRqNeonlzGrfyXKJVGqQeaNEQ1bgSfRVjj1yz/RTqt4oUa3l5+CnnibimXedClSQSQ76x9 l5tiT73XObMHXm4KWKH2my8O9fdbHg2K6NKgxsX2jwtSvhii0z2WFBXIn4ux4inX63pR+ol94Tk/ /T2cy04bZr+sI/1UCq4PO42cnALwcMHWk5fpXFamwyMjEVWvntdm+5blgdUp3iZb9QuW4dyJ9Bcv 9+akvgl2VuXBnz5K3iiMfbWDvuQobryd0TTYQrFKfhfjQu/xQXATZjcfRKxW+S3cze5OypVVflvZ i/icpsPX+NfOeEbE62n/ffe/wn9p+0shp6rdRXkX6fJV7u2260IWv1uVW7/lSulovcYyvsIpbkq7 FOj40VOugjuusKu3lp1/cwkbQ+ehkA+i2R56kRFR7L3BvK9VZfH+jD34ekdV/fo0FGFp0sXoOfs4 2OpmHMifgssqaXcQSLn2icaHo6hvvuqZj+C2nZy2y1b11CpCX+VZF0Yz9vQ1zhdh7IyXuF+76fOl p26MLBSQ79bj/GDLU6O1ycln/HKbaT4uc9z/2dRH6O9YvghYRe6iXovkWNXvgCYihVC6V34C/ici K38aq1IKdk1hE5FDloJvjr350Hu4valnhfKRXR+i9029sFE6izunfmPv1OuqBIfSQgSqAAHtROSu Eylo4WTFdhVIPyWh4hEQA0qrgWTF05g0IgKBExDlXUioKuWexo8iR0NzL876DOdc2l0Wzj7zxtMt tUezhibOqiBV1LeqUs+qQp5QGohAaQmIei3kWNXvSvpbjUgW3YlA9SJw/vX8c8ql4Cfq3nHhB4iN 64LWV56P37bNRWo6+wWYXfyTzmH3mXxSKLvSPyJABIgAESACRIAIEIHqRIDGj6HM7SJ89lKSHMEN w9fSJGQoUZNsIkAEqgwBWhFZZbIysITQisjAuJVnqP3sxN2hnYYgVfKcRCr0aZ84CmPfeAGtNCsl hRvdiQARqPgE8ndNx7k3PiX/oLArbwOtiKz4WVblNRS/bFv9ol3lAVACqxUBUd5FoqtSuafxo8jV YN9LkJ2Rjl9PheOqG5qhHi3zsQ1Y1LeqVM9sJ548EoEqSkDUa5E8q/pNE5GCUDW900Rk5c14vn9J Qf4pFLL9bcLYHm/16zc237ex8iaRNCcC1Y9AyR84fOQEULsxLm7ke8/W6geHUlweBMSA0mogWR46 UZxEIFQERHkX8qtiuafxo8hdupc3AVHfqmI9K2+2FD8RKC8Col6L+K3qN01ECkLV9E4TkdU04ynZ RIAIEAEiQARsEBADSquBpA0R5IUIVBoCorwLhancCxJ0JwLBJyDqG9Wz4LMliUSgvAiIei3it6rf NYQHuhMBIkAEiAARIAJEgAgQASJABIgAESACRIAIEAEiQARCRYAmIkNFluQSASJABIgAESACRIAI EAEiQASIABEgAkSACBABIqASoIlIFQUZiAARIAJEgAgQASJABIgAESACRIAIEAEiQASIABEIFQGa iAwVWZJLBIgAESACRIAIEAEiQASIABEgAkSACBABIkAEiIBKgCYiVRRkIAJEgAgQASJABIgAESAC RIAIEAEiQASIABEgAkQgVARoIjJUZEkuESACRIAIEAEiQASIABEgAkSACBABIkAEiAARIAIqAZqI VFGQgQgQASJABIgAESACRIAIEAEiQASIABEgAkSACBCBUBGgichQkSW5RIAIEAEiQASIABEgAkSA CBABIkAEiAARIAJEgAioBGgiUkVBBiJABIgAESACRIAIEAEiQASIABEgAkSACBABIkAEQkWAJiJD RZbkVkACJSgoyENBUUm56VaY+Tm6Nm+PDt1G4cciqdz0oIiDQaD8y5OdVBTu/whxNWqiefwo/Fwm Rb9icfGd/hLs+ngiusY2h8vlgqtmDAbO3gTfmCpW+uyUAfJjn4Dv8mJfDvkkAkSACJQdgbLql8zj qRjtZiD9ednlEMVEBIgAESACegJh+kd6IgImBIp+xsxX38aPhfqJs8jI+riq5a2I69AGF9cLNwlY sazS5/ZHbL+5cJ3zMHb9vhAtolxlrmDxqd+QujcNrn11cbKYRR8RgAoW+aFKOnUKl3V/Hs/cdaVq RYbgE6gI5clOqoqLC7BROgvX5l34ndXhy0Jc7isaF1/pP7J+Am68f7gH49kMLPzyV0zqD1h1jhUt fR7lyRQMAr7KSzDkkwwiQASIQLAJlFW/ZBVPRWg3A+nPg50PJI8IEAEiQATsE7B617IvgXxWeQL5 36/CwLGTfKZz2oZf8XTcP3z6KW/H4vw/FRWkgvJWRY4/0KlbO/lxw/89UgknIv/AynlLcCBfws09 +qBV08gKkU9WSlS08mSlp9Y+0DKnleHPbM2l/PNXn/4/sWbaRDk5rvDOSNn1Fq4t/hV7jjewnITk nq3T549MebuXP//yJuA0fn15cRqa/BMBIkAEyoZAWfVLduIpn3YzsP68bHKHYiECRIAIEAEzAjQR aUaF7PQEws9Rn+NfnYPnbmqAP3NzsW/TIrw8e53sNujORDTP2YDb65X9KkNVOT+G81vei/79a8HV sD0aRFZcPf0kA9DkR4fh7+P51g1xRhPozJkzOP/6qzU2lcSYfwDj+w2UV+9NuLlHhZ+IrDLlKcjF w5JLBczf01BWece/Pgydm13BSFyBy/3wsEyfn3Dl7lwB+Zc7E1KACBABIlAFCJRVv1RW8QSSJYH0 54HEQ2GIABEgAkQgOARoIjI4HKuNlJ7dHsDd19dW0vvwI7jn5qdwY7/pkP7eiG8P5OL2Vg0qLIsL 7+iDWeyvPK9wBHcC9IGHHvTkR3kmLBhxR9bGheDb1p7FubUr9mpIntyKUJ6CgT3YMiy5VLj8jQD7 WUJOftS57jbNBgzL9NkIW65eKhz/cqVhL/LyWdpjTzfyRQSIABFwEyirfqms4nGesYH1587joRBE gAgQASIQLAJ0WE2wSFYTOafPFOpSeu3NLdXntO2HVLPWkLnlEwxP6obY2Fj5r32H3pgwbz3ytJ5U 85/Y/MFE9G7fXPbbvH1XvDZ/Mztg5hfMTOqDbgPG4Wf3IS9Z699BYmIiBry2DEVqeMVQmLUGSQmJ SBwwRfXPD4rhdn2enYmjmtMouH3/hAQ8xw6pyMnaiCEJHVAzJkw+3EN7oExg6WjvTnccRrB0ZBcH 983WmB8GDMhMfVNmlNjnVezJ0+/xmbnqbcWNM2I8PBy+RlHRUSwd/xwS3PnQIaE/Zq9KNz3Ewy4X j3wj55cw783XkNRvEBZJSsa8M3IIhg8fjuSkZMzfesSYLN2ztVz9gUD+9SzCyvFPykxGzP9aF4fy UILNs0YikZWVCcsPyLzMypMI6D8+qPnDy7Bxw4D0D16XdXl22jqv8r2fHbCSmNiNlVkzPYUGhnvN Jigu+AUpLF/bu+uikq/73fnK0/+cz/Rv4+ln8b6+fJ9BuOeR54eeSxHWT7WXv1lbPkQyky/aioTE IZi/WujniYOb7PDVhxBPRXI+Jic/hf+m/iFbfvbkECSz8paUPM6rnohQ4u6dPuECONHfE0oxactx QcHPmDt6oCefug3BJ9vN68GR3asxOrmP6jc2Ng4Dhk9B2g/H3VHY52/USftsl3fo0qFo47Td56FK cr5jPJ9Fe7k9i0P7hN5yfvM2ZnjyAIwwqWPg9eXYz1hqMx+0rMhMBIhA9SDgv/1VOGjbRV/jTDNq dvoVq35JG29BwY+YObyvOibtw/q7HdnKmL7w8A6MY/2I6Hv7jJiJHw1jRq6bVTxmegu7IxlpmMra 34T2nvFwt6RhWL7bu0/T6muPk7P+PFj5pdUzGFw5Kzv5LJjSnQgQASJQJQhIhoslis9WqH/5+fkS /VVdBtq85maz6+Ted9XyMG3X7zovJ75+U3WbsF3vJknF0ro3eqjuxrhqdRgrHS7WisuT5vRuaOmf h2d7uUnb88/KgXZOvl/2Wyt+upSrFcPMJ3cqOmv9q3Y126kyeDBt+rQ68rC75bhCkw5FtkFxG49a fWen/+EzxLF1Y1Se5yV/xnJEuc4e2yq1c9WQ3Wp3e1/KZ9aCj5aB0dx96lea+Jxx0eqtlesK6yg9 V+McVU+tGzc3HP2lJk5vo6Vcx/lXKC10lz92oJGUUaiUMzXGk3ukLq6asp53Tv1G5eUylCcn5X7v jEeVdNdoJq0+ro0vW3qlZoTsxnXZrdMlR3ojpq7sFj3gM1U9K4MVHy3nvrO+YcH16dfHyZwN6beM T9Q9lUueNCmstpJOTd8i4hf5e2DJ86Z+SsOX6yjS76nPvvWZaGjjjOkU9cSol339jRKVZ6Gn4GJ2 n7DlN03gYmnTlEdMmYmwz378PfPvO72Cv0awwRicei504vfA0qGo5bTdP3NotdQMLp+cIuLfY6Vf uZzngwFXFXwUeVcFk0ZJIgJeBER5F3cvD7KF3fZXCW3Vrnj6JfNY7PYrVv2SVbwibTz+mQvHm7aR NSIHSQfFoNGtnr94jOnZt/Apn22vvi/w9NdCP3E3yvXQ8t2/efrz4OZXsLnazWdPuquOSeRx1UkR pYQIEAFRr8XdigitiGSE6HJAQF1JWIIjGZ9j0K0vKoFrNMMNl0brBOVunor4oR/LdnUSJ2F31jHk 5x7Gklfvk+1Orx+G5Dl71TBHVr6Ffgt/l5/PaT8Iq3btw7aVs8EmzFQ/3CDWFIbXqqvae+0xIDxp /KsBa0SpRlWAxsDjnrtoJgb3uw21mZxQpUMTZcDGPRn7cPjgQfzwww/q3+Ecz9q6xh2SsaR/Y1n+ H5O6Yeaek8xcgo9f6q6cpFyzHT6f9SiiuA8NM/54TvsXkbptL7atmAb2Is+t8OmQJKzO5sd9O+ci B9L8Uzk/1hadtm7GuqUTVNcBU5Zh8+b1WL9yPTYkXq/a2zGoch3nXwTufORZOQrpzAdYtVOsKFNi Pf7NSqRKf8sPvdtd6eFlKE9Oyss/4zsrwtlpzWu2ZSlm9l868h0++fu0/Mx1+TI9V+O2B4vS/5Kf B/W8UbW3a4hIeBGrWL5+neLJ1/kD+7F8rYk7nxgmi+Fxrvj6iE6kLv13XqVz0z2IcqRyOQ/dtm/w nb8lP+PtB6fKYiITxsptxfEjmVi36DU0C2uqK5pO+Or0Uh+4Pquxfn0qBscox9bzONdv3oyV67eh X4yf7SW80scEO9BfVcOPISLhFazflY51c0eoPke+shhKC6nUv7aD58lubLIaH2/ei6ysTGxi9UjU 17d6PsjytY5//moM3obS8g5eOpR2x1m7X4TPXuqNDP7bKuujZm0+gPz849ikYVq3z/vYMbMjlJLg nX5/+nuHIBsiQASqOgHeLtprf5V2y8jDOE4xusvPTvoVs37JRGjzxLHYnL4LC4d1l12l4uUY0Pvf chvJ9xzflb4Nk3srXzqdLZyKOesP6aXYjEcEOvX7QdnYbdhkFu8BHD9+BDtXesYeL7/1hdfXICIs v/vnZK8/D3V+lYqrk3zWwiEzESACRKCyEzDOULL06H69otWQVXc1JM9bY34bywN/Nv7yFxMT4xVu wvqfDUHzpBld68n++MrHbJ1rscQmx9xuk9yrGQukOV3ry3ZeK8BO7JCeqBGuuKmr3CRJrCbjKyL5 ij7tJXTW/opqZsfDCHvOwlvX0KdDq7cds1ZfY/7x5/CWk3Q8zp7wrH4Ma/GKtH7FBJkl99t3Hl8x pVxauS2TF+hWmR7b5Fn52vcDZZWVs/z1x5npcOY7qZcrTNZtdsZfQi2/d63epc6/Ux4dtCtI+WpB UWY5Q16eRbzaMsZXnznicvawNLRmLTnN0QM+Uldl/W/FS2oe8XyKH71R5XBo2QuyG493S652FaXq RWcQenI5LZM/0pWNY+smqvEM5Pl65ke1rtXts0DVxyz9ukg0DyI+PRfmwVf+ntyhrjb1XlmtEe6U LwtqqQ9LnWhzus/6VhuJT7OpPNv6W4sWcuX8Hv6ZLp9WDG2l5rmyIjxHmhx3rmLHVsyKVeJC+olN b6v5qqbNF38R0OvusDyz8KFOh6N2n9WvUTF1ZBbato6X5+lufn0Nee9Mfy9gVdKCl0n+RxcRqA4E RHkXd+80O29/te2K9zjFOwbZxkG/IuQb+11hz9MSz/oVsfJb0ow9uFvfWZqvXU7pv/7QaifkWcVj tC88fljKPHJSK0I2f/3G3XKbwsdThzWuQj7XyTYnObyv/jz4+aXVs9RcHeSzBlWVMVrXsyqTREoI Eah2BES9FncrAPqlZsw3XUTAH4H09HSdl4Gpv+L59pfq7JCfhZWp+bJdndYxiCgqQE5OjvyXV1CI q9soh8ac2bwBWQVsPJKfiWWpfLUeEP/a02gRoazAky3q34SJOybLxpD+YytmUv/7Ii7QRlLR08F0 jouL0/zF4t67r9KtIHPVvw3TFwyUU1Wy5xV06PSCbA5vMRZj+16rTa1sZgNJzBjVC/U0Lo1vTcDg Gsrp6QW/n2L55TB/NbL4yiQvzty9xLNywN/el1pxqtlMrlM9I69GrxeV1QAn31mKDPd+pMjPwMJ3 T8hRdRlwj76MqAowg9P4XBeh6+txsoSCOSnIlOMrwc41q7RSsfHTjTgq2xThmxXzZVPkvQmIdXBK vZKv9yurX93SG7fprObrMZ6v4Veh9yvtZde/Fr2PnWKPKE36ew1IsE6/W67pzVf+1m6AS1015WAv 3BKHaWw/Us+6Xo00p3w1Qb2N6vJu4LSn7Hn7s2FjV38bong+jX+pqy6fbnvoCTWkvCAl/3/YsPFP 2a7bxGS0itK0l8y2fpvuYJ/vy+4rV32lsPTFX5VuMJSCd8jSYVDR52NBLnZlKDsIX3mRdqVrCU6f OCsHLbDIe1v6+4ycHIkAEaiSBAJpfwUIs3GKcDPeQ9CvqCu/+dhjjPJFRq0OkzCp/y2e2COvQEKX c+Vn+WsZj4tjU0Sji3B5U8/XUiUlRfKe1A2vuUmW9fd3u/AbfwcwXk44yWF99OchzC/RT5SKaxDz 2YiRnokAESACFZkATURW5NypgLqNSPkWucezsG7Oc6p2M3u8iD3GgQR7W45yf86bO+Ye1I+MRuPG jeW/+tHRiO09UQl/tgDyFIDGf8w156uyVUO4MgmmPofA4Kp5CRoZR10avSpiOqbt3IINGzZo/r7F p6938vrM8J+9XgFbQeWhxgZ5/1062HJCSZ7s8PgGwhrjms51ZJt1+35GkVMuGlmmnDXugRpN5TrW Mwy39XhCVkH7efKRb9Ypn2Uzbo/eFWutouP4gGs73qfGt3E/m7yXfkXaVLZlAYtr9Mxx8me2JXs/ wa7DbLBefBAp7yqfafftdYdusspaKY8LU09/hTfV5ytzvanHo7If6e+N+GxDpmw+8uVyNf097vWe vNYLDeAp7DK88PkrSkD2mfqgjrGIrhmDEbNWIkfzfsFn2B21KwGoElAQu/rbFe5vXlTD4e7brzSR GoXGlyptZs2oWibuNq008dhq/4xiyzsd0Z4X6tenLVYPLju+/VPMSVcmck0nvEU6/Okv/NGdCBCB 6kNA0y46bX9NxylW5ELcr9SOVga8NaJrwWt7IyudArA/krFaPggnxlUD4eGRCHe5cGXCaFUSw+l1 OeLkFdpgEer8MvQTjrkGO58NyadHIkAEiEBFJRDKvqeippn0KgWBiy+9BPUanYsOj07EgbpsMNFz IviEzWuLk/FJf/P96mrGdsFjraNxii240l9/wtWoM/6Pr+bRHMZ9fhPPr6d6/+ZPpXrRNhdpahvq dJhG6s/Sfcq0P29sJhG6qVw22YNik1+hLQWV4NjnmkzS+LPFReO/vIx29YyObS+vEpxy9gzGL/kK I+K648t5k2S1a8X1w20Xmw2bvVNlO75/tgHbegDvni1G6tYDSGp8DDxuV0Rr3N/zPvz11H+Q8XcG VuzMQodrtykni7NJyq63XOIdqWObIq98jfxnB3k13VA2UfPOzHV4/b5LsfGDGbLkyK4D0bapvfQ7 VeXCjsNwLL0Zxox8GFNS2fQQK6NjBnTCG8mDsC93Mq7WrpJmwu3ydapHoP6d6h9oPHbDFeUr+5my XbbsBvHpr7x4W6XDXrtfFzff/xCQ8g4KP0vG5ZHJbPV4LNLS2EQ/u9iBQxj2oI8fFnwSIUciQASI gDkBq3bL3Le1bVn0K2w9QMiu/YtewLVi4QGLpUZMDNo2aIATJ7YgPV37K2PIVLAlOFj5pY3MCdey yGetbmQmAkSACFQEAjQRWRFyoRLpcLrYM3C44v5nMSpmBl5mB2csG7IAP/a7EVeLEsV+ISyQt5UC hox+BxM7/8N3KjX+v95+CGjVQOc/3L26UmtZDGVFS9GqvchmaqlxM0/h4fpPFbXhHJk1eoUqHY70 CdBzVsoYPJmmfPouRCQ+PAFtd7/svSrSxQ7zMc41SflwXcc+nWVf5cdfexkinHIRkZb1PRA92a/T D47tgikvfoyCeWuxe+glSF2UJ2veb+A9uk/WvZITSHzhl6HboOZ4d/I32LphHdbVV44jqdOzLS6v dznaPBODN5jb9i/TsPF/W+Uo+YToDU4nBE3z9ZQ+X2XpDdHl330xtPc7OLNpJTZlXIOVi/6QXZ58 9G7HqzC9GPmwaNzsXkxOycfLh3dg9siBGLpwN/iG+c+8m4g1z7AfOgLh6yO+YDv51T9YEWo4fJme hSdaGCfTPO303wWleMvUxGOr/XOaPo18u+lw1O4X/4RJfWbrtBKTkPwQhNTZoxHXyNjY6bzTAxEg AkRATyCAdksvwNlTmfUrztTy77vwWwxlB1Xyix9+uG3BcLRwf6ZduP991L72cf8yguGjjPMrUJUr bT4HmmAKRwSIQLUnQJ9mV/siUBoAF+BhNlnALz5Z8PGW/3mERdZGE/YZBr+mz11uvt+bxzdQO1rd I+6L1G+gTPsID0cx+z/Piwf13uCCS2SzdCYd2WIvO9nmd8wfo6zgUj0HaiiDdHDVCuT9M51PGNQK FzO/PhKY+w0Gd3tL9hCV9D5WzPHsFzls/j6vgHyFa8qmTJ19fsYaecKZW0ZFsxd3p1x00iweNIPF tJ2asmTh3ZZ1gHrGdu8hi5eK3sMNl7SWVyHy1VMPt7/Cd7QBxReGG7p1k+UWLhuGTr3flM2Jd7eU P5e64V7Fbfekx9BpyDzZ7Z6ecWgom+z/U/I1SxegMGOTPl/drtfc2UM+rZ6fqHl3THsl/Wzvwp63 X6IL7+jBQf7Wu7gVXlywSd1OoGl0bSWqgPg60jIoni31D4p0JoT9UiA+Uf9wQZqhvWTztZlp6g8P He++VZk8dsBfVTPUvANIh5N2vzBzj7zSmNfdVVmnIBXmIzc3F/mFxTi9fgruutzZ6nuVi8EQaPtt EEOPRIAIVAYCAbRbwUhWyPuVYChpkCH6qTcn/0edhORecrMOG3yG8LGc8ivQFFXGfA40rRSOCBCB 6k2AJiKrd/6XOvVX3NUTXdyHTIyZtsYz4cgOvUh6K0GWX/jZk+g7YRlyityrdNhm1dkH92Du6Gcx YfkBRQe2Cq37K3Gy+fS6JzFk2iYUlJSgIHsHXm1/NYakKCuytAo3uaqZ/Mj3suv60lz8wuQX5XyH cQlXYODCXVqvgZvLIB356e8hWt4/MxrPL2erQR1cP/x4ADnZh3H4sP4vO085oAEowtJh96r7+30w 7FF0fGQo2EnNciz/fewppOXoP9Hmn86MZAfePDd/E/JYHuQf3ojnWzypaMU+CX7oTrZHoFMudtIU 3QS3NouUfa7e+hWOFhUh5+B3+CFbOfTIjggvPwHqGXlFG/WwDyGzTq/HcKO/w2ECjK9x83i1Hon4 2rS6VDY2atFGnhQU9vx+f4ertI+2zSPvvkyTr19icIvHlLAsX3vwfHVfrsY34/Fe9cWjfI96rDdi /KVfF8Lw4CN/C/d/hNhzumI2P6TG3Uzk7l+jHsiSfdy9mjdAvgZNgv5oW/9gxRx5HfqP6iBLO70+ GT1HLEG2DK4Ex39Yg6eufkCJieVrf7Gnpw/+lmqFmncA6XDS7kc0+Ycyoc76iLsvqY32DyZi0KBB eHLwU0hKSsaEWSn4MY/N0JbiKk37XYpoKSgRIALlRSCAdisQVcu8XwlESV9hiovVL6NSPhTvByXY n/om/tHJs0ekLxFBcSuj/ApU10qfz4EmnMIRASJABIzHaTMifFZC/cvPz5for+oy0OY1N5tdJ/e+ q5aHabt+N3gplpYNuUl1/yTzlMf91HcS2/tOdePyY2JidM83jv9K9X/2WJrUzlVD527Uj51QJ+3O P+sOky29UjPCr//tbv8iHVyGsOOCrOxVxUKUDqHD3hmPqml49uOf1GitDCd3vqP6N/IRz3dO/UYO fmzTm6rf7lM9rE/u9ORp3T7vS/nMt+AgZJjd40ev9ajlkIuQb+TvEVgsfda/iaqviL/vB76Z+JXr UE+hz945nnzhury24VfhJN8t4w0ovkJpYe+GatprRA6SDhaL6PKkGV3redzqvCgdFk427kJPwdPs rstXt8xj68aoccrp3/Kbjdg85cg7n63z11imY2LCdHEv3n/SE7dDviL93voUSHO61pfj6e6uL55I rE1m8hzpbyHaTK7wqnVT27+Te6ReLj0nY94O/OBbIYLdrflrPHkbg8ZbXzYCT4eTdr9YWhB7rq4s GRmxQ6GkVE2/pWUt2mgBResm9HfafgtZlekumFUmnUlXIhAoAVHexd1UjsP2V9t2GNsVU/nM0km/ YiXfyp7HKdquWvHT5TGgR48Cdcxh7But5Jnb50jskERP+8va2jhD327sl83leDSzNvnpz4OcX770 dMrVST5bp7/yuvisZ5U3WaQ5EajWBES9FncrGLQikhGiyzeB8HDlZD3uy/tT4DDEPfqMKuCM9gAU 9ivk7D9+wIwhyqel3FN6Ottk0H0l9B+FST2vE49wNW6HlH0p6BWjP1whfvgCbFs3TfXnMVyAEUc3 Y3CccpqzsG+RNAn7s7bLB4BwO68dwGo2QW0vS+bRyj5I6WiRNN1UryvbKitBua716ysrArnZ6oq+ 9CawCQgrZ9m+aS2ewD/xxVuvy8816ryICQNvUcNE3/AI29fzJvn5r8XLsF9z6jn/jHH83Cleq/CS Z63F8pHxqgw45KIGtOLMPkROGLscg2MiVK/ccGV932lVPVvJDVDPZvf0URm4Ih5nh8NcqEalMxjj DSi+CNz2sPLJPJfdPPkuXKQm+zy0vf9hNcqEsV1xkfpk31AncTo2r5gmn8KtDTVg6lp8qs1Xt2Pj Nh316b+xsTaYf7ORi4/8jY7tiSWv9lVlik3sa8b2wse7juHBazSf0AbEl4n20keNTtluwPNoz6SR 50h/f9I1cj1eTU6+jm6OhSe+w+T+nvZV+Ofc5q0/gOkPafeODLB+BZV3MNJhv90vzFyO8XuVFdXx wz9C5pEsZGbux/70XVg2c4RSF9ihSKMW7xDoPHeb+eC0/fZEQCYiQAQqLQHH7a87pabtijmFgPoV K/lW9izqGp4hvqpIVBTbE9zXZSVPZ98Qg1O2443eLRVJrK1NYwfU1Gz+OBatnKd8BcL2rnY0Hvel k9tN3j7I6C9U+aVLrz5Su1wDymd9VPREBIgAEaiUBFx8hlKrucvl0j6CrYbUPdND1SIQHa15wWdJ MxQHT2LZJ7r8Y9+IMHV2xOPGTcydf1EZZulehLy8ArCtuRAZGYHIqCgmSy/C81SCvJw8xW9UPdSL CkNhOtvYOvZxsF9PsetEClrwk7Y1V0FeDgqY8PDI+mhUT5nIKmE68dOitSqVsM/CWSp0dlyMlT13 010svP10KHs/FrDPU/zqxT5DLmS6RllD0alh/4HlC/8kPoKl2SRQCYsXYQoP/onhubFPyIzTT6Xg +rDTyMkpAFMfUY0bgWWD9WWTi13OPD9ltVn+22FiVy6D4Sj/eLkuYn9hVvwsypMKymF8vMzyYhth Ug5kNybYsg6qkXob5HwWadDo5DNf879F7/NukveHvGH4Wux8Pd5bsIWNv/ywzF9VN15nolhdNnlD 0sap+vfdrljqI+evOW9tNEaztTxRvmzqbxBsKZf5U9x4e+ZdEUuKCpDHDqXhddUON0v+Bn28HkvL OwTp8NXu75rZEzcOXIqwFq/gF6+Duf7EkJoN5BPqI7tNx7FPB6oHMTnNB16/QtN+e+VAuViIcaHl +KBctKJIiUBoCIjyLqT7K/d2219f7YqIy/Sutru++xUr+Vb2PC7d2EAXOR87Mgs2FjH2OFbyrOy5 2KKCPBQUFPIOCvUa1ZNlWvm3stepZ/Zgsz8PVn750jMQrp7xqe98Nkt6ZbYT9c1fPavMaSTdiUB1 IyDqtUi3Vf029i/CP92JgJ4Ae/nVr1PTO/OZPZ+FiU121WvE/gzBzB/DmN9GOr/F7hO4zf2zibJ6 bKLMINzshT2M6WF2Wdl7+XWUDqYXS4dxKsVULzZJZPTnFXdAFixfTCa1hCg+wWZ2FbPxIpsBRCOW Z7Yum1zscpbz01bEiie7cvmkq/1yyGTzcm8y8SNU8xuvw/h42bCKTnYTETu86/LZpk5ZqxfJk5A8 qqQHldWzdqP1x8Uyf23qpuph07+lPnL+qtJsG6zlOSxfhhgt5TJ/Pt0i2KQt+7N7WfL3J6C0vEOR Dl/t/mklQX9//xMOZhfigqaeFedHdn2OvRL/sQq4Pe4mXfvrkzVjYLx4/bJP3xianokAEajMBMJs tr++2hWf6S9lu+srXt3YQKcEHzvqLNQHK3lW9jxgBBug8z/tZeXfyl4b1tRssz8PVn750jMQro7H p6YQyJIIEAEiUHkI+Jw7qjzJIE2JABEgAkQgeAR+x0czZsvi+Gf9dzU7N3iiSRIRKCMC51/fgsW0 FPzE+Dsu/ACxcV3Q+srz8du2uUhNZ8tH2cW3ohh2n/YTdtma/hEBIkAEiAARIAJEgAgQASIQIgK0 R2SIwJLYIBMoPqMIPMs+PwyyaBLnJqBhTEyqOYH8Q1iUViBD6DC2R0B7UlZzgpT8CkDgwg7DsG/l NPVE+r1pqZg9e7Y6Cdk+cRS2/bICcU3NNg2uAAkgFYgAESACRIAIEAEiQASIQBUkQHtEVsFMdZIk 23tEOhEaCr8lBcg+kovi8Nq4sGkj35+BhyL+6iCz5A8cPnICqN0YFzeiDw2rQ5Zbp7EIOYeP4RQ7 6qnJxU19b8tgLYRciECFISDvI5x/CoVsH7GwyEh2MFhjW/vPVpgElKMiYq8fqz1+ylE1ipoIBJ2A KO9CMJV7QYLuRCD4BER9o3oWfLYkkQiUFwFRr0X8VvWbJiIFoWp6rzQTkdU0fyjZRIAIEAEiQATK k4AYUFoNJMtTN4qbCASbgCjvQi6Ve0GC7kQg+AREfaN6Fny2JJEIlBcBUa9F/Fb1mz7NFoToTgSI ABEgAkSACBABIkAEiAARIAJEgAgQASJABIhAyAjQRGTI0JJgIkAEiAARIAJEgAgQASJABIgAESAC RIAIEAEiQAQEAZqIFCToTgSIABEgAkSACBABIkAEiAARIAJEgAgQASJABIhAyAjQRGTI0JJgIkAE iAARIAJEgAgQASJABIgAESACRIAIEAEiQAQEAZqIFCToTgSIABEgAkSACBABIkAEiAARIAJEgAgQ ASJABIhAyAjQRGTI0JJgIkAEiAARIAJEgAgQASJABIgAESACRIAIEAEiQAQEAZqIFCToTgSIABEg AkSACBABIkAEiAARIAJEgAgQASJABIhAyAjQRGTI0JJgIkAEiAARIAJEgAgQASJABIgAESACRIAI EAEiQAQEAZqIFCToTgSIABEgAkSACBABIkAEiAARIAJEgAgQASJABIhAyAjQRGTI0JJgIkAEiAAR IAJEgAgQASJABIgAESACRIAIEAEiQAQEAZqIFCToTgSIABEgAkSACBABIkAEiAARIAJEgAgQASJA BIhAyAjQRGTI0JJgIkAEiAARIAJEgAgQASJABIgAESACRIAIEAEiQAQEAZqIFCToTgSIABEgAkSA CBABIkAEiAARIAJEgAgQASJABIhAyAjQRGTI0JJgIkAEiAARIAJEgAgQASJABIgAESACRIAIEAEi QAQEAZqIFCToTgSIABEgAkSACBABIkAEiAARIAJEgAgQASJABIhAyAjQRGTI0JJgIkAEiAARIAJE gAgQASJABIgAESACRIAIEAEiQAQEAZqIFCToTgSIABEgAkSACBABIkAEiAARIAJEgAgQASJABIhA yAjQRGTI0JJgIkAEiAARIAJEgAgQASJABIgAESACRIAIEAEiQAQEAZqIFCToTgSIABEgAkSACBAB IkAEiAARIAJEgAgQASJABIhAyAjQRGTI0JJgIkAEiAARIAJEgAgQASJABIgAESACRIAIEAEiQAQE AZqIFCToTgSIABEgAkSACBABIkAEiAARIAJEgAgQASJABIhAyAjQRGTI0JJgIkAEiAARIAJEgAgQ ASJABIgAESACRIAIEAEiQAQEAZqIFCToTgSIABEgAkSACBABIkAEiAARIAJEgAgQASJABIhAyAjQ RGTI0JJgIkAEiAARIAJEgAgQASJABIgAESACRIAIEAEiQAQEAZqIFCToTgSIABEgAkSACBABIkAE iAARIAJEgAgQASJABIhAyAjQRGTI0JJgIkAEiAARIAJEgAgQASJABIgAESACRIAIEAEiQAQEAZqI FCToTgSIABEgAkSACBABIkAEiAARIAJEgAgQASJABIhAyAjQRGTI0JJgIkAEiAARIAJEgAgQASJA BIgAESACRIAIEAEiQAQEgbDvv/9emOlOBOByuYgCESACRIAIEAEiQAR0BGh8oMNBD9WEAJX7apLR lMxyJUD1rFzxU+REIKQErOYbaUVkSLGTcCJABIgAESACRIAIEAEiQASIABEgAkSACBABIkAEOAGX xC4tCuMvEvn5+VpnMlcxAtHR0boUGYqDzo0eiAARqF4ERH9A7UL1yndKLRHQEqB2QEuDzFWdgCjv Ip3U/wkSdCcCwScg6hvVs+CzJYlEoLwIiHot4req37QiUhCiOxEgAkSACBABIkAEiAARIAJEgAgQ ASJABIgAESACISNAE5EhQ0uCiQARIAJEgAgQASJABIgAESACRIAIEAEiQASIABEQBGgiUpCgOxEg AkSACBABIkAEiAARIAJEgAgQASJABIgAESACISNAE5EhQ0uCiQARIAJEgAgQASJABIgAESACRIAI EAEiQASIABEQBGgiUpCgOxEgAkSACBABIkAEiAARIAJEgAgQASJABIgAESACISNAE5EhQ0uCiQAR IAJEgAgQASJABIgAESACRIAIEAEiQASIABEQBGgiUpCgOxGwTaAEBQV5KCgqsR2CPBIBIlDVCVC7 UNVzmNJHBPwToHbAPyPyQQSqLoHCzM/RtXl7dOg2Cj8WSVU3oZSyciBA/Us5QKcoQ0ggrLSy/zy6 FyuWpWDN59vxfW4uXPXr47orbkLcXZ3Q6V+tcGLNVIxc8DVcUa0wauoQXBnh8opyx5zRmLR2H1xN OuCtyY/jfC8fwI8pE/HKh7sQ9c9eeGt4c3w0ciIOIMLEp8GqsBC1Wz+M4Q+3RqkTaxBdbR6LfsHc VydjW6GE2rWvxoChSbg6yjsfM1e9jVEzt+OiTo9jVP+2VZZ3+tz+iO03F65zHsau3xeihQmLsi4b BdnfIfXjxVi57GtknNiC73AtOsfEIbH/ENx3xyU6dUpyvsGYke8hr3Ztnb14OOW6GiPGD8BFJhUm a/tyLPhwKdI27MUJOUB9xNx8M3o+/QI6N6svRJT7PZQ8SsOv3MEEUwFqF3Q0K2K7IBQMrN7+jkWj X8Kqn/4ECoDWg1/F03GXCpEoPrIRLzw1GVlojIFvTsFdl0eqbsCfSBn/AuZmHMW5Vz+CWSMT7PTW mvDlYwxZu1HyC2a+MAY/QsvIO42nTkUg8eVXcXvTcG/HimpD7YAuZypyO6BT1McDtRc+4AgnKveC BN0NBIpP/YbUvWlw7auLk8XM0carqkEEPQoCVM8ECfleFfoXXYJMHqj/MYFSla0kw8XSyn++Uf/y 8/Mlq79NM55R/WnDCLMr/H7pg/eeVv1M2JxlImuf9GyNc1Q/c789ZuLnkDTqutqyn3PavSVlH0mT roVLDSPis7rXeWi+dNxHOqzSVx3sjcwMxUF+PLnzHR3r6AEfSYUmHnfOuF/2V6vDJCnXxL2qWO2c rKTTFd5Z2p1/ttyTdWjF67r8MeZp33nf6HQ05qfRP2o0k7Z6pStPWjLkTst4asVPl/J1sZg95Ekr 5s6SpkyZKW0/csrMQ1DsQs0jMH5BSVqZCxFlwyxiIwdqFypWu6DkWeD19sCS53X1/c6p1u3ItF2/ 64qI6At4+Yke8JlUrHM1PpRNu2CM1fgc0nbj5A6pmc0xy+LM0LWNxjTbfaZ2wC4pSapo4wP7mnOf laG9cJaiQHyL8i7uZjLKvv+rGO2kGYvKYVd2/E7ufVfuOyvKO0JFz5+KVc8qNq3K3b/4Y0v9jz9C lcld1Gtxt9LdZM0TC2Lj+nHJc2g78F3V54PPTULPO2NQ+9RRbP7oXYz5aBOk4qU4WO+/bG2WC/vY 3OaKTQeQ1Ly1GoYbin/5DqvO8p+MlGvt7sO477JrxKNyzzuAtfuKZHOPB29H3agL8OaC95F9hrf1 wDnnnIPff1iB5NcXy8/PT34PsQ1cOHNGfkTdC2PoBykFRWD/w8/Rhcuf+QAWPHkXnmh2rs4+HHWV Z1etKrsakifw/Jb3on//WnA1bI8Gkd4rQ3VQyuDhxE9b5FjYoAfj5g1Em8trYducsRgye51sP79f Pzx05y7cJVbZaPKzz7gZiGus/bn2NE7jIq8Vr9umPIGek9fK8s5p/yI+HtMXMf9XG4W//YyNXyzH rxfdhCh/ac0/gPH9BmKjdBYTbu6BVk19rw7yJ87KPeQ8AuBnpWulttdw4OmgdqFitQs8TwKut/nf 4rkHJnER6uVVvw35Lzwe3/wWbhy4VH6sUedF7JmW4Ls/KKN2QehndQ9puxF9KUbPnILDOAe1DArU YmDf6jUQGfLvv2w8Y3Cv8I+GckDtQMVrB+yWoUrRXthNTKj9lXW5ryDtZKixhkw+8QsZ2pAKLut6 FtLElF54RXv/LH2KPBKo//GwqE6mwCYi87Yh+Yn3FU6uazHnq5XocV09ldut8V3w2JBVGPbENFx4 cXM8cEcdvLzlT3y5bidODG6NBqpP4GjGVnmSUlgtW/MNJva4RkxpydY5+77BVjZ5wa87b76Y/Y/E bV17yM/iX/E1hfJEJFuFiR597se1YeU/QSR0q2p3trIDzyTPRbd1Q9CwqiXORnouvKMPZrG/inKd 3/IhjJ83DI/3bQNRC1u3boXoU5ei38LfgbMZOPC/fDYRqa15kD8tf+HZJFzvp65IuV9iWPKncnLr JE5H1n8HevK96cW4pmWcPRSRtXEh+La0Z3Fu7dBMQnJFQs1DJJZ/mm+Hn/Bf1e/ULlSsdqE09Xb9 5KFIlf4GWx2NZme/UyfJ/JXh4iNrEN/2edkb/2Fk06GxuMzfKKOM2gV/uoe23WiIrknPmKsg/YIf x0UiI/0UIrtNx526T9zNg1RkW2oHKkA7UPg9etdpjsYzUvFC3464QPtbo0XhqTTthYX+5W0d8nJf QdrJ8uYccPxlyC+cvSPRFRoCIa9noVE7aFIr1PtnwS9ImfsGur1wstTblFH/E7QiUukEBXRYzY7F 09WJwacXLNRNQgoCja67G+999QV6XHUJ2t0TL1sXb/0C3/+urGJU/JUgY8tWEUS+F36yEQf/1PoB vt+6QXarUTsZrS8zn8AoKj6tyJH+QrGyeFInlx5KT4C/WA4b0k1+KT29Phmz0v5nS2jW+neQmJiI Aa8tgzFrCrPWICkhEYkDpuBn96bOfKPn/gkJeG72JnYozI+YObwvYmNj2V8c+iSPw47sQjnewsM7 MC65j9stFn1GzMSPefqyo1Uwc8snGJ7UTfXfvkNvTJi3HnlaT8ysjT8nayOGJHRAzZgwNI9XNp7m 7lznPs/OxFGv82pKkL5qPpITRTxx6JY0DJ9sz9LFUpDzCzIyfkB2nmc1sM6DgwfeMb2gmYRUgtbF PU8M80gxmwyQCnBKQenxZ2I6uH6xvIqRT0p8+uYAzySkiV9zqyKsn/oakvoNwiJJAfbOyCEYPnw4 kpOSMX/rEV2wI7tXYzTL1/Zyniv5PmD4FKT9cFznz+oh1DzUeG3yU/1XUQO1CxWzXQi03hZmfoT4 l1fLpXXCxoV4sX8j/yXXxfpl6RBeuKizOmk5b9cC3N7I1wtZ2bYL/hJRZu2GQZGs1PfwBpuE5NeI Z7v7X1luCF9RHqkdqEDtQPEpHGE/+E0a0AlN68RgxKyVOGocfBkKTsVvLwwKV5DHQMu9UN//eMdZ Oynkau9ZWz7UjEljkZA4BPNX74d2+Br4OP1rFBUdxdLxzyGhfXN5fN0hoT9mr0rXyfeMq+35F/r7 56P49MjfBP24/SXMe9P++NPue4IS65/Y/MFE9G7f3v1eEYcR8zcju7gS7fErQFfwe6D1LPByTe+f lkWCT0BOfQ6u6IuRMHgG8Hc2SvsmS/2PJe2q72D8ZpulmM/kqH/eU/yxAQAAQABJREFU+yQelSbd ES27u2r1lbYdP2myp6N+X8kjX01T5b30+X6P/5N7pYE1wmW3B598VN33Ub+X5E/S8OsiZT+xz6d4 whr2fBRxuMI6SVuy/evknS69ztXFXZvX3Gx2qfudRDwu7T6yW+rlCpPzg312Jx3UbP61d8ajsr1x v0CxpwW3N+4deXKnZy+V7e59CUV8Rt3EM+uQpJkLx5vuuVUjcpBOJyU9xdK6N3rIugkZ2nutDmOl w5p0WMXP4+V7Qqo612wnCZ2VeArYPoo3WcYz8OOfFG9nflQZGlmZ8Q/U7sDCp1RdtHu4ifTx9GQU +9vjslhaMbSVLKdunwV+9nqz0jRPmhSm7PGq5S7MDUd/6Q5YLG2a8oiqs3DX3p/9+HurSPzaB4eH JDnj51etCu1BsDdTUuVA7UIFbBcCrbd50uS4c+U6yFbnsb2AC6U5XevLz92Ne0S698HiZWR++iFp mabtG5H6s1mRMdhVjHbBoJTXY7DaDS/BskW29EZMXZkv708Pm3sqd1tqBzxZINo9wUTcK9b4IE9a Nq6vvi9lez8Pn7tOOm62wTfr2QPr58uyvfDkQahNIk/F3Sw+UQ5cAfZ/EmNub7xjt50001KSjHv9 ijS52Ph1W4Fn/Od4nO4euwt5ZvfuU79SlRLjZjN/wk7r3z4fJQqRH0KWuLvCOkrPac4hEPbirh1/ OnlP4PupzundUF/HNO/OXL5oE1QIZDAlIPLCzFHka6D1zHG51oxrhF7aO8/Tavv+mZ8tLZv5rFeZ HzBro+m5EWb5aW5H/Y85l8ptq6033Gx1OV8RWfgLvt76F5MJ1O3VHleZnIItO2r+RV19Gx6poSzJ St34k+pS/Ov3mMH2h3TVvB29n+qPu2sovyLxvSTFJWXvw7LvlZ9yu9x5nbCme3kQ+PsYwhs3xysL kuTYz/41Dq8u3edXk/Ba7r0jmU+vhXmaHw41Rp3M5oljsTl9FxYO6y7bS8XLMaD3v+WVNx2Gv49d 6dswuXdL2e1s4VTMWX9IFz5381TED/1YtquTOAm7s44hP/cwlrx6n2x3ev0wJM/ZqwujfTin/SDM XTQTg/vdhtpcSaFojSjVyP1npYxn+yh+Iwfl+yhu2H8Imekb8MYTN8h23/zMPpPmV+FJdggtb8uZ qKbGHcNk6yD8+wPrln4gy2EDTjS/1PtEa86x5b8SkcRWqyYmJrGTsmcibXeWIe4iHN6v1EdX5Bls Tp3NfllPZL98t0f79glsheqrXqs9DQLY43notn0D02eC6jRgyjJs3rwe61eux4bE62V7nk9tB8+T zfyz548370VWViY2sXD8cwx+vdXzQazODuS3t2DxkNWQ/9nj5/FfZU3ULlTAdiGwepuV8haGpJ2U i+rCCY+zvZVL2J6xSlvlq/z2jbkUCe62r/v4jXit86W+vLvdKkK74E/N4Lcb2hhzt32KoensVHJ2 Jb7Th+3OW4kvagcqUDtwHrr+ex6Kcw9iybgBSqFiW7SMeTQejfkKSfYlSI5uhWRlaC8qaN0IsNzb H+/UsTV+MqVT8jPefnCq7BSZMFYe+x4/kol1i15Ds7Cmuv1oHY/TxTjYHTEf86Zu24ttK6ap47VP hyR5xmsO/dvnYz4eVMftj7VFp62bbY0/nbwnHFn5lrL1EUs/j2vVrn3YtnI22rmcv1ab5h1Z6gkE WM8cl2t9rKD3TwaErXheOWskWwHZFAkD3lIJJU9dhsP5ZzGjf9tSnsNB/Y8KtToajDOUjIFutttr ZeCxrVInV03ZT5cpX1quUNSHy5UWP9pIDsM+r5b2uVcz7vnvINkuLGaY9AuzW/xoC/fzK9Iht58f PnlRtuMrHTf4WOlIKyIDW9FpzG9jeeDP6i9S7JcgeQXg2Z+lwe5fGNmEkXpytNWKSCt7o2xxArWI j+sWP/wzzy8tZw9LQ2vWkssDd+s7y/Nrq3Rqj9TFXS71p7vmSTO61pPD8JWP2boEFktL+jd2u3lO +tbG7x1Gz0PoLDHJo2LqyLL4qswfNCsseZQHNqdKG/afcMeew35JvUH22230F5706XQr3cOxTW/K 8jkn42nGxtMejWWgRdL7Uo4afY66QsroT/usyws1rMFw5jt1JejsjL8Mjp54eJnSrzSVpBOb3lbT 033Wt4aw/h+Dx4Plv+EUeS0Hbtbz869bRfYh0mamo6gn/BdiahcqWrvgqU8iD83uunp7ylM/40dv dGd5ga0VkVw2+7FACm8x1mvVu1nZ0dmVY7ug08PkIZjthrd4D1u1Dnl7qhA2ouyYKUPtgJ6KlkeF GR/kH/ZeycJWSI5etEnKlccqlai90OMOyZMo7+JuFok2n533fx7etsc7PttJMw2Z3ckd6rh4wvbf LTwp1qUZp7dMXqBr97XtZt8PlK9YBC/O1L9/53y08s3G7ZJPfk7fEzRtN38HKvSsLJVO7JCecH/p RysifRY51TF09UySSlOuq/37Z3GOtGLmCPXdS84nvrJ+5grpiPsLRjUTS2Xw1HdRFszuFWK8Wqp0 Vq/Axjy0Sn1AP93UZdLl67T5L1HC2XMPQ4t7+8mPZwtXY8+vPBzbHzJtsWx3fZeb2ZopoNm//iU/ l2QswV55L8kS7Fm/VraL6HgPrqnra78p2Rv9CzEB+UdN16V44fMX5ZikMx/gxZmbQxIr68Qx/qWu nl9aXBeh65jOcly1OkzCpP63eOKNvAIJXZRTvHWnu+ZnYWVqvuyvTmt2enpRAXJycuS/vIJCXN1G OXTmzOYNyCrg7a3mYnsipv73RVygsbI05h/DrgxliUHijCRcbVj6ecUdnRF3jViV2BCPLtjJ1ynj 05GdPOkzE16Uh4M/HMTBg/q/w9lKmsyCIP8bPNtOyR++GnLJS910cURfdTdWLl2KlWw14rZdu7CN rUxcOOVZ9VfsPbMeQ9LsnYro/EPYsFFZscMt2ieOwsfrv8b+/ft1KxXnD0xCWo6f9qDE4376jGFz yvz/qfF0m5iMVlH6ul6/TXewTxhlnVau+oqtKHVwBZMHi9YRPwdqVmav1C5Y5F55tQsB1NvNbM8f vocrX408/vk2aoLsrIjknvmpz8V7hmHR9mNqWFuGsmgXyrsdNQFRnLkW/VJyZZeW/xnk1eaZBKnw VtQOWGRRqNoBi+i8rKPY2CnpTUiFOfhafJnAVki+1KstFmWwFdCVqb3wSlz5Wzgu94GMd3y1k1YI ajfApa6asusLt8RhGtu30dHYyUquxp6P02eM6qUelMidGt+aALZYQfZV8Luy/60IYst/IHxEBFbj dl/8nL4n5GdiWary5UD8a0+jhfbLwPo3YeKOyUIbugeRgON6Voq46f2TdQt7l6DTgNdViuOXfo3j f6Xj9aSOaGp4R1M9mRn8jb+o/zGjVm3sDNMlNtLNdjcW0xIFticigQuat8G1GI990j6k7clG53+c xYb5yjEhnW9WPrn+vxa3MD8u2c+Xe3PQvgP7FHRmhqxUt2436U7StqEpeQkhgQs7DsLkuKnyZ3xr hz6DjY/vxT9C8ZUxn7vSnPhYO1qZZqwRXcv7M2+z9LKeK8r9WW/umHtQf4yZJ2Z3tsBrs11XzUvQ SDeraRGWW2viua3lhT48OnPK/34xrrjxKa9Adft8hJz5PbVo3H6OYlxCvHoozPDP5rDTsuXu2yMj 6jLc3eMyzzMztb6jPXp2uQv/uqyjfDDNF0u2Iq//jagXXhtN+Kcm7ATdO9knl2teaKuGu+aaa7Bu XTGaxA+XT+b+/td8xDVqoLo7Mmj43X37lSZBo9D4UjawTQdqRjkpaEHmwTVzws8kJVXZitoFQ+5q ynWZtgsO6+3NJzej7VDlgJrRq97SvFhFoJa7/UQtQzsikspe/MYveBZbez8un7Q96I4n0PxYCm6v p/8xQXh3dNfwK027UO7tqFeiS7Du/TdU2+GJnnZVtazEBmoHDJmnKcfBbAcMsfh9LCnMx7Hso97+ qkp74Z2yMrWxXe415aE07ZrfxIVdxhYNvIIpnZQx2qCOsRjE2uvh08dhyGMd0cj5G6BplF49Q1hj XNO5DpByBuv2/cwOqbxRF86v//Cr1HG7Uz6Oxu1CK01+2HpP0PiPueZ8IcVzD1cmYT0WZAomAdv1 rLSRVvP3TyO+P07ksQNOGZQIrxps9Kp79jv+ov5Hx6u6PTjvhiKjcA37hW0Fm5jYsvRLnBjcGnam HlyNrsUDd9TBy1v+xEdpP+I/N57FvLNs9QXbH7L1tcqpnK6mzM91kXj5+1NY8+X3SP7naXkPSZ4p 97S8uLrlTQVPL1vVN3kihsQ+IU9CPf/OSsy61PxEc5EQZxNIIpT5nc0bOr5qxnbBY62jcUr/Ay2T 8ydcjTrj/5z8wuMrdu1RhL782XALZ79ot6sRA1dbbS3LxXn/MBvo/I6Zic0wNE1ZLck2/ra5V5ui SPgl/8LIV+7ERnZibvFXh5DH0lEv8mLc0jkK77KVO1Hn8nXL+qvxTfFsT5yRyqnaQUy3PhblqSj/ b7e1WdrNQoSAh48W05SfD/9mGld+O2oXLPMwiPXDb7vgsN7u+0L5OoHr/knqZPy1Vkwi5uLzFOUH w8+eHILk/c3RtP0TeKHztZ5kspVV57XsiXfXHkUq+1GC750af/8U/G/dEDT0+AqZyU674JeXTrvQ txtS7naMH6esOq/b533cebGzgb1O3Qr5QO2AZbYEsR2wjMPgUJTzIxbPHIN+//mv6sK/lpjy4Vj0 bcG/JKnpqJ+vzO2FCiAkBufl3koNO+2aVVit/YUdh+FYejOMGfkwpqSygTPfK5Sdpv5G8iDsy52M q7Wr+VjA4IzTS3Dsc8NXL1qlvMxO/bNt6xyPB70iNbWw9Z6gSdr5TaJN5ZBlKAk4r2fBKddKmqrL +2f0DX2wM+Usnk8YLL/j8XZjDNtyOHH0QoxI6o6rG/l+5xclwO/4qxqNVwUTunsIOH9NDrsAV3Rk v3R9cQYl6a9gzU8D8dBVdgojm1C5Jx7YsgyndqzD2pVK1DWvi8d1DcVLz/m4rSf73Pbl9fh+9Uas v4z/HAGwfSXR4jI7cXgSRqbQE4iO6Y2FvYeh98LfsevloRjdWfkExBhzsXsNbdGqvchmg3DtZ8vh 4SLvjaGC9MyKkDgYZsjodzCx8z+CJNhbjIjnlz/4LKnymbi3L2c2kf98AGl/P2Aj0J9YxJbLD1x4 QvbbcvgXWPSM5tN1GxK4FzU7anjqm/g0c82XGSjqH6tbhSkV/QG286Ui3Xlr4tFKk09fpmfhiRax HjfZ5Hl7+7vAzix06HgYFNM9mvHTeagGD9Qu6DO5vNoFZ/XWU6f2TH4De/RJkJ+kvzdi8uSNuKFB ApuI1Hs4zX4lb9zhBSwb8pl8aM3p9cl4eEIL3QpqfQibT0FqFypCO6pN8e4FU5Qfb5jl2Ke6stU/ Ve+idkCfp6FoB/QxeD8V5XyHxZMmoN9Y7wnIR3rcrCt3VaK98EZQ5ja2yn2Q2jW7iWvc7F5MTsnH y4d3YPbIgRi6cDf4wY5Pz07E2kHKasWAx+kudmij8XcUKR+u69j7APuCJf7ay+Qx4xmhrB3/ZcyH fw4l6qet9wSN/6+3HwJaNRCpk+/h4isCnS09BJOArXrGIgy4XAdDWU05sVWuShGnKL/BfP9kRxLj hi5PI+1sb2z7eCGG9VQmJBe81BsLXmITksPn4N9PPYjrm3reF82SYGf8Rf2PGbnqYce+uXR6ReCu pEFqoKf6TcYhzxyBao+S3/DFnJnY/Kvnp6Mr2nSQ3f/OmInHkt+Wzbd3aaVbUXllu46yfUnGJCQ+ qfhp9mQ7hG76yKMymZwSiEDP0fPkQDWu24eUlG9NBTS44BLZXjqTjuw896SVbPM75o+ZYRomaJaR 7k+LmcDpc5cHfX8crZ7iE/A3p3nHU3D4O2Qc1uzrKO9VmYcis7qjFWrLXISUYR3Q272vI9tgGV++ 7mfvSTO5hd9iNvsRgF/ht1zs/mynLprfqtTbvxYvwU5d/gGHN62R94aTA7n8zERqOuW0nf+Tg6j/ 2EhW8PtwQRryVAfFUJyZhifdp/l2vPtW3QuUwSt7DCUP79hUG1N+qms1MlC7oM1sUa7Ltl1wVm8v vWsElrJ9Y1NSUgx/89DLXa/P6fAKlqYsxYSu/9QmTzGzvSXBNsvoOuFDdW+wtf9uh4lbj3n7NdqU WbtgjNj4XEbtRuH3mPXsMjnysBav4D7DS6xRq8r7TO2ANu/Kth34A0uH34fIxs3USUi+ApLv8XWi KA3PGCYh+Qunk36+XNsLLdQKabZR7gMZ7/hqJ21yqHdxK7y4YBPbVkn5ofzCc2urIQMdp/N94lM2 ZapyuCE/Yw1eTv9LtouK1s9S2vIfCB+dBiYPvvg5fU+oHa3uvflF6jeG8epRzP7P8yYKkFVwCdio ZyzCQMt1UHR1Wq5KEWlo+5fzcHMPNiF55oS8x7A4GX7BmH5odmFtdB+xzFAHnCaE+h+nxKqUf+Mp NixxfKZI/dOffi1OZv5JGn5dpOrHFX6/NGf5JunHn3+Wfv7xWyn1/dek2101ZPdZO494TtY+sVt6 pEaYGo7H89rqTI87Pyn7yFapp/v0Y6GHlx/3idpa3ejUbJE3zu6CsbgbywN/FqfRsc171ROytf42 vXqXLk8ju02X8jUeTu37r+oexU5kPlxYLBUez5De6Hquaq+V7Ss+6xPQPKfYdZ/6jSZ2Sdo5+X41 nm7jP5OOs/jlq7hQOpK5W5rzarI0PvUnNYyv+Lknc/diacXQVmo83cd/IcdTnH9c2rRwpGz/L3Ha c/FB9dTx2t3e17FSlXBg+HpyDzVe+QTGrCNSVmamlKn9yzouyalmJ+PyE/2Sxi2UdmUekQqLi6Vi zmH/BmloXF1VzkD3SYdcjRNfe06srpM4STqYW8hsi6VDm+fLJ+XyslOjzovSQcNJ4d5JyJbYgTNy HHUSp0vZhYXS8cwMaf+Rk7JXbTmKH/4RO5WNCyyWju1frZ5CCHZi26ojZ7xFa2xCyiMAfhrVKp2R 2oXK2y4Ep94Wek7NFu2XuxSLdpCXkWm7PCeynjrwqdqOsMkPactxzYmipjWgbNoF06g1liFtNzTx HFr2gspn4Mee8qXxUuGM1A548kmUe+2YRZth5u5lPD5gpyWzl0WlnLE+k01Auk/H1mqqN1ee9kKv dyieRHkXd7M4zPPZ41M7nuFyjONirbu98Y7vdtITs8d0at+HUkx4F2nWyr2SPJxiTif2faKepB0/ /kvVc6Dj9BoxMXI5e3beRlbGiqWTWWmm4zXBy65/p3yEfKt6KUm++Tl9T9Dq12fqRsa3mL2/bpdG xUWp7bu1Lip2MjACoaxngZZrs7yj9093cS3OkzYtnaD2Ma6Ix6Uf/L7/+S7q1P/45lMZXUW9Fner NPCTe3WXCCDu2sk+rfnkz2leE4YijPY+d+cxzURjrrT40UZqo8P2h5RW/3JS484n0Y5K0x+o7/ET 1knakG304z3Zpp2ItONfm5bqbNbmFTebXX47eDbo7aKZPGYnWku5OkHZ0is1I9Q8NcbJn3mjvz1f eWHVxifshDhfHcGMrvXkOIwTkZJ78kgbb4x78CTsbhz/lYhCN9FojJ97stLv7LE0tWEWcrV3dSJS w6tunwWlnIjMk6bHeSZ0tfFpzXyCMqOQ8dW+oDDuWj/CzPYsM+RfniTYCj/G+7Rtv6n8rA3F0mf9 m3jF2fcD90veyT0SW33l5a6Na+AH31qLl11CzCMgfn5UrsDOgr2Zitp6sNtdd3X+NOWcy6F2wby+ haZd4DkRjHpr/QOPyH+et9qJSB7zvoVPqfWY53sOt7S8yqJdsIzc7RDidkNEf/awNCqmjsyGt8m7 eZtcCS5qByrZ+ICNeQbHxkmjF23yOwHpKX6Vpb3waBwqkyjv4m4Wj2j/zCYsZP/++j/H4x0/7aSJ kid3vqO2wzwtMTH68dXi/dolA4GN0wUjs3v86LWqVoKXmT9hp/UvOeQj5GvfJdTIZYMffg7fE/yN 93marHXRa1bdn0T+m3HQ5iuNMyvY+yefkFz0mhTTws5CFLPc1dpR/6OlURXMol6Lu1WaAvg0m4lk l6vhDXjvWAb+O+5psNWPiqX477oW/Z6fhC0/HsF9uv0jw9Ci25PCF2p16o5/nmfcI7AObknorfqp 2+cBXF/X6Ed19ja46vADjOkKIoHwcD87WEXfhOlrx6kx3tO1NeqpT9xwAUYc3YzBcWxvUc3VImkS 9mdtB1uhJ9t65VvNJqjtZakIqGGiUlSU+R6ViLwOs//4ATOGdFNjT09nm9e4r4T+ozCp53Xi0XP3 Eb/syeDuatwOKw6tx+CuLTwyuImdUpg89Qss7Ofe9zCqCW5ophwFzrditEiiXoblUxiiL/QvwVWz oRJPdDOMXTIOXdsp8WvF8k26x3/wNTuNu58h/87DgI+/xZxh3bXeZXMs28R41f4TeLp1Ey83b4sw JIxdjsEx+rivrO/+pDu6ORae+A6T+3vyScioGdsL89YfwPSH3AyFg9c9xDwC4uelZJWwoHbBIhsr RLvAdQtWvXWn03BYvTb/a4Xrt2X4Z683sGTITXLAM1u+wW9F/H3Y6iqLdsEqbmEf4nZDRFOQi10Z RfJTt4ls72vDQRHCW2W6a8uBqd40PpCxlOn4gI15Jn+7ASMfboN6+qppmkWKZWVpL3wkoQydSl3u HY93/LSTJmmPju2JJa/2VV3S05W9gPh46uNdx/DgNdqBdGDjdPmT/7lT2KGF+vfA5FlrsXxkvBq3 MNj275iPOwZD/yvi5VuH+Bx/OnxP4PU5ZV8KesXoD09skTTd93uNRyEy2SBQ6npG75+he/8MOw9t Hh6BvbvfwGW2+xmrTKf+x4pMVbd38RlKbSJdLv2kH1stqHW2MJfgzz/+lPe7i4iIQETdCNbkW18l JSXg3WFEmLUv2Q/zFBFh7ccYQ0kJH+CzuO0HMYqods/R0foT3wzFIeg8CvJyUMAONgiPrI9G9ZQJ KZ7XfJCgzTdfeVlSxPKZlTPvbGblSi4CTJaV5sxDXl4BmAqIjIxAZFQUK4f/z96ZwEdRnn/8t5BI giY2XB5YBI9q1SSACrZVFEirUpHgQf8qh6UlgFUJViqgVpEqCiiHlcsKKKAVUA5FPAiX1YIalIBi BSFYQSFCIEtJIJH5vzOz7+zM7M7uzmY32SS/yWcz7/m8z/t9j5l99p13AhOHKl9NHS6+wluKg95y Uc9UpGVkWF7wopdWBa+3SpQfrB6B+sQjpEK89MUrWFb6WGRkmG9Kg5dYJfa2LBX5KiuTNXYZQv9o DrUfqPtjpqRlIC1IA/jLEYba1DTRV8LrFo0e5jxuebhNby6rrrjl9YDzgt5i4cZ9uPjamhf84ymK cSvmZ22sBhmnYiIUO7KKcWyevE2dW5urRVySQ7wpqeZMxHnBrqPd73YeiObexl5mTfs5D1iJhxvn 4eJrax6w1sLZV1fmC+caVC9G9ncpJd7XPz/vyO53ws2TUm/jbNz3qvfe4e+nIrlPLyv6B07NHgSx 6g9FR5fhkqRjKClR7w2BtFYtkWa7r3ab3tBdOCLlE27cSZlh+Rm8Qn9PMOSViO81ouLhvtfI9Dxb CcjxFu9xFkm/VjUL1Y/4/dPadvHw+cd7Yt+vxqPu9UmmHNeyTk7jO0aGSFkMz3WNQE0bIusaH+pL Ag2ZgLyQOF1AGjIb1p0EGgoBzgMNpaVZT5WA7O+SBq9/koT/bDYsFh5Yhg5p1kUs/pS6y216e376 6y8BOd44zupvG7NmDY+AHNey5k7j27qWXqbmmQRIgARIgARIgARIgARIgARIgARIgARIgARIgARi SICGyBjCpCgSIAESIAESIAESIAESIAESqLcEKo/rVTvhjayKbtNHJpWpSIAESIAE6jABPppdhxsv Fqrz0exYUKQMEqifBOTSeqcl9fWz1qwVCZCAmQDnATMNuus7AdnfZT15/ZMkTOeqQ9i95wDQtBXO bhnBHt5u05uKorN+E5DjjeOsfrcza9ewCMhxLWvtNL5piJSEGuiZhsgG2vCsNglEQEBeSJwuIBGI YBISIIE6ToDzQB1vQKrvioDs7zITr3+SBM8kEHsCcrxxnMWeLSWSQG0RkONalu80vvlotiTEMwmQ AAmQAAmQAAmQAAmQAAmQAAmQAAmQAAmQQNwI0BAZN7QUTAIkQAIkQAIkQAIkQAIkQAIkQAIkQAIk QAIkIAnQEClJ8EwCJEACJEACJEACJEACJEACJEACJEACJEACJBA3AjRExg0tBZMACZAACZAACZAA CZAACZAACZAACZAACZAACUgCNERKEjyTAAmQAAmQAAmQAAmQAAmQAAmQAAmQAAmQAAnEjQANkXFD S8EkQAIkQAIkQAIkQAIkQAIkQAIkQAIkQAIkQAKSAA2RkgTPJEACJEACJEACJEACJEACJEACJEAC JEACJEACcSNAQ2Tc0FIwCZAACZAACZAACZAACZAACZAACZAACZAACZCAJEBDpCTBMwmQAAmQAAmQ AAmQAAmQAAmQAAmQAAmQAAmQQNwI0BAZN7QUHD2BKni9pfBWVEUvogZylm97FV0bNUb7nDHYmdiq hqRRX+oRspKMJIG4E6gb81bcMbAAEogrgcQaZ/Xl+llf6hHXrkfhJEACJEACJEACMSOQFDNJFFS/ CXh3YtGcF7Bg6QrsXFMET1Ym2mV1Re87BuKm67KQFsPaF83JQ/bAOfCcdDsKf5iPDmmeGEqPnajK Si/WKifgWV+IH8oVnJOgeoarcX2ph1bPqh+wbNo4zFn6KTzth+ClZ/rEtG+GY9mg4iu+wZzHJmOD 6PtNm16AISMH44IgY2DH23/HmBkb0abHHzEm72rU14tObcxb3r1bsXzxK1i59N/YcuB9bMVF6Cnm 5X55+bj5qraW7lhV8jGeeOgfKG3a1BIuPUc9F+DB8UPQJkgDFW98A/P+uQhrVm/GAS1DM2RdcQX6 3D0CPTObSREJc45O3x+wYOzDePurI4AX6DzsMdzdtZ1Rp8o9azHiT5NRjFYY+vQUXHtuqhEHHMGy 8SMwZ8t3OPWCOzHzoVykmGLrvbMB3x/Ul+tnItbDzfxW78cYK0gCJEACJEAC9YxAkK8c9ayGrE61 CahfwG75aQ6WKz/6ZRUVoUh8ls2fguUzP8Nredn+OBzCyrkLsb1MwRW39EenM81f2EzJHJyVZeKL oHoo4ttgHTmSE1rPyNsjsesRGvKeTa/jrsv6GP20SeNbUYcXqoaubALEln3+JgaOm2RoMvtgM+yb 3ifAAHO4eD3mL1uEJkcuxf3CEJlh5Khfjpqet4pXPoF2PR60QRRzsm9eHjD3Y8wdcJkRf/Sbj/HI rFmGP8DRKBP9xwxGG4sx+RAWDe+DPpPfC0heVLQWi3a2Qcl7Q8MY+yOffwIKcR0Qvb47Fj2Fvn+d YZS4r/swiyGy/PsvMGXZMi0+56/jcC3817XCGQOR+8AiLS59yJ14wZBS/x28P/C3cWJfPyMfh4lQ D7fzm78V6CIBEiABEiABEqgLBGiIrAutVKs6VmDJSL9xp/foF/BQv6uRfHgHlsyeKL7YrsI3h49a NSzbjvEDh2qrBSdccYtrQ+TpHW9AXl4TeFp0Q/PUxFwNaa1wgvuq2R4JXjuhnjA+jP4d+ox7N0BV TnABSGIXkHySRVbZjN9h3l3XYlDmqZbwZJyi+z1N6u1qSLWCNT1vHfjqfY2rJ7knnpo7FF3ObYIN s8chX8zJ6vHiwIG47deFuPZMn1nB1F79n5qOrq3Ma/aO4RjaBKxo3TBlkGGEPKnbA1j8xABk/bQp yr/fibUr3sB/21wexggpFKnB+Sdqfcs+w59/5zeqq/wCVvmb+Knx8ti//hlcNlQ3QjY6+QF8+mxu ve7nst76mfcHVh4J7KvBcRgLCq7nt1gUShkkQAIkQAIkQAI1RoDf02sMdR0tqGI3Vr18SFO+4/Al WPi4/JJ1LjI7X4uhf9mKsvRzrZVLbYrWULcfPYFTm/pXjVgTOftaX9UfM8WHR4wIuGmPRFgK4bLa lTveMYyQ/Z+aj1/snYyhUz5xKYXJq0sgEx7cM3wOeq/KR4vqCquD+Wt63jq9420YP3cU/jigi7HK tHPnTkg/2g4D5/8gpt8t2P5tmTBENrfQVLe8GHHfYFySFPpHHuXgBxg1/HUt78n9pqH4paH+dj3z bFzYsatFrqPHzfzjKCR8RHX0LZg8Ul9JLVaFZp7Yii1QwhcoUlTueRc5V9+vpVUNwut2jcM5Demu ivcHEfWThEjkZhxGex9Q/jn6ntweraYvx4gB1+MM828dLiFEO7+5LIbJSYAESIAESIAEaolAQ7pl riXEdbzY42XYJ/ZBVI+27c4KWOnR8txL0NKoYgUKpk7Ewo/XYIGiPxT73EP52HVRC5QfKEf7fvdj wJWtUb7jTQy7/x9I6zEcI3+j4PH8sXh25zpktnoYr775V7T5dgXy738V5ef8Ck+JPcvO8PVSc75H b/spFk+egHmLP9T2LGtxTlfcNXIEbu7c2tBGdVSVbMW8GbMxb81qHDiQgebtWiP7ojb6Q3XlB+E5 5xY8fE+O8Tipt+QbFH9/FM3POhdnZkR7N66rsOP91zB7/nys2LBTC2jeIhPX9/s9/nhnd8NwoEbE r15X4oMI2kPXVvxvfBoq94m9QF+aiOlhuBp5EsCRfFZ7sffgKHS+Ox/XZrbCtjkFQisaImuqaVQD zMg/JWHc5CVAwXDMXHMLHux6Vtjiiwuew8NzN+DkC27GZNueeuXF7yI/fx6Onn4Zxky+F+ekeGzj 5HQsGPcEpq/4TJTTDNndrsPdI+7VVl+X7/4IUyf/HS+L/QzVI/uGoXjwfrF/ZUZww1s049TNvKUp ITYJKHp7AeYsWIrVRep80AzniD0W+w4cLOastnoS8d/N/KMaPkdcZWT1OU7BbweNAub/WfcHu8KL LS+OlovogCV/VllfF7yirWqHMM69/vQQvxHSmiyEL7LrgRSwZ9M7mD1vgWUfyl/8Nhe/638bul7Y SiZzPEerb/mOV5HzyDua3Alr5+OM+b9G31n7HcvRIjziBzZlF0a06WkYLecWzsOVLYP3sdDC6nBs A7s/iKaloplfYnt/U4P3AZVHsUf8AL1gSA9MuisTo6c9hbujNEhGPb9F00jMQwIkQAIkQAIkUPME FNshNFCXAhifsrIyhZ/6y8Dc1qo74DixWxmTdbLeHxplKjPX7wpI4g8oVSYlNTX6jl12i7EfaEkP b34+aBph0FA2lZ1QDn+ix3saX6NsFH55OOUzlzPh/e9lcuX4rncUsUoraFkyT0rOP5RymeP4f5Q7 PEla+iY505QyGe5wlvpIvf3JKpVVT97iWG6T7uOU3ZX+1FKO1CnYObp6Va89zHqYy/drbnZ5lcL1 BUrB+vXKesePGl/o4+o2vbms0O7N038fcRuGlsRY2QeCkZD91pPyR2XTnk3G2BGPpypfm/q3U3t8 MvlWo50O2gow5gAxJ8g5QJYndbKf1XE4Y/74oGO+Ueq9Fp304mIzTuX4N3S2zVuK4lUW5l/uOB8M XfyVro7L+ceGzPBun/8no6xnC38wwiU/Vd8tlf551UhgcVQqb43spMk5pf88xdScllShPZHNP4qQ vm7KnYbO9nZV/fct/jx0UUJGdPqWKpO7nqqVndp7mrgWlCuzezXT/DdN/dhSpuSn6vNi0S5lqalN H1y+05K2vnlkmwTUqyHdHwRUXg+Q/ULOA/5ksZlfJHv1bL4OR35/E9k4lPUwl2d3m8v319PsKlWW PjXAOpbFfePoOauU/caNljm9e7fT/OZeknMOe72dUzKGBEigugTkeKuuHOYnARJIHAJyXMuzk2bq 87M8SMCZgKcNcof20ePFo36Du7RDzpDJ+Ojrg0Hy/AS9N67GqkUTjLghU5Zi/foCFKwswOp+lxjh ZsdJ3e4VK4VmYNjAX6GpughRLkRslGY4zemlOyX3URQUFmHVHP8LGx569BWIhxLFIfauerivvlpF rOiZuX47ysr2Y50p7Sn9X8BHM643VkOi/LB4Wap6Dy1UOLOJdo7m38H1U5EzcrGW9eR+k7CpeB/K Du7Gwsdu1sKOFYzC8Nn6aq1g8mNXr+jaI3T5wTQWYWXbcGeXHHTv0gVdHD/dkZPzNHZXCMZu0zsU y+AEIPDjPiS3ao9H5w3WlDnxv6fw2KIvwiqW3OQUI03Awj05B4gUJqeRXnW07zcO64sKMX/UTVq4 UvkGhvT9izbmu4u9bAuLNmBy345a3InyqZhdsEtzy3/VHaeRzlvFy8aLfRY/1opV91lcvW0XdhSt xpODLtXCPt6pz1ixmX8Oifn3ZU2u+CEH7dsFvtFa5dTxN/0wuF8/9Os3WLwpewbWbCrW8vj/VWD3 tu26nNTjWL98FoaL9LnduqFbt1z0H/4YXttoz+PPrbsim3/Udrh62Fwti/rY+OL1m1FcvAPrxHVE fdxfPZ7p8394Z2+l5g7+Lzp9i5c9g/w1hzWR8yf8UVwLqsRemfo1IHg5euiArHbI9bXpTePX4m89 24VKXn/jGtL9gctWrO78Evo67Ob+JrJxaK9e6PLtqaX/J+j1l7moPPg1Fj41RA8U941P/D4HrU7O woNzC1BSIdNGcw4/v0UjlXlIgARIgARIgARqgYDdQilUUO/CjQ9XQ9bf1ZBq25rbWnUHP7zK0sdu DkjbYfCTYiXU0cAsx7caq6NmbflfQLz5l3d1deBeWwoZb19hIMNVPXNGL7GsWJSrYdQ82goq00qN AXPNq2nKlWm+FTADZn5mK7lEmd33Uq2evceu8K+UtKWSXqmPVc9SZXqvDE1GYN0qlYV5rXxxkxS5 CkzKiVu9XLRHWK6y8vZz5dfKk337KX3z8pQ8x09fJVf0ma/LxWost+nt5YXwO63AC5GFUQ4E5PwQ LFr2W/+Y26kMa3SS1r+FQUlb3azmc2oPp3A1j1m2ukraHCbHibHARoz1kY2baOWqcQNmfqil1/4d /VS50dNYi/u1ZYVb9cZp4NgOrrMiZje5olxdlfmlbWnh9vXLldXbDvj0dTf/+Cvpd+1b97TBIX3I q5Y57PAnzxlxsl3N5w6DX1BKDFElxkpBcxq728LayGtzhJx//OWofUaufpUSDqz7u6HzTQHztUyl nv1y7Dqa/RZ9j/qvUzlj1/qEeSNaEanKVFfbJ3cYZ8zjZm3qm1syDF6vhnJ/ELz2weYqRane/BL2 OhzN/U3Iceifv9S2Dlt+cBSBoWW7laUz7jPGsNaPxArJsQvWKQdtc2Fg5sCQUPNbYOroQ2R/l+fo JTEnCZBAOAIcZ+EIMZ4E6h4BOa7l2akGXBEpCPEIR+AU9Hp4MXZteA2DsvwrBT+dORIdWzfF8xv3 WQVU+VeuHDuubkbmcIiVistfegBnOEQ7BQvDB8Y/3MuyxdmvbhtkJNdWUHkPonCL/tP7+W2aG3Fi 10gcO6Dveek95tdTT9ACv5/3iWqNxesP9fCvlDTlDussK8bK5WVaspM7ZyGlwouSkhLtU+otxwVd +mtxx9evRrFXvT/3H3GrV4TtEVH5fnWtrqRz8MC8lzBv5kzMdPzMw5IZD2j7/cFtemtp9CUYAW3M edphxJsPaJopx1/GAzPWx0VL2U+N9yCIVVm9nuipldWk+yRMyvuFv9zU85B7o/4Wb8uWiNUYp+qe iRHPW2X7jHmo33SxT6Vt6ed5V/UU+x/KVYvVnH/KPsZ91+j81dWQCx/ubZnD0n92HVYuWoSVYnX6 hsJCbBAr1edPuc9YdfjpzD9g8KxPdHZlu7B67RGDY7d+Y7C44N/Ytm2bZaXii0MHY02JfR41sumO UPNP2bdGOb0nDkenNH0FpJTQrMtNeDJLXzm78u0PxYp1hyMKfddP/bO2l7G6CnP8/V0MwZGsiFQT qy+0qfx0FBbYr3+GpIbiaCj3By7asxrzi5zfzPNVTO5vQo1DU9UiKt+UPqQzTczNg5+GUl6Cf8sn ZcQKyYfvuBoLtugrkUPmN0eGmd/MSekmARIgARIgARJIfAI0RCZ+GyWMhm0734RZm49gV6HVIDn4 qkH4qNRqVItEaU/jtmhpvtuOJJNME+a7L9L9BojHn30FO9XHgcWxf+PrmF2kf8F2/FIry4jmLCwy ab7HCQ8+8Vs0S01Hq1attE+z9HRk952oSz3hRdAqBA00KRLveoUr36QKnSRgJ9D6+nsh9tzTgt8b eQ/Winmhqf+3C3vy6P22fto0XZ9IGqU3CXihVtBCqjFOXc1bpnJ+1bF1UFViE/gdnsrNMV4SNnrJ bPG2bM087Befdg6uu+UWXHddN3Tu2BGdr+qGO+59GoW73sY1Hv1WYMXCf6FUzZHcFKf5wn4tHj0u eOmvuLnbFbjwwgvR5Zb7sWrV47pcYVT4/L/6Dy/+gly4THyuu/L8IBnT0KrdSVp447QQHcmlvuU7 luDqkfoLasa+/Qw6iJch6UcKmvjmbzSx8ZPaCUP0+AVzIFbaaiH3iuvfv6K4/klx9eXM+wNTS5r6 Ne8DxM+/5eKlh3u/MwFy64xgfnMrkulJgARIgARIgARqlYBtfUat6sLC6wSBJLTtqBokv8fVw/ug 7+T3oO45tn77QXTqZF55WNuVOQVX3HobsOw5lC8ZjnNTh6Nr12ysWaPvzaiuGBr1f9lxVbJx9o34 Q+d0HD1qL+YIPC174qe21T/2VMH9tV+voHpV/AejevwfNlreBx6Y8qCnE15dMQ4X4Ct36Q1DQaBM hiQSAbGqb/JE5GcPAoSR6v7nVmJmO/GG4RBHSANTiHzBooR93/URn3EaRI2qIGExCfoBM/plYuQa 3SB409QPXe1ZmNz2N3jo0V9jrXhzdOWHu1Aq9MxIPRu/6JmG55cdRNqpPwnQstXlOcJ4+ZD+Vu24 1UsvtqLsR1/5ukEyQBk1wKW+X6x4xRDz2vLJ+N970hB5EG8u00yxWHJXPoZva48zuw3CiJ4XGenV fv2Tjn3w/HvfYXnOaO36l3PrFHy7Kj+KN4v7xdYPF+8P7O0Yn/klQe8DbJWvKPkPXpnxBAb+9SUj Rr33mvLPcRjQQf/ByohwdFRvfnMUywgSIAESIAESIIFaJUBDZK3ir8uF/wQ9f9cNEIZI9WiV7rB6 pLaqWPkVJvWfZSldGiHVl0wsnzUWXVvGQWexUku+8CZ/7HOY2PMsiw7V9tRWvcIpfrwMK4SRV31c MdThOekMfSWo2/ShhDIuoQikZ/XF/L6j0Hf+Dyh8ZCTG9tRXjtmVrIS+Mrni7c3YK4xZ5seWk5Ol YcieK0b+eI9Tk5pyPvjmkGoljfTLt0lASOcRLBh8PYbOP6Cl6jh6BRbcY3o0PWRef6SBu5HfaCwf UX73gy2oyMu2POatVByC2NlSF1CduwhTO3xQVIxBHew/DvmtnD96Q1uZ3enrl/Xp5CfxqR+F4VJ+ XIvJk9fi0ua5whBpBGuOY+WVaNV9BJbmL9FeWnOsYDhun9AB74642pqwwfoa+P2BqV83qPsAX3+v KNmKVyZNwMBxgQbIO2+5wrKtTughEpv5LXQZjCUBEiABEiABEqgNAtX5ClEb+rLMmibg/Q5bio/h 55ltAx559Jb6l/rtLxN33vIw3YSv+eRb3N2xuYypsXP5jk/x/IlKqL++r/z6LVx7WhVKy6uQlJqG tJQQ3V7d09FbhbSMDIRK5liRVN8jjcqPmDbnDTzSc6iLm25HqUZEVPWqifZIz8Qb2zbD3A0Mpc2O 5HScp65uTHGZ3iwjQrd46TqPWiGQgj5j5wpD5A1odPEXWLZMrmizKtP8jLZagHK8CHvFo60XtJTG xx/w4hPTrYlj7YvzODWrK7dqePrZN/CXrtb5wLt7K4rRBplnp+tZXM0/FVg2qjv6+vZ1FC+YwBuP R7G3bflnmPVIgVZ+8i/ORkttejwF7X/ZXawoX4z/vbIQn0y+A1dmyPYBdq971/+jgyfEfKpKDTX/ JCcbW1n8c94aTBqQbVlTXbljDe7yvdX6+ut+GWIudadvu2sfxKJFf8BJJ9lXWZZiYe4ftUfcT+r+ KBbcezGat/u53jbm/4pqIE1Crwn/xLCpP8eUE8fx3l+uwcRffI/7rzzNnLJ+uxva/UGkrRnn+SVh 7wNwCItG/wF9xr1ukFLvwZ4SKyD/mHsFMsJMFUYmzRGj+c0qlD4SIAESIAESIIEEIeDqtiBBdKYa NUig7KslyLrsT0jJHYb59w1Gt/ZnIamqArs2voq+Pf6maaJubt7lfPnCBRGUfhp+mZmK5WIvxnf+ 9SG+638BkvbswIHUNrjwTN8X7jjXIeW0s7R9z9b+uBbXtW2Krr16oXWasEw1bQr177yO1+DGPj1w QYZpVWTVTuSfrH+pbNr7BXz/+sAQX3wdKpD8Mwx+JhfP5y8Sj4TfhQETzsDMe25AS9WqKbjt3b0N 77w8Dz+0HypW2ZzvIMQ5OKp61Uh7pODsCzOdFQ+IcZs+QIApQBiZS0rFa4iEaUC8wWTP/r1a3Imy wygpLUVFlW40yGiZEWBMNwmhM4YEktv+FuseuxZX/1Xfh08VbTcMn/Yzvb+oK896PTwHWyf3Ryvv l5gy6EqMXObyRQZudY/zODXUSb0EdzzQEQue/EibD+6ccDZm3PMbZFSW4sPlU3F137/hNzM/wzti xSFczj8bpvRDrpCrHuoLVx7P64R9X3+tjQOj/KR0nH12SySVf468Uzqg0bg5yLu5Ky46u5UYC1XY v+PfePauG429JQcOvNqY837W5RohZrH26PF1w6agaMoQnCMsCcXvvyzmzqe1Ihqd/AB6ZIZZ5Rly /rkYeWO6Y4HoJ+qqwj4PnokXR96EM8VUvf/L1Xjo4t/pVRH7MubdYHo8Wg+1/Hejb7OkK3HLhZbs Pk8FDtx4HxaIR9Jv6JOLW260r9C05REv3Rr3n39iyvk3aRF/ueb/cMV3q3GlYVS3pa9n3gZ1f+Cm 7eI8vyTsfUDZdkx7cqlOSt1L9dVZURgg9eyu5jc3bcO0JEACJEACJEACiUHA/jptoZX6vJXxKSsr U/ipvwzMba267cfhzc8bfcGeVvofXP6VLVulsiTvtIB8A17W00mZwoCpbCw7YcurKE7xTuGqAHPc Jk1mpTIv+9QAHaTO2rlRprJ8x1F/+Yc/UsQLCLQ8p/Sfp5T5Y4K6zGVa6nF0qzKoUbKl7KysLIv/ svEfGjId5YgU5rio66VE3x6B5RtqJ47j8KeKeNmGha+lnUW/VvvalvLAvpY4lUhMTSTHYNqF7Rum 8aTKEW+0Vg5aBO1VHm2cErbd5NgylyfDpLjN03+vyWmSM802br3K9F4ZWtxNUz+WyfVzDMepKtBJ vxP71oTsn8IQqetj4hV+/ilVpnUNM7+p/f6k2/V+L2SHGyOn9H/B1j6lBjvZD+znZzd8r+se8n/o +UcR4/cOT1LIfjD0ZR+jkOXEQl+vMrtXs6D9RbavyuDZwh8smnwx/0+G/mo/L7HE1n2PbHd7TcxM ZBr7ud7cH9gr7/NLBgH3MzGcX8xlJPR9gKjzsOyuytgF65SDlQ7AIgp2Ob9FJDPyRPY+HHlOpiQB EnBLQI43t/mYngRIIHEJyHEtz06a6q/KFKl4kEAwAup+b5tXzsWgru0DorPFJv6LC78VL0awr+xL Qu64NzAsSyxPMx3nN7MtwG18GpqaFiSakupOp/ig4U0s2ct3vIHxm/WXN+SMfhU79hRjx45t2FZU iKUzHkSm+mZU8dKBMa/oK4q0zGmn4dJMXWd1q7RQqlkKs+uTejFmHfoS0/N7G8mKiooMd27eGEzq c7HhNxx2OVpEDOol1j5F3x7W8g1dE8khHu883/cGW0e1BFsesSWQnCyWrYU60i/HtPeeMlL8tldn y2O3wBl48Lv1GNb1ZCON6ugweBK2FW+EMOZr4QHjMOg40UXYV12qoWlpwfeoREzHqV6+9t+mn6fV NXhrVwGG9epgSiScYsXQ8KkrMH+gb9Wdq/knCemtA8hY5Qufp3ELfR4TWyeMW/gUel1jnZPVDOrL NMa//G+UvDjQ1j4/wZDFn2H2KH21n1l4tlgh//a2A7i7cyTjKsz8k94e8w9sxeQ8/3wpy2qcfQfm FohVVreFWZmoZYiVvr7SbVOfub83SbZey35+x5NYmH+5lvH4+x/j+wrVLln/jwZ1fxCuOW3jPrbz i7UzRnV/UxP3AWJOnfyZWMl8exeXj2Hb4bqc3+zZ6ScBEiABEiABEkh4Ah7VQmnW0uPx7wOlhovV kOZouusZgfR066PStu5gqW2V2L+s1FuBSrHnV6p4zDkjLfBLrSWD8HhLS8SjsWJLwLQMy96MVeIx ZRGKJOv3OSO7U7xTuJpRj0sSMpNQOKMPLhu6CEkdHsU3mx4RJg/zcQT5jZtr+3ql9p6Gfa+b922r glfsEZkq6uagmlmQr0zneqiPY5eWeiHebYDU1BSNW7C9J+NfL13taNrDzNVSeXrqPQF5PQg1L8QC gtovvWKQJKc2Q8sMfV6p8j1Sb54jQo6TCjGnpAQbt1XqMBRxYm5wUjYG41QVHUo/Nb7CW4qD3nJR z1R9H1o10HK4m38sWSP0VIiXvngFK20eF3NSRkYYg7KQq8/9XpEnOeK5P5g6TvOPTOsvR/wQJPbz bRmBbjKv+eyXE4W+ot9p16zgEzX0rhS8J1WpfVB0WPUaVJ+OSOaBhnF/ELxVw4173gcE55aoobK/ S/3iff2T5fBMAg2RgBxvHGcNsfVZ5/pKQI5rWT+n8V2/7pZlbXmOC4GkFPHFUHzcHGkZLY09x8z5 ktTN/EIcTvFO4aooS9wxXfiPn3+Fr/eW44wz/W+D3VP4JjZrLxsArux6uU2/JLGCKvJhYSkzWH1E PTNaik+wOFNYKDmWuKjrpRcWTXtYyjfpTCcJxIqA1i9tgySYMSdUX0wSRsjghzAMOUXJDDEYp6qo UPqp8eoPMmeKj/Phbv5xluMckyJ+RFI/bo5o5v5g8p3mH5k2VuVUS44wIgazQWo6qnFS2SBn5z4Y JHE9C4qGuVN/CDeOnOKdwlXUlrhqXkftTWeRbY/UCud9QDAsDCMBEiABEiABEmi4BLgisuG2vVZz Nysi6xKqPQXjcFbOaEPl7K43ovP5p+P7DXPES3TE8kRxqG9zLPjmXXQ9M/wjjoagWnbU13rVMlYW 70BA/qLl9EuWQzYGkwAJ1CMC9W0eqOvX0bquf6IPDdnfpZ68/kkSPJNA7AnI8cZxFnu2lEgCtUVA jmtZvtP4piFSEmqg5/pqiFSbc9vbf8fIHvlYrvwY0Lrd+o3BuCdHoJNppWRAogQNqK/1SlDcDVot eSFxuoA0aDisPAk0EAL1cR6o69fRuq5/Ig8d2d+ljrz+SRI8k0DsCcjxxnEWe7aUSAK1RUCOa1m+ 0/imIVISaqDn+myIlE2q7T9XdhTlYu+vJLE3W7NmrSz7Vcp0de1cX+tV19qhPusrLyROF5D6XHfW jQRIQCdQn+eBun4drev6J+IYk/1d6sbrnyTBMwnEnoAcbxxnsWdLiSRQWwTkuJblO41vGiIloQZ6 bgiGyAbatKw2CVSbgLyQOF1Aql0ABZAACSQ8Ac4DCd9EVDCGBGR/lyJ5/ZMkeCaB2BOQ443jLPZs KZEEaouAHNeyfKfx3Ugm4JkESIAESIAESIAESIAESIAESIAESIAESIAESIAE4kWAhsh4kaVcEiAB EiABEiABEiABEiABEiABEiABEiABEiABgwANkQYKOkiABEiABEiABEiABEiABEiABEiABEiABEiA BOJFgIbIeJGlXBIgARIgARIgARIgARIgARIgARIgARIgARIgAYMADZEGCjpIgARIgARIgARIgARI gARIgARIgARIgARIgATiRYCGyBCtRWEAAEAASURBVHiRpVwSIAESIAESIAESIAESIAESIAESIAES IAESIAGDAA2RBgo6SIAESIAESIAESIAESIAESIAESIAESIAESIAE4kWAhsh4kaVcEiABEiABEiAB EiABEiABEiABEiABEiABEiABgwANkQYKOkiABEiABEiABEiABEiABEiABEiABEiABEiABOJFgIbI eJGlXBIgARIggRgSqILXWwpvRVUMZUYvqnzbq+jaqDHa54zBzsRQKarK1Jd6RFV5ZiIBEiABEiAB EiABEiABEqhxAjRE1jhyFkgCJEAC9YSAdycWTX0Qud3aI8vTCNnZ2cjtl48X3y6CN8ZVLJqTh/T0 Zjj11AH41KvEWLp7cZWVXqxVTqBofSF+KK99fdzXQM9RH+rh3bsVC0Q/7Nutm+iDyWjs64evvV8c LRbmIwESIAESIAESIAESIAESiBOBpDjJpVgSIAESIIF6TKByz1rc8tMcLFd+9NeyqAhF4rNs/hQs n/kZXsvL9sfhEFbOXYjtZQquuKU/Op2ZaooL76wsO6InUmJt4gxfdrgUyeES1Gp85NwTux7BIRav fALtejxoixR90NcPB8z9GHMHXGaLp5cESIAESIAESIAESIAESKC2CHBFZG2RZ7kkQAIkUGcJVGDJ yD6GEbL36BdQuG0Hija8jTF5OVqtvjl81Fq7su0YP3Aohg0bgvXf2uKsKYP6Tu94A/Ly+iJvRG80 T/UETcPAIASqyT2IxIQKOvDV+5o+nuSeGL/gLWzYUIDJvj6oRrw4cCDe2VuZUDpTGRIgARIgARIg ARIgARJoyAS4IrIhtz7rTgIkQALREKjYjVUvH9Jydhy+BAsfz4V+MTkXmZ2vxdC/bEVZ+rlWyalN 0Rrqb18ncGpTd6shVUGtr+qPmeLDwyUBN9zr4JLI0zvehvFzR+GPA7ogw4emc+dOSD/aDgPn/yC6 2xZs/7YM157Z3CU4JicBEiABEiABEiABEiABEogHARoi40GVMkmABEigPhM4XoZ9Yn9E9Wjb7iyf EdJf4ZbnXoKWhrcCBVMnYuHHa7BA0d/q8txD+dh1UQuUHyhH+373Y8CVrVG+400Mu/8fSOsxHCN/ o+Dx/LF4duc6ZLZ6GK+++Ve0+XYF8u9/FeXn/ApPjR+CM3xXL3O+R2/7KRZPnoB5iz/EAVF+i3O6 4q6RI3Bz59aGNqqjqmQr5s2YjXlrVuPAgQw0b9ca2Re1gWYeLT8Izzm34OF7cpBiyeXOs+P91zB7 /nys2LBTy9i8RSau7/d7/PHO7obBTI2In/5X4oMIuBu1anwaKveJPT9fmojpYfgZeRLAoRqoR1xl V+QU/HbQKGD+n/UI3unYAdFPAiRAAiRAAiRAAiRAArVGwKOIw1y6x2N95K2srMwcTXc9I5Cenm6p ka07WOLoIQESaFgE5PUgYF5QvsFj7S/CI0X/AxplYuba5ci7qq0DnEOYnNwaw6uCP47dYuwHKHno lygr+gdOzR4UIEN95LbwwDKc+9ULOPWyQfA0vgYbSlejU5p+rXLKZxY04f3vcf+Vp2lBlcXv4tJ2 12ELLJc+c3Kk5PwDpe/9IaQhUpYr9evg00eYOVHw1G3IGbnYIlN6mnQfh6/eHok2PuOYlCPjg52j 0/9mzKgGd7Me5vLN4X73EWx6/yOxC2iy+HM6KlGJn+DyqzoiDW7TO8l0Dt+x4G6c3/c5LcGzhT/g 7o5cEelMK3SM4zwQOhtjSaBOEpD9XSofcP2TETyTAAlUm4Acbxxn1UZJASSQMATkuJYKOY1v7hEp CfFMAiRAAiQQGQFPG+QO7aOnFY++Du7SDjlDJuOjrw8Gyf8T9N64GqsWTTDihkxZivXrC1CwsgCr +11ihJsdJ3W7F3MWzMCwgb9CU9W6JS1cjdIMpzm9dKfkPoqCwiKsmuN/gclDj74C8ZCuOMTelg/3 1Y2QqgF1/XaUle3HOlPaU/q/gI9mXB/SCCnLCnY+uH6qYYQ8ud8kbCreh7KDu7HwsZu15McKRmH4 7M3BsmphsdM/Ou6hy3dQu2wb7uySg+5duqCL46c7cnKexu4KYQB2m96hWOfgQ6K/vaxFq4br9u2a OSdlDAmQAAmQAAmQAAmQAAmQQI0S4ANLNYqbhZEACZBA/SCQNWQqlpaUIfevr2kVKpg5HJ3Fp8Pg J/HCX+9FB9Nbsc/u2BlnZ56COzyjtMezO3b7Na66pKkjCHXV4K5VI3GGmuJ2PVkka/NzRi/B62K/ yjQ1S8dMvPWf99DjyY9wfP1q7PQOQ4tT9uPLIn1l5oDZ/xSrOM/ThHe58yFMe+nvuGvNYdz8q0uR ee6ZeqGu/x/Cwmf+puVS67D9pXy9DiLk1of/iYXftkafWfuxYuEalIo3iss9DWUxsdbfLfew5Rur PqXGvnPT5rijb19sFXt/OrfqUez3XKLHu01vKy6cd//62Ri6rFRLljZoKC7LsD7pES4/40mABEiA BEiABEiABEiABOJHgIbI+LGlZBIgARKoxwROQa+HF2PXb17HE3m34/miY1pdP505Eh3FZ9aG7zGo s/44tBZR5X9z8bHj5SLIwWQlViouf+kBw4AXKUDtrckP99KNkL5Mv7pNPOotDJHqoS2o9B5E4ZYK zX9+G/OjulU4dkDf89J7zK+nltDNv7JirFyum0xP7pyFlAovSrx6eUkpKbigi3jZzqyJmmG0WBhG M0yGvbjpHyH3iMp3YpF0Dh6Y95JTbJBwt+mDiHAKKvsY913zgBarroZc+HDvqFe3OhXBcBIgARIg ARIgARIgARIggegJ8NHs6NkxJwmQAAk0eAJtO9+EWZuPYFfhaxiU1cTgMfiqQfio1HkfRiOhzeFp 3BYttSWNtohIvOFsiOnnIffGUzVJjz/7CnaqjwmLY//G1zG76Ijm9mr/o/wnrJ1p0FffHXzit2iW mo5WrVppn2ZiP97svhN1wSe8Yr/EIEfQQFO6eOsfrnyTKonp/A5P5eYYL0UavWS2eFu2fKY/MTWm ViRAAiRAAiRAAiRAAiTQ0AhwRWRDa3HWlwRIgARiTiAJbTuqBsnvcfXwPug7+T0olW9g/faD6NTJ vPIw5gW7FHgKrrj1NmDZcyhfMhznpg5H167ZWLNG37NRXUE36v+yXcoMnrxx9o34Q+d0HA14R88R eFr2xE9NqyGDSwgWWnP6ByvdMaziPxjV4/+wMeBhc2uOg55OeHXFOFyAr9ylT4nk0eofMKNfJkau 0Vek3jT1Q/ytZzurAvSRAAmQAAmQAAmQAAmQAAnUOgEaImu9CagACZAACdQXAj9Bz991A4QhUj1a pSfYarTKrzCp/ywLbGmEVF+Os3zWWHRtWQ2dxYpCr+9t3Pljn8PEnmdZyqq2J976R6vg8TKsEMbc UG8iV0V7TjpDXwnqNn1YvY5gweDrMXT+AS1lx9ErsOCeX4TNxQQkQAIkQAIkQAIkQAIkQAI1T4CG yJpnzhJJgARIoG4T8H6HLcXH8PPMtrBfRLyl/iWA+8tMz/qajHRrPvkWd3es+ZWS5Ts+xfMnKqGu fFz59Vu49rQqlJZXISk1DWkp9ppE0USpTXGaR+x4ovyIaXPewCM9h1r2rIxCoiVLVPrXBPf0TLyx bTPMzW1RXHqS03GeuroxxWV6mT/ouQLLRnVH31mfaLHqC3feeLwH94UMyoqBJEACJEACJEACJEAC JFD7BGLwzav2K0ENSIAESIAEao5A2VdLkHXZn5CSOwzz7xuMbu3PQlJVBXZtfBV9e/xNU0R9+UmX 85v5lUo/Db/MTMVysRfjO//6EN/1vwBJe3bgQGobXHhmuj9dHF0pp52Fa4ShcO2Pa3Fd26bo2qsX WqeJDSmbNhWvzmmK8zpegxv79MAFGVGuikz+GQY/k4vn8xeJR7/vwoAJZ2DmPTegpWrkFHz27t6G d16ehx/aD8WInue7rmlU+tcI9xScfWGmi/q4Te8sesOUfsj1vZDIc9LteDyvE/Z9/TWqzFmS0nH2 2S0DjObmJHSTAAmQAAmQAAmQAAmQAAnUDAEaImuGM0shARIggfpDIPkkrS4VS6fgFvEJdox+7Wl0 yjDv7dcSF1xxMiAMkf+bdxfOFB/1GPDyV5h7m9UQaVpHGUx08Be9iJTh8nmadcYfstKwdvNhTe6a Zcts8ifjL3eJt3Z/tRE9z021xTl7zeVemvcIBt23VFt5ueQvvbHkL0BWVhaKiooMAZeNvzWoIdIs x0hsckSnf+y4m1RJEOchfLrsPUMX5fjL6Nz2ZcMvHaqBsujwfFwS0V6TMhfPJEACJEACJEACJEAC JEAC8SDAt2bHgyplkgAJkEA9JpCe1RebV87FoK7tA2qZ3W0QFhd+K14UYl/xl4TccW9gWFaKJc/5 zWy/hzU+DU1DLUh0ig8a7n+Lt1po+Y43MH6z/jKTnNGvYseeYuzYsQ3bigqxdMaDyFTfeH1iC8a8 8pFFx5Aee7mpF2PWoS8xPb+3kc1shMzNG4NJfS424gyHXY4WEQv9q8PdWr6ha8I4kpDeOlRn0RX1 NG6B8KkSplJUhARIgARIgARIgARIgATqNQGPIg5zDT0e8woWoKxM/9JmTkN3/SGQnm5diWTrDvWn oqwJCZCAawLyehBqXqiq8KLUW4FKsZwvVTzmnJFmNTQGK9RbWoIK8exsSlqGZW/GKvH4sghFks02 KWU4xTuFq/n0uCQhMwmFM/rgsqGLkNThUXyz6RGcIQVr5yPIb9wcU04cR2rvadj3evj9HUOVq4kU 9Skt9aJcZZOaovEJthVlKDmx1D8a7ubyLbjoaTAEIpkHGgwMVrTeE5D9XVY01PVPpuGZBEggOgJy vHGcRcePuUggEQnIcS11cxrfDl/3ZDaeSYAESIAESMCZQFJKmtgDUeyz6OJIy2gZ9CUuSUmhjZhO 8U7hqkqWuGO6kj9+/hW+3luOM870P369p/BNbFb0nQWv7Hp5UP3sVbTItkeqflGfjJbiEyzOFBZK jiWumvpHw91SvklnOkmABEiABEiABEiABEiABEggGgI0REZDjXlIgARIgATqHIHTL+kgdF4EdS/B q1q/jOyuN6Lz+afj+w1zxEt09B0a1Tdqj7o5OyHrVtf1T0ioVIoESIAESIAESIAESIAESKBGCfDR 7BrFnXiF8dHsxGsTakQCiUJALq13WlKfKHq60WPb23/HyB75WK78GJCtW78xGPfkCHQyrZQMSFTL AXVd/1rGx+KjIFAf54EoMDBLAyEg+7usbn26/sk68UwCiUJAjjeOs0RpEepBAtUnIMe1lOQ0vmmI lIQa6JmGyAba8Kw2CURAQF5InC4gEYhI2CTqfonesqMor6pCUmoqmjVrZdmvMmEV9ylW1/VPdL7U z0+gPs8D/lrSRQI6AdnfJY/6eP2TdeOZBGqbgBxvHGe13RIsnwRiR0COaynRaXzTECkJNdAzDZEN tOFZbRKIgIC8kDhdQCIQwSQkQAJ1nADngTregFTfFQHZ32UmXv8kCZ5JIPYE5HjjOIs9W0okgdoi IMe1LN9pfDeSCXgmARIgARIgARIgARIgARIgARIgARIgARIgARIggXgRoCEyXmQplwRIgARIgARI gARIgARIgARIgARIgARIgARIwCBAQ6SBgg4SIAESIAESIAESIAESIAESIAESIAESIAESIIF4EaAh Ml5kKZcESIAESIAESIAESIAESIAESIAESIAESIAESMAgQEOkgYIOEiABEiABEiABEiABEiABEiAB EiABEiABEiCBeBGgITJeZCmXBEiABEiABEiABEiABEiABEiABEiABEiABEjAIEBDpIGCDhIgARIg ARIgARIgARIgARIgARIgARIgARIggXgRoCEyXmQplwRIgARIgARIgARIgARIgARIgARIgARIgARI wCBAQ6SBgg4SIAESIAESIAESIAESIAESIAESIAESIAESIIF4EaAhMl5kKZcESIAESIAESIAESIAE SIAESIAESIAESIAESMAgQEOkgYIOEiABEiABEiABEiABEiABEiABEiABEiABEiCBeBGgITJeZCmX BEiABEiABEiABEiABEiABEiABEiABEiABEjAIEBDpIGCDhIgARIgARIgARIgARIgARIgARIgARIg ARIggXgRoCEyXmQplwRIgARIgARIgARIgARIgARIgARIgARIgARIwCDgUcRh+ITD4/GYvXSTAAmQ AAmQAAmQAAmQAAmQAAmQAAmQAAmQAAmQQMQEbOZGIx9XRBoo6CABEiABEiABEiABEiABEiABEiAB EiABEiABEogXgaTPP/88XrIplwRIgARIgARIgARIgARIgARIgARIgARIgARIoIERcLI3ckVkA+sI rC4JkAAJkAAJkAAJkAAJkAAJkAAJkAAJkAAJ1AaBgD0ipRJyr0inZ7plOp7rBwFpqb744ovrR4VY CxIgARIgARIgARIgARIgARIgARIgARIggRolEM6eyBWRNdocLIwESIAESIAESIAESIAESIAESIAE SIAESIAEGiYBGiIbZruz1iRAAiRAAiRAAiRAAiRAAiRAAiRAAiRAAiRQowRoiKxR3CyMBEiABEiA BEiABEiABEiABEiABEiABEiABBomARoiG2a7s9YkQAIkQAIkQAIkQAIkQAIkQAIkQAIkQAIkUKME aIisUdwsjARIgARIgARIgARIgARIgARIgARIgARIgAQaJgEaIhtmu7PWJEACJEACJEACJEACJEAC JEACJEACJEACJFCjBGiIrFHcLKy2CZTveBO92ndD995j8J8KpcbVqe3y41PhKni9pfBWVMVHvGup iaaPXoHyba+ia6PGaJ8zBjstqBJTXzt2Z/3tKRuKP3i7OXFyCnei5Ta9kxyGR0ogeHvquatQuHgi emW3h8fjgadxFobOWgd9GIfKF2nZsUyXaPrEsm7uZNXP6607BkxNAiRAAiRAAiRAAolIIDpDZMU3 mDP6PgwePhzDH5yB/3iDG3R2vP139MvthweNG/ZERECdIiLg3YlFUx9Ebrf2yPI0QnZ2NnL75ePF t4vgjUhAYiSqPPo9lm9egzUrCnG4suZ1qonyty1/Grli3Kljb9a/vo17JYvm5CE9vRlOPXUAPnWY C+KuhKmARNNHqlZZ6cVa5QSK1hfih3L/nJmo+kq95dlJfxnf0M5O7ebEySnciZvb9E5yGB4ZAaf2 VHPvKZiAy24dgeVFm3VhJ7Zg/gf/1QyRofJFVnJsUyWaPrGtnTtpNXG9dacRU5MACZAACZAACZAA CagEkqLBUPb5mxg4bpKRdfbBZtg3vQ9SjBDdcbh4PeYvW4QmRy7F/XlXI8MWH7n3EFbOXYjtZQqu uKU/Op2ZGnlWpqw2gco9a3HLT3OwXPnRL6uoCEXis2z+FCyf+Rley8v2x6FutFeySePacMalfOUb zOw9GstOHNeqtEiMvVtX5Vdj7KliQrdnZdkRHZ+SGCbpRNNHh2P9b277xNE3dDuba2DW3xzekNyR tJsTJ6dwJ35u0zvJYbgzAef2PIJ3n52oZfQk98SywmdwUeV/8en+5toNlHM+57KqFxN6nNa8PtWr TU3lbrhjKHR/qSn+LIcESIAESIAESIAEzASiMkQi+SSzDJTN+B3m3XUtBmWeaglPxim639MkOoun lFa2HeMHDtVWE0244hYaIiWXGjlXYMnIPoYRsvfoF/BQv6uRfHgHlsyeiEdmrcI3h49aNWF7WXnU oK9sy7uY4jNCqsUeWzMbH+z+E244uxpfw8K05+kdb0BeXhN4WnRD81RPDdY2eFGJpk9wLf2hCaNv mHb2a0yXSiBh2o3NERMCodrzGPQVzDmPj0LPzPNEeefhXF+pofLFRDG7kDDjtMb1setHf2IRCNNf EktZakMCJEACJEACJNBQCERniLTRyYQH9wyfg95i5VULW1xMvKlN0RrqU+QncGpTroaMCdNIhVTs xqqXD2mpOw5fgoWP5/qMyucis/O1GPqXrShLl1/JfEITuL2SRV+tzSPe5X/8z+et1ROPEM55ZzNu yLvMGu7GF6Y9W1/VHzPFJ1GORNMnHJeE0TdMO1vqUQ27tkVOHfYkTLvVYYaJpLpze6ZA/MyiqZp2 atMAlZ3zBSSNTUCYcVrj+sSmVnGREu/rbVyUjrXQMP0l1sVRHgmQAAmQAAmQAAlEQiC6PSJ9ktXH lEbl98YWsVrgWMFwzFzzbSRlGmn2bHoHY4f3Rzex36C652B2dlcMGT0Fa77c70tTgYKpf8Pggfdi gaJvC//cQ/kYPXo0hg8ejhf/tceQpTp2vP8aRg/u7ZOVjW7d+2LC3AKUWlLpnuL3/4nh/fxptf0O 39nm23zen8Fb8g22bPkSe0trYUNBvxq15zpehn1iXzv1aNvurICVrS3PvQTntpTG4cjba8+WNZg6 9j6x52Q3o+17Dx6FNzZZ21QtV91wPi83F38We416xV6Vc8YONfpM9975eG1jYB7gCNa/PBF9TfIf fHE99lYGt6BEq09J8Vrk53ZH46wk7SUk/hfguCs/0v6o8nA8yj/HnCc3adH3Lfo35ue10txL71+B bxwzVaHo7RdNY6Er1HZ4bWOxyBFZe6rtM1jsR9n/vhn4zvISFr3Q8ONcTxddO+t5zf+d9LHK/w9m jB5g9L3+w5/CR3vLNTHluz/CU2Je0uekbPRX98Et9e/pKMvyy/s3Kiq+w6Lxf9b2UFXzdc/Nwyyx f2oQHDK7cXbSVyaIx7wmZevnyNrZyNP4NFTuE3vGRjQOI5+X/TzXwXlcRS7P0Nfk2CH2T+3Xrx+G /G1pwN62RS8/rsXd9+wq0fOtxzbxopJ+4nrx51n/NiLCtZuRsLoOlbf3GywT/UteK/X+FXi9Uoty 01+cVHMzHzrJUMMjmdf87e5uHLmrZ6h5Tq9BYHtWYP3MhzB8+J/w0nL9x7gld+VjuLj/GCzmi099 c0JgPjOR8OWqqSPjHdk4Da2PKCvsfZefh/vrrrnufndk9atOue6ut37NAl2R9Cs5j/Tr/5jRD6Qk bW90Mcf0GzJFeylZvPu3X7593nwYc5+O7P45knEq68czCZAACZAACZAACcSEgOJwCOHqN++gsYc3 P6/FeVL+qGzas0m5w5Ok+Rud/IDydaU/y+bpv9fCm+RMU8r8wcJVqaybcqcWJ8uxn+9b/LlIV6pM SmrqmK7F2A98UiuVVU/e4piuSfdxym6TXtsX3h80rafxNcrGshN+TY//x6hbYB38yeqDa+vWrYr6 CThO7FbGZJ2s82qUqcxcvysgiT8gsvb6Yv6fgvKXfWDC+9/7RQqX7G8yPtjZmqdUmd23RcgyhBFd 2eRr61jp45fprvyI+6OFSqBn37onjHZac/CEsu+thw0Gs4oOBWZQvMrC/MuNNHauQxd9HNH4O/yJ bz6wj5+Ix7mumvt2DlIlEeSkTzj5avvNmD9eESu8A5g0Sr3XMrepJcty7NzM/pumfmgoKcv39xM9 SsoJmH8Ev7jMa4ZG0hHZuJX6m+tnd1vHoTv9neT7ebmTJ2tnPstrEsRc9s5+01yv7FUebZyitbvn pNuVTeXmuBLlyaxTtLj0IUsMcU7tJuvh11vP4hRuCLQ5ZHo7Y7N/wMyPTbmqz0cV5nY+NClgcUY6 r0mO5nrZ3eZxpN4/uBkXSrh5bvFXmt5SD/84DD0uJhb+4JBPYggzv/rKjZx3aH3k/VBgPaQ+kd53 6ekj6X/W8S7LsZ4jr1+05bq73lq1M/si71f7VvmuteIe+SfDl4geqR8n9v1LucbTSJsrmvZ+Qbvv le1h79Nmf3X6t1M7eZKuV/7c6KSAa5ksV/aXSMepmRTdJEACJEACJEACJBCOgLzncEoX3NIoUofK KG981C9aWypPKNtNhqUBL6sGRP2QX/rsRrwD65425Ktf+hav36wUF+9Q1i2a4DcCiC+Kb+85rhQX blBWiXCpz5ApS5X16wuUgpUFSlHxYa0gs7yT+01SNhXvU8oO7lYWPnazke+mmZ/pSlV+rQzz3Zyl 5o7T0u7fs0NZteBvSlYT8QXUbIg8/JFyo6exJuOU/vpNpa9q9e7kaIgUNZXtKNug++BJysYdB4Iy iKS9Ppl8nca096jJyvqi7cr+/XuUT1Y+a7S9vIGXBcj+JstPyX1UKSgsUlbNedBo3ybdJyklvgzf mgxwJ3W7V3m78Atlw8pZxhcEVY7ZSFBdfdQy5iyYoeQPflL5UhgwXJXvpj9KIEHP5cp8n/E1tbdu +D9xwP+l6NKx7wXk2rXUb6g8qdsDyuptu5QdRauVJwddqnG9bPyHEY0/2T5mpmph5nEZbpyr6aWc SNtZzRPskHLs+shwKb99v3Gi/xUq80fdZPQjGdd99AtKYdEGZXLfjkbcg2/vtBRnl6cyXL5hs7Lh LX9fVg1e6jymHjK9k172cDO/mM5rllronkjGrdRfMgo3Dl3pb+Ij5dvHlVt5QaqpHN/+utGef17u b88T375rzD9q+c9u1I1Mqgxz3EOr/2uIlTzs7eY23BBoc0g5kkdK7gPK26J//XtZ8P4VCz6qCm7n Q5vautfFvGavZ7hx5LaekcxzqtJSD3N7Fhe+rxQULFeGZelGavWeoWD9emVlwQbloM/6FCyfKi/S ct3wdjNOzfVQ9TFzq8n52E39VD0lT3+/j+31Xi0j2GHmE3a+VcqVhXmtjLnk2U3qD32VRphqzF7t +6HDXp9Y9+9A+f77kYIPw9w/uxinwZgxjARIgARIgARIgAScCMh7Ocd4xwjxZUzNHOyQNz7qja62 gvDETsO4p60m8RnzpAHLaogsUSZ3PVWTraa1rEAUhR1Y93fj5s4wHh7faqxMnLXlfzaVSpXpvTK0 POrKx72WWP+NoWqoOqjGmYyLE0xfNi3ZDE+JWFmnG2V6j10hbj3r7xHKEKmuKFlqMurKTtVBGN42 7TkaCCVkeylK+f7dyo49uhHZnPnfT+oGyqQOjyq7TRGyv6nl5oxeYlld+9bITnpfkn1R6Dq7VzOj f1lWNh34SBnUKNlIL43O1dEnsM+5LN9VfzRBsTnNRsf7fCttBGn/FyOxelk1kvqPvcZKV3W135dy SYcvwfb1y4Vh0mdsDtOesn2sX3zdj3MpJ7J29tfE7pJyrPpYv+Cq/cgYz2LV78jGTbR+oZY9YKZ/ FaNy9FPjx4hfTzWvPrPK6zh8nj6/+JTZZ/qxRf44E04vq77xnNfsxHz+CNs5svZxqb9QQfJR5QeO K/fygtbS1NbpQ141+oD5xwOtfmPXGtl3LR1hzBnvi5XG8pD6WtvNX49Iw6U8+1nKV/XpOPxVy7y3 b9VEo78O1X78ixEfoYTb+dCut+Z3Ma9Z6xluHLmtZ+TznNTD3m7qPCqvKcY9ianSwfNFXq5r3hGO U2s9am8+dls/yTOyecbl9dbUblan234lfqAw/dCn3rMUvOX/wXzAXP8P8ub6hL9OuNfDLD9w3hS1 DNVfXIxTKy/6SIAESIAESIAESCA0AfVeTv04HdXaI1IIhrbjnqcdRrz5gOqFcvxlPDBjveYO+q/s W6xee0SL6j1xODqlWV8e0qzLTRCPwWnxK9/+UN/Hq8q/P+Ox4/o+bobssmKsXF6meU/unIWUCi9K Skq0T6m3HBd00V+icXz9ahR7BYumzdHO01hLP+IXXfGs2MfNawizO1rg9/M+Uenh9Yd6IMUe3WD8 p6DXw4uxa8NrGJTVxKj1pzNHomPrpnh+4z4jTHOEai+RIKVlG5x7ZrqRp6qqQttLr8WFl2thP24t xPdqW9kO8cUK4x/uhTRT+K9uG2T4tL5YtgNLlx/WwnL+djc6pJj6V7PLMfGjyUZ66YhWH7HaDctf egBnSEHq2W35rvqjuSCr++uCpdpb5VVGvbupb3VVjxRcfUe+5lIq/oE3PpF7r4qgsn0o3KLvhNdv +mBcYHtt1XlX9UTXC5tpeRGmPfVEtv/RjHOfiIja2VacG6+Ub4xnTxv0eqKnJkL8YIFJeb/wi0s9 D7k3nqr5zf3OnwBQ5U0fcwcyTIGtfpkLsfJaC/H+YHurvCmdozOu85pDqRG2s+Rn5hE4Dl3Oy2aV go6rasgzy1bb+vGuWoh39jLsqFDnmSp88u7b5lRY+/pafKeFVODjt17UXKk35CI7wzSfWHLEz6P3 r1st816rLj2N/rVP7V9u+0sIdaOeD80yo5jXIhpHbuvpZp4z629xm3Z6Pea/F7EksXtclOuad4Tj 1KJSLc7HruvnUzyyecb99d7CRXrc9iuRz9PsV5g2b6gmoerTR9G9xwjNndxhHMYNuEhKNs5x6d+G dOEINm+q8aH6SxTj1Fwk3SRAAiRAAiRAAiQQLYFqGyJlwa2vvxdipaPmfW/kPVgrNnJv6rdZyWSa 5TLN9wbK66483x9uuNLQqp3+Bb5xWjABRkLdIaxPUt7BJ36LZqnpaNWqlfZplp6O7L4T9XQnvNC+ QiSdI4ymj/rCtuDe67OR3jgLD85ciRLT9w09Af+bCbTtfBNmbT6CXYVWg+TgqwbhoyAv8zDntbv3 bHlHeyFIlqcRkpNTkezx4PzcsUYyzaho+EyOcN8DTf0h68LTTRl9zmS9b9kjotHH07gtWpqtMapQ t+XHpD8ewnvTn9eq5Em5FG2SjqC0tFR8vEhpc6lR1bEL1vlfnmLS81cdWxtpYuYwyY9qnIdr5+oq apPfNF1vyEbpTQJeyBRJUaK61iOpFS7sebIWtuqLnQEvP7EmDuIz8UvIec3GL6AGbvU3CQg3riLi YZJnd150/c1akPqj2dpt4kcs5b9YM3Wz9kV+7IynIPYIRdXm11C4WxgpK7/GsucPaukH3HGVxRho lxtPf0D/Sj7T2r+qwTuY3tHMhxY5Uc5rAfW0jyO39TSlj8s8Z6m0yeOy3GrzNhUd1GnSpzbm46jr 52KecXO9D2Bk4uNmfvn5HY8a972aTGEMfGnRMOuPk6bCRDHWo7r92yQt6Lxpig/qjHKcBpXFQBIg ARIgARIgARJwQcC2DspFzoCkYvXg5InIzx4EnNiC+59biZnt5NuUAxKHDKgo+9EXH9xo5JS5cfaN +EPndBwNWIB0BJ6WPfFT3+rL1tePwr6iTDzx0O2YslyshxT6PjGkB54cfi++ODgZF5hX0TkV1mDD k9C2o2qQ/B5XD++DvpPfg1L5BtZvP4hOnZpHRGXbghG4SBqIRY5GWVm4unlzHDjwPoqKYmcNPv00 /6rLUIrFS59Iy69uf6zc8wGmr9FXBZ/wPoqz0x8NWl3vC/Ox6Ylb0cm+qit2yIOW6xQY7Th3kheL cPF7RYyOKux707Z6O0rJdX1ei1T/SPFUV176z7tAbNGA509UYvm/tmNwq32YcuI4PCmdcWufm/G/ P/0VW37cgrc+KUb3izZggSIGiDAw9PpF20hVrIF0FY79q7p8YjUfVnde0yE6j6OI6mkegrU0z/l/ /QneLWLFO7j0yEPjNR/XVP0ivd6GIxJRvzKEJMFylyruJVEZ+DSHkTzAUc3+HSDPfUBsxqn7cpmD BEiABEiABEigYROIoSESSM/qi/l9R6Hv/B9Q+MhIjO2pPwJtQSx+4fZqj4sDHxQVY1CHbEu0+pic PH70RmAVMMnLH/scJvY8S2YPeW6VeQMmLyvDI7s/wqyHhmLk/E04UT4V9zzfD+/ec1nIvIxUCfwE PX/XDRCGSPVolR7wW78WHvCv/DOM7DdJCxabtmPDvNHo4HtMu3zbC2h60R8DsrgKMPWHf2/cBdiM o8m+1biGzFjr47Z8nyLV6Y/b3ngNW3xjyqhXEIdqMF74r2J06tlOi5Xj8JtD6jjTVzMHyRZdkIlD TMZ5dFrUTC5PmljVaytKKYPnYjH/FQE5F52jbetw3JYkpNfEr07Oa1Hq78gklvKSz0Hve9vj+ckf 41+rV2FVsx+0Yk/uczXOzTgXXe7JwpMibuMHa7D2239pcU26DsSlZ9ob2VHb2EYE7V9Hrf0rVnxi PB+6mteC1tM2jqKoZ1znuRAtHVG5MebtqI6JW43Ox/Gun6leEV3vnQCZ5LiZb4uXPYG71uhbwUjR /W6fgKs3PRK4KjJO/VuWW52zq3FanYKYlwRIgARIgARIgAR8BGL2aLYuLwV9xs7VnI0u/gLLln3m K8Z0Et/Y5aPU/5y3BqWmKNVZuWONcWN3/XW/1B+FM90krvnkW2uO1KY4TTzeqx7T5rwRYr9Hazbp yzi7Ex6Yt854vObM9KYySj9re06WosJvH7XG13ef9zts2VJsMg/7K+wt9S893V8mGkkeodpLpJHt //TkvxpGSDXrweLdUkL056bpxh6gK5Z/bOtf32HWX+8PkB1TfaIo36xQ2P5oTqy5v8PS6Qs1l3jb OMQLmbQ9TdV9TY3P4U9xh0f/zWHanLeNMWLU+9nAcePdvRVbduurLNU9DeSX6oDxF6CPLyCace4k K8HD1Ud8l63bYdGybMu7eKTof1pYWqRGerOEeM9r5rKkO5p2lnnt52rqbxeHmMpLwqW9e2tFlC8d hR59n9bc/a7rqD2Wf+kNetymSX9Aj/y5Wtxv+3RFC81V8//0/lVsKbh8yzpr/4ohH2NeiOH8HMm8 FtE4iqKeRn3CzXMWwtX3RFqukS5S3tGM01qcj13Xzw36al5vjaKi6Fc4+DGG9X5GE5E2+AW8Ndu/ X+SoF78wREtHvPq3lO94dtFfIhmnjuUwggRIgARIgARIgARcEIixIVJskdf2t1j32LXiaWf5eLV4 qs28j17qxcgb011T8VjBcPR5cCH2elUrXxX2f/ku/nTB73T1xaNweTf4NvxOPw2/zNQf837nXx/i u4oKlHy9FV/uFYaS5J9h8DO5Wp7yJXdhwISlKJFWQ/ESlL1ff4o5Y+/DhDe262m2vYrsk3phlvqS Gp9x8eC2d40X6Ozdb/p1u2on8k9uIfabbIbmfWYbBhxdwYbxv+yrJcjKaoe03vl47f1tKBWrVL2l JSh6+++4vsffNAjqJuxdzm/mBxKqvSorDaPWsn++62NahW3Ln8ZZPcb6ZUTrEnse3fRoVy33sVV3 If/ZdaKdq+Dd+xEe63YB8pcdskqOtT4uyy930x+tmmu+8m2rDIPE0N93tbwwxUiefgnueKCjnn7Z dHy4V3wzSTWFiXFz54S3tHFT5S3B+gUPI71tJu5/R6woVY9Q7amnCPwfzTgPlFInQtStBR667mf4 84vrUCr6Wtnutbi/w1267mIeu+3XvnnMTW3iOa856RFNOzvJcqm/kxgjPMbyWrXPwY2+l5bJMrp0 0lcKt+zQBdf4ftyScbd2/5l01sr5oevOMfWvDzCswx90PUT/ukXtX7HiE6P5MJp5LaJx5Laebua5 WLZspOVGwzuacVpb83E09XPTDi6vt46i3fYrsevvolE3YLki7nPFGHx51O9x/Z0jMbKxvq/5S3/4 E9aUWB/Rjkv/dqyQKSJEf4lmnJok00kCJEACJEACJEAC0RNwep22kKjeRQWNPrz5eS1OGKCUTWUn AtMc/kgRX/K0NKoM8SZaRazU8h+HP1XECi0jXpZlPg99+TN/eqVSWZJ3WkD6AS9/pac5ulURe35Z 4rOysiz+y8Z/qKU9/MlzlvCsLKser2w77C/XVI9T+s9Tyvwx9c61detWRf3YD9nW5raxux9c7msH I3Oo9ipRxEuN/G3QKFPpamsDtV9tNPUrqYM9XC3OHCf74ol9axRhSPCX4evLZr39smKrj6qTm/Jd 9UdVuO1YNeZarZ6extco7x8MMhZ96c3lDJirj61wev5mphyDodrT2gbmdlNcjnNzW1rkiDqY42Q7 21AYXnNasxyncDXj5um/1zg2yZlmG+deZXqvDC3upqkfG2WoDinP3K/s7pyx7xl5ZHp/39OjnMKV eM1rhkZ2R5TtLMSY62C0jwv9VU3MMsztZmjpUp6RL6ijXJnft4UxRzRKvVf5ulImLDXaXG3PRic/ oOyWUaazk75uw00iLU4px96nzH5z/3LTXywFWTzu50NLdp/HPN+o+oa6zsa7npHOc1IP+/hUFK8y u1ezoHOAWl2nfJGVGw3vKMdprczH7uvnxNPOWs4z4Tir/S+wTX0d1XxyMb/sW/e0MXfcNFW/t9T0 +0S/N1bLPKX/C9q1RNbHPG7t7uqMYynfuY7O/cXNODWjopsESIAESIAESIAEwhGQ9ztO6aJaEZmc bF7iKIqwH+mXY9p7Txmhv+3V2bpSK7095h/Yisl5+iNwRkLhaJx9B+YWbMe028x7RyYhd9wbGJaV Yk6K85vpj5tC/No/69CXmJ7vl1dUVGSkzc0bg0l9Ltb86dl9sPCxAUacfDmKWu7iwn34vwtNLzhJ Ow2XZuplNhILMmtphzBD19pwqPt+bl45F4O6tg8oPrvbIMHsW/yt5/m2uFDt1QLDlm3Ek331FXrq i4LWiBfUNG7/RywQ5WirlMReSk2DwW58WpDwwDere1pdg2VfLMMdWZZt5NFh8DRsK96ovahCVVgv Itb6AG7Kd9UfbZSBI9i+6SMtNG3QUFxmfwmNKX169nXGao3XVm/R3uKs6vnWrgIM69XBlFI4xQqP 4VNXYP5AOQZDtacpq719XI9znyy7HC04sJ1NJQd3BpUjkjqFiyjL6m2f1LQ0sddjiEMYgTF+zpSA VXTDZ76HNx7KCczpVL49PF7zWqBGvpAo21nLHaR9XOhvUcnOQUZGK0/mt5xT8Kvb9Ucp1eD2w68V b5uXCX6Cq2+9XXrEtacX2hi+IA4nfd2GBxGtBp3cbxrWv/UsMm372w6Z+h5eN/evmPCpxnxo0j+a eS3iceSynpHPc74KOLWbiA65zYItX2TlRsM7ynFaK/NxNPUL1Q6B84yb662piwY6I+5XR7Dimce1 /OJHCkwY+gtDVvqld2Jp/uWa/3+vLMU2r2qv1I949W8p3/m65txfohmnRnl0kAAJkAAJkAAJkEA1 CHhUC2Ww/B6PRwt2iA6WJaqwKrEHo/q4r3iCB8mpaWiZEdrIqT4WrD55nZKWgbQU45ujv2zxOHZp qRfl6tOnqSlITUtDsGQw0lWGKVc81iue4U5NS9H2D/MXVL9cn3/+uVahiy/WDbbBaqe3VYXWVirX DMEk3BGqvSq8pYKteK1pcioyWmZofKtEu4jWRZKtaZ3C1fL1uCSRx5ZJxHlLSuAVnSs5tZnoW7q+ VeLxWYjS7MljpY+qkzwiLj/i/igly3MVxE4FSAnayWUaedbTJom0dlJq3Q+KtkhOTUVaRob2chWZ y3x2as9Q7aPmj3Sch5ITqp3NOmrlRdOPdJABbNRtI3RxVm5lRf/AqdmDIFaioOjoMlySdAwlJfpc ltaqJdLskFUOUeil1c3oH7Ga1+zErP5o2jlk+0SovxMfq3bCF6G8gHy2AHUuUKeDYONHixPpU+wT hUmGk75uw00iLc4qc5801dmpfxmZTWlDXgeNDIEON/NhYG5fiKGH83U2mnFklGfIDzMufBnCzXNO 7aZ2Eu2+w2GedcwXYblqsmh4RzNO1bJqej52W79QPPW46l/vVZ0cj7D9Sr0maBNHkOuFyldclJP0 +5ia6N+heJnr6NRf/POp8zg1y6GbBEiABEiABEiABMIRCGdPrHVDZLgKML5mCERiiKwZTVgKCdQN AuYvmIUHlqFDmv7jTd3QnlqSQGIQ4DhKjHagFvEhwP4dH66USgIkQAIkQAIkkNgEwhkio3o0O7Gr TO1IgARIgARIgARIgARIgARIgARIgARIgARIgAQSjQANkYnWItSHBEigbhCoPK7recJbN/SlliSQ iAQ4jhKxVahTrAiwf8eKJOWQAAmQAAmQAAnUIwJ8NLseNWZ1qsJHs6tDj3kbJIGqQ9i95wDQtBXO bhl6b9sGyYeVJoFICHAcRUKJaeoqAfbvutpy1JsESIAESIAESKAaBMI9mk1DZDXg1qesNETWp9Zk XUiABEiABEiABEiABEiABEiABEiABEig5gmEM0Ty0eyabxOWSAIkQAIkQAIkQAIkQAIkQAIkQAIk QAIkQAINjgANkQ2uyVlhEiABEiABEiABEiABEiABEiABEiABEiABEqh5AjRE1jxzlkgCJEACJEAC JEACJEACJEACJEACJEACJEACDY4ADZENrslZYRIgARIgARIgARIgARIgARIgARIgARIgARKoeQI0 RNY8c5ZIAiRAAiRAAiRAAiRAAiRAAiRAAiRAAiRAAg2OAA2RDa7JWWESIAESIAESIAESIAESIAES IAESIAESIAESqHkCNETWPHOWSAIkQAIkQAIkQAIkQAIkQAIkQAIkQAIkQAINjgANkQ2uyVlhEiAB EiABEiABEiABEiABEiABEiABEiABEqh5AjRE1jxzlkgCJEACJEACJEACJEACJEACJEACJEACJEAC DY4ADZENrslZYRJITALl215F10aN0T5nDHZWJaaOdUurKni9pfBWBINZhcLFE9Eruz08Hg88jbMw dNY66ClD5asNAommT20wiEeZtc+1fMeb6NW+G7r3HoP/VChhKlmz+tbEfOSu/mHwMLqeEqjZfl9P IbJaJEACJEACJEACCUYgKcH0oTqJSKBiJ2Y89nf8p9z6RTE1tRl+1vGX6Nq9C87OSA7U3CGfTHi0 PANDxj2MDhkeGWScvXs/xfLFi7Fy6b+x5cABeJo3R+b5nZHz2164sccVyAjRc6tKPsYTD/0DpU2b GvLMjqOeC/Dg+CFoY5Lh3btVlPeKr7z3sRUXoWdWV/TLy8fNV7U1Z9fcbtNLAcUb38C8fy7CmtWb cUALbIasK65An7tHoGdmM5msQZ4rK71Yq5yAZ30hfhB97Zy0wH5Ra2C8O7FozgtYsHQFdq4pgicr E+1E/+h9x0DcdF0W0mpNMeeCi+bkIXvgHHhOuh2FP8xHBxPPPQUTcNmto/2ZT2zB/A/+i0l5wBch 8vkz1JwrVD1qTgtTSQ7zWtj50CQiEZyJwLXy6PdYvnkNPF+cgsOVgkqKM5ma1rcm5iM39XcmU80Y h/5sSD16FOfcdD/uufZ8I6heOxx41Nb4rul+X6/blpUjARIgARIgARJIGAImU0zC6ERFEoxA2edv Y+i4SSG1enb1f3F317MsaSLJ13PUKGGItBoxC+fej8t+/7RFlurZvGYN5s96UjOsbPh+LjrZ8skM R7/5GI/MmiW9gedGmeg/ZjDa+AwzxSufQLseD9rSFWFZkfjMn4IBcz/G3AGXGfFu0+sZD2HR8D7o M/k9Q450FBWtxaKdbVDy3tCENGhJPat/PoSVcxdie5mCK27pj05npjqKtPYIx2QuIyIv3yy4cs9a 3PLTHCxXfvQHi75R5Osfy2d+htfysv1xCeKqLDuia6J4bRodwbvPTtTCPMk9sazwGVxU+V98ur85 1AuCcz6bmJh5Q7dLzesTumKRzGvB5sPQUms+NtG4hhvztalvON1i0Xo1UUYwPSPpz5f+9M46aIgM Pa8EY6GGRcKjJsd3bfZ7J0YMJwESIAESIAESIIHqEqAhsroEG0L+5JOMWuY8Nht/vrw5jhw8iC/W LRAGv1Va3L2/7of2JatxpXl1oylf9+HTMOSXLXH8+HFDFnAKsk6zdsFtC+4WRsjnjDT9Rk/H7dd1 wMn/+xZrFkzHI/MLoBx/Geu3T0WnTs2NdBaHqdz+T01H11bmZTbHcAxtcIFpddiBr97XsqtGmafm DkWXc5tgw+xxyPfV7cWBA3Hbrwtx7Zn6V0W36VXhG6YMMoyQJ3V7AIufGICsnzZF+fc7sXbFG/hv m8vruRFSQCjbjvEDh2qrHidccUtIQ6TWILH+F1X5FVgyso9hhOw9+gU81O9qJB/egSWzJ2r9/5vD R2OtaUzknd7xBuTlNYGnRTc0T7WuLj0GfXVzzuOjxErc80R55+FcX6mh8sVEMbuQMO1S4/rY9bP7 TfOLq/nQLqeW/QnHNQyPuqZvmOokTrSpP3cX89v9nVvAfJVWr9mnX3JB4ugbqSZh5hVHMSYeiTC+ 2e//v70zgY+iSPv/MySRBEwUhPAu7qvgiWgSwFtXNARf8cAERdYVAopCQP8LBHUFxF0UBRSUaxXB VUAOFXEh4HJJCIcHKAFJ0LDLlewKLgSIJEoiCfS/qnr6nO6Z7skkmSS/+TDp6jqeep5vPVXdU1RX 27YUEkAABEAABEAABOozAcnmw2ziv1RtUhHd0Ajs3r1b4l+rz8ld7whf4P4wJ/8XQ5bt7z2pps3c dsyQ5q+cIaP35Ozxz6U7PE1keU0SpA/yjvtkO5K3UuqblCx9UHDSJ02JUOplj6RK+ZVnlWjb4w+b 50uvzdsknTDkKJPe69fK0ja3+fV2NU9/Syo21NOITk7vlvp6IgVTsx9xCmq7RfWUdpQHbjfX5ALU bymvfI80qEmU0LlL5jKp0pTp6L58ad/RU6bYcD+tlN5LbSlsemD2t3WvbDDtUodaK37qdjysQ5XD tupTu/4m/JD9J5C0o7QG+nw1LFfauSZ1Cwf7FTut/Lka+Oq+aJDjij8e/u536t5gaAACIAACIAAC IAAC4UOA31vyr90HL6thdPBxTuDX0+WGzB1v6qKe52w7qIbNAXM5czo/37Zgmlgtx8Mjl3xCD1vs mRifcB8t/HYDPdwhjmfz/2GPpJ4yqmuZ/8Lb+tOzA7pSC0PquXTvoNFajG7hptv8+7M/kO1ij4T/ /fUh1EqT6jpUuOVDykzvRUlJSeKblj6C5q8t8L5kRBN3KD+HZowfSWndunnzsv0MM0bTyh2HtExU Qatfe5rS09Pp+flf6eKVYBVtnT2WpfeiV1Z+LyKd1q9IkI8VlD3jZcoYOIwWSfLrUN4cO4LGjBlD mRmZNP9zvU6sREQbqjzC9mQcP5S6ee1M6TWCPtlmyseyOrXTVf165U+X0hG2byX/tGv/W/Hosj65 9aXX0KWtjY+Y8xdQDE5Lo6fnfEUVFT/Sx4xxWrdOoh1S0gbTnDV5Pu3FZe7b8gmNydDatltKP5o8 L5tK9BWq4SrKWzNf5wty+36yrVDNwfXISEun/iPfph8F9grazNozM/Mpen/FTyLfsidHUCZrh4zM V2lnCb9WEPmWE9HeP4Hr5RlD2S7+9WF17VhL4zP7q76SlJRMQ8ZMp5w9R/WKC7vkdtnEXuJzgOY6 8C+DAIsT87jmZDx0184/0+bFU6if1386dUull+dvZi8g+je9ndGfeg15lQ54X/JSmP2m6MtDXl7O erbxU164TvhC+pDpan47rjxe4VRcuJFGpKVQRGKkeImU/oUywdmhjUfPMzsOV8qrzI3aWp850dd5 uzrzYytN3HKWZSjt6Nx+N3yDG5d9rTP7sznHvhWvCx9L7/+SOl4oefat+aucxn2MjTeaH9XMOKjJ 30RGP32B5r3u4nqjGGBxNPMITf/m190nBSu76y4fp9PZNWTyyr0BxmNn1w2l3fjYYN6oI2/xK0KX kTPX+4wbBeyFZvz6z69l+IAACIAACIAACIBASAnYzVCySvzOYNqVQ3z9JOB0ReTMXOOqx+NfvS78 hPvLZD8rIs3lfCmVSW8lnydkeaKfkPKrsSJOWdHAV7I4WRHpq4scs3fhU6ptgfWXJOv8ldKqUTcI Oef2X+Czos6ubqv4vUueUfVR+ic/eiLukLbpVhN9r9Nbn08JT97yX6/4cmlhP3nVJ1896rMK8eRO 6X5PhKjzzhnfSE7r99W9RJoa2cxSd65Tq/FfiCJKuyl6Wh013SXJuZ3O6vfVm8WcLZJeTGwu685W 6c7efNAymz7y5HZtBbGVDTzugRlf6opUSusn9bbl0zRlolRkWIpZJi0Zcb1t/qFL/yVkK3po/uGf wxRv3/Ytp6jqrN5Qt4u9PpXSpumP2nLgnEcu/U5RXl1xa9cmPF7vX2pBU0Dvp+Zxwd94KLHe767I EN0hAABAAElEQVSdSwyrsq305mOc0ve3T3tIsGja/S3T6m622tjrk/r8apxp/NDbp69TWxlYM3YE WhHpVl+97sZ2debHCgfNbtkR3HKWJGftqNnvjm/w47Jsj2In5zUn7yeTtxtPj6yfoPa383UrxM8e 0Z5maNbrXamUFVPaS98O5nB1xkG93nq5nsi7paebnKPqqU/jYeV6Y7RMO9PLrZn+bbzu+tzrmK67 CkdtHFd0de4nu2Y9JvNg17C1R/Urjw9L4yKiRZrvPUCxNCnxXJEWN2SZUimOIAACIAACIAACIOCI gHIPZpcZKyIZIXxcEJAXtLECVWzV06c07Jbn5MJstd+17f2sUvTolhRaVVdeRF9s/EWkxD56J3WI Nu5pZ1UkUJxUuZK6/F86ZbAVf+npGexN2W9Tzo7CQMW86T/R+o8XizD7AUCd2gd6o7Vd/goqKtgr y4k5TZtXzGGr2NLFSsVu3dKof+ZLbKVfobdOP4eqA/TXh2eIDDFpE2lH4RE6emgfrV/0MiVEtiX9 uqJTx/aLfL1GT6PNeXvp6NFDtH31TEogmelf3viHd1VENN3pXfXJ991c9ZVxxeHRb1areyP26xbl uH5fK86nXts2MJ6T1aQh05fT5s3ZlL06mzakX6PG6wPRaeMoOzeP1s/VXiQ0dtwHdMybybmdwdUv qvFcRGlD+8g1sjdLZ3RtT92HTKOv95/Qq2oM6xuDpfA9QVds3UVbV2lt8PcRGbT2cKUod2LzDOo+ aqkIN0+fKtq29EQRLXnpQRH3a/ZoynxvlwjzP4VZr7H9Rr8R51z2hoKDtC9vA00adK2I++aAl5Ci R5NYr39wDmspO3sFDU+U903lvpS9eTOtzt5KAxO9e676lBNiHdcb8nax0Ydzu334PKEcfzP40s27 qLBwH21ifqb4+ht9HlY5y1ZofwP5l5bTT8jFeOi2nQ+tfoMGLpTb8pxuw2hN7ve0dfUcYttXGBRS 8EQ1PVeN9xltlUwshxpUAqp/qMUNAV733EVv0/CBt1IzVqam7DBUanXiUN9A7eq4/1jpwOLccnba jkp1rvi6uC4o8v0dd+Z/T0X799OePXvUb1GxtoYuPiWTlgyOFyJ+mtqL3t55koWraOkLD4hV//xa +ensx+T9jpX28lYY6nHQbIfqp4/fTvd8vtn19cYsT5zXSP9m191HRwrx/Lq7Zrtx5bbhunvH5VqH NfVTN35yVfeesnnsGrZua6EcZn+lQ7vpkzO/inOuyxd52nVNOrSTFuXJ92TD+lynlkEABEAABEAA BEAABEJCwG6GkgkX/xNql474hkXA6YpI7heJiYny/657fYTHTc4+4ANEv7KA2P/Ep6amat/kJCkl c4FYOSEKntJW31V337qT29/00U/xZ37snPFuwH0aj2zSVnrGDflIKvexzhhhn79YmuZd6anXwRwe MFu/Qs4oW5yd/FpdnWheeWrOXX60SNp3yHcPza8m9RBcIjuPk4qUQqf/qe6ByFdsanaWS+wHp5r/ kIv6FdE+xwB7dun9pfuYZZpvMEHKqlL9ii5XdnJlAtTvo68aUSYtf+lBH5/qnDFJ2nHId39IvR1d mI/r9x7V+8mAxXy1Xok0K7WFkM1XPh5W6+SBSrUNmqZM9co5rK7QbBIzTNpjWCnJVuVuXiFtKJD3 VlX0MK/oklgr+9sj0rqc83pD3S7W+mj9iq/kUVYFKviOb/qr2l7KeKLI4X3PiX8pssxHvRwuy9l4 6Lad2R613n08fVYqHf9a7bP6tlVWPfEVkXxFmv6j6KzPbxXHyyjx3DZfn6x5O/R668OKXnobzPoG blfnfmxXnzvObtvRJd8QjMuKneZrknIe1WWqwZ/0ex7za0n2qslqXxswz3oFcujHwUB+yjwjyPHe zKNG+vcpbb9k/cpSPjbrr7v8eqDoY/R7l37CVvaPimgq2kl/P/PDqhfUtuPt3X38RrXLHVz+rEjj 9W45oV9FqWZBAARAAARAAARAAARsCSj3knYZjEsrWG58QCAQgby8PEOWoSv+Q890a2+I8zlh/xOf lZWlfXN20cZ3fzDslRfrXbFHv8orxXxkOIyIu6IHrf74Y1rNVtttzc2lrWzl3cLpI9VVUjtnP04Z c7bbSyv9hkbeIa/05Cs8lrzQi/Tv3fYp6C9/6UHasPFntUi39BdpafZXVFBQYFi5NX9oBuUU+7G7 2QXU3hMh5Dx7czLNZPsMautUVPEiEN36Irq0rbY6taqqQnBu1eF6kX5mdy79t4z/xmCfqCuo37hu IvjLondpu3efQCrNp4XvHBfxfYekUVsX9YtCVn+qNPvMe2/ps7MfPvTaC6mGt4jf+odBahZloY0r O3lph/WrFamBcyn1haV0cOsnNCixqRq7c/Yo6nJhM3pn2xE1Th/gdsx6sa9h79H4W9JoeBP5LfRl x9jbtksLafWKUlGs+Y2JFF1RRsXFxeJbUlZOV3btL9JOb95AhbzNSo9Qbr68A2D6rAy60rT07bLb elJyh5Z6NSzC6jIfctzXXNRbK+1S+oPar3pNyaQbYuXVvoqxLbs+QOyxQnG6es2Xhr7i1L8UWYGO jsZD1+28j5av4KvNiLq//P+os36FeMvracrX0wKpVf10tsp9xfvP0W/0ksLYDkft6sKP9WYHHS51 2Y5u+YZiXNYbx9o8OTlZ902i+3pcoa2iZXk9LW+ltxYMFaWqdo6jlHueFeGozhNp4oCOemkiXCPj oL4WKz/l6UGP93rhRDXSv2OupL7PdREVnXzzY8r37vOqv+7eP+ReY9/Tq+XWT9jK/tRXkoWEsvey aJ+or4q2r1ujl0ob/76RfhQxFfTNqvkiFHNfGiW1MI6vhkI4AQEQAAEQAAEQAIEgCGAiMghojbnI 81nf0omjhbT+vadVDG/3fo52KhNbaqwx0H/2Z+yGPpdy2cSg8v16W7o22cTmqMrEIlx2rNAmrIxS HJ7FXkI9evemHj260Y1dutCNt3WjvsNep9yDa9THGv+x5HObl4D8SK+mdVdfqjJm2Xt0V1tl6suq /gD5o5pRG++jlHe+tpGy3/8zPdjtJurQoQN17f0MrV//iiyUTdR+9x95QsqqFoq8hJ79dJyad9jd SRQXkUjPz15Nxbp5JaXsofy19Cp7gUciqzsqKoaiPB66PG28kmz4YXl978dEvHRmIy3bsE+ED32x Un4sm/3I630f+3Hpsn61omADDl3AjZ3BqqKUa3fjAzRn1890MNc4IZlx2yD6WpnAVTJ7jz6eExlP HXo2F6nrvz9AFSyDMgF/YsK91DImjuLj48W3ZVwcJfWbIks6W0YCiS7/rV0uNNVWg6cu663xdtHp 0+N3l1sYHkvx7eUJ34hYbfJYzejQv9T8NgHH46FOX7ftnNjhf3xrj5Jt800IXYwnoh21jjXJC3c7 ArWrTv9a6T+6+hy1oy6/Iz8J8bg8c/sW2rBhg+77Lf39lXt8/iPuqr7jiK3015yDXSfe/3i47cQZ M8v4qe44qJNm6ae69OoEa6x/s9ee3dp7kFBNvy3KoW/Wq9fdx+5KslfdrZ8wSR3vflCtb2MBu9eQ /kM5M9iWH6ztxr/9qviP2qpdn1BuEfsPr8r9lPWO/Jj2gL63afdp9hohBQRAAARAAARAAARcETCt p3FVFpkbIYGL27ejFq3Po5THptDec9nkVp8pxG+kX/4gkz4ZbL+P0O9uuYUSrmlmT6xZHHVsEkkr zpyhjR9somPP3lytt0tbVRTV7v9o7Lg7aeNf1lLllwephE3gtTD0gGP0dnoCjcqRJwTZRvr0cs/2 VqK8cQ7yx1xMN/eMpXeyTlDseef7yIq/vjubHB0rv1XbYkJRX+DCu0fTkbwEmjD2EZq+gq2HZJOX E4bcQ5Myh9H3J6bRld5VUwWLnqWOygQWE9AkMZFuv+ACOn58C5sM9q0k5qoUsXpsVN7P9Obb6+mV B9vTxsWzRNUxqUPpdu9ErNP69TrXZNitnaHRJZLadeETkv+l2zP7UL9pnxHfi3Tz3hN0ww0XOKii io58av0q94ik++nxG+PoFFsoafz8TJ7WPel/+ao/fVHfpjQWq6mzAPXWTbv4GltResYbWXOTdsGM h27b+X/aaKubfa30jbGcePXNVu2Ymraj2goGEhDAjwMVd8vZdTs6GQ+YkiEdlyWnUCLJ0KvYtYgq vavsA4ET6dUcBx3VUf1MNda/mWpxSd3E6vjpZ0/Ta0u+pOeTH6Av5k0VSjdNHki3XuwzfWtpkKN+ yOu7qisNahJF75ytpBWf76WM+CPE6/ZE30gP9XmQfnnqz5R/Jp9WbS+klI5b5f+MZZOUqTe3s6wX kSAAAiAAAiAAAiBQHQKGaZjqCELZxkHg10rth8plD42kFxNn0V/YhubLRyygfw68zudRUYWK/Ciu n4lI9sKVK+5jK8WyfqXKnaNp1Z5h1L+Dn/yKYJfHKOUJoyYxppI/06KMu2noQvlx5C5j/kGL/niz KY/+1Hn+X70rPdd9kU8Vg5MMq0ukip+I7egnC3bQG+MT7qNpWaX0l6Kvac7YoTRq4Q46Wz6D/vhO Oq37I5sILv+WRrEXnvAPfznA1gVjqLP3Me3ygnepWccn5LoMf1vR/X8aQKP6vUmnN62mTfkdaPWi n0SOJx/rYVgNEbB+g9waPAnKzlDqcz71/D17pJ1NRPJPfJzFj0YPe0mMOVoqJc/V7BH7PPbIbcdL KJqt4FJWAo8Y/yZN6fnbgEoq+f/9E5uMJt2qpIAlq5fBUb211S46bl/kFdKgzubVQ9o4daaMc6qZ j+PxUKevo3bW5f9q20Ei0yR3lLKNhc6sSpK3gKhYs4sOM/P1j+1HqQOfrkAwQZ1eNWVHMGq5KePI j/0IdMVZx8tRO+ryO+Lr1bO2x+XCrAn0ZI68dYCCKv2RyXT7jr/4roqsoXFQqbcmjzXWv7nSbDXr wxPvp+nPLaWyeZ/RjlHtaMWiEmHOwKH3Grb08LExGD+JuoR6DetE77AXnX2+YT2tb3lMiG3e53a6 tMWl1PWPiTSJpW37Ioc2/vC5SOMTotf6fSLERzNEgAAIgAAIgAAIgIAjAng02xEmZLIm8Bt6hE2G 8Q+fDFu65QfrbI5io+nePz6j5nyc/ag5oM0lqPFU9SNlzZ5JOUX6pWFast8QmySZ85dskSXq5oup tTrxV0FZo1Oon3ffSPbCA/rC4nE0Tbab/OdSp1tSRNFfPlii7cHoFVa0aR3leycqKdCbxTUFqMXF N9BzCzapj8e1jdMmbZVHfV+f9md1EpIXPVFYpJNgDHa4s7d4bJ2v7uuR2E2shuB7e/X5XTtjRu+Z v/otC/BI3Y+nnO3V8RW5Btd2BlN/2Y+Un19o2MtUsa+sRFu6eLSUCTd9+ErhrE37DLGl+evExD2P jOWTlzHao/tvzV1p2MvQUFB3oto90zd/WdFuyi/y84i/To7boNN61XxO/S+YdmEzvEo9Hy7I8dlm oXJfjjpRcnePWwyT6W7tdp7fz3jotp3ZCnFlT9h/rPjGZN+PNOfP2lip6HfBb9qJoHQ6jw4btgo4 RvMnyCuclbxBH2vBjqB1c1hQ8ZvXg+w/rji7bUe3fE02BzUu62Q0jVIvirpYU/DENzS81xsiMjbj XVr1nrZf5Oj535sysyeAa2gc9KnIHBHMuGKWYTgPYf/2yk16oLcISRV/o2vb3ShfdyPuoEe6XWao 2eckKD+JpGt79RKiypePpnv6vS7C6T26sAfFia69T07bMfVxumfEPJF2b5/kkD+ZIgTjDwiAAAiA AAiAQKMngInIRu8C1QNw2V196H7vS1QmzFznaCLFrsb4lEfZCkt5/zy+Cf5lzfvSBxty6TB/ecfh /ZS9eAoln/NbShsyjP5T7jvxI+SWf0eDI86hIa8toh37D1NFVRXxl7Uc3pNDo++9Td37ceDA29XJ ia3T0ylt0teiOHtDLb0y+AY6sn8/7dd/i4rVySi3+a/oeoeQLSb5hk+nAyUV7LyKCre8T/f3kX8M NGn+HN2TYL+6rbzgI0o6J5Xm8JfUeCdoTxSsU1/Ycfiod3VKZaW6wi7rQ6U9qqhgxev023u0PSKF Qro/nvib6Im+LXUxbKLs8X6U6N2k3nH9Bgmmk7g2dEuCvBJ17edf0o8VFVS8fzftORzExFkwdgZR f+m/llFiYnuK7TWCPtlSQCVsdV1ZSTHlrfkr3X3Py8JAPmHb9XIjO57AH4kfy1708PT8TWwbgCoq LdpIz3R+UobCHnn7w50dxcuCMt5IE3Hly56kAZOXU3GFt4G53+7fSXPHj6TJK/fK5WKuUV9ywPM/ OnmVyF9VVkybF71Ace0S6Jm1bAVdqD9O662ldqGYq2nwi/IE/6/ZmdTn+SV0WHSMKjq6Zx09deXv ZQKM82C+x2ktfWzHQ/ZSKFftzFZLPTAuWWj96/onacTMTazfV1HZ4a/ppW5X0ogsecWy3qw2VySI U77Xa+oLc+nfzI8qinezPW8vYyu9c/VZgw/Xgh3BK+egpFM/9iPKFWe37eiSb0jGZZ2te/65l11r i6ioyPg9LK5ZPGMFfTz6PnUfw8WjH6O7Hx1F7I3MQsr7jz/FXrpmfES7RsZBnc62wSDGe1tZ3oSQ 9W+vvJjLuqov1VLqbt73cbou0MthXPqJIju+U3f1fk2J63pDexFs3bmruoe2kvZQyhVKEEcQAAEQ AAEQAAEQCC0Bu9dps1r43aRdMuIbGIHdu3dL/Gv1ObnrHeEL3B9m5h4zZamUlo+4Xk3/ZN8pNd1/ OTWbIXD26NdSX0+kKk/xQ/Pxg4JfDOXUk5NfS3d4mvgtf27/d6UTaoES6a3k8/zm53WzCUopv/ws K+U2P6+oRJqV2sJvHTO3/lfVyCpwcvubhvKJiUZGHxSc9BYrlthLBLS8TRKkZFNeNnEmbSvlthg/ R9ZP0Moxm1/eounkvH6jTONZpbRscBtDHZztgMX/EtkUf7HST5+2Q+gejJ3+6zfqKp8p9Zr9T3/+ /ApZf6W8kzLdx3+mZJekU7sltneXgUtiYqLh/LrXvlTznz2S49fH/2/2tyKvoocvzzLpvdSWQv4D M75R5SoBu3LO6g19u9jpI53cGXCsGLpYZsFts5VjSpP9S6Hhe1TkcB9wMx6Gup15/bxtNX0PS+Mi og1+o/dTJb/S9xU7zP5hF6+SCLG/mvVS6zEF7PSyi+fF9WkKJ2d+bCyrMJNVcsc5UH0+9rvgG4px 2SzD7DP8/E7vOHFk0+uqf7E9lNUWOrldu0fg19dSHXsreUpcdcZBfdsa20dRy/14z0sqcrmONdm/ FS13vfeYypTX+fKG/yhJ4qjoY+6nbscTWWi5tLBfK7W+JjHDpP2VSnXG+xT2n6NSkZKEIwiAAAiA AAiAAAi4JKDc79kVw4pIRggf/wSiomLVDL6PbkVS8mN/VNNP6zas919OLWIIeFpfTwtP7acl00f6 /O88f7tjxphZtOPQSXrYbv/IuASauORVSr0j2iCXn/BN3V9b/BUVzx+o238pkuIuNG/k51OUPBGt vG+adpufyzqfhiz9lt4b/YCP4KS04bSm4Dj9vxvb+KTpI+KS+tCSlwaoUcpLZyKS+tLS3COMh/JC i1Y0PGsbTerXRc7LXiKQw15QE9HpCVq0ep68GoLt2dXMwuT4rnerzD3RT1DqdfFqfc7rV4tYBCIp beJKGp5obJvLW5oeB4xoY6Gf+c3HwdjpsH6d5nGJ/WgX4zYouZMuVg4mdRvE2P/AXmh0uU8aj/Cw R+xemztdZapkymRvkF85trtyyh7Pvprm/LSHZo2QH43jCXl5eWp62uAXaWqfq9VzT/wdtOpgNg1P 7azGiQDrH5kz/kELB5r2S7TkKRcVj4cbpWhnpnLO6q3BdjHpQ3GdaOHx3TRtsMZNUZ73i3nZe+mt P5hY8AxmOaKQ2b8USb5H/+Oa/XgYTDtnfZ9FfRMNrwWh7mMW0Nb1M30VY7vzPf/jZhqeLK8qVzJ0 zphKBYXbxIsqeJxP17fkwTLaxQfhr1Z2dM54y79eigHmo51elvG+7erMj3WV+sh1x5nX58p+F3xD MS7Htb+e2H/+6Qz2DbZtyr3mZ/rHG6+IRL6Cf/JQbQ/luGsfZftEXy/SfvlgORWU8bku+VNT46Ai 39ZP2QPHjq43qiA5UFv9W6k24d7+6jVCXHdvvlBJMh7NfujCTzRB0XTrI/Kj9DyuU+ZddJHa9OfT 7Q89omZNm5hKF6lnCIAACIAACIAACIBAaAl4+AyllUiPxyOibZKtiiCuHhP47rvvhPZXX61NeBjM YY8F8geKoyPVu1ZDMnv+WTy6HGlOD1TOKMV0xh5FLCljj1ezeqNjKCY2WuxlZMpke1rBH6Nlj/+y p0UpJiaaWrTQJlRtC9VwQlVFmXi8t7IyitkTSy2YTa4+7HHdEsaknBkVFRNLrf3YVFFWQmVlbC/N qBj2pvMWgh1/TJ3RJHMzCR1Kv6V+518vHl+/dsxntP0V3WSZoqSL+pUiVkf+eLNo19gWFBut+ZQ/ /eS0SKa7lp/Ldm0nK2NXv5WuSpzcdl5/8tN2pXl/o/OSBhFbwUJ5p7Lomshfqbi4TPhhbHxrijWq r4iXjypf2We5j+jwGPOyM277CdbGUTExFNuiheFFSDyzLU/eL0W/slbGtpxXg0D18myhbJdA+mj9 iru7fb/wJ0dO8/Uvr8nGQ6BxzW48VKS4aucqKikuYX2e+QTrLy2YA5XnsRdPJT0hfCz3eBZ15m9U 1324f5exAlExLdkYIY8xVUwn9oYMQ9+342EXr6tCDrqyg/U7ts1GmRi7/OvlU483wk4vu3heTE6z btdAfuxPLpftlDPPyz+u7XfKV80X+LogaxLsX3adlwcOy2txFbveUqR8famNcTBQ+yhWuh7va7V/ My15fewbGW19jxPQTrX9nV03+FjA/rH7Kt/xX6QxlWzv9RSoOIIACIAACIAACICAHwKB5hMxEekH XmNKCjgR2ZhgNFJbCz9+ltr3mSKsn5P3Ew3ys2dlI0XkyGz9D3CrSSJHQpAJBPwQgI/5gYOksCAA Hw2LZoASIAACIAACIAACIFAnBAJNROLR7DppFlQKAuFG4Bh9NGuOUIo/dncXJiHDrYGgDwiAAAiA AAiAAAiAAAiAAAiAAAjUewKYiKz3TQgDQCAEBEoP0qKcMiEoZWJv7A1VHaSVp+XSZ2We1RGFsiBg SUDnY+yJbXxAIPwI6Hw0/JSDRiAAAiAAAiAAAiAAAnVJAI9m1yX9MKobj2aHUWPUiSoVVFx0hE6x V1m0ubitz16DdaJSfa206icqOnScqFk8Xdy67vclra8YobcfAlVldPjQCaqMakYXtm1tuV+fn9JI AoGaJ4BxsOYZowYQAAEQAAEQAAEQCFMCgR7NxkRkmDZcbauFicjaJo76QAAEQAAEQAAEQAAEQAAE QAAEQAAEQKBhEQg0EYlHsxtWe8MaEAABEAABEAABEAABEAABEAABEAABEAABEAhLApiIDMtmgVIg AAIgAAIgAAIgAAIgAAIgAAIgAAIgAAIg0LAIYCKyYbUnrAEBEAABEAABEAABEAABEAABEAABEAAB EACBsCSAiciwbBYoBQIgAAIgAAIgAAIgAAIgAAIgAAIgAAIgAAINiwAmIhtWe8IaEAABEAABEAAB EAABEAABEAABEAABEAABEAhLApiIDMtmgVIgAAIgAAIgAAIgAAIgAAIgAAIgAAIgAAIg0LAIYCKy YbUnrAEBEAABEAABEAABEAABEAABEAABEAABEACBsCSAiciwbBYoBQIgAAIgAAIgAAIgAAIgAAIg AAIgAAIgAAINiwAmIhtWe8IaEAABEAABEAABEAABEAABEAABEAABEAABEAhLApiIDMtmgVIgAALB E6iisrISKquoshBRRblLp1BqUifyeDzkiUikoXM2kZzTXzkLUYgCARBwTKC84CNKbhJBnbq/SAes uqZjScgIAs4JwO+cs0JOEAgVAfS7UJGEHBAAARBouAQiG65psCzUBPatfp2emb2FzrvuUZo9No2i WQX7VrC497aQJ+5mmjTnT3RltMen2q2zx9Kk1bvJ8z930VtvD6Xf+OQgKlg6gUYv/Jrirn6U3nyx Cy16dgL9k2IscpqiTp2iZrc8Si8OuJngzCY2jfQ0b+5gSho4lzznPEK5xxZS51jNJw9lT6brHhqj kTmbTwu/+A9NHUz0vZ9yWgGEQAAEgiFQWVlGG6Wz5NmcS8fKJbpE1y+DkYcy7gmUHd5JK5YupdXL v6L848fJc8EFlHD5jdT93lS6/56b6Piqhnc9h9+59xOUAIHqEkC/qy5BlAcBEACBhk8AczcNv41D ZuGpom2UlZVFTX+5i6aNJTERGSkdEXFEWZQy4gm6sssFxvqkf1PWU1Mo68yvLD6Lfv/so/TwpeYJ xmO0YvxEysr7Wch+89QRemvaHMonySjL5uzcihR6ARORNnQaX3Rl6c+y0VKZyfifad3MKSLOE9WT snLfoI6V/6GdRy8Qk9j25Uxi6t3pT7R63hLaWyrRTb370w1tzf2vtg0KN31q2/7arq+2eDuvJ6pW ETjXq1bVquXKcuc9Q9c99rpPrbtycmjhnEniP26WzW3ToK/ntet3PqgRUScEwq3/h5s+Nd8ojaPf Nb52rXnPQQ0gAAINnQAmIht6C4fUvnNVaYrjXHzznZRAU8Sk4Yrsf9H/63KzmocHKovy6R9nTqtx a74+yCYiO6rnPCCd+CetyT8l4h7udzvFxrWlv368iH44LU9EnnPOOXSsYCUN/fP7Is+Yt9kqtws8 dNorNvZ/u4hJUZGIP42ewP90uY8GD25Knlbd6IIYbTUkB/Ord3K7+yujqWfCZSzmMrrUS8xfOW+W +nko3UuvDRwqVqNNvql33U9Ehps+9bNVnWtdW7xrqx7nlss5w1Uvt3ZUI3/Bov/HJiHfVCWkj5lF j/ToTM1/+YFyFs2ivyzMJun0YvpXy4/Z9XwarucqKQTqPYFw6//hpk+9b+AwMQDtGiYNATVAAATq EwFlPqk+6Qxdw4iAJ74z9U2OpVE5pbR57TY69uzN1Eqn36FdmwwrGz9Zs5Vm/qEjxeryFO/eJiZJ eFSP37Vnf2Ooa+8/6HKwCc2CcjERyR+3/cPjj9A1kcYJJkNmnDRqAhfe1p9ms6/vJ5rY9KSIjj2v mU+yfTmfrPUrIqYZXUh8O+CzdF6zul4NydQIN33qV2u617a2eLuppzaXyLjRyz3dsC8hnfiCnkyf JevZJIE++HYjPZzQ0qv3jXRbjwdpyJ8+pZHpb9D/tuuC63nYtygUdEUg3Pp/uOnjCiYy2xJAu9qi QQIIgAAI2BHAy2rsyCDeIYFW1D31LpH39MYsyi/WP05dRbs2bjTI+eXDbNpXps9DlL9xncjTpPlz dIvPY9ty8fJK/mg3+7DHbSvL5aDTv4XZb1J6ejoNeXk5VZgKlReuo4y0dEofMp0OVGh6FW75kDLT e1FSUpL4pqWPoPlrC7wvNTEK2bflExqToeXtltKPJs/LphJjNnHmRq65ePm+T2lwWho9zV6uUlZ2 gOaOH0rdvPql9BpBn2w7ZC4izg/tWEvjM/ureZOSkmnImOmUs+eoZX6rSCd6a/p9RRUVP9LHrz1N ad06CX4paYNpzpq8avMjJiFvzXxd2yRTr4zRzPZCVW2uB2/T/iPfph/FSzEqaDPbpzQz8yl6f8VP It+yJ0dQ5pgxlJH5Ku0skdvdt5wqkgUC16vPbQ7751dBqxkr7qPPz//KXFTUzfdZTWf++MrK70nj HMgPKih7xsuUMXAYLZLkt4O8OXYEjWF2Z2Zk0vzPNX85lJ9DM8aPZO3VzevzMteVO7Q8XDG+JyzX M73/Syo3ReF9a/4qp/G+ZPkyEuf6cJm15beq/g77scbfuZ875ct10eRvouLCjTQiLYUiEiPFS17+ 6R2jnMlzx9vNOKYwk4/u6qGINlR55AB97HD8qjG9tuwPst85b3fOx43+/scJjXpZ8b8pP38PHS6p 1CJtQtsWTFP/o2/kkk90k5BagfiE+2jhtxvo4Q6XhP31nGvtzP81+8whZRzj9wTmDTzyFr8ixrGR M9f73C8UsBed8XH46TnGcdqZPu7Gea6zU38w26ecuynv1E+18cl5P3DGR9Zakx++458brkpbEPMm v9fjejweaTZahPh4X8a2aGL3OOr9qrgfVO6n3fcLi1pElP92cVeP3g/9328HaNdav8+yo4N4EAAB EAhDApLNh6nKf53bpCK6oRHYvXu3xL/+PrtmPSZ8omn3t6RSXcaTu94R8dxfXt7wHy3l7AFpeJNz RFr6iMFSAnlEeGbuMS2PdFh6MbG5iL92zGe6eGNQqYPt7SftKD1rTAxwtn3aQ0I+1/uEKe/J7bLu XO42r9y9S54R+ZU+oBw9EXeoeWQxldL6Sb0t8/IyTVMmSkWVWoXO5Wpl9CGFgaKP1XHylv/qilRK m6Y/aqsfLz9y6Xe6/NZBp3orLK30UuIemPGlrhJ3/CSpTFoy4npbe4Yu/ZeQreihtVeJNDWymW25 KV5/9C2nqOqsXiW3+RiYX7m0sF8roR9b8SvtKDf598md0v2eCJF+54xvJOd+4N/uVuO/EKp+v/Ap Wza83fQ+dWT9BDXv+ZnLJMW9zx75XLrD00SkNev1rmF80Hg400diUmvTb3l9bvqx4ieKT1sd9X7u hi9nZde+ytjnXJ5z3m7s19pTCTmrx84uPT+9r7ltF0Ub7RhIrxx3/c57rdDraw7r292t/oHHCa9l p/8p9fVEir5mvhZrtiuhMumt5PNEXk/0E1K+eWxRsumO+nYKx+u5c/+XjVLsUfoPj1XuZahJgrT2 qH68PSyNi4iWefmMxcXSpMRzRVrckGUqMef6uBvnHfuDqokx4Lw8xj83459zrsb2kKQGOh6ZzfSe K/3OPEbqzwfM/obldtcvbKqTAreLu3qc6C9frwK1a23fZ9kRQjwIgAAI1D4BZcy3q9l2pjFQQTuB iK+fBKozESmxH0aDmkSJG3T9ZOLpg3+Xb+jZBN6GwjxpVERTcX7na9pk1Nkf1qkTlC8bJtGMHJWb Av2PCWMO+zPlR4fVjzYfuZX71cnTmLSJ0o7CI9LRQ/uk9YtelhKbskki3STo8U2vC3t4X2mePlXk LT1RJC156UE1/oHZ38qKuZBrZ4miq9I3o9PGSdm5edL6uc+r9TVNmSoVewXo9eMTXEs375IKC/dJ mz6erDLnP8TWHDptVyX7Le2ch1m/c7o9J63YukvaumqmZX16/QLyYxoeXP6CaieXvaHgoLQvb4M0 adC1Iv46r18peuh9pTB3i5SdvUIanij/yORtm715s7Q6e6t0wjubZlWOg3FaryVEh/yO6HzJ8OOf CdVP/s0vOOkzUeXPDwpzt0rrWXsrPjNk+nJp8+ZsKXt1tpRXeFKovH1aD5Hea/Q0aXPeXuno0UPS 9tVamxknFsulJYPjVXkzd/zEZFSqcXzyd4Phh72RihN99H5RG36rr8+JHyp+ojAN5Ofu+PpORJ7T bZg0d9Hb0oiMSdIeNpHkRp5b3k7sN7aofOakHjM3f37Lpbptl2D0qk6/C9TurvR3OE4IG09+rf7H xLn97Sb9vTRO7VYnLeOGfKT+x4EVKzUuzK/nbvyf26T4nf56cHqvfG/C+/DTKw6opuvvR3jazG3a f5rq08bq/sPVjT6O/W33t47vQ1Tl9QEX/uTKT3U8G+X454KrvjmUcKBx0rF/WNwH1Nl4pBhnOir9 TvGT6LTnpDXsfvCrLO3eQrn/dGO3qRr51GG7uKnHV3/7++1A7cqVdDNO8MnZ6txnWTJCJAiAAAjU AQHlGmBXNSYi7cg0svhqTUSynzfLBrcRkxPs8WqpyMtO+R/KyM7jxErE5YOvE3miOk9UJ8t+WCVP LvEfCcqKRCv0yk2B/seEVT6rOFcTkbofeZN1P0J85ZZIs1JbCHv4ysfDhgzaxAyfGBSrMB3LNQgy nCgMeKfuPmaZYdXZqlE3CF00jsXSNGUlDJuENLM9vumvIj+XpU6WGmrznrjQW69fl8wFhtWn+hvA AYv5KkyX/HQrZ5vEDJP2KEvxvGru3byCTUweF2eKHr6+Ui69l9pS2G1ls3U5bcVuoHq9qhgPTvnp fvyf238Buw1VPtoNKe9H3M8UPZ35AStwWpuMmJP/iyJYPZYfLZL2HZInJdVIFvhqkjxByetV+jRP P3tcW/3I07JXaROdA+YFXmHrX5/a9lu3fmjkH9jP2U8Kl3z17es7triX55+3e/v1PmIIB/AzvV2B x69a0ivIfhe43V3q73ScEMCLpff6yf/50mv8P3RjhaE15JNT2mpqqzHPogSLCu/rebD9yXA9OFuk /scon6BVxlvlfkS5ce4+fqOK6ODyZ9Vr7JYT2ipKV/o49LdDrvxBVVELOC7v0k9ZDfp+HLgfuB+v 9PLDbvxzzFVrCp+Qv3HSoX+Y7wMCt4PLdg6Bnfp27JL5keF+9cj6Ker951B+P+jCbh+ePMKpvi7q 0esf+HrFdPDXrizZ1TjB8lf7PovJwAcEQAAE6pqAcj9lpwf2iGSE8KkugUi6nu35wj9ny1fR9iK+ b1UV7Vwvv+U66YFbqQWLSbrnbp6FKnctph3F/D6kiravWyPiYu5Lo6tiw+AFNM0uoPaeCKHTszcn 00y2r6F5DymRWFpIq1eUimDzGxMpuqKMiouLxbekrJyu7Cq/LOX05g1UyPfEdCpXSPT/h/2gotde SDW88OfWPwxSC0XxUOkPtGHjzyKu15RMusHEtmXXB4g9ZibSV6/50tpGnhqE3ly/WS/2FW0uKmB/ 4m9JI/aYvjgtO8bekO6WX+kRys2Xd/hMn5VBV5pes3XZbT0puYPyAgalVvNRt3Hhr4H3VhOlq1uv U35RV1C/cd1Elb8sepe2e/etpNJ8WvjOcRHfd0ga/UZnkiM/4PmrNFt/Pe27wWp064vo0rZxquSq qgrWM4ladbhexJ3ZnUv/5T7s/Xha3kpvLRgqzqp2jqOUe54VYfYfDDRxQEclm/3Rnz617bdu/VBn lSM/Z/nd8lWrYC8WWfH+c4Y252mu5fnl7XIcU5WzCPirR5fdkd9Wo110VclBf3oF2e9CPr45HSeE Ra3osQXb+X8i09/H3kPRPgYbI2K9L+gip2Mehff13LX/G3HIZ56LKPWVZBEuey+L9om9V7X7EaXI xr9vpB/FSQV9s2q+CPF7laQW2r2KK30c+ltbV/6gaKs7Oi1fjX7WKMc/p1x1TeETbHDjkY+FhgjZ Tx4y3K/Gd+2p3g8e4feDDvuF/v7HUInTdgmiHkfXK66Mv3Zlya7GCZa/2vdZXCd8QAAEQCDMCWAi MswbqL6o1/babsT2gGQzkfm0fvsPbJ3df+izv8mva+l1a4Iw4+LrblPzbN7BXpQiHaacGbtE2kMP 3WS4UakzuyMvoWc/HSdXz2wZdncSxUUk0vOzV1Oxbh6L2Gyf8gPvxIR7qWVMHMXHx4tvy7g4Suo3 xSuDvVyHh5zKlUsF/qvNLVnn1enX43eXW+SJpfj28sRgRGxTi3RvVJB6i8lQvdTIeOrQs7mIWf/9 AarQ6eeIny7/rV0u1Euu2XB163XB7/rejwlbpDMbadmGfSJ86IuVtEI6Q+wRJup9n8UkXyA/cEjn UP5aepW90CjR04SiomIoyuOhy9PGq6XN7XlV33HEVtyq6Vy/9z8e7jNppmVwGNLxrhW/1dXnyA9N Zpi5kNnPvfnd8uXFPBHtqHWsqcJqyLOUVE37LWU6iQzkt7WoVzD9LmC7u9XfxTjhBK+ah3EuE9t9 s2NFIOhqKQr363kw/UmzTg51vPtBEZBOL6aNBew/Fdk9i7gfYWPZ+LdfFfcqVbs+odwi9p8wlfsp 650TIv+Avrf53Ku40ceRv1XXH5yWd+unJogB+4E3vxs+ShVhOf455aoYEcTRkX+Y5AZsB7ftHGI7 ffSLamu8H2T2BGO3isGFvkHV43zoVFWyCrjtBzV2n2WlHOJAAARAoA4ImNYV1YEGqLJBEPDEX0N9 k2NpVE4pLVr/Pb1yE9E7ZyvZj+k76JZr4oWNngtZnsTmNCrvZ1qzOZ+eu+ZXmn72tEi7/4b2Nc7B 74SbrvYL7x5NR/ISaMLYR2j6CrYekk1IThhyD03KHEbfn5hGV0azCVfdJyLpfnr8xjg6xf5j1/j5 mTyte9L/elcjupVrlBX6s4pSNsElPvKEpF0NodG7io586rsaj9fpiJ++qH5C2E7pmogPsl6n/GKu ShGrVHn/ePPt9fTKg+1p4+JZwpKY1KF0e1uf2/mQWFmw6FnqqEycM4lNEhPp9gsuoOPHt1Benp3R kWTwGtZHqFJbNRkSxWyE1JTfOvJDG520aF8/D46vJtEcCrU8RX5o7Fekhe5Y03qFpt/5trtCwKn+ TscJRa6jY7M46tgkklacOUMbP9hEx569mVo5KBjO1/NQ+X/cVV2J7W0t7lNWfL6XMuKPiPsRT/SN 9FCfB+mXp/5M+WfyadX2QkrpuJUWSWwsZJOUqTe3MxB0q49Tf6uuP7gt79RPDcb7nPj2A7d8fESa IkItTxHv1H63XBX5To9O/cO/PN92UPKHh50VPveD1bXbabtUtx6Fo9tjcH5bd/dZbu1DfhAAARAI ioDdM9tMGP9VaZeM+AZGoHp7RMowlLdTR3YaJi2aNVL4j34/SJ5L3Xeu03PSx+89LfLo95W0w6rs 18IekzC8MMYuvz5++yz5rdlWe/yd+v5vQgc7uScKt0mT+nUReXh/4G8tFh/dm4yfXqF7U7i+Yj9h W7l+yvhj4JOm02/APO8LcwyyS9S3qcb0Mr4F3ZDNdOJPb1UHtielz9tZ2Z5cytvRH+AMdfo54qfb 60z/ogCTeuJU1cPHV8q0PSKVdtQJsCznol6dKNugP368kPIGVu6Pa9iLeJS34+pfqGCpp7dGyzRm gyLH+MZ6VkhnH9/sfodur0h/fUPZL025TvCjsoelVxX7gz99dH5RK36rq8+RHzKrVMZO/DwIvqp8 H/8Nsr0c8nZqv23D+qtHz83CLh+bg2iXYPXi5Vz1OyftXk39A40Ttrb6JGj74vI+Or/Ad49YnyLe iLC8noe0P1VKq0ZcL67t/OVlqxbK9yN8j16+BbGS1iXzXWnVtEdFPv3L4ASmIPTh5Zz4m5Dv/VNd f7AtH4Sfqn3VST8Igo8q32KcCOp65W9cCsL+areLP328wp34h8rJSTvUgZ2u9HNht56/XdjW313U o+pv4YeWaf7aNYh+wFWt1n2WHRzEgwAIgEAtElB+J9pViUezGSF8nBE4VWq5W6Ja+PLk/xPhqm9n UN+hb4jw7Q8YV2Bc0b2nN8+r9NDA10W48/DudJEI1cyfC37TTgiWTufRYWXvPRFzjOZPkFec2dXc 4uIb6LkFm9THUNvGNZOzxjSjNuwxVv55a+5K+z0W5dw+f23l+uQMMiIqSn10/MMFOSQ/JK/JqtyX Q0/mnBQRd/e4xedRMy2nMeREb/6oW9amfYaCpfnr6C95v4i42Di2si8Ifsqj8K/P9OVdVrSb8ovk PTsNFYfgJJT1BuLX4c7edAfzK6lyJfVI7CZW4fA9ivr8rl3wlugez8zh2yaYPqp90/5MnXV7RZ4o LDLl9J6e+IaG95L7d2zGu7TqPW2/yNHzv7cuo4/1p09t+20QfqiY4sjPWWbXfJUKbI6u5fnjXQ37 fdTzV49P5gARtayXm37nqN2rqX+gcYKqyqj4cDGVVNitWFb4RtO9f3xGOaHHH5lMB6yKVP1IWbNn Uk6RtvQ8XK/nrv1ftd4ciKRre/USkeXLR9M9/eT7kfQeXdgumUTX3ien7Zj6ON0zYp7Id2+fZJ8V pcHo48bfeMUB/UFoZ//Htnw1/NRRP2AqBcPH3pIg5Pkbl6phP9fRlqs/A/zp4y3nxj8ctUNd2Om1 Rdav0ECkPH+T8X4wCLsNAk0ngdrFDV+TaPvTAO3quh9U9z7LXlOkgAAIgEDYEMBEZNg0RRgqUnGA pmeOp5U7CunwvnX011HL/SqpPOqkz3TXHR30p9Ty8luIrc4yxD18d4LhPNQnba6Q5fO991JfmEv/ Zj/eKop306tpl9HQhbmG6soLPqKkc1JpDn9JjfcH24mCdeqLXw4flSfv+ObaGW+kibLly56kAZOX U7Hyo5C97OPw/p00d/xImrxyr5zHqVyDNtU4ibmaBr+YIgT8mp1JfZ5fQoeFQVV0dM86eurK38vC 2aNmg632HvRW7ZiHTlX+aO/YHlfQ0/M3UUlVFZUWbaRnOj+p1veHO9lehy75UQx7rP+5LkIG5/3o 5FWCd1VZMW1e9ALFtUugZ9Ye1GkRomA163XLzxN/Ez3R1/jSndjH+1Gi7uUIri2La0O3JMSIYms/ /5J+rKig4v27ac9hNnFbWanuIZf14TrvhHoVFax4nX57j7ZHpFZnBX08+j5138rFox+jux8dRaMi 5H1G33/8KcoRL6LSSviE/OlT237r1g91xjjyc9d8dRVYBYOR5493Nez3Uc9fPT6ZA0TUsl5u+p2j dnepv7tx4mea27sdxV8YT7995P2A/wkWn/IosdXoAjh/udRlzfvSBxty6TB/udrh/ZS9eAoln/Nb ShsyjP5Tzn5Nez9heT0Pxv8VgyyO8Z260/3el9MpyV2928S07txV/KeQEs+PD6VcoT8NYvyUiwfy N3f+YFSJnzku79JP9TU56gchbi/31yumsb9xyaX9jrnqQZnD/vTx5g3kH3qRjtqhLuzUKTm2xyW6 +8EvaHjnx+VUdv/Zm98Pej9u7FbK8KPbdgm2Hn2dPmF/7eq6H4TgPstHQUSAAAiAQBgSsFsqyVQV j6LYpSO+YRGwfDT75NcSW50l/EDxB34cMO87G+MrpWWD26j52f6Q0pYTZ0152eOx/VppedhjD9tK zXlMRdip/lEIJ/mNEg5L4yKi1Tr1tihh/igsl3ty+5uGfImJkYbzDwpOaqJP7ZbYHlOG9MTERMP5 da99KfK7kqvVYAj5Y6BP26HwZI/jKI/kKnaaj0MXWz22rVXrRm9FB3Md+vPu4z/ThLvgxwudPZJj 6Y+K/P+bLdui6KG0qVah80ez9T7mtF6tHi3khp9S6sj6CQYfennLf5UkcbS3z9hPVD9gDxrq+6XC a8DifzF5xRJ76YxWX5MEKdnk83qORza9ruZ9YIbs21ypk9vfUePP7f+uVCo0tfvjTx8urHb9VnLp hwp/haPVUfNzd3w5MUW+nrtG0r08yW/7M8ku7dd0MYf8t6s/u/Rpqt/Wkl6KFU77nVV7K3Fau7vj 6m6c0MaxZr0C9TXZurNHvw54LeA2fGB4dNvYnuFxPXfv/3rf0o/rMplyaaHufoRv37KfP5ctPiXS rNQW6rhmvYWMe30U6f78zZ0/KBK1o6vyLvuZwlPxeauj1g/c81Hkh+P454qr1hymkLFfKfzk67GW 1Z9/8FwKJ6W81VFrB1bARTuHwk7X+nlND2S3N5vhEIy+gepR9LfyQ32aer3ye5111w9Cc59lQIQT EAABEKgTAsq1ya5y200gAxW0E4j4+knAciKycr/0YnKseiPOfSIlcwGburD//KCbROF7D56wyLp3 +TOqzLghH0nlFnnMUeqFn+2Ho134zbnszyvZD7Hhyc3VerktnTOmSgVsD0g+mchvNoTcymJpyUsD DPl43oikvtLS3CO+FZTul2aN6OWTn5dJG/yitKXQO3HpVq5vTeqNpyf6CZ89GE/uel/ooNqhlD+x R5o22Fc/bs+87L1KLvujC73VNmIT0K/Nne4zaZg5+zPftnbKz6vhqcIcaXhqZyNvNnmWOeMf0lHv D0hVDx9O2g94q/0H7cuxe3gH9VpCdMFPLX96p8rOuq3lST/rNBs/OM78P9E4Gf/ymgNylaV7DPug Cn/v9IS0aPU8ia0WkjzqHlQaP/6jXPvBzsVUSsu9+61Z3birtikBf/rwPLXot0IlF36o+olTP3fM V4ajyvfxXzldcilPlArE24X9Xi2sD37q8WeX7fhVC3qphjjtd07bnQt2qr+bcUK33y7fz9DJ9VPY WF4kLZk+Uh1beD8XXzZ+ZoyZZdgfVmESltdzl/7vz++4nQdXvaBeT7qM+QcbybSPslcf56T/jxct Bwu51Ect68/f3PiDKlAXcFveqZ+yKlSeTvuBSz6q/HAc/9xy1TWJIehnnFTz+fOPYNqBC3baziGw U2nH5ulvSZtXzZQSyKP2M96fhsz4zPo/LAPYrfLRB4LRN0A9iv71+j5LzwhhEAABEKgDAsq9pl3V Hp7AMvl8PB75zcA2yT75EVG/CXz33XfCgKuvvtrHkLKSYuJPHUdGt6AWscbHqn0ys4gq9jguf6o5 OtI+r8jDMkVH2+cxy65ijzyzEuRHrLmIzzm3pYw9fhYV05Jat4gW6VwXZp1RLqurpKSMytkjFVEx sSxvrI8sQ4San21/GBNNMbGxzH5DDvlEzedQrkmEPwZyGrfDt+KqijIqKSvjTzY5s8dULznQuzTv b3Re0iBiE1GUdyqLron8lYqL5Tpj41uTX9dR5Qfg59WroqyETpSVM1tiKLZFC+YVxo8tJ9bW3Jft /M62nMN6jVrozlT7HLR76bfU7/zrxf6Q1475jLa/0l0nSA7609OfHyh9OTq2BcWaHJQzLWNMGVRq 0bqF2CfNtx7Wt2WAIt2sWBV77JsNFMa+ZM6kO/enD89WG36rU4dX6O339n4YrJ874ytr48vdoKU4 cSNPKR2ItxP7FVn+jnb1+LPLn9/WtF7ClgD9Lth2F7Id+JUxn/04cTR7IrXpPkZkn5P3Ew1KOE+E nf+pojJ2bZO7cQy7VrH+6qdwuF7P3fi/P7/jpvu7H3FiP5fhRh+enwL4m8ij+o29P4h8dn/cllfz Y/yryfs4pbnsxkmRHsA/wmU8UmyxOor7gWjv+KLzLb/3gwHstqpHjVPrcNBfHNTjb9zwd73y167O xonQ3mepfBAAARAAgVomEGg+0d/9Zy2riurClUBsCzaJ5EI5PhEWyLFEnkCZTHVGsgmO6n6ELS2M Uqwm7vhkSovW7GvMan/mNL/TfDY1+WPgNy2aTaayb9Afl3pX8ncesB+4rRlDRx+X8vlEWlv2tfvY smC+aZp/M4iwLefNFahegzD9iQv7CtcuEpOQvHjGw9frpahhf3r6S/PXl7lt/Kv/+MpifdsPwEj2 o8PNx58+XE5kLfut237vxs+d8ZXp+XL3pepGnlI6EG+39ityzUe7evzZ5S+tpvXi+jvpd4qdbtpd lHHa/wPm+5HmjpwgRLLHLoOYhORFI8V/3ji9GoTr9dyN//v1LU6E37PY3I84sZ9TdaMPz+/I3wL6 A5fk5+O2vMv8bvqBGz6B2otb7EaeQshuXFLSHY8zLjmp8k0Bf/o48g+vPDftIIo41d9pPpNdyqnh fsChLDd2K/WoR4d18PxO6vHnh/7S/LWrM78N7X2WygcBEAABEAgzAnhZTZg1CNQBARBozASO0Uez 5ggA7PFnusv1aqfGzA62g0CwBOpHvyvNXUaj8n4mtpchzR7VPVhjUa7OCdQPf6tzTI1WgcbqH7Vl d23V02gdGIaDAAiAgCMCNv8H7KgsMoEACICARqDytBw+W6bFIeSOQOlBWpQj80uZ2JsuclcauWuD APy8NijXbh1O+l0YtHuzK+6jrZuvpVYdutAluHurXR8JZW1O/C2U9YVSVhj0g1CaE5aynPhHQ2wH J3aHosFqq55Q6AoZIAACINCACWCPyAbcuG5M87dHpBs5yNuICVT9REWHjhM1i6eLWzt98K8R87I0 vYKKi47QKYqiNhe39dn70rIIImuXAPy8dnnXSm0O+h3avVZajOufnAAAGeFJREFUonFU4sDfwhUE +kEttIwD/2iQ7eDA7pDQr616QqIshIAACIBAvSUQaI9ITETW26YNreKYiAwtT0gDARAAARAAARAA ARAAARAAARAAARAAgcZGINBEJPaIbGweAXtBAARAAARAAARAAARAAARAAARAAARAAARAoA4IYCKy DqCjShAAARAAARAAARAAARAAARAAARAAARAAARBobAQwEdnYWhz2ggAIgAAIgAAIgAAIgAAIgAAI gAAIgAAIgEAdEMBEZB1AR5UgAAIgAAIgAAIgAAIgAAIgAAIgAAIgAAIg0NgIYCKysbU47AUBEAAB EAABEAABEAABEAABEAABEAABEACBOiCAicg6gI4qQQAEQAAEQAAEQAAEQAAEQAAEQAAEQAAEQKCx EcBEZGNrcdgLAiAAAiAAAiAAAiAAAiAAAiAAAiAAAiAAAnVAABORdQAdVYIACIAACIAACIAACIAA CIAACIAACIAACIBAYyOAicjG1uKwFwRAAARAAARAAARAAARAAARAAARAAARAAATqgAAmIusAOqo0 Eigv+IiSm0RQp+4v0oEqLc0uXssRLqEqKisrobIKnfLholqD1gPcrZq3/vQbK+0RBwIgAAIgAAIg AAIgAAIgAAIg0JAJRDZk42BbiAhUHKC3X/or/bNcshR4qrwFDZn4AnVu4bFMDxRZWVlGG6Wz5Nmc S8dYHZfEynLs4gPJq+30vLmDKWngXPKc8wjlHltInb3617Yeja0+cLdu8frSb6y1RywIgAAIgAAI gAAIgAAIgAAIgEBDJoCJyIbcuiGyrfS7NTR04lS/0nqOHs0mIqP85nGSaCfBLt6JzJrOU1n6s1yF VFbTVXnl/0Sr5y2hvaUS3dS7P93QNqaW6g2vamqfe6jsr732C+d+EyqakAMCIAACIAACIAACIAAC IAACIFB/CGAisv60Vd1pGnWOWndK5ls05JbWdPr0aTWO6FxKbNN4Xel/utxHgwc3JU+rbnRBTHCr QnUwAwdL99JrA4eKVaSTb+rdaCcia5174JZxlgPt54wTcoEACIAACIAACIAACIAACIAACDQ4Ao13 9qjBNWXtGPT7gQOo9zXNaqeyelLLhbf1p9nsW2ufmGZ0IfHtXc/Sec0a52pIzrrWuYeqgWuz/bAk MlStBjkgAAIgAAIgAAIgAAIgAAIgAAIhIICX1YQAYmMS8evp8oDmFma/Senp6TTk5eVUYcpdXriO MtLSKX3IdDpQYb3npKmI7rSCVr/2tJD9/PyvdPFKsIq2zh7L0nvRKyu/VyJ9juX7PqXBaWn09Jyv qKLiR/qYyUzr1omSkpIoJW0wzVmTR/rXzmj5N1Fx4UYakZZCEYmR4uU6/2Q28HRuU/+Rb9OPoiDX 80m/em7mejIdJq/cK/Q7lJ9DM8aPZHp0E3okJSVTr4zRtHLHIZ3+FZQ942XKGDiMFkmyhm+OHUFj xoyhzIxMmv+5Pi/Rvi2f0JiMXl55SdQtpR9NnpdNJTqJ/oLBtGPhlg8pk/HnLPk3LX0EzV9bYOCp 1Fld/Xy5K5KJ3OihlZJD+vYuKztAc8cPpW5ee1J6jaBPthk5K+UP7VhL4zP7q3l5Gw4ZM51y9hz1 ZnHXfopc/dGVXRFtqPLIAfo4ZPozn1rxutq3zRsR5C1+RaSNnLnep98XLJ0i+iXvc8onWM5KeRxB AARAAARAAARAAARAAARAAATqIQHJ5sNM4bNENqmIbmgEdu/eLfGv1efkrneEL3B/mJl7zCqLIW77 tIdE/qbd35JOGFIk6eR2WZYnqqe0rfSsSFXk87gd3jie4BtfLi3s10rIZi+GkXaUy+XVKk7ulO73 RIj0O2d8o0abA4oOio9bHR+Y8aVaTNHDnE/RV5HnibjDa5NRz/wAen6/8CmVr7kOfj55y3+9upRI UyOb2eZtNf4Lb75Kaf2k3rb5mqZMlIoqVfNsA27bce+SZyzr1LgoVYVGP1/usnzneij6GI927a1v G61NeNlKadP0Ry1tV8qMXPody+e0/Yz6KGdO7ao5/SVp16zHZDubJEhrj+r732FpXES0SPPtm8XS pMRzRVrckGWKOWr/VhhZHY2c1aIIgAAIgAAIgAAIgAAIgAAIgAAIhCkB5bednXpYEckI4eOCgCfw 0/xRTc9VBfrk1j0qqguq+f0HounOQaNFFun0Ylr1lXFl2tFvVtMK6YxI73fnFfaiTBWf0+05WrF1 F21dNZMSSN7j8e8jMmjt4UpLGed0G0ZzF71NwwfeSs24LEVek1hvkOn56EhRluu5ZruyIk4WZ9Dz jsvp1LH9IqHX6Gm0OW8vHT16iLav1nT5yxv/IHn12fnUa9sGWv/xZFkQ+ztk+nLavDmbsldn04b0 a0T8ic0zqPuopSLcPH0q7Sg8QqUnimjJSw+KuF+zR1Pme7tE2N8fV+1YdYD++vAMIS4mbaKo8+ih fbR+0cuUENlWRcQzhEo/VajKnQl3oYdQ1sGf6LRxlJ2bR+vnPq/mHjvuAzrmPeP23D58njjjb05f unkXFRbuo02snRR/eqPPw8yfmjtqP7USfaAadoVO/0q6qntPWauz+bRua6GqoXRoN31y5ldxzn3+ i7wTurSdtCjvF3E+rM91arw5EEhPc36cgwAIgAAIgAAIgAAIgAAIgAAI1EMCdjOUzBSxgsUuHfEN i4DTFZHEVkKlpqZq3+QkKSVzgVSqw6GsmuIrIvXxPIuyWktZTWgXZxt/+p/SoCZRwjfP7b9AKucZ xadcWjI4XsRHdh4nHVaiLY6KDtzHuzDd9as2j2x6XcjgaQMW81Vsms48jq8mNMtW5Oltkk7tlvp6 IoWs8zOXsTVzysdXz/KjRdK+QyeVDOrxq0k9VHuK1FgWOK3JnpP/iz6FhUukWaktRDlfXStVRk1T phrsNgkRp67a8eTX6mrUydv8rZoNnX6W3B3rYWWxHKfI5e3dfcwygw+vGnWDYMvbWl7RWyxNSz5P jmOrdJVVvor045v+KtK4rAdmfytH+20/paTp6MKuGtX/bJE0KqKpsCluyEdq//th1QuqnYLb+I2q AQeXPyvzYcy2nNBWUbrTUxWHAAiAAAiAAAiAAAiAAAiAAAiAQBgT4L8J+dfugxWRjA4+LgiwlVBZ WVnaN2cXbXz3B8s9AF1IdZ416grqN66byP/Londpewn3b/YpzaeF7xwXwb5D0ug3IuT/D5tMolkv 9qUWumzxt6TR8CbyW8LLjp3SpbBgkwRa8f5zjmRTzJXU97kuovzJNz+mfGU/TJ2e9w+5V8iKbn0R Xdo2Tq2rqqpC8GzV4XoRd2Z3Lv23zGsnj6nSVmr67NlZWkirV5SKcs1vTKToijIqLi4W35Kycrqy q/xSndObN1ChXqYoUY0/zS6g9p4IIeDZm5NpJttn07yHoEisaf2c6uHAVO4fr72QSrG6vLf+YZB6 JhbClv5AGzb+LOJ6TcmkG2KNb01v2fUBYo8li/TVa76UmfhrP1W6KRCEXTWiv+ciSn0lWShX9l4W 7RN+XUXb160xKLzx7xvpRxFTQd+smi9CMfelUVILIx+e4EhPIQF/QAAEQAAEQAAEQAAEQAAEQAAE 6jsBTETW9xasZf37z/6M8vJyKTdX+369Ld0wWVPTKl3f+zFRhXRmIy3bsE+ED32xUn4sm00W9r6v o2MVlKeq1QKR8dShZ3Nxuv77A4aXbngi2lFr/ayUWsgqEEm39pYnrfSPkR/6Zr2q52N3JakFD+Wv pVfZi04SPU0oKiqGojweujxtvJruo6eaYgqwjLHex8tPTLiXWsbEUXx8vPi2jIujpH5T5AJny0ib zjTJCOY08hJ69tNxXtn5NOzuJIqLSKTnZ6+mYv2bf2paP6d6OLUxECSdPT1+d7mF1FiKby9PbEfE NrVIdxgVrF01oH/Hu+VH/Llfbyxgk97SfyhnBnvUn/W98W+/Kh5Hr9r1CeUWscnzyv2U9Y78mPaA vrfZjxOB9HSICdlAAARAAARAAARAAARAAARAAATCm4DPFn7hrS60q2sCv7vlFkq4ppkjNao18eKn hpirUsQqs1F5P9Obb6+nVx5sTxsXzxIlYlKH0u1t2exQ0J8qOvJp4DeDOxEfl9RNrK6cfvY0vbbk S3o++QH6Yt5UUbRp8kC69WJZz4JFz1JHZYKQpTZJTKTbL7iAjh/fwiZ99bN4TmrV8kQk3U+P3xhH p0wLO4l+Jk/rnvS/ptV7WkljyGk7Xnj3aDqSl0ATxj5C01ew9ZBs9eyEIffQpMxh9P2JaXRltHE1 XKj0M2pL5FYPc/lQn1eUyvuWEskTksHKryu7zPrHXdWV2PYI9M7ZSlrx+V7KiD9C3Mc90TfSQ30e pF+e+jPln8mnVdsLKaXjVvkN72ySMvXmdsGajnIgAAIgAAIgAAIgAAIgAAIgAAINhABWRDaQhqwt M3weBbaouJJNdPFPxZpddNg0jxYVZZyMsijuIKoV3f+nASLf6U2raVP+Flq96Cdx/uRjPexXXZkl e9jLZcxzllIpea6WHzHu3vESijaXcXPOVrE9PPF+UaJs3me0o2gHrVhUIs4HDr1XfiS8/FsaxV4o wz/8pTk7Dp2kM7t20YYNG2jrh2+LeFd/2MqyMrEdA9GI8W/S7NkLaMEC83cZvf/GwICPmAfTjvEJ 99G0rFI6UbiNJvWTH00/Wz6D/vhOrmxGCPXzxyWgHv4Ku0nT2fNFXqFFSa0DnCmzfFjdoox9VMjt Ckb/qEuo17BOQsnPN6yn9RtzRLh5n9vp0haXUtc/JorzbV/k0MZ1n4swn3i/tlr/QSDE4A8IgAAI gAAIgAAIgAAIgAAIgEA9J4CJyHregOGo/gW/aSfUkk7n0WFlD0cRc4zmT5BXLlZX7w539qY72GPM UuVK6pHYTay64nvN9fmdXLcT+fzR0qxN+wxZS/PX0V+8b/iNjTPPUhqyOjpJeqC3yCdV/I2ubXej rGfEHfRIt8vU8sqj1K9P+zN11u0VeaKwSM1jCOgmj3K2/2BIophm1IZx4Z+35q603qfRWML2rDrt 2OLiG+i5BZuIvchFyG8b511FG0L9bBXXJdjqoctTrSCbyVba78MFOSRPM2sSK/fl0JM5J0XE3T1u kSfJ/bWfVtRvKGR2BaM/RdK1vXoJ/cqXj6Z7+r0uwuk9urAUomvvk9N2TH2c7hkxT6Td2yeZWokQ /oAACIAACIAACIAACIAACIAACDRmApiIbMytX0O2t7kiQUjmezimvjCX/l1RRRXFu+nVtMto6ELv yrhq1u2Jv4me6NvSICX28X6UaPEyDEMm3Ql/BHpsjyvo6fmbqKSqikqLNtIznZ+Uc7BHSf9wp/O9 JnViDcGYy7qqLytREpr3fZyuU/SsrFRXMGZ9uM47cVhFBStep9/eo+0RqZQVx7g2dEtCjAiu/fxL +rGigor376Y9h9l+fexlPhlvpIm08mVP0oDJy6mY8Rcf9hKcw/t30tzxI2nyyr1ynJ+/btqxvOAj Sjonlebwl9R4qztRsE59kcvho/JkXCj1s1LdsR5WhYOJi7maBr+YIkr+mp1JfZ5fQocFgCo6umcd PXXl72WpzJ8GK3uX+ms/Gx1qzK5g9Gc6xnfqTvd7X06kqNz1hvYi2LpzV/GfBEo8Pz6UcoX+FGEQ AAEQAAEQAAEQAAEQAAEQAIFGSgATkY204WvS7JirutO4CPmh5rLZj9PFMVEUE59Ao7K8k1HeytnC MJ+PVRzP5BsfTXc+OtJQ/k99b3f1KPXZvDxR/o1H76CWbGXYee2Sxb53PLL7i2/QXRaPkvrqYVDB Qs/f0N0jHjJkGsXqUx/5jmtP3e6Q36q8fkIv8YKXbkkx1DH1GUMZY72t6cqb5Bfq/LLgSWobE0Px lyXQpE1HRJlrB/9F7OHHT5b9qRfFM/5JSUns7cQxdOFlXWjgn6fSkj3HDPKtTty0Y+Wp45RXuYIy +Etq2OP3SUlRdEHHB+UX8zDhA3terVYRKv1UgSyg8HGjh768XViRa5fO47sOn0R9PXwtINH6Cb+n C9lKWo8nitpcdZfqT0MXLtD5k//2E4JMf4K1q2b0Z8rFJVCfvi1ULZvEDKMbLpYnxz0tr6bf3y+v hOUZmjR/jm65VE5TC5gCTvQ0FcEpCIAACIAACIAACIAACIAACIBAPSSAich62Gi1rXJUVKxaZdMo ecJFjbAM/Iae/3EzDU+WJ8uULJ0zplIB2zuQv+iCf3wefI5oQ818IllGm/j4rnerK6880U9Q6nXx Qq7TPx72iPRrc6erMpRymezN4CvHdldOtaONHmoGm/SEe/urdQg9b75QLULsgdXhWdp+ivwFLzns BTURnZ6gRavnyavO2F6WRi6RlDZxJQ1PVKczhbzLW3rbhq1ym/PTHpo1Qn5ElifmeSddeTht8Is0 tY82McjjrD/O2zEuqQ8teUnet5PLUl6yE5HUl5bmHqGHO8RpVYRMP69IHXdXemgaWYd0crUMFm++ jutEC4/vpmmDNd5Kfm7/vOy99NYfkpQodgzQfrqcSjAou2pMf65VNN36yFBFPeqUeRddpA4N59Pt Dz2ipqVNTKWL1DOLgFM9LYoiCgRAAARAAARAAARAAARAAARAoH4R8EjsY6Wyx+MR0TbJVkUQV48J fPfdd0L7q6+2maBijy5XsBzRkepsgyNry0qKqay8kqJiWlLrFvLEWRWTxSdj9KKq2GPDfHJDH8cr sIvnaVT6LfU7/3qx7+K1Yz6j7a9YTB6KjMY/pXl/o/OSBrEVgj0p71QWXRP5KxUXlxF7Sppi41tT rIWJfvVg4gOlswxUwb6R0cxGozrqWUVZCZWVsTd2s5WLLVq3EPkCyeV8+ZPX0bEtKDbaQjLjWlJS RqwJKCYmmmJiY1kbqlU6DjhtR1Lr420ey9pcm8S2rEzNH5x+tnxUuQ71MClnK5flk9O4//qCrKoo oxL2UhruS07sD9h+Jr2c8q0t/Xlf5t052sKpRBrT39+YEayeZiw4BwEQAAEQAAEQAAEQAAEQAAEQ CA8CgeYTMREZHu1U51oEnIiscw19FSj8+Flq32eKSJiT9xMNStAeB/XNrcXoJyJzj2dR51h50l3L gRAIgAAIgAAIgAAIgAAIgAAIgAAIgAAIgIBbAoEmIvFotluiyB8mBI7RR7PmCF34HnR3OZyEDBPl oQYIgAAIgAAIgAAIgAAIgAAIgAAIgAAINDoCmIhsdE3eQAwuPUiLcsqEMSkTe/vfg85scuVpOeas XN6cjHMQAAEQAAEQAAEQAAEQAAEQAAEQAAEQAIHQE/Dd5Cz0dUAiCISeAHtrb3bhQTrFXnnT5uK2 ruTHJT1ChYV3ETWLp4vxWLYrdsgMAiAAAiAAAiAAAiAAAiAAAiAAAiAAAsESwERksORQro4JRFPr iy8OTofI8+nii88PrixKgQAIgAAIgAAIgAAIgAAIgAAIgAAIgAAIBEUAj2YHhQ2FQAAEQAAEQAAE QAAEQAAEQAAEQAAEQAAEQAAE3BDARKQbWsgLAiAAAiAAAiAAAiAAAiAAAiAAAiAAAiAAAiAQFAFM RAaFDYVAAARAAARAAARAAARAAARAAARAAARAAARAAATcEMBEpBtayAsCIAACIAACIAACIAACIAAC IAACIAACIAACIBAUAUxEBoUNhUAABEAABEAABEAABEAABEAABEAABEAABEAABNwQwESkG1rICwIg AAIgAAIgAAIgAAIgAAIgAAIgAAIgAAIgEBQBTEQGhQ2FQAAEQAAEQAAEQAAEQAAEQAAEQAAEQAAE QAAE3BDARKQbWsgLAiAAAiAAAiAAAiAAAiAAAiAAAiAAAiAAAiAQFAFMRAaFDYVAAARAAARAAARA AARAAARAAARAAARAAARAAATcEMBEpBtayAsCIAACIAACIAACIAACIAACIAACIAACIAACIBAUAUxE BoUNhUAABEAABEAABEAABEAABEAABEAABEAABEAABNwQwESkG1rICwIgAAIgAAIgAAIgAAIgAAIg AAIgAAIgAAIgEBQBTEQGhQ2FQAAEQAAEQAAEQAAEQAAEQAAEQAAEQAAEQAAE3BDARKQbWsgLAiAA AiAAAiAAAiAAAiAAAiAAAiAAAiAAAiAQFAFMRAaFDYVAAARAAARAAARAAARAAARAAARAAARAAARA AATcEMBEpBtayAsCIAACIAACIAACIAACIAACIAACIAACIAACIBAUAUxEBoUNhUAABEAABEAABEAA BEAABEAABEAABEAABEAABNwQwESkG1rICwIgAAIgAAIgAAIgAAIgAAIgAAIgAAIgAAIgEBSByO++ +85vQY/H4zcdiSAAAiAAAiAAAiAAAiAAAiAAAiAAAiAAAiAAAiCgELCbb8SKSIUQjiAAAiAAAiAA AiAAAiAAAiAAAiAAAiAAAiAAAjVGwCOxj5V0Zeby6quvtkpGXAMjgPZuYA0Kc0AgBAQwLoQAIkSA QD0ngHGgnjcg1A+KAPw+KGwoBAKuCKCfucKFzCBQrwgE6t9YEVmvmhPKggAIgAAIgAAIgAAIgAAI gAAIgAAIgAAIgED9JICJyPrZbtAaBEAABEAABEAABEAABEAABEAABEAABEAABOoVAUxE1qvmgrIg AAIgAAIgAAIgAAIgAAIgAAIgAAIgAAIgUD8JYCKyfrYbtAYBEAABEAABEAABEAABEAABEAABEAAB EACBekUAE5H1qrmgLAiAAAiAAAiAAAiAAAiAAAiAAAiAAAiAAAjUTwKYiKyf7QatQQAEQAAEQAAE QAAEQAAEQAAEQAAEQAAEQKBeEcBEZL1qLigLAiAAAiAAAiAAAiAAAiAAAiAAAiAAAiAAAvWTwP8H U6AkgFXDlEwAAAAASUVORK5CYII= --Apple-Mail=_2A33192B-8732-499A-8657-AEAA6615BD1B-- --Apple-Mail=_D6F09D49-832A-435A-AB85-C9D83518CC63-- From nobody Thu Jun 27 15:14:46 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A0C5D1200A1 for ; Thu, 27 Jun 2019 15:14:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xoSQBufX6B2o for ; Thu, 27 Jun 2019 15:14:43 -0700 (PDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DBD70120114 for ; Thu, 27 Jun 2019 15:14:42 -0700 (PDT) Received: from kduck.mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id x5RMEcO1016203 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 27 Jun 2019 18:14:40 -0400 Date: Thu, 27 Jun 2019 17:14:37 -0500 From: Benjamin Kaduk To: Thomas Hardjono Cc: "rats@ietf.org" Message-ID: <20190627221437.GN18345@kduck.mit.edu> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.10.1 (2018-07-13) Archived-At: Subject: Re: [Rats] More use cases for draft-richardson-rats-usecases-00 X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 27 Jun 2019 22:14:45 -0000 On Mon, Jun 24, 2019 at 03:04:12PM +0000, Thomas Hardjono wrote: > > Folks, > > What's the best way to contribute use-cases to draft-richardson-rats-usecases-00 ? > > Should I post the text on the mail-list for discussion. Hi Thomas, That's never wrong, so in the absence of other guidance please go ahead. -Ben From nobody Fri Jun 28 14:24:10 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 76C771202DB for ; Fri, 28 Jun 2019 14:24:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.499 X-Spam-Level: X-Spam-Status: No, score=-14.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=lOOGJ+oy; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=JIUM9TIl Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Wu1Ai4zD0Xry for ; Fri, 28 Jun 2019 14:24:07 -0700 (PDT) Received: from alln-iport-5.cisco.com (alln-iport-5.cisco.com [173.37.142.92]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4848E12028B for ; Fri, 28 Jun 2019 14:24:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=4511; q=dns/txt; s=iport; t=1561757047; x=1562966647; h=from:to:subject:date:message-id:mime-version; bh=8fVInWOjAcYmQsdYTzfHLRyMJdGJS68LohnpQgaosGM=; b=lOOGJ+oyobJAvJTxhvo3YeM08oikuB1OmLxj66sSkYFLfNcwjsp0EVbj UgfL9J8I9bBbB7MOpvscn5SM+MUgWsuBPnVjQrrb2PvcVmdWyqz8v+Sj8 AMGqJ7lDhmLWq0/pH7eMBHieVqrDpjyGAPErbQqFveuLAmop2Im7t105e o=; IronPort-PHdr: =?us-ascii?q?9a23=3AQ/uU5BKKI5MRKodjjNmcpTVXNCE6p7X5OBIU4Z?= =?us-ascii?q?M7irVIN76u5InmIFeBvKd2lFGcW4Ld5roEkOfQv636EU04qZea+DFnEtRXUg?= =?us-ascii?q?Mdz8AfngguGsmAXEvwJfv1bio1NM9DT1RiuXq8NBsdFQ=3D=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0DPAABGhRZd/51dJa1lHgEGBwaBVAg?= =?us-ascii?q?LAYEUL1ADalUgBAsohByDRwOOXUyBapMVhFSBLoEkA1QJAQEBDAEBIwoCAQG?= =?us-ascii?q?EQBmCaSM1CA4BAwEBBAEBAgEFbYo3AQuFYxEdAQE4EQEMPgIEMCcENYMAAYE?= =?us-ascii?q?dTQMdAQ6bdgKBOIhgcYEygnkBAQWCR4JIGIIRAwaBNItfF4F/gTgME4MKgmE?= =?us-ascii?q?CA4ILgl0ygiaOYIR8iFmNewkCghaGU40mG5djGYQEiRCHOI9pAgQCBAUCDgE?= =?us-ascii?q?BBYFRATaBWHAVZQGCDQEzgkFPgyKFFIU/coEpjxoBAQ?= X-IronPort-AV: E=Sophos;i="5.63,429,1557187200"; d="scan'208,217";a="292068163" Received: from rcdn-core-6.cisco.com ([173.37.93.157]) by alln-iport-5.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 28 Jun 2019 21:24:05 +0000 Received: from XCH-ALN-006.cisco.com (xch-aln-006.cisco.com [173.36.7.16]) by rcdn-core-6.cisco.com (8.15.2/8.15.2) with ESMTPS id x5SLO5Br032362 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL) for ; Fri, 28 Jun 2019 21:24:05 GMT Received: from xhs-rtp-003.cisco.com (64.101.210.230) by XCH-ALN-006.cisco.com (173.36.7.16) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 28 Jun 2019 16:24:05 -0500 Received: from xhs-rtp-002.cisco.com (64.101.210.229) by xhs-rtp-003.cisco.com (64.101.210.230) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 28 Jun 2019 17:24:04 -0400 Received: from NAM01-BN3-obe.outbound.protection.outlook.com (64.101.32.56) by xhs-rtp-002.cisco.com (64.101.210.229) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Fri, 28 Jun 2019 17:24:04 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=8fVInWOjAcYmQsdYTzfHLRyMJdGJS68LohnpQgaosGM=; b=JIUM9TIlIM+ymEls7EpWBhW5hWNf0JlVcc3VhD2lg/EOW20kWxH7res+GZFxWm9ITm9z68b5zZxQDEIfX4NEypwVP2y4mPVYxBvxiy8b+hBYteTA2MNIrKGudHIYfUg9wRWjuykdpp1uppWdS2L1iXCo3x4+NucBfRt3bLAY/L0= Received: from MWHPR11MB1791.namprd11.prod.outlook.com (10.175.53.138) by MWHPR11MB1471.namprd11.prod.outlook.com (10.172.53.141) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2032.18; Fri, 28 Jun 2019 21:24:03 +0000 Received: from MWHPR11MB1791.namprd11.prod.outlook.com ([fe80::1c5:a33f:e151:4f85]) by MWHPR11MB1791.namprd11.prod.outlook.com ([fe80::1c5:a33f:e151:4f85%6]) with mapi id 15.20.2008.018; Fri, 28 Jun 2019 21:24:03 +0000 From: "Nancy Cam-Winget (ncamwing)" To: "rats@ietf.org" Thread-Topic: Live: https://github.com/ietf-rats-wg Thread-Index: AQHVLffOnmX96TcQTU2Z1Z3Rzde+4g== Date: Fri, 28 Jun 2019 21:24:02 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.10.b.190609 authentication-results: spf=none (sender IP is ) smtp.mailfrom=ncamwing@cisco.com; x-originating-ip: [2001:420:c0c8:1005::506] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: e3d84afd-e9d3-43ce-199e-08d6fc0ef185 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:MWHPR11MB1471; x-ms-traffictypediagnostic: MWHPR11MB1471: x-ms-exchange-purlcount: 5 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:4502; x-forefront-prvs: 00826B6158 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(396003)(136003)(366004)(39860400002)(376002)(346002)(199004)(189003)(99286004)(14454004)(606006)(33656002)(966005)(6306002)(25786009)(102836004)(6436002)(5640700003)(186003)(53936002)(2351001)(68736007)(4744005)(236005)(6512007)(478600001)(6486002)(6916009)(6506007)(8676002)(81166006)(64756008)(7736002)(81156014)(6116002)(1730700003)(54896002)(8936002)(5660300002)(58126008)(316002)(66556008)(66446008)(66476007)(91956017)(73956011)(76116006)(66946007)(476003)(86362001)(2616005)(486006)(256004)(2501003)(36756003)(2906002)(71200400001)(71190400001)(46003); DIR:OUT; SFP:1101; SCL:1; SRVR:MWHPR11MB1471; H:MWHPR11MB1791.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: Wf+FIKYwDO/G2Hw4C5bjpz3pL36t3RgN7aUHHYCG/gLYK1eKL9quTmfcwwFERNVh/BgZIUF0vcmXCxgJfiZPYpSDvOqdnh5fcUXHneruo0s4GtPavYVhaiuWqDuihWZMAcM4vj7PG6o/edkYONRKpKO0Yup7k/7trlAhoqfE/zM7c46mXLVN69LwKGHli6q4gTQbxBWcBSJr8BpkzaPzz7WroudcHF5kShhUwNQmGdU0jT6LoveMocFbuQF7u8oLWlvtcIhqnEH7au1h15uyH0RqmDADhaMarNv6k3cdExRO7/CbmWzVvzjfD9YnsAiZECN2NoVcPLT6zAZqr9oGWYYCD0bj8VdyxyHBjZmK4gqb3I7Tb4ocZ4PXAHRHqcaJ2OGX9nwaLxi37eu0GyoBgBwbK1NeHK+ZOo43uBb+t1E= Content-Type: multipart/alternative; boundary="_000_BF1F31367202411980B5130037E74528ciscocom_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: e3d84afd-e9d3-43ce-199e-08d6fc0ef185 X-MS-Exchange-CrossTenant-originalarrivaltime: 28 Jun 2019 21:24:03.0246 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: ncamwing@cisco.com X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR11MB1471 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.36.7.16, xch-aln-006.cisco.com X-Outbound-Node: rcdn-core-6.cisco.com Archived-At: Subject: [Rats] Live: https://github.com/ietf-rats-wg X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Jun 2019 21:24:10 -0000 --_000_BF1F31367202411980B5130037E74528ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 UkFUcyBwYXJ0aWNpcGFudHMsDQoNClRoZSBHaXRIdWIgaHR0cHM6Ly9naXRodWIuY29tL2lldGYt cmF0cy13ZyBpcyBub3cgdXAgYW5kIGxpdmUsIEnigJl2ZSB1cGxvYWRlZCB0aGUgVmlydHVhbCBt ZWV0aW5nIG1pbnV0ZXMgYW5kIHNsaWRlcyB0aGVyZSBhcyB3ZWxsIGFzIGluDQpodHRwczovL2Rh dGF0cmFja2VyLmlldGYub3JnL3dnL3JhdHMvbWVldGluZ3MvDQoNCldlIG5lZWQgdG8gZ2V0IHRo ZSBFQVQgZHJhZnQgaW4gR2l0SHViIHNvIHdlIGNhbiBzdGFydCBlbnRlcmluZyBpc3N1ZXMsIGJ1 dCBuZWVkIHRoZSBBdXRob3LigJlzIEdpdEh1YiBhY2NvdW50cyB0byBpbmNsdWRlIHRoZW0gYXMg bWVtYmVycyBzbyB0aGV5IGNhbiB1cGxvYWQgdGhlIGRyYWZ0cy4gIFRoZXJlIGFyZSBnb29kIGlu c3RydWN0aW9ucyBhbmQgdG9vbHMgaW4gaHR0cHM6Ly9naXRodWIuY29tL21hcnRpbnRob21zb24v aS1kLXRlbXBsYXRlDQpGb3IgZHJhZnQgc3VibWlzc2lvbnMgdG9vLg0KDQpCZXN0LCBOYW5jeQ0K --_000_BF1F31367202411980B5130037E74528ciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: <5F9C31C40C914346AE81B2451ED2C32F@namprd11.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3Jt YWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOiMwNTYzQzE7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9 DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOiM5NTRGNzI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpz cGFuLkVtYWlsU3R5bGUxNw0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1jb21wb3NlOw0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1z b0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6 IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4g MTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rp b24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9keSBs YW5nPSJFTi1VUyIgbGluaz0iIzA1NjNDMSIgdmxpbms9IiM5NTRGNzIiPg0KPGRpdiBjbGFzcz0i V29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0Ij5SQVRzIHBhcnRpY2lwYW50cyw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJz cDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQiPlRoZSBHaXRIdWIgPC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8vZ2l0aHVi LmNvbS9pZXRmLXJhdHMtd2ciPmh0dHBzOi8vZ2l0aHViLmNvbS9pZXRmLXJhdHMtd2c8L2E+IGlz IG5vdyB1cCBhbmQgbGl2ZSwgSeKAmXZlIHVwbG9hZGVkIHRoZSBWaXJ0dWFsIG1lZXRpbmcgbWlu dXRlcyBhbmQgc2xpZGVzIHRoZXJlIGFzIHdlbGwgYXMgaW4NCjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PGEgaHJlZj0iaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy93 Zy9yYXRzL21lZXRpbmdzLyI+aHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy93Zy9yYXRzL21l ZXRpbmdzLzwvYT48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+V2UgbmVlZCB0byBnZXQgdGhlIEVB VCBkcmFmdCBpbiBHaXRIdWIgc28gd2UgY2FuIHN0YXJ0IGVudGVyaW5nIGlzc3VlcywgYnV0IG5l ZWQgdGhlIEF1dGhvcuKAmXMgR2l0SHViIGFjY291bnRzIHRvIGluY2x1ZGUgdGhlbSBhcyBtZW1i ZXJzIHNvIHRoZXkgY2FuIHVwbG9hZCB0aGUgZHJhZnRzLiZuYnNwOyBUaGVyZSBhcmUgZ29vZCBp bnN0cnVjdGlvbnMgYW5kIHRvb2xzIGluDQo8YSBocmVmPSJodHRwczovL2dpdGh1Yi5jb20vbWFy dGludGhvbXNvbi9pLWQtdGVtcGxhdGUiPmh0dHBzOi8vZ2l0aHViLmNvbS9tYXJ0aW50aG9tc29u L2ktZC10ZW1wbGF0ZTwvYT48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkZv ciBkcmFmdCBzdWJtaXNzaW9ucyB0b28uPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkJlc3QsIE5h bmN5PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_BF1F31367202411980B5130037E74528ciscocom_-- From nobody Fri Jun 28 16:01:36 2019 Return-Path: X-Original-To: rats@ietf.org Delivered-To: rats@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 7DCB112098E; Fri, 28 Jun 2019 15:57:58 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "\"IETF Secretariat\"" To: , Cc: rdd@cert.org, rats@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.98.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <156176267850.11015.18095237537020894122.idtracker@ietfa.amsl.com> Date: Fri, 28 Jun 2019 15:57:58 -0700 Archived-At: Subject: [Rats] rats - Requested sessions have been scheduled for IETF 105 X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Jun 2019 22:58:10 -0000 Dear Kathleen Moriarty, The session(s) that you have requested have been scheduled. Below is the scheduled session information followed by the original request. rats Session 1 (1:30 requested) Wednesday, 24 July 2019, Afternoon Session II 1550-1650 Room Name: Van Horne size: 130 --------------------------------------------- rats Session 2 (1:30 requested) Thursday, 25 July 2019, Afternoon Session II 1550-1720 Room Name: Sainte-Catherine size: 100 --------------------------------------------- iCalendar: https://datatracker.ietf.org/meeting/105/sessions/rats.ics Request Information: --------------------------------------------------------- Working Group Name: Remote ATtestation ProcedureS Area Name: Security Area Session Requester: Kathleen Moriarty Number of Sessions: 2 Length of Session(s): 1.5 Hours, 1.5 Hours Number of Attendees: 40 Conflicts to Avoid: First Priority: secdispatch saag mile acme tls sacm teep suit netconf People who must be present: Ned Smith Kathleen Moriarty Nancy Cam-Winget Roman Danyliw Resources Requested: Special Requests: If 2 sessions at 1.5 hours is not possible, 1 session at 2.5 hours is the minimum we'll need to sort through items unless the interim goes swimmingly. --------------------------------------------------------- From nobody Fri Jun 28 19:03:59 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 87F1A1201A8 for ; Fri, 28 Jun 2019 19:03:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9EF1GiqVrTwE for ; Fri, 28 Jun 2019 19:03:55 -0700 (PDT) Received: from p3plsmtpa12-03.prod.phx3.secureserver.net (p3plsmtpa12-03.prod.phx3.secureserver.net [68.178.252.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7015A12009C for ; Fri, 28 Jun 2019 19:03:55 -0700 (PDT) Received: from [172.20.10.4] ([174.213.0.240]) by :SMTPAUTH: with ESMTPSA id h2iXhpqGcE5Geh2iYhDzwM; Fri, 28 Jun 2019 19:03:54 -0700 From: Laurence Lundblade Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_0C1B238F-D610-4B47-BBD7-33C2B3F24CFA" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Fri, 28 Jun 2019 19:03:53 -0700 In-Reply-To: <5C7BC8CB-480B-41E4-856F-9D3E54BE46E9@qti.qualcomm.com> Cc: "Smith, Ned" , "rats@ietf.org" To: Jeremy O'Donoghue References: <4CC3F371-5DD9-4E3F-84F9-9A4952A36470@intel.com> <1F7DD45D-6508-41E6-B67E-64EB84C4AEC9@island-resort.com> <79646E0D-87AC-4D82-A68E-AB97D1058FF0@intel.com> <5C7BC8CB-480B-41E4-856F-9D3E54BE46E9@qti.qualcomm.com> X-Mailer: Apple Mail (2.3445.9.1) X-CMAE-Envelope: MS4wfHfCG0Kd5t0mtQfdXVb+MzVtdWG+t1IxD/lnsKPxHzBkE+ni+nHNpDeFlNdODnmMPN0bwaE/zlKdEkbrXHcSVtclWlTI7N5vp7QBermuqBRY0USph4qt xchDunXhz/jL17kieX1xwHcm3JvvC6ST6uUVYG/Yh8NF6xumqufqJX9kn0fPJtd3VHaZiATgVm+0g+0qgbrRLeCtXWTBESgKMw1v/d5xHw58ZZ/kdNw3JNfG Archived-At: Subject: Re: [Rats] UEID questions X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 29 Jun 2019 02:03:58 -0000 --Apple-Mail=_0C1B238F-D610-4B47-BBD7-33C2B3F24CFA Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Here=E2=80=99s an update to the UEID text that hopefully addresses the = discussion from April. I pasted in below rather than a PR as I am = waiting for access to the Rats GitHub.=20 LL 3.3. = Universal Entity ID Claim (ueid) = UEID=E2=80=99s identify individual manufactured entities / devices such = as a mobile phone, a water meter, a Bluetooth speaker or a networked = security camera. It may identify the entire device or a submodule or = subsystem. It does not identify types, models or classes of devices. It = is akin to a serial number, though it does not have to be sequential. UEID=E2=80=99s must be universally and globally unique across = manufacturers and countries. UEIDs must also be unique across protocols = and systems, as tokens are intended to be embedded in many different = protocols and systems. No two products anywhere, even in completely = different industries made by two different manufacturers in two = different countries should have the same UEID (if they are not global = and universal in this way then relying parties receiving them will have = to track other characteristics of the device to keep devices distinct = between manufacturers). The UEID should be permanent. It should never change for a given device = / entity. In addition, it should not be reprogrammable. UEID=E2=80=99s are variable length. The recommended maximum is 33 bytes = (1 type byte and 256 bits). The recommended minimum is 17 bytes (1 type = and 128 bits) because fewer bytes endanger the universal uniqueness. When the entity constructs the UEID, the first byte is a type and the = following bytes the ID for that type. Several types are allowed to = accommodate different industries and different manufacturing processes = and to give options to avoid paying fees for certain types of = manufacturer registrations. Creation of new types requires a Standards Action [RFC8126] = . UEID Composition Types Type Byte Type Name Specification 0x01 RAND This is a 128- to 256-bit random number generated once = and stored in the device. This may be constructed by concatenating = enough identifiers to be universally unique and then feeding the = concatenation through a cryptographic hash function. It may also be a = cryptographic quality random number generate once at the beginning of = the life of the device and stored. 0x02 IEEE EUI This makes use of the IEEE company = identification registry. An EUI is made up of an OUI and OUI-36 or a = CID, different registered company identifiers, and some unique = per-device identifier. EUIs are often the same as or similar to MAC = addresses. (Note that while devices with multiple network interfaces may = have multiple MAC addresses, there is only one UEID for a device) TODO: = normative references to IEEE. 0x03 IMEI This is a 14-digit identifier consisting of an 8-digit = Type Allocation Code and a six-digit serial number allocated by the = manufacturer, which SHALL be encoded as a binary integer over 48 bits. = The IMEI value encoded SHALL NOT include Luhn checksum or SVN = information. 0x04 EUI-48 This is a 48-bit identifier formed by concatenating the = 24-bit OUI with a 24-bit identifier assigned by the organisation that = purchased the OUI. 0x05 EUI-60 This is a 60-bit identifier formed by concatenating the = 24-bit OUI with a 36-bit identifier assigned by the organisation that = purchased the OUI. 0x06 EUI-64 This is a 64-bit identifier formed by concatenating the = 24-bit OUI with a 40-bit identifier assigned by the organisation that = purchased the OUI. UEID=E2=80=99s are not for direct use by humans (e.g., printing on the = case of a device), so no textual representation is defined. The consumer (the relying party) of a UEID MUST treat a UEID as a = completely opaque string of bytes and not make any use of its internal = structure. For example, they should not use the OUI part of a type 0x02 = UEID to identify the manufacturer of the device. Instead they should use = the OUI claim that is defined elsewhere. The reasons for this are: UEIDs types may vary freely from one manufacturer to the next. New types of UEIDs may be created. For example, a type 0x07 UEID may be = created based on some other manufacturer registration scheme. Device manufacturers are allowed to change from one type of UEID to = another anytime they want. For example, they may find they can optimize = their manufacturing by switching from type 0x01 to type 0x02 or vice = versa. The requirement of the manufacturer is only that UEIDs be = universally unique. --Apple-Mail=_0C1B238F-D610-4B47-BBD7-33C2B3F24CFA Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Here=E2=80=99s an = update to the UEID text that hopefully addresses the discussion from = April. I pasted in below rather than a PR as I am waiting for access to = the Rats GitHub. 

LL

3.3. Universal Entity ID Claim (ueid)

UEID=E2=80=99s identify = individual manufactured entities / devices such as a mobile phone, a = water meter, a Bluetooth speaker or a networked security camera. It may = identify the entire device or a submodule or subsystem. It does not = identify types, models or classes of devices. It is akin to a serial = number, though it does not have to be sequential.
UEID=E2=80=99s must be = universally and globally unique across manufacturers and countries. = UEIDs must also be unique across protocols and systems, as tokens are = intended to be embedded in many different protocols and systems. No two = products anywhere, even in completely different industries made by two = different manufacturers in two different countries should have the same = UEID (if they are not global and universal in this way then relying = parties receiving them will have to track other characteristics of the = device to keep devices distinct between manufacturers).
The UEID should be permanent. = It should never change for a given device / entity. In addition, it = should not be reprogrammable.
UEID=E2=80=99s are variable length. The recommended maximum = is 33 bytes (1 type byte and 256 bits). The recommended minimum is 17 = bytes (1 type and 128 bits) because fewer bytes endanger the universal = uniqueness.
When= the entity constructs the UEID, the first byte is a type and the = following bytes the ID for that type. Several types are allowed to = accommodate different industries and different manufacturing processes = and to give options to avoid paying fees for certain types of = manufacturer registrations.
Creation of new types requires a Standards Action [RFC8126].
UEID Composition = Types
Type = ByteType NameSpecification
0x01RANDThis is a 128- to 256-bit random = number generated once and stored in the device. This may be constructed = by concatenating enough identifiers to be universally unique and then = feeding the concatenation through a cryptographic hash function. It may = also be a cryptographic quality random number generate once at the = beginning of the life of the device and stored.
0x02IEEE = EUIThis = makes use of the IEEE company identification registry. An EUI is made up = of an OUI and OUI-36 or a CID, different registered company identifiers, = and some unique per-device identifier. EUIs are often the same as or = similar to MAC addresses. (Note that while devices with multiple network = interfaces may have multiple MAC addresses, there is only one UEID for a = device) TODO: normative references to IEEE.
0x03IMEIThis is a 14-digit identifier = consisting of an 8-digit Type Allocation Code and a six-digit serial = number allocated by the manufacturer, which SHALL be encoded as a binary = integer over 48 bits. The IMEI value encoded SHALL NOT include Luhn = checksum or SVN information.
0x04EUI-48This is a 48-bit identifier formed = by concatenating the 24-bit OUI with a 24-bit identifier assigned by the = organisation that purchased the OUI.
0x05EUI-60This is a 60-bit identifier formed by concatenating the = 24-bit OUI with a 36-bit identifier assigned by the organisation that = purchased the OUI.
0x06EUI-64This is a 64-bit identifier formed = by concatenating the 24-bit OUI with a 40-bit identifier assigned by the = organisation that purchased the = OUI.
UEID=E2=80=99s are not for direct use by humans (e.g., = printing on the case of a device), so no textual representation is = defined.
The = consumer (the relying party) of a UEID MUST treat a UEID as a completely = opaque string of bytes and not make any use of its internal structure. = For example, they should not use the OUI part of a type 0x02 UEID to = identify the manufacturer of the device. Instead they should use the OUI = claim that is defined elsewhere. The reasons for this are:

  • UEIDs types may vary freely from one manufacturer to = the next.
  • New types of UEIDs may be created. For example, a type 0x07 = UEID may be created based on some other manufacturer registration = scheme.
  • Device manufacturers are allowed to change from one type of = UEID to another anytime they want. For example, they may find they can = optimize their manufacturing by switching from type 0x01 to type 0x02 or = vice versa. The requirement of the manufacturer is only that UEIDs be = universally unique.

= --Apple-Mail=_0C1B238F-D610-4B47-BBD7-33C2B3F24CFA-- From nobody Fri Jun 28 21:28:14 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A1E21120086 for ; Fri, 28 Jun 2019 21:28:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=qti.qualcomm.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Cgc2XIGW1b3R for ; Fri, 28 Jun 2019 21:28:11 -0700 (PDT) Received: from alexa-out-sd-01.qualcomm.com (alexa-out-sd-01.qualcomm.com [199.106.114.38]) (using TLSv1.2 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DB08212002E for ; Fri, 28 Jun 2019 21:28:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=qti.qualcomm.com; i=@qti.qualcomm.com; q=dns/txt; s=qcdkim; t=1561782490; x=1593318490; h=from:to:subject:date:message-id:references:in-reply-to: mime-version; bh=E3tht3EceOBB7tuVR91cYkoKckm+Tuj0pRdWJnhQuTo=; b=ws64143CXgLsCLlePPzQR61yDewCo4wKPLTC/slQEzu6UnPD7CgfRhCf TqvZUYhYRPLv4Ufh3Q4LJKthiWAnZ02EzaKkFM2L2i0/vPRNMHFKjxBCf oTJgaDVr1em/tJ3nxtsFHaU6gdV6cVWvmKzeuulB32bsu96OcqN2I1B4V k=; Received: from unknown (HELO ironmsg05-sd.qualcomm.com) ([10.53.140.145]) by alexa-out-sd-01.qualcomm.com with ESMTP; 28 Jun 2019 21:28:10 -0700 X-IronPort-AV: E=McAfee;i="6000,8403,9302"; a="276276618" Received: from nasanexm01h.na.qualcomm.com ([10.85.0.34]) by ironmsg05-sd.qualcomm.com with ESMTP/TLS/AES256-SHA; 28 Jun 2019 21:28:10 -0700 Received: from NASANEXM01C.na.qualcomm.com (10.85.0.83) by NASANEXM01H.na.qualcomm.com (10.85.0.34) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Fri, 28 Jun 2019 21:28:09 -0700 Received: from NASANEXM01C.na.qualcomm.com ([10.85.0.83]) by NASANEXM01C.na.qualcomm.com ([10.85.0.83]) with mapi id 15.00.1473.003; Fri, 28 Jun 2019 21:28:09 -0700 From: Giridhar Mandyam To: "rats@ietf.org" Thread-Topic: Live: https://github.com/ietf-rats-wg Thread-Index: AQHVLffOnmX96TcQTU2Z1Z3Rzde+4qayB9Qg Date: Sat, 29 Jun 2019 04:28:09 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.80.80.8] Content-Type: multipart/alternative; boundary="_000_ccc07ed4a16a4699930fafecbfa9767aNASANEXM01Cnaqualcommco_" MIME-Version: 1.0 Archived-At: Subject: Re: [Rats] Live: https://github.com/ietf-rats-wg X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 29 Jun 2019 04:28:13 -0000 --_000_ccc07ed4a16a4699930fafecbfa9767aNASANEXM01Cnaqualcommco_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhhbmtzIE5hbmN5Lg0KDQpOb3RlIHRoYXQgRUFUIGFscmVhZHkgaGFzIGEgR0ggcmVwbyAtIGh0 dHBzOi8vZ2l0aHViLmNvbS9lYXQtaWV0Zi13Zy9lYXQuICBDYW4gd2UgcmUtdXNlIGl0Pw0KDQpB bHNvIG5vdGUgdGhhdCB0aGUgY3VycmVudCB2ZXJzaW9uIG9mIEVBVCBpcyBpbiBLcmFtZG93bi4g IEkgaGF2ZSBiZWVuIHVuYWJsZSB0byBmaW5kIGFueSB3YXkgdG8gZG8gYW4gYXV0b21hdGVkIHBy ZXZpZXcgb2YgUFLigJlzIGZvciBLcmFtZG93bi4gICBGb3IgdGhhdCBtYXR0ZXIsIEkgaGF2ZSBu b3QgZm91bmQgYW55IGF1dG9tYXRlZCBwcmV2aWV3IHRvb2xzIGZvciBYTUwyUkZDLiAgQnV0IEkg aGF2ZSBub3QgbG9va2VkIHRoYXQgaGFyZCwgc28gbWF5YmUgb3RoZXJzIGluIHRoZSBncm91cCBj YW4gcHJvdmlkZSBndWlkYW5jZS4gIFVubGVzcyB0aGlzIGNhbiBiZSByZXNvbHZlZCwgbXkgc3Vn Z2VzdGlvbiBpcyB0aGF0IGdyb3VwIHBhcnRpY2lwYW50cyBjcmVhdGUgaXNzdWVzIHcuci50LiBF QVQgYW5kIHdlIGhhc2ggb3V0IHRoZSBjYW5kaWRhdGUgdGV4dCBvbiB0aGUgbGlzdC4gIFdoZW4g YSBjb25zZW5zdXMgaXMgYXJyaXZlZCBhdCwgdGhlbiB0aGUgZWRpdG9ycyBjYW4gY3JlYXRlIHRo ZSBhc3NvY2lhdGVkIFBSIGFuZCBjbG9zZSBvdXQgdGhlIGlzc3VlLiAgVGhpcyBob3dldmVyIHB1 dHMgdGhlIG9udXMgb24gdGhlIGVkaXRvcnMgdG8gZW5zdXJlIHRoYXQgdGhlIFBSIHdpbGwgc2Vh bWxlc3NseSBmbG93IHRocm91Z2ggdG8gY3JlYXRpb24gb2YgdmFsaWQgdHh0L1hNTC9QREbigJlz IGZvciB1cGxvYWQuDQoNCi1HaXJpDQoNCkZyb206IFJBVFMgPHJhdHMtYm91bmNlc0BpZXRmLm9y Zz4gT24gQmVoYWxmIE9mIE5hbmN5IENhbS1XaW5nZXQgKG5jYW13aW5nKQ0KU2VudDogU2F0dXJk YXksIEp1bmUgMjksIDIwMTkgNToyNCBBTQ0KVG86IHJhdHNAaWV0Zi5vcmcNClN1YmplY3Q6IFtS YXRzXSBMaXZlOiBodHRwczovL2dpdGh1Yi5jb20vaWV0Zi1yYXRzLXdnDQoNCg0KQ0FVVElPTjog VGhpcyBlbWFpbCBvcmlnaW5hdGVkIGZyb20gb3V0c2lkZSBvZiB0aGUgb3JnYW5pemF0aW9uLg0K UkFUcyBwYXJ0aWNpcGFudHMsDQoNClRoZSBHaXRIdWIgaHR0cHM6Ly9naXRodWIuY29tL2lldGYt cmF0cy13ZyBpcyBub3cgdXAgYW5kIGxpdmUsIEnigJl2ZSB1cGxvYWRlZCB0aGUgVmlydHVhbCBt ZWV0aW5nIG1pbnV0ZXMgYW5kIHNsaWRlcyB0aGVyZSBhcyB3ZWxsIGFzIGluDQpodHRwczovL2Rh dGF0cmFja2VyLmlldGYub3JnL3dnL3JhdHMvbWVldGluZ3MvDQoNCldlIG5lZWQgdG8gZ2V0IHRo ZSBFQVQgZHJhZnQgaW4gR2l0SHViIHNvIHdlIGNhbiBzdGFydCBlbnRlcmluZyBpc3N1ZXMsIGJ1 dCBuZWVkIHRoZSBBdXRob3LigJlzIEdpdEh1YiBhY2NvdW50cyB0byBpbmNsdWRlIHRoZW0gYXMg bWVtYmVycyBzbyB0aGV5IGNhbiB1cGxvYWQgdGhlIGRyYWZ0cy4gIFRoZXJlIGFyZSBnb29kIGlu c3RydWN0aW9ucyBhbmQgdG9vbHMgaW4gaHR0cHM6Ly9naXRodWIuY29tL21hcnRpbnRob21zb24v aS1kLXRlbXBsYXRlDQpGb3IgZHJhZnQgc3VibWlzc2lvbnMgdG9vLg0KDQpCZXN0LCBOYW5jeQ0K --_000_ccc07ed4a16a4699930fafecbfa9767aNASANEXM01Cnaqualcommco_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjojMDU2M0MxOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFu Lk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjoj OTU0RjcyOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5tc29ub3JtYWwwLCBsaS5t c29ub3JtYWwwLCBkaXYubXNvbm9ybWFsMA0KCXttc28tc3R5bGUtbmFtZTptc29ub3JtYWw7DQoJ bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXplOjExLjBwdDsN Cglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFuLkVtYWlsU3R5bGUxOA0K CXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1z ZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4uRW1haWxTdHlsZTIxDQoJe21zby1zdHls ZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNv bG9yOndpbmRvd3RleHQ7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjINCgl7bXNvLXN0eWxlLXR5cGU6cGVy c29uYWwtY29tcG9zZTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xv cjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1v bmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41 aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNl Y3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNv IDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAv Pg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxh eW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwv bzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVO LVVTIiBsaW5rPSIjMDU2M0MxIiB2bGluaz0iIzk1NEY3MiI+DQo8ZGl2IGNsYXNzPSJXb3JkU2Vj dGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQiPlRoYW5rcyBOYW5jeS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQiPk5vdGUgdGhhdCBFQVQgYWxyZWFkeSBoYXMgYSBHSCByZXBvIC0NCjwvc3Bhbj48YSBocmVm PSJodHRwczovL2dpdGh1Yi5jb20vZWF0LWlldGYtd2cvZWF0Ij5odHRwczovL2dpdGh1Yi5jb20v ZWF0LWlldGYtd2cvZWF0PC9hPi4mbmJzcDsgQ2FuIHdlIHJlLXVzZSBpdD88bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+QWxzbyBub3RlIHRoYXQgdGhlIGN1cnJlbnQgdmVyc2lvbiBvZiBFQVQgaXMg aW4gS3JhbWRvd24uJm5ic3A7IEkgaGF2ZSBiZWVuIHVuYWJsZSB0byBmaW5kIGFueSB3YXkgdG8g ZG8gYW4gYXV0b21hdGVkIHByZXZpZXcgb2YgUFLigJlzIGZvciBLcmFtZG93bi4mbmJzcDsgJm5i c3A7Rm9yIHRoYXQgbWF0dGVyLCBJIGhhdmUgbm90IGZvdW5kIGFueSBhdXRvbWF0ZWQgcHJldmll dyB0b29scyBmb3IgWE1MMlJGQy4mbmJzcDsgQnV0IEkgaGF2ZSBub3QNCiBsb29rZWQgdGhhdCBo YXJkLCBzbyBtYXliZSBvdGhlcnMgaW4gdGhlIGdyb3VwIGNhbiBwcm92aWRlIGd1aWRhbmNlLiZu YnNwOyBVbmxlc3MgdGhpcyBjYW4gYmUgcmVzb2x2ZWQsIG15IHN1Z2dlc3Rpb24gaXMgdGhhdCBn cm91cCBwYXJ0aWNpcGFudHMgY3JlYXRlIGlzc3VlcyB3LnIudC4gRUFUIGFuZCB3ZSBoYXNoIG91 dCB0aGUgY2FuZGlkYXRlIHRleHQgb24gdGhlIGxpc3QuJm5ic3A7IFdoZW4gYSBjb25zZW5zdXMg aXMgYXJyaXZlZCBhdCwgdGhlbiB0aGUgZWRpdG9ycw0KIGNhbiBjcmVhdGUgdGhlIGFzc29jaWF0 ZWQgUFIgYW5kIGNsb3NlIG91dCB0aGUgaXNzdWUuJm5ic3A7IFRoaXMgaG93ZXZlciBwdXRzIHRo ZSBvbnVzIG9uIHRoZSBlZGl0b3JzIHRvIGVuc3VyZSB0aGF0IHRoZSBQUiB3aWxsIHNlYW1sZXNz bHkgZmxvdyB0aHJvdWdoIHRvIGNyZWF0aW9uIG9mIHZhbGlkIHR4dC9YTUwvUERG4oCZcyBmb3Ig dXBsb2FkLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4tR2lyaTxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3Jk ZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+RnJv bTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij4gUkFUUyAmbHQ7cmF0 cy1ib3VuY2VzQGlldGYub3JnJmd0Ow0KPGI+T24gQmVoYWxmIE9mIDwvYj5OYW5jeSBDYW0tV2lu Z2V0IChuY2Ftd2luZyk8YnI+DQo8Yj5TZW50OjwvYj4gU2F0dXJkYXksIEp1bmUgMjksIDIwMTkg NToyNCBBTTxicj4NCjxiPlRvOjwvYj4gcmF0c0BpZXRmLm9yZzxicj4NCjxiPlN1YmplY3Q6PC9i PiBbUmF0c10gTGl2ZTogaHR0cHM6Ly9naXRodWIuY29tL2lldGYtcmF0cy13ZzxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjxwPjxzdHJvbmc+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo4LjVwdDtm b250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2JhY2tncm91bmQ6I0ZGRUI5 QyI+Q0FVVElPTjwvc3Bhbj48L3N0cm9uZz48c3BhbiBzdHlsZT0iZm9udC1zaXplOjguNXB0O2Zv bnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7YmFja2dyb3VuZDojRkZFQjlD Ij46IFRoaXMgZW1haWwgb3JpZ2luYXRlZCBmcm9tIG91dHNpZGUgb2YgdGhlIG9yZ2FuaXphdGlv bi48L3NwYW4+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdCI+UkFUcyBwYXJ0aWNpcGFudHMsPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5UaGUgR2l0SHViIDwvc3Bhbj48YSBocmVmPSJodHRw czovL2dpdGh1Yi5jb20vaWV0Zi1yYXRzLXdnIj5odHRwczovL2dpdGh1Yi5jb20vaWV0Zi1yYXRz LXdnPC9hPiBpcyBub3cgdXAgYW5kIGxpdmUsIEnigJl2ZSB1cGxvYWRlZCB0aGUgVmlydHVhbCBt ZWV0aW5nIG1pbnV0ZXMgYW5kIHNsaWRlcyB0aGVyZSBhcyB3ZWxsIGFzIGluDQo8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxhIGhyZWY9Imh0dHBzOi8vZGF0YXRyYWNrZXIu aWV0Zi5vcmcvd2cvcmF0cy9tZWV0aW5ncy8iPmh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcv d2cvcmF0cy9tZWV0aW5ncy88L2E+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPldlIG5lZWQgdG8g Z2V0IHRoZSBFQVQgZHJhZnQgaW4gR2l0SHViIHNvIHdlIGNhbiBzdGFydCBlbnRlcmluZyBpc3N1 ZXMsIGJ1dCBuZWVkIHRoZSBBdXRob3LigJlzIEdpdEh1YiBhY2NvdW50cyB0byBpbmNsdWRlIHRo ZW0gYXMgbWVtYmVycyBzbyB0aGV5IGNhbiB1cGxvYWQgdGhlIGRyYWZ0cy4mbmJzcDsgVGhlcmUg YXJlIGdvb2QgaW5zdHJ1Y3Rpb25zIGFuZCB0b29scyBpbg0KPGEgaHJlZj0iaHR0cHM6Ly9naXRo dWIuY29tL21hcnRpbnRob21zb24vaS1kLXRlbXBsYXRlIj5odHRwczovL2dpdGh1Yi5jb20vbWFy dGludGhvbXNvbi9pLWQtdGVtcGxhdGU8L2E+PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5Gb3IgZHJhZnQgc3VibWlzc2lvbnMgdG9vLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5CZXN0LCBOYW5jeTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_ccc07ed4a16a4699930fafecbfa9767aNASANEXM01Cnaqualcommco_-- From nobody Sat Jun 29 10:37:24 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 17C971200F8 for ; Sat, 29 Jun 2019 10:37:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8vyTzieKKjAl for ; Sat, 29 Jun 2019 10:37:20 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BEDBE1200E9 for ; Sat, 29 Jun 2019 10:37:20 -0700 (PDT) Received: from sandelman.ca (unknown [IPv6:2607:f0b0:f:2:56b2:3ff:fe0b:d84]) by tuna.sandelman.ca (Postfix) with ESMTP id 6423C3818C; Sat, 29 Jun 2019 13:35:31 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 5312FBD3; Sat, 29 Jun 2019 13:37:19 -0400 (EDT) From: Michael Richardson To: Giridhar Mandyam cc: "rats\@ietf.org" In-Reply-To: References: X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Rats] Live: https://github.com/ietf-rats-wg X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 29 Jun 2019 17:37:23 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Giridhar Mandyam wrote: > Thanks Nancy. > Note that EAT already has a GH repo - > https://github.com/eat-ietf-wg/eat. Can we re-use it? yes, just got to the bottom of the Settings and Transfer ownership. > Also note that the current version of EAT is in Kramdown. I have been > unable to find any way to do an automated preview of PR=E2=80=99s for= Kramdown. What do you mean? The pull request is going to be in the source format, it won't get formatted for you. =2D- Michael Richardson , Sandelman Software Works -=3D IPv6 IoT consulting =3D- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl0Xoc8ACgkQgItw+93Q 3WV6fAf8CBtxvs5gfMgZciyJBLzh4zMMFxEChzSDqHf3HQ+FJC/TenRdveVlK6gg MjApXTHiWPo+9XI0CJvnccHQm9GpLs6MCQ989RErM08izfO14XSDVPufE8vLzQPG 3aeBK2cem0WCRX9TTyP2et3wbtrC8qbcaHZmJEpbk7FcHQS1I8Ees/9Mmu6aLgpI g1f6FpP5jt4BxmeZ0XaMoe/LiIxItgDmcntAfwQosPn/Vu0JTWYsJPNQQ0xFR5F6 fCuyL9VHgrEiELIQffqcEw0e9c9tmMfzSJyMqKpU4TMZabhixmUp61LHAQ4hdm/C y0zHQcqHeZdtxe6RVFRWpXQFVDYjTA== =XW1h -----END PGP SIGNATURE----- --=-=-=-- From nobody Sat Jun 29 11:14:11 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 07D9A120113 for ; Sat, 29 Jun 2019 11:14:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s0qtBy4y5Qkm for ; Sat, 29 Jun 2019 11:14:08 -0700 (PDT) Received: from mx0a-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [IPv6:2620:100:9001:583::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5C3B1120100 for ; Sat, 29 Jun 2019 11:14:08 -0700 (PDT) Received: from pps.filterd (m0050093.ppops.net [127.0.0.1]) by m0050093.ppops.net-00190b01. (8.16.0.27/8.16.0.27) with SMTP id x5TIE60H000400; Sat, 29 Jun 2019 19:14:06 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=jan2016.eng; bh=TvhrZs1uoLCHa/clnz1iNAAR7loGoiE5IGib4DUgvm4=; b=WEiia7MKuO1RUQXVfKKPCvtyPcU4DeeZ2N6HEgn+Lh5xvmzmhYrJZncDcrUZWEQKxqlF tfTdHq3WwPX40Ptf6dYGzdw1RpV9Jr8b2yQP0w7U5rEpcK7gbWUdM0v+OosyZQOmvhQi d9iH/dY3yqNv6euJX36mCWtatZlf2JrIjFWZKA9nRRXnTJrubQkxicW6e6MG7lMkHJK7 N6ajwH5mWPIKtB9YySc+yQ8iDBM/ycrg1EHjMJ5wP50P0nz4UR7yZJlY1/6Fn15tH3eX ruDDkIl9UYe00uApFuPwGoEk6jwQLWQZtxZnoGIaJfoqZ8q/FBmAxTogZ18G9umJf6/z jA== Received: from prod-mail-ppoint2 (prod-mail-ppoint2.akamai.com [184.51.33.19] (may be forged)) by m0050093.ppops.net-00190b01. with ESMTP id 2tdy8na484-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 29 Jun 2019 19:14:06 +0100 Received: from pps.filterd (prod-mail-ppoint2.akamai.com [127.0.0.1]) by prod-mail-ppoint2.akamai.com (8.16.0.27/8.16.0.27) with SMTP id x5TI2C5A017658; Sat, 29 Jun 2019 14:14:05 -0400 Received: from email.msg.corp.akamai.com ([172.27.123.32]) by prod-mail-ppoint2.akamai.com with ESMTP id 2te3avkpqu-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Sat, 29 Jun 2019 14:14:05 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com (172.27.123.101) by usma1ex-dag1mb3.msg.corp.akamai.com (172.27.123.103) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Sat, 29 Jun 2019 14:14:04 -0400 Received: from USMA1EX-DAG1MB1.msg.corp.akamai.com ([172.27.123.101]) by usma1ex-dag1mb1.msg.corp.akamai.com ([172.27.123.101]) with mapi id 15.00.1473.004; Sat, 29 Jun 2019 14:14:04 -0400 From: "Salz, Rich" To: Michael Richardson , Giridhar Mandyam CC: "rats@ietf.org" Thread-Topic: [Rats] Live: https://github.com/ietf-rats-wg Thread-Index: AQHVLffOnmX96TcQTU2Z1Z3Rzde+4qayB9QggAEh5ID//8c1gA== Date: Sat, 29 Jun 2019 18:14:03 +0000 Message-ID: References: <8996.1561829839@localhost> In-Reply-To: <8996.1561829839@localhost> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1a.0.190609 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.32.206] Content-Type: text/plain; charset="utf-8" Content-ID: <77DC9D6B80EBA140894211C6F4CC0B04@akamai.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-06-29_12:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=888 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1906290224 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-06-29_13:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=929 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1906290227 Archived-At: Subject: Re: [Rats] Live: https://github.com/ietf-rats-wg X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 29 Jun 2019 18:14:10 -0000 PiAgICBUaGUgcHVsbCByZXF1ZXN0IGlzIGdvaW5nIHRvIGJlIGluIHRoZSBzb3VyY2UgZm9ybWF0 LCBpdCB3b24ndCBnZXQgZm9ybWF0dGVkDQogICAgZm9yIHlvdS4NCiAgDQoNClRoYXQgY2FuIGJl IGZpeGVkIGJ5IHNldHRpbmcgdXAgY29udGludW91cyBpbnRlZ3JhdGlvbiAoQ0kpIGJ1aWxkcyB3 aGljaCByZXN1bHQgaW4gZm9ybWF0dGluZyBkb25lIGZvciBldmVyeSBQUiBhcyBJIHJlY2FsbC4g IFVzaW5nIE1hcnRpbidzIHRvb2xpbmcgYWxzbyBoZWxwcyBmb3IgUFIgZm9sa3MgdG8gdmlldyB0 aGUgY29udGVudCBpbiB0aGVpciBidWlsZCBlbnZpcm9ubWVudCBiZWZvcmUgcHVzaGluZyBhIFBS IG9yIGFuIHVwZGF0ZS4NCmh0dHBzOi8vZ2l0aHViLmNvbS9tYXJ0aW50aG9tc29uL2ktZC10ZW1w bGF0ZSBmb3IgTWFydGluJ3Mgc3R1ZmYsIG5vdyBwYXJ0IG9mIHRoZSBJRVRGIGFuZCBHaXRIdWIg d29ya2luZyBncm91cCwgd2hpY2ggaGFzIHNvbWUgdXNlZnVsIGNvbnRlbnQgYW5kIHBvaW50ZXJz IGF0IGh0dHBzOi8vZ2l0aHViLmNvbS9pZXRmLWdpdHdnL3dnLW1hdGVyaWFscy9ibG9iL21hc3Rl ci9UT09MSU5HLm1kDQoNCg0K