From nobody Thu Aug 1 12:31:24 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 73DBF1201B4 for ; Thu, 1 Aug 2019 12:31:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cXiY1feSytG6 for ; Thu, 1 Aug 2019 12:31:21 -0700 (PDT) Received: from mga18.intel.com (mga18.intel.com [134.134.136.126]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1FF721201ED for ; Thu, 1 Aug 2019 12:31:20 -0700 (PDT) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga001.jf.intel.com ([10.7.209.18]) by orsmga106.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 01 Aug 2019 12:31:19 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.64,335,1559545200"; d="scan'208";a="256749671" Received: from orsmsx103.amr.corp.intel.com ([10.22.225.130]) by orsmga001.jf.intel.com with ESMTP; 01 Aug 2019 12:31:19 -0700 Received: from orsmsx162.amr.corp.intel.com (10.22.240.85) by ORSMSX103.amr.corp.intel.com (10.22.225.130) with Microsoft SMTP Server (TLS) id 14.3.439.0; Thu, 1 Aug 2019 12:31:19 -0700 Received: from orsmsx109.amr.corp.intel.com ([169.254.11.25]) by ORSMSX162.amr.corp.intel.com ([169.254.3.137]) with mapi id 14.03.0439.000; Thu, 1 Aug 2019 12:31:19 -0700 From: "Smith, Ned" To: Henk Birkholz , "rats@ietf.org" Thread-Topic: [Rats] Some info model comments Thread-Index: AQHVQ0ALRD933wS9FkeuOeeo3dxIVabc7xwAgACIFgCAAAJrAIAGRjMAgAL5EIA= Date: Thu, 1 Aug 2019 19:31:18 +0000 Message-ID: References: <996741CC-C71D-4C3F-829E-BD8B1D08980A@island-resort.com> <9E1496F2-42E9-48B2-8BEC-DEEC996362FF@redhoundsoftware.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1b.0.190715 x-originating-ip: [10.24.10.219] Content-Type: text/plain; charset="utf-8" Content-ID: <986FD4C7E31ED941BD4175FB581431C0@intel.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [Rats] Some info model comments X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Aug 2019 19:31:23 -0000 SXQgYXBwZWFycyB0aGUgVFBNLCBUVURBIHVzZSBjYXNlIGV4YW1wbGVzIGJlbG93IGNvdWxkIGJl IGNhdGVnb3JpemVkIGFzIGVpdGhlciAoSVYpLCAoVikgb3IgKFZJKT8gDQoNCkZyb20gYSBkaWZm ZXJlbnQgdGhyZWFkOg0KSW4gc3VtbWFyeSwgaXQgc2VlbXMgcmVhc29uYWJsZSBmb3IgYW4gSU0g dGhhdCBjYW4gdGFsayBhYm91dDoNCmkpICAgICAgICAgICAgICAgICAgICBpbmRpdmlkdWFsIGNs YWltcyBhcyB1bnNpZ25lZCBleHByZXNzaW9ucyB3aGVyZSB0aGUgc2VtYW50aWNzIGFyZSBjbGVh cg0KaWkpICAgICAgICAgICAgICAgICAgIGdyb3VwaW5ncyBvZiB1bnNpZ25lZCBjbGFpbXMNCmlp aSkgICAgICAgICAgICAgICAgIHNpZ25lZCBjbGFpbXMNCml2KSAgICAgICAgICAgICAgICAgZ3Jv dXBpbmdzIG9mIHNpZ25lZCBjbGFpbXMgdGhhdCBhcmUgdW5zaWduZWQNCnYpICAgICAgICAgICAg ICAgICAgIGdyb3VwaW5ncyBvZiBzaWduZWQgY2xhaW1zIHRoYXQgYXJlIHNpZ25lZCAobWF5YmUg ZXhwYW5kIHRvIGdyb3VwaW5nIG9mIGJvdGggc2lnbmVkIGFuZCB1bnNpZ25lZCBjbGFpbXM/KQ0K dmkpICAgICAgICAgICAgICAgICBncm91cGluZ3Mgb2Ygc2lnbmVkIGNsYWltcyB0aGF0IGFyZSBm b3JtYXR0ZWQgZGlmZmVyZW50bHkgZnJvbSBhIHBhcmVudCBvciBjaGlsZCBncm91cGluZyBvZiBz aWduZWQgY2xhaW1zDQoNCu+7v09uIDcvMzAvMTksIDg6MDcgQU0sICJSQVRTIG9uIGJlaGFsZiBv ZiBIZW5rIEJpcmtob2x6IiA8cmF0cy1ib3VuY2VzQGlldGYub3JnIG9uIGJlaGFsZiBvZiBoZW5r LmJpcmtob2x6QHNpdC5mcmF1bmhvZmVyLmRlPiB3cm90ZToNCg0KICAgIEl0IHdvdWxkIGJlIHBv c3NpYmxlIHRvIHRha2UgYSBUUE0gc3RydWN0dXJlICh0aGF0IGlzIHRoZSBvdXRwdXQgb2YgYSAN CiAgICBUUE0gY29tbWFuZCBhbmQgdHlwaWNhbGx5IGluY2x1ZGVzIGEgc2lnbmF0dXJlKSBhbmQg cHV0IGl0IGludG8gYW4gRUFUIA0KICAgIGNsYWltIHZhbHVlLg0KICAgIA0KICAgIElmIHRoZXJl IGlzIGEgdXNlIGNhc2Ugd2hlcmUgYSBidW5kbGUgb2YgVFBNIHN0cnVjdHVyZXMgb3RoZXIgY2xh aW1zIGFyZSANCiAgICBjb252ZXllZCwgc2lnbmluZyB0aGUgRUFUIGNvdWxkIG1ha2Ugc2Vuc2Ug aW4gc2FtZSBjYXNlcywgSSB0aGluaywgDQogICAgYmVjYXVzZSBpdCBtaWdodCBhZGQgc29tZSAo aW4gdGhpcyBjYXNlIHN0aWxsIGh5cG90aGV0aWNhbCkgdmFsdWUuDQogICAgDQogICAgSWYgcmVt b3RlIGF0dGVzdGF0aW9uIGlzIGJhc2VkIHNvbGVseSBvbiBhbHJlYWR5IHNpZ25lZCBUUE0gc3Ry dWN0dXJlcywgDQogICAgbWF5YmUgYnVuZGxpbmcgdGhlbSBpbiBhbiBFQVQgc3RpbGwgY291bGQg YmUgdXNlZnVsLCBidXQgc2lnbmluZyB0aGF0IA0KICAgIGJ1bmRsZSB3b3VsZCBub3QgYWRkIHZh bHVlLCBJIHRoaW5rLiBBbmFsb2dvdXNseSwgSSBhbSBub3QgY29udmluY2VkIA0KICAgIHRoYXQg bnVsbCBjaXBoZXJzLCBldGMuIGFyZSB0aGUgYmVzdHMgYXBwcm9hY2ggaGVyZSAtIGFuZCBDV1Qg bmVlZCB0byANCiAgICB1c2UgQ09TRS4NCiAgICANCiAgICBUaGF0IGlzIHdoeSBUVURBIGlzIHdv cmtpbmcgdGhlIG90aGVyIHdheSBhcm91bmQuDQogICAgDQogICAgSWYgYSBUUE0gaXMgdXNlZCBp biBUVURBLCB0aGUgbmF0aXZlIHN0cnVjdHVyZSBpcyBkZWNvbXBvc2VkIGRvd24gdG8gaXRzIA0K ICAgIHZhbHVlcyBvbiB0aGUgc2VuZGVyIHNpZGUsIHB1dCBpbnRvIGEgdmVyeSBjb25jaXNlIENC T1Igc3RydWN0dXJlIHRoYXQgDQogICAgaXMgZmFyIHNtYWxsZXIgdGhhbiB0aGUgbmF0aXZlIHN0 cnVjdHVyZSwgaXMgdGhlbiBjb252ZXllZCwgYW5kIHRoZW4gDQogICAgY2Fub25pY2FsbHkgcmVj b25zdHJ1Y3RlZCBhcyBhIHZhbGlkIHNpZ25lZCBUUE0gc3RydWN0dXJlIG9uIHRoZSANCiAgICBy ZWNlaXZlciBzaWRlLg0KICAgIA0KICAgIEFkZGl0aW9uYWxseSwgYW55IHZhbHVlcyB0aGF0IGNh biBiZSBvbWl0dGVkIGJlY2F1c2UgdGhlIHJlY2VpdmVyIHdvdWxkIA0KICAgIGFscmVhZHkga25v dyB0aGVzZSB2YWx1ZXMgb3IgY291bGQgZGV0ZXJtaW5pc3RpY2FsbHkgaW5mZXIgdGhlbSBpbiBh IA0KICAgIFRVREEgcHJvY2VkdXJlIGFyZSBvbWl0dGVkIGluIHRoZSBjb252ZXllZCBDQk9SIHN0 cnVjdHVyZSAtIG1ha2luZyBpdCANCiAgICBldmVuIG1vcmUgY29tcGFjdC9jb21wcmVzc2VkLg0K ICAgIA0KICAgIFRoYXQgaXMgdGhlIHJlYXNvbiB3aHkgVFVEQSBpcyBub3QgdXNpbmcgRUFULCBp ZiBhIFRQTSBpcyBpbnZvbHZlZC4gSWYgYSANCiAgICBUQSBpbiBhIFRFRSB3b3VsZCBwcm92aWRl IHRoZSByZXNwZWN0aXZlIHJvb3Qtb2YtdHJ1c3Qgc2VydmljZXMsIEVBVCANCiAgICBjb3VsZCBi ZSB1c2VkIGluIHRoYXQgVFVEQSBmbGF2b3IgLSBhbmQgYWN0dWFsbHkgd291bGQgYmUgbXkgZmly c3QgYW5kIA0KICAgIG1vc3Qgb2J2aW91cyBjaG9pY2UgOikNCiAgICANCiAgICBWaWVsZSBHcsO8 w59lLA0KICAgIA0KICAgIEhlbmsNCiAgICANCiAgICANCiAgICANCiAgICBPbiA3LzI2LzE5IDU6 MTggUE0sIENhcmwgV2FsbGFjZSB3cm90ZToNCiAgICA+IFNlZW1zIHlvdSBjb3VsZCBkZWZpbmUg YSBjbGFpbSBjYXJyaWVkIGluIGFuIEVBVCB0aGF0IGVuY2Fwc3VsYXRlZCANCiAgICA+IGV4aXN0 aW5nIGF0dGVzdGF0aW9uIHR5cGVzLg0KICAgID4gDQogICAgPiBPbiBKdWwgMjYsIDIwMTksIGF0 IDg6MDkgQU0sIExhdXJlbmNlIEx1bmRibGFkZSA8bGdsQGlzbGFuZC1yZXNvcnQuY29tIA0KICAg ID4gPG1haWx0bzpsZ2xAaXNsYW5kLXJlc29ydC5jb20+PiB3cm90ZToNCiAgICA+IA0KICAgID4+ IEhpIElhbiwNCiAgICA+Pg0KICAgID4+IE15IFRQTSBrbm93bGVkZ2UgaXMgbGltaXRlZCwgYnV0 IEkgdGhpbmsgaXQgZ29lcyBsaWtlIHRoaXM6DQogICAgPj4gKlBheWxvYWQgLyBjbGFpbXM6KiBF QVQgYW5kIFRQTSBhcmUgdmVyeSBkaWZmZXJlbnQgYW5kIGluY29tcGF0aWJsZQ0KICAgID4+ICpT aWduaW5nIGZvcm1hdDoqIEVBVCBhbmQgVFBNIGFyZSB2ZXJ5IGRpZmZlcmVudCBhbmQgaW5jb21w YXRpYmxlDQogICAgPj4gKlByb3Bvc2VkIGFzIHBhcnQgb2YgcmVtb3RlIGF0dGVzdGF0aW9uIHN0 YW5kYXJkIGluIFJBVFMgV29yayBHcm91cDoqIA0KICAgID4+IGlkZW50aWNhbA0KICAgID4+ICpU cmFuc3BvcnRhYmxlIGJ5IFlBTkctZGVzY3JpYmVkIHByb3RvY29scyBsaWtlIE5ldENvbmYgYW5k IENPQVA6IA0KICAgID4+ICpuZWFyIGlkZW50aWNhbA0KICAgID4+ICpUcmFuc3BvcnRhYmxlIGlu IGV4dGVuc2lvbnMgb2YgcHJvdG9jb2xzIGxpa2UgRklETzogKm5lYXIgaWRlbnRpY2FsDQogICAg Pj4NCiAgICA+PiBJIGRvbuKAmXQgdGhpbmsgdGhlcmXigJlzIGFueSB1c2VmdWwgd2F5IHRvIGFj aGlldmUgbXVjaCBtb3JlIA0KICAgID4+IGNvbXBhdGliaWxpdHkgd2l0aCB0aGUgZmlyc3QgdHdv IHBvaW50cywgc28gSeKAmW0gbm90IHN1cmUgd2hhdCANCiAgICA+PiDigJxzdWJ0eXBl4oCdIHdv dWxkIG1lYW4gaWYgeW91IGFyZSB0YWxraW5nIGFib3V0IGRhdGEgc3RydWN0dXJlcyBpbiBzb21l IA0KICAgID4+IGZvcm1hbCBvciBzZW1pLWZvcm1hbCB3YXkuDQogICAgPj4NCiAgICA+PiBNYXli ZSB5b3UgYXJlIHN1Z2dlc3RpbmcgdGhhdCBhbGwgdGhlIGF0dGVzdGF0aW9uIHRva2VucyBzdGFu ZGFyZGl6ZWQgDQogICAgPj4gYnkgUkFUUyBzaG91bGQgYmUgbmFtZWQgYW4gRUFUPw0KICAgID4+ DQogICAgPj4gTEwNCiAgICA+Pg0KICAgID4+DQogICAgPj4NCiAgICA+Pj4gT24gSnVsIDI2LCAy MDE5LCBhdCAzOjAyIEFNLCBPbGl2ZXIsIElhbiAoTm9raWEgLSBGSS9Fc3BvbykgDQogICAgPj4+ IDxpYW4ub2xpdmVyQG5va2lhLWJlbGwtbGFicy5jb20gDQogICAgPj4+IDxtYWlsdG86aWFuLm9s aXZlckBub2tpYS1iZWxsLWxhYnMuY29tPj4gd3JvdGU6DQogICAgPj4+DQogICAgPj4+IEkgc3Vw cG9ydCB0aGlzIHByb3Bvc2FsLiBJIHRvbyBhbSBhIGxpdHRsZSBjb25mdXNlZCB0aGF0IFRQTSAN CiAgICA+Pj4gYXR0ZXN0YXRpb24gc3RydWN0dXJlcyBhcmUgdHJlYXRlZCBkaWZmZXJlbnRseSBm cm9tIHRoZSBwcm9wb3NlZCANCiAgICA+Pj4gRUFULXR5bGUuDQogICAgPj4+DQogICAgPj4+IElu IG91ciB0aGlua2luZywgdGhlIFRQTS1jb25zdHJhaW50ZWQgYXR0ZXN0YXRpb24gKFRQTTJfQVRU RVNULCBha2EuIA0KICAgID4+PiBUUE0yIHF1b3RlKSBpcyBhIHN1YnR5cGUgb2YgYSBtb3JlIGdl bmVyaWMgRUFUIHN0cnVjdHVyZS4NCiAgICA+Pj4NCiAgICA+Pj4gQXQgbGVhc3QgdGhpcyBpcyBo b3cgd2Ugc2VlIGl0DQogICAgPj4+DQogICAgPj4+IElhbg0KICAgID4+Pg0KICAgID4+PiAtLQ0K ICAgID4+PiBEci4gSWFuIE9saXZlcg0KICAgID4+PiBDeWJlcnNlY3VyaXR5IFJlc2VhcmNoDQog ICAgPj4+IERpc3Rpbmd1aXNoZWQgTWVtYmVyIG9mIFRlY2huaWNhbCBTdGFmZg0KICAgID4+PiBO b2tpYSBCZWxsIExhYnMNCiAgICA+Pj4gKzM1OCA1MCA0ODMgNjIzNw0KICAgID4+Pg0KICAgID4+ PiAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0NCiAgICA+Pj4gKkZyb206KkxhdXJlbmNlIEx1bmRibGFkZSA8bGds QGlzbGFuZC1yZXNvcnQuY29tIA0KICAgID4+PiA8bWFpbHRvOmxnbEBpc2xhbmQtcmVzb3J0LmNv bT4+DQogICAgPj4+ICpTZW50OioyNiBKdWx5IDIwMTkgMDI6MjMNCiAgICA+Pj4gKlRvOipyYXRz QGlldGYub3JnIDxtYWlsdG86cmF0c0BpZXRmLm9yZz4gPHJhdHNAaWV0Zi5vcmcgDQogICAgPj4+ IDxtYWlsdG86cmF0c0BpZXRmLm9yZz4+DQogICAgPj4+ICpTdWJqZWN0OipbUmF0c10gU29tZSBp bmZvIG1vZGVsIGNvbW1lbnRzDQogICAgPj4+IEhlcmXigJlzIGEgY2hhcmFjdGVyaXphdGlvbiBv ZiBSQVRTIHdvcmsuIFRoZSBub24tYmx1ZSBib3hlcyBhcmUgd2hlcmUgDQogICAgPj4+IEkgYmVs aWV2ZSBSQVRTIHdvcmsgaXMuDQogICAgPj4+DQogICAgPj4+IDxQYXN0ZWRHcmFwaGljLTYucG5n Pg0KICAgID4+Pg0KICAgID4+PiBUaGUgcHJvcG9zZWQgaW5mb3JtYXRpb24gbW9kZWwgZHJhZnQg ZG9lcyB0d28gdGhpbmdzIHRoYXQgSSB0aGluayBhcmUgDQogICAgPj4+IHByb2JsZW0uDQogICAg Pj4+DQogICAgPj4+ICAgICBGaXJzdCwgaXQgdHJpZXMgdG8gc3BhbiB0aGUgb3JhbmdlIGFuZCB5 ZWxsb3cgYm94ZXMuIFRoZXNlIGJveGVzDQogICAgPj4+ICAgICBhcmUgc3VwZXIgZGlmZmVyZW50 LiBJIGRvbuKAmXQgdGhpbmsgdGhleSBzaG91bGQgYmUgbWl4ZWQgaW4gb25lDQogICAgPj4+ICAg ICBtb2RlbC4gVGhlIHllbGxvdyBib3hlcyBhcmUgZ2VuZXJhbCBjbGFpbXMgYWJvdXQgdGhlIGVu dGl0aWVzLg0KICAgID4+PiAgICAgVGhlIG9yYW5nZSBib3ggaXMgaW5wdXRzIGFuZCBvdXRwdXRz IHJlbGF0ZWQgdG8gVFBNcy4gRm9yDQogICAgPj4+ICAgICBleGFtcGxlLCBpbnN0cnVjdGlvbnMg dG8gVFBNcyB0byBkbyBvbmUgdHlwZSBvZiBhdHRlc3RhdGlvbiBvcg0KICAgID4+PiAgICAgYW5v dGhlciB0eXBlLg0KICAgID4+Pg0KICAgID4+PiAgICAgU2Vjb25kLCBpdCBjdXQgdGhlIGRlZmlu aXRpb24gb2YgYSBjbGFpbSBpbiB0d28uIFBhcnQgb2YgaXQgd291bGQNCiAgICA+Pj4gICAgIGdv IGluIHRoZSBpbmZvcm1hdGlvbiBtb2RlbCBhbmQgYW5vdGhlciBwYXJ0IG9mIGl0IHdvdWxkIGdv IGluDQogICAgPj4+ICAgICB0aGUgRUFUIGRyYWZ0IG9yIHN1Y2guIFdoZW4geW91IHR3ZWFrIHRo ZSBkZWZpbml0aW9uIG9mIGEgY2xhaW0sDQogICAgPj4+ICAgICBzYXkgdGhlIGxvY2F0aW9uIGNs YWltLCB5b3UgbWlnaHQgaGF2ZSB0byB1cGRhdGUgb25lIGRvY3VtZW50LA0KICAgID4+PiAgICAg dGhlIG90aGVyLCBvciBib3RoLg0KICAgID4+Pg0KICAgID4+PiBJIGNhbiB0aGluayBvZiB3YXlz IHRvIG1ha2UgdXNlIG9mIGluZm8vZGF0YSBtb2RlbHMgaW4gcHJvZHVjdGl2ZSANCiAgICA+Pj4g d2F5cyBmb3IgUkFUcywgYnV0IHRoZXkgd291bGQgYmUgZGlmZmVyZW50IHRoYW4gdGhlIHByb3Bv c2FsLiANCiAgICA+Pj4gU29tZXRoaW5nIGxpa2UgdGhpczoNCiAgICA+Pj4NCiAgICA+Pj4gICAg IFRoZXJlIHdvdWxkIGJlIG9uZSBpbmZvIG1vZGVsIGZvciBjbGFpbXMgYW5kIGFub3RoZXIgZm9y DQogICAgPj4+ICAgICB0cmFuc3BvcnQuIE1heWJlIGEgbGl0dGxlIGZ1ZGdpbmcgZm9yIHRoZSBu b25jZSwgYnV0IGl0IGlzIHNpbXBsZQ0KICAgID4+PiAgICAgYW5kIHdlbGwgdW5kZXJzdG9vZC4N CiAgICA+Pj4NCiAgICA+Pj4gICAgIFRoZSBkZWZpbml0aW9uIG9mIGEgcGFydGljdWxhciBjbGFp bSB3b3VsZCBiZSBpbiBvbmx5IG9uZQ0KICAgID4+PiAgICAgZG9jdW1lbnQuIEl04oCZcyBPSyBp ZiB0aGVyZSBhcmUgY29tbW9uIGRhdGEgdHlwZXMgdXNlcyBieSBjbGFpbXMNCiAgICA+Pj4gICAg IGFyZSBpbiBhIHNlcGFyYXRlIGRvY3VtZW50IChraW5kIG9mIGxpa2UgYSAuaCBmaWxlKS4gDQog ICAgPj4+DQogICAgPj4+DQogICAgPj4+DQogICAgPj4+IExMDQogICAgPj4NCiAgICA+PiBfX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KICAgID4+IFJBVFMg bWFpbGluZyBsaXN0DQogICAgPj4gUkFUU0BpZXRmLm9yZyA8bWFpbHRvOlJBVFNAaWV0Zi5vcmc+ DQogICAgPj4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9yYXRzDQogICAg PiANCiAgICA+IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f DQogICAgPiBSQVRTIG1haWxpbmcgbGlzdA0KICAgID4gUkFUU0BpZXRmLm9yZw0KICAgID4gaHR0 cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9yYXRzDQogICAgPiANCiAgICANCiAg ICBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KICAgIFJB VFMgbWFpbGluZyBsaXN0DQogICAgUkFUU0BpZXRmLm9yZw0KICAgIGh0dHBzOi8vd3d3LmlldGYu b3JnL21haWxtYW4vbGlzdGluZm8vcmF0cw0KICAgIA0KDQo= From nobody Fri Aug 2 09:35:06 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9D1AA120687 for ; Fri, 2 Aug 2019 09:35:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4KkjJCHnZ1Ef for ; Fri, 2 Aug 2019 09:35:02 -0700 (PDT) Received: from p3plsmtpa07-02.prod.phx3.secureserver.net (p3plsmtpa07-02.prod.phx3.secureserver.net [173.201.192.231]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8B1DF1201E8 for ; Fri, 2 Aug 2019 09:35:02 -0700 (PDT) Received: from [192.168.0.102] ([206.125.91.54]) by :SMTPAUTH: with ESMTPSA id taWDhpzp1ucxxtaWDhN5IM; Fri, 02 Aug 2019 09:35:02 -0700 From: Laurence Lundblade Content-Type: multipart/alternative; boundary="Apple-Mail=_88BAD4DD-FC9B-4C28-887C-271431FA9795" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Message-Id: Date: Fri, 2 Aug 2019 09:34:53 -0700 To: rats@ietf.org X-Mailer: Apple Mail (2.3445.9.1) X-CMAE-Envelope: MS4wfEwbYp5UUcIQJOwztoEo1Z8dA0IUpu5kAmvvpbRLgMvyfsQKLZR41kI5GPs4CqM7BR3SkBAnrR0yda/WvfW154TePGPaKyyb5Hht+rMXeckM5krO0Wb+ cDDFO8VdIjTEX/loaiM3qXAa20hzGwELKnKbGsyYTGXv2KWlGW3CS0ei Archived-At: Subject: [Rats] Info & Data Models X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Aug 2019 16:35:05 -0000 --Apple-Mail=_88BAD4DD-FC9B-4C28-887C-271431FA9795 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 =46rom WG meetings, side conversations and reading it seems to me that = =E2=80=9Cinformation model" is being used an a few ways by RATS folks: 1) One description common to several serialization formats Idea here is that one primary description exists for an information = element (e.g. each claim) and it is common to the serializations in = CBOR, JSON, ASN.1 and so on. This is the classic definition in RFC 3444 = and RFC 3198 and what was done in draft-ietf-rats-eat-01. 2) One info model for ALL of RATS Idea is that there is only one info model in one document that is common = for every draft output by the RATS WG. It would cover claims in tokens = as well as information elements in conveyance protocols. Elements marked = =E2=80=9CP=E2=80=9D in draft-birkholz-rats-information-model-00 are for = conveyance protocol information elements and those marked =E2=80=9CS=E2=80= =9D and =E2=80=9CH=E2=80=9D are claims. =20 3) That the payload claims/assertions need more sophisticated structure Idea here is for more nesting, sub categories and rich structure for = claims. Note that EAT already has both nesting and sub modules. I have = always thought they needed improvement, but they are still powerful as = they are. 4) That there be more typing and abstract data structures Idea here is we define some generic types like hashes, date stamps, ways = to list SW components in the abstract. Then different concrete claim = instantiations can use them. So can claims registered with IANA. I think 1) is essential because we clearly need multiple serialization = formats, at the minimum CBOR and JSON. I thought this was the main = reason our charter mentions info and data models. I think 2) is impractical because the span is too large. There will be = several RATS documents they will evolve at different rates and be = authored by different people for different purposes. For example, claims = will be in one document and conveyance protocols in another. We can=E2=80=99= t be changing the one common info model document every time an = information element in the claims or conveyance protocol document = changes.=20 I do however think we should try for one info model for the = claims/assertions/evidence. I always figured there would be a lot of work for 3) and 4), though it = didn=E2=80=99t occur to me that they were implied by the info and data = model separation (you can do 3 and 4 without info / data model = separation). At any rate, the means we use to express the info model = will be the same as we use for 3) and 4).=20 I=E2=80=99d like to do work on 3) and 4) in the context of the EAT draft = and CDDL now. I hope that we will end up with a claims info and data = model in CDDL like in the EAT draft and separate from the conveyance = protocol, but if we don=E2=80=99t this work on 3) and 4) will still be = good useful work. I think the work on 3) and 4) also lines up with the = questions Ned is raising about signed and not signed claims. LL --Apple-Mail=_88BAD4DD-FC9B-4C28-887C-271431FA9795 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
=46rom WG meetings, side conversations and = reading it seems to me that =E2=80=9Cinformation model" is being used an = a few ways by RATS folks:

1) One description common to several serialization = formats
Idea here is that one primary description = exists for an information element (e.g. each claim) and it is common to = the serializations in CBOR, JSON, ASN.1 and so on. This is the classic = definition in RFC 3444 and RFC 3198 and what was done in = draft-ietf-rats-eat-01.

2) One info model for ALL of RATS
Idea = is that there is only one info model in one document that is common for = every draft output by the RATS WG. It would cover claims in tokens as = well as information elements in conveyance protocols. Elements marked = =E2=80=9CP=E2=80=9D in draft-birkholz-rats-information-model-00 are for = conveyance protocol information elements and those marked =E2=80=9CS=E2=80= =9D and =E2=80=9CH=E2=80=9D are claims.
 
3) That the payload = claims/assertions need more sophisticated structure
Idea here is for more nesting, sub categories and rich = structure for claims.  Note that EAT already has both nesting and = sub modules. I have always thought they needed improvement, but they are = still powerful as they are.

4) That there be more typing and abstract data = structures
Idea here is we define some generic = types like hashes, date stamps, ways to list SW components in the = abstract. Then different concrete claim instantiations can use them. So = can claims registered with IANA.


I = think 1) is essential because we clearly need multiple serialization = formats, at the minimum CBOR and JSON. I thought this was the main = reason our charter mentions info and data models.
I think 2) is impractical because the = span is too large. There will be several RATS documents they will evolve = at different rates and be authored by different people for different = purposes. For example, claims will be in one document and conveyance = protocols in another. We can=E2=80=99t be changing the one common info = model document every time an information element in the claims or = conveyance protocol document changes. 

I do however think we should try for = one info model for the claims/assertions/evidence.

I always figured there = would be a lot of work for 3) and 4), though it didn=E2=80=99t occur to = me that they were implied by the info and data model separation (you can = do 3 and 4 without info / data model separation). At any rate, the means = we use to express the info model will be the same as we use for 3) and = 4). 


I=E2=80=99d like to do work on 3) and = 4) in the context of the EAT draft and CDDL now. I hope that we will end = up with a claims info and data model in CDDL like in the EAT draft and = separate from the conveyance protocol, but if we don=E2=80=99t this work = on 3) and 4) will still be good useful work. I think the work on 3) and = 4) also lines up with the questions Ned is raising about signed and not = signed claims.

LL


= --Apple-Mail=_88BAD4DD-FC9B-4C28-887C-271431FA9795-- From nobody Sun Aug 4 11:38:33 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 994EA120047 for ; Sun, 4 Aug 2019 11:38:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id F288FCdqrkvc for ; Sun, 4 Aug 2019 11:38:31 -0700 (PDT) Received: from p3plsmtpa06-08.prod.phx3.secureserver.net (p3plsmtpa06-08.prod.phx3.secureserver.net [173.201.192.109]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3A9E9120033 for ; Sun, 4 Aug 2019 11:38:31 -0700 (PDT) Received: from [10.21.13.244] ([207.242.54.130]) by :SMTPAUTH: with ESMTPSA id uLOohn51sbJ6yuLOohz7pO; Sun, 04 Aug 2019 11:38:30 -0700 From: Laurence Lundblade Content-Type: multipart/alternative; boundary="Apple-Mail=_78E53D40-2B9D-46AB-BC27-DD22A9901C6B" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Message-Id: <2DE09A2A-A6EA-4474-9DBE-8D52B523645B@island-resort.com> Date: Sun, 4 Aug 2019 11:37:38 -0700 To: rats@ietf.org X-Mailer: Apple Mail (2.3445.9.1) X-CMAE-Envelope: MS4wfGxAKVcL14Z8+jok0JX+1Gb6Q6prbt3POL7Hd1vosrrOymKyjv6jaAt0vc4is3klB3/yYNVTEzH7A2zOs3im7KVslHrOekiOmVNVg24ogRpK/FJ5XyWN fAG0u4JGHHrW7Qij0OZHmCI0v0VkQWsG861fLr1PKd/H8pDOqXV2WIeq Archived-At: Subject: [Rats] No root of trust requirement in RATS/EAT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 04 Aug 2019 18:38:32 -0000 --Apple-Mail=_78E53D40-2B9D-46AB-BC27-DD22A9901C6B Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 An Android phone often looks like this: - Linux / Android apps - Linux kernel - TA=E2=80=99s (Trusted Apps =E2=80=94 apps running the TEE) - TEE kernel It must be allowed for any one of these to generate RATS/EAT = attestations. It might be that only the Android app generates RATS/EAT = attestations. This phone is just one example. Other devices, like cars, = may be similar. If there is a normative or descriptive text saying a root of trust is = required to generate an attestation, then we have to redefine root of = trust to so that Android apps are roots of trust. This is very counter = to the normal definition of root of trust. By common definition the root = of trust of the above phone would be the TEE. Such a redefinition for = RATS would be very confusing. So I don=E2=80=99t think normative text = should require a root of trust. My second reason is that I don=E2=80=99t think the IETF should set = internal security requirements for the internal implementation of an = end-point: The TLS RFC does not require an HSM, even in its very extensive security = considerations COSE mentions keys should be protected, but only as a recommendation and = only in security considerations At the Writing Security Considerations tutorial in Montreal, Yoav Nir = said that IETF doesn=E2=80=99t get into end-point security internals so = much Some of my IETF friends tell me SHOULD and MUST are for interoperability = aspects of a protocol only I think it is fine to: Mention a root of trust as an example Have lots of text in security considerations about signing key = protection Require a root of trust in profile documents, particularly ones outside = the IETF Have claims that describe the internal security of an entity I know that large parts of the TCG and TEE worlds have the root of trust = as a fundamental part of their architectures. It makes sense there. = However, these groups fundamentally work on the security internals of = end points. The IETF does not. It focuses on on-the-wire security. Thus, = it makes sense that orientations around end-point internal security = implementation is different. Some of what goes in the TCG and TEE = worlds doesn=E2=80=99t carry over to the IETF. I know reorienting the RATS architecture draft to not hinge on roots of = trust is a big upheaval, but I think it is necessary. LL= --Apple-Mail=_78E53D40-2B9D-46AB-BC27-DD22A9901C6B Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 An = Android phone often looks like this:
  - Linux / = Android apps
  - Linux kernel
  - TA=E2=80=99s (Trusted Apps =E2=80=94 apps running = the TEE)
  - TEE kernel
It must be allowed for any one of = these to generate RATS/EAT attestations. It might be that only the = Android app generates RATS/EAT attestations. This phone is just one = example. Other devices, like cars, may be similar.

If there is a normative = or descriptive text saying a root of trust is required to generate an = attestation, then we have to redefine root of trust to so that Android = apps are roots of trust. This is very counter to the normal definition = of root of trust. By common definition the root of trust of the above = phone would be the TEE. Such a redefinition for RATS would be very = confusing. So I don=E2=80=99t think normative text should require a root = of trust.

My = second reason is that I don=E2=80=99t think the IETF should set internal = security requirements for the internal implementation of an = end-point:
  • The TLS RFC does not require an HSM, even in its very = extensive security considerations
  • COSE mentions keys = should be protected, but only as a recommendation and only in security = considerations
  • At the Writing Security Considerations = tutorial in Montreal, Yoav Nir said that IETF doesn=E2=80=99t get into = end-point security internals so much
  • Some of my IETF = friends tell me SHOULD and MUST are for interoperability aspects of a protocol = only

I = think it is fine to:
  • Mention a root of trust as an example
  • Have = lots of text in security considerations about signing key = protection
  • Require a root of trust in profile = documents, particularly ones outside the IETF
  • Have = claims that describe the internal security of an = entity

I know that large parts of the TCG and TEE worlds have the = root of trust as a fundamental part of their architectures. It makes = sense there. However, these groups fundamentally work on the security = internals of end points. The IETF does not. It focuses on on-the-wire = security. Thus, it makes sense that orientations around end-point = internal security implementation is different.  Some of what goes = in the TCG and TEE worlds doesn=E2=80=99t carry over to the = IETF.

I know = reorienting the RATS architecture draft to not hinge on roots of trust = is a big upheaval, but I think it is necessary.

LL
= --Apple-Mail=_78E53D40-2B9D-46AB-BC27-DD22A9901C6B-- From nobody Sun Aug 4 12:13:01 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AAD5F120116 for ; Sun, 4 Aug 2019 12:12:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id A_hcsvPKZapP for ; Sun, 4 Aug 2019 12:12:42 -0700 (PDT) Received: from mail-wr1-x433.google.com (mail-wr1-x433.google.com [IPv6:2a00:1450:4864:20::433]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6D21A120120 for ; Sun, 4 Aug 2019 12:12:42 -0700 (PDT) Received: by mail-wr1-x433.google.com with SMTP id p13so7665306wru.10 for ; Sun, 04 Aug 2019 12:12:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=MuE4IIrmW+03YTqOhLDfPU+MUHgI0mh5Dk6+QLGFBwg=; b=XzpEPPJhtPn5ABact5htfPDT5VgkYaRH5ofcmxAdRYC0m0/0EbEoe2NTOtYlQxmPhP TWqojyZfcZZemQH9QQYoNjbbgt6avn43ho3V7Rh5YxxdLTc/JrPsvCRjZz55aZ+6MH1S 6d8GR4+xoz8/l5VyBWLSdnLTgEXDOn2pSGyhIlhAWiD9lhgEaU9oK11hS7HJOiywZs/+ c8xriZeIo0zL9B/Ki5Cs/E7W3+0ftC6LyaUcI4XLZuw5dkylEIh9TZXc2hUwm3Cs1Lkz A/vEaIrWHogB+9a+fSsSB+BZpudmpYqIdcMtOJjgXi4RSQ/d6mktMl9NS1vXGZPcxKzZ uJ2Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=MuE4IIrmW+03YTqOhLDfPU+MUHgI0mh5Dk6+QLGFBwg=; b=Lgr3EOddVnQ0V1EgwZyJQsG+VF1MDgS3KizXO8YF628hfALFfWHICbcsw3bZmyasrI kgId/t3PUPq3e8UdH63/APLMVznkVje9T1QfzXc6e2Lph3VeZG59dVPUqvHjx9SKOA7C v0X+2h09zOXnuAlCZLvBFcT43kk7IMOxR3TZIBqr/szjftozg32eo2nE8oXINAS1XJks Bxp5QvP01atbWkQ+m5GTIQSqVIcXWDSW4tUXgkna9GHSMAvTcSBT9Mcd3bgPKeZN4pqv fduLr3IJz6aQ99Z0OccFk6Tb+Gv3r8hsuZM8qFmOkXERbn51DJ14OVVMH9N5hlLBrDU5 reTw== X-Gm-Message-State: APjAAAWkc86HqRMTm43BhVIFbEegioKllWCBqO3Wd9evM57NVFvi9KMG 3sjBxLuKiQ2PUJ0iReJ/FV8Yy19l X-Google-Smtp-Source: APXvYqwazCgfNBm48s4KPYmMJGhtgjJVEANzSoUzWgSD6qixqYpkqV210vpFBw4gI0l9nqxMuPdo4A== X-Received: by 2002:adf:d4c1:: with SMTP id w1mr87061312wrk.229.1564945960295; Sun, 04 Aug 2019 12:12:40 -0700 (PDT) Received: from [192.168.1.79] (25.131.146.77.rev.sfr.net. [77.146.131.25]) by smtp.googlemail.com with ESMTPSA id g19sm149495447wrb.52.2019.08.04.12.12.39 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 04 Aug 2019 12:12:39 -0700 (PDT) To: Laurence Lundblade , rats@ietf.org References: <2DE09A2A-A6EA-4474-9DBE-8D52B523645B@island-resort.com> From: Anders Rundgren Message-ID: <987fbfbb-b3f6-c104-878a-b283978ca0f0@gmail.com> Date: Sun, 4 Aug 2019 21:12:37 +0200 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <2DE09A2A-A6EA-4474-9DBE-8D52B523645B@island-resort.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Rats] No root of trust requirement in RATS/EAT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 04 Aug 2019 19:12:47 -0000 On 2019-08-04 20:37, Laurence Lundblade wrote: > An Android phone often looks like this: >   - Linux / Android apps >   - Linux kernel >   - TA’s (Trusted Apps — apps running the TEE) >   - TEE kernel > > It must be allowed for any one of these to generate RATS/EAT attestations. It might be that only the Android app generates RATS/EAT attestations. This phone is just one example. Other devices, like cars, may be similar. > > If there is a normative or descriptive text saying a root of trust is required to generate an attestation, then we have to redefine root of trust to so that > Android apps are roots of trust. Where does this trust come from and how is it delivered to the concerned party? Android apps are signed but they are not shipped with a private key. AFAICT it is only the Android OS who can vouch for an app's authenticity. Anders > This is very counter to the normal definition of root of trust. By common definition the root of trust of the above phone would be the TEE. Such a redefinition for RATS would be very confusing. So I don’t think normative text should require a root of trust. > > My second reason is that I don’t think the IETF should set internal security requirements for the internal implementation of an end-point: > > * The TLS RFC does not require an HSM, even in its very extensive security considerations > * COSE mentions keys should be protected, but only as a recommendation and only in security considerations > * At the Writing Security Considerations tutorial in Montreal, Yoav Nir said that IETF doesn’t get into end-point security internals so much > * Some of my IETF friends tell me SHOULD and MUST are for /interoperability/ aspects of a protocol only > > > I think it is fine to: > > * Mention a root of trust as an example > * Have lots of text in security considerations about signing key protection > * Require a root of trust in profile documents, particularly ones outside the IETF > * Have claims that describe the internal security of an entity > > > I know that large parts of the TCG and TEE worlds have the root of trust as a fundamental part of their architectures. It makes sense there. However, these groups fundamentally work on the security internals of end points. The IETF does not. It focuses on on-the-wire security. Thus, it makes sense that orientations around end-point internal security implementation is different.  Some of what goes in the TCG and TEE worlds doesn’t carry over to the IETF. > > I know reorienting the RATS architecture draft to not hinge on roots of trust is a big upheaval, but I think it is necessary. > > LL > > _______________________________________________ > RATS mailing list > RATS@ietf.org > https://www.ietf.org/mailman/listinfo/rats > From nobody Sun Aug 4 21:56:06 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6F565120146 for ; Sun, 4 Aug 2019 21:56:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cHkX6u_0L_1j for ; Sun, 4 Aug 2019 21:56:02 -0700 (PDT) Received: from p3plsmtpa11-01.prod.phx3.secureserver.net (p3plsmtpa11-01.prod.phx3.secureserver.net [68.178.252.102]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A54F3120134 for ; Sun, 4 Aug 2019 21:56:02 -0700 (PDT) Received: from [10.20.13.8] ([207.242.54.130]) by :SMTPAUTH: with ESMTPSA id uV2PhsZdNpMjLuV2PhHTjD; Sun, 04 Aug 2019 21:56:02 -0700 From: Laurence Lundblade Message-Id: <6F1E85F0-35CB-415A-9672-BD3257F59373@island-resort.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_E96B53D7-5BFA-4244-B743-C2C58AEC47C8" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Sun, 4 Aug 2019 21:56:01 -0700 In-Reply-To: <987fbfbb-b3f6-c104-878a-b283978ca0f0@gmail.com> Cc: rats@ietf.org To: Anders Rundgren References: <2DE09A2A-A6EA-4474-9DBE-8D52B523645B@island-resort.com> <987fbfbb-b3f6-c104-878a-b283978ca0f0@gmail.com> X-Mailer: Apple Mail (2.3445.9.1) X-CMAE-Envelope: MS4wfGQs797JisHzz0ucmreTcfOAXGIC9wSL2FalJLwAOyMQm7iwf/TRW2q772AUrSvkokBdu3fq1gNJOJ9l26RdhYksct2qwj6W72uIokpkaPQ9aXFsplLt AhwpyO7BLBqxUGfo/EbNkQqPykseh78UBNM1EA19VtlalWx7J05dbABBBc/9JLJ4Pwea8+ZyyNWrTSm9Ktd43SR9e1oB3peKWX8= Archived-At: Subject: Re: [Rats] No root of trust requirement in RATS/EAT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Aug 2019 04:56:04 -0000 --Apple-Mail=_E96B53D7-5BFA-4244-B743-C2C58AEC47C8 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On Aug 4, 2019, at 12:12 PM, Anders Rundgren = wrote: >=20 > On 2019-08-04 20:37, Laurence Lundblade wrote: >> An Android phone often looks like this: >> - Linux / Android apps >> - Linux kernel >> - TA=E2=80=99s (Trusted Apps =E2=80=94 apps running the TEE) >> - TEE kernel >> It must be allowed for any one of these to generate RATS/EAT = attestations. It might be that only the Android app generates RATS/EAT = attestations. This phone is just one example. Other devices, like cars, = may be similar. >> If there is a normative or descriptive text saying a root of trust is = required to generate an attestation, then we have to redefine root of = trust to so that >=20 >> Android apps are roots of trust. >=20 > Where does this trust come from and how is it delivered to the = concerned party? >=20 > Android apps are signed but they are not shipped with a private key. >=20 > AFAICT it is only the Android OS who can vouch for an app's = authenticity. >=20 > Anders For the definition of an EAT token it doesn=E2=80=99t matter where the = trust comes from, just like it doesn=E2=80=99t matter where trust comes = from in protocol definitions for TLS, COSE, JWT, CWT and such. The = *protocol* definitions do not require or establish trust. They may have = a means to do it, but no absolute trust is written into the protocol = definition. I=E2=80=99m pretty sure there=E2=80=99s nothing normative in the TLS = protocol definition or other IETF documents that proscribes how the = secret key on a TLS server is to be protected. A server implementing TLS = could have near zero protection for its private key and still be in = compliance with the TLS RFC. That private key could even have been = intentionally published and there would still be compliance with the TLS = protocol. To go in a bit further, a definition of root of trust is often =E2=80=9Cth= e thing that you have to trust because there is nothing more underlying = it to trust=E2=80=9D. This definition doesn=E2=80=99t give any absolute = sense of trust. It could be a terrible root of trust full of bugs and = such. The way you usually avoid that is to make sure your root of trust = is certified. That is good and useful in some ways, but we can=E2=80=99t = say XX certification from YY organization is required in normative text = in a protocol document. Trust does need to be established (but not through or in protocol = definition). Typically who ever receives a token and want to trust it = will have some how obtained the necessary public key. They hopefully = will also have figured out whether that the whole device side key = custody and handling is good enough for their purposes. For example when = they get that public key they may come to know that the corresponding = private keys are only put in to EAL 5 certified devices. I really hope that lots of excellent policy and profile documents are = written for entity attestation that locks down end-end trustworthiness. = FIDO=E2=80=99s certification program is one example. It specifies = minimum crypto, key protection, key handling and such for the = FIDO-specific attestation it does now. But it is not in the FIDO = protocol definition. It is clearly separated. LL --Apple-Mail=_E96B53D7-5BFA-4244-B743-C2C58AEC47C8 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
On = Aug 4, 2019, at 12:12 PM, Anders Rundgren <anders.rundgren.net@gmail.com> wrote:

On 2019-08-04 20:37, Laurence = Lundblade wrote:
An Android phone often looks like = this:
  - Linux / Android apps
  - = Linux kernel
  - TA=E2=80=99s (Trusted = Apps =E2=80=94 apps running the TEE)
  - TEE kernel
It= must be allowed for any one of these to generate RATS/EAT attestations. = It might be that only the Android app generates RATS/EAT attestations. = This phone is just one example. Other devices, like cars, may be = similar.
If there is a normative or descriptive text = saying a root of trust is required to generate an attestation, then we = have to redefine root of trust to so that

Android= apps are roots of trust.

Where does this trust come from = and how is it delivered to the concerned party?

Android apps are signed but they = are not shipped with a private key.

AFAICT it is only the Android OS who can vouch for an app's = authenticity.

Anders

For the definition of an EAT token it = doesn=E2=80=99t matter where the trust comes from, just like it = doesn=E2=80=99t matter where trust comes from in protocol definitions = for TLS, COSE, JWT, CWT and such. The *protocol* definitions do not = require or establish trust. They may have a means to do it, but no = absolute trust is written into the protocol definition.

I=E2=80=99m pretty sure = there=E2=80=99s nothing normative in the TLS protocol definition or = other IETF documents that proscribes how the secret key on a TLS server = is to be protected. A server implementing TLS could have near zero = protection for its private key and still be in compliance with the TLS = RFC. That private key could even have been intentionally published and = there would still be compliance with the TLS protocol.

To go in a bit further, = a definition of root of trust is often =E2=80=9Cthe thing that you have = to trust because there is nothing more underlying it to trust=E2=80=9D. = This definition doesn=E2=80=99t give any absolute sense of trust. It = could be a terrible root of trust full of bugs and such. The way you = usually avoid that is to make sure your root of trust is certified. That = is good and useful in some ways, but we can=E2=80=99t say XX = certification from YY organization is required in normative text in a = protocol document.

Trust does need to be established (but not through or in = protocol definition). Typically who ever receives a token and want to = trust it will have some how obtained the necessary public key. They = hopefully will also have figured out whether that the whole device side = key custody and handling is good enough for their purposes. For example = when they get that public key they may come to know that the = corresponding private keys are only put in to EAL 5 certified = devices.

I = really hope that lots of excellent policy and profile documents are = written for entity attestation that locks down end-end trustworthiness. = FIDO=E2=80=99s certification program is one example. It specifies = minimum crypto, key protection, key handling and such for the = FIDO-specific attestation it does now. But it is not in the FIDO = protocol definition. It is clearly separated.

LL





= --Apple-Mail=_E96B53D7-5BFA-4244-B743-C2C58AEC47C8-- From nobody Sun Aug 4 23:21:11 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1AC3B120059 for ; Sun, 4 Aug 2019 23:21:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ynbsY0tGxsnn for ; Sun, 4 Aug 2019 23:21:08 -0700 (PDT) Received: from mail-wm1-x334.google.com (mail-wm1-x334.google.com [IPv6:2a00:1450:4864:20::334]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8ECCB12004D for ; Sun, 4 Aug 2019 23:21:08 -0700 (PDT) Received: by mail-wm1-x334.google.com with SMTP id a15so73495438wmj.5 for ; Sun, 04 Aug 2019 23:21:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=EHIewWfAjUzADoRj1qi1E0FTfM9LmwAy7LNB/CgthBc=; b=pD4RaM5CFkXkxCjLrVTdGpmZZKTcAOyt8JDFS3sZgttSHdLgKgtBY0N6aa0sDUJtFr y+WeuRszT2v1cTPlAoDzf8R01+tqoiZUcj74tRtljx2hCBWsiJvzkNLKIdPFQQnu1qaR aDwRE4SL/9e2/esoWz83EABfmCzX23uKxeR2KCg79IQJFGVrZ2N4dHKeQDo/BajKN0SE CdE7ndkkevAIutR2mvieBDlo1PUaKP2d6XU+YJHnGUgNBtyHIrzkqpaWkPMhUgIcMikg +OQyfxrsvmAxxP339b0tMZX8cPBGqPG8MqXfszB3R9rIpGfIDzX1ybVhpG/Nr/SnKZwA x/Cg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=EHIewWfAjUzADoRj1qi1E0FTfM9LmwAy7LNB/CgthBc=; b=XSqjKwLXiI0MPi4HmLNW+q3IEaPTYVmx/c/LreTZAIItavSWa1QykAymAr79bbGPDc fn5v2SYIdIcWzRQxj1BFI2Sn8dEIlVcUpQr4v6dNvPXEn92gKZfqHLJgo+KgaiN1TeUH r8V9gQ0DIWu2NmFPCjPsuv9GZsYlgJ5bD/859wpKZnsgmMoz5P5eMXHGHSGEp2XT5ThL rFGsBGPCL8xbQx4bzQz50kuJDdQs3OCI8h+LF0TSWH4ktu7v+wPn4efJuu7fivGuGp6q iaFObqZ9agRCTWP5lIRWxlK8YPTxB5D/9Ko5m2qtcAUk5YF8f2GUXIaqfqSbJR8lmFIw hJ8Q== X-Gm-Message-State: APjAAAVlvrMyR4eGVbnlTbwRK6oUdId2LX0kwdfgoA/U6FvpIV3kA5HL SaebHVwBO9+4sfn1IHEAqeOcFFi7 X-Google-Smtp-Source: APXvYqwYu2N2dyhAqwSgbDABbTWRn7NHt3s08/R7de7GSIKMmMRPsNKUWn025GVbwmqc/Bh6Su4xow== X-Received: by 2002:a05:600c:2385:: with SMTP id m5mr15484159wma.4.1564986066547; Sun, 04 Aug 2019 23:21:06 -0700 (PDT) Received: from [192.168.1.79] (25.131.146.77.rev.sfr.net. [77.146.131.25]) by smtp.googlemail.com with ESMTPSA id t24sm76720754wmj.14.2019.08.04.23.21.05 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 04 Aug 2019 23:21:05 -0700 (PDT) To: Laurence Lundblade Cc: rats@ietf.org References: <2DE09A2A-A6EA-4474-9DBE-8D52B523645B@island-resort.com> <987fbfbb-b3f6-c104-878a-b283978ca0f0@gmail.com> <6F1E85F0-35CB-415A-9672-BD3257F59373@island-resort.com> From: Anders Rundgren Message-ID: <2c9ebe7b-9826-2d23-6f86-d098b79128d6@gmail.com> Date: Mon, 5 Aug 2019 08:21:02 +0200 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: <6F1E85F0-35CB-415A-9672-BD3257F59373@island-resort.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Rats] No root of trust requirement in RATS/EAT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Aug 2019 06:21:10 -0000 Hi Laurence, I still don't get it. IMHO there must be some kind RoT for an attestation to be of any use. If the RoT source is weak, buggy, inferior etc. should be out of scope for the specification; it is an application consideration and a part of each RATS/EAT profile. In TLS the assumption is that private keys are sufficiently protected and that are certificates issued by known (trusted) CAs which is why we trust TLS. In some TLS installations I have been working with, private keys were indeed mandated to be in HSMs. Anders On 2019-08-05 06:56, Laurence Lundblade wrote: > >> On Aug 4, 2019, at 12:12 PM, Anders Rundgren > wrote: >> >> On 2019-08-04 20:37, Laurence Lundblade wrote: >>> An Android phone often looks like this: >>> - Linux / Android apps >>> - Linux kernel >>> - TA’s (Trusted Apps — apps running the TEE) >>> - TEE kernel >>> It must be allowed for any one of these to generate RATS/EAT attestations. It might be that only the Android app generates RATS/EAT attestations. This phone is just one example. Other devices, like cars, may be similar. >>> If there is a normative or descriptive text saying a root of trust is required to generate an attestation, then we have to redefine root of trust to so that >> >>> Android apps are roots of trust. >> >> Where does this trust come from and how is it delivered to the concerned party? >> >> Android apps are signed but they are not shipped with a private key. >> >> AFAICT it is only the Android OS who can vouch for an app's authenticity. >> >> Anders > > For the definition of an EAT token it doesn’t matter where the trust comes from, just like it doesn’t matter where trust comes from in protocol definitions for TLS, COSE, JWT, CWT and such. The *protocol* definitions do not require or establish trust. They may have a means to do it, but no absolute trust is written into the protocol definition. > > I’m pretty sure there’s nothing normative in the TLS protocol definition or other IETF documents that proscribes how the secret key on a TLS server is to be protected. A server implementing TLS could have near zero protection for its private key and still be in compliance with the TLS RFC. That private key could even have been intentionally published and there would still be compliance with the TLS protocol. > > To go in a bit further, a definition of root of trust is often “the thing that you have to trust because there is nothing more underlying it to trust”. This definition doesn’t give any absolute sense of trust. It could be a terrible root of trust full of bugs and such. The way you usually avoid that is to make sure your root of trust is certified. That is good and useful in some ways, but we can’t say XX certification from YY organization is required in normative text in a protocol document. > > Trust does need to be established (but not through or in protocol definition). Typically who ever receives a token and want to trust it will have some how obtained the necessary public key. They hopefully will also have figured out whether that the whole device side key custody and handling is good enough for their purposes. For example when they get that public key they may come to know that the corresponding private keys are only put in to EAL 5 certified devices. > > I really hope that lots of excellent policy and profile documents are written for entity attestation that locks down end-end trustworthiness. FIDO’s certification program is one example. It specifies minimum crypto, key protection, key handling and such for the FIDO-specific attestation it does now. But it is not in the FIDO protocol definition. It is clearly separated. > > LL > > > > > From nobody Mon Aug 5 03:39:08 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A08AC1200B9 for ; Mon, 5 Aug 2019 03:39:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.997 X-Spam-Level: X-Spam-Status: No, score=-0.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, FREEMAIL_REPLY=1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AhwgAxNTEfXv for ; Mon, 5 Aug 2019 03:39:03 -0700 (PDT) Received: from mail-ot1-x335.google.com (mail-ot1-x335.google.com [IPv6:2607:f8b0:4864:20::335]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 96AA01200D5 for ; Mon, 5 Aug 2019 03:39:03 -0700 (PDT) Received: by mail-ot1-x335.google.com with SMTP id l15so27525562oth.7 for ; Mon, 05 Aug 2019 03:39:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=luxswxfYRmDRoRuhKB/65prgqF3FcnIoycPZ5u4YBS0=; b=G9l1cluzgOus08z3u0y7vN9MlGDW2h3wg9oGrBPcPP3cmGFTPygyJOAHVcdmOcRoeD enG4TRPBMXDvNyXpk18Fv52vKP4erJ5rlOTfAdSD4Uc8AxGmm5FYvbVGroi/FUzYPaY6 RzJlGkSN+XdJXyfmxddKqWJXsgrAJBiccTH2W4onWFaNjHYT3uk8ckNhbbTD/G2HoJD0 8SsfXFGyCbQeeWoP6Zjs2mZgy2uvUoI9eeNqrAFWzt/R9A9OtuOvlhAbBZUSERpm7oBR HtiubznF0aqtrrqqGJ+pMGDWCcLW/igkLvLpUlrDRh8HJGiF8sQY9Oc4ef6suWW+a6cR SpVw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=luxswxfYRmDRoRuhKB/65prgqF3FcnIoycPZ5u4YBS0=; b=TCmmmF7tZUld+T+pSlfNeeRlUG+YZeDM3kZWAxv2JoIlIXuEjWl+1PkaK+yB6Dp/6Z Ogjr9x+Mx0HR/JgCfrAY3hHvCYKoC8qi/QDiyNTbE4grbahijfVED7hKEMGedeGnEKd9 q4/kJPyhaqOZUAukF78PdtomN/x0ojbbgfs8jLuKIhMVkae4GwKo5RorRjfe6tOPaEeQ 6aXZ+bbIpp8krvyeDsuK+klkr7Wxuu0YwYk3Mf2SPtCJF1bWqd2Wetc3bfS+2TvhhQvA /r40c04a0i/KVlD9jMtoNFhIivrEyjXgKs1sVwEHGa3snZid7IB+VnqzmoFGmXRllIh7 WSHw== X-Gm-Message-State: APjAAAU/bEJXdIzPzt+LVy9r05e7hZ0pbx9u6tXlNdJppbxVmCiIiESZ 5gv4PJhU7Bo3k7D3m9olWMzi/0wznBifCW8dzDI= X-Google-Smtp-Source: APXvYqzZ5Bte4Y2Qhns2lW+X0nt0nYH4Ch9xS8tZn78bbhlLS6t+upWlPybnGLTiVsEEfPU8q3fUN8Qsx85AsVy4KNI= X-Received: by 2002:a05:6830:18a:: with SMTP id q10mr628661ota.114.1565001542800; Mon, 05 Aug 2019 03:39:02 -0700 (PDT) MIME-Version: 1.0 References: <2DE09A2A-A6EA-4474-9DBE-8D52B523645B@island-resort.com> <987fbfbb-b3f6-c104-878a-b283978ca0f0@gmail.com> <6F1E85F0-35CB-415A-9672-BD3257F59373@island-resort.com> <2c9ebe7b-9826-2d23-6f86-d098b79128d6@gmail.com> In-Reply-To: <2c9ebe7b-9826-2d23-6f86-d098b79128d6@gmail.com> From: Kathleen Moriarty Date: Mon, 5 Aug 2019 06:38:26 -0400 Message-ID: To: Anders Rundgren Cc: Laurence Lundblade , rats@ietf.org Content-Type: multipart/alternative; boundary="000000000000083c16058f5c512f" Archived-At: Subject: Re: [Rats] No root of trust requirement in RATS/EAT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Aug 2019 10:39:06 -0000 --000000000000083c16058f5c512f Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Chair hat off. Laurence has an interesting point. In the PKI space, the IETF defined a policy profile. The profile could be filled out however the entity wanted. Then it could be audited to meet assurance level requirements that are defined by NIST. I'm not sure if the same assurance levels were used globally or if there are other defined assurance levels. There are also levels of authentication defined by NIST as well as levels of identity proofing. As it turns out, we did need all of those levels as there were use cases for each. To Anders point, why would I want a device with no root of trust? Plausible deniability perhaps? Lower cost? Why would I want to sell such a device? I probably wouldn't and this could spur on higher level of assurance and remake of devices without this capability depending on the target market for a device. If we went this route, which organization should define the assurance levels? I'd personally like to see them openly defined and published. Perhaps it's NIST? If the IETF were to do this, I wouldn't put it out of scope, but may require the redefinition of our threat model to speed up. End point is a gap in our model that has been raised and talked about quite a bit in Montreal. The IETF wouldn't do audits against defined levels, but if there's only 2 - with and without a root of trust and we left anything more complex to NIST, TCG, etc., maybe this would be okay. How it's worded in the document would matter and if we plainly state it as a definition with root of trust and without, we may be fine. In that case, we'd detail out differences in the security considerations section of a document that did this. We had a similar discussion in the IoT space with lighting. I'd prefer to see both levels defined along with security considerations rather than rat hole on the need for always having perfect security. We are making deployment progress with ACME (note: it can support any level of certificate, just requires additional overhead) and other efforts when there is better security than using nothing, but it may not be perfect. The bar has been lowered with PM, and as a result, we are seeing better deployment. ACME relies on certificate type definitions that are external to the IETF that are only lightly mentioned in the publications. Best regards, Kathleen On Mon, Aug 5, 2019 at 2:21 AM Anders Rundgren < anders.rundgren.net@gmail.com> wrote: > Hi Laurence, > > I still don't get it. IMHO there must be some kind RoT for an attestatio= n > to be of any use. > > If the RoT source is weak, buggy, inferior etc. should be out of scope fo= r > the specification; it is an application consideration and a part of each > RATS/EAT profile. > > In TLS the assumption is that private keys are sufficiently protected and > that are certificates issued by known (trusted) CAs which is why we trust > TLS. > In some TLS installations I have been working with, private keys were > indeed mandated to be in HSMs. > > Anders > > On 2019-08-05 06:56, Laurence Lundblade wrote: > > > >> On Aug 4, 2019, at 12:12 PM, Anders Rundgren < > anders.rundgren.net@gmail.com > > wrote: > >> > >> On 2019-08-04 20:37, Laurence Lundblade wrote: > >>> An Android phone often looks like this: > >>> - Linux / Android apps > >>> - Linux kernel > >>> - TA=E2=80=99s (Trusted Apps =E2=80=94 apps running the TEE) > >>> - TEE kernel > >>> It must be allowed for any one of these to generate RATS/EAT > attestations. It might be that only the Android app generates RATS/EAT > attestations. This phone is just one example. Other devices, like cars, m= ay > be similar. > >>> If there is a normative or descriptive text saying a root of trust is > required to generate an attestation, then we have to redefine root of tru= st > to so that > >> > >>> Android apps are roots of trust. > >> > >> Where does this trust come from and how is it delivered to the > concerned party? > >> > >> Android apps are signed but they are not shipped with a private key. > >> > >> AFAICT it is only the Android OS who can vouch for an app's > authenticity. > >> > >> Anders > > > > For the definition of an EAT token it doesn=E2=80=99t matter where the = trust > comes from, just like it doesn=E2=80=99t matter where trust comes from in= protocol > definitions for TLS, COSE, JWT, CWT and such. The *protocol* definitions = do > not require or establish trust. They may have a means to do it, but no > absolute trust is written into the protocol definition. > > > > I=E2=80=99m pretty sure there=E2=80=99s nothing normative in the TLS pr= otocol definition > or other IETF documents that proscribes how the secret key on a TLS serve= r > is to be protected. A server implementing TLS could have near zero > protection for its private key and still be in compliance with the TLS RF= C. > That private key could even have been intentionally published and there > would still be compliance with the TLS protocol. > > > > To go in a bit further, a definition of root of trust is often =E2=80= =9Cthe > thing that you have to trust because there is nothing more underlying it = to > trust=E2=80=9D. This definition doesn=E2=80=99t give any absolute sense o= f trust. It could > be a terrible root of trust full of bugs and such. The way you usually > avoid that is to make sure your root of trust is certified. That is good > and useful in some ways, but we can=E2=80=99t say XX certification from Y= Y > organization is required in normative text in a protocol document. > > > > Trust does need to be established (but not through or in protocol > definition). Typically who ever receives a token and want to trust it wil= l > have some how obtained the necessary public key. They hopefully will also > have figured out whether that the whole device side key custody and > handling is good enough for their purposes. For example when they get tha= t > public key they may come to know that the corresponding private keys are > only put in to EAL 5 certified devices. > > > > I really hope that lots of excellent policy and profile documents are > written for entity attestation that locks down end-end trustworthiness. > FIDO=E2=80=99s certification program is one example. It specifies minimum= crypto, > key protection, key handling and such for the FIDO-specific attestation i= t > does now. But it is not in the FIDO protocol definition. It is clearly > separated. > > > > LL > > > > > > > > > > > > _______________________________________________ > RATS mailing list > RATS@ietf.org > https://www.ietf.org/mailman/listinfo/rats > --=20 Best regards, Kathleen --000000000000083c16058f5c512f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Chair hat off.

Laurence has an interest= ing point.=C2=A0 In the PKI space, the IETF defined a policy profile.=C2=A0= The profile could be filled out however the entity wanted.=C2=A0 Then it c= ould be audited to meet assurance level requirements that are defined by NI= ST.=C2=A0 I'm not sure if the same assurance levels were used globally = or if there are other defined assurance levels.=C2=A0 There are also levels= of authentication defined by NIST as well as levels of identity proofing.= =C2=A0 As it turns out, we did need all of those levels as there were use c= ases for each.=C2=A0=C2=A0

To Anders point, why wo= uld I want a device with no root of trust?=C2=A0 Plausible deniability perh= aps? Lower cost?
Why would I want to sell such a device?=C2=A0 I = probably wouldn't and this could spur on higher level of assurance and = remake of devices without this capability depending on the target market fo= r a device.=C2=A0=C2=A0

If we went this route, whi= ch organization should define the assurance levels?=C2=A0 I'd personall= y like to see them openly defined and published.=C2=A0 Perhaps it's NIS= T?

If the IETF were to do this, I wouldn't put= it out of scope, but may require the redefinition of our threat model to s= peed up.=C2=A0 End point is a gap in our model that has been raised and tal= ked about quite a bit in Montreal.=C2=A0 The IETF wouldn't do audits ag= ainst defined levels, but if there's only 2 - with and without a root o= f trust and we left anything more complex to NIST, TCG, etc., maybe this wo= uld be okay.=C2=A0 How it's worded in the document would matter and if = we plainly state it as a definition with root of trust and without, we may = be fine.=C2=A0 In that case, we'd detail out differences in the securit= y considerations section of a document that did this.

<= div>We had a similar discussion in the IoT space with lighting.=C2=A0 I'= ;d prefer to see both levels defined along with security considerations rat= her than rat hole on the need for always having perfect security.=C2=A0 We = are making deployment progress with ACME (note: it can support any level of= certificate, just requires additional overhead) and other efforts when the= re is better security than using nothing, but it may not be perfect.=C2=A0 = The bar has been lowered with PM, and as a result, we are seeing better dep= loyment.=C2=A0

ACME relies on certificate type def= initions that are external to the IETF that are only lightly mentioned in t= he publications.

Best regards,
Kathleen<= /div>

On Mon, Aug 5, 2019 at 2:21 AM Anders Rundgren <anders.rundgren.net@gmail.com> wrote:<= br>
Hi Laurence,

I still don't get it.=C2=A0 IMHO there must be some kind RoT for an att= estation to be of any use.

If the RoT source is weak, buggy, inferior etc. should be out of scope for = the specification; it is an application consideration and a part of each RA= TS/EAT profile.

In TLS the assumption is that private keys are sufficiently protected and t= hat are certificates issued by known (trusted) CAs which is why we trust TL= S.
In some TLS installations I have been working with, private keys were indee= d mandated to be in HSMs.

Anders

On 2019-08-05 06:56, Laurence Lundblade wrote:
>
>> On Aug 4, 2019, at 12:12 PM, Anders Rundgren <anders.rundgren.net@gmail= .com <mailto:anders.rundgren.net@gmail.com>> wrote:
>>
>> On 2019-08-04 20:37, Laurence Lundblade wrote:
>>> An Android phone often looks like this:
>>> - Linux / Android apps
>>> - Linux kernel
>>> - TA=E2=80=99s (Trusted Apps =E2=80=94 apps running the TEE) >>> - TEE kernel
>>> It must be allowed for any one of these to generate RATS/EAT a= ttestations. It might be that only the Android app generates RATS/EAT attes= tations. This phone is just one example. Other devices, like cars, may be s= imilar.
>>> If there is a normative or descriptive text saying a root of t= rust is required to generate an attestation, then we have to redefine root = of trust to so that
>>
>>> Android apps are roots of trust.
>>
>> Where does this trust come from and how is it delivered to the con= cerned party?
>>
>> Android apps are signed but they are not shipped with a private ke= y.
>>
>> AFAICT it is only the Android OS who can vouch for an app's au= thenticity.
>>
>> Anders
>
> For the definition of an EAT token it doesn=E2=80=99t matter where the= trust comes from, just like it doesn=E2=80=99t matter where trust comes fr= om in protocol definitions for TLS, COSE, JWT, CWT and such. The *protocol*= definitions do not require or establish trust. They may have a means to do= it, but no absolute trust is written into the protocol definition.
>
> I=E2=80=99m pretty sure there=E2=80=99s nothing normative in the TLS p= rotocol definition or other IETF documents that proscribes how the secret k= ey on a TLS server is to be protected. A server implementing TLS could have= near zero protection for its private key and still be in compliance with t= he TLS RFC. That private key could even have been intentionally published a= nd there would still be compliance with the TLS protocol.
>
> To go in a bit further, a definition of root of trust is often =E2=80= =9Cthe thing that you have to trust because there is nothing more underlyin= g it to trust=E2=80=9D. This definition doesn=E2=80=99t give any absolute s= ense of trust. It could be a terrible root of trust full of bugs and such. = The way you usually avoid that is to make sure your root of trust is certif= ied. That is good and useful in some ways, but we can=E2=80=99t say XX cert= ification from YY organization is required in normative text in a protocol = document.
>
> Trust does need to be established (but not through or in protocol defi= nition). Typically who ever receives a token and want to trust it will have= some how obtained the necessary public key. They hopefully will also have = figured out whether that the whole device side key custody and handling is = good enough for their purposes. For example when they get that public key t= hey may come to know that the corresponding private keys are only put in to= EAL 5 certified devices.
>
> I really hope that lots of excellent policy and profile documents are = written for entity attestation that locks down end-end trustworthiness. FID= O=E2=80=99s certification program is one example. It specifies minimum cryp= to, key protection, key handling and such for the FIDO-specific attestation= it does now. But it is not in the FIDO protocol definition. It is clearly = separated.
>
> LL
>
>
>
>
>

_______________________________________________
RATS mailing list
RATS@ietf.org
https://www.ietf.org/mailman/listinfo/rats


--

Best regards,
Kathleen
--000000000000083c16058f5c512f-- From nobody Mon Aug 5 13:18:42 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5BC001202D9 for ; Mon, 5 Aug 2019 13:18:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.298 X-Spam-Level: X-Spam-Status: No, score=-4.298 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=qti.qualcomm.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ozNediW0Bd_o for ; Mon, 5 Aug 2019 13:18:28 -0700 (PDT) Received: from alexa-out-sd-02.qualcomm.com (alexa-out-sd-02.qualcomm.com [199.106.114.39]) (using TLSv1.2 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 93D8C12012A for ; Mon, 5 Aug 2019 13:18:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=qti.qualcomm.com; i=@qti.qualcomm.com; q=dns/txt; s=qcdkim; t=1565036308; x=1596572308; h=from:to:subject:date:message-id:mime-version; bh=4bV3iFqjzY+U5ZlLn8YlmIPlVtp6mHreCfGBELW2fKY=; b=c/HPzxqHFnOJIMqYGSnNBsOHw2nJAA3P8s+IrSIFbaPq42OJ0jmwLtpZ /Xquh7u4AVMdwH+c0riTw1UJwEYXSgu4i8PHkE5m3WnDuWmTBnDwGQWD+ tLx2bNtPkB0BnuOtY2P8fao4cNHcZ41bYociVxZX2Uh6WxL0hGrz9N8eu M=; Received: from unknown (HELO ironmsg04-sd.qualcomm.com) ([10.53.140.144]) by alexa-out-sd-02.qualcomm.com with ESMTP; 05 Aug 2019 13:18:27 -0700 Received: from nasanexm01a.na.qualcomm.com ([10.85.0.81]) by ironmsg04-sd.qualcomm.com with ESMTP/TLS/AES256-SHA; 05 Aug 2019 13:18:27 -0700 Received: from NASANEXM01C.na.qualcomm.com (10.85.0.83) by nasanexm01a.na.qualcomm.com (10.85.0.81) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Mon, 5 Aug 2019 13:18:27 -0700 Received: from NASANEXM01C.na.qualcomm.com ([10.85.0.83]) by NASANEXM01C.na.qualcomm.com ([10.85.0.83]) with mapi id 15.00.1473.003; Mon, 5 Aug 2019 13:18:27 -0700 From: Giridhar Mandyam To: "rats@ietf.org" Thread-Topic: Comments on draft-birkholz-rats-architecture-01 Thread-Index: AdVLpJl2sBLswY9kRGGwhcuJl1yT3w== Date: Mon, 5 Aug 2019 20:18:27 +0000 Message-ID: <2661c5114f194ed5834b919554e7ba0e@NASANEXM01C.na.qualcomm.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.49.16.6] Content-Type: multipart/alternative; boundary="_000_2661c5114f194ed5834b919554e7ba0eNASANEXM01Cnaqualcommco_" MIME-Version: 1.0 Archived-At: Subject: [Rats] Comments on draft-birkholz-rats-architecture-01 X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Aug 2019 20:18:40 -0000 --_000_2661c5114f194ed5834b919554e7ba0eNASANEXM01Cnaqualcommco_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Please note that these comments are not meant as a response to any call-for= -adoption of this document. Thanks to the editors for preparing this document. It was an interesting r= ead. That being said, I had some brief and initial follow-up. After I con= duct a more detailed review, I may send more follow-up comments/questions. 1. This document [1] is listed as "Standards Track" and is not listed as= "Informational" . I am wondering what that means in practice, as I would = assume a standards track document would address areas where interoperabilit= y is required. I am having trouble identifying where in the document there= is any actual specification that affects interoperability (e.g. protocol r= equirements between the actors defined in Sec. 4). So what is the intentio= n behind requiring this document to be standards track? Does it mean that = if I set up a remote attestation solution that does not follow the architec= ture defined in Section 2, then I am doing it wrong? 2. Subsequently, I compared this document to another security architectu= re document on standards track in the IETF, namely the RTCWeb sec. arch. dr= aft [2], Note that there are several areas crucial to WebRTC interoperabil= ity that are defined in [2], particularly in the usage of the SDP identity = attribute (also defined in this document - see [3] for the IANA registry re= ference). As a result, there are several 'MUST' requirements in this docum= ent. * In contrast, [1] has zero "MUST" or even "SHOULD" requirements. S= o what is being defined here that is standards track? Could this instead b= e an informative document that is not standards track, like the Use Cases? 3. The term "appraise" is used in the document without defining the role= of an appraiser and the target of appraisal. This is unfortunate and is n= ot consistent with previously-published work on attestation. For instance,= [4] offers the following definitions: "An appraiser is a party, generally= a computer on a network, making a decision about some other party or parti= es. A target is a party about which an appraiser needs to make such a decis= ion." The authors go on to comment, "We refer to the decision-making party= as an appraiser rather than a verifier to emphasize that the decision-maki= ng process is a matter of evaluating the target against the appraiser's int= ernal standards, rather than proving the target's correctness." * I contrast this with [1], where appraisal seems to be the sole res= ponsibility of the verifier. Forcing appraisal to be part of verification = means that all attestation appraisals will be tied into verification. Ther= efore it can be assumed that a successful verification is required for appr= aisal, when in many cases it is not. 4. Sec. 4.1.1: Attester Duties. Amongst them, "Acquisition or collecti= ons of assertions about itself". What constitutes 'itself' in this case? * Note another terminology definition in [4]: "Attestation is the a= ctivity of making a claim to an appraiser about the properties of a target = by supplying evidence which supports that claim. An attester is a party per= forming this activity. An appraiser's decision-making process based on atte= sted information is appraisal." i. Ther= e is no requirement that attester and target be the same in this definition= , while [1] seems to require that the attester can only make claims about '= itself'. * Note that if the attester and target have to be one and the same, = then this excludes certain architectures that may be required for limited-r= esource devices that are simply unable to make claims about themselves. Fo= r instance, in [5] (apologies in advance for being self-referential), an ar= chitecture is described wherein an IoT gateway constructions attestations o= n behalf of attached devices for a relying party based on network observati= ons. 1. Sec. 3.1. The role of the verifier in appraisal. Note that [4] goes= on to state that "A given target may wish to provide different information= to different appraisers depending on the current trust relationships it ha= s with those parties." The definition of the verifier does not cover multip= le appraisers. * An individual relying party may actually execute different levels = of appraisal, depending on the type of authorization it wants to provide. = An example could be an RP that allows access to its service for a successfu= lly-verified attestation where all claims are as expected, but requires ste= p-up authentication for a successfully-verified attestation where certain c= laims do not meet the appraisal criteria (e.g. target's SW version is not a= t the tip, target's location is outside a permissible geofence). 2. Sec. 3.1. Authentication Checker. I tried to determine whether an A= uthentication Checker can fulfil the role of an appraiser, but I don't see = how this is possible. * "The consumer ... that assesses the trustworthiness or other trust= relationships of the information consumed via trusted third parties or ext= ernal trust authorities ...". This sentence seems to restrict assessment a= s being only based on information provided only by external or 3rd-parties.= If the RP and the manufacturer of the target are one and the same, this s= eems to be unnecessary. i. Note= that in my reading of [4], no such restriction is proposed. However, this= paper focuses on the TPM-model for attestation and therefore in its exampl= es tends to assume the use of external CA's. 1. Privacy: The role of privacy considerations in an attestation archit= ecture should ideally be addressed. There is a mention of a privacy CA in = the definition of Authentication Checker, but the use of a privacy CA is on= ly one option and is often undesirable for many service providers. * FIDO defined the role of a "none" attestation statement [6], to al= low RP's to avoid undesired exposure to information that could be used for = device fingerprinting, user tracking, etc. Any reference architecture shou= ld be able to accommodate a none attestation as a means of preserving priva= cy. 2. There is no definition of attestation delegation or definition of an = attestation proxy as an actor or architectural component in the current dra= ft. I contrast this to [7], where Section 5.4 clearly defines these concep= ts and demonstrates their usage in the context integrating trusted 3rd-part= ies in attestation verification and appraisal. * This kind of operational model may be depicted in the example of S= ection 6.1. If so, why not use the terms-of-art such as 'attestation proxy= ' or 'attestation delegation'? * The use of attestation proxies may be addressed in Section. 7.1 ("= lying endpoint"), but it is not clear how an RP distinguishes between a lyi= ng endpoint and a trusted system. i. I in= terpret the guidance in Section 7.2 to actually discourage the use of attes= tation proxies: "Remote Attestation argues that a systems's integrity char= acteristics should not be believed until rationale for believability is pr= esented to the relying party seeking to interact with the system." This me= ans that the RP must have access to all aspects of the 'rationale' and cann= ot simply consume a 'yes/no' indication from a trusted 3rd-party. 1. Has this document been compared to the TEEP reference architecture [8= ]? I have done a very superficial comparison, but I expect that if the g= roup adopts [1] then the TEEP architecture will evolve to be consistent wit= h the RAts architecture. * Note that the status of the TEEP arch. draft is "Informational". = Maybe the RAts architecture should be as well. * Sec. 7.1 of [8] specifically requires signature non-repudiation. = I could not find an equivalent requirement in [1]. Is there a reason why n= on-repudiation is not required for the RAts architecture? i. If s= uch a requirement is in [1] but is worded differently from [8], please poin= t me to it. * Sec. 5.3 of [8] states "... the TEEP Broker provides connections f= rom the TEE and the Client App to one or more TAMs. The selection of which= TAM to communicate with is dependent on information from the Client App an= d is directly related to the TA." i. Sinc= e the TEEP Broker plays a critical role in conveyance of the attestation in= formation to the correct TAM, it seems to me that there should be a similar= entity defined in the attestation target of the RAts architecture that wou= ld determine how and to which endpoint the attestation is conveyed. [1] https://www.ietf.org/id/draft-birkholz-rats-architecture-01.txt. [2] https://tools.ietf.org/html/draft-ietf-rtcweb-security-arch-20. [3] https://www.iana.org/assignments/sdp-parameters/sdp-parameters.xhtml. [4] Coker, George et al. "Principles of Remote Attestation." Internationa= l Journal on Information Security. Vol. 10. No .2. 2011. pp. 63-81. [5] Mandyam, G. IEEE/ACM International Conference on Communications System= s and Networks (COMSNETS). January 2017. https://ieeexplore.ieee.org/abst= ract/document/7945438. [6] https://www.w3.org/TR/webauthn/#none-attestation. [7] J. Guttman et al. ""Attestation: Evidence and Trust". MITRE Technica= l Report MTR080072. March 2008. https://www.mitre.org/sites/default/files= /pdf/07_0186.pdf. [8] https://datatracker.ietf.org/doc/draft-ietf-teep-architecture/. -Giri Mandyam, Qualcomm --_000_2661c5114f194ed5834b919554e7ba0eNASANEXM01Cnaqualcommco_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Please note that these comments are not meant as a r= esponse to any call-for-adoption of this document.

 

Thanks to the editors for preparing this document.&n= bsp; It was an interesting read.  That being said, I had some brief an= d initial follow-up.  After I conduct a more detailed review, I may se= nd more follow-up comments/questions.

 

  1. This document [1] is listed as “Standards Track” and is n= ot listed as “Informational” .  I am wondering what that m= eans in practice, as I would assume a standards track document would address areas where interoperability is required.  I am having troubl= e identifying where in the document there is any actual specification that = affects interoperability (e.g. protocol requirements between the actors def= ined in Sec. 4).  So what is the intention behind requiring this document to be standards track?  Does it mean t= hat if I set up a remote attestation solution that does not follow the arch= itecture defined in Section 2, then I am doing it wrong?
    2. Subsequently, I compared this document to another security architecture = document on standards track in the IETF, namely the RTCWeb sec. arch. draft= [2],  Note that there are several areas crucial to WebRTC interoperability that are defined in [2], particul= arly in the usage of the SDP identity attribute (also defined in this docum= ent – see [3] for the IANA registry reference).  As a result, th= ere are several ‘MUST’ requirements in this document.
    1. In contrast, [1] has zero “MUST” or even “SHOULD= 221; requirements.  So what is being defined here that is standards tr= ack?  Could this instead be an informative document that is not standa= rds track, like the Use Cases?
  2. The term “appraise” is used in the document without = defining the role of an appraiser and the target of appraisal.  This i= s unfortunate and is not consistent with previously-published work on attestation.  For instance, [4] offers the following definiti= ons:  “An appraiser is a party, generally a computer on a networ= k, making a decision about some other party or parties. A target is a party= about which an appraiser needs to make such a decision.”  The authors go on to comment, “We refer to the decision-making party= as an appraiser rather than a verifier to emphasize that the decision-maki= ng process is a matter of evaluating the target against the appraiser’= ;s internal standards, rather than proving the target’s correctness.”
    1. I contrast this with [1], where appraisal seems to be the sole respon= sibility of the verifier.  Forcing appraisal to be part of verificatio= n means that all attestation appraisals will be tied into verification.  Therefore it can be assumed that a succes= sful verification is required for appraisal, when in many cases it is not.<= o:p>
  3. Sec. 4.1.1:  Attester Duties.  Amongst them, “Ac= quisition or collections of assertions about itself”.  What cons= titutes ‘itself’ in this case?
    1. Note another terminology definition in [4]:  “Attestation = is the activity of making a claim to an appraiser about the properties of a= target by supplying evidence which supports that claim. An attester is a party performing this activity. An appraiser’= ;s decision-making process based on attested information is appraisal.̶= 1;

       =             &nb= sp;            =             &nb= sp;            =       i.  = ;    There is no requirement that at= tester and target be the same in this definition, while [1] seems to requir= e that the attester can only make claims about ‘itself’.

    1. Note that if the attester and target have to be one and the same, the= n this excludes certain architectures that may be required for limited-reso= urce devices that are simply unable to make claims about themselves.  For instance, in [5] (apologies in = advance for being self-referential), an architecture is described wherein a= n IoT gateway constructions attestations on behalf of attached devices for = a relying party based on network observations.
  1. Sec. 3.1.  The role of the verifier in appraisal.  Note tha= t [4] goes on to state that “A given target may wish to provide diffe= rent information to different appraisers depending on the current trust relationships it has with those parties.” The defi= nition of the verifier does not cover multiple appraisers.
    1. An individual relying party may actually execute different levels of = appraisal, depending on the type of authorization it wants to provide. = ; An example could be an RP that allows access to its service for a successfully-verified attestation where all claims ar= e as expected, but requires step-up authentication for a successfully-verif= ied attestation where certain claims do not meet the appraisal criteria (e.= g. target’s SW version is not at the tip, target’s location is outside a permissible geofence).<= /o:p>
  2. Sec. 3.1.  Authentication Checker.  I tried to determi= ne whether an Authentication Checker can fulfil the role of an appraiser, b= ut I don’t see how this is possible.
    1. “The consumer … that assesses the trustworthiness or othe= r trust relationships of the information consumed via trusted third parties= or external trust authorities …”.  This sentence seems to restrict assessment as being only based on information provided o= nly by external or 3rd-parties.  If the RP and the manufact= urer of the target are one and the same, this seems to be unnecessary.=

       =             &nb= sp;            =             &nb= sp;            =       i.  = ;    Note that in my reading of [4],= no such restriction is proposed.  However, this paper focuses on the = TPM-model for attestation and therefore in its examples tends to assume the use of external CA’s.

  1. Privacy:  The role of privacy considerations in an attestation a= rchitecture should ideally be addressed.  There is a mention of a priv= acy CA in the definition of Authentication Checker, but the use of a privacy CA is only one option and is often undesirable fo= r many service providers.
    1. FIDO defined the role of a “none” attestation statement [= 6], to allow RP’s to avoid undesired exposure to information that cou= ld be used for device fingerprinting, user tracking, etc.  Any reference architecture should be able to accommodate a none attestatio= n as a means of preserving privacy.
  2. There is no definition of attestation delegation or definition o= f an attestation proxy as an actor or architectural component in the curren= t draft.  I contrast this to [7], where Section 5.4 clearly defines these concepts and demonstrates their usage in the con= text integrating trusted 3rd-parties in attestation verification= and appraisal. 
    1. This kind of operational model may be depicted in the example of Sect= ion 6.1.  If so, why not use the terms-of-art such as ‘attestati= on proxy’ or ‘attestation delegation’?
      2. The use of attestation proxies may be addressed in Section. 7.1 (“= lying endpoint”), but it is not clear how an RP distinguishes between= a lying endpoint and a trusted system.

       =             &nb= sp;            =             &nb= sp;            =       i.  = ;    I interpret the guidance in Sec= tion 7.2 to actually discourage the use of attestation proxies:  ̶= 0;Remote Attestation argues that a systems's integrity characteristics shou= ld not be  believed until rationale for believability is presented to the re= lying party seeking to interact with the system.”  This means th= at the RP must have access to all aspects of the ‘rationale’ an= d cannot simply consume a ‘yes/no’ indication from a trusted 3rd-party.

  1. Has this document been compared to the TEEP reference architecture [8= ]?    I have done a very superficial comparison, but I expec= t that if the group adopts [1] then the TEEP architecture will evolve to be consistent with the RAts architecture.
    1. Note that the status of the TEEP arch. draft is “Informational&= #8221;.  Maybe the RAts architecture should be as well.
    2. Sec. 7.1 of [8] specifically requires signature non-repudiation.&nbs= p; I could not find an equivalent requirement in [1].  Is there a reas= on why non-repudiation is not required for the RAts architecture?

       =             &nb= sp;            =             &nb= sp;            =       i.  = ;    If such a requirement is in [1]= but is worded differently from [8], please point me to it.

    1. Sec. 5.3 of [8] states “… the TEEP Broker provides connec= tions from the TEE and the Client App to one or more TAMs.  The select= ion of which TAM to communicate with is dependent on information from the Client App and is directly related to the TA.”<= o:p>

       =             &nb= sp;            =             &nb= sp;            =       i.  = ;    Since the TEEP Broker plays a c= ritical role in conveyance of the attestation information to the correct TA= M, it seems to me that there should be a similar entity defined in the attestation target of the RAts architecture that would determine how and t= o which endpoint the attestation is conveyed.

 

[1] https://www.ietf.org/id/draft-birkholz-rats-architecture-01.txt.

[2] https://tools.ietf.org/html/draft-ietf-rtcweb-security-arch-20.

[3] https://www.iana.org/assignments/sdp-parameters/sdp-parameters.xhtml.

[4] Coker, George et al.  “Principles of = Remote Attestation.”  International Journal on Information Security.  Vol. 10.  = No .2.  2011.  pp. 63-81.

[5] Mandyam, G.  IEEE/ACM International Confere= nce on Communications Systems and Networks (COMSNETS).  January 2017.&= nbsp; https://i= eeexplore.ieee.org/abstract/document/7945438.

[6] https://www.w3.org/TR/webauthn/#none-attestation.

[7] J. Guttman et al.  “”Attestatio= n:  Evidence and Trust”.  MITRE Technical Report MTR080072.=   March 2008.  https= ://www.mitre.org/sites/default/files/pdf/07_0186.pdf.

[8] https://datatracker.ietf.org/doc/draft-ietf-teep-architecture/.

 

-Giri Mandyam, Qualcomm

--_000_2661c5114f194ed5834b919554e7ba0eNASANEXM01Cnaqualcommco_-- From nobody Mon Aug 5 17:50:05 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0FA05120045 for ; Mon, 5 Aug 2019 17:50:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2VG7WZQhbJVv for ; Mon, 5 Aug 2019 17:50:00 -0700 (PDT) Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6873312000E for ; Mon, 5 Aug 2019 17:50:00 -0700 (PDT) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga007.fm.intel.com ([10.253.24.52]) by fmsmga105.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 05 Aug 2019 17:49:59 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.64,350,1559545200"; d="scan'208,217";a="175739294" Received: from orsmsx104.amr.corp.intel.com ([10.22.225.131]) by fmsmga007.fm.intel.com with ESMTP; 05 Aug 2019 17:49:59 -0700 Received: from orsmsx151.amr.corp.intel.com (10.22.226.38) by ORSMSX104.amr.corp.intel.com (10.22.225.131) with Microsoft SMTP Server (TLS) id 14.3.439.0; Mon, 5 Aug 2019 17:49:59 -0700 Received: from orsmsx109.amr.corp.intel.com ([169.254.11.25]) by ORSMSX151.amr.corp.intel.com ([169.254.7.148]) with mapi id 14.03.0439.000; Mon, 5 Aug 2019 17:49:58 -0700 From: "Smith, Ned" To: Kathleen Moriarty , Anders Rundgren CC: "rats@ietf.org" , Laurence Lundblade Thread-Topic: [Rats] No root of trust requirement in RATS/EAT Thread-Index: AQHVSvPjFx1t01pVXEauYmUEMz2sl6br0JiAgACjAICAABfBAIAAR+sAgAB4kQA= Date: Tue, 6 Aug 2019 00:49:58 +0000 Message-ID: References: <2DE09A2A-A6EA-4474-9DBE-8D52B523645B@island-resort.com> <987fbfbb-b3f6-c104-878a-b283978ca0f0@gmail.com> <6F1E85F0-35CB-415A-9672-BD3257F59373@island-resort.com> <2c9ebe7b-9826-2d23-6f86-d098b79128d6@gmail.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1b.0.190715 x-originating-ip: [10.241.230.55] Content-Type: multipart/alternative; boundary="_000_A4E8245F6A5F4E6DB94041F43E8DBC38intelcom_" MIME-Version: 1.0 Archived-At: Subject: Re: [Rats] No root of trust requirement in RATS/EAT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Aug 2019 00:50:04 -0000 --_000_A4E8245F6A5F4E6DB94041F43E8DBC38intelcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhlIFJBVFMgY2hhcnRlciBleGNsdWRlcyBkZWZpbml0aW9uIG9mIHRoZSBlbmRwb2ludCBkZXZp Y2UgLyB0cnVzdGVkIGRldmljZS4gVGhpcyBpcyBub3QgdG8gc2F5IHRoYXQgdGhlIGVuZHBvaW50 IHdvdWxkbuKAmXQgLyBjb3VsZG7igJl0IGhhdmUgYSByb290IG9mIHRydXN0LCB0cnVzdGVkIGV4 ZWN1dGlvbiBlbnZpcm9ubWVudCAoVEVFKSwgdHJ1c3RlZCBjb21wdXRpbmcgYmFzZSAoVENCKSBv ciBpbiBzb21lIHdheSBiZSB0cnVzdHdvcnRoeS4gIFRoZSBjb3VudGVyIGV4YW1wbGUgaXMgYWxz byB0cnVlLiBUaGUgZW50aXR5IHRoYXQgcGFydGljaXBhdGVzIGluIGEgUkFUUyBleGNoYW5nZSBt YXkgbm90IGhhdmUgdGhlIHRydXN0d29ydGhpbmVzcyBwcm9wZXJ0aWVzIGltcG9ydGFudCB0byB0 aGUgdmVyaWZpZXIuDQoNCkEgZGVmaW5pdGlvbiBvZiByb290IG9mIHRydXN0IGlzOiBJdCBpcyB0 cnVzdGVkIGFsd2F5cyB0byBiZWhhdmUgaW4gdGhlIGV4cGVjdGVkIG1hbm5lciwgYmVjYXVzZSBp dHMgbWlzYmVoYXZpb3IgY2Fubm90IGJlIGRldGVjdGVkLg0KDQpCeSB0aGlzIGRlZmluaXRpb24g YWxsIGVuZHBvaW50cyBhcmUgdHJ1c3RlZCAvIGhhcyBhIHJvb3Qgb2YgdHJ1c3QuIFRoZSB2ZXJp ZmllciBtdXN0IGRldGVybWluZSBpZiBpdCBpcyBqdXN0aWZpZWQgaW4gdHJ1c3RpbmcgdGhlIGVu ZHBvaW50IGJhc2VkIG9uIGl0cyByb290LW9mLXRydXN0IGRlZmluaXRpb24uIEZvciBleGFtcGxl LCBpZiB0aGUgZW5kcG9pbnQgZGVmaW5lcyBpdHMgcm9vdCBvZiB0cnVzdCBpbiB0ZXJtcyBvZiBh IHNvZnR3YXJlIGFwcGxpY2F0aW9uIChvbmx5KSB0aGVuIHRoZSB2ZXJpZmllciBpcyBsaWtlbHkg bm90IGp1c3RpZmllZCBpbiByZWdhcmRpbmcgaXQgYXMgYSByb290IG9mIHRydXN0LCBzaW5jZSB0 aGVyZSBhcmUgbWFueSBwb3NzaWJsZSB3YXlzIHRvIGNvbXByb21pc2Ugc29mdHdhcmUgKGluIHRo ZSBhYnN0cmFjdCkuDQoNClRoZSB2ZXJpZmllciB3YW50cyB0byBrbm93IHNvbWV0aGluZyBhYm91 dCB0aGUgZW50aXR5IGl0IGlzIHBvdGVudGlhbGx5IGludGVyYWN0aW5nIHdpdGgsIHRoZXJlZm9y ZSBpdCBuZWVkcyBhIGNyZWRlbnRpYWwgdGhhdCBpZGVudGlmaWVzIHRoZSBlbnRpdHkgaW4gdGVy bXMgb2YgaXRzIGNvbnN0cnVjdGlvbi4gVGhlIHZlbmRvciwgcHJvZHVjdCwgdmVyc2lvbiBpbmZv IGlzIG9mdGVuIGEgcmVhc29uYWJsZSB3YXkgdG8gZG8gdGhpcy4gVGhlIFZlcmlmaWVyIHdhbnRz IHRvIGNvbm5lY3QgdGhlIHZlbmRvcuKAmXMgaWRlbnRpZmllciB3aXRoIHRoZSBlbnRpdHkgb24g dGhlIHdpcmUsIGhlbmNlIHRoZSB2ZW5kb3IgbWlnaHQgcHJlLXByb3Zpc2lvbiBjcnlwdG9ncmFw aGljIGtleXMgYW5kIGlzc3VlIGNyZWRlbnRpYWxzIHRoYXQgYWxsb3dzIHRoZSB2ZXJpZmllciB0 byBjb25uZWN0IHRoZSBmb2xsb3dpbmc6DQoNCiAgKiAgIEN1cnJlbnQgZW50aXR5IGludGVyYWN0 aW9uIChzZXNzaW9uIGtleXMsIGNlcnRpZmljYXRlKQ0KICAqICAgRW50aXR5IHR5cGUgKHZlbmRv ciwgcHJvZHVjdCwgdmVyc2lvbikNCiAgKiAgIEVudGl0eSB2ZW5kb3IgcmVwdXRhdGlvbiAodHJ1 c3QgYW5jaG9yLCBjZXJ0aWZpY2F0ZSkNCiAgKiAgIENyeXB0b2dyYXBoaWMgYmluZGluZyBvZiB0 aGUgYWJvdmUuDQoNCkV2ZW4gaWYgdGhlc2UgcGFyYW1ldGVycyBhcmUgZXZhbHVhdGVkIGJ5IHRo ZSBWZXJpZmllciwgaXQgY291bGQgc3RpbGwgZGVjaWRlIHRoZXJlIGlzbuKAmXQgc3VmZmljaWVu dCBiYXNpcyBmb3Igbm9uLWRldGVjdGlvbiBvZiBtaXNiZWhhdmlvci4gTWF5YmUgYmVjYXVzZSB0 aGUgc2l6ZSBvZiB0aGUgdHJ1c3RlZCBwYXJ0IG9mIGVudGl0eSBoYXMgYW4gYXR0YWNrIHN1cmZh Y2UgdGhhdCBpcyB0b28gbGFyZ2UuIFRoZSB2ZXJpZmllciBtaWdodCByZXF1aXJlIGEgcm9vdCBv ZiB0cnVzdCB0aGF0IGlzIHNtYWxsZXIgb3IgaGFyZGVuZWQgaW4gYSBwYXJ0aWN1bGFyIHdheS4g VGhlIHZlcmlmaWVyIG1heSByZXF1aXJlIGEgZGlmZmVyZW50IGNvbXBvbmVudCBvciBURUUgdG8g YmUgdGhlIHN0YXJ0aW5nIHBvaW50IHJvb3Qgb2YgdHJ1c3QsIGhlbmNlIGl0IG1heSBleHBlY3Qg YSBkaWZmZXJlbnQgKHZlbmRvciwgcHJvZHVjdCwgdmVyc2lvbikgZW50aXR5IHR5cGUgYXMgaXRz IHN0YXJ0aW5nIHBvaW50Lg0KDQpPbmNlIGEgc3RhcnRpbmcgcG9pbnQgcm9vdCBvZiB0cnVzdCBp cyBlc3RhYmxpc2hlZCwgYXR0ZXN0YXRpb24ga2V5cyBjb3VsZCBzYXkgYWRkaXRpb25hbCB0aGlu Z3MgYWJvdXQgdGhlIHJlc3Qgb2YgdGhlIGVuZHBvaW50LiBGb3IgZXhhbXBsZSwgaG93IGl0IHdp bGwgY29tcHV0ZSBpdHMgbG9jYXRpb24gYW5kIGV2ZW4gaXRzIGN1cnJlbnQgbG9jYXRpb24gY29v cmRpbmF0ZXMuDQoNClNvbWUgbWlnaHQgb2JzZXJ2ZSB0aGF0IHRoZXJlIGFyZSBsb3RzIG9mIHN0 YW5kYXJkcy9mcmFtZXdvcmtzIGZvciBlbmNvZGluZyBsb2NhdGlvbiBjb29yZGluYXRlcyDigJMg dGhhdCBkb27igJl0IHNheSBhbnl0aGluZyBhYm91dCB3aHkgdGhlIHZlcmlmaWVyIHNob3VsZCBi ZWxpZXZlIHRoZXNlIHZhbHVlcy4gQSBwb3NzaWJsZSBzY29waW5nIHF1ZXN0aW9uIGZvciBSQVRT IG1pZ2h0IGFzayB3aGV0aGVyIGl0IG1ha2VzIHNlbnNlIHRvIHNvbHZlIGludGVyb3BlcmFiaWxp dHkgZm9yIHRoZSBteXJpYWQgb2YgcG9zc2libGUgZGF0YSB2YWx1ZXMgdGhhdCBhIGRldmljZSBj b3VsZCBzZW5zZSB2cy4gZm9jdXNpbmcgbW9yZSBvbiDigJhob3figJkgdGhlIGRldmljZSBpcyBh YmxlIHRvIHByb3ZpZGUgdmFsdWVzIGluIGEgd2F5IHRoYXQgaXMgYmVsaWV2YWJsZSB0byB0aGUg dmVyaWZpZXIuDQoNCknigJltIG5vdCBzdWdnZXN0aW5nIGxvY2F0aW9uIGNvb3JkaW5hdGVzIHNo b3VsZCBiZSBvdXQgb2Ygc2NvcGUgZm9yIFJBVFMuIExvY2F0aW9uIGNvb3JkaW5hdGVzIGFyZSBh IHJlYXNvbmFibGUgY29udGV4dCBmb3Igd2h5IGEgdmVyaWZpZXIgbWlnaHQgbm90IGJlbGlldmUg c29tZSBvdGhlciB2YWx1ZXMgdGhhdCBhcmUgY29tbXVuaWNhdGVkIHRvIGl0LiBIb3dldmVyLCBp ZiBsb2NhdGlvbiBjb29yZGluYXRlcyBhcmUgbm90IGFjY29tcGFuaWVkIGJ5IGFkZGl0aW9uYWwg Y2xhaW1zIHRoYXQgZXhwbGFpbiB3aHkgaXQgaXMgcmVhc29uYWJsZSB0byB0cnVzdCB0aGVpciB2 YWx1ZSwgdGhlIGNvb3JkaW5hdGVzIGJ5IHRoZW1zZWx2ZXMgZG9u4oCZdCBlcXVhdGUgdG8gYXR0 ZXN0YXRpb24uIE90aGVyd2lzZSwgd2UgY2FuIHBvaW50IHRvIGFuIElvVCBmcmFtZXdvcmsgdGhh dCBlbmNvZGVzIGxvY2F0aW9uIGNvb3JkaW5hdGVzIGFuZCBjYWxsIGl0IGEgZGF5Lg0KDQotTmVk DQoNCg0KT24gOC81LzE5LCAzOjM5IEFNLCAiUkFUUyBvbiBiZWhhbGYgb2YgS2F0aGxlZW4gTW9y aWFydHkiIDxyYXRzLWJvdW5jZXNAaWV0Zi5vcmc8bWFpbHRvOnJhdHMtYm91bmNlc0BpZXRmLm9y Zz4gb24gYmVoYWxmIG9mIGthdGhsZWVuLm1vcmlhcnR5LmlldGZAZ21haWwuY29tPG1haWx0bzpr YXRobGVlbi5tb3JpYXJ0eS5pZXRmQGdtYWlsLmNvbT4+IHdyb3RlOg0KDQpDaGFpciBoYXQgb2Zm Lg0KDQpMYXVyZW5jZSBoYXMgYW4gaW50ZXJlc3RpbmcgcG9pbnQuICBJbiB0aGUgUEtJIHNwYWNl LCB0aGUgSUVURiBkZWZpbmVkIGEgcG9saWN5IHByb2ZpbGUuICBUaGUgcHJvZmlsZSBjb3VsZCBi ZSBmaWxsZWQgb3V0IGhvd2V2ZXIgdGhlIGVudGl0eSB3YW50ZWQuICBUaGVuIGl0IGNvdWxkIGJl IGF1ZGl0ZWQgdG8gbWVldCBhc3N1cmFuY2UgbGV2ZWwgcmVxdWlyZW1lbnRzIHRoYXQgYXJlIGRl ZmluZWQgYnkgTklTVC4gIEknbSBub3Qgc3VyZSBpZiB0aGUgc2FtZSBhc3N1cmFuY2UgbGV2ZWxz IHdlcmUgdXNlZCBnbG9iYWxseSBvciBpZiB0aGVyZSBhcmUgb3RoZXIgZGVmaW5lZCBhc3N1cmFu Y2UgbGV2ZWxzLiAgVGhlcmUgYXJlIGFsc28gbGV2ZWxzIG9mIGF1dGhlbnRpY2F0aW9uIGRlZmlu ZWQgYnkgTklTVCBhcyB3ZWxsIGFzIGxldmVscyBvZiBpZGVudGl0eSBwcm9vZmluZy4gIEFzIGl0 IHR1cm5zIG91dCwgd2UgZGlkIG5lZWQgYWxsIG9mIHRob3NlIGxldmVscyBhcyB0aGVyZSB3ZXJl IHVzZSBjYXNlcyBmb3IgZWFjaC4NCg0KVG8gQW5kZXJzIHBvaW50LCB3aHkgd291bGQgSSB3YW50 IGEgZGV2aWNlIHdpdGggbm8gcm9vdCBvZiB0cnVzdD8gIFBsYXVzaWJsZSBkZW5pYWJpbGl0eSBw ZXJoYXBzPyBMb3dlciBjb3N0Pw0KV2h5IHdvdWxkIEkgd2FudCB0byBzZWxsIHN1Y2ggYSBkZXZp Y2U/ICBJIHByb2JhYmx5IHdvdWxkbid0IGFuZCB0aGlzIGNvdWxkIHNwdXIgb24gaGlnaGVyIGxl dmVsIG9mIGFzc3VyYW5jZSBhbmQgcmVtYWtlIG9mIGRldmljZXMgd2l0aG91dCB0aGlzIGNhcGFi aWxpdHkgZGVwZW5kaW5nIG9uIHRoZSB0YXJnZXQgbWFya2V0IGZvciBhIGRldmljZS4NCg0KSWYg d2Ugd2VudCB0aGlzIHJvdXRlLCB3aGljaCBvcmdhbml6YXRpb24gc2hvdWxkIGRlZmluZSB0aGUg YXNzdXJhbmNlIGxldmVscz8gIEknZCBwZXJzb25hbGx5IGxpa2UgdG8gc2VlIHRoZW0gb3Blbmx5 IGRlZmluZWQgYW5kIHB1Ymxpc2hlZC4gIFBlcmhhcHMgaXQncyBOSVNUPw0KDQpJZiB0aGUgSUVU RiB3ZXJlIHRvIGRvIHRoaXMsIEkgd291bGRuJ3QgcHV0IGl0IG91dCBvZiBzY29wZSwgYnV0IG1h eSByZXF1aXJlIHRoZSByZWRlZmluaXRpb24gb2Ygb3VyIHRocmVhdCBtb2RlbCB0byBzcGVlZCB1 cC4gIEVuZCBwb2ludCBpcyBhIGdhcCBpbiBvdXIgbW9kZWwgdGhhdCBoYXMgYmVlbiByYWlzZWQg YW5kIHRhbGtlZCBhYm91dCBxdWl0ZSBhIGJpdCBpbiBNb250cmVhbC4gIFRoZSBJRVRGIHdvdWxk bid0IGRvIGF1ZGl0cyBhZ2FpbnN0IGRlZmluZWQgbGV2ZWxzLCBidXQgaWYgdGhlcmUncyBvbmx5 IDIgLSB3aXRoIGFuZCB3aXRob3V0IGEgcm9vdCBvZiB0cnVzdCBhbmQgd2UgbGVmdCBhbnl0aGlu ZyBtb3JlIGNvbXBsZXggdG8gTklTVCwgVENHLCBldGMuLCBtYXliZSB0aGlzIHdvdWxkIGJlIG9r YXkuICBIb3cgaXQncyB3b3JkZWQgaW4gdGhlIGRvY3VtZW50IHdvdWxkIG1hdHRlciBhbmQgaWYg d2UgcGxhaW5seSBzdGF0ZSBpdCBhcyBhIGRlZmluaXRpb24gd2l0aCByb290IG9mIHRydXN0IGFu ZCB3aXRob3V0LCB3ZSBtYXkgYmUgZmluZS4gIEluIHRoYXQgY2FzZSwgd2UnZCBkZXRhaWwgb3V0 IGRpZmZlcmVuY2VzIGluIHRoZSBzZWN1cml0eSBjb25zaWRlcmF0aW9ucyBzZWN0aW9uIG9mIGEg ZG9jdW1lbnQgdGhhdCBkaWQgdGhpcy4NCg0KV2UgaGFkIGEgc2ltaWxhciBkaXNjdXNzaW9uIGlu IHRoZSBJb1Qgc3BhY2Ugd2l0aCBsaWdodGluZy4gIEknZCBwcmVmZXIgdG8gc2VlIGJvdGggbGV2 ZWxzIGRlZmluZWQgYWxvbmcgd2l0aCBzZWN1cml0eSBjb25zaWRlcmF0aW9ucyByYXRoZXIgdGhh biByYXQgaG9sZSBvbiB0aGUgbmVlZCBmb3IgYWx3YXlzIGhhdmluZyBwZXJmZWN0IHNlY3VyaXR5 LiAgV2UgYXJlIG1ha2luZyBkZXBsb3ltZW50IHByb2dyZXNzIHdpdGggQUNNRSAobm90ZTogaXQg Y2FuIHN1cHBvcnQgYW55IGxldmVsIG9mIGNlcnRpZmljYXRlLCBqdXN0IHJlcXVpcmVzIGFkZGl0 aW9uYWwgb3ZlcmhlYWQpIGFuZCBvdGhlciBlZmZvcnRzIHdoZW4gdGhlcmUgaXMgYmV0dGVyIHNl Y3VyaXR5IHRoYW4gdXNpbmcgbm90aGluZywgYnV0IGl0IG1heSBub3QgYmUgcGVyZmVjdC4gIFRo ZSBiYXIgaGFzIGJlZW4gbG93ZXJlZCB3aXRoIFBNLCBhbmQgYXMgYSByZXN1bHQsIHdlIGFyZSBz ZWVpbmcgYmV0dGVyIGRlcGxveW1lbnQuDQoNCkFDTUUgcmVsaWVzIG9uIGNlcnRpZmljYXRlIHR5 cGUgZGVmaW5pdGlvbnMgdGhhdCBhcmUgZXh0ZXJuYWwgdG8gdGhlIElFVEYgdGhhdCBhcmUgb25s eSBsaWdodGx5IG1lbnRpb25lZCBpbiB0aGUgcHVibGljYXRpb25zLg0KDQpCZXN0IHJlZ2FyZHMs DQpLYXRobGVlbg0KDQpPbiBNb24sIEF1ZyA1LCAyMDE5IGF0IDI6MjEgQU0gQW5kZXJzIFJ1bmRn cmVuIDxhbmRlcnMucnVuZGdyZW4ubmV0QGdtYWlsLmNvbTxtYWlsdG86YW5kZXJzLnJ1bmRncmVu Lm5ldEBnbWFpbC5jb20+PiB3cm90ZToNCkhpIExhdXJlbmNlLA0KDQpJIHN0aWxsIGRvbid0IGdl dCBpdC4gIElNSE8gdGhlcmUgbXVzdCBiZSBzb21lIGtpbmQgUm9UIGZvciBhbiBhdHRlc3RhdGlv biB0byBiZSBvZiBhbnkgdXNlLg0KDQpJZiB0aGUgUm9UIHNvdXJjZSBpcyB3ZWFrLCBidWdneSwg aW5mZXJpb3IgZXRjLiBzaG91bGQgYmUgb3V0IG9mIHNjb3BlIGZvciB0aGUgc3BlY2lmaWNhdGlv bjsgaXQgaXMgYW4gYXBwbGljYXRpb24gY29uc2lkZXJhdGlvbiBhbmQgYSBwYXJ0IG9mIGVhY2gg UkFUUy9FQVQgcHJvZmlsZS4NCg0KSW4gVExTIHRoZSBhc3N1bXB0aW9uIGlzIHRoYXQgcHJpdmF0 ZSBrZXlzIGFyZSBzdWZmaWNpZW50bHkgcHJvdGVjdGVkIGFuZCB0aGF0IGFyZSBjZXJ0aWZpY2F0 ZXMgaXNzdWVkIGJ5IGtub3duICh0cnVzdGVkKSBDQXMgd2hpY2ggaXMgd2h5IHdlIHRydXN0IFRM Uy4NCkluIHNvbWUgVExTIGluc3RhbGxhdGlvbnMgSSBoYXZlIGJlZW4gd29ya2luZyB3aXRoLCBw cml2YXRlIGtleXMgd2VyZSBpbmRlZWQgbWFuZGF0ZWQgdG8gYmUgaW4gSFNNcy4NCg0KQW5kZXJz DQoNCk9uIDIwMTktMDgtMDUgMDY6NTYsIExhdXJlbmNlIEx1bmRibGFkZSB3cm90ZToNCj4NCj4+ IE9uIEF1ZyA0LCAyMDE5LCBhdCAxMjoxMiBQTSwgQW5kZXJzIFJ1bmRncmVuIDxhbmRlcnMucnVu ZGdyZW4ubmV0QGdtYWlsLi5jb208bWFpbHRvOmFuZGVycy5ydW5kZ3Jlbi5uZXRAZ21haWwuY29t PiA8bWFpbHRvOmFuZGVycy5ydW5kZ3Jlbi5uZXRAZ21haWwuY29tPG1haWx0bzphbmRlcnMucnVu ZGdyZW4ubmV0QGdtYWlsLmNvbT4+PiB3cm90ZToNCj4+DQo+PiBPbiAyMDE5LTA4LTA0IDIwOjM3 LCBMYXVyZW5jZSBMdW5kYmxhZGUgd3JvdGU6DQo+Pj4gQW4gQW5kcm9pZCBwaG9uZSBvZnRlbiBs b29rcyBsaWtlIHRoaXM6DQo+Pj4gLSBMaW51eCAvIEFuZHJvaWQgYXBwcw0KPj4+IC0gTGludXgg a2VybmVsDQo+Pj4gLSBUQeKAmXMgKFRydXN0ZWQgQXBwcyDigJQgYXBwcyBydW5uaW5nIHRoZSBU RUUpDQo+Pj4gLSBURUUga2VybmVsDQo+Pj4gSXQgbXVzdCBiZSBhbGxvd2VkIGZvciBhbnkgb25l IG9mIHRoZXNlIHRvIGdlbmVyYXRlIFJBVFMvRUFUIGF0dGVzdGF0aW9ucy4gSXQgbWlnaHQgYmUg dGhhdCBvbmx5IHRoZSBBbmRyb2lkIGFwcCBnZW5lcmF0ZXMgUkFUUy9FQVQgYXR0ZXN0YXRpb25z LiBUaGlzIHBob25lIGlzIGp1c3Qgb25lIGV4YW1wbGUuIE90aGVyIGRldmljZXMsIGxpa2UgY2Fy cywgbWF5IGJlIHNpbWlsYXIuDQo+Pj4gSWYgdGhlcmUgaXMgYSBub3JtYXRpdmUgb3IgZGVzY3Jp cHRpdmUgdGV4dCBzYXlpbmcgYSByb290IG9mIHRydXN0IGlzIHJlcXVpcmVkIHRvIGdlbmVyYXRl IGFuIGF0dGVzdGF0aW9uLCB0aGVuIHdlIGhhdmUgdG8gcmVkZWZpbmUgcm9vdCBvZiB0cnVzdCB0 byBzbyB0aGF0DQo+Pg0KPj4+IEFuZHJvaWQgYXBwcyBhcmUgcm9vdHMgb2YgdHJ1c3QuDQo+Pg0K Pj4gV2hlcmUgZG9lcyB0aGlzIHRydXN0IGNvbWUgZnJvbSBhbmQgaG93IGlzIGl0IGRlbGl2ZXJl ZCB0byB0aGUgY29uY2VybmVkIHBhcnR5Pw0KPj4NCj4+IEFuZHJvaWQgYXBwcyBhcmUgc2lnbmVk IGJ1dCB0aGV5IGFyZSBub3Qgc2hpcHBlZCB3aXRoIGEgcHJpdmF0ZSBrZXkuDQo+Pg0KPj4gQUZB SUNUIGl0IGlzIG9ubHkgdGhlIEFuZHJvaWQgT1Mgd2hvIGNhbiB2b3VjaCBmb3IgYW4gYXBwJ3Mg YXV0aGVudGljaXR5Lg0KPj4NCj4+IEFuZGVycw0KPg0KPiBGb3IgdGhlIGRlZmluaXRpb24gb2Yg YW4gRUFUIHRva2VuIGl0IGRvZXNu4oCZdCBtYXR0ZXIgd2hlcmUgdGhlIHRydXN0IGNvbWVzIGZy b20sIGp1c3QgbGlrZSBpdCBkb2VzbuKAmXQgbWF0dGVyIHdoZXJlIHRydXN0IGNvbWVzIGZyb20g aW4gcHJvdG9jb2wgZGVmaW5pdGlvbnMgZm9yIFRMUywgQ09TRSwgSldULCBDV1QgYW5kIHN1Y2gu IFRoZSAqcHJvdG9jb2wqIGRlZmluaXRpb25zIGRvIG5vdCByZXF1aXJlIG9yIGVzdGFibGlzaCB0 cnVzdC4gVGhleSBtYXkgaGF2ZSBhIG1lYW5zIHRvIGRvIGl0LCBidXQgbm8gYWJzb2x1dGUgdHJ1 c3QgaXMgd3JpdHRlbiBpbnRvIHRoZSBwcm90b2NvbCBkZWZpbml0aW9uLg0KPg0KPiBJ4oCZbSBw cmV0dHkgc3VyZSB0aGVyZeKAmXMgbm90aGluZyBub3JtYXRpdmUgaW4gdGhlIFRMUyBwcm90b2Nv bCBkZWZpbml0aW9uIG9yIG90aGVyIElFVEYgZG9jdW1lbnRzIHRoYXQgcHJvc2NyaWJlcyBob3cg dGhlIHNlY3JldCBrZXkgb24gYSBUTFMgc2VydmVyIGlzIHRvIGJlIHByb3RlY3RlZC4gQSBzZXJ2 ZXIgaW1wbGVtZW50aW5nIFRMUyBjb3VsZCBoYXZlIG5lYXIgemVybyBwcm90ZWN0aW9uIGZvciBp dHMgcHJpdmF0ZSBrZXkgYW5kIHN0aWxsIGJlIGluIGNvbXBsaWFuY2Ugd2l0aCB0aGUgVExTIFJG Qy4gVGhhdCBwcml2YXRlIGtleSBjb3VsZCBldmVuIGhhdmUgYmVlbiBpbnRlbnRpb25hbGx5IHB1 Ymxpc2hlZCBhbmQgdGhlcmUgd291bGQgc3RpbGwgYmUgY29tcGxpYW5jZSB3aXRoIHRoZSBUTFMg cHJvdG9jb2wuDQo+DQo+IFRvIGdvIGluIGEgYml0IGZ1cnRoZXIsIGEgZGVmaW5pdGlvbiBvZiBy b290IG9mIHRydXN0IGlzIG9mdGVuIOKAnHRoZSB0aGluZyB0aGF0IHlvdSBoYXZlIHRvIHRydXN0 IGJlY2F1c2UgdGhlcmUgaXMgbm90aGluZyBtb3JlIHVuZGVybHlpbmcgaXQgdG8gdHJ1c3TigJ0u IFRoaXMgZGVmaW5pdGlvbiBkb2VzbuKAmXQgZ2l2ZSBhbnkgYWJzb2x1dGUgc2Vuc2Ugb2YgdHJ1 c3QuIEl0IGNvdWxkIGJlIGEgdGVycmlibGUgcm9vdCBvZiB0cnVzdCBmdWxsIG9mIGJ1Z3MgYW5k IHN1Y2guIFRoZSB3YXkgeW91IHVzdWFsbHkgYXZvaWQgdGhhdCBpcyB0byBtYWtlIHN1cmUgeW91 ciByb290IG9mIHRydXN0IGlzIGNlcnRpZmllZC4gVGhhdCBpcyBnb29kIGFuZCB1c2VmdWwgaW4g c29tZSB3YXlzLCBidXQgd2UgY2Fu4oCZdCBzYXkgWFggY2VydGlmaWNhdGlvbiBmcm9tIFlZIG9y Z2FuaXphdGlvbiBpcyByZXF1aXJlZCBpbiBub3JtYXRpdmUgdGV4dCBpbiBhIHByb3RvY29sIGRv Y3VtZW50Lg0KPg0KPiBUcnVzdCBkb2VzIG5lZWQgdG8gYmUgZXN0YWJsaXNoZWQgKGJ1dCBub3Qg dGhyb3VnaCBvciBpbiBwcm90b2NvbCBkZWZpbml0aW9uKS4gVHlwaWNhbGx5IHdobyBldmVyIHJl Y2VpdmVzIGEgdG9rZW4gYW5kIHdhbnQgdG8gdHJ1c3QgaXQgd2lsbCBoYXZlIHNvbWUgaG93IG9i dGFpbmVkIHRoZSBuZWNlc3NhcnkgcHVibGljIGtleS4gVGhleSBob3BlZnVsbHkgd2lsbCBhbHNv IGhhdmUgZmlndXJlZCBvdXQgd2hldGhlciB0aGF0IHRoZSB3aG9sZSBkZXZpY2Ugc2lkZSBrZXkg Y3VzdG9keSBhbmQgaGFuZGxpbmcgaXMgZ29vZCBlbm91Z2ggZm9yIHRoZWlyIHB1cnBvc2VzLiBG b3IgZXhhbXBsZSB3aGVuIHRoZXkgZ2V0IHRoYXQgcHVibGljIGtleSB0aGV5IG1heSBjb21lIHRv IGtub3cgdGhhdCB0aGUgY29ycmVzcG9uZGluZyBwcml2YXRlIGtleXMgYXJlIG9ubHkgcHV0IGlu IHRvIEVBTCA1IGNlcnRpZmllZCBkZXZpY2VzLg0KPg0KPiBJIHJlYWxseSBob3BlIHRoYXQgbG90 cyBvZiBleGNlbGxlbnQgcG9saWN5IGFuZCBwcm9maWxlIGRvY3VtZW50cyBhcmUgd3JpdHRlbiBm b3IgZW50aXR5IGF0dGVzdGF0aW9uIHRoYXQgbG9ja3MgZG93biBlbmQtZW5kIHRydXN0d29ydGhp bmVzcy4gRklET+KAmXMgY2VydGlmaWNhdGlvbiBwcm9ncmFtIGlzIG9uZSBleGFtcGxlLiBJdCBz cGVjaWZpZXMgbWluaW11bSBjcnlwdG8sIGtleSBwcm90ZWN0aW9uLCBrZXkgaGFuZGxpbmcgYW5k IHN1Y2ggZm9yIHRoZSBGSURPLXNwZWNpZmljIGF0dGVzdGF0aW9uIGl0IGRvZXMgbm93LiBCdXQg aXQgaXMgbm90IGluIHRoZSBGSURPIHByb3RvY29sIGRlZmluaXRpb24uIEl0IGlzIGNsZWFybHkg c2VwYXJhdGVkLg0KPg0KPiBMTA0KPg0KPg0KPg0KPg0KPg0KDQpfX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KUkFUUyBtYWlsaW5nIGxpc3QNClJBVFNAaWV0 Zi5vcmc8bWFpbHRvOlJBVFNAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFu L2xpc3RpbmZvL3JhdHMNCg0KDQotLQ0KDQpCZXN0IHJlZ2FyZHMsDQpLYXRobGVlbg0K --_000_A4E8245F6A5F4E6DB94041F43E8DBC38intelcom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseTpXaW5nZGluZ3M7DQoJcGFub3NlLTE6NSAwIDAgMCAwIDAgMCAwIDAg MDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0x OjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJp Ow0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCi8qIFN0eWxlIERlZmluaXRpb25z ICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjow aW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1m YW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0K CXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246 dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXttc28t c3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRl cmxpbmU7fQ0KcC5Nc29MaXN0UGFyYWdyYXBoLCBsaS5Nc29MaXN0UGFyYWdyYXBoLCBkaXYuTXNv TGlzdFBhcmFncmFwaA0KCXttc28tc3R5bGUtcHJpb3JpdHk6MzQ7DQoJbWFyZ2luLXRvcDowaW47 DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltYXJnaW4tYm90dG9tOjBpbjsNCgltYXJnaW4tbGVmdDou NWluOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQt ZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnAubXNvbm9ybWFsMCwgbGkubXNvbm9ybWFs MCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6bXNvbm9ybWFsOw0KCW1zby1tYXJn aW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJbXNvLW1hcmdpbi1ib3R0b20t YWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1m YW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTgNCgl7bXNvLXN0 eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2Vy aWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlw ZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0K CXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0K ZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQovKiBMaXN0IERlZmluaXRp b25zICovDQpAbGlzdCBsMA0KCXttc28tbGlzdC1pZDoyMDkwMDQzNjE7DQoJbXNvLWxpc3QtdHlw ZTpoeWJyaWQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOi0xNTU0NjA3MTU4IDk0NzQ0MTIxNCA2 NzY5ODY5MSA2NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2NzY5ODY5MyA2NzY5ODY4OSA2NzY5 ODY5MSA2NzY5ODY5Mzt9DQpAbGlzdCBsMDpsZXZlbDENCgl7bXNvLWxldmVsLXN0YXJ0LWF0OjEy Ow0KCW1zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDotOw0K CW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVm dDsNCgltYXJnaW4tbGVmdDouNzVpbjsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1p bHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJbXNvLWZhcmVhc3QtZm9udC1mYW1pbHk6Q2FsaWJy aTt9DQpAbGlzdCBsMDpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0K CW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVs LW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCW1hcmdpbi1sZWZ0OjEuMjVpbjsNCgl0ZXh0LWluZGVu dDotLjI1aW47DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDMN Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsN Cgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxl ZnQ7DQoJbWFyZ2luLWxlZnQ6MS43NWluOw0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglmb250LWZh bWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6bGV2ZWw0DQoJe21zby1sZXZlbC1udW1iZXItZm9y bWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5v bmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCW1hcmdpbi1sZWZ0OjIuMjVp bjsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGww OmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRl eHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0 aW9uOmxlZnQ7DQoJbWFyZ2luLWxlZnQ6Mi43NWluOw0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCglm b250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwwOmxldmVsNg0KCXttc28tbGV2ZWwt bnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10 YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgltYXJnaW4t bGVmdDozLjI1aW47DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OldpbmdkaW5n czt9DQpAbGlzdCBsMDpsZXZlbDcNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0K CW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJbWFyZ2luLWxlZnQ6My43NWluOw0KCXRleHQtaW5k ZW50Oi0uMjVpbjsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw4DQoJe21z by1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1s ZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCglt YXJnaW4tbGVmdDo0LjI1aW47DQoJdGV4dC1pbmRlbnQ6LS4yNWluOw0KCWZvbnQtZmFtaWx5OiJD b3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0 OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCW1hcmdpbi1sZWZ0OjQuNzVpbjsN Cgl0ZXh0LWluZGVudDotLjI1aW47DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCm9sDQoJe21h cmdpbi1ib3R0b206MGluO30NCnVsDQoJe21hcmdpbi1ib3R0b206MGluO30NCi0tPjwvc3R5bGU+ DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+ DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhlIFJB VFMgY2hhcnRlciBleGNsdWRlcyBkZWZpbml0aW9uIG9mIHRoZSBlbmRwb2ludCBkZXZpY2UgLyB0 cnVzdGVkIGRldmljZS4gVGhpcyBpcyBub3QgdG8gc2F5IHRoYXQgdGhlIGVuZHBvaW50IHdvdWxk buKAmXQgLyBjb3VsZG7igJl0IGhhdmUgYSByb290IG9mIHRydXN0LCB0cnVzdGVkIGV4ZWN1dGlv biBlbnZpcm9ubWVudCAoVEVFKSwgdHJ1c3RlZCBjb21wdXRpbmcgYmFzZSAoVENCKSBvciBpbiBz b21lIHdheQ0KIGJlIHRydXN0d29ydGh5LiAmbmJzcDtUaGUgY291bnRlciBleGFtcGxlIGlzIGFs c28gdHJ1ZS4gVGhlIGVudGl0eSB0aGF0IHBhcnRpY2lwYXRlcyBpbiBhIFJBVFMgZXhjaGFuZ2Ug bWF5IG5vdCBoYXZlIHRoZSB0cnVzdHdvcnRoaW5lc3MgcHJvcGVydGllcyBpbXBvcnRhbnQgdG8g dGhlIHZlcmlmaWVyLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5BIGRlZmluaXRpb24gb2Ygcm9v dCBvZiB0cnVzdCBpczogSXQgaXMgdHJ1c3RlZCBhbHdheXMgdG8gYmVoYXZlIGluIHRoZSBleHBl Y3RlZCBtYW5uZXIsIGJlY2F1c2UgaXRzIG1pc2JlaGF2aW9yIGNhbm5vdCBiZSBkZXRlY3RlZC4N CjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5CeSB0aGlzIGRlZmluaXRpb24gYWxsIGVuZHBvaW50 cyBhcmUgdHJ1c3RlZCAvIGhhcyBhIHJvb3Qgb2YgdHJ1c3QuIFRoZSB2ZXJpZmllciBtdXN0IGRl dGVybWluZSBpZiBpdCBpcyBqdXN0aWZpZWQgaW4gdHJ1c3RpbmcgdGhlIGVuZHBvaW50IGJhc2Vk IG9uIGl0cyByb290LW9mLXRydXN0IGRlZmluaXRpb24uIEZvciBleGFtcGxlLCBpZiB0aGUgZW5k cG9pbnQgZGVmaW5lcyBpdHMgcm9vdCBvZiB0cnVzdCBpbg0KIHRlcm1zIG9mIGEgc29mdHdhcmUg YXBwbGljYXRpb24gKG9ubHkpIHRoZW4gdGhlIHZlcmlmaWVyIGlzIGxpa2VseSBub3QganVzdGlm aWVkIGluIHJlZ2FyZGluZyBpdCBhcyBhIHJvb3Qgb2YgdHJ1c3QsIHNpbmNlIHRoZXJlIGFyZSBt YW55IHBvc3NpYmxlIHdheXMgdG8gY29tcHJvbWlzZSBzb2Z0d2FyZSAoaW4gdGhlIGFic3RyYWN0 KS4NCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGUgdmVyaWZpZXIgd2FudHMgdG8ga25vdyBz b21ldGhpbmcgYWJvdXQgdGhlIGVudGl0eSBpdCBpcyBwb3RlbnRpYWxseSBpbnRlcmFjdGluZyB3 aXRoLCB0aGVyZWZvcmUgaXQgbmVlZHMgYSBjcmVkZW50aWFsIHRoYXQgaWRlbnRpZmllcyB0aGUg ZW50aXR5IGluIHRlcm1zIG9mIGl0cyBjb25zdHJ1Y3Rpb24uIFRoZSB2ZW5kb3IsIHByb2R1Y3Qs IHZlcnNpb24gaW5mbyBpcyBvZnRlbiBhIHJlYXNvbmFibGUgd2F5DQogdG8gZG8gdGhpcy4gVGhl IFZlcmlmaWVyIHdhbnRzIHRvIGNvbm5lY3QgdGhlIHZlbmRvcuKAmXMgaWRlbnRpZmllciB3aXRo IHRoZSBlbnRpdHkgb24gdGhlIHdpcmUsIGhlbmNlIHRoZSB2ZW5kb3IgbWlnaHQgcHJlLXByb3Zp c2lvbiBjcnlwdG9ncmFwaGljIGtleXMgYW5kIGlzc3VlIGNyZWRlbnRpYWxzIHRoYXQgYWxsb3dz IHRoZSB2ZXJpZmllciB0byBjb25uZWN0IHRoZSBmb2xsb3dpbmc6PG86cD48L286cD48L3A+DQo8 dWwgc3R5bGU9Im1hcmdpbi10b3A6MGluIiB0eXBlPSJkaXNjIj4NCjxsaSBjbGFzcz0iTXNvTGlz dFBhcmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi4yNWluO21zby1saXN0OmwwIGxldmVsMSBs Zm8xIj5DdXJyZW50IGVudGl0eSBpbnRlcmFjdGlvbiAoc2Vzc2lvbiBrZXlzLCBjZXJ0aWZpY2F0 ZSk8bzpwPjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFy Z2luLWxlZnQ6LjI1aW47bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEiPkVudGl0eSB0eXBlICh2ZW5k b3IsIHByb2R1Y3QsIHZlcnNpb24pPG86cD48L286cD48L2xpPjxsaSBjbGFzcz0iTXNvTGlzdFBh cmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi4yNWluO21zby1saXN0OmwwIGxldmVsMSBsZm8x Ij5FbnRpdHkgdmVuZG9yIHJlcHV0YXRpb24gKHRydXN0IGFuY2hvciwgY2VydGlmaWNhdGUpDQo8 bzpwPjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjI1aW47bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEiPkNyeXB0b2dyYXBoaWMgYmluZGlu ZyBvZiB0aGUgYWJvdmUuPG86cD48L286cD48L2xpPjwvdWw+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkV2ZW4gaWYgdGhl c2UgcGFyYW1ldGVycyBhcmUgZXZhbHVhdGVkIGJ5IHRoZSBWZXJpZmllciwgaXQgY291bGQgc3Rp bGwgZGVjaWRlIHRoZXJlIGlzbuKAmXQgc3VmZmljaWVudCBiYXNpcyBmb3Igbm9uLWRldGVjdGlv biBvZiBtaXNiZWhhdmlvci4gTWF5YmUgYmVjYXVzZSB0aGUgc2l6ZSBvZiB0aGUgdHJ1c3RlZCBw YXJ0IG9mIGVudGl0eSBoYXMgYW4gYXR0YWNrIHN1cmZhY2UgdGhhdCBpcyB0b28gbGFyZ2UuIFRo ZQ0KIHZlcmlmaWVyIG1pZ2h0IHJlcXVpcmUgYSByb290IG9mIHRydXN0IHRoYXQgaXMgc21hbGxl ciBvciBoYXJkZW5lZCBpbiBhIHBhcnRpY3VsYXIgd2F5LiBUaGUgdmVyaWZpZXIgbWF5IHJlcXVp cmUgYSBkaWZmZXJlbnQgY29tcG9uZW50IG9yIFRFRSB0byBiZSB0aGUgc3RhcnRpbmcgcG9pbnQg cm9vdCBvZiB0cnVzdCwgaGVuY2UgaXQgbWF5IGV4cGVjdCBhIGRpZmZlcmVudCAodmVuZG9yLCBw cm9kdWN0LCB2ZXJzaW9uKSBlbnRpdHkgdHlwZSBhcw0KIGl0cyBzdGFydGluZyBwb2ludC4gPG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uY2UgYSBzdGFydGluZyBwb2ludCByb290IG9mIHRydXN0 IGlzIGVzdGFibGlzaGVkLCBhdHRlc3RhdGlvbiBrZXlzIGNvdWxkIHNheSBhZGRpdGlvbmFsIHRo aW5ncyBhYm91dCB0aGUgcmVzdCBvZiB0aGUgZW5kcG9pbnQuIEZvciBleGFtcGxlLCBob3cgaXQg d2lsbCBjb21wdXRlIGl0cyBsb2NhdGlvbiBhbmQgZXZlbiBpdHMgY3VycmVudCBsb2NhdGlvbiBj b29yZGluYXRlcy4NCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Tb21lIG1pZ2h0IG9ic2VydmUg dGhhdCB0aGVyZSBhcmUgbG90cyBvZiBzdGFuZGFyZHMvZnJhbWV3b3JrcyBmb3IgZW5jb2Rpbmcg bG9jYXRpb24gY29vcmRpbmF0ZXMg4oCTIHRoYXQgZG9u4oCZdCBzYXkgYW55dGhpbmcgYWJvdXQg d2h5IHRoZSB2ZXJpZmllciBzaG91bGQgYmVsaWV2ZSB0aGVzZSB2YWx1ZXMuIEEgcG9zc2libGUg c2NvcGluZyBxdWVzdGlvbiBmb3IgUkFUUyBtaWdodCBhc2sgd2hldGhlciBpdCBtYWtlcw0KIHNl bnNlIHRvIHNvbHZlIGludGVyb3BlcmFiaWxpdHkgZm9yIHRoZSBteXJpYWQgb2YgcG9zc2libGUg ZGF0YSB2YWx1ZXMgdGhhdCBhIGRldmljZSBjb3VsZCBzZW5zZSB2cy4gZm9jdXNpbmcgbW9yZSBv biDigJhob3figJkgdGhlIGRldmljZSBpcyBhYmxlIHRvIHByb3ZpZGUgdmFsdWVzIGluIGEgd2F5 IHRoYXQgaXMgYmVsaWV2YWJsZSB0byB0aGUgdmVyaWZpZXIuDQo8bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+SeKAmW0gbm90IHN1Z2dlc3RpbmcgbG9jYXRpb24gY29vcmRpbmF0ZXMgc2hvdWxkIGJl IG91dCBvZiBzY29wZSBmb3IgUkFUUy4gTG9jYXRpb24gY29vcmRpbmF0ZXMgYXJlIGEgcmVhc29u YWJsZSBjb250ZXh0IGZvciB3aHkgYSB2ZXJpZmllciBtaWdodCBub3QgYmVsaWV2ZSBzb21lIG90 aGVyIHZhbHVlcyB0aGF0IGFyZSBjb21tdW5pY2F0ZWQgdG8gaXQuIEhvd2V2ZXIsIGlmIGxvY2F0 aW9uIGNvb3JkaW5hdGVzDQogYXJlIG5vdCBhY2NvbXBhbmllZCBieSBhZGRpdGlvbmFsIGNsYWlt cyB0aGF0IGV4cGxhaW4gd2h5IGl0IGlzIHJlYXNvbmFibGUgdG8gdHJ1c3QgdGhlaXIgdmFsdWUs IHRoZSBjb29yZGluYXRlcyBieSB0aGVtc2VsdmVzIGRvbuKAmXQgZXF1YXRlIHRvIGF0dGVzdGF0 aW9uLiBPdGhlcndpc2UsIHdlIGNhbiBwb2ludCB0byBhbiBJb1QgZnJhbWV3b3JrIHRoYXQgZW5j b2RlcyBsb2NhdGlvbiBjb29yZGluYXRlcyBhbmQgY2FsbCBpdCBhIGRheS4NCjxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj4tTmVkPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbiI+T24gOC81LzE5LCAzOjM5IEFNLCAmcXVvdDtSQVRTIG9uIGJlaGFsZiBvZiBL YXRobGVlbiBNb3JpYXJ0eSZxdW90OyAmbHQ7PGEgaHJlZj0ibWFpbHRvOnJhdHMtYm91bmNlc0Bp ZXRmLm9yZyI+cmF0cy1ib3VuY2VzQGlldGYub3JnPC9hPiBvbiBiZWhhbGYgb2YNCjxhIGhyZWY9 Im1haWx0bzprYXRobGVlbi5tb3JpYXJ0eS5pZXRmQGdtYWlsLmNvbSI+a2F0aGxlZW4ubW9yaWFy dHkuaWV0ZkBnbWFpbC5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPkNoYWlyIGhhdCBvZmYuIDxvOnA+PC9vOnA+ PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWlu Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5MYXVyZW5jZSBoYXMgYW4gaW50ZXJlc3Rpbmcg cG9pbnQuJm5ic3A7IEluIHRoZSBQS0kgc3BhY2UsIHRoZSBJRVRGIGRlZmluZWQgYSBwb2xpY3kg cHJvZmlsZS4mbmJzcDsgVGhlIHByb2ZpbGUgY291bGQgYmUgZmlsbGVkIG91dCBob3dldmVyIHRo ZSBlbnRpdHkgd2FudGVkLiZuYnNwOyBUaGVuIGl0IGNvdWxkIGJlIGF1ZGl0ZWQgdG8gbWVldCBh c3N1cmFuY2UgbGV2ZWwgcmVxdWlyZW1lbnRzDQogdGhhdCBhcmUgZGVmaW5lZCBieSBOSVNULiZu YnNwOyBJJ20gbm90IHN1cmUgaWYgdGhlIHNhbWUgYXNzdXJhbmNlIGxldmVscyB3ZXJlIHVzZWQg Z2xvYmFsbHkgb3IgaWYgdGhlcmUgYXJlIG90aGVyIGRlZmluZWQgYXNzdXJhbmNlIGxldmVscy4m bmJzcDsgVGhlcmUgYXJlIGFsc28gbGV2ZWxzIG9mIGF1dGhlbnRpY2F0aW9uIGRlZmluZWQgYnkg TklTVCBhcyB3ZWxsIGFzIGxldmVscyBvZiBpZGVudGl0eSBwcm9vZmluZy4mbmJzcDsgQXMgaXQg dHVybnMgb3V0LCB3ZSBkaWQNCiBuZWVkIGFsbCBvZiB0aG9zZSBsZXZlbHMgYXMgdGhlcmUgd2Vy ZSB1c2UgY2FzZXMgZm9yIGVhY2guJm5ic3A7Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+VG8gQW5kZXJzIHBvaW50LCB3aHkgd291bGQgSSB3YW50 IGEgZGV2aWNlIHdpdGggbm8gcm9vdCBvZiB0cnVzdD8mbmJzcDsgUGxhdXNpYmxlIGRlbmlhYmls aXR5IHBlcmhhcHM/IExvd2VyIGNvc3Q/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+V2h5IHdvdWxkIEkg d2FudCB0byBzZWxsIHN1Y2ggYSBkZXZpY2U/Jm5ic3A7IEkgcHJvYmFibHkgd291bGRuJ3QgYW5k IHRoaXMgY291bGQgc3B1ciBvbiBoaWdoZXIgbGV2ZWwgb2YgYXNzdXJhbmNlIGFuZCByZW1ha2Ug b2YgZGV2aWNlcyB3aXRob3V0IHRoaXMgY2FwYWJpbGl0eSBkZXBlbmRpbmcgb24gdGhlIHRhcmdl dCBtYXJrZXQgZm9yIGEgZGV2aWNlLiZuYnNwOyZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPklmIHdlIHdlbnQgdGhpcyByb3V0ZSwgd2hpY2ggb3Jn YW5pemF0aW9uIHNob3VsZCBkZWZpbmUgdGhlIGFzc3VyYW5jZSBsZXZlbHM/Jm5ic3A7IEknZCBw ZXJzb25hbGx5IGxpa2UgdG8gc2VlIHRoZW0gb3Blbmx5IGRlZmluZWQgYW5kIHB1Ymxpc2hlZC4m bmJzcDsgUGVyaGFwcyBpdCdzIE5JU1Q/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbiI+SWYgdGhlIElFVEYgd2VyZSB0byBkbyB0aGlzLCBJIHdvdWxkbid0IHB1 dCBpdCBvdXQgb2Ygc2NvcGUsIGJ1dCBtYXkgcmVxdWlyZSB0aGUgcmVkZWZpbml0aW9uIG9mIG91 ciB0aHJlYXQgbW9kZWwgdG8gc3BlZWQgdXAuJm5ic3A7IEVuZCBwb2ludCBpcyBhIGdhcCBpbiBv dXIgbW9kZWwgdGhhdCBoYXMgYmVlbiByYWlzZWQgYW5kIHRhbGtlZCBhYm91dCBxdWl0ZSBhIGJp dCBpbg0KIE1vbnRyZWFsLiZuYnNwOyBUaGUgSUVURiB3b3VsZG4ndCBkbyBhdWRpdHMgYWdhaW5z dCBkZWZpbmVkIGxldmVscywgYnV0IGlmIHRoZXJlJ3Mgb25seSAyIC0gd2l0aCBhbmQgd2l0aG91 dCBhIHJvb3Qgb2YgdHJ1c3QgYW5kIHdlIGxlZnQgYW55dGhpbmcgbW9yZSBjb21wbGV4IHRvIE5J U1QsIFRDRywgZXRjLiwgbWF5YmUgdGhpcyB3b3VsZCBiZSBva2F5LiZuYnNwOyBIb3cgaXQncyB3 b3JkZWQgaW4gdGhlIGRvY3VtZW50IHdvdWxkIG1hdHRlciBhbmQgaWYgd2UNCiBwbGFpbmx5IHN0 YXRlIGl0IGFzIGEgZGVmaW5pdGlvbiB3aXRoIHJvb3Qgb2YgdHJ1c3QgYW5kIHdpdGhvdXQsIHdl IG1heSBiZSBmaW5lLiZuYnNwOyBJbiB0aGF0IGNhc2UsIHdlJ2QgZGV0YWlsIG91dCBkaWZmZXJl bmNlcyBpbiB0aGUgc2VjdXJpdHkgY29uc2lkZXJhdGlvbnMgc2VjdGlvbiBvZiBhIGRvY3VtZW50 IHRoYXQgZGlkIHRoaXMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 LjVpbiI+V2UgaGFkIGEgc2ltaWxhciBkaXNjdXNzaW9uIGluIHRoZSBJb1Qgc3BhY2Ugd2l0aCBs aWdodGluZy4mbmJzcDsgSSdkIHByZWZlciB0byBzZWUgYm90aCBsZXZlbHMgZGVmaW5lZCBhbG9u ZyB3aXRoIHNlY3VyaXR5IGNvbnNpZGVyYXRpb25zIHJhdGhlciB0aGFuIHJhdCBob2xlIG9uIHRo ZSBuZWVkIGZvciBhbHdheXMgaGF2aW5nIHBlcmZlY3Qgc2VjdXJpdHkuJm5ic3A7IFdlIGFyZQ0K IG1ha2luZyBkZXBsb3ltZW50IHByb2dyZXNzIHdpdGggQUNNRSAobm90ZTogaXQgY2FuIHN1cHBv cnQgYW55IGxldmVsIG9mIGNlcnRpZmljYXRlLCBqdXN0IHJlcXVpcmVzIGFkZGl0aW9uYWwgb3Zl cmhlYWQpIGFuZCBvdGhlciBlZmZvcnRzIHdoZW4gdGhlcmUgaXMgYmV0dGVyIHNlY3VyaXR5IHRo YW4gdXNpbmcgbm90aGluZywgYnV0IGl0IG1heSBub3QgYmUgcGVyZmVjdC4mbmJzcDsgVGhlIGJh ciBoYXMgYmVlbiBsb3dlcmVkIHdpdGggUE0sIGFuZCBhcw0KIGEgcmVzdWx0LCB3ZSBhcmUgc2Vl aW5nIGJldHRlciBkZXBsb3ltZW50LiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW4iPkFDTUUgcmVsaWVzIG9uIGNlcnRpZmljYXRlIHR5cGUgZGVmaW5p dGlvbnMgdGhhdCBhcmUgZXh0ZXJuYWwgdG8gdGhlIElFVEYgdGhhdCBhcmUgb25seSBsaWdodGx5 IG1lbnRpb25lZCBpbiB0aGUgcHVibGljYXRpb25zLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPkJlc3QgcmVnYXJkcyw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5L YXRobGVlbjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPk9u IE1vbiwgQXVnIDUsIDIwMTkgYXQgMjoyMSBBTSBBbmRlcnMgUnVuZGdyZW4gJmx0OzxhIGhyZWY9 Im1haWx0bzphbmRlcnMucnVuZGdyZW4ubmV0QGdtYWlsLmNvbSI+YW5kZXJzLnJ1bmRncmVuLm5l dEBnbWFpbC5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2Nr cXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7 cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6 MGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5IaSBM YXVyZW5jZSw8YnI+DQo8YnI+DQpJIHN0aWxsIGRvbid0IGdldCBpdC4mbmJzcDsgSU1ITyB0aGVy ZSBtdXN0IGJlIHNvbWUga2luZCBSb1QgZm9yIGFuIGF0dGVzdGF0aW9uIHRvIGJlIG9mIGFueSB1 c2UuPGJyPg0KPGJyPg0KSWYgdGhlIFJvVCBzb3VyY2UgaXMgd2VhaywgYnVnZ3ksIGluZmVyaW9y IGV0Yy4gc2hvdWxkIGJlIG91dCBvZiBzY29wZSBmb3IgdGhlIHNwZWNpZmljYXRpb247IGl0IGlz IGFuIGFwcGxpY2F0aW9uIGNvbnNpZGVyYXRpb24gYW5kIGEgcGFydCBvZiBlYWNoIFJBVFMvRUFU IHByb2ZpbGUuPGJyPg0KPGJyPg0KSW4gVExTIHRoZSBhc3N1bXB0aW9uIGlzIHRoYXQgcHJpdmF0 ZSBrZXlzIGFyZSBzdWZmaWNpZW50bHkgcHJvdGVjdGVkIGFuZCB0aGF0IGFyZSBjZXJ0aWZpY2F0 ZXMgaXNzdWVkIGJ5IGtub3duICh0cnVzdGVkKSBDQXMgd2hpY2ggaXMgd2h5IHdlIHRydXN0IFRM Uy48YnI+DQpJbiBzb21lIFRMUyBpbnN0YWxsYXRpb25zIEkgaGF2ZSBiZWVuIHdvcmtpbmcgd2l0 aCwgcHJpdmF0ZSBrZXlzIHdlcmUgaW5kZWVkIG1hbmRhdGVkIHRvIGJlIGluIEhTTXMuPGJyPg0K PGJyPg0KQW5kZXJzPGJyPg0KPGJyPg0KT24gMjAxOS0wOC0wNSAwNjo1NiwgTGF1cmVuY2UgTHVu ZGJsYWRlIHdyb3RlOjxicj4NCiZndDsgPGJyPg0KJmd0OyZndDsgT24gQXVnIDQsIDIwMTksIGF0 IDEyOjEyIFBNLCBBbmRlcnMgUnVuZGdyZW4gJmx0OzxhIGhyZWY9Im1haWx0bzphbmRlcnMucnVu ZGdyZW4ubmV0QGdtYWlsLmNvbSIgdGFyZ2V0PSJfYmxhbmsiPmFuZGVycy5ydW5kZ3Jlbi5uZXRA Z21haWwuLmNvbTwvYT4gJmx0O21haWx0bzo8YSBocmVmPSJtYWlsdG86YW5kZXJzLnJ1bmRncmVu Lm5ldEBnbWFpbC5jb20iIHRhcmdldD0iX2JsYW5rIj5hbmRlcnMucnVuZGdyZW4ubmV0QGdtYWls LmNvbTwvYT4mZ3Q7Jmd0OyB3cm90ZTo8YnI+DQomZ3Q7Jmd0Ozxicj4NCiZndDsmZ3Q7IE9uIDIw MTktMDgtMDQgMjA6MzcsIExhdXJlbmNlIEx1bmRibGFkZSB3cm90ZTo8YnI+DQomZ3Q7Jmd0OyZn dDsgQW4gQW5kcm9pZCBwaG9uZSBvZnRlbiBsb29rcyBsaWtlIHRoaXM6PGJyPg0KJmd0OyZndDsm Z3Q7IC0gTGludXggLyBBbmRyb2lkIGFwcHM8YnI+DQomZ3Q7Jmd0OyZndDsgLSBMaW51eCBrZXJu ZWw8YnI+DQomZ3Q7Jmd0OyZndDsgLSBUQeKAmXMgKFRydXN0ZWQgQXBwcyDigJQgYXBwcyBydW5u aW5nIHRoZSBURUUpPGJyPg0KJmd0OyZndDsmZ3Q7IC0gVEVFIGtlcm5lbDxicj4NCiZndDsmZ3Q7 Jmd0OyBJdCBtdXN0IGJlIGFsbG93ZWQgZm9yIGFueSBvbmUgb2YgdGhlc2UgdG8gZ2VuZXJhdGUg UkFUUy9FQVQgYXR0ZXN0YXRpb25zLiBJdCBtaWdodCBiZSB0aGF0IG9ubHkgdGhlIEFuZHJvaWQg YXBwIGdlbmVyYXRlcyBSQVRTL0VBVCBhdHRlc3RhdGlvbnMuIFRoaXMgcGhvbmUgaXMganVzdCBv bmUgZXhhbXBsZS4gT3RoZXIgZGV2aWNlcywgbGlrZSBjYXJzLCBtYXkgYmUgc2ltaWxhci48YnI+ DQomZ3Q7Jmd0OyZndDsgSWYgdGhlcmUgaXMgYSBub3JtYXRpdmUgb3IgZGVzY3JpcHRpdmUgdGV4 dCBzYXlpbmcgYSByb290IG9mIHRydXN0IGlzIHJlcXVpcmVkIHRvIGdlbmVyYXRlIGFuIGF0dGVz dGF0aW9uLCB0aGVuIHdlIGhhdmUgdG8gcmVkZWZpbmUgcm9vdCBvZiB0cnVzdCB0byBzbyB0aGF0 PGJyPg0KJmd0OyZndDs8YnI+DQomZ3Q7Jmd0OyZndDsgQW5kcm9pZCBhcHBzIGFyZSByb290cyBv ZiB0cnVzdC48YnI+DQomZ3Q7Jmd0Ozxicj4NCiZndDsmZ3Q7IFdoZXJlIGRvZXMgdGhpcyB0cnVz dCBjb21lIGZyb20gYW5kIGhvdyBpcyBpdCBkZWxpdmVyZWQgdG8gdGhlIGNvbmNlcm5lZCBwYXJ0 eT88YnI+DQomZ3Q7Jmd0Ozxicj4NCiZndDsmZ3Q7IEFuZHJvaWQgYXBwcyBhcmUgc2lnbmVkIGJ1 dCB0aGV5IGFyZSBub3Qgc2hpcHBlZCB3aXRoIGEgcHJpdmF0ZSBrZXkuPGJyPg0KJmd0OyZndDs8 YnI+DQomZ3Q7Jmd0OyBBRkFJQ1QgaXQgaXMgb25seSB0aGUgQW5kcm9pZCBPUyB3aG8gY2FuIHZv dWNoIGZvciBhbiBhcHAncyBhdXRoZW50aWNpdHkuPGJyPg0KJmd0OyZndDs8YnI+DQomZ3Q7Jmd0 OyBBbmRlcnM8YnI+DQomZ3Q7IDxicj4NCiZndDsgRm9yIHRoZSBkZWZpbml0aW9uIG9mIGFuIEVB VCB0b2tlbiBpdCBkb2VzbuKAmXQgbWF0dGVyIHdoZXJlIHRoZSB0cnVzdCBjb21lcyBmcm9tLCBq dXN0IGxpa2UgaXQgZG9lc27igJl0IG1hdHRlciB3aGVyZSB0cnVzdCBjb21lcyBmcm9tIGluIHBy b3RvY29sIGRlZmluaXRpb25zIGZvciBUTFMsIENPU0UsIEpXVCwgQ1dUIGFuZCBzdWNoLiBUaGUg KnByb3RvY29sKiBkZWZpbml0aW9ucyBkbyBub3QgcmVxdWlyZSBvciBlc3RhYmxpc2ggdHJ1c3Qu IFRoZXkNCiBtYXkgaGF2ZSBhIG1lYW5zIHRvIGRvIGl0LCBidXQgbm8gYWJzb2x1dGUgdHJ1c3Qg aXMgd3JpdHRlbiBpbnRvIHRoZSBwcm90b2NvbCBkZWZpbml0aW9uLjxicj4NCiZndDsgPGJyPg0K Jmd0OyBJ4oCZbSBwcmV0dHkgc3VyZSB0aGVyZeKAmXMgbm90aGluZyBub3JtYXRpdmUgaW4gdGhl IFRMUyBwcm90b2NvbCBkZWZpbml0aW9uIG9yIG90aGVyIElFVEYgZG9jdW1lbnRzIHRoYXQgcHJv c2NyaWJlcyBob3cgdGhlIHNlY3JldCBrZXkgb24gYSBUTFMgc2VydmVyIGlzIHRvIGJlIHByb3Rl Y3RlZC4gQSBzZXJ2ZXIgaW1wbGVtZW50aW5nIFRMUyBjb3VsZCBoYXZlIG5lYXIgemVybyBwcm90 ZWN0aW9uIGZvciBpdHMgcHJpdmF0ZSBrZXkgYW5kIHN0aWxsDQogYmUgaW4gY29tcGxpYW5jZSB3 aXRoIHRoZSBUTFMgUkZDLiBUaGF0IHByaXZhdGUga2V5IGNvdWxkIGV2ZW4gaGF2ZSBiZWVuIGlu dGVudGlvbmFsbHkgcHVibGlzaGVkIGFuZCB0aGVyZSB3b3VsZCBzdGlsbCBiZSBjb21wbGlhbmNl IHdpdGggdGhlIFRMUyBwcm90b2NvbC48YnI+DQomZ3Q7IDxicj4NCiZndDsgVG8gZ28gaW4gYSBi aXQgZnVydGhlciwgYSBkZWZpbml0aW9uIG9mIHJvb3Qgb2YgdHJ1c3QgaXMgb2Z0ZW4g4oCcdGhl IHRoaW5nIHRoYXQgeW91IGhhdmUgdG8gdHJ1c3QgYmVjYXVzZSB0aGVyZSBpcyBub3RoaW5nIG1v cmUgdW5kZXJseWluZyBpdCB0byB0cnVzdOKAnS4gVGhpcyBkZWZpbml0aW9uIGRvZXNu4oCZdCBn aXZlIGFueSBhYnNvbHV0ZSBzZW5zZSBvZiB0cnVzdC4gSXQgY291bGQgYmUgYSB0ZXJyaWJsZSBy b290IG9mIHRydXN0IGZ1bGwgb2YNCiBidWdzIGFuZCBzdWNoLiBUaGUgd2F5IHlvdSB1c3VhbGx5 IGF2b2lkIHRoYXQgaXMgdG8gbWFrZSBzdXJlIHlvdXIgcm9vdCBvZiB0cnVzdCBpcyBjZXJ0aWZp ZWQuIFRoYXQgaXMgZ29vZCBhbmQgdXNlZnVsIGluIHNvbWUgd2F5cywgYnV0IHdlIGNhbuKAmXQg c2F5IFhYIGNlcnRpZmljYXRpb24gZnJvbSBZWSBvcmdhbml6YXRpb24gaXMgcmVxdWlyZWQgaW4g bm9ybWF0aXZlIHRleHQgaW4gYSBwcm90b2NvbCBkb2N1bWVudC48YnI+DQomZ3Q7IDxicj4NCiZn dDsgVHJ1c3QgZG9lcyBuZWVkIHRvIGJlIGVzdGFibGlzaGVkIChidXQgbm90IHRocm91Z2ggb3Ig aW4gcHJvdG9jb2wgZGVmaW5pdGlvbikuIFR5cGljYWxseSB3aG8gZXZlciByZWNlaXZlcyBhIHRv a2VuIGFuZCB3YW50IHRvIHRydXN0IGl0IHdpbGwgaGF2ZSBzb21lIGhvdyBvYnRhaW5lZCB0aGUg bmVjZXNzYXJ5IHB1YmxpYyBrZXkuIFRoZXkgaG9wZWZ1bGx5IHdpbGwgYWxzbyBoYXZlIGZpZ3Vy ZWQgb3V0IHdoZXRoZXIgdGhhdCB0aGUgd2hvbGUNCiBkZXZpY2Ugc2lkZSBrZXkgY3VzdG9keSBh bmQgaGFuZGxpbmcgaXMgZ29vZCBlbm91Z2ggZm9yIHRoZWlyIHB1cnBvc2VzLiBGb3IgZXhhbXBs ZSB3aGVuIHRoZXkgZ2V0IHRoYXQgcHVibGljIGtleSB0aGV5IG1heSBjb21lIHRvIGtub3cgdGhh dCB0aGUgY29ycmVzcG9uZGluZyBwcml2YXRlIGtleXMgYXJlIG9ubHkgcHV0IGluIHRvIEVBTCA1 IGNlcnRpZmllZCBkZXZpY2VzLjxicj4NCiZndDsgPGJyPg0KJmd0OyBJIHJlYWxseSBob3BlIHRo YXQgbG90cyBvZiBleGNlbGxlbnQgcG9saWN5IGFuZCBwcm9maWxlIGRvY3VtZW50cyBhcmUgd3Jp dHRlbiBmb3IgZW50aXR5IGF0dGVzdGF0aW9uIHRoYXQgbG9ja3MgZG93biBlbmQtZW5kIHRydXN0 d29ydGhpbmVzcy4gRklET+KAmXMgY2VydGlmaWNhdGlvbiBwcm9ncmFtIGlzIG9uZSBleGFtcGxl LiBJdCBzcGVjaWZpZXMgbWluaW11bSBjcnlwdG8sIGtleSBwcm90ZWN0aW9uLCBrZXkgaGFuZGxp bmcgYW5kIHN1Y2ggZm9yDQogdGhlIEZJRE8tc3BlY2lmaWMgYXR0ZXN0YXRpb24gaXQgZG9lcyBu b3cuIEJ1dCBpdCBpcyBub3QgaW4gdGhlIEZJRE8gcHJvdG9jb2wgZGVmaW5pdGlvbi4gSXQgaXMg Y2xlYXJseSBzZXBhcmF0ZWQuPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IExMPGJyPg0KJmd0OyA8YnI+ DQomZ3Q7IDxicj4NCiZndDsgPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IDxicj4NCjxicj4NCl9fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0KUkFUUyBtYWls aW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86UkFUU0BpZXRmLm9yZyIgdGFyZ2V0PSJfYmxh bmsiPlJBVFNAaWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcv bWFpbG1hbi9saXN0aW5mby9yYXRzIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly93d3cuaWV0Zi5v cmcvbWFpbG1hbi9saXN0aW5mby9yYXRzPC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3Rl Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+ PGJyIGNsZWFyPSJhbGwiPg0KPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9k aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+LS0gPG86 cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+QmVzdCByZWdhcmRzLDxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0Oi41aW4iPkthdGhsZWVuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9k aXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_A4E8245F6A5F4E6DB94041F43E8DBC38intelcom_-- From nobody Mon Aug 5 19:54:03 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DB9AA120115 for ; Mon, 5 Aug 2019 19:54:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wEKHVVvMzdNm for ; Mon, 5 Aug 2019 19:53:59 -0700 (PDT) Received: from p3plsmtpa11-08.prod.phx3.secureserver.net (p3plsmtpa11-08.prod.phx3.secureserver.net [68.178.252.109]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E58DB120112 for ; Mon, 5 Aug 2019 19:53:58 -0700 (PDT) Received: from [10.20.13.8] ([207.242.54.130]) by :SMTPAUTH: with ESMTPSA id upbqhktpEn3JuupbqhfU2o; Mon, 05 Aug 2019 19:53:58 -0700 From: Laurence Lundblade Message-Id: <8E4ED21F-EE52-4FAF-AFCB-A7624C56ED28@island-resort.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_F6D67613-DBDD-407C-8447-446E99DE8FF1" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Mon, 5 Aug 2019 19:53:57 -0700 In-Reply-To: Cc: Kathleen Moriarty , Anders Rundgren , "rats@ietf.org" To: "Smith, Ned" References: <2DE09A2A-A6EA-4474-9DBE-8D52B523645B@island-resort.com> <987fbfbb-b3f6-c104-878a-b283978ca0f0@gmail.com> <6F1E85F0-35CB-415A-9672-BD3257F59373@island-resort.com> <2c9ebe7b-9826-2d23-6f86-d098b79128d6@gmail.com> X-Mailer: Apple Mail (2.3445.9.1) X-CMAE-Envelope: MS4wfPn4k/3fMozIwYBgsJJbcyiWTn0/AdYXuNTb/PcED84j7Mbos4aeXupF3rEVhM6ufFUJlsN9e05JHWusW6dHtxdupIWmNdYg3WES3Hy0gOPwhN1/lRoL b4i1Xbl0jp2xHlyytuFlHC0aBDHhx4ljrJHQIxxO2FhowsOxohGyV2uEuvD9930c4CzJr8wkGse7HDyDKVCTTKl86ONk2pa9tvQHv56zVCkVEW0/P0gYLXIV 2qKi8LzJS8E9JFN6TFvorani8NzeymJNyGQAzW/3psefxzoL17PsQIfhCxDArMpG Archived-At: Subject: Re: [Rats] No root of trust requirement in RATS/EAT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Aug 2019 02:54:01 -0000 --Apple-Mail=_F6D67613-DBDD-407C-8447-446E99DE8FF1 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On Aug 5, 2019, at 5:49 PM, Smith, Ned wrote: >=20 > A definition of root of trust is: It is trusted always to behave in = the expected manner, because its misbehavior cannot be detected. This definition is very clear and useful in a trusted computing = environment. But note that this definition doesn=E2=80=99t actually say = the security of the root of trust is any good (which is counter to the = way most use the term). It is just a nice way to label the part that you = have to trust. I find the definition much less useful in network protocol environment. = We=E2=80=99re already trusting end points in very big ways. We trust TLS = servers to protect their private keys, encrypting email clients to = protect their keys and so on. Maybe we should call them "points of = trust=E2=80=9D. Most don=E2=80=99t leverage trusted computing = architectures we use them all the time even though they have no root of = trust. We trust them every day with thousands of dollars of value in = stock trading apps and such. I can=E2=80=99t see what this definition means in a networked protocol = environment. It doesn=E2=80=99t seem to elucidate or clarify anything = for me. > =20 > By this definition all endpoints are trusted / has a root of trust. = The verifier must determine if it is justified in trusting the endpoint = based on its root-of-trust definition. For example, if the endpoint = defines its root of trust in terms of a software application (only) then = the verifier is likely not justified in regarding it as a root of trust, = since there are many possible ways to compromise software (in the = abstract). In a way I agree with this. However I think there are two problems in = adopting this view: 1) It is not what most people think. They think it means something like = a TPM chip or a TEE or trusted boot. Using the term this way will cause = confusion. 2) If a root of trust can be anything, then the term loses its worth. It = isn=E2=80=99t saying anything. So why use it? LL (I have more comments, but want to take time to think and write=E2=80=A6)= --Apple-Mail=_F6D67613-DBDD-407C-8447-446E99DE8FF1 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
On = Aug 5, 2019, at 5:49 PM, Smith, Ned <ned.smith@intel.com>= wrote:

A definition of root of trust is: It = is trusted always to behave in the expected manner, because its = misbehavior cannot be detected.

This definition is very clear and useful in a = trusted computing environment. But note that this definition doesn=E2=80=99= t actually say the security of the root of trust is any good (which is = counter to the way most use the term). It is just a nice way to label = the part that you have to trust.

I = find the definition much less useful in network protocol environment. = We=E2=80=99re already trusting end points in very big ways. We trust TLS = servers to protect their private keys,  encrypting email clients to = protect their keys and so on. Maybe we should call them "points of = trust=E2=80=9D. Most don=E2=80=99t leverage trusted computing = architectures we use them all the time even though they have no root of = trust. We trust them every day with thousands of dollars of value in = stock trading apps and such.

I = can=E2=80=99t see what this definition means in a networked protocol = environment. It doesn=E2=80=99t seem to elucidate or clarify anything = for me.


 
By this definition all endpoints are = trusted / has a root of trust. The verifier must determine if it is = justified in trusting the endpoint based on its root-of-trust = definition. For example, if the endpoint defines its root of trust in = terms of a software application (only) then the verifier is likely not = justified in regarding it as a root of trust, since there are many = possible ways to compromise software (in the = abstract).

In= a way I agree with this.  However I think there are two problems = in adopting this view:

1) It is not what most people = think. They think it means something like a TPM chip or a TEE or trusted = boot. Using the term this way will cause confusion.

2) If a root of trust = can be anything, then the term loses its worth. It isn=E2=80=99t saying = anything. So why use it?

LL

(I have more comments, but want to take time to think and = write=E2=80=A6)
= --Apple-Mail=_F6D67613-DBDD-407C-8447-446E99DE8FF1-- From nobody Tue Aug 6 00:20:54 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8053012013B for ; Tue, 6 Aug 2019 00:20:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.501 X-Spam-Level: X-Spam-Status: No, score=-14.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cxKoYXY381JY for ; Tue, 6 Aug 2019 00:20:50 -0700 (PDT) Received: from aer-iport-3.cisco.com (aer-iport-3.cisco.com [173.38.203.53]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EA837120137 for ; Tue, 6 Aug 2019 00:20:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=5193; q=dns/txt; s=iport; t=1565076050; x=1566285650; h=from:message-id:mime-version:subject:date:in-reply-to:cc: to:references; bh=LVQ1aox9UFFyb9UqdIiYUYrucCgmB7O97KWiybJxpvk=; b=aEUIhklOOlfQ3AQo6ks3pKf8PgDriSko7cd8aZFImZlERhyfY5FRHFJJ SXo6maKWSgw/JXePgErzZSNyem+8GXPUpRrU/HwUNe9mfn2OQywlWklx4 sC4TFE856FH8GFQ+UcOGc1GzsUl8JONLrFbXblaI6aqNvZ7kpFpgzlYcA E=; X-Files: signature.asc : 195 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AtAADyKEld/xbLJq1kGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAQGBVgEBAQEBAQsBgRVTgW0BMiqEHoh8iDIlfoY5i0yGGYF?= =?us-ascii?q?nAgcBAQEJAwEBLwEBhD8CgxI3Bg4BAwEBAQQBAQIBBm2FM4VKAQEBAQIBI0c?= =?us-ascii?q?PBQsLBAoKKgICVwYTgyIBgXsPq3yBMoVJhGcQgTQBgVCKKYF/gREnDBOCFwc?= =?us-ascii?q?uPoQRARIBgyoygiYElQuWGQmCHoIfgQ6QchuNRopkoiqDDgIEBgUCFYFmImd?= =?us-ascii?q?xMxoIGxVlAYJBPoELjz89AzCLI4JDAQE?= X-IronPort-AV: E=Sophos;i="5.64,352,1559520000"; d="asc'?scan'208,217";a="15071516" Received: from aer-iport-nat.cisco.com (HELO aer-core-4.cisco.com) ([173.38.203.22]) by aer-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 06 Aug 2019 07:20:47 +0000 Received: from [10.61.221.4] ([10.61.221.4]) by aer-core-4.cisco.com (8.15.2/8.15.2) with ESMTPS id x767Kkp5025053 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Tue, 6 Aug 2019 07:20:47 GMT From: Eliot Lear Message-Id: <148D90BA-036A-4682-B920-4650182E2CB1@cisco.com> Content-Type: multipart/signed; boundary="Apple-Mail=_8FC7F505-C130-48B9-91FB-D234C568E4FB"; protocol="application/pgp-signature"; micalg=pgp-sha1 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Tue, 6 Aug 2019 09:20:45 +0200 In-Reply-To: <8E4ED21F-EE52-4FAF-AFCB-A7624C56ED28@island-resort.com> Cc: "Smith, Ned" , "rats@ietf.org" , Kathleen Moriarty , Anders Rundgren To: Laurence Lundblade References: <2DE09A2A-A6EA-4474-9DBE-8D52B523645B@island-resort.com> <987fbfbb-b3f6-c104-878a-b283978ca0f0@gmail.com> <6F1E85F0-35CB-415A-9672-BD3257F59373@island-resort.com> <2c9ebe7b-9826-2d23-6f86-d098b79128d6@gmail.com> <8E4ED21F-EE52-4FAF-AFCB-A7624C56ED28@island-resort.com> X-Mailer: Apple Mail (2.3445.104.11) X-Outbound-SMTP-Client: 10.61.221.4, [10.61.221.4] X-Outbound-Node: aer-core-4.cisco.com Archived-At: Subject: Re: [Rats] No root of trust requirement in RATS/EAT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Aug 2019 07:20:53 -0000 --Apple-Mail=_8FC7F505-C130-48B9-91FB-D234C568E4FB Content-Type: multipart/alternative; boundary="Apple-Mail=_4A0B8211-90E5-4923-9BF5-8E22AD90A4E4" --Apple-Mail=_4A0B8211-90E5-4923-9BF5-8E22AD90A4E4 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On 6 Aug 2019, at 04:53, Laurence Lundblade = wrote: >=20 > This definition is very clear and useful in a trusted computing = environment. But note that this definition doesn=E2=80=99t actually say = the security of the root of trust is any good (which is counter to the = way most use the term). It is just a nice way to label the part that you = have to trust. The whole point of the word =E2=80=9Ctrust=E2=80=9D is that there is = always some leap of faith, being that security is not perfect. You = either trust ARM or Intel or Microchip or whoever to get it right or you = don=E2=80=99t. > I find the definition much less useful in network protocol = environment. We=E2=80=99re already trusting end points in very big ways. = We trust TLS servers to protect their private keys, encrypting email = clients to protect their keys and so on. Maybe we should call them = "points of trust=E2=80=9D. Most don=E2=80=99t leverage trusted computing = architectures we use them all the time even though they have no root of = trust. We trust them every day with thousands of dollars of value in = stock trading apps and such. What you describe in the above paragraph is not a choice but a = technology limitation. Is your point that you are seeking a = self-asserted root of trust for every system on your network or that you = want trust anchored not in the TEE/OS but above those layers? If so, = what=E2=80=99s the value when the OS is hacked? Eliot --Apple-Mail=_4A0B8211-90E5-4923-9BF5-8E22AD90A4E4 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8

On 6 Aug 2019, at 04:53, Laurence Lundblade <lgl@island-resort.com> wrote:

This definition is very clear = and useful in a trusted computing environment. But note that this = definition doesn=E2=80=99t actually say the security of the root of = trust is any good (which is counter to the way most use the term). It is = just a nice way to label the part that you have to = trust.

The = whole point of the word =E2=80=9Ctrust=E2=80=9D is that there is always = some leap of faith, being that security is not perfect.  You either = trust ARM or Intel or Microchip or whoever to get it right or you = don=E2=80=99t.

I find the definition = much less useful in network protocol environment. We=E2=80=99re already = trusting end points in very big ways. We trust TLS servers to protect = their private keys,  encrypting email clients to protect their keys = and so on. Maybe we should call them "points of trust=E2=80=9D. Most = don=E2=80=99t leverage trusted computing architectures we use them all = the time even though they have no root of trust. We trust them every day = with thousands of dollars of value in stock trading apps and = such.

What you describe in the above paragraph is not a choice but = a technology limitation.  Is your point that you are seeking a = self-asserted root of trust for every system on your network or that you = want trust anchored not in the TEE/OS but above those layers?  If = so, what=E2=80=99s the value when the OS is hacked?

Eliot
= --Apple-Mail=_4A0B8211-90E5-4923-9BF5-8E22AD90A4E4-- --Apple-Mail=_8FC7F505-C130-48B9-91FB-D234C568E4FB Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQTgo4LlIIJ5lIBumWpugA9nE248uAUCXUkqTQAKCRBugA9nE248 uM36AKCDqInO1wVY8iTJRmyPMFNjGEI1wgCeKrbOk1IG+Z6QxKwd+SwwLb4KQSk= =ixnb -----END PGP SIGNATURE----- --Apple-Mail=_8FC7F505-C130-48B9-91FB-D234C568E4FB-- From nobody Tue Aug 6 06:08:31 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EE9AC1201A2 for ; Tue, 6 Aug 2019 06:08:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DDwNZ7brHgsi for ; Tue, 6 Aug 2019 06:08:26 -0700 (PDT) Received: from mail-ot1-x329.google.com (mail-ot1-x329.google.com [IPv6:2607:f8b0:4864:20::329]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7D7961201D2 for ; Tue, 6 Aug 2019 06:08:26 -0700 (PDT) Received: by mail-ot1-x329.google.com with SMTP id d17so92342037oth.5 for ; Tue, 06 Aug 2019 06:08:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=byq++w8bCKE3YuBzG2kCAnEnibZxHSjGXe1GZZ0KlRU=; b=NCiBcFDw43hQzhLwazJQ6QStTJHsw+KInIqWXRRsjvRPIu4pue2nw0tDVsOT0Mj15k s7qUPaRMDLs9jY2aZLyLp+vkfjAiceFWvNMH9Dk1CU/YEKcjHNK6Z+4L/Av4TBzXlxbG ZI5WNQIV+Xv/iRtK5q5oSwzY1ngfA8aCmz9Qqq03xoDdWLTtGkskM92FcNlQ8YjlvMJg QSXk+ej1u+mo3rqYx7D2tbHNGrt0gG6NI2CWbL9C8UOPQlaknRhAkAJfUK00o7iN8aV8 lcMStevdP4nQuyv4yLGcrS9cLgzYcUETfZf4xuPyJ6wCciFtWcbTjukbFAEkBARxn+XV XDBw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=byq++w8bCKE3YuBzG2kCAnEnibZxHSjGXe1GZZ0KlRU=; b=pUfQVkx4nk31DCFBgsM/wZ2PvDwWhG8EMKuHs4gYwOsfuQ0CATUXAyRHEjwO2Y8c53 Q3ypbkCvB5dskzk40tfuBBNtcSnGhATP5ozsw5VhtbEgSVgIJrdv6bjaZScyBZrcpxA/ fZ3vjixcBUsFF+K36xai7guG9IcImI5OTKd5UonNj05cNisDwHRPRS82rYkCD75WDxVU cTKIHVfQL0tD+owVZMbVe6uh5xIiYefhc32bM6ShNiFD4ir2d26jLZYLlvTmKsPv5V5h O5OkGAMnp4lfZQzjFFl4uc4u2fZqy81KXpYQUXu4OcoqrHMNIsXbVfZGL96STCIr7TIx fk2A== X-Gm-Message-State: APjAAAVuUswxO/9IgDFK91Pb2dr0v6lOhwUfBTbwrcAsp/p5nd1WT6Em +/Oz8AhV5stYGF++LihBrypBUnbzoNLFtjfSHT8hJ0+Y X-Google-Smtp-Source: APXvYqwyFLE/YsrsebTSCw6y8YmMZN77jY2FvxeHrXgJTgYJoYEAfFVULuauLnnyNXllRD/83WasinSAwf5+3bvG8zg= X-Received: by 2002:a05:6830:1319:: with SMTP id p25mr3220706otq.224.1565096905887; Tue, 06 Aug 2019 06:08:25 -0700 (PDT) MIME-Version: 1.0 References: <2DE09A2A-A6EA-4474-9DBE-8D52B523645B@island-resort.com> <987fbfbb-b3f6-c104-878a-b283978ca0f0@gmail.com> <6F1E85F0-35CB-415A-9672-BD3257F59373@island-resort.com> <2c9ebe7b-9826-2d23-6f86-d098b79128d6@gmail.com> <8E4ED21F-EE52-4FAF-AFCB-A7624C56ED28@island-resort.com> <148D90BA-036A-4682-B920-4650182E2CB1@cisco.com> In-Reply-To: <148D90BA-036A-4682-B920-4650182E2CB1@cisco.com> From: Kathleen Moriarty Date: Tue, 6 Aug 2019 09:07:49 -0400 Message-ID: To: Eliot Lear Cc: Laurence Lundblade , "Smith, Ned" , "rats@ietf.org" , Anders Rundgren Content-Type: multipart/alternative; boundary="0000000000001d581c058f7285e7" Archived-At: Subject: Re: [Rats] No root of trust requirement in RATS/EAT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Aug 2019 13:08:30 -0000 --0000000000001d581c058f7285e7 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, Aug 6, 2019 at 3:20 AM Eliot Lear wrote: > > > On 6 Aug 2019, at 04:53, Laurence Lundblade wrote= : > > This definition is very clear and useful in a trusted computing > environment. But note that this definition doesn=E2=80=99t actually say t= he > security of the root of trust is any good (which is counter to the way mo= st > use the term). It is just a nice way to label the part that you have to > trust. > > > The whole point of the word =E2=80=9Ctrust=E2=80=9D is that there is alwa= ys some leap of > faith, being that security is not perfect. You either trust ARM or Intel > or Microchip or whoever to get it right or you don=E2=80=99t. > Right, Laurence is pointing out that Ned's definition encompasses systems without the TEE. I may be wrong, but it seems that point was missed in your response. I still think we can use the level model, where you have levels of security assertions depending on implementation and point out the differences in security considerations. We could establish a profile, like PKI, and then leave it to another organization to define levels. We would need to state risks of choices to have a proper security considerations section to align with end point security that is likely to be in the IETF's evolved threat model per Montreal discussions. Best regards, Kathleen > I find the definition much less useful in network protocol environment. > We=E2=80=99re already trusting end points in very big ways. We trust TLS = servers to > protect their private keys, encrypting email clients to protect their ke= ys > and so on. Maybe we should call them "points of trust=E2=80=9D. Most don= =E2=80=99t leverage > trusted computing architectures we use them all the time even though they > have no root of trust. We trust them every day with thousands of dollars = of > value in stock trading apps and such. > > > What you describe in the above paragraph is not a choice but a technology > limitation. Is your point that you are seeking a self-asserted root of > trust for every system on your network or that you want trust anchored no= t > in the TEE/OS but above those layers? If so, what=E2=80=99s the value wh= en the OS > is hacked? > > Eliot > --=20 Best regards, Kathleen --0000000000001d581c058f7285e7 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Aug 6, 2019 at 3:20 AM Eliot = Lear <lear@cisco.com> wrote:


On 6 Au= g 2019, at 04:53, Laurence Lundblade <lgl@island-resort.com> wrote:

This definition is very clear and usef= ul in a trusted computing environment. But note that this definition doesn= =E2=80=99t actually say the security of the root of trust is any good (whic= h is counter to the way most use the term). It is just a nice way to label = the part that you have to trust.

Th= e whole point of the word =E2=80=9Ctrust=E2=80=9D is that there is always s= ome leap of faith, being that security is not perfect.=C2=A0 You either tru= st ARM or Intel or Microchip or whoever to get it right or you don=E2=80=99= t.

Right, Laurence is pointing = out that Ned's definition encompasses systems without the TEE.=C2=A0 I = may be wrong, but it seems that point was missed in your response.

I still think we can use the level model, where you have l= evels of security assertions depending on implementation and point out the = differences in security considerations.=C2=A0 We could establish a profile,= like PKI, and then leave it to another organization to define levels.=C2= =A0 We would need to state risks of choices to have a proper security consi= derations section to align with end point security that is likely to be in = the IETF's evolved threat model per Montreal discussions.=C2=A0

Best regards,
Kathleen


I find the defin= ition much less useful in network protocol environment. We=E2=80=99re alrea= dy trusting end points in very big ways. We trust TLS servers to protect th= eir private keys, =C2=A0encrypting email clients to protect their keys and = so on. Maybe we should call them "points of trust=E2=80=9D. Most don= =E2=80=99t leverage trusted computing architectures we use them all the tim= e even though they have no root of trust. We trust them every day with thou= sands of dollars of value in stock trading apps and such.

What you describe in the above paragraph is not a choi= ce but a technology limitation.=C2=A0 Is your point that you are seeking a = self-asserted root of trust for every system on your network or that you wa= nt trust anchored not in the TEE/OS but above those layers?=C2=A0 If so, wh= at=E2=80=99s the value when the OS is hacked?

Elio= t


--

Best rega= rds,
Kathleen
--0000000000001d581c058f7285e7-- From nobody Tue Aug 6 06:33:18 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 326181201A1 for ; Tue, 6 Aug 2019 06:33:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id had6KBvhU4hZ for ; Tue, 6 Aug 2019 06:33:14 -0700 (PDT) Received: from outgoing-exchange-5.mit.edu (outgoing-exchange-5.mit.edu [18.9.28.59]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5D85C12019C for ; Tue, 6 Aug 2019 06:33:14 -0700 (PDT) Received: from oc11exedge2.exchange.mit.edu (OC11EXEDGE2.EXCHANGE.MIT.EDU [18.9.3.18]) by outgoing-exchange-5.mit.edu (8.14.7/8.12.4) with ESMTP id x76DYeks021766; Tue, 6 Aug 2019 09:34:41 -0400 Received: from w92expo23.exchange.mit.edu (18.7.74.77) by oc11exedge2.exchange.mit.edu (18.9.3.18) with Microsoft SMTP Server (TLS) id 15.0.1293.2; Tue, 6 Aug 2019 09:33:20 -0400 Received: from oc11expo23.exchange.mit.edu (18.9.4.88) by w92expo23.exchange.mit.edu (18.7.74.77) with Microsoft SMTP Server (TLS) id 15.0.1365.1; Tue, 6 Aug 2019 09:33:09 -0400 Received: from oc11expo23.exchange.mit.edu ([18.9.4.88]) by oc11expo23.exchange.mit.edu ([18.9.4.88]) with mapi id 15.00.1365.000; Tue, 6 Aug 2019 09:33:09 -0400 From: Thomas Hardjono To: Kathleen Moriarty , Eliot Lear CC: "rats@ietf.org" , "Smith, Ned" , Laurence Lundblade , Anders Rundgren Thread-Topic: [Rats] No root of trust requirement in RATS/EAT Thread-Index: AQHVSvPUhaEckXFlEkiciiP4Ef5JxKbrnk6AgACjAICAABfBAIAAR+oAgADt6wCAACKkgIAASouAgABg+ID//78XEw== Date: Tue, 6 Aug 2019 13:33:09 +0000 Message-ID: References: <2DE09A2A-A6EA-4474-9DBE-8D52B523645B@island-resort.com> <987fbfbb-b3f6-c104-878a-b283978ca0f0@gmail.com> <6F1E85F0-35CB-415A-9672-BD3257F59373@island-resort.com> <2c9ebe7b-9826-2d23-6f86-d098b79128d6@gmail.com> <8E4ED21F-EE52-4FAF-AFCB-A7624C56ED28@island-resort.com> <148D90BA-036A-4682-B920-4650182E2CB1@cisco.com>, In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.54.222.150] Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Rats] No root of trust requirement in RATS/EAT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Aug 2019 13:33:16 -0000 >>> But note that this definition doesn=92t actually say the security of=20 >>> the root of trust is any good (which is counter to the way most use the= term).=20 >>> It is just a nice way to label the part that you have to trust. So this very question ("root of trust is any good") was discussed in the TC= G in the 1999-2000 timeframe in the context of what is meant by "trust" (wh= at I now call technical-trust, versus legal-trust or business-trust). =20 I think it would be useful for RATS to define *technical-trust* first, befo= re we can decide what's "good" or "bad". This is what the TCG came-up with: =20 -- Something is trusted if: (a) It does one specific function well (over & over again without change); = (NB. this is where designing the function correctly comes into play). (b) Operates unhindered (NB. this is where the non-interference rule & shi= elded locations feature comes in); (c) Is able to report the outcome truthfully (NB. this is where the RTR fea= ture comes in). Example: we all trust our car-brakes (at least the mechanical ones) becaus= e (a) I can open the hood and see the pedal, rods and mechanicals (master c= ylinder, rotor, pads); (b) I can see that the brake pedal operates/pushes t= he brake mechanicals; (c) It works every time correctly. -- thomas -- ________________________________________ From: RATS [rats-bounces@ietf.org] on behalf of Kathleen Moriarty [kathleen= .moriarty.ietf@gmail.com] Sent: Tuesday, August 6, 2019 9:07 AM To: Eliot Lear Cc: rats@ietf.org; Smith, Ned; Laurence Lundblade; Anders Rundgren Subject: Re: [Rats] No root of trust requirement in RATS/EAT On Tue, Aug 6, 2019 at 3:20 AM Eliot Lear > wrote: On 6 Aug 2019, at 04:53, Laurence Lundblade > wrote: This definition is very clear and useful in a trusted computing environment= . But note that this definition doesn=92t actually say the security of the = root of trust is any good (which is counter to the way most use the term). = It is just a nice way to label the part that you have to trust. The whole point of the word =93trust=94 is that there is always some leap o= f faith, being that security is not perfect. You either trust ARM or Intel= or Microchip or whoever to get it right or you don=92t. Right, Laurence is pointing out that Ned's definition encompasses systems w= ithout the TEE. I may be wrong, but it seems that point was missed in your= response. I still think we can use the level model, where you have levels of security= assertions depending on implementation and point out the differences in se= curity considerations. We could establish a profile, like PKI, and then le= ave it to another organization to define levels. We would need to state ri= sks of choices to have a proper security considerations section to align wi= th end point security that is likely to be in the IETF's evolved threat mod= el per Montreal discussions. Best regards, Kathleen I find the definition much less useful in network protocol environment. We= =92re already trusting end points in very big ways. We trust TLS servers to= protect their private keys, encrypting email clients to protect their key= s and so on. Maybe we should call them "points of trust=94. Most don=92t le= verage trusted computing architectures we use them all the time even though= they have no root of trust. We trust them every day with thousands of doll= ars of value in stock trading apps and such. What you describe in the above paragraph is not a choice but a technology l= imitation. Is your point that you are seeking a self-asserted root of trus= t for every system on your network or that you want trust anchored not in t= he TEE/OS but above those layers? If so, what=92s the value when the OS is= hacked? Eliot -- Best regards, Kathleen= From nobody Tue Aug 6 12:01:52 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EC2841201D2 for ; Tue, 6 Aug 2019 12:01:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wyQZQAwSHYi2 for ; Tue, 6 Aug 2019 12:01:48 -0700 (PDT) Received: from mga12.intel.com (mga12.intel.com [192.55.52.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6F8A11200A3 for ; Tue, 6 Aug 2019 12:01:48 -0700 (PDT) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga004.jf.intel.com ([10.7.209.38]) by fmsmga106.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 06 Aug 2019 12:01:48 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.64,353,1559545200"; d="scan'208";a="325725090" Received: from orsmsx103.amr.corp.intel.com ([10.22.225.130]) by orsmga004.jf.intel.com with ESMTP; 06 Aug 2019 12:01:47 -0700 Received: from orsmsx126.amr.corp.intel.com (10.22.240.126) by ORSMSX103.amr.corp.intel.com (10.22.225.130) with Microsoft SMTP Server (TLS) id 14.3.439.0; Tue, 6 Aug 2019 12:01:47 -0700 Received: from orsmsx109.amr.corp.intel.com ([169.254.11.25]) by ORSMSX126.amr.corp.intel.com ([169.254.4.77]) with mapi id 14.03.0439.000; Tue, 6 Aug 2019 12:01:47 -0700 From: "Smith, Ned" To: Thomas Hardjono , Kathleen Moriarty , Eliot Lear CC: "rats@ietf.org" , Laurence Lundblade , Anders Rundgren Thread-Topic: [Rats] No root of trust requirement in RATS/EAT Thread-Index: AQHVSvPjFx1t01pVXEauYmUEMz2sl6br0JiAgACjAICAABfBAIAAR+sAgAB4kQCAAJf9gIAASouAgABg+ICAAAcUgP//5nmA Date: Tue, 6 Aug 2019 19:01:47 +0000 Message-ID: <864C25C7-4584-495C-A6CD-40D7C2207EE9@intel.com> References: <2DE09A2A-A6EA-4474-9DBE-8D52B523645B@island-resort.com> <987fbfbb-b3f6-c104-878a-b283978ca0f0@gmail.com> <6F1E85F0-35CB-415A-9672-BD3257F59373@island-resort.com> <2c9ebe7b-9826-2d23-6f86-d098b79128d6@gmail.com> <8E4ED21F-EE52-4FAF-AFCB-A7624C56ED28@island-resort.com> <148D90BA-036A-4682-B920-4650182E2CB1@cisco.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1b.0.190715 x-originating-ip: [10.24.14.85] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [Rats] No root of trust requirement in RATS/EAT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Aug 2019 19:01:51 -0000 VGhlIGludGVudCBvZiBteSBwcmV2aW91cyByZXBseSB3YXMgdG8gaGF2ZSBhIHNjb3BpbmcgZGlz Y3Vzc2lvbi4gVGhlIFJBVFMgV0cgbGlrZWx5IGRvZXNuJ3QgaGF2ZSByZXNvdXJjZXMgLyBpbnRl cmVzdCAvIGNoYXJ0ZXIgdG8gZGVmaW5lIGRyYWZ0cyBmb3IgZXZlcnkgdG9waWMgcmVsZXZhbnQg dG8gcmVtb3RlIGF0dGVzdGF0aW9uLiBOZXZlcnRoZWxlc3MsIHdlIGNhbiBpZGVudGlmeSB0aGUg dG9waWNzIHdlIGNob3NlIG5vdCB0byBkZWZpbmUgYW5kIGxhYmVsIHRoZW0gc28gdGhhdCB3ZSBo YXZlIGEgdm9jYWJ1bGFyeSB0byB0YWxrIGFib3V0IHRoZW0gKHdpdGhvdXQgY3JlYXRpbmcgZHJh ZnRzIHRoYXQgZGVmaW5lcyB0aGVtKS4gDQoNCkxhdXJlbmNlJ3Mgb3JpZ2luYWwgcG9pbnQgd2Fz IHRoYXQgUm9UIHdhcyBzb21ldGhpbmcgdGhlIFdHIHNob3VsZG4ndCBkZWZpbmUgKGluIGEgZHJh ZnQpIHRvIHdoaWNoIEkgY29uY3VyLiBOZXZlcnRoZWxlc3MsIHRoZXJlIGlzIGEgbmVlZCB0byB0 YWxrIGFib3V0IHRoZSBwYXJ0IG9mIHRoZSBkZXZpY2UgKGVudGl0eSkgd2hlcmUgZGV0ZWN0aW9u IG9mIG1pc2JlaGF2aW9yIGlzIG5vdCBwb3NzaWJsZS4gVGhpcyBwYXJ0IGNhbid0IGJlIGF0dGVz dGVkIChieSBkZWZpbml0aW9uKS4gSWYgd2UgZG9uJ3QgbGlrZSB0aGUgdGVybSByb290IG9mIHRy dXN0IHRoZW4gd2UgY2FuIGludmVudCBzb21ldGhpbmcgZWxzZS4gSWYgd2UgZ28gd2l0aCBzb21l dGhpbmcgbGlrZSAidGhlLWVudGl0eS13aG9zZS1taXNiZWhhdmlvci1jYW5ub3QtYmUtZGV0ZWN0 ZWQiLCB0aGF0IGlzIGxvbmdpc2ggdG8gdHlwZS4gSWYgd2UgZ28gd2l0aCByb290LW9mLXRydXN0 IHRoZW4gaXQgaXMgc29tZXRoaW5nIG1vc3Qgb2YgdGhlIHJlc3Qgb2YgdGhlIGluZHVzdHJ5IHVu ZGVyc3RhbmRzIGlzIHNvbWV0aGluZyB3aG9zZSBtaXNiZWhhdmlvciBjYW4ndCBiZSBkZXRlY3Rl ZCwgdGhvdWdoIHRoZXJlIG1heSBiZSBhZGRpdGlvbmFsIGNvbm5vdGF0aW9ucy4gUkFUUyBXRyBo YXMgdGhlIG9wdGlvbiBvZiBpbmNsdWRpbmcgYSB0ZXJtaW5vbG9neSBzZWN0aW9uIHRoYXQgY2xh cmlmaWVzIGZvciB0aGUgcmVhZGVyIG9mIFJBVFMgZHJhZnRzIHdoYXQgcHJvcGVydGllcyBvZiB0 aGUgdGVybXMgd2UgdXNlIGFyZSBtb3N0IHJlbGV2YW50Lg0KDQpMb29raW5nIGF0IHRoaXMgdG9w aWMgZnJvbSB0aGUgcGVyc3BlY3RpdmUgb2Ygd2hhdCBjYW4gYmUgYXR0ZXN0ZWQsIGl0IHN1Z2dl c3RzIHRoYXQgdGhlIGNsYWltcyBhdHRlc3RlZCBzaG91bGQgYmUgcHJvcGVydGllcyB3aGVyZSBt aXNiZWhhdmlvciBjYW4gYmUgZGV0ZWN0ZWQuIEZvciBleGFtcGxlLCBhIGhhc2ggb2YgZmlybXdh cmUgQSB3aWxsIG5vdCBkZXNjcmliZSBmaXJtd2FyZSBCIGFzIGxvbmcgYXMgdGhlIGhhc2hpbmcg d2FzIHBlcmZvcm1lZCBjb3JyZWN0bHkuIEl0IG1heSBub3QgYmUgcG9zc2libGUgdG8gZGV0ZWN0 IGlmIHRoZSBoYXNoIG9mIEEgd2FzIHBlcmZvcm1lZCBjb3JyZWN0bHkgKHNpbmNlIGFuIGF0dGFj a2VyIGNvdWxkIGhhdmUgaW5wdXQgQiBhbmQgc2FpZCB0aGUgb3V0cHV0IHdhcyBBKSB0aGVyZWZv cmUgdGhhdCBiZWxvbmdzIGluIHRoZSBSb1QuIA0KDQpJdCBpcyBhIHNlY3VyaXR5IGZhdXggcGFz IHRvIGV4cGVjdCB0aGUgZW52aXJvbm1lbnQgcmVwb3J0aW5nIGF0dGVzdGVkIHZhbHVlcyBjYW4g YXR0ZXN0IHRvIGl0cyBvd24gc2VjdXJpdHkgcHJvcGVydGllcy4gVGhlcmUgbmVlZHMgdG8gYmUg ZmluZXIgZ3JhbnVsYXJpdHkgZGVjb21wb3NpdGlvbiB0byBzZXBhcmF0ZSB3aGF0IGlzIHRoZSBS b1QgZnVuY3Rpb25hbGl0eSBmcm9tIHRoZSBhdHRlc3RhYmxlIGZ1bmN0aW9uYWxpdHkuIEhlbmNl LCB0aGUgdGVybSAndHVydGxlcyBhbGwgdGhlIHdheSBkb3duJy4gDQoNClNpbmNlIHRoZSBSQVRT IFdHIHNjb3BlIGRvZXNuJ3QgYW50aWNpcGF0ZSB3YW50aW5nIC8gbmVlZGluZyB0byBkZWZpbmUg c3BlY2lmaWMgdHVydGxlcywgd29ya2luZyBncm91cCBwYXJ0aWNpcGFudHMgc2hvdWxkIGhhdmUg c29tZXRoaW5nIGluIG1pbmQgaW4gdGVybXMgYSB0dXJ0bGUgdGhhdCBpcyBhIHJvb3Qgb2YgdHJ1 c3QgYW5kIGEgdHVydGxlIHRoYXQgaXMgYXR0ZXN0YWJsZS4gVGhleSBjYW4gZm9yd2FyZCBjbGFp bXMgYWJvdXQgdGhlIGF0dGVzdGFibGUgdHVydGxlIGFuZCBhZ3JlZSB0aGF0IHRoZSByb290IG9m IHRydXN0IHR1cnRsZSBjYW4gYmUgaWRlbnRpZmllZCAoZS5nLiB2ZW5kb3IsIG1vZGVsLCB2ZXJz aW9uIC0gYW5kIHNvbWUgd2F5IHRvIGF1dGhlbnRpY2F0ZSB0aGVzZSB2YWx1ZXMpIGJ1dCBpdCBp cyB1cCB0byB0aGUgdmVyaWZpZXIgdG8gaGF2ZSBhIHBvbGljeSBmb3Igd2hhdCBpdCBhY2NlcHRz IGFzIGl0cyByb290LW9mLXRydXN0IHR1cnRsZXMuIFRoZSBSb1QgdHVydGxlIGlzIHRoZSBzdGFy dGluZyBwb2ludCBmb3IgZXZhbHVhdGluZyB0aGUgdHVydGxlcyB0aGF0IGNhbiBiZSBhdHRlc3Rl ZC4gDQoNCi1OZWQNCg0K77u/T24gOC82LzE5LCA2OjMzIEFNLCAiUkFUUyBvbiBiZWhhbGYgb2Yg VGhvbWFzIEhhcmRqb25vIiA8cmF0cy1ib3VuY2VzQGlldGYub3JnIG9uIGJlaGFsZiBvZiBoYXJk am9ub0BtaXQuZWR1PiB3cm90ZToNCg0KICAgIA0KICAgIA0KICAgID4+PiBCdXQgbm90ZSB0aGF0 IHRoaXMgZGVmaW5pdGlvbiBkb2VzbuKAmXQgYWN0dWFsbHkgc2F5IHRoZSBzZWN1cml0eSBvZiAN CiAgICA+Pj4gdGhlIHJvb3Qgb2YgdHJ1c3QgaXMgYW55IGdvb2QgKHdoaWNoIGlzIGNvdW50ZXIg dG8gdGhlIHdheSBtb3N0IHVzZSB0aGUgdGVybSkuIA0KICAgID4+PiBJdCBpcyBqdXN0IGEgbmlj ZSB3YXkgdG8gbGFiZWwgdGhlIHBhcnQgdGhhdCB5b3UgaGF2ZSB0byB0cnVzdC4NCiAgICANCiAg ICBTbyB0aGlzIHZlcnkgcXVlc3Rpb24gKCJyb290IG9mIHRydXN0IGlzIGFueSBnb29kIikgd2Fz IGRpc2N1c3NlZCBpbiB0aGUgVENHIGluIHRoZSAxOTk5LTIwMDAgdGltZWZyYW1lIGluIHRoZSBj b250ZXh0IG9mIHdoYXQgaXMgbWVhbnQgYnkgInRydXN0IiAod2hhdCBJIG5vdyBjYWxsIHRlY2hu aWNhbC10cnVzdCwgdmVyc3VzIGxlZ2FsLXRydXN0IG9yIGJ1c2luZXNzLXRydXN0KS4gIA0KICAg IA0KICAgIEkgdGhpbmsgaXQgd291bGQgYmUgdXNlZnVsIGZvciBSQVRTIHRvIGRlZmluZSAqdGVj aG5pY2FsLXRydXN0KiBmaXJzdCwgYmVmb3JlIHdlIGNhbiBkZWNpZGUgd2hhdCdzICJnb29kIiBv ciAiYmFkIi4NCiAgICANCiAgICBUaGlzIGlzIHdoYXQgdGhlIFRDRyBjYW1lLXVwIHdpdGg6ICAN CiAgICANCiAgICAtLSBTb21ldGhpbmcgaXMgdHJ1c3RlZCBpZjoNCiAgICANCiAgICAoYSkgSXQg ZG9lcyBvbmUgc3BlY2lmaWMgZnVuY3Rpb24gd2VsbCAob3ZlciAmIG92ZXIgYWdhaW4gd2l0aG91 dCBjaGFuZ2UpOyAgKE5CLiB0aGlzIGlzIHdoZXJlIGRlc2lnbmluZyB0aGUgZnVuY3Rpb24gY29y cmVjdGx5IGNvbWVzIGludG8gcGxheSkuDQogICAgDQogICAgKGIpIE9wZXJhdGVzIHVuaGluZGVy ZWQgIChOQi4gdGhpcyBpcyB3aGVyZSB0aGUgbm9uLWludGVyZmVyZW5jZSBydWxlICYgc2hpZWxk ZWQgbG9jYXRpb25zIGZlYXR1cmUgY29tZXMgaW4pOw0KICAgIA0KICAgIChjKSBJcyBhYmxlIHRv IHJlcG9ydCB0aGUgb3V0Y29tZSB0cnV0aGZ1bGx5IChOQi4gdGhpcyBpcyB3aGVyZSB0aGUgUlRS IGZlYXR1cmUgY29tZXMgaW4pLg0KICAgIA0KICAgIA0KICAgIEV4YW1wbGU6ICB3ZSBhbGwgdHJ1 c3Qgb3VyIGNhci1icmFrZXMgKGF0IGxlYXN0IHRoZSBtZWNoYW5pY2FsIG9uZXMpIGJlY2F1c2Ug KGEpIEkgY2FuIG9wZW4gdGhlIGhvb2QgYW5kIHNlZSB0aGUgcGVkYWwsIHJvZHMgYW5kIG1lY2hh bmljYWxzIChtYXN0ZXIgY3lsaW5kZXIsIHJvdG9yLCBwYWRzKTsgKGIpIEkgY2FuIHNlZSB0aGF0 IHRoZSBicmFrZSBwZWRhbCBvcGVyYXRlcy9wdXNoZXMgdGhlIGJyYWtlIG1lY2hhbmljYWxzOyAo YykgSXQgd29ya3MgZXZlcnkgdGltZSBjb3JyZWN0bHkuDQogICAgDQogICAgDQogICAgDQogICAg LS0gdGhvbWFzIC0tDQogICAgDQogICAgDQogICAgDQogICAgDQogICAgDQogICAgX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KICAgIEZyb206IFJBVFMgW3JhdHMtYm91 bmNlc0BpZXRmLm9yZ10gb24gYmVoYWxmIG9mIEthdGhsZWVuIE1vcmlhcnR5IFtrYXRobGVlbi4u bW9yaWFydHkuaWV0ZkBnbWFpbC5jb21dDQogICAgU2VudDogVHVlc2RheSwgQXVndXN0IDYsIDIw MTkgOTowNyBBTQ0KICAgIFRvOiBFbGlvdCBMZWFyDQogICAgQ2M6IHJhdHNAaWV0Zi5vcmc7IFNt aXRoLCBOZWQ7IExhdXJlbmNlIEx1bmRibGFkZTsgQW5kZXJzIFJ1bmRncmVuDQogICAgU3ViamVj dDogUmU6IFtSYXRzXSBObyByb290IG9mIHRydXN0IHJlcXVpcmVtZW50IGluIFJBVFMvRUFUDQog ICAgDQogICAgT24gVHVlLCBBdWcgNiwgMjAxOSBhdCAzOjIwIEFNIEVsaW90IExlYXIgPGxlYXJA Y2lzY28uY29tPG1haWx0bzpsZWFyQGNpc2NvLi5jb20+PiB3cm90ZToNCiAgICANCiAgICANCiAg ICBPbiA2IEF1ZyAyMDE5LCBhdCAwNDo1MywgTGF1cmVuY2UgTHVuZGJsYWRlIDxsZ2xAaXNsYW5k LXJlc29ydC5jb208bWFpbHRvOmxnbEBpc2xhbmQtcmVzb3J0LmNvbT4+IHdyb3RlOg0KICAgIA0K ICAgIFRoaXMgZGVmaW5pdGlvbiBpcyB2ZXJ5IGNsZWFyIGFuZCB1c2VmdWwgaW4gYSB0cnVzdGVk IGNvbXB1dGluZyBlbnZpcm9ubWVudC4uIEJ1dCBub3RlIHRoYXQgdGhpcyBkZWZpbml0aW9uIGRv ZXNu4oCZdCBhY3R1YWxseSBzYXkgdGhlIHNlY3VyaXR5IG9mIHRoZSByb290IG9mIHRydXN0IGlz IGFueSBnb29kICh3aGljaCBpcyBjb3VudGVyIHRvIHRoZSB3YXkgbW9zdCB1c2UgdGhlIHRlcm0p LiBJdCBpcyBqdXN0IGEgbmljZSB3YXkgdG8gbGFiZWwgdGhlIHBhcnQgdGhhdCB5b3UgaGF2ZSB0 byB0cnVzdC4NCiAgICANCiAgICBUaGUgd2hvbGUgcG9pbnQgb2YgdGhlIHdvcmQg4oCcdHJ1c3Ti gJ0gaXMgdGhhdCB0aGVyZSBpcyBhbHdheXMgc29tZSBsZWFwIG9mIGZhaXRoLCBiZWluZyB0aGF0 IHNlY3VyaXR5IGlzIG5vdCBwZXJmZWN0LiAgWW91IGVpdGhlciB0cnVzdCBBUk0gb3IgSW50ZWwg b3IgTWljcm9jaGlwIG9yIHdob2V2ZXIgdG8gZ2V0IGl0IHJpZ2h0IG9yIHlvdSBkb27igJl0Lg0K ICAgIA0KICAgIFJpZ2h0LCBMYXVyZW5jZSBpcyBwb2ludGluZyBvdXQgdGhhdCBOZWQncyBkZWZp bml0aW9uIGVuY29tcGFzc2VzIHN5c3RlbXMgd2l0aG91dCB0aGUgVEVFLiAgSSBtYXkgYmUgd3Jv bmcsIGJ1dCBpdCBzZWVtcyB0aGF0IHBvaW50IHdhcyBtaXNzZWQgaW4geW91ciByZXNwb25zZS4N CiAgICANCiAgICBJIHN0aWxsIHRoaW5rIHdlIGNhbiB1c2UgdGhlIGxldmVsIG1vZGVsLCB3aGVy ZSB5b3UgaGF2ZSBsZXZlbHMgb2Ygc2VjdXJpdHkgYXNzZXJ0aW9ucyBkZXBlbmRpbmcgb24gaW1w bGVtZW50YXRpb24gYW5kIHBvaW50IG91dCB0aGUgZGlmZmVyZW5jZXMgaW4gc2VjdXJpdHkgY29u c2lkZXJhdGlvbnMuICBXZSBjb3VsZCBlc3RhYmxpc2ggYSBwcm9maWxlLCBsaWtlIFBLSSwgYW5k IHRoZW4gbGVhdmUgaXQgdG8gYW5vdGhlciBvcmdhbml6YXRpb24gdG8gZGVmaW5lIGxldmVscy4g IFdlIHdvdWxkIG5lZWQgdG8gc3RhdGUgcmlza3Mgb2YgY2hvaWNlcyB0byBoYXZlIGEgcHJvcGVy IHNlY3VyaXR5IGNvbnNpZGVyYXRpb25zIHNlY3Rpb24gdG8gYWxpZ24gd2l0aCBlbmQgcG9pbnQg c2VjdXJpdHkgdGhhdCBpcyBsaWtlbHkgdG8gYmUgaW4gdGhlIElFVEYncyBldm9sdmVkIHRocmVh dCBtb2RlbCBwZXIgTW9udHJlYWwgZGlzY3Vzc2lvbnMuDQogICAgDQogICAgQmVzdCByZWdhcmRz LA0KICAgIEthdGhsZWVuDQogICAgDQogICAgDQogICAgSSBmaW5kIHRoZSBkZWZpbml0aW9uIG11 Y2ggbGVzcyB1c2VmdWwgaW4gbmV0d29yayBwcm90b2NvbCBlbnZpcm9ubWVudC4gV2XigJlyZSBh bHJlYWR5IHRydXN0aW5nIGVuZCBwb2ludHMgaW4gdmVyeSBiaWcgd2F5cy4gV2UgdHJ1c3QgVExT IHNlcnZlcnMgdG8gcHJvdGVjdCB0aGVpciBwcml2YXRlIGtleXMsICBlbmNyeXB0aW5nIGVtYWls IGNsaWVudHMgdG8gcHJvdGVjdCB0aGVpciBrZXlzIGFuZCBzbyBvbi4gTWF5YmUgd2Ugc2hvdWxk IGNhbGwgdGhlbSAicG9pbnRzIG9mIHRydXN04oCdLiBNb3N0IGRvbuKAmXQgbGV2ZXJhZ2UgdHJ1 c3RlZCBjb21wdXRpbmcgYXJjaGl0ZWN0dXJlcyB3ZSB1c2UgdGhlbSBhbGwgdGhlIHRpbWUgZXZl biB0aG91Z2ggdGhleSBoYXZlIG5vIHJvb3Qgb2YgdHJ1c3QuIFdlIHRydXN0IHRoZW0gZXZlcnkg ZGF5IHdpdGggdGhvdXNhbmRzIG9mIGRvbGxhcnMgb2YgdmFsdWUgaW4gc3RvY2sgdHJhZGluZyBh cHBzIGFuZCBzdWNoLg0KICAgIA0KICAgIFdoYXQgeW91IGRlc2NyaWJlIGluIHRoZSBhYm92ZSBw YXJhZ3JhcGggaXMgbm90IGEgY2hvaWNlIGJ1dCBhIHRlY2hub2xvZ3kgbGltaXRhdGlvbi4gIElz IHlvdXIgcG9pbnQgdGhhdCB5b3UgYXJlIHNlZWtpbmcgYSBzZWxmLWFzc2VydGVkIHJvb3Qgb2Yg dHJ1c3QgZm9yIGV2ZXJ5IHN5c3RlbSBvbiB5b3VyIG5ldHdvcmsgb3IgdGhhdCB5b3Ugd2FudCB0 cnVzdCBhbmNob3JlZCBub3QgaW4gdGhlIFRFRS9PUyBidXQgYWJvdmUgdGhvc2UgbGF5ZXJzPyAg SWYgc28sIHdoYXTigJlzIHRoZSB2YWx1ZSB3aGVuIHRoZSBPUyBpcyBoYWNrZWQ/DQogICAgDQog ICAgRWxpb3QNCiAgICANCiAgICANCiAgICAtLQ0KICAgIA0KICAgIEJlc3QgcmVnYXJkcywNCiAg ICBLYXRobGVlbg0KICAgIF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fDQogICAgUkFUUyBtYWlsaW5nIGxpc3QNCiAgICBSQVRTQGlldGYub3JnDQogICAgaHR0 cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9yYXRzDQogICAgDQoNCg== From nobody Tue Aug 6 15:26:50 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DE03F12008C for ; Tue, 6 Aug 2019 15:26:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LWJ-mRppoJMv for ; Tue, 6 Aug 2019 15:26:47 -0700 (PDT) Received: from outgoing-exchange-5.mit.edu (outgoing-exchange-5.mit.edu [18.9.28.59]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C96CF12006E for ; Tue, 6 Aug 2019 15:26:46 -0700 (PDT) Received: from w92exedge4.exchange.mit.edu (W92EXEDGE4.EXCHANGE.MIT.EDU [18.7.73.16]) by outgoing-exchange-5.mit.edu (8.14.7/8.12.4) with ESMTP id x76MS4ix025511; Tue, 6 Aug 2019 18:28:13 -0400 Received: from oc11expo23.exchange.mit.edu (18.9.4.88) by w92exedge4.exchange.mit.edu (18.7.73.16) with Microsoft SMTP Server (TLS) id 15.0.1293.2; Tue, 6 Aug 2019 18:26:28 -0400 Received: from oc11expo23.exchange.mit.edu (18.9.4.88) by oc11expo23.exchange.mit.edu (18.9.4.88) with Microsoft SMTP Server (TLS) id 15.0.1365.1; Tue, 6 Aug 2019 18:26:37 -0400 Received: from oc11expo23.exchange.mit.edu ([18.9.4.88]) by oc11expo23.exchange.mit.edu ([18.9.4.88]) with mapi id 15.00.1365.000; Tue, 6 Aug 2019 18:26:37 -0400 From: Thomas Hardjono To: "Smith, Ned" , Kathleen Moriarty , Eliot Lear CC: "rats@ietf.org" , Laurence Lundblade , Anders Rundgren Thread-Topic: [Rats] No root of trust requirement in RATS/EAT Thread-Index: AQHVSvPUhaEckXFlEkiciiP4Ef5JxKbrnk6AgACjAICAABfBAIAAR+oAgADt6wCAACKkgIAASouAgABg+ID//78XE4AAo86A///0THA= Date: Tue, 6 Aug 2019 22:26:37 +0000 Message-ID: References: <2DE09A2A-A6EA-4474-9DBE-8D52B523645B@island-resort.com> <987fbfbb-b3f6-c104-878a-b283978ca0f0@gmail.com> <6F1E85F0-35CB-415A-9672-BD3257F59373@island-resort.com> <2c9ebe7b-9826-2d23-6f86-d098b79128d6@gmail.com> <8E4ED21F-EE52-4FAF-AFCB-A7624C56ED28@island-resort.com> <148D90BA-036A-4682-B920-4650182E2CB1@cisco.com> , <864C25C7-4584-495C-A6CD-40D7C2207EE9@intel.com> In-Reply-To: <864C25C7-4584-495C-A6CD-40D7C2207EE9@intel.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [73.167.220.69] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [Rats] No root of trust requirement in RATS/EAT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Aug 2019 22:26:50 -0000 DQoNCkhpIE5lZCwNCg0KPj4+IExhdXJlbmNlJ3Mgb3JpZ2luYWwgcG9pbnQgd2FzIHRoYXQgUm9U IHdhcyBzb21ldGhpbmcgDQo+Pj4gdGhlIFdHIHNob3VsZG4ndCBkZWZpbmUgKGluIGEgZHJhZnQp IHRvIHdoaWNoIEkgY29uY3VyLg0KDQpBZ3JlZS4gVGhpcyB3b3VsZCBzaW1wbGlmeSB0aGUgUkFU UyBkaXNjdXNzaW9uIGFuZCBkcmFmdHMgdHJlbWVuZG91c2x5Lg0KDQoNCj4+PiBpdCBzdWdnZXN0 cyB0aGF0IHRoZSBjbGFpbXMgYXR0ZXN0ZWQgc2hvdWxkIGJlIA0KPj4+IHByb3BlcnRpZXMgd2hl cmUgbWlzYmVoYXZpb3IgY2FuIGJlIGRldGVjdGVkLg0KDQpvaywgYWdyZWUgLS0gSSB0aGluayB0 aGlzIGlzIHR5cGlmaWVkIGJ5IG1vc3Qgb2YgdGhlIHVzZS1jYXNlcyBpbiBSQVRTLg0KDQoNCj4+ PiBTaW5jZSB0aGUgUkFUUyBXRyBzY29wZSBkb2Vzbid0IGFudGljaXBhdGUgd2FudGluZyAvIG5l ZWRpbmcgDQo+Pj4gdG8gZGVmaW5lIHNwZWNpZmljIHR1cnRsZXMsIHdvcmtpbmcgZ3JvdXAgcGFy dGljaXBhbnRzIHNob3VsZCBoYXZlIA0KPj4+IHNvbWV0aGluZyBpbiBtaW5kIGluIHRlcm1zIGEg dHVydGxlIHRoYXQgaXMgYSByb290IG9mIHRydXN0IGFuZCANCj4+PiBhIHR1cnRsZSB0aGF0IGlz IGF0dGVzdGFibGUuDQoNClNvIHRoaXMgbWVhbnMgdGhhdCB0aGUgUkFUUyBhcmNoaXRlY3R1cmUg c2hvdWxkIGFzc3VtZSB0aGUgZXhpc3RlbmNlIG9mIGEgUm9vdCBvZiBUcnVzdCAobWF5YmUgZXZl biBhbiBSVE0gYW5kIFJUUikuDQoNCldvdWxkIGl0IGJlIGZhaXIgdG8gZXhwZWN0IHRoYXQgb3Ro ZXIgUkFUUyBkcmFmdHMgdG8gaW5jbHVkZSBhbiBhc3N1bXB0aW9uIHN0YXRlbWVudCBhYm91dCB0 aGVpciBUdXJ0bGVzPyAodGhhdCB0aGUgZHJhZnQgYXNzdW1lcyB0aGF0IGFuIFJUTSBhbmQgUlRS IGV4aXN0cykuDQoNCg0KLS0gdGhvbWFzIC0tDQoNCg0KDQoNCl9fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX18NCkZyb206IFNtaXRoLCBOZWQgW25lZC5zbWl0aEBpbnRlbC5j b21dDQpTZW50OiBUdWVzZGF5LCBBdWd1c3QgNiwgMjAxOSAzOjAxIFBNDQpUbzogVGhvbWFzIEhh cmRqb25vOyBLYXRobGVlbiBNb3JpYXJ0eTsgRWxpb3QgTGVhcg0KQ2M6IHJhdHNAaWV0Zi5vcmc7 IExhdXJlbmNlIEx1bmRibGFkZTsgQW5kZXJzIFJ1bmRncmVuDQpTdWJqZWN0OiBSZTogW1JhdHNd IE5vIHJvb3Qgb2YgdHJ1c3QgcmVxdWlyZW1lbnQgaW4gUkFUUy9FQVQNCg0KVGhlIGludGVudCBv ZiBteSBwcmV2aW91cyByZXBseSB3YXMgdG8gaGF2ZSBhIHNjb3BpbmcgZGlzY3Vzc2lvbi4gVGhl IFJBVFMgV0cgbGlrZWx5IGRvZXNuJ3QgaGF2ZSByZXNvdXJjZXMgLyBpbnRlcmVzdCAvIGNoYXJ0 ZXIgdG8gZGVmaW5lIGRyYWZ0cyBmb3IgZXZlcnkgdG9waWMgcmVsZXZhbnQgdG8gcmVtb3RlIGF0 dGVzdGF0aW9uLiBOZXZlcnRoZWxlc3MsIHdlIGNhbiBpZGVudGlmeSB0aGUgdG9waWNzIHdlIGNo b3NlIG5vdCB0byBkZWZpbmUgYW5kIGxhYmVsIHRoZW0gc28gdGhhdCB3ZSBoYXZlIGEgdm9jYWJ1 bGFyeSB0byB0YWxrIGFib3V0IHRoZW0gKHdpdGhvdXQgY3JlYXRpbmcgZHJhZnRzIHRoYXQgZGVm aW5lcyB0aGVtKS4NCg0KTGF1cmVuY2UncyBvcmlnaW5hbCBwb2ludCB3YXMgdGhhdCBSb1Qgd2Fz IHNvbWV0aGluZyB0aGUgV0cgc2hvdWxkbid0IGRlZmluZSAoaW4gYSBkcmFmdCkgdG8gd2hpY2gg SSBjb25jdXIuIE5ldmVydGhlbGVzcywgdGhlcmUgaXMgYSBuZWVkIHRvIHRhbGsgYWJvdXQgdGhl IHBhcnQgb2YgdGhlIGRldmljZSAoZW50aXR5KSB3aGVyZSBkZXRlY3Rpb24gb2YgbWlzYmVoYXZp b3IgaXMgbm90IHBvc3NpYmxlLiBUaGlzIHBhcnQgY2FuJ3QgYmUgYXR0ZXN0ZWQgKGJ5IGRlZmlu aXRpb24pLiBJZiB3ZSBkb24ndCBsaWtlIHRoZSB0ZXJtIHJvb3Qgb2YgdHJ1c3QgdGhlbiB3ZSBj YW4gaW52ZW50IHNvbWV0aGluZyBlbHNlLiBJZiB3ZSBnbyB3aXRoIHNvbWV0aGluZyBsaWtlICJ0 aGUtZW50aXR5LXdob3NlLW1pc2JlaGF2aW9yLWNhbm5vdC1iZS1kZXRlY3RlZCIsIHRoYXQgaXMg bG9uZ2lzaCB0byB0eXBlLiBJZiB3ZSBnbyB3aXRoIHJvb3Qtb2YtdHJ1c3QgdGhlbiBpdCBpcyBz b21ldGhpbmcgbW9zdCBvZiB0aGUgcmVzdCBvZiB0aGUgaW5kdXN0cnkgdW5kZXJzdGFuZHMgaXMg c29tZXRoaW5nIHdob3NlIG1pc2JlaGF2aW9yIGNhbid0IGJlIGRldGVjdGVkLCB0aG91Z2ggdGhl cmUgbWF5IGJlIGFkZGl0aW9uYWwgY29ubm90YXRpb25zLiBSQVRTIFdHIGhhcyB0aGUgb3B0aW9u IG9mIGluY2x1ZGluZyBhIHRlcm1pbm9sb2d5IHNlY3Rpb24gdGhhdCBjbGFyaWZpZXMgZm9yIHRo ZSByZWFkZXIgb2YgUkFUUyBkcmFmdHMgd2hhdCBwcm9wZXJ0aWVzIG9mIHRoZSB0ZXJtcyB3ZSB1 c2UgYXJlIG1vc3QgcmVsZXZhbnQuDQoNCkxvb2tpbmcgYXQgdGhpcyB0b3BpYyBmcm9tIHRoZSBw ZXJzcGVjdGl2ZSBvZiB3aGF0IGNhbiBiZSBhdHRlc3RlZCwgaXQgc3VnZ2VzdHMgdGhhdCB0aGUg Y2xhaW1zIGF0dGVzdGVkIHNob3VsZCBiZSBwcm9wZXJ0aWVzIHdoZXJlIG1pc2JlaGF2aW9yIGNh biBiZSBkZXRlY3RlZC4gRm9yIGV4YW1wbGUsIGEgaGFzaCBvZiBmaXJtd2FyZSBBIHdpbGwgbm90 IGRlc2NyaWJlIGZpcm13YXJlIEIgYXMgbG9uZyBhcyB0aGUgaGFzaGluZyB3YXMgcGVyZm9ybWVk IGNvcnJlY3RseS4gSXQgbWF5IG5vdCBiZSBwb3NzaWJsZSB0byBkZXRlY3QgaWYgdGhlIGhhc2gg b2YgQSB3YXMgcGVyZm9ybWVkIGNvcnJlY3RseSAoc2luY2UgYW4gYXR0YWNrZXIgY291bGQgaGF2 ZSBpbnB1dCBCIGFuZCBzYWlkIHRoZSBvdXRwdXQgd2FzIEEpIHRoZXJlZm9yZSB0aGF0IGJlbG9u Z3MgaW4gdGhlIFJvVC4NCg0KSXQgaXMgYSBzZWN1cml0eSBmYXV4IHBhcyB0byBleHBlY3QgdGhl IGVudmlyb25tZW50IHJlcG9ydGluZyBhdHRlc3RlZCB2YWx1ZXMgY2FuIGF0dGVzdCB0byBpdHMg b3duIHNlY3VyaXR5IHByb3BlcnRpZXMuIFRoZXJlIG5lZWRzIHRvIGJlIGZpbmVyIGdyYW51bGFy aXR5IGRlY29tcG9zaXRpb24gdG8gc2VwYXJhdGUgd2hhdCBpcyB0aGUgUm9UIGZ1bmN0aW9uYWxp dHkgZnJvbSB0aGUgYXR0ZXN0YWJsZSBmdW5jdGlvbmFsaXR5LiBIZW5jZSwgdGhlIHRlcm0gJ3R1 cnRsZXMgYWxsIHRoZSB3YXkgZG93bicuDQoNClNpbmNlIHRoZSBSQVRTIFdHIHNjb3BlIGRvZXNu J3QgYW50aWNpcGF0ZSB3YW50aW5nIC8gbmVlZGluZyB0byBkZWZpbmUgc3BlY2lmaWMgdHVydGxl cywgd29ya2luZyBncm91cCBwYXJ0aWNpcGFudHMgc2hvdWxkIGhhdmUgc29tZXRoaW5nIGluIG1p bmQgaW4gdGVybXMgYSB0dXJ0bGUgdGhhdCBpcyBhIHJvb3Qgb2YgdHJ1c3QgYW5kIGEgdHVydGxl IHRoYXQgaXMgYXR0ZXN0YWJsZS4gVGhleSBjYW4gZm9yd2FyZCBjbGFpbXMgYWJvdXQgdGhlIGF0 dGVzdGFibGUgdHVydGxlIGFuZCBhZ3JlZSB0aGF0IHRoZSByb290IG9mIHRydXN0IHR1cnRsZSBj YW4gYmUgaWRlbnRpZmllZCAoZS5nLiB2ZW5kb3IsIG1vZGVsLCB2ZXJzaW9uIC0gYW5kIHNvbWUg d2F5IHRvIGF1dGhlbnRpY2F0ZSB0aGVzZSB2YWx1ZXMpIGJ1dCBpdCBpcyB1cCB0byB0aGUgdmVy aWZpZXIgdG8gaGF2ZSBhIHBvbGljeSBmb3Igd2hhdCBpdCBhY2NlcHRzIGFzIGl0cyByb290LW9m LXRydXN0IHR1cnRsZXMuIFRoZSBSb1QgdHVydGxlIGlzIHRoZSBzdGFydGluZyBwb2ludCBmb3Ig ZXZhbHVhdGluZyB0aGUgdHVydGxlcyB0aGF0IGNhbiBiZSBhdHRlc3RlZC4NCg0KLU5lZA0KDQrv u79PbiA4LzYvMTksIDY6MzMgQU0sICJSQVRTIG9uIGJlaGFsZiBvZiBUaG9tYXMgSGFyZGpvbm8i IDxyYXRzLWJvdW5jZXNAaWV0Zi5vcmcgb24gYmVoYWxmIG9mIGhhcmRqb25vQG1pdC5lZHU+IHdy b3RlOg0KDQoNCg0KICAgID4+PiBCdXQgbm90ZSB0aGF0IHRoaXMgZGVmaW5pdGlvbiBkb2VzbuKA mXQgYWN0dWFsbHkgc2F5IHRoZSBzZWN1cml0eSBvZg0KICAgID4+PiB0aGUgcm9vdCBvZiB0cnVz dCBpcyBhbnkgZ29vZCAod2hpY2ggaXMgY291bnRlciB0byB0aGUgd2F5IG1vc3QgdXNlIHRoZSB0 ZXJtKS4NCiAgICA+Pj4gSXQgaXMganVzdCBhIG5pY2Ugd2F5IHRvIGxhYmVsIHRoZSBwYXJ0IHRo YXQgeW91IGhhdmUgdG8gdHJ1c3QuDQoNCiAgICBTbyB0aGlzIHZlcnkgcXVlc3Rpb24gKCJyb290 IG9mIHRydXN0IGlzIGFueSBnb29kIikgd2FzIGRpc2N1c3NlZCBpbiB0aGUgVENHIGluIHRoZSAx OTk5LTIwMDAgdGltZWZyYW1lIGluIHRoZSBjb250ZXh0IG9mIHdoYXQgaXMgbWVhbnQgYnkgInRy dXN0IiAod2hhdCBJIG5vdyBjYWxsIHRlY2huaWNhbC10cnVzdCwgdmVyc3VzIGxlZ2FsLXRydXN0 IG9yIGJ1c2luZXNzLXRydXN0KS4NCg0KICAgIEkgdGhpbmsgaXQgd291bGQgYmUgdXNlZnVsIGZv ciBSQVRTIHRvIGRlZmluZSAqdGVjaG5pY2FsLXRydXN0KiBmaXJzdCwgYmVmb3JlIHdlIGNhbiBk ZWNpZGUgd2hhdCdzICJnb29kIiBvciAiYmFkIi4NCg0KICAgIFRoaXMgaXMgd2hhdCB0aGUgVENH IGNhbWUtdXAgd2l0aDoNCg0KICAgIC0tIFNvbWV0aGluZyBpcyB0cnVzdGVkIGlmOg0KDQogICAg KGEpIEl0IGRvZXMgb25lIHNwZWNpZmljIGZ1bmN0aW9uIHdlbGwgKG92ZXIgJiBvdmVyIGFnYWlu IHdpdGhvdXQgY2hhbmdlKTsgIChOQi4gdGhpcyBpcyB3aGVyZSBkZXNpZ25pbmcgdGhlIGZ1bmN0 aW9uIGNvcnJlY3RseSBjb21lcyBpbnRvIHBsYXkpLg0KDQogICAgKGIpIE9wZXJhdGVzIHVuaGlu ZGVyZWQgIChOQi4gdGhpcyBpcyB3aGVyZSB0aGUgbm9uLWludGVyZmVyZW5jZSBydWxlICYgc2hp ZWxkZWQgbG9jYXRpb25zIGZlYXR1cmUgY29tZXMgaW4pOw0KDQogICAgKGMpIElzIGFibGUgdG8g cmVwb3J0IHRoZSBvdXRjb21lIHRydXRoZnVsbHkgKE5CLiB0aGlzIGlzIHdoZXJlIHRoZSBSVFIg ZmVhdHVyZSBjb21lcyBpbikuDQoNCg0KICAgIEV4YW1wbGU6ICB3ZSBhbGwgdHJ1c3Qgb3VyIGNh ci1icmFrZXMgKGF0IGxlYXN0IHRoZSBtZWNoYW5pY2FsIG9uZXMpIGJlY2F1c2UgKGEpIEkgY2Fu IG9wZW4gdGhlIGhvb2QgYW5kIHNlZSB0aGUgcGVkYWwsIHJvZHMgYW5kIG1lY2hhbmljYWxzICht YXN0ZXIgY3lsaW5kZXIsIHJvdG9yLCBwYWRzKTsgKGIpIEkgY2FuIHNlZSB0aGF0IHRoZSBicmFr ZSBwZWRhbCBvcGVyYXRlcy9wdXNoZXMgdGhlIGJyYWtlIG1lY2hhbmljYWxzOyAoYykgSXQgd29y a3MgZXZlcnkgdGltZSBjb3JyZWN0bHkuDQoNCg0KDQogICAgLS0gdGhvbWFzIC0tDQoNCg0KDQoN Cg0KICAgIF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCiAgICBGcm9t OiBSQVRTIFtyYXRzLWJvdW5jZXNAaWV0Zi5vcmddIG9uIGJlaGFsZiBvZiBLYXRobGVlbiBNb3Jp YXJ0eSBba2F0aGxlZW4uLm1vcmlhcnR5LmlldGZAZ21haWwuY29tXQ0KICAgIFNlbnQ6IFR1ZXNk YXksIEF1Z3VzdCA2LCAyMDE5IDk6MDcgQU0NCiAgICBUbzogRWxpb3QgTGVhcg0KICAgIENjOiBy YXRzQGlldGYub3JnOyBTbWl0aCwgTmVkOyBMYXVyZW5jZSBMdW5kYmxhZGU7IEFuZGVycyBSdW5k Z3Jlbg0KICAgIFN1YmplY3Q6IFJlOiBbUmF0c10gTm8gcm9vdCBvZiB0cnVzdCByZXF1aXJlbWVu dCBpbiBSQVRTL0VBVA0KDQogICAgT24gVHVlLCBBdWcgNiwgMjAxOSBhdCAzOjIwIEFNIEVsaW90 IExlYXIgPGxlYXJAY2lzY28uY29tPG1haWx0bzpsZWFyQGNpc2NvLi5jb20+PiB3cm90ZToNCg0K DQogICAgT24gNiBBdWcgMjAxOSwgYXQgMDQ6NTMsIExhdXJlbmNlIEx1bmRibGFkZSA8bGdsQGlz bGFuZC1yZXNvcnQuY29tPG1haWx0bzpsZ2xAaXNsYW5kLXJlc29ydC5jb20+PiB3cm90ZToNCg0K ICAgIFRoaXMgZGVmaW5pdGlvbiBpcyB2ZXJ5IGNsZWFyIGFuZCB1c2VmdWwgaW4gYSB0cnVzdGVk IGNvbXB1dGluZyBlbnZpcm9ubWVudC4uIEJ1dCBub3RlIHRoYXQgdGhpcyBkZWZpbml0aW9uIGRv ZXNu4oCZdCBhY3R1YWxseSBzYXkgdGhlIHNlY3VyaXR5IG9mIHRoZSByb290IG9mIHRydXN0IGlz IGFueSBnb29kICh3aGljaCBpcyBjb3VudGVyIHRvIHRoZSB3YXkgbW9zdCB1c2UgdGhlIHRlcm0p LiBJdCBpcyBqdXN0IGEgbmljZSB3YXkgdG8gbGFiZWwgdGhlIHBhcnQgdGhhdCB5b3UgaGF2ZSB0 byB0cnVzdC4NCg0KICAgIFRoZSB3aG9sZSBwb2ludCBvZiB0aGUgd29yZCDigJx0cnVzdOKAnSBp cyB0aGF0IHRoZXJlIGlzIGFsd2F5cyBzb21lIGxlYXAgb2YgZmFpdGgsIGJlaW5nIHRoYXQgc2Vj dXJpdHkgaXMgbm90IHBlcmZlY3QuICBZb3UgZWl0aGVyIHRydXN0IEFSTSBvciBJbnRlbCBvciBN aWNyb2NoaXAgb3Igd2hvZXZlciB0byBnZXQgaXQgcmlnaHQgb3IgeW91IGRvbuKAmXQuDQoNCiAg ICBSaWdodCwgTGF1cmVuY2UgaXMgcG9pbnRpbmcgb3V0IHRoYXQgTmVkJ3MgZGVmaW5pdGlvbiBl bmNvbXBhc3NlcyBzeXN0ZW1zIHdpdGhvdXQgdGhlIFRFRS4gIEkgbWF5IGJlIHdyb25nLCBidXQg aXQgc2VlbXMgdGhhdCBwb2ludCB3YXMgbWlzc2VkIGluIHlvdXIgcmVzcG9uc2UuDQoNCiAgICBJ IHN0aWxsIHRoaW5rIHdlIGNhbiB1c2UgdGhlIGxldmVsIG1vZGVsLCB3aGVyZSB5b3UgaGF2ZSBs ZXZlbHMgb2Ygc2VjdXJpdHkgYXNzZXJ0aW9ucyBkZXBlbmRpbmcgb24gaW1wbGVtZW50YXRpb24g YW5kIHBvaW50IG91dCB0aGUgZGlmZmVyZW5jZXMgaW4gc2VjdXJpdHkgY29uc2lkZXJhdGlvbnMu ICBXZSBjb3VsZCBlc3RhYmxpc2ggYSBwcm9maWxlLCBsaWtlIFBLSSwgYW5kIHRoZW4gbGVhdmUg aXQgdG8gYW5vdGhlciBvcmdhbml6YXRpb24gdG8gZGVmaW5lIGxldmVscy4gIFdlIHdvdWxkIG5l ZWQgdG8gc3RhdGUgcmlza3Mgb2YgY2hvaWNlcyB0byBoYXZlIGEgcHJvcGVyIHNlY3VyaXR5IGNv bnNpZGVyYXRpb25zIHNlY3Rpb24gdG8gYWxpZ24gd2l0aCBlbmQgcG9pbnQgc2VjdXJpdHkgdGhh dCBpcyBsaWtlbHkgdG8gYmUgaW4gdGhlIElFVEYncyBldm9sdmVkIHRocmVhdCBtb2RlbCBwZXIg TW9udHJlYWwgZGlzY3Vzc2lvbnMuDQoNCiAgICBCZXN0IHJlZ2FyZHMsDQogICAgS2F0aGxlZW4N Cg0KDQogICAgSSBmaW5kIHRoZSBkZWZpbml0aW9uIG11Y2ggbGVzcyB1c2VmdWwgaW4gbmV0d29y ayBwcm90b2NvbCBlbnZpcm9ubWVudC4gV2XigJlyZSBhbHJlYWR5IHRydXN0aW5nIGVuZCBwb2lu dHMgaW4gdmVyeSBiaWcgd2F5cy4gV2UgdHJ1c3QgVExTIHNlcnZlcnMgdG8gcHJvdGVjdCB0aGVp ciBwcml2YXRlIGtleXMsICBlbmNyeXB0aW5nIGVtYWlsIGNsaWVudHMgdG8gcHJvdGVjdCB0aGVp ciBrZXlzIGFuZCBzbyBvbi4gTWF5YmUgd2Ugc2hvdWxkIGNhbGwgdGhlbSAicG9pbnRzIG9mIHRy dXN04oCdLiBNb3N0IGRvbuKAmXQgbGV2ZXJhZ2UgdHJ1c3RlZCBjb21wdXRpbmcgYXJjaGl0ZWN0 dXJlcyB3ZSB1c2UgdGhlbSBhbGwgdGhlIHRpbWUgZXZlbiB0aG91Z2ggdGhleSBoYXZlIG5vIHJv b3Qgb2YgdHJ1c3QuIFdlIHRydXN0IHRoZW0gZXZlcnkgZGF5IHdpdGggdGhvdXNhbmRzIG9mIGRv bGxhcnMgb2YgdmFsdWUgaW4gc3RvY2sgdHJhZGluZyBhcHBzIGFuZCBzdWNoLg0KDQogICAgV2hh dCB5b3UgZGVzY3JpYmUgaW4gdGhlIGFib3ZlIHBhcmFncmFwaCBpcyBub3QgYSBjaG9pY2UgYnV0 IGEgdGVjaG5vbG9neSBsaW1pdGF0aW9uLiAgSXMgeW91ciBwb2ludCB0aGF0IHlvdSBhcmUgc2Vl a2luZyBhIHNlbGYtYXNzZXJ0ZWQgcm9vdCBvZiB0cnVzdCBmb3IgZXZlcnkgc3lzdGVtIG9uIHlv dXIgbmV0d29yayBvciB0aGF0IHlvdSB3YW50IHRydXN0IGFuY2hvcmVkIG5vdCBpbiB0aGUgVEVF L09TIGJ1dCBhYm92ZSB0aG9zZSBsYXllcnM/ICBJZiBzbywgd2hhdOKAmXMgdGhlIHZhbHVlIHdo ZW4gdGhlIE9TIGlzIGhhY2tlZD8NCg0KICAgIEVsaW90DQoNCg0KICAgIC0tDQoNCiAgICBCZXN0 IHJlZ2FyZHMsDQogICAgS2F0aGxlZW4NCiAgICBfX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fXw0KICAgIFJBVFMgbWFpbGluZyBsaXN0DQogICAgUkFUU0BpZXRm Lm9yZw0KICAgIGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vcmF0cw0K From nobody Tue Aug 6 15:41:53 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9C70D12008C for ; Tue, 6 Aug 2019 15:41:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id O0LpzKufpqhy for ; Tue, 6 Aug 2019 15:41:50 -0700 (PDT) Received: from p3plsmtpa11-07.prod.phx3.secureserver.net (p3plsmtpa11-07.prod.phx3.secureserver.net [68.178.252.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 176C612006E for ; Tue, 6 Aug 2019 15:41:50 -0700 (PDT) Received: from [172.20.10.4] ([174.214.5.233]) by :SMTPAUTH: with ESMTPSA id v89MhBTMiEs2pv89MhDqaU; Tue, 06 Aug 2019 15:41:49 -0700 From: Laurence Lundblade Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_155D0191-0A22-4C37-BBD4-9E3096FE15DC" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Tue, 6 Aug 2019 15:41:47 -0700 In-Reply-To: Cc: Kathleen Moriarty , Eliot Lear , "rats@ietf.org" , "Smith, Ned" , Anders Rundgren To: Thomas Hardjono References: <2DE09A2A-A6EA-4474-9DBE-8D52B523645B@island-resort.com> <987fbfbb-b3f6-c104-878a-b283978ca0f0@gmail.com> <6F1E85F0-35CB-415A-9672-BD3257F59373@island-resort.com> <2c9ebe7b-9826-2d23-6f86-d098b79128d6@gmail.com> <8E4ED21F-EE52-4FAF-AFCB-A7624C56ED28@island-resort.com> <148D90BA-036A-4682-B920-4650182E2CB1@cisco.com> X-Mailer: Apple Mail (2.3445.9.1) X-CMAE-Envelope: MS4wfLnLFgPKJ16Q5KF4UaIIdJoiaTS5edeUp4YCd2J4T5WZEDcVo2q3JeFUAiI5LO72HVHKicyK7IrjQK+M2lzJN7o2fdekGBgPeKuyrOJN2BYeruifnPcK gVIQXsYH1/8RHxHUv4YzKCRoGlyfAeSeB92FdY8SJ2EnIQHAapQ3iB7CjxaU1mo08Jd+xqw6ky0s8vspl2kSK78WuPaeSqoZZXiN9pah7YbV31F9YvupTbgl XBQ1FZycrvLGHleNxSaVQqlLHkGzk5VWi96TbWbnBKWZwK8FIsVMy0lNmyWuvLyOpYlNcNSo+al+c7cuu+PSwGRLtwsRakCTmfs7CSw+w3Y= Archived-At: Subject: Re: [Rats] No root of trust requirement in RATS/EAT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Aug 2019 22:41:52 -0000 --Apple-Mail=_155D0191-0A22-4C37-BBD4-9E3096FE15DC Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On Aug 6, 2019, at 6:33 AM, Thomas Hardjono wrote: >=20 > -- Something is trusted if: >=20 > (a) It does one specific function well (over & over again without = change); (NB. this is where designing the function correctly comes into = play). >=20 > (b) Operates unhindered (NB. this is where the non-interference rule = & shielded locations feature comes in); >=20 > (c) Is able to report the outcome truthfully (NB. this is where the = RTR feature comes in). I don=E2=80=99t think trust in can be yes-or-no in any kind of absolute = sense when considering real world deployment. You can=E2=80=99t say this = HW+SW is *always* trusted in every single use case. You probably don=E2=80= =99t know all the use cases and attacks. The reality is attackers that = might be willing to spend a lot of money (a nation state) or have high = motivation (black hats) comes in. One issue is whether or not there are SW bugs. This can never be = determined absolutely. If you spend a lot of money on review, testing = and analysis on a simple function, you can get close, but it is not = guaranteed.=20 Another issue is local HW attacks. Circuit boards can be probed, chips = decapped and glitched. Defense against these are expensive and not in = common hardware. There are varying degrees of attacks and of defenses, = so it is not yes-or-no. Side channels are another. Could be power, RF, cache timing or such. = Here also, there are varying degrees of attacks and of defenses, so it = is not yes-or-no. LL --Apple-Mail=_155D0191-0A22-4C37-BBD4-9E3096FE15DC Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
On = Aug 6, 2019, at 6:33 AM, Thomas Hardjono <hardjono@mit.edu> = wrote:

-- Something is trusted = if:

(a) It does = one specific function well (over & over again without change); =  (NB. this is where designing the function correctly comes into = play).

(b) Operates = unhindered  (NB. this is where the non-interference rule & = shielded locations feature comes in);

(c) Is able to report the outcome truthfully (NB. this is = where the RTR feature comes in).

I don=E2=80=99t think = trust in can be yes-or-no in any kind of absolute sense when considering = real world deployment. You can=E2=80=99t say this HW+SW is *always* = trusted in every single use case. You probably don=E2=80=99t know all = the use cases and attacks. The reality is attackers that might be = willing to spend a lot of money (a nation state) or have high motivation = (black hats) comes in.

One issue is whether or not there are SW bugs. This can never = be determined absolutely. If you spend a lot of money on review, testing = and analysis on a simple function, you can get close, but it is not = guaranteed. 

Another issue is local HW attacks. Circuit boards can be = probed, chips decapped and glitched. Defense against these are expensive = and not in common hardware. There are varying degrees of attacks and of = defenses, so it is not yes-or-no.

Side channels are another. Could be = power, RF, cache timing or such. Here also, there are varying degrees of = attacks and of defenses, so it is not yes-or-no.

LL



= --Apple-Mail=_155D0191-0A22-4C37-BBD4-9E3096FE15DC-- From nobody Tue Aug 6 15:54:58 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 452D012008A for ; Tue, 6 Aug 2019 15:54:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JvAnty_nnJVl for ; Tue, 6 Aug 2019 15:54:54 -0700 (PDT) Received: from outgoing-exchange-7.mit.edu (outgoing-exchange-7.mit.edu [18.9.28.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3137812006E for ; Tue, 6 Aug 2019 15:54:53 -0700 (PDT) Received: from oc11exedge1.exchange.mit.edu (OC11EXEDGE1.EXCHANGE.MIT.EDU [18.9.3.17]) by outgoing-exchange-7.mit.edu (8.14.7/8.12.4) with ESMTP id x76MsqeT022546; Tue, 6 Aug 2019 18:54:53 -0400 Received: from w92expo23.exchange.mit.edu (18.7.74.77) by oc11exedge1.exchange.mit.edu (18.9.3.17) with Microsoft SMTP Server (TLS) id 15.0.1293.2; Tue, 6 Aug 2019 18:54:16 -0400 Received: from oc11expo23.exchange.mit.edu (18.9.4.88) by w92expo23.exchange.mit.edu (18.7.74.77) with Microsoft SMTP Server (TLS) id 15.0.1365.1; Tue, 6 Aug 2019 18:54:49 -0400 Received: from oc11expo23.exchange.mit.edu ([18.9.4.88]) by oc11expo23.exchange.mit.edu ([18.9.4.88]) with mapi id 15.00.1365.000; Tue, 6 Aug 2019 18:54:49 -0400 From: Thomas Hardjono To: Laurence Lundblade CC: Kathleen Moriarty , Eliot Lear , "rats@ietf.org" , "Smith, Ned" , Anders Rundgren Thread-Topic: [Rats] No root of trust requirement in RATS/EAT Thread-Index: AQHVSvPUhaEckXFlEkiciiP4Ef5JxKbrnk6AgACjAICAABfBAIAAR+oAgADt6wCAACKkgIAASouAgABg+ID//78XE4AA4UaA//++rOA= Date: Tue, 6 Aug 2019 22:54:49 +0000 Message-ID: <5e0900299b6c4fd28843814d656b625d@oc11expo23.exchange.mit.edu> References: <2DE09A2A-A6EA-4474-9DBE-8D52B523645B@island-resort.com> <987fbfbb-b3f6-c104-878a-b283978ca0f0@gmail.com> <6F1E85F0-35CB-415A-9672-BD3257F59373@island-resort.com> <2c9ebe7b-9826-2d23-6f86-d098b79128d6@gmail.com> <8E4ED21F-EE52-4FAF-AFCB-A7624C56ED28@island-resort.com> <148D90BA-036A-4682-B920-4650182E2CB1@cisco.com> , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [73.167.220.69] Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Rats] No root of trust requirement in RATS/EAT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Aug 2019 22:54:57 -0000 >>> I don=92t think trust in can be yes-or-no in any kind of absolute sense= when considering=20 >>> real world deployment. You can=92t say this HW+SW is *always* trusted i= n every=20 >>> single use case. You probably don=92t know all the use cases and attack= s.=20 >>> The reality is attackers that might be willing to spend a lot of=20 >>> money (a nation state) or have high motivation (black hats) comes in. Yes of course. I don't think I was claiming there is an absolutely secure = HW+SW that is *always* trusted in single use case. No one in security indus= try has ever claimed this. Everything can be cracked, but that doesn't mean we should not use "trusted= H/W" like the TPM. This is why the notion of the TCB was developed (Orang= e Book), but this is a separate discussion. >>> One issue is whether or not there are SW bugs.=20 >>> This can never be determined absolutely.=20 >>> If you spend a lot of money on review, testing and analysis=20 >>> on a simple function, you can get close, but it is not guaranteed. >>>=20 >>> Another issue is local HW attacks. Circuit boards can be probed,=20 >>> chips decapped and glitched. Defense against these are expensive >>> and not in common hardware. There are varying degrees of attacks=20 >>> and of defenses, so it is not yes-or-no. >>>=20 >>> Side channels are another. Could be power, RF, cache timing or such.=20 >>> Here also, there are varying degrees of attacks and=20 >>> of defenses, so it is not yes-or-no. @Laurence: Thank you for this great explanation :-) -- thomas --- ________________________________________ From: Laurence Lundblade [lgl@island-resort.com] Sent: Tuesday, August 6, 2019 6:41 PM To: Thomas Hardjono Cc: Kathleen Moriarty; Eliot Lear; rats@ietf.org; Smith, Ned; Anders Rundgr= en Subject: Re: [Rats] No root of trust requirement in RATS/EAT On Aug 6, 2019, at 6:33 AM, Thomas Hardjono > wrote: -- Something is trusted if: (a) It does one specific function well (over & over again without change); = (NB. this is where designing the function correctly comes into play). (b) Operates unhindered (NB. this is where the non-interference rule & shi= elded locations feature comes in); (c) Is able to report the outcome truthfully (NB. this is where the RTR fea= ture comes in). I don=92t think trust in can be yes-or-no in any kind of absolute sense whe= n considering real world deployment. You can=92t say this HW+SW is *always*= trusted in every single use case. You probably don=92t know all the use ca= ses and attacks. The reality is attackers that might be willing to spend a = lot of money (a nation state) or have high motivation (black hats) comes in= . One issue is whether or not there are SW bugs. This can never be determined= absolutely. If you spend a lot of money on review, testing and analysis on= a simple function, you can get close, but it is not guaranteed. Another issue is local HW attacks. Circuit boards can be probed, chips deca= pped and glitched. Defense against these are expensive and not in common ha= rdware. There are varying degrees of attacks and of defenses, so it is not = yes-or-no. Side channels are another. Could be power, RF, cache timing or such. Here a= lso, there are varying degrees of attacks and of defenses, so it is not yes= -or-no. LL= From nobody Tue Aug 6 16:24:55 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BCD6F12008B for ; Tue, 6 Aug 2019 16:24:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K8exS_gHGDkw for ; Tue, 6 Aug 2019 16:24:52 -0700 (PDT) Received: from p3plsmtpa12-09.prod.phx3.secureserver.net (p3plsmtpa12-09.prod.phx3.secureserver.net [68.178.252.238]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 575F012006E for ; Tue, 6 Aug 2019 16:24:52 -0700 (PDT) Received: from [172.20.10.4] ([174.214.5.233]) by :SMTPAUTH: with ESMTPSA id v8p0hhJsktBSUv8p0hYBoy; Tue, 06 Aug 2019 16:24:51 -0700 From: Laurence Lundblade Message-Id: <52607B4E-C89C-4C6A-A21B-CC2D2CC0C3FA@island-resort.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_F26F1772-4010-4D11-ADAD-B577C3002BB6" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Tue, 6 Aug 2019 16:23:22 -0700 In-Reply-To: <5e0900299b6c4fd28843814d656b625d@oc11expo23.exchange.mit.edu> Cc: "rats@ietf.org" , Kathleen Moriarty , "Smith, Ned" , Eliot Lear , Anders Rundgren To: Thomas Hardjono References: <2DE09A2A-A6EA-4474-9DBE-8D52B523645B@island-resort.com> <987fbfbb-b3f6-c104-878a-b283978ca0f0@gmail.com> <6F1E85F0-35CB-415A-9672-BD3257F59373@island-resort.com> <2c9ebe7b-9826-2d23-6f86-d098b79128d6@gmail.com> <8E4ED21F-EE52-4FAF-AFCB-A7624C56ED28@island-resort.com> <148D90BA-036A-4682-B920-4650182E2CB1@cisco.com> <5e0900299b6c4fd28843814d656b625d@oc11expo23.exchange.mit.edu> X-Mailer: Apple Mail (2.3445.9.1) X-CMAE-Envelope: MS4wfD0bqeQFDnNFyqCvDyhEIILQFZHg4mZ1sISp2AwKSGRorOt859tEIDyreQ7iQ2MMKT1EOza29Zgh5nfm3QZd9kfDOQuppSW1KkQAL7gS3ImUlrykuKXG dXDoiQ6DwcPWBP/o49a7WRqGo1nrwrbeegApexD730Fa8bBfyJQgXMOt8/rRFZssQ7oYEgOiTRN0Z8bhPtoLSc3F4M0IJCQCgZrDKZs4nncI7Na90ZvoYnDt fXaiFdDNH3n5OVopvqUPYSL/WtNmG3iXKn3uhR+pCReDyqKUV7lTXCR0bi6yHm64aL4+KL3FwHCLgjg1TxGjyLgEwRyxjf6TybvCOhHl0TU= Archived-At: Subject: Re: [Rats] No root of trust requirement in RATS/EAT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Aug 2019 23:24:54 -0000 --Apple-Mail=_F26F1772-4010-4D11-ADAD-B577C3002BB6 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On Aug 6, 2019, at 3:54 PM, Thomas Hardjono wrote: >=20 > Everything can be cracked, but that doesn't mean we should not use = "trusted H/W" like the TPM. This is why the notion of the TCB was = developed (Orange Book), but this is a separate discussion. So, not sure what you mean by =E2=80=98use =E2=80=9Ctrusted H/W=E2=80=9D = like the TPM=E2=80=99. It could mean: 1) TPM chips are good and useful things for the world to use. I agree. 2) The term =E2=80=98trusted H/W=E2=80=99 has clear meaning. I disagree = per my previous comments about degree. 3) We should use the term =E2=80=98trusted H/W=E2=80=99 in the RATS = architecture document. I disagree because of 2) above and other = comments. I think =E2=80=98trusted=E2=80=99 can be yes-or-no in specific use cases = where requirements and the threat model are clearly set and determined, = but we are not working on one of those. Our attestation work has to span = from use cases that only stand up to lame wanna be hackers to use cases = that stand up to nation states. LL --Apple-Mail=_F26F1772-4010-4D11-ADAD-B577C3002BB6 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
On = Aug 6, 2019, at 3:54 PM, Thomas Hardjono <hardjono@mit.edu> = wrote:

Everything can be cracked, but = that doesn't mean we should not use "trusted H/W" like the TPM. =  This is why the notion of the TCB was developed (Orange Book), but = this is a separate discussion.

So, not sure what you mean by =E2=80=98use = =E2=80=9Ctrusted H/W=E2=80=9D like the TPM=E2=80=99. It could = mean:

1) TPM = chips are good and useful things for the world to use. I = agree.

2) The = term =E2=80=98trusted H/W=E2=80=99 has clear meaning. I disagree per my = previous comments about degree.

3) We should use the term =E2=80=98truste= d H/W=E2=80=99 in the RATS architecture document. I disagree because of = 2) above and other comments.

I think =E2=80=98trusted=E2=80=99 can = be yes-or-no in specific use cases where requirements and the threat = model are clearly set and determined, but we are not working on one of = those. Our attestation work has to span from use cases that only stand = up to lame wanna be hackers to use cases that stand up to nation = states.

LL

= --Apple-Mail=_F26F1772-4010-4D11-ADAD-B577C3002BB6-- From nobody Wed Aug 7 00:40:25 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4B4C412022D for ; Wed, 7 Aug 2019 00:40:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fJ6ZJ3jisP4J for ; Wed, 7 Aug 2019 00:40:22 -0700 (PDT) Received: from aer-iport-2.cisco.com (aer-iport-2.cisco.com [173.38.203.52]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 48008120043 for ; Wed, 7 Aug 2019 00:40:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=4552; q=dns/txt; s=iport; t=1565163622; x=1566373222; h=from:message-id:mime-version:subject:date:in-reply-to:cc: to:references; bh=W4glHgrodCZB/VaVe3rCGn3s0aXryzpj4F0a+1EDzvQ=; b=Sm3Wxoz0tsIOmx1i0rdLvghRozNpbyBv6Oa128Ats61KfZy4e81zMxCs A8/YoKe2zs7wz/4JF1bFldDGHQvRtfZVN1pzyBPWfQ1Z07PIPVl64emye 7unT6gqtKzsWlPXRgD+fQSOTUePE6Cl/NNebBems9KupMjHg7TdzhDg63 I=; X-Files: signature.asc : 195 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0ARAAB6f0pd/xbLJq1mGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAQGBVQIBAQEBAQsBgRWCQAEyKoQeiHyIW4c3i02GBYF7Agc?= =?us-ascii?q?BAQEJAwEBLwEBhD8CgmI2Bw4BBAEBBAEBAgEGbYUzhUoBAQEBAgEjVgULCwQ?= =?us-ascii?q?KCioCAlcGE4MiAYF7D6oYgTKFSYRzEIE0AYFQiimBf4ERJx+CHi4+h08ygiY?= =?us-ascii?q?EjlaGN5YdCYIegh+BDpB0G41GimeiLoMOAgQGBQIVgVcHKiqBLjMaCBsVZQG?= =?us-ascii?q?CQT6QSj0DMI4wAQE?= X-IronPort-AV: E=Sophos;i="5.64,356,1559520000"; d="asc'?scan'208,217";a="15180609" Received: from aer-iport-nat.cisco.com (HELO aer-core-2.cisco.com) ([173.38.203.22]) by aer-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 07 Aug 2019 07:40:20 +0000 Received: from [10.61.221.4] ([10.61.221.4]) by aer-core-2.cisco.com (8.15.2/8.15.2) with ESMTPS id x777eJeP016711 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Wed, 7 Aug 2019 07:40:20 GMT From: Eliot Lear Message-Id: Content-Type: multipart/signed; boundary="Apple-Mail=_82D696F6-330B-4653-9DC8-6BBA77CAF449"; protocol="application/pgp-signature"; micalg=pgp-sha1 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Wed, 7 Aug 2019 09:40:18 +0200 In-Reply-To: <52607B4E-C89C-4C6A-A21B-CC2D2CC0C3FA@island-resort.com> Cc: Thomas Hardjono , "rats@ietf.org" , Kathleen Moriarty , "Smith, Ned" , Anders Rundgren To: Laurence Lundblade References: <2DE09A2A-A6EA-4474-9DBE-8D52B523645B@island-resort.com> <987fbfbb-b3f6-c104-878a-b283978ca0f0@gmail.com> <6F1E85F0-35CB-415A-9672-BD3257F59373@island-resort.com> <2c9ebe7b-9826-2d23-6f86-d098b79128d6@gmail.com> <8E4ED21F-EE52-4FAF-AFCB-A7624C56ED28@island-resort.com> <148D90BA-036A-4682-B920-4650182E2CB1@cisco.com> <5e0900299b6c4fd28843814d656b625d@oc11expo23.exchange.mit.edu> <52607B4E-C89C-4C6A-A21B-CC2D2CC0C3FA@island-resort.com> X-Mailer: Apple Mail (2.3445.104.11) X-Outbound-SMTP-Client: 10.61.221.4, [10.61.221.4] X-Outbound-Node: aer-core-2.cisco.com Archived-At: Subject: Re: [Rats] No root of trust requirement in RATS/EAT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 07:40:24 -0000 --Apple-Mail=_82D696F6-330B-4653-9DC8-6BBA77CAF449 Content-Type: multipart/alternative; boundary="Apple-Mail=_DB6420BA-6D19-446A-B6FD-2238FE48FECF" --Apple-Mail=_DB6420BA-6D19-446A-B6FD-2238FE48FECF Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi, > On 7 Aug 2019, at 01:23, Laurence Lundblade = wrote: >=20 >=20 > I think =E2=80=98trusted=E2=80=99 can be yes-or-no in specific use = cases where requirements and the threat model are clearly set and = determined, but we are not working on one of those. Our attestation work = has to span from use cases that only stand up to lame wanna be hackers = to use cases that stand up to nation states. I would go further. While I agree that there are no certainties, at the = end of the day RATS provides values asserted by a particular entity that = is authenticated via a root of trust for various purposes, some of which = are likely to be automated, like anomaly detection, remediation = management, etc. That automation demands a small number of return = values in its evaluation (e.g., expected, unexpected, and whether or not = to trust the results). The latter will require external configuration = in advance. The answer can only be yes or no. If it is no, an = exception process will kick in. At that point a human will get = involved. The more a human has to get involved in that decision = process, the less use the system will be. Eliot --Apple-Mail=_DB6420BA-6D19-446A-B6FD-2238FE48FECF Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi,

On 7 Aug 2019, at 01:23, Laurence Lundblade = <lgl@island-resort.com> wrote:


I think =E2=80=98trusted=E2=80=99 can be yes-or-no in = specific use cases where requirements and the threat model are clearly = set and determined, but we are not working on one of those. Our = attestation work has to span from use cases that only stand up to lame = wanna be hackers to use cases that stand up to nation = states.


I would go further.  While I agree = that there are no certainties, at the end of the day RATS provides = values asserted by a particular entity that is authenticated via a root = of trust for various purposes, some of which are likely to be automated, = like anomaly detection, remediation management, etc.  That = automation demands a small number of return values in its evaluation = (e.g., expected, unexpected, and whether or not to trust the results). =  The latter will require external configuration in advance. =  The answer can only be yes or no.  If it is no, an exception = process will kick in.  At that point a human will get involved. =  The more a human has to get involved in that decision process, the = less use the system will be. 

Eliot

= --Apple-Mail=_DB6420BA-6D19-446A-B6FD-2238FE48FECF-- --Apple-Mail=_82D696F6-330B-4653-9DC8-6BBA77CAF449 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQTgo4LlIIJ5lIBumWpugA9nE248uAUCXUqAYgAKCRBugA9nE248 uE08AJ4gH7/gmdLTtERnb4NXbP1Aatw2NACfajqKd0adnICpSpiVoWgpQujErmw= =SfkR -----END PGP SIGNATURE----- --Apple-Mail=_82D696F6-330B-4653-9DC8-6BBA77CAF449-- From nobody Wed Aug 7 05:25:04 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9BF52120090 for ; Wed, 7 Aug 2019 05:25:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=R9AOWd3i; dkim=fail (1024-bit key) reason="fail (body has been altered)" header.d=armh.onmicrosoft.com header.b=+L/joEsy Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7ibP001kkCVo for ; Wed, 7 Aug 2019 05:24:59 -0700 (PDT) Received: from EUR03-DB5-obe.outbound.protection.outlook.com (mail-eopbgr40063.outbound.protection.outlook.com [40.107.4.63]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 84EE312001B for ; Wed, 7 Aug 2019 05:24:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=cxfNUXAih54g4AdFCjgYbrljQs9S780gfzg4MLdHG6Y=; b=R9AOWd3ifd+1D0cwtxktxKrys5sQgq78V+q1Gc4OYeAPZVcJqBfV5cVTdoE2wR2WwTXhLI0uWpfQ3Q/6jZlSreCkcacL1H8ip7lHi8mUAvRMx7/IOl+epLlIF+wENtSz1q71lSluk0tOHQuH0SQLjdoKnbbamKcfHFuybWQpFzM= Received: from DB6PR0801CA0061.eurprd08.prod.outlook.com (2603:10a6:4:2b::29) by HE1PR0802MB2603.eurprd08.prod.outlook.com (2603:10a6:3:e0::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2157.15; Wed, 7 Aug 2019 12:24:52 +0000 Received: from AM5EUR03FT050.eop-EUR03.prod.protection.outlook.com (2a01:111:f400:7e08::203) by DB6PR0801CA0061.outlook.office365.com (2603:10a6:4:2b::29) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2136.15 via Frontend Transport; Wed, 7 Aug 2019 12:24:52 +0000 Authentication-Results: spf=temperror (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; ietf.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;ietf.org; dmarc=temperror action=none header.from=arm.com; Received-SPF: TempError (protection.outlook.com: error in processing during lookup of arm.com: DNS Timeout) Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by AM5EUR03FT050.mail.protection.outlook.com (10.152.17.47) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2052.18 via Frontend Transport; Wed, 7 Aug 2019 12:24:50 +0000 Received: ("Tessian outbound 1e6e633a5b56:v26"); Wed, 07 Aug 2019 12:24:50 +0000 X-CR-MTA-TID: 64aa7808 Received: from a92c61fcf6b2.1 (ip-172-16-0-2.eu-west-1.compute.internal [104.47.0.55]) by 64aa7808-outbound-1.mta.getcheckrecipient.com id F2F686A3-CE7A-40CF-B660-B49030E9EED6.1; Wed, 07 Aug 2019 12:24:45 +0000 Received: from EUR01-HE1-obe.outbound.protection.outlook.com (mail-he1eur01lp2055.outbound.protection.outlook.com [104.47.0.55]) by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id a92c61fcf6b2.1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Wed, 07 Aug 2019 12:24:45 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=iORm9mM1EV+VjMrdMhn0zeekLy6Kv/4FAmk9hWKeHMUIf1V5uNjCfXF/3veQ5h7oyGW0qLOH97tSaqGjAW1i5wNySmlTQ7OHNQ7uSBChjzEHjzokT+bzJzV+FztwjGQKUp3E+29iD29Gi6JwSE8RVYxwhUcB3gvIDd5G6xMOEWaWareUvC5E1xJBZiY2AOTxBjC+lQO4dGPKxw+edJsYSO0au8lVjkFgyfjo1p4wHZZ+XELzzty0AIWcC3Roo2c2dOmPw3ZMwCC4rkcPwRXkCxpDCS3FiSV69M3orvEKGcUf94jnFpe84UIjYiaLw51f1uvXDUg6dTZm2wDr9A45ww== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=MrOLaosQKdLyWjNRCj4/dFR564bcMP+zMjcQ6SsjZIE=; b=lBzcyJSapnYKJvetcGbAIxXlgBds77XtN1RZ2JStJWIgqvcndel1NlZR8X537+2W7EcnebaeBLpQ4TG7OwETurN6Pk6Kw8o1TeLea1MWdjAk6CkldDh2J4x7tTzm6tee+4R15gLVXv04Ccp9C6xyc+rCd7+Z6FQrAmNhzcuaSuKgrcsoOvqGM0a9aokf/N1+ipuh8f0hoM7fdNh4IjMR6nKwFx9+yuMfJUiR/jN7Wi4OO2yLnrgd2N8APDqKqoIlbuqLBCr5dQBIYtx6fIN6gRukeGmPg+p/BzccKlHip8BJ1+6SJFAYuuR7wMGx+/8SqXJzjzMS62jYUdxgA9rDdA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=arm.com; dmarc=pass action=none header.from=arm.com; dkim=pass header.d=arm.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=MrOLaosQKdLyWjNRCj4/dFR564bcMP+zMjcQ6SsjZIE=; b=+L/joEsyESeMrnnmWI7d2xSTBDjK6bQDR6e5eR54tHTzOyW0VqJK+okmtq6dmmh3F9BRX9q+eWZvcY1UfFBqL/1ylY5GBDvoOnSFpKwvu8ZEc86e5YpLDWt3feRlfpF5jgnPfTH9GCbaL7lEVrzPXmlOi3lLgN6PrZBhJcw2F6w= Received: from AM0PR08MB5345.eurprd08.prod.outlook.com (52.132.212.135) by AM0PR08MB3620.eurprd08.prod.outlook.com (20.177.108.148) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2157.16; Wed, 7 Aug 2019 12:24:44 +0000 Received: from AM0PR08MB5345.eurprd08.prod.outlook.com ([fe80::7532:a9e4:63b6:6a55]) by AM0PR08MB5345.eurprd08.prod.outlook.com ([fe80::7532:a9e4:63b6:6a55%4]) with mapi id 15.20.2136.018; Wed, 7 Aug 2019 12:24:44 +0000 From: Hannes Tschofenig To: Laurence Lundblade , "rats@ietf.org" Thread-Topic: [Rats] No root of trust requirement in RATS/EAT Thread-Index: AQHVSvPZgyRnZ9PEIkCboD8VKdKKxqbvng0g Date: Wed, 7 Aug 2019 12:24:44 +0000 Message-ID: References: <2DE09A2A-A6EA-4474-9DBE-8D52B523645B@island-resort.com> In-Reply-To: <2DE09A2A-A6EA-4474-9DBE-8D52B523645B@island-resort.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ts-tracking-id: 768a3209-846e-4fdc-84d8-0b2a1683ac5f.1 x-checkrecipientchecked: true Authentication-Results-Original: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; x-originating-ip: [80.92.121.27] x-ms-publictraffictype: Email X-MS-Office365-Filtering-Correlation-Id: 8bf56342-ec08-4c64-f108-08d71b323eaf X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam-Untrusted: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:AM0PR08MB3620; X-MS-TrafficTypeDiagnostic: AM0PR08MB3620:|HE1PR0802MB2603: X-Microsoft-Antispam-PRVS: x-checkrecipientrouted: true x-ms-oob-tlc-oobclassifiers: OLM:8273;OLM:8273; x-forefront-prvs: 01221E3973 X-Forefront-Antispam-Report-Untrusted: SFV:NSPM; SFS:(10009020)(4636009)(136003)(396003)(346002)(366004)(376002)(39860400002)(199004)(189003)(7736002)(5660300002)(6246003)(6306002)(54896002)(9686003)(53936002)(8676002)(55016002)(71200400001)(71190400001)(86362001)(74316002)(25786009)(52536014)(66066001)(476003)(68736007)(8936002)(33656002)(486006)(81166006)(81156014)(11346002)(446003)(110136005)(6116002)(7696005)(76176011)(14454004)(790700001)(186003)(99286004)(316002)(3846002)(229853002)(478600001)(102836004)(66446008)(6506007)(76116006)(53546011)(64756008)(66556008)(66476007)(66946007)(2501003)(256004)(2906002)(14444005)(6436002)(26005); DIR:OUT; SFP:1101; SCL:1; SRVR:AM0PR08MB3620; H:AM0PR08MB5345.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam-Message-Info-Original: K0yuV3UMWMIOxHuSY66+ZPMKQfu+Z5jrNJ76MiGs7lb8N1xQhdWpjQzntglJFwxgSn3MxgDAOBmwrqLxNI5lBgZEZsbCrNd8BeqghRr2moRbC1LEtunU21ZDgqTp/Rur9X+5INiEO5Gqt8K4M9N+XlZXBhhyayVy6DYkcCe2tjN/5ea/4erLnMBTcveDqMuWw5w5qeJa4gc6lwY1tdXcrk9WFaZDBeOEPOVAmCWbHmDIYJ7WOIcxOigx5g4mzKDSBcYVOi+jUtOj/77R5kYcOMhImWAY+07RTx2lO3fOj/If6bl+9EqbXlIEYF1L0R8Ig32wNcMdBpam7Km24kn7wdA7bYpCuOxo9T77tAKdw5G6zjNww6a+4CSuQ26mkSKXgBuuSLDInrTXermANn4KMeVg55H9XbKhL9qU9lmGGk4= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_AM0PR08MB534566E2C6D43AACFAA6FA98FAD40AM0PR08MB5345eurp_" MIME-Version: 1.0 X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR08MB3620 Original-Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com; X-EOPAttributedMessage: 0 X-MS-Exchange-Transport-CrossTenantHeadersStripped: AM5EUR03FT050.eop-EUR03.prod.protection.outlook.com X-Forefront-Antispam-Report: CIP:63.35.35.123; IPV:CAL; SCL:-1; CTRY:IE; EFV:NLI; SFV:NSPM; SFS:(10009020)(4636009)(39860400002)(346002)(376002)(396003)(136003)(2980300002)(189003)(199004)(40434004)(16586007)(316002)(110136005)(86362001)(2906002)(36906005)(102836004)(3846002)(6116002)(9686003)(26826003)(790700001)(81156014)(2501003)(446003)(63370400001)(63350400001)(336012)(476003)(126002)(5660300002)(486006)(7736002)(11346002)(81166006)(8936002)(70586007)(186003)(54896002)(6306002)(70206006)(55016002)(229853002)(22756006)(33656002)(5024004)(6506007)(99286004)(26005)(14444005)(8676002)(52536014)(61614004)(74316002)(66066001)(25786009)(7696005)(14454004)(71190400001)(76130400001)(76176011)(33964004)(478600001)(6246003)(356004)(53546011); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR0802MB2603; H:64aa7808-outbound-1.mta.getcheckrecipient.com; FPR:; SPF:TempError; LANG:en; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; MX:1; A:1; X-MS-Office365-Filtering-Correlation-Id-Prvs: c90696a5-e7c0-4251-219e-08d71b323aa1 X-Microsoft-Antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600148)(710020)(711020)(4605104)(1401327)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7193020); SRVR:HE1PR0802MB2603; X-Forefront-PRVS: 01221E3973 X-Microsoft-Antispam-Message-Info: nZ9Cqt+lWUBGpr9B1+BbAazIOa93Msd1+5YLJu/TXP0YpoUt1B2NW89Y0/KelgFKzWmzG0Yxv9xO6B8ZqqXPbxiLMoXjAMp0D1cp8zaxEb1PyWe0ogUpe2YfZjVe0Sh4ffzLMpVF6i72TkxEuPkTcRtdtwUjkRfsOplKsFPW5HwaKkA0xgbdYn7d/LvixhBks8AzKXJVtwz/DY2kBWsx6sjmJSp7kASaqz7k7iG7hWRgS19/9o1t/kXFkTRFQu230bwmgGzPVJtq425/EQ5d206Lxwc8cc10NKfHd75zgTk0UMgroQ7bkxMMBBd3IWaqVVUZz/1SZ51S8+57fEjSLstO96+E0oJGkv/y7jLvwiCu6s8KnJYwScwQrhiFfN/3mAMCvlceHb6zvyG5I/WpZze8+0CehXoDmUisVIvhXTo= X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Aug 2019 12:24:50.9336 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 8bf56342-ec08-4c64-f108-08d71b323eaf X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0802MB2603 Archived-At: Subject: Re: [Rats] No root of trust requirement in RATS/EAT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 12:25:03 -0000 --_000_AM0PR08MB534566E2C6D43AACFAA6FA98FAD40AM0PR08MB5345eurp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhlcmUgYXJlIHR3byBhc3BlY3RzIGhlcmU6DQoNCg0KICAqICAgV2hhdCBpcyBzcGVjaWZpZWQg aW4gdGVybXMgb2YgaW50ZXJvcGVyYWJpbGl0eQ0KICAqICAgV2hhdCBpcyBkZXNjcmliZWQgYXMg cGFydCBvZiB0aGUgYmlnZ2VyIHBpY3R1cmUuDQoNCklFVEYgc3BlY2lmaWNhdGlvbnMsIGFzIHlv dSBjb3JyZWN0bHkgbm90ZWQgYmVsb3csIGRvIG5vdCBzcGVjaWZ5IG1hbnkgYXNwZWN0cyBvZiB0 aGUgYmlnIHBpY3R1cmUuIFdoaWxlIHRoZXJlIGFyZSBzb21lIGRvY3VtZW50cyB0aGF0IHRyeSB0 byBkZXNjcmliZSB0aGVtIGFzIHBhcnQgb2YgYXJjaGl0ZWN0dXJlIGRvY3VtZW50cyBJRVRGIGRv Y3VtZW50cyBuZXZlciBnbyBpbnRvIHRoZSBkZXRhaWxzIG9mIG1vc3QgdGhpbmdzLg0KDQpJTUhP IEVBVCB0b2tlbnMgc2hvdWxkIHNwZWNpZnkgaG93IHRoZSBjbGFpbXMgbG9vayBsaWtlIGFuZCBu b3Qgd29ycnkgYWJvdXQgdGhlIHJlc3QgdG9vIG11Y2guIFRoaXMgaW5jbHVkZXMgbm90IHRvIHdv cnJ5IGFib3V0IHRoZSByb290IG9mIHRydXN0Lg0KVGhlIGFyY2hpdGVjdHVyZSBkb2N1bWVudCBj YW4gYW5kIHNob3VsZCB0YWxrIGFib3V0IHRoZSBiaWdnZXIgcGljdHVyZSBidXQgbm90IG1hbmRh dGUgYSBzcGVjaWZpYyBkZXBsb3ltZW50IG9yIGltcGxlbWVudGF0aW9uLg0KDQpJc27igJl0IGl0 IHNpbXBsZT8NCg0KQ2lhbw0KSGFubmVzDQoNCkZyb206IFJBVFMgPHJhdHMtYm91bmNlc0BpZXRm Lm9yZz4gT24gQmVoYWxmIE9mIExhdXJlbmNlIEx1bmRibGFkZQ0KU2VudDogU29ubnRhZywgNC4g QXVndXN0IDIwMTkgMjA6MzgNClRvOiByYXRzQGlldGYub3JnDQpTdWJqZWN0OiBbUmF0c10gTm8g cm9vdCBvZiB0cnVzdCByZXF1aXJlbWVudCBpbiBSQVRTL0VBVA0KDQpBbiBBbmRyb2lkIHBob25l IG9mdGVuIGxvb2tzIGxpa2UgdGhpczoNCiAgLSBMaW51eCAvIEFuZHJvaWQgYXBwcw0KICAtIExp bnV4IGtlcm5lbA0KICAtIFRB4oCZcyAoVHJ1c3RlZCBBcHBzIOKAlCBhcHBzIHJ1bm5pbmcgdGhl IFRFRSkNCiAgLSBURUUga2VybmVsDQoNCkl0IG11c3QgYmUgYWxsb3dlZCBmb3IgYW55IG9uZSBv ZiB0aGVzZSB0byBnZW5lcmF0ZSBSQVRTL0VBVCBhdHRlc3RhdGlvbnMuIEl0IG1pZ2h0IGJlIHRo YXQgb25seSB0aGUgQW5kcm9pZCBhcHAgZ2VuZXJhdGVzIFJBVFMvRUFUIGF0dGVzdGF0aW9ucy4g VGhpcyBwaG9uZSBpcyBqdXN0IG9uZSBleGFtcGxlLiBPdGhlciBkZXZpY2VzLCBsaWtlIGNhcnMs IG1heSBiZSBzaW1pbGFyLg0KDQpJZiB0aGVyZSBpcyBhIG5vcm1hdGl2ZSBvciBkZXNjcmlwdGl2 ZSB0ZXh0IHNheWluZyBhIHJvb3Qgb2YgdHJ1c3QgaXMgcmVxdWlyZWQgdG8gZ2VuZXJhdGUgYW4g YXR0ZXN0YXRpb24sIHRoZW4gd2UgaGF2ZSB0byByZWRlZmluZSByb290IG9mIHRydXN0IHRvIHNv IHRoYXQgQW5kcm9pZCBhcHBzIGFyZSByb290cyBvZiB0cnVzdC4gVGhpcyBpcyB2ZXJ5IGNvdW50 ZXIgdG8gdGhlIG5vcm1hbCBkZWZpbml0aW9uIG9mIHJvb3Qgb2YgdHJ1c3QuIEJ5IGNvbW1vbiBk ZWZpbml0aW9uIHRoZSByb290IG9mIHRydXN0IG9mIHRoZSBhYm92ZSBwaG9uZSB3b3VsZCBiZSB0 aGUgVEVFLiBTdWNoIGEgcmVkZWZpbml0aW9uIGZvciBSQVRTIHdvdWxkIGJlIHZlcnkgY29uZnVz aW5nLiBTbyBJIGRvbuKAmXQgdGhpbmsgbm9ybWF0aXZlIHRleHQgc2hvdWxkIHJlcXVpcmUgYSBy b290IG9mIHRydXN0Lg0KDQpNeSBzZWNvbmQgcmVhc29uIGlzIHRoYXQgSSBkb27igJl0IHRoaW5r IHRoZSBJRVRGIHNob3VsZCBzZXQgaW50ZXJuYWwgc2VjdXJpdHkgcmVxdWlyZW1lbnRzIGZvciB0 aGUgaW50ZXJuYWwgaW1wbGVtZW50YXRpb24gb2YgYW4gZW5kLXBvaW50Og0KDQogICogICBUaGUg VExTIFJGQyBkb2VzIG5vdCByZXF1aXJlIGFuIEhTTSwgZXZlbiBpbiBpdHMgdmVyeSBleHRlbnNp dmUgc2VjdXJpdHkgY29uc2lkZXJhdGlvbnMNCiAgKiAgIENPU0UgbWVudGlvbnMga2V5cyBzaG91 bGQgYmUgcHJvdGVjdGVkLCBidXQgb25seSBhcyBhIHJlY29tbWVuZGF0aW9uIGFuZCBvbmx5IGlu IHNlY3VyaXR5IGNvbnNpZGVyYXRpb25zDQogICogICBBdCB0aGUgV3JpdGluZyBTZWN1cml0eSBD b25zaWRlcmF0aW9ucyB0dXRvcmlhbCBpbiBNb250cmVhbCwgWW9hdiBOaXIgc2FpZCB0aGF0IElF VEYgZG9lc27igJl0IGdldCBpbnRvIGVuZC1wb2ludCBzZWN1cml0eSBpbnRlcm5hbHMgc28gbXVj aA0KICAqICAgU29tZSBvZiBteSBJRVRGIGZyaWVuZHMgdGVsbCBtZSBTSE9VTEQgYW5kIE1VU1Qg YXJlIGZvciBpbnRlcm9wZXJhYmlsaXR5IGFzcGVjdHMgb2YgYSBwcm90b2NvbCBvbmx5DQoNCkkg dGhpbmsgaXQgaXMgZmluZSB0bzoNCg0KICAqICAgTWVudGlvbiBhIHJvb3Qgb2YgdHJ1c3QgYXMg YW4gZXhhbXBsZQ0KICAqICAgSGF2ZSBsb3RzIG9mIHRleHQgaW4gc2VjdXJpdHkgY29uc2lkZXJh dGlvbnMgYWJvdXQgc2lnbmluZyBrZXkgcHJvdGVjdGlvbg0KICAqICAgUmVxdWlyZSBhIHJvb3Qg b2YgdHJ1c3QgaW4gcHJvZmlsZSBkb2N1bWVudHMsIHBhcnRpY3VsYXJseSBvbmVzIG91dHNpZGUg dGhlIElFVEYNCiAgKiAgIEhhdmUgY2xhaW1zIHRoYXQgZGVzY3JpYmUgdGhlIGludGVybmFsIHNl Y3VyaXR5IG9mIGFuIGVudGl0eQ0KDQpJIGtub3cgdGhhdCBsYXJnZSBwYXJ0cyBvZiB0aGUgVENH IGFuZCBURUUgd29ybGRzIGhhdmUgdGhlIHJvb3Qgb2YgdHJ1c3QgYXMgYSBmdW5kYW1lbnRhbCBw YXJ0IG9mIHRoZWlyIGFyY2hpdGVjdHVyZXMuIEl0IG1ha2VzIHNlbnNlIHRoZXJlLiBIb3dldmVy LCB0aGVzZSBncm91cHMgZnVuZGFtZW50YWxseSB3b3JrIG9uIHRoZSBzZWN1cml0eSBpbnRlcm5h bHMgb2YgZW5kIHBvaW50cy4gVGhlIElFVEYgZG9lcyBub3QuIEl0IGZvY3VzZXMgb24gb24tdGhl LXdpcmUgc2VjdXJpdHkuIFRodXMsIGl0IG1ha2VzIHNlbnNlIHRoYXQgb3JpZW50YXRpb25zIGFy b3VuZCBlbmQtcG9pbnQgaW50ZXJuYWwgc2VjdXJpdHkgaW1wbGVtZW50YXRpb24gaXMgZGlmZmVy ZW50LiAgU29tZSBvZiB3aGF0IGdvZXMgaW4gdGhlIFRDRyBhbmQgVEVFIHdvcmxkcyBkb2VzbuKA mXQgY2Fycnkgb3ZlciB0byB0aGUgSUVURi4NCg0KSSBrbm93IHJlb3JpZW50aW5nIHRoZSBSQVRT IGFyY2hpdGVjdHVyZSBkcmFmdCB0byBub3QgaGluZ2Ugb24gcm9vdHMgb2YgdHJ1c3QgaXMgYSBi aWcgdXBoZWF2YWwsIGJ1dCBJIHRoaW5rIGl0IGlzIG5lY2Vzc2FyeS4NCg0KTEwNCklNUE9SVEFO VCBOT1RJQ0U6IFRoZSBjb250ZW50cyBvZiB0aGlzIGVtYWlsIGFuZCBhbnkgYXR0YWNobWVudHMg YXJlIGNvbmZpZGVudGlhbCBhbmQgbWF5IGFsc28gYmUgcHJpdmlsZWdlZC4gSWYgeW91IGFyZSBu b3QgdGhlIGludGVuZGVkIHJlY2lwaWVudCwgcGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyIGltbWVk aWF0ZWx5IGFuZCBkbyBub3QgZGlzY2xvc2UgdGhlIGNvbnRlbnRzIHRvIGFueSBvdGhlciBwZXJz b24sIHVzZSBpdCBmb3IgYW55IHB1cnBvc2UsIG9yIHN0b3JlIG9yIGNvcHkgdGhlIGluZm9ybWF0 aW9uIGluIGFueSBtZWRpdW0uIFRoYW5rIHlvdS4NCg== --_000_AM0PR08MB534566E2C6D43AACFAA6FA98FAD40AM0PR08MB5345eurp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6RGVuZ1hpYW47DQoJcGFub3NlLTE6MiAx IDYgMCAzIDEgMSAxIDEgMTt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJ cGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWls eToiXEBEZW5nWGlhbiI7DQoJcGFub3NlLTE6MiAxIDYgMCAzIDEgMSAxIDEgMTt9DQovKiBTdHls ZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1h bA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEu MHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5N c29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOiMwNTYzQzE7DQoJ dGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5r Rm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOiM5NTRGNzI7DQoJdGV4 dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLk1zb0xpc3RQYXJhZ3JhcGgsIGxpLk1zb0xpc3RQ YXJhZ3JhcGgsIGRpdi5Nc29MaXN0UGFyYWdyYXBoDQoJe21zby1zdHlsZS1wcmlvcml0eTozNDsN CgltYXJnaW4tdG9wOjBjbTsNCgltYXJnaW4tcmlnaHQ6MGNtOw0KCW1hcmdpbi1ib3R0b206MGNt Ow0KCW1hcmdpbi1sZWZ0OjM2LjBwdDsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1z aXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpwLm1zb25v cm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1z b25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGNtOw0K CW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBjbTsNCglmb250LXNp emU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uRW1h aWxTdHlsZTE4DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5 OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1 bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpA cGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo2MTIuMHB0IDc5Mi4wcHQ7DQoJbWFyZ2luOjcyLjBw dCA3Mi4wcHQgNzIuMHB0IDcyLjBwdDt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNl Y3Rpb24xO30NCi8qIExpc3QgRGVmaW5pdGlvbnMgKi8NCkBsaXN0IGwwDQoJe21zby1saXN0LWlk OjE0NTIxNjM2OTI7DQoJbXNvLWxpc3QtdHlwZTpoeWJyaWQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUt aWRzOjE0MjUxNjQzODIgLTUxODYwNzIyMiAxMzQ4MDc1NTUgMTM0ODA3NTU3IDEzNDgwNzU1MyAx MzQ4MDc1NTUgMTM0ODA3NTU3IDEzNDgwNzU1MyAxMzQ4MDc1NTUgMTM0ODA3NTU3O30NCkBsaXN0 IGwwOmxldmVsMQ0KCXttc28tbGV2ZWwtc3RhcnQtYXQ6MDsNCgltc28tbGV2ZWwtbnVtYmVyLWZv cm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDpu b25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTgu MHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDsNCgltc28tZmFyZWFzdC1mb250LWZhbWlseTpEZW5n WGlhbjsNCgltc28tYmlkaS1mb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIjt9DQpAbGlzdCBs MDpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10 ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIg TmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0 Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250 LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6bGV2ZWw0DQoJe21zby1sZXZlbC1udW1iZXIt Zm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9w Om5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0x OC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsNQ0KCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwt dGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1p bmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwwOmxl dmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6 74KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRp b246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9 DQpAbGlzdCBsMDpsZXZlbDcNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1z by1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwt bnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWls eTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw4DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1 bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1z by1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZv bnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWw5DQoJe21zby1sZXZlbC1u dW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRh Yi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5k ZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwxDQoJe21zby1s aXN0LWlkOjE2NjA3NzIzNDU7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOjcyNDU3NDg0NDt9DQpA bGlzdCBsMTpsZXZlbDENCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1s ZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MzYuMHB0Ow0KCW1zby1sZXZlbC1u dW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCW1zby1hbnNpLWZv bnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVsMg0K CXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCglt c28tbGV2ZWwtdGFiLXN0b3A6NzIuMHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVm dDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJ Zm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3IjsNCgltc28tYmlkaS1mb250LWZhbWlseToiVGltZXMg TmV3IFJvbWFuIjt9DQpAbGlzdCBsMTpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6 YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MTA4LjBw dDsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBw dDsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9 DQpAbGlzdCBsMTpsZXZlbDQNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1z by1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MTQ0LjBwdDsNCgltc28tbGV2 ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCgltc28tYW5z aS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMTps ZXZlbDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0 Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MTgwLjBwdDsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCgltc28tYW5zaS1mb250LXNpemU6 MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMTpsZXZlbDYNCgl7bXNv LWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28t bGV2ZWwtdGFiLXN0b3A6MjE2LjBwdDsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7 DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZv bnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMTpsZXZlbDcNCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6MjUyLjBwdDsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRl bnQ6LTE4LjBwdDsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5Oldp bmdkaW5nczt9DQpAbGlzdCBsMTpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVs bGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6Mjg4LjBwdDsN Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsN Cgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpA bGlzdCBsMTpsZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1s ZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MzI0LjBwdDsNCgltc28tbGV2ZWwt bnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCgltc28tYW5zaS1m b250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMg0KCXtt c28tbGlzdC1pZDoxNzIxNzA1MjQ5Ow0KCW1zby1saXN0LXRlbXBsYXRlLWlkczotMTMyNjAzNDMw Njt9DQpAbGlzdCBsMjpsZXZlbDENCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0K CW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MzYuMHB0Ow0KCW1zby1s ZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCW1zby1h bnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwyOmxl dmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6 bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6NzIuMHB0Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRp b246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4w cHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3IjsNCgltc28tYmlkaS1mb250LWZhbWlseToi VGltZXMgTmV3IFJvbWFuIjt9DQpAbGlzdCBsMjpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1m b3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 MTA4LjBwdDsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LTE4LjBwdDsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5Oldpbmdk aW5nczt9DQpAbGlzdCBsMjpsZXZlbDQNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0 Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MTQ0LjBwdDsNCglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglt c28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlz dCBsMjpsZXZlbDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZl bC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MTgwLjBwdDsNCgltc28tbGV2ZWwtbnVt YmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCgltc28tYW5zaS1mb250 LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMjpsZXZlbDYN Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsN Cgltc28tbGV2ZWwtdGFiLXN0b3A6MjE2LjBwdDsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9u OmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0 Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMjpsZXZlbDcNCgl7bXNvLWxldmVs LW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwt dGFiLXN0b3A6MjUyLjBwdDsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4 dC1pbmRlbnQ6LTE4LjBwdDsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFt aWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMjpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6Mjg4 LjBwdDsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4 LjBwdDsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5n czt9DQpAbGlzdCBsMjpsZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0K CW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MzI0LjBwdDsNCgltc28t bGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCgltc28t YW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpvbA0KCXtt YXJnaW4tYm90dG9tOjBjbTt9DQp1bA0KCXttYXJnaW4tYm90dG9tOjBjbTt9DQotLT48L3N0eWxl PjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIg c3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48 eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQi IGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+ DQo8Ym9keSBsYW5nPSJFTi1HQiIgbGluaz0iIzA1NjNDMSIgdmxpbms9IiM5NTRGNzIiPg0KPGRp diBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoZXJlIGFyZSB0 d28gYXNwZWN0cyBoZXJlOiA8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHVsIHN0eWxlPSJtYXJnaW4tdG9wOjBjbSIgdHlwZT0iZGlz YyI+DQo8bGkgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDowY207 bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzMiPldoYXQgaXMgc3BlY2lmaWVkIGluIHRlcm1zIG9mIGlu dGVyb3BlcmFiaWxpdHk8bzpwPjwvbzpwPjwvbGk+PGxpIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBo IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MGNtO21zby1saXN0OmwwIGxldmVsMSBsZm8zIj5XaGF0IGlz IGRlc2NyaWJlZCBhcyBwYXJ0IG9mIHRoZSBiaWdnZXIgcGljdHVyZS4NCjxvOnA+PC9vOnA+PC9s aT48L3VsPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5JRVRGIHNwZWNpZmljYXRpb25zLCBhcyB5b3UgY29ycmVjdGx5IG5v dGVkIGJlbG93LCBkbyBub3Qgc3BlY2lmeSBtYW55IGFzcGVjdHMgb2YgdGhlIGJpZyBwaWN0dXJl LiBXaGlsZSB0aGVyZSBhcmUgc29tZSBkb2N1bWVudHMgdGhhdCB0cnkgdG8gZGVzY3JpYmUgdGhl bSBhcyBwYXJ0IG9mIGFyY2hpdGVjdHVyZSBkb2N1bWVudHMgSUVURiBkb2N1bWVudHMgbmV2ZXIg Z28gaW50byB0aGUgZGV0YWlscyBvZiBtb3N0DQogdGhpbmdzLiA8bzpwPjwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+SU1ITyBFQVQgdG9rZW5zIHNob3VsZCBzcGVjaWZ5IGhvdyB0aGUgY2xhaW1zIGxvb2sg bGlrZSBhbmQgbm90IHdvcnJ5IGFib3V0IHRoZSByZXN0IHRvbyBtdWNoLiBUaGlzIGluY2x1ZGVz IG5vdCB0byB3b3JyeSBhYm91dCB0aGUgcm9vdCBvZiB0cnVzdC4NCjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhlIGFyY2hpdGVjdHVyZSBkb2N1bWVudCBjYW4gYW5kIHNo b3VsZCB0YWxrIGFib3V0IHRoZSBiaWdnZXIgcGljdHVyZSBidXQgbm90IG1hbmRhdGUgYSBzcGVj aWZpYyBkZXBsb3ltZW50IG9yIGltcGxlbWVudGF0aW9uLg0KPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPklzbuKAmXQgaXQgc2ltcGxlPyA8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Q2lhbzxvOnA+ PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SGFubmVzPG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2IHN0 eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzoz LjBwdCAwY20gMGNtIDBjbSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBsYW5nPSJF Ti1VUyI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIGxhbmc9IkVOLVVTIj4gUkFUUyAmbHQ7cmF0cy1i b3VuY2VzQGlldGYub3JnJmd0Ow0KPGI+T24gQmVoYWxmIE9mIDwvYj5MYXVyZW5jZSBMdW5kYmxh ZGU8YnI+DQo8Yj5TZW50OjwvYj4gU29ubnRhZywgNC4gQXVndXN0IDIwMTkgMjA6Mzg8YnI+DQo8 Yj5Ubzo8L2I+IHJhdHNAaWV0Zi5vcmc8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gW1JhdHNdIE5vIHJv b3Qgb2YgdHJ1c3QgcmVxdWlyZW1lbnQgaW4gUkFUUy9FQVQ8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5BbiBBbmRyb2lkIHBob25lIG9mdGVuIGxvb2tzIGxp a2UgdGhpczo8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJz cDsgLSBMaW51eCAvIEFuZHJvaWQgYXBwczxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7IC0gTGludXgga2VybmVsPG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgLSBUQeKAmXMgKFRy dXN0ZWQgQXBwcyDigJQgYXBwcyBydW5uaW5nIHRoZSBURUUpPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgLSBURUUga2VybmVsPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkl0IG11c3Qg YmUgYWxsb3dlZCBmb3IgYW55IG9uZSBvZiB0aGVzZSB0byBnZW5lcmF0ZSBSQVRTL0VBVCBhdHRl c3RhdGlvbnMuIEl0IG1pZ2h0IGJlIHRoYXQgb25seSB0aGUgQW5kcm9pZCBhcHAgZ2VuZXJhdGVz IFJBVFMvRUFUIGF0dGVzdGF0aW9ucy4gVGhpcyBwaG9uZSBpcyBqdXN0IG9uZSBleGFtcGxlLiBP dGhlciBkZXZpY2VzLCBsaWtlIGNhcnMsIG1heSBiZSBzaW1pbGFyLjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JZiB0aGVyZSBpcyBhIG5vcm1h dGl2ZSBvciBkZXNjcmlwdGl2ZSB0ZXh0IHNheWluZyBhIHJvb3Qgb2YgdHJ1c3QgaXMgcmVxdWly ZWQgdG8gZ2VuZXJhdGUgYW4gYXR0ZXN0YXRpb24sIHRoZW4gd2UgaGF2ZSB0byByZWRlZmluZSBy b290IG9mIHRydXN0IHRvIHNvIHRoYXQgQW5kcm9pZCBhcHBzIGFyZSByb290cyBvZiB0cnVzdC4g VGhpcyBpcyB2ZXJ5IGNvdW50ZXIgdG8gdGhlIG5vcm1hbCBkZWZpbml0aW9uDQogb2Ygcm9vdCBv ZiB0cnVzdC4gQnkgY29tbW9uIGRlZmluaXRpb24gdGhlIHJvb3Qgb2YgdHJ1c3Qgb2YgdGhlIGFi b3ZlIHBob25lIHdvdWxkIGJlIHRoZSBURUUuIFN1Y2ggYSByZWRlZmluaXRpb24gZm9yIFJBVFMg d291bGQgYmUgdmVyeSBjb25mdXNpbmcuIFNvIEkgZG9u4oCZdCB0aGluayBub3JtYXRpdmUgdGV4 dCBzaG91bGQgcmVxdWlyZSBhIHJvb3Qgb2YgdHJ1c3QuPG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk15IHNlY29uZCByZWFzb24gaXMgdGhhdCBJ IGRvbuKAmXQgdGhpbmsgdGhlIElFVEYgc2hvdWxkIHNldCBpbnRlcm5hbCBzZWN1cml0eSByZXF1 aXJlbWVudHMgZm9yIHRoZSBpbnRlcm5hbCBpbXBsZW1lbnRhdGlvbiBvZiBhbiBlbmQtcG9pbnQ6 PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8dWwgdHlwZT0iZGlzYyI+DQo8bGkgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvO21zby1saXN0OmwyIGxldmVsMSBsZm8xIj4NClRoZSBUTFMgUkZDIGRv ZXMgbm90IHJlcXVpcmUgYW4gSFNNLCBldmVuIGluIGl0cyB2ZXJ5IGV4dGVuc2l2ZSBzZWN1cml0 eSBjb25zaWRlcmF0aW9uczxvOnA+PC9vOnA+PC9saT48bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21z by1saXN0OmwyIGxldmVsMSBsZm8xIj4NCkNPU0UgbWVudGlvbnMga2V5cyBzaG91bGQgYmUgcHJv dGVjdGVkLCBidXQgb25seSBhcyBhIHJlY29tbWVuZGF0aW9uIGFuZCBvbmx5IGluIHNlY3VyaXR5 IGNvbnNpZGVyYXRpb25zPG86cD48L286cD48L2xpPjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bXNv LWxpc3Q6bDIgbGV2ZWwxIGxmbzEiPg0KQXQgdGhlIFdyaXRpbmcgU2VjdXJpdHkgQ29uc2lkZXJh dGlvbnMgdHV0b3JpYWwgaW4gTW9udHJlYWwsIFlvYXYgTmlyIHNhaWQgdGhhdCBJRVRGIGRvZXNu 4oCZdCBnZXQgaW50byBlbmQtcG9pbnQgc2VjdXJpdHkgaW50ZXJuYWxzIHNvIG11Y2g8bzpwPjwv bzpwPjwvbGk+PGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6 YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttc28tbGlzdDpsMiBsZXZlbDEgbGZvMSI+ DQpTb21lIG9mIG15IElFVEYgZnJpZW5kcyB0ZWxsIG1lIFNIT1VMRCBhbmQgTVVTVCBhcmUgZm9y Jm5ic3A7PGk+aW50ZXJvcGVyYWJpbGl0eTwvaT4mbmJzcDthc3BlY3RzIG9mIGEgcHJvdG9jb2wg b25seTxvOnA+PC9vOnA+PC9saT48L3VsPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ SSB0aGluayBpdCBpcyBmaW5lIHRvOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHVs IHR5cGU9ImRpc2MiPg0KPGxpIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzttc28tbGlzdDpsMSBsZXZlbDEg bGZvMiI+DQpNZW50aW9uIGEgcm9vdCBvZiB0cnVzdCBhcyBhbiBleGFtcGxlPG86cD48L286cD48 L2xpPjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzIiPg0KSGF2 ZSBsb3RzIG9mIHRleHQgaW4gc2VjdXJpdHkgY29uc2lkZXJhdGlvbnMgYWJvdXQgc2lnbmluZyBr ZXkgcHJvdGVjdGlvbjxvOnA+PC9vOnA+PC9saT48bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21zby1s aXN0OmwxIGxldmVsMSBsZm8yIj4NClJlcXVpcmUgYSByb290IG9mIHRydXN0IGluIHByb2ZpbGUg ZG9jdW1lbnRzLCBwYXJ0aWN1bGFybHkgb25lcyBvdXRzaWRlIHRoZSBJRVRGPG86cD48L286cD48 L2xpPjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxpc3Q6bDEgbGV2ZWwxIGxmbzIiPg0KSGF2 ZSBjbGFpbXMgdGhhdCBkZXNjcmliZSB0aGUgaW50ZXJuYWwgc2VjdXJpdHkgb2YgYW4gZW50aXR5 PG86cD48L286cD48L2xpPjwvdWw+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+SSBrbm93IHRoYXQgbGFyZ2UgcGFydHMgb2YgdGhlIFRDRyBhbmQgVEVFIHdv cmxkcyBoYXZlIHRoZSByb290IG9mIHRydXN0IGFzIGEgZnVuZGFtZW50YWwgcGFydCBvZiB0aGVp ciBhcmNoaXRlY3R1cmVzLiBJdCBtYWtlcyBzZW5zZSB0aGVyZS4gSG93ZXZlciwgdGhlc2UgZ3Jv dXBzIGZ1bmRhbWVudGFsbHkgd29yayBvbiB0aGUgc2VjdXJpdHkgaW50ZXJuYWxzIG9mIGVuZCBw b2ludHMuIFRoZSBJRVRGIGRvZXMNCiBub3QuIEl0IGZvY3VzZXMgb24gb24tdGhlLXdpcmUgc2Vj dXJpdHkuIFRodXMsIGl0IG1ha2VzIHNlbnNlIHRoYXQgb3JpZW50YXRpb25zIGFyb3VuZCBlbmQt cG9pbnQgaW50ZXJuYWwgc2VjdXJpdHkgaW1wbGVtZW50YXRpb24gaXMgZGlmZmVyZW50LiAmbmJz cDtTb21lIG9mIHdoYXQgZ29lcyBpbiB0aGUgVENHIGFuZCBURUUgd29ybGRzIGRvZXNu4oCZdCBj YXJyeSBvdmVyIHRvIHRoZSBJRVRGLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5JIGtub3cgcmVvcmllbnRpbmcgdGhlIFJBVFMgYXJjaGl0ZWN0 dXJlIGRyYWZ0IHRvIG5vdCBoaW5nZSBvbiByb290cyBvZiB0cnVzdCBpcyBhIGJpZyB1cGhlYXZh bCwgYnV0IEkgdGhpbmsgaXQgaXMgbmVjZXNzYXJ5LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5MTDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCklNUE9SVEFOVCBOT1RJQ0U6IFRoZSBjb250ZW50cyBvZiB0aGlzIGVtYWlsIGFuZCBh bnkgYXR0YWNobWVudHMgYXJlIGNvbmZpZGVudGlhbCBhbmQgbWF5IGFsc28gYmUgcHJpdmlsZWdl ZC4gSWYgeW91IGFyZSBub3QgdGhlIGludGVuZGVkIHJlY2lwaWVudCwgcGxlYXNlIG5vdGlmeSB0 aGUgc2VuZGVyIGltbWVkaWF0ZWx5IGFuZCBkbyBub3QgZGlzY2xvc2UgdGhlIGNvbnRlbnRzIHRv IGFueSBvdGhlciBwZXJzb24sIHVzZSBpdCBmb3IgYW55IHB1cnBvc2UsDQogb3Igc3RvcmUgb3Ig Y29weSB0aGUgaW5mb3JtYXRpb24gaW4gYW55IG1lZGl1bS4gVGhhbmsgeW91Lg0KPC9ib2R5Pg0K PC9odG1sPg0K --_000_AM0PR08MB534566E2C6D43AACFAA6FA98FAD40AM0PR08MB5345eurp_-- From nobody Wed Aug 7 08:45:13 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0698C120416 for ; Wed, 7 Aug 2019 08:45:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=4iGy76i3; dkim=fail (1024-bit key) reason="fail (body has been altered)" header.d=armh.onmicrosoft.com header.b=9oxL3yF/ Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bV4jHlAPcGNQ for ; Wed, 7 Aug 2019 08:45:03 -0700 (PDT) Received: from EUR03-VE1-obe.outbound.protection.outlook.com (mail-ve1eur03on061e.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe09::61e]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 747B512041E for ; Wed, 7 Aug 2019 08:45:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=+d50ZLWOv75wYtcHbMNI/weKa25BffwhCU0/rXBojIA=; b=4iGy76i3gccnpUV5P+Wde7yVTj3wr1qT3+/hg9Dc5Atw2mRLqO7aEkgMAXaWzhBECGqx+7p7qdeq3borEKNlWsod1vJQzHy7XQCwwqyQ7Y+cvMjIrQ4Ro57SpdxRKAQ1Lm5V5+2PmmRF/CuLFbJFcwOWaKgwSXNjG7tjO8Kx+l8= Received: from VI1PR08CA0246.eurprd08.prod.outlook.com (2603:10a6:803:dc::19) by AM5PR0802MB2596.eurprd08.prod.outlook.com (2603:10a6:203:98::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2136.17; Wed, 7 Aug 2019 15:44:58 +0000 Received: from DB5EUR03FT010.eop-EUR03.prod.protection.outlook.com (2a01:111:f400:7e0a::203) by VI1PR08CA0246.outlook.office365.com (2603:10a6:803:dc::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2157.15 via Frontend Transport; Wed, 7 Aug 2019 15:44:57 +0000 Authentication-Results: spf=temperror (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; ietf.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;ietf.org; dmarc=temperror action=none header.from=arm.com; Received-SPF: TempError (protection.outlook.com: error in processing during lookup of arm.com: DNS Timeout) Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by DB5EUR03FT010.mail.protection.outlook.com (10.152.20.96) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2052.18 via Frontend Transport; Wed, 7 Aug 2019 15:44:56 +0000 Received: ("Tessian outbound 71602e13cd49:v26"); Wed, 07 Aug 2019 15:44:54 +0000 X-CR-MTA-TID: 64aa7808 Received: from 183663b85fd8.1 (ip-172-16-0-2.eu-west-1.compute.internal [104.47.5.52]) by 64aa7808-outbound-1.mta.getcheckrecipient.com id C7B228B8-CB7E-4CE5-A17B-1957F26C9363.1; Wed, 07 Aug 2019 15:44:49 +0000 Received: from EUR02-HE1-obe.outbound.protection.outlook.com (mail-he1eur02lp2052.outbound.protection.outlook.com [104.47.5.52]) by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id 183663b85fd8.1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384); Wed, 07 Aug 2019 15:44:49 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=SJpTfB9pBVkQPamVf9Q2d7L+wj7zCBDWsFeD/CFjpJ/ikkt+/ysGXynZPk5QnDa9lAfP4oPM5vtSVXsmX/G8wuxi6CBeBi7lTNCq+QEVYt69WYauSwgtlPmNZsbgVHft5gJcDgZP4l4PFW7JRscBsI2oMPMF0fV2FT+hE1ECPiJ4iG9pSXRDdglXdt0EzBAqfTnbAcqyKFZpbNjglMKb5gk4RBEvoXic/NPJtQkc/0fEHB4QbBaOrfttLjlyuuomdvYSWdAbZDdYqIzos0fVKHNs8H70mKlDUbjfE4fBrS9GlOj3A1nTNAtg2EUzcVz2XJ5ew5Zqp0vhRRtz7JDA+A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=wHsn4BzzzFqQsTq0JrjDekBpw5YJNLIqT+nHYjf1OL8=; b=E8TdAJVlm+i7wGEBxpW+8jBTUPb9zjfPpbfyO2zU6ElJAbZKkLC7HIlD19FV95Ic2+vTIb6BEMlwlV/cM+/MQpiIejzlhTE0uGAu3Otd0s3YS4KMeQ1n+cSdt7Nmh2CRC0q46lIizOwoJua06AG+fhTQw1qX1JRcaaQbf/on10iB9W4NwyD2R1cgNKT+za9JNzQQuGWhFhfAStFtbIJ3hyeT9LMj2cznssJqMGT4EGzLysMAXAgskGVp3K7bYFVLEf6UzoZkqSZz50kXqGxvlphDwY8H+saMZNgqcYh9tBVttW0WHAk4wpppK28L2qlyQgnp3Pw4wuwdlq4DYyCMYQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=arm.com; dmarc=pass action=none header.from=arm.com; dkim=pass header.d=arm.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=wHsn4BzzzFqQsTq0JrjDekBpw5YJNLIqT+nHYjf1OL8=; b=9oxL3yF/UpfKN1MmIx5/IiPIPymwFVBcWQFdbNttx4QpOgW5P+d/kcTjO9RmLUlVhsJbyvlpDUmDWDX30Cv4p+CKyoDJoDmHJ59pJMBp8Q3WKYVYYEZEpUeDT08DPdi5VM8ogw5E8hL2U/rjEi7WvUsdNyGp7DgswIDu7Dht+Fg= Received: from DB7PR08MB3642.eurprd08.prod.outlook.com (20.177.120.148) by DB7PR08MB2970.eurprd08.prod.outlook.com (52.134.107.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2157.13; Wed, 7 Aug 2019 15:44:47 +0000 Received: from DB7PR08MB3642.eurprd08.prod.outlook.com ([fe80::88e4:1b47:b2c1:965f]) by DB7PR08MB3642.eurprd08.prod.outlook.com ([fe80::88e4:1b47:b2c1:965f%5]) with mapi id 15.20.2157.015; Wed, 7 Aug 2019 15:44:47 +0000 From: Simon Frost To: Laurence Lundblade , Thomas Hardjono CC: "rats@ietf.org" , Kathleen Moriarty , "Smith, Ned" , "Eliot Lear" , Anders Rundgren Thread-Topic: [Rats] No root of trust requirement in RATS/EAT Thread-Index: AQHVTRsrsg1VzcY/YUmIM2A9q/ruX6bv0SKw Date: Wed, 7 Aug 2019 15:44:47 +0000 Message-ID: References: <2DE09A2A-A6EA-4474-9DBE-8D52B523645B@island-resort.com> <987fbfbb-b3f6-c104-878a-b283978ca0f0@gmail.com> <6F1E85F0-35CB-415A-9672-BD3257F59373@island-resort.com> <2c9ebe7b-9826-2d23-6f86-d098b79128d6@gmail.com> <8E4ED21F-EE52-4FAF-AFCB-A7624C56ED28@island-resort.com> <148D90BA-036A-4682-B920-4650182E2CB1@cisco.com> <5e0900299b6c4fd28843814d656b625d@oc11expo23.exchange.mit.edu> <52607B4E-C89C-4C6A-A21B-CC2D2CC0C3FA@island-resort.com> In-Reply-To: <52607B4E-C89C-4C6A-A21B-CC2D2CC0C3FA@island-resort.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ts-tracking-id: 188e30f8-a496-409a-9c07-302a5fd8346d.0 x-checkrecipientchecked: true Authentication-Results-Original: spf=none (sender IP is ) smtp.mailfrom=Simon.Frost@arm.com; x-originating-ip: [217.140.106.51] x-ms-publictraffictype: Email X-MS-Office365-Filtering-Correlation-Id: 178605ce-5a13-43f7-6275-08d71b4e3274 X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam-Untrusted: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:DB7PR08MB2970; X-MS-TrafficTypeDiagnostic: DB7PR08MB2970:|AM5PR0802MB2596: X-Microsoft-Antispam-PRVS: x-checkrecipientrouted: true x-ms-oob-tlc-oobclassifiers: OLM:8273;OLM:8273; x-forefront-prvs: 01221E3973 X-Forefront-Antispam-Report-Untrusted: SFV:NSPM; SFS:(10009020)(4636009)(136003)(39860400002)(366004)(396003)(376002)(346002)(189003)(199004)(64756008)(316002)(81166006)(99286004)(81156014)(8936002)(25786009)(8676002)(26005)(4326008)(186003)(14454004)(76176011)(110136005)(54906003)(7696005)(478600001)(66556008)(7736002)(256004)(66446008)(66476007)(6436002)(5660300002)(76116006)(74316002)(6246003)(66946007)(86362001)(2171002)(33656002)(229853002)(2906002)(68736007)(71190400001)(71200400001)(486006)(11346002)(476003)(53936002)(52536014)(3846002)(790700001)(6116002)(102836004)(53546011)(6506007)(446003)(236005)(66066001)(9686003)(55016002)(54896002)(6306002); DIR:OUT; SFP:1101; SCL:1; SRVR:DB7PR08MB2970; H:DB7PR08MB3642.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam-Message-Info-Original: gkKtE68/5AeZjiMbaiwaviBPiz2jJtBvcnxafsjikV/hSos1K0eNKwARuz/fy769a6r2MUGhMZWjZrRjy+Uhk+iD2Ag+hfkagv9NvTDDQC72DmXydsbGzUXO54vcNc63eI9WVZe3Fg89OlwL/U1iCHZGmuZCc8/8anDlFmxLK9+o8+ecu1Xu/aPmIRgxDKRfGv4vA1KGf1vim6QeTHw1pQNkqHE2ZuNijdfWeQ80qblezQfTZZ4a3TcWRRWSn0FIE64GC9Xkq/Rd1/ZZryuoOIG0mcucviOUlpl0SW8paB1bQSpRcHn280n+ODN4DK/5nylNB4n6f0s2khWFavGJpY3SvPZAS6lhRpFfenY9EqutY6cn6PczQ//N+FAxmQWjGAIeyBiTtrLOZD0KX8KN3BZEyPrBJzk2E8SSEIQpOn8= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_DB7PR08MB3642B467A11DA346267DE7BBEFD40DB7PR08MB3642eurp_" MIME-Version: 1.0 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB7PR08MB2970 Original-Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=Simon.Frost@arm.com; X-EOPAttributedMessage: 0 X-MS-Exchange-Transport-CrossTenantHeadersStripped: DB5EUR03FT010.eop-EUR03.prod.protection.outlook.com X-Forefront-Antispam-Report: CIP:63.35.35.123; IPV:CAL; SCL:-1; CTRY:IE; EFV:NLI; SFV:NSPM; SFS:(10009020)(4636009)(346002)(136003)(376002)(39860400002)(396003)(2980300002)(40434004)(189003)(199004)(3846002)(26826003)(790700001)(76176011)(6116002)(7696005)(14454004)(99286004)(86362001)(14444005)(54906003)(5024004)(81166006)(7736002)(81156014)(22756006)(74316002)(110136005)(102836004)(16586007)(53546011)(478600001)(6506007)(2906002)(33964004)(316002)(61614004)(66066001)(236005)(446003)(55016002)(11346002)(356004)(70586007)(6306002)(9686003)(8936002)(486006)(476003)(54896002)(126002)(76130400001)(33656002)(186003)(4326008)(5660300002)(71190400001)(336012)(6246003)(52536014)(70206006)(25786009)(63350400001)(8676002)(63370400001)(2171002)(229853002)(26005)(107886003); DIR:OUT; SFP:1101; SCL:1; SRVR:AM5PR0802MB2596; H:64aa7808-outbound-1.mta.getcheckrecipient.com; FPR:; SPF:TempError; LANG:en; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; MX:1; A:1; X-MS-Office365-Filtering-Correlation-Id-Prvs: 43e3fe67-9e09-4f83-c90b-08d71b4e2d44 X-Microsoft-Antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(710020)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:AM5PR0802MB2596; X-Forefront-PRVS: 01221E3973 X-Microsoft-Antispam-Message-Info: mZkmdV8BdHakRTrGXQW2+5wERN3e3izXO97tRriw7qI+dPXP0sbNi2bOUk0rd7Z/IWtnjjmfq4biyeFds/KJivQlwuwhDapysOymiB3XRFcm1BDA0qVi2J8/lIMZKIYA5eqeqDETKnZPS4IhHTKY6OmwE0WvOq08eJZuiJVRGDgzwpudldzEvlbHKghXUw7zVWCSBWndMcBWmBWp7PsbnjDZpL24OxhVTuLJP6BZjqUH6aVA84M4LR9j++hAv4mP4pWhkeHwdFNUAR6o7zOPwa+LAxzIvrdl4+0qFgS47zqugYM1A5Q5rq7s2bu3P8/Nhm0K0Qk1t8A+MfbgE5u1vZdpE4CkLC6Uzz5pFSGABXxSIjazj2xGNV/ffQvfb9LaiAXu5xi7QblkyOL+VedyzTDK8T16M20K/wtnNQCviLw= X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Aug 2019 15:44:56.3361 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 178605ce-5a13-43f7-6275-08d71b4e3274 X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM5PR0802MB2596 Archived-At: Subject: Re: [Rats] No root of trust requirement in RATS/EAT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 15:45:06 -0000 --_000_DB7PR08MB3642B467A11DA346267DE7BBEFD40DB7PR08MB3642eurp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 PiBJIHRoaW5rIOKAmHRydXN0ZWTigJkgY2FuIGJlIHllcy1vci1ubyBpbiBzcGVjaWZpYyB1c2Ug Y2FzZXMgd2hlcmUgcmVxdWlyZW1lbnRzIGFuZCB0aGUgdGhyZWF0IG1vZGVsIGFyZSBjbGVhcmx5 IHNldCBhbmQgZGV0ZXJtaW5lZCwgYnV0IHdlIGFyZSBub3Qgd29ya2luZyBvbiBvbmUgb2YgdGhv c2UuIE91ciBhdHRlc3RhdGlvbiB3b3JrIGhhcyB0byBzcGFuIGZyb20gdXNlIGNhc2VzIHRoYXQg b25seSBzdGFuZCB1cCB0byBsYW1lIHdhbm5hIGJlIGhhY2tlcnMgdG8gdXNlIGNhc2VzIHRoYXQg c3RhbmQgdXAgdG8gbmF0aW9uIHN0YXRlcy4NCg0KUGVyaGFwcyBpdOKAmXMgYXBwcm9wcmlhdGUg dGhlbiB0aGF0IHRoZSBVc2UgQ2FzZXMgZG9jdW1lbnQgaXMgYW5ub3RhdGVkIHdpdGggZXhwZWN0 YXRpb25zIG9mIFRydXN0IG9yIGludGVycHJldGF0aW9ucyBvZiBSb1QgcGVyIHVzZSBjYXNlIHJh dGhlciB0aGFuIHB1dHRpbmcgYW4gb3ZlciBnZW5lcmFsaXNhdGlvbiBpbnRvIHRoZSBBcmNoaXRl Y3R1cmUgc3BlYz8NCg0KRnJvbTogTGF1cmVuY2UgTHVuZGJsYWRlIDxsZ2xAaXNsYW5kLXJlc29y dC5jb20+DQpTZW50OiAwNyBBdWd1c3QgMjAxOSAwMDoyMw0KVG86IFRob21hcyBIYXJkam9ubyA8 aGFyZGpvbm9AbWl0LmVkdT4NCkNjOiByYXRzQGlldGYub3JnOyBLYXRobGVlbiBNb3JpYXJ0eSA8 a2F0aGxlZW4ubW9yaWFydHkuaWV0ZkBnbWFpbC5jb20+OyBTbWl0aCwgTmVkIDxuZWQuc21pdGhA aW50ZWwuY29tPjsgRWxpb3QgTGVhciA8bGVhckBjaXNjby5jb20+OyBBbmRlcnMgUnVuZGdyZW4g PGFuZGVycy5ydW5kZ3Jlbi5uZXRAZ21haWwuY29tPg0KU3ViamVjdDogUmU6IFtSYXRzXSBObyBy b290IG9mIHRydXN0IHJlcXVpcmVtZW50IGluIFJBVFMvRUFUDQoNCg0KT24gQXVnIDYsIDIwMTks IGF0IDM6NTQgUE0sIFRob21hcyBIYXJkam9ubyA8aGFyZGpvbm9AbWl0LmVkdTxtYWlsdG86aGFy ZGpvbm9AbWl0LmVkdT4+IHdyb3RlOg0KDQpFdmVyeXRoaW5nIGNhbiBiZSBjcmFja2VkLCBidXQg dGhhdCBkb2Vzbid0IG1lYW4gd2Ugc2hvdWxkIG5vdCB1c2UgInRydXN0ZWQgSC9XIiBsaWtlIHRo ZSBUUE0uICBUaGlzIGlzIHdoeSB0aGUgbm90aW9uIG9mIHRoZSBUQ0Igd2FzIGRldmVsb3BlZCAo T3JhbmdlIEJvb2spLCBidXQgdGhpcyBpcyBhIHNlcGFyYXRlIGRpc2N1c3Npb24uDQoNClNvLCBu b3Qgc3VyZSB3aGF0IHlvdSBtZWFuIGJ5IOKAmHVzZSDigJx0cnVzdGVkIEgvV+KAnSBsaWtlIHRo ZSBUUE3igJkuIEl0IGNvdWxkIG1lYW46DQoNCjEpIFRQTSBjaGlwcyBhcmUgZ29vZCBhbmQgdXNl ZnVsIHRoaW5ncyBmb3IgdGhlIHdvcmxkIHRvIHVzZS4gSSBhZ3JlZS4NCg0KMikgVGhlIHRlcm0g 4oCYdHJ1c3RlZCBIL1figJkgaGFzIGNsZWFyIG1lYW5pbmcuIEkgZGlzYWdyZWUgcGVyIG15IHBy ZXZpb3VzIGNvbW1lbnRzIGFib3V0IGRlZ3JlZS4NCg0KMykgV2Ugc2hvdWxkIHVzZSB0aGUgdGVy bSDigJh0cnVzdGVkIEgvV+KAmSBpbiB0aGUgUkFUUyBhcmNoaXRlY3R1cmUgZG9jdW1lbnQuIEkg ZGlzYWdyZWUgYmVjYXVzZSBvZiAyKSBhYm92ZSBhbmQgb3RoZXIgY29tbWVudHMuDQoNCkkgdGhp bmsg4oCYdHJ1c3RlZOKAmSBjYW4gYmUgeWVzLW9yLW5vIGluIHNwZWNpZmljIHVzZSBjYXNlcyB3 aGVyZSByZXF1aXJlbWVudHMgYW5kIHRoZSB0aHJlYXQgbW9kZWwgYXJlIGNsZWFybHkgc2V0IGFu ZCBkZXRlcm1pbmVkLCBidXQgd2UgYXJlIG5vdCB3b3JraW5nIG9uIG9uZSBvZiB0aG9zZS4gT3Vy IGF0dGVzdGF0aW9uIHdvcmsgaGFzIHRvIHNwYW4gZnJvbSB1c2UgY2FzZXMgdGhhdCBvbmx5IHN0 YW5kIHVwIHRvIGxhbWUgd2FubmEgYmUgaGFja2VycyB0byB1c2UgY2FzZXMgdGhhdCBzdGFuZCB1 cCB0byBuYXRpb24gc3RhdGVzLg0KDQpMTA0KDQpJTVBPUlRBTlQgTk9USUNFOiBUaGUgY29udGVu dHMgb2YgdGhpcyBlbWFpbCBhbmQgYW55IGF0dGFjaG1lbnRzIGFyZSBjb25maWRlbnRpYWwgYW5k IG1heSBhbHNvIGJlIHByaXZpbGVnZWQuIElmIHlvdSBhcmUgbm90IHRoZSBpbnRlbmRlZCByZWNp cGllbnQsIHBsZWFzZSBub3RpZnkgdGhlIHNlbmRlciBpbW1lZGlhdGVseSBhbmQgZG8gbm90IGRp c2Nsb3NlIHRoZSBjb250ZW50cyB0byBhbnkgb3RoZXIgcGVyc29uLCB1c2UgaXQgZm9yIGFueSBw dXJwb3NlLCBvciBzdG9yZSBvciBjb3B5IHRoZSBpbmZvcm1hdGlvbiBpbiBhbnkgbWVkaXVtLiBU aGFuayB5b3UuDQo= --_000_DB7PR08MB3642B467A11DA346267DE7BBEFD40DB7PR08MB3642eurp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30NCkBmb250LWZhY2UN Cgl7Zm9udC1mYW1pbHk6V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7 fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToy IDQgNSAzIDUgNCA2IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6RGVuZ1hpYW47 DQoJcGFub3NlLTE6MiAxIDYgMCAzIDEgMSAxIDEgMTt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFt aWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiXEBEZW5nWGlhbiI7DQoJcGFub3NlLTE6MiAxIDYgMCAzIDEgMSAx IDEgMTt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1h bCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsN Cglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30N CmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNv bG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4u TXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1 cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAuTXNvTGlzdFBhcmFncmFwaCwg bGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgNCgl7bXNvLXN0eWxlLXBy aW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6MGNtOw0KCW1hcmdpbi1yaWdodDowY207DQoJbWFyZ2lu LWJvdHRvbTowY207DQoJbWFyZ2luLWxlZnQ6MzYuMHB0Ow0KCW1hcmdpbi1ib3R0b206LjAwMDFw dDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlm O30NCnAubXNvbm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0 eWxlLW5hbWU6bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1y aWdodDowY207DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGNt Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7 fQ0Kc3Bhbi5FbWFpbFN0eWxlMTgNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJ Zm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQou TXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6 MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjYxMi4wcHQgNzkyLjBwdDsNCglt YXJnaW46NzIuMHB0IDcyLjBwdCA3Mi4wcHQgNzIuMHB0O30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7 cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLyogTGlzdCBEZWZpbml0aW9ucyAqLw0KQGxpc3QgbDANCgl7 bXNvLWxpc3QtaWQ6MjE2ODE2MDAzOw0KCW1zby1saXN0LXR5cGU6aHlicmlkOw0KCW1zby1saXN0 LXRlbXBsYXRlLWlkczotMTI2Mzc0ODg3MiAtMzIyODAwMTQ2IDI2ODQzNTQ1OSAyNjg0MzU0NjEg MjY4NDM1NDU3IDI2ODQzNTQ1OSAyNjg0MzU0NjEgMjY4NDM1NDU3IDI2ODQzNTQ1OSAyNjg0MzU0 NjE7fQ0KQGxpc3QgbDA6bGV2ZWwxDQoJe21zby1sZXZlbC1zdGFydC1hdDowOw0KCW1zby1sZXZl bC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvg5g7DQoJbXNvLWxldmVs LXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQt aW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzOw0KCW1zby1mYXJlYXN0LWZv bnQtZmFtaWx5OkRlbmdYaWFuOw0KCW1zby1iaWRpLWZvbnQtZmFtaWx5OkFyaWFsO30NCkBsaXN0 IGwwOmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVs LXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseToiQ291cmll ciBOZXciO30NCkBsaXN0IGwwOmxldmVsMw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxs ZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1z by1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZv bnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDQNCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LTE4LjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw1DQoJe21zby1s ZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZl bC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0 LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6 bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4 dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2Rpbmdz O30NCkBsaXN0IGwwOmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJ bXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZl bC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFt aWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6 YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJ bXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJ Zm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDkNCgl7bXNvLWxldmVs LW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwt dGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1p bmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDENCgl7bXNv LWxpc3QtaWQ6NzMxMjczODIyOw0KCW1zby1saXN0LXR5cGU6aHlicmlkOw0KCW1zby1saXN0LXRl bXBsYXRlLWlkczotMTk5MzkzNjg1OCAtMjU2MDUzNDk2IDI2ODQzNTQ1OSAyNjg0MzU0NjEgMjY4 NDM1NDU3IDI2ODQzNTQ1OSAyNjg0MzU0NjEgMjY4NDM1NDU3IDI2ODQzNTQ1OSAyNjg0MzU0NjE7 fQ0KQGxpc3QgbDE6bGV2ZWwxDQoJe21zby1sZXZlbC1zdGFydC1hdDowOw0KCW1zby1sZXZlbC1u dW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvg5g7DQoJbXNvLWxldmVsLXRh Yi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5k ZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzOw0KCW1zby1mYXJlYXN0LWZvbnQt ZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iOw0KCW1zby1iaWRpLWZvbnQtZmFtaWx5OkNhbGlicmk7 fQ0KQGxpc3QgbDE6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCglt c28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1u dW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5 OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDE6bGV2ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9y bWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5v bmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4w cHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwxOmxldmVsNA0KCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZl bC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0 LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMTpsZXZlbDUN Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJ bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0 Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpA bGlzdCBsMTpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1s ZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVt YmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseTpX aW5nZGluZ3M7fQ0KQGxpc3QgbDE6bGV2ZWw3DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1 bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJ bXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJ Zm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwxOmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVy LWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4 LjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwxOmxldmVsOQ0KCXtt c28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1z by1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsN Cgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpvbA0KCXtt YXJnaW4tYm90dG9tOjBjbTt9DQp1bA0KCXttYXJnaW4tYm90dG9tOjBjbTt9DQotLT48L3N0eWxl PjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIg c3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48 eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQi IGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+ DQo8Ym9keSBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0 aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+Jmd0Ozwvc3Bh bj48c3BhbiBsYW5nPSJFTi1HQiI+IDwvc3Bhbj5JIHRoaW5rIOKAmHRydXN0ZWTigJkgY2FuIGJl IHllcy1vci1ubyBpbiBzcGVjaWZpYyB1c2UgY2FzZXMgd2hlcmUgcmVxdWlyZW1lbnRzIGFuZCB0 aGUgdGhyZWF0IG1vZGVsIGFyZSBjbGVhcmx5IHNldCBhbmQgZGV0ZXJtaW5lZCwgYnV0IHdlIGFy ZSBub3Qgd29ya2luZyBvbiBvbmUgb2YgdGhvc2UuIE91ciBhdHRlc3RhdGlvbg0KIHdvcmsgaGFz IHRvIHNwYW4gZnJvbSB1c2UgY2FzZXMgdGhhdCBvbmx5IHN0YW5kIHVwIHRvIGxhbWUgd2FubmEg YmUgaGFja2VycyB0byB1c2UgY2FzZXMgdGhhdCBzdGFuZCB1cCB0byBuYXRpb24gc3RhdGVzLjxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1HQiI+UGVyaGFwcyBpdOKAmXMg YXBwcm9wcmlhdGUgdGhlbiB0aGF0IHRoZSBVc2UgQ2FzZXMgZG9jdW1lbnQgaXMgYW5ub3RhdGVk IHdpdGggZXhwZWN0YXRpb25zIG9mIFRydXN0IG9yIGludGVycHJldGF0aW9ucyBvZiBSb1QgcGVy IHVzZSBjYXNlIHJhdGhlciB0aGFuIHB1dHRpbmcgYW4gb3ZlciBnZW5lcmFsaXNhdGlvbiBpbnRv IHRoZSBBcmNoaXRlY3R1cmUgc3BlYz88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3Jk ZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwY20g MGNtIDBjbSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBsYW5nPSJFTi1VUyI+RnJv bTo8L3NwYW4+PC9iPjxzcGFuIGxhbmc9IkVOLVVTIj4gTGF1cmVuY2UgTHVuZGJsYWRlICZsdDts Z2xAaXNsYW5kLXJlc29ydC5jb20mZ3Q7DQo8YnI+DQo8Yj5TZW50OjwvYj4gMDcgQXVndXN0IDIw MTkgMDA6MjM8YnI+DQo8Yj5Ubzo8L2I+IFRob21hcyBIYXJkam9ubyAmbHQ7aGFyZGpvbm9AbWl0 LmVkdSZndDs8YnI+DQo8Yj5DYzo8L2I+IHJhdHNAaWV0Zi5vcmc7IEthdGhsZWVuIE1vcmlhcnR5 ICZsdDtrYXRobGVlbi5tb3JpYXJ0eS5pZXRmQGdtYWlsLmNvbSZndDs7IFNtaXRoLCBOZWQgJmx0 O25lZC5zbWl0aEBpbnRlbC5jb20mZ3Q7OyBFbGlvdCBMZWFyICZsdDtsZWFyQGNpc2NvLmNvbSZn dDs7IEFuZGVycyBSdW5kZ3JlbiAmbHQ7YW5kZXJzLnJ1bmRncmVuLm5ldEBnbWFpbC5jb20mZ3Q7 PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbUmF0c10gTm8gcm9vdCBvZiB0cnVzdCByZXF1aXJl bWVudCBpbiBSQVRTL0VBVDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJt YXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPk9uIEF1ZyA2LCAyMDE5LCBhdCAzOjU0IFBNLCBUaG9tYXMgSGFyZGpvbm8gJmx0 OzxhIGhyZWY9Im1haWx0bzpoYXJkam9ub0BtaXQuZWR1Ij5oYXJkam9ub0BtaXQuZWR1PC9hPiZn dDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNh bnMtc2VyaWYiPkV2ZXJ5dGhpbmcgY2FuIGJlIGNyYWNrZWQsIGJ1dCB0aGF0IGRvZXNuJ3QgbWVh biB3ZSBzaG91bGQgbm90IHVzZSAmcXVvdDt0cnVzdGVkIEgvVyZxdW90OyBsaWtlIHRoZSBUUE0u ICZuYnNwO1RoaXMgaXMgd2h5IHRoZSBub3Rpb24gb2YgdGhlIFRDQiB3YXMgZGV2ZWxvcGVkIChP cmFuZ2UgQm9vayksIGJ1dCB0aGlzIGlzDQogYSBzZXBhcmF0ZSBkaXNjdXNzaW9uLjwvc3Bhbj48 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5Tbywgbm90IHN1cmUgd2hhdCB5b3UgbWVhbiBieSDigJh1c2Ug4oCcdHJ1c3RlZCBIL1fi gJ0gbGlrZSB0aGUgVFBN4oCZLiBJdCBjb3VsZCBtZWFuOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4xKSBUUE0gY2hpcHMgYXJlIGdvb2QgYW5k IHVzZWZ1bCB0aGluZ3MgZm9yIHRoZSB3b3JsZCB0byB1c2UuIEkgYWdyZWUuPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjIpIFRoZSB0ZXJtIOKA mHRydXN0ZWQgSC9X4oCZIGhhcyBjbGVhciBtZWFuaW5nLiBJIGRpc2FncmVlIHBlciBteSBwcmV2 aW91cyBjb21tZW50cyBhYm91dCBkZWdyZWUuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjMpIFdlIHNob3VsZCB1c2UgdGhlIHRlcm0g4oCYdHJ1 c3RlZCBIL1figJkgaW4gdGhlIFJBVFMgYXJjaGl0ZWN0dXJlIGRvY3VtZW50LiBJIGRpc2FncmVl IGJlY2F1c2Ugb2YgMikgYWJvdmUgYW5kIG90aGVyIGNvbW1lbnRzLjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIHRoaW5rIOKAmHRydXN0ZWTi gJkgY2FuIGJlIHllcy1vci1ubyBpbiBzcGVjaWZpYyB1c2UgY2FzZXMgd2hlcmUgcmVxdWlyZW1l bnRzIGFuZCB0aGUgdGhyZWF0IG1vZGVsIGFyZSBjbGVhcmx5IHNldCBhbmQgZGV0ZXJtaW5lZCwg YnV0IHdlIGFyZSBub3Qgd29ya2luZyBvbiBvbmUgb2YgdGhvc2UuIE91ciBhdHRlc3RhdGlvbiB3 b3JrIGhhcyB0byBzcGFuIGZyb20gdXNlIGNhc2VzIHRoYXQgb25seSBzdGFuZCB1cA0KIHRvIGxh bWUgd2FubmEgYmUgaGFja2VycyB0byB1c2UgY2FzZXMgdGhhdCBzdGFuZCB1cCB0byBuYXRpb24g c3RhdGVzLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5MTDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KSU1QT1JUQU5UIE5PVElD RTogVGhlIGNvbnRlbnRzIG9mIHRoaXMgZW1haWwgYW5kIGFueSBhdHRhY2htZW50cyBhcmUgY29u ZmlkZW50aWFsIGFuZCBtYXkgYWxzbyBiZSBwcml2aWxlZ2VkLiBJZiB5b3UgYXJlIG5vdCB0aGUg aW50ZW5kZWQgcmVjaXBpZW50LCBwbGVhc2Ugbm90aWZ5IHRoZSBzZW5kZXIgaW1tZWRpYXRlbHkg YW5kIGRvIG5vdCBkaXNjbG9zZSB0aGUgY29udGVudHMgdG8gYW55IG90aGVyIHBlcnNvbiwgdXNl IGl0IGZvciBhbnkgcHVycG9zZSwNCiBvciBzdG9yZSBvciBjb3B5IHRoZSBpbmZvcm1hdGlvbiBp biBhbnkgbWVkaXVtLiBUaGFuayB5b3UuDQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_DB7PR08MB3642B467A11DA346267DE7BBEFD40DB7PR08MB3642eurp_-- From nobody Wed Aug 7 08:47:34 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0296C12043B for ; Wed, 7 Aug 2019 08:47:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.895 X-Spam-Level: X-Spam-Status: No, score=-1.895 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, LOTS_OF_MONEY=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kxjAd3AmJmCr for ; Wed, 7 Aug 2019 08:47:30 -0700 (PDT) Received: from p3plsmtpa07-07.prod.phx3.secureserver.net (p3plsmtpa07-07.prod.phx3.secureserver.net [173.201.192.236]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5A80612043F for ; Wed, 7 Aug 2019 08:47:30 -0700 (PDT) Received: from [192.168.1.108] ([76.192.164.238]) by :SMTPAUTH: with ESMTPSA id vO9xhUEiPj8wOvO9xhX1sr; Wed, 07 Aug 2019 08:47:29 -0700 From: Laurence Lundblade Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_6507696B-65A9-4DC5-B18B-22F71FA418FB" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Wed, 7 Aug 2019 08:47:28 -0700 In-Reply-To: Cc: Eliot Lear , "rats@ietf.org" , "Smith, Ned" , Anders Rundgren To: Kathleen Moriarty References: <2DE09A2A-A6EA-4474-9DBE-8D52B523645B@island-resort.com> <987fbfbb-b3f6-c104-878a-b283978ca0f0@gmail.com> <6F1E85F0-35CB-415A-9672-BD3257F59373@island-resort.com> <2c9ebe7b-9826-2d23-6f86-d098b79128d6@gmail.com> <8E4ED21F-EE52-4FAF-AFCB-A7624C56ED28@island-resort.com> <148D90BA-036A-4682-B920-4650182E2CB1@cisco.com> X-Mailer: Apple Mail (2.3445.9.1) X-CMAE-Envelope: MS4wfKTCT4/8LzMhC/bJ83Prqe+xoaMICDvbjSqHUjut68qVm/yhd+LxvMKEQF0RiGWwfgtpyec5/TzsTVXLcSlp4rP53PyiPZKVWUmen0ZCTMhC2b8ezo2m KiKXzkHGxNRg0wWbUmMIKPxNnKYK/UfADV2/8F/g+lzEBSR4jVfswR3fHUIyVOuM5FyLlmNKKQDv8yJWTJFelQincY3d0MLYq2lYR/ahl9UmLrZc/PsJU/Sl 8LU0lmXbIKAyGZ/Q23wIL2ofaJkC9dFN31iEZbCZThghe4Smn0u7FHqxLyqB5X0jlqoK2by8sA0gk2TAqxgFJA== Archived-At: Subject: Re: [Rats] No root of trust requirement in RATS/EAT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 15:47:33 -0000 --Apple-Mail=_6507696B-65A9-4DC5-B18B-22F71FA418FB Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On Aug 6, 2019, at 6:07 AM, Kathleen Moriarty = wrote: >=20 > I still think we can use the level model, where you have levels of = security assertions depending on implementation and point out the = differences in security considerations. We could establish a profile, = like PKI, and then leave it to another organization to define levels. = We would need to state risks of choices to have a proper security = considerations section to align with end point security that is likely = to be in the IETF's evolved threat model per Montreal discussions.=20 Here=E2=80=99s a description of what we=E2=80=99ve done in FIDO for = certification levels. It=E2=80=99s just one example, but an interesting = one because it spans lots of technologies (TEEs, SGX, secure elements, = Linux, Windows, standalone USB tokens and so on) and a wide range of = security and use cases. The FIDO protocol includes attestation. Three main levels are defined. Then there is a =E2=80=9C+=E2=80=9D = modifier for each level: L1: There are no hardware or system software requirements at all. A FIDO = authenticator running anywhere can be certified. To a large degree this = is about just trusting the hardware and software from the device / = platform vendor. Cost to certify is under $10,000. L2: There must be some sort of restricted operating environment like a = TEE, SGX, secure element or such. The FIDO authenticator can=E2=80=99t = be running in an environment like Linux or MacOS. A certification lab = must be engaged. The cost to certify is vaguely around $100,000 (mostly = lab fees). L2+: The restricted operating environment (TEE or such) and = authenticator application must be certified. This can be quite = expensive, but typically the TEE or such will already have been = certified. L3: In addition to L2+, there must be defenses against hardware attacks = at the circuit board level. This might be just a multi-layer PCB, = potting or a really difficult to open enclosure. L3 is intended to = defend against devices that have physically been captured by the = attacker.=20 L3+: In addition there must be defenses against chip-level attacks. = Smart cards and secure elements have these defenses today. You could say that L1 is kind of =E2=80=9Cbest practice=E2=80=9D, L2 is = about reduced attack surface to address network-born scalable attacks = and L3 adds HW defenses to deal with a lost phone or such that the = attacker tries to disassemble. Different use cases need different levels = of protection. Certification programs is typically are set up with three participants = to prevent collusion: 1) Many vendors of technology, the ones being certified 2) Several qualified certification labs that do the evaluation 3) A single issuer / overseer of the certification program In the case of FIDO, the FIDO Alliance is the overseer. They collect = fees, qualify labs, set requirements and issue the certifications. They = very explicitly have a committed to do this with staff, legal and = financial structure. Things like revocations, expiration and dispute = policy are addressed. More info is here and here = . A main point is that there is a big range here. There is degree. There = is no binary trust decision. LL --Apple-Mail=_6507696B-65A9-4DC5-B18B-22F71FA418FB Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
On = Aug 6, 2019, at 6:07 AM, Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com> wrote:

I still think we can use the = level model, where you have levels of security assertions depending on = implementation and point out the differences in security = considerations.  We could establish a profile, like PKI, and then = leave it to another organization to define levels.  We would need = to state risks of choices to have a proper security considerations = section to align with end point security that is likely to be in the = IETF's evolved threat model per Montreal = discussions. 

Here=E2=80=99s a description of what we=E2=80=99ve = done in FIDO for certification levels. It=E2=80=99s just one example, = but an interesting one because it spans lots of technologies (TEEs, SGX, = secure elements, Linux, Windows, standalone USB tokens and so on) and a = wide range of security and use cases. The FIDO protocol includes = attestation.

Three main levels are = defined. Then there is a =E2=80=9C+=E2=80=9D modifier for each = level:

L1: There are no = hardware or system software requirements at all. A FIDO authenticator = running anywhere can be certified. To a large degree this is about just = trusting the hardware and software from the device / platform vendor. = Cost to certify is under $10,000.

L2: = There must be some sort of restricted operating environment like a TEE, = SGX, secure element or such. The FIDO authenticator can=E2=80=99t be = running in an environment like Linux or MacOS. A certification lab must = be engaged. The cost to certify is vaguely around $100,000 (mostly lab = fees).

L2+: The restricted operating = environment (TEE or such) and authenticator application must be = certified. This can be quite expensive, but typically the TEE or such = will already have been certified.

L3: = In addition to L2+, there must be defenses against hardware attacks at = the circuit board level. This might be just a multi-layer PCB, potting = or a really difficult to open enclosure. L3 is intended to defend = against devices that have physically been captured by the = attacker. 

L3+: In addition = there must be defenses against chip-level attacks. Smart cards and = secure elements have these defenses today.

You could say that L1 is kind of =E2=80=9Cbe= st practice=E2=80=9D, L2 is about reduced attack surface to address = network-born scalable attacks and L3 adds HW defenses to deal with a = lost phone or such that the attacker tries to disassemble. Different use = cases need different levels of protection.

Certification programs = is typically are set up with three participants to prevent = collusion:
1) Many vendors of technology, = the ones being certified
2) Several qualified = certification labs that do the evaluation
3) A = single issuer / overseer of the certification program

In the case of FIDO, the = FIDO Alliance is the overseer. They collect fees, qualify labs, set = requirements and issue the certifications. They very explicitly have a = committed to do this with staff, legal and financial structure. Things = like revocations, expiration and dispute policy are addressed.

More info is here and here.

A main point is that there is a big = range here. There is degree. There is no binary trust = decision.

LL







= --Apple-Mail=_6507696B-65A9-4DC5-B18B-22F71FA418FB-- From nobody Wed Aug 7 09:09:29 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6FCE212046E for ; Wed, 7 Aug 2019 09:09:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VXgS_-URnsbo for ; Wed, 7 Aug 2019 09:09:26 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6B4DB120480 for ; Wed, 7 Aug 2019 09:09:26 -0700 (PDT) Received: from sandelman.ca (unknown [IPv6:2607:f0b0:f:2:56b2:3ff:fe0b:d84]) by tuna.sandelman.ca (Postfix) with ESMTP id B34F83818D for ; Wed, 7 Aug 2019 12:08:47 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 63F98912 for ; Wed, 7 Aug 2019 12:09:24 -0400 (EDT) From: Michael Richardson To: "rats\@ietf.org" In-Reply-To: References: <2DE09A2A-A6EA-4474-9DBE-8D52B523645B@island-resort.com> <987fbfbb-b3f6-c104-878a-b283978ca0f0@gmail.com> <6F1E85F0-35CB-415A-9672-BD3257F59373@island-resort.com> <2c9ebe7b-9826-2d23-6f86-d098b79128d6@gmail.com> <8E4ED21F-EE52-4FAF-AFCB-A7624C56ED28@island-resort.com> <148D90BA-036A-4682-B920-4650182E2CB1@cisco.com> , <864C25C7-4584-495C-A6CD-40D7C2207EE9@intel.com> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Rats] No root of trust requirement in RATS/EAT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 16:09:29 -0000 --=-=-= Content-Type: text/plain This discussion about Root of Trust seems silly. There are no absolute trusts. All paths of trust start from a local trust anchor in the verifier and/or relying party. They are *ALL* circles of signed statements (whether claims or certificates) There is no need to invoke an infinity of turtles. (Rivert and co. said this in SDSI/SPKI in RFC2692/2693 and in a number of papers.) -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl1K97QACgkQgItw+93Q 3WUcEQf8D4NJaNCPRqXNmdu3AcfHkGvCCHdOlmfzS/DMBlPk7KAWuaoGMCKsr96j W+FnWO8ygNahTc8NtfTiZuFQsPnAXvTSulfh8qQbVGOxILpQcliegZ0yoim0STEO 4RJFUUlMKgzJgvHH0frviFvri5TtjnhE92AqXWmBWY1JT1iObp/6VfefPlt7e6X1 Yy5rFA2hUNDhRrLoIsUfPYuYzfS9BaIO/yvzi/xgVYLTsZCVsio+aGsyJkx1Uhai uNnDaYWNZGkCqCCo6BeFtnkeh8AjshGy85INMyEXuXeYsDAokb5bpE0IpQov4PEM 6J2Rzir+eNmQjHfW56aOZfISJCc1Uw== =bAWz -----END PGP SIGNATURE----- --=-=-=-- From nobody Wed Aug 7 09:13:29 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AE9A2120496 for ; Wed, 7 Aug 2019 09:13:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 98s7PULZhe4j for ; Wed, 7 Aug 2019 09:13:23 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 490C91205B4 for ; Wed, 7 Aug 2019 09:13:12 -0700 (PDT) Received: from sandelman.ca (unknown [IPv6:2607:f0b0:f:2:56b2:3ff:fe0b:d84]) by tuna.sandelman.ca (Postfix) with ESMTP id 9EA3C3818D; Wed, 7 Aug 2019 12:12:34 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 602E3912; Wed, 7 Aug 2019 12:13:11 -0400 (EDT) From: Michael Richardson To: Simon Frost , "rats\@ietf.org" In-Reply-To: References: <2DE09A2A-A6EA-4474-9DBE-8D52B523645B@island-resort.com> <987fbfbb-b3f6-c104-878a-b283978ca0f0@gmail.com> <6F1E85F0-35CB-415A-9672-BD3257F59373@island-resort.com> <2c9ebe7b-9826-2d23-6f86-d098b79128d6@gmail.com> <8E4ED21F-EE52-4FAF-AFCB-A7624C56ED28@island-resort.com> <148D90BA-036A-4682-B920-4650182E2CB1@cisco.com> <5e0900299b6c4fd28843814d656b625d@oc11expo23.exchange.mit.edu> <52607B4E-C89C-4C6A-A21B-CC2D2CC0C3FA@island-resort.com> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Rats] No root of trust requirement in RATS/EAT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 16:13:27 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Simon Frost wrote: >> I think =E2=80=98trusted=E2=80=99 can be yes-or-no in specific use c= ases where >> requirements and the threat model are clearly set and determined, but >> we are not working on one of those. Our attestation work has to span >> from use cases that only stand up to lame wanna be hackers to use >> cases that stand up to nation states. > Perhaps it=E2=80=99s appropriate then that the Use Cases document is = annotated > with expectations of Trust or interpretations of RoT per use case > rather than putting an over generalisation into the Architecture spec? Are you saying that each use case should indicate what kind of trusted path is required? If so, then I agree. Based upon the feedback at IETF105, I have a bunch of similar use cases which are probably distinguished by the kinds of trust, or perhaps degree of paranoia^W^W^Wlevels of assurance required. =2D- Michael Richardson , Sandelman Software Works -=3D IPv6 IoT consulting =3D- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl1K+JYACgkQgItw+93Q 3WXE2wf+LGCLmfpU3b3UUi8dAm8tVhaYMh3UMfP6fq3LyhWB/38kT8HNldgY//Cd w7A5flbvUaCEUTYglHK8WBbQPu7LhW95l6LmLWA+fzDiYSYLtDaGlcy9BRHCObLE r/5LoiyG/c5OQuWWPgvvjbo2iUxzltepvLzv3HkS53sgaCC2iRIXMHIpCp0NQGgg VJJKQGU3UlwRT6tdi/TEl+EaIyVdSB6lwe8MtALzttbwbIYkrHf74rhflZuv0gh9 CBGJ2ZiVwyu8TLTCYLD319VWf1rEA2WTqujyAV3S7QgpuTmtJpdfXw0l4+dBBrl2 HzB1owqYyEHpVWxU9pi3PZoZiwL2CQ== =zQ71 -----END PGP SIGNATURE----- --=-=-=-- From nobody Wed Aug 7 09:20:20 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A40211203ED for ; Wed, 7 Aug 2019 09:20:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 16TAUxwihcES for ; Wed, 7 Aug 2019 09:20:17 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 651E61204AC for ; Wed, 7 Aug 2019 09:20:14 -0700 (PDT) Received: from sandelman.ca (unknown [IPv6:2607:f0b0:f:2:56b2:3ff:fe0b:d84]) by tuna.sandelman.ca (Postfix) with ESMTP id BCB433818D for ; Wed, 7 Aug 2019 12:19:26 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 6F648912 for ; Wed, 7 Aug 2019 12:20:03 -0400 (EDT) From: Michael Richardson To: "rats\@ietf.org" In-Reply-To: References: <2DE09A2A-A6EA-4474-9DBE-8D52B523645B@island-resort.com> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Rats] No root of trust requirement in RATS/EAT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 16:20:20 -0000 --=-=-= Content-Type: text/plain Hannes Tschofenig wrote: > There are two aspects here: > * What is specified in terms of interoperability > * What is described as part of the bigger picture. > IETF specifications, as you correctly noted below, do not specify many > aspects of the big picture. While there are some documents that try to > describe them as part of architecture documents IETF documents never go > into the details of most things. I agree with you strongly. Where I think we are getting into trouble is that 1) our charter says that we can go beyond just documenting the (interoperable) claims into designing a transport protocol, and I think that the details of that start to be attractive nuissances. 2) it might be that some want to have different claims that differ only in their degree of assurance. That is, there is a difference between: "Little Bobby said the babysitter said that Sarah could watch the scary movie on TV" vs "Little Bobby has a note from Mom that says that Sarah could watch the scary movie on TV" -- ] Never tell me the odds! | ipv6 mesh networks [ ] Michael Richardson, Sandelman Software Works | IoT architect [ ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on rails [ -- Michael Richardson , Sandelman Software Works -= IPv6 IoT consulting =- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEyBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl1K+jMACgkQgItw+93Q 3WVn7Af2Jiv77Ew0qqv4gKG/q+g76pWMqs6vsvsyMp+70CiFdwzxUJXehi+DWuLV cI9iAIijuJP0puLl12EryFTPxbHZcsN/1LJF12mRulKvDvelt6hfQAn03yUSrN3f QPTLFa89lxDPP6ydRz5j5SZze7XS39BqvQJbMdS0154VCw192w0v2F4hRkDhPw0y xMG1Lu0CWBC+Iwr1/K8RrJUapGVwwH4RVE88PVfJ1wy8YDzdwztsS/Kp75EfjFV4 fxZqFzN1NsQwKW5z7jxj40Bwg5dFPHrRrgFAUNxHHELkYFNcqxFo9EC5I+VwOktn Gv+gumKxzEf3ucQbsegadnBEOp65 =Ov4h -----END PGP SIGNATURE----- --=-=-=-- From nobody Wed Aug 7 09:24:56 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7696512063E for ; Wed, 7 Aug 2019 09:24:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id U82swlsKDf57 for ; Wed, 7 Aug 2019 09:24:53 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EC41C12062B for ; Wed, 7 Aug 2019 09:24:52 -0700 (PDT) Received: from sandelman.ca (unknown [IPv6:2607:f0b0:f:2:56b2:3ff:fe0b:d84]) by tuna.sandelman.ca (Postfix) with ESMTP id 4E0D43818D for ; Wed, 7 Aug 2019 12:24:15 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 05316912 for ; Wed, 7 Aug 2019 12:24:52 -0400 (EDT) From: Michael Richardson To: "rats\@ietf.org" In-Reply-To: References: <2DE09A2A-A6EA-4474-9DBE-8D52B523645B@island-resort.com> <987fbfbb-b3f6-c104-878a-b283978ca0f0@gmail.com> <6F1E85F0-35CB-415A-9672-BD3257F59373@island-resort.com> <2c9ebe7b-9826-2d23-6f86-d098b79128d6@gmail.com> <8E4ED21F-EE52-4FAF-AFCB-A7624C56ED28@island-resort.com> <148D90BA-036A-4682-B920-4650182E2CB1@cisco.com> X-Mailer: MH-E 8.6; nmh 1.7+dev; GNU Emacs 24.5.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [Rats] No root of trust requirement in RATS/EAT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 16:24:55 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Laurence Lundblade wrote: > Here=E2=80=99s a description of what we=E2=80=99ve done in FIDO for c= ertification > levels. It=E2=80=99s just one example, but an interesting one because= it spans > lots of technologies (TEEs, SGX, secure elements, Linux, Windows, Would these different levels (L1,L2,L3,+) be visible in claims two layers away? For instance, would the recipient of funds transfer be able to see how the authorization was attested to by the senders' bank? =2D- Michael Richardson , Sandelman Software Works -=3D IPv6 IoT consulting =3D- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl1K+1MACgkQgItw+93Q 3WX3xwgApJMNe3wKAbCsO/TsFIfZOoHIFDTaFZWhif1tfkwsWtZosIkUj6MZ8NJu 5ZDZ3Obxk+Wcpzf3xRVOuTDJvyAvg2HywQhtzoaQiB2QgWMgdV+CfbZoUDZM5OHp rFWw/kd0B/8C23AoCgnBopKEoHQb9oz4qpwi7sIp5+OVXHV/9ltw4pUtmvI3oF27 l77kMyLeQn1J5bbWnQ5ZRLpuNuouxEPOxgVwrytAAqWh1qJbWmUEwV2vUKXvSvxw GAz7cuoGIPqpU2Y11AOQhke1twBtG8rCrrm0TKXp2MU03eeBsoNeS+Om+wfVBOBl NLFvnhjRXsWfewBHNBzr8FKeU+ISvQ== =cIxc -----END PGP SIGNATURE----- --=-=-=-- From nobody Wed Aug 7 11:40:04 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 746E61206BD for ; Wed, 7 Aug 2019 11:39:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.499 X-Spam-Level: X-Spam-Status: No, score=-14.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=ZSTUa2g7; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=GYjtf5wy Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8-95qHhkg8fK for ; Wed, 7 Aug 2019 11:39:49 -0700 (PDT) Received: from alln-iport-5.cisco.com (alln-iport-5.cisco.com [173.37.142.92]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6725A1206C5 for ; Wed, 7 Aug 2019 11:39:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=4163; q=dns/txt; s=iport; t=1565203189; x=1566412789; h=from:to:subject:date:message-id:mime-version; bh=ndfYqlgpW/d2EONNxvLIqTvJj2NgliK8+RJmHTZiQ7E=; b=ZSTUa2g7N643RUbP9r4mzShNO/0JOMpg0DBZXw+rnHA9Z9gnzXHDfrJc 4j0YC/S5U80Dy6tpLiMkofJn4vHeZiKRrj0ft5ew/uvAsUVx6fvPPI9Vm a11saZtmK+eE6usEqxP5W1EpiCftsOAs9EG/wi0CjDaW90FthZn7PB9Vb 0=; IronPort-PHdr: =?us-ascii?q?9a23=3AULIwVhdGTLVMFY/rdwEYWn8llGMj4e+mNxMJ6p?= =?us-ascii?q?chl7NFe7ii+JKnJkHE+PFxlwGQD57D5adCjOzb++D7VGoM7IzJkUhKcYcEFn?= =?us-ascii?q?pnwd4TgxRmBceEDUPhK/u/aSczGdtDUlBN9HCgOk8TE8H7NBXf?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CBAQAHGktd/5xdJa1mHAEBAQQBAQc?= =?us-ascii?q?EAQGBVQUBAQsBgRUvUANtVSAECyqEHoNHA4syTIFqkymEWYEugSQDVAkBAQE?= =?us-ascii?q?MAQEjCgIBAYQ/GYI7IzYHDgEEAQEEAQEDAQpthScBC4VjER0BATgRAQw+AgQ?= =?us-ascii?q?wJwQ1gwABgR1NAx0BDqA1AoE4iGBxgTKCegEBBYEzAYEUgk4YghQDBoE0AYt?= =?us-ascii?q?jF4F/gREnDBOHe4JeMoImjwuFBpcfCQKCHIZdjUYbgjCHLo5UjGoJWodakBo?= =?us-ascii?q?CBAIEBQIOAQEFgVcBMIFYcBVlAYJBgkKDcYpTcoEpjX0BAQ?= X-IronPort-AV: E=Sophos;i="5.64,358,1559520000"; d="scan'208,217";a="305814881" Received: from rcdn-core-5.cisco.com ([173.37.93.156]) by alln-iport-5.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 07 Aug 2019 18:39:48 +0000 Received: from XCH-ALN-014.cisco.com (xch-aln-014.cisco.com [173.36.7.24]) by rcdn-core-5.cisco.com (8.15.2/8.15.2) with ESMTPS id x77IdmJK017893 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL) for ; Wed, 7 Aug 2019 18:39:48 GMT Received: from xhs-aln-003.cisco.com (173.37.135.120) by XCH-ALN-014.cisco.com (173.36.7.24) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 7 Aug 2019 13:39:47 -0500 Received: from xhs-rtp-002.cisco.com (64.101.210.229) by xhs-aln-003.cisco.com (173.37.135.120) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 7 Aug 2019 13:39:47 -0500 Received: from NAM04-SN1-obe.outbound.protection.outlook.com (64.101.32.56) by xhs-rtp-002.cisco.com (64.101.210.229) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Wed, 7 Aug 2019 14:39:47 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=FM5j46rM5Xy35q9bBujpYB4GVoEgXNxl2cQuofahxL+Vc6LTVYls4bemdrKTurkDHl0zYgCd+1PwfXZQMK7Ycyd0d9/Zz4axv7S3f2MrxrQoaUlvU9kyhrJfdyH4MpCWrFBM26ldbgen3/k40eqVDPWSo03xa30+PGFDQF4VjDVnaCcN5eLR+hTNEoduF2we4/yEveHrC2drd/h/Qh91S/ruFup8kdFRDYU1FDcbjzisNEJ9n0eW4o7AkRaQHOToOdZ9i5nZaqxpRLibVrwtDjsEadn8Pf3ELr4dw4O9fgVjhPBvOGIry5XBho0W11zs+lXwo27UYy7SBaZwS3Z1wQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ndfYqlgpW/d2EONNxvLIqTvJj2NgliK8+RJmHTZiQ7E=; b=JYk6UKRxPFfBAmFUayuZ5vAvou5PY6g0NtsXbPH0NNW882e1R4mhnEmC641RagAIs+hPdAeVZPMjeqP2BscBtMWmArJOA5ErFhq/T1bC8pU6qO5/bAJfs9hxboHcUSxIgidYF+0oHA82aF8C4dLDYUSSZQ9tovYUTUUPSIoT1wPbFqAXOYr8lNhhMKjQCAH9uNYxaVow0g1Q+IgLLwg+iPXQFa4Z6VbPRvUNhpZhgnuwOGrmaJ+Ry2tJ7+Mib0tHD+Jx5oR5WVxBUouOK2Ylr31iuWA+1wl+kmHAGurysfCbVNcBl7R4ojUwWvyfjzurPOYs+8XWFDfjbRGKxrV72w== ARC-Authentication-Results: i=1; mx.microsoft.com 1;spf=pass smtp.mailfrom=cisco.com;dmarc=pass action=none header.from=cisco.com;dkim=pass header.d=cisco.com;arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ndfYqlgpW/d2EONNxvLIqTvJj2NgliK8+RJmHTZiQ7E=; b=GYjtf5wywk+Ci8uBUfFWH+TuE6wPQAZL9y64MQpdkd/nqeuBf83CzWUYxw7O62z36Fg7sScB11ld9r0Wx8L2vZEUiZFCpZr8JCXUrFDByLsBq63fOiWVxKpdLUHNHtWg6w5NzF57Jsj7zthDOCWXQAUKFYEsrJdyapQtOD9PJDY= Received: from MWHPR11MB1791.namprd11.prod.outlook.com (10.175.53.138) by MWHPR11MB1517.namprd11.prod.outlook.com (10.172.55.11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2136.17; Wed, 7 Aug 2019 18:39:46 +0000 Received: from MWHPR11MB1791.namprd11.prod.outlook.com ([fe80::a9d8:d4d6:df7b:5c84]) by MWHPR11MB1791.namprd11.prod.outlook.com ([fe80::a9d8:d4d6:df7b:5c84%8]) with mapi id 15.20.2157.015; Wed, 7 Aug 2019 18:39:46 +0000 From: "Nancy Cam-Winget (ncamwing)" To: "rats@ietf.org" Thread-Topic: RATS virtual interim(s) doodle poll Thread-Index: AQHVTU98UfFXtFvL3kqTB9idVKalfg== Date: Wed, 7 Aug 2019 18:39:45 +0000 Message-ID: <8F15A9BA-8CD3-4F29-8784-5D00DECA4C37@cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.10.c.190715 authentication-results: spf=none (sender IP is ) smtp.mailfrom=ncamwing@cisco.com; x-originating-ip: [2001:420:2ca:4411:4de8:2070:ee4a:a315] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: b7be07db-f376-4cd0-7d4d-08d71b669ebf x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:MWHPR11MB1517; x-ms-traffictypediagnostic: MWHPR11MB1517: x-ms-exchange-purlcount: 3 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-forefront-prvs: 01221E3973 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(136003)(376002)(39860400002)(346002)(366004)(396003)(189003)(199004)(478600001)(186003)(8936002)(6116002)(7736002)(6512007)(6306002)(486006)(54896002)(71200400001)(66446008)(64756008)(8676002)(66476007)(66556008)(66946007)(71190400001)(476003)(5640700003)(36756003)(14454004)(76116006)(2616005)(91956017)(33656002)(25786009)(86362001)(256004)(4744005)(14444005)(606006)(5660300002)(2906002)(1730700003)(2501003)(6436002)(53936002)(966005)(102836004)(81166006)(58126008)(2351001)(81156014)(236005)(6486002)(6916009)(99286004)(68736007)(316002)(46003)(6506007); DIR:OUT; SFP:1101; SCL:1; SRVR:MWHPR11MB1517; H:MWHPR11MB1791.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: XUtu5SoBZcaW9+NGf8/KF/BnZFcdai81XdwjUVVzaCARhhu3/ps0nw5pfVkofOFeXEx+kg+N25dnv1uj9I9vQrCloRIG0DgrcN7CWq/LSn/xtXJlBUo2lqO4pg7WX6pzDemBQBDnyLzXOlW36OX/RxmZIFXmzI+hx5p/5w3RQsV3ZKzuF1trg7fSOAdMvyi9JpWEbIEz1Y25PtMI3PWIbvRxhIpwWfuEa67ZAvuQGA1O7/uQ8CQlGkpVHKF0vtZ3T8ws536CRYzUjCyoEJ7Fq8Hhf3BbIcfNxMkp0Dbyw2nWuDVf0dXfsfVogMNo4x9PNDJ+Z5SqJ6hQz/7EKP7Au6JaXJR2b5ANuCpzoci5sac2cZZfyB5YbuWFc4L/MVQ1KWESugo4ZANqd0iRc+hlM4F+77M8F+Km19gHgYUOpEE= Content-Type: multipart/alternative; boundary="_000_8F15A9BA8CD34F2987845D00DECA4C37ciscocom_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: b7be07db-f376-4cd0-7d4d-08d71b669ebf X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Aug 2019 18:39:45.7489 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: kI7IFyPIXLiJNEaY3w+ml+6Kqie5N+4CpodjeFZz2Z5w6It7NxGMc96Q/7oX4TuD1f7KJwi2TIrAL1SgVVIJuw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR11MB1517 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.36.7.24, xch-aln-014.cisco.com X-Outbound-Node: rcdn-core-5.cisco.com Archived-At: Subject: [Rats] RATS virtual interim(s) doodle poll X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Aug 2019 18:39:59 -0000 --_000_8F15A9BA8CD34F2987845D00DECA4C37ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 QWxsLA0KVGhlcmUgd2FzIGludGVyZXN0IHRvIGhvbGQgYXQgbGVhc3Qgb25lIGlmIG5vdCB0d28g dmlydHVhbCBpbnRlcmltcyBiZWZvcmUgd2UgbWVldCBhdCBJRVRGIDEwNi4gIFBsZWFzZSByZXNw b25kIG9uIHlvdXIgYXZhaWxhYmlsaXR5IG9uOg0KaHR0cHM6Ly9kb29kbGUuY29tL3BvbGwvM3Y1 cnBoYml4dDg1dmUyNA0KDQpTbyB0aGF0IHdlIGNhbiBzZWUgaWYgd2UgY2FuIGdldCBxdW9ydW0g Zm9yIGF0IGxlYXN0IG9uZSBkYXRlIGlmIG5vdCB0d28uICBJIHdpbGwgY2xvc2UgdGhlIGRvb2Rs ZSBwb2xsIG9uIEF1ZyAxNHRoLg0KDQpXYXJtIHJlZ2FyZHMsDQpOYW5jeSAob24gYmVoYWxmIG9m IHRoZSBSQVRTIGNoYWlycykNCg== --_000_8F15A9BA8CD34F2987845D00DECA4C37ciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: <43C75B850C72C543BCFC3D8887C35320@namprd11.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3Jt YWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOiMwNTYzQzE7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9 DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOiM5NTRGNzI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpz cGFuLkVtYWlsU3R5bGUxNw0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1jb21wb3NlOw0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1z b0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6 IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4g MTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rp b24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9keSBs YW5nPSJFTi1VUyIgbGluaz0iIzA1NjNDMSIgdmxpbms9IiM5NTRGNzIiPg0KPGRpdiBjbGFzcz0i V29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0Ij5BbGwsPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPlRoZXJlIHdhcyBpbnRlcmVzdCB0byBo b2xkIGF0IGxlYXN0IG9uZSBpZiBub3QgdHdvIHZpcnR1YWwgaW50ZXJpbXMgYmVmb3JlIHdlIG1l ZXQgYXQgSUVURiAxMDYuJm5ic3A7IFBsZWFzZSByZXNwb25kIG9uIHlvdXIgYXZhaWxhYmlsaXR5 IG9uOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0Ij48YSBocmVmPSJodHRwczovL2Rvb2RsZS5jb20vcG9sbC8z djVycGhiaXh0ODV2ZTI0Ij5odHRwczovL2Rvb2RsZS5jb20vcG9sbC8zdjVycGhiaXh0ODV2ZTI0 PC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+U28gdGhhdCB3 ZSBjYW4gc2VlIGlmIHdlIGNhbiBnZXQgcXVvcnVtIGZvciBhdCBsZWFzdCBvbmUgZGF0ZSBpZiBu b3QgdHdvLiZuYnNwOyBJIHdpbGwgY2xvc2UgdGhlIGRvb2RsZSBwb2xsIG9uIEF1ZyAxNDxzdXA+ dGg8L3N1cD4uPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5XYXJt IHJlZ2FyZHMsPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPk5hbmN5IChvbiBiZWhhbGYgb2YgdGhlIFJBVFMg Y2hhaXJzKTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_8F15A9BA8CD34F2987845D00DECA4C37ciscocom_-- From nobody Thu Aug 8 00:54:52 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 41A361200E3 for ; Thu, 8 Aug 2019 00:54:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com header.b=pskxvcQd; dkim=fail (1024-bit key) reason="fail (body has been altered)" header.d=armh.onmicrosoft.com header.b=lF0zp0hr Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 10pjjKVLlb4Y for ; Thu, 8 Aug 2019 00:54:48 -0700 (PDT) Received: from EUR04-VI1-obe.outbound.protection.outlook.com (mail-eopbgr80089.outbound.protection.outlook.com [40.107.8.89]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0FD49120024 for ; Thu, 8 Aug 2019 00:54:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=pulS3J+pvxW901cOwsYGVJ4zAt2dakxlhSLhj5W0taw=; b=pskxvcQduXakNxgN39dnDcwOlYTzf5Yz61VvigNO2yN2yCTMp6OQy+7TrbOgMbJlfqmXOlNfO4tS2UspxKfmvh/dBjt3ATpPSOuZ1G7sxJCFnUms60Rn5vprQfL7J9xBBrX/QUVgFMtVf/SZxWA+dM9tBs+4fAUSrJ2CO67/Wkc= Received: from VI1PR08CA0193.eurprd08.prod.outlook.com (2603:10a6:800:d2::23) by DB8PR08MB4955.eurprd08.prod.outlook.com (2603:10a6:10:38::26) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2157.18; Thu, 8 Aug 2019 07:54:44 +0000 Received: from DB5EUR03FT004.eop-EUR03.prod.protection.outlook.com (2a01:111:f400:7e0a::200) by VI1PR08CA0193.outlook.office365.com (2603:10a6:800:d2::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2157.15 via Frontend Transport; Thu, 8 Aug 2019 07:54:43 +0000 Authentication-Results: spf=temperror (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; ietf.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;ietf.org; dmarc=temperror action=none header.from=arm.com; Received-SPF: TempError (protection.outlook.com: error in processing during lookup of arm.com: DNS Timeout) Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by DB5EUR03FT004.mail.protection.outlook.com (10.152.20.128) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2052.18 via Frontend Transport; Thu, 8 Aug 2019 07:54:41 +0000 Received: ("Tessian outbound 6d016ca6b65d:v26"); Thu, 08 Aug 2019 07:54:41 +0000 X-CR-MTA-TID: 64aa7808 Received: from a962ca7abce9.1 (cr-mta-lb-1.cr-mta-net [104.47.14.50]) by 64aa7808-outbound-1.mta.getcheckrecipient.com id 9A5FBA89-0FCA-4605-8610-9F0D74282097.1; Thu, 08 Aug 2019 07:54:36 +0000 Received: from EUR04-VI1-obe.outbound.protection.outlook.com (mail-vi1eur04lp2050.outbound.protection.outlook.com [104.47.14.50]) by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id a962ca7abce9.1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Thu, 08 Aug 2019 07:54:36 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=hgaOUScgCzuJUVrkT7vkEeIp5HdWx8OO+mQWuTGoXj3i59zsdBg9A3Wu3a0hLwzdTqviS/hQJD1IJ0BMh22cSgegInSFOaLG5P6ge0xt8tJ3q82iA9zUZc3ZMHgSfXx+The+MJO0aEOLkg6fd11as8q4cX5rCJAgZzzcaL8WAn6TX2MAoKXLxiVMsENO39SF6JBqksGKGJSh1K4xawQtgJCBPcOBBjS5ia1jlUG1lEyQP2JBVZBF0o77oltJNjoaElyoD478OXkK891ZRiVSY8+V+EXcD/COJvyhfeIAbzByAeTW56shcfCPgOwWwREJBtCfaVhjp6CLlSjwdCHDiw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=or5WtKQ0SFTk7ltzIQ0rqY0ziu96FdQEJ9NwoNr5Fbg=; b=DX/M7fH5iV8Nntbp5/d8uN6N/MYg2DpxxA0dqfZ0hgSkkWT6x8iTkzNI/V/XJud3yGsFg5jh7Ja1kVp4srlqoSyNlNb5NEsKQMfFgAXoW240+NhRx6mzlCMta7Zk9fzmQ/r/sDhcoEZ/xAHtAw8NBl24mze19tkDNJZ2QflNe9q5BPgTFQHPMvyvPW9if1zvAEvUoBMur/RbfEWCtI/05g7KoFOfodYt5M0va45sVcu/uvmxuOUlm+JI4Uyw2ygCcYAd0KN5FrB4zm/gB1HQoHkmlR8RIwA08EG/SPp7YlPYQJEb0n9Sc178rG1Pu6lst7JWsmdJnZ7mx8sVNT1tAQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=arm.com; dmarc=pass action=none header.from=arm.com; dkim=pass header.d=arm.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=or5WtKQ0SFTk7ltzIQ0rqY0ziu96FdQEJ9NwoNr5Fbg=; b=lF0zp0hrtn3eZUiOJcgy9yUY8sXBYrShUbTCmotdO5twLSYHCkocr7hIqFBCcCQhh3ocuw3OSWAMmeGtkV9oH4DzWVhYE7JFFJxPw8sHcVJovNM0xxRTo0qXyG6w0bDRpLZlv71FLEHrohns4fwCBwvvoAtteourvhpCHsg3nBk= Received: from DB7PR08MB3642.eurprd08.prod.outlook.com (20.177.120.148) by DB7PR08MB3161.eurprd08.prod.outlook.com (52.134.110.20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2157.14; Thu, 8 Aug 2019 07:54:34 +0000 Received: from DB7PR08MB3642.eurprd08.prod.outlook.com ([fe80::88e4:1b47:b2c1:965f]) by DB7PR08MB3642.eurprd08.prod.outlook.com ([fe80::88e4:1b47:b2c1:965f%5]) with mapi id 15.20.2157.015; Thu, 8 Aug 2019 07:54:34 +0000 From: Simon Frost To: Michael Richardson , "rats@ietf.org" Thread-Topic: [Rats] No root of trust requirement in RATS/EAT Thread-Index: AQHVTRsrsg1VzcY/YUmIM2A9q/ruX6bv0SKwgAAKq4CAAQa0QA== Date: Thu, 8 Aug 2019 07:54:33 +0000 Message-ID: References: <2DE09A2A-A6EA-4474-9DBE-8D52B523645B@island-resort.com> <987fbfbb-b3f6-c104-878a-b283978ca0f0@gmail.com> <6F1E85F0-35CB-415A-9672-BD3257F59373@island-resort.com> <2c9ebe7b-9826-2d23-6f86-d098b79128d6@gmail.com> <8E4ED21F-EE52-4FAF-AFCB-A7624C56ED28@island-resort.com> <148D90BA-036A-4682-B920-4650182E2CB1@cisco.com> <5e0900299b6c4fd28843814d656b625d@oc11expo23.exchange.mit.edu> <52607B4E-C89C-4C6A-A21B-CC2D2CC0C3FA@island-resort.com> <28203.1565194391@localhost> In-Reply-To: <28203.1565194391@localhost> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ts-tracking-id: ee2aded2-71fc-4241-935a-cdb2a32eda8c.0 x-checkrecipientchecked: true Authentication-Results-Original: spf=none (sender IP is ) smtp.mailfrom=Simon.Frost@arm.com; x-originating-ip: [217.140.106.51] x-ms-publictraffictype: Email X-MS-Office365-Filtering-Correlation-Id: 0a634ed9-e7f6-4f5a-a81a-08d71bd5abc3 X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam-Untrusted: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:DB7PR08MB3161; X-MS-TrafficTypeDiagnostic: DB7PR08MB3161:|DB8PR08MB4955: X-Microsoft-Antispam-PRVS: x-checkrecipientrouted: true x-ms-oob-tlc-oobclassifiers: OLM:1201;OLM:1201; x-forefront-prvs: 012349AD1C X-Forefront-Antispam-Report-Untrusted: SFV:NSPM; SFS:(10009020)(4636009)(39860400002)(136003)(376002)(346002)(366004)(396003)(199004)(13464003)(189003)(86362001)(478600001)(71200400001)(25786009)(14454004)(71190400001)(33656002)(6436002)(53936002)(6246003)(9686003)(55016002)(229853002)(186003)(26005)(6506007)(81156014)(81166006)(53546011)(66066001)(102836004)(8936002)(3846002)(64756008)(66946007)(66556008)(6116002)(52536014)(8676002)(2501003)(7696005)(76116006)(74316002)(76176011)(99286004)(305945005)(7736002)(66446008)(446003)(2906002)(316002)(256004)(110136005)(476003)(486006)(66476007)(11346002)(5660300002); DIR:OUT; SFP:1101; SCL:1; SRVR:DB7PR08MB3161; H:DB7PR08MB3642.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts) X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam-Message-Info-Original: 0wpIyI8l4UtHGZmMM7wxQYwejFmxbP9sa6jBtvQCs+E/bP2BFq+ZVO4t5LJq353w5WpB1nl+Vm3oCmUopANzrg28PH/062UNg9bWr8nWVtzpd5o4I8kBRmRSVJSKxpHWotKvtgALfy3shV5Mbk3E8zI8+G7I+jDWR5pqHBbsxBA0Az9G7rNQBfjwRkxNOgfIQTQAxauPckL9MmCE2Y8j1lnzEUGJNIiJhjIu8G2Syz/SlPt6EA6jTnjiF0Yb5S8GOv1rBW2x8LaSDB+RgQ7DuOlpM20MhPd9p114nr4l2Bg4SSkC+gmxuONZnhRThO6/TJHIoGqybX1FHUcRy0q4hb0b7Cg+lBiAZBmlLD4QHT5mNBzEESsQvyMPcrg0qzTI3KKepUGJdqbDOWkMh+9qNxgfUSExsKQcI7flqfTi+go= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB7PR08MB3161 Original-Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=Simon.Frost@arm.com; X-EOPAttributedMessage: 0 X-MS-Exchange-Transport-CrossTenantHeadersStripped: DB5EUR03FT004.eop-EUR03.prod.protection.outlook.com X-Forefront-Antispam-Report: CIP:63.35.35.123; IPV:CAL; SCL:-1; CTRY:IE; EFV:NLI; SFV:NSPM; SFS:(10009020)(4636009)(376002)(346002)(396003)(39860400002)(136003)(2980300002)(13464003)(199004)(189003)(40434004)(26826003)(25786009)(7736002)(76130400001)(99286004)(50466002)(316002)(478600001)(74316002)(305945005)(33656002)(8676002)(81166006)(6246003)(81156014)(110136005)(14454004)(70586007)(8936002)(70206006)(6506007)(53546011)(446003)(436003)(63350400001)(63370400001)(2486003)(7696005)(356004)(2501003)(336012)(126002)(11346002)(486006)(476003)(55016002)(23676004)(9686003)(14444005)(2906002)(229853002)(102836004)(5024004)(6116002)(3846002)(76176011)(5660300002)(66066001)(47776003)(186003)(26005)(22756006)(86362001)(52536014); DIR:OUT; SFP:1101; SCL:1; SRVR:DB8PR08MB4955; H:64aa7808-outbound-1.mta.getcheckrecipient.com; FPR:; SPF:TempError; LANG:en; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; A:1; MX:1; X-MS-Office365-Filtering-Correlation-Id-Prvs: 8d2e2459-342f-4af2-d6c5-08d71bd5a715 X-Microsoft-Antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(710020)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:DB8PR08MB4955; X-Forefront-PRVS: 012349AD1C X-Microsoft-Antispam-Message-Info: opwh1n4oQ+QA4MN8GcrbMNN91LhjUP7AmvPmkooBH6vbNWk4EDXZqnos4zWKUOT5cUEomFNSswqI4JVZu3+28DzSyG0Juaje5kwisp1qDmHtaCRMtCQLIwrxB1tD0VLjPPAd/Dwav8ay/Ahp+GaVgadEv9e81kmmTuFpP3u/2LZpSdtzDK/lVRzJ656ek2Vi8GzHqQYU/aKAEPl2iKBWDVDkhmwo2bb0M6gnKh/79VjHjG8xWcZ+7NnPOtADp1CfYTgSvwik99/eaDNAjuWOkFree2ZXI4m+m0BINq4jOQHYjba/qcvHeSKd8XOYDrbSUCi3rHtQpeymvbDNKjRfxE+3Sk4uehDUf0tm3BjLE25MyxD8RgME3rjlehDdgkjJOh7LZBJbV0CQFOwD6T0WXKhds8pOQ0yAfoP4H013cYc= X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Aug 2019 07:54:41.9364 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 0a634ed9-e7f6-4f5a-a81a-08d71bd5abc3 X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB8PR08MB4955 Archived-At: Subject: Re: [Rats] No root of trust requirement in RATS/EAT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 07:54:51 -0000 PiBBcmUgeW91IHNheWluZyB0aGF0IGVhY2ggdXNlIGNhc2Ugc2hvdWxkIGluZGljYXRlIHdoYXQg a2luZCBvZiB0cnVzdGVkIHBhdGggaXMgcmVxdWlyZWQ/ICBJZiBzbywgdGhlbiBJIGFncmVlLg0K WWVzLCB0aGF0IHdhcyBteSBpbnRlbnRpb24uDQoNCkNoZWVycw0KU2ltb24NCg0KLS0tLS1Pcmln aW5hbCBNZXNzYWdlLS0tLS0NCkZyb206IE1pY2hhZWwgUmljaGFyZHNvbiA8bWNyK2lldGZAc2Fu ZGVsbWFuLmNhPg0KU2VudDogMDcgQXVndXN0IDIwMTkgMTc6MTMNClRvOiBTaW1vbiBGcm9zdCA8 U2ltb24uRnJvc3RAYXJtLmNvbT47IHJhdHNAaWV0Zi5vcmcNClN1YmplY3Q6IFJlOiBbUmF0c10g Tm8gcm9vdCBvZiB0cnVzdCByZXF1aXJlbWVudCBpbiBSQVRTL0VBVA0KDQoNClNpbW9uIEZyb3N0 IDxTaW1vbi5Gcm9zdEBhcm0uY29tPiB3cm90ZToNCiAgICA+PiBJIHRoaW5rIOKAmHRydXN0ZWTi gJkgY2FuIGJlIHllcy1vci1ubyBpbiBzcGVjaWZpYyB1c2UgY2FzZXMgd2hlcmUNCiAgICA+PiBy ZXF1aXJlbWVudHMgYW5kIHRoZSB0aHJlYXQgbW9kZWwgYXJlIGNsZWFybHkgc2V0IGFuZCBkZXRl cm1pbmVkLCBidXQNCiAgICA+PiB3ZSBhcmUgbm90IHdvcmtpbmcgb24gb25lIG9mIHRob3NlLiBP dXIgYXR0ZXN0YXRpb24gd29yayBoYXMgdG8gc3Bhbg0KICAgID4+IGZyb20gdXNlIGNhc2VzIHRo YXQgb25seSBzdGFuZCB1cCB0byBsYW1lIHdhbm5hIGJlIGhhY2tlcnMgdG8gdXNlDQogICAgPj4g Y2FzZXMgdGhhdCBzdGFuZCB1cCB0byBuYXRpb24gc3RhdGVzLg0KDQogICAgPiBQZXJoYXBzIGl0 4oCZcyBhcHByb3ByaWF0ZSB0aGVuIHRoYXQgdGhlIFVzZSBDYXNlcyBkb2N1bWVudCBpcyBhbm5v dGF0ZWQNCiAgICA+IHdpdGggZXhwZWN0YXRpb25zIG9mIFRydXN0IG9yIGludGVycHJldGF0aW9u cyBvZiBSb1QgcGVyIHVzZSBjYXNlDQogICAgPiByYXRoZXIgdGhhbiBwdXR0aW5nIGFuIG92ZXIg Z2VuZXJhbGlzYXRpb24gaW50byB0aGUgQXJjaGl0ZWN0dXJlIHNwZWM/DQoNCkFyZSB5b3Ugc2F5 aW5nIHRoYXQgZWFjaCB1c2UgY2FzZSBzaG91bGQgaW5kaWNhdGUgd2hhdCBraW5kIG9mIHRydXN0 ZWQgcGF0aCBpcyByZXF1aXJlZD8gIElmIHNvLCB0aGVuIEkgYWdyZWUuDQoNCkJhc2VkIHVwb24g dGhlIGZlZWRiYWNrIGF0IElFVEYxMDUsIEkgaGF2ZSBhIGJ1bmNoIG9mIHNpbWlsYXIgdXNlIGNh c2VzIHdoaWNoIGFyZSBwcm9iYWJseSBkaXN0aW5ndWlzaGVkIGJ5IHRoZSBraW5kcyBvZiB0cnVz dCwgb3IgcGVyaGFwcyBkZWdyZWUgb2YgcGFyYW5vaWFeV15XXldsZXZlbHMgb2YgYXNzdXJhbmNl IHJlcXVpcmVkLg0KDQotLQ0KTWljaGFlbCBSaWNoYXJkc29uIDxtY3IrSUVURkBzYW5kZWxtYW4u Y2E+LCBTYW5kZWxtYW4gU29mdHdhcmUgV29ya3MgIC09IElQdjYgSW9UIGNvbnN1bHRpbmcgPS0N Cg0KDQoNCklNUE9SVEFOVCBOT1RJQ0U6IFRoZSBjb250ZW50cyBvZiB0aGlzIGVtYWlsIGFuZCBh bnkgYXR0YWNobWVudHMgYXJlIGNvbmZpZGVudGlhbCBhbmQgbWF5IGFsc28gYmUgcHJpdmlsZWdl ZC4gSWYgeW91IGFyZSBub3QgdGhlIGludGVuZGVkIHJlY2lwaWVudCwgcGxlYXNlIG5vdGlmeSB0 aGUgc2VuZGVyIGltbWVkaWF0ZWx5IGFuZCBkbyBub3QgZGlzY2xvc2UgdGhlIGNvbnRlbnRzIHRv IGFueSBvdGhlciBwZXJzb24sIHVzZSBpdCBmb3IgYW55IHB1cnBvc2UsIG9yIHN0b3JlIG9yIGNv cHkgdGhlIGluZm9ybWF0aW9uIGluIGFueSBtZWRpdW0uIFRoYW5rIHlvdS4NCg== From nobody Thu Aug 8 10:07:50 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 152F8120156 for ; Thu, 8 Aug 2019 10:07:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tqiKSN3-qtSF for ; Thu, 8 Aug 2019 10:07:45 -0700 (PDT) Received: from p3plsmtpa11-01.prod.phx3.secureserver.net (p3plsmtpa11-01.prod.phx3.secureserver.net [68.178.252.102]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 09300120177 for ; Thu, 8 Aug 2019 10:07:32 -0700 (PDT) Received: from [192.168.1.76] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id vlsxh9SgapMjLvlsxhKslN; Thu, 08 Aug 2019 10:07:31 -0700 From: Laurence Lundblade Content-Type: multipart/alternative; boundary="Apple-Mail=_8C2208A5-CB87-4632-930F-245CE8B38EFC" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Message-Id: <4DACB0FB-8D81-4D19-B1B2-B4925960B4B7@island-resort.com> Date: Thu, 8 Aug 2019 10:07:31 -0700 To: rats@ietf.org X-Mailer: Apple Mail (2.3445.9.1) X-CMAE-Envelope: MS4wfAtl1mzwdzvfJ7RRK1MyT7EW0gX62tYOwpATugZi/8egsOSzwD9VqOfNguN+Hxq7j9fq6OjWZxdYbnsygmGLvI1Iy2Be9tHwQL0Hdaj5313zsk+Pd29n A4KrDJLy0a8CvkHYhHmyOQ/p9H3zsR6p6iD31PWA89vFD0yVzLrL6wIa Archived-At: Subject: [Rats] Hypothetical example of trust establishment X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Aug 2019 17:07:48 -0000 --Apple-Mail=_8C2208A5-CB87-4632-930F-245CE8B38EFC Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Here=E2=80=99s a hypothetical example of how I think trust is = established in RATS. It=E2=80=99s only one of many possible means. This example uses the term manufacturer, for the organization that = builds the chip, the OS for the chip, the attestation implementation and = the final product assembly. Say it=E2=80=99s an IoT sensor. The = manufacturer builds everything from scratch. I=E2=80=99m depicting this = way to keep the example simple. During Manufacturing of the sensor The manufacturer designs the sensor and builds prototypes They receive some certification for their sensor design They make the chip, the OS and attestation implementation They generate the attestation key pair and signs public key into an = X.509 cert and sign it under their attestation root for the particular = sensor product and certification. They put the private key and X.509 cert into the sensor The sensor ships to the customer Manufacturer Publication The manufacturer publishes the following about their sensor: Model number and product description Certifications received probably with link to certifying organization so = it can be checked Attestation root X.509 certificate for that product and certification = level The Attestation is Produced The nonce is received from the verifier/RP and input into the attestator The claims are created The token is signed with the attestation signing private key The X.509 cert with the public key is put in the right COSE/JOSE header The token is transmitted to the verifier/RP The RP Decides Whether to Trust for Their Particular Use Case The RP decides what types of certifications are good for their use case The RP fetches the attestation roots from manufacturers with such = products and certifications The attestation is received from the sensor with X.509 cert They chain up the individual sensor cert to the trusted manufacturer's = attestation root Some other variants might use a more elaborate X.509 hierarchy. Others = might not use X.509 at all with the manufacturer operating a public key = look up service based on key ID. There might even be some third parties = that brokers trust for multiple manufacturers and certification types. Some of this may have manual out-of-band steps to set up the initial = trust of the manufacturer. (I think this may be akin to a user = downloading a web browser with CA roots embedded, the basis of a lot of = TLS trust). There might be other criteria than certification. It might just be = enough to know it is a particular manufacturer and model based on the = signing keys. LL= --Apple-Mail=_8C2208A5-CB87-4632-930F-245CE8B38EFC Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Here=E2=80=99s a hypothetical example of how I think trust is = established in RATS. It=E2=80=99s only one of many possible means.

This example uses the = term manufacturer, for the organization that builds = the chip, the OS for the chip, the attestation implementation and the = final product assembly. Say it=E2=80=99s an IoT sensor. The manufacturer builds everything from scratch. I=E2=80=99m = depicting this way to keep the example simple.


During Manufacturing of the = sensor
  1. The = manufacturer designs the sensor and builds prototypes
  2. They receive some certification for their sensor = design
  3. They make the chip, the OS and attestation = implementation
  4. They generate the attestation key pair = and signs public key into an X.509 cert and sign it under their = attestation root for the particular sensor product and = certification.
  5. They put the private key and X.509 = cert into the sensor
  6. The sensor ships to the = customer

Manufacturer Publication
The manufacturer publishes the following about their = sensor:
  • Model number = and product description
  • Certifications received = probably with link to certifying organization so it can be = checked
  • Attestation root X.509 certificate for that = product and certification level
The Attestation is = Produced
  • The nonce is received from the verifier/RP and input into the = attestator
  • The claims are created
  • The token is signed with the attestation signing private = key
  • The X.509 cert with the public key is put in the = right COSE/JOSE header
  • The token is transmitted to = the verifier/RP


The RP = Decides Whether to Trust for Their Particular Use = Case
  • The RP decides what types of certifications are good for = their use case
  • The RP fetches the attestation roots = from manufacturers with such products and certifications
  • The attestation is received from the sensor with X.509 = cert
  • They chain up the individual sensor cert to the = trusted manufacturer's attestation root


Some other variants might use a more elaborate X.509 = hierarchy. Others might not use X.509 at all with the manufacturer = operating a public key look up service based on key ID. There might even = be some third parties that brokers trust for multiple manufacturers and = certification types.

Some of this may have manual out-of-band steps to set up the = initial trust of the manufacturer. (I think this may be akin to a user = downloading a web browser with CA roots embedded, the basis of a lot of = TLS trust).

There might be other criteria than certification. It might = just be enough to know it is a particular manufacturer and model based = on the signing keys.

LL
= --Apple-Mail=_8C2208A5-CB87-4632-930F-245CE8B38EFC-- From nobody Thu Aug 8 18:10:00 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3D0A512007A for ; Thu, 8 Aug 2019 18:09:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4Pjumu4HCO1q for ; Thu, 8 Aug 2019 18:09:56 -0700 (PDT) Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 679A212006E for ; Thu, 8 Aug 2019 18:09:56 -0700 (PDT) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by fmsmga102.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 08 Aug 2019 18:09:55 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.64,363,1559545200"; d="scan'208";a="193279726" Received: from orsmsx109.amr.corp.intel.com ([10.22.240.7]) by fmsmga001.fm.intel.com with ESMTP; 08 Aug 2019 18:09:55 -0700 Received: from orsmsx116.amr.corp.intel.com (10.22.240.14) by ORSMSX109.amr.corp.intel.com (10.22.240.7) with Microsoft SMTP Server (TLS) id 14.3.439.0; Thu, 8 Aug 2019 18:09:55 -0700 Received: from orsmsx109.amr.corp.intel.com ([169.254.11.25]) by ORSMSX116.amr.corp.intel.com ([169.254.7.102]) with mapi id 14.03.0439.000; Thu, 8 Aug 2019 18:09:55 -0700 From: "Smith, Ned" To: Michael Richardson , "rats@ietf.org" Thread-Topic: [Rats] No root of trust requirement in RATS/EAT Thread-Index: AQHVSvPjFx1t01pVXEauYmUEMz2sl6bwFaEAgABBv4CAAbEGAA== Date: Fri, 9 Aug 2019 01:09:54 +0000 Message-ID: References: <2DE09A2A-A6EA-4474-9DBE-8D52B523645B@island-resort.com> <29713.1565194803@localhost> In-Reply-To: <29713.1565194803@localhost> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1b.0.190715 x-originating-ip: [10.24.14.90] Content-Type: text/plain; charset="utf-8" Content-ID: <7EB2473A1286014D9355F4A3A299DBD1@intel.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [Rats] No root of trust requirement in RATS/EAT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 01:09:58 -0000 VGhlIGFzc3VtcHRpb24gaXMgIm1vbSIgaGFzIG1vcmUgY3JlZGliaWxpdHkvYXV0aG9yaXR5IHRo YW4gImJhYnlzaXR0ZXIiIHRvIGNsYWltIHRoYXQgInNjYXJ5IG1vdmllIG9uIFRWIiBpcyBhIHRy dXN0d29ydGhpbmVzcyBwcm9wZXJ0eS4gDQoNClRoZSBWZXJpZmllciBuZWVkcyB0byBoYXZlIGEg cG9saWN5KD8pIHRoYXQgcmVjb2duaXplcyBtb20gYXMgaGF2aW5nIG1vcmUgY3JlZGliaWxpdHkg dGhhbiBiYWJ5c2l0dGVyIHNpbmNlIGl0cyByZWFzb25hYmxlICh3aXRoaW4gdGhlIHVzZSBjYXNl IGNvbnRleHQ/KSBmb3IgYm90aCB0byBtYWtlIHRoZSBzYW1lIGNsYWltLiANCg0K77u/T24gOC83 LzE5LCA5OjIwIEFNLCAiUkFUUyBvbiBiZWhhbGYgb2YgTWljaGFlbCBSaWNoYXJkc29uIiA8cmF0 cy1ib3VuY2VzQGlldGYub3JnIG9uIGJlaGFsZiBvZiBtY3IraWV0ZkBzYW5kZWxtYW4uY2E+IHdy b3RlOg0KDQogICAgMikgaXQgbWlnaHQgYmUgdGhhdCBzb21lIHdhbnQgdG8gaGF2ZSBkaWZmZXJl bnQgY2xhaW1zIHRoYXQgZGlmZmVyIG9ubHkNCiAgICAgICBpbiB0aGVpciBkZWdyZWUgb2YgYXNz dXJhbmNlLiAgVGhhdCBpcywgdGhlcmUgaXMgYSBkaWZmZXJlbmNlIGJldHdlZW46DQogICAgDQog ICAgICAgIkxpdHRsZSBCb2JieSBzYWlkIHRoZSBiYWJ5c2l0dGVyIHNhaWQgdGhhdCBTYXJhaCBj b3VsZCB3YXRjaCB0aGUgc2NhcnkNCiAgICAgICAgICAgICAgICBtb3ZpZSBvbiBUViINCiAgICB2 cw0KICAgICAgICJMaXR0bGUgQm9iYnkgaGFzIGEgbm90ZSBmcm9tIE1vbSB0aGF0IHNheXMgdGhh dCBTYXJhaCBjb3VsZCB3YXRjaA0KICAgICAgICAgICAgICAgdGhlIHNjYXJ5IG1vdmllIG9uIFRW Ig0KDQo= From nobody Fri Aug 9 09:40:25 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5529612002E for ; Fri, 9 Aug 2019 09:40:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nfYNQKPELt9i for ; Fri, 9 Aug 2019 09:40:22 -0700 (PDT) Received: from p3plsmtpa06-10.prod.phx3.secureserver.net (p3plsmtpa06-10.prod.phx3.secureserver.net [173.201.192.111]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 86707120020 for ; Fri, 9 Aug 2019 09:40:22 -0700 (PDT) Received: from [192.168.1.108] ([76.192.164.238]) by :SMTPAUTH: with ESMTPSA id w7wDhX2yVKFk2w7wDh0v56; Fri, 09 Aug 2019 09:40:22 -0700 From: Laurence Lundblade Message-Id: <51591A70-7E30-47BA-A3FE-C5A76EA8FDDA@island-resort.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_EC854B3C-30BE-414D-9E8B-40BB906178B6" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Fri, 9 Aug 2019 09:40:20 -0700 In-Reply-To: <864C25C7-4584-495C-A6CD-40D7C2207EE9@intel.com> Cc: Thomas Hardjono , Kathleen Moriarty , Eliot Lear , "rats@ietf.org" , Anders Rundgren To: "Smith, Ned" References: <2DE09A2A-A6EA-4474-9DBE-8D52B523645B@island-resort.com> <987fbfbb-b3f6-c104-878a-b283978ca0f0@gmail.com> <6F1E85F0-35CB-415A-9672-BD3257F59373@island-resort.com> <2c9ebe7b-9826-2d23-6f86-d098b79128d6@gmail.com> <8E4ED21F-EE52-4FAF-AFCB-A7624C56ED28@island-resort.com> <148D90BA-036A-4682-B920-4650182E2CB1@cisco.com> <864C25C7-4584-495C-A6CD-40D7C2207EE9@intel.com> X-Mailer: Apple Mail (2.3445.9.1) X-CMAE-Envelope: MS4wfIIB26n9fn0qGBiD9XPtddgWoFIGihGF+Qu8KjWU5I3S3+kGlJyoBkZgY5YxlyuXOxRfaKv0WFUKGCaHXNPIgkJU+Xvsusd6F4pa6A9EyeeoIlz9uXVF Zjxu96Cn4e1vwPczJ54J/9C5uzsOpoqk5ry/NX56GrurFiFw+XlOo6ehwbZdRlL8jgwJJzNTx1RifZ0iiqPRThTRRS5PWCWKWumwtgxrQQulxX2q8cUyIylH ZtIYMvVJMw98qpo0o4xSCtzQGmGdVh5AKXhZd43xsnlEXfytsUkq+wpPBTEYZKfkr+/PlqesunEZ+vAwaCNez3BYAuYKJ2xiKm3tg9L+7hU= Archived-At: Subject: Re: [Rats] No root of trust requirement in RATS/EAT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 16:40:24 -0000 --Apple-Mail=_EC854B3C-30BE-414D-9E8B-40BB906178B6 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Ned, > On Aug 6, 2019, at 12:01 PM, Smith, Ned wrote: >=20 > The intent of my previous reply was to have a scoping discussion. The = RATS WG likely doesn't have resources / interest / charter to define = drafts for every topic relevant to remote attestation. Nevertheless, we = can identify the topics we chose not to define and label them so that we = have a vocabulary to talk about them (without creating drafts that = defines them).=20 >=20 > Laurence's original point was that RoT was something the WG shouldn't = define (in a draft) to which I concur. Nevertheless, there is a need to = talk about the part of the device (entity) where detection of = misbehavior is not possible. This part can't be attested (by = definition). If we don't like the term root of trust then we can invent = something else. If we go with something like = "the-entity-whose-misbehavior-cannot-be-detected", that is longish to = type. If we go with root-of-trust then it is something most of the rest = of the industry understands is something whose misbehavior can't be = detected, though there may be additional connotations. RATS WG has the = option of including a terminology section that clarifies for the reader = of RATS drafts what properties of the terms we use are most relevant. My original point is that RATS should not put any requirements on = implementation. If a root of trust is required, that will imply HW security requirements = on the implementation for most people If we redefine root of trust so that it doesn=E2=80=99t imply any = requirements on the implementation, we will confuse We MUST allow generation of attestations from subsystems other than = the-entity-whose-misbehavior-cannot-be-detected Implementation requirements would be a large divergence from most other = IETF-defined protocols like TLS and COSE Maybe we can just call it the =E2=80=9Cattester=E2=80=9D and say that it = is the thing that has the attestation signing key and generates the = attestation. Say that in many cases, particularly those with better = security, the attester will be what is traditionally known as a =E2=80=9Cr= oot of trust=E2=80=9D. Some implementation profiles will require a root = of trust. >=20 > Looking at this topic from the perspective of what can be attested, it = suggests that the claims attested should be properties where misbehavior = can be detected. For example, a hash of firmware A will not describe = firmware B as long as the hashing was performed correctly. It may not be = possible to detect if the hash of A was performed correctly (since an = attacker could have input B and said the output was A) therefore that = belongs in the RoT.=20 The real basis for attestation trust is actually out-of-band trust = establishment between the relying party and manufacturer or such as = I=E2=80=99ve tried to illustrate in my recent hypothetical example. It = seems to me that the real trust in TLS is established out of band = through the download of a web browser containing roots by the end user. = This is similar.=20 >=20 > It is a security faux pas to expect the environment reporting attested = values can attest to its own security properties. There needs to be = finer granularity decomposition to separate what is the RoT = functionality from the attestable functionality. Hence, the term = 'turtles all the way down=E2=80=99. There is a non-turtle in the out-of-band interaction.=20 > Since the RATS WG scope doesn't anticipate wanting / needing to define = specific turtles, working group participants should have something in = mind in terms a turtle that is a root of trust and a turtle that is = attestable. They can forward claims about the attestable turtle and = agree that the root of trust turtle can be identified (e.g. vendor, = model, version - and some way to authenticate these values) but it is up = to the verifier to have a policy for what it accepts as its = root-of-trust turtles. The RoT turtle is the starting point for = evaluating the turtles that can be attested.=20 For TPMs and the TCG I think there may be a non-turtle out-of-band = interaction that is tacitly assumed and baked into "root of trust=E2=80=9D= . The TCG sharply defines the functionality and security of the TPM. TPM = vendors all precisely adhere to this. There is also a strong HW-oriented = Common Criteria certification program. I think there are also = conventions for key distribution the TPM world. A TPM vendor diverging = from this wouldn=E2=80=99t sell any product so all of this is = ever-present and uniform. (I=E2=80=99m not a TPM expert, so hopefully I = have got this right). Seems like the GP / TEE world has some of this too, though not as much. I am aiming for RATS applicable in a broader way with no tie to = implementation security. The same sort of broadness that TLS has. LL --Apple-Mail=_EC854B3C-30BE-414D-9E8B-40BB906178B6 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi = Ned,

On Aug 6, 2019, at 12:01 PM, Smith, Ned = <ned.smith@intel.com> wrote:

The = intent of my previous reply was to have a scoping discussion. The RATS = WG likely doesn't have resources / interest / charter to define drafts = for every topic relevant to remote attestation. Nevertheless, we can = identify the topics we chose not to define and label them so that we = have a vocabulary to talk about them (without creating drafts that = defines them).

Laurence's original point = was that RoT was something the WG shouldn't define (in a draft) to which = I concur. Nevertheless, there is a need to talk about the part of the = device (entity) where detection of misbehavior is not possible. This = part can't be attested (by definition). If we don't like the term root = of trust then we can invent something else. If we go with something like = "the-entity-whose-misbehavior-cannot-be-detected", that is longish to = type. If we go with root-of-trust then it is something most of the rest = of the industry understands is something whose misbehavior can't be = detected, though there may be additional connotations. RATS WG has the = option of including a terminology section that clarifies for the reader = of RATS drafts what properties of the terms we use are most relevant.

My = original point is that RATS should not put any requirements on = implementation.

  • If a root of trust is required, = that will imply HW security requirements on the implementation for most = people
  • If we redefine root of trust so that it = doesn=E2=80=99t imply any requirements on the implementation, we will = confuse
  • We MUST allow generation of attestations from = subsystems other than = the-entity-whose-misbehavior-cannot-be-detected
  • Implementation requirements would be a large divergence from = most other IETF-defined protocols like TLS and COSE

Maybe we can just call = it the =E2=80=9Cattester=E2=80=9D and say that it is the thing that has = the attestation signing key and generates the attestation. Say that in = many cases, particularly those with better security, the attester will = be what is traditionally known as a =E2=80=9Croot of trust=E2=80=9D. = Some implementation profiles will require a root of trust.


Looking at = this topic from the perspective of what can be attested, it suggests = that the claims attested should be properties where misbehavior can be = detected. For example, a hash of firmware A will not describe firmware B = as long as the hashing was performed correctly. It may not be possible = to detect if the hash of A was performed correctly (since an attacker = could have input B and said the output was A) therefore that belongs in = the RoT.

The real basis for attestation trust is actually = out-of-band trust establishment between the relying party and = manufacturer or such as I=E2=80=99ve tried to illustrate in my recent = hypothetical example.  It seems to me that the real trust in TLS is = established out of band through the download of a web browser containing = roots by the end user. This is similar. 


It is a security faux pas to expect the = environment reporting attested values can attest to its own security = properties. There needs to be finer granularity decomposition to = separate what is the RoT functionality from the attestable = functionality. Hence, the term 'turtles all the way = down=E2=80=99.

There is a non-turtle in the out-of-band = interaction. 


Since the RATS WG scope doesn't anticipate wanting / needing = to define specific turtles, working group participants should have = something in mind in terms a turtle that is a root of trust and a turtle = that is attestable. They can forward claims about the attestable turtle = and agree that the root of trust turtle can be identified (e.g. vendor, = model, version - and some way to authenticate these values) but it is up = to the verifier to have a policy for what it accepts as its = root-of-trust turtles. The RoT turtle is the starting point for = evaluating the turtles that can be attested.

For = TPMs and the TCG I think there may be a non-turtle out-of-band = interaction that is tacitly assumed and baked into "root of trust=E2=80=9D= . The TCG sharply defines the functionality and security of the TPM. TPM = vendors all precisely adhere to this. There is also a strong HW-oriented = Common Criteria certification program. I think there are also = conventions for key distribution the TPM world. A TPM vendor diverging = from this wouldn=E2=80=99t sell any product so all of this is = ever-present and uniform. (I=E2=80=99m not a TPM expert, so hopefully I = have got this right).

Seems like the = GP / TEE world has some of this too, though not as much.

I am aiming for RATS applicable in a broader way = with no tie to implementation security. The same sort of broadness that = TLS has.

LL

= --Apple-Mail=_EC854B3C-30BE-414D-9E8B-40BB906178B6-- From nobody Fri Aug 9 15:44:22 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7632C1200B8 for ; Fri, 9 Aug 2019 15:44:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.899 X-Spam-Level: X-Spam-Status: No, score=-6.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 35IjThhCm8f0 for ; Fri, 9 Aug 2019 15:44:17 -0700 (PDT) Received: from mga01.intel.com (mga01.intel.com [192.55.52.88]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 882F4120019 for ; Fri, 9 Aug 2019 15:44:17 -0700 (PDT) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by fmsmga101.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 09 Aug 2019 15:44:17 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.64,367,1559545200"; d="scan'208,217";a="204064460" Received: from orsmsx106.amr.corp.intel.com ([10.22.225.133]) by fmsmga002.fm.intel.com with ESMTP; 09 Aug 2019 15:44:16 -0700 Received: from orsmsx115.amr.corp.intel.com (10.22.240.11) by ORSMSX106.amr.corp.intel.com (10.22.225.133) with Microsoft SMTP Server (TLS) id 14.3.439.0; Fri, 9 Aug 2019 15:44:16 -0700 Received: from orsmsx109.amr.corp.intel.com ([169.254.11.25]) by ORSMSX115.amr.corp.intel.com ([169.254.4.240]) with mapi id 14.03.0439.000; Fri, 9 Aug 2019 15:44:16 -0700 From: "Smith, Ned" To: Laurence Lundblade , "rats@ietf.org" CC: Kathleen Moriarty , Thomas Hardjono , Eliot Lear , Anders Rundgren Thread-Topic: [Rats] No root of trust requirement in RATS/EAT Thread-Index: AQHVSvPjFx1t01pVXEauYmUEMz2sl6br0JiAgACjAICAABfBAIAAR+sAgAB4kQCAAJf9gIAASouAgABg+ICAAAcUgP//5nmAgAUE0gD///BVgA== Date: Fri, 9 Aug 2019 22:44:15 +0000 Message-ID: <02C00816-7EE8-403F-B0A8-9A92174B7D7D@intel.com> References: <2DE09A2A-A6EA-4474-9DBE-8D52B523645B@island-resort.com> <987fbfbb-b3f6-c104-878a-b283978ca0f0@gmail.com> <6F1E85F0-35CB-415A-9672-BD3257F59373@island-resort.com> <2c9ebe7b-9826-2d23-6f86-d098b79128d6@gmail.com> <8E4ED21F-EE52-4FAF-AFCB-A7624C56ED28@island-resort.com> <148D90BA-036A-4682-B920-4650182E2CB1@cisco.com> <864C25C7-4584-495C-A6CD-40D7C2207EE9@intel.com> <51591A70-7E30-47BA-A3FE-C5A76EA8FDDA@island-resort.com> In-Reply-To: <51591A70-7E30-47BA-A3FE-C5A76EA8FDDA@island-resort.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1b.0.190715 x-originating-ip: [10.24.15.22] Content-Type: multipart/alternative; boundary="_000_02C008167EE8403FB0A89A92174B7D7Dintelcom_" MIME-Version: 1.0 Archived-At: Subject: Re: [Rats] No root of trust requirement in RATS/EAT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Aug 2019 22:44:21 -0000 --_000_02C008167EE8403FB0A89A92174B7D7Dintelcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 U2VlIG15IGNvbW1lbnRzIGlubGluZSBbbm1zXS4NCg0KT24gOC85LzE5LCA5OjQxIEFNLCAiUkFU UyBvbiBiZWhhbGYgb2YgTGF1cmVuY2UgTHVuZGJsYWRlIiA8cmF0cy1ib3VuY2VzQGlldGYub3Jn PG1haWx0bzpyYXRzLWJvdW5jZXNAaWV0Zi5vcmc+IG9uIGJlaGFsZiBvZiBsZ2xAaXNsYW5kLXJl c29ydC5jb208bWFpbHRvOmxnbEBpc2xhbmQtcmVzb3J0LmNvbT4+IHdyb3RlOg0KDQpIaSBOZWQs DQoNCg0KT24gQXVnIDYsIDIwMTksIGF0IDEyOjAxIFBNLCBTbWl0aCwgTmVkIDxuZWQuc21pdGhA aW50ZWwuY29tPG1haWx0bzpuZWQuc21pdGhAaW50ZWwuY29tPj4gd3JvdGU6DQoNClRoZSBpbnRl bnQgb2YgbXkgcHJldmlvdXMgcmVwbHkgd2FzIHRvIGhhdmUgYSBzY29waW5nIGRpc2N1c3Npb24u IFRoZSBSQVRTIFdHIGxpa2VseSBkb2Vzbid0IGhhdmUgcmVzb3VyY2VzIC8gaW50ZXJlc3QgLyBj aGFydGVyIHRvIGRlZmluZSBkcmFmdHMgZm9yIGV2ZXJ5IHRvcGljIHJlbGV2YW50IHRvIHJlbW90 ZSBhdHRlc3RhdGlvbi4gTmV2ZXJ0aGVsZXNzLCB3ZSBjYW4gaWRlbnRpZnkgdGhlIHRvcGljcyB3 ZSBjaG9zZSBub3QgdG8gZGVmaW5lIGFuZCBsYWJlbCB0aGVtIHNvIHRoYXQgd2UgaGF2ZSBhIHZv Y2FidWxhcnkgdG8gdGFsayBhYm91dCB0aGVtICh3aXRob3V0IGNyZWF0aW5nIGRyYWZ0cyB0aGF0 IGRlZmluZXMgdGhlbSkuDQoNCkxhdXJlbmNlJ3Mgb3JpZ2luYWwgcG9pbnQgd2FzIHRoYXQgUm9U IHdhcyBzb21ldGhpbmcgdGhlIFdHIHNob3VsZG4ndCBkZWZpbmUgKGluIGEgZHJhZnQpIHRvIHdo aWNoIEkgY29uY3VyLiBOZXZlcnRoZWxlc3MsIHRoZXJlIGlzIGEgbmVlZCB0byB0YWxrIGFib3V0 IHRoZSBwYXJ0IG9mIHRoZSBkZXZpY2UgKGVudGl0eSkgd2hlcmUgZGV0ZWN0aW9uIG9mIG1pc2Jl aGF2aW9yIGlzIG5vdCBwb3NzaWJsZS4gVGhpcyBwYXJ0IGNhbid0IGJlIGF0dGVzdGVkIChieSBk ZWZpbml0aW9uKS4gSWYgd2UgZG9uJ3QgbGlrZSB0aGUgdGVybSByb290IG9mIHRydXN0IHRoZW4g d2UgY2FuIGludmVudCBzb21ldGhpbmcgZWxzZS4gSWYgd2UgZ28gd2l0aCBzb21ldGhpbmcgbGlr ZSAidGhlLWVudGl0eS13aG9zZS1taXNiZWhhdmlvci1jYW5ub3QtYmUtZGV0ZWN0ZWQiLCB0aGF0 IGlzIGxvbmdpc2ggdG8gdHlwZS4gSWYgd2UgZ28gd2l0aCByb290LW9mLXRydXN0IHRoZW4gaXQg aXMgc29tZXRoaW5nIG1vc3Qgb2YgdGhlIHJlc3Qgb2YgdGhlIGluZHVzdHJ5IHVuZGVyc3RhbmRz IGlzIHNvbWV0aGluZyB3aG9zZSBtaXNiZWhhdmlvciBjYW4ndCBiZSBkZXRlY3RlZCwgdGhvdWdo IHRoZXJlIG1heSBiZSBhZGRpdGlvbmFsIGNvbm5vdGF0aW9ucy4gUkFUUyBXRyBoYXMgdGhlIG9w dGlvbiBvZiBpbmNsdWRpbmcgYSB0ZXJtaW5vbG9neSBzZWN0aW9uIHRoYXQgY2xhcmlmaWVzIGZv ciB0aGUgcmVhZGVyIG9mIFJBVFMgZHJhZnRzIHdoYXQgcHJvcGVydGllcyBvZiB0aGUgdGVybXMg d2UgdXNlIGFyZSBtb3N0IHJlbGV2YW50Lg0KDQpNeSBvcmlnaW5hbCBwb2ludCBpcyB0aGF0IFJB VFMgc2hvdWxkIG5vdCBwdXQgYW55IHJlcXVpcmVtZW50cyBvbiBpbXBsZW1lbnRhdGlvbi4NCltu bXNdIEkgaW5mZXIgeW91IG1lYW4gUkFUUyBzaG91bGQgbm90IHB1dCBhbnkgdHJ1c3QgcmVxdWly ZW1lbnRzIG9uIGltcGxlbWVudGF0aW9uPw0KW25tc10gVGhlIGNoYXJ0ZXIgdGV4dCBpcyBjYXJl ZnVsIHRvIHVzZSB0aGUgcGhyYXNlIOKAmHRydXN0d29ydGhpbmVzc+KAmSByYXRoZXIgdGhhbiDi gJh0cnVzdOKAmS4gVGhlIGFyY2hpdGVjdHVyZSBkcmFmdCB0cmllcyB0byBhdm9pZCB1c2luZyDi gJh0cnVzdOKAmSBhbmQg4oCYdHJ1c3RlZOKAmS4gVGhlIG1vdGl2YXRpb24gZm9yIHVzaW5nIOKA mHRydXN0d29ydGhpbmVzc+KAmSBhbmQg4oCYdHJ1c3R3b3J0aGluZXNzIHByb3BlcnRpZXPigJkg aXMgdG8gZm9jdXMgZW5lcmd5IG9uIGlkZW50aWZ5aW5nIHRoaW5ncyAoY2xhaW1zKSB0aGF0IGNh biBiZSBjb25jcmV0ZWx5IGV4cHJlc3NlZCAoYXMgZGF0YSBzdHJ1Y3R1cmVzKSBhbmQgYXMgc3Rh dGVtZW50cyB0aGF0IGFyZSBvYnZpb3VzIGFuZCBmYWN0dWFsLiBUaGUgd29yZCDigJh0cnVzdOKA mSB0ZW5kcyB0byBldm9rZSBpZGVhcyB0aGF0IHNlZW0gdG8gYmUgc3ViamVjdGl2ZSBvciBvcGVu IHRvIGludGVycHJldGF0aW9uLiBUaG9tYXMgSGFyZGpvbm8gbWVudGlvbmVkIGluIGEgcHJldmlv dXMgdGhyZWFkIHRoZSBkaWZmZXJlbmNlcyBiZXR3ZWVuIHNvY2lhbCBhbmQgdGVjaG5pY2FsIHRy dXN0LiBJIHJlY29tbWVuZCByZXZpZXcgb2YgaHR0cHM6Ly93d3cudzMub3JnLzIwMTYvMDQvYmxv Y2tjaGFpbi13b3Jrc2hvcC9zbGlkZXMvSGFyZGpvbm8tUGVudGxhbmQtVzNDLUp1bmUyMDE2LnBk ZiB0byBhbnlvbmUgaW50ZXJlc3RlZCBpbiBkaWdnaW5nIGRlZXBlci4gVGhlIHdvcmQg4oCYdHJ1 c3TigJkgbWF5IGV2b2tlIGlkZWFzIHRoYXQgYXJlIG1vcmUgY29ycmVsYXRlZCB3aXRoIOKAmHNv Y2lhbCB0cnVzdOKAmSB3aGlsZSB0aGUgUkFUUyBjaGFydGVyIGFuZCBvdGhlciBkb2N1bWVudHMg YXJlIHRyeWluZyB0byBmb2N1cyBvbiDigJh0ZWNobmljYWwgdHJ1c3TigJkuDQoNCsK3ICAgICAg ICAgSWYgYSByb290IG9mIHRydXN0IGlzIHJlcXVpcmVkLCB0aGF0IHdpbGwgaW1wbHkgSFcgc2Vj dXJpdHkgcmVxdWlyZW1lbnRzIG9uIHRoZSBpbXBsZW1lbnRhdGlvbiBmb3IgbW9zdCBwZW9wbGUN CsK3ICAgICAgICAgSWYgd2UgcmVkZWZpbmUgcm9vdCBvZiB0cnVzdCBzbyB0aGF0IGl0IGRvZXNu 4oCZdCBpbXBseSBhbnkgcmVxdWlyZW1lbnRzIG9uIHRoZSBpbXBsZW1lbnRhdGlvbiwgd2Ugd2ls bCBjb25mdXNlDQrCtyAgICAgICAgIFdlIE1VU1QgYWxsb3cgZ2VuZXJhdGlvbiBvZiBhdHRlc3Rh dGlvbnMgZnJvbSBzdWJzeXN0ZW1zIG90aGVyIHRoYW4gdGhlLWVudGl0eS13aG9zZS1taXNiZWhh dmlvci1jYW5ub3QtYmUtZGV0ZWN0ZWQNCsK3ICAgICAgICAgSW1wbGVtZW50YXRpb24gcmVxdWly ZW1lbnRzIHdvdWxkIGJlIGEgbGFyZ2UgZGl2ZXJnZW5jZSBmcm9tIG1vc3Qgb3RoZXIgSUVURi1k ZWZpbmVkIHByb3RvY29scyBsaWtlIFRMUyBhbmQgQ09TRQ0KDQpNYXliZSB3ZSBjYW4ganVzdCBj YWxsIGl0IHRoZSDigJxhdHRlc3RlcuKAnSBhbmQgc2F5IHRoYXQgaXQgaXMgWzJddGhlIHRoaW5n IHRoYXQgaGFzIHRoZSBhdHRlc3RhdGlvbiBzaWduaW5nIGtleSBhbmQgZ2VuZXJhdGVzIHRoZSBh dHRlc3RhdGlvbi4gU2F5IHRoYXQgaW4gbWFueSBjYXNlcywgcGFydGljdWxhcmx5IHRob3NlIFsz XXdpdGggYmV0dGVyIHNlY3VyaXR5LCB0aGUgYXR0ZXN0ZXIgd2lsbCBiZSB3aGF0IGlzIHRyYWRp dGlvbmFsbHkga25vd24gYXMgYSDigJxyb290IG9mIHRydXN04oCdLiBTb21lIGltcGxlbWVudGF0 aW9uIHByb2ZpbGVzIHdpbGwgcmVxdWlyZSBhIHJvb3Qgb2YgdHJ1c3QuDQpbbm1zXSBbMV0gVGhl IFJBVFMgYXJjaGl0ZWN0dXJlIChpcyB0cnlpbmcgdG8pIGRlZmluZSBhdHRlc3RhdGlvbiByb2xl cyBzdWNoIGFzIEF0dGVzdGVyLCBWZXJpZmllciBldGMuLiBhbmQgYWN0b3JzIHN1Y2ggYXMgRGV2 aWNlLCBTdXBwbHkgQ2hhaW4gRW50aXR5LCBTZXJ2aWNlIFByb3ZpZGVyIGV0Y+KApiBSZWZlcnJp bmcgdG8gWzJdIOKAnHRoaW5n4oCdIGlzIHN0ZXJlb3R5cGVkIGFzIGEg4oCYZGV2aWNl4oCZIGFj dG9yIGluIHRoZSBhcmNoaXRlY3R1cmUgZHJhZnQgc28gdGhhdCBwZXJmb3JtYW5jZSBvZiB0aGUg QXR0ZXN0ZXIgcm9sZSBkb2VzbuKAmXQgY2Fycnkgd2l0aCBpdCBhbnkgYmFnZ2FnZSBvciBhc3N1 bXB0aW9ucyBhYm91dCBhY3RvciAoYWthIGRldmljZSkgY29tcG9zaXRpb24gb3IgdHJ1c3QuIFRo ZSBBdHRlc3RlciByb2xlIGRvZXMgc2VlbSB0byBoYXZlIHNvbWUgc2VtYW50aWNzIHJlZ2FyZGlu ZyB3aGF0IGl0IGNhbiBzYXkgKGNsYWltKSB2cy4gd2hhdCBzaG91bGQgYmUgY2xhaW1lZCBieSBh biBBc3NlcnRlciAoYWthIENsYWltYW50KS4gSW4gb3RoZXIgd29yZHMsIHNlbGYtYXNzZXJ0aW9u IChlLmcuIOKAnEnigJltIHRydXN0d29ydGh5IGJlY2F1c2UgSSBzYWlkIHNv4oCdKSBkb2VzbuKA mXQgc2VlbSByZWFzb25hYmxlIChsb2dpY2FsKS4gVGhlIGFyY2hpdGVjdHVyZSBkcmFmdCB1c2Vz IHRoZSB0ZXJtIOKAmHJvb3Qgb2YgdHJ1c3TigJkgdG8gZGVzY3JpYmUgYSBkZWNvbXBvc2l0aW9u IG9mIHRoZSBkZXZpY2UgKGFjdG9yKSBpbnRvIG1vcmUgcHJpbWl0aXZlIGRldmljZSBjb21wb25l bnRzIChzdWItYWN0b3JzPykgc28gdGhhdCBpdCBpcyBwb3NzaWJsZSBmb3IgdGhlIEF0dGVzdGVy IHRvIGF2b2lkIGJlY29taW5nIGEgc2VsZi1hc3NlcnRlci4NCg0KU3BlY2lmaWMgdG8geW91ciBz dGF0ZW1lbnQgYWJvdmUgaW4gWzNdLiBUaGUgQXR0ZXN0ZXIgY2FuIG1ha2UgbG90cyBvZiBjbGFp bXMgbGVnaXRpbWF0ZWx5IGFuZCBzaWduIHRoZW0gdXNpbmcgaXRzIGF0dGVzdGF0aW9uIGtleS4g SG93ZXZlciwgaXQgY2Fu4oCZdCBtYWtlIGNsYWltcyBhYm91dCB0aGUgc2lnbmluZyBrZXkgYmVj YXVzZSB0aGUga2V5IGl0c2VsZiBpcyBzcGVha2luZyAoYXR0ZXN0aW5nKS4gU29tZSBvdGhlciBl bnRpdHkgKGFjdG9yKSBuZWVkcyB0byBhc3NlcnQgY2xhaW1zIGFib3V0IHRoZSB0cnVzdHdvcnRo aW5lc3MgcHJvcGVydGllcyBvZiB0aGUgQXR0ZXN0ZXLigJlzIGtleS4gTWF5YmUgaXQgaXMgYSBz ZWNvbmQgQXR0ZXN0ZXIgb3IgbWF5YmUgaXQgaXMgYW4gQXNzZXJ0ZXIuIElmIHRoZSBBc3NlcnRl ciBpcyBhIHN1cHBseSBjaGFpbiBlbnRpdHkgdGhhdCBtYW51ZmFjdHVyZWQgdGhlIGtleSBzbyB0 aGF0IGl0IHJlc2lzdHMgY2VydGFpbiBhdHRhY2tzIHRoZW4gdGhlIHN1cHBseSBjaGFpbiBlbnRp dHkgc2hvdWxkIHNheSB0aGF0LiBJZiB0aGUgQXR0ZXN0ZXIgdHJpZXMgdG8gc2F5IHRoZSBzYW1l IHRoaW5nIGFib3V0IGl0cyBrZXksIHRoZSBWZXJpZmllciBzaG91bGQgYmUgc3VzcGljaW91cy4g SG93IGNhbiBhIGtleSBiZSBjb2duaXphbnQgb2YgdGhlIG1hbnVmYWN0dXJpbmcgcHJvY2VzcyB0 aGF0IGNyZWF0ZWQgaXQ/DQoNCk1heWJlIGRpZmZlcmVudCB0ZXJtaW5vbG9neSBiZXNpZGVzIHJv b3Qgb2YgdHJ1c3Qgd2lsbCBiZSBoZWxwZnVsPw0KDQpOZXZlcnRoZWxlc3MsIHRoZSBhcmNoaXRl Y3R1cmUgYW5kIG90aGVyIGRyYWZ0cyBzaG91bGQgYmUgY2FyZWZ1bCBub3QgdG8gZGVzY3JpYmUg dGhpbmdzIHRoYXQgYXJlIGluc2VjdXJlIChpbGxvZ2ljYWw/KSBieSBkZXNpZ24uIFVsdGltYXRl bHksIHRoZSBkZWdyZWUgKHN0cmVuZ3RoLW9mLWZ1bmN0aW9uKSB0byB3aGljaCBhbiBhY3RvciBp cyB3b3J0aHkgb2YgYmVpbmcgY29uc2lkZXJlZCB0cnVzdGVkIGlzIHNvbWVob3cgZW1ib2RpZWQg aW4gdGhlIHBvbGljaWVzIGFmZmVjdGluZyBlaXRoZXIgVmVyaWZpZXIgb3IgUmVseWluZyBQYXJ0 eSByZXNwb25zZXMgdG8gYXR0ZXN0YXRpb24gcmVzdWx0cy4gVGhlIGludGVudCBvZiB0aGUgYXJj aGl0ZWN0dXJlIGRyYWZ0IGlzIHRoYXQgdGhlIEF0dGVzdGVyIHJvbGUgZG9lc27igJl0IGltcGx5 IGFueSBwYXJ0aWN1bGFyIHN0cmVuZ3RoLW9mLWZ1bmN0aW9uIHRvIGJlIGNvbnNpZGVyZWQgYW4g QXR0ZXN0ZXIuIEl0IGFsc28gaXNu4oCZdCB0cnlpbmcgdG8gaW1wbHkgdGhhdCB0aGVyZSBpcyBu byBzdWNoIHRoaW5nIGFzIHN0cmVuZ3RoLW9mLWZ1bmN0aW9uIChvciB3aGF0ZXZlciB3b3JkcyB3 ZSB1c2UgdG8gY2FwdHVyZSB0aGUgaWRlYSBvZiBsZXZlbCBvZiBpbXBsZW1lbnRhdGlvbiBoYXJk ZW5pbmcgYW5kL29yIHJlc2lzdGFuY2UgdG8gYXR0YWNrKS4NCg0KTG9va2luZyBhdCB0aGlzIHRv cGljIGZyb20gdGhlIHBlcnNwZWN0aXZlIG9mIHdoYXQgY2FuIGJlIGF0dGVzdGVkLCBpdCBzdWdn ZXN0cyB0aGF0IHRoZSBjbGFpbXMgYXR0ZXN0ZWQgc2hvdWxkIGJlIHByb3BlcnRpZXMgd2hlcmUg bWlzYmVoYXZpb3IgY2FuIGJlIGRldGVjdGVkLiBGb3IgZXhhbXBsZSwgYSBoYXNoIG9mIGZpcm13 YXJlIEEgd2lsbCBub3QgZGVzY3JpYmUgZmlybXdhcmUgQiBhcyBsb25nIGFzIHRoZSBoYXNoaW5n IHdhcyBwZXJmb3JtZWQgY29ycmVjdGx5LiBJdCBtYXkgbm90IGJlIHBvc3NpYmxlIHRvIGRldGVj dCBpZiB0aGUgaGFzaCBvZiBBIHdhcyBwZXJmb3JtZWQgY29ycmVjdGx5IChzaW5jZSBhbiBhdHRh Y2tlciBjb3VsZCBoYXZlIGlucHV0IEIgYW5kIHNhaWQgdGhlIG91dHB1dCB3YXMgQSkgdGhlcmVm b3JlIHRoYXQgYmVsb25ncyBpbiB0aGUgUm9ULg0KDQpUaGUgcmVhbCBiYXNpcyBmb3IgYXR0ZXN0 YXRpb24gdHJ1c3QgaXMgYWN0dWFsbHkgb3V0LW9mLWJhbmQgdHJ1c3QgZXN0YWJsaXNobWVudCBi ZXR3ZWVuIHRoZSByZWx5aW5nIHBhcnR5IGFuZCBtYW51ZmFjdHVyZXIgb3Igc3VjaCBhcyBJ4oCZ dmUgdHJpZWQgdG8gaWxsdXN0cmF0ZSBpbiBteSByZWNlbnQgaHlwb3RoZXRpY2FsIGV4YW1wbGUu ICBJdCBzZWVtcyB0byBtZSB0aGF0IHRoZSByZWFsIHRydXN0IGluIFRMUyBpcyBlc3RhYmxpc2hl ZCBvdXQgb2YgYmFuZCB0aHJvdWdoIHRoZSBkb3dubG9hZCBvZiBhIHdlYiBicm93c2VyIGNvbnRh aW5pbmcgcm9vdHMgYnkgdGhlIGVuZCB1c2VyLiBUaGlzIGlzIHNpbWlsYXIuDQoNCltubXNdIFVz aW5nIHRoZSByb2xlcyB0ZXJtaW5vbG9neSBhcmNoaXRlY3R1cmUgZHJhZnQgeW91IGFwcGVhciB0 byBiZSBzYXlpbmcgdGhlIGZvbGxvd2luZzoNCuKAnFRoZSBiYXNpcyBmb3IgYmVsaWV2aW5nIGV2 aWRlbmNlIGZyb20gdGhlIEF0dGVzdGVyIChieSB0aGUgVmVyaWZpZXIgb3IgUmVseWluZyBQYXJ0 eSkgaXMgYWN0dWFsbHkgdGllZCB0byBhbiBvdXQtb2YtYmFuZCBmbG93IG9mIEFzc2VydGlvbnMg ZnJvbSBvbmUgb3IgbW9yZSBBc3NlcnRlcnMu4oCdDQpUaGlzIG1ha2VzIHNlbnNlIGFuZCByZXNv bmF0ZXMgd2l0aCB3aGF0IGlzIGRlcGljdGVkIGluIHRoZSBhcmNoaXRlY3R1cmUgZGlhZ3JhbXMg YW5kIGluIHRoZSBhcmNoaXRlY3R1cmUgZHJhZnQuICBEZWZpbml0aW9uIG9mIGZsb3dzIHRvIGFu ZCBmcm9tIHRoZSBBc3NlcnRlciAoY2xhaW1hbnQpIGFyZSBjdXJyZW50bHkgb3V0IG9mIHNjb3Bl IGZvciB0aGUgV0cgYnV0IHdpbGwgYmUgZGVzY3JpYmVkIGluIHRoZSBhcmNoaXRlY3R1cmUgZHJh ZnQuIFlvdXIgcG9pbnQgc2VlbXMgdG8gYmUgdGhhdCBWZXJpZmllciAvIFJlbHlpbmcgUGFydHkg ZGVwZW5kcyBvbiB0aGlzIG91dC1vZi1iYW5kIGZsb3cgaW4gb3JkZXIgdG8gYXJyaXZlIGF0IGFu eSBzb3J0IG9mIG1lYW5pbmdmdWwgY29uY2x1c2lvbiBhYm91dCB0cnVzdHdvcnRoaW5lc3Mgb2Yg ZXZpZGVuY2UuIFRvIHdoaWNoIEkgZnVsbHkgYWdyZWUuDQoNCg0KDQpJdCBpcyBhIHNlY3VyaXR5 IGZhdXggcGFzIHRvIGV4cGVjdCB0aGUgZW52aXJvbm1lbnQgcmVwb3J0aW5nIGF0dGVzdGVkIHZh bHVlcyBjYW4gYXR0ZXN0IHRvIGl0cyBvd24gc2VjdXJpdHkgcHJvcGVydGllcy4gVGhlcmUgbmVl ZHMgdG8gYmUgZmluZXIgZ3JhbnVsYXJpdHkgZGVjb21wb3NpdGlvbiB0byBzZXBhcmF0ZSB3aGF0 IGlzIHRoZSBSb1QgZnVuY3Rpb25hbGl0eSBmcm9tIHRoZSBhdHRlc3RhYmxlIGZ1bmN0aW9uYWxp dHkuIEhlbmNlLCB0aGUgdGVybSAndHVydGxlcyBhbGwgdGhlIHdheSBkb3du4oCZLg0KDQpUaGVy ZSBpcyBhIG5vbi10dXJ0bGUgaW4gdGhlIG91dC1vZi1iYW5kIGludGVyYWN0aW9uLg0KW25tc10g VGhlIHNlY3VyaXR5IGZhdXggcGFzIGlzIHJlZmVycmluZyB0byBbMV0gaW4gdGhpcyBlbWFpbC4g 4oCYVHVydGxlc+KAmSByZWZlcnMgdG8g4oCYc3ViLWFjdG9yc+KAmSBpbiBbMV0uIFllcywgaW4g YWRkaXRpb24gdG8gdGhlIGRldmljZSAvIGRldmljZSBjb21wb25lbnRzIChha2EgYWN0b3IgLyBz dWItYWN0b3JzKSB0aGVyZSB3aWxsIGFsc28gYmUgc3VwcGx5IGNoYWluIGVudGl0aWVzIChhY3Rv cnMpIHBlcmZvcm1pbmcgdGhlIEFzc2VydGVyIHJvbGUgd2hvIHN1cHBseSBBc3NlcnRpb25zIG91 dC1vZi1iYW5kKD8pIHRvIHRoZSBWZXJpZmllciAoYW5kIG1heWJlIFJlbHlpbmcgUGFydHkpLiBB c3NlcnRpb25zIGFyZSB1c2VkIHRvIGNvbXBhcmUgLyBldmFsdWF0ZSBBdHRlc3RlciBzaWduZWQg RXZpZGVuY2UgYXMgd2VsbCBhcyBjbGFpbXMgbWFkZSBieSBBc3NlcnRlcnMuIFRvIGJlIHByZWNp c2UsIHRoZSBzdWItYWN0b3IgdGhhdCB1c2VzIHRoZSBhdHRlc3RhdGlvbiBrZXkgaW1wbGVtZW50 cyB0aGUgQXR0ZXN0ZXIgcm9sZSBhbmQgdGhlIHN1Yi1hY3RvciB0aGF0IHByb3RlY3RzIHRoZSBh dHRlc3RhdGlvbiBrZXkgaXMgd2hhdCB0aGUgYXJjaCBkcmFmdCBjYWxscyDigJhyb290IG9mIHRy dXN04oCZLiBUaGUgQXNzZXJ0aW9ucyBmcm9tIEFzc2VydGVycyBjb250YWluIGNsYWltcyBhYm91 dCB0aGUg4oCYcm9vdCBvZiB0cnVzdOKAmSBzdWItYWN0b3Igd2hpbGUgY2xhaW1zIGZyb20gdGhl IG90aGVyIHN1Yi1hY3RvciBhcmUgRXZpZGVuY2UuDQoNCg0KU2luY2UgdGhlIFJBVFMgV0cgc2Nv cGUgZG9lc24ndCBhbnRpY2lwYXRlIHdhbnRpbmcgLyBuZWVkaW5nIHRvIGRlZmluZSBzcGVjaWZp YyB0dXJ0bGVzLCB3b3JraW5nIGdyb3VwIHBhcnRpY2lwYW50cyBzaG91bGQgaGF2ZSBzb21ldGhp bmcgaW4gbWluZCBpbiB0ZXJtcyBhIHR1cnRsZSB0aGF0IGlzIGEgcm9vdCBvZiB0cnVzdCBhbmQg YSB0dXJ0bGUgdGhhdCBpcyBhdHRlc3RhYmxlLiBUaGV5IGNhbiBmb3J3YXJkIGNsYWltcyBhYm91 dCB0aGUgYXR0ZXN0YWJsZSB0dXJ0bGUgYW5kIGFncmVlIHRoYXQgdGhlIHJvb3Qgb2YgdHJ1c3Qg dHVydGxlIGNhbiBiZSBpZGVudGlmaWVkIChlLmcuIHZlbmRvciwgbW9kZWwsIHZlcnNpb24gLSBh bmQgc29tZSB3YXkgdG8gYXV0aGVudGljYXRlIHRoZXNlIHZhbHVlcykgYnV0IGl0IGlzIHVwIHRv IHRoZSB2ZXJpZmllciB0byBoYXZlIGEgcG9saWN5IGZvciB3aGF0IGl0IGFjY2VwdHMgYXMgaXRz IHJvb3Qtb2YtdHJ1c3QgdHVydGxlcy4gVGhlIFJvVCB0dXJ0bGUgaXMgdGhlIHN0YXJ0aW5nIHBv aW50IGZvciBldmFsdWF0aW5nIHRoZSB0dXJ0bGVzIHRoYXQgY2FuIGJlIGF0dGVzdGVkLg0KDQpG b3IgVFBNcyBhbmQgdGhlIFRDRyBJIHRoaW5rIHRoZXJlIG1heSBiZSBhIG5vbi10dXJ0bGUgb3V0 LW9mLWJhbmQgaW50ZXJhY3Rpb24gdGhhdCBpcyB0YWNpdGx5IGFzc3VtZWQgYW5kIGJha2VkIGlu dG8gInJvb3Qgb2YgdHJ1c3TigJ0uLiBUaGUgVENHIHNoYXJwbHkgZGVmaW5lcyB0aGUgZnVuY3Rp b25hbGl0eSBhbmQgc2VjdXJpdHkgb2YgdGhlIFRQTS4gVFBNIHZlbmRvcnMgYWxsIHByZWNpc2Vs eSBhZGhlcmUgdG8gdGhpcy4gVGhlcmUgaXMgYWxzbyBhIHN0cm9uZyBIVy1vcmllbnRlZCBDb21t b24gQ3JpdGVyaWEgY2VydGlmaWNhdGlvbiBwcm9ncmFtLiBJIHRoaW5rIHRoZXJlIGFyZSBhbHNv IGNvbnZlbnRpb25zIGZvciBrZXkgZGlzdHJpYnV0aW9uIHRoZSBUUE0gd29ybGQuIEEgVFBNIHZl bmRvciBkaXZlcmdpbmcgZnJvbSB0aGlzIHdvdWxkbuKAmXQgc2VsbCBhbnkgcHJvZHVjdCBzbyBh bGwgb2YgdGhpcyBpcyBldmVyLXByZXNlbnQgYW5kIHVuaWZvcm0uIChJ4oCZbSBub3QgYSBUUE0g ZXhwZXJ0LCBzbyBob3BlZnVsbHkgSSBoYXZlIGdvdCB0aGlzIHJpZ2h0KS4NCltubXNdIFRoZSBU Q0cgZG9lcyBkZWZpbmUgYSBjb21tb24gY3JpdGVyaWEgcHJvY2Vzcy4gSG93ZXZlciwgbm90IGFs bCBpbXBsZW1lbnRhdGlvbnMgb2YgYSBUUE0gcmVjZWl2ZSBjZXJ0aWZpY2F0aW9ucyBvciBicmFu ZGluZy4gVGhlcmUgYXJlIG9wZW4gc291cmNlIHNvZnR3YXJlIGltcGxlbWVudGF0aW9ucyBvZiBU UE0gZnVuY3Rpb25hbGl0eSB0aGF0IGNvdWxkIGJlIHVzZWQgdG8gcGVyZm9ybSBhbiBhdHRlc3Rh dGlvbiBwcm90b2NvbC4gVENHIGF0dGVzdGF0aW9uIHZlcmlmaWVycyBzaG91bGRu4oCZdCBhc3N1 bWUgdGhlIGF0dGVzdGF0aW9uIGlzIGJlbGlldmFibGUgc2ltcGx5IGJlY2F1c2UgdGhlIGF0dGVz dGF0aW9uIHByb3RvY29sIHdhcyBmb2xsb3dlZC4NCg0KVGhlIFRDRyBhdHRlc3RhdGlvbiBtZWNo YW5pc20gZG9lcyBkZWZpbmUgYSBjb21tb24gY3JpdGVyaWEgY2xhaW0uIE5vcm1hbGx5LCB0aGlz IGNsYWltIGlzIGFzc2VydGVkIGJ5IGEgVFBNIG1hbnVmYWN0dXJlciAoZS5nLiB0aGUgdmVuZG9y 4oCZcyBrZXkgc2lnbnMgaXQpIG5vdCBhIFRQTSBhdHRlc3RhdGlvbiBrZXkuDQoNClNlZW1zIGxp a2UgdGhlIEdQIC8gVEVFIHdvcmxkIGhhcyBzb21lIG9mIHRoaXMgdG9vLCB0aG91Z2ggbm90IGFz IG11Y2guDQoNCkkgYW0gYWltaW5nIGZvciBSQVRTIGFwcGxpY2FibGUgaW4gYSBicm9hZGVyIHdh eSB3aXRoIG5vIHRpZSB0byBpbXBsZW1lbnRhdGlvbiBzZWN1cml0eS4gVGhlIHNhbWUgc29ydCBv ZiBicm9hZG5lc3MgdGhhdCBUTFMgaGFzLg0KDQpMTA0KDQo= --_000_02C008167EE8403FB0A89A92174B7D7Dintelcom_ Content-Type: text/html; charset="utf-8" Content-ID: <85980DDAF7152F4B9A0648C8D2CDF0C9@intel.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZp c2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5 Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAubXNvbm9y bWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6bXNv bm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47DQoJ bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQtc2l6 ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5FbWFp bFN0eWxlMTgNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6 IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVmYXVs dA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBw YWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4w aW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9 DQovKiBMaXN0IERlZmluaXRpb25zICovDQpAbGlzdCBsMA0KCXttc28tbGlzdC1pZDoyNDA1MjYx NTk7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOi0yMDU1NTkwNzAwO30NCkBsaXN0IGwwOmxldmVs MQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3 Ow0KCW1zby1sZXZlbC10YWItc3RvcDouNWluOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47DQoJbXNvLWFuc2ktZm9udC1zaXplOjEwLjBwdDsN Cglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1i ZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3Rv cDoxLjBpbjsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LS4yNWluOw0KCW1zby1hbnNpLWZvbnQtc2l6ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJp ZXIgTmV3IjsNCgltc28tYmlkaS1mb250LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIjt9DQpAbGlz dCBsMDpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZl bC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MS41aW47DQoJbXNvLWxldmVsLW51bWJl ci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNp emU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDQNCgl7 bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCglt c28tbGV2ZWwtdGFiLXN0b3A6Mi4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0 Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZv bnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDUNCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6Mi41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50 Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5Oldpbmdk aW5nczt9DQpAbGlzdCBsMDpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0 Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6My4waW47DQoJbXNv LWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28t YW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBs MDpsZXZlbDcNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10 ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6My41aW47DQoJbXNvLWxldmVsLW51bWJlci1w b3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6 MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDgNCgl7bXNv LWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28t bGV2ZWwtdGFiLXN0b3A6NC4waW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0uMjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQt ZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1m b3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 NC41aW47DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0u MjVpbjsNCgltc28tYW5zaS1mb250LXNpemU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5n czt9DQpvbA0KCXttYXJnaW4tYm90dG9tOjBpbjt9DQp1bA0KCXttYXJnaW4tYm90dG9tOjBpbjt9 DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2 OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYg Z3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAg djpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZd LS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBs ZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U2Vl IG15IGNvbW1lbnRzIGlubGluZSBbbm1zXS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+T24gOC85LzE5LCA5OjQxIEFNLCAmcXVv dDtSQVRTIG9uIGJlaGFsZiBvZiBMYXVyZW5jZSBMdW5kYmxhZGUmcXVvdDsgJmx0OzxhIGhyZWY9 Im1haWx0bzpyYXRzLWJvdW5jZXNAaWV0Zi5vcmciPnJhdHMtYm91bmNlc0BpZXRmLm9yZzwvYT4g b24gYmVoYWxmIG9mDQo8YSBocmVmPSJtYWlsdG86bGdsQGlzbGFuZC1yZXNvcnQuY29tIj5sZ2xA aXNsYW5kLXJlc29ydC5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+SGkgTmVkLDxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48YnI+DQo8YnI+DQo8 bzpwPjwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdp bi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDouNWluIj5PbiBBdWcgNiwgMjAxOSwgYXQgMTI6MDEgUE0sIFNtaXRoLCBOZWQgJmx0 OzxhIGhyZWY9Im1haWx0bzpuZWQuc21pdGhAaW50ZWwuY29tIj5uZWQuc21pdGhAaW50ZWwuY29t PC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPlRo ZSBpbnRlbnQgb2YgbXkgcHJldmlvdXMgcmVwbHkgd2FzIHRvIGhhdmUgYSBzY29waW5nIGRpc2N1 c3Npb24uIFRoZSBSQVRTIFdHIGxpa2VseSBkb2Vzbid0IGhhdmUgcmVzb3VyY2VzIC8gaW50ZXJl c3QgLyBjaGFydGVyIHRvIGRlZmluZSBkcmFmdHMgZm9yIGV2ZXJ5IHRvcGljIHJlbGV2YW50IHRv IHJlbW90ZSBhdHRlc3RhdGlvbi4gTmV2ZXJ0aGVsZXNzLCB3ZQ0KIGNhbiBpZGVudGlmeSB0aGUg dG9waWNzIHdlIGNob3NlIG5vdCB0byBkZWZpbmUgYW5kIGxhYmVsIHRoZW0gc28gdGhhdCB3ZSBo YXZlIGEgdm9jYWJ1bGFyeSB0byB0YWxrIGFib3V0IHRoZW0gKHdpdGhvdXQgY3JlYXRpbmcgZHJh ZnRzIHRoYXQgZGVmaW5lcyB0aGVtKS4NCjxicj4NCjxicj4NCkxhdXJlbmNlJ3Mgb3JpZ2luYWwg cG9pbnQgd2FzIHRoYXQgUm9UIHdhcyBzb21ldGhpbmcgdGhlIFdHIHNob3VsZG4ndCBkZWZpbmUg KGluIGEgZHJhZnQpIHRvIHdoaWNoIEkgY29uY3VyLiBOZXZlcnRoZWxlc3MsIHRoZXJlIGlzIGEg bmVlZCB0byB0YWxrIGFib3V0IHRoZSBwYXJ0IG9mIHRoZSBkZXZpY2UgKGVudGl0eSkgd2hlcmUg ZGV0ZWN0aW9uIG9mIG1pc2JlaGF2aW9yIGlzIG5vdCBwb3NzaWJsZS4gVGhpcyBwYXJ0IGNhbid0 IGJlIGF0dGVzdGVkDQogKGJ5IGRlZmluaXRpb24pLiBJZiB3ZSBkb24ndCBsaWtlIHRoZSB0ZXJt IHJvb3Qgb2YgdHJ1c3QgdGhlbiB3ZSBjYW4gaW52ZW50IHNvbWV0aGluZyBlbHNlLiBJZiB3ZSBn byB3aXRoIHNvbWV0aGluZyBsaWtlICZxdW90O3RoZS1lbnRpdHktd2hvc2UtbWlzYmVoYXZpb3It Y2Fubm90LWJlLWRldGVjdGVkJnF1b3Q7LCB0aGF0IGlzIGxvbmdpc2ggdG8gdHlwZS4gSWYgd2Ug Z28gd2l0aCByb290LW9mLXRydXN0IHRoZW4gaXQgaXMgc29tZXRoaW5nIG1vc3Qgb2YgdGhlDQog cmVzdCBvZiB0aGUgaW5kdXN0cnkgdW5kZXJzdGFuZHMgaXMgc29tZXRoaW5nIHdob3NlIG1pc2Jl aGF2aW9yIGNhbid0IGJlIGRldGVjdGVkLCB0aG91Z2ggdGhlcmUgbWF5IGJlIGFkZGl0aW9uYWwg Y29ubm90YXRpb25zLiBSQVRTIFdHIGhhcyB0aGUgb3B0aW9uIG9mIGluY2x1ZGluZyBhIHRlcm1p bm9sb2d5IHNlY3Rpb24gdGhhdCBjbGFyaWZpZXMgZm9yIHRoZSByZWFkZXIgb2YgUkFUUyBkcmFm dHMgd2hhdCBwcm9wZXJ0aWVzIG9mIHRoZSB0ZXJtcw0KIHdlIHVzZSBhcmUgbW9zdCByZWxldmFu dC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW4iPk15IG9yaWdpbmFsIHBvaW50IGlzIHRoYXQgUkFUUyBzaG91bGQgbm90 IHB1dCBhbnkgcmVxdWlyZW1lbnRzIG9uIGltcGxlbWVudGF0aW9uLjxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+W25tc10gSSBpbmZlciB5b3UgbWVhbiBSQVRTIHNob3VsZCBu b3QgcHV0IGFueSA8c3BhbiBzdHlsZT0iYmFja2dyb3VuZDp5ZWxsb3c7bXNvLWhpZ2hsaWdodDp5 ZWxsb3ciPg0KdHJ1c3Q8L3NwYW4+IHJlcXVpcmVtZW50cyBvbiBpbXBsZW1lbnRhdGlvbj8gPG86 cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5bbm1zXSBUaGUgY2hhcnRlciB0ZXh0 IGlzIGNhcmVmdWwgdG8gdXNlIHRoZSBwaHJhc2Ug4oCYdHJ1c3R3b3J0aGluZXNz4oCZIHJhdGhl ciB0aGFuIOKAmHRydXN04oCZLiBUaGUgYXJjaGl0ZWN0dXJlIGRyYWZ0IHRyaWVzIHRvIGF2b2lk IHVzaW5nIOKAmHRydXN04oCZIGFuZCDigJh0cnVzdGVk4oCZLiBUaGUgbW90aXZhdGlvbiBmb3Ig dXNpbmcg4oCYdHJ1c3R3b3J0aGluZXNz4oCZIGFuZCDigJh0cnVzdHdvcnRoaW5lc3MgcHJvcGVy dGllc+KAmSBpcw0KIHRvIGZvY3VzIGVuZXJneSBvbiBpZGVudGlmeWluZyB0aGluZ3MgKGNsYWlt cykgdGhhdCBjYW4gYmUgY29uY3JldGVseSBleHByZXNzZWQgKGFzIGRhdGEgc3RydWN0dXJlcykg YW5kIGFzIHN0YXRlbWVudHMgdGhhdCBhcmUgb2J2aW91cyBhbmQgZmFjdHVhbC4gVGhlIHdvcmQg 4oCYdHJ1c3TigJkgdGVuZHMgdG8gZXZva2UgaWRlYXMgdGhhdCBzZWVtIHRvIGJlIHN1YmplY3Rp dmUgb3Igb3BlbiB0byBpbnRlcnByZXRhdGlvbi4gVGhvbWFzIEhhcmRqb25vDQogbWVudGlvbmVk IGluIGEgcHJldmlvdXMgdGhyZWFkIHRoZSBkaWZmZXJlbmNlcyBiZXR3ZWVuIHNvY2lhbCBhbmQg dGVjaG5pY2FsIHRydXN0LiBJIHJlY29tbWVuZCByZXZpZXcgb2YNCjxhIGhyZWY9Imh0dHBzOi8v d3d3LnczLm9yZy8yMDE2LzA0L2Jsb2NrY2hhaW4td29ya3Nob3Avc2xpZGVzL0hhcmRqb25vLVBl bnRsYW5kLVczQy1KdW5lMjAxNi5wZGYiPg0KaHR0cHM6Ly93d3cudzMub3JnLzIwMTYvMDQvYmxv Y2tjaGFpbi13b3Jrc2hvcC9zbGlkZXMvSGFyZGpvbm8tUGVudGxhbmQtVzNDLUp1bmUyMDE2LnBk ZjwvYT4gdG8gYW55b25lIGludGVyZXN0ZWQgaW4gZGlnZ2luZyBkZWVwZXIuIFRoZSB3b3JkIOKA mHRydXN04oCZIG1heSBldm9rZSBpZGVhcyB0aGF0IGFyZSBtb3JlIGNvcnJlbGF0ZWQgd2l0aCDi gJhzb2NpYWwgdHJ1c3TigJkgd2hpbGUgdGhlIFJBVFMgY2hhcnRlciBhbmQgb3RoZXIgZG9jdW1l bnRzIGFyZQ0KIHRyeWluZyB0byBmb2N1cyBvbiDigJh0ZWNobmljYWwgdHJ1c3TigJkuIDxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO3RleHQtaW5kZW50Oi0uMjVpbjtt c28tbGlzdDpsMCBsZXZlbDEgbGZvMSI+DQo8IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBzdHls ZT0iZm9udC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpTeW1ib2wiPjxzcGFuIHN0eWxlPSJtc28t bGlzdDpJZ25vcmUiPsK3PHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3IFJv bWFuJnF1b3Q7Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsNCjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT5JZiBhIHJvb3Qgb2YgdHJ1c3QgaXMg cmVxdWlyZWQsIHRoYXQgd2lsbCBpbXBseSBIVyBzZWN1cml0eSByZXF1aXJlbWVudHMgb24gdGhl IGltcGxlbWVudGF0aW9uIGZvciBtb3N0IHBlb3BsZTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO3RleHQtaW5kZW50Oi0uMjVpbjttc28tbGlz dDpsMCBsZXZlbDEgbGZvMSI+DQo8IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjEwLjBwdDtmb250LWZhbWlseTpTeW1ib2wiPjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJ Z25vcmUiPsK3PHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1 b3Q7Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsNCjwv c3Bhbj48L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT5JZiB3ZSByZWRlZmluZSByb290IG9mIHRydXN0 IHNvIHRoYXQgaXQgZG9lc27igJl0IGltcGx5IGFueSByZXF1aXJlbWVudHMgb24gdGhlIGltcGxl bWVudGF0aW9uLCB3ZSB3aWxsIGNvbmZ1c2U8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0bzttYXJnaW4tbGVmdDoxLjBpbjt0ZXh0LWluZGVudDotLjI1aW47bXNvLWxpc3Q6bDAg bGV2ZWwxIGxmbzEiPg0KPCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMC4wcHQ7Zm9udC1mYW1pbHk6U3ltYm9sIj48c3BhbiBzdHlsZT0ibXNvLWxpc3Q6SWdub3Jl Ij7CtzxzcGFuIHN0eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+ Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+ PC9zcGFuPjwvc3Bhbj48IVtlbmRpZl0+V2UgTVVTVCBhbGxvdyBnZW5lcmF0aW9uIG9mIGF0dGVz dGF0aW9ucyBmcm9tIHN1YnN5c3RlbXMgb3RoZXIgdGhhbiB0aGUtZW50aXR5LXdob3NlLW1pc2Jl aGF2aW9yLWNhbm5vdC1iZS1kZXRlY3RlZDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFs dDphdXRvO21hcmdpbi1sZWZ0OjEuMGluO3RleHQtaW5kZW50Oi0uMjVpbjttc28tbGlzdDpsMCBs ZXZlbDEgbGZvMSI+DQo8IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBzdHlsZT0iZm9udC1zaXpl OjEwLjBwdDtmb250LWZhbWlseTpTeW1ib2wiPjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJZ25vcmUi PsK3PHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij4m bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsNCjwvc3Bhbj48 L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT5JbXBsZW1lbnRhdGlvbiByZXF1aXJlbWVudHMgd291bGQg YmUgYSBsYXJnZSBkaXZlcmdlbmNlIGZyb20gbW9zdCBvdGhlciBJRVRGLWRlZmluZWQgcHJvdG9j b2xzIGxpa2UgVExTIGFuZCBDT1NFPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPk1heWJlIHdlIGNhbiBqdXN0IGNhbGwgaXQgdGhlIOKAnGF0dGVzdGVy4oCdIGFuZCBzYXkg dGhhdCBpdCBpcyBbMl08c3BhbiBzdHlsZT0iYmFja2dyb3VuZDp5ZWxsb3c7bXNvLWhpZ2hsaWdo dDp5ZWxsb3ciPnRoZSB0aGluZyB0aGF0IGhhcyB0aGUgYXR0ZXN0YXRpb24gc2lnbmluZyBrZXk8 L3NwYW4+IGFuZCBnZW5lcmF0ZXMgdGhlIGF0dGVzdGF0aW9uLiBTYXkgdGhhdCBpbg0KIG1hbnkg Y2FzZXMsIHBhcnRpY3VsYXJseSB0aG9zZSBbM108c3BhbiBzdHlsZT0iYmFja2dyb3VuZDp5ZWxs b3c7bXNvLWhpZ2hsaWdodDp5ZWxsb3ciPndpdGggYmV0dGVyIHNlY3VyaXR5LCB0aGUgYXR0ZXN0 ZXIgd2lsbCBiZSB3aGF0IGlzIHRyYWRpdGlvbmFsbHkga25vd24gYXMgYSDigJxyb290IG9mIHRy dXN04oCdLiBTb21lIGltcGxlbWVudGF0aW9uIHByb2ZpbGVzIHdpbGwgcmVxdWlyZSBhIHJvb3Qg b2YgdHJ1c3QuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+W25t c10gWzFdIFRoZSBSQVRTIGFyY2hpdGVjdHVyZSAoaXMgdHJ5aW5nIHRvKSBkZWZpbmUgYXR0ZXN0 YXRpb24gcm9sZXMgc3VjaCBhcyBBdHRlc3RlciwgVmVyaWZpZXIgZXRjLi4gYW5kIGFjdG9ycyBz dWNoIGFzIERldmljZSwgU3VwcGx5IENoYWluIEVudGl0eSwgU2VydmljZSBQcm92aWRlciBldGPi gKYgUmVmZXJyaW5nIHRvIFsyXSDigJx0aGluZ+KAnSBpcyBzdGVyZW90eXBlZCBhcyBhIOKAmGRl dmljZeKAmSBhY3RvciBpbg0KIHRoZSBhcmNoaXRlY3R1cmUgZHJhZnQgc28gdGhhdCBwZXJmb3Jt YW5jZSBvZiB0aGUgQXR0ZXN0ZXIgcm9sZSBkb2VzbuKAmXQgY2Fycnkgd2l0aCBpdCBhbnkgYmFn Z2FnZSBvciBhc3N1bXB0aW9ucyBhYm91dCBhY3RvciAoYWthIGRldmljZSkgY29tcG9zaXRpb24g b3IgdHJ1c3QuIFRoZSBBdHRlc3RlciByb2xlIGRvZXMgc2VlbSB0byBoYXZlIHNvbWUgc2VtYW50 aWNzIHJlZ2FyZGluZyB3aGF0IGl0IGNhbiBzYXkgKGNsYWltKSB2cy4gd2hhdCBzaG91bGQNCiBi ZSBjbGFpbWVkIGJ5IGFuIEFzc2VydGVyIChha2EgQ2xhaW1hbnQpLiBJbiBvdGhlciB3b3Jkcywg c2VsZi1hc3NlcnRpb24gKGUuZy4g4oCcSeKAmW0gdHJ1c3R3b3J0aHkgYmVjYXVzZSBJIHNhaWQg c2/igJ0pIGRvZXNu4oCZdCBzZWVtIHJlYXNvbmFibGUgKGxvZ2ljYWwpLiBUaGUgYXJjaGl0ZWN0 dXJlIGRyYWZ0IHVzZXMgdGhlIHRlcm0g4oCYcm9vdCBvZiB0cnVzdOKAmSB0byBkZXNjcmliZSBh IGRlY29tcG9zaXRpb24gb2YgdGhlIGRldmljZSAoYWN0b3IpIGludG8NCiBtb3JlIHByaW1pdGl2 ZSBkZXZpY2UgY29tcG9uZW50cyAoc3ViLWFjdG9ycz8pIHNvIHRoYXQgaXQgaXMgcG9zc2libGUg Zm9yIHRoZSBBdHRlc3RlciB0byBhdm9pZCBiZWNvbWluZyBhIHNlbGYtYXNzZXJ0ZXIuDQo8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+U3BlY2lmaWMgdG8geW91ciBzdGF0ZW1lbnQgYWJvdmUgaW4g WzNdLiBUaGUgQXR0ZXN0ZXIgY2FuIG1ha2UgbG90cyBvZiBjbGFpbXMgbGVnaXRpbWF0ZWx5IGFu ZCBzaWduIHRoZW0gdXNpbmcgaXRzIGF0dGVzdGF0aW9uIGtleS4gSG93ZXZlciwgaXQgY2Fu4oCZ dCBtYWtlIGNsYWltcyBhYm91dCB0aGUgc2lnbmluZyBrZXkgYmVjYXVzZSB0aGUga2V5IGl0c2Vs ZiBpcyBzcGVha2luZyAoYXR0ZXN0aW5nKS4gU29tZQ0KIG90aGVyIGVudGl0eSAoYWN0b3IpIG5l ZWRzIHRvIGFzc2VydCBjbGFpbXMgYWJvdXQgdGhlIHRydXN0d29ydGhpbmVzcyBwcm9wZXJ0aWVz IG9mIHRoZSBBdHRlc3RlcuKAmXMga2V5LiBNYXliZSBpdCBpcyBhIHNlY29uZCBBdHRlc3RlciBv ciBtYXliZSBpdCBpcyBhbiBBc3NlcnRlci4gSWYgdGhlIEFzc2VydGVyIGlzIGEgc3VwcGx5IGNo YWluIGVudGl0eSB0aGF0IG1hbnVmYWN0dXJlZCB0aGUga2V5IHNvIHRoYXQgaXQgcmVzaXN0cyBj ZXJ0YWluDQogYXR0YWNrcyB0aGVuIHRoZSBzdXBwbHkgY2hhaW4gZW50aXR5IHNob3VsZCBzYXkg dGhhdC4gSWYgdGhlIEF0dGVzdGVyIHRyaWVzIHRvIHNheSB0aGUgc2FtZSB0aGluZyBhYm91dCBp dHMga2V5LCB0aGUgVmVyaWZpZXIgc2hvdWxkIGJlIHN1c3BpY2lvdXMuIEhvdyBjYW4gYSBrZXkg YmUgY29nbml6YW50IG9mIHRoZSBtYW51ZmFjdHVyaW5nIHByb2Nlc3MgdGhhdCBjcmVhdGVkIGl0 PzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5NYXliZSBkaWZmZXJlbnQgdGVybWlub2xvZ3kgYmVz aWRlcyByb290IG9mIHRydXN0IHdpbGwgYmUgaGVscGZ1bD8NCjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5OZXZlcnRoZWxlc3MsIHRoZSBhcmNoaXRlY3R1cmUgYW5kIG90aGVyIGRyYWZ0cyBzaG91 bGQgYmUgY2FyZWZ1bCBub3QgdG8gZGVzY3JpYmUgdGhpbmdzIHRoYXQgYXJlIGluc2VjdXJlIChp bGxvZ2ljYWw/KSBieSBkZXNpZ24uIFVsdGltYXRlbHksIHRoZSBkZWdyZWUgKHN0cmVuZ3RoLW9m LWZ1bmN0aW9uKSB0byB3aGljaCBhbiBhY3RvciBpcyB3b3J0aHkgb2YgYmVpbmcgY29uc2lkZXJl ZCB0cnVzdGVkIGlzDQogc29tZWhvdyBlbWJvZGllZCBpbiB0aGUgcG9saWNpZXMgYWZmZWN0aW5n IGVpdGhlciBWZXJpZmllciBvciBSZWx5aW5nIFBhcnR5IHJlc3BvbnNlcyB0byBhdHRlc3RhdGlv biByZXN1bHRzLiBUaGUgaW50ZW50IG9mIHRoZSBhcmNoaXRlY3R1cmUgZHJhZnQgaXMgdGhhdCB0 aGUgQXR0ZXN0ZXIgcm9sZSBkb2VzbuKAmXQgaW1wbHkgYW55IHBhcnRpY3VsYXIgc3RyZW5ndGgt b2YtZnVuY3Rpb24gdG8gYmUgY29uc2lkZXJlZCBhbiBBdHRlc3Rlci4gSXQNCiBhbHNvIGlzbuKA mXQgdHJ5aW5nIHRvIGltcGx5IHRoYXQgdGhlcmUgaXMgbm8gc3VjaCB0aGluZyBhcyBzdHJlbmd0 aC1vZi1mdW5jdGlvbiAob3Igd2hhdGV2ZXIgd29yZHMgd2UgdXNlIHRvIGNhcHR1cmUgdGhlIGlk ZWEgb2YgbGV2ZWwgb2YgaW1wbGVtZW50YXRpb24gaGFyZGVuaW5nIGFuZC9vciByZXNpc3RhbmNl IHRvIGF0dGFjaykuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUg c3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48YnI+DQpM b29raW5nIGF0IHRoaXMgdG9waWMgZnJvbSB0aGUgcGVyc3BlY3RpdmUgb2Ygd2hhdCBjYW4gYmUg YXR0ZXN0ZWQsIGl0IHN1Z2dlc3RzIHRoYXQgdGhlIGNsYWltcyBhdHRlc3RlZCBzaG91bGQgYmUg cHJvcGVydGllcyB3aGVyZSBtaXNiZWhhdmlvciBjYW4gYmUgZGV0ZWN0ZWQuIEZvciBleGFtcGxl LCBhIGhhc2ggb2YgZmlybXdhcmUgQSB3aWxsIG5vdCBkZXNjcmliZSBmaXJtd2FyZSBCIGFzIGxv bmcgYXMgdGhlIGhhc2hpbmcgd2FzIHBlcmZvcm1lZA0KIGNvcnJlY3RseS4gSXQgbWF5IG5vdCBi ZSBwb3NzaWJsZSB0byBkZXRlY3QgaWYgdGhlIGhhc2ggb2YgQSB3YXMgcGVyZm9ybWVkIGNvcnJl Y3RseSAoc2luY2UgYW4gYXR0YWNrZXIgY291bGQgaGF2ZSBpbnB1dCBCIGFuZCBzYWlkIHRoZSBv dXRwdXQgd2FzIEEpIHRoZXJlZm9yZSB0aGF0IGJlbG9uZ3MgaW4gdGhlIFJvVC4NCjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 LjVpbiI+VGhlIHJlYWwgYmFzaXMgZm9yIGF0dGVzdGF0aW9uIHRydXN0IGlzIGFjdHVhbGx5IG91 dC1vZi1iYW5kIHRydXN0IGVzdGFibGlzaG1lbnQgYmV0d2VlbiB0aGUgcmVseWluZyBwYXJ0eSBh bmQgbWFudWZhY3R1cmVyIG9yIHN1Y2ggYXMgSeKAmXZlIHRyaWVkIHRvIGlsbHVzdHJhdGUgaW4g bXkgcmVjZW50IGh5cG90aGV0aWNhbCBleGFtcGxlLiAmbmJzcDtJdCBzZWVtcyB0byBtZQ0KIHRo YXQgdGhlIHJlYWwgdHJ1c3QgaW4gVExTIGlzIGVzdGFibGlzaGVkIG91dCBvZiBiYW5kIHRocm91 Z2ggdGhlIGRvd25sb2FkIG9mIGEgd2ViIGJyb3dzZXIgY29udGFpbmluZyByb290cyBieSB0aGUg ZW5kIHVzZXIuIFRoaXMgaXMgc2ltaWxhci4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+W25tc10gVXNpbmcgdGhlIHJvbGVzIHRl cm1pbm9sb2d5IGFyY2hpdGVjdHVyZSBkcmFmdCB5b3UgYXBwZWFyIHRvIGJlIHNheWluZyB0aGUg Zm9sbG93aW5nOjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+4oCcVGhlIGJh c2lzIGZvciBiZWxpZXZpbmcgZXZpZGVuY2UgZnJvbSB0aGUgQXR0ZXN0ZXIgKGJ5IHRoZSBWZXJp ZmllciBvciBSZWx5aW5nIFBhcnR5KSBpcyBhY3R1YWxseSB0aWVkIHRvIGFuIG91dC1vZi1iYW5k IGZsb3cgb2YgQXNzZXJ0aW9ucyBmcm9tIG9uZSBvciBtb3JlIEFzc2VydGVycy7igJ08bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoaXMgbWFrZXMgc2Vuc2UgYW5kIHJlc29u YXRlcyB3aXRoIHdoYXQgaXMgZGVwaWN0ZWQgaW4gdGhlIGFyY2hpdGVjdHVyZSBkaWFncmFtcyBh bmQgaW4gdGhlIGFyY2hpdGVjdHVyZSBkcmFmdC4gJm5ic3A7RGVmaW5pdGlvbiBvZiBmbG93cyB0 byBhbmQgZnJvbSB0aGUgQXNzZXJ0ZXIgKGNsYWltYW50KSBhcmUgY3VycmVudGx5IG91dCBvZiBz Y29wZSBmb3IgdGhlIFdHIGJ1dCB3aWxsIGJlIGRlc2NyaWJlZCBpbiB0aGUNCiBhcmNoaXRlY3R1 cmUgZHJhZnQuIFlvdXIgcG9pbnQgc2VlbXMgdG8gYmUgdGhhdCBWZXJpZmllciAvIFJlbHlpbmcg UGFydHkgZGVwZW5kcyBvbiB0aGlzIG91dC1vZi1iYW5kIGZsb3cgaW4gb3JkZXIgdG8gYXJyaXZl IGF0IGFueSBzb3J0IG9mIG1lYW5pbmdmdWwgY29uY2x1c2lvbiBhYm91dCB0cnVzdHdvcnRoaW5l c3Mgb2YgZXZpZGVuY2UuIFRvIHdoaWNoIEkgZnVsbHkgYWdyZWUuDQo8bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48YnI+DQo8YnI+ DQo8bzpwPjwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21h cmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PGJyPg0KSXQgaXMgYSBzZWN1cml0eSBmYXV4IHBhcyB0 byBleHBlY3QgdGhlIGVudmlyb25tZW50IHJlcG9ydGluZyBhdHRlc3RlZCB2YWx1ZXMgY2FuIGF0 dGVzdCB0byBpdHMgb3duIHNlY3VyaXR5IHByb3BlcnRpZXMuIFRoZXJlIG5lZWRzIHRvIGJlIGZp bmVyIGdyYW51bGFyaXR5IGRlY29tcG9zaXRpb24gdG8gc2VwYXJhdGUgd2hhdCBpcyB0aGUgUm9U IGZ1bmN0aW9uYWxpdHkgZnJvbSB0aGUgYXR0ZXN0YWJsZSBmdW5jdGlvbmFsaXR5LiBIZW5jZSwg dGhlDQogdGVybSAndHVydGxlcyBhbGwgdGhlIHdheSBkb3du4oCZLjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+VGhl cmUgaXMgYSBub24tdHVydGxlIGluIHRoZSBvdXQtb2YtYmFuZCBpbnRlcmFjdGlvbi4mbmJzcDs8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPltubXNd IFRoZSBzZWN1cml0eSBmYXV4IHBhcyBpcyByZWZlcnJpbmcgdG8gWzFdIGluIHRoaXMgZW1haWwu IOKAmFR1cnRsZXPigJkgcmVmZXJzIHRvIOKAmHN1Yi1hY3RvcnPigJkgaW4gWzFdLiBZZXMsIGlu IGFkZGl0aW9uIHRvIHRoZSBkZXZpY2UgLyBkZXZpY2UgY29tcG9uZW50cyAoYWthIGFjdG9yIC8g c3ViLWFjdG9ycykgdGhlcmUgd2lsbCBhbHNvIGJlIHN1cHBseSBjaGFpbiBlbnRpdGllcyAoYWN0 b3JzKSBwZXJmb3JtaW5nDQogdGhlIEFzc2VydGVyIHJvbGUgd2hvIHN1cHBseSBBc3NlcnRpb25z IG91dC1vZi1iYW5kKD8pIHRvIHRoZSBWZXJpZmllciAoYW5kIG1heWJlIFJlbHlpbmcgUGFydHkp LiBBc3NlcnRpb25zIGFyZSB1c2VkIHRvIGNvbXBhcmUgLyBldmFsdWF0ZSBBdHRlc3RlciBzaWdu ZWQgRXZpZGVuY2UgYXMgd2VsbCBhcyBjbGFpbXMgbWFkZSBieSBBc3NlcnRlcnMuIFRvIGJlIHBy ZWNpc2UsIHRoZSBzdWItYWN0b3IgdGhhdCB1c2VzIHRoZSBhdHRlc3RhdGlvbg0KIGtleSBpbXBs ZW1lbnRzIHRoZSBBdHRlc3RlciByb2xlIGFuZCB0aGUgc3ViLWFjdG9yIHRoYXQgcHJvdGVjdHMg dGhlIGF0dGVzdGF0aW9uIGtleSBpcyB3aGF0IHRoZSBhcmNoIGRyYWZ0IGNhbGxzIOKAmHJvb3Qg b2YgdHJ1c3TigJkuIFRoZSBBc3NlcnRpb25zIGZyb20gQXNzZXJ0ZXJzIGNvbnRhaW4gY2xhaW1z IGFib3V0IHRoZSDigJhyb290IG9mIHRydXN04oCZIHN1Yi1hY3RvciB3aGlsZSBjbGFpbXMgZnJv bSB0aGUgb3RoZXIgc3ViLWFjdG9yIGFyZSBFdmlkZW5jZS4NCjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48YnI+DQo8YnI+DQo8bzpwPjwvbzpwPjwvcD4NCjxi bG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+U2luY2UgdGhlIFJBVFMgV0cgc2NvcGUgZG9lc24ndCBhbnRpY2lwYXRlIHdhbnRpbmcgLyBu ZWVkaW5nIHRvIGRlZmluZSBzcGVjaWZpYyB0dXJ0bGVzLCB3b3JraW5nIGdyb3VwIHBhcnRpY2lw YW50cyBzaG91bGQgaGF2ZSBzb21ldGhpbmcgaW4gbWluZCBpbiB0ZXJtcyBhIHR1cnRsZSB0aGF0 IGlzIGEgcm9vdCBvZiB0cnVzdCBhbmQgYSB0dXJ0bGUgdGhhdCBpcyBhdHRlc3RhYmxlLg0KIFRo ZXkgY2FuIGZvcndhcmQgY2xhaW1zIGFib3V0IHRoZSBhdHRlc3RhYmxlIHR1cnRsZSBhbmQgYWdy ZWUgdGhhdCB0aGUgcm9vdCBvZiB0cnVzdCB0dXJ0bGUgY2FuIGJlIGlkZW50aWZpZWQgKGUuZy4g dmVuZG9yLCBtb2RlbCwgdmVyc2lvbiAtIGFuZCBzb21lIHdheSB0byBhdXRoZW50aWNhdGUgdGhl c2UgdmFsdWVzKSBidXQgaXQgaXMgdXAgdG8gdGhlIHZlcmlmaWVyIHRvIGhhdmUgYSBwb2xpY3kg Zm9yIHdoYXQgaXQgYWNjZXB0cyBhcyBpdHMNCiByb290LW9mLXRydXN0IHR1cnRsZXMuIFRoZSBS b1QgdHVydGxlIGlzIHRoZSBzdGFydGluZyBwb2ludCBmb3IgZXZhbHVhdGluZyB0aGUgdHVydGxl cyB0aGF0IGNhbiBiZSBhdHRlc3RlZC4NCjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+Rm9yIFRQTXMgYW5kIHRoZSBU Q0cgSSB0aGluayB0aGVyZSBtYXkgYmUgYSBub24tdHVydGxlIG91dC1vZi1iYW5kIGludGVyYWN0 aW9uIHRoYXQgaXMgdGFjaXRseSBhc3N1bWVkIGFuZCBiYWtlZCBpbnRvICZxdW90O3Jvb3Qgb2Yg dHJ1c3TigJ0uLiBUaGUgVENHIHNoYXJwbHkgZGVmaW5lcyB0aGUgZnVuY3Rpb25hbGl0eSBhbmQg c2VjdXJpdHkgb2YgdGhlIFRQTS4gVFBNIHZlbmRvcnMNCiBhbGwgcHJlY2lzZWx5IGFkaGVyZSB0 byB0aGlzLiBUaGVyZSBpcyBhbHNvIGEgc3Ryb25nIEhXLW9yaWVudGVkIENvbW1vbiBDcml0ZXJp YSBjZXJ0aWZpY2F0aW9uIHByb2dyYW0uIEkgdGhpbmsgdGhlcmUgYXJlIGFsc28gY29udmVudGlv bnMgZm9yIGtleSBkaXN0cmlidXRpb24gdGhlIFRQTSB3b3JsZC4gQSBUUE0gdmVuZG9yIGRpdmVy Z2luZyBmcm9tIHRoaXMgd291bGRu4oCZdCBzZWxsIGFueSBwcm9kdWN0IHNvIGFsbCBvZiB0aGlz IGlzIGV2ZXItcHJlc2VudA0KIGFuZCB1bmlmb3JtLiAoSeKAmW0gbm90IGEgVFBNIGV4cGVydCwg c28gaG9wZWZ1bGx5IEkgaGF2ZSBnb3QgdGhpcyByaWdodCkuPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5bbm1zXSBUaGUgVENHIGRvZXMgZGVmaW5lIGEgY29tbW9uIGNyaXRl cmlhIHByb2Nlc3MuIEhvd2V2ZXIsIG5vdCBhbGwgaW1wbGVtZW50YXRpb25zIG9mIGEgVFBNIHJl Y2VpdmUgY2VydGlmaWNhdGlvbnMgb3IgYnJhbmRpbmcuIFRoZXJlIGFyZSBvcGVuIHNvdXJjZSBz b2Z0d2FyZSBpbXBsZW1lbnRhdGlvbnMgb2YgVFBNIGZ1bmN0aW9uYWxpdHkgdGhhdCBjb3VsZCBi ZSB1c2VkIHRvIHBlcmZvcm0gYW4gYXR0ZXN0YXRpb24NCiBwcm90b2NvbC4gVENHIGF0dGVzdGF0 aW9uIHZlcmlmaWVycyBzaG91bGRu4oCZdCBhc3N1bWUgdGhlIGF0dGVzdGF0aW9uIGlzIGJlbGll dmFibGUgc2ltcGx5IGJlY2F1c2UgdGhlIGF0dGVzdGF0aW9uIHByb3RvY29sIHdhcyBmb2xsb3dl ZC4NCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGUgVENHIGF0dGVzdGF0aW9uIG1lY2hhbmlz bSBkb2VzIGRlZmluZSBhIGNvbW1vbiBjcml0ZXJpYSBjbGFpbS4gTm9ybWFsbHksIHRoaXMgY2xh aW0gaXMgYXNzZXJ0ZWQgYnkgYSBUUE0gbWFudWZhY3R1cmVyIChlLmcuIHRoZSB2ZW5kb3LigJlz IGtleSBzaWducyBpdCkgbm90IGEgVFBNIGF0dGVzdGF0aW9uIGtleS48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDou NWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5TZWVtcyBsaWtlIHRoZSBHUCAvIFRFRSB3 b3JsZCBoYXMgc29tZSBvZiB0aGlzIHRvbywgdGhvdWdoIG5vdCBhcyBtdWNoLjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPkkgYW0gYWltaW5nIGZvciBSQVRT IGFwcGxpY2FibGUgaW4gYSBicm9hZGVyIHdheSB3aXRoIG5vIHRpZSB0byBpbXBsZW1lbnRhdGlv biBzZWN1cml0eS4gVGhlIHNhbWUgc29ydCBvZiBicm9hZG5lc3MgdGhhdCBUTFMgaGFzLjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPkxMPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2JvZHk+DQo8L2h0bWw+DQo= --_000_02C008167EE8403FB0A89A92174B7D7Dintelcom_-- From nobody Fri Aug 9 19:02:23 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5467F1200B4 for ; Fri, 9 Aug 2019 19:02:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MzKTMHp_iEo9 for ; Fri, 9 Aug 2019 19:02:20 -0700 (PDT) Received: from p3plsmtpa09-10.prod.phx3.secureserver.net (p3plsmtpa09-10.prod.phx3.secureserver.net [173.201.193.239]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5936112008F for ; Fri, 9 Aug 2019 19:02:20 -0700 (PDT) Received: from [192.168.1.76] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id wGi3hbQ5qU6pgwGi3h1pxz; Fri, 09 Aug 2019 19:02:19 -0700 From: Laurence Lundblade Message-Id: <6F1D08C5-B718-48D2-977D-C9A26B747E2A@island-resort.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_227BB6B3-BB65-4871-8EA3-3141B9A6C232" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 9 Aug 2019 19:02:19 -0700 In-Reply-To: <02C00816-7EE8-403F-B0A8-9A92174B7D7D@intel.com> Cc: "rats@ietf.org" , Kathleen Moriarty , Thomas Hardjono , Eliot Lear , Anders Rundgren To: "Smith, Ned" References: <2DE09A2A-A6EA-4474-9DBE-8D52B523645B@island-resort.com> <987fbfbb-b3f6-c104-878a-b283978ca0f0@gmail.com> <6F1E85F0-35CB-415A-9672-BD3257F59373@island-resort.com> <2c9ebe7b-9826-2d23-6f86-d098b79128d6@gmail.com> <8E4ED21F-EE52-4FAF-AFCB-A7624C56ED28@island-resort.com> <148D90BA-036A-4682-B920-4650182E2CB1@cisco.com> <864C25C7-4584-495C-A6CD-40D7C2207EE9@intel.com> <51591A70-7E30-47BA-A3FE-C5A76EA8FDDA@island-resort.com> <02C00816-7EE8-403F-B0A8-9A92174B7D7D@intel.com> X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfEtfSeTyvqr6XX0VS/dYKV6fnoD+JUGuNdM1bGPXvMlNPJMwyo6kpWjcnKFiD8V0N/SA12AC0Dkv2BKMBBiq0IQdNUDcyI0Jtf8MpcIQLOTN84M9DoL8 Hk3zuxnNfl9D1ErAs8WLI4lBGxpYGMUZ5xIjLipZ+A+q13+D1JvfQKVmh70lbqFHP9FwUCWw6O1hSrrbqn7Y9MC9qC9BaD7ovEhrEUbEP22Gbv3dK7/kt1Ao ZoxS9ywr/fBzmNFqK0z35iHOL7J93k/6F5ZRiKdT8psexbtj75unqYt7HgqH5vg+9IQ3aPIJgR1v/nGubxRkqkWAf71z59qRBap8yrV134M= Archived-At: Subject: Re: [Rats] No root of trust requirement in RATS/EAT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 10 Aug 2019 02:02:22 -0000 --Apple-Mail=_227BB6B3-BB65-4871-8EA3-3141B9A6C232 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On Aug 9, 2019, at 3:44 PM, Smith, Ned wrote: > =20 > My original point is that RATS should not put any requirements on = implementation. > [nms] I infer you mean RATS should not put any trust requirements on = implementation?=20 The mainline RATS documents should have no security requirements or = strength-of-function requirements on the implementation roughly meaning: No requirement for how well it protects the signing key from SW attacks, = HW attacks, side channels and such No requirement that the owner of the device can=E2=80=99t replace the SW = or change the keys (no secure / trusted boot) Other similar... Protocol requirements are obviously necessary. Security recommendations = are fine (but not MUSTs or SHOULDs). =E2=80=A6skipping the complex discussion on trust and roles for now. >=20 > Maybe different terminology besides root of trust will be helpful? I think it is necessary. It should be defined in the architecture = document. The roles in the architecture document are not clear to me yet. = =E2=80=9CAttester=E2=80=9D seemed the closest. > =20 > ...The intent of the architecture draft is that the Attester role = doesn=E2=80=99t imply any particular strength-of-function to be = considered an Attester. It also isn=E2=80=99t trying to imply that there = is no such thing as strength-of-function (or whatever words we use to = capture the idea of level of implementation hardening and/or resistance = to attack). Agree with this. >>=20 >> Looking at this topic from the perspective of what can be attested, = it suggests that the claims attested should be properties where = misbehavior can be detected. For example, a hash of firmware A will not = describe firmware B as long as the hashing was performed correctly. It = may not be possible to detect if the hash of A was performed correctly = (since an attacker could have input B and said the output was A) = therefore that belongs in the RoT. > =20 > The real basis for attestation trust is actually out-of-band trust = establishment between the relying party and manufacturer or such as = I=E2=80=99ve tried to illustrate in my recent hypothetical example. It = seems to me that the real trust in TLS is established out of band = through the download of a web browser containing roots by the end user. = This is similar.=20 > =20 > [nms] Using the roles terminology architecture draft you appear to be = saying the following: > =E2=80=9CThe basis for believing evidence from the Attester (by the = Verifier or Relying Party) is actually tied to an out-of-band flow of = Assertions from one or more Asserters.=E2=80=9D > This makes sense and resonates with what is depicted in the = architecture diagrams and in the architecture draft. Definition of = flows to and from the Asserter (claimant) are currently out of scope for = the WG but will be described in the architecture draft. Your point seems = to be that Verifier / Relying Party depends on this out-of-band flow in = order to arrive at any sort of meaningful conclusion about = trustworthiness of evidence. Yes. It seemed like to some that requiring a root of trust solves this = problem of trust. I was bringing up the out-of-band flow to show how = trust is really established. > To which I fully agree. LL= --Apple-Mail=_227BB6B3-BB65-4871-8EA3-3141B9A6C232 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
On = Aug 9, 2019, at 3:44 PM, Smith, Ned <ned.smith@intel.com>= wrote:
 
My original point is that RATS should = not put any requirements on implementation.
[nms] I = infer you mean RATS should not put any trust requirements on = implementation? 

The mainline RATS documents = should have no security requirements or strength-of-function = requirements on the implementation roughly meaning:
  • No requirement for how well it = protects the signing key from SW attacks, HW attacks, side channels and = such
  • No requirement that the owner of the device = can=E2=80=99t replace the SW or change the keys (no secure / trusted = boot)
  • Other similar...

Protocol requirements are obviously necessary. = Security recommendations are fine (but not MUSTs or = SHOULDs).

=E2=80=A6skipping the = complex discussion on trust and roles for now.


Maybe = different terminology besides root of trust will be = helpful?

I think it is necessary. It should be defined in = the architecture document.

The roles = in the architecture document are not clear to me yet. =E2=80=9CAttester=E2= =80=9D seemed the closest.


 
...The = intent of the architecture draft is that the Attester role doesn=E2=80=99t= imply any particular strength-of-function to be considered an Attester. = It also isn=E2=80=99t trying to imply that there is no such thing as = strength-of-function (or whatever words we use to capture the idea of = level of implementation hardening and/or resistance to = attack).

Agree with this.


Looking= at this topic from the perspective of what can be attested, it suggests = that the claims attested should be properties where misbehavior can be = detected. For example, a hash of firmware A will not describe firmware B = as long as the hashing was performed correctly. It may not be possible = to detect if the hash of A was performed correctly (since an attacker = could have input B and said the output was A) therefore that belongs in = the RoT.
 
The real basis for attestation trust is actually = out-of-band trust establishment between the relying party and = manufacturer or such as I=E2=80=99ve tried to illustrate in my recent = hypothetical example.  It seems to me that the real trust in TLS is = established out of band through the download of a web browser containing = roots by the end user. This is similar. 
 
[nms] = Using the roles terminology architecture draft you appear to be saying = the following:
=E2=80=9CThe basis for believing evidence from the Attester = (by the Verifier or Relying Party) is actually tied to an out-of-band = flow of Assertions from one or more = Asserters.=E2=80=9D
This = makes sense and resonates with what is depicted in the architecture = diagrams and in the architecture draft.  Definition of flows to and = from the Asserter (claimant) are currently out of scope for the WG but = will be described in the architecture draft. Your point seems to be that = Verifier / Relying Party depends on this out-of-band flow in order to = arrive at any sort of meaningful conclusion about trustworthiness of = evidence.

Yes.

It seemed = like to some that requiring a root of trust solves this problem of = trust. I was bringing up the out-of-band flow to show how trust is = really established.

To which I fully = agree.


LL
= --Apple-Mail=_227BB6B3-BB65-4871-8EA3-3141B9A6C232-- From nobody Sat Aug 10 05:25:25 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 391F712008C for ; Sat, 10 Aug 2019 05:25:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bZg4A12uW-8w for ; Sat, 10 Aug 2019 05:25:20 -0700 (PDT) Received: from mail-yw1-xc41.google.com (mail-yw1-xc41.google.com [IPv6:2607:f8b0:4864:20::c41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E9162120089 for ; Sat, 10 Aug 2019 05:25:19 -0700 (PDT) Received: by mail-yw1-xc41.google.com with SMTP id x74so18759320ywx.6 for ; Sat, 10 Aug 2019 05:25:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=x5tz8x1nRu4hYn1EZmvyn7mnclMvmEIdP9qjFI5av7I=; b=uOz/wWNx27oQN14drghRJ+Nbn0pHQaJxg2ep0kG7R6n+aHtMl1jtbbUCGIRxAuCcf1 5U8ZZs/plUi0tjXbVhPZHgr4OjRS6mM7Gmkmh5PnaZ+HEQvLQ966ENJMNbL/mcf6EOtH 2K3Oc+TOGSY9HAyd47Ay6PdWANH7xTEdAfZD/R+ropKbzAKTmHk2xtHYu/XNNq0NhpUE fs340bViCLHx6AdycevatoWnoCczJzMkkh/iVBRLheyaor1vI3lp4AgwD1snKn5WbL2n hrzE8lL9RmwfH4NYx2gDe27lGV17NiGiGlfCm/Bvt3oLyfBqGKygyvfTlRvbFVy4Zxk2 6fNw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=x5tz8x1nRu4hYn1EZmvyn7mnclMvmEIdP9qjFI5av7I=; b=pcqIxfZK2m5gkxpSRV4WS8dI3HzbS1tQSBmc/3MhLexvjahlMoabxD7M2PXpYkP975 DJ1PG/3ArtXtWynVnqeCOOcut3ok+RsJyZAYxELPoUSxJdM7t+jZLRJbvaRhhllr2scL Et5+2DoXNmtH/yc7+6xZyMdCik9Ig1/KRh5Z1kKS8Zke8Thm6PDLNPQmknMvdBUp97tq 1vHCNh3YnZeAfdIbHzzdlsKYLZonGmAHmXEb6QpEKkB0gR3LTdT+IF0e9icF45QdlJb7 ktK7s3wGRUgSjAWJ7kEGc43AQVHygnrMzOzYVJrWbYRk5KS2jLkRWmi17B5IrCflAXjG v9ww== X-Gm-Message-State: APjAAAW9A9TIKKSTC9YqfSG+ODM628ul5zg/RAB/3abVr82QNT/wKahz yQqsrW63iG6G1up79/EkAf4Ey5YWz/cBLKemGxA= X-Google-Smtp-Source: APXvYqz4+kU7Cww1SiuxdXcMliWTeqoFR+eqmg9bxlvfZAOtQR5E0ttrmm/ukCmX7LpLiyVJCJTr3rNUXHhxfz/sedU= X-Received: by 2002:a81:3acf:: with SMTP id h198mr8347332ywa.352.1565439919143; Sat, 10 Aug 2019 05:25:19 -0700 (PDT) MIME-Version: 1.0 References: <2DE09A2A-A6EA-4474-9DBE-8D52B523645B@island-resort.com> <987fbfbb-b3f6-c104-878a-b283978ca0f0@gmail.com> <6F1E85F0-35CB-415A-9672-BD3257F59373@island-resort.com> <2c9ebe7b-9826-2d23-6f86-d098b79128d6@gmail.com> <8E4ED21F-EE52-4FAF-AFCB-A7624C56ED28@island-resort.com> <148D90BA-036A-4682-B920-4650182E2CB1@cisco.com> <864C25C7-4584-495C-A6CD-40D7C2207EE9@intel.com> <51591A70-7E30-47BA-A3FE-C5A76EA8FDDA@island-resort.com> <02C00816-7EE8-403F-B0A8-9A92174B7D7D@intel.com> <6F1D08C5-B718-48D2-977D-C9A26B747E2A@island-resort.com> In-Reply-To: <6F1D08C5-B718-48D2-977D-C9A26B747E2A@island-resort.com> From: Ira McDonald Date: Sat, 10 Aug 2019 08:28:23 -0400 Message-ID: To: Laurence Lundblade , Ira McDonald Cc: "Smith, Ned" , "rats@ietf.org" , Kathleen Moriarty , Thomas Hardjono , Eliot Lear , Anders Rundgren Content-Type: multipart/alternative; boundary="0000000000004c52a1058fc262fd" Archived-At: Subject: Re: [Rats] No root of trust requirement in RATS/EAT X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 10 Aug 2019 12:25:23 -0000 --0000000000004c52a1058fc262fd Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi, I agree with Laurence that this (usually ignored) out-of-band flow of configuration information for keys, key usage, and "trustworthiness" attestation context is important to recognize in RATS architecture (and to mention in RATS information model). Ned correctly quoted the essence of the US NIST definition of an RoT earlier in this thread. But I've always strongly disliked that definition, because it consists of saying one thing about whats NOT true about an RoT (never use a negative in a definition is a good rule of thumb). But it says nothing about what functionality an RoT *does* provide. It's true that a Verifier always does make a binary decision about instantaneous "trustworthiness". So what. That decision might well be different a moment later or for a different requested access or operation permission. The historic focus (not just in TCG) on the value of "secure boot" is pretty irrelevant for a server (or mobile phone) that booted up months ago. It's only the *current* state of the Attester's device or application that's actually useful. Cheers, - Ira Ira McDonald (Musician / Software Architect) Co-Chair - TCG Trusted Mobility Solutions WG Co-Chair - TCG Metadata Access Protocol SG Chair - Linux Foundation Open Printing WG Secretary - IEEE-ISTO Printer Working Group Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG IETF Designated Expert - IPP & Printer MIB Blue Roof Music / High North Inc http://sites.google.com/site/blueroofmusic http://sites.google.com/site/highnorthinc mailto: blueroofmusic@gmail.com PO Box 221 Grand Marais, MI 49839 906-494-2434 On Fri, Aug 9, 2019 at 10:02 PM Laurence Lundblade wrote: > > On Aug 9, 2019, at 3:44 PM, Smith, Ned wrote: > > My original point is that RATS should not put any requirements on > implementation. > [nms] I infer you mean RATS should not put any trust requirements on > implementation? > > > The mainline RATS documents should have no security requirements or > strength-of-function requirements on the implementation roughly meaning: > > - No requirement for how well it protects the signing key from SW > attacks, HW attacks, side channels and such > - No requirement that the owner of the device can=E2=80=99t replace th= e SW or > change the keys (no secure / trusted boot) > - Other similar... > > > Protocol requirements are obviously necessary. Security recommendations > are fine (but not MUSTs or SHOULDs). > > =E2=80=A6skipping the complex discussion on trust and roles for now. > > > Maybe different terminology besides root of trust will be helpful? > > > I think it is necessary. It should be defined in the architecture documen= t. > > The roles in the architecture document are not clear to me yet. =E2=80=9C= Attester=E2=80=9D > seemed the closest. > > > > ...The intent of the architecture draft is that the Attester role doesn= =E2=80=99t > imply any particular strength-of-function to be considered an Attester. I= t > also isn=E2=80=99t trying to imply that there is no such thing as > strength-of-function (or whatever words we use to capture the idea of lev= el > of implementation hardening and/or resistance to attack). > > > Agree with this. > > > Looking at this topic from the perspective of what can be attested, it > suggests that the claims attested should be properties where misbehavior > can be detected. For example, a hash of firmware A will not describe > firmware B as long as the hashing was performed correctly. It may not be > possible to detect if the hash of A was performed correctly (since an > attacker could have input B and said the output was A) therefore that > belongs in the RoT. > > > The real basis for attestation trust is actually out-of-band trust > establishment between the relying party and manufacturer or such as I=E2= =80=99ve > tried to illustrate in my recent hypothetical example. It seems to me th= at > the real trust in TLS is established out of band through the download of = a > web browser containing roots by the end user. This is similar. > > [nms] Using the roles terminology architecture draft you appear to be > saying the following: > =E2=80=9CThe basis for believing evidence from the Attester (by the Verif= ier or > Relying Party) is actually tied to an out-of-band flow of Assertions from > one or more Asserters.=E2=80=9D > > This makes sense and resonates with what is depicted in the architecture > diagrams and in the architecture draft. Definition of flows to and from > the Asserter (claimant) are currently out of scope for the WG but will be > described in the architecture draft. Your point seems to be that Verifier= / > Relying Party depends on this out-of-band flow in order to arrive at any > sort of meaningful conclusion about trustworthiness of evidence. > > > Yes. > > It seemed like to some that requiring a root of trust solves this problem > of trust. I was bringing up the out-of-band flow to show how trust is > really established. > > To which I fully agree. > > > > LL > _______________________________________________ > RATS mailing list > RATS@ietf.org > https://www.ietf.org/mailman/listinfo/rats > --0000000000004c52a1058fc262fd Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi,

I agree with Laurence th= at this (usually ignored) out-of-band flow of
configuration = information for keys, key usage, and "trustworthiness"
= attestation context is important to recognize in RATS architecture
(and to mention in RATS information model).

Ned correctly quoted the essence of the US NIST definition of an RoT
=
earlier in this thread.

But I've always s= trongly disliked that definition, because it consists of
say= ing one thing about whats NOT true about an RoT (never use a
negative in a definition is a good rule of thumb).=C2=A0 But it says nothi= ng
about what functionality an RoT *does* provide.

It's true that a Verifier always does make a binary dec= ision about
instantaneous "trustworthiness".=C2=A0 So w= hat.=C2=A0 That decision might
well be different a moment later o= r for a different requested access
or operation permission.=C2=A0=

The historic focus (not just in TCG) on the = value of "secure boot" is
pretty irrelevant for a = server (or mobile phone) that booted up months
ago.=C2=A0 It= 's only the *current* state of the Attester's device or application=
that's actually useful.

Cheers= ,
- Ira

Ira McDonald (Mu= sician / Software Architect)
Co-Chair - TCG Trusted Mobility Solutions W= G
Co-Chair - TCG Metadata Access Protocol SG
Chair - Linux Foundation Open Printing WG
Secretary - IEEE-ISTO Pr= inter Working Group
Co-Chair - IEEE-ISTO PWG Internet Printing Protocol = WG
IETF Designated Expert - IPP & Printer MIB
Blue Roof Music / H= igh North Inc
http://sites.google.com/site/= blueroofmusic
http://sites.google.com/si= te/highnorthinc
mailto: blueroofmusic@gmail.com
PO Box 221=C2=A0 Grand Mara= is, MI 49839=C2=A0 906-494-2434

=


On Fri, Aug 9, 2019 at 10:02 PM Laurence Lund= blade <lgl@island-resort.com> wrote:

<= div class=3D"gmail-m_8885521518204237060WordSection1" style=3D"font-family:= Helvetica;font-size:12px;font-style:normal;font-variant-caps:normal;font-we= ight:normal;letter-spacing:normal;text-align:start;text-indent:0px;text-tra= nsform:none;white-space:normal;word-spacing:0px;text-decoration:none">
=
=C2=A0
M= y original point is that RATS should not put any requirements on implementa= tion.
[nms] I infer you mean RATS should not p= ut any=C2= =A0trust=C2=A0requirem= ents on implementation?=C2=A0
<= br>
The mainline RATS documents should have no security requireme= nts or strength-of-function requirements on the implementation roughly mean= ing:
  • No = requirement for how well it protects the signing key from SW attacks, HW at= tacks, side channels and such
  • No requirement that the owner of the = device can=E2=80=99t replace the SW or change the keys (no secure / trusted= boot)
  • Other similar...

Protocol= requirements are obviously necessary. Security recommendations are fine (b= ut not MUSTs or SHOULDs).

=E2=80=A6skipping the co= mplex discussion on trust and roles for now.


Maybe different terminology besides root of trust will be helpf= ul?

I think i= t is necessary. It should be defined in the architecture document.

The roles in the architecture document are not clear to me= yet. =E2=80=9CAttester=E2=80=9D seemed the closest.

=C2=A0
...The intent of the architecture d= raft is that the Attester role doesn=E2=80=99t imply any particular strengt= h-of-function to be considered an Attester. It also isn=E2=80=99t trying to= imply that there is no such thing as strength-of-function (or whatever wor= ds we use to capture the idea of level of implementation hardening and/or r= esistance to attack).

Agree with this.


L= ooking at this topic from the perspective of what can be attested, it sugge= sts that the claims attested should be properties where misbehavior can be = detected. For example, a hash of firmware A will not describe firmware B as= long as the hashing was performed correctly. It may not be possible to det= ect if the hash of A was performed correctly (since an attacker could have = input B and said the output was A) therefore that belongs in the RoT.
=C2=A0
The real basis for attestation trust = is actually out-of-band trust establishment between the relying party and m= anufacturer or such as I=E2=80=99ve tried to illustrate in my recent hypoth= etical example.=C2=A0 It seems to me that the real trust in TLS is establis= hed out of band through the download of a web browser containing roots by t= he end user. This is similar.=C2=A0
[nms] Using the roles terminology arc= hitecture draft you appear to be saying the following:
<= div style=3D"margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,san= s-serif">=E2=80=9CThe basis for believing evidence from the Attester (by th= e Verifier or Relying Party) is actually tied to an out-of-band flow of Ass= ertions from one or more Asserters.=E2=80=9D
=
This makes sense and resonates with wh= at is depicted in the architecture diagrams and in the architecture draft.= =C2=A0 Definition of flows to and from the Asserter (claimant) are currentl= y out of scope for the WG but will be described in the architecture draft. = Your point seems to be that Verifier / Relying Party depends on this out-of= -band flow in order to arrive at any sort of meaningful conclusion about tr= ustworthiness of evidence.

Yes.

It seemed like to some that requiring a ro= ot of trust solves this problem of trust. I was bringing up the out-of-band= flow to show how trust is really established.

To which I fully agree.


LL
_______________________= ________________________
RATS mailing list
RATS@ietf.org
https://www.ietf.org/mailman/listinfo/rats
--0000000000004c52a1058fc262fd-- From nobody Sat Aug 10 11:21:07 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4FFA1120115 for ; Sat, 10 Aug 2019 11:21:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bloCKYZyMQ0M for ; Sat, 10 Aug 2019 11:21:03 -0700 (PDT) Received: from p3plsmtpa12-05.prod.phx3.secureserver.net (p3plsmtpa12-05.prod.phx3.secureserver.net [68.178.252.234]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D27E81200F6 for ; Sat, 10 Aug 2019 11:21:03 -0700 (PDT) Received: from [192.168.1.76] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id wVzDhUuKq4JUmwVzDhHSr7; Sat, 10 Aug 2019 11:21:03 -0700 From: Laurence Lundblade Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Message-Id: <9D03ECD4-498F-433E-A30D-587D996E1FA1@island-resort.com> Date: Sat, 10 Aug 2019 11:21:02 -0700 To: rats@ietf.org X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfNgL8c6tFB0R0tvuwJy/QujS+GA8BBJ7htHCsIK0WL/Vyc1luKW8ua5qAx/J4E1EKd3iuJEQIixtfY6tbl99JREJTon62Qt5VEWHPhZBFOEH6bAzO6IV woy5GGvQ2Nqr6jWhh0VyOKvtL4OeFzQKLKQjswjFhKvGjkG/ctvAY49W Archived-At: Subject: [Rats] Multiple attesters and verifiers X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 10 Aug 2019 18:21:05 -0000 I think there are elaborate deployments that involve multiple attesters = and verifiers. Ned has been bringing these up. The architecture needs to = cover these. That said, I prefer us to get straight on the simpler case = with one of each.=20 To go on a bit further. You could have: Attester =E2=80=94(IPC)=E2=80=94 > Attester =E2=80=94(TCP/IP) =E2=80=94= > Verifier =E2=80=94(in same process) =E2=80=94 > Attester =E2=80=94(TCP/= IP) =E2=80=94 > Verifier =E2=80=94(HTTPS/TCP/IP)=E2=80=94 > RP The first two attesters are on the entity / device that is the subject = of the attestation. This would probably look like nested EAT tokens.=20 The first verifier is a service that might broker attestation from = multiple entity / device vendors. It outputs an EAT token that has made = some implied claims explicit and perhaps checked some claims against = known-good-values. The second verifier is the one that really relates to the relying party. Sometimes the connections are internal to a computing device, in which = case the trust and security are provided by the local OS. Sometimes the connections are over IP in which case the claims are = likely secured by being in a EAT. In the last link in the example, the result is secured by HTTPS and is = probably internal to the RP. LL From nobody Mon Aug 12 15:34:31 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0E415121152; Mon, 12 Aug 2019 15:34:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fh-Q7SOTCZB7; Mon, 12 Aug 2019 15:34:18 -0700 (PDT) Received: from mga06.intel.com (mga06.intel.com [134.134.136.31]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7A3FA121F7E; Mon, 12 Aug 2019 10:06:40 -0700 (PDT) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga006.fm.intel.com ([10.253.24.20]) by orsmga104.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 12 Aug 2019 10:01:37 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.64,378,1559545200"; d="scan'208";a="376011251" Received: from orsmsx101.amr.corp.intel.com ([10.22.225.128]) by fmsmga006.fm.intel.com with ESMTP; 12 Aug 2019 10:01:36 -0700 Received: from orsmsx109.amr.corp.intel.com ([169.254.11.25]) by ORSMSX101.amr.corp.intel.com ([169.254.8.157]) with mapi id 14.03.0439.000; Mon, 12 Aug 2019 10:01:36 -0700 From: "Smith, Ned" To: Laurence Lundblade , "rats@ietf.org" CC: "teep@ietf.org" Thread-Topic: [Rats] Multiple attesters and verifiers Thread-Index: AQHVT6hjq+DUI7Qea0u3+OqyApj/Oab3v+GA Date: Mon, 12 Aug 2019 17:01:35 +0000 Message-ID: <69791140-FEFB-41CF-BB1B-9C0F172F8328@intel.com> References: <9D03ECD4-498F-433E-A30D-587D996E1FA1@island-resort.com> In-Reply-To: <9D03ECD4-498F-433E-A30D-587D996E1FA1@island-resort.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1b.0.190715 x-originating-ip: [10.251.12.118] Content-Type: text/plain; charset="utf-8" Content-ID: <672CCDCE1CD77D4CA766A56E4CB23692@intel.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [Rats] Multiple attesters and verifiers X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Aug 2019 22:34:22 -0000 U2VlIGlubGluZSBbbm1zXQ0KDQrvu79PbiA4LzEwLzE5LCAxMToyMSBBTSwgIlJBVFMgb24gYmVo YWxmIG9mIExhdXJlbmNlIEx1bmRibGFkZSIgPHJhdHMtYm91bmNlc0BpZXRmLm9yZyBvbiBiZWhh bGYgb2YgbGdsQGlzbGFuZC1yZXNvcnQuY29tPiB3cm90ZToNCg0KICAgIEkgdGhpbmsgdGhlcmUg YXJlIGVsYWJvcmF0ZSBkZXBsb3ltZW50cyB0aGF0IGludm9sdmUgbXVsdGlwbGUgYXR0ZXN0ZXJz IGFuZCB2ZXJpZmllcnMuIE5lZCBoYXMgYmVlbiBicmluZ2luZyB0aGVzZSB1cC4gVGhlIGFyY2hp dGVjdHVyZSBuZWVkcyB0byBjb3ZlciB0aGVzZS4gVGhhdCBzYWlkLCBJIHByZWZlciB1cyB0byBn ZXQgc3RyYWlnaHQgb24gdGhlIHNpbXBsZXIgY2FzZSB3aXRoIG9uZSBvZiBlYWNoLiANCiAgICAN CiAgICBUbyBnbyBvbiBhIGJpdCBmdXJ0aGVyLg0KICAgIA0KICAgIFlvdSBjb3VsZCBoYXZlOg0K W25tc10gSXMgdGhpcyBleGFtcGxlIGludGVuZGVkIHRvIGZvbGxvdyBvbmUgb2YgdGhlIFJBVFMg dXNlIGNhc2VzIG9yIHBlcmhhcHMgb25lIG9mIHRoZSBURUVQIGludGVyYWN0aW9uIHNjZW5hcmlv cz8NCg0KICAgICAgIEF0dGVzdGVyIOKAlChJUEMp4oCUID4gQXR0ZXN0ZXIg4oCUKFRDUC9JUCkg 4oCUID4gVmVyaWZpZXIg4oCUKGluIHNhbWUgcHJvY2Vzcykg4oCUID4gQXR0ZXN0ZXIg4oCUKFRD UC9JUCkg4oCUID4gVmVyaWZpZXIg4oCUKEhUVFBTL1RDUC9JUCnigJQgPiBSUA0KDQpbbm1zLWJs b2NrXSBUbyBicmVhayB0aGlzIGRvd24gZXZlbiBmdXJ0aGVyOg0KQXR0ZXN0ZXIxIHByZXN1bWFi bHkgc2lnbnMgRXZpZGVuY2UxIHdpdGggS2V5MSBhbmQgaW5jbHVkZXMgYSBOb25jZTEgZnJvbSBW ZXJpZmllcjENCg0KQXR0ZXN0ZXIyIHByZXN1bWFibHkgc2lnbnMgRXZpZGVuY2UyICh3aGljaCBw cmVzdW1hYmx5IGNvbnRhaW5zIEV2aWRlbmNlMSkgd2l0aCBLZXkyIGFuZCBpbmNsdWRlcyBhIE5v bmNlMig/KSBmcm9tIFZlcmlmaWVyMSAtIG9yIGl0IGNvdWxkIGhhdmUgdXNlZCBOb25jZTEuIA0K DQpOb3RlOiB0aGVyZSBpcyBhbiBpbnRlcmVzdGluZyBxdWVzdGlvbiByZWxhdGVkIHRvIEV2aWRl bmNlIGZyZXNobmVzcy4gKGkpIHJlcGx5IGF0dGFjayBwcmV2ZW50aW9uIGFuZCAoaWkpIHRpbWUg c2luY2UgdGhlIHN0YXRlIGRlc2NyaWJlZCBieSB0aGUgRXZpZGVuY2Ugd2FzIGV4dGFudC4gVGhp cyByZWxhdGVzIHRvIElyYSBNY0RvbmFsZHMgY29tbWVudCBpbiBhIGRpZmZlcmVudCB0aHJlYWQg LSAiSXQncyBvbmx5IHRoZSAqY3VycmVudCogc3RhdGUgb2YgdGhlIEF0dGVzdGVyJ3MgZGV2aWNl IG9yIGFwcGxpY2F0aW9uIHRoYXQncyBhY3R1YWxseSB1c2VmdWwuIiBSZWdhcmRpbmcgKGkpIGdp dmVuIG11bHRpcGxlIGF0dGVzdGVycyBvbiB0aGUgc2FtZSBkZXZpY2UgTVVTVCAvIFNIT1VMRCBF dmlkZW5jZSBiZSBzaWduZWQgaW4gcmVzcG9uc2UgdG8gYSByZXF1ZXN0IG9yIGNhbiBFdmlkZW5j ZSBiZSBwcmUtc2lnbmVkIGluIGFudGljaXBhdGlvbiBvZiByZWNlaXZpbmcgb25lIG9yIG1vcmUg cmVxdWVzdHM/IFRoZSBUVURBIGRyYWZ0IHBvc3NpYmx5IGFkZHJlc3NlcyB0aGlzIGRpZmZlcmVu dGx5IHRoYW4gdXNpbmcgYSByZXF1ZXN0ZXIgc3VwcGxpZWQgbm9uY2UuIChpaSkgRXZpZGVuY2Ug ZnJlc2huZXNzIGFsc28gcmVsYXRlcyB0byBob3cgcmVjZW50bHkgdGhlIHRydXN0d29ydGhpbmVz cyBzdGF0ZSB3YXMgdGVzdGVkIC8gbWVhc3VyZWQuIEZvciBleGFtcGxlLCA1IHJlcXVlc3RzIHVz aW5nIE5vbmNlMSAtIE5vbmNlNSBjb3VsZCBhbGwgYmUgcmV0dXJuaW5nIHRoZSBzYW1lIGhpc3Rv cmljYWwgRXZpZGVuY2UuIA0KDQpWZXJpZmllcjEgYW5kIEF0dGVzdGVyMyAoYXJlIGluIHRoZSBz YW1lIHByb2Nlc3MgLSBvciB3aGF0IHRoZSBhcmNoaXRlY3R1cmUgZHJhZnQgYWJzdHJhY3RzIGFz ICJhY3RvciIpLiBWZXJpZmllciAxIHByZXN1bWFibHkgaGFzIGEgUG9saWN5MSBvZiBrbm93bi1n b29kIC8gd2hpdGVsaXN0IC8gYmxhY2tsaXN0IHZhbHVlcyB0aGF0IGluZm9ybXMgaG93IHRvIHBy b2R1Y2UgYSBSZXN1bHQxIHRoYXQgY29uc2lzdHMgb2YgInZlcmlmaWVkIENsYWltcyIuIEF0dGVz dGVyMyBwb3NzaWJseSBpbmNsdWRlcyBuZXcgQ2xhaW1zIHRoYXQgYXJlIHBhY2thZ2VkIGFzIEV2 aWRlbmNlMy4gIFJlc3VsdDEgYW5kIEV2aWRlbmNlMyBhcmUgc2VudCB0byBWZXJpZmllcjIuIA0K DQpWZXJpZmllcjIgYXBwZWFycyB0byBhbHNvIGJlIGEgUmVseWluZyBQYXJ0eS1SUDEgc2luY2Ug UmVzdWx0MSBpcyBiZWluZyBzZW50IHRvIGl0IGZyb20gQXR0ZXN0ZXIzLg0KDQpWZXJpZmllcjIg dG8gcHJvZHVjZSBSZXN1bHQyIHVzaW5nIFBvbGljeTIgd2hpY2ggaXMgc2VudCB0byBSUDIuDQpS UDIgcHJlc3VtYWJseSBldmFsdWF0ZXMgUmVzdWx0MiB1c2luZyBhIHJpc2sgbWFuYWdlbWVudCBw b2xpY3kgKFBvbGljeTMpLg0KDQpQb3NzaWJseSB0aGUgdXNlIGNhc2UgY2FuIGJlIHN1bW1hcml6 ZWQgYXMgZm9sbG93cyAod2hpY2ggaXMgaXNvbW9ycGhpYyB0byBMYXVyZW5jZSdzIG9yaWdpbmFs IGV4cHJlc3Npb24pOg0KTm90YXRpb246ICgpS3ggLSBzaWduaW5nIHVzaW5nIEt4DQowKVZlcmlm aWVyIDEgc2VuZHMgTm9uY2UxIGFuZCBOb25jZTIgdG8gQXR0ZXN0ZXIxIGFuZCBBdHRlc3RlcjIg cmVzcGVjdGl2ZWx5LiBWZXJpZmllcjItUlAxIHNlbmRzIE5vbmNlMyB0byBWZXJpZmllcjEtQXR0 ZXN0ZXIzLiBSUDIgc2VuZHMgTm9uY2U0IHRvIFZlcmlmaWVyMi1SUDEuDQoxKSBBdHRlc3RlcjE6 IChFdmlkZW5jZTEsIE5vbmNlMSlLMSDigJQoSVBDKeKAlCA+IEF0dGVzdGVyMg0KMikgQXR0ZXN0 ZXIyOiAoKEV2aWRlbmNlMSwgTm9uY2UxKUsxLCBFdmlkZW5jZTIsIE5vbmNlMilLMiDigJQoVENQ L0lQKSDigJQgPiBWZXJpZmllcjEtQXR0ZXN0ZXIzIChOb3RlOiBWZXJpZmllcjEgYW5kIEF0dGVz dGVyMyBhcmUgcm9sZXMgb24gdGhlIHNhbWUgYWN0b3IpDQozKSBWZXJpZmllcjE6IEV2YWx1YXRl cyBwYXlsb2FkIHVzaW5nIFBvbGljeTEgdG8gcHJvZHVjZSAoUmVzdWx0MSwgTm9uY2UzKUszDQo0 KSBBdHRlc3RlcjM6IENyZWF0ZXMgKEV2aWRlbmNlMywgTm9uY2UzKUszDQo1KSBWZXJpZmllcjEt QXR0ZXN0ZXIzOiAoUmVzdWx0MSwgRXZpZGVuY2UzLCBOb25jZTMpSzMg4oCUKFRDUC9JUCkg4oCU ID4gVmVyaWZpZXIyLVJQMSAoTm90ZTogQWdhaW4gdHdvIHJvbGVzIGJlbG9uZ2luZyB0byB0aGUg c2FtZSBhY3RvcikNCjYpIFZlcmlmaWVyMjogRXZhbHVhdGVzIHBheWxvYWQgRXZpZGVuY2UzIHVz aW5nIFBvbGljeTIgdG8gcHJvZHVjZSAoUmVzdWx0MmEsIE5vbmNlNClLNA0KNykgUlAxOiBFdmFs dWF0ZXMgcGF5bG9hZCBSZXN1bHQxIHVzaW5nIFBvbGljeTIgdG8gcHJvZHVjZSAoUmVzdWx0MmIs IE5vbmNlNClLNCBhbmQvb3IgdGFrZXMgc29tZSBhY3Rpb24uDQo4KSBWZXJpZmllcjItUlAxOiAo UmVzdWx0MiwgTm9uY2U0KUs0IOKAlChIVFRQUy9UQ1AvSVAp4oCUID4gUlAyDQo5KSBSUDI6IEV2 YWx1YXRlcyBSZXN1bHQyIHVzaW5nIFBvbGljeTMgYW5kIHRha2VzIHNvbWUgYWN0aW9uLg0KW2Js b2NrLU5NU10NCiAgDQogICAgVGhlIGZpcnN0IHR3byBhdHRlc3RlcnMgYXJlIG9uIHRoZSBlbnRp dHkgLyBkZXZpY2UgdGhhdCBpcyB0aGUgc3ViamVjdCBvZiB0aGUgYXR0ZXN0YXRpb24uIFRoaXMg d291bGQgcHJvYmFibHkgbG9vayBsaWtlIG5lc3RlZCBFQVQgdG9rZW5zLiANCltubXNdIEFuIGlt cG9ydGFudCBxdWVzdGlvbiBpcyB3aGljaCBrZXkocykgYXJlIHVzZWQgdG8gc2lnbiBlYWNoIEF0 dGVzdGVyJ3MgRXZpZGVuY2UgYW5kIGVhY2ggVmVyaWZpZXIncyBSZXN1bHRzLiBEb2VzIEVBVCB0 b2tlbiBuZXN0aW5nIHN1cHBvcnQgbXVsdGlwbGUgc2lnbmF0dXJlcyBhbmQga2V5cz8gQ2FuIEVB VCB0b2tlbnMgZGlzdGluZ3Vpc2ggYmV0d2VlbiBFdmlkZW5jZSBhbmQgUmVzdWx0cz8NCiAgICAN CiAgICBUaGUgZmlyc3QgdmVyaWZpZXIgaXMgYSBzZXJ2aWNlIHRoYXQgbWlnaHQgYnJva2VyIGF0 dGVzdGF0aW9uIGZyb20gbXVsdGlwbGUgZW50aXR5IC8gZGV2aWNlIHZlbmRvcnMuIEl0IG91dHB1 dHMgYW4gRUFUIHRva2VuIHRoYXQgaGFzIG1hZGUgc29tZSBpbXBsaWVkIGNsYWltcyBleHBsaWNp dCBhbmQgcGVyaGFwcyBjaGVja2VkIHNvbWUgY2xhaW1zIGFnYWluc3Qga25vd24tZ29vZC12YWx1 ZXMuDQpbbm1zXSBUaGVyZSBjb3VsZCBiZSBhIHNlbWFudGljIGRpZmZlcmVuY2UgYmV0d2VlbiBl dmFsdWF0ZWQgY2xhaW1zIHZzLiBhdHRlc3RlZCBjbGFpbXMuIFRoZSBhcmNoaXRlY3R1cmUgZHJh ZnQgd291bGQgYXJndWUgdGhhdCBSUCBtYXkgT05MWSBwcm9jZXNzIGNsYWltcyBmcm9tIGEgVmVy aWZpZXIuIElmIHRoZSBwYXlsb2FkIGNvbnRhaW5zIGNsYWltcyBmcm9tIGFuIGF0dGVzdGVyIHRo ZXJlIG11c3QgYmUgYSBWZXJpZmllciBjby1yZXNpZGVudCB3aXRoIHRoZSBSUC4gQWRkaXRpb25h bGx5LCBjbGFpbXMgZnJvbSBhIHZlcmlmaWVyIG1heSBiZSBlbnRpcmVseSBkaWZmZXJlbnQgY2xh aW1zIGZyb20gdGhvc2Ugc3VwcGxpZWQgdG8gaXQgYnkgYXR0ZXN0ZXJzLiBUaGlzIGlzIHdoeSB0 aGUgYXJjaGl0ZWN0dXJlIGRpc3Rpbmd1aXNoZXMgYmV0d2VlbiBFdmlkZW5jZSBhbmQgUmVzdWx0 cy4gQm90aCBjb3VsZCBiZSBleHByZXNzZWQgYXMgc2V0cyBvZiBjbGFpbXMgKElNTykuDQogICAg DQogICAgVGhlIHNlY29uZCB2ZXJpZmllciBpcyB0aGUgb25lIHRoYXQgcmVhbGx5IHJlbGF0ZXMg dG8gdGhlIHJlbHlpbmcgcGFydHkuDQogICAgDQogICAgU29tZXRpbWVzIHRoZSBjb25uZWN0aW9u cyBhcmUgaW50ZXJuYWwgdG8gYSBjb21wdXRpbmcgZGV2aWNlLCBpbiB3aGljaCBjYXNlIHRoZSB0 cnVzdCBhbmQgc2VjdXJpdHkgYXJlIHByb3ZpZGVkIGJ5IHRoZSBsb2NhbCBPUy4NCiAgICANCiAg ICBTb21ldGltZXMgdGhlIGNvbm5lY3Rpb25zIGFyZSBvdmVyIElQIGluIHdoaWNoIGNhc2UgdGhl IGNsYWltcyBhcmUgbGlrZWx5IHNlY3VyZWQgYnkgYmVpbmcgaW4gYSBFQVQuDQpbbm1zXSBUaGUg YXJjaGl0ZWN0dXJlIGRyYWZ0IHRyaWVzIHRvIGRpc3Rpbmd1aXNoIHRoZXNlIHR3byBjYXNlcyBh cyBsb2NhbCBjb252ZXlhbmNlLiBMb2NhbCBjb252ZXlhbmNlIGlzIGludGVybmFsIHRvIHRoZSBB Y3RvciBlbnZpcm9ubWVudC4gTG9jYWwgY29udmV5YW5jZSBpc24ndCBpbnRlcmVzdGluZyB0byAi UmVtb3RlIEF0dGVzdGF0aW9uIi4gDQogICAgDQogICAgSW4gdGhlIGxhc3QgbGluayBpbiB0aGUg ZXhhbXBsZSwgdGhlIHJlc3VsdCBpcyBzZWN1cmVkIGJ5IEhUVFBTIGFuZCBpcyBwcm9iYWJseSBp bnRlcm5hbCB0byB0aGUgUlAuDQpbbm1zXSBJJ20gbm90IHN1cmUgaWYgeW91IGFyZSBzdWdnZXN0 aW5nIHRoZSBsYXN0IGNvbnZleWFuY2UgaW5zdGFuY2UgKHN0ZXAgOCkgaXMgbG9jYWwgb3IgcmVt b3RlLiANCiAgICANCiAgICBMTA0KICAgIA0KICAgIA0KICAgIA0KICAgIA0KICAgIF9fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQogICAgUkFUUyBtYWlsaW5n IGxpc3QNCiAgICBSQVRTQGlldGYub3JnDQogICAgaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1h bi9saXN0aW5mby9yYXRzDQogICAgDQoNCg== From nobody Mon Aug 12 15:34:51 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 06B101211DB for ; Mon, 12 Aug 2019 15:34:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SvQ_Ju-qIu7b for ; Mon, 12 Aug 2019 15:34:47 -0700 (PDT) Received: from p3plsmtpa12-02.prod.phx3.secureserver.net (p3plsmtpa12-02.prod.phx3.secureserver.net [68.178.252.231]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5FD131222F2 for ; Mon, 12 Aug 2019 11:46:08 -0700 (PDT) Received: from [192.168.1.76] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id xFKZhWZsvTHCrxFKZh5p2j; Mon, 12 Aug 2019 11:46:07 -0700 Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) From: Laurence Lundblade In-Reply-To: <69791140-FEFB-41CF-BB1B-9C0F172F8328@intel.com> Date: Mon, 12 Aug 2019 11:46:07 -0700 Cc: "rats@ietf.org" , "teep@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <86F304B1-868D-45BF-998F-05570A58BAB2@island-resort.com> References: <9D03ECD4-498F-433E-A30D-587D996E1FA1@island-resort.com> <69791140-FEFB-41CF-BB1B-9C0F172F8328@intel.com> To: "Smith, Ned" X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfFhxvkUvfRTLym03O8YsWKaYC9QZv9A/x1RoBhCywRWPDsWfsU3KGUD8q2HtbJJ6zN3GJzoI0gsqew10R6CIBTxOfeUtfUTvz1YGl291MtOfMD+WMSek kWChJXx4c4WLLtBtOVWrW8/4OfSJqqoNfGa8dobzorz1WSdWnSFsQvksLptyY5Y4uvHiKFtR9LEho6Xs2kdquH2yWqepn7fYZ8EX28PElJa5QonlJSeokOpc Archived-At: Subject: Re: [Rats] Multiple attesters and verifiers X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Aug 2019 22:34:50 -0000 > On Aug 12, 2019, at 10:01 AM, Smith, Ned wrote: >=20 > See inline [nms] >=20 > =EF=BB=BFOn 8/10/19, 11:21 AM, "RATS on behalf of Laurence Lundblade" = wrote: >=20 > I think there are elaborate deployments that involve multiple = attesters and verifiers. Ned has been bringing these up. The = architecture needs to cover these. That said, I prefer us to get = straight on the simpler case with one of each.=20 >=20 > To go on a bit further. >=20 > You could have: > [nms] Is this example intended to follow one of the RATS use cases or = perhaps one of the TEEP interaction scenarios? Neither. Just something I imagined. I think concrete example are really = helpful. >=20 > Attester =E2=80=94(IPC)=E2=80=94 > Attester =E2=80=94(TCP/IP) = =E2=80=94 > Verifier =E2=80=94(in same process) =E2=80=94 > Attester = =E2=80=94(TCP/IP) =E2=80=94 > Verifier =E2=80=94(HTTPS/TCP/IP)=E2=80=94 = > RP >=20 > [nms-block] To break this down even further: Everything you say below generally makes sense to me. > Attester1 presumably signs Evidence1 with Key1 and includes a Nonce1 = from Verifier1 >=20 > Attester2 presumably signs Evidence2 (which presumably contains = Evidence1) with Key2 and includes a Nonce2(?) from Verifier1 - or it = could have used Nonce1.=20 >=20 > Note: there is an interesting question related to Evidence freshness. = (i) reply attack prevention and (ii) time since the state described by = the Evidence was extant. This relates to Ira McDonalds comment in a = different thread - "It's only the *current* state of the Attester's = device or application that's actually useful." Regarding (i) given = multiple attesters on the same device MUST / SHOULD Evidence be signed = in response to a request or can Evidence be pre-signed in anticipation = of receiving one or more requests? The TUDA draft possibly addresses = this differently than using a requester supplied nonce. (ii) Evidence = freshness also relates to how recently the trustworthiness state was = tested / measured. For example, 5 requests using Nonce1 - Nonce5 could = all be returning the same historical Evidence.=20 >=20 > Verifier1 and Attester3 (are in the same process - or what the = architecture draft abstracts as "actor"). Verifier 1 presumably has a = Policy1 of known-good / whitelist / blacklist values that informs how to = produce a Result1 that consists of "verified Claims". Attester3 possibly = includes new Claims that are packaged as Evidence3. Result1 and = Evidence3 are sent to Verifier2.=20 >=20 > Verifier2 appears to also be a Relying Party-RP1 since Result1 is = being sent to it from Attester3. >=20 > Verifier2 to produce Result2 using Policy2 which is sent to RP2. > RP2 presumably evaluates Result2 using a risk management policy = (Policy3). >=20 > Possibly the use case can be summarized as follows (which is = isomorphic to Laurence's original expression): > Notation: ()Kx - signing using Kx > 0)Verifier 1 sends Nonce1 and Nonce2 to Attester1 and Attester2 = respectively. Verifier2-RP1 sends Nonce3 to Verifier1-Attester3. RP2 = sends Nonce4 to Verifier2-RP1. > 1) Attester1: (Evidence1, Nonce1)K1 =E2=80=94(IPC)=E2=80=94 > = Attester2 > 2) Attester2: ((Evidence1, Nonce1)K1, Evidence2, Nonce2)K2 =E2=80=94(TCP= /IP) =E2=80=94 > Verifier1-Attester3 (Note: Verifier1 and Attester3 are = roles on the same actor) > 3) Verifier1: Evaluates payload using Policy1 to produce (Result1, = Nonce3)K3 > 4) Attester3: Creates (Evidence3, Nonce3)K3 > 5) Verifier1-Attester3: (Result1, Evidence3, Nonce3)K3 =E2=80=94(TCP/IP)= =E2=80=94 > Verifier2-RP1 (Note: Again two roles belonging to the same = actor) > 6) Verifier2: Evaluates payload Evidence3 using Policy2 to produce = (Result2a, Nonce4)K4 > 7) RP1: Evaluates payload Result1 using Policy2 to produce (Result2b, = Nonce4)K4 and/or takes some action. > 8) Verifier2-RP1: (Result2, Nonce4)K4 =E2=80=94(HTTPS/TCP/IP)=E2=80=94 = > RP2 > 9) RP2: Evaluates Result2 using Policy3 and takes some action. > [block-NMS] >=20 > The first two attesters are on the entity / device that is the = subject of the attestation. This would probably look like nested EAT = tokens.=20 > [nms] An important question is which key(s) are used to sign each = Attester's Evidence and each Verifier's Results. Does EAT token nesting = support multiple signatures and keys? Can EAT tokens distinguish between = Evidence and Results? >=20 > The first verifier is a service that might broker attestation from = multiple entity / device vendors. It outputs an EAT token that has made = some implied claims explicit and perhaps checked some claims against = known-good-values. > [nms] There could be a semantic difference between evaluated claims = vs. attested claims. The architecture draft would argue that RP may ONLY = process claims from a Verifier. If the payload contains claims from an = attester there must be a Verifier co-resident with the RP. Additionally, = claims from a verifier may be entirely different claims from those = supplied to it by attesters. This is why the architecture distinguishes = between Evidence and Results. Both could be expressed as sets of claims = (IMO). >=20 > The second verifier is the one that really relates to the relying = party. >=20 > Sometimes the connections are internal to a computing device, in = which case the trust and security are provided by the local OS. >=20 > Sometimes the connections are over IP in which case the claims are = likely secured by being in a EAT. > [nms] The architecture draft tries to distinguish these two cases as = local conveyance. Local conveyance is internal to the Actor environment. = Local conveyance isn't interesting to "Remote Attestation".=20 >=20 > In the last link in the example, the result is secured by HTTPS and = is probably internal to the RP. > [nms] I'm not sure if you are suggesting the last conveyance instance = (step 8) is local or remote.=20 >=20 > LL >=20 >=20 >=20 >=20 > _______________________________________________ > RATS mailing list > RATS@ietf.org > https://www.ietf.org/mailman/listinfo/rats >=20 >=20 From nobody Fri Aug 16 12:24:00 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 311411200C1 for ; Fri, 16 Aug 2019 12:23:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xzO2Kb5EDHxi for ; Fri, 16 Aug 2019 12:23:56 -0700 (PDT) Received: from p3plsmtpa11-10.prod.phx3.secureserver.net (p3plsmtpa11-10.prod.phx3.secureserver.net [68.178.252.111]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B0B801200C3 for ; Fri, 16 Aug 2019 12:23:56 -0700 (PDT) Received: from [10.171.0.234] ([45.56.150.129]) by :SMTPAUTH: with ESMTPA id yhpLhIoNZ798gyhpMhIIPP; Fri, 16 Aug 2019 12:23:56 -0700 From: Laurence Lundblade Content-Type: multipart/alternative; boundary="Apple-Mail=_2AEFA915-6648-4A25-9F55-D6010C6AF7F0" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Message-Id: Date: Fri, 16 Aug 2019 12:23:52 -0700 To: rats@ietf.org X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfAFPHqJrwSD6sB0hRMR5iKvNM59j7wIlz346zN6WzKmk19wvtPL6vhSNJX//tT5sojS59HJT2azvYZtt6lo8SJfuiyJjWowKL2DgVRyG6oNqeal0Yckg LHt3uMk67eVLtjiFh6N1U9NubbdzuLz/bCZSX07JsYp3qf2294eEDzwV Archived-At: Subject: [Rats] Use the term "attester" instead of root of trust X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Aug 2019 19:23:58 -0000 --Apple-Mail=_2AEFA915-6648-4A25-9F55-D6010C6AF7F0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I propose we use the term =E2=80=9Cattester=E2=80=9D instead of root of = trust in RATS/EAT. We say something like this about an attester: While it is not required, for many implementations the attester will = involve a root of trust. It is also quite reasonable for profile = specifications for specific use cases to require a root of trust. This not a big divergence from the current definition of attester in = draft-birkholz-rats-architecture-01 = . To go on with some more comments on the current definition of attester > Attester: The producer of attestation evidence that has a root of > trust for reporting (RTR) As above, RTR should be optional > and implements a conveyance protocol, Conveyance protocol should be outside the attester so the token/evidence = can be put into extensions in existing protocols, HTTP headers =E2=80=A6 > authenticates using an attestation credential, > consumes assertions about itself I=E2=80=99m not sure where people think the attester boundary is. I = think it is OK for the attester to take in claims from lots of different = places, even those less-secure than the attestation signing keys as long = as they are labeled as such. For example, the Qualcomm implementation = runs in the TEE, but takes in claims from the Android app that requests = the attestation. I think we want to accommodate something running in the cloud that = checks reference values and knows about implicit claims. It might be a = middle man between chip makers and relying parties so that every relying = party doesn=E2=80=99t have to know about every chip maker. It may output = signed EATs. If we call this an attester, the assertions are not about = itself. > and presents it to a consumer of evidence (e.g. a > relying party or a verifier). =20 > Every output of an attester can be appraised via reference values. This should not be required. Location, for example can=E2=80=99t compare = to a reference value. > 4.1.1 = . Attester Duties >=20 > o Acquisition or collection of assertions about itself Same comment as above related to =E2=80=9Citself=E2=80=9D. >=20 > o Provide or create proof that an assertion is bound to the = Attester >=20 > o Create Evidence from assertion bundles via roots-of-trust Same comment as above related to root of trust. LL --Apple-Mail=_2AEFA915-6648-4A25-9F55-D6010C6AF7F0 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 I = propose we use the term =E2=80=9Cattester=E2=80=9D instead of root of = trust in RATS/EAT. We say something like this about an attester:

While it is not = required, for many implementations the attester will involve a root of = trust. It is also quite reasonable for profile specifications for = specific use cases to require a root of trust.

This not a big divergence from the current = definition of attester in draft-birkholz-rats-architecture-01.



To go on with some more = comments on the current definition of attester

   Attester:  The producer of =
attestation evidence that has a root of
      trust for reporting (RTR)
As above, RTR should be optional

 and implements a conveyance protocol,

Conveyance protocol =
should be outside the attester so the token/evidence can be put into =
extensions in existing protocols, HTTP headers =E2=80=A6

authenticates using an attestation =
credential,

 consumes =
assertions about itself
I=E2=80=99=
m not sure where people think the attester boundary is. I think it is OK =
for the attester to take in claims from lots of different places, even =
those less-secure than the attestation signing keys as long as they are =
labeled as such. For example, the Qualcomm implementation runs in the =
TEE, but takes in claims from the Android app that requests the =
attestation.

I think we want to accommodate something running in =
the cloud that checks reference values and knows about implicit claims. =
It might be a middle man between chip makers and relying parties so that =
every relying party doesn=E2=80=99t have to know about every chip maker. =
It may output signed EATs. If we call this an attester, the assertions =
are not about itself.

 and =
presents it to a consumer of evidence (e.g. a
      relying party or a verifier).  

Every output of an attester can be =
appraised via reference values.
This should not be required. Location, for example can=E2=80=99=
t compare to a reference value.



4.1.1.  =
Attester Duties


   o  Acquisition or collection of assertions about itself

Same comment as above related to =
=E2=80=9Citself=E2=80=9D.


   o  Provide or create proof that an assertion is bound to the Attester

   o  Create Evidence from assertion bundles via =
roots-of-trust
Same comment as above related to root of =
trust.

LL





= --Apple-Mail=_2AEFA915-6648-4A25-9F55-D6010C6AF7F0-- From nobody Sun Aug 18 03:37:03 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 872EB120116 for ; Sun, 18 Aug 2019 03:37:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nokia.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wrWfsjrjLDUz for ; Sun, 18 Aug 2019 03:37:01 -0700 (PDT) Received: from EUR03-AM5-obe.outbound.protection.outlook.com (mail-eopbgr30096.outbound.protection.outlook.com [40.107.3.96]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 98BE8120114 for ; Sun, 18 Aug 2019 03:37:00 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=aqrEJ1S3qCVFxe8q5/Yafsn/2FyFoDnWfqQAkWIcv2YN3PA1XnRpM14RyyPJkdt9BKfz5MUXUDXVnLh8PAV0Wbi4fsK3wJOqZ6r4YFWFsR7e8u5/HCcPAZGUCOZL+evUD4JYXhdAiWZM1P8FLQio9g9qwhSyDGCcHkKM3kxMupXgfwV909xBPNkQ75Pa0JYGh17cOAmkn3cXQzhIrAKPJ8PI5+ZLr8hr9XyfABG+W79YWqBFV27iG657jUWCg75kkPd2iKEFQab3hLwJdD7Bdn2Dg/wDRXkSgaOMmMOAc5JkXZKZLbknhNHAWui4Tjni5t8jXD9GKbJAyvNscVNoIQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Q9qyhrhB9Qc3qz3SDILZ8X4nafeMpv1vI7+KlVZDs8I=; b=UXvE/HXF0f/Svj7DNMmnLIYED/DYZaxkhQULFiIGphmztDbXQKUEf74xPG38GkPTf8L/WOHTzzI9zucswTF0GC5nSEvaanmkY55M75AJK0I711PjqGsduaua/cFbpem05NQc53OwbyH7EmGHFdneOWb+sJqnQZJCWm/0zCC2g7zYXjx5GsNv6rHqftmKOFZt92BUmQzmE01zG0yBKxbw858hpir1cAOCwDBW+I/BNghOmo3KrsTYQDcyn/5asozWD+dOLoVa+oPJQREtRD8yNtQIcqBEx3KWF+swU9o9evZVnv9lLbLEWEl+P+mknkX29sSKHOFFxgmJkMxKwFW4lg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nokia-bell-labs.com; dmarc=pass action=none header.from=nokia-bell-labs.com; dkim=pass header.d=nokia-bell-labs.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nokia.onmicrosoft.com; s=selector1-nokia-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Q9qyhrhB9Qc3qz3SDILZ8X4nafeMpv1vI7+KlVZDs8I=; b=trhu25fJlT4wqXjD8Jn5Mo6/q9zKZAPhvcXxlsP2bH/KIrZ3qK1x6xmr/0GlbbYkrrOAXz9grOwOdj65n9eFI0ikns5KL9x/6drmqoOv7Qno7/V0M1VYnNHgK9Nm5NKkFYybM5i8U8I6iUX2gxCKHSP8x3FnrG2m3oKJCDKVYbE= Received: from HE1PR0701MB2267.eurprd07.prod.outlook.com (10.168.35.143) by HE1PR0701MB2185.eurprd07.prod.outlook.com (10.168.35.149) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2178.14; Sun, 18 Aug 2019 10:36:57 +0000 Received: from HE1PR0701MB2267.eurprd07.prod.outlook.com ([fe80::c17b:6cc3:5587:cab0]) by HE1PR0701MB2267.eurprd07.prod.outlook.com ([fe80::c17b:6cc3:5587:cab0%6]) with mapi id 15.20.2178.018; Sun, 18 Aug 2019 10:36:57 +0000 From: "Oliver, Ian (Nokia - FI/Espoo)" To: Laurence Lundblade , "rats@ietf.org" Thread-Topic: [Rats] Use the term "attester" instead of root of trust Thread-Index: AQHVVS4WI4XPPc1sEkCSZl6MK+2UpqcAt1RG Date: Sun, 18 Aug 2019 10:36:57 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=ian.oliver@nokia-bell-labs.com; x-originating-ip: [131.228.2.20] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: d5446bce-37f2-4aaf-46ab-08d723c7feb9 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:HE1PR0701MB2185; x-ms-traffictypediagnostic: HE1PR0701MB2185: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:1923; x-forefront-prvs: 01334458E5 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(39860400002)(396003)(376002)(346002)(366004)(136003)(189003)(199004)(6246003)(5660300002)(53936002)(8676002)(7696005)(52536014)(76176011)(26005)(102836004)(6506007)(19627405001)(7736002)(33656002)(81156014)(74316002)(6116002)(3846002)(99286004)(14454004)(66066001)(9686003)(2906002)(54896002)(8936002)(558084003)(81166006)(55016002)(25786009)(478600001)(316002)(110136005)(229853002)(6436002)(64756008)(76116006)(66446008)(66476007)(66946007)(66556008)(11346002)(446003)(476003)(2501003)(186003)(256004)(86362001)(486006)(71190400001)(71200400001)(105004); DIR:OUT; SFP:1102; SCL:1; SRVR:HE1PR0701MB2185; H:HE1PR0701MB2267.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:0; received-spf: None (protection.outlook.com: nokia-bell-labs.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: TRFTTmw/lK+kQD0pRhWxNc2TuYTmT+0hN+gg3qaZCNHNbqJAmSEJj/ZPAE8OhjzbLY+LhLRituOlewdtwRm+7qAvXonfG+aUJ3N3xqnUvXl71nYMzkB1Fbg13cHK853vJLHaCSmLiwIInCm3SuvfmVUVGOGrTJS7dqbzKT6SspAm0+8Wwnmpu1IMBdLJX9wv6R/FjtrSkV5k9ZjCPPEIhx964Un6q0YFb2A5hgOu83ISYdXpFi+D6PRffYT2PHQt1kiGB6L95INZ9dEAZ8zvigKG9pGkRCdC+5yKyIr+bulmIffCzGEW5lcCcC2PgEJ/LqmZ8SOK7Xiq36h6+79mbR97GgcSot8EG+oU0khh49EQKA13X+o9L5PNZaiMwhiDZxhLSdcF11xtCAtmOjMbpXECBqoOxbvSROY9p1gCihw= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_HE1PR0701MB2267DBF85CE058187F5DDDAD8FA90HE1PR0701MB2267_" MIME-Version: 1.0 X-OriginatorOrg: nokia-bell-labs.com X-MS-Exchange-CrossTenant-Network-Message-Id: d5446bce-37f2-4aaf-46ab-08d723c7feb9 X-MS-Exchange-CrossTenant-originalarrivaltime: 18 Aug 2019 10:36:57.3154 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5d471751-9675-428d-917b-70f44f9630b0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: jijcHaEd3jyieAt48sF6A4DmD6rcDQiB254nQTXnP4/RRhCn6fP/zlgvZGMta+CbLgGCVmkhDjYk2Al0S3Qnq3m/NxMyE/sSwdwKmAyKGkk= X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0701MB2185 Archived-At: Subject: Re: [Rats] Use the term "attester" instead of root of trust X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 18 Aug 2019 10:37:02 -0000 --_000_HE1PR0701MB2267DBF85CE058187F5DDDAD8FA90HE1PR0701MB2267_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable -- Dr. Ian Oliver Cybersecurity Research Distinguished Member of Technical Staff Nokia Bell Labs +358 50 483 6237 --_000_HE1PR0701MB2267DBF85CE058187F5DDDAD8FA90HE1PR0701MB2267_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable


--

Dr. Ian Oliver

Cybersecurity Research

Distinguished Member of Technical Staff

Nokia Bell Labs

+358 50 483 6237

--_000_HE1PR0701MB2267DBF85CE058187F5DDDAD8FA90HE1PR0701MB2267_-- From nobody Sun Aug 18 03:58:49 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 257FB12022D for ; Sun, 18 Aug 2019 03:58:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nokia.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id giygJLebC8z8 for ; Sun, 18 Aug 2019 03:58:38 -0700 (PDT) Received: from EUR04-HE1-obe.outbound.protection.outlook.com (mail-eopbgr70103.outbound.protection.outlook.com [40.107.7.103]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 596A3120147 for ; Sun, 18 Aug 2019 03:58:37 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=d9eq7i4mpTKg76V58f9q2TtXeh+GZs0cSChAXqD07aq6Z8e+IbBTJ0sXvjZlN79M8h1kpzCI+jL+bIlzHprv8ZlsrVPPskEWy5jjXrWqYMlkeyoHlBGTCLwOlQLZ3ZT2Zi6u+y2JOTb30zr3kbWJ8vKJkKtiUOMdk+HxHWokOJszh6BLqiQ1Rg6OY3I/M5rNjrQaBfrxCCE0uIBS8vG5IjePoThJp2yWcrdhCCnVVwRbMikqFcrIqjGRPKWBvHefi7ImO9yi4s5XInh0xqhuEatmrc7VO+poX69i0FQO3TPty/H1cqV85v06Od3UzTOH7UeZleBS0EXKn08I0U1uzw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ZgJ4kAJRxgC97nPVnFyR4GENIxX4ReC2+9yFNFWMpEo=; b=LbTogXipbUJpomuM2Hl4qgrO+fXJ8L1wxm8nNBmKy3Lyf9rL3Qa59xAWxdSbNi7vGz16saUfTl3RUVQafFpEtCZhVYjgkNLIKJ6Buw25e9axfpO65SuZjv9mlrcFs91ZljtI4J9F8q0UQqXR5ke6MmzJ0BvNrOSTBu/OL52ndnFYnHpUptuz5D/N7nVf664FI8n9hfk+WIlcnFkEl1LLr0NobTtBqQDh+Yuhx5i2rvTEF4dbJY9EGKciuxGEymVA4l8OQ7Lx6o8hglaJ6MeY6nKPvgL8zYAX4Fr5lBXgMvmcZchJI2To29LvpoSpV8sZ+JA7OVdO74Fi4mjDWuDcUg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nokia-bell-labs.com; dmarc=pass action=none header.from=nokia-bell-labs.com; dkim=pass header.d=nokia-bell-labs.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nokia.onmicrosoft.com; s=selector1-nokia-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ZgJ4kAJRxgC97nPVnFyR4GENIxX4ReC2+9yFNFWMpEo=; b=dGnsv+A0pKIJoUQ2E/4uvb+/LyP3yalRs2kaKayfpRQZLwi7BCMRucaPhuDLx4ori0chgVKamb2tKm7D1ejtTeyHzrOslHEZnoP53qo1HrM7WXAWyIEICwpORNxLilowXn2L/6OhT52qhBcf4ei/oaqAgG9DrhHxL0DoiK8fwvU= Received: from HE1PR0701MB2267.eurprd07.prod.outlook.com (10.168.35.143) by HE1PR0701MB2651.eurprd07.prod.outlook.com (10.168.187.20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2199.9; Sun, 18 Aug 2019 10:58:34 +0000 Received: from HE1PR0701MB2267.eurprd07.prod.outlook.com ([fe80::c17b:6cc3:5587:cab0]) by HE1PR0701MB2267.eurprd07.prod.outlook.com ([fe80::c17b:6cc3:5587:cab0%6]) with mapi id 15.20.2178.018; Sun, 18 Aug 2019 10:58:34 +0000 From: "Oliver, Ian (Nokia - FI/Espoo)" To: Laurence Lundblade , "rats@ietf.org" Thread-Topic: [Rats] Use the term "attester" instead of root of trust Thread-Index: AQHVVS4WI4XPPc1sEkCSZl6MK+2UpqcAtxSf Date: Sun, 18 Aug 2019 10:58:34 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=ian.oliver@nokia-bell-labs.com; x-originating-ip: [131.228.2.20] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 7948f1d4-e0d9-4c07-6eb2-08d723cb03a9 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:HE1PR0701MB2651; x-ms-traffictypediagnostic: HE1PR0701MB2651: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:5516; x-forefront-prvs: 01334458E5 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(396003)(366004)(376002)(136003)(39860400002)(346002)(189003)(199004)(5660300002)(33656002)(19627405001)(6246003)(14454004)(478600001)(7696005)(186003)(76176011)(7736002)(6506007)(55016002)(102836004)(6436002)(26005)(229853002)(9686003)(54896002)(476003)(11346002)(86362001)(4744005)(25786009)(446003)(486006)(74316002)(66066001)(105004)(256004)(99286004)(66946007)(66476007)(66556008)(71200400001)(71190400001)(64756008)(76116006)(3846002)(6116002)(53936002)(316002)(8676002)(81156014)(81166006)(2906002)(8936002)(2501003)(52536014)(110136005)(66446008); DIR:OUT; SFP:1102; SCL:1; SRVR:HE1PR0701MB2651; H:HE1PR0701MB2267.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:0; received-spf: None (protection.outlook.com: nokia-bell-labs.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: rR4cSbjekFVHptsfxlejAGaRCttl1d+bCmdZjB7ecqHSfMhn7YxsmTgc2g5Inlh7bJCXyFrMcBoJqDtz0ZWqHb4zTYevz/owgIAaoTtDNa7Jme7eMNeDDN6jvrmmPAQOhBl1l43AzgpuF3sIf0n+MikOxyJ6cssjGL5zf5ebhA3c2+whiSpYePpvynlTLwCiqa2tVon3ojNHVuAhEve/Uml5ZKt428ve3fa+srVgzxmhfW8eU++IeSrUc1iV5x8UXBIW5+TMlMBRrMIFilVZmvsaSAi/AGpO58YAbCh792z+zAKgSkmOYp4UxAKW1hJEIvtyQeDM1DzRc2TZ+S0FcD0koE+hQ2ugG/Rjl0yLLXGaMwGbykzXmefOmTQhuKjyzjwjyaf3/J2ZanY66q129SfRvNBmG00SX8ul7/FKHbo= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_HE1PR0701MB2267E350D17B31CA364B5A108FA90HE1PR0701MB2267_" MIME-Version: 1.0 X-OriginatorOrg: nokia-bell-labs.com X-MS-Exchange-CrossTenant-Network-Message-Id: 7948f1d4-e0d9-4c07-6eb2-08d723cb03a9 X-MS-Exchange-CrossTenant-originalarrivaltime: 18 Aug 2019 10:58:34.1943 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5d471751-9675-428d-917b-70f44f9630b0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: QmqzXxOpAKCTGjuY6N8C/20hhmuaBmNBDO+6YUN9ySGNb3Q0+7Xs+J59T+3E4YlrY+D7miHWNdS55871N6uPyJLhQwfSVthM9PogmIPcxSQ= X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0701MB2651 Archived-At: Subject: Re: [Rats] Use the term "attester" instead of root of trust X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 18 Aug 2019 10:58:48 -0000 --_000_HE1PR0701MB2267E350D17B31CA364B5A108FA90HE1PR0701MB2267_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable I'm just trying to put this into some more familiar architectural terms tha= t we have implemented. So for example, we have an attestation server (AS) t= hat can connect to a daemon running on, say, some servers/IoT devices/eleme= nts with TPMs. Do I understand that the elements above are claimants and that the AS takes= the roles of attester, verifier and authentication checker, while the daem= on interpreting and responding to requests from the AS is the relaying part= y? The data returned from the element (the claimant via the daemon) is, ostens= ibly an EAT, though in our case is a body of data that contains the TPMS_AT= TEST structure + meta-data. Further, do I understand that the attester may have itself a root-of-trust,= thus becoming in the case where it does, a claimant in its own right? t. Ian -- Dr. Ian Oliver Cybersecurity Research Distinguished Member of Technical Staff Nokia Bell Labs +358 50 483 6237 --_000_HE1PR0701MB2267E350D17B31CA364B5A108FA90HE1PR0701MB2267_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
I'm just trying to put this into some more familiar architectura= l terms that we have implemented. So for example, we have an attestation se= rver (AS) that can connect to a daemon running on, say, some servers/IoT de= vices/elements with TPMs.

Do I understand that the elements above are claimants and that the AS = takes the roles of attester, verifier and authentication checker, while the= daemon interpreting and responding to requests from the AS is the relaying= party?

The data returned from the element (the claimant via the daemon) is, o= stensibly an EAT, though in our case is a body of data that contains the TP= MS_ATTEST structure + meta-data.

Further, do I understand that the attester may have itself a root-of-= trust, thus becoming in the case where it does, a claimant in its own right= ?

t.

Ian

--

Dr. Ian Oliver

Cybersecurity Research

Distinguished Member of Technical Staff

Nokia Bell Labs

+358 50 483 6237

--_000_HE1PR0701MB2267E350D17B31CA364B5A108FA90HE1PR0701MB2267_-- From nobody Sun Aug 18 11:16:58 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CA813120143 for ; Sun, 18 Aug 2019 11:16:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Dfef57MeQvWu for ; Sun, 18 Aug 2019 11:16:54 -0700 (PDT) Received: from p3plsmtpa12-04.prod.phx3.secureserver.net (p3plsmtpa12-04.prod.phx3.secureserver.net [68.178.252.233]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 55C90120133 for ; Sun, 18 Aug 2019 11:16:54 -0700 (PDT) Received: from [10.171.0.46] ([45.56.150.129]) by :SMTPAUTH: with ESMTPA id zPjYhnhKgJL4fzPjZhvSAA; Sun, 18 Aug 2019 11:16:53 -0700 From: Laurence Lundblade Message-Id: <3F5C57F7-C75F-4C27-9898-25AF98237DE9@island-resort.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_6D017EE8-0814-48A5-A5A6-C8B847BA3F1B" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Sun, 18 Aug 2019 11:16:52 -0700 In-Reply-To: Cc: "rats@ietf.org" To: "Oliver, Ian (Nokia - FI/Espoo)" References: X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfHfLXcmmqyoNEx6uMDRl+/CA46obBiGIMZgeOcDN4sSqLY6n45YPEAKQWR+T3jf6BduGEjm/C6nvxSO1w1sFgJ1Ew6cdDofeNlEY2Wj3FLE4jV1CRZiX qJan46bEB6DhyRMXOUg5ZVod8Eyo3NBJnd2RBQ7jTuWdVjKsS9RLuHy2qT9uAmiBsOi03+KiD+S4E0iQpaZaGYMrR0mLqoXupYo= Archived-At: Subject: Re: [Rats] Use the term "attester" instead of root of trust X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 18 Aug 2019 18:16:57 -0000 --Apple-Mail=_6D017EE8-0814-48A5-A5A6-C8B847BA3F1B Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Here=E2=80=99s much of what I think defines an =E2=80=9Cattester": 1) It has some private / secret key material it uses to sign claims. = Usually this is an ECDSA private key, but it could be a symmetric key = used with a MAC. The RATS architecture document refers to this as an = =E2=80=9Cattestation credential=E2=80=9D and to the process of signing = as "Provide or create proof that an assertion is bound to the = Attester=E2=80=9D (by my understanding). 2) It outputs evidence. An EAT is evidence. Evidence is claims / = assertions that are signed so their authenticity can be checked by the = verifier.=20 The RATS architecture document doesn=E2=80=99t formally define evidence = (it really needs to), but usually depicts it as what goes from the = attester to the verifier. Also, everyone I have talked to personally = seems to use the term evidence in this way. 3) It is an implementation of EAT or some other attestation token = format. It is not a legal entity like a chip manufacturer or service = operator.=20 4) There is a notion of a boundary around the attester. The boundary = might the TEE boundary, a user mode / kernel mode boundary, inside a TPM = vs outside a TPM chip or simply the bounds of an Android app. The key = material and signing implementation are inside this boundary. (IMO most = definitions of root of trust seem to lack this concept).=20 5) For most implementations, the claims originate inside the boundary, = but that is not required. I don=E2=80=99t understand the term claimant yet, so I=E2=80=99m going = avoid it. > On Aug 18, 2019, at 3:58 AM, Oliver, Ian (Nokia - FI/Espoo) = wrote: >=20 > I'm just trying to put this into some more familiar architectural = terms that we have implemented. So for example, we have an attestation = server (AS) that can connect to a daemon running on, say, some = servers/IoT devices/elements with TPMs. If I=E2=80=99m understanding right, your =E2=80=9CAS" is actually the = RATS verifier and/or RATS relying party. Your =E2=80=9Cdaemon" is the = RATS attester. It is the server/IoT devices/elements that you are trying to evaluate = for trustworthiness. The claims and assertions are about these, right? = They are the ones that have the secret signing keys, right? There is a signed data structure that goes from the server/IoT = devices/elements to the AS. That is the evidence.=20 The AS receives the evidence and has public key material to evaluate the = signature. (Pardon if I=E2=80=99ve gone on too long, just trying to be clear) LL >=20 > Do I understand that the elements above are claimants and that the AS = takes the roles of attester, verifier and authentication checker, while = the daemon interpreting and responding to requests from the AS is the = relaying party? >=20 > The data returned from the element (the claimant via the daemon) is, = ostensibly an EAT, though in our case is a body of data that contains = the TPMS_ATTEST structure + meta-data. >=20 > Further, do I understand that the attester may have itself a = root-of-trust, thus becoming in the case where it does, a claimant in = its own right? >=20 > t. >=20 > Ian >=20 > --=20 > Dr. Ian Oliver > Cybersecurity Research > Distinguished Member of Technical Staff > Nokia Bell Labs > +358 50 483 6237 > _______________________________________________ > RATS mailing list > RATS@ietf.org > https://www.ietf.org/mailman/listinfo/rats = --Apple-Mail=_6D017EE8-0814-48A5-A5A6-C8B847BA3F1B Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
Here=E2=80=99s much of what I think defines an = =E2=80=9Cattester":

1) It has some = private / secret key material it uses to sign claims. Usually this is an = ECDSA private key, but it could be a symmetric key used with a MAC. The = RATS architecture document refers to this as an =E2=80=9Cattestation = credential=E2=80=9D and to the process of signing as "Provide or create = proof that an assertion is bound to the Attester=E2=80=9D (by my = understanding).

2) It outputs evidence. An EAT is evidence. Evidence is claims / = assertions that are signed so their authenticity can be checked by the = verifier. 
The RATS architecture document doesn=E2=80=99t = formally define evidence (it really needs to), but usually depicts it as = what goes from the attester to the verifier. Also, everyone I have = talked to personally seems to use the term evidence in this = way.

3) It is an implementation of EAT or = some other attestation token format. It is not a legal entity like a = chip manufacturer or service operator. 

4) There is a notion of a boundary around the = attester. The boundary might the TEE boundary, a user mode / kernel mode = boundary, inside a TPM vs outside a TPM chip or simply the bounds of an = Android app. The key material and signing implementation are inside this = boundary. (IMO most definitions of root of trust seem to lack this = concept). 

5) For most = implementations, the claims originate inside the boundary, but that is = not required.

I = don=E2=80=99t understand the term claimant yet, = so I=E2=80=99m going avoid it.


On Aug 18, 2019, at 3:58 AM, Oliver, Ian (Nokia - FI/Espoo) = <ian.oliver@nokia-bell-labs.com> wrote:

I'm just trying to put this into some more familiar = architectural terms that we have implemented. So for example, we have an = attestation server (AS) that can connect to a daemon running on, say, = some servers/IoT devices/elements with TPMs.

If I=E2=80=99m understanding right, your =E2=80=9CAS= " is actually the RATS verifier and/or RATS relying party. Your = =E2=80=9Cdaemon" is the RATS attester.

It is the server/IoT devices/elements that you are = trying to evaluate for trustworthiness. The claims and assertions are = about these, right? They are the ones that have the secret signing keys, = right?

There is a signed data = structure that goes from the server/IoT devices/elements to the AS. That = is the evidence. 

The AS = receives the evidence and has public key material to evaluate the = signature.

(Pardon if I=E2=80=99ve = gone on too long, just trying to be clear)

LL



Do I understand that the elements above are claimants = and that the AS takes the roles of attester, verifier and authentication = checker, while the daemon interpreting and responding to requests from = the AS is the relaying party?

The data returned from the element (the claimant via = the daemon) is, ostensibly an EAT, though in our case is a body of data = that contains the TPMS_ATTEST structure + meta-data.

Further, do I understand that the = attester may have itself a root-of-trust, thus becoming in the case = where it does, a claimant in its own right?

t.

Ian

-- 
Dr. Ian Oliver
Cybersecurity Research
Distinguished Member of Technical Staff
Nokia Bell = Labs
+358 50 483 6237
_______________________________________________
RATS mailing list
RATS@ietf.org
https://www.ietf.org/mailman/listinfo/rats

= --Apple-Mail=_6D017EE8-0814-48A5-A5A6-C8B847BA3F1B-- From nobody Mon Aug 19 10:28:27 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9C5F1120089 for ; Mon, 19 Aug 2019 10:28:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=mP8Jcg3w; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=VYITlhJw Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DBNuUSJA-9aH for ; Mon, 19 Aug 2019 10:28:23 -0700 (PDT) Received: from alln-iport-3.cisco.com (alln-iport-3.cisco.com [173.37.142.90]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6316A120096 for ; Mon, 19 Aug 2019 10:28:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=3803; q=dns/txt; s=iport; t=1566235703; x=1567445303; h=from:to:subject:date:message-id:mime-version; bh=GoZ/4dGKD3Zgb03hRkVYaVNWSn9gH6kSbmCJqvxnkBs=; b=mP8Jcg3wKRBX1wTlM/Gftq9ovnQn1qU3ZF6sd5G3QwUwg7Vd4bUyWGWr snUU7rwVl+QOBD/eZcqKpaCDae/bVqBYTsdOpA1A2093swQBLNJBNbs2q vK8q8Muk8+CmA2nXOfe993auKJbbjCzst2+yYvV1wdwuA+vp03K0R7Reg o=; IronPort-PHdr: =?us-ascii?q?9a23=3Ap6bwRhayXB30zm9KzoyivK3/LSx94ef9IxIV55?= =?us-ascii?q?w7irlHbqWk+dH4MVfC4el20gabRp3VvvRDjeee87vtX2AN+96giDgDa9QNMn?= =?us-ascii?q?1NksAKh0olCc+BB1f8KavsZCU/A8VEW3du/mqwNg5eH8OtL1A=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0ACAQCd21pd/4oNJK1mHQEBBQEHBQG?= =?us-ascii?q?BVQYBCwGBFS9QA21VIAQLKoQfg0cDinpNlRqEWoEugSQDVAkBAQEMAQEtAgE?= =?us-ascii?q?BhFiDDQIjNgcOAgMBAQEBBAEBAQIBBgRthScBC4VjER0BATgRAQw+AgQwJwQ?= =?us-ascii?q?1gwABgR1NAx0Bn2sCgTiIYXOBMoJ6AQEFgkeCRhiCFAmBNAGLaBeBf4E4H4p?= =?us-ascii?q?ZMoImjC2CaIUPiQKOLwkCgh2UORuYRI1amAsCBAIEBQIOAQEFgVcGK4FYcBV?= =?us-ascii?q?lAYJBUBAUgU6DcopSAXKBKY1EAQE?= X-IronPort-AV: E=Sophos;i="5.64,404,1559520000"; d="scan'208,217";a="322512366" Received: from alln-core-5.cisco.com ([173.36.13.138]) by alln-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 19 Aug 2019 17:28:14 +0000 Received: from XCH-RCD-003.cisco.com (xch-rcd-003.cisco.com [173.37.102.13]) by alln-core-5.cisco.com (8.15.2/8.15.2) with ESMTPS id x7JHSB5R006386 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL) for ; Mon, 19 Aug 2019 17:28:12 GMT Received: from xhs-rcd-001.cisco.com (173.37.227.246) by XCH-RCD-003.cisco.com (173.37.102.13) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Mon, 19 Aug 2019 12:28:11 -0500 Received: from xhs-aln-001.cisco.com (173.37.135.118) by xhs-rcd-001.cisco.com (173.37.227.246) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Mon, 19 Aug 2019 12:28:11 -0500 Received: from NAM01-BN3-obe.outbound.protection.outlook.com (173.37.151.57) by xhs-aln-001.cisco.com (173.37.135.118) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Mon, 19 Aug 2019 12:28:11 -0500 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=RI+7vYQBggb0Lq09as8OTYI8l8s+9/MYYG+5ZayTi9cVc4ySyQeImByBkJ1Z8LEHuaW4aoH2tWLXCnNlMtsdzk9KVe14Ke/EheUlFS2iP05uqIRUTjsKoVsXvXXmN4+/ZFCVzUnS9xdAun3q5aWElwHgJf69E+DpbErj1DRJMjUAKORwz4SP8gFYNi5/Zi+EzKJeHka3ZxKFIcIwm1zfCJ+xZR3voao4CP+PJfUXXRMXvj03UXx8wPHjaoYQci+8dBsxcm8E/qHnrcVTkIdPB9bskcK+YURe/8FFYSEh1g+/bEHy4BG0ADhCupywFMQABMDI6Qf/um130Qkg3CBk5g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=GoZ/4dGKD3Zgb03hRkVYaVNWSn9gH6kSbmCJqvxnkBs=; b=cZMujlNP0/Dk9CdtXrVVkRhyAHHij6weCtoIOhWiew1uEyYtzXYjdivPLYXJmaPl2zj7sYh/86jsUHNRkXEMc2qWYZOTdGt2H0J1f1Zj9nDQfOeDY909C/dyMPY08SuaioNaxlRPaFF+y2c5T8fpmNnjrWLfgo2xctG8LlMvQiKUPW0f9toMIio2uTOhfz4qsoHUJKxVz3neg5OZfxqwydODYujZT0Mu4AJcoqv1Xy+Rcy2tAROyv1gQRNiuro6p6puKDkD5zVUBZ4DLi+lZ0aHE/4lELOBvOOHRV+9EIIgDOZbckxPlLIo23lv6A40m49gRPe7SsIZozCVxc77dew== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=GoZ/4dGKD3Zgb03hRkVYaVNWSn9gH6kSbmCJqvxnkBs=; b=VYITlhJwNI7gbVgZou1WlcOwyAvHzjxmccuM1L080TrDB4HHtwkdbfBjOJQBnJWAKHwe0mdBCEENAvo44cYnMEMP+3SczA/Q4tBWKbThD3+fUQ7ZxJAQxGFOjKojC5DdttG69SQh2oAsma7OQ1aMP9cOc4YAhr+rnJRwvXHAhaM= Received: from MWHPR11MB1791.namprd11.prod.outlook.com (10.175.53.138) by MWHPR11MB1776.namprd11.prod.outlook.com (10.175.54.14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2178.16; Mon, 19 Aug 2019 17:28:09 +0000 Received: from MWHPR11MB1791.namprd11.prod.outlook.com ([fe80::a9d8:d4d6:df7b:5c84]) by MWHPR11MB1791.namprd11.prod.outlook.com ([fe80::a9d8:d4d6:df7b:5c84%8]) with mapi id 15.20.2178.018; Mon, 19 Aug 2019 17:28:09 +0000 From: "Nancy Cam-Winget (ncamwing)" To: "rats@ietf.org" Thread-Topic: Virtual Interim dates Thread-Index: AQHVVrN463eZl4Bk+EKM+Pxeamm0yA== Date: Mon, 19 Aug 2019 17:28:09 +0000 Message-ID: <6D7BFC83-F073-4A0D-9EBF-B22E1BD8FBB7@cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.10.c.190715 authentication-results: spf=none (sender IP is ) smtp.mailfrom=ncamwing@cisco.com; x-originating-ip: [2001:420:2ca:4411:4de8:2070:ee4a:a315] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 1b76e706-7507-468d-c7e7-08d724ca9ae6 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600148)(711020)(4605104)(1401327)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7193020); SRVR:MWHPR11MB1776; x-ms-traffictypediagnostic: MWHPR11MB1776: x-ms-exchange-purlcount: 2 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8273; x-forefront-prvs: 0134AD334F x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(396003)(39860400002)(366004)(136003)(346002)(376002)(199004)(189003)(54164003)(5660300002)(6436002)(476003)(46003)(2616005)(86362001)(66476007)(486006)(91956017)(71190400001)(71200400001)(64756008)(66946007)(76116006)(66446008)(66556008)(102836004)(36756003)(186003)(6506007)(256004)(7116003)(53936002)(8676002)(6486002)(33656002)(6512007)(54896002)(6306002)(5640700003)(14454004)(6916009)(1730700003)(81156014)(8936002)(81166006)(2351001)(2501003)(3480700005)(478600001)(25786009)(316002)(7736002)(6116002)(58126008)(2906002)(558084003)(99286004); DIR:OUT; SFP:1101; SCL:1; SRVR:MWHPR11MB1776; H:MWHPR11MB1791.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: ZPlVmTCjzWDEyKPBfN9R1bPlsbb1jYpjXnCcv3/CEPxQVuzNFOiJc0XPeIYCNID1YPGhFQciDcQsXQzI+cIh0c7ouhZ8LRh16qJQ0nmg5NvTCQ4ErGHzrfcsh08Dekf5Utmq4WHed8iojhUGFbnd1vtQdofnkmqlWBfkh/QRH+5DQLePSZp5kV/hpSNgiXFhLNmDCCikowbATt5XHJgSUKxxE2nFdMrImiXhSwUMakfl84m77ibtYys+L7WyG5lMxsLp98uNqfTBzJZE7MvaMFdpRn+QML8h3yiJsP3T+fD6C5N8BhiHtLuqZmZUkIqXAghCp9miHoILv2H1bYk3CpoWqYboBI1sx6KlmGtj+a40/p3OKnkNSd1AkgqVCoWIYJNbyhc2huWo/zeWMnxEcgsB1xbWfICaG1mOMGZiuJo= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_6D7BFC83F0734A0D9EBFB22E1BD8FBB7ciscocom_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 1b76e706-7507-468d-c7e7-08d724ca9ae6 X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Aug 2019 17:28:09.5194 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: tl9BFLQxNeqoxwSr0AWpGgZ5p3zwLpdvrWOuMBt1Qp6TNwY8+b3pk+/L2EI+Cfi0L6MkQC/B/yIMt38Wypujww== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR11MB1776 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.102.13, xch-rcd-003.cisco.com X-Outbound-Node: alln-core-5.cisco.com Archived-At: Subject: [Rats] Virtual Interim dates X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Aug 2019 17:28:26 -0000 --_000_6D7BFC83F0734A0D9EBFB22E1BD8FBB7ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhhbmtzIHRvIGFsbCB3aG8gcGFydGljaXBhdGVkIGluIHRoZSBEb29kbGUgUG9sbCwgd2Ugd2ls bCBoYXZlIHR3byB2aXJ0dWFsIGludGVyaW0gc2Vzc2lvbnMgb24NClNlcHQgMTAgN2FtUFNUICAg YW5kICAgT2N0IDggNzozMGFtUFNUIGZvciA5MG1pbiBlYWNoLg0KDQpNb3JlIGRldGFpbHMgdG8g Y29tZSBzb29uIQ0KDQpXYXJtIHJlZ2FyZHMsDQogICBOYW5jeSAob24gYmVoYWxmIG9mIHRoZSBS QVRzIGNoYWlycykNCg0K --_000_6D7BFC83F0734A0D9EBFB22E1BD8FBB7ciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: <26A825A11EFC6841BC90EEEB34886EB6@namprd11.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3Jt YWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOiMwNTYzQzE7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9 DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOiM5NTRGNzI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpz cGFuLkVtYWlsU3R5bGUxNw0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1jb21wb3NlOw0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1z b0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6 IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4g MTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rp b24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9keSBs YW5nPSJFTi1VUyIgbGluaz0iIzA1NjNDMSIgdmxpbms9IiM5NTRGNzIiPg0KPGRpdiBjbGFzcz0i V29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0Ij5UaGFua3MgdG8gYWxsIHdobyBwYXJ0aWNpcGF0ZWQgaW4gdGhlIERvb2RsZSBQ b2xsLCB3ZSB3aWxsIGhhdmUgdHdvIHZpcnR1YWwgaW50ZXJpbSBzZXNzaW9ucyBvbjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6MTEuMHB0O2NvbG9yOmJsYWNrIj5TZXB0IDEwIDdhbVBTVCAmbmJzcDsmbmJzcDthbmQgJm5i c3A7Jm5ic3A7T2N0IDggNzozMGFtUFNUIGZvciA5MG1pbiBlYWNoLjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+TW9yZSBkZXRhaWxzIHRvIGNvbWUgc29vbiE8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPldhcm0gcmVnYXJkcyw8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdCI+Jm5ic3A7Jm5ic3A7IE5hbmN5IChvbiBiZWhhbGYgb2YgdGhlIFJBVHMg Y2hhaXJzKTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_6D7BFC83F0734A0D9EBFB22E1BD8FBB7ciscocom_-- From nobody Mon Aug 19 11:58:20 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CB2CA120885 for ; Mon, 19 Aug 2019 11:58:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cMHVL8PKfj7p for ; Mon, 19 Aug 2019 11:58:16 -0700 (PDT) Received: from mga17.intel.com (mga17.intel.com [192.55.52.151]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0841D120877 for ; Mon, 19 Aug 2019 11:58:15 -0700 (PDT) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga008.jf.intel.com ([10.7.209.65]) by fmsmga107.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 19 Aug 2019 11:58:15 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.64,405,1559545200"; d="scan'208,217";a="172211854" Received: from orsmsx108.amr.corp.intel.com ([10.22.240.6]) by orsmga008.jf.intel.com with ESMTP; 19 Aug 2019 11:58:14 -0700 Received: from orsmsx121.amr.corp.intel.com (10.22.225.226) by ORSMSX108.amr.corp.intel.com (10.22.240.6) with Microsoft SMTP Server (TLS) id 14.3.439.0; Mon, 19 Aug 2019 11:58:14 -0700 Received: from orsmsx109.amr.corp.intel.com ([169.254.11.25]) by ORSMSX121.amr.corp.intel.com ([169.254.10.173]) with mapi id 14.03.0439.000; Mon, 19 Aug 2019 11:58:14 -0700 From: "Smith, Ned" To: Laurence Lundblade , "Oliver, Ian (Nokia - FI/Espoo)" CC: "rats@ietf.org" Thread-Topic: [Rats] Use the term "attester" instead of root of trust Thread-Index: AQHVVGg+OnGyLZ7bikigtz9osO2brqcBNEoAgAB6dQCAASiKgA== Date: Mon, 19 Aug 2019 18:58:13 +0000 Message-ID: <10825C3E-81E0-43A9-B529-28E7C501E098@intel.com> References: <3F5C57F7-C75F-4C27-9898-25AF98237DE9@island-resort.com> In-Reply-To: <3F5C57F7-C75F-4C27-9898-25AF98237DE9@island-resort.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1c.0.190812 x-originating-ip: [10.24.14.103] Content-Type: multipart/alternative; boundary="_000_10825C3E81E043A9B52928E7C501E098intelcom_" MIME-Version: 1.0 Archived-At: Subject: Re: [Rats] Use the term "attester" instead of root of trust X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Aug 2019 18:58:19 -0000 --_000_10825C3E81E043A9B52928E7C501E098intelcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 U2VlIGlubGluZSBbbm1zXQ0KDQpPbiA4LzE4LzE5LCAxMToxNyBBTSwgIlJBVFMgb24gYmVoYWxm IG9mIExhdXJlbmNlIEx1bmRibGFkZSIgPHJhdHMtYm91bmNlc0BpZXRmLm9yZzxtYWlsdG86cmF0 cy1ib3VuY2VzQGlldGYub3JnPiBvbiBiZWhhbGYgb2YgbGdsQGlzbGFuZC1yZXNvcnQuY29tPG1h aWx0bzpsZ2xAaXNsYW5kLXJlc29ydC5jb20+PiB3cm90ZToNCg0KSGVyZeKAmXMgbXVjaCBvZiB3 aGF0IEkgdGhpbmsgZGVmaW5lcyBhbiDigJxhdHRlc3RlciI6DQoNCjEpIEl0IGhhcyBzb21lIHBy aXZhdGUgLyBzZWNyZXQga2V5IG1hdGVyaWFsIGl0IHVzZXMgdG8gc2lnbiBjbGFpbXMuIFVzdWFs bHkgdGhpcyBpcyBhbiBFQ0RTQSBwcml2YXRlIGtleSwgYnV0IGl0IGNvdWxkIGJlIGEgc3ltbWV0 cmljIGtleSB1c2VkIHdpdGggYSBNQUMuIFRoZSBSQVRTIGFyY2hpdGVjdHVyZSBkb2N1bWVudCBy ZWZlcnMgdG8gdGhpcyBhcyBhbiDigJxhdHRlc3RhdGlvbiBjcmVkZW50aWFs4oCdIGFuZCB0byB0 aGUgcHJvY2VzcyBvZiBzaWduaW5nIGFzICJQcm92aWRlIG9yIGNyZWF0ZSBwcm9vZiB0aGF0IGFu IGFzc2VydGlvbiBpcyBib3VuZCB0byB0aGUgQXR0ZXN0ZXLigJ0gKGJ5IG15IHVuZGVyc3RhbmRp bmcpLg0KDQoyKSBJdCBvdXRwdXRzIGV2aWRlbmNlLiBBbiBFQVQgaXMgZXZpZGVuY2UuIEV2aWRl bmNlIGlzIGNsYWltcyAvIGFzc2VydGlvbnMgdGhhdCBhcmUgc2lnbmVkIHNvIHRoZWlyIGF1dGhl bnRpY2l0eSBjYW4gYmUgY2hlY2tlZCBieSB0aGUgdmVyaWZpZXIuDQpUaGUgUkFUUyBhcmNoaXRl Y3R1cmUgZG9jdW1lbnQgZG9lc27igJl0IGZvcm1hbGx5IGRlZmluZSBldmlkZW5jZSAoaXQgcmVh bGx5IG5lZWRzIHRvKSwgYnV0IHVzdWFsbHkgZGVwaWN0cyBpdCBhcyB3aGF0IGdvZXMgZnJvbSB0 aGUgYXR0ZXN0ZXIgdG8gdGhlIHZlcmlmaWVyLiBBbHNvLCBldmVyeW9uZSBJIGhhdmUgdGFsa2Vk IHRvIHBlcnNvbmFsbHkgc2VlbXMgdG8gdXNlIHRoZSB0ZXJtIGV2aWRlbmNlIGluIHRoaXMgd2F5 Lg0KDQozKSBJdCBpcyBhbiBpbXBsZW1lbnRhdGlvbiBvZiBFQVQgb3Igc29tZSBvdGhlciBhdHRl c3RhdGlvbiB0b2tlbiBmb3JtYXQuIEl0IGlzIG5vdCBhIGxlZ2FsIGVudGl0eSBsaWtlIGEgY2hp cCBtYW51ZmFjdHVyZXIgb3Igc2VydmljZSBvcGVyYXRvci4NCg0KNCkgVGhlcmUgaXMgYSBub3Rp b24gb2YgYSBib3VuZGFyeSBhcm91bmQgdGhlIGF0dGVzdGVyLiBUaGUgYm91bmRhcnkgbWlnaHQg dGhlIFRFRSBib3VuZGFyeSwgYSB1c2VyIG1vZGUgLyBrZXJuZWwgbW9kZSBib3VuZGFyeSwgaW5z aWRlIGEgVFBNIHZzIG91dHNpZGUgYSBUUE0gY2hpcCBvciBzaW1wbHkgdGhlIGJvdW5kcyBvZiBh biBBbmRyb2lkIGFwcC4gVGhlIGtleSBtYXRlcmlhbCBhbmQgc2lnbmluZyBpbXBsZW1lbnRhdGlv biBhcmUgaW5zaWRlIHRoaXMgYm91bmRhcnkuIChJTU8gbW9zdCBkZWZpbml0aW9ucyBvZiByb290 IG9mIHRydXN0IHNlZW0gdG8gbGFjayB0aGlzIGNvbmNlcHQpLg0KDQo1KSBGb3IgbW9zdCBpbXBs ZW1lbnRhdGlvbnMsIHRoZSBjbGFpbXMgb3JpZ2luYXRlIGluc2lkZSB0aGUgYm91bmRhcnksIGJ1 dCB0aGF0IGlzIG5vdCByZXF1aXJlZC4NCg0KSSBkb27igJl0IHVuZGVyc3RhbmQgdGhlIHRlcm0g Y2xhaW1hbnQgeWV0LCBzbyBJ4oCZbSBnb2luZyBhdm9pZCBpdC4NCltubXNdIENsYWltYW50IGlz IHN5bm9ueW1vdXMgd2l0aCDigJhhc3NlcnRlcuKAmSBpbiB0aGUgbW9zdCByZWNlbnRseSBwcmVz ZW50ZWQgYXJjaGl0ZWN0dXJlIHNsaWRlcy4gSSBiZWxpZXZlIGZpeGluZyB0aGUgdGVybSBpbiB0 aGUgYXJjaCBkcmFmdCBpcyBvbiB0aGUgaXNzdWVzIGxpc3QuIEEgc2ltcGxlIGRlZmluaXRpb24g aXMgdGhlIEFzc2VydGVyIChDbGFpbWFudCkgaXMgYSBzdXBwbHkgY2hhaW4gZW50aXR5IHRoYXQg Y29udmV5cyByZWZlcmVuY2UgdmFsdWVzIHRvIGEgVmVyaWZpZXIgc28gdGhhdCB0aGUgVmVyaWZp ZXIgY2FuIGNvbXBhcmUg4oCYcmVmZXJlbmNl4oCZIGNsYWltcyB3aXRoIGFjdHVhbCBjbGFpbXMg YWthIOKAmGV2aWRlbmNl4oCZLg0KDQoNCk9uIEF1ZyAxOCwgMjAxOSwgYXQgMzo1OCBBTSwgT2xp dmVyLCBJYW4gKE5va2lhIC0gRkkvRXNwb28pIDxpYW4ub2xpdmVyQG5va2lhLWJlbGwtbGFicy5j b208bWFpbHRvOmlhbi5vbGl2ZXJAbm9raWEtYmVsbC1sYWJzLmNvbT4+IHdyb3RlOg0KDQpJJ20g anVzdCB0cnlpbmcgdG8gcHV0IHRoaXMgaW50byBzb21lIG1vcmUgZmFtaWxpYXIgYXJjaGl0ZWN0 dXJhbCB0ZXJtcyB0aGF0IHdlIGhhdmUgaW1wbGVtZW50ZWQuIFNvIGZvciBleGFtcGxlLCB3ZSBo YXZlIGFuIGF0dGVzdGF0aW9uIHNlcnZlciAoQVMpIHRoYXQgY2FuIGNvbm5lY3QgdG8gYSBkYWVt b24gcnVubmluZyBvbiwgc2F5LCBzb21lIHNlcnZlcnMvSW9UIGRldmljZXMvZWxlbWVudHMgd2l0 aCBUUE1zLg0KDQpJZiBJ4oCZbSB1bmRlcnN0YW5kaW5nIHJpZ2h0LCB5b3VyIOKAnEFTIiBpcyBh Y3R1YWxseSB0aGUgUkFUUyB2ZXJpZmllciBhbmQvb3IgUkFUUyByZWx5aW5nIHBhcnR5LiBZb3Vy IOKAnGRhZW1vbiIgaXMgdGhlIFJBVFMgYXR0ZXN0ZXIuDQoNCkl0IGlzIHRoZSBzZXJ2ZXIvSW9U IGRldmljZXMvZWxlbWVudHMgdGhhdCB5b3UgYXJlIHRyeWluZyB0byBldmFsdWF0ZSBmb3IgdHJ1 c3R3b3J0aGluZXNzLiBUaGUgY2xhaW1zIGFuZCBhc3NlcnRpb25zIGFyZSBhYm91dCB0aGVzZSwg cmlnaHQ/IFRoZXkgYXJlIHRoZSBvbmVzIHRoYXQgaGF2ZSB0aGUgc2VjcmV0IHNpZ25pbmcga2V5 cywgcmlnaHQ/DQoNClRoZXJlIGlzIGEgc2lnbmVkIGRhdGEgc3RydWN0dXJlIHRoYXQgZ29lcyBm cm9tIHRoZSBzZXJ2ZXIvSW9UIGRldmljZXMvZWxlbWVudHMgdG8gdGhlIEFTLiBUaGF0IGlzIHRo ZSBldmlkZW5jZS4NCg0KVGhlIEFTIHJlY2VpdmVzIHRoZSBldmlkZW5jZSBhbmQgaGFzIHB1Ymxp YyBrZXkgbWF0ZXJpYWwgdG8gZXZhbHVhdGUgdGhlIHNpZ25hdHVyZS4NCg0KKFBhcmRvbiBpZiBJ 4oCZdmUgZ29uZSBvbiB0b28gbG9uZywganVzdCB0cnlpbmcgdG8gYmUgY2xlYXIpDQoNCkxMDQoN Cg0KDQoNCkRvIEkgdW5kZXJzdGFuZCB0aGF0IHRoZSBlbGVtZW50cyBhYm92ZSBhcmUgY2xhaW1h bnRzIGFuZCB0aGF0IHRoZSBBUyB0YWtlcyB0aGUgcm9sZXMgb2YgYXR0ZXN0ZXIsIHZlcmlmaWVy IGFuZCBhdXRoZW50aWNhdGlvbiBjaGVja2VyLCB3aGlsZSB0aGUgZGFlbW9uIGludGVycHJldGlu ZyBhbmQgcmVzcG9uZGluZyB0byByZXF1ZXN0cyBmcm9tIHRoZSBBUyBpcyB0aGUgcmVsYXlpbmcg cGFydHk/DQoNClRoZSBkYXRhIHJldHVybmVkIGZyb20gdGhlIGVsZW1lbnQgKHRoZSBjbGFpbWFu dCB2aWEgdGhlIGRhZW1vbikgaXMsIG9zdGVuc2libHkgYW4gRUFULCB0aG91Z2ggaW4gb3VyIGNh c2UgaXMgYSBib2R5IG9mIGRhdGEgdGhhdCBjb250YWlucyB0aGUgVFBNU19BVFRFU1Qgc3RydWN0 dXJlICsgbWV0YS1kYXRhLg0KDQpGdXJ0aGVyLCBkbyBJIHVuZGVyc3RhbmQgdGhhdCB0aGUgYXR0 ZXN0ZXIgbWF5IGhhdmUgaXRzZWxmIGEgcm9vdC1vZi10cnVzdCwgdGh1cyBiZWNvbWluZyBpbiB0 aGUgY2FzZSB3aGVyZSBpdCBkb2VzLCBhIGNsYWltYW50IGluIGl0cyBvd24gcmlnaHQ/DQoNCnQu DQoNCklhbg0KDQotLQ0KRHIuIElhbiBPbGl2ZXINCkN5YmVyc2VjdXJpdHkgUmVzZWFyY2gNCkRp c3Rpbmd1aXNoZWQgTWVtYmVyIG9mIFRlY2huaWNhbCBTdGFmZg0KTm9raWEgQmVsbCBMYWJzDQor MzU4IDUwIDQ4MyA2MjM3DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXw0KUkFUUyBtYWlsaW5nIGxpc3QNClJBVFNAaWV0Zi5vcmc8bWFpbHRvOlJBVFNAaWV0 Zi5vcmc+DQpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3JhdHMNCg0KDQo= --_000_10825C3E81E043A9B52928E7C501E098intelcom_ Content-Type: text/html; charset="utf-8" Content-ID: <90EAF971CA3F1E46B5D8CC859330D520@intel.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseTpIZWx2ZXRpY2E7DQoJcGFub3NlLTE6MCAwIDAgMCAwIDAgMCAwIDAg MDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0x OjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJp Ow0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCi8qIFN0eWxlIERlZmluaXRpb25z ICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjow aW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1m YW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0K CXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246 dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXttc28t c3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRl cmxpbmU7fQ0KcC5tc29ub3JtYWwwLCBsaS5tc29ub3JtYWwwLCBkaXYubXNvbm9ybWFsMA0KCXtt c28tc3R5bGUtbmFtZTptc29ub3JtYWw7DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFy Z2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVm dDowaW47DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1z ZXJpZjt9DQpzcGFuLmFwcGxlLWNvbnZlcnRlZC1zcGFjZQ0KCXttc28tc3R5bGUtbmFtZTphcHBs ZS1jb252ZXJ0ZWQtc3BhY2U7fQ0Kc3Bhbi5FbWFpbFN0eWxlMTkNCgl7bXNvLXN0eWxlLXR5cGU6 cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29s b3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQt b25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjgu NWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRT ZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPg0KPC9oZWFkPg0KPGJv ZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0i V29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlNlZSBpbmxpbmUgW25tc108bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+T24gOC8xOC8xOSwgMTE6MTcgQU0sICZxdW90O1JBVFMgb24gYmVoYWxmIG9mIExhdXJlbmNl IEx1bmRibGFkZSZxdW90OyAmbHQ7PGEgaHJlZj0ibWFpbHRvOnJhdHMtYm91bmNlc0BpZXRmLm9y ZyI+cmF0cy1ib3VuY2VzQGlldGYub3JnPC9hPiBvbiBiZWhhbGYgb2YNCjxhIGhyZWY9Im1haWx0 bzpsZ2xAaXNsYW5kLXJlc29ydC5jb20iPmxnbEBpc2xhbmQtcmVzb3J0LmNvbTwvYT4mZ3Q7IHdy b3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+SGVyZeKAmXMgbXVjaCBvZiB3aGF0IEkgdGhpbmsgZGVmaW5lcyBhbiDigJxhdHRlc3RlciZx dW90Ozo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4xKSBJ dCBoYXMgc29tZSBwcml2YXRlIC8gc2VjcmV0IGtleSBtYXRlcmlhbCBpdCB1c2VzIHRvIHNpZ24g Y2xhaW1zLiBVc3VhbGx5IHRoaXMgaXMgYW4gRUNEU0EgcHJpdmF0ZSBrZXksIGJ1dCBpdCBjb3Vs ZCBiZSBhIHN5bW1ldHJpYyBrZXkgdXNlZCB3aXRoIGEgTUFDLiBUaGUgUkFUUyBhcmNoaXRlY3R1 cmUgZG9jdW1lbnQgcmVmZXJzIHRvIHRoaXMgYXMgYW4g4oCcYXR0ZXN0YXRpb24NCiBjcmVkZW50 aWFs4oCdIGFuZCB0byB0aGUgcHJvY2VzcyBvZiBzaWduaW5nIGFzICZxdW90O1Byb3ZpZGUgb3Ig Y3JlYXRlIHByb29mIHRoYXQgYW4gYXNzZXJ0aW9uIGlzIGJvdW5kIHRvIHRoZSBBdHRlc3RlcuKA nSAoYnkgbXkgdW5kZXJzdGFuZGluZykuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbiI+MikgSXQgb3V0cHV0cyA8aT5ldmlkZW5jZTwvaT4uIEFuIEVBVCBpcyBl dmlkZW5jZS4gRXZpZGVuY2UgaXMgY2xhaW1zIC8gYXNzZXJ0aW9ucyB0aGF0IGFyZSBzaWduZWQg c28gdGhlaXIgYXV0aGVudGljaXR5IGNhbiBiZSBjaGVja2VkIGJ5IHRoZSB2ZXJpZmllci4mbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj5UaGUgUkFUUyBhcmNoaXRlY3R1cmUgZG9jdW1lbnQgZG9l c27igJl0IGZvcm1hbGx5IGRlZmluZSBldmlkZW5jZSAoaXQgcmVhbGx5IG5lZWRzIHRvKSwgYnV0 IHVzdWFsbHkgZGVwaWN0cyBpdCBhcyB3aGF0IGdvZXMgZnJvbSB0aGUgYXR0ZXN0ZXIgdG8gdGhl IHZlcmlmaWVyLiBBbHNvLCBldmVyeW9uZSBJIGhhdmUgdGFsa2VkIHRvIHBlcnNvbmFsbHkgc2Vl bXMgdG8gdXNlDQogdGhlIHRlcm0gPGk+ZXZpZGVuY2U8L2k+Jm5ic3A7aW4gdGhpcyB3YXkuPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+MykgSXQgaXMgYW4g aW1wbGVtZW50YXRpb24mbmJzcDtvZiBFQVQgb3Igc29tZSBvdGhlciBhdHRlc3RhdGlvbiB0b2tl biBmb3JtYXQuIEl0IGlzIG5vdCBhIGxlZ2FsIGVudGl0eSBsaWtlIGEgY2hpcCBtYW51ZmFjdHVy ZXIgb3Igc2VydmljZSBvcGVyYXRvci4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtYXJnaW4tbGVmdDouNWluIj40KSBUaGVyZSBpcyBhIG5vdGlvbiBvZiBhIGJvdW5kYXJ5IGFy b3VuZCB0aGUgYXR0ZXN0ZXIuIFRoZSBib3VuZGFyeSBtaWdodCB0aGUgVEVFIGJvdW5kYXJ5LCBh IHVzZXIgbW9kZSAvIGtlcm5lbCBtb2RlIGJvdW5kYXJ5LCBpbnNpZGUgYSBUUE0gdnMgb3V0c2lk ZSBhIFRQTSBjaGlwIG9yIHNpbXBseSB0aGUgYm91bmRzIG9mIGFuIEFuZHJvaWQgYXBwLiBUaGUg a2V5DQogbWF0ZXJpYWwgYW5kIHNpZ25pbmcgaW1wbGVtZW50YXRpb24gYXJlIGluc2lkZSB0aGlz IGJvdW5kYXJ5LiAoSU1PIG1vc3QgZGVmaW5pdGlvbnMgb2Ygcm9vdCBvZiB0cnVzdCBzZWVtIHRv IGxhY2sgdGhpcyBjb25jZXB0KS4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+NSkgRm9yIG1vc3QgaW1wbGVtZW50YXRpb25zLCB0aGUg Y2xhaW1zIG9yaWdpbmF0ZSBpbnNpZGUgdGhlIGJvdW5kYXJ5LCBidXQgdGhhdCBpcyBub3QgcmVx dWlyZWQuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDou NWluIj5JIGRvbuKAmXQgdW5kZXJzdGFuZCB0aGUgdGVybSA8aT5jbGFpbWFudDwvaT4mbmJzcDt5 ZXQsIHNvIEnigJltIGdvaW5nIGF2b2lkIGl0LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+W25tc10gQ2xhaW1hbnQgaXMgc3lub255bW91cyB3aXRoIOKAmGFzc2VydGVy4oCZ IGluIHRoZSBtb3N0IHJlY2VudGx5IHByZXNlbnRlZCBhcmNoaXRlY3R1cmUgc2xpZGVzLiBJIGJl bGlldmUgZml4aW5nIHRoZSB0ZXJtIGluIHRoZSBhcmNoIGRyYWZ0IGlzIG9uIHRoZSBpc3N1ZXMg bGlzdC4gQSBzaW1wbGUgZGVmaW5pdGlvbiBpcyB0aGUgQXNzZXJ0ZXIgKENsYWltYW50KSBpcyBh IHN1cHBseSBjaGFpbiBlbnRpdHkNCiB0aGF0IGNvbnZleXMgcmVmZXJlbmNlIHZhbHVlcyB0byBh IFZlcmlmaWVyIHNvIHRoYXQgdGhlIFZlcmlmaWVyIGNhbiBjb21wYXJlIOKAmHJlZmVyZW5jZeKA mSBjbGFpbXMgd2l0aCBhY3R1YWwgY2xhaW1zIGFrYSDigJhldmlkZW5jZeKAmS4NCjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7 bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW4iPk9uIEF1ZyAxOCwgMjAxOSwgYXQgMzo1OCBBTSwgT2xpdmVyLCBJ YW4gKE5va2lhIC0gRkkvRXNwb28pICZsdDs8YSBocmVmPSJtYWlsdG86aWFuLm9saXZlckBub2tp YS1iZWxsLWxhYnMuY29tIj5pYW4ub2xpdmVyQG5va2lhLWJlbGwtbGFicy5jb208L2E+Jmd0OyB3 cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2EiPkknbSBqdXN0IHRyeWluZyB0 byBwdXQgdGhpcyBpbnRvIHNvbWUgbW9yZSBmYW1pbGlhciBhcmNoaXRlY3R1cmFsIHRlcm1zIHRo YXQgd2UgaGF2ZSBpbXBsZW1lbnRlZC4gU28gZm9yIGV4YW1wbGUsIHdlIGhhdmUgYW4gYXR0ZXN0 YXRpb24gc2VydmVyIChBUykgdGhhdCBjYW4gY29ubmVjdA0KIHRvIGEgZGFlbW9uIHJ1bm5pbmcg b24sIHNheSwgc29tZSBzZXJ2ZXJzL0lvVCBkZXZpY2VzL2VsZW1lbnRzIHdpdGggVFBNcy48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj5JZiBJ4oCZbSB1bmRlcnN0YW5kaW5nIHJpZ2h0LCB5b3VyIOKAnEFT JnF1b3Q7IGlzIGFjdHVhbGx5IHRoZSBSQVRTIHZlcmlmaWVyIGFuZC9vciBSQVRTIHJlbHlpbmcg cGFydHkuIFlvdXIg4oCcZGFlbW9uJnF1b3Q7IGlzIHRoZSBSQVRTIGF0dGVzdGVyLjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPkl0IGlzIHRoZSBzZXJ2ZXIv SW9UIGRldmljZXMvZWxlbWVudHMgdGhhdCB5b3UgYXJlIHRyeWluZyB0byBldmFsdWF0ZSBmb3Ig dHJ1c3R3b3J0aGluZXNzLiBUaGUgY2xhaW1zIGFuZCBhc3NlcnRpb25zIGFyZSBhYm91dCB0aGVz ZSwgcmlnaHQ/IFRoZXkgYXJlIHRoZSBvbmVzIHRoYXQgaGF2ZSB0aGUgc2VjcmV0IHNpZ25pbmcg a2V5cywgcmlnaHQ/PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+VGhlcmUgaXMgYSBzaWduZWQgZGF0YSBzdHJ1Y3R1cmUgdGhhdCBnb2VzIGZyb20gdGhlIHNl cnZlci9Jb1QgZGV2aWNlcy9lbGVtZW50cyB0byB0aGUgQVMuIFRoYXQgaXMgdGhlIGV2aWRlbmNl LiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPlRo ZSBBUyByZWNlaXZlcyB0aGUgZXZpZGVuY2UgYW5kIGhhcyBwdWJsaWMga2V5IG1hdGVyaWFsIHRv IGV2YWx1YXRlIHRoZSBzaWduYXR1cmUuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbiI+KFBhcmRvbiBpZiBJ4oCZdmUgZ29uZSBvbiB0b28gbG9uZywganVzdCB0 cnlpbmcgdG8gYmUgY2xlYXIpPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6LjVpbiI+TEw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxicj4N Cjxicj4NCjxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4w cHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0 O2ZvbnQtZmFtaWx5OkhlbHZldGljYSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4i PjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6SGVsdmV0aWNhIj5EbyBJ IHVuZGVyc3RhbmQgdGhhdCB0aGUgZWxlbWVudHMgYWJvdmUgYXJlIGNsYWltYW50cyBhbmQgdGhh dCB0aGUgQVMgdGFrZXMgdGhlIHJvbGVzIG9mIGF0dGVzdGVyLCB2ZXJpZmllciBhbmQgYXV0aGVu dGljYXRpb24gY2hlY2tlciwgd2hpbGUgdGhlIGRhZW1vbiBpbnRlcnByZXRpbmcNCiBhbmQgcmVz cG9uZGluZyB0byByZXF1ZXN0cyBmcm9tIHRoZSBBUyBpcyB0aGUgcmVsYXlpbmcgcGFydHk/PG86 cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9u dC1mYW1pbHk6SGVsdmV0aWNhIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2EiPlRoZSBkYXRh IHJldHVybmVkIGZyb20gdGhlIGVsZW1lbnQgKHRoZSBjbGFpbWFudCB2aWEgdGhlIGRhZW1vbikg aXMsIG9zdGVuc2libHkgYW4gRUFULCB0aG91Z2ggaW4gb3VyIGNhc2UgaXMgYSBib2R5IG9mIGRh dGEgdGhhdCBjb250YWlucyB0aGUgVFBNU19BVFRFU1Qgc3RydWN0dXJlDQogJiM0MzsgbWV0YS1k YXRhLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjku MHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2EiPkZ1cnRoZXIs IGRvIEkgdW5kZXJzdGFuZCB0aGF0IHRoZSBhdHRlc3RlciBtYXkgaGF2ZSBpdHNlbGYgYSByb290 LW9mLXRydXN0LCB0aHVzIGJlY29taW5nIGluIHRoZSBjYXNlIHdoZXJlIGl0IGRvZXMsIGEgY2xh aW1hbnQgaW4gaXRzIG93biByaWdodD88L3NwYW4+DQo8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxMi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+dC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDouNWluIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+SWFuPG86cD48L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXYgaWQ9IlNpZ25hdHVyZSI+DQo8ZGl2IGlkPSJk aXZ0YWdkZWZhdWx0d3JhcHBlciI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij4tLTxzcGFu IGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQiPkRyLiBJYW4gT2xp dmVyPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIu MHB0Ij5DeWJlcnNlY3VyaXR5IFJlc2VhcmNoPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij5EaXN0aW5ndWlzaGVkIE1lbWJlciBvZiBUZWNo bmljYWwgU3RhZmY8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMi4wcHQiPk5va2lhIEJlbGwgTGFiczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+JiM0MzszNTggNTAgNDgzIDYyMzc8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBw dDtmb250LWZhbWlseTpIZWx2ZXRpY2EiPl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fPGJyPg0KUkFUUyBtYWlsaW5nIGxpc3Q8YnI+DQo8L3NwYW4+PGEgaHJl Zj0ibWFpbHRvOlJBVFNAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9u dC1mYW1pbHk6SGVsdmV0aWNhIj5SQVRTQGlldGYub3JnPC9zcGFuPjwvYT48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OkhlbHZldGljYSI+PGJyPg0KPC9zcGFuPjxhIGhy ZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vcmF0cyI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTpIZWx2ZXRpY2EiPmh0dHBzOi8vd3d3Lmll dGYub3JnL21haWxtYW4vbGlzdGluZm8vcmF0czwvc3Bhbj48L2E+PG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW4iPjxicj4NCjxicj4NCjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2JvZHk+DQo8L2h0bWw+DQo= --_000_10825C3E81E043A9B52928E7C501E098intelcom_-- From nobody Thu Aug 22 10:47:22 2019 Return-Path: X-Original-To: rats@ietf.org Delivered-To: rats@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 388CA120A9F; Thu, 22 Aug 2019 10:47:20 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IESG Secretary To: "IETF-Announce" Cc: rats@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.100.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <156649604012.14894.6777124724988189385@ietfa.amsl.com> Date: Thu, 22 Aug 2019 10:47:20 -0700 Archived-At: Subject: [Rats] Remote ATtestation ProcedureS (rats) WG Virtual Meeting: 2019-09-10 X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 17:47:20 -0000 The Remote ATtestation ProcedureS (rats) Working Group will hold a virtual interim meeting on 2019-09-10 from 07:00 to 08:30 America/Los_Angeles. Agenda: (No agenda submitted) Information about remote participation: JOIN WEBEX MEETING https://ietf.webex.com/ietf/j.php?MTID=mefed41895b6dc942bf92a1b4c121d907 Meeting number (access code): 646 390 311 Meeting password: hPrEtxQc JOIN BY PHONE 1-650-479-3208 Call-in toll number (US/Canada) Tap here to call (mobile phones only, hosts not supported): tel:%2B1-650-479-3208,,*01*646390311%23%23*01* From nobody Thu Aug 22 10:48:20 2019 Return-Path: X-Original-To: rats@ietf.org Delivered-To: rats@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E2A7D120AEA; Thu, 22 Aug 2019 10:48:11 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IESG Secretary To: "IETF-Announce" Cc: rats@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.100.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <156649609186.14801.1558810621836898003@ietfa.amsl.com> Date: Thu, 22 Aug 2019 10:48:11 -0700 Archived-At: Subject: [Rats] Remote ATtestation ProcedureS (rats) WG Virtual Meeting: 2019-10-08 X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 17:48:18 -0000 The Remote ATtestation ProcedureS (rats) Working Group will hold a virtual interim meeting on 2019-10-08 from 07:30 to 09:00 America/Los_Angeles. Agenda: (No agenda submitted) Information about remote participation: JOIN WEBEX MEETING https://ietf.webex.com/ietf/j.php?MTID=m60fe91349400854aee77d20c5847a15e Meeting number (access code): 640 521 410 Meeting password: PjvPCHa5 JOIN BY PHONE 1-650-479-3208 Call-in toll number (US/Canada) Tap here to call (mobile phones only, hosts not supported): tel:%2B1-650-479-3208,,*01*640521410%23%23*01* From nobody Thu Aug 22 11:23:44 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EA901120AE5 for ; Thu, 22 Aug 2019 11:23:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kM8Bgzawmt-5 for ; Thu, 22 Aug 2019 11:23:36 -0700 (PDT) Received: from p3plsmtpa08-09.prod.phx3.secureserver.net (p3plsmtpa08-09.prod.phx3.secureserver.net [173.201.193.110]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 97233120B01 for ; Thu, 22 Aug 2019 11:23:36 -0700 (PDT) Received: from [192.168.1.76] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id 0rkFiE5Rsu2OI0rkFiZHtk; Thu, 22 Aug 2019 11:23:36 -0700 From: Laurence Lundblade Message-Id: <910BEC2B-AA72-4106-9E5E-5DDEC6B9CFED@island-resort.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_DD792E46-B734-42DC-80F2-0F5BE6EE4D80" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 22 Aug 2019 11:23:35 -0700 In-Reply-To: <10825C3E-81E0-43A9-B529-28E7C501E098@intel.com> Cc: "Oliver, Ian (Nokia - FI/Espoo)" , "rats@ietf.org" To: "Smith, Ned" References: <3F5C57F7-C75F-4C27-9898-25AF98237DE9@island-resort.com> <10825C3E-81E0-43A9-B529-28E7C501E098@intel.com> X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfLYPptR4FtTrzQt4yMdfff9f3KwVWAccZg+wT/QGyynyzIbjIw4Gc4DePuRW7LlxM5/xwOorMDX71dbNpJVJwgOOWS33qCDtosKRfoHI+eu2UrYfBnpy JgRdN/6D8YLwn0NOAaW5xznf0TsuCS+MxVmTvy1A8Wozg3jmMI0KAWRTOHpq1BD6B2uFkW3CPbuEHWHj2kSCz9sF6We9nI3byDYILWTmt02SPfrOFabZgagE XqtPLkectQvAygAWaRHTSA== Archived-At: Subject: Re: [Rats] Use the term "attester" instead of root of trust X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Aug 2019 18:23:43 -0000 --Apple-Mail=_DD792E46-B734-42DC-80F2-0F5BE6EE4D80 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Below > On Aug 19, 2019, at 11:58 AM, Smith, Ned wrote: >=20 > See inline [nms] > =20 > On 8/18/19, 11:17 AM, "RATS on behalf of Laurence Lundblade" = on behalf of = lgl@island-resort.com > wrote: > =20 > Here=E2=80=99s much of what I think defines an =E2=80=9Cattester": > =20 > 1) It has some private / secret key material it uses to sign claims. = Usually this is an ECDSA private key, but it could be a symmetric key = used with a MAC. The RATS architecture document refers to this as an = =E2=80=9Cattestation credential=E2=80=9D and to the process of signing = as "Provide or create proof that an assertion is bound to the = Attester=E2=80=9D (by my understanding). > =20 > 2) It outputs evidence. An EAT is evidence. Evidence is claims / = assertions that are signed so their authenticity can be checked by the = verifier.=20 > The RATS architecture document doesn=E2=80=99t formally define = evidence (it really needs to), but usually depicts it as what goes from = the attester to the verifier. Also, everyone I have talked to personally = seems to use the term evidence in this way. > =20 > 3) It is an implementation of EAT or some other attestation token = format. It is not a legal entity like a chip manufacturer or service = operator.=20 > =20 > 4) There is a notion of a boundary around the attester. The boundary = might the TEE boundary, a user mode / kernel mode boundary, inside a TPM = vs outside a TPM chip or simply the bounds of an Android app. The key = material and signing implementation are inside this boundary. (IMO most = definitions of root of trust seem to lack this concept).=20 > =20 > 5) For most implementations, the claims originate inside the boundary, = but that is not required. > =20 > I don=E2=80=99t understand the term claimant yet, so I=E2=80=99m going = avoid it. > [nms] Claimant is synonymous with =E2=80=98asserter=E2=80=99 in the = most recently presented architecture slides. I believe fixing the term = in the arch draft is on the issues list. A simple definition is the = Asserter (Claimant) is a supply chain entity that conveys reference = values to a Verifier so that the Verifier can compare =E2=80=98reference=E2= =80=99 claims with actual claims aka =E2=80=98evidence=E2=80=99 I few emails ago, I described how trust is fundamentally established out = of band. Some how the verifier/relying party must get the public key to = verify the signature on the token. This is also how they implicitly know = some of the main security characteristics of the entity being attested = to, like how well the private key is protected. Someone has to publish = this public key and the implicit characteristics associated with it. That has to be a role in the RATS architecture.=20 It seems like claimant is closest to that role. I don=E2=80=99t think it is always the case that the role publishing the = reference values is the same as the role publishing the public key used = to verify. For example, a TPM or TPM-like subsystem might exist and have = the signing keys. It is made by one manufacturer. It has some inputs for = measurements and claims and is tasked with measuring the HLOS. It can = even be used with many different HLOS=E2=80=99s. The reference values = don't come from this vendor. Instead they come from the various HLOS = vendors. LL --Apple-Mail=_DD792E46-B734-42DC-80F2-0F5BE6EE4D80 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Below

On Aug 19, 2019, at 11:58 AM, = Smith, Ned <ned.smith@intel.com> wrote:

See = inline [nms]
 
On 8/18/19, 11:17 = AM, "RATS on behalf of Laurence Lundblade" <rats-bounces@ietf.org on behalf of lgl@island-resort.com> = wrote:
 
Here=E2=80=99s much of what I think defines an = =E2=80=9Cattester":
 
1) It has some private / secret key material it = uses to sign claims. Usually this is an ECDSA private key, but it could = be a symmetric key used with a MAC. The RATS architecture document = refers to this as an =E2=80=9Cattestation credential=E2=80=9D and to the = process of signing as "Provide or create proof that an assertion is = bound to the Attester=E2=80=9D (by my understanding).
 
2) It outputs evidence. = An EAT is evidence. Evidence is claims / assertions that are signed so = their authenticity can be checked by the verifier. 
The RATS architecture document doesn=E2=80=99t formally = define evidence (it really needs to), but usually depicts it as what = goes from the attester to the verifier. Also, everyone I have talked to = personally seems to use the term evidence in this way.
 
3) It is an implementation of EAT = or some other attestation token format. It is not a legal entity like a = chip manufacturer or service operator. 
 
4) There is a notion of a boundary = around the attester. The boundary might the TEE boundary, a user mode / = kernel mode boundary, inside a TPM vs outside a TPM chip or simply the = bounds of an Android app. The key material and signing implementation = are inside this boundary. (IMO most definitions of root of trust seem to = lack this concept). 
 
5) For most implementations, the claims = originate inside the boundary, but that is not required.
 
I don=E2=80=99t = understand the term claimant yet, so I=E2=80=99m going avoid it.
[nms] = Claimant is synonymous with =E2=80=98asserter=E2=80=99 in the most = recently presented architecture slides. I believe fixing the term in the = arch draft is on the issues list. A simple definition is the Asserter = (Claimant) is a supply chain entity that conveys reference values to a = Verifier so that the Verifier can compare =E2=80=98reference=E2=80=99 = claims with actual claims aka = =E2=80=98evidence=E2=80=99
=
I few emails ago, I described how trust is = fundamentally established out of band. Some how the verifier/relying = party must get the public key to verify the signature on the token. This = is also how they implicitly know some of the main security = characteristics of the entity being attested to, like how well the = private key is protected. Someone has to publish this public key and the = implicit characteristics associated with it.

That has to be a role in the RATS = architecture. 

It seems like = claimant is closest to that role.

I = don=E2=80=99t think it is always the case that the role publishing the = reference values is the same as the role publishing the public key used = to verify. For example, a TPM or TPM-like subsystem might exist and have = the signing keys. It is made by one manufacturer. It has some inputs for = measurements and claims and is tasked with measuring the HLOS. It can = even be used with many different HLOS=E2=80=99s. The reference values = don't come from this vendor. Instead they come from the various HLOS = vendors.

LL


= --Apple-Mail=_DD792E46-B734-42DC-80F2-0F5BE6EE4D80-- From nobody Thu Aug 22 18:05:17 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0F754120168 for ; Thu, 22 Aug 2019 18:05:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.898 X-Spam-Level: X-Spam-Status: No, score=-6.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rW9blFKbUqvv for ; Thu, 22 Aug 2019 18:05:12 -0700 (PDT) Received: from mga09.intel.com (mga09.intel.com [134.134.136.24]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 605F3120113 for ; Thu, 22 Aug 2019 18:05:12 -0700 (PDT) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga005.fm.intel.com ([10.253.24.32]) by orsmga102.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 22 Aug 2019 18:05:11 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.64,419,1559545200"; d="scan'208,217";a="378711385" Received: from orsmsx110.amr.corp.intel.com ([10.22.240.8]) by fmsmga005.fm.intel.com with ESMTP; 22 Aug 2019 18:05:11 -0700 Received: from orsmsx161.amr.corp.intel.com (10.22.240.84) by ORSMSX110.amr.corp.intel.com (10.22.240.8) with Microsoft SMTP Server (TLS) id 14.3.439.0; Thu, 22 Aug 2019 18:05:10 -0700 Received: from orsmsx109.amr.corp.intel.com ([169.254.11.172]) by ORSMSX161.amr.corp.intel.com ([169.254.4.172]) with mapi id 14.03.0439.000; Thu, 22 Aug 2019 18:05:10 -0700 From: "Smith, Ned" To: Laurence Lundblade CC: "Oliver, Ian (Nokia - FI/Espoo)" , "rats@ietf.org" Thread-Topic: [Rats] Use the term "attester" instead of root of trust Thread-Index: AQHVVGg+OnGyLZ7bikigtz9osO2brqcBNEoAgAB6dQCAASiKgIAFIqqA///62QA= Date: Fri, 23 Aug 2019 01:05:09 +0000 Message-ID: References: <3F5C57F7-C75F-4C27-9898-25AF98237DE9@island-resort.com> <10825C3E-81E0-43A9-B529-28E7C501E098@intel.com> <910BEC2B-AA72-4106-9E5E-5DDEC6B9CFED@island-resort.com> In-Reply-To: <910BEC2B-AA72-4106-9E5E-5DDEC6B9CFED@island-resort.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1c.0.190812 x-originating-ip: [10.24.14.140] Content-Type: multipart/alternative; boundary="_000_A8D75C7BEC1340BDBB0E91B41E249351intelcom_" MIME-Version: 1.0 Archived-At: Subject: Re: [Rats] Use the term "attester" instead of root of trust X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Aug 2019 01:05:15 -0000 --_000_A8D75C7BEC1340BDBB0E91B41E249351intelcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 U2VlIGlubGluZSBbbm1zXQ0KDQpPbiA4LzIyLzE5LCAxMToyNCBBTSwgIkxhdXJlbmNlIEx1bmRi bGFkZSIgPGxnbEBpc2xhbmQtcmVzb3J0LmNvbTxtYWlsdG86bGdsQGlzbGFuZC1yZXNvcnQuY29t Pj4gd3JvdGU6DQoNCkJlbG93DQoNCg0KT24gQXVnIDE5LCAyMDE5LCBhdCAxMTo1OCBBTSwgU21p dGgsIE5lZCA8bmVkLnNtaXRoQGludGVsLmNvbTxtYWlsdG86bmVkLnNtaXRoQGludGVsLmNvbT4+ IHdyb3RlOg0KDQpTZWUgaW5saW5lIFtubXNdDQoNCk9uIDgvMTgvMTksIDExOjE3IEFNLCAiUkFU UyBvbiBiZWhhbGYgb2YgTGF1cmVuY2UgTHVuZGJsYWRlIiA8cmF0cy1ib3VuY2VzQGlldGYub3Jn PG1haWx0bzpyYXRzLWJvdW5jZXNAaWV0Zi5vcmc+IG9uIGJlaGFsZiBvZiBsZ2xAaXNsYW5kLXJl c29ydC5jb208bWFpbHRvOmxnbEBpc2xhbmQtcmVzb3J0LmNvbT4+IHdyb3RlOg0KDQpIZXJl4oCZ cyBtdWNoIG9mIHdoYXQgSSB0aGluayBkZWZpbmVzIGFuIOKAnGF0dGVzdGVyIjoNCg0KMSkgSXQg aGFzIHNvbWUgcHJpdmF0ZSAvIHNlY3JldCBrZXkgbWF0ZXJpYWwgaXQgdXNlcyB0byBzaWduIGNs YWltcy4gVXN1YWxseSB0aGlzIGlzIGFuIEVDRFNBIHByaXZhdGUga2V5LCBidXQgaXQgY291bGQg YmUgYSBzeW1tZXRyaWMga2V5IHVzZWQgd2l0aCBhIE1BQy4gVGhlIFJBVFMgYXJjaGl0ZWN0dXJl IGRvY3VtZW50IHJlZmVycyB0byB0aGlzIGFzIGFuIOKAnGF0dGVzdGF0aW9uIGNyZWRlbnRpYWzi gJ0gYW5kIHRvIHRoZSBwcm9jZXNzIG9mIHNpZ25pbmcgYXMgIlByb3ZpZGUgb3IgY3JlYXRlIHBy b29mIHRoYXQgYW4gYXNzZXJ0aW9uIGlzIGJvdW5kIHRvIHRoZSBBdHRlc3RlcuKAnSAoYnkgbXkg dW5kZXJzdGFuZGluZykuDQoNCjIpIEl0IG91dHB1dHMgZXZpZGVuY2UuIEFuIEVBVCBpcyBldmlk ZW5jZS4gRXZpZGVuY2UgaXMgY2xhaW1zIC8gYXNzZXJ0aW9ucyB0aGF0IGFyZSBzaWduZWQgc28g dGhlaXIgYXV0aGVudGljaXR5IGNhbiBiZSBjaGVja2VkIGJ5IHRoZSB2ZXJpZmllci4NClRoZSBS QVRTIGFyY2hpdGVjdHVyZSBkb2N1bWVudCBkb2VzbuKAmXQgZm9ybWFsbHkgZGVmaW5lIGV2aWRl bmNlIChpdCByZWFsbHkgbmVlZHMgdG8pLCBidXQgdXN1YWxseSBkZXBpY3RzIGl0IGFzIHdoYXQg Z29lcyBmcm9tIHRoZSBhdHRlc3RlciB0byB0aGUgdmVyaWZpZXIuIEFsc28sIGV2ZXJ5b25lIEkg aGF2ZSB0YWxrZWQgdG8gcGVyc29uYWxseSBzZWVtcyB0byB1c2UgdGhlIHRlcm0gZXZpZGVuY2Ug aW4gdGhpcyB3YXkuDQoNCjMpIEl0IGlzIGFuIGltcGxlbWVudGF0aW9uIG9mIEVBVCBvciBzb21l IG90aGVyIGF0dGVzdGF0aW9uIHRva2VuIGZvcm1hdC4gSXQgaXMgbm90IGEgbGVnYWwgZW50aXR5 IGxpa2UgYSBjaGlwIG1hbnVmYWN0dXJlciBvciBzZXJ2aWNlIG9wZXJhdG9yLg0KDQo0KSBUaGVy ZSBpcyBhIG5vdGlvbiBvZiBhIGJvdW5kYXJ5IGFyb3VuZCB0aGUgYXR0ZXN0ZXIuIFRoZSBib3Vu ZGFyeSBtaWdodCB0aGUgVEVFIGJvdW5kYXJ5LCBhIHVzZXIgbW9kZSAvIGtlcm5lbCBtb2RlIGJv dW5kYXJ5LCBpbnNpZGUgYSBUUE0gdnMgb3V0c2lkZSBhIFRQTSBjaGlwIG9yIHNpbXBseSB0aGUg Ym91bmRzIG9mIGFuIEFuZHJvaWQgYXBwLiBUaGUga2V5IG1hdGVyaWFsIGFuZCBzaWduaW5nIGlt cGxlbWVudGF0aW9uIGFyZSBpbnNpZGUgdGhpcyBib3VuZGFyeS4gKElNTyBtb3N0IGRlZmluaXRp b25zIG9mIHJvb3Qgb2YgdHJ1c3Qgc2VlbSB0byBsYWNrIHRoaXMgY29uY2VwdCkuDQoNCjUpIEZv ciBtb3N0IGltcGxlbWVudGF0aW9ucywgdGhlIGNsYWltcyBvcmlnaW5hdGUgaW5zaWRlIHRoZSBi b3VuZGFyeSwgYnV0IHRoYXQgaXMgbm90IHJlcXVpcmVkLg0KDQpJIGRvbuKAmXQgdW5kZXJzdGFu ZCB0aGUgdGVybSBjbGFpbWFudCB5ZXQsIHNvIEnigJltIGdvaW5nIGF2b2lkIGl0Lg0KW25tc10g Q2xhaW1hbnQgaXMgc3lub255bW91cyB3aXRoIOKAmGFzc2VydGVy4oCZIGluIHRoZSBtb3N0IHJl Y2VudGx5IHByZXNlbnRlZCBhcmNoaXRlY3R1cmUgc2xpZGVzLiBJIGJlbGlldmUgZml4aW5nIHRo ZSB0ZXJtIGluIHRoZSBhcmNoIGRyYWZ0IGlzIG9uIHRoZSBpc3N1ZXMgbGlzdC4gQSBzaW1wbGUg ZGVmaW5pdGlvbiBpcyB0aGUgQXNzZXJ0ZXIgKENsYWltYW50KSBpcyBhIHN1cHBseSBjaGFpbiBl bnRpdHkgdGhhdCBjb252ZXlzIHJlZmVyZW5jZSB2YWx1ZXMgdG8gYSBWZXJpZmllciBzbyB0aGF0 IHRoZSBWZXJpZmllciBjYW4gY29tcGFyZSDigJhyZWZlcmVuY2XigJkgY2xhaW1zIHdpdGggYWN0 dWFsIGNsYWltcyBha2Eg4oCYZXZpZGVuY2XigJkNCg0KSSBmZXcgZW1haWxzIGFnbywgSSBkZXNj cmliZWQgaG93IHRydXN0IGlzIGZ1bmRhbWVudGFsbHkgZXN0YWJsaXNoZWQgb3V0IG9mIGJhbmQu IFNvbWUgaG93IHRoZSB2ZXJpZmllci9yZWx5aW5nIHBhcnR5IG11c3QgZ2V0IHRoZSBwdWJsaWMg a2V5IHRvIHZlcmlmeSB0aGUgc2lnbmF0dXJlIG9uIHRoZSB0b2tlbi4gVGhpcyBpcyBhbHNvIGhv dyB0aGV5IGltcGxpY2l0bHkga25vdyBzb21lIG9mIHRoZSBtYWluIHNlY3VyaXR5IGNoYXJhY3Rl cmlzdGljcyBvZiB0aGUgZW50aXR5IGJlaW5nIGF0dGVzdGVkIHRvLCBsaWtlIGhvdyB3ZWxsIHRo ZSBwcml2YXRlIGtleSBpcyBwcm90ZWN0ZWQuIFNvbWVvbmUgaGFzIHRvIHB1Ymxpc2ggdGhpcyBw dWJsaWMga2V5IGFuZCB0aGUgaW1wbGljaXQgY2hhcmFjdGVyaXN0aWNzIGFzc29jaWF0ZWQgd2l0 aCBpdC4NCg0KVGhhdCBoYXMgdG8gYmUgYSByb2xlIGluIHRoZSBSQVRTIGFyY2hpdGVjdHVyZS4N CltubXNdIEl0IGlzIGNsZWFybHkgYSBkZXBlbmRlbmN5IOKAkyBpZiBub3Qgb24gYSBSQVRTIHJv bGUgZGlyZWN0bHkgdGhlbiBvbiBzb21ldGhpbmcgZWxzZSBvdXRzaWRlIG9mIHRoZSBhcmNoaXRl Y3R1cmUuDQoNCkl0IHNlZW1zIGxpa2UgY2xhaW1hbnQgaXMgY2xvc2VzdCB0byB0aGF0IHJvbGUu DQpbbm1zXSBBc3NlcnRlciAoY2xhaW1hbnQpIGFuZCBWZXJpZmllciBoYXZlIHRoZSBjaGFsbGVu Z2Ugb2Ygc29tZWhvdyBpbnRyb2R1Y2luZyB0aGVtc2VsdmVzLiBHaXZlbiB0aGVyZSBhcmUgZXhp c3RpbmcgYXV0aGVudGljYXRpb24gZnJhbWV3b3JrcyBhbmQgcHJvdG9jb2xzIHRoYXQgYWRkcmVz cyBhdXRoZW50aWNhdGlvbiBhbmQgdHJ1c3RlZCAzcmQgcGFydGllcy4gTWF5YmUgaXQgaXMgT0sg Zm9yIHRoZSBBc3NlcnRlciByb2xlIHRvIGJlIGRlc2NyaWJlZCBhcyBoYXZpbmcgc3VjaCBhIGRl cGVuZGVuY3k/DQoNCkkgZG9u4oCZdCB0aGluayBpdCBpcyBhbHdheXMgdGhlIGNhc2UgdGhhdCB0 aGUgcm9sZSBwdWJsaXNoaW5nIHRoZSByZWZlcmVuY2UgdmFsdWVzIGlzIHRoZSBzYW1lIGFzIHRo ZSByb2xlIHB1Ymxpc2hpbmcgdGhlIHB1YmxpYyBrZXkgdXNlZCB0byB2ZXJpZnkuDQpbbm1zXSBh Z3JlZS4gVGhlc2UgY291bGQgYmUgZGlmZmVyZW50IG1lY2hhbmlzbXMuIEhvd2V2ZXIsIHRoZSBB c3NlcnRlciBhbmQgdGhlIGludHJvZHVjdGlvbiBvZiB0aGUgQXNzZXJ0ZXIgdG8gdGhlIFZlcmlm aWVyIGRvIG5vdCBuZWNlc3NhcmlseSByZXF1aXJlIGFub3RoZXIgYXJjaGl0ZWN0dXJhbCByb2xl LiBUaGV5IGNvdWxkIHNpbXBseSBhZ3JlZSB0byBtZWV0IHBoeXNpY2FsbHkgYW5kIGV4Y2hhbmdl IHB1YmxpYyBrZXlzIChQR1Aga2V5IHBhcnR5KS4NCkZvciBleGFtcGxlLCBhIFRQTSBvciBUUE0t bGlrZSBzdWJzeXN0ZW0gbWlnaHQgZXhpc3QgYW5kIGhhdmUgdGhlIHNpZ25pbmcga2V5cy4gSXQg aXMgbWFkZSBieSBvbmUgbWFudWZhY3R1cmVyLiBJdCBoYXMgc29tZSBpbnB1dHMgZm9yIG1lYXN1 cmVtZW50cyBhbmQgY2xhaW1zIGFuZCBpcyB0YXNrZWQgd2l0aCBtZWFzdXJpbmcgdGhlIEhMT1Mu IEl0IGNhbiBldmVuIGJlIHVzZWQgd2l0aCBtYW55IGRpZmZlcmVudCBITE9T4oCZcy4gVGhlIHJl ZmVyZW5jZSB2YWx1ZXMgZG9uJ3QgY29tZSBmcm9tIHRoaXMgdmVuZG9yLiBJbnN0ZWFkIHRoZXkg Y29tZSBmcm9tIHRoZSB2YXJpb3VzIEhMT1MgdmVuZG9ycy4NCg0KTEwNCg0KDQo= --_000_A8D75C7BEC1340BDBB0E91B41E249351intelcom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3Jt YWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAubXNv bm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6 bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47 DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQt c2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5h cHBsZS1jb252ZXJ0ZWQtc3BhY2UNCgl7bXNvLXN0eWxlLW5hbWU6YXBwbGUtY29udmVydGVkLXNw YWNlO30NCnNwYW4uRW1haWxTdHlsZTE5DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5 Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7 fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1z aXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJ bWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFn ZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVT IiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5TZWUgaW5saW5lIFtubXNdPG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPk9uIDgvMjIvMTks IDExOjI0IEFNLCAmcXVvdDtMYXVyZW5jZSBMdW5kYmxhZGUmcXVvdDsgJmx0OzxhIGhyZWY9Im1h aWx0bzpsZ2xAaXNsYW5kLXJlc29ydC5jb20iPmxnbEBpc2xhbmQtcmVzb3J0LmNvbTwvYT4mZ3Q7 IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5C ZWxvdzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj48YnI+DQo8YnI+DQo8bzpwPjwvbzpwPjwvcD4NCjxibG9ja3F1b3Rl IHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5PbiBBdWcgMTksIDIw MTksIGF0IDExOjU4IEFNLCBTbWl0aCwgTmVkICZsdDs8YSBocmVmPSJtYWlsdG86bmVkLnNtaXRo QGludGVsLmNvbSI+bmVkLnNtaXRoQGludGVsLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5TZWUgaW5saW5lIFtubXNdPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6LjVpbiI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRp diBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbiI+T24gOC8xOC8xOSwgMTE6MTcgQU0sICZxdW90O1JBVFMgb24gYmVo YWxmIG9mIExhdXJlbmNlIEx1bmRibGFkZSZxdW90OyAmbHQ7PGEgaHJlZj0ibWFpbHRvOnJhdHMt Ym91bmNlc0BpZXRmLm9yZyI+PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+cmF0cy1ib3VuY2Vz QGlldGYub3JnPC9zcGFuPjwvYT48c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4m bmJzcDs8L3NwYW4+b24gYmVoYWxmDQogb2Y8c3BhbiBjbGFzcz0iYXBwbGUtY29udmVydGVkLXNw YWNlIj4mbmJzcDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOmxnbEBpc2xhbmQtcmVzb3J0LmNvbSI+ PHNwYW4gc3R5bGU9ImNvbG9yOnB1cnBsZSI+bGdsQGlzbGFuZC1yZXNvcnQuY29tPC9zcGFuPjwv YT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRp dj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5IZXJl4oCZcyBtdWNoIG9mIHdoYXQg SSB0aGluayBkZWZpbmVzIGFuIOKAnGF0dGVzdGVyJnF1b3Q7OjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4mbmJzcDs8bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVp biI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+MSkgSXQg aGFzIHNvbWUgcHJpdmF0ZSAvIHNlY3JldCBrZXkgbWF0ZXJpYWwgaXQgdXNlcyB0byBzaWduIGNs YWltcy4gVXN1YWxseSB0aGlzIGlzIGFuIEVDRFNBIHByaXZhdGUga2V5LCBidXQgaXQgY291bGQg YmUgYSBzeW1tZXRyaWMga2V5IHVzZWQgd2l0aCBhIE1BQy4gVGhlIFJBVFMgYXJjaGl0ZWN0dXJl IGRvY3VtZW50IHJlZmVycyB0byB0aGlzIGFzIGFuIOKAnGF0dGVzdGF0aW9uDQogY3JlZGVudGlh bOKAnSBhbmQgdG8gdGhlIHByb2Nlc3Mgb2Ygc2lnbmluZyBhcyAmcXVvdDtQcm92aWRlIG9yIGNy ZWF0ZSBwcm9vZiB0aGF0IGFuIGFzc2VydGlvbiBpcyBib3VuZCB0byB0aGUgQXR0ZXN0ZXLigJ0g KGJ5IG15IHVuZGVyc3RhbmRpbmcpLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+MikgSXQgb3V0cHV0czxzcGFuIGNs YXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48aT5ldmlkZW5jZTwvaT4u IEFuIEVBVCBpcyBldmlkZW5jZS4gRXZpZGVuY2UgaXMgY2xhaW1zIC8gYXNzZXJ0aW9ucyB0aGF0 IGFyZSBzaWduZWQgc28gdGhlaXIgYXV0aGVudGljaXR5IGNhbiBiZSBjaGVja2VkIGJ5IHRoZSB2 ZXJpZmllci4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRp diBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbiI+VGhlIFJBVFMgYXJjaGl0ZWN0dXJlIGRvY3VtZW50IGRvZXNu4oCZ dCBmb3JtYWxseSBkZWZpbmUgZXZpZGVuY2UgKGl0IHJlYWxseSBuZWVkcyB0byksIGJ1dCB1c3Vh bGx5IGRlcGljdHMgaXQgYXMgd2hhdCBnb2VzIGZyb20gdGhlIGF0dGVzdGVyIHRvIHRoZSB2ZXJp Zmllci4gQWxzbywgZXZlcnlvbmUgSSBoYXZlIHRhbGtlZCB0byBwZXJzb25hbGx5IHNlZW1zIHRv IHVzZQ0KIHRoZSB0ZXJtPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7 PC9zcGFuPjxpPmV2aWRlbmNlPC9pPiZuYnNwO2luIHRoaXMgd2F5LjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4mbmJzcDs8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6 LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+Mykg SXQgaXMgYW4gaW1wbGVtZW50YXRpb24mbmJzcDtvZiBFQVQgb3Igc29tZSBvdGhlciBhdHRlc3Rh dGlvbiB0b2tlbiBmb3JtYXQuIEl0IGlzIG5vdCBhIGxlZ2FsIGVudGl0eSBsaWtlIGEgY2hpcCBt YW51ZmFjdHVyZXIgb3Igc2VydmljZSBvcGVyYXRvci4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+Jm5ic3A7PG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjQpIFRo ZXJlIGlzIGEgbm90aW9uIG9mIGEgYm91bmRhcnkgYXJvdW5kIHRoZSBhdHRlc3Rlci4gVGhlIGJv dW5kYXJ5IG1pZ2h0IHRoZSBURUUgYm91bmRhcnksIGEgdXNlciBtb2RlIC8ga2VybmVsIG1vZGUg Ym91bmRhcnksIGluc2lkZSBhIFRQTSB2cyBvdXRzaWRlIGEgVFBNIGNoaXAgb3Igc2ltcGx5IHRo ZSBib3VuZHMgb2YgYW4gQW5kcm9pZCBhcHAuIFRoZSBrZXkNCiBtYXRlcmlhbCBhbmQgc2lnbmlu ZyBpbXBsZW1lbnRhdGlvbiBhcmUgaW5zaWRlIHRoaXMgYm91bmRhcnkuIChJTU8gbW9zdCBkZWZp bml0aW9ucyBvZiByb290IG9mIHRydXN0IHNlZW0gdG8gbGFjayB0aGlzIGNvbmNlcHQpLiZuYnNw OzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJn aW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDou NWluIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4N CjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjUpIEZvciBtb3N0IGltcGxlbWVudGF0aW9ucywgdGhlIGNs YWltcyBvcmlnaW5hdGUgaW5zaWRlIHRoZSBib3VuZGFyeSwgYnV0IHRoYXQgaXMgbm90IHJlcXVp cmVkLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJt YXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDouNWluIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxk aXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5JIGRvbuKAmXQgdW5kZXJzdGFuZCB0aGUgdGVybTxz cGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48aT5jbGFpbWFu dDwvaT4mbmJzcDt5ZXQsIHNvIEnigJltIGdvaW5nIGF2b2lkIGl0LjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41 aW4iPltubXNdIENsYWltYW50IGlzIHN5bm9ueW1vdXMgd2l0aCDigJhhc3NlcnRlcuKAmSBpbiB0 aGUgbW9zdCByZWNlbnRseSBwcmVzZW50ZWQgYXJjaGl0ZWN0dXJlIHNsaWRlcy4gSSBiZWxpZXZl IGZpeGluZyB0aGUgdGVybSBpbiB0aGUgYXJjaCBkcmFmdCBpcyBvbiB0aGUgaXNzdWVzIGxpc3Qu IEEgc2ltcGxlIGRlZmluaXRpb24gaXMgdGhlIEFzc2VydGVyIChDbGFpbWFudCkNCiBpcyBhIHN1 cHBseSBjaGFpbiBlbnRpdHkgdGhhdCBjb252ZXlzIHJlZmVyZW5jZSB2YWx1ZXMgdG8gYSBWZXJp ZmllciBzbyB0aGF0IHRoZSBWZXJpZmllciBjYW4gY29tcGFyZSDigJhyZWZlcmVuY2XigJkgY2xh aW1zIHdpdGggYWN0dWFsIGNsYWltcyBha2Eg4oCYZXZpZGVuY2XigJk8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJn aW4tbGVmdDouNWluIj5JIGZldyBlbWFpbHMgYWdvLCBJIGRlc2NyaWJlZCBob3cgdHJ1c3QgaXMg ZnVuZGFtZW50YWxseSBlc3RhYmxpc2hlZCBvdXQgb2YgYmFuZC4gU29tZSBob3cgdGhlIHZlcmlm aWVyL3JlbHlpbmcgcGFydHkgbXVzdCBnZXQgdGhlIHB1YmxpYyBrZXkgdG8gdmVyaWZ5IHRoZSBz aWduYXR1cmUgb24gdGhlIHRva2VuLiBUaGlzIGlzIGFsc28gaG93IHRoZXkgaW1wbGljaXRseQ0K IGtub3cgc29tZSBvZiB0aGUgbWFpbiBzZWN1cml0eSBjaGFyYWN0ZXJpc3RpY3Mgb2YgdGhlIGVu dGl0eSBiZWluZyBhdHRlc3RlZCB0bywgbGlrZSBob3cgd2VsbCB0aGUgcHJpdmF0ZSBrZXkgaXMg cHJvdGVjdGVkLiBTb21lb25lIGhhcyB0byBwdWJsaXNoIHRoaXMgcHVibGljIGtleSBhbmQgdGhl IGltcGxpY2l0IGNoYXJhY3RlcmlzdGljcyBhc3NvY2lhdGVkIHdpdGggaXQuPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxl ZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+VGhhdCBoYXMgdG8gYmUgYSByb2xl IGluIHRoZSBSQVRTIGFyY2hpdGVjdHVyZS4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPltubXNdIEl0IGlzIGNsZWFybHkgYSBkZXBlbmRlbmN5IOKAkyBpZiBub3Qg b24gYSBSQVRTIHJvbGUgZGlyZWN0bHkgdGhlbiBvbiBzb21ldGhpbmcgZWxzZSBvdXRzaWRlIG9m IHRoZSBhcmNoaXRlY3R1cmUuDQo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4t bGVmdDouNWluIj5JdCBzZWVtcyBsaWtlIGNsYWltYW50IGlzIGNsb3Nlc3QgdG8gdGhhdCByb2xl LjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+W25tc10gQXNzZXJ0ZXIgKGNs YWltYW50KSBhbmQgVmVyaWZpZXIgaGF2ZSB0aGUgY2hhbGxlbmdlIG9mIHNvbWVob3cgaW50cm9k dWNpbmcgdGhlbXNlbHZlcy4gR2l2ZW4gdGhlcmUgYXJlIGV4aXN0aW5nIGF1dGhlbnRpY2F0aW9u IGZyYW1ld29ya3MgYW5kIHByb3RvY29scyB0aGF0IGFkZHJlc3MgYXV0aGVudGljYXRpb24gYW5k IHRydXN0ZWQgMzxzdXA+cmQ8L3N1cD4gcGFydGllcy4gTWF5YmUgaXQgaXMgT0sNCiBmb3IgdGhl IEFzc2VydGVyIHJvbGUgdG8gYmUgZGVzY3JpYmVkIGFzIGhhdmluZyBzdWNoIGEgZGVwZW5kZW5j eT8gPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+SSBkb27i gJl0IHRoaW5rIGl0IGlzIGFsd2F5cyB0aGUgY2FzZSB0aGF0IHRoZSByb2xlIHB1Ymxpc2hpbmcg dGhlIHJlZmVyZW5jZSB2YWx1ZXMgaXMgdGhlIHNhbWUgYXMgdGhlIHJvbGUgcHVibGlzaGluZyB0 aGUgcHVibGljIGtleSB1c2VkIHRvIHZlcmlmeS4NCjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+W25tc10gYWdyZWUuIFRoZXNlIGNvdWxkIGJlIGRpZmZlcmVudCBtZWNoYW5p c21zLiBIb3dldmVyLCB0aGUgQXNzZXJ0ZXIgYW5kIHRoZSBpbnRyb2R1Y3Rpb24gb2YgdGhlIEFz c2VydGVyIHRvIHRoZSBWZXJpZmllciBkbyBub3QgbmVjZXNzYXJpbHkgcmVxdWlyZSBhbm90aGVy IGFyY2hpdGVjdHVyYWwgcm9sZS4gVGhleSBjb3VsZCBzaW1wbHkgYWdyZWUgdG8gbWVldCBwaHlz aWNhbGx5IGFuZCBleGNoYW5nZQ0KIHB1YmxpYyBrZXlzIChQR1Aga2V5IHBhcnR5KS48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5G b3IgZXhhbXBsZSwgYSBUUE0gb3IgVFBNLWxpa2Ugc3Vic3lzdGVtIG1pZ2h0IGV4aXN0IGFuZCBo YXZlIHRoZSBzaWduaW5nIGtleXMuIEl0IGlzIG1hZGUgYnkgb25lIG1hbnVmYWN0dXJlci4gSXQg aGFzIHNvbWUgaW5wdXRzIGZvciBtZWFzdXJlbWVudHMgYW5kIGNsYWltcyBhbmQgaXMgdGFza2Vk IHdpdGggbWVhc3VyaW5nIHRoZSBITE9TLiBJdCBjYW4gZXZlbiBiZQ0KIHVzZWQgd2l0aCBtYW55 IGRpZmZlcmVudCBITE9T4oCZcy4gVGhlIHJlZmVyZW5jZSB2YWx1ZXMgZG9uJ3QgY29tZSBmcm9t IHRoaXMgdmVuZG9yLiBJbnN0ZWFkIHRoZXkgY29tZSBmcm9tIHRoZSB2YXJpb3VzIEhMT1MgdmVu ZG9ycy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5MTDxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_A8D75C7BEC1340BDBB0E91B41E249351intelcom_-- From nobody Thu Aug 22 18:35:29 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 56796120852 for ; Thu, 22 Aug 2019 18:35:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ueslr8EY6ulr for ; Thu, 22 Aug 2019 18:35:25 -0700 (PDT) Received: from p3plsmtpa06-02.prod.phx3.secureserver.net (p3plsmtpa06-02.prod.phx3.secureserver.net [173.201.192.103]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 37930120829 for ; Thu, 22 Aug 2019 18:35:25 -0700 (PDT) Received: from [192.168.1.76] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id 0yU6iArEDF7xo0yU7iTX85; Thu, 22 Aug 2019 18:35:23 -0700 From: Laurence Lundblade Message-Id: <7F4FC12D-8F77-46BD-A025-C223F670826C@island-resort.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_A79076C9-F12F-462F-8468-9001D94A1511" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Thu, 22 Aug 2019 18:35:22 -0700 In-Reply-To: Cc: "Oliver, Ian (Nokia - FI/Espoo)" , "rats@ietf.org" To: "Smith, Ned" References: <3F5C57F7-C75F-4C27-9898-25AF98237DE9@island-resort.com> <10825C3E-81E0-43A9-B529-28E7C501E098@intel.com> <910BEC2B-AA72-4106-9E5E-5DDEC6B9CFED@island-resort.com> X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfOZCZbvzkDcTEQ+TfXSBmptUfLyA87dDkPmGKM45frntIS/P+pxglNKgvLSjVFZrqBYpPv5ojuX/GJk17lEvQo0UN02nOThVPVJYfEeUD3OSg5gIk7s/ IPZzKFjMEoiR+FTzWD7c48fMu2lLensLl2OT119Ql+IveeyyrY8hV/0MrpRLa2VnYYFuo9z6yTqL81GbtX9ROZerRm0otrHdH3PIHcO5HHy6Lie+k+MUdaYe EPUQdgVuRkXqARvbhsfqLw== Archived-At: Subject: Re: [Rats] Use the term "attester" instead of root of trust X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Aug 2019 01:35:27 -0000 --Apple-Mail=_A79076C9-F12F-462F-8468-9001D94A1511 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On Aug 22, 2019, at 6:05 PM, Smith, Ned wrote: >=20 > See inline [nms] > =20 > On 8/22/19, 11:24 AM, "Laurence Lundblade" > wrote: > =20 > Below >=20 >=20 >> On Aug 19, 2019, at 11:58 AM, Smith, Ned > wrote: >> =20 >> See inline [nms]. >> =20 >> I don=E2=80=99t understand the term claimant yet, so I=E2=80=99m = going avoid it. >> [nms] Claimant is synonymous with =E2=80=98asserter=E2=80=99 in the = most recently presented architecture slides. I believe fixing the term = in the arch draft is on the issues list. A simple definition is the = Asserter (Claimant) is a supply chain entity that conveys reference = values to a Verifier so that the Verifier can compare =E2=80=98reference=E2= =80=99 claims with actual claims aka =E2=80=98evidence=E2=80=99 >=20 > =20 > I few emails ago, I described how trust is fundamentally established = out of band. Some how the verifier/relying party must get the public key = to verify the signature on the token. This is also how they implicitly = know some of the main security characteristics of the entity being = attested to, like how well the private key is protected. Someone has to = publish this public key and the implicit characteristics associated with = it. > =20 > That has to be a role in the RATS architecture.=20 > [nms] It is clearly a dependency =E2=80=93 if not on a RATS role = directly then on something else outside of the architecture. I think it should be in the architecture document because it is crucial. = We don=E2=80=99t have to define a protocol or info model or anything = for it, but we should talk about it and generally frame it up.=20 > =20 > It seems like claimant is closest to that role. > [nms] Asserter (claimant) and Verifier have the challenge of somehow = introducing themselves. Given there are existing authentication = frameworks and protocols that address authentication and trusted 3rd = parties. Maybe it is OK for the Asserter role to be described as having = such a dependency?=20 Seems OK to me to describe the service needed at a very high level and = leave it open as to the mechanism. As you say, it can be a physical meeting to exchange PGP keys. Or maybe = there are new businesses that step in to aggregate the way CA=E2=80=99s = work for TLS. Lots of different solutions are likely in between. I think the out-of-band trust role is much more important than the = reference-value-supplying role. You can have real attestation without = reference values. For example, most claims can be implicit. The entity = has secure boot and can be assumed to perform correctly. Maybe the only = claim is location. If you don=E2=80=99t have the out-of-band trust, the measurements are = worthless, so the architecture is incomplete if it just has a role that = provides reference values. I hope we can get to a clear architecture with all of this laid out. I = think it will help cut through a lot of confused conversations. LL --Apple-Mail=_A79076C9-F12F-462F-8468-9001D94A1511 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8

On Aug 22, 2019, at 6:05 PM, Smith, Ned <ned.smith@intel.com>= wrote:

See = inline [nms]
 
On 8/22/19, 11:24 = AM, "Laurence Lundblade" <lgl@island-resort.com> wrote:
 
Below


On Aug 19, 2019, at 11:58 AM, Smith, = Ned <ned.smith@intel.com> = wrote:
 
See inline = [nms].
 
I don=E2=80=99t understand the = term claimant yet, so I=E2=80=99m going avoid it.
[nms] Claimant is synonymous with =E2=80=98asserter=E2=80=99 = in the most recently presented architecture slides. I believe fixing the = term in the arch draft is on the issues list. A simple definition is the = Asserter (Claimant) is a supply chain entity that conveys reference = values to a Verifier so that the Verifier can compare =E2=80=98reference=E2= =80=99 claims with actual claims aka =E2=80=98evidence=E2=80=99
 
I few emails ago, I described how trust is = fundamentally established out of band. Some how the verifier/relying = party must get the public key to verify the signature on the token. This = is also how they implicitly know some of the main security = characteristics of the entity being attested to, like how well the = private key is protected. Someone has to publish this public key and the = implicit characteristics associated with it.
 
That has to be a role in the RATS = architecture. 
[nms] It is clearly a dependency =E2=80=93 if not on a RATS = role directly then on something else outside of the = architecture.

I think it should be in the architecture document = because it is crucial.  We don=E2=80=99t have to define a protocol = or info model or anything for it, but we should talk about it and = generally frame it up. 

 
It seems like claimant is closest to = that role.
[nms] Asserter (claimant) and Verifier have the challenge of = somehow introducing themselves. Given there are existing authentication = frameworks and protocols that address authentication and trusted 3rd parties. Maybe it is OK for = the Asserter role to be described as having such a dependency? 

Seems OK to me to describe the service = needed at a very high level and leave it open as to the = mechanism.

As you say, it can be a = physical meeting to exchange PGP keys. Or maybe there are new businesses = that step in to aggregate the way CA=E2=80=99s work for TLS. Lots of = different solutions are likely in between.

I think the out-of-band trust role is much more = important than the reference-value-supplying role. You can have real = attestation without reference values. For example, most claims can be = implicit. The entity has secure boot and can be assumed to perform = correctly. Maybe the only claim is location.

If you don=E2=80=99t have the out-of-band trust, = the measurements are worthless, so the architecture is incomplete if it = just has a role that provides reference values.


I hope we can get to a = clear architecture with all of this laid out. I think it will help cut = through a lot of confused conversations.

LL


= --Apple-Mail=_A79076C9-F12F-462F-8468-9001D94A1511-- From nobody Fri Aug 23 10:52:11 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F212312006A; Fri, 23 Aug 2019 10:52:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.499 X-Spam-Level: X-Spam-Status: No, score=-14.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=DcyhyuP3; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=t632JQuf Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id R6_4LdzAeZiw; Fri, 23 Aug 2019 10:52:08 -0700 (PDT) Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1FF7E120044; Fri, 23 Aug 2019 10:52:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=6667; q=dns/txt; s=iport; t=1566582728; x=1567792328; h=from:to:subject:date:message-id:mime-version; bh=usnAfWqWCEtLkzmWAfGsdM5tLIlCpWjVNtWI3RhHSNY=; b=DcyhyuP3lglbWRPpyBy7GTw94YohB+MMZ9aRQFnlzbJdVziD2bf3oemB N7vHGfQwna3KT0/KsMg8Ye4rcNfl+lG5KdyHIjZv+59zMEIM591vSb3Nl LskoSJBJhDIhw/YpmV0GQS91sC5+y4SkUMAeW0HRnJDvfXtGxmPeWd613 o=; IronPort-PHdr: =?us-ascii?q?9a23=3Ar+uWSx+BBHUnjv9uRHGN82YQeigqvan1NQcJ65?= =?us-ascii?q?0hzqhDabmn44+8ZR7E/fs4iljPUM2b8P9Ch+fM+4HYEW0bqdfk0jgZdYBUER?= =?us-ascii?q?oMiMEYhQslVciOAEjkLfjlRyc7B89FElRi+iLzPA=3D=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0ArAADeJmBd/4sNJK1LFwMbAQEBAQM?= =?us-ascii?q?BAQEHAwEBAYFTBgEBAQsBgRUvUANtViAECyqEIINHA4RShhtNlRuEW4EugSQ?= =?us-ascii?q?DVAkBAQEMAQElCAIBAYQ/GYJQIzQJDgIKAQEEAQEBAgEGBG2FLQyFYxEdAQE?= =?us-ascii?q?kFA0EATQEDAYCBBkXJAMEATSDAAGBHU0DHQEOOaB8AoE4iGFzgTKCewEBBUR?= =?us-ascii?q?yBIENglgYghYDBgWBLwGFWYYWGIF/gREnH4VrBBiBOCYKDBoIghIqMoILG48?= =?us-ascii?q?chRGJCI42CQKCHYZqjVkbgjKHMI5sjWeHaZA5AgQCBAUCDgEBBYFQOIFYcBV?= =?us-ascii?q?lAYJBE4IvDBeBMIIfilNyAYEoi1aCLgEB?= X-IronPort-AV: E=Sophos;i="5.64,422,1559520000"; d="scan'208,217";a="399977690" Received: from alln-core-6.cisco.com ([173.36.13.139]) by rcdn-iport-5.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 23 Aug 2019 17:52:06 +0000 Received: from XCH-ALN-008.cisco.com (xch-aln-008.cisco.com [173.36.7.18]) by alln-core-6.cisco.com (8.15.2/8.15.2) with ESMTPS id x7NHq6CW000736 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Fri, 23 Aug 2019 17:52:06 GMT Received: from xhs-aln-003.cisco.com (173.37.135.120) by XCH-ALN-008.cisco.com (173.36.7.18) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 23 Aug 2019 12:52:06 -0500 Received: from xhs-rcd-002.cisco.com (173.37.227.247) by xhs-aln-003.cisco.com (173.37.135.120) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 23 Aug 2019 12:52:06 -0500 Received: from NAM05-BY2-obe.outbound.protection.outlook.com (72.163.14.9) by xhs-rcd-002.cisco.com (173.37.227.247) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Fri, 23 Aug 2019 12:52:05 -0500 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=CIs6N0UVIl4JZDi87WzOq45FuWmJfoVJLET9cLocDo4VYjbsyQ10b3Q8/0PWOg2ECpYDRGNxt3Pni6wBiT77uHOnGWEnFyZDSZ+AQC6VVA/H6G53fGjaLLGryiirmOQD0JDMm+ZANU1uD/ilOCCS8ADueVretfKou7dFPeeDb5GSNlCsqF6LR0aOPUdNkbe98lpgiKmGKqsewD4sFn3P8GcyuZVcaPuL3uT7ljsX5eQl6OLFXXfT/eqsfzDBc8N7YH2tUGu2vU0Diq4tzPmLLxW2O/t68tDKk6YU3Js79LHyQyD3kB2x5e8VGFS38xFWGYLzkU7IK+Myn1DLpvUdrQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=usnAfWqWCEtLkzmWAfGsdM5tLIlCpWjVNtWI3RhHSNY=; b=W6WE2zTAHW3iy7UP3DCECGe9WmDgcBGCJ6+fIYxtjrnLi7mhM/XU/GGC1slqTgK6gjukV/MFQd5sukJO8LwiI+NQ9ChIWaaI16VeBsuR5f4t5lOLuwHY/rIA/EIIrE/VltaGKl0jfObeG0xaId+uuav+fE2vAARhvuTQ9aKIN4Yjf0x+rGEnB7cX5pWD6yfZPirJxzD+R2Dhv3MHKP7KK2EqFF15mEC2SyC1AsR507brsi1kg/8BD44GBSEmj3r+kmfoCU/K6VLQUj0JqseX7iWQkUE1zVLGRKvDZ81wmzi5U2mwjs65kWeiNBqazBLkKisMIT8LnW9e++jFiNCMJA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=usnAfWqWCEtLkzmWAfGsdM5tLIlCpWjVNtWI3RhHSNY=; b=t632JQuf2IwRGRyCu4Hh8cZq75MLaZ69fAVxMEO3LV3R7mAocKo+s2maTeNXjeEVBAsTnXCdh9jFdO+BliMjhH6e+ssucDcNvBfVXN6DydajQe1q7SKBSUZDfkxBa9Yn3T4Ec/T7wrrCKZxw7UCT2ijvBVkKm7xKXItIEE8WpbQ= Received: from MWHPR11MB1791.namprd11.prod.outlook.com (10.175.53.138) by MWHPR11MB1933.namprd11.prod.outlook.com (10.175.54.20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2178.18; Fri, 23 Aug 2019 17:52:04 +0000 Received: from MWHPR11MB1791.namprd11.prod.outlook.com ([fe80::a9d8:d4d6:df7b:5c84]) by MWHPR11MB1791.namprd11.prod.outlook.com ([fe80::a9d8:d4d6:df7b:5c84%8]) with mapi id 15.20.2178.020; Fri, 23 Aug 2019 17:52:03 +0000 From: "Nancy Cam-Winget (ncamwing)" To: "rats@ietf.org" , "teep@ietf.org" Thread-Topic: RATS Virtual meeting (1st hour with TEEP) Thread-Index: AQHVWdt4OyVlBxcp2ky+QX9/Beaotg== Date: Fri, 23 Aug 2019 17:52:03 +0000 Message-ID: <79E5AD05-85F9-47F6-936F-E5BB5762DB83@cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.10.d.190811 authentication-results: spf=none (sender IP is ) smtp.mailfrom=ncamwing@cisco.com; x-originating-ip: [2001:420:292:1260:501d:68aa:7d24:8d07] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 9cbc6384-97dc-4753-55ac-08d727f29b75 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600166)(711020)(4605104)(1401327)(2017052603328)(7193020); SRVR:MWHPR11MB1933; x-ms-traffictypediagnostic: MWHPR11MB1933: x-ms-exchange-purlcount: 3 x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:6790; x-forefront-prvs: 0138CD935C x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(4636009)(346002)(39860400002)(376002)(366004)(136003)(396003)(199004)(189003)(54896002)(33656002)(486006)(476003)(71190400001)(81156014)(16799955002)(81166006)(450100002)(606006)(25786009)(14454004)(8936002)(86362001)(8676002)(110136005)(58126008)(2501003)(478600001)(966005)(316002)(99286004)(7736002)(5660300002)(71200400001)(6506007)(236005)(76116006)(91956017)(66946007)(66476007)(36756003)(4744005)(102836004)(46003)(6116002)(186003)(53936002)(6486002)(6436002)(6512007)(66446008)(2906002)(66556008)(64756008)(256004)(6306002)(2616005)(14444005); DIR:OUT; SFP:1101; SCL:1; SRVR:MWHPR11MB1933; H:MWHPR11MB1791.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 4dCCT1dT3q7BQM1HiptWQerD3XbIj5yw/ksnrhWenmV/R/CYnZ3+HJnoilzan1gVqqPQyHdw1zCbvUO2jHytEiT+wO5LHEDe4Sgxu9pB8i5xlPgPKjrLBZC51pYxN5adjBU/XLMlFT4lQx51p2Q3WUPdsj4k92OkmZuLLUZwLP6Dj2hf5EdO2UclcXOPvfMfUQSiq7ofU5fsQzka1T8f5jj58iPyW6jeHEMyf4dbYaefBZxtklkChLPpDdnT5GokYuleL9+Ph83jn02NXy6JYk7GQnjFoRoJb5cLRRw5cg4xxCDjAH4A8oKoPlv3VJlVEEJ9ARJG7B9WkPV5CesbXEUNEkYQNC+MkdkZsF32ca2xrDI8most8J3xcL9p9F+1+twpRH8m6QE+/yoMTjGZlNdgK1bK2TgFp5DJQ8Vu/7Y= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_79E5AD0585F947F6936FE5BB5762DB83ciscocom_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 9cbc6384-97dc-4753-55ac-08d727f29b75 X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Aug 2019 17:52:03.8352 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: W1fFvfxVFarkDLgzTT945t3lIb9Bw26h/N73lxhWWuUeHo6AZtelripJBnGeUQ6Wvt41eFx7W/eWiWPWvyqYCA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR11MB1933 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.36.7.18, xch-aln-008.cisco.com X-Outbound-Node: alln-core-6.cisco.com Archived-At: Subject: [Rats] RATS Virtual meeting (1st hour with TEEP) X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Aug 2019 17:52:10 -0000 --_000_79E5AD0585F947F6936FE5BB5762DB83ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 UkFUcyBhbmQgVEVFUCBwYXJ0aWNpcGFudHMsDQpXZSB3aWxsIGJlIGhvbGRpbmcgYSBWaXJ0dWFs IEludGVyaW0gb24gU2VwdCAxMCwgMjAxOSA3LTg6MzBhbSBQU1QuDQoNClRoZSBmaXJzdCBob3Vy IGlzIHRvIGhvbGQgYSBqb2ludCBkaXNjdXNzaW9uIG9uIHRoZSBURUVQIHVzZSBjYXNlcyBhbmQg cmVxdWlyZW1lbnRzLg0KUGxlYXNlIHByb3ZpZGUgb3RoZXIgc3VnZ2VzdGVkIGFnZW5kYSBpdGVt cyBieSByZXNwb25kaW5nDQoNCkluZm9ybWF0aW9uIGFib3V0IHJlbW90ZSBwYXJ0aWNpcGF0aW9u Og0KSk9JTiBXRUJFWCBNRUVUSU5HIGh0dHBzOi8vaWV0Zi53ZWJleC5jb20vaWV0Zi9qLnBocD9N VElEPW1lZmVkNDE4OTViNmRjOTQyYmY5MmExYjRjMTIxZDkwNw0KTWVldGluZyBudW1iZXIgKGFj Y2VzcyBjb2RlKTogNjQ2IDM5MCAzMTENCk1lZXRpbmcgcGFzc3dvcmQ6IGhQckV0eFFjDQpKT0lO IEJZIFBIT05FIDEtNjUwLTQ3OS0zMjA4IENhbGwtaW4gdG9sbCBudW1iZXIgKFVTL0NhbmFkYSkN ClRhcCBoZXJlIHRvIGNhbGwgKG1vYmlsZSBwaG9uZXMgb25seSwgaG9zdHMgbm90IHN1cHBvcnRl ZCk6IHRlbDolMkIxLTY1MC00NzktMzIwOCwsKjAxKjY0NjM5MDMxMSUyMyUyMyowMSoNCg0KV2Fy bSByZWdhcmRzDQogIFRoZSBSQVRzIGFuZCBURUVQIGNoYWlycy4NCg0KDQoNCg== --_000_79E5AD0585F947F6936FE5BB5762DB83ciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: <969CC4C6B5266B4C96D4D1CDF781799F@namprd11.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3Jt YWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOiMwNTYzQzE7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9 DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOiM5NTRGNzI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpz cGFuLkVtYWlsU3R5bGUxNw0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1jb21wb3NlOw0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0Kc3Bh bi5hcHBsZS1jb252ZXJ0ZWQtc3BhY2UNCgl7bXNvLXN0eWxlLW5hbWU6YXBwbGUtY29udmVydGVk LXNwYWNlO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0K CWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0K CXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0K ZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPg0KPC9o ZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9IiMwNTYzQzEiIHZsaW5rPSIjOTU0RjcyIj4N CjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iY29sb3I6YmxhY2siPlJBVHMgYW5kIFRFRVAgcGFydGljaXBhbnRzLDwvc3Bhbj48c3Bh biBzdHlsZT0iY29sb3I6YmxhY2siPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+V2Ugd2lsbCBiZSBob2xkaW5nIGEg VmlydHVhbCBJbnRlcmltIG9uIFNlcHQgMTAsIDIwMTkgNy04OjMwYW0gUFNULiZuYnNwOyZuYnNw Ozwvc3Bhbj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+Jm5ic3A7PC9z cGFuPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5UaGUgZmlyc3QgaG91 ciBpcyB0byBob2xkIGEgam9pbnQgZGlzY3Vzc2lvbiBvbiB0aGUgVEVFUCB1c2UgY2FzZXMgYW5k IHJlcXVpcmVtZW50cy48L3NwYW4+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6Ymxh Y2siPlBsZWFzZSBwcm92aWRlIG90aGVyIHN1Z2dlc3RlZCBhZ2VuZGEgaXRlbXMgYnkgcmVzcG9u ZGluZw0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPkluZm9ybWF0aW9uIGFib3V0 IHJlbW90ZSBwYXJ0aWNpcGF0aW9uOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+Sk9JTiBXRUJFWCBNRUVUSU5HPHNw YW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Imh0 dHBzOi8vaWV0Zi53ZWJleC5jb20vaWV0Zi9qLnBocD9NVElEPW1lZmVkNDE4OTViNmRjOTQyYmY5 MmExYjRjMTIxZDkwNyI+aHR0cHM6Ly9pZXRmLndlYmV4LmNvbS9pZXRmL2oucGhwP01USUQ9bWVm ZWQ0MTg5NWI2ZGM5NDJiZjkyYTFiNGMxMjFkOTA3PC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+TWVldGluZyBu dW1iZXIgKGFjY2VzcyBjb2RlKTogNjQ2IDM5MCAzMTEmbmJzcDsmbmJzcDs8c3BhbiBjbGFzcz0i YXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5NZWV0aW5n IHBhc3N3b3JkOiBoUHJFdHhRYyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOzxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+ Sk9JTiBCWSBQSE9ORSAxLTY1MC00NzktMzIwOCBDYWxsLWluIHRvbGwgbnVtYmVyIChVUy9DYW5h ZGEpPHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xv cjpibGFjayI+VGFwIGhlcmUgdG8gY2FsbCAobW9iaWxlIHBob25lcyBvbmx5LCBob3N0cyBub3Qg c3VwcG9ydGVkKToNCjxhIGhyZWY9InRlbDolMkIxLTY1MC00NzktMzIwOCwsKjAxKjY0NjM5MDMx MSUyMyUyMyowMSoiPnRlbDolMkIxLTY1MC00NzktMzIwOCwsKjAxKjY0NjM5MDMxMSUyMyUyMyow MSo8L2E+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPldhcm0gcmVnYXJkczxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xv cjpibGFjayI+Jm5ic3A7IFRoZSBSQVRzIGFuZCBURUVQIGNoYWlycy48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2NvbG9yOmJsYWNrIj4mbmJzcDs8L3NwYW4+PHNwYW4gc3R5 bGU9ImNvbG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_79E5AD0585F947F6936FE5BB5762DB83ciscocom_-- From nobody Fri Aug 23 11:29:10 2019 Return-Path: X-Original-To: rats@ietf.org Delivered-To: rats@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 58AD71200EF; Fri, 23 Aug 2019 11:29:08 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IETF Meeting Session Request Tool To: Cc: rdd@cert.org, rats@ietf.org, Kathleen.Moriarty.ietf@gmail.com, rats-chairs@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.100.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <156658494828.24971.11466290560098589007.idtracker@ietfa.amsl.com> Date: Fri, 23 Aug 2019 11:29:08 -0700 Archived-At: Subject: [Rats] rats - New Meeting Session Request for IETF 106 X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Aug 2019 18:29:09 -0000 A new meeting session request has just been submitted by Kathleen Moriarty, a Chair of the rats working group. --------------------------------------------------------- Working Group Name: Remote ATtestation ProcedureS Area Name: Security Area Session Requester: Kathleen Moriarty Number of Sessions: 2 Length of Session(s): 2 Hours, 1.5 Hours Number of Attendees: 40 Conflicts to Avoid: Chair Conflict: SecDispatch, SAAG, mile, acme, tls, SACM, TEEP, SUIT, NetConf Key Participant Conflict: cose anima People who must be present: Ned Smith Kathleen Moriarty Nancy Cam-Winget Roman Danyliw Resources Requested: Special Requests: --------------------------------------------------------- From nobody Fri Aug 23 11:38:17 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 79F60120124 for ; Fri, 23 Aug 2019 11:38:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6Mz1lPMlg1KH for ; Fri, 23 Aug 2019 11:38:13 -0700 (PDT) Received: from p3plsmtpa11-06.prod.phx3.secureserver.net (p3plsmtpa11-06.prod.phx3.secureserver.net [68.178.252.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 279F01200F5 for ; Fri, 23 Aug 2019 11:38:13 -0700 (PDT) Received: from [10.17.0.50] ([45.56.150.72]) by :SMTPAUTH: with ESMTPA id 1ERvi7MKqr3HR1ERvijeOS; Fri, 23 Aug 2019 11:38:11 -0700 From: Laurence Lundblade Content-Type: multipart/alternative; boundary="Apple-Mail=_75488829-F1F1-4CFA-BC7D-4CB2D13AB21C" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Message-Id: <7DDCE325-8A86-4AAF-B2CA-F68EF673C395@island-resort.com> Date: Fri, 23 Aug 2019 11:38:10 -0700 To: rats@ietf.org X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfE5WSlaT0sDTmF4OI0z4g6z8GzM2D25wH98JddQVt9BUkyT8YjRMKgrk3U0jSPlErwojLHeetNSYkU9s/+kqoyWZRUPeTmXOfCN5oP2QZM1u8XI41alM B5YqNzIm83EekiUX3ae5kR4DfEA/KrzFVLoxXYTFPg+RQaR/udvwXi1x Archived-At: Subject: [Rats] Comments on architecture diagrams X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Aug 2019 18:38:15 -0000 --Apple-Mail=_75488829-F1F1-4CFA-BC7D-4CB2D13AB21C Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Here=E2=80=99s a few comments on the architecture diagrams below. A) Use the term "reference values" or "known-good-values=E2=80=9D = instead of =E2=80=9CAttestation Assertions=E2=80=9D. We=E2=80=99ve = overused the terms =E2=80=9Cattestation=E2=80=9D and =E2=80=9Cassertion=E2= =80=9D in confusing ways. B) The out-of-band trust establishment is not shown. In the simplest = case it is the publication or distribution of a public key. This happens = along arc I2. Probably there should be an I2a for trust establishment = and an I2b for reference value publication. C) The signing key is provisioned on arc I1. This needs to be shown. D) The characteristics of the Attester will vary widely. Some will be = super hardened like a secure element. Others will not. There will be = some implied claims for the Attester. These are associated with the = signing key because the manufacturer of the Attester will only put a = particular private signing key into Attester with specific = characteristics. So also on arc I1 is the manufacture and construction = of the Attester.=20 E1) Need to get clear on the terminology =E2=80=9CAsserter=E2=80=9D and = =E2=80=9CClaimant=E2=80=9D. I=E2=80=99m not very enthusiastic about = either because they seem like more overload of terms we already have = confusion around. =E2=80=9CSupply Chain Entity=E2=80=9D is better, but I = like =E2=80=9CManufacturer=E2=80=9D because it seems simpler and more = direct to me. E2) Possibly the Attester/Claimant/Manufacturer box has to split in to = two to show the manufacturer of the attester separate from the supplier = of the reference values. F) Don=E2=80=99t use the term =E2=80=9CRoT key=E2=80=9D because it = implies a RoT is required. EAT uses =E2=80=9Cattestation key material=E2=80= =9D or AKM. Could just be =E2=80=9Cattestation key=E2=80=9D. I choose = AKM because of ECDAA where the secrets used for signing are more complex = than just one key pair. G) I don=E2=80=99t understand why "only evidence containing verifiable = AtAS=E2=80=9D is so. For one, the token / evidence might be encrypted = over I3 as part of a privacy management or monetization strategy so they = can=E2=80=99t selectively pull the token apart. Next, it would break the = signing. Next, there=E2=80=99s no reason for it.=20 H) In =E2=80=9CTEE, eSE or similar=E2=80=9D, remove =E2=80=9Cor = similar=E2=80=9D so there is no strong implication it has to be such. = Probably remove =E2=80=9CRoT=E2=80=9D too. (Sometimes TEE=E2=80=99s = implement TPM=E2=80=99s. Sometimes called soft TPM. In this case I argue = that the whole TEE is the RoT because a compromise in the TEE kernel or = boot sequence will compromise the soft TPM). LL --Apple-Mail=_75488829-F1F1-4CFA-BC7D-4CB2D13AB21C Content-Type: multipart/related; type="text/html"; boundary="Apple-Mail=_A79754EC-5B98-44A5-9AA2-5D00728C51B9" --Apple-Mail=_A79754EC-5B98-44A5-9AA2-5D00728C51B9 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
Here=E2=80=99s a few comments on the architecture diagrams = below.

A) Use = the term "reference values" or "known-good-values=E2=80=9D instead of = =E2=80=9CAttestation Assertions=E2=80=9D. We=E2=80=99ve overused the = terms =E2=80=9Cattestation=E2=80=9D and =E2=80=9Cassertion=E2=80=9D in = confusing ways.

B) The out-of-band trust establishment is not shown. In the = simplest case it is the publication or distribution of a public key. = This happens along arc I2. Probably there should be an I2a for trust = establishment and an I2b for reference value publication.

C) The signing key is = provisioned on arc I1. This needs to be shown.

D) The characteristics of the Attester = will vary widely. Some will be super hardened like a secure element. = Others will not. There will be some implied claims for the Attester. = These are associated with the signing key because the manufacturer of = the Attester will only put a particular private signing key into = Attester with specific characteristics. So also on arc I1 is the = manufacture and construction of the Attester. 

E1) Need to get clear on = the terminology =E2=80=9CAsserter=E2=80=9D and =E2=80=9CClaimant=E2=80=9D.= I=E2=80=99m not very enthusiastic about either because they seem like = more overload of terms we already have confusion around. =E2=80=9CSupply = Chain Entity=E2=80=9D is better, but I like =E2=80=9CManufacturer=E2=80=9D= because it seems simpler and more direct to me.

E2) Possibly the = Attester/Claimant/Manufacturer box has to split in to two to show the = manufacturer of the attester separate from the supplier of the reference = values.

F) = Don=E2=80=99t use the term =E2=80=9CRoT key=E2=80=9D because it implies = a RoT is required. EAT uses =E2=80=9Cattestation key material=E2=80=9D = or AKM. Could just be =E2=80=9Cattestation key=E2=80=9D. I choose AKM = because of ECDAA where the secrets used for signing are more complex = than just one key pair.

G) I don=E2=80=99t understand why "only evidence containing = verifiable AtAS=E2=80=9D is so. For one, the token / evidence might be = encrypted over I3 as part of a privacy management or monetization = strategy so they can=E2=80=99t selectively pull the token apart. Next, = it would break the signing. Next, there=E2=80=99s no reason for = it. 

H) = In =E2=80=9CTEE, eSE or similar=E2=80=9D, remove =E2=80=9Cor similar=E2=80= =9D so there is no strong implication it has to be such. Probably remove = =E2=80=9CRoT=E2=80=9D too. (Sometimes TEE=E2=80=99s implement TPM=E2=80=99= s. Sometimes called soft TPM. In this case I argue that the whole TEE is = the RoT because a compromise in the TEE kernel or boot sequence will = compromise the soft TPM).

LL



= --Apple-Mail=_A79754EC-5B98-44A5-9AA2-5D00728C51B9 Content-Transfer-Encoding: base64 Content-Disposition: inline; filename="Screen Shot 2019-08-23 at 11.08.56 AM.png" Content-Type: image/png; x-unix-mode=0644; name="Screen Shot 2019-08-23 at 11.08.56 AM.png" Content-Id: <7982B2FD-C5AF-40C9-8E06-56CA5D288FA3> iVBORw0KGgoAAAANSUhEUgAAAz0AAAQPCAYAAAA6fYVdAAABRmlDQ1BJQ0MgUHJvZmlsZQAAKJFj YGASSSwoyGFhYGDIzSspCnJ3UoiIjFJgf8zAwSDMIMKgw8CamFxc4BgQ4ANUwgCjUcG3awyMIPqy Lsgs14XZhlXxfvOsiua+ehxmG4WpHgVwpaQWJwPpP0CcnlxQVMLAwJgCZCuXlxSA2B1AtkgR0FFA 9hwQOx3C3gBiJ0HYR8BqQoKcgewbQLZAckYi0AzGF0C2ThKSeDoSG2ovCPD6uCuE+oQEOYZ7urgS cC/JoCS1ogREO+cXVBZlpmeUKDgCQylVwTMvWU9HwcjA0JKBARTmENWfb4DDklGMAyFWIMbAYDED KPgQIRYP9MN2OQYG/j6EmBrQvwJeDAwH9xUkFiXCHcD4jaU4zdgIwubezsDAOu3//8/hDAzsmgwM f6////97+///f5cxMDDfYmA48A0A/8xgYq+Y3OAAAAGeaVRYdFhNTDpjb20uYWRvYmUueG1wAAAA AAA8eDp4bXBtZXRhIHhtbG5zOng9ImFkb2JlOm5zOm1ldGEvIiB4OnhtcHRrPSJYTVAgQ29yZSA1 LjQuMCI+CiAgIDxyZGY6UkRGIHhtbG5zOnJkZj0iaHR0cDovL3d3dy53My5vcmcvMTk5OS8wMi8y Mi1yZGYtc3ludGF4LW5zIyI+CiAgICAgIDxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSIiCiAg ICAgICAgICAgIHhtbG5zOmV4aWY9Imh0dHA6Ly9ucy5hZG9iZS5jb20vZXhpZi8xLjAvIj4KICAg ICAgICAgPGV4aWY6UGl4ZWxYRGltZW5zaW9uPjgyOTwvZXhpZjpQaXhlbFhEaW1lbnNpb24+CiAg ICAgICAgIDxleGlmOlBpeGVsWURpbWVuc2lvbj4xMDM5PC9leGlmOlBpeGVsWURpbWVuc2lvbj4K ICAgICAgPC9yZGY6RGVzY3JpcHRpb24+CiAgIDwvcmRmOlJERj4KPC94OnhtcG1ldGE+CqpqmaAA AEAASURBVHgB7N0HuGxFlS/wAslJUHK8IEkQkSgoygUFBERQVJIBRRQRzCOjjA/8nHHGGUcGn4iK +AQjQQRESQoISA4CkkGu5CQ5K/r6V07du2129+nu092n7zmr7rfv7rND7ar/rlq1/mutqj3H3xop RQoEAoFAIBAIBAKBQCAQCAQCgUBgkiIw5yStV1QrEAgEAoFAIBAIBAKBQCAQCAQCgYxAkJ5oCIFA IBAIBAKBQCAQCAQCgUAgMKkRCNIzqV9vVC4QCAQCgUAgEAgEAoFAIBAIBIL0RBsIBAKBQCAQCAQC gUAgEAgEAoFJjUCQnkn9eqNygUAgEAgEAoFAIBAIBAKBQCAQpCfaQCAQCAQCgUAgEAgEAoFAIBAI TGoEgvRM6tcblQsEAoFAIBAIBAKBQCAQCAQCgSA90QYCgUAgEAgEAoFAIBAIBAKBQGBSIxCkZ1K/ 3qhcIBAIBAKBQCAQCAQCgUAgEAgE6Yk2EAgEAoFAIBAIBAKBQCAQCAQCkxqBID2T+vVG5QKBQCAQ CAQCgUAgEAgEAoFAIEhPtIFAIBAIBAKBQCAQCAQCgUAgEJjUCATpmdSvNyoXCAQCgUAgEAgEAoFA IBAIBAJBeqINBAKBQCAQCAQCgUAgEAgEAoHApEYgSM+kfr1RuUAgEAgEAoFAIBAIBAKBQCAQCNIT bSAQCAQCgUAgEAgEAoFAIBAIBCY1AnNN6tpF5QKBQCAQCAQCgXEi8NRTT6Xbb789Pfjgg2n55ZdP K6ywQnrRi140zlzj9kBgtBF44okn0qOPPpr+8pe/pAUXXDC9+MUvTnPPPfdoFzpKFwi0QSBITxtw Wp3629/+lv7617+mOeaYI805ZzjLWuHUr+OBd7+QjHymGgLk1J///OekD1FWQlHvrQXcdttt6d/+ 7d/SKaeckvbff/90wAEHpEUWWaS3zGruev755/M78n6MK5ECgYlG4JFHHklnn312Ouecc9KTTz6Z Vl555bTddtulddddN/SeiX458fyeERg46WEpuPvuu9Njjz2WhXq1pIQ7IT/vvPPmAeQlL3lJmn/+ +TsW+u3yrj6n+TeLxbLLLpsWXXTR5lO1f1MaCABWPlYPVr9nnnkmKxHysi222GLppS99aVpggQU6 Ln/1YZ5x5513pnvuuScLFNZEZeyWVLXDpIq3MsN7oYUW6qm81bL3+/cw8O53mSO/iUOg0zZPSe1W xrSqVbf9tZSR/OhHIjPJh8UXX/wF2XnWvffemx5++OEsdx966KFspCGj1N89SyyxRM+y6gUPrDnQ LT41WYzUoaeffjpj+fjjj+e9+vUrGVtuuOGG9Kc//SlNmzYtvexlL0vzzTdfv7KPfAKBnhC44IIL 0pe//OV0+eWXZx2BLkIH+pd/+Zes6/SU6ThvYrx59tlnsyFnnnnmSbYwEowT1Cl2+8BJz6WXXpq+ 9rWvpauvvvoFpAfhQXKQhbXXXjttsskm6RWveEUW/J0QknZ5t3uPa665ZvrYxz6Wttlmm3aXJdY3 A9Hvf//79Nvf/jade+65+bdjBj3lX3jhhfMgtcEGG6TNNtssrb/++mnFFVfMx9tm3nRS6MRXv/rV dMwxx2Qytc8++2SLIiWlm9QOE+U1mFJ6DKyvfvWr04YbbpjxphBNdBom3hNd13h+/xAYq82PR8a0 KmW3/fXaa69Nhx56aLroootaZdnV8aWWWirLsF133XXmfZQBBiay6qSTTkpwue+++7KBxkUUhJVW Wiltuummaauttkqvec1rcpjWIMJVusVnZiWm4I+LL744feELX0iXXHJJ8j4///nPpzXWWGMKIhFV HhUEGHUvu+yydM011+TQNuVCeq666qqsy22xxRYTUlTyjVxj1FluueUSvYvxJ1Ig0CkCAyc9V155 Zfr1r3+dB17xoDwMEsaOOLBK/vGPf0znnXdeOuKII9KrXvWq9P73vz+95S1vSQb2dp6OVnmPVXme Gpa7dum5555LN998czr++OPTD3/4w3TLLbekueaaK3tGdDKKFCVdPs4RBq6jSLznPe9JW2+9dVpy ySXbPWLmOViwppzTcCMjVNJvfvObNH369LT55pvPvK6TH+0wqeKNwP3gBz/Irmp477jjjhnvibKa DBPvTnCMa/qHgP72wAMPZAsdD0O/CXarNt8PGVOHQi/9FQZCRISbtUrOl/h5stLWKjXLMLKIceaw ww7LhEdejElCUniFnHcP+UJOIUXvete70ic+8YlsAGn1nF6O94JPL8+ZLPd4Jyzo3hGvXCtv4KD7 0UTiOZnrNpG49vrsW2+9NcuTqp5EdtFzyFsG3kEYS8Yq78knn5wNBIw5SM9BBx2U9t5777Fui/OB wEwEBk56KLOUbQMwIrPxxhvnh5dYc2FvSM/111+fbrzxxqz8Y/MGgr322isr4jNL2/SjVd5Nl73g z6WXXjqtt956LzheDsj3d7/7XTrkkEPSiSeemBWVVVZZJa211lrZAmeP+BDUd911V7rpppuy9QNJ Qlz8TVi8733vy0Sp5Ntqj/gRJgSNcDOJZdix1772tR3lUfJuhwlLMLz/8Ic/pOuuuy4/jzWH1QTe yrvMMsuUrIa2HzbeQ6tYPCgjoF8fddRRuZ+/973vTTvttFNfkWnV5vshY+oK2kt/feUrX5n222+/ PBm+Lk/H9EWDugGdJXX77bdvdWkOzeVVLumOO+5I3/nOd9JPfvKTHLa25ZZbpje+8Y3ZqMGzSx7x vngGbxMZdcUVV2SZy+vbz9QLPv18/uyWl7GFEim6gfedMleXBt2P6p45rGOTuW7DwrBfz2G0oP+I zmEE9XcxhgqZpZsIwxfRMuwkFNQmMRAoT6RAoBsEBk56SmFYLQ3k1XCMck6nmjFjRvrRj36Ujj76 6Oxh8ZuV8h3veMeYSn+7vMszOt0rC0KA8JxwwgnZmrHRRhulfffdN+2www4zPVXV/ChXJrqyntoI C0IcKepksqt4bgRH+BmS4z6eL8cIFysFdZvaYaK8iOb3v//9rIwqO4WJZ4qXShjMsNJE4D2susVz /o4AhZxn0WDJ6NFv0lNwbtfmxytjyjPse+mvjD5CytolsgJOvGLCThl9OklWVvrFL36RZQ/POHz/ 6Z/+6QUhUsKH3/72t2fP9HHHHZcNHcrV79QLPv0uw+yUH6KDeCKLPKHF8NVch2H1o+bnDuPvyVy3 YeDXz2eYt1aMsOQmuUSuMJhK9BukaCJITz/rGXlNTQRGYukxVgQEx6o4u+22Wxb6PD8UgPvvv3+o b4bCwVpKiaD8s5gefPDBmXyV0LzmAhEIBq2Pf/zj6Stf+Urac889k3lDwkrGSkIaCBixs6uuump+ jkHQswkX5/qdlBfeiBzvjjBCxEcYIi/QMNOw8R5m3eJZo4NAv2TMRPTXsVBk8SzWVx4lhqJWc0L0 /dVXXz199rOfTV/60pfyHMSx8u/m/Cji0035J+JabRPZIZNbEZ6JKFc8c2oiwOhLH9GXtU0h+zyR wvsZTMkapMe8n14TMsVDj+gjWfKS9zCT53kuMmdjbGZA6kdSP5E16ibUuF2+ri1TD0o5YB9pMAgM zdPTSfFZFAzahD+FnwLOAzSsiWoa2llnnZWXJdUZeaY+/elPp9e//vWdFD9bQ3iFStgJz81YicKC 2AiTe93rXpc3hMfqbbxFzglTGcRqPsJe3va2t2UBd+yxx+ZwF/G6CNsw0kTgPYx6xTNGF4HxypiJ 7K+tUOUNtkkITSvCU70f+RmETBlFfKr1jt+BQCDQGgFjMh2A/iUx3PIQC7nkwRWCjyggReYyW3iq m4RYCKcnrxi0zWVDPoR2ijRhgBViz2tPRiELdCNTHpRNhEohR/b0w/PPP/8fiiAvXiiyvjkhGIiF /DxfKLHQfsctSsXzzQBhCoR9OxmpbDyUVt2VROTASf5Fd5U3DOmwjNr0umIMR/oYfdUPHn4jPwwf BQf3qU8numRzXePvegRGivQoIsJTSI8BdJgxmxod7xIvk073hje8IYeZ1EPX+mg3DZTwIGAsdU2A qLv4e+TPfCKkRwcyj2gQiXDwTGUmBIbpWRs03oQSAcTiQqB1YkUlSIt1hmfPfYRvcyKA5W0AIFyL F9CztFvnCFLv1Qp8zrOaSeO5t7kc/iYoWZMQdW3Hu1RXG6FdV/5qPq3Ko/zyUx+DlXwKJhbyaNfO XW+DZ5mc75nK2dzGWBDlWwaDatkG8Xs8Mmai+2sdHvAtk99hOCwc68rSb3xatc1O+llz+bRF7Vk/ 0Q4pHaXtUSz0ldJHm+9t9bc+op0bp7rtIyXPUkdlK3KqlGMQ/Wi88qKUu7rvBdvx1m1U5XsVl/J7 EJiXvPu5R0L04WJEoajTSxhSGHNLJAidhbfHqrulrbYrh/YhT8tgmwLg+z/Ij+Ml0bmsxmbuN91L 9Iz5O4cffnj67ne/m/ssHG0SGXDkkUfmEP2ShzFKHv/8z/+c3vSmN5XDea9/IU2eTbeyWmKZH1Qu JA+MDwzN2267bWLERsbqxlCExsIx3/zmN/PtVtzdZZddsg75ve99L0+TKPUzvvHAM6LDjI6BXJpC IapIpA05UJLx1feQ3vrWt+ZpFautttqY0zzKvbFvj8DIkR7eB5tEqNmGlUzstYqahqrj8LxQWgeV dF6khjuZUFlnnXXyHCKCBuk5/fTTZ4a4vfzlL+9IuHRbVooxawKBQ3EiBNS/rpOXAZ7SQLFyLyHR axo03oTqqaeemj1mBKBQxbp6VctPGTrzzDOzcLa0r2XN6yxGBN5pp52WV7iRN6+gY5bTFCboncIR qXzzm9+cz1NopPHcWy0roc/SxCPI6mZyOgsWgakNEZQs/34jXq0Gp7ryGCDKxHeDA6HMA2kg0la1 Tx7BUqdqufRZ95iX5rfyIbiE+oUXXvgCsiSP6Y2VCs1jGUbqVcaMQn+tw0ffpbRLrIYsjxOxIMkg 8Klrm532sypWjBAWmhGaY89ijaiQ79o0eU+5s6Q3udZJorSXPmLZ6RkNq3OnfaSaf6mjsYCMMvdL Pv3uR/2SF9Wy+90Ltv2o26jK9yo+/ca832Nwtax+a4NITxkrrKZL1vNiMLwa940N+o9rzXMmf9ol 46Drv/3tb+cVY3lXSvIcdbLXjs5pLARlyX394FOf+lR+HiO0viqfcm3ZkznaUkmOI2PuqZIe47qx B0n51a9+lQ0UJQ/3lt/GKGOpDRkR/r9nY7qCcbxZd1APJAoekjHPGOw5DIXydI+95ztP/iBVdIz/ +q//yvqC87aSYMGY6nrkEllE4nh/Io0fgd411vE/uzaHong7ydXY7XdqajPt4KDGrkHqLJRGcazt VnjrIMsxL6GgEBw6COHBAiCxCiBABmOdyDVWcqpTvsd8SAcXeJ7BH5lhva92wOrtBI+ltBFDRIk1 hFLdSxoG3gStBTEIUstriktu565WD8q5FbQs8sAjQejX4U7ZERJIMMoTKfWNJVYp1jBtCI4ErPdL 0Hmn0njuzRk0/tNPECwLUCiDwbV4dgwCrGkEJ2JiSU9hjFzvdd6Z5vIoJ4scKxrPJ8GtjRhgkEgW cgsSWI0MKWyeDO+56u37XAYq5XGv30IRKIjVhPTAcFikp1cZMyr9tYqd3wiO/ug9IZgsiBQU72yY aRD4NLfNbvqZupMzlGNKhr6i7RVPqL22qr8jGRaRsXw/0tHcpptx1KcZNnrtI9X8qnXUt4QTeX4/ +1E/5UUp+3iw7UfdRlW+F3wGgXk/x+BSzrLX9sgOpIesNp7ob9MaH8w1fiI/xnuKuLHNEvl0JrpS u0QuIBu8Hzwc7pU3JZ6MKkq+8RZmysGgSPezrD6jnRUOlcl5fU/bI+9c00y6yMLq4k/yM+78x3/8 R9ZflNUzjeu8OMZqfxujGCBs8mc8Um5t9aMf/WiWsc31dJ9NnZAUST7Kpg/7PAPjiDyNcUgjjHmH yjfbChbq4T7l5XGjixjXESvGzCA9zej39vdIkR6NxaBNaeRB0HA14GEkHg6Dj06pk+ncGuMgEzJj 09gpmtWO6m9ChlBxDTJmgYN+J4JEByNMxbDqWHWKsefqrD6gSoAQGITBJz/5yZ6KNGy8CaVOUqfX VfNioUKAvv71r+f2w0PIy0JwElgENsFal3q517v6+c9/nv7v//2/eeDRRwxOPDAUYOSVQqDtsGr/ +7//exbgH/7whzORritHOaYtIG+EMksW4s8KPq0x8CmrAQ/Zsn3xi1/MhIZLvxpSpa4UN0KbANev WN+8c9Z07bqaeF6Qy2Gk8ciYUeivdRgZXBlMxKGzUPoOj37M+1hH2Ovy6MexQePTS1+huPj+2//7 f/8vK0z6CEMA+c7QgxDBTD8h1/RXJH333XfPCkgdLpQu/f3HP/5xz32kLt/mY/3qR4OSF+PBtl91 K5h1Krc7va7ka99LuxsU5v0cg6t19FvUgDFDfSnyxhR6SPkeD7lNTiNFcNTfyXV6SSudgReEAU44 WSE85JTvD/LE6IcUfWMEgyovj6gCnhHtix74gQ98IBvEkIdf/vKX2UihvO4z31oYWkmOMRYLDSvJ XCQyQP6SsYpH1702BknlN14xipjXTd8yXunrP/3pT/MYbmXbVkZTeJAb9vInY5SLXDaOwslzlO1n P/tZrieMySD6ggW8jLXyJ5NESSjHjIb3mLGymdiVusW+ewRGhvRQoDVODUKnQgA0BsrWMBJrhE0S KtLvDyg214EwIDR4cjR2wqUqOCjKhMwpp5ySFVudhiW8ek1znr38raMb6AkZHbVdWEyJhfec6u9e njtsvHspY6f3ENQ2VhmWYkKacJMITYp2K49lt/ciUoShJdUZCBASZEYcdDXUjADmrUHEWLktBW+w +chHPtKSgCmva+WvP3Ltqw9FkYCWDAS8Z4ceemjur9qnMhQvpWu0USF9Nokl/eCDD85txpLJVg6b iDQeGTMq/bUON3jzuJGbPJSUd22OdXF6I2zQoFklpXV5jPfYMPDptq9437ygMKFwCZlhsYVJNSwX 0dfutWtknkzWf3h/6hLliVJCweq1j9Tl23ysH/1oUPKiH9iOooxofgf+7rbdDQpzZamOu9Xfzo03 0TEYtYqsp3/QS0pCFMh54wyPC+Wct4cOYWypS3Q6Xn+kRqJXIQ/6IblUEiOZD6TrVzyy+qHzxk3k yybxBunT+qc+LOKg3dL+iBIDoZBzSZ9SByvtmi/T7A0XUbPddtul//7v/87TC9zPgHjGGWck4e5V PHKG//sfsuO9F4+YTwYYkwthLNfStZA68pL8oHN96EMfynUv1zC6i0phTETC6MCwj9QfBIZGengU KNYsICVpuISn4xQ4ljPzWFguKUcGKY10rMSazEph0G+XNDJWZR4Nv6vJwEdJkHTMEiNfvaafv1kX kR6Kso5UOnV5hs7iuE5BALhWGfvp4oSbSX2EuuexuuhgrRLcnEdY4NOOILXKoxwfNt7luYPYC/fT ZpEdIV9VYd6K7JRydHsv7PURgw2B/7nPfS4rvM39xIDAimWAIozL5FHH3Ncq8bIi3AYlg1OZX1eu 99732GOPbIX7n//5n+zSJ5iFU5XBslw77P0gZcwo9Nd2eHpnvBP6lQG+fIDUAE6WkiUUk1Yex3Z5 d3JuGPh021eEn+krLMZbb711jouvC8XRxllaWbFNLEbym5WVKgZi7OHN2DDqfWRQ8mJQ2FZxHpXf 3ba7QWEOj36OwVV8KfdID5JCgedZoJNYbawkYwoihDSU0CwkiW5SR3rIY2ODDyJLdC7eZ3KqOkaW /BlmhMzziCA/JYKhnO9lz2Mj7AxJk+Cnz1pUoM4QpIxkBD2V3FB2eGgD9DCRCq3GOceRE3oAQl8n QxhfYF30T3VspUeRMbZI/UVgaKRHozO3gqVY0pCQHdYCihYljlvVhLGdd945W5jbKeBVGOTBOsCF 2i5RDLHnPRsT05oZPuZtkyh2gyQ96k5QIGmUZQpJXRhfCQXS8QgX21gfOGxX/3LO82FtIQHfJIK9 cCwKUjP5KvfYE3isElZxIQwJsF7TMPHutYyd3kd4cmWLP64T5u3y6eZeRgJ9yCZsiWAVJtBMeKrP 07YYD0yuNADZ88y0uocAJrT1kVaEzYDI68gipe2wjDNeDEqhrtan3e9ByZiJ7q/t6lw9xzrIYKMN 8sBRvng5eDHIDR8t1XcpKK3CNKr5dfp7WPh001e0RxZmXi/tmCfMSkztEtl34IEHtrskn5td+sig 5MUgsR0T/Am4oJt2NyjMS7X7OQaXPO0ZnekjDKGUd+OGZzWPE3QS54wljGnuQZboAs2eUfIYiTIf hYwwPuiD1aiAahnKb1ESJVKiHOt1T89SPkm9RA9ZGc47bZcQH9fSkbxTHhoYISzNumPJm4GR7srD 0yp/GDiHECI+sOH5gXU/ZXK7uk31c0MjPdySP/jBD/JWB7oXToGjVFPSuolhFMrBwqlBtksavUZG 4W5uuAS5TaJQDjIWnjDQGTV2lvdW1gPEQmcwaLNYuAdGzcKlrs4EEmsFq6RE6MBJ3bnFWT+EPOnU 8kcGKQbNQq6atzlOrrGNNw0T7/GWdaz7KUuE3VjCvC6fbu7VbhBgVnWDjInXze24+RnFOscTwwNQ QhlbtW/58gy0IjwlfxYtm0GP9co20aRnUDJmGP214DrevTb4+c9/PsfZH3fccbl/MwohP7we4uhZ OcXh83CQieNNw8Knm76inZv/ILyU9ZiyVWd57aXus0sfGZS8GCS2vbyPQd/TTbsbFOaljv0cg0ue FHB9hVG1JHKkbjxjnKWvGB/oXOQ+w5fwNUawauIpoW8VGYPIDHPpZfqOchXSRbfhxW0uZ7XM5Tfj kbLyDBUdyp4srSNkCAxcpjdCZy2O0CrJj1EK8aEDIWRks7k9pjm4txP9rlX+cXxsBIZGerxUXhwv tSjgSIpBSefBkrnypjXCp7pVnnhLeClYsNsljZ6lU4NuTjo+oiBpwO2U/+Z7u/27LE7gPh2FUK1L ysGq4hrWfUJJGF9dp2u+H64m/YlHldSPQGb9ndGYHCcf70FeVo7bddddcwdvzmdQfw8T70HVoeQr XKzXRSa6uVfsNMXeeyuko5Sh3d4AVdo8IqxttCI9nXo5Db76rGTgQ6TbCft25evXuUHJmGH0135h IB/vW382ACM6QhsNrgZthg5zvXjyXKMdIcbjScPCp5u+Qr5RuiSKjtDdfqXZpY8MSl4MEtt+vaN+ 5tNNuxsU5v2sT3Neom8Yr5BZiT7FSFYXdoXACAOloPOkSvQS8oUuUQiO46YLGGscsyFMdWFwrh1E MtYZL3lqJHLR81t5YZrLwOhsbrmFCOhi8qOr1ulf6sdQX8bE5rzK38ZdugKdDmZ0Tnoa4shDJAyX rIK9MbaKZ8kj9uNDYHyjXRfP1niEDrzzne+cqYDrZDwOJqbZW/5TB7QmOWW/0xduENJYDOK9Juy6 dAahXwhCXchZr/mX+3RAHhuNXAdUT+y/VSJ8eHuEabjPVtfpmu/XQS0vTOmRYKmOCCXlcFqDXMpb fC1L6FidtTn/8f49LLzHW85O7mdB7tWK3M29ZRBRJlYiK04hsWMlym7xgupfJcR0rPvanedh0o4k eQtVneg0CBkzrP46COzIl/e+973ZIEQO8PyQszzMvhGhXZjQ24nls1X5holPN32F8mkrykgrkt+q Xv04PtF9ZFDyYhSw7cf76TSPbtrdoDDvtKy9XIfw2CT9hXFa2xW2XJcQAF5ihktJCBsFXoh3NfLA mMAg5jr30DGG2Q+LMa7UAemxdZqQGNcru1QNye80j7rreIrpvvRMe/O6GRIsj23lTWHKCBCyTU8b tm5WV+bJdGxopAdoLIrFdSeczaR8L1YjsBSyQdlKG140FyCLw7ASMlBiKimFSM8gEssDywg3KaKG eBQPU93zYMAqACtKLtIjRKUonHX3OEb4sHCWOSY8VzpwsV7wqnl2PxdGaFWWuuPDwrvu2bPrMVYz g6pklUOktpPEM1RCNw1A/h5v0pcL0dN+27Xh8T6rm/v7LWOG1V+7qWO31zKqmG8mHNKgKsxYiCR5 Sz6YkN/rHMZRxYeCgowzZFEaikGrW+zGc/1E95FByYtRwHY872WQ9w4K80GVmdGihLYVEiMc7Kij jspLNbd6LvmBDLhHGBkjrjkvImlKkrdzxhub/mAbVjI/yfNLOauG1k7KUCW7yi8vdRpvQvwspkAu kccWBWFIMIZqP3Rgq8VZ0c7qqfREURSdOgHGW77Jfv/wWmAbJMWOmjzNjcgiWV64sKthvWgNsVgh EJ5+WMPrqozwIC5FCIg5ZZFol3QE4Ums+u5lgRnruyaUmU9/+tPj8n61K9N4zw0L7/GWc5Tur1qu tIduPZEGHIovj8hUS73KmGH112G8D6siWZWPBZORSZir0ArzXXh7e0mjik9ReBhXbFMxDUpeBLat W9OgMG/9xPGd4e0VnipsqyTHGGXHSnSYkuglyBO9pHhGGFptRYdDkAqxKvcNcu+55dmeU0hYp8+s GvPkgzQVQ1+nebS6jpGJF954zIBpvq0FvejAPGS8P5bG55V3zNL4w3QCtCr3ZDg+EqQHkDw+XHoG UVYDyyhbPaPMRRg02GIoixLJmm7TqaudZrxl0JAJB4sSSML6bN0kbmh5CHkrwqWb+0fl2mHgPSp1 7Vc5eCKLxZpBYP/995/5dyfPoPzx9o3lJewkr9nxmm5lzGTsr4wNQoxZZX2AlsXWvL9eSM8o46Of 2CihlPSpmAYlLwLb1q1pUJi3fuL4ztAl6Fz0nGKI7dQbgxQgEu5jvKWbCKsvyjksjDVFTykewvGV uPO7y7soRIsssHWazFMVglbIneiZavhep/m0ug4u5u8ccMAB6d3vfnf+fAh90PLYDNzIj7A3Cx2Y e2mxpIJlqzzj+NgIjAzpYRHw8ScuPV/AtSSiOFGhb8NIwrxYwLF5lg7eFI2+n/GU4jcJGZ4kSj9v TKeNWAfQEUoelN5u4lOHgWE3zxgG3rAt+FatNt2Uc5SuZQAoRgAWJ3M2mr+jM0rlHbWydCtjSl+b bP1V3xP6ytrIuMOqS3npVNkp73WU8VE3Hi3KGMVFaEq/rLSl/qO+H5S8GBVsR1G+DwrzQbQ1Rgs6 FiMzYqB/8IiTDZ0Ye4Vk8RLxREhlbtD0xgIqEt2pqj8JhXXPsFKJJimEjqwrYWTGgnYJ0aFvIR10 B3nQt9rNv26X31jnGNx9/85nKEQ7MUj5vISwdLj6LpIwNzIt0vgQGBnSoxo+xGllC6uCeNGW57Ve erFuj6+q7e9mFbBEoUl8rJ8WDrCeuyWl+5F0omJV8SyLLuy7774d143r85BDDskrMcmHsOEJm13T oPGGC89G8WqUyfb9tNQMG3sDaiG6JQQzSE93b6FTGTPZ+6t2Y2OZNbDyhnRDekYdH4q5TTmFKiM+ xQLdXYuZfa8elLwYFWxHUb4PCvNBtEIeXoSHB4ZSb77vxz72sbRnY2XHTpIFDL74xS/mb/0hTfQS JMpEfLKEccVcFOf0Q6FaNiRiLNJRvDPFaFnKo5w2SZ62Vkk7ZRika6ijTUgv8sXo3C4xMptDzQAu IYSM4uo0yITU+KQAI425VcogMUwpS5Ce8aP/92Upxp9PX3LQsEyEs6KZeSy+IaOTDCtZ8tpHF3U0 LkZfBdb4+5HkQyggVGLrkTurJulInWyuVz5KO8JDuPRjUl0/6tZrHoPEW5mqlqZOXdu8e7ZRTJQ2 G6HPAmWbHVKxyBrIDHjtBqpB16dTGTPZ+ysSgDhbFpX1shgHOsV/1PFhHCgGAktXzy59pR3+3faj QcmLQWDbbd3gNIryfVCYt2sXvZwjg+kQJbQN/pahXnfddTvOzmJIPENFdtDZkKhCFKrRHDLlETLv hzLfKikXUiLSR9max2JkqhAm+g9jTSFIzXmqE11LaJhk3PR8ebfTnYxR9D8rXSIfkjyEoiFQ40me q05lYaG6vJSTTsgArw7+dl+7MtflE8fqERgp0qOIVirT+SgnSI/G16pR11ep96NICCuFzkoh4HE6 p/F9nOaO1+4JrAmIDYtCNZZcDD3Sw6WsjrZuks5mHo+OR3gQCJ1MNuzmGcO+dpB4q0txb/sNq7Hw IrTPOuusPBi4Z9QSyzzMWHu0JS7vshT1qJW1Wh5tl1WW0NY/ykBSvWaYvzuRMbNLfyUbEZBu2gHP Bxll8rKwijKXsZt3MOr4sPBOa6wCKkrAOFJVYFrVk8JVjCMTScxbla/bfjQoeTEIbLutG4xGUb4P CvNWbaLX49q5MYQngQxBJHjBRbt0mkwFoJP4ziDF3EYvQaYkMp+sNWaV8+eee2468cQTs4e5uY8Z G3iPvvWtb+XVJj/72c9mA2+1PAhWIVnGEzKsuuiUuthK3ozoFmpBlhxHeo4//vgcSUQXa050NrLt Rz/6UQ4vk496WnDAnNDxJnh7vhA24cGtyiAsF3ks9UHww8szXvT/fv/IkR5WR6SHq1VIlxA3IRjD SIjWVlttlbbffvvcsXh6vvKVr6TTTjtt5sIGrcqhs4gBda3Oevjhh89cEUXDJWCE7OmwBEEn39pp fhYPWFnAQH62YSbWCZ3Wxw0JNiRhPGlQeJcyCTVgMSEwWKC0pToLC8FGeB5zzDHpO9/5zkzvYhGc Jb+J3htEzHET8slSf/bZZ+d3YbAYKyEayHuViI91T7/OU068AwnOtolMY8mY2am/lnZgmVPhKnXt u4o1gmTA1XYk8fvdyqLZAR+GK4oKJY6XR30pM62spY5TNE444YS8atJE9JPqe6r73W0/GpS8GAS2 3dYNPqMo3weFeWkP/RqDLaZEHynzVRgIeG14frtJRSdBasgFUSiIRZFDImcYkpFa5+kPvsdoSWzG CMYXcgtZOuWUU/K3HOlcjMaMu82GSoRbaFohUfQQhkoRQeZh000sglXu440yDaB8ukM/R7q+9KUv 5U8+wMDzS6iflYOdO/bYY3MdPIe3yFQHeY0nqb9n+0TAPvvsk/71X/81y2K6ifrakD7GdvPavSM6 iHfi2fpdpPEjMFJzekp1kB6bRqBjUO633HLLcvoFex3X4M8t2knC+oWJ1c0V4knZZZddMgvXeXh6 5Kss06dPz2ybAke4eS6Fk9VEp0N4Tj755MzQP/jBD+aOqTzIgToYfBEeGyHQbeJiRXowfp2DoLDq Ul09us27k+sJKB81VEeC4HOf+1x6+9vf3smtLa8ZBN7lYTAWFshlb44WZQ/2LDbla8eEM7JK2fnu d7+brUbikL1zAm/UkiVBt9lmmzywsJohjqz8QgW1C+2S1Y6wpLhpmyZwMiDwXrqfRW+YifUTplz1 Za6eSZneD0uXMrKmUXyGldrJmNmpvxrcfevBYK1dvO1tb8vf36IQMrCQDdoCOaVeiP8RRxyR2w+y s+OOO3YV0uL9zC74WBiHzCa39H0x/r57od76v3FA+2NUo4z95Cc/yXLAfMthzSXtpr330o8GJS/6 jW0vdRtV+T4ozLWVfozB9BbEhP4gGeeUmW7RbWJURJb0Lf2InEF8kAjH6QnbbbddNpJ6JuOb59Id eICMRfqh6+k0xgLJGEbJ1y6qib7As+TbNggMHa2Ma54vMsg4c9BBB6W99tor5+2jqXBj0CS7jJdI BXIhL3oVDOhn8q0a2ZXBN858G7GE1VXL083voi/CgH6B/PH6wIlxRrmF/hkjS4ig8Z0Oo78ZIyON H4GRJD0aNqXEQK4BID6sBc0vXUO1aaQGNbHbnSTKlcGQFaIusaZj5RQGlgOMWycSY6mTso4KCTFg eiYLA4uDhqzzsywgaRQ9SR2QHspHIT11zx3rmE7HsuKjojq7PCmzOu4wkmepC3cywVWW3h7vs/uN d7U83Nu8d6y8Z555ZhZ4u+22W36P2hNBh8SxFlGE9mxM4kRgeX1GMWmTCIN34eOS+ojyIr/ahkFI PQhWAt5Aog1feumluc0efPDBQyc9yoSUMQroy8glssliZzUd7UhfpLQPK7WTMbNTfyVvDNrkFaXd d3fITiEd5BWvlsEWsdcGEGXtguXTdyKsAtksV8d6B7MLPupI4dK+xPF/73vfy7KaAuP9I4Vktjap bSI+LMmUsRJCMxYWwzzfSz8alLzoN7a91A32oyjfB4W5+vZjDKYvUe4p2HQS5aVDdOvxVR6KeiFM ZItEPtgo8xIviX522GGH5f6HGNl4OIoOQUaVxCCtD5JNxrRqQg7oV8Y0uhe551nq47eN8a+QJ/eK GiLrCtkpK7jRY4SIk4uSMsBDgon7EB46QTP5cg3dsznVHSvXIDA8NojgjIYR3fOUwSptwm/d65g6 SEg9XXP33XfPpKfkE/vxITBw0qNTeJll30lxvWzCjHKvMbAcYL4G92rSuG2snSz1tk6SToXEtCI9 yAUlEmk5+uijc2gEAUHgUCKrSd1Y103ulN/mm2+eG2kJQ9OAlV+n5CFyfFrDldxrIkh4LgziOjvB USU9Beey7/U5dfcRBN6NVP1dd203x/qJd/NzvRdLQRKyXNZwE7aI+BJChCMFR1sjGL2/r33tazmb 0m6b8/R39Vy3WI/nXs9GvD/zmc9kpZaiy0pmiUtEhwJr4+WxqaO6Un4NFnUDWy/lqda5er/yNSdl sAoionzSSSflL05Tzh1XZv1Cf+yV9JSylH3z8+v+biVjKF/D7K/VshUcu6kHJZ1nWvv2MTtykkJw TsND3ZzgrT8I+9ppp53ydx/qBvPm+6p/D1ueFUyUoRtcSpkZCBgBhBvDh7FIqJu8JEoGXJBHY46V k3wPo8i5kk8v5aiWt3p/ybPsq+eq95TzZd9rP+q3vCjl6Re28uu1bqMo39VnUJhXx93qb8/sNCE9 jE7Fs84QyyhFj+klGTt9aoTcRCxsIm9Kom8xNPI+++aM64Q4G3tLuKkxy3k6F6JjzGYMbS6TOpNd DDfGc3qZZ8mHHiEP/ZhRo5qU8Z/+6Z/ymCmMjrFTGZS1lMH9ZIXFKJAN3zNDvPxdl+gNzhUcjbEl jLvuescYYYSZ8/AgbaIw/K0MCJcylPGaXuf7Pe5plket8o/jYyMwcNKDqPDSsOqOtUxgtbislUIv CEONqcSIVq8RpmTAp0wVhl493+q3AW6sCXsGHxYMnYdb1hdz7cWZUiYN/sqmU1KUdHqKnc5StZwa VP0tHwrneN2UMJze8FIhYHV17hXvVlhVj8OM1QY26uwd9Sv1C++68sD9k5/8ZH43p556ahaUBC78 kEhklYAjLCmP6kkxJHQI7LqkDRksCF/XE8adpvHcW57B07jffvvlwcoHzXgbWbDM2dDmhAwok0FE ObVN/YWS0Jx6KQ8hrK3DSf5F8DfnXf5G1A06LMQsggYqhEcZGQJ4JnpNvbb5Ohkz7P5arTMCoy0K qejGMKIelCzeZiEbPBfID0+0wZScKgO0UAlKg+v1uW7TsPHppW1W60SJQPb1F/OeEELYUDRKXeCt b/hGhrYIr+bUSzk67SPd5N1rP+qnvCjY9Avbkl+vdRs1+V7qMwjM+zEG82DQrbRP8oE+oY/0mvQf xgJ6DjLBS2NcqCbjKGMCPYn8Z3ygwxhvJWQF2VEW8kyfaJWMIZbWNmbw0Apdkw9dDD6ICj2rOfF8 0wPUnQGEh0d56ZZ0ATKSF8a9xkvXt0sFR/WmDzIC1BkVq3kYj32qBJGBgTKI1DBuy6OUgc6sDOoa qb8IzNF42X/35/U335m5GVi8UAOshs+q1WlCLjBxilEz4+80j35epzziRym6hAUvEyVS2drVq9TD YNpKie6mnAVTnUR+1UG6nOsF707KoC7ep47ej7q0e2aveLfLE2ben0nLfiNvSHVVAaQsEoTaXTsL C0GrjN4/PLpJ47m37jneOwseIa7PsFipF0uUeoyVeimPurtP3Tvtn8QNhZOFDvE02FEOOr2/rh7j afPq0CxjyrFh9NdqfWBTHfwQ116S9suKWUgwQmrwpEhU23kvebtn2Pj00jZb1U2fF1Ki/+vj+gdD kv4yVuqlHJ32kW7zHm8/Gq+8qMNqPNhW8xtP3UZFvlfrU373C3NtalhjcCn7oPYwkRDoiUrKoM31 Km/7Ue5RwKEf9Zgd8hg46ZkdQIgyBgKBQCAQCAQCgUAgEAgEAoHA5EWg+/iGyYtF1CwQCAQCgUAg EAgEAoFAIBAIBCYhAkF6JuFLjSoFAoFAIBAIBAKBQCAQCAQCgcAsBIL0zMIifgUCgUAgEAgEAoFA IBAIBAKBwCREIEjPJHypUaVAIBAIBAKBQCAQCAQCgUAgEJiFQJCeWVjEr0AgEAgEAoFAIBAIBAKB QCAQmIQIBOmZhC81qhQIBAKBQCAQCAQCgUAgEAgEArMQCNIzC4v4FQgEAoFAIBAIBAKBQCAQCAQC kxCBID2T8KVGlQKBQCAQCAQCgUAgEAgEAoFAYBYCQXpmYRG/AoFAIBAIBAKBQCAQCAQCgUBgEiIQ pGcSvtSoUiAQCAQCgUAgEAgEAoFAIBAIzEIgSM8sLOJXIBAIBAKBQCAQCAQCgUAgEAhMQgSC9EzC lxpVCgQCgUAgEAgEAoFAIBAIBAKBWQgE6ZmFRfwKBAKBQCAQCAQCgUAgEAgEAoFJiECQnkn4UqNK gUAgEAgEAoFAIBAIBAKBQCAwC4EgPbOwiF+BQCAQCAQCgUAgEAgEAoFAIDAJEQjSMwlfalQpEAgE AoFAIBAIBAKBQCAQCARmIRCkZxYW8SsQCAQCgUAgEAgEAoFAIBAIBCYhAkF6JuFLjSoFAoFAIBAI BAKBQCAQCAQCgcAsBIL0zMIifgUCgUAgEAgEAoFAIBAIBAKBwCREIEjPJHypUaVAIBAIBAKBQCAQ CAQCgUAgEJiFQJCeWVjEr0AgEAgEAoFAIBAIBAKBQCAQmIQIBOmZhC81qhQIBAKBQCAQCAQCgUAg EAgEArMQCNIzC4v4FQgEAoFAIBAIBAKBQCAQCAQCkxCBID2T8KVGlQKBQCAQCAQCgUAgEAgEAoFA YBYCQXpmYRG/AoFAIBAIBAKBQCAQCAQCgUBgEiIQpGcSvtSoUiAQCAQCgUAgEAgEAoFAIBAIzEIg SM8sLOJXIBAIBAKBQCAQCAQCgUAgEAhMQgTmmt3q9Je//CXdcccd6YEHHkhzzTXbFX92gzvK2ycE tNslllgirbDCCtFu+4RpZBMIBALdI/DXv/413X///elPf/pT9zfHHYHABCGg3S6yyCJp6aWXTvPO O+8ElSIeO7sjMNuxhvvuuy8deeSR6ZJLLsmNf3Z/AVH+qYGAdrvJJpukffbZJy2zzDJTo9JRy0Ag EBg5BB577LF04oknpgsvvDArkSNXwChQIFCDwFNPPZWmTZuWdt5557TWWmvVXBGHAoGxEZjtSA8v z9xzz5322muvtPHGG49dw7giEBgBBC644IJ06623prvuuitIzwi8jyhCIDBVEbj77rvTvffem9Zd d9202WabTVUYot6zGQKiey6++OJ0ww03BOmZzd7dKBV3tiM9wBPWtvjii6eVV155lLCMsgQCLRG4 6aab0owZM1qejxOBQCAQCAwLAYZD42cYDoeFeDxnvAhcd9116Xe/+12aY445xptV3D+FEYiFDKbw y4+qBwKBQCAQCAQCgUAgEAgEAlMBgSA9U+EtRx0DgUAgEAgEAoFAIBAIBAKBKYxAkJ4p/PKj6oFA IBAIBAKBQCAQCAQCgcBUQCBIz1R4y1HHQCAQCAQCgUAgEAgEAoFAYAojEKRnCr/8qHogEAgEAoFA IBAIBAKBQCAwFRCYLVdv6+bFWNvddwl8HDJSIDBRCFhuUzv0UcA777xzzGLMP//86cUvfnF8yHRM pOKCQCAQGCQCzz33XJZdzzzzzCAfE3kHAm0R8K07Y6iP6nYyhs4333z5O1TzzDNP23zj5NRCYFKT nj//+c/poosuSpdeemksczi12vXI1fb222/PhOf5559Pv//979uWT7tdbLHF0vTp06fk9wj+9re/ JYqWpUnHGrAYM1xrGXvL8JblTB2Txrq/7YuY4JPaASyGWQdfPZfmnHPyBgFMBK4T3JTG9Xjy6rzz zktPP/30pG4X4wIpbh44Ag899FC67bbb0qOPPpr8bpfITYZD36Faf/31210a56YYApOa9DzyyCPp lFNOyVaBbbbZZoq92qjuKCHwkpe8JCuwlPKimLcqH6/Qz3/+86zMT7UvT1NI1V/fLZ4uH3Rl4Vt4 4YXTsssum1760pemF73oRfkDi77d4EOLiyyySFpjjTXSSiutlAe7YhFEHmGPFLVKCNLDDz+c7rnn nvxcCj8roT2SutBCC6Wll146Lbroovm5rfKpHmcVZ41UNmWd1viS+DLLLFO9JP92nQ8uV69TR+Xx TYpnn302vepVr8rPf8HN/3sAZj44CSe/PQsOvSRlQXzk0a6deo6EaFZTq+PVa7r9PZ48m+/tBtdu yzlZr//lL3+ZLrzwwrT99tuneeedd7JWM+o14giQ4y972ctyKccyypCbv/jFLzJBCtIz4i92yMVr rQkMuSCDeBy2T0F6+ctfnvbaa69BPCLyDAT6joAQOMr2ggsu2Pe8RzlDyjZL3m9/+9u04oorZrJy 1VVXpa9//evp9NNPT1tuuWX6yEc+kl7zmtekJ554Iv3gBz/IAxtF1t8bbrhh+uQnP5k23XTTTIJ8 ufvyyy9PG220UVp11VVbKvHuveaaa9Jhhx2WTj755KzYeQbi4KOyPC2MJjvuuGNabbXVOrJ2s0Yq 3+GHH56JwUEHHZT23nvvF8Cv7N/73vfSt771rUyODj744PThD384XXHFFekLX/hC9g66d7fddnvB veUAC/yJJ56YDjnkkEx85HHggQeW0x3vhQIfe+yxmWjBGWGsS0gibBEesrWkVsfL+V7248mz7t5u cO2lvJPxHhZz/eH9739/NgZMxjpGnSYXAkgP2RokfXK9137UZvLGMPQDncgjEAgEhoaAmO0zzjgj D1Sve93rsndj6623TptvvnlaYoklkt9vfvObs8flkksuybHdH//4x9PXvva1tMMOO+RQ1uOOOy49 +OCDmaj42jzyeOaZZ+YBsFVFWBDf+MY3ZrLEw2N7y1vekr75zW+mnXfeOROif/3Xf01HH31023yq +S+11FLpFa94RVpyySWrh1/wm/dnvfXWe4Enx31IHGVz+eWXf8F91QO8XOuss04mitXj3f4WxnTO Oefkd4Ac1CWeE9chc2efffbMS1odn3lBDz/Gk2ere7vBtYcixy2BQCAQCAQCI4zApPb0jDDuUbRA IBCoIMAqf9ppp6UZM2ak1772tf8wj4W1TohZCaVyLUV/p512SsiR5G/33nrrrTlcDOngoRHaIMT1 3HPPzYSpXZibc9XznrfKKqukFVZYIXte5C1kjUeEFVH4l7A35UPYHOed82yheNVQxscffzxdf/31 M8P0lltuuRy+p+xCNYTAlcRz4/499tgjl6eQHseFsfEiKZt7kEFbNQ8KfwmZg4HyI3btEsvoZZdd lgme/M2F5DFbYIEFZt7m+VdffXX2iP3qV7/KZbz22mtzPYTW8ZRVj8OGp919wvdgoJyOIR/K36pO 3nfds0qe8hIGaW9eF7wQSPtW5dRG6nBVQe9OeCOvn3K5Dq7qD0/eVxOoJeXnlVQn7wG+jkUKBAKB QCAQGG0EgvSM9vuJ0gUCUwIBCz0Ia6O4rr766m3rLGxVyJqwm5KEr4n3/uMf//gPBMIxSutZZ52V Nthgg6yglnvG2nuOuUWFZCAqnikE7qc//WnO94Mf/GDO99vf/nY6//zz0ytf+crk2CabbDIzeySN dwQRueCCCzJJeN/73pdJGOW6OVGuf/zjHydzKTzvQx/60EyP05FHHpnLpCw8WsLukKNqgsEPf/jD XEbH99tvv/T2t7+9bbike9TTvCXlNIdD3rxNJSEZxxxzTJ5vhiSoL4zU+corr3zBcV453jZ1NkfN /CXbyiuvnN7znvfkvbDCujohs3XPkicPGo8gTBEc87oQzz333DOXGS5195obpZ014/rkk09mUlze KcIlv+222y5PhFZm9wj9g9Eb3vCGjNPxxx+fPYnw3WWXXdriWzCMfSAQCAQCgcDEIRDhbROHfTw5 EAgE/hcBc294UXhWxprLhAiYbyIMrSReFYqq+4tnxDnXIFLmCvFkdJJY8REPCwlQ2Cm6lHceKIQM 4bB6kPM8PGuuuebM+Uc33nhj9uZUn0Op5hEQKrfttttmD8Y3vvGNJESvLik/7wHPA28HsoE48aLA SR4UbWXhoakmZZ/R8HjBZ+21107mRJ1wwgl5blL1uupvnpJbbrklz1cyb4l3Q3gb4uO5JfEWrbvu uhlfuFL+99133zzXqu44koHUfPWrX81lQgaF6/3sZz/LZYJrqzq1epY8hdV9+ctfzh6ez3/+89nb hwR9//vfTzfffHN+F3XlQZiacUXaEDbzocxTete73pV23XXXXO5DDz007xFB9/EqwZ8XzDGLjKjf SSedlLz3SIFAIBAIBAKjjUCQntF+P1G6QGDSI2DejQUDEA3KZC+pKJ2IyeKLL/4PWSAAiIcQLEru WIlnCKExb0W+b33rW9O//du/Zc+Me5Eum4RsCdnyd1la2rFq8nweE8un8mAgK5RnpEfd65L8qqFl FG4Ei3fDogV/+MMfcn5IQDV5tmeYdG6uEAIpNMu9rZKQOeSJB4YHDYlDuCj3CFRJPCDCuBAeIWBw dg8SWHfcs4UV8uAhMerjXiRL/YXGtapTq2dZ0Y/3jfdFKJq6CUmEvXrY2t3bjCtSp4zqqh42q+cJ o/v1r3+d54Mpr3K7F76vf/3rM748XI4pgy1SIBAIBAKBwGgjEOFto/1+onSBwKRHgPLKc0KxrAv3 GgsA82uQlGmNZZanT5+eFdPqPZRvyi1FnnLvOe0SJZri/+53vzt7TCj3vEj9SOaV2IRl8eAgY50k yj6CQaEXXmc+CW+PEKxqopQrK8+S3wgZEkdxr0s8QzwdiARihsyou2NIGTIgRNDxbpM8S9icJcQR Nu8AqVAPRKWTOjU/1zuWvEfeQV4q5LFs+WSH/wmFQ+yQykJs1BV+3hGiXP0mCEyV2/kyBwy2rchr h8WIywKBQCAQCASGgECQniGAHI8IBAKB1ghQLm2U9W7JBcJEMaewssA3e3k8lTWeokp5FVI1Fumh 9LL4mzvS71QUZcozwtGKjDQ/133qZ5U6pOfiiy/OirqyvuMd72i+/B/+5t1q5eHiXaP02wv/cx1C gmTxJglx22qrrWq/MfQPD6n5gzfGe5WQO8TAXCeb/C0JjpR1WyfhfzxS5tnAoXh7aoow5iFzk2wS LG1VrMqcrnYZtcO33X1xLhAIBAKBQGC4CATpqeBNCWlnFa1cGj8DgYEhQAnjmbB14gmgOFLqKWyz Y6Jk836ob/MclXb1gRMPD4XdnBvzeSig+nHxcri/eAAQKjiNN8nbJlUV5E7yRXJsiJi5Rp2G87mH x8U3fHjDTLo3B0XoGFLSS1J2Hh24m/9T2o8V74QbntNYvhqp4PGxhHe13s3PK3hUj6sbEoqwIT9W bLP8uOd6z95LuzrV5ele85zM6eEpO+CAA/KKfRZVqKa6e6vny29Yanuu127KBm/HtM2x5piVvGL/ 9/5gDLVFCgQmCgHyhVzThzsZQ13He2uLNLkRCNJTeb9CL0z8FYphoI4UCEwEAtqfifeU+VNPPbWj IghJMrEaAZrdEsVSyJOy1w1QlGNKaJVg8PBceumleRloHhnLRFOChbohNvIrBAeevA7mnVBwWyUK r2cVBbjVdfJFoJTJ4Oo92dxblObqvUUJVH5lsVltrnzo1HH3lb17y++yF3513nnnZQ/JZz7zmUya jjjiiIwXLMp15V5/l2NlXy2T37xeJv7DyupjJSEovCeJccw8AABAAElEQVTwtTKaxRx4mcxNKp4q dVUvz/beWh0XvmbpZySK18h8JvfyoMDRcV6fujrV5QlzH6rl5fGxWs9WVnnavGflqrvXtQWLsjfX CPFSNyS6tD8YKBciXZajdo9U3lXJo+wLflN5rx+UBT669dpOZdyi7v1FgAwwhiIxnYyh5Ao5YJ5e tNv+votRyy00+8obsaztUUcdlSfd1oXJVC6Nn4HAwBCgVBHWFGptcqxEyaAAHnjggVkZHuv6UTwv ZAkhoQyXxFInJM0SypQpRokSyoQAWNZZqBpCQDGHlzkYvAlW4CpJnvKe1pjzU7wZ5Zx9eU6Z82MA NCHeJHvKcCFP5R6T3FdcccWsxPM68LowlrhPWZRVnlKZvG8ODgXfal/KaXEECxtQrpE15KH89reN Ak4R95syzysj77322ivXBcm1UdyFpiFTFH+YqYtrPauUye8yoCM8Vjxzn+/x+Lt4PORB/iGSQtxM 9OdJs4S1Y8LSzM9BmNwPi1bHEVJzhSwKQLYqE48Pki7MrVWd5Oe9NT9LufQP7xH2P/jBDzLJ0Q7U 35LU7qsrD/LVjKv3hNAheHCzuIIEDx+s1ZaQJWTaOyr4ah/t8M2ZTMH/tAcrE8LJu4sUCEwEAgwR xlAGrE7GUN9QI6s+9alPZdk6EWWOZw4HgSA9FZwJ6i222CLt2fjeg5j+SIHA7IDA1772tZkK2exQ 3royCq/S5yilFFFEg9KP0NlbpcweaaCcU67KimQmy5fEe8K7UMgNIoEIsdhXvzlTrrdHCjwHsUBE JPdRqn3bB6moJs9AWijX8qZoW4pZ4mEoHgP3bb311llpJluQI8qze83DofxTnl2/xhpr5MEWceJd UdfqMfchF8gGsofACGsTdmaAp5A7L6RMGZAJyvqrX/3qTITVTT0L6VFmGMLbYgD+RqDgBldlYvWU J+XBc/3tPe2+++6ZeCAJFH/PsKRzq+P77LNPDhEzd4hyMa1BPr0LhLJVnYT/tXrW9MZCBqy4SI5l s71bCra8tQ1tp+5exLoZV2TUO95///3Tcccdl1eVoyi537eNkD24eZb7hcPJX3uBL+KG2DbjW20v U+m3fqM9aOPaU6RAYHZAwDL65C65F2lyIzBHY8Acew3XEcLApGVWQ4ONAa9dYhUWAkK52Hvvvdtd ms9973vfy0pMkJ4xoYoLRgiBQno++tGP5jkII1S0jotCDFmKmTdkp512ygp/xze3uRBx4WGggL33 ve/NhKDN5V2dQnqQlEI0mm+mYEvmhPjNe+C3sKluE3wo1hLF0nORBoRkIpLnSwhWNbU6ruyIA48M YiJ1Wqe6PJuPNf9dytTqeDlf3QuJQeQkIW3NdateOzv/ptxR8vQJ5GSs9N///d+57bGCj7UISFEe g/SMhWqcHyUEot2O0tsYbFn+ccQa7LMi90AgEAgEahFgXedlZWnjpTDPpJflq6uZIxkUPGELlnbu txI71iIE1Qnwflf/rpazk9/w4f2Qyr6T+wZ1TSssWx2nLDcrzJ3WqS7P5mPNf5d6tzpezlf3CKSw uEiBQCAQCAQCkxOB2W/W8+R8D1GrQGDKI4BECBOzsAGPjxCuXhPPgnAn4Vo+1hnKbK9Ixn2BQCAQ CAQCgcDkQCA8PZPjPUYtAoFJgUBZ7UtoqnAok897Sbw85tS8/OUv7ymcrJdnxj2BQCAQCAQCgUAg MLoIBOkZ3XcTJQsEpiQCPD228SSenfDujAfBuDcQCAQCgUAgEJhcCER42+R6n1GbQCAQCAQCgUAg EAgEAoFAIBBoQiBITxMg8WcgEAgEAoFAIBAIBAKBQCAQCEwuBIL0TK73GbUJBAKBMRDwcUvb7JQs p1w+eDpK5W6HZbtz3dah17x6va/b8sX1gUAgEAgEAqOPQMzpGf13FCUMBAKBPiJwxx13ZNLjI5mW TR61hOBI5Rs8PkzqY5hWs/OR1qWXXnrCi+xjqz5MarEJ37TxzaDm1CnOzfVtzsffnebVfK9vKfn2 jm8jWdiifLS2+br4OxAIBAKBQGDyIxCensn/jqOGgUAg8L8I+A7Qsccem374wx8mCvGoJd4cS23f csstM4t2xRVXpIMOOih9/OMfT2efffbM4xP1wwc/b7zxxvwx2d/+9reZ+DSXpVOc6+rba17N9/nb Kn7nnntu/hjnzTffnD/qWnddHAsEBo1AMRTcfffd+Xtkg36e/H0AmNHkzjvvTE888cQwHhnPCARG GoEgPSP9eqJwgUAg0E8Efv/736dzzjknnXHGGQmZGKXE46F8hx9++D+QmyWXXDJtuOGG+RtGyy+/ /IQWmRKFPCjj7bffnrbaaqu00korvaBMneDcqr7NmXWSV/M95W9LoL/xjW/MJPIb3/hGuvXWW7Mi WM7HPhAYFgL33XdfOuaYY9IRRxyRv0PW/Fyk5J577kn33ntvevLJJ5tPt/ybEQKx+eMf/5huu+22 9MADD8wMhUW0fvOb36T/+q//Sueff37yd6RAYCojEOFtU/ntR90DgSmEgPCwyy67LF1zzTXZA3DR RRelTTfdNC2wwAL/gMLTTz+dWGN5CYSYCYnyvSDbWOcoLI8//niac845c9gXwuJ+igll5MEHH8yh dZbTnnfeebMFdq655kqLL754+sMf/pAOO+yw9Ktf/SotvPDC6dprr02LLLJI/r3HHnsk11VJD28K JYmy5BnuUUb1QSh860gImiQEzfwW5VOnFVZYIR9zrl2dnK8m4Ww//vGP0+WXX54+/elPp2WXXbZ6 Ov/uBGfPvPrqq19QX6F7ylpSJ3m5tl0dVlxxxbT++uunr371qznvT3ziExnX8ozYBwKDRoCx4MIL L0zf/OY3c3gqY0E1ITlnnXVW9krq51tuuWWaPn16mmeeefJl+oEwTaRFmGaRWe7jGebNJC/IGURf /htssEGWMUJDf/SjH+Xw2HXXXTcts8wy1UfH70BgSiEQpGdKve7eKkvQCgUieBdddNGZAre33Lq7 y2Dh2YS7Z4/3+y3dPT2unkwIsIQiMtoRRYASss0222QvSrWeSNGRRx6Z291yyy2XiYrrEI9W5972 trelCy64IP385z9PzzzzTN4oH+95z3uyEkIpp9RQPhCPd77znfk7Qt/5zncy4dl1113TJZdcku9H ZlhltX1zeHhUfvnLX6b5558/fehDH0o777xz7g8UnZ/+9KeZ4OgXSNR2222XNttss/x89wjlU+c3 vOENud7HH398Vpz222+/tMsuu6QFF1ywZZ3UtzldeeWV6bzzzsuK28te9rLm0/nvTnBGAFm94VWt 75vf/Oa0+eabz8y3k7xc3Oq9lDr4SK13qewUyte97nUznxE/AoFBI8AwwVAgbBWZWW211f7hkTfd dFP67ne/m0466aR8/K677kqrrLJKWnXVVfPf+oG+y+jw9re/Pcss8oER54tf/GK69NJLs8Fjvvnm S7/+9a+zMYRBggxac8010xprrJGuuuqqvAXp+Qfo448phkCEt02xF95LdVu55du51ctzWJcRFooe wc2C7m8CWxLTzzXvfHVjpaYMhXu+IBn78SCgrVI4KBs77rhjJu7C2xCf6qpofvO0UFC23XbbhBys vvrqmfC3O0fp5kmYMWNG+uAHP5hD0X72s5+lE044IRMQXhgLJ8jDc0877bRkPoxy8QohLaywPDkU FyRl3333TUgArwyPDs8IsqDvIB+HHHJIuuGGG9K73vWuhDQpw6GHHpr3iJ37eJ3UhVfLsbXWWiuf p1yZl9OuTs14l+daVIG12dacOsXZvXX1RfJK6jSvTupQygs3+Bf5U54V+0BgkAjw4vLIkANICI9s SdqiEE6eGguC6Kf6sk0yDjp/8sknZ+LDOGJMZgwkq4Sv6Tdf+MIXctjpAQcckDbaaKOZXiKEx0ZW kCFl4ZDy/NgHAlMJgfD0TKW33UNdCeQ6t/xYbnWKG4s3JZA1itBGZKyiRCCztFLKDAYEN8tWNbFq i8UXfhTu+Soy8bsXBJBtnkqWTyEjFA/KLzLAi4PYSEgChUJ7PfHEEzMJ4TkRZtbqnLbK64LE8PgI PdH+Ke0IB7JP6RC2UlZk85sXgjJOqUFG5OE+oWrC3ZRVkr88y0RkSr5rlR0x48Hg5REaxvOjz6y3 3no5L/daoe71r399ev/735/zQMb0RVurOqlvc4KfeyhbpUzN13SKM5InjK2uviXPTvPqpA7w49US IsS4AkOYRQoEhoGAcc5m/hvjRzXx3iA45I4xz7ipf5NB+rf9qaeemsdBsoLBQjs2z0/4KjlDBujz 5EyzF9M5z3Qvww/DSV1YarVM8TsQmKwIBOmZrG+2T/Wqc8sjQmO51VmsKXwszyaNU/IoUpQNYS3m A3zsYx9LF198cbaQs2RTAEusMqWKYH7Na14T7vk+vcupmg1vIws/ZZ2igFQgPY6xmiIPQrUcR8qR DUo5yyoFmbdH2Jj2W3du4403zsRGGBkFhpKiPWu/8hHa1pyErShDL8tPmxfEmEDZRxr0FWVHqDyL AYFSVBLSg+g5rx/aKEq8qO3qW+4ve/WDoVTyKufsu8G5el/d727y6qQO1fKqh818q0iBwDAQIA/I Et5N7bWaeFzJDGPmDjvskBcjsEqjY4iSldf81vf0Wx4h3mFea23YmIkkCcndaaedsgGHQUE/l8gG 3iNeJnLBFqSn+gbi91RCIEjPVHrbPdSV0G12y7NEFbc6UiKcx2RhYS8UMAoW6/a3vvWtbC1nRd9+ ++3TOuusky1TLOKuoXRRbuxZwMxzMChIrLDi8KXinhcqxD0v9IcSEykQ6AQB1lAkwR5ZR9qREcqH 9s2TaeKvWHeKAq8I5QPpQcqRC4rDO97xjtpze+6550wvDA+o9rzJJpvkzTPqVjdznCLSS2KxtUnK ZVOnkihHlPp2yfW2sepbFCd5CYuhdEmIFMWrmrrBuXpf3e9u8uqkDtXyMrzYIgUCw0JACLcN8bCV ZPzj5bnuuutyBIQoCCSGZwbRsU1vzAHiYbX6oL797ne/O4fomvOD9DAumqvGwGgeHzll3g+jinFW 8kwyz/22SIHAVEUgSM9UffMd1ptSaKu65VmzKSWt3OqUKZMyxRoL09l7770zMUKIpDK5uAhkx1im uOWbV7VxLtzzUIjUCwLaIo8OJXfttdfOBEE+VvMyeficxvLViA2Pz1ve8pZMWHh9PvzhD2dFQbiY WHhEfYsttsgeoeZzjALFk8DTQhExGd+zhYRRuJuTtl9t/87XXdd8n78pMLxOrqc0lU1/dIxyI5Sr k+SeVvXVF/XfkhC1EvbmPltJ3eKsnK3q221eSOZYdVDWMpdBHaqKZ6lD7AOBQSCgf5ID2p9+We2b CAhiwwvE++KcsdB4SzYhRAyGDIfm+5BjjIe8yxIDjXH16KOPzoufMDb+53/+Zx6zP/vZz2aZ57ry XGO3LVIgMFURCNIzVd98h/Wuc8sToO3c6pQQ38MwF2frrbdOr371q7NgLo+sKlLlGAu5738Q+JI9 yzvFMNzzBaXYd4sAj4d2RaGwWllJyAnrqVWPWFmtvEaBkFhNKfif+cxncrv1XQ3tk2JiJbXmc5R0 7dXkZESK54iSoh9QavSVEsbm2pKqvx3jsbC5j4IktJQ3xXUUp7IXBkrJpwTx+CibpE7KxgJc+lF5 Rrm/5FH2vFit6uv51b6q3/tbSB0lzlZStzgre6v6Uuz69c5KHUp5eZBhgxhGCgSGgUDpe57VTPbJ HqTHGCfMjazRp4WwarPO6Qutkvt4lV/5yldmw40lsc3/ER5HnjH0SJ5LlpAr4eVshWYcnwoI/GN8 wlSocdSxKwTq3PKUH5ZsS79SKrjVhbj5xgghbkKm+yhWFL7qSjWtHk6wf/nLX84rUXHfC40z4bKk cM8XJGLfKQIUcfPJhLQhBv4uJACxoMD7Xg7lQky8JaWFbvIM8fDwZk5rhJlYZMCGOLU6py+YL+QZ Rx11VJ6n5ns2Phao7fI0iKUvVlb9w9+lPOqkLCy8lCT9QbnLxwaVnzKkT1BaKDQ8MUiVGH+bZ5sI rW9ScDxD/1RXz7IwgDqpL7Ljt2e1qpPyVJM8ka2VG3OePKuEyfjdLc7KVVdfil+3ebV7Z6UOxcIN X6SQshgpEBgGAsg9Q4G9dm+T9EukxpiJjDMUkjtIi35unHXeJiEu7rFJ+rE+SC4IiZveCIOzRL6w Nv27PMe1fjumHLZIgcBURSA8PVP1zXdQbwoRwVrnlm/nVhe+5j6JctGJgiE8iAWWFVtisaZklWQA sBXlpRyPfSDQCgFeGcSBAmEysL+RF+0RMacssJCaj6b9US4oDP72G2nRjpELoW/m4LQ6R5Eu/cT8 ISFvCBMipN1SOigoPD6UEwqM67T30j9YZXffffdMRJAUpMTkZoTHvDb5IU88Tj48uP/++6fjjjsu x/TLz/1i+YW+UHD0FfcjXTym5tzpUyzDlCRkQf1a1amEo1bxVR+rwyFjFkyAVy84w72uvsrVz3dW 6oDw8eyZg2jeRKRAYJgIGM9s+qVN0r+Fr/HqvPWtb819t4S8ipL4yU9+kkNvXcNA4xwZQrYwcpBf JbSWZ5kccZzsEBJuK6k8V39VjkiBwFRFIEjPVH3zHdS7nVuegG3lVqfQFMFKsNsobO0SBejggw+u ndPjvnDPt0MvztUhIPZdfHtd4rH41Kc+lbfqeZ4XBMZ3b4SLIRlCsZAi5xyvOycPK7zx+CAbrKll /otzwql22223vPm7LnkGciUfiWVYstKhrTm99rWvzQSHkiMxGpR79L/3vve9eaveZ35ANY1Vp+q1 fuvHvEmHH354/tChMvSCc8m3rr5lvkK5pux7eWfu5RmjDKqrsnu/kQKBYSLA2CFcu0ROeDbCYnNO GDiDRUm8p4iPuYY8QYwNPKxCUYXAWW7fHFjt+vTTT8+kiLdIOLqxkqxxj0SGeS7jiWfZIgUCUxWB ID1T9c13UO9WbnnWYQohy1Nxq7M6sf4S4oQuAU/RM8eBhdlKbK7lmmetcg1lstNU3PPyDfd8p6jF dd0ioF0W70DZlzzanSvX9CN8pBCXkme7PaJUQrjaXdfqXCd1qt7LU4SU8ZrwVFG6GDmUo9fUTX3r ntGuDhQ+C1GY4O1Dr8pe9SDX5RfHAoF+IzCtYSyw8WIiMwyK2qaQWUYDC6tUE6MFg4LxkzEDUbEc NfLifiHjPkjKwyMf3lZ5+lYPMmQFN0YCiWfYPfqJMgTpqSIdv6caAkF6ptob77K+hK+tuMfdLqzl /PPPz4pOnVtduAyhLATHqlfChFihfFcAOfJdFMLXhxxLYoUi4AsRopgYEIqALs8P93xBLPaBwMQg QB4IwzP3hhVaCN14iNcga8ELZpl7xIw1vciXQT4z8g4EmhFAQITW+tQDEo688AoLE0dG6og/kv6m N70pZ+W866Y3QmONhVVPsuX1GRKRH+272VjjeTaeIsbH5vPNZY2/A4HJjECQnsn8dvtQN6Sj2S2P oFB42rnV3ScMSGgbkmOjLJn3IAktEm5CmLMSm8D8pS99KXuDnCeYP/rRj6YPfOAD4Z4HSKRAYIQQ YNQQQmOuFGVrVBN5Y2EHBpQyd2pUyxrlmrwIICO8OYiHsc5CJcLD23lIkZzm88bFZtIi4sKCQXWJ 98fzLJKAZPEORQoEpjICQXqm8tvvoO48MraqW57gNvFyLLe6lWRYgX1U1Ld+hMUJeTORmAWLtUpe rFeEcjXxDJkALoV7vopM/A4ERgMB3lhe3VFO1cnco1zOKNvkR8CnG8zbEWppLBxGMkYzLAqh23bb bdOqq646jMfGMwKBkUUgSM/IvprRKFidW16M8c4775y/Wt/OrW4ODxe9ydPm5PAQIT22kjbbbLNk a5fCPd8OnTgXCAQCgUAgMOoIMB4eeOCBeV4ro94wEi/QnnvumT8F4Znh7RwG6vGMUUYgSM8ov50R KFudWx7pkdq51atF56a3bK6t2xTu+W4Ri+sDgUAgEAgERhGBYZGdat09cyKeWy1D/A4ERgWBOUel IFGO0UWguOVNVh6WW76gEe75gkTsA4FAIBAIBAKBQCAQCAR6RSA8Pb0iN4Xumwi3fIE33PMFidgH AoFAIBAIBAKBQCAQCPSKQJCeXpGbYvdNpHs83PNTrLFFdQOBQCAQCAQCgUAgEOgzAkF6+gxoZBcI BAKBwEQiYB6cpZqfeeaZHI7qd9mEi9pcY7NsfNnMvbNZlc3epGcrP5Vl5e15Xq26yBBhOV3XRQoE AoFAIBAIBGYHBIL0zA5vKcoYCAQCgUATAs8//3x6+umn86qIVkb04V9/2/uA4aOPPpr3Vk50vGzm 5SFB7rcVAlSITiE7CA5yg+T4NojVGK28uMgii+RvbvntmHOWl/fb3vWIU6RAoFsEnnvuudyey9xR bRK51q4mMtqg23qM53r9Vf9Vd4v/lE83jCfPUbr3/vvvzx84J0d80mKqvNdRegdTuSxBeqbA22fZ NYhQZgiYQVlnh/WcKfDKooqBwAsQoBAWMvPYY4/lr7o/8MADiRJh/+CDD+aPAevrlCUfLLT4yKKL LpqVC0qGrSiQVQ8OkoIAFU+QPU+R53mWvc3Hhq+77rp033335fPyspqjj5XaPHPxxRfPzyzPQ46a P7L4gsrFgUCggYDvuf3qV7/KSjFAtEsftV599dXTK1/5ytyOkfFRSPrZQw89lPvNS17ykpkf1h5P 2RgvzjrrrHTuuedmD6sPik5vfMeu1LnVM1sdH09Z3DuefFvd+8tf/jIdcsgh6XWve1365Cc/mVZZ ZZXxFjPuDwQ6RiBIT8dQdXYhZaEoCiyoBnxCuwitznLp71U33XRT/rjoCiuskD8Mqky9JPVhLVY/ Ao0io24svIhUv57TL0tQs9Ww1NlAWqzU5Viv+36Vtdfnx32TFwH9jdWXYmVDNO688850xx135E1f RDimNb7/sfbaa+cP/erjFLBhyBvPR7Ruv/32dNttt6UZM2ZkOYMkFaKlPKy5yJByWQK/yIvJ++ai Zr0icPHFF6evfvWr+YPU2jYjnbavL/iw5yc+8Ync1nvNv5/3+cjo8ccfn40CyrbhhhuOO3tj6He/ +9100kkn5bzuuuuuTArKR0VbPbPV8fEWaDz51t0rlJZxhXyiP9CXIgUCw0QgSE8f0Waluf7667OV 5tprr80deuWVV05bbbVV2mCDDXLYRx8f13FWp512WvrCF76Qv8i89NJLp5e//OUd31suZPUtSs3v f//7bF1GeDbaaKNssaHc9OM5ntcvS1Cz1bDURTjOG9/4xvSa17ymHBpz36nVyhfg+239G7NwccGk QaAQHWQaydHnbrnllmwBd87Hgl/xilekd77znZnkTGToi36k39te+9rXznwHwupuvvnm7BHiFTrz zDNzCBzFzbbiiitmDxSPUBCgmbDFjwYC2jileKWVVkq777579vD8+te/TieffHL62c9+lr09a621 Vr6O8e3hhx/OvxmxEO1qqBSDAQLuHK8mLyVDmOtsfjtGthvLHHOdVPqh/IWCUtIRdnkx8AkhNQ4q F+KvTesHvJv6hTqMVb78oMp/CIE86Q6e5e9rrrkmb/pNq2cq83jK4jnFuAITGCKc6tkqXyGs9B34 MH4UjxwMkZlWZYUPfWjZZZfNMsB7LmkszF3X/E6Ntcrs/dnK+yt5xj4QaEYgSE8zIj3+TXBcdtll 6Ytf/GK69NJLc6gHwUBg33PPPbmTI0ATlZTP1ksi9C+//PJ06KGHpjPOOCMLFsKLsDnmmGPSpz/9 6fSxj30sZz2e58jA/f2yBBWrIfyr4QcGJUK3G9LTqdWq7rpeMI97phYCjAqIzt13351JDmWDR0e7 ZTBhSUZ4yJRRT5QPVu9i+ab83XDDDVkukh/qqi68U0JblllmmaxkDcM7NerYRfn+jgCl3/fhtt56 6+zJ1BdOP/30TDAo1DyLwsCMS8YhpEAomL5ibJKMw6eeemo2EjAOGIspya4RWsWooD0iPuuuu27a YYcdEkLF+yD/c845J4/pSHwpj2cgN/qnvJVLeXhm5L3ddtvldo30j1W+v9d01v8IGpKjXIxy+okw N8/adtttWz5TWCndo5eyCIPlTWKY+O1vf5vrwCv7tre9LYfBtqqjZ5599tnpwgsvzPqNvqs/v+lN b8pYtsOHPPAuXI8sIlne4ViYC8+vvlNlhzHcvb83v/nNac0114z5hLOaVPyqQSBITw0ovRxiLRKL /Jvf/CYr0x/84Adzh/7d736XLT+Egs5OgLJuUgx0YoLtkUcemWkpIQCq1gzXEMqIR7FmlPj4Tq+r 1oeApliV0LSiaLDaKBulqpSt3EeR/9a3vpVOPPHEbHnbfvvt0zrrrJPLRVDKA1GpJs8RilNnhUFs 2lmJ6ixB1bqy5nRi4alaDVnGCUYJxsXb1Um+6kKI11n1qmU1WBDCddeps/fcDe5VPOP35ENAmyAT 7r333hwaeuWVV2YPCaWNUrbffvslnsNBzcEbFqKUEx5hGznBA3tOQ6HkGfY3z5W+iQiZg0Q+Rpra CBjvyHiKPGWY7EQ8eAdvvfXW9J//+Z9Z6UaYjZGUaNvnP//5tM022+TxVH/65je/mUMreSDkJx+R BGussUbuV7w0+iDS4vc///M/Z9Lxla98Jf3iF7/IY6H+yCDx05/+NO25557p4x//eB7bjAnyQ5J4 Z3g7XvWqV2WjYCfla37DN954Yx5nhIMiYOqNWHiOPmM8rXsmDESY9FKW17/+9eknP/lJDinkxULo kCBlkG/d89QRtl//+tezkVJ/paPAy/UHHXRQy7K6Vwjft7/97UzkNtlkk/xOHRsLc2Vqfqc8TfQW XkDv6IADDsgG52Zs4+9AoCAQpKcgMc49K42OTwBSVNZbb70sWCkvJSFFp5xySrY0sUoQ4jr7z3/+ 80w23vKWt6TVVlstWzMoBCwhvBLuk7+JnCw+jlOeWT06ua48355wpJQTVJ5H+UcOLrrooiy01l9/ /WwxMUhIFDNEzmbA2XvvvRNCp1zSHnvskfeFPPmD8FVmAxah1GyFIbzbWYkI+2ZL0HgsPFz13gOC 0pw6yZcgb2XxqlqtKK+troNjN7g3lzP+njwIaAvINmMCy+4ll1yS+wkL9L/8y7/ksLVi2Jg8tf57 TSioZJztXe96V5ZHlNCjjz46K1wbb7xxlm88sUF+Jtvb77w+vPMnnHBC9nToH8YMxjbE2djC67P5 5punz33uc3ks+vd///d07LHH5nGFB5/hriRKMQ8NBZ9ijrwYd3ll9t9///wMir++iLxcccUVeZzW Rp037lKqKerGWx4oz6Zkf+Mb38jj3bvf/e6044475jb84x//uKvyKacx2POFgxYDgfY/rTFfz/hj s6BB3TORFR6hXsrC08ILSx69//3vzxEbdA3GCM9HPpvz5Z2F07777pt1GXnwFH35y1/O5XRuiy22 qC2re2FfTQyjPG50o3aYv+Md75h5Gx3DO+ARY2j0/q6++uqcNy9UpECgFQJBeloh0+Vx7nOWfoKC ADryyCPTTjvtlD0jlG7eCS5oHhOdVwx8IT06LGsS4arTs2a4TmgL8sEropOzRrFyffazn81W0U6v q1YFMSOgTD6Wt1VxDAoEDuHGumwwKIlA8kwERqgBgV8Ij2sQoeYkrIzVioJTtcKwormegGtnJRKy 0GwJGo+FB37CDbwHyZ4VC1HrJN9WFrZmq5X3Z3Cqs7h5Vje4N2Maf08OBLRF7Ylidf7552dlpyhk vBxTKZEjjCwMROSR/kEOwYWRgrHEHESe2UhTCwFeGaFTjIh+I8OIBRKAIDOmaRfaDU+oscae4ckY VyU9xiyGOuGWlHsGN+Fwe+21V1aayWZtjgGLwQ0JkD+lGpExthsHjd8UbMYKY72x0xjunMgHZfR8 Y0035fNmjRnGDvcj/J5pnDLn5ZyGVxQhQvrqnul+9/VSFvKojOHqpr8hjchJ0Q+a8/W8TTfdNOsg SBhDKqJE94E9jFvh497mxMPWCebV+3iI9tlnn0wQvXsRJ8rgHUYKBNohEKSnHTpdnCOkCEkK+3nn nZfnv7BgIjji8cWadpPKpD4xsjZE6vvf/37u3LwTQkGkTq8rz+YlokzIgyAlpLjOCS5Kl5hmZKsk wtvGOk2QdWJFQfDe8IY31FphCFgDTjsrUXl23b4XC49BiBXKOzIwGsg+8pGPZI9ceUa7fDfbbLOO rFauM1DVWcaEP3aDeynXZNz/9a9/S3/+y/PpuYZCY/+X5//aUG7+/r2YvzXOSd6TcJEXvaixzfWi NHdjP8/cjY9jNn47NrslyptlpfU7yoXJv8JwWEQpFVM5edeUuw984APZ4MIaz8ADK/gwJpBJ2sPs kp7PE/Ibk/Ib7Vl792+ORuFLu57rRQ1FvVEff0d6IQLmv1rIwLjDc8I7YGwlXym2xj0eH+HjJVHU S7hbOWZP7tskRMlWd4x3wzhAaTeGMUSW+/y2CUfXd5WrLilbt+WTDw8P0kOBZzA84ogj8lwhhMDY 4ZxxrJvUSVmM+aJHZjQWTBHtceCBB2Zd5aMf/WgeJ+ueBydeFfoIYoo4wYR8Qza9m26ScnaLuffC wyUJybeRsbZIgUA7BIL0tEOny3Pc56yXLFEsRyxCYnuRCt6ZbhMLFZczCxWygKRccMEFM79hUPLr 9DrXsyLxUCAv8iNMWcsIWoTIVk0Erk0ikG1jpVZWGJYYaSwrUbv8W+VNcLZKQoUMloXMEczNClS7 fDu1WrnOgFBnGTNIdoN7q7rMbsfV+9k/P5+efPrZxuDYUBieaeyfeS498fiT6fGHH0tPP/p4errx +7knnkx/aVzz1z83Bq3GPXM0lI655p0nzbPQAo2t8eHLRRZKCy62SFp40YXTQvPPm+afd+6GZXG+ tFBjm6/x+0Vzjq7yaECntPFk8Jry8vKmdmJAmN3e93jLSz4JoUUILQf8ox/9KMsm5IciPGpeH6T9 qWf/3FD6ns1t+9nnEPm/pmef+3N65uln0nONto7Q/61B7OdocDbyc6555k7zNNrwfI32Pe//Evn5 5punMXbMmxZo7OedZ6405xQnQ2S0MC9jm/HHd12EtJnXQcElv0UeCJEsoaCOCbVyTa9J3toY5dmY Yj4nD4axS9QCRRv5QVbLRubbpKKAd1M+9xqHER/PJiN4nCQki4LvvE3/8NzqM13Xa1mE4sOMEZV8 EnXCa/LDH/4wR53U5YsYIqLf+c53sqGXARM++iovdkl195Zz1X03mFfvi9+BQC8IBOnpBbUW9xjQ KM8sk+KQTaI0x4M7HSEiBEpqZSkq5+0J22ZLE1d6ISHl2k6vc70y8DjYWM5YanhyrBiz884753lI JV97g49N4hWyTZs2Lf/d6r92VhjCejxWonZ5tyoPInfwwQfXzukp9/SSb7m3k323uHeS56heo20/ 9cyf0yMNMvPIY0+lBx94ON17253pgZtuS3+645703GNPpAX//Gx66TNPphc/9URa9KnH04LPPp3m brSNuf7WUA4bVvG/zPGi9JeGEvP0PPOmJ+dfKD24wELpxsb+0bnnS3MsMH9adOnGxzBXXSkttdq0 tOTSDUL7Yt/Dalj/GorjXCPiCYKD0BwGEAoFMsyCqj1WZcGovseJLBdFzHwKobLID8OReZDC4SyM MFGJ1+apZ59Ljz3+VHr0iacbsvPx9OA9D6Q/zbgrPXL7XemxRlt/6snGEr4NpXmhv/0lzffXv6S5 GpbvFzXaNV/P8402/cycc6UnG9uzDRY093zzZiL/4uWWSi+dtnxafMXGSnaLL5ZevND8aZGFF0gL Lzhfmrvh3ZyqydjDSIbw8OowHjBgIQcICYXZ5HvjCuOCULVODHOt8JS3/OQrBJU3iQeJdxYp8dsm KYPnIQEiJcxl0TaRrm7KZ0xlgOTVeetb35ojQ+QrCStHRPQD1zB+Nj+zhIA2H++kLDw0iAqSJ8yW bjGj4fUpXiJG3OZ84UxfgLN5iCJceImaUx0+ytqcusG8+d74OxDoFoEgPd0i1uJ6woIAISCQkOnT p2ehzGJDIBIUrD8EhetYcBAYwsVv1qPm5B7nKU8Eq62qnJfrO72uXG/xAqQHGbOIgsRLQRlrDrUh OIUMsHAZcAw87ldHA40yUeCa7yvPat67vhMrUfN9E/23OtqaLWzN5Wp3XTe4N+c7O/wtTO3RhjJ4 358eTXf88d4048rr0j3X3ZzmbgzqKz90b9rgwbvTCo89lBZ/5ok07/O9hSE833gHj8yzQLp7oUXT jJcuk65dfNl0waKNuW+rrJimbfCKtNJqK6all1gsvWTRBdN8DYv6RCUhHlZJZPQQplXmB5SQjIkq 1+z0XBZ8IaPmOVoan9wwh4DXp8xDGFZ9eHAefuzJ9MBDj6W77rgv/fF316d7rr81zdEgtcs+8XBa /k/3pfUe+1Na4unH00saZH6+Dtq3tvx4g8Q/2CDz9y64aLrrpUulS1+8RHpi4RenxVZaLi237ppp pTWmpaWXfEl66aINT2eD0M85wh7NfrwL8tM4afNbMlaJdjD2GEvN92JEFPItmsJKbAiQ/vae97wn hy67r8jisu/kmPFOX9VnEQ2rgWlrnqNPy5/3SaLA8z4KZxeOhiTxeiife8cqX86k8Z862eTHeyUc viTeJcSHERXpgkPdM4Wl1x0fqyyed9hhh2XChsz5JhidQ3i6kFPvoTnfXXbZJR+jy1icB0my8AQP FbJY3lsrfMr7KHsysVPMyz1lD6fyu+wLdrEPBOoQCNJTh0oPxyzzyKJroDbZkEBg+WHp5UK2EWAs V4QDQSmszKR+9yIdzYlHRHw7RZvFidBjRZJXNXV6XblHGYRaTWt4bHh7JMLP0rHNST0IWhYdbm+K BwsORcRAw8IjH+v6d5Lg0YmVqJO8Or1GzDHCVogZQS5MoM7q1CrPTq1Wra5jzeoG91blGMXjyM4j DYXw9rsbE1KvuCHdetGVaf4Zt6V17p2R3nzfH9NSTz3WsHTXx8B3Wx/5vPTZJ/O2zp/uSqmxENDD 8y6QbvrdMunKC1dJVy+3Ulp6vbXTyzddN60ybZm0RCMkTrjQMBMjBWOHEBEKy6677poHdfMEekny s2m3s2uiSEmUym6TeQcmnZeVt1imTWofBvF5phGm9uDDjZX2br833XDptemuK36fFrr7zrR2o11v e/8daelG2577r/+4XH+n9dOWF33u6byt+ugDKd19c8MblNJj88yfbllsqXTNRSunM5ZcLi20xsvS 6puul1ZZfaW03JKLNrw/8zfawt8JQafPml2uI5d5drzb8n6Nd1bp0peEKIukYKDjAUEWKOrGXUYl yn9JvIWUfuNaMTaU/J0rK5Qae4XSycMzkSzJWCfs2/jrmUIujXNlrDbuWaxIpISyCVcl4y1oII1V vnxR4z9eFuWyGAJPZjXJTzhs8XAZs+qe2WtZ1IUuYL6Q8DlGW3VE7sy9RfSan4ccKSt9hv6AEIpw kQ8c1EVqVaa69+I9SWNhXncv3L0/pCdChjOM8V8bBHobhdtkOFVPUawRGG54gpPyy/qhI+62226Z OBAIhDUL0P/5P/8ne20oMhQB1zUnQkXc7FFHHZWtLwQQK1CzYBzrumIBKXvPIditmkTYUcYMDMha XWLZorhxwyM5NsLYcpbSpz71qayUlfzL3rnyu+wNWixH7axE5dqyr8un1THHS1IvA5mB60tf+lL2 TjnHZS/MyMTp8oyyd778LnvHOrVatbpOaI7UDe75hhH+j4L2xFPPpBl3PZiuuuCqdNv5l6Xlbr4u 7XL79Wnaow/2rAx2W+XFnn0qvfruW9PGje3+6xdOl9ywRjrvwsvS1Rs3VgabvlFaY5Vl02KN0DcT xwedkBP93mIWViTy4V6eiV6S/m5VJvlRvCgoFAoeYqkocr3kPex7WL4lymsviYdb+C3yZPlgMpMs LIprL3m2uweRf+jRJ9KNt9yVfnfuZenxy36XVr/9lrTVHTem5Z5ofFct05N2OfR2zijw4gYR2uC+ GXlDgK69dvl0yaWXpavWXCuttflGae311kzLL7VYnv/T21NG9y7GN2FWUtVIIOzLt2skMl3Sr8qK XdqHMcm4UhLl3aI15Hg57rMF7nOs5I9kUZqlcoynw3XGVqREJIYxvZqM3RYBmN6I6tAueTlKxEa5 v135Sl5l9cZqmco5e2OHxYwk5XNd3TN7LYtxkPdGXY2NcCw4tKsjncE9rnVPMc4UrFvd67rm94Js FczaYV73ThEuhtmCT/4R/wUCLRAI0tMCmG4PU+QJZgKSB4fCglSwYFjBzURBCvH73ve+LBx5PNzj /IyGe1iIGm9ANbEucd2zGiMYOjYLjPuqaazr6qwjykNocU+zpCJjBFddMqB4Li+TbyeIrxfOR+ky WBDIBH7dc5qtMOoIJ4KtlZVI+F+zha6TvJvLDieDA89aNRm81EnqNN9p0+qtes33U0qbLWNVXLvB vVrmUfttbsMDjYUILr/ypnTVmRekJS+5KO1x2zVppcceTHM2BrWJSBTGpRrzg3a46bL02j9en86f cWM659ob0x+mb5o23WLDtNIyLx34/AgrGFHKkRUT8nslPPATCqq/CbUpfc2ytVdddVVWMLRtCgeZ Y6MM+ptSQf4gSn47RlFClvyt/VNI/NaPXUtRcV1RWMgb98uzHFMm19bl47j83ONZlBh/y8deaJLj vZIez1YO8lO4rTlSCA/rey/eI/m1Sk81Fh+4rUHkLzn70nTfuRemtW68Om3aIDuLP/1Eq1sGdnyR BgHa9K6b0/r33pZu+sM16TfXX5tuahihNtxq0/SqV6zSIPMLTbpFD7TD5qTtFLJTzmnD2kAr4uue 5rzq8pFf83WOyb9EB/i7VUIUbM1prPKV61uVqd35Vs9sdXyssuhD7fpRXb76eCeeleZ7695LqetY mLe6t+79lTxjHwhUEXihdKmejd8dI0ApYYlkjaKsUEIITB2+JIo2r4+PglIc/E1wVJWTcq09t/4n PvGJPMjr7JTnqgJSrh3rujrrCCWFgDGQID+2dskcHhYnSheCxrOlzraS6p5TZ4XhqRrLStRsCeo0 71IWe/MBbO1Sp/nCqs6SRqFrLmvddaUM3eJe7hulvTrfef/D6czTL0z3n35Omn7NRWn9hpdlnh7D fAZRt5c0QuCQn1fcf3s6/c7b088ffCRtucPmac1pS+UVswbxTOGevL3ly+5CQMaTzFHgXWVU0E61 QaGhlsJHVhghGBsQrNIfkWrWZoYJYWD6bZnoLQyF3EHUbfIqBhf5CA1C2h1naFEfXmvhLBQiBEae 1Xyc0x48T71dg1QJf/WsYnAQwtscltsLNjCAh7zPaXy/RLlYypsV4l7yds/jjRUGr7z2tnThL89N S5xzVtrj1qvS8o05OxOdzIFbp9GWV3novnRJY3/R7Xem27d6faPuG6YVG14f40OkQCAQCAQCgfYI BOlpj0/XZ5GYEvPb6mZkp3gaXFNHZAxiNueaPUDVfDu5zjXNlhBx0CZeWkSBckZJ6STJq5VVqO45 8mx+tmNjWYma7+kmb/l3mrrNt1OrVfN1pTy94l7un+g9D8+9jYUKTv3F+enRE05Jb73hkrTGQ/+f vfcAs6O48r7P5DwjaZTjCOUsQAGJJEAIkA2YYIKxMbDPOjzG2F7sfb37rNdrex3e5/kWf3i96wA2 DhhMNDI2OUgIUEYoR5SRRmkkTc7z1q+GGpqmb5g76d4758DVvdNdXeHf3VX1P+fUqSPtqxbuKWay KiYKm2H8ImdMKHMzwe5sYRp41uljcuPmt+SZmmp5rqFRWq5dIJPGDO104sPEn7V1WDSwfnrXFsTa LrSokBbeU2eNhVhAcnCnYWNdrMoQEc7jPgvJhwSwOz2WVBZ8I1wDAYF84GKKhYTw91yLkgbSxN5V ECY2CGX9IH0U7jkocrDQkIa6ePPBAky6J554wlqgWAdAHV2oYTChbtSV784QiA9uStSdtZGUCdnr qFRV18ny9bvknSWvyLmvvyAX7jcYNLa6EnY0b3s9Fgw+hsCYuNYxZZnXWCeX7N0s/Y2L3RPHTpgo cjVy43UXyZD+fQwpVuITE6h6kSKgCPQaBJT0xOGtRtuKKxtExEuO/FWNNp3/Ov5Gg4xGFq0pOzCH M20HXa/HYkMg0XE/cbrCWBreltqn/yo3blkpo1mA3R4x7igyzewFZVw/ZdgQEbNQXDZuEnl7hVnI bciTIQ+dLUTUumHXOnn5r42yNMW4e91wuUwePaRTJ4mQAwKZYN2FdAQpMtrbLkgCrrFPPfWUjQ4F oWEdi/Nfh1hBeiAlkBj2B4MIYKmBzPNus2s5hAy3OxZ6E/aWRdGQEazR5IXVCHdTojVhsYEY4VaL RRb3V44h9BEsqvbmgzWKfgolBXUg4MB9991nscBlFus3eLBfGWSls4R+ESL28MMPy7Jly6w1C0VK rFJb3yjrNu+RlX9/Q2a8/pJcum+TZELIo5VoiLzp12X8WJEDB00AjvZtNOmvxrTjxopXXycvSKO8 mJkmV33yQhkyINg92X+t/q0IKAKKQG9FQElPHN553N/cRqeh/JWpdrTpgpqIJpaJDRMF75qToLR6 rPMQSGTc6xubZM2G3VLz2jJZtGNd+wkPMM4wLl+fv12kj5mgGQuDDDMTwasXizzymMivf9N6rPPg bssJd7dF770rz76QJWsGD5QhxYU2DHBbgg7+YJ0NUZx4b6Pxc4+mOEgJLmy4uL7wwgt2HQuWJCes fUNwTXPfkC2ug6DwXkM0CPO8ZMkSG9DDXUO+1JdAJtSXABuQLCxCfJwFCKsQUZkQCLs/H9w1ESyb EBHK54P7GeLWD0GKOpP0kDf9F4QL6ykud9Faq7nWK5DCXQeOyvpXVsj8l5fIpcaS0q6IbNES+ZnT zbP/WZG//q3DpIf6jzEKh8VbV8mLL+TJykH95YpLz0nK4Abee6W/FQFFQBHoCAJKejqCXhddi0sL n0gSbbqgfJgoEVhBpXsRSGTc3z96Sg5t3CHjtqyXCScPxwbciZMiD/1eZMtWMfHcRWaZEK3/51si 55m9L5a9IbJqTWu+Zrd6KTB7V5nNG80s3sTxxQWudZIfW8EiRHmbfXCnvPH2Ktk8abRcNGtCu9ZC 4AbGmhUUEd41JKzJIzw9E3wX7jbWOnqvw00MSwqCJYn1Nayho2wiurHmhvoQahaSs2/fPuue5idd WG7Ii7pRR6LKQXggKriGYTEi6AdEBeJDFEfOYdXxuusG5eOtr/uNlQkXX77BhbywSPkDsLj0sX6T P9YoLFGQzlhJT1VNvWwwATn6vPqyDVjQLsJD5XuIyFP0aOO+OW3HBtmwZpLsGjtcZowfzuEuF6yJ PH88L9GMVV1eIS1AEVAEFIEoEFDSEwVImkQRUASMcnrvYUlfsdLsUXJAYl49ANnxyp59YlbNm4mj 0YLntkbUk+J+YswLIlPNnhtEFGT9g9mPQ942u34bq0VHZKzZJPXdrZvNvitHpXb6GMnJag1/G02e uK/hHkZwDly8ICFYMIjEiBWECWBnKhJwOWN/LoIKYD0hoiFWF8gJlg2OE0jAbdpIwALSYJ3ht7MS E7QAEsIaH0gTawQhRkxcsejwQQiWsMBEhIMcER0NEkVeuKfhBheUD9YkiJG3PH7jektZ1B/iRhoI VmcLeTLphlRh4fKvBYymPCK1VW/dLtOOvy+F9bXRXPLRNNES+barzNtjrGJSaNa1mdDYltCbtZWx yuTS/bLTbCOwa87ZMnXs0G4Jzc6eSbgV4kLJs8H9DueKHWvb9DpFQBFQBDoTASU9nYmm5qUI9AAC uOcwgWWdRriJB5rxIInmOCtttu7cK/2OHLabjQblE9MxswbGLIQxvlPG6lNmrEAIBOimG1rX9xw1 JGecmSxfebmY2brIHx42JKh1f6jWxO37Fy0+a3y279kr6zf3k4FFOSGtPX5cCB393//935bsQBCY 8E2cONGugcF1qzOik3lbg/sW+/xAcsgf4oAQBhsrDMIx9tjgGWDC7+rMWhonkBzW2mCRIh8+uMtB iiA0PDMENYBkcT3HcNODREC2nFUrKB/K4Bpvee43x1nng5BPVwhWJIgZ1h7IH7/BIpQEndu0eb+k bt4iw8tiJNTREHlXIYO9dem8wjzPUwypx4q53rgsrl7bavl06drxjQWz6PRJ2f/ePln3brbkmjU+ oYT2gxX9BfcdEu8kCBvOQVp5BknrnkGsiwSvePbZZ+3zyD0ngAfWHxVFQBFQBOIVASU93XRnmFAQ KQ3NqPPB76aie0UxuB4xqWMi15EJVqz5uAmDm3R2J+hMTom4tXTp0ra2Uw9vXdzvUN/UN+w1KamS 3m+s3GUWvbfb/ScUGJnGynKuCWgwaqTIq6+LYPVBtu8Q+dH/ZbbVauWB9HzbuMBNNQEQsAKVHm1N F+O/GTVVsuntt+TVdUtNmO0PJ2lh22/KIgAAEcxwDWNhPvvxQH6w8DApdJaVGKsVeBkEJai/cJNP Lgqybrj77DJ1ZMf9zd5euKthiYHUEEKegCZOyDMoX38+Lr23PO/voDzcNZ31jWsfhIeJONYl9y6S v/vt//aeq88cLIvNOqY+9R8+Cx2qWxCRdxnitnzFIpHJk0x8bLPvz/BhZsfWy0R++5DIE0+bwB6t a6Fc8mi/86rKZfXzz8szz/xBWuqMK+gH4m83f7OuC8skhPGxxx5rw4hLgtKzxou1W2+99ZYlzKSB NBEAg7zYS+q1116z5Ic9lPzula4uyfxNH0xERdxQwYrn0FlBu6PdrNvjfSb6Iuv1cGNVUQQUgY8j oKTn45h0+hEm40xIGSjY68b55KOVxC2AiQSTJgYXJjPRuMjQydK5Mqng+o4IZIwOkzqgrXa7Snck z+6+9o033rADDsEdOlL/WPJhEkAYX/DD3ShoktrVeDD5oHzvhNNbppvMeI+536HOeY+nGNJTnNpf Gg2ZajafDm9AiubfWEnshA8S88prZhJY0Vol8x7Y9TwmmphRR4v0M5YgnvE8M2Hk7w5KnXHOO2Si mb37/napKz/eNtHzZ+ttP+eY5LGGBuEc7mVETGMNDBsRd4Rs20y78R/ec3ZiTwah/2ONE/eD36He AdoadG7QOLOeLDVL0k1/2mEJReRdxkxGjdug/Nf/3xq1cOYMs6btmyIXXiDWfXOvOReDpJkxpqai XA4cOygNFR9YTAPyof08w/T5EHg+ToKw4Rz7svG8EwHQpeE6935wjDFux44ddu0Y7p+9ScBim3G/ ZexgDRtjM+vXCKt+7rnndst4wN5dP/3pT6176z/90z/Zcag33QNtqyIQLQJKeqJFqgPp0KqtWLHC LjaG6DzzzDPyi1/8wrqQfPnLX7bEhzQPPfSQ/c1O7pGEPTkYhOhcO6JZQ2vNHhp//vOfrWsC9XGu M5HqEE/n0fJCKhloOkJ6YskH8vnqq6/a+8G9627Sw0SPe8Z6DqfhcxOSSN/cQ9K4dO7voO+Dp1Ok ceU6Kc/INlrxDgQVgMBg3bntFpGBA1qjtr27gSJbhdC+l11iwlqbdT1Gc2mJzoRxImvWMWt1qWL6 hrCV5xbICGPpmHzBVEltro+6/bwnK83aCe4363lY14OLG9pt1pQwkVTpfgQg+/SDc+bMsRp2NzGn Ju63/9t7rrwxT5q3viflmdmSXRO766RhvaGJvIOFiIUE7CBMO7Jte2tQj7lzjNXHBCHYu88ebs8/ OPNV5ebLGLO2Zt7QiyQz9UPy5m83f6Ncw1UN5RoWP38ayvYeo29jIn/ZZZdZhR3nsBCyrgcFHmu4 5s2bJzfddJONFMh6s94i9Jtr166VH/zgB4L7K2Mx/T+YQcRRavJsdqVQB0gnClPuB/dKRRFQBIIR UNITjEunHkULhK8zv3K/3QAAQABJREFUPs90iBAN3N3wo2dNAIMF2jdcq/wTdrRsECLOc459QNA4 45O/evVqazm6+OKLrWsNVh9M7KRnYkZaTOz85no6RL+7CXVjACO6Ez7eTCDCiXP/YuDjt/Opd5Nt dy11pB5owXA/gezRKdN2Vzcm67gDuLaRlnN04t68wYy/Q51zZfINXmjccS/gOvKiTAQ83GDO35yj fBai85s1C3y7a6iPv320i/SUA55cQ1mQLdpBO5FocbKJO/gP7cXScNddd9m6dDC7kJev3bxX3qlq kD0HdsrZpfskJvphnhtjThT53GfEsAaRhx8xVp5XWzcppWQmjouvErPjosjL5vhDf2itzxeNVcLg 3VE5mZMvZ4aOkCtvuFauveQcYxmIvhUoKnhPmCxeddVV8qlPfcpqVF3IZJQQ3SlMdHieeY/aI+46 nnOecZ6fcGvBQuXt8mlv+aHyi+U4deBdIxQ8Chv6u/bKhu0HZM3vn5ID+3bIQLPeKyaJRORdpqa+ Zobq/sJ8aBiLsbZwfYwuSZVGCXGqeKDMvfwyuXHRbHM/wz8PbDyLayZR+667zrxnEQQrMoT+C1/4 QptCh+cOxRtukYxfKF3oB8m3NwnjAeMnQR1wDwUjAn7gbsnY4XVD5VllfHZjIHjhEuvGTsYUxiPe RcY6xhnnDs9xxhuvyxzvLs8+4xzr/CBYuNqy3xZCeVznxk6upTw3B4hUn950H7WtvQcBJT3dcK9x faKDKSkpaSuNKEwMJBAfBmxv5+gS4adLxCgWqNO5EoEJbT7iIjbRgXHtggULrH+1izBFekK4sigZ zQ8Ts6Cdyzn2ta99TZYa9zs+kQQTPgthIRC4M9BBL1q0yIaOde49lEf9SAu5c/VAI0gZdO4MtnT6 aMlwrUOLyG/ypmNm/YTrzNHgunKDzrlBg7pD4tBkQjCJQsUg87zxdSfCE65vro6kRROHLzpaT3Ck HOrL8RdffLFtsa9rH5M72kwbKAOhHAYcLEQMMGj9GZxcfcPhZDNIoH/GlQyWbfPnmmjTW+QsEyq3 T20MayAGDxK5/TYxZk6RJX8VeevtVrc11jpgKUk3pGeEIUUGS3njzdb1PWPOEvOQw1I7hFZtWoa8 M2ysNM2fJ5PHDGsX4aFgnmPeFZ5VtLeOQDPR4LlyLqJB73IsFWfiw8QSCybPJ88VfQBWJt4xoq7x 7OPD7xfeMYR3zCv0C+46JkGrVq2ySoloXJK8eXrzCSrfW2ZX/mYCyeQQTPwKo2jLHTV8gKw/e4bs MJr6SSYUe16DISLtEUMAwhJ5b16Qesi76UvMzLb1uTaTYzEbjRrNmDdlVL+xXG4dMExqpk2XqaYd kQhPVJlGkYiIbSjscN/yP2NRXJ40SejzUe7xPuIyivKJACRunHYN5X1hTyzGG6Ioolxk7GV8BkOe XSxFjFW4y3J++fLl1pKMy/RLL71kCQ8bEZM/fQNWZ9ZyMpfgXWbsZ0NgSBfCWIXF6Z133rH5MR6i qIHsRlMfV3f9VgSSCQElPV18N9GmMmmhE2PC7oTJMO4xkB40RUykvILVgMg4dHbsxM5kmr8hUETK QdtMVB06TsgEwnkWmy4wBAhhN3UmBEzWmKgjY8aMsd/uHyZRiJvAueOhvpnc4wr3iU98wuZLJ03H T77OygFxQOPHcXaUBwNnQYJgoC1HU85gyUCA5pH9NlzekBM6b9pOG5lUhjvHIOGEySeDB506edDx gzHkxEt4qA9uhrhogBc4gBX3irIgqNwfb/sYWJgwkg/3i0GGzRq5l1zjda9z9Q2Hk6tzonwX5efI jCmjZdn5F8iycrMR5+6Ndu+bdtX/0gUmMtuNYsAy63bMhPyGDzTNEBrc14wLmbx/WOT8+a0R24YM Fpk+TWTaFMP0N7arKG/i+tQ02dR/mGyePlumzDtHxowwbnXtlIULFwZewYSFiT/Pckc2yfRnTh/w 8MMP24kLE0yEZ3rx4sV2koO7He8cGl6ed0g5hMtNiHjvsAJznGP8zbvprkNLz3MKYWCyRh8AsUJB w2+ecyZzCH8zySIP3hcIkMuHtlNX0nI9BI10rkyXX2eRQVuhD/6h7yB/JoLR9mHe6/ndxzzXE8eP lNUzz5F3jh+W2e/vluymdri5RSLyXrfHPPPMT5wgpuM2ATmM4uSs0a3RCXkfPlCk+OsX6m9UAIfy +8q6iWdL34vmy8Qxxi20m4SJugqet3l27ECphqLrN7/5jSUWjEl4AfAuIIxDBD95/fXX7VjOuwUh 4fOd73zHRjnkffrlL39pCRBjI5Yc3nveKTw7GDd5V8kb6w3jPdbnr3zlK1ap9+tf/9qOqygwUJb8 5Cc/aYvSiLcFSkUUiZCeaOrTkxZcfbYUga5CQElPVyH7Qb5MBJgg0HH5NWJYFpho0xn5w93iKsOG e0xyMJmj0aVjJVIO2k0m5HR8hJZF04N1AusK6RwJoNOFJDFJglS0RxMKYWGdApMkJitojyAfCASC ELgQLlwfsK4w4Xekh0kIpn0mYnx7CdEHsIT8Iu8777zTXgNedOxspoiEOufaSxomPxBCLFvUiYWl DDz4rnsFKxoEDOzuvvtuW0/OgyPpv/jFL36kfaSnfWjmuDdgDyZMcjkXJJFwCrom3o9NNvuAlF1+ vrxUXiNnWlJl8d6N0r+m1aoQVd3rjPukeSZTMozlxrPgmUmyjWZF+F7c2gyRFGORMQ+uyMpVIs88 2+oGFIM2vC4tXbb1Gyqvz7lUhtxwtcw7e5wxKBmNeycKzxGkB8JdYggz73tHBdJAPlhFv/rVr9r3 4IEHHrBE/Pbbb5dp06bZiT7POmQcUs67hgWZhc28f5B58mHCRP8BQeE6Zx2FrOwzC+tRllAWChSu Y3KEmwz9B0LeLk/yQAnj8sHqSRABJmm8s9SBvgarLeVShuuXOrL+0I8n5dHn0T/RT3ZEpk8cKaWL L5WVZacls65WZp44KFlNUa6NuHRBeCK/ek2rVYcKmr5R5p1n3DjN0Lt1WyuZH24sm7//o5jNo0gR lUB4jucWynMzL5RKo4C6YsZYKcjNjupaTdR5CEB6UCxgvcEyc//999v3BGXfjTfeaEkLZBzFJt4D pP3Xf/1XO978+Mc/lscff9wSIW/kRLwTWCNFWixqKNUgKo8++qjtA5hP0NdAXHifmAtwjRMUeuyz hdIQizQBS7Dy4DHC37yP0dSHd15FEUg2BJT0dPEdddpOtCZ+zQmTELTHTFrQ+EAgnEA2IEx0eG6C gqWIiQmDvX9SRafHBwLiFlSTDq0Pk3VHWFz+kb6ZRBHOFOKFdunWW2+161a4jokNmiMEUgNJoCN1 wkQLl7A//vGPct9991lihlmeSVQkbSx580GYONFO155w51zZDEJ08HT4TOTAFgy9xIi0YMW9oa60 wStB7WMgoY0Q1KXGagbxQZsGOYTkBUlQPl6cgq6J92OQhQvOHS9n6hrlhZQMaTHYXbV9jRRXm7VU LR8uoA7ZjidNWF7zYdIWUt7bI/J//79Wt7dmk9I8x9YdiAvMPYtWKKMiK0e29h8ub86+WEbfep0s vnCa5OeYCFqdLJBtCAOWE7Tg/N3ZgtYXqy0kG6LCxIY+g+cY5Qkkmz6FZwwiwjOO9ph3GPKCgoS6 QRR47lmHRhrnPot7Hq40TsnB+4olFKGfcnnyTvEeYwXl3aFfIw/6GN4JLNMoB9jHhbJRjkB+yIN+ pDOENjPRpJ+iPBQdHZHcbOMiPGeSVNZfK6/z4Kx6TaaeOBSdq1s0RN4QSQOCyEuvtK7jwcJz/bWt EQsfflTkuRc/utYnTGMaTSTFY3lF8vL0edK4+Cq58VJjuRzZarEPc5me6iIEeK94D4jkiPUfRRhW HUj/v/zLv1iLDyQFZSVjOcpE3h+sPXzzXuEi5wQFJdYbLKoI7zOkB0UERIf3j29cwDkO4ccK64S8 eN+ZQ0CceOdQgDqXO8qLpj5Kehyi+p1MCCjp6eK7yaSdDhGrAxMMv6aTCTqdHBYNNDjOjYXJO2SC jpIgCHSWTBwQSAyEhsm2m0STnsk9IbHvvfdeO/lxrilM2OkImRD5J/ihmk9n+v3vf9+6qdAx84lW KJfJFZ0xZnm0WZTNQnsmVJyn/nTitI/6OcGCwjE6adrL5MZ1vuHOuev5xqqDq8FTTz1lJ2JMihyR cumoD5hCWpg4gjXkyhEsl877DdF58skn7STvW9/6lh14mNj1NoH4XH3+FBlSlCtLBxkLQGGRzN68 WkaUn5T8+tqOh7MGUMhNhceCxN/tENbvlOYXycbRk2Tb7Atk4pUXySVzJ3cJ4aFavOdMUpj0o9GF VPA+drY4kuHeGd5/lCH0K7xzWGF4ttEQI1h5mWQRZe5LX/qSfacgPU7Ijz4DbTDRIyEvXO/EWuDM H7xTLk8UGM66yeSKd5VjbETKxA8iQn/HO8UxrMIoP3BV7SyBoOEqRLs7K9okbm43XjpTXsrOkNfy 86R8zXKZcWiX9DOWzLDhrKMh8jR8hbFYrlzdujbNPC+mAzQzWtP31dRGBQtcrMpEmNtbNEBWzZgn tYsul4WXzpIxZq2dSs8hAHlBucg7QnAhXNRQCPB8QohY8+mUbFhYvO8fSgaspuThhL7Dq6Skb2Es RXGH1wOKDIgPXgm4gnPcS3ooiw/vH++H88Bw+bvzjK3R1Mddp9+KQDIgoKSni+8iWlA6HiZDTNqd OCJBh4ZWFK0lBMGRCzo9OjPcZVibQ0eI5YIODHM2kw0m6yxEdlFbSE8+uKGgdYYscQ6CQUcJucJ3 3ytMXpgU0ZmiAcLli2tw3WJC5OrjrnH1dn8HfUNaqB/khs4cLayzVlEvXM6wxDBZY5DAouPKYdLF OhnchViLg0UJTTHtCnWOOnjrVWLci6g/RBKLk9+1jfTgiamfRZ7gC7GivmDgnfSR1gkTTGetQ5tH fSBCiLf8oL9toiT6BxzmTB8jgwb0kVdGDZO/vTlGJq1fJRMO7pZBlaelwJCfqCw/nYhJi6RITXqG nMgtkL39h8q7M8+TpvPmyuXzp8r0CSMlI/3DiUUnFtuWFc8pmlWsI7yDrOfyruNrSxjjD5QiPG+8 Sy5fJk0oKFifhusbm6XiGuMV3iGeb/fses/R/zA5gtygkHBKCRQqvA8885wPJc46jQID4Zt3nmvp P1DG8Ld3Uhcqr2iP05fi5sukjfcb0tVZkm322bl83hQpysuW1aNGyvsr3pSZW9fLiDMnpKi2StKj sWaGqgwunHwQFD0eZU/rweB/uaI6I8tYdwpl2/Cxsunc+TL4kvly1bypMnzgh+tEg6/Wo12JAK6g vAO8N4wbKD4Yd3H3xOuCd5Z3gg/vH8/rZz/72TZPDY4xVqGsCCeM+bznKPIgVJSJUoVjeGJ4xb3H vB+M/aSlbvxGOqM+3vL0tyKQSAiEHs0SqRVxXlcm4UyQ0YBCPFi/wyTDTa4hK0RVYeLswk0ysUGL Q4eFpYRJCOkIYsBEh44LVxeiwfAbEzbaViwVWB/Ii86P9Ex6mCjga+8XCMif/vQne54ymKyRx223 3faxdUZcSwcNSXEkBi0VdfRaUtBCQ9AgbNSDNmNtQfjeZ1xzIDYQIDrzEoMPkyOEDhzT+1LjQgYW 1ANyEumct15M0nAv4nqOg5dfmJCBL1ov3PDAiuAEWNpoW1D7uG9o7cAX323qj6UOAsUA48XFWx/K DsLJX6dE/HvUkGL57NXzZYtZE7Fs9VTZtmmzjN+4Tka/v1cGVJ2RopoqyW2s7xzrTwBATAjrjFWn PDtXCEd9sP8Q2T71XKmaOs1YPibK3Jlj7UL1gEu75BDPN8SEiQkTnmuvvTZm1yveHd5J+g2UFrw3 uKygVXbvG2Xw3EGwsDChAYb0QGbQBHONswoFNZgJGm4yKB9Iy0SKvglSzzG+3fvn8mRC50gMyhl+ 49ZHP0Me1AdFj1doS2cI/RiLt1GsYLkKUmh0tJycrAy5ePZEGT1ykLw+rkSeWztdRr+7Vibs2SqD K05JX2P5yTakLiW8k2ZHqyENJvhGRWaOnMzNlz2DjLJoxhyzxu1s44Y3WWZOGikQNJWeRQCLIy5t vBuMz7wLjKm4mzJe8EFRCalhTOF9Y7xm7ODd5v1l7HHvU6jWMJ5g7UG5wdiIoMCE9PjFlUe+uGOj TOUdJugHCk3cYDtaH3+Z+rcikCgIKOnphjvFRBrLBn64TEBwJ0Gc5pVvCIs77qpER4cbFSSEiQid pZs80HlxjhC6dJh0cMg3vvENmx4NLenpjLl2gdFAuWtd/nwziecTrTiffFd33FcQ9ze/6eipBx08 ZUIw3Hna9O1vf9tqkDnmOnt3nk6cdqG9pe5eLXO4c9560V40zZBCJkUOG+rmFUggkXMgba6ekBfE 1cffPu4TayHc/eDbK+46b30478/He02i/87KSJdzJpfI5LHDZMfeKfLWOyYS354DMmDPThm1c7MM OXFUiupqJM98cow7T3ZTvWR8gHN7295knidITk16plRlZUulcfc5VlgsB88aLwfHTZKM0aNk1tSz 5GxTn76FH7pptbecWNPzrPGM4E6KMoFJDW6dsbi68W5AliEURIWCTPCuQqzQMDNxgtgwqYGckBYF A0JkNo6xKTJWHucuQ/24DksRv7FOMWnDtQ2LLFEVmbBB2phg8Q6SxpsnihbqQD7UiWcewoVmm2Os HWDi5crhWn53RHgvsUr/6le/slp0Ajvwbgf1aR0px3vtyEF95bZPzpM9Z4+V5WunyN+375FB27fI mO2bZMjp48byUy0FddWW1Id1f/NmGuY34acJulFpiA5r0Y6bdTv7R5wle6fMlLTxY2X2zHH2ucYK pRIfCGA9YWzn+UdhB7HhneS5ZAzAJRSFHu8EXhm4XfNeopRjfMTlk6AkrOHhGu/H20LeQ0gP10Fk vH+Tznsd7zvvJ54SlIkSEYUEChOC9uByF019vOXrb0UgWRBQ0tMNd5KJPu5arFFBQ+kmIP6i6biC BPISJEyKIBR+Ib33Gtch+tPF8reb1Ltr/X97jztttDvmvrnGWVLcMb6ZGKL9ou7+doU7x7XeepAH Aw8WGCZ/4QRsnMXNn0/Q3xzzY8sxv3jrwzn/3/70yfA3mucZE0bItPHD5VhZhWzeech8DsrKoyel 8FipDDywR4pL35d+p81GuIYAZZmJbEZzk6Q3GTdIc89Sze/UD7TnzejRzYLtJvOMN9pPutSlpEmN ifp2uqCPlA0YLMdGjpYTQ0dIVnE/mTBmiNw8ybg1DjKb4GZ0rRtbpHvF80T0P54/gg1AHiC9kIr2 PAdMbO644w778ZfJ+4EVF4Hg88yT3ikRIEdurQvHnUB23HU8+5/5zGfklltusddTN6dkcIoQlx/X e/OEMKHZRshngVGqoADgev5GXDn+3/ZkO/5BgYMFCTdU+k/WCGHtcuW0I6t2J01PS5XxxuIzdsRA OXpypryzZaas3XFQ6o4clcH73pMh+3bJwBOlUmie5+xGE6XOkPos853RbJ5p83zj4plqSk0x2KAe aTHYQG4azbPcaPBuMCSnzjzTteZTZYj8ycK+Ujq8RN43JL56yDAZVTJEPmncSMeaQAVq2Wn37evy C0YbCwrRFXkHcROHnGOBgVQQwc15V0BCELZ7QDmARZb30rmtcY55AtcxZgWNnURLRDFK/8J7jCut c23zX8s53hvKwzLLu02EOOrBOx1NfaiTiiKQbAgo6emGO0qHw4JitL7Ojasbik24ItBAocFGK+WX cOf8aZkAEg6cCVhHNcz+vPXvyAikmknd4OJCGTxvsiw0n/KqWtl3pEz2HTwq+w4dk1Wnq6S+tk7y jaY8r6pCMisrJNu8G+kmVHCqIUBIsxmYm81EsD43T2rzCqTaRPSrMG4+LUaT2r8gR4YNLpZZIwfL WcP6S/8+Zt2IecfiSZhYYPFh8sJkHZc3rCi4WnZWH+Am/UyevMTG4QAxCRJ3Hef4TV295Ibjjvzw 2yvePL35BKX3nvf+9uYX7jckikAjTBLZhBGL7B2GBBKwoT3kMVwZ0Z7jmR7S37gRXjxTrrhgmhw5 UW6smkdk997DsubYGUmpqpS+p05KwfGjUnDyuORWlkt2rVnr0WD2T7KE3liQTR5N5jltNOSm1ih2 6nLypLKor5QPGCSn+w+UahMQpKjQhPw2JGuxsZqWGNfRgtysaKuo6XoAAd5vyD3vOmt2IT8o6PxK O5R8uE+jOOCZxq2afgCrjHv3WI+HO6x7J/3NwV0bzwQiwpHG+84HXUudCGCChQehLHdNNPXxl69/ KwLJgICSnm66i2hknFamm4pMuGIw34eScOf819ChOzcf/zn9u/sRKDTuONPN/j58EDwCa0yY37Ly ajlTVSOV1XVSXdcg9Q2NZtJgwn+bBGkm6ECGIa3ZZn1FngknTB79jLsak8B4IzihEOU5ZNKBKyoa VwINMPGBkLPmJYgohMqrtx3HDZj1EqwNZP8TNOb/+I//2LbmsSfxIHrhCOP6xmfheZOlsalZTlVU S+nJcmvhPHnytBw9XSFV5rmurTfBIMz5ZvNMG+cl8+ymSJaxRBIiu8CQ9779imRcsXE/7Fcgg/oW 2OM92TYtOzYEUAZg2Y0kkHWsNHz8ApGJ1CdwvVfx4PIIdS0kJ9y8I1x9XN76rQgkEwJKepLpbmpb FIEEQMCM7XZyx8RvuHx88E+AJrSriqw9YZ0b1goiuxEpETcW1pyx9sVpetuVaZImxiUHqxjWHUL+ sr4IjfUC4z4X5PITDzDgAjegT779yMdjxcRDFbUOioAioAgoAgYBJT36GCgCioAi0MUIEJiDBcu4 ZhGN8cEHH7TWSKw+rAvAJSaSlreLq9ij2WPZYc0ji64JvkBEOdYwsH9QSUlJj9ZNC1cEFAFFQBFI DgSU9CTofXRRwzBrB0mk80HXJMux3tz2ZLmHydgO3lUWKRMAgP2h2GuGjQoJckLocyb3uL15A2Uk Iw6uTbynRLBiI1MWdoMFES7B4Zvf/KYNH9/da3dc3fRbEVAEFAFFIPkQUNKTAPeUxZFEhUETzCSA yQKbf6IdZWE0x8Odj+dJFK4s7ENCW2gHkWnwjUbzHcuEx49NPLc9AR49rWIXIIBPPtHHIDpM9NlE lz2tIEMQIBYsu3fALTzugmr0WJaE4MdtDbKzZ88eu/Ew63cI7f/1r3/dRrTqzVavHrsxWrAioAgo AkmOgJKeBLjBbMgHOcANBk0wBOfVV1+1x1jci7Y03Pl4nvi/8sor8tvf/taua2B9A5Hb0IYT4pfF y+1d7+DHJp7bngCPnlaxCxEgwhMbieLihqWD/XZwfeM47wAkgCAIKAD4EBghlGW3C6vZ4aydRYdw 05Ad+jM2SmTdDooNwud++ctf1kiLHUZaM1AEFAFFQBEIh4CSnnDodME5QlWycSGTcyYyhJFk4Cfc JaGWmdTwm4kPJICFvUyG2B2dGP3E3yfyCxtkcg6tMW4yoc6TBxKqXEJEUx82WYNwkN4fHYb6UF8m L966OUIRKm/SUkeupRzWNfjD9ZKGPQY+97nP2QkeGu8nnnjC7nlwzz332IlQUP7UlzxZ3Ew9qBuT KmThwoU2dKhrO+cIE8qEi9/Ug7aSR9C9sJl4/qEcriXkOJp3rqdcQoEGtS+ovrFYrTxV0J9JjADE nk0H+fBMYf1hA1A2FuRdx5qLAoBgCPzNhqA8v/FKgnjfsebwzrn3DmsuxA7LDlZdSB0bMrLhsD+8 bxLfam1aGAR49nluGBPd2BImuZ7qAQQYP5FEVL70AFxaZBwioKSnG28KO4qz+/mmTZvshJ3oTZde eql1Z2GnZiYEECH82iEHixYtsi5fTILQiuLyASFZYCIZsUs7Ewr838OdZ5d2yEBQuUyiuJayGXBc ffx727i6MeFigTEDEvsNoKHmuqC8cdHhOupNnXHRI3wvi5P9wnkICu49fJjMofFmQTO/g/IHyw0b Ntg6EB0LovHcc89Z3OiYsX7RdkgKG5UyiQR3MKTeaNG3bNkSeC+89SMv7sfSpUultLTUnpo9e7Zt f1D72Hg2qL7goaIIREKACR+KDT4QbZ5ZFBooNiATvJvDhw+3H1zgID+4hNJf8OHd7E6CjaKG/XNQ IPDhvaNP4F2B6OC2xq7zEBtc97BM8+5RbxVFwCHAc0Qfi8sjyj3XbzMuYO3kmYYs81wxXrDRbzjx u4SHSxvpHHlRLuMI9SQENHXivYtVnFs3CjWUHrz3jFf+9wI83EbblBlOeP943wgIAikBI65hDO0M YSz0utUrMe0MVDWP7kZASU83IY5FAN999p2AtCBsWsjE5u6777Ykhr08PvGJT1jy8fzzz1tSc9tt t9nOi4nD2LFj7aSHAQHSQ4fIBILOLdR5ynrxxRcDy7311lvlL3/5iy2H3aPp1BhY/EJZ1O2aa64R 9st56aWXbHkMSCtXrgzM27Xp4Ycftpsy4sISbchZNynaZ3ZhD4UZayKwCjEgUSfIGCRp1qxZdpAA G6xhdMzPPPOMDRUMFkwUOcd9YHAIuhfeQYKJJpM3Bib2WIHQLFmyxJJTcPG2j+tC1Rc8vPn6Mda/ FQE/ArxfjgChAcctjGcOss6zTp+Cu6v7QLi5BoLBs8azzzeTRMg+/QbffJhEMjHi25Ek3n8+PPPu mzJ4x9w3/QN1YbLGNyQHaynvFIoI3in6NAgYu82jHOH9ZPJFuSqKQBACPEM800z6eYbps3/xi18I m1Lj+sjzQ5qHHnrI/oY8hxO/S3i4tJHOYaFECUfwEUgPCizGS8a09rpfu7Jw66YtvHu8Kyg7IXso Oh2Z4p1jjvDrX/9abr75ZmsZDWUV5R0FP+pJ2914RT1RknSG0C943eqV9HQGqppHdyOgo1A3Ic5k AKsKkxCsGQhuUmhOOIdgQfiHf/gHS27QnmIlYaLC5AE3MAYAtKVeQfMb7ny4cpmo0IkygeEbFxoG nCChbnfeeadNA3lhcg8BYBIWrk1sEnrXXXfZiU9QvkHHmKQhEDk68KD8IYdM9ghxSxupB5MqrD5o xpwwEUNbDm4QD9rJ+R/96EeB+ZIXFjAnDB5Y49DMOVe8/fv32wkeabztI99w99ibr8tfvxWBaBBg goElls91111nJ188k1iH9+7dK/uMgoBJGc8v7wGaYz5YZ3lfeYd49vmQF2l4tpl08ZtvJnTuA+lh 0gWpoS+C4PDBxRPLMdYcPk6jzESQdw/LM2sP6UfUBSaaO6tpQICxjmeNcYbn0z1jb7/9tlXs3XTT TfZ5pA/GvdMJzyNkiGeV45AHxrMgl3Ce81Cux47YO8WAy59nHgLG+/Xd737X5v9f//VfVvGFO6rf 4kT9eId49vnN+8a7wPvnFc4xdn/+85+38wAI3pNPPmnfHzfGM54wP+D945uxjncsSPD6wNOB+hMO H6F/4G8kVLupB9hBaMDNKUjoM7gP9APObRxsnVs9beKcc1/lN/MZ7gFtD1UeZXC/sEo5guvGe+pJ fZzSxYsfdUFC5etvB3WBTKooAn4ElPT4Eemiv3lZ+dC505EivPhYLOiMEToaZ96ms+Q4HVJHJFy5 mNPRLP3xj3+U++67z5IqNgIMcsWibnwQOjY6UwhFpDbR+YTbETqobXSKdKKUQWcWhBkdMOsClhqX CKxNDApM8CCUWLacUD86USw8YIqEw8TdC3c9+K9du9aWwyACCaOjZ2BDvO1rT74uf/1WBGJBAMLC hIvP/Pnz27LgeeWdQaHBx5F1nllcX3hG6Xew2JDWTfZ435is8M65DxM1Jg687/RLfLP+jneJD5Yl jlEXFUWgIwjQf9OnlhjS7ITJP2MlxGfu3Ll2Qu7O8c34g+Jt48aNdsLOM8mmv0iQyzfkIZTrMYos LDp4U6D8c0J/zwe37LPPPtseZq8t6oTCwU96nCs445PXTR3lmP89YbLvxiysoYxjkDgntIv3E8LH u8vf1CNImcD77MgW7zUKNqdkcziFcqtnfKUulMV4xniJC7jfbRxPD5SL9CXMHair320cyzR1CcKZ +kRyp3f4dZUrvcNWv3svAkp6uunee03Y9957rzVh08kg/om2v0pOC0tnFiThzocrl7zQ2NDhushR mNaxzPiFiRQaHzpFtMl0jHRiuLJglm9vm/z58zd4UAYLuJmEMehBOELlzwCAmxrrHRhkiITlSKPL n/YweaOjZtADa+oOAQqVr7uWbyaNaODA+Fvf+pYdyAi0ECThsI50j4Py02OKQHsRgLA4dzeUAiqK QLwjQF8PQWeyzGTXCX06XgwQDNzBcC92wliItwGu1riZMQnnb8jTDTfcYMmI1+Wb68K5HkN4nLLM S3oY36gf46QT6giBYUzxC6QgyE09yIuCvCEBBw4csNEMIXxO4YhFBDdWyAiW3d/97nc2DWViwfUL ikVcux999FH5+c9/bl3KGR9JG67d1Nfros0YDNZ8+93GaTPpuVeQG/L9+9//Lgs+cBunPbiCM34H ufFH407v8OsuV3o/jvp38iOgpKeb7jETEawQ69ats2ZoTNuY8/FV5jjamyANDtWj82fCTmdCeq71 pg93Ply5XIe2ig6ODg2tld8M7+BBy8RaFogIgxDkApJB5xxLm1y+kAk6S8gN5vzt27fbhdto7BYv XmwHllD5M5BQZ8z6pKWTR7zYoP3D3QbXH/yjGQTAEg012j2uDboXrn4MrtQRIT04QIQQbzn8HQ5r d49Jp6IIKAKKgCLQigDjD1YDCLvzJnDYYHFw44OzXHCOPphANkzMv/CFL9hxCwUXCjAUZ36X70iu x4xl5MW44BX6fywobgzgnFNgUQ6TdNw8ISdYQZEgN3WIgpc4kY51qNSL6xmjbrnlFjsWcY5xGQsT JIh2M+7TXqwyRDyEKHnLxeoKOaL+EJ8f/vCHdn0w5CScyzVleV20sQRTTpDbOGmdBLmNcy4czmCA spE5A99BRJA8utOVnvJUehcCSnq66X7TKeI6hrkeSwETZo6hlcJPnw6TDsuRDjRXTM4ZBNDikAZT Mr6taEy86emsQ52HnIQql84OjQwBAagPf6M1CxLqQEe41LiT0RETYAGfZvKPtk1B+dIOyn7kkUds W0uMtovw1ZAe2h6q7rQXLHAPdL7OTkPnxYbOFa0RnTlufGCOxhCXAUzpQfeC+jhhwGExNunuv/9+ OyixqSRkCouR955FusfefF3++q0IKAKKQG9GgH4UawrEwksuwAQiwxYEWGJYRM+YiDDhhyyhuHNj JhYYiBPum3x7JZLrMf04H7+4tSTOJZ3zTNpREkLGHnvsMUsSGB8ZlxHGLedxwPgDSQry0oDQ3X77 7dZNj3xwP2PCT91RrmE1wXsAiwokD8sVx8nfXy5rbTh+7bXX2jGcsY5gSOBE24NcxB1587poU+9Q buO2cR/8Q57cN8ZB2ugkHM7RutPTDj4I9wQ8usqV3tVbv3sPAkp6uvFeE0XlG9/4hiUJdIJ0qK5z dh2m6/TZnBNxf+Na9bWvfc12tkyuvenp7COdD1Uux7E4MSGn83Ll+WFBu0QZdJDU2XWY7WmTP0/+ vuqqq+wn6BzHwuXPeQgMpARxdfdiw3HI0He+8x07YLp2chzfbAYz/73gnBPaCfFiUGFg5p7x7RVX Lsci1dd7nf5WBBQBRaC3I8B4wtiDJYBJMxZzr6BkQiHH5B+LENE9IQP0zVhbGL8gPrhdI1hUID5Y aBzZiOR6DJkiH0iWdxLPeAfBgXBwnt8umifjDhYlxgPGFT4oEKMVxg1IBm3DYoQ3AnmiaGPzXuoE NgQqcfMEyMunPvUp+f73v/+RcknLWEbdaT+WK/Kj/RDDaFy5Xb1jdRunfNoUqjzyp24oacO503eH K71rq373PgSU9PTAPWfi7DRIrnjvxJlj/r/pbL2dcXvPk2eocp1WhTRBQifGAML13jp404bK25um I7+D8nf5+bHw/006BiQGNL+Ey9eblnROyCuSRJtvpHz0vCKgCCgCyYwA/TVEB3cuJrxOHJFgwk8E TdycmSxzHHcuXIYhGbgtY3HAa4FJNUSEtT0QAecS7tKHcpXGrRqSAAFxAQuoB0osFH7slUU5jCGk 5RibBrs6+uvs/g737a5lTGU9Dh4L1A9iBwHECwTXPSeEuH799dctQQIPrncCKeNasIKo0W6IIEFO IGmh2u3q4PLhO5TbOOdcevDEJc/rNo7lDQ+MUG78zCOicafvKld66q+iCCjp0WcgIgKEysak70z2 ES/QBIqAIqAIKAKKQJQIlJSUtLl0QTywdmBBcYoqJtJYOJh0417NhB63ZYgNe9OglCMNRAEygtLJ 7/IdzlUaNzBIl3ORdtWGRFAOVh4CFGBdOv/8821dvIowl97rWs0xr5u6S8M37WNMdQpHrFlM9rHM EKyAtoCDV/ibTVJps1+wZOECR2AHzkMir7/+eksWsYZhhQly5fbXl3xpV5DbOOdcetbGBrmN454X CmfqH407fVe50lN/FUUgxXQsH/XViXNMCOuIby8vpTeaS1C18QN94IEHrBYo0mZmXP87EyGF0JB3 3HGH7ZSC8tRjikC8IfCzn/3MagfvueeetkE03uqo9VEEFIH4QADXKTalxlrB4vdIwr40TJqJ0Bk0 0fdeT77kT77kH63sM/vg0I9BEnDjdu7Tfqu9m654rRzUjePUzXscIkREOLwkcAl3Qnq/SzPX83GW DJfW+w1JQdwaIu8595t1Loirt//vUOk47tK6NC4P97c3TdA5zge1zV0fdM6VGZRf0Dn/MTCDZIGb 3wskVHkQSJfeXy7752HlCnKlj7Ud7rpw37E+t+Hy1HPxiYBaeuLzvmitFAFFQBFQBBSBXoEAFgQi g7IuB8sE7lNB4iU17nwoIuZ3Cfem918Tjuy468KRHZfGP4n3/x0qHcdDpXXXRJOGdvnb5q4POheu zKBz/mPg5qxxrhz3Hao8Z91y6bzf8eBK762P/k4+BJT0JN891RYpAoqAIqAIKAIJgwCTabYdYD0L rloqvRMBdaXvnfe9O1utpKc70dayrAsBMKAhYtEqLghuszcvPOHOuXSY2tEMkpc/4o9Lo9+KgCKg CCgC8Y8Aazn4qPReBIjspqIIdCUCrbsudmUJmrci8AEC+P8SVcftGcA+OewlQHhRv4Q759JCmNhF m12h8R9WUQQUAUVAEVAEFAFFQBFQBIIQSDhLD366mMDZrGzw4MFBbWo7xuZhJ0+eVCtAGyI9+wPL DEEoiDJDYAn2JmDRInvg+DeGC3fOtcK7dwHPA5uqqSgCioAioAiERoAxlMXn7P+yZcuW0Ak/OEMf 7e+fI16UBAmI6IYyjUhlodbJJLu3AYpKRD0zkuCB1iZYBBKO9GD+RsOPdp+JcTghSghRYcaOHRsu mZ4zCOBORgdOJ8dvIrGw54Hr7CGaEEii3jAAsuDQkQ6i2nAOiw1hrbmOfPzHiKADwSEP0iCUCTkl f3+ZNsEH/7BpHfmRnrIZiPADJ0LQ+vXr7a7YSnq8iOlvRUARUAQ+jgD9N9HRli1bZonPx1N89Aih lNkXJhGFMYmIrM4NGkXp0KFDbQQ25geEgEYJx7jCmEIoab6ZYyxdutQq5djYk7GO/W5cBDewIC0B F/A2IP0tt9zSNl4mIlb+OjvPDCLgEQYc7wvCaROq2k+Cw51z+TrPjGTEyrVRv+MfgYQjPWyI9fWv f912ZE4LEQpmJtOQIxf+MlQ6PS62Q2PjMNbX7Ny503be7A49Z84cQeP15ptv2n0E6PTZCO7CCy+U 6dOnW+Lx7rvv2utJx94ILEYkXDgdoTvGoDlixAhLVOk4CU2KsKkaLm4MSpAeyiTWv1fIi/I3bdpk Bx3KID/2a+B5QAuF2xydKVpMFUVAEVAEFIFgBOh7v/zlL9sxlA0lI8kjjzySkP0qbVuxYoXdx4c9 eBgb2Obi05/+tB3n2DPmueees8SPtGxEevPNN9uxBQUb1zolHiGNf/vb39o8iFbGmHPjjTfKTTfd ZOHDZTvZvA0gguqZEent0POJhkDCkR4ARlPDJ5IwWWYnYjoolfAIYDVj8zW0OCwmZJMzCAlWFXZ3 5u8LLrjAkpVnn33Wkgz2U8Biw4AAkWEwgYiiOfMfQ1uEeN3W+JvBAhIzbdo0WwZaOUiVE6xCaNIY oBYsWGAPszM2hPbuu++2Giei/WCdwhoEaVNRBBQBRUARCI0AFopQYaH9Vy1fvjwh10wyJkFqsNI8 +OCDtlmMTShB165da/flI1T2j3/8Y0tuIDkozvgwLmEJQgGHtwPjC2k///nPt+0/BPmBSIXzNkBJ 6DwZqEdxcbHdS825izG+QS5IxznGslBeDd77op4ZXjT0tyIQPQIJSXqib56mbA8CdPB33nmn3ZWa WPqQGywsbDYHEfrCF75g3QLo7J9++mlreYEIYaGh0+abHa0ZNPzHnDubvz7z58+363u4zpW5Y8eO tmRYgLAksUcCu1QjDA5YdjiHiwHX8ZuBQElPG3T6QxFQBBSBXosAijbGIggG5IKxgg9jFUSOMcVL YiA1TpznQElJiTtkyRKkBOsPrtXOqyCUtwEKQMYy3ORwo0MYY/FmYJzCEwJyhds3lqYrr7zSEtFQ Xg1tFTE/uFY9M7yI6G9FIDoENHpbdDj1ilSQBz4IPrtopljESoeMxcdtzkaHzTn8pbHKLFq0yA4k 9913nzz22GNWK+g/hj90kDCI+Mtkka0TtF583nnnHfnVr35lP2xexzot57bIAEQdGcxUFAFFQBFQ BBQB1v/OmjXLkoOf//znlijg/YGCDI8CvEVYq+IXyArjHqTJq0Tj2pUrV1qXLzxIGIcQxkqvt4HL DwsO455zq2P8XLJkiVXikQavh9///vc2DeMZ51E0/u1vf7Nu2xMnTrTu+U8++eTHxjauxd0OlzoU kpC0P/3pT7Jr1y6bB+MwysFzzz3Xlve73/1O9u/fb93N8cIgiAWufricO88M7zGvZ8aaNWts4Avq DEkDB8qk7IcfftjmyzkEchmuDaGwar1a/1UEuh4BtfR0PcYJUwKWEjpyOksGBjptBgb8mzmOuZ+O mXMI1hvIBh0rneALL7xg/afRXN1xxx0fOYZ16K677voYFqz5cWW6QAUsJHXCYALhYjHpvffea3d/ pkwE0oMmD1KEUIaKIqAIKAKKgCLA+HDddddZUvLoo4/KD3/4Q/nEJz5hrS1EZcNtjbHKL4wvBNZB secUcqSBwDDGMR7hdYDFh7GSckjn9zaA7LD2FFLh3OMgHpAGJ+ecc44dFxk/jxw5EtGrwV3Ht3pm eNHQ34pAdAgo6YkOp16Riig9aKJmzpwpb7/9tu3Uzz//fKtlQtvDWhosO6yvgfBMmjTJEha0TAwU dPJEx8EChGXGe8xZiXA1cGus+CZkKsEmiLzmykTrxfWcZ9NRBhg0a/hno5mCfEHGOI7fNgMU9Qnl Qtcrbp42UhFQBBQBReAjCEBGrr32Wrse9Y9//KMNmkMCFGQo3FCYeZVsnEPZh7UHDwI+TrAaEQCC AD5+CfI2wOrB2qGlxr0N4kMwBcYrFHVOIE1uQ1bn1YA1xe07x1h63nnntXk1uOv4pm2OlLXXMwMs 8Mwg6BAKRTwzvMeuvvpqGyjIWx6/o/XMCNeGIKz85ejfikBXIaCkp6uQTcB86Xwxj9NJExnttttu E0zsdKy4nD3++OO2w4Zs3HDDDdY1ADcBSBCkCJKC5mru3LkfO8baHwS/aTpoSBC/L774Yhsw4eWX X24rEx9plw5tGh0wg8ATTzxhy0A7R/kEQED7xjl+0yGrKAKKgCKgCCgCjFmMDawvRSE2b968NmVa iVmrAyFBuca6Uqw1eBwwhkGCuAYXN4gIirdwEsrbAKKDaxqT/G9961t2fQ9jWCiJ5NXgv049M/yI 6N+KQGQEkp70oLWhcwi1psQLEelI31uFKDR0zmifMO0zECAQEI4zgKABwy2AwQFhYeg3vvENa33h GIMFnTzaKSwy3mOkv/XWW/myafjNh0EDqxDlUS7iTYdfNWVQPtozyicddSHIAmXgHqCiCCgCioAi 0LkIMCZioSCaZ5A7mLc0IpXRl8eDUF88BBgrGNOIQoqyDa8CFG8EGWDtC2QHwsHfKNyuuOIKS3Sw zDAnQBjTaJtby8OYQ4jrEkOeQnkbMFZxHYJbG54UECEn5MHHSSSvBm9arlHPDIecfisC0SOQ1KSH zo7OjYkxew1Ekg0bNgSadCNdlwzn8VOGfEAoIC5BwrkgoWN3ZnZ3PugY59wg4P3NMUd2vNe73+6b 8r11YDBGE0fkN0JeqygCioAioAh0LgJYSRhDnaU9XO7bt2+3a17CpemucxAZSAbbLWD1gVRcf/31 gsu2G0cgPQTIYSzBXZt96RiLIDOQCpSleC+g+IN0ECwA4Td79Nx+++0hvQ1QCBKpDdzuv/9+65o9 Y8aMti0ZnDeDc/2GUIbzavCTHvXM6K4nSctJJgRSjLa8JZka5G8LEUYwYTM5jiRoglizgt8uHVZv EtbWEP0Mi4nrhOO9/WgUGZSwEKF1663ys5/9zK5ruueeez5GPnsrJtpuRUAR6BwECLfMGMpC+0iC 4hBCQSAbPAfiQfweAv46Me4xDWLcc8Ri3759Qr/KRq7sRxfKwsV1uH0TApuNTdm02y9eDwk33ULR 57xKvIpAd22kOv/oRz+y7ndBnhnePCiP++HaxTnK9XthBB1zafn21jfIMyOoLf42RIMVZfWEENEO Yk/gi3h5bnsCh95QZlJberiBLIrnE42wEJ81Kr1REtE9DLKDRk5FEVAEFAFFoGsQIDjN4sWLo8rc TR6jStxNiZj0O8tOUJFBSj6sMAT0ISIb7m+hNnJlsh/J28Bbtpd8BJEdV79IdVbPDIeUfisC7UMg 6UlP++DQ1IqAIqAIKAKKgCLQmxGAkED0iAwaLkAO1ouFCxdabwPvnj5djR1R17BQEegnUaSnsEoU fLSe3YOAkp7uwVlLUQQUAUVAEVAEFIEEQYA1My6cdKgq95S3gXpmhLojelwRCI/Ah0How6fTs4qA IqAIKAKKgCKgCCgCioAioAgkJAJKehLytmmlFQFFQBFQBBQBRUARUAQUAUUgWgSU9ESLlKZTBBQB RUARUAQUAUVAEVAEFIGEREBJT0LeNq20IqAIKAKKgCKgCCgCioAioAhEi4CSnmiR0nSKgCKgCCgC ioAioAgoAoqAIpCQCGj0Nt9tI6wioSCrqqp8Z/RPRSA+EWC3cTaMU1EEFAFFIB4QYP8aNo9WUQQS AQHGT+Z+KsmPgJIezz3OycmR8vJyeeutt4TfKp2DgBsA+SbEJx+VzkNgx44ddpPWcJvddV5pmpMi oAgoAsEIsNHnmTNnZNWqVXLkyJHgRHpUEYgzBDZs2CDMTzIzM+OsZlqdzkZAZ58eRKdNmya7du2S ZcuW6cPvwaWjP0+ePCmbNm2yu1uD8YQJEzqapV7vQSA/P19mz54tQTuLe5LpT0VAEVAEuhSBMWPG yPLly+Wpp55SxWGXIq2ZdyYCeEtcddVVMnDgwM7MVvOKQwRSjElPbXpxeGOSqUpo/b73ve/J6tWr 5bvf/a589atfTabmaVsUAUVAEVAEFIGERwCXRCweaWlp9pPwDdIGKAI+BNTS4wNE/+x8BODVfFJS Uuyn80vQHBUBRUARUAQUgfhEAG8HpLi4OD4raGpVX18v27Ztk927d8u4ceNk0qRJkpGREbf11Yop ArEgoNHbYkFNr2k3Akp62g2ZXqAIKAKKgCKQ4AhUV1fLkiVL7Iff8SqsZ37ggQfkxhtvlIceekji ua7xiqHWK/4RUEtP/N+jhK+hs/TQEKw9KoqAIqAIKAKKQG9AYPPmzfLkk0/apk6dOlXmzJnTG5qt bVQE4hIBJT1xeVuSq1KQHkTd25LrvmprFAFFQBFQBEIjgLVk6dKldj0rqfgN8cnNzQ19kZ5RBBSB LkNA3du6DFrN2CHgLD1q5XGI6LcioAgoAopAsiOAlQeiw5oePvzmmIoioAj0DAJKenoG915Vqpf0 KPHpVbdeG6sIKAKKQK9EwG/lAQQimEJ8dL1Mr3wktNFxgICSnji4Cb2hCl4Xt97QXm2jIqAIKAKK QO9FgChobHpZW1vbFgKa3xzjnIoioAh0PwK6pqf7Me91Jaqlp9fdcm2wIqAIKAK9GgFCQE+ePFkq KipkxYoVFot58+bZY5xTUQQUge5HQElP92Pe60r0WnnUva3X3X5tsCKgCCgCvQ6BWbNmCZ+nn35a 9u/fb9t/xx13yPXXX9/rsNAGKwLxgoC6t8XLnUjiengtPUncTG2aIqAIKAKKgCKgCCgCikCcIqCk J05vTLJVC+KjIauT7a5qexQBRUARUAQUAUVAEUgMBJT0JMZ9SuhaOksPjVD3toS+lVp5RUARUAQU AUVAEVAEEhIBJT0JedsSq9K6piex7pfWVhFQBBQBRUARUAQUgWRDQAMZJNsdjZP2QHQqa+qk7FSl HDpeKS1ZfSSnaKA0Sro0NDZJRnpanNRUq6EIKAKKgCKgCCgCioAikOwIKOlJ9jvcA+1rNoTn6Ikz 8u76nbLtzXVybOdemZ4xTMaNHChlxxtk275SGW9+Z2dm9EDttEhFQBFQBBQBRUARUAQUgd6GgJKe 3nbHu7i9zc0tcuDYKXn++RVy+rmX5aId78iUowckq6lB9hcUy4tVlfJMQ6osvOZimTl+uORmZ3Zx jTR7RUARUAQUAUUgOgSampulrr5Ras2nrsF8zHe98U5obGoWxjeUeiJ8zBpV/ktNkTTzSU9Lsx4M 2RlpkpWZbpV6WRmJNcVqDTaUqmtv7d3Vf5IRgcR6I5PxDiRZm46Vlctfnn1Lji55Xm7dsUqmnzjU 1sIJp4/KsKrT8tfaSnmxqUnSb7hMzpk0ygwWurSsDST9oQgoAoqAItBtCEBmqmvrpbyqVipq6qXC fB8/Uy1HjWt26alq+/tMVb1UmTR1DU3WPRviA0FINZ/09FTJNuQmLztD+uZnyYCiXBnUN08Gm09x Ya4cOV0nkpkvqS2NRPLptnZFWxCu6BXGFX3/0TNSlZIvRcPHm+88OXi8XDKyclQxGS2Qmi4hEFDS kxC3KTEqWVvfIKvf2SmyfLncZgjPVA/hcS3Ib6iTa997V/7+UqqsH9BXhg4okuGD+rnT+q0IKAKK gCKgCHQpAlhzKqvr5GR5tRwz5GZv6WnZduCk7Dp8Sk5X1UlaWqakZGRJc0q6seRkSEpajqRkp0lK rrHmQFxSPlDUtTQLpKG6uUmqjDWo9GSDbD1eIWnNp6S5oVZamg3Rqa+SjFFzJLP+lBwub5R9pWXS z5Ch/OwsSTUWop4UjFalZRXy1qb98ur6vXIwc4JMu+5e2ZeWIQ8+v0EWnjNa5k4ZJf375Bublooi kPgIKOlJ/HsYNy3YfeCYHFizQc7evDaQ8LiK5jXWyfwD2+X5116TdeNHyaDiIg1s4MDRb0VAEVAE FIEuQaDeWGrKKqrlsFlzunXfcVm147DsP1YpjSkZkpqZZz6DJHtAluE00XofhA/I02LIUGN9rfTP GyINNWfkxZ0Nsrd6tcyZMEQmjhwgQ/sXSp/8nB4Z/7BWHT5+Rh5/faMs21IqLTn9JG/YYClITZNm 446+7fgx2fXsWmPtqpQbF0yXIlNPJT5d8lhqpt2IgJKebgQ7mYvC53nHzgOSs2KFTC49ELGpQytP ybADe+TQjr1yZOpZMnKwWnsigqYJFAFFQBFQBNqNAC5sZcaqs/vQCXlry0FZu+uoVNSnSlpOoaT1 LZZsY9noCkkxBCIjO89+RIZIU2O97CyrlG2v7ZJ+ubtl7sQhct6k4XLW0GLpU5Bj1gZFS7Y6Xtuy M1XyyCvr5fm1+yW3eLhk5fZtyzTV4JFXPEzqKrLl7W2lMqhfoSyYeZYU5Ga1pdEfipKwdWIAAEAA SURBVEAiIqCkJxHvWhzWudRozk7tOyQjjr0vA2oqItaQrn2yCXBwZNVq2XXOZCU9ERHTBIqAIqAI KALtRQA3tvcOn5TX3t0rq7aXSnlThqTnDpbswpz2ZtXh9GnpmZKW308y8vpKeV21PL/hmLE2lcqF U4bLRdNHyajBfbtlDQ3bRqzadlC2HKqQgoFmXa0hf0GSZYIPHa86JS+u2yv98rNl3tSSHnfJC6qn HlMEokVASU+0SGm6sAgcPHJSZPNWGVF29OPpcnNFcs0AU1UtUlPTdn6wCWqQdfCAlB4tk3oTJScz wSLdtDVEfygCioAioAjEFQKsVzlZXiVvb94vz695T/aXNUpGAVslmPGop4UACMYClJ6dK+W1VbJk zSHZuv+4fGLuWJkzaaS1+nRlFQ8eOy3rdh2RsvoMg0kw4XHlp+cUyd6yUlm9/ZBMMC55rO9RUQQS FYHus6UmKkJa74gI2MWQJkx12nvvyfDysg/TpxtOPWyYyFVXiHz2MyJTJn14zvzKbmqUgdXlUn/0 uBw/XfWRc/qHIqAIKAKKgCIQCwIEFzhy8ow8vWyzPLJ0uxyqzpGsvsMlrRMJD2GqM03kNr5jF8hP vmT2Gy67T6fK71/eJM+t3G5d8VqDYseec6grCbu9eU+pbD9cJSkmqlwkYX1TWlaBSV8pW/YFKDUj ZaDnFYE4QkBJTxzdjEStSn1jo4mEUyuZ1ZWSZyLWWMnJFpkxTeQf7xL55jdEbr9NZOLEjzWxX+UZ kcOH5ZTRyKkoAoqAIqAIKAIdReCEWa/y2Gsb5S8r9kh1Wl/rThZ9cIKPlp6VkSqFOemSZQiOV4rz M2TKsHwZXNTxdS6pZu1PVuFAOSNF8tdVe+TF1TulwrjldYWcqaqRfUdPS7lZ05SeFZ3VKy0rTw6f aZA975+0XhldUS/NUxHoDgQ++hZ3R4laRtIhwP4GLWfKpY9ZpNn2QA0eLLL4SpG+fUTWrBU5Ydzf AqRPVbmkGNJz+nTkdUABl+shRUARUAQUAUWgDYEqs+fMy2t3yYqdxyWjaHDI9SptF4T4gQWnf36m zB7dRy6b0l9G9jcu2h45a2CufPLsgTLZEJ/Okkyz3qc6va8sN8ED1pg1N2yM2tlywBCeQ2U1kpph FJMfSLppa0F2uvQvyJR+eRlm36G2kdymgDCmpGfJkVM1xoJW7i7Tb0Ug4RDQNT0Jd8vir8I1dQ1m vU6V5DTUf1i5CkNi/vxEK9m5YqHIWaM/POf5ldNori2vkFpjKVJRBBQBRUARUARiRQBXa1ywVu88 KrVphTETHtzWRhVny3lj+8qs0WypkCrlNQ2yq7TrPRLSswvl4JkTdt+cwf3yZcpoo0DsRGE9z6Ey M94acoXkZ6VJyYBcGTco1wQryJRG4/6293i1CXJQKWWV9eLc7FrSsuTQ6Vp5/0S5Cbig0VY78ZZo Vt2IwEfpfDcWrEUlDwLsfSA1xr0NAuMEy86u3SKnTrkjgd+ZbN5WVyeEvFZRBBQBRUARUARiRYAN sjeZ9SrvHTdeB2YdSqyCtWP2mD5mA9F02XGkSs5Ue8a2gEyxjHBNn9wMu84nIEn0h0yQg9TsItl+ pEY2vXdECLfdWcJapzOVNVJZ2ySp6a1hurFYXTGtv0wfafYMMvWfMCRPbj1vqLFuFUuuIUROSF9W 0SAndP2tg0S/ExABtfQk4E2Ltyo3m92tUwzhSTMbsbVX0syO1ilNTcLiShVFQBFQBBQBRSBWBHC9 OlJWLSnGdSs1LfbpTU19kyzbVmasO41ybkmhDOkTvG4n1RAU1vZgDRpl3N+azDj23tFqQ1iqpKI2 dte0tIxMs5lpuhwuq7KbqQ7spIhpdUZBWW08M5qNI3q6WUeEnDFtfGnTCdl3osbWedzgPLl57hCZ NDRfNh4ot20hXWpaplRWNgnu7CqKQKIiEHuvkKgt1np3OgLp6WnSkp0t9R9ojtpTQH1qurRkZkq6 b5Foe/LQtIqAIqAIKAKKAFaIY8Ya0ZKa2SEwIAJ8IgnBDWaf1ccQnnqBKLEm5pySInlh43F5Y0eZ sdLErsxjDc0pY2E6aYIydBrpMZaw+kZDeT4gPLRvvyE7Xik9XSelZ+oEC1BWxoeWHtb14PrGHj9Y jFIM4VNRBBINASU9iXbH4rC+Weyvk5MTG+lBG2euzcromh2x4xAurZIioAgoAopAFyCAm3SDmdSb GXkX5P7xLFn7A0l4ak2p7DHrYMYYonCzcQ2bNrxAtr5facnDx6+K7oihFYagtEhjJ7p+gw/ZhYtk V5CdZoMaVBjSx8craYb4NBnPjgbjcpdplJ0qikCiIaBrehLtjsVhffOyjVYtv0AqjUm+vVKZaSLI 9OsrefnRhc5sb/6aXhFQBBQBRaB3IFCQm2nW4ZjJeAyu1rEghAvbxoMVlvBw/YGTJhy0sZwUG4vP APPpiKS0NEmeWVOTy/jaSYIbObanUFaa9LQUwb1tYGGmvHesWo4Yi49XuI7r1R3di4r+TiQElPQk 0t2K07oW5GVJelGBlBs/6gajCbLCt3F5k3wTzpNvNirNNn7R/G3c2ZyU5RVJy4gR0rdf7ItOXV76 rQgoAoqAItB7ERjYt0AGmX1zUprMZJ1Qbl0szaYMPk4ajDtbrXFzY60PEd9ilRaz1lVMGwiZXVyU F2s2H7su07irUa3mAFLIHqsj+2Vb97xTVQ2yfn+5ddnzZoKVJ62DbfPmp78Vge5GQN3buhvxJCwP k3e//BwpLS6WMrO79KBqE8e/sFDk7BkiJSUis88V6d9fZJb5NkELZONmkXc3mI63WcryiyTV7OnT r7DzOvYkhFibpAgoAoqAIhABgQFmwf/IAQWStfuUccEyEdzMupiuFAgAe9yYL8uxsJSwmSnuX7VE NY1Rms0m3wWZLTJyYJEU5X10f6AYs7SXZRpX9Iy0VDv2evOh/pDFSyf3l6LcdHnu3WMmIMNHw3ND xEwyo79ME8Z8FUUgERHQJzcR71oc1nnY0GJpnjRJDvQZ0Fq7vmYPgPnzJOX6T0mKseSkHCmVlGHD RMzfMmO6tfaUG9e2E0X9JG9QsfQt6LyOPQ7h0SopAoqAIqAIdDEC6WZCP33MUJnChqG1Z6QlwKIR TRUgAazXyclMtd9sVJpp8uZviI2T7Mw0GWH28xnWN1tyze9RxTn2N5YSPrFIs4mEmlJ3Rs4eVSTT xw7p1OVJOZnpQp3BxVqTTAVpDRalywzhGWHq/9rWk/KOsfL4A6o2NzXa9lt39lgaptcoAnGAgFp6 4uAmJEMVRgwulncnT5QDy4fIjKP7JXPvXpEf/qRtY7OgNu4dOEqaJ06UkiHF1h0gKI0eUwQUAUVA EVAEokVg3Ij+cuG0ESbc8w4prT4taTlFktLO8NV5hhiMGZRnrB+ZMsGsccH6Md58NxlXtr3Ha2xY aurD2pZJQwvs+MV6npL+uZZAvLz5hBw949msO8rKtzSZ6GoVx6WkT4ucP3WUjBjYuoFolJdHTJZq LDSFeRC0VBMkwWwzkZElfc3+Qgunsk9Pgby965QNwMC+Q2JiCxFIgWhvSItJ39fg0K9Q199GBFoT xC0CSnri9tYkVsXoCIeMGiq7S8bKgYO7Zeyp0rANqEnLkB3DRkvanFkyZlTn7jgdtmA9qQgoAoqA IpC0COB6df60Eqk1+9E8/sZ2G8I6q8Ao1syYE62wKSnWoolmrxrkZGWDDU5wQUE/Yxk5ZcM8s4fP un1njCtbiww2rmHnj+8nNXVN8urWE7J6z+mPrPWJXK5ZF4T1pfa09M+slcWzJ8ucycZD4kOjUuQs okwxsG++DbJwqNqQMkN6Zo4qlIsn9rOWqRxD9i4Y30q0WKq0s7TKbM5aaa0+LcZdEBe4wbr+Nkqk NVk8IqCkJx7vSoLWafL44XLwovNl4/73ZEjlKclr+GjkF9esppRU2d5/qJRNmiIzxg6Xvqo5ctDo tyKgCCgCikAHEcjOzJArz5tolpA2y1PLt5nQy2Y5aZZZP2rW+KSY8SeSsE/NIysOh022zYSk3na4 0phARNKMyxvub+xj4ywjYS/2nMTVrNmMldlSIyOLU+Wa8861pA2rTFdIyeC+diPVQ+9Vm+BCBZa0 HTZht1mbxIakXqkx65J2m7U9TVh7mmpleL9iGTagyJtEfysCCYWAkp6Eul3xXdnhA/rIpLMnyuot c2XVmVMy5/1dku8jPs1GdbW3sL8sn3aeDLjqcpk+aVR8N0prpwgoAoqAIpBwCGDxWTx/sgzpXyjP r94p24+USVVDrqRkmo+x+kRDfsI12nAdS3j4YhPSRoL0tENaTCAf3NlaGqqkMKVapo0slMWGqE0e PbhL3b2JcDe8OE/SdxtrlCl/udlElU84aW6sk/yMFhlmsMQ9TkURSFQE0v7DSKJWXusdfwj0Mx3q mbwCWVFhotdUVEn/2krJMh0rVvpaM9AcKOovfzv3Eqm/9mpZNH+KDC42Ud5UFAFFQBFQBBSBTkYg 1VgvsExMGjVQMlMbpbr8lNTV1kh9wwfrVIwSrqPkp31VNiGuDTlqMSSipb5K8qVCRvcR4842Wq6/ eJqMHNTX1KcLfNo8lYQMsoHrwaNlcsK47aWxV54doT2JPD9bjJ9bk1kbNWN4rlx2zlm6pseDjf5M PATU0pN49yyua0xkl0XnTxMTLFTeyi+Uio2rZfz+nZLeUC9Hcwtky8y50nfxIrn8opky0gQwUFEE FAFFQBFQBLoSAdax3HTpTJk3ZZQsW/+ebNx7TI5XVUt5baY0pRqXN9b7pKZJSmp6p5MOoqS1GKKD VQXLToYZHYvSzfqYvhly9rjhctGMs6w1qivb7897wsgBMnN0sRwsO2IIUPjQ3s311ZKfVi/TSobJ SOMap6IIJDICKYbFWyttIjdC6x5/CDQ0Nsm2PUfkzXU7Ze2GrbJj5y7JMhT75qsvk09fe5nuyxN/ t0xrpAgoAopAr0DgxOlKWbfzfVm346CUnjLkpz5NKhrSpNFQEhvpzRAgw4KMASTV/M83FiEsMCGs MGYaxX9s1oPbmvnHflpamqSpvk5qy08Ya8lJGVacLzMmlMjsiSPMetahPbqedefB4/LYa5tk7X6z Lim3v43k5r/5TWa/oNTq43LJ5GK56ZIZ6pnhB0j/TjgE1NKTcLcsMSqcYTYwm24CG/D5c8pxeXvJ /0pBfp7Zw+ByJTyJcQu1loqAIqAIJCUC/c0mplfMmSALZ42TY2WVsmVvqWzdf1TeP14uNfVNUtuc KtWNqVLXmCKNLWnSBAGyJKiV+DgPtDadsSE7KdJsUjRLZkqzZKc3S65ZA5OZ0ignzxyRQ5tXSnZj hVz9pTvk09ct6NI1O9HesLHD+sul54yWwyfekf2nj5gNxQeZQA+ZluhB1lqwANWekilDc+TimWOU 8EQLrKaLawSU9MT17UmWyqEBM7s5t2nLkqVd2g5FQBFQBBSBREWA9S0EOuCzcPZ4s9anSU6cqTTk 54whA+VSWlYhJ8urpaK6TurqG8y+PMZVzdAbt+4G0pNijqSlpZlNP9OlIDdbiovyZGhxgQw1ebKe aOkrL8rmv603sdnY+qYhLggP94v1TvOnlti9hv761lY5dPqEVODu15Ii6Ya49clslClnFcon50+S qSa4gooikAwIKOlJhrsY521gYHAaMTdYxHmVtXqKgCKgCCgCvQyBzIw0Q1aK7Ceo6Y0mBDau2024 sBmBNGUar4Y0E646lKSHORfqmu46znh8oVlTNHZ4f3l97Q556oWlsnX7Tpk5dbLcePWlcv6MsdLf kDgVRSBZEAj9piZLC7UdPY6Al/Ao6enx26EVUAQUAUVAEYgBAQhMTlaG5Odk2Q+/wxGeGIrokUuG mCiqi84dLUMa9sv2Fx6UwY0HZMGMEiU8PXI3tNCuREBJT1eiq3lbBJylRwmPPhCKgCKgCCgCioAi oAgoAj2BgJKenkC9l5XpJT1KfHrZzdfmKgKKgCKgCCgCioAiEAcIKOmJg5vQG6rgdXHrDe3VNioC ioAioAgoAoqAIqAIxA8CSnri514kbU0yMjKksLDQfvitoggoAoqAIqAIKAKKgCKgCHQnAhq9rTvR 7qVljR49Wq655hpLeoYMGdJLUdBmKwKKgCKgCCgCioAioAj0FAJKenoK+V5U7syZM2XixIlmX4BU ycrK6kUt16YqAoqAIqAIKAKKgCKgCMQDAkp64uEuJHkdMjMzhY+KIqAIKAKKgCKgCCgCioAi0BMI 6JqenkBdy1QEFAFFQBFQBBQBRUARUAQUgW5DQC093Qa1FqQIKAKKgCKgCCgCvQkBgvfk5+fbJsdz IB+2k8jJybFrb7Ozs0W3l+hNT2nvaauSnt5zr7WlioAioAgoAoqAItCNCAwbNkwWLVpkS+R3vAqE bMyYMXLRRRfZ77S0tHitqtZLEYgZASU9MUOnFyoCioAioAgoAoqAIhAagalTp1oSQQosKfEqBBoq KiqSwYMHS0FBgQ08FK911XopArEioGt6YkVOr1MEFAFFQBFQBBQBRSAMAgTxgUzwieeAPrW1tfLW W2/Jgw8+KCtXrpT6+vowrdJTikBiIqCkJzHvm9ZaEVAEFAFFQBFQBBQBRUARUASiRKDXkJ6Wlhap q6uLWnvR3NwsjY2NwrcTNB/JoP1oaGhoVzvam97hlWjfydJOnlGedZ55FUVAEVAEFAFFQBFQBBQB kV6xpofJ7PHjx+X06dPWxJyeni7vv/++lJeXW9/VoUOHSnFxsTU9M1E8c+aM7N271xIeFvb16dPH PiukP3nypPTt21f69esn5BNKmHieOnVKjhw5YsvFX5aIKHw3NTXZaC74zpJ3dy4YpE7vvvuunRSz aSh1CCftTR8ur0jnMK+fOHFCSktLpbKy0uKSl5dn7wt4gvegQYPsvQqHfaRygs53djshHe7+8zwh 3OshQ4bY56CioqLT2wlmPNc86whY8WyDoYoioAgoAoqAIqAIKAK9GYHQs/YkQQVLDQQGX9WRI0da srJhwwb5+c9/Li+++KJceuml8pWvfEXmz59vzzEZJe3//M//WELw7W9/u430FBYWyvbt22XdunUy e/ZsGTt2bMiwjkxAN23aZPP561//KllZWbaMUaNGyc6dO+1E/oorrpBrr71Wxo0b122LBt955x35 3ve+J8eOHZPvfve7cuutt4a90+1NHzazCCchCW+++ab8+te/ltdff92Gzrzkkktk2rRpcuDAAUs4 zz77bLnmmmtkypQpkpubGyHH6E93djt5jtavX2/v/9///nd7f6k3zxpEc/PmzZ3aTqySYPfUU09Z UgjRqampkU9+8pP2uYseCU2pCCgCioAioAgoAopA8iGQ9O5tR48elZdeesmSjgsvvNBOOAkfefHF F8uAAQNsKEkmhlhuECbeaOaxDmF58AqLEOfMmWMtNS+//LJN6z3v/U1+CxculHnz5lnNPlYeJr2/ /OUv5YYbbrCE6D//8z/lD3/4Q9h8vHl2xu+BAwfKrFmz7ER4+PDhEbNsb/qIGYZJgBVk8eLFArFB IJncmx/84Afyne98R0aPHi0PPPCA/Q0pglh0lnR2O/v37y9XXnmlfV6w7kF6zzvvPPtMEM2ns9tZ VlYmf/vb36xL5he/+EXhwzMHwVdRBBQBRUARUAQUAUWgtyOQ1JYeXKJeeOEF2bdvn5x//vkfiZzC JJQNw/ybhWGJYbKI1hx3OL9AfM455xw7wXzjjTfspDycqxXnvOcp76yzzpIRI0YI1oX33ntPDh8+ bNfY4NqFZQq3JOp36NAhey3khBCS1dXV1l3OuX5xDOKGxQOihluYI2q44JEPGHCcfIkewzW33XZb W760D4sAdSAP6oe7HfmCT1B6rglXFwgjliRcARFcBymfepA/bedYkFB2kLsfVrXPfvazFq/nn3/e lk/4Tyx1CG0gf4gQJIP8ITJgFSsu5AueEGeeBTZrw0UNbFzo0VDl0gbSu/a4b/JE/H+3HhVrPQzX TpfO/41LG/WEbPP80m7uPc+RiiKgCCgCioAioAgoAr0dgaQmPbhE4aqGBWH8+PFR32tICpPSUMI6 Hyb2r732mpx77rl2Eh8qrf84a4aYQDuCwWZlEAvyeuSRR+wE/aabbrKEhdCRWAz++Z//WWbMmCGQ LNyXKBtCwoQWi8EFF1wg+wyx++1vf2tDTTLpv+666+TOO++0a2Q4jvvT5ZdfbjX/zz33nJ20Yw1w Vqff/OY3tl7UB/KF6x3WsEcffVT86auqqsLWBaLANY8//rht52WXXWbJwpNPPmmtZHfffbfcfPPN 7V5rghsg5AdhXdLatWvtRmrg8fbbb8uzzz5rSQrlYxW6/fbb7bqtWHEhnxUrVti2gAlruiA8n//8 52Xu3Ll2XVSocik/VgnVTi959ucNGed54DlYvXq1rSsubhMnTrRkiHVkPBc8a7rGx4+e/t1dCND/ QcZRCEQK34uihHebtChL+Ea4Hol0vU0U4h/yRngnklXADrw7glNPY5MMbehpDBOp/Pb0D65dvMv0 CbzLPOsd7R+0b3DIJud3UpMe1t5gLcHK05kTPTTpEKlVq1bZiTeWi0jCi4Tlg8k6E2VID65y1K2k pMQuQOdlxfqDWxeTe4gKLzKL4lkf8tOf/tRaOFiLQx2+//3vy65du6wFB+sT61z+8pe/WPLyqU99 yhIN0rGWifbjboUbFMEVsARgHaDMV155xa5TgoywGzPkizKxMNE2b3o6pUh1Yb0T12F14R5Q9i23 3CKTJ0+2eS9ZskQIokCd2yNYqrC0MPkhb6xTfIPBfffdZydG//7v/27vyf/+7/9aYvilL30pJlyo 15YtW+T++++35d17773WTZK/sSKxzmjr1q0hy2XtDtjHIkHt5H7R9lDCOiHuF8QYsgwZhxBzDWQT 0gaZwsUOS6OKItDdCDCBjSagDASHdFjBCcwBmadvo0/hXHsCyoRq48GDB631mb7XkamgtNQZoVyv hDruTdPe3x3J039tZwdmCdcWxgo3rnBvwBOlHB4IjHt4BfBBgQfe0Y7FkdrAWMQ4un//fjvmUSb5 h/IiCNcGPdfzCPAMR9M/+Ek8fQRjMeMf/URH+wftG3r+WejKGiStmgvNNgEDIBrhJouxgov7GBYP Xjg630jCCw3h+cUvfiE7duywlpgf/vCH1j2Oa9Hiu4GV37igsaAfKw9rQJjMsmEYlhg+ROViovvq q68K64uoAxNaiBQTZMqAFKD5Z7DhOAQKtyxvAABIA25RLKx/5plnZM+ePdZyBClB/OkhSZHqAllj ws+1DIAQqbvuukumT59uj+H6xqe9gvWNDs9Z4RhsndUJix6uXbSNsqmDI72x4ML9WrZsmSxfvty6 yWHdYy0UJJV2gRs4hCqXgThWCWonVqdQwoSC55B6cY/BZMGCBTbYBs/+7t27rYUP6xMEWEUR6G4E mPwSUIbgMShReMZZb/Yf//Ef1qr8b//2b/Z9pe9iIosiBkUG6x5RxvCbyQiCUojJEWnIM5r+19te 3hes0H/605/sZNl7zvubvm7btm32/YnmuDdNe3+HKiuafIKuRXmGcuzrX/+6DQoTTT6xpqEvRBGG wgl3Y9bMcj+ffvppeeyxx+RnP/uZoHz6yU9+YsejaMuJ1AbuO/3sj3/8Y+vFgOcClnmVxEOgPf2D t3X0Fyh6UQAzP0I60j9o3+BFNzl/J62lh5cB7RMTYFx6OlvQVjHYMIAz+Y6k1YfI4Gr0uc99zoa8 hoiEWm+BlYe0Lpw0E1rIC4OLIxNMGiBJrCnhPG2dMGGCnZgzGWDAwP2L9BCBUO59WBWYDKMlI8oc 61+YZGAlCBIsBtHUxV0L6YGoUFcw4AMhgZS2V7gOrJ2rFp0bvxn4mCih4YG8cU8ghbQJfCZNmtRu XNAyQhbcMwSOuAdi4YFc0I5I5ba3fS59UDtDPcM85xAviC8aToJnsI6NvyHLPDNYJYlOCPkLp9V2 5eu3ItDZCLiAMigmCChDn0D/RoRL+iomygQtQfib80yieb6xrmIdx90WKyXnUOJAeNxzT77RCn3E 0qVL7btBoBncb/2C0oN0BE7hnacPQUId91/fnr87kmeoa11gFlyp0YB3pTCWMV5w3+h7uD9g+s1v ftP2v/TBrMNEodYeidQGFDy4feNqTLkqiYtAe/oH10qn2CSoEeO0k470D9o3OBST9ztpSQ8dLR+I RShy0ZHbysSXl4uXjQl3JNIDScFCw0Q0kjj3JpcO7QMfhHz4eLWbbo0QgwSuZQzSa9asseuEGNRx C6GuQcLkHUvM1VdfbUkPLntMlCnj05/+9McuibYuH7vQc4C6e+vvORX2J6SGD9eCEZN56sl9RrBw QIKY3PMhDYEpuP/txYW8HOZYC/lARt1aHdwmI5UbtjFhTga1M5RLCNYsLIJYoe655x5LdCGlhMmm rlh6cPmADCnhCQO6nuoyBFAORRtQhneb99pZsqkU2wTwvvFeOKE/a09AGXcdShOUQZAt+m20w/SR Xus37/XGjRttuHkUSCgccHWlP0HBxHYG3uOQNxQOXBcUTMX1UaGCxQSV5fKkL8aqxTeTPOoCPnyH qifKIM77A9aAAX2ac1emXv+PvTuB/20q9we+zEOUaKDxNAilIonKcAqVzFKi0pE0KPeldKvbv5Lq vkqvV1xdpeGmhJApNGcMFcolc6GDTBchCaHz3++lddpnn/0df9/f7/yG53m99nfYwxo+a++1n896 nvUs55VgOAjUsAFopK1/QUTqwtuCIEEIK5zhPpbgMogwLL339Iv+N/OVZ6f2YFUYpJ6s7JRy+amj PrXfYDbKEdIdgUH6h3pK5mx7jt3DTWI/TP8QfcP49Q31dlvUv6ct6THKr/P3QLmZRy2UaxuFuhOh GDZP6dXT9FCriw5Xh102L0H71LUoxVzIKMAmswsmMKtSeI2idhJpcN1673vfmzsPgRIoGawHLBtN GaQszWvH+p/CQflRZ/W0eQEZaUTevOQQPyPClCft7lwyKC7wtLmeRQeRgJP/8Nce/eQ7TJ3b6tmW jpcx9zsKAEue8hr13GmnndIXvvCF7EqJzAqVzh2TuGcJhSckEJgIBAYJKOP5otQX8Rx71hCTYm0p x4YJKFOss/oN7nLcoQRt0WcWQTK4ZQmMgiSI5Kkc+hBuXM39LFQsT92CmlDO2oLFsHq15SVNA2SW WzD6rG8zb8H7Zs6cObnMrO5t13JNhvmiDEADL9ZymCCLLDL6ZgKLYYPLwMHI/hFHHJEHHM3h8E7w HquL8zq1h76w30A7iyqYTb0u0/33IP1DwcIACB1F32DQ9rjjjiuH5n8P2j9E39A5UJbnoN9nZn4D TNIfCw7LTNJCDlMsRMBoYZnj0EyD8qej1Dk3pezzXX43z/HQuRGM8HnwOgkFWV6FqHQ6z/56XvXf XDc8wDprL2FWCJ26zQvFCFqZvGkEilWDhYNia8SwvGxKHsoifd9GEM1dkZb5Q8IlS1MeRtDKeeV7 kLKUOpT8Shrluw0Lx8p19d/qrZMzD0C7WtSVoqGdWTTU26giJQZpoND478VLBsUF1sVSYi6WkWru NAiG9N1XvfIt9SxtX+qlPPW61X93qqdrmsL65IWhTEZOXcviOLuaz+NFgLwaoUb+jFI63yiv80IC gYlCoMyt00+VwZl+8ta/CmbALUoQlGbgE/c6guS5ZL3pJfp7LqsCeug/WB24ZOkzDI4V0cdR0o0e y4OVYq+99srzVdr2IxkUefOODI68613vyu6k5hqY18KywTIEhy233DK7Dxuk8Fx2ykualPsDDjgg v6esU4YgIUEUfsFbOl2LMJUANKxISJw+pgSg0S/o5wWXUW7ug74RwXoAGlYw+2DvuAA05or2Ev2d NjFnSnm9W4g+04bMISv6Iv2TsskH3uYc8lQQdKdZB2moj3mx+mTROUUoLW7ejhfp1h7atN96lmA2 7ps99tgjl1tEU2ui6Ue75eP+DemNwKD9A4uk5x2+Bvk66V+D9A/RNzwaKGu8+4bed8P4nzFtSQ/o dKIeCApfES83CiKluCiBTN3lpedB0hlTll1HoWxTEh2T9qzKktI2al7ykZaXm3SlxUxe8ipl8sBx kyvuG/L238uAsPpQYlle5KsjtnmZclti2ai78FEOEAKjl3VFwcvHC7C4bvmtXF6GLDzwUB8vOZv6 Nc9X9l5l8WJTB6QJ4VMXdZc+LBCt8rtg4FtZtIs8Cdy9PL3g+O6zaiAjIqMJeY3wEC9RdYXH4Ycf npUPLybXskwVGQQX5aRkUHi0gwhoFBCR7eDleLd8tYc6u7dgUO4H955yDlPPUo/yrW6Il/SNwlBK KCpGhO13b3ih7L///llR0sZGjct9VdKJ70BgvBBwbw4TUMZ1nhEKPssKpdNgQ/Pe1R/oz9qONevk efTcejYMDJk3qX/2zCArRfQrBpEoTfp2Fl3XcE9u24/IdQtqoq/W73v2msFiOuVl4Elfr0/Uj+pH WLO9C9TD1u1a7td1lz39z0QFoPE+Yx3TdtqtKTAdJrgMMlWCyyCu2g85pPjWybT8u7WHEX1tCyOW Re+ztkA7lOuSn4FDA4/eMxMRzKaJ2XT9P0z/oP2QfoMo5jF3k377h+gbugfK8kz188zoZ+h7+ruy +W//ZJFp694GYKNJXlSUaKB7YXhBUqJ96zB9G62hEDvuRYPtUlqNpBllNJej/gJBHrxkPXR1t4h6 o1Ls5eOlZR0d4jojVcIJS7uIc+TLKjO7GqXXEXsJO6cQKtfsvffe2YxLkXWO+nFlQnDqorwIkpeE l0MRN5/66ihmVeTGjYycGF3zQkYUKAWu5RKlvM3zKe29yqLuCBzSSTGHKyyQIS87WKqz8+pkTVlY cpw3u8KBwAGR0X6IGMJjtLX+klN/0YHsc76IS+qnbernDYKLerreCK80jHC6F+DpvqH8dMsXtkaR vThLXWCrfu5JeA9azwxI7QMp1f6UobOqidkmXbNoUQIEzHjnO9+ZjjnmmPlmaS9rm+tCAoGJQIDC rt/xwqwPQPTK2/PjedGHUDhZDYzomxxfBjuk4dnUN5TBJfm0ib7QYIV+1nOtX6U028cVGPGh1Jb+ ti2NTvukWVxj9HuebeUpwVT0f0iTcvcTLKbkU/oNdeLChUBQEstWzuvneyID0Kiv+UTKr930T00Z JuiO94V+2T2l3ct9oB+1FenVHt5rRbxHlbct0I73EczL/asdvBsnIphNKd90/x60fzBgiIhqb/qA tqaj6C8Mkvqtncpz3E//EH3D6IJT6QdZqA1YFdGHi+pY10XLsUXxvXBvtChKMU55eqmZz2Kk0ai/ jhbzZzq3tQniYQJ/2yT+cr5RBpYKSm+nhqQUd8unpOVb573LLrvkrb6//ttDTmGVp06YyKPthWKf RUeJDr0IZZvSYCti5NQLmauDl4HOA0ZeAqR5frmuW1mMUlrA01aXrbbaqv53od9cVZTDNogoq+hB HixKh06vTbEfBJeS/6te9arsqqJzRdC4YRTpla/5NLY2YSUatJ5t6bj//v3f/z271FAKYF9XLj/4 wQ+mOdUcAIoSEt12v7SlG/sCgVEgoE+xeXbqAxy90nauZ8TGki0krcEo7pyUnSL9BpTRX8+tBkR8 c43R7+l3PS8GM7i4UWjr84lKHr2+DeAURZrS5VlrBlPRf/cbLKbkR1lgkWLFFWCmWHvK8UG+KYTF Y4FCaKtbzfRvFMpu4vz6Nd3Olb7BF2UuUpRTiqj2HTS4DAVZH0f0veUdVdIv3/20h/p2klJP5S2Y uW9sExXMplPZptv+QfsHA74GE91DPBeI/yw1ZeCCjsQ6S/rpH6JvGF3fwBjA9VM7FWFQ4M7bSVcu 503U97QmPUZxKK06LiN6Rt7qCuEwIHsxcB/yMqZoT7QSqaN/8pOf3LPoZRSs14kw0jGQ8t3rmnK8 37KU88f7G9mxdZN+camn4QXdDfN+8q2nNx6/KW+2pmhf5DgkEFgUCHjeDECwxrDcDCMUTUSnWM7r aRSrh2e0PsBTP4cSq/9XBtbxMgrsZWxA7KzKSopUsPiwcHtmbG3Stt9ASLegJsrIitQpWExbmsrM K4BLLU+Fj3zkI3l+E7exurRdWz9efnvvaQfnG9kum0Eu+7QTRXLUYuCxCI8KxAUhlN+gwWX0b2Wg z73U6X7q1R79YgYPm/ONYM+tSLN2LBjCs1u795tPwWcmfg/TPyC1BircT4RV1TPieTGw7Z4rpKdX /xB9Q8o68aj6hlmVhw0rrwHoIgaSDKxPFpnWpAfIOkBrlPCr9oJDVrwghxEPG9cpL03zPbopwsOk H9cEAoFAIDCdEKDUDBpQxugvZcRgAgsJRdl/Cg3rR11YdvXLlGEv7jYxUMU6rxzmAhaRD0uE8P4G skT7Mr+Dpdtglo3SxEVVGZSl034v9XowFSObrmVRQMa8eyjtgsUYXOKKypIg3bY0kRELubLyUCDk raxFiVNn5Wq71rnwQmzKNysvhV3dDALKm8BAuerBcFxDyvUljfKdDzY+yrFCpsq1Rnf95pbG7YUy ap4kqQeXcU6voDvuJQF6tDVF1+g+JUv7wqJg47xu7VEC+/SqJ6ykQ4dAuAWzgZP7Ul7leKd2l486 hXRGYND+wbNQV6ilbKFhkRHf9KY35WAT9dx69Q/RN/wje4CMqm/wPNoms0x70gP80gF6aXgIdFLD iAfEy0Po1LZR9WHSjGsCgUAgEJjOCCAqCEndpYjVhZsu32/uJZRY/TMliGuE/Sw8/hthN1DFpbYo rAUvaUrbi7ZYcMox3/psEcS4tAl77X8Z1aS4UsINXhk5Nvmda4wQ1vZRsM3PQZhcb+5jp/0G08wV Ov300/McRHVSVqPOLBssTfaJAKasLFc26alDMy/lQgTUyQj2kUcemRV7Crd3GDc/17WVx/vNyHdx zypzWhE6BA/uBgELPiUYDrLUbwCa+sAhi4s5Q4WUadsSgEaaMBe9TjAacw3rFpASXAbJ87sIMtas A4LIUuc89whCqI7wkadrYOy7W3tox37qCf8SzMbiqoLZcK9D5JBa92O3fCiSIb0RGKR/QEA7WXTb curWP0Tf8Lf8jHl2xqtvaGuTRb1viU9VsqgLMRH5e1CMzIzFhO8FbJTJiyckEAgEAoFAoDcClFwW copyCSJAcae4clFhrTCYVPpnvvmCqiAbyA8llmKOkNQVZvsRGor1jjvu2DqYJQ0j9NyT9P0ULITC NdKWP6XdiDwLjL7dIBml1n952CiwlO1yXnO/EMjqUNyuKOhIDauGdwaSgvjweUcOKO/mXUrP8WZe 5sNwH6aQKK/5oeanOo8I5sI9zDzN5rX2qReMkSJ1RiDlydqFTCgD64syi1yGmCEQAq2woCgXcqDN /EcQ7WPpkFY9sA8CgUyZc8WNznXOn1uRVaSRhUcgGOUwSl8nA5RY+do3uwp8UIir8pmr0VYHeSBu 0keWkDz7EEeEUltov07toU791lO5kFeWJG2rrOqvXbnt2Drlo12nkrAAcvXUlu4H7TERus4g/YNn oTwDBVv3ivtEgIn6vJFe/UP0DePfN5Q2mkzfi1Um3oUXqplMJYyyBAKBQCAQCExZBLxihGrm4rX9 9ttnN7VulXE+JYYLF6tMU8kp1xrhF9kRuRA0BXkatVCqSTPtTvuVWdkpi8pO1Md+QhFzLYLXnIjf lmZzX/N/TrT66LS/HK9/U+B7BcOpnz/evxFEYlCxX2FxoaQjOwgWjP2uk2JptbVHv3nUz0N4WA0Q JkStKaPKp5nuRP5nrTMG/uUvfznts88++fdEeLQM2j/0i8l49w+dnrlO+9vukegb+m3N0Z03+rfE 6MoWKQUCgUAgEAhMcQQoooMElHE+ZaubwsU1ZSICyjTJTmmKTvuRnebouPoU4la+Szr177Y0m/ua /8v1nfaX4/XvyRaAZhCyU+qB4Nh6SVt79Lqm7Tiyw2rWSUaVT6f0p/P+QfuHfrCYiP6h0zPXaX/b PRJ9Qz+tOdpz/hXcfrTpRmoNBIyucVVYlMJH2TYKGWVaoyjPZEljMrTzZMEiyhEIFASMjgsoQ8Fl 8TFyPqwYMY2AMsOiF9cFApMPgegfJl+bTNcShaVnwJb1suYaYOItNwa+4fyb+SI75j8f4+L7LXk+ z6K/OG5hS8eGEaZQIxj805naKRCzKh/mfn2H+bAjK64xwtBJKO6k6X5RP7/ftOrX9PrdT7690qAQ MdOXRey0C19+c7qQTqMwRuxg1mlEplcenY6Pqp07pR/7A4GpjEAElJnKrRdlDwTGF4HoH8YX30j9 UQSC9Ax4JyA6JuAeeuihOXoME/tGG22UJ2KarEnZNsn0rW99a47ugpiYkLn//vvnyaP77bdf10VI uxUH6UF4Pve5z6UTTzwxT2Tlg7v11lt3uywf4/8stCPi9b73vS/7lLddhBiYkIrwiFLXJv2m1XZt p3395Nvp2vp+xMNaFl//+tfzBFp+9VxrTHI0mVh0n3XXXTevx2Fib31Cbj2dYX6Pqp2HyTuuCQSm AgL6Q9tYxKBFN1ejsaQd1wYCgcCiQyD6h0WH/UzJOdzbBmxpVhyLkookxKrDirDddtul//7v/06f +MQncqQX4UW/+MUv5ggxkhf9RdQi7h0i2Awr8kOoRPYZVFkXRUdkFtGOKOdtwtLiPIROxJ1O0k9a na5t299vvm3XNveJpqN9EBuC9CCFn/nMZ3L7GE2yRoa2UseywncznWH+j6qdh8k7rgkEAoFAIBAI BAKBQCAQ6IxAWHo6Y9PxCPLBbarpIiZkpo0I82kTrYc1yCq13KmQHkq+MIusDoSrFbczViIWFiE3 6y5rottIi0sbkuW/MvQrrDvWmRDGlHuckLDWrKgTJ+UU7UTkFmsqKLO1HLji1cvST1rKJT1llp86 wQthtNWlV76sSlwJ1VkayiWNetnr6fntPFtThBplgbv22muTdRekbWJxWexMWbQBIgRf9UZk5G0/ 1zki8pKRZtYp+7WdSdfNdi75u+62227L7eee4b+sDmVSc6d82+pQ0ozvQCAQCAQCgUAgEAgEAoH+ EQjS0z9WHc8UMpNiLJqQRdkQE5YGK4gjNtacsJAaJffd7353jvHvP3czpEDMf4qwxc+k9f73vz+v HC4dCjGLxBFHHJHnEnHJ+tOf/jQ/RGnHQtUOcImTjzzMxfnVr36VF+BjfSpi7YZjjz02nXrqqZkM cBHjTsdKsummm5bTsntdr7ScjGBZJRlRs26EeTYW/UP+6tItX+WzYOAJJ5yQiSLTtyg6LDlcCptR kurpdvotjj/yQ8yzQgYtzIWIWpFd/ZEUG6vQbrvtluduHXbYYZksIkM77LBD2n333XOd7Beicost tsiWvXo7W4dDOvC2HwbcIxEeIXZZ7JDITvnKPyQQCAT6Q0B/ZSDCs2yASV9hkEGfSmIQoT8cx3qW QSDSNjDX7dhY83V9r3ugDFS2lW0U+UcaMwOBXvdZ9DWT9z4I0jPGtqHwWuTKHBukhbJvpeZdd901 z4kplptiraDkIx+sOSwK5gchN29+85vzehPf/e5308knn5wDHlgMj/WFu9k111yTPv7xj+d5PJ// /OczGeqn6MrnWso+NzxWDu5tFHGL25XVjS2wxnWOJcrcF0TMonX2F+k3LYoHa5G6IXBIhXpR8JvS LV+L+R100EGZhJkLheR8+tOfznizrKy//vrN5Hr+dx38vfzgzxrlWxseeOCB2Sr1yU9+MpOhr3zl K3n+wXve8568sN9JJ52USZy1RqShPBbi034WDywBLhBg7UxYyw4++OCc37777pvdC/1nRTLPCFHu lK+5V8MQu54gxAmBwDRCQL9kQGFutVgli6r/FjHk2qp/Y9FlnbXQZFF6p1H1J01VkEuDfAZ29G8w b0q3ADjeD6UPlYa2MtDFqo8saUebtp1VBePR7xbp9x7wvpGH94DfoZwWBEfzbZDPPVA8JuCrDQ1C aDvi3ckNnWfERD2PyuXeUy5lcv9YqLeIgRJCX+sm/d5n0dd0Q3HRHgvSM0b8Pcjcxa677rps5eH2 xMJjlNHqzR5wFh4dN2W4CGXWfg89UoBgOE6x5vpm09GfffbZ6ZxzzsnnrLnmmpkMsRBYZbwfodR7 mbAaUACkgfQoM8uLlauJjsmLSrl0Cl4sTUtDv2khEZQPc38sSohIscyUxfrq5e6UrzKz8ijnlltu ma1FMOVux/LDPY81bdAIbOoGB986MPloJ3mdd955eWV3bQUHxxE3ljUrVJvHhdwKWAELL2Y4IS9G DpvtrCMt7bfTTjtlpYv1Cil2Lpy65ctC514KCQQCgXYEPL8Cr7BSn1XNWaQIi5BJ4abcspQjQwYl DCJMlJLVXtrpu1dfKRQ5DwH99OzZsxciPd6V3YLp6A8NdBlsYhmngHI99u7QzrwoWOb1oR/96Efz QBREB7kHttpqq9znKq/3Lqv/oO+Q6duKY68ZL5ALLrggffWrX80DfMglLwiDrgZcPYvembwgvNeR n4kQAY6+/e1vp6997Wv53S8A1Hvf+96cdb9BlAa5z6KvmYhWHS6PID3D4Tb/Kor8nDlz0p577pkV XBPmDznkkNz5f+xjH8vWlfknt/zwEqaE6+B1vjYdslEzLwEjE8iQlzmCQCjY/ZjnkSYvES5mXhQU faTHPh0TQmFEwv5eMkhaOjqESXlPOeWUXAcWH25p/UoZuYVBIYjKCSeKzE033ZSVGnNuBhHY6rzg C0Pt53dxAURkkDWWOSNB6iA/kexgyIKFNHr5KheCVIhjsxw6WlY2ypdzbV4ASBLSo6175dtMM/4H AoHAowh4Lj2HX/rSl3J/a2DBSvL6NOJZN2DEMq4PDBkfBLj6sJTzSND377XXXguMopdcSwAcfbpB K94EdaEMe0foXw3qeS8650Mf+lDug7W3uZgGGIsMeg8Y4d98883zO1p5KKf67yDDBdGxfRv05RLv uRQ0iTXH4Oo73/nOPEh4wAEHZO8NruWsL/SmXtaVsZXo0auRK4OkBk2LF4YjBibdB4IbeS93ilg7 6H02ijJHGuODQJCeEeFKgTb35fzzz88bYkFBNqo/qHiJ2JAdLwiiYxi0c2BmNrLiWyckTUq8F5MX Bxc3Sng/oy2DpEWZN4q2zTbbZNIDE/VAWt74xjf2NbJmVLCYw11nU/4ilBijSoOSHqTGJi04qLu0 dWqE1QcJYtmxOUdwCqOX3Ol0jBdeeGE644wz8oubm6KXc5tIq9QBfjYji8WCxoLUK9+2dGNfIBAI POo6KkrmD37wg6zIcikuhAc++iFWgl122SX/LoqtZ7K4G3v268FRKEH9BJnR9xiQoriRtuAmFCz9 h2e8uPt4T5QAKfpE+w3CKBuvAEqjNFnKif/ScC5lzTcyp8z6Lt/9ljknWH2U9PWhJd+xBFbRn5q3 yiqOoNTdhkqe6ugd1C2YTjlXmZqDeqxIBAl69rOfPT+QDffhQe8BLslcx7kVa4sPfOADrV4IpTzx PRgCninPXlMMMBp0dd/SP7h2uwfde6TTc1Lez7wrPHf0IPtc59nwrBhgdN945ryr7fOcGyz2DHlO 3FOuKyK/foI3OX+Y+8x10ddMviBOC9+ZWipkKAQ8VF5cHjA3O6XXNqx4oHXKOhAvDVu/QqlHvJhu BT8oD7vO3gvkrMoVBBlh8dl2221zh6HTaJNB00IaKB/Mx7DgjsYFhfsYkmVEry5t+bpOJ+kYK1PZ vPDtQ97qPt319Lr9ZiFCNqRhTpNNmykTnHWEiBQCq95FIZGmc1l7YMb9YlY1avia17ymY3bKZ5MX iw4CCpdSJ/XrJ9+OGcSBQGCGIqCP0Z/Y/PYs2ppCQTL44ln23OmPuwVHQQg8272CzHiWewU3EeyE W0+nQCUUNcFekAF9jwApApxQ2KStzNyekQij5kak9U+URYrdnDlz8ii6Pr6fMuuL1G/UgVW8Z1jU KJx10llvi2LR1td2CqZTP7/8hgGcYOh9aN5pGega9h6QthF9AXaUmwvdxhtvXLKM73FCwLubXuR+ df/ykih6ifu603NikLBTYCRuq7xJSrCjd73rXWm99dbL6/RxtfTOts8AZlMMIvQTvGnY+yz6mtH3 Nc02HOZ//3GPh0l9ml6jI6aEk6KM+20UonTulHYPq9GIcn75di7xn0jD73K8fFPsWRkQHyOTRjpY f+RjdM/DaGsT53A58MLceeedM7FBbkQj08l7AXp56miK64cXr02a0peXTmrQtIxGmsuiI/vwhz+c w0R7YekEpNmUtny5gnmBGkEtBFJ6NmkZ7YNLmxQsHav/lg4l6ZJLLsm4COxgng6cS1shhJQC5MjL 2X8vXaItWXu0ic7aS768gB0v7Va+lV26XvTM+Vw2+KVrR+kjyf3kK+2QQCAQ+BcCrAtGi7nBehY9 m536A/sNLnguKeiCoxiEEb5eABkKleAivj2r9SAzXIDte/7zn5+PCzJjTt/aa6+dB5P0y0aBpe08 8xdZEliEnSNNFgUkifJlrTbzNs0N5FZFidcfIDTeA9JAlByThgEr0Tu5BVEarS9GQUeCRPTUx/db ZuiVwCrcbvfYY4+cPisNa5n+sVt5EaamFEz1bwID2Jqi3PVgOpTdEkyHAtxJ4KG/POqoo3J99f1E v2kb5h4oeZWyuh+URT1CRo8AXYJ7t2fVIKv3r3ZEQnjBeEeSbvcd/aMERjIPiKu858OApGcbeZWH e9CAAWuS9vWe96y6T9rEOSV4E32DFZFrpjmBdRnmPivPRfQ1B+dnfxR9Tb1NxvI7SM+A6HnQShQQ D7QXhQl6RuuOO+64rDAzpxq145/M9cmIAoXfuX5Tom0IQOkUvPi4P0kfaSi/vfRYZ7w0jOb9/Oc/ zyZZLwudh/PKy6BURSfhpahM8vW/dOryowAoo7yMenLVUhb7KPReNl6mrtdpDJqWl6OXidEX5TMC S2mwyaMpbfnqxLjIsQwhZV7WNnXhk80SY7SoKfLWPnAmMPfi1CHCzsiejpYvNzKI8BAKCiuO9A8/ /PCsqFAGXIvAFtEWiJJz/S6iDZrtDF8Kis4U/qL7UV5EsoOP4/3mW/KJ70AgEEi5vyoDKKw5BnF6 uf/qM/V3iAxFyWZQyODF6aefnvsHCjoFqBlkxoixfSXIDKJFcdMXKEcJboLc6F/t14+WQCUUrGaA FAMf5rZIR59vEIoV2n6DKfoXyr3+T78mH/kbJPJe8c6wkX7KbCCrBFaRvkEl/VhbYJW28hrQa4o+ TJmUET7q2BRldJ4BHoNGlFJkUTvAq5NoC6P1yJ33X1PgMeg9UNJQTveM9wwXw27kq1wT34MjUHQB gwrIikED9zvyzkuC9VU7d3tOvPeRGQMDAiMhUNxWCzlx39mI9Dwz/he3c/vaxLsfafLseJ49t+5R g6p1GeY+i75m9H1NvU3G8jvc2wZEj1JMYUUeZlcRaogQz6KCeMB16FwUKOtG/bzAEA9RuGZVyr8H 3ENr9MBxCrWHk1LuYdUh6JCl5UXov8l+FHzneDjNC5G+a5UDgSoPfSkPwkIJ9xJVPoTDtcXX1Uvc iCRFQWfiP4LFL97L2ssAYVGWQdOCgbSlizh44SkvS1O9nBm86qMtXxHq4LX33ntnMslfXOflXBOW KRVtAgsjPLCc/c/28WJFZHREcEB4jPB46RWRntDU9jn/yiuvzPlTCurnFexhZES2CLya7exl6nqj R9KgGGl71+mwdbj95lvyie9AIBBIuc8sSo3+RV9JqS/72jDqNzhKuVZ/Iz19ZLFG67/1uUSf7vnu FNwEESiWf/29/pCyj2hRuAyU6I/0ASUN/RylS35Gs0npxyhn+nMEQBnKlk/650e3MusbXauvkpZN v8yipF+WZ6/y1vPy2/tQPUnBKf/554d+0vvSObBQkqUxAABAAElEQVTyDvJ+sK9XMB3YW9dN/Vl7 lK8ujpf27vceKNfXy6oOtrrVvpwX32NDQPsYXCiDw54fXhrugaIL9HpOpIGMeGaGDYw0lloMc59F XzP6vmYsbVi/dsFepH4kfrcioGPkFmXrRzzwJnfa6sLvFDmqi3CabcJqxLqh4yhEh+XA77ZRDC+x L3zhC21J5dE968XY2gQxKVHWykumE8EwUtiWlrLp2LiOeLHr6FhXvGjaxP62fJ1rFFL+XtQEUSjl yjsaHyZJytc2iCiDenP9o6BQCMy5aYq8hdsk5YXrd6d2duxVr3pVdmvRuSOv3FGK9JtvOT++A4FA IGVi4FmnOOljKPS2NktywUv/aSOUb1uxgNvn+aT8dhPnl2s8y92Cmxi4UjZiQARJMYhlQ2xY1fUh yIBBGJYPlg3/vWeK1cTgmHxY+rkIFWtPt3LWj5UyK0OpvwEt21gDqyCa+nfiXWSwqS7yMIjk2+CZ slBe1d8AUK9gOtrIAJg6F1EPeRpIGvQeKGnUy2owLCw9BZnRfnu/ITjIvfuAt8UPf/jDPHj5tre9 bf4Ab6/nxH3VKTDSaEu8cGru1UHvs+hrRt/XLNwyw+1ZsIcaLo24agIQQHC80L0I/S6T/Mcja4p9 N2LRK08vFMqIjZuEF7jOr5d0yte16m4bS7l65e84sqO8bYSnXO+lbRtEKEjKXyc89ev7ybd+fvwO BGYyAp4XIWhZfilEFCpbmxjEsNX7TRYIGyJCgdZneabrVt22tJr7WMiRFMo8UsKSU8Leeta5zOiz KHX6FW653HYpgoXUlDSkXeb9Gdkm0hVhyqLMwjWbuM1dFhkYVNTNpq4sOvCSPoFFp8AqzfLW86UQ lr4SjoUAOUfaLDoIhXZSZlhw22PplmcJplPKUU+7/hteNmL+hwiaZNB7IF9UfSgnwkaU370RMn4I IO0ityL6yC7Xd1ZN90Cv58TAgAFWgZFY/lhKS2AkAxXuZxvpdR81a1iua+6v/4++ZnL0NfU2Gcvv sPSMBb24NhAIBAKBQGCRICAowJve9KbsxksJNveQSxglijJDAeLOy8KAcFC0m8FRFBwhobzXg6MU 5YlS5ret/PZdpB7cxP56cBMkCnlxTgmQonyIFmVNmZzPeo04ORdpomTNqlx7CcX8pz/9aSZUrNAI HqtHcW1jTSrKe68ytwVWUWf5Sa8c71XeXLB/fiBRiJ00uJjZirCa1YPplP3wVgdtVoLpIFbyLzjD smz2cQn2n8uwwA7yRP4GvQeK10Ipq8Eo+A86iFXqEt8LI1DazRH3lf8GLhF283O+/vWvZ4umCInu eZbMbs8J0uP58YwKjGQw1bo6LH7m2ziuHRFZ7VqsmCVv+ZNyb5Vv+8pAq3M9R9LzjJUBCeeQQe+z 6GsWDuI01r7m0ZYY+2eQnrFjGCkEAoFAIBAITDAClNU5VdhmCos5e4IRUJwpthQjhMD8Pq4m3Lgo R5RryjZ3WQoYoZyX4CgUHm5ylB/pOq9TkBmKFinBTShd9eAmjpVAJcqmjBQyZIfVAgErwt0Z8RE4 hatbsYxTxChtrCQsPkceeWRWzpAM1ivzNUtwnF5llk4JrMJqJLCKuVAlWhxX4n7LW8oNL/WgtMIR mUPk/C4BcARr8J9FBRmFK9LC8m3U3yR2bTa7mrujzQqpYyEqQWjkIw1zn7hIcY2S1qD3QCl3sf6x PFDGhrGclbTi+18IaD/zmJFT4tnz/LhHtTlXfURXG4oYiNxrS+5v7v+254Q7KIuhZ0cUMNc43+Ye kqc5xFwlPSOsSJ57z6P723XaWxk8I0h3+e1694D5diV4k7TcE3UZ9D6Lvmb0fU29Pcbye4lPVTKW BOLaQCAQCAQCgUBgUSDA0iCgACWFgsWqI+CLkWGhiLnC7LjjjlmxUT6++fZReijXlDMuuNbDoVwZ PaYwUdQo7xQg5MZ/yrp98kKiymgwy5LrKP8U97oCLT/pF8sCpYuyxkpBkSoiDVEnnWtF++IyRnmi 3CMAlEaj5aJeIXUEQUI4SvS4XmVWRqQLmVIm5VYX5VHWfstbyu1bWZATQRaMcMOHAslVjxudNjKa r/zIi3pyUZO/8roeiYOBSKhcl7ibwR7mcys3PEopC496SovVq5DGQe8BZZY/4ofkmf8J95kunp+z qvX7DAp4FtzL2mUQMYFfgAoBM1hmPGsGIrS9+x1hQejlpd0QcfcA9zfndHpOkHvEB6Hy3HKXNLfW tdJ3XyE4LLv+eyY8O/J0n3ie3FeIM6LjHnLfI/zuP0TI5lwDF2XQoV73Qe+z6GtG39fU22PY34tV pr4IUD8senFdXwgYcbEVn24v8ZBAIBAIBEaNACWe4oWoUKI6zQGk9PcbHKWfMiIzpJOblNFoo82U yEJoKPTKSvGj8LNiUN4EVGn2kfpPUurT/J8PDvBBuWSVgZO8m9JW3uY55b/yW+Tx0EMPTdtvv32O VjmoslzSGsV3r3sAgeQeZa0kZHeXXXbJuI8i76mchnvRGPiXv/zltM8+++TfiMtEStt9R0W1nyAm 7n3EpklM3M+OuZ/Lc9Jv2Yd5nnrdZyXv6GtG19cUTMfyHe5tY0Evru2JgBeiUR+bRf/4tJdRyp4X xwmBQCAQCAyAgNFYWy+hMBnxHZV0IjslfSSgSQQomdbsQpgEODAoJApkk/BIo6nENf+XfPr9Rna6 1b+tvJ3SLkTNCPzcyirDbVBwhqZS2un6Ue/vdg9Qbo34s0CxqCGYyh8yORBou+88D0VnKN9tpW0j 723nte0b5nnqdp/V84i+ZnR9TR3XYX/H0z4scnFdXwgYzTz11FPzwmTWWuAvHxIIBAKBwExHQF+I IAhUYH4DIsJVbyoKi4A13szLMGejWNEmW12Uy7wPpEwkMBaDkEBguiMwnfqasbZVWHrGimBc3xUB lh4PnJE1LxwkKCQQCAQCgZmOgHkHos9Zm8ccBfNzmtagqYSRqG9cxcztKe5Ck638XI1Y1cw1qc+9 mmzljPIEAqNEYLr1NWPBJkjPWNCLa/tCoD5trM11o69E4qRAIBAIBKYRAiw7ghLYpotwFROAYLIK 98GQQGCmITAd+5ph2zDc24ZFLq7rCwGEp5AehCdIT1+wxUmBQCAQCAQCgUAgEAgEAiNEIEjPCMGM pBZGoBAeR4L0LIxP7AkEAoFAIBAIBAKBQCAQGH8Ewr1t/DGe0Tk0LT0zGoyofCAQCGQEhA02v8Lc D5sIR9a9KVGUzAW0lofQygZLHJuo+S7KJqKaMLnKJcQ095BeoszWCnGtdWZKaOpe1zkuT/Vtm/PY xKYtPeFz5S2ilLzroh7WJYKfeTczTbph08RikHOb18b/QCAQmPwIBOmZ/G005UtYrD1h6ZnyTRkV CATGjADF0mR3pAdRsJAlhX/ddddNa621Vp5g7phFLC0UinC87GUvy+Gcu2VeCMOwE9T1U1Zvt9Am kqCcSJjQzhbctKhnt/DGCJpV4X/729/myfIbbbRRt+IucAxhEVVMOGXhr0s4aWmqvwVNLajYSeZW oaIt3iggAhyLqBMcjzjiiLzw4m677TatXIz7afNO2BSM6t+DnFu/Ln5PTwT0T6Ttue92bFRoeH7L AJG+SF9Ajyr3vd+dyjeqMky3dIL0TLcWnWT18dDaipSHtPyP70AgEJg5CHiBU85vvvnmtMEGG2Qi cemll+aFLddZZ5207777ZoLh5c4qgRwJh4xwdBOkweKECMOwYYitm/P9738/Wf39da97XXr5y1+e CZlw0tJ84xvf2JV4UIKsVYPECYk8iKy88srZ4nX88ccnOLzzne/M/aYyXXfddRmDbqTHGiWImXTq okwIpDK1KW71c6fa737bvBM2bfUd5Ny262Pf9EAAqTAAYkHhVVZZpbVPMZjg+Zo1a9ZCAwmsq66/ 9dZbswXWQIy+CXExwEPca6uttlq2zDb1ItZvzz4Sftttt+W+wWLLrMdLL710TkOf5HkXFVcf6few Az7To9X6q0WQnv5wirOGRKBJeJoP95DJxmWBQCAwBRGgwF9wwQVpzTXXTM985jNzDRAE1onzzjsv rbrqquk973lPJjle8hYzJly8CNJE2aVscOPismWV9nPOOSeHxX/FK16RXeGQJvu5mlESnEvpZzmR huP2F0EMfv7zn6df/OIXmdy88pWvzIdYmCg+3/rWt/ICiXPmzMlkhFJCgZFHUWi4llFiilsbxcdx faBFFUtZlaH8L/nrF9XXhuyxeBHlghMlTOj/kpbyS7+khRTKt+DkWsfUn2ugdOvSho3j9rfVrShT 8pSm/zCFQbmuiXU+UPvodG1bm5bLOpXHNc02L8ogpdJvSqZyNrHplOag5yojrFgEtQuc4R/vuNJ6 U/Nbm/7+97/PoeQ9Z7Nnz16I9LjHvve97+Vn7H3ve99Cx++5557cz331q19NP/vZzzIp2WKLLdLq q6+err322jS3IjOeyTe84Q1pyy23zP1GQctzy+J77LHHprPOOiu7rBoIQXIQHPev6w3MbLXVVrnP UuZNNtkkPfe5z53/TJb04ntBBIL0LIhH/BsxAl4GNhIvgxGDG8kFAlMIAYo7RZXyXpT6Unwkg4KB dFBSLXRJia/3GRQJo6usP6w6XMAQJsq2BZBZj+yzUXq5qd1yyy2ZID3nOc/J7l32sXogXYVQKYNR VXkjRmuvvXYpVv72n4Kv7KxTRnApH9Z6sf4Y2XjjjRcK1WyE9pe//GUmWaxGFJJrrrkmXyNNa2c0 RX3hRPGhyLA6wcV2+umn57oqg7TUQ50pUhShq6++OtdL2rBy3EizdFigjFgTZW/DRr7c8zrVTb2R VvVSPiPc3O7k3ZZefQ5Wp2uRl7Y2VVZkolN5vFPqbe6eUSbt4d6QrnsDxnAp2PjfKU2Eu99zheWG MfzdO4ixe849wSJn5D1k6iHgvvLcHHroobkN99prr9ymzZpcdtllmZAYgPFsb7bZZgucog/aeuut 029+85tMevQfr33ta7MF171ywAEHpIMOOihdfPHFefBizz33zITZs+SaL33pS5l07bTTTmmfffbJ fZcMPMv6oc9//vP5PvcMbr755umQQw5JyoSA6dfq/eYCBYs/KaK3xU0wrgg0SU88jOMKdyQeCExa BCijXsysF5SCulAKuI9R6CmzFHyWgSKuOfvss7OiQTnVjxx22GHpxz/+cR4JZR3hLuLbiL3rKQeU TxYkSgGFnfJNsfVdF4o8guB86dTFf6OsjnPFM8IrbwrL3GrE9bjjjstWovo1frP8XHHFFVnpUXeE ipIsb5aeNtFfmk+kjBdddFGu3+WXX57Lpfw/+clP8nEWBekgfOS0005LRx99dCYfsDrjjDMStzzk QTmQHoIMdMLGOZ3qhlD89Kc/zfizPKnHCSeckPPrlF7OsProdC2C0qlNC1HrVB6EuN7mLE7uBe2D 2LDacRWEex2bbnVEsvo9V90Q2pNOOikTUm3x2c9+Nn3jG9/I2JS6x/fUQgAh8RyZl/eSl7yklfC4 nxET95o5h7/+9a/nu6zVa6sfKpbQ+n73rkEXVmHPkT7CfUo861/84hfzfWWxYoM/BmyKSM9cQYsA u8/1gwi4sirHMcccky3h5fz4XhiBsPQsjEnsGTECXuRFgvQUJOI7EJhZCBgRZ0UwEtmm9FMC3vrW t2YFnWuH0XvKrxc9woHEPP3pT89zXoyon3vuuXnU3kgn5d7Iu8Unjb5SJPQ1rncNawLFlEWmLcAA MoAsICa2uiAYNpYQabFuKBN3FWSN4qJ8TeG+wnXlqKOOSldeeWW+Tj7qibi1ib5SPVizjPr6z2LC VWt25WaDZBmJpuQQ9WX1USZuMwSBO/PMMzN+6623Xk5PgANy0003dcWmU91YnJA8VqUXvvCFuTzq rT07YZ0zrD46Xaue3dqUUtepPEhovc25limb9kbyWF2UDXZ1bHql2e+52oWCqt0RePeOa1/60pcu ZMUsOMT35EfAfEP3pOezTjbqJUfW3bsGQ/QrLIesONq+H3GPco/TF7DguncRJP2LARqb37MqK46t KfqibbbZJvcNRZ9iOdcXKPurX/3q3M81r4v/jyIQpCfuhHFFwMvBRjyg5SEd10wj8UAgEJh0CHjJ m4vjpd2pH/DynlPNmznwwAPTd77znazIrrHGGpkIIU1Ih/7EKL8RTiOyCEJdKLsIDuXcXCGbfOvu VvXz/UawKK+UGe53dWuP0V9EqpAVI7yUavVA3nxTZNrEaC0CgjAoM+mkTDmGcKnv61//en+ze576 UoJgQxmjbJ9//vn5XEo8oTTZCDKiHsilstnKiDNcumEj/7a6wQQJo6QR+WoLI97d0nNup2u1Xbc2 VddO5ZFuXZSLBQo20lUm7and69i4plua/Z7r/nU/mPvBegljmMxqUVLr5YzfkxcBzxnS41k116YZ FETJPedcVBHs7bbbLg80sMgiPtwpPTtt4vnVL7HWcrlFbDxPG264YeLai8Sz9jjumXAf6i8Q+zZp 7ldWGxdd5TGw06mPbUtvJu1bcEhrJtU86johCBTCIzMPYTyIEwJ7ZBIITDoEvJRZLLzsKQFF9BFl s4+PvNDKRlRNAnaMUqDvYKnghkQQDooxlzTHnCddCjAFgkLKFQXZMbLKFYzSwm2uSVKkg6A4h1Ij LeLbfBWkB3kqpKsczyf987zyu/7N6kCpUWeuWpSZQlTq55XfzXQp1hRqihKFymiy+v/oRz/KaTle pFzLfYayjwyqj/1lg1knbKRTzitpln0IBGy53SGBcGVRQmS7pef6TtciH93atORd6uU/Kf/rbc7i wrXH/YEwFmIJB1u5plxf/1/2+Sb1Y37X/9ePs6KxssEEziaSu0dCpiYC7mnuj+5nzwkLTFMMKDjP M7z++utnNzXPJteyuZUVtpPocxCqgw8+OL3//e9PJ598ciY8n/jEJ9JrXvOa/By4h2zEM6/v8N2P KKvzESvPgucypB2BID3tuMTeESFQf2l4SYUEAoHAzESAuxclndJQiIuXs5FNLlC+i4sZRcAkXmSH sOpQMo3gX3jhhXlEFJHhG2/iuJe+NLl+UfpZRSgioieZp2E0nrKOSJmLQTmuC2IkGhLrCEtBCQJg 5JVVhRVBpCSkRToUI9YUG0UFKWLR8O2Y76J4cEWj+CM+MJBGU5yrbtKGg3yRLVGczONhXWKtoVSr n/OK5QiBq+cLD6PO6mCeizSUyYZ0wqwNG+XrVDfEkvsWSwrXQ3NxkEr16oR1qaPytF2LaHZr027l Ud96m8MKCYOdclH+tA0ltdTdNerXqY7N9ut2rrS49blfuQ7CQftIw76QqYeA+8W9QpCNYh0tNUGe ERfnsAzrkzxL9BoRKT1T9cGccp1vAxbcz9wb3FB9CzHvegSrnFMsRfpI91i/91K9vKVfyonGx0II hHvbQpDEjlEjUEbKdA5BfEaNbqQXCEwNBFhgRBYzMm50lPLuxW5kEgmxD+mgYFMEdtxxx2zJ4cpB ATGCjxxwJUEKuJiwCjlXupRdm9+ulTblnN/9W97yljSrcj3yn987JQGRqQu3MlGUTMw3EZ6SomzK 7XpKCusJCwWFm2JtBFc9lMFILyXFb+VEwigxjiuT/BCENlFWCru6UvYRNeTIPv+NLPuPNJqXJP1i zXCckoS4yZ/iZb6Rsp544okZU+WwIWhcd3w3sVHXTnUTXEGEKuSUxQpWMPHdCetST+Vuu5bVrFub dsNaWettrr7C+mpb7oRICBKJDMGkYONe6FRH59Zx7Haue1Xby0/QCPendmbV23777fO9Vuof31MD AfdJsQDTU9wndXE/ecZ9c+uk1xhE0F/pj/RL7sO69bVcr79BcJB/aehffvjDH2bC/La3vS33J9Jx rf7DM41A29zLvaReXn2DLaQDAlXDhQQC44ZA1UHM23vvvfmKzPu3f/u3eZWiMG55RcKBQCAwuRGo lOd5laVgXmW9mFe9mHsWtlJE5tmKVAr9vGokc15FEsqu+d+VwjLPVsR1zqsUiLIr5+l//bz5B2s/ KlIwr7IczPM9rMi/shbMqxTkeZU7y7yzzjpr2KQWuK5SzOfZekmllM+rRqVzHSoCtgAObdj0Ss9x bQbTZv79pNfp2m5t2qtM9TaXjjzKvl5t3Cvtbse91yp3unmV4prvx4q0z6ssiPOqqH75u9u1k/WY Z7MKeZzf1VWY5HzvTNayjke5PKsf/OAHW3WVysozr4peOO8LX/hCbnfPs62yJM+bPXt2vqayws6r Fjee51zifvzkJz+Zj1XWznlVZL98f7pHqgGLvL8iSfOqeTj5XNeccsop8yoX1nkV4ZpXBUGZV1mP 7F5I9IG2IvQq+hU96wMf+MCMa7uCQz/fYenpQAZj92gQqG7C+T7RYekZDaaRSiAwVRHg3sU6YKSe /zwXpzZ3r1K/pouJ0Vcj6m3STMe1RmLrYsTV1kv4x9vGIqw0XF6M7LIyGekdhRQXmF5psVDZ2qQN m7bzmvs64ddPep2u7damzfyb/+ttLh3bRAgrELdB0fvcjyxJLD+sj+b5hEw9BDzv+idtyeJnK8Jl jLuoqJE777xz2Z0tMvoxLrfcHbnOmtvFLZc7nI1UBCj/9gxwo+Um+vWvfz1HoGQ5ZcnlBmpx5Te9 6U05LL00zWlk/RZYhf5En+LGydLExc7iyaSU1/POWtzs9/JJ8ZERCNITN8K4IuAhLeKhDQkEAoGZ jYCAAV7M3L+8rLmKTUehKFnHg+IjpG0/birTEYfpWCeKKOXWfCtr87iHzd2i0Ja5VtOx3tO5Tggz l1EExLNr7o5BGb+RD0SDO63/iC59BplBlDzbXNxET0NENt1003yewR1i/qH5ZdxEnb/DDjtkksTN zXpas6pBEW5ujs2poldK9/DDD8+utgiUNLm9Idb6FOnVyXWZf8aFlhtufTBgOrfZMHUL0jMManFN 3wiEpadvqOLEQGDGIGBUc7oLi9Z+++033as5I+tHAX3Vq16VtxkJwDSttOiIiI35XeYZss6ax4bw ICzmmflvbg5iweqCgAgcIrABS46gKUgQwkP/mT17diZIiIn1ugz6IDFIDqJl8IfVkPVHqGmkeY89 9sikpnKJzcTafCGWncqNNJPrN7/5zfl/aQaEisWJpUhUuZDOCATp6YxNHBkRAsXaE+5tIwI0kgkE AoFAIBAIBAKBkSLA4mKx40MPPTRbVASmsN5XNZenNR+WoX333TdvbSeIQNlJdtlll2RrE8THtTak iKss1zWWoKbLbzWPLRMmepays/SEdEYgSE9nbOLICBCoW3okFy5uIwA1kggEAoFAIBAIBAKBkSLA 8iKiIKvJ3GouHusLKw4LzqKSbvMLq2Ad2UokFP/WW2+dyz5R89oWFR5jzTdIz1gRjOu7IlCsPE4K S09XqOJgIBAIjBABI6RCQVMaTDgn5tfYLxSsEVJBAfjMl+PN7J0jRC1FooTOLudIS/rCP5cJ7eVY v9989ykuXGWaI7jd0hj2um5pxrFHETBvgiuTCe3mbmhno+yhTM6MO0To6F133TXP4xGcgCvuZJ2P J2z+7373u0zMrG1W1jWbGS01XC2D9AyHW1zVJwJ1S09YefoELU4LBAKBMSNgpNZighaPtKgnsb7K NddckzcLfiIrJhWbhN4mlN+jjz46T1SnCImiVEQQBr72FjM1cZk//qBiToBRWlGhmusGSQu5Ic2J yb2uyxfFx8AIeF+JzHbEEUfkSe0CE7gHEF4uR4MQ04EzjwsmDQLamuuZOTwGJSarmOOj79F/NPuI yVrmRV2uID2LugVmQP7F2hOWnhnQ2FHFQGCSIICg8G9feeWVc4kQiGqtjUwktt122zwpWCSmbqOj lFxRmSgUTeWHBYAbjFC2XGAGFf2iCdLHH398dk2xWGfdmsCKJIKU8LP1Mva6btByxPn/QkCbUiS1 qbag/Jq4LhTxeuutl6Ns/evs+DWdEdD+ghNMZrGAcshgCATpGQyvOHtABLygC+lxaVh7BgQwTg8E ZhACXIusRq7PECGLW5F9rCr+czlynEsZ1zSWGsqJfYWUUFydK9oR9yT++I4hKKIn2SfE8Nvf/va8 v/jry1MkJpu0kQ1uLVZJN5FYHkb9lckxbnOOSa8ubeWrHy+/RXNiVWApEhrXJORC0KRxzjnnZCuQ iEzKK1/S7TrH1R8+MFMPWPiuS1tdEbs2HF3bb520lbylpW2KZYSbIBKnbPZrR1Lyc57froMt4uH/ IPeBPOrXlHul171TcHGessPahHHifSXaFuKrPZAg7R4SCAQCUxOBID1Ts92mTKm9tGwkLD1Tptmi oIHAIkHA/BkuY5TPDTbYIIdtNeouJCs3NQqxcLLc1CjQoichDNzYXEvBp/wKKcuyc/XVV+ews6wo QslSXpEhvvqUXERIWFppczOzsa5Ig/XGeiz6LeWRx9zKZQ7JefWrX906CszHvlk+ZSxKfh1UZaBc b7XVVunaa6/N0aKEQSbKdeqpp+Z6I1429STdrtPXwkp6rFhIxFprrbVARCfntNXVqLHFVOs4rrPO OpmI9VMn18GX6x1sZ1WRsLQDLJE7rkKwVRfYwkRbw4x7jjKRjTfeOJd70PsAeUUg5SfssHVMuDJK d+21107manSqB6zcZ8IMF4LMpY0gfYgabLhEbrjhhnn/dPsweMA6ag6Lb/9DAoHphkDc1dOtRSdZ fQrhUayw8kyyxoniBAKTDAGKKcXZoo+sKhRZyjTSwRpw+umn5xF355133nnpkEMOycqoVc3/53/+ J1100UVZseWSdNppp+X5OBRdiqtrjNIjLcjRueeeO/84RfnHP/5xVmqfVS1OaNFAbmfFekRht5aG TThbx1xTF4p+W/nUpynORU6UZ/vtt8/1tAI7SwlRRlYFyqdv1gfS6zpWKmVQXvWAHQJVl051RSSb OCpjP3VSLq6DZ1Xripib5LoTTjghE46zzz4770favAMOO+ywjHXJz/+LL744E8rjjjsuYz/MfYCw IIQWkkSuKO3KAQO/O9WDVemMM87Ii0QiOtqkiRmiJk0kerqKZwQ5RMKR1WKlm671jXrNTATC0jMz 233Cao30FOITlp4Jgz0yCgSmJAIsObOrxfxYVIy8lwADrBAIAaVWP4KMsN6wICAIlDViXYvy23ks HgTJ4YrGfaxYGijdlGIivdVXXz1/U3opgCwQ3KWIY7vttlse8f/c5z6Xfv/738+/Np9QfVjMsK18 lO6msECIIMfCoc6UfITNfuU3h4cCzgKh7upIel0nMh3CI0/zmSy2WJ8PJI1OdYVLwa7giLCdeeaZ C2HerBOSibjAybom6gRb5ecWpq1YjdQX2WTF4c5XlOstttgiY+sa5GWY+0B7b7nllumoo47KbozF yqTdWf06tQ1s1ZEF0LwdZWb5q4t7ArasWCyM09EK4r7wTAjTrP4liEYdh/gdCEx1BIL0TPUWnALl D9IzBRopihgITBIEKFysApSv888/PyuYrBZIBWWbUi0am40Cyk2Kws0agtwU4dpl6yT14+bLsFDI k4uUfJAA6ROj3jbKr8nNRTmvp40kdSpf/bzidsftSt9IkVZuJO+CCy7I7mht5e7nOkTJau/f/OY3 02c/+9lsRRK0oS7d6oo41HHst04IHIJY5h1pL0QHluZD+a2urFbwsx85Qx4QTBY9GPimfJNh7gN5 IDDuB3kR7oXd6sHtEdHhyih/W9PKoYzwN5/K93QlPQYJkFJkWT1DAoHphkC4t023Fp1k9fESshXx Ug0JBAKBQKATAogFpcvI+o9+9KNMXIzWU4q5GLGycKdCdrhzcX0jzb6m7MsH/3kcian3R+U3d6Zj jjkmEyuLE1KUSfN8/ynl3M5K0IF8YvXRq3zlPKPpFEr57Lnnnmn33XdPH/jAB/IcFNHcWDqIvlL5 nCvffq6DB4vKJz/5yUx+TjzxxOzWVfL23auudRz7rROCqJzcvxAD7YPMIQfqgbBqTyJNpJZ1q55X Plh9lDYZ5j5wzStf+cpMwLjqIY8IWLd6sPTAFwlzL5UylW/lKq6M0m8SolLu+A4EAoHJj0CQnsnf RlO6hOUFphJefkF6pnRzRuEDgQlBgBWHMkqBLiP2rAUm5ZtQ/tWvfjXP2TFKT7kWGYy1ASmifCMm JeSzb65xjrM6sMbYnGtzHNGQjuNIFcuA0X8EgfXC9SwzjtmvHFy16nlQ/NvKpw5FKNXmnHDLM2G8 CNcq/1lAHHcNiwuiUAI59HOdc81lUu4dd9wxifxW74Plp+5tdVU/GNVx7IR5vU7SVHbuZCxlxx57 bDKPB1bIDZcxeZqzxF0OMRM8glVKOtoApjb4wNRGBrkPSpm4RGoLlieBIhCfbvVAigRWgJ15XeZt lXvDN1E27YF8xzssQxIfgcCURCDc26Zks02dQtdHy+JlMXXaLUoaCCxKBCiXongZYS9WFySIIk8h plQjDm95y1vyXBAWBeRE8ANWBsSnWINMVKfIO2aknrBIIBSsRY4jViwk5p9wj6I0U9SRIe5ilF55 Ol95SpQ117IiKCfluq18s6ooZkWkN7ear8SyQPnXP+oX1YnlSDko3ywj5tcgDjb59nMd8qHcCIxy qhN3wLooT1tdERZWjDqOnTCv10na6r7ZZpvlNW1YWNZYY43cNsgGixZ8zONBesz7EV1N/bUbMoFk IpbygyecREwb5D4oZZIG7LgrIqGkWz3U2Zwilh6WMW5u3Nls3BjNiVIe9wTcQgKBQGDqIrBY1en+ y/do6tYjSj5JEfCi3n///dO3v/3t9PGPfzztt99+4R4wSdsqihUITCYEiksR5bMurDgUZMoqMjAq QUSQpfp8Dco8QW4QE/M9KOPdZJTlUx5SytEtX8fUwSsdofBbQIC2a7vVtS2PfusEJ2SzkIaSlvxY cWCrTINIv/eBMrLuILPmRnGfs1p9XbrVQ7nLfYWIKqv7iwWJ9Uqddt5555Hec/WyLerfrJyf+tSn 0pe//OW0zz775N8wDAkEphMCYemZTq05SetS59Vh7ZmkjRTFCgQmGQJNslOKh+wMqjiXa7t9U3Lr hKd+LrLTnMNTP17/PcrytRGWel7N36X8vYhZt7o20/S/3zqVQADNNOTH2jKM9HsfUNq5PhpoY/Xh QteUbvVg4bLVBQliaWM1YjEbJcmu5xO/A4FAYGIQiDk9E4PzjM0F4SmkB+EJ0jNjb4WoeCAQCAQC 44YAF8RLLrkkuzJyr+OONlaRJqLDrY2rXUggEAhMbQTC0jO122/Sl74QHgUN0jPpmysKGAgEAoHA lEQA0eE+PUpBnEZBnkZZpkgrEAgEhkcgLD3DYxdXdkGAH7aJw8KsllClfOLLgnV8vEMCgUAgEAgE AoFAIBAIBAKBiUAgSM9EoDwD8xAt6Yc//GH62te+loSVJaL3fOlLX8rfJryGBAKBQCAQCAQCgUAg EAgEAhOBQLi3TQTKMzAPE42FXT3llFNyuFcQmGSKDPGPbk4YnYEQRZUDgUAgEAgEpjkCotYJyU0E wxiPIBzTHMKoXiAwMgTC0jMyKCOhOgLWw9hkk03yyuoleIEoPNa3sGJ2SCAQCAQCgUAgMN0R4Olw 0EEH5a14PUz3Okf9AoHJikCQnsnaMtOgXFbTtk5CCZ9aFvV7xjOeMQ1qF1UIBAKBQCAQCAS6I2Ae 6xlnnJE3v0MCgUBg0SEQpGfRYT/tc2bGZ+1Zb731sjsbK4+VuEMCgUAgEAgEAoFAIBAIBAKBiUQg 5vTU0BZRLKKK1QAZwc8XvehFaaONNsoR3DbeeOO81oFVsUNGgwDXQQv/FRfC0aQaqQQCgUAgEAgE AoFAIDC9EAjS88/2tJqzlZf/8pe/pEFXwZ5et8Toa2MVbK5uwlifeeaZo89gBqdoHSSrjz/3uc/t uJr8DIYnqh4IBAKBQCAQCAQCgUBGIEjPP2+Ec889N331q1/NivnjH//4uD1GiEBZoPTkk08eYaqR FASuvfbatNVWW6WPfexjSfCIkEAgEAgEAoFAIBAIBAKBhREI0vNPTCygyf3qLW95Sx45Xxiq2BMI TD4EvvKVr+Qw4KxoQXomX/tEiQKBQCAQmMwIeHfccMMN2dPl1ltvzUUVcOH8889Pgg8JPLTUUktN 5ipE2QKBvhGIQAZ9QxUnBgKBQCAQCAQCgUAgMH0QsI7Qd77znbT77runU089NVfs+9//fnr729+e jjrqqPS3v/1t+lQ2ajLjEQjSM+NvgQAgEAgEAoFAIBAIBGYiAhZMXX/99dPTnva07N4PA9afZz7z mellL3tZetzjHjcTYYk6T1MEgvRM04aNagUCgUAgEAgEAoFAINALgQ022CDNnj07LbfccvnU5Zdf Pv9HekICgemEQJCe6dSaUZdAIBAIBAKBQCAQCAQGQOBJT3pSJjlrrbVWvuqFL3xh/s8KFBIITCcE gvRMp9aMugQCgUBHBEQRfPDBB+e7cHQ8sTpgva5ybok+6HxuH7ZhZSasBfbQQw+NCaNhsR31ddOl HqPGJdKbnggUaw+iM7uy+oSVZ3q280yvVURvm+l3QNQ/EJgBCFBgb7/99nT33XdnH3VrR9100015 Xa4VV1wxPeUpT0mrrLJKjlLkPKHAHV9mmWXSC17wgvT0pz89H7OO15133pmEtaccSGcQufHGGzOh srZStwVllZc0oyZ12j9IGZrnjiXN5rV33XVXuvjiizNhXGedddKqq67azG6k/xHTP//5z+mWW27J bQnTFVZYIXHPQTBNwrY94QlPyFE5+41w2KseiPA999yTrr/++nxPyVObuodC+kcAjrfddlve6oML /acw+c+cO3duuv/++3NB/fZ8TFZh8XnJS16SnvjEJ+aIbqK6TVdxv6nnaqutFmszTtdGbqnXYG/s lgRi19RHwMi1kN0UCGJxVsoe/15KXTflbNja/9///V9WKh/72MfmCZTyCwkExgMByu8f//jHdN55 5+Xwq8jKJZdckg455JD005/+NL361a9O73vf+9IrXvGKvMDraaedlk466aT0hz/8IYcD32abbdIH P/jB9OxnPzu5X6+66qr029/+Nk/+tShsv88H5ft73/tefs7k12k9MM+jPBCe4m4Cl077x4LZWNJs u/aiiy5K+++/f/J877fffmmXXXYZS/F6Xnvvvfem//3f/01Ct//oRz/KmGnPjTbaKOOs3X/zm9+k l770pemjH/1oJrA9E61O6FUPChPC87nPfS6deOKJ6UUvelH61Kc+lbbeeut+ko9z/okAMuBZ+/nP f97xeZjqYLlPDJQQ9+jll18+aatkEMMAwe9+97t0xRVXTNpyjqJg2uSVr3xlesc73hGDFaMAdIqk EaRnijTUeBbzuuuuSxQ9I9sE2THiI5rLs571rBzFxUjmKEXnf9BBB+W1kYpCOcr0I61AoCBgJPln P/tZtsxYi2vppZfOFohLL700K7evec1r5iurlF3HP/nJTyahXA8++OD0y1/+Mm266aaZ9DjG7YMy TVEzst+v3/tll12WzjrrrERRf/nLX54222yzUsT535QO533jG99I/OoL6em0f/6FQ/wYS5qdrtVv IBgsavqP8RYK2utf//rcjj/5yU9y28H1Qx/6UB5dp1T/+Mc/Tvq4QaRXPRZffPH04he/OHEJkm/I cAh4xlhWWRd22mmn4RKZ5FfpJ1h4yXbbbZe22GKLSV7imVG8M888Mw/OeD+EhXZmtLlaBumZOW3d saYWITvwwAOziwgFzggzy4+RXKEs3/3ud+eOeqWVVuqYxiAHjJI+8sgjWUGR18MPPzzI5XFuINA3 Au5hSim3EqN6SEsR1kVkvriQuS+5OnB1K25ZLC5/+tOfsutUuU4alLQf/OAH6Re/+EUmTL3c3FhR WRwQLW5Rv/71rzPx4YZVhIJuhPXLX/5yHoTgdmdUWMhYAxLN/croZe06iwoiU5Rx+yjtLLaOWWhQ nuppH5cO9W7Lq6QpLcqob8+nssDGd6dysoI5boFneNRJDysXFzRKrjI4TznUH4FiGSqj4crPOqdO ysy1sJdSwtqm7nX5/e9/n/8iQax08oKDdB944IF8jLXtyU9+cu7r7JcvvDvVQ/nhidRxlfO/ma+E O7WJ9Aepq3JSyuSnjvpguJUoW53ygfFUEWV1v6655ppTpcgDlZPFZNlll83XPPWpT5229RwIlElw 8pVXXpldYydBUaIIE4hAkJ4JBHuyZuVFjISIy//GN74xKwjXXHNNOvfcc/OqzJQRL1yjVEVBdD6F iO+76ylRXsgUSYSpKFkUiKJo2u/l7QXwqle9KiuXFA75FpGueRPOKwqIdClR3fIs18d3IFBHgE86 tzYK+/Oe97z6oYV+u8edVwQJosizyhSLSzlmpXLK+hlnnJHWW2+9rJiXY23fXFw8E+5lo76/+tWv 0mtf+9psFSnnIxnHHntsXiAQSfD8KQPXKS5cFg6s7+dKxerEEuUYBdnGOrvbbrvlbyTrm9/8Zn6e KFx33HFHzpfFqy0vaa699trZMsbiRKmmtHmu58yZk6+VRtu15vDAmxWXUm6w5A1veEPuD5DDE044 IWOmr5AeCw03NGV2Ddc/GCEpcDr++OPzM//+978/7bzzzplkFKy6fcNMvwQX/Q+LDKWawOOwww7L pBNZ2WGHHfKijOpkP4JnJJ77Y7MesDA6fMQRR2RlyVwvhLg5aOO8Tm2CZPVbV7i4T5yvfPpFhMei kSxMiHSnfNwDIYFAIBAIBAILIhCkZ0E8ZvQ/o6mbbLJJfulTHChdn/nMZ/KLnnvQhhtumEdvvWzN d6DwmdtgNN3cBr70FECj45QwCof5EGussUYmMEa3jY5TjhyTPsXhGc94RlaCpHv11Ven008/Pbur SJfCsv322ydKZrc8KachgUATAfcnxZSVp99J7NKgcLqOW9Tzn//8bNmpp424I0ispCw4rBGdhFJs EGH11VfPAweCJHCjo9AiNGVQgJXV/c5CgjxQ/vmbO24AoLnf+ZR4VlqDEVzylMX8FsTine98Z7YY wQBx8Gx/97vfzcpyp7zs545zwAEHZILziU98Iqf32c9+NltoWEw8i23ldK3nvlh0kDj9CMLGlRVh M88Hdp/+9Kfz86wfYE2Gn0EUZdVOb37zmzPuynvyySfnPoN1rZfAieuhleT1I2WOTbHGIHT6HPNI DKzoWxAsZdIPyft1r3vd/OAIxf1Kvixjhx56aG7Lj3/847ntPv/5z2diWC9XtzYxl6vfurLyca9E xvfdd99MRP3XT3N9REY7tb181CkkEAgEAoFA4F8ILOgP8K/98WuGI+BFazTRXAajshSJuZWLEEFM vOwpRl7MFMOvfe1r6f/9v/+XR9W5Y3Ap4o5DsaP4UDAoRBQyo6iUs69//ev5PMoR8RL/z//8zzwh 2MiwtI1SS6tXnpSdkECgjgDLIBcnlkqKbb/iOtYYI/ruWYSFe5n7uC5G7Vkv247Vz+MOhdAbfafg c+NBDAwClGfK+YgKhZayyuXHfBXXsNC07aege05YshAO7luuRbKQB8+PZ5HF5vvf/35+TllWDDp0 ygsJ8awifRR+rlisrIiXeti6XcvCU3fZM3ChjOqqHrbiPoiUIFjKq9yu1e8gZ8geQmifMtj6EWkZ TNF22q0pcDV4w0KmfvoVddIO8LYfQWrWQ/9y9tlnp3POOSeTV20IR31knUzLv1ubsPj1U1dWxJIf KxWiaa4U8q5sCGKvfJp1j/+BQCAQCMx0BMLSM9PvgC71p+hwP6PccRehDHkZC3og6hVC9LGPfSy/ hEUx4p7C/UPEJqPjRx99dLb6UC5YaSgY3DO4Cnlp14VyRAFiUaLoGaU2mmx01Qh3rzxF3qKwhQQC BQH3nXDGlExzNPoViiuS4r6jcLIasKSYHE/hL0LZdd8iMM6XT1Moyywdnh1KK6WbwmzfBRdckMkA hdb+QUWaxW2O6xNyoyxIhXJ6fj1Lfp9yyil5LguLD7eybjK7WqODqA9rF/KACJYtH+zzg1sWQuF5 L8q+usKTGxjCqI2KID3K7TiyZdMe8u5HXGtOkTpoN9c3heVZW+hTWNwMwCgbstbJBVL5zflxT2n3 ch8gSMWKJJ9ebaLORbrVVX8L93L/Kh+3OxYepEe9urV9PZ+SX3wHAoFAIDDTEVj4jTDTEYn6L4CA F3PZHDBqXkL5sgBxw3GcIuObYkB5QHq8qBEdL2/fRt3t515i5Lcu0uX2w6cfmUKcjG6beyBN1h6K QKc8XR+kp45o/Kb42dwztn7FudygbO5FrlhcNt3r7t8ilE9KNsXUfet+b4r7cm6l9PumXLMWUZjd qyykLKGU2fpcomYanf6zxhTllsUJMWDFsEnfXDkKORdTpIcrHuXds2ruXidB9likzCVxTbH2dDq/ 234ubTYiX1vdYoYkwK6bOL9+TbdzHZMHC0zdOgQf5Alh0b7qh0BceOGF2U3XvC1uZ9qzTZCdMlCD kNnapJ82UedOUuqqvAU3946NCzESS5DRXm3fKY/YHwgEAoHATEUgSM9Mbfk+6m30muLgJU3Z4/7h xW8zgm2ktL7QGn9/yhvlD7ExakpZNKqN+BiF3nbbbfP+Jukp6RrBZA3irlOkHOuWJ0UnJBCoI4Bc mOvFGuNeHkYomu599zmFti7F8kGJblOWKbDuffl7Hso9am6KAYCzqvDVSAWLj+eiPrhQz8dvx5rC Zc8z6ZmhALNKIWnyVV/lY0V673vfmy1dAgl4HrnDIVptabqWdZXrKrfTj3zkI3kwgstYXdqurR8v v1nYtIHzPb9lQ0Ds00Z197By3Si+69HAzLNBXBBCeXKdY+2BPXI3q1pYVOjyToJEGoSBNWw73U+9 2qRf3GBicz6LDuKsLQuOMO3W9v3m06m+sT8QCAQCgemIQJCe6diqI6iTl7q5N5QCv40aIzRGjpEa 35SEt771rfNHPe0zGdhIMaWGskjRsk4GpYybXCFPzSJSGm2UIqOczmcxKiPY/eTZTDP+z2wEKLdc vdyX7qOmIAXuU4p+Efed/+V+oyj7zyXKfV0XLmWIEGW4LZAGCwarqDKIPlZEHgYTWBnMYxOByzwW zwel2qZsXEnlr/yd9hv5N0iARLEaGWhwrYEKz5P9FPYPf/jD2S3K+j+wkG5bmvDguooICEwib2WV pk19lavtWufCyjNcvg1eUNbVjeWitAMMlMtACfyIa0i5vqRRvvPBlo9yvBCqcr3AEX6zFHO7RRIE hyAwY+3RrzlHqO4S4c3xkmb5di85V1kN3pgHhChpY3gUfJzXrU1KHtIlpawln/INL+kgUQg3Szes 3JfyKsc7tb18Stj1nFF8BAKBQCAQCMQ6PXEP/AsBihA3NC9uL3aExWRaCh8FiPsHZYXyZ3SbEuMl bL8XsespWka0kR+j2yZQn1WNaJN11103k578p/FBOZKu67kBecl76VMKKZQmQPfKs5Fk/A0E8j3l /qm7FLG8cEkTrIDbkHudYu++FwDAfhYe/42wu+9MIC8Ka4FVmtKm/BYrTjlGGTY/zb3Mdcp/5xqB 96xQwM2X4+JmQroJ9EJYlxDu5ucgTK73LHXazwWPxUJQgMMPPzzXRzlZOVg1WJrUcY899sjlNOhg k57yU+TreSkXRVx9WHyOPPLIrNR7zpE8Ln6uaysPBZx1CLHRN/gNa4QOwYO54AoEHptvvnm2TCFL XFf1H7BxHlKh3AZcWHrLb21RF8fNGyrETH6CriAK0pUPi7T5gm9729sy/uV6Fje4I3r1yHD6uGY9 lE1/5jz3CFKonjCSp2uU0Xe3NtGW/dRVG3DtRdIMGgnfDQdEDrF1P3bLB9EMCQQCgUAgEFgQgbD0 LIjHjPxn1JaPOsIjNC1lwcubgkH5oyxQUOzncuFlzC2Hssb1Aimi5FBUrA8iXKr0KAmOUdzq/4FM +atvFEKRpYx6S5vCxzWG0mLytZc8q1O3PGdk40WluyLgHkSYiwKOVFNWKcW+ReDyzf3Jvcr9i4KJ gNuQcRZN8z/q4vkwCd/oO9LRFOTAfS9f8y/KfCBkQkQ1zwsXK0qwZwPx8F95d91110w8KP8UafNT DCx02v+e97wnP5cImgX3ZlUkTJlYA6QvbUFFEARubVzpzEfqlNfsKggA4oDkULrVETmStucUhm3X wguWcFQGZIKVRRj7vffeOx133HGZMHjuXb/TTjtl0kGZl5frPfPSL6QFcWPxZWFyXpP0uE4wAtYW 5SbwRQD1a/okbaAO+rK6+A8PBAOZKAL3tnooy5577pnLoHzasqSh3AgbQoNIdWoTde+3rtpwr732 ym2rb0aQldM9y+LULZ/xchksGMV3IBAIBAJTEYHFKnP6v3w7pmINRlRmkX4oDSL/eGHPJOGv/+1v fzv77qu3F6ZRWy90ZMfoJsWsCOXJNcccc0xWhCgcjjvfwnkWHiUIkXSt58NNY/fdd8/rYjjGivSt b30rj0bPmTMnKzwUSaOy0qV0IVmUI2lSnPrJU9ozSYQAp2hRjii5IQsioHtjbeTmZU0WCnk3cT6l lJJNwUcO2sQIP8Wa1cT9ScEepSAMpJlup/3Kq9wsMspN1MV+4tlyrXuk/iw71pZmc1/zv+tIp/2P Hl3wUz+BUBBKe7NuC549Mf9YcAirXr+CfCGthejA2W+Epi5tbVI/3u9v/S3rGsKnH23KqPJppjsR /1nouFyyTiKU01FOPPHEtP/+++eqWadqxx13nI7VnHJ1slYXTxILFOvHQ2YGAqN9U88MzKZdLVlY bP2Kl68RYOSGokUJQJT46NfdfIwOW9zwP/7jP7JCUFe2dPzbbbdd3l+uoWCKNGVxQBYeIs1yXT95 9luHOG9mIEARdZ9SUrl6mV9DQe0kznfP2TqJe9PLknuR8M/jobx3SrPTfmTHVhd1KaStfNePl99t aTb3Nf93u7Yca357jrnFTSYZhOyUcrt/ut1D5by2NinHBvnW33bDbVT5DFKmODcQCAQCgamIQJCe qdhqk6TMLDFGHttGH0sRncNdpSkUsk6KFOXI3II26SfPtuti38xFwP1pHSfzSVh8kJWmm1S/6BhV 5+aFqHPz7KaM9ptmnBcIBAKBQCAQCAQC449AkJ7xxzhyCAQCgUWMQImoxZ2GdZL75jDCymOejwV2 u1mDhkk7rgkEAoFAIBAIBAKB8UMgSM/4YRspBwKBwCRCgCvTMO5M9Sqw7IR1p45I/A4EAoFAIBAI BKYGAotPjWJGKQOBQCAQCAQCgUAgEAgEAoFAIBAYDoEgPcPhFlcFAoFAIBAIBAKBQCAQCAQCgcAU QSBIzxRpqChmIBAIBAKBQCAQCAQCgUAgEAgMh0DM6RkOt7gqEAgEAoH5CFir5e9//3teJFNUQtHh RCi0YCUpYdnnXxA/Ro6ARUaJCI9N6Xasee4w/3u1v3uBtJVtmPzimkAgEAgEAoHBEQjSMzhmcUUg EAgEAhkBi3PecccdaW61sPFtt92WF+sUbt0CoUK1Wx/IgqDPec5zFlq8MiAcDQKI5Z133pmj8ln0 tG2R3htvvDEhPrNmzVqoHSz+adHUW265JaeBoAh4sfzyy+drtKFNu7remmRF+m1/Ef/kIeKf30GC C4LxHQgEAoHAxCEQpGfisI6cAoFAYBohQFm+6qqr0rHHHpvOOuusrAyvs846Wemm4N5///2ZDFls 933ve99CyvY0gmKRVQXpsPbSueeem61rs2fPXoj0ICzf+973kvbSDk1SZHFlC9d+5StfST/60Y/y YsivfvWr84LNrvnjH/+YfvOb36SXvvSl6aMf/Wh6wQtekOs7SPtvtdVW6Re/+EUmxZtsskl67nOf 23GdskUGZmQcCAQCgcA0RyBIzzRv4KheIBAIjB4BhIYi/KUvfSkr3DvttFPaZ599skVHbpTxc845 J33+859Pd9990rcjaQAAQABJREFU9+gLECkmLmV/+MMf0qGHHpotKHvttVd6ylOeshAyl112WSal yM3LX/7ytNlmmy1wDgvO61//+nTRRReln/zkJ9lC55wPfehDmbhq6x//+Mfpuuuum3/doO3PQrT5 5punQw45JCkP8vW85z0viPB8RONHIBAIBALjj0CQnvHHOHIIBAKBaYbA5Zdfnr74xS+mH/zgB1mZ 3XXXXecTHlU1r2ejjTZKu+yyS/5d5nSwOnCj+utf/5pdnFZcccW8UCpXqoceeihZPJWrFuGqxSXr 1ltvzdaHpz/96XmfBVLte+CBB/J5LBfWDjKnyH7XrLrqqpkIUM7to/CbTyLNJz3pSfm//awVyrbS SivlNKTJTY9IkzuWa2+//fb8jcwp82qrrZa/+y1zTrD6KOkjgiVfC8Uut9xy+ZRO5W1zB7PI7NFH H51++9vfZoLSRnjUDzm99NJLE9x+/etfZ+ID76YoT3PODSsSQYKe/exnZ5c3/4dp/2c84xnpJS95 STrwwANzO3zgAx/IbpDSCwkEAoFAIBAYfwSC9Iw/xpFDIBAITCMEzCE577zz8ua3UXxbU5Zaaqm0 zTbbZIsEhfq+++7LLk4nnHBCJjjmjQh4wMqAICEE3Ku4YlHQKdrIyPHHH58DIrz//e9PO++8c3aZ O+yww7ICT0nfYYcd0u67757nFtmPmPi/+uqrp1/+8pfp1FNPzWlL/1nPelbabbfd0l133ZW++c1v ZkKAoEnj7W9/eyY80mBFecc73pEtJz/72c+ydQIhueKKK3KZ58yZk1772tdmotVPmc2Dkf+vfvWr XEfzoJAWhEe+G2ywQSZgncqr3E3hksaahuCZM9Um119/fcYSjub1yF+5uap1E/WHkfIgfi9+8Ysz WXTNsO3v2rXWWis99alPzeXmQrfxxhvbHRIIBAKBQCAwAQgsHOZmAjKNLAKBQGByIkDZe/Chh9Pd f60sBH++N11/613pD3+6I115/f+ly/94a7r0ulvydtl1t6Yr5t6Wrr7h9nTdzXemm26/J915z33p vvv/XimFj0bRmpw1HHupKOtcnSjuLBAUdxaUNrGf+xRcKekHHXRQngf01re+Nb35zW/OFoiDDz44 f1PMWXNYVlgvWCXse/7zn5+Pn3zyyenqq69Oa6+9dp5XwmLE4iBt5z3taU9LrAkvfOEL8zmsG6wK c6sgC+9617vSK17xinTSSSelE088MbtWUeRvvvnmTGhYh6SBKHG7koa5K2eeeWY64IADMpH6xCc+ kZV0JOiII47IrmX9lhk2yqqu11xzTdpjjz1y+iw1rGUsYN3KizDVpeB58cUX58AAggM0BfmTlzpt t9122UrDhQ3xYRXrJLAwj+eoo45K6orsEQTTNkz7l7yU0+ZeUBb1CAkEAoFAIBCYGATC0jMxOEcu gcCkRQDJufe+B9M99z2Q7v3bA+nOv1QuWH/+a0V67ku33f239Oe/PlCRmYfS3x96JD1cKYT0tCWq 4ZKlllwiLbf0Uumxyy+dnvi45dKqj39MWnXlx6QnP36FtNIKy6UVl18mPW6FZdPyyyxdKYuLTdr6 D1owrmk2wprDiuG7m1CyTWRHZLbccss82s/Kw0rB8mOuybrrrpuWXXbZ7OrFMmTCO2uLvJAVrm82 RGvDDTdML3vZyzKBQYSQF8o4goWwUNzlxyK14447ZoVf2ogAQnXTTTflPKUjfxacP/3pT1kJ5/7G lYuCzw0N4VAGebMKiUonPxvi1E+ZucGdffbZ2cJh/hPLDGvLK1/5ylxfRK9beVls1lhjjfkQc1tT HuXjGtfmrqZ8zmMlUuY111wzEw1twNqD3LUJjARGgBMy1pRh2r+koZzuF4EuuBe6L9wHIYFAIBAI BALjj0CQnvHHOHIIBCYdAg9X1pi/VCTnjso6w0pz5Q13pMuuvyPdePu9FbFZLC25zLLpH4stXbGb irAs8di02DJLpsWWXSLPw8BfjFD/fd4/0gOVe9ef//pw+uM9f0+Lza2IwCMPpn88/Pe00mOWSWs8 feX0wllPTM9adaX0pMevmFZ+7PJpuWW6k4NJB1RLgSjQNkKpprBT6su+lkvmh7V2biEJyAuyxJKA hFCEiyA90nMc0bBRxrlWEQQAaTjttNOyIm/einQp1ZR5ZKC4diFDJs+zDJn3wq1OnixIiFNJg5LP lUtehRDMrqKhEWkjRSwnylC2fPCfH93KzFXMteooLdsWW2yRCRrSIs9e5a3nxf1PHUnBqH4c6WNN cQ6cYI302HfBBRdk8ol42d8UuL/lLW9J6s7ao2x1cby0db/tX66vl1UdbEhmSCAQCAQCgcD4I7Bg bz7++UUOgUAgsAgReOjhiqTc+7d04213p4uvvTX96oqb0m33PFhpjtVE8qVXSEuu/IS01BL9E5O2 U+dVCudfH3ogXXjDfen8P1yVll/yH+mFz3pi2nDNp6TnPe0J6ckrr5iWW3bpNFVtP4iBifyUdeSB Qm8z8b+TsBgUqwFF21Z3baKcU4C7ifPLNawD66+/fiYNF154YTrjjDOy5YZ7HIWcdaa4ZZlLhKSw 6tiU/5nPfGY+DyFgrWH9YN3wnxJeLCdc5uRj3s75558/39rTrZz1Y6XMylDqL1CDTdjmMlcHoepV 3nq6SCYSSJAtVqm6SH9u5dbnGyFUDmRP3bkmcnFDurRjm2gf84xYk4qogzxZagZt/5JGvaysPN3c 7Mo18R0IBAKBQCAwGgSC9IwGx0glEJjUCPyjUvruqdzUrr3pjvSLS69PF1x9a/rL3yvle/mV0lKr PCYttvjCI97DVmixSgFdcpkqOpZtxSdUVpAH04XX35N+84dL0uqrrZg2W3dWetFzVstucEsvNfW6 IFYKrmjmvJiXQbm2tZEeVhYi4pkFSym9rBBlo0TbRyGnTA8iL3rRizJJYblASmbNmpVe85rX5CTM teHqxkqBTCAym266aVb+WSfkSUoaSI9wzeYgUfYJovC73/0uz+kRve0jH/lIuvbaazM5yicM8KFu Nvmy6MCrLNgKC9j0U96SJfLiGgLDQoD8V24WHYRCGxVrjshporGdddZZmcDBbdttt52PhWubwjpU xJwjrm2I46DtXy8rwkbsc1+EBAKBQCAQCEwMAlNP45gYXCKXQGDaIGAuzs133JN+8bu56cxLbki3 3Ve5rz3myWnZFRcO2zv6Si+Wllhq2bz945FV0h/uuidd95PL0zrPujlttcHqaa1ZT04rLLfM6LMd 5xQFBXjTm96UQzmztJjwziUM2aDYU7yFfmZlQDgsWkrJF16axYPVgCAkFHhzaEowBNcSZMBvW/nt u4gACqwwrDb2mx9UXKWQKFYU51D0WTaUj8WHVcl5zpcn645zub8hdLMq8kQo5z/96U8zoRJpjDWF 5aO4trEmFQW+V5nVWx7wEXwAwVJn+UmvHO9V3lyw6gOBQpJcj8TZirCYWb+HK59od0Vgrfzayxwm kdnMm5J3wRiOZbNPEAT/zb8R1EGeouoN2v7cCEkpK0sd7LVTSCAQCAQCgcDEIBCkZxxw9nI1MloU m3HIIpIcJwS4LFG8Bh11H6fijDnZB/7+cLrq+tvSSedelS6aW62Nstwqadkq0EClmY857UETWHyJ JdPiK6ySHnloxcryc2e6/S+Xpte99L70ihc8I63yuMGsHIPmPerzKaxzqrDNFPbDDz88nX766Vl5 pty6hxCCSy65JBMcblxczijYFG7zWkQyIxR0i1aywiAV3ORYE6TrPJPxuWhRls0HKr/L5HfWC3my dPhdF1HeEBplU0bXIjusFwhYkfXWWy+fJ2IZVzfzTghCQ+FnKWHxOfLII/M+RIMF64Ybbsj9XD9l lo7wzAiDhT6F4VafEi1OQIN+y6tssFIHRAqGiBwS5zcCimwKDuE/iwoiClOkhUWOi5vACbCbXc3d 0V6F0LEQwQI5k480zHv6+c9/nt72trfltAZtf2UmcLMhqkhfsUI9ejQ+A4FAIBAIBMYTgSA944Au heaHP/xhnrxcFIhxyCaSHDEClCJkR3St6bB+hmAFl113czrmzMvTFbc9lJZa8SmVxeXRCfgjhm6g 5JRh8cetmm647+50xOmXpzvuvi9tt9Hzc6CDgRJaxCcjx0IvIzVcplgvWFQQC4QBCRGWulhfkIu9 9947HXfccTkyGEWc+5VoZpRvJIBCbB4NtydEqSjeXKrMs6GcO6+QHnmbm4JUIBB1keZ73vOefE9z J7vyyivTrMqKgwjVST3lW9msH6M8RZyDECAAylUW6KSwSwuZQLb6LbN899prr5y3iHOIhzKzgiER /Za3lE96iI3yCQSBzCFiCI9BJ/OE/BewAblgeWNl49IntLe+WYAHFiHhx7WZ+hLnIorcAxFP6cEJ 3kUGbX/XSQu5YilipQsJBAKBQCAQmDgEFqtM+LFQQIW3KD0UA1F7KAZjEYv7IT6UhHBfGAuSE3ut 0fRTTjkluwFRTqeCfOUrX8nWAcokN50iCI/5O0f87OJ0wfV/S8s/ftUqClv/AQqks8xSi6dllly8 WrfnH+nBh//lVlXyGMX3Q/fdlR7zj3vSdi9/Ttr65WtWYa6XHUWyiyQNll3KM0JS5qe0FYRyXSK1 Ufab0cHarum2j2WIdOprECXEhIWmzC1B8JUVWeJyxpLBqmGhVGSsLmW+TCln83/93H5+e85YZuAk 76a0lbd5jv/Kfuyxx6ZDDz00bb/99plQqeOikl7tz4L0jW98I4cZF4p8l112yZgvqvJOhnwRQJgY GNhzzz0nQ5FGXgbrYu2///453f322y+HkB95JpHgwAhYBoCbq4WZDYyEzAwEwtIzDu1MebAAHVcR o6chUwMBbjomN08Hl5Nb7vxLOuGcy9NFN94/MOFZoopJ/fjll0prPmWF9MTHLp0u+9O96Q+3PjoH ZdQtudRjqjku9y+Wzrr0pvTklR6TNlnnOWnJJRaMxDXqPMcrPZaRugWlUz4sDG1BDzqd32t/J7JT rkMEmmQA4fnud7+bXem41rnn9VVNwiONQnZKes3/ZX+/38hOt/q3lbct7ULSKM5zqwErA02sOIvK ut6t/RHFq666Kgdx2HrrrTO5VP6QQCAQCAQCgYlDIEjPxGEdOQUCE4IAK8+FV96YfnfDvWmpx6w8 kIVn6cqy88xVlk0bPvfx6aXPely1AGm1An21MOl4kR6ALLHsY9NNf3mgiih3c1rjGU9KT33i4yYE p5mcCYKPJFDEuctZrLO++OdUwUYQiF133TXP4zFqyzWwG6FaVPVi2TMvCikTYa9ulV1UZYp8A4FA IBCYaQgE6ZlpLR71nfYI3H73X9M1N1cT4h9eMi1dzQMZRFZ+zFJp/eeslFZYdsl09S33padXBKhN llpisbT80tXimhUpeuQf89LfHnxkaBe4xRZbPC2+7IrpqpvvTZfPvTVITxvgI94nAIDoc9bmMY+H VbppDRpxluOWnLk1XMXM4Smud+OW2ZAJc2lkUTN/aDpYkoeEIS4LBAKBQGCRIhCkZ5HCH5kHAqNH 4Ppb70o3/PmBtJgFRweU+//+SDr7yj9X1p2H03qzHptWW2nhcNKPXW7J9JwnLZ+e+YTl0grLLJke rkjPDXfen6646d50998eXTBywGyrAAvLpdvvuSvddPs9leL6SOVSNbp1gwYty0w4n4sZi0NZ12eq 15mrmOAEk1XCzXmytkyUKxAIBGYSAkF6FkFrm4Ar2hBf9DYf+kVQpMiyQoCbj/U4TEi26GSbmABu ZJkbzVjnNrSlP4p9t1fR0O6896G0+JKDrwFyT0V2bN3k2U9cPm2y5srVKpAp3fW3h9IzHr9sdoVD hk677I5Mgrpd33YsL2i65NLpvgeqaGB/e6CK5Da1Qli31Sn2BQKBQCAQCAQCgcDkQSBIzyJoC8r1 Mccck84444ysQC+CIkSWLQggowiPUeP/+q//ajnj0VC21hR597vfPSnnDij0wxUxY32pGHVrHca6 88Y/35+O/lW1fsxfH8qubU+tSM/OG6yWZj1xubRiRXzuuu/RFecHzccAgHKbkxQSCAQCgUAgEAgE AoHAKBEI0jNKNPtMyyRiC5i+7nWvS9tuu22fV8VpkwGBs88+O6/9wSI0GSdMw2i5ZZZKy1Xhph+s yE8ahyf8zxWpMZ/nyY9bJi1b5bNiNf9n8Sri27JLLZH/D9tOj/zjkSSQwrJLDxZau1d+QiSXBT/N W7HeTbHSIbrWbnEO0uXYeM9tEbpYnqyGTRF5rF6+5vHyHzk3eCJimDV96iLks3Vl1INVcqoKfMzR MQemtFc/dRn2un7S7vecUbVBt3butyxxXiAQCAQCgcCjCIyDShTQ9oOAF7m1PEwoDpk6CIh4xTVx MsuTHl+Fml5xqWr9ngerYg4+r6dX3VZZYem07jMfm+f1PKaa04P4PG3lZdPvq7DWw9qW5j3ycFrs Hw+nxy63dHpMtY1KKI3CGZvkXtalWXfdddNaa62VlWkTzG+88cZ0ySWX5HVjLJDZz/yLQliGmZSO rIjkJXKacNP/n737jrusKu8FvqYzQ+8gAgMoYqGIoljAQZoCVlD0AopBDVFiTHJb7v3E5I+0m3tD EktsoYhiJYiFIqAhqChYgKAigjAC0usAM0y/+7twDZvDOec957ynve88C/ac8+6z9yq/vddaz+95 nvWsQp4RL2tt7BnBfbJd0qarr746ByHQnpJsu6Y9n/3sZ9Nuu+2W3vGOd0xZF1obhP7mN7/Ji/9t iNqYWj2Die5rzKfZ363ybnZt47l+PoNWz7mxzPg7EAgEAoFAYGIEYqOAiTGKKwKBKYXAjttsVrma LUgzVz+e1laWjH4mFp2X7LpZevXztszubV/9yV3piz+8owpi8MQGmb2WtXrF0rT9pnPTTttunmb1 af8SFhXEAFEtQrONLG3oSpgknCIZrCGFFNkkcaKEtNxxxx15w8+Jrm32uz28WDDOOeecdM0116Qd d9wxkxzhl+XbCam2qeeuu+6a9wOrl8FyhcjdeOON6ZZbbqn/NKW+ezY//vGP88ajV155Zd6ItN6A Vs9govvqebT63irvVtc3nu/nM2j1nBvLjL8DgUAgEAgEJkYgLD0TYxRXBAJTCoGtNt0oPWfHrdJP bn4wPbD8sTR7gyqgQYfre1w2p9oc1P6gXM1sVDq3+mP+3Jlp5eq1aXb1tw1Ll1ZR3q677ZF0WxW1 bfvNNqg2FO3VxpPSmlUr06xVj6a9d94yPW/hxKSj04dx8803581m99hjj+RABlhFvv/976ftttsu nXzyyXkneBbX3XffPWdb39gSaSIAE2K5kHEX45b63e9+N1sgXv7yl2dXNMTJeS50c+fOzddaF8Zy Iw+/O18SNzplOhAuVidJ/ZAzdeAeJU9C/Pz583MezsnT38jZJpts8pSNOP2mDtzj5F1PzernHPLF dcx3ViuWp2K9Up78/K39xcWsWV71stQZZq0SbCYK4LJkyZJssfrJT36Sn9UhhxyyjuApv9kzUF67 +/yuXtoEK88ElvVn0yrvZu+C/BpTt8+gl+fc63NprGv8HQgEAoHA+oZAkJ717YlHe6c9AojLi/fY Md16z0PpW9fenVasnJNmzW2+304jGBtWa3V223bDar3O3PSc7TZMmy6YnXavPldXguwt9y5Li+9d WkWGW5Gev8NG6cW7bpq22GhOEs1tl+r49T2PNWY34d9rK5e25Y/cm3bbPKX9qjpvtVn3EeeaFcI9 iWBs/VwhFa4ThAIJufzyyzNxsLEl8tAohD/88MNZ6GYBeuihh7ILmo0lCczf+MY3skWGW5qD0Myq cuedd2ahmluZwzkWF4SrkKp6XZWpngRl5OPWW2/NdUN8WHt+8IMf5PJe+tKXpmc961k5L5agZz/7 2Zmk3HDDDTnvF7zgBUl9lWWtmbxEhtxyyy1zcTbGbKwf0scK5jd7x3Ajkw444IAc+vn+++9PSCNX MfVbuHBhdrtDChrz0tb6Oih1saYIiWtMxbIG83bJRqOI25FHHpl+/etfZ/fDgw46KN+ibY3PQHuk dvchY/CTnzoic94NFrOSmuWNGHEZbHwXCr7l3m6fAdzg3M1znsxzKfWMz8EgwJXWO0DpwGrbOKYM ptTINRAIBLpBINzbukErrg0EpggCW2yyIB30wt3SfrtW1oAVD6TVKx+vQkxXEd0mSDYlRWheufsW lUVnXnZh23Ljuflv5MZE/pPFD6efLl6SSdHhe26dI65dceOD6Tf3Letqg9K1VeCCVUsfSpvPfjwd 8sKF6YW77zBB7Tr/GVH52c9+lgXvsmbG3SwWb3nLWxIiQXD+9re/na0q9ZwJ6wJWXHbZZdnKoM2n n356uvDCC3PgANYZbkc+Cc7yQLAIOqxIH/3oRzNhIKAiJj6bJUI4cuAaIdLlzxVPkhfScdFFF+Vr WH/kg3RJl156afrCF76QCYj6igT5zW9+MxMdwQ0I7xILRbP6/fCHP0xf/vKXc7u42C2u3P2+8pWv pEsuuSSTnG9961u5/QgYovBv//ZvuaxmealnPVk7JU9lNB7XXXddJlr16xu/I1nK1I43vvGN2Zr1 ox/9aN1zQpjqz4CQKU10n+AR6o+8WEsJz4JTqUNj3nBv9S4glyX18gzg1s1z1r7JPJdS1/gcDAKU DmeccUb63Oc+l9fsGYP08UiBQCAwPgiEpWd8nsVTakJrbHJu5ybylBvij6Eg8Ktf/Spr4Qlv3Ewa E0GIIEMzzlVo0MmkSluvXs2053tsNSstvuX+dMt9S9LszXZIs+dVxGVm640/73p4efp8FY66Xbrz oeXpS1fekaO1Kf/xlWsqMvTEHR3N8dVFa1evTGuXP5K222BFOuaVe6aDX/zsykWufzoYgjdcWFho 6utp++23T8cff3wWeL/0pS9li4/nVty3WEuQGGtt9tlnn2wJ+d73vpc18tysaPhpdAU84P7GuoAY ycM9rAIEalaTV77ylfWin/IddvLRz1lQ/F0sJt6dRYsWZTJCmNp3333zvcpk9RHsgMVCYo3593// 99yOF73oRTnP5z//+fk3FqNm9fOuyEObDz300EwGEQ1tZ3FCWliU9txzz/we+w2ezfJqJHVIpoAQ zSw9rGLWNLVLN910U7bQsUDBQX9CCp1n1dp8882f8gzKez/RfTTxsFZf1p0Xv/jFOa96XRrzRpTa vQvFwtTLM1APz6DT5zzZ51Jv5yC/I9r6n3d7ouSdQvzNc9dff/1El4/175QXSCmC7t069thj8xgA B307LD9j/fiicusJAkF6xvRBn3feeYlA1uibP6bVXW+qRbDlkkTzXdY+1Btvsif4vu9970sve9nL 6j8N5Lv60PoTCuvrUeqFrZgxPz02b9s0Z7vnpk2esXuat+FmaeacudUk3DvJqObwtKxa11OSvztJ orSxOm2w5tG08xYz0xEveW56+Z4LK8LTmoh1km/jNQQvghRMmgkb3JpOPPHEdOqpp6azzjorC/jP ec5zcja0/+U5ElZYFXbaaadkfQmhuZ4IbYRX5MB6IYdyC3mpX9v43doWZR5xxBH5J4oO5Xm/1Blx IVSz/ljM7/oS7dG7V94/hIRgheBpr6MQOHVrVT/ubUiI6xFDn96nElKfK5qkTO+0wAKt8soX/u4f ROuqq67KhLB+3neEByFqpRDQdsIjdztYIBPqhvjJ03Mr7a7n3cl9yKqyTzvttPRXf/VX2Yo00ZYB E70LhfT0+gy0odPnPNnnUsdrkN+9I6wdxqWJkn7qffEeIpdTOemDFBGUYZQk+gvyo+8YD8zlrd77 qdzuqHsgMJUQCNIzpk+LafzAAw9MH/zgB5sKbWNa7fW+WiY9bko05sNIBEOaUgIzobhVYuHZYsm9 ac6qR9LqLRemeZttn2ZV52bOnhz5aVXeU85XdeTKtmbV8jRr9bK0VeXOts9uW6TXvHSP9Oxnbl29 30+5ui9/EK4JGCwoBGKCMqzKoRCkVEhnEd2sUynrbmj7kQ7CGOsANyuCNwGX1cFv8pEvYqCvsrRx P/I7woQ8EOR8IiCFhNQbJ496YoEqzxLRUi6h6Wtf+1q64IIL0hve8IbkmpLK/SwdiBZCxv2ttNGn ereqX7mu5OfTOZaaQiIEBtBGbSKgtsqruJjJowSO8L3b5D1WNiJYlAYI0F//9V9nIfLwww/PFrb6 M9D2Tu6DE8vdhz70oezKd+6552aMreuqp3re5Xm3ehfKfb0+A7h1+pwn+1xKXQf96T1h7RSWfaLk 2emjxi5kaSonls3ifqod/haWXmIhFviEZS9SIBAIjA6BID2jw75tySZe2iGTbjPNZtub48eRIUCI aUc++l0x7waXJsIcAbddImKvmLFBenT26vTI2ofSwyuWVa5p1XqI2fMql7fZacas6piE9ecpZVfC 85qK6FRMJ61dtSLNXrs8bTFnedq1Coqw6IV7pRc+e4e0YIMnI5o95d4+/EGriiDQuiIu+hLBnYuQ 8/bBYdk47LDDMtGwlqUkVh2YsoRwVfE3NyfCvPs8Y3myPtDSsz4gJZ/4xCfyfQgOFzSubwR2C9ZL yGxlEAoJeAiFOlnbob8jTcpTd/WSWI64riEbiJCESMnbOZ/qJMiC9TMIN82y3yTET72dr9ePm5zy XUdD7Z0lsHmfjDmEM5p61uYSUY67Wau2dhLqO1eozT/Kv/jii3Od9t9//3VXylsbzz///Pz70Ucf /ZRn4L3v5L699947W5E8/ze/+c25zUheY6o/X5ahdu9CuZc1rNtn4B0puHXynJGeUTyX0sZOPxFA LpN1gt7qXs+cRQTx22+//VpdNiXOI3rW1lF8UZx4vgcffHBeQ2icaKb4mBINi0oGAtMIgSA90+hh RlPWPwQIqQRE7nQm2k7SalaBKrLb969bnK67+a5036PL0pJVs9PjK+akNKtyB7PmZ4ZDaOHfhReu hPLm6QnrSWUieGJPoLUV0Vm7Jq/ZmbV2ZdpkdnXMX5MWbrtJesVez00v2GX7vm4+2rxOKVsnrP/g KsUKgEiwvtHY+5tVh3BPYCYAs+KUaFyEE5YG5ERkLaTE+haWB9fLl2XH4bv7kQ8L3gk+xx13XFpY renyN5cd5KpOelyL7CiPlhu58Byd8zcB2t8SwdHaIHVBniTXIEiIHG0yywghk6WH9ULbWJkchEok wWe9fgI6IDoEfC56yCFhVftYmwhrCKJgB1zwtMlnq7bmik3yH89ncRVQgfYfyURIkEF4sdwhfYim Z1h/BnDo5D7ECdksRJSigFtiY6rn7Xu7d6HcyxrW7TPwjpTUyXP2zEfxXEodO/00DnEbnMh1UH7c Bz/96U9n8vee97ynbRH6AGUDHCTvhr6FMBVXzLYZDPhH5E0/866OiuxQiKgDjNphYwxxnb6mz1OO DFNZN+BHEdkHAi0RmFFNLE9XdbW8fPr+cPbZZ+eJswgsk2npmWeemSfmE088senu7iZo5Zn0lNcs /d3f/V0ekP7H//gf6wSgZtfFufFCwELvr371q1kj+6Y3vWnglbPRJl//bkhPvVKPLl2efnXbvenq m+5IN//2/vTIspVp2epZ6bFV1T4zq6uQymlWWpMqt7lG8oPkVBnZ/HRGdYWr5sxYkxbMXpM2nLM6 VUHg0nabb5T23G37tHd1bLvFE0J2vexBf0ciaF6Rm1e/+tVZCGhVJmFBqmtjCQQEA8JAoy8+oiEV cuJ+xMH9hHCpEBLCR7ku/9DlP4Q9CYlplwg6pQ4EQvUudWlWv3Z5+U395VkIVLm+l7zKvf38bHwG E+XteZruECrfPdNWz6Ux73bvQr3cyTyDTp/zuD+XOh4Tfe+G9HAVoyBAeiXvt76N5LOyIbUT9ZGJ 6jOZ37nIihjJMjwqyw4rkwiFZAwRJgVSYamsk0LE8YorrsiWYeSHBdT4WCzJk8FgKt1rnjZfm6fD 7XAqPbnJ1TUsPZPDL+4OBKY0AhstmJf2fc4z87GyEuTve+ix9Ju7Hki33v1QuqOK+PbAI8vS0mpi XLW62myyEqTzUbEdlKfSmOQ/582dkzbdaH7atiI5O26zadp5283TM7beNG00/4mF8KMCiHWHdYIF gXDFmtNKyK2TnVJfQhXrR7PUmI/7G4kRsuOYbOpUkCPY1IWbernN6lf/vdn3VvXvJa9m+U/2XOMz mCg/z1Ni5ZooNebd7l2o5zWZZ9Dpcx7351LHo5/fBfMQeER/ZiWFNSslQnrMMcekP/7jP85ko59l dpPXLpWF1jHKxDL993//93mNonoIz/8Xf/EX2S211Evk0X/4h3/I4emds/8Vd9f1jfQUPOJz/UIg SM/69byjtYFASwTmVC5V22+5ST72fyLi8bprV6ysNtFcuaoiP6uztnxWJUDOnTM7zZsza6zdImgx CUjFLYY7V6RAIBCYegggNyxwXEUFn2DhYdX4+te/nq3rrD009qycruMWyQperHosH0UpwOLHios0 sbA5b5zgKldSse7Jg3UNKeW6R7mhDPlbD2dMYXFClFlarZMrVij5Ksf6OXnLU5muV56/y9o6351X z6KEmagdpa7lUz0dxdXZukSRPa3rU2dWWm54LFKukX85YGKcLFECSxvUpyhvSltgoI4FP/V2lHp3 kpc6szTVyyvlUDZRTsCk3XMs9WmGrfZGCgQaEQjS04hI/B0IBAJPQ2BuRW4cUzFxe4kUCAQC0wMB wrrNhQX7WFi5iFtHZ38c7qxFgLf2i2urMPNIjaACXLi4ehGmucgJXmIzYYK7gBLWqy1atCiTG/dw V7vssssySUBuSrnyESyE5cmGwPI86qij8u/W+dn0mFupNU3WAgpOIpAIkiZf6/xe85rX5JDp1pch boiJ3yhpbMiLvHGVbNeOVlZoT1l7EQj5iqL3ute9LlutWcnswQUnLnj+LsmaQEFTWIuse0TyXKOu 6qVNpS3WusERxvDzOwyQK2Spk7zcx80Oxq5HEJEp94t2B2f4tHqO2l/q04itPZKKa29pX3wGAhAI 0hPvQSAQCAQCgUAgEAhMCQRYMgjMyA5iwrKCkHBnZW2xToOLFwFegAjnEAvHn//5n+etIL74xS9m VzlCNgKDBFGOCBEvEAHy8v/+3//LEQNZMAjYXGTtz3ZitVbXVhIsJp/85CezC9krXvGKdaRH3q5n eUJ6WFtETnROeawp3G6dFy7/oosuytYdJEKehHWkRxCWdu0Qvh1BaJa0gUUMRkgPTAS8QXiuvfba HMBDHeyDVZIIiB/96EezJZ/1StAPERNZhbjIITqlLUgiCxArDUJofQx8rEHmJjdRXqJAuuZv/uZv Mh6eE+LjYAHzLDxP+LR6jtpf6lPHFvFCGIP0lCcbn3UEgvTU0YjvQ0eA+ZpWqT74Dr0SXRRIQ2ZQ NygXU34Xt8elgUAgEAgEApNAwHwhSuHll1+eN6wlKB955JF5HxzuW4IdsPy86lWvSv/rf/2vHJ3s b//2b3MkQgK0QAOCInCN+r3f+730R3/0R9nFzNiOlLC4EMhZcZCWP/zDP8wEhmD/qU99KpMUlqZu EzctESDVCyGygalyrAN697vfna0lCIq/EbuJ2mHfH4SsVUJSkB4kR74iFSI9gh28613vSrvuuuu6 dT3yYB0SEIflCkYsYf/n//yfTHpskCy/khBN7WCRYYlB9JSBLJofJ8pL/jYbVr//+T//ZxK5DzH8 v//3/+YoiKxGnmG756j9JdWxRVzDjbkgE5+NCATpaUQk/h4qAnygzznnnDy40eyMe0LOaPV+//d/ P2/iOO71jfoNDgHCEW0obSvtZCMJptE1GfM3p8XtNOkTwkbTVBIges2n0/I6vW5U9aC15ftPKJVo 7rnecIfxfaJEEBaxjSDZLMGZkFTWALiOBlt5NObKmUxSf8od+bTSzE8m//XtXlYeLlieq+/2Ujrh hBOysG585hLm+cFb2HXP1XvikzuX97jMNQR2AU4I0EiA9+qOO+7IpEgeBHubAuvD+jtLjHu4XXWb 9t133/T+978/Lapc6BA3EVxZSZTx9re/PY8hwtNL6jlRO4w97UgPly+kAnlCSIS8R3rcg3Rpaz0h ZK5hsbn++uszESwWHwSxnliNTj755Ly3Emy5CVqbZLyTJsoLlqVP6B/aIh+kkwVJ3+uk/aVOdWzL ufgMBJohEKSnGSpxbmgIlIWIBx54YOKHO+7JXicmUpOSzQIjrb8IICZf+MIXssBsYbXJup4WV2Fj uV/wi7f5ZCfJAmCCymc/+9ksgLzjHe9IveTTSVndXjOqehCk4EgIIhQRUuHEpYUmvgiwrdpDwBSx CnGSCHX2JnEfoZPWmXbYOYnw9rWvfS1bAuxx5PfJJGUoEzFGYhvJ8WTyXh/vZQnR37wD+h/rgrU7 rC/eFQeBmrBPyC8JqeFGZdx+7Wtfm/uVDX3/9//+33ktygc+8IFMcNxvXvKcvGMIj+S7g1LCu1QW 3ftNXSZKXMLKnFHqqQzvBHJdT+X3du2YiPCrq7GHVwIckD3kB+Fh9eE+VxKS4TfjDkLpWm00xiFJ 6lFPMNEXJUoDBxLq6CQvedrsGJaeIWsUV0V90Pog2E70HOvtr2Nbr2d8DwQaEQjS04jIFPibaZlm pD4QGSQMnAYcv5VBmCDmvIm82fn6wNFJ0w2EFowaFA2qJnJa1MnkXTTlow732Un7mfnLPhGdXB/X TF8ECCw2LtWHTPaNSd8jaDUKNI3X1f/Wp1kaCPjFKtBLPvU8+/V9VPWAH+HIRqk2FOX6QttukTZS Yq+zdu4slBSek7UbxkGuUdxv3EfQomm2DqCQHs+TJh9RUe5kE6FWfhZtcx2y+D5S7wgQmPfbb79M cjy7f/zHf8yeAqwPLBUEcH1HoIPjjz9+HTlxDoEVntmna7lwcc1iqWB5QaIRE1YifZrgbX7zfnl3 EFjCvrmPtcK7Yk70nvjb9b77vV1iZXHo74VgKMN3qRCJdu1AZiZKXNIclHVIjrq+9a1vzUEV6qSH TGH9zr/+679myxM3N+39/Oc/n9fZTFRO/Xd5ITLt8oKpuhhT4IBcaY+NgAVdMAZO9Bw7aX+9XvE9 EIBAkJ4p+B4wPV9WRTwxKRs8DLAGcvH2b7rppvwbMiLRfjGnExLc03i+TPSdwFDM+3ypacIIDnae pmWbbN6dlB/XBALjhADhiOaYEsAEbuImLBGKCCu0j/pm0Qi7hiCFLPlOYHKtT4kAp18RfurWi27z UQbhieJDXsovrlvKUbZDXR3K1beNBQQNgph6OE8gcd5nv+uhLupoDHMoo46H36WCJQuPxdnWEfhE Zi6rxjTuQVx5pCJ4agOXQu0xNjqQDdpsYyACZONGJIobk2dSEkFMWQRYiRALLxjCAmb+hpE6K0e5 zmlPwdHfMPQ37TXiJXIXElSsB6XM+OweAeSHG5V1HywZoqmxYBCGPSPvlOfvWVMGlufluVgHpJ+I EOYZLa6ssp63QxAB97gXsWYxorwwhwoI4LuDBVEdrJHxXL2P1uhQiukr7RIir57eHy5zghlQ+smf BQSpm6gdZdxoVw4Sx9ojf+0UQABG+lk9cRPkGihPxFyfYgXrJXWSl7JY6PQ70eq4F+onxkt9SJ/q R/t7qX/cM70ReHKkn97tnFato6EyQNDesDwY1AxUJvbzzjsva0mEyzRJG3wNrCKw0J40nm8FjGsN XkWzRVBAsi644II8GbztbW/Lv5k4us27VZlxPhCYagjoY4Qp7lcEJ5M2QYrQTJPqYEUg0HAb0acI NWVNAB9+Wmf9jHWH26Q+Vdyh9MNu87EmARGjqdX3lUeAIKBJrLKsDoR7wpXrCXeIg/UR/ibIqRMh iKDk/n7Xg3ADBwftMOLA9UY96iRNnf1dzsGHQCshD4VUqi/XQAKt/JBS+S1sY1kh/DUKgDnj2j8U SQQ0z1TdEEoWIkIvcmU8VocSHpkgTiHkPm2jaff8CXIESa52rBKRukPA80eAHeVdQCa5JiI9yAMr oD6FAFHOwV+UMu+L95q7KAvQxz72sTx3Ii+eE7JDgYdMex8I/cIhy0dEMkoIeXne8qBMRFDMvcr5 0Ic+lN9FdfOcS/200Pf64ZxxAunWD5Wh77vPO3zKKafkCHMTtcP6oMaknIKPT21Bcrx/+i+89Amp fp353TX6u32PjGXeb+MA8lfaU29Hq3MI3UR5GYtgqr9++MMfTmeddVYu25gkRLY1Wp20v1l9GjGJ vwOBOgJBeupoTJHviIzDIE6IKtqbUn0DHQ20idj3ohFqdb7cVz4N7CZ50WUMfO4zCRioDJS0aLSV NGJF4Og071JGfAYC0wUBQrZoUAQFgq8+yXWKhlgfOrEKcUs4555FG0wwI9wQqlgRCFG0yPzahWFF opAe/ZqA3Wk+J510UhaiEDDWEOTmtNNOy+uJBN4opEffpahAjAhtxgfhfLWDgO47DSzhSF7qIiRw v+uB5Ni/hBbemj7hco07//2///d140r9HTEuwRZxUBf15g6DNCKHZb0dYRK+p59+esaTgqZuyann OdF35AkurEEERuOcfVho8ymaRPjSBgvRCcGsOZ6bcdL47BlQUElImPwIn0F6JkL+6b8j7wglYblY Qin6vOuEZ8I28uL5S9zWeEUgNeYpz8WcZe5k4UM09AOKAXv06IfIqkTglrhpeV7eUf1B/3StPPRp UdCQAu8lQd99xgF9uHhVeD+d17e8PyWZU7236olEe2dYPNTfuz1RO0o+9c+CEaJf+rv1hKwpxhtY IXoSEo+8qSeLEMKn3xjDEDzvKJxgK1+pWVuMJ5QnCIjv8nvTm97UNi8kVP9XB+VQDMENgfyXf/mX nI8xS2r1HP3WrD7ORwoEWiEQpKcVMlP4vMGcfy6tiQGPJlJqdb6xqQY+FiOaYloxkzztj0HIpMHa Q5jiTle0Rp3m3VhW/B0ITHUECAwEJppaoXEJ7lxo9BWaUolA5G/C96GHHpqvJRSz7HD1EEqXIEWQ 1v+QEUkf7jQflhOW3xJkg0DlXppwAl9JlBaEL+VIynBISBYhn7BOOHIvwuPodz1YbGDnkwBJ+CQ8 wq4oU3KlfvcPwdM4QyBDOoQSZrkuBIOLEbckghohDeFkXSPoEa66TQgKtyA4iOBF0EZqkBsCnnor j1Dob4vjrQshaMOKUEf5VMrWRvh63gicekfqHAFzESuqVCexBGzrQKTy3rDamJ/MYYgQ7JGAogAU IlrgHH0AKfVbPU/vYsnDNZ4164y+U5I8kV3voGdd3mHvqb5Y8kOSvD/ekVK+PJAl78yiyv2ca6z+ Kg8JCZIPC6uQ2ki399E9xZKE/CunHO7jzmqeVpY+7Brf1dEBHwoa9UBQKBh8l6/6smp5R2HifXeu Xu9mbUFajBNSabNoakge7JyDb6mn8qyrs45KPz3mmGMyKdS3PCt9zhhQfwatnmOz+uSKxD+BQAsE gvS0AGYqnzZYGBgNgGUQ0p5W5xvbShttwDRAGmgNWL4biN7ylrdkQYUG7CMf+UgW9rrJu7Gs+DsQ mOoI6GMOAgvNYyEzJndHSYRcfVBfIlT4JEy5nnDAdco5R73fdpoP4YSQjXTRYMsH2VrYxr2r1K18 0tJycaPU+Ku/+qusISYsSf2uBwGSdhlRo1025rCGIATNkvaoG6uQsYdAR8NM288axXKFhBCuCHSe hXyRuEI8muXb6hxyhYQhhOV5+Fs9uQxRKDnUl9CoXOSVq5XypaJw8t2zJ8gS4HwG6YFKd6k8h/pd 3nvvRmOCb53QN/5ujnS0S/JA+Nsl/b6QFdeVPu+9QIbMmyy61tTUj/Ibqwei4dO15dO1rqkfxgvk yPsj//pRSIU6qHf9KH0XTt7DcvhbP/T+OsgMjYfzrmk8nDeOeSbNnosySj9Qp3ryXPR1rp4sslwT F1eWHmvuWPNYVdVf8tnqOXr2zcqulxXfA4E6AkF66mhMk++0xMhJGTRKs5qdNxgbLA1gBpCSDK4G SgMKrQ2NE82PawkahKm//uu/zkKFgbebvEsZ8RkITCcE9AP9xgTN1YaLi/5SUl0oqZ8jeLmXcF7u KdeW+8un+8pvJY9yzidLESsIl5yFFdlBEAjojUnfViYByicBS74ELpYSaxS+8pWvZI0sgU6IYKmf 9UBUuK7A6p3vfGcWeLRffZRTH4/8Xc4jGjTnn/vc5/JO8Pz/Caau13YCpDoTyJAdSpuS6vmUc60+ udwggTZRRCa5JcqTIgixhJm8kS3PnaXOHl7axJXRGGycLInwKqlbCGoFlan/iYAgK3XiUv6mzECU vTPIbrFYOO8apEP/9x6VA1FwzrvW7EA+Colp/DTnq0/j4b3X15XZeJAB1F2dHMah8l1/1K9Yhlm6 HKWePvU75xAldS2EyTuunvU+XH/S3OpYpPQT5V1WBSRBkrj8scAZtyIFAoNAIEjPIFAdYp4GlfrA YtAziPDfdd5ETBPa6jzNisnbIGTQkUzwNKYmaWTHwEowMRDSyvqbcOSTeZqmmrDRWGazvIcITRQV CAwcAZO7/sYqQPjVR7iS6Rf6CmGHy0YRePztGv2RQKEPEXK4ibJcWB+i77lOkqd7O8lHOVyvCDdl /QnhmmuMvl3XhhPmaVn1WX2b9YLwwn0MYTIGcB1RTwIToV7+/ayHMourFxJRXNuQIUJfqa/xifsP LBzqwc2JO4yQw+rtbxiycGkTK48xCnExhknGM/fDQ1k+CW7aWE+EQpj7XFS5HrHefOlLX8rlUO7I 03OygzySCWNrQYy1FESu50JESeT5luS5EwphWx+zy+/xOf4I6AfeK+8goqAPe67eq2JtLNZA13m/ jAXeDVY/n/q7Q7+jbOx3qr9zk81b39dObdMHSxu111hh3jfeFEWPccV7r52+68cIUzm0V3/zN7c2 VmT4IV6udfSz/pNtf9w//RAI0jOFn6lBhSbRpF8S/3MLoi0GlAgDFjE2Oy9KikXLBi3a00J6DFgm e+t6xNonfFhUyU+dHy5hzqRNI8zPmi89glMvs1XepZ6T+TT4EjQJQwZIEwtBwoDZLlnr4D4TVz0Z iIslq34+vgcCEyHA6kkAsIjee0SwsZaAsOD9dE7/su7DZE/oJRSZ5PVb2lHCt3U+3k2+7tzc9EWH NUGE9U7yEXREvvqjwAiEcWWwPhgDFtbc3AjnCBLSQOEhwhVLirogI0ictujjLEUIQKft6bQe6iN/ 9UUUuLsoWz8tC8rhTygibBES4cr9FvEoi6VFwHKvMcvv1vEgRNYLcZWBsURQRbIIZZ6FdRPWHZRx L19U/aMOxjfPyvgCP21SDnc85RJ2PXPPVdCKgi285em6+joqeZe1VtocaWogoO95b7yDDn3XO+R9 8Dx91zfMmebiQrIpGr2T5d2bGq19ei31g0JYyBCNSX+jIKD4NH4hQcYOfRpZ0mfhwOKK/CF7xTpk 3qY0ci5SIDAsBGZUL+2T/hfDKnUMy7EAlU9pfQLrtZpnnnlm7vwnVlGbDH6NSTnKM1Eqr1n6u7/7 uyyEWFjYSvNRHl2vWkNRbexxQMAQlaYxFbcX+RO6JGUSrOrnGu/z90R5l3sIM5/+9KfzpPGe97yn nG77aT3RGWeckQUXg6ZBlOsJAkZQaZUEd+B6QrAzQBMKkR3PSISnErGn1f3Oi9aEVCqPNr0xESS/ +tWvZoJIOBp0QjS1x2ZycIg0fASQGoJRcVXptQZIhb7lvdS/COal33WSJ4EMiUH+KSkI5gQQVgfC GAJQTzTR+jihnyJAuQ59vPxG4Gk1/tTzqn/vph7K54qjrSV1W165z6f8tFt+6j6oBK/yrDwjfxN+ CXrc4Qh0XHVKIhiyFsGa+043z7XkMR0/exn/B4mDd9H7Y0x1qB+S7TBn6BcUbBQTlAIO88ewyY0x h9XV+27cbyTug8Sok7yNIepH1qG4cbDmGieRHNZs1ljYUUJoA2sRHHuVZzqpV/0a87T52jxNoRtp /UAgLD1T+DlPdnAwcIq80qiRLJAQHBoHc2U2nivX1z8nyrt+bbffDaYGTesAWLs+/vGPp3POOSct /J3m2KRFW6sONK8GVAIpDTzNvInsH/7hH7IW6k//9E/zhDFIAanb9sX1UwsB7xaN5mRTWSjcaz6s DggO0uO9J1gTzFk86paTkn9dQdAoNE1kNS15NPvsph7GmDrhaZZfN+fkpe2DTshhfcxg7eOeSMgz DiGZJXkGBD7WH1azIDwFmfH4NE+w4pgzWG4oCgjpniUyy4LDddK6NoI6RVu/E/Ki3yjfeKI/Ilet xhVKRZZHc5sw170E6uh3G+r5kRPUzcGLREKEEEnus1xr9RdeG65hRUIgi8cFIgTnfo4N9frF9/UX gSA96++zb0l2+gFJKyLVj7zlYVKgGaJx42dvAEV2EBqhast6Im4HLDgmLUJeEfR8ElrCv75fTyTy GTUC+oIFwEK+sp56x7mxcTUdpgvJuNRjmM+D0MwCTHhlNefSU5LfEB1ubcajSKNHgEXHczFfcMmy PgUx5bLmGQnB/Na3vjUTnk6UfJNtEeIlMAd3c1YHQr9w1uqBLKgvImHe8911rE/HH3/8ujlNHkga 0sRa6l10rfuRdOe46zlfrlFv97mufm6y7Wl2v/ojcSzOxerMKszaIsoiLwr1Q4AoDXzqR8YuY5n7 IwUCk0UgSM9kEYz7R4KAwVJoWAO/QXNhpV3lM2xPoYsvvji79yA0/qa1s9cBjXekQGC6IkA4Y810 jDKNSz2GiYE1UX/xF3/RtEiCW50ENb0oTvaMAKF+TXXMqP6bObO9YMwFEdFhVSkWB9YG8wf3aEoC QvawBexCRKy9s/+UhAAgYqyIiAlLMIUCgmI9GguivoZQI2vOca+kzGMx4UrGJQ9hQCCUgdzJV3tZ Hlle3MdtD9Fy3WSsvN0+RCSIK65DvVjZKDApLgULYWVjHWWpNr+zCiFnkQKBXhEI0tMrcnHfSBEw GVhMSltnYLQmx+BP28ry8973vjdPEgZ8i8OZ04P0jPSRReGBQCAQCPQNgWXLV6b7Hnos3b9kaXp8 xco0e9bMtOmGG6RttqjcOxc8GS4ZKUIALLY3b1x99dVZEcaiI4CIQB4E/lEnVhokRf0I9ywzwsab 0wj9yI+NdgXKMPdpExc87pw2D+fdgFwjdEg4xaB5j/WXm5i9cH76059m74YSwOPSSy/NSkOuZNad 2eRVGaNIrFjmaAdXQmTssiqUNSWmtce8NRzme88u3ERH8ZSmfplBeqb+MxxZCwzSEtP5sJNNCt/x jndkrZ0FwgZ3A7c6mTBoxSQucDRDNGCRAoFAIBAIBKY+Ag8/+nj66Y23p0t+cnP6+W8eSMtXrUkz Z8xIO2wxPx24547pVfvsmp659abZ5Zk3AELAgmAesK6TWxjheZzWjAhkgpiwyBDuuUOaW7lLnnTS SenUU0/NxO3tb397DpXuKSJtPB4QHITFtWeddVZuL+sN19aTTz45X2Mt7NFHH52D8CCCyBTXPgSJ hQtxEvVwHBLCh+g5ECB1ZfkRwIg1yjPkBojkBfkZhyc2deowfGl16mAz7WuKIDDtG1g79fkv9wCH adzgZNAcdjJZMcMbrO3NQYNlIaS2qJcBH/GhHZNaLQgddr2jvEAgEAgEAoHeEXjo0WXp4qtuSOdf dXO6f8UGafZmO6cFs+emtWtWpzuXPpTOuORn6ZY7H0iH7rV9uuWX11WuUt/N7moIgvWdgt+MY6K0 E0msuLdxw+O+5rx51tEscdmTivDvk6KPl4MogubKEmnQnJndASti5T5ucaxLCJE5chzDqWuHNUAs cqw/XNZZwLjwCSfP/Y3lZxTK12bPI86NNwJBesb7+Qy0dgZC++7wAaYR6iSVewycXAUMoqMgPXyu HSYFiz35Khu8mcZpy2itDITaZzCvB1Yo9w7bb7sTfOOaQCAQCAQCgeYIPL5iVZqyyQgAAEAASURB VLr82pvTed//ZXpgzcZpwWZPBoyYMXNWmrvRlmnGrLnp+7+8M33nkm+lnRcsTce8/rXZxQsBGNdk LrJWp7i3NQsqUJ+v6t9ZOxAiyj/zMZc3RKFuxapfY75HpFxrjZA5FHngXmbOHNekPRSbH/zgB/Pa n6997Ws5DDwrkPDwgh+M8zMeV1zXt3oF6ZmiT5zFhUmbhoZFo4R4ZBrnm8uMb/GjAa74KzvPsiOx 7BjsmI8NsOU+pMaCQn9zE/M332Hfi9uYe5xHeqTiM10WXLoO0TBItapLvrHHf8T25wqgbZL9crgv KM/+Oer25S9/OU8iBnUmfSbxkorvcAyQBZH4DAQCgUBgvBGo9GzpxtvuTd//+W/TkhnVni6bNl+H M2d+tUl1dfFGG7wkHfHK3dJhr9o7zZsz3qIO0iLwDuJy2mmn5blWKGpbM3DRlnwvqf59YRWUQFho 616uv/76fJ1gJqw45V7XWMdjfYxrWE2OPPLIPHfa2wtRMmfbzJwScdyTIAynnHJKDkbB6nP66adn Yov8wLGVVWzc2xX1GzwC4z0SDL79AysBEUBMEIjGhIwgFb0m94o8Y9djizORFmtcaGuYeO1ubjEk 4d4+PBYmMmWzevBrpuUxuBkERTZjDqdBsYu7fOWHTNUjvggOwBpk0aR7tKEk7TRYX3755fk+AyxX AuSkWV3Kfb1+IjZS0WSJ6vLf/tt/W3fOd8THM9C2ulbMRchOcSFo/C1nEv8EAoFAIBAIjBUCSx9f ka78xa3p+jurDXw33uZp43q9snMWbJJWrFmRfnbrg2mfytXtOTuNrwVDvc25J1abmTvqyRxWEuVd Scccc0z5mudBc/yiRYvynEcGMK/V70UCjjjiiDwvO68815ADBDowh7vG+amSzP88OMz3QngLeS36 GxdBHh/h7jZVnuRw6/nkNtjDLXdal8bywgpj8zCdsfFAPpixmbN7SQjJeeedl7UzQlyy5FxwwQV5 sSIywr3L4kbm3uLWhRwhPKww4v/ThrjWZoaFxIiV/6Mf/WhdWMzPfOYz2aJiwSASJd/6PaXuiJ02 85emYSoEqFVdyn29fhrsCuEpeTSeQ3ZYslqRmsbrSz7xGQgEAoFAIDB+CNx4+73phjuWVJu0Va5b syYWzmfO3Sj98s6l6bqb76rm2t6VjKNEwvxV5rBW30v9CPmFzDhXv75c43fK0JKn8+4r64DKdVPp 0zxPEfqBD3wgK11Zfcgg5I9IgUAjAmHpaUSkD39zqUIQzjnnnHWLC+vZcj0TapkVppdEm4FouN9C fm5eQlgurkzUXL0Masy8NENlcGOhsYBTtBYHolTXBKmHgY/W5/Wvf30OBGAwYbExKIqAg2w1S8W9 zjUCCLAqcYmTmtWlWR5xLhAIBAKBQCAQaIbAmjXVGtLb7ks337sszZy/dbNLnnZu1twN0rLHq7nr niXpgUeWpq03e8Id+mkXxolpgQDl7Dvf+c70kY98JH3yk59Mf/AHf5AjvIXFZ1o83r41IkhP36B8 MqMXvehF60JKPnn2yW/Iydlnn50JwZNnu/uGsHBz88k0LZXO7bOu8fEbwmOHae5mn/3sZ3NoSn/X U9364TtzN9Lku89WLnnWCWkPMsVlrriWybtZXeplxvdAIBAIBAKBQKAdAkuWPp7ufvDRtHzNzDS3 itQmza42Il0wb1aaN3tmWl3Ng0uXr06Pr3yqRWfmnPnptvuXpd/c9WCQnnYAT5PfuOH/8R//cTrz zDNzhDfuglz3IwUCBYFwbytITKFPrmmsMEy43NF+8IMfZHIhwECrxLLE5Y67m4NFBjnpNCE9xWrU eI985cWdjrbFmplW1zbeG38HAoFAIBAIBALtELjzviXp7iUr0sw5G+TLNqrIznN32Ci9+nlbpiP3 2SYdVR3777ZZ2mqjynWrltGM2fPSbx98PN1+z8O1s+vvVy71JbhQHQXnWyk169dNhe+iySI72iRw Q+zRNxWe2vDqGJae4WHdt5K22267vADx3HPPTZ/4xCdycIHDDjssb2imo4tsghTVk8hqortYv1Pi 3lvfU65lkSnf3Se6Gxc617L4+K3Ewve9JOXstNNOOeiBNUwixnB3c64xz3JPfAYCgUAgEAgEAp0i cN/Dj6V7K9KzdsYTpGeXrRekg5+3VRWVbWZ6aOnKtO0m8yrSs3naZpP70zevuSctXfHEellrf5au WJMerixFXORmVtahfiX76HArL54NvCt4VFBKmgO7TY8++mi+pUQl7fb+VtfX86XsvPLKK3O46uJe LxKqNcbqbO+b6ZAQH8GdtNXG5aWt06Ft0YbJIRCkZ3L4jexuISftSsy1jfsZglGSHYwbk2gmIpZZ 3IfEWGsjlWvlUb47v6iKBCMVi81xxx237u/6dU66ly+t864vdfG98dqcSfwTCAQCgUAgEAh0iMAD jyyriMvKytJThaOu0oPV9/MrcnN7ZcVZVhGcnbean4596fZpt20XpO02m5duvmdpvm5GNTfZv2fZ 8pXVsSJtOL97MpIzavIPYfr8889P9olBfAja1tIKBW0OLNaTMiead+uu6CwrCIf5028CDXFXX1TN vWXedb64srvOefn69Jv5XJ4IlzLLta7x3XX1fJEeHiLW9Apz7XeWEIGKhKwWcbW4zZdyiqygLOeU pWyp3gbXKbO0yd/yH1UiH3k2trNAgOAXKRB4UlIOLIaKgMGCmZllpFminWm01jRepxOXAan+W6vO bVAshKRcX7+2/r1xsKr/Xb+u5OP3bupS7vMJC4EPWmFRv3bU32n3TByRAoFAIBAIBIaDwPJqU9Ll q9akGfOeEFxvf+CprtmPPb46PVat6dlk/tNFmpkV6VlR3Wtj036SnoMPPjg57KvDk+Kkk07KZILQ bw871pNCEHg+8JDgaSHtsssuaXG1ttc13MFtIyECq3tZW8zTyIzvZX89hER+d99997pNOG+55ZZM WliHrF0RsOjmm2/O+fLScNTz9TfyIugQzwxztnrtueee2dLDu8P9Zc891h+BmZAdZZn7ECbbWfht ca0N9g4S7Ki0SX3KPkHDeUueWoqtLGBb5ux+W9CeWlr8NVUQePoIMVVqPoXrWcIp2yTMYNIs0cZM hU3CmtW9m3MGcQP+jTfemKPddXPvKK4VlY9boMkjUiAQCAQCgcDgEVhVzZOrKve02TOe1NZvULm2 zZ/7RCCD52y/Ydp8wznZwnP/Iw1741XKwVWr11bEp/lc2+/aWz9rc2xbQCATiMArX/nKTC5YhiSR VV1jPSyLBEUipR/l30033ZRdy30uqqw+iIU9aI499tjsliZfUVsRK1aMbbfdNt122225DPvulLJF YkWU6vny+FAGC4hPQYj22muvrHjkvi5aq80+/W6NMPLDNYxS8xe/+EWeq5Gw173udXkvnHobXGuN cWmTOXKUpEedzdWiyapzkJ5+v+lTM78gPSN4bgYXZvCrrrqq6ealqsT6sT4kmhgDtQHS4DTuSUhw kxRNXaRAIBAIBAKBwSOwpnKbytt01tyldtpyftprp03SdpvOS7tWa3zuf3RFuvbWJWnJ409EMy21 qkLwpIovVXPqkxt9lt8G9Ungtpm37R8Qg5K4f0msLRtvvHFeOyvaK4uO6KcSQuE7iwuiweJjm4pi OSpubMiFaw8//PB01lln5d9ZgUrZJ598ciZT1h2VfFk9eJDY14Zl6tRTT80bnFsnXJL85Vl+twk6 qw33PWTr61//eq7bwoULn9IGLn6NbSp5juqzyFHNvFNGVacod7QIBOkZAf46IMHZ0Soxc5cO2+qa 6XAeFvvss08+pkN7og2BQCAQCAQC/UVgdrWGZFYVhGBtpQycMesJa8/cKlS1KG5iEzy8bGWaPWtG 2mWbBemOh5anBx97cmPKtWvXpDnVb3PnPLEOpb81a54b4Z9CrxAUHh3IC7LjHPcw1h+bjH/6059O b37zm5+SkWAIFIE2GUc2bAXx4IMPZlc2FhjeIlL90zobZZSyWwn6SA/vCtc7kKR6avydyxtrEdLF amXtjzm7sQ02Sm9s08te9rJ61kP9DmuYwQEmkQIBCDxpKw48AoFAIBAIBAKBQCAQGDME5lWEZW5F dpCekn52+yPpzO/enj588eL0ie/cmu56eHk65Plbpb13eqqAu2ZNtfi+Ikjz5gxOx4s4NJIH9URc EAuWGp4dPikzrdm1/kbQA25XXNm4enMRs3YG0eBNcMcdd+Q1PKKzstg4kB4ubfLlBv/Tn/40u8DJ T9TVxlTPlzWmnlrVu1zjd2VZ18MidcQRR+SDm1xjGxC0xjaVfEbxCWskDYFE8iIFAhAY3CgQ+AYC gUAgEAgEAoFAIDBJBDZZsEHaeINZ6b7KkpHSE5FH61neXRGeX931WHrBMzdOW2xY+51bXEV6NqhI 0/x5c+q39O17EaqRC0lwAIv6rWdBAmyYeeGFF2arjmuQFu5rl156aSZB7uc2xvWMoP6d73wnu5/Z T4+Fx7qcV7ziFfk3HiAIB3Ij+pptKKwNVt4BBxyQrTCl7NJAeZR8WWLqv/uOdFn7or71urvf78oX vOCSSy7J5Iqlh0s6IlFvA3J00UUXPaVNpQ7D/kTu7F8owSlSIFAQCNJTkIjPQCAQCAQCgUAgEBg7 BLbadEHacqM56d77V1QWlQU5aMG8ynqzZFnlMlYFKZhfBTWwMenKKkrbI7U1PWtWr0pzK3+WjatQ 1XNmD8a97bWvfW3Gq1h6kAeBCkoSHOCggw7Kf7LOSK5FfuohoJEj5EYqkVD//M//PP/NRcuWE1Jx WzvkkEPSoirQgXVCXOZK+fWyXa/ser6sNiU1XiuP+rny3XmBEbjPaUMheI1t4FJWb1MpZ5if6ijg EAsY6xTyGCkQKAgE6SlIxGcgEAgEAoFAIBAIjB0CW222UbXx6Lx0w72PpVmVAL7vzpumPZ6xYbrl 3mXp0YrkCGbwgh03TrfctyzddPdj6+q/ZtXytPXGc9LWmw/OvamQjXWFVl8azyEljQlxKOSh/FbI Tvm7EBx/17+X35vl21i2a+v51n+vfy951s/VvyursbzGNjT+XfIc1ifSxeVP8AjWKYSzsc7DqkuU M54IPL0njmc917ta0d4IfckM3mywW+8AmSIN5pPNtL4+BKGYIo8kqhkIBAJTHIFtt9gobbvZ/JRW PVBZc1am2+5flhZWG5K+ZNfKJauy+NjDh3vb9254IC2uiNC6tOrxtHCHBWmX7bdYdyq+TE8EuP79 /Oc/T2eeeWZ283vve9+b1yNNz9ZGq3pFIEhPr8gN+D5+s8JVfvGLXxxwSZF9PxFAeCxCjWgx/UQ1 8goEAoH1GQHR23badvO07Sb3pLtXLEs33DU7k5x5lVsb0vP4yjV5A9I6RlzbZq5ZkZ651ZZp2y02 qf8U36cZAhTEV199dbIPkvVOxx13XKqH4Z5mzY3mTAKBID2TAG+Qt4q/bwGhuPuRphYCe+yxR16Y OrVqHbUNBAKBQGB8EXjewm3S8595Z7rnlw+ntXMrd7VqnQuy42iWVj/+aNp5s9npOTtunTaYO71F HetoHnuscv2ryKEw1tzS1gcPEQpGEe3sJeSwLuotb3lLjtjW7J2Ic4HA9B4JpvDzfcYznpEckQKB QCAQCAQCgfUdga2rdT3Pr4jPtb95KN23/NE0Z4MqNHUl3DdLq1cuTyuW3J22qzYt3WHzDfJi//r6 lGb3jNM57tG33XZbVnoiMiKlkQdEg2uWli5dmq688sq8dsdGp/Pmzcsbnja7djqcQ/K4kvOGueyy y9K9996bN4IVVc4+Q5ECgVYIBOlphUycDwQCgUAgEAgEAoGxQABpeclzd0y33fNQOv+nd6QVM6so YnMXPI34IDyrH7knbbj8nnTfzUvSdy9bmvbee+8cfpnb8VQgPxbkf+5zn0vf/va3c5Q3xIf3x+GH H56tOX4XpUzgAAv1ly1blhfw+44AcI9HfiTWECSqBE0o0d78Jg94yH8qJPW9//77080335xJ3nXX XZee97znpXe9611p4cKFU6EJUccRIxCkZ8QPIIoPBAKBQCAQCAQCgYkR2HSj+enAvXdNdz+wJF11 871p5Zot06y589OMigBVG/JU/69Kqx+9O+206dp01KEHpRX3/yZ966IL854t+++/f3Z/QgaElR7n qF6FpLzpTW9KJ598cjr11FPz5qZCTyM4NjDlzmaPnd12220dcCxCe+65Z7b0IDc2N73xxhsz8UEK EByEaeedd87ub/bvYRnx9zgna2WRucWLF+dQ1Ndee222fJ1yyim5veP8LMcZ1/WxbkF61senHm0O BAKBQCAQCASmIALPeuZW6bjDXpQ2/t7P01U33pseXf54qmweaWZakzaatTztVEVrO3L/3dPLXrAw zZyxd3rVgQfk9R42zrz88svzZpWsAzbetOgdURhH6w/iY4E+NzfuXFzbuLF94xvfSP/5n/+ZI5P5 zYaj3Lok119wwQVpm222ydaec889N5MEG6DapBQRQhxe85rXZFc4mCBJ40h6WHW0x6atv/71r9M1 11yTPz2397///WmvvfZaZ72agq9xVHlECATpGRHwUWwgEAgEAoFAIBAIdI+ASG4nHP6i9IJdfpt+ fMNt6b6Hl6b58+ak5+78zIrs7JyeufVm64jM5ptvntd7HHzwwZkAIAU/+MEPsqBP4N91110z+dly yy3TggUL1t3Xfa36ewe3NGtWvvKVr2TrDiuPwEYPPPDAOle3s846K91+++1NAx7ddNNN6aGHHsqb jR511FGZ8LjWIbSzvXu4tVn8Py4JuVuyZEler8NKdcMNNyQubI8++mgmq3/2Z3+W3f3WhyAN4/JM pls9gvRMtyca7QkEAoFAIBAIBKY5AlzdFu37rHx00lQWnQMOOCAhD9y6/uM//iNdeumlyf4uz3rW s9Jzn/vctNNOOyXkx5oYrmOjdJtCSFhsWHF22WWXvNkmsiaJ0FY+Xccq0pi4hKm/dUwsPCxHgiFo G8sJ65YIsY5RJviz6CBzrDrW61x//fXZNY+FCmHbb7/9cr1HWc8oe3ogEKRnejzHaEUgEAgEAoFA IBAITIAAKwES4Xj729+e17x873vfS1y9EAXnkaDi/rbpppvmNUCsQMNc8C/wwLOf/ews8Jcmbbvt trkOP/vZzzKZ4arG7Y2bXmOqX4vAIX3WM3Fz+/GPf5zX9iBUw7aasGA98sgjmeiwRAk5bY0Sy5R1 O4jOy1/+8vTSl740k7RxdD1sxDr+njoIBOmZOs8qahoIBAKBQCAQCAQCfUJAaGckwGGBPwvQj370 o0wKLrzwwkx2rHdxsJIIgIBksJ4gEe4fBGlArlid5F9PghG88IUvTN/61reyNQQxY71ivfG9JPV0 rXZdfPHF+VokAhHafffdsxWL5Yd1a5CJBUrgBe5piE5xXeNid+utt2a81cPedkcccURuWzMCN8g6 Rt7rFwJBehqetw7YzFTccFn8GQiMBQJ8oLkuRAoEAoFAIBDoHQGWFRYeBwsQl6tf/vKXSaQwbmXW 07CYIBesEQgEVzgkqFhSWINEQ+NWNhkLhfU2xx577NMag2AdcsghadGiRXncr5dz9NFHP+V65SMS hx56aL5W+5y76667stvcdttt19RC9JRMOvyD3MSCg+CIKofk+GTJYb2B3W9/+9u8nkiWMLae6rjj jsuEsrjrdVhcXBYI9IxAkJ7fQWeQEf/9iiuuyP6uPSMaNwYCQ0TgV7/6Vfb1HoS2cYjNiKICgUAg EBgrBLi1sY44JFYK600srhcG+oc//GG2XriuToJYXRAhBMhBoHew2jjIGp2M1+1IU7O1Rq2uL/vz FHCtneHCJ4JdN4ky2PobB4LDFVA0uUJ0EBx5Izlc1hAd1yFXSM5BBx2ULTrWEMEgUiAwCgSC9PwO dbHu+fV+/vOfjx19R/EmRpk9IUDDZpGnyTVSIBAIBAKBwGAQQGT22WeffJQSECEucQIDLK7W11gr I+oYVzkuZiUognvLwTWONQgRIvwjMIhJ48HFrRxIUidEqdSr3Seyw52MlwDi4hOhUef6Uc7VCQ7r lzZzVUNyKIodyI92sYJxy+OCR6ZCBsOK0+5pxG/DRiBIz+8Q33fffZMjUiAQCAQCgUAgEAgEAhMh gMhw03KUxN0YMUB+uHQ5WD0s1mcFQRwQGKSIWxxSUKxCPq0VQoqQIKSoHMhRIUHKYtmpH4UUKb/V geA4kBtkxuE76w13tGK58Vm+IzgOZW+11VbZJc66G8SpRH/j6qfOkQKBcUcgSM+4P6GoXyAQCAQC gUAgEAhMCQQQES5vjmaBApAOxOe+++7L7mDFeuLTIWwzkoGEcB1jjfGJyCBAyFAhO8UC5LO4vLH+ Nx7uVS5y41MeSEo5EC2WmuKqV+rvk7UK2UHIlBspEJjKCATpmcpPL+oeCAQCgUAgEAgEAlMGARYT 634c3STuZghQsc4gL+VAcnxHbgoRKlYhnwiRo6wtKlahbsqPawOB6YBAkJ7p8BSjDYFAIBAIBAKB QCAwbRFAWrjDRQoEAoHeEZjZ+61xZyAQCAQCgUAgEAgEAoFAIBAIBALjj0CQnvF/RlHDQCAQCAQC gUAgEAgEAoFAIBCYBALh3jYJ8OLWQCAQCAQCgUAgEOgNAWtLRA+79dZb0zXXXNNbJnFXINADAsKM WyNlzVOk9QeBID3rz7OOlgYCgUAgEAgEAmODgIX1Qjd/5zvfySGex6ZiUZFpj4Aw4vvvv39+/6Z9 Y6OB6xCYUUX7WLvur/gSCAQCgUAgEAgEAoHAkBCwp40NLoVTjhQIDAsBFh6huDfffPNhFRnljAEC QXrG4CFEFQKBQCAQCAQCgUAgEAgEAoFAYHAIRCCDwWEbOQcCgUAgEAgEAoFAIBAIBAKBwBggEKRn DB5CVCEQCAQCgUAgEAgEAoFAIBAIBAaHQJCewWEbOQcCgUAgEAgEAoFAIBAIBAKBwBggEKRnDB5C VCEQCAQCgUAgEAgEAoFAIBAIBAaHQJCewWEbOQcCgUAgEAgEAoFAIBAIBAKBwBggEKRnDB5CVCEQ CAQCgUAgEAgEAoFAIBAIBAaHQJCewWEbOQcCgUAgEAgEAoFAIBAIBAKBwBggEKRnDB5CVCEQCAQC gUAgEAgEAoFAIBAIBAaHwOylS5cOLvfIORAIBAKBQCAQCAQCgUAgEAgEAoERIzDjfe9739oR1yGK DwQCgUAgEAgEAoFAIBAIBAKBQGBgCMyu0sAyj4wDgUAgEAgEAoFAIBAIBAKBQCAQGDUCQXpG/QSi /EAgEAgEAoFAIBAIBAKBQCAQGCgCs2fMmDHQAiLzQCAQCAQCgUAgEAgEAoFAIBAIBEaJQJCeUaIf ZQcCgUAgEAgEAoFAIBAIBAKBwMARmL12bcQxGDjKUUAgEAgEAoFAIBAIBAKBQCAQCIwMgSA9I4M+ Cg4EAoFAIBAIBAKBQCAQCAQCgWEgMHvVqlXDKCfKCAQCgUAgEAgEAoFAIBAIBAKBQGAkCATpGQns UWggEAgEAoFAIBAIBAKBQCAQCAwLgRmPPfZYLOoZFtpRTiAQCAQCgUAgEAgEAoFAIBAIDB2BGVUg gyA9Q4c9CgwEAoFAIBAIBAKBQCAQCAQCgWEhMHNYBUU5gUAgEAgEAoFAIBAIBAKBQCAQCIwCgSA9 o0A9ygwEAoFAIBAIBAKBQCAQCAQCgaEhEKRnaFBHQYFAIBAIBAKBQCAQCAQCgUAgMAoEgvSMAvUo MxAIBAKBQCAQCAQCgUAgEAgEhoZAkJ6hQR0FBQKBQCAQCAQCgUAgEAgEAoHAKBAI0jMK1KPMQCAQ CAQCgUAgEAgEAoFAIBAYGgJBeoYGdRQUCAQCgUAgEAgEAoFAIBAIBAKjQCBIzyhQjzIDgUAgEAgE AoFAIBAIBAKBQGBoCATpGRrUUVAgEAgEAoFAIBAIBAKBQCAQCIwCgSA9o0A9ygwEAoFAIBAIBAKB QCAQCAQCgaEhEKRnaFBHQYFAIBAIBAKBQCAQCAQCgUAgMAoEgvSMAvUoMxAIBAKBQCAQCAQCgUAg EAgEhoZAkJ6hQR0FBQKBQCAQCAQCgUAgEAgEAoHAKBAI0jMK1KPMQCAQCAQCgUAgEAgEAoFAIBAY GgJBeoYGdRQUCAQCgUAgEAgEAoFAIBAIBAKjQCBIzyhQjzIDgUAgEAgEAoFAIBAIBAKBQGBoCATp GRrUUVAgEAgEAoFAIBAIBAKBQCAQCIwCgSA9o0A9ygwEAoFAIBAIBAKBQCAQCAQCgaEhEKRnaFBH QYFAIBAIBAKBQCAQCAQCgUAgMAoEgvSMAvUoMxAIBAKBQCAQCAQCgUAgEAgEhoZAkJ6hQR0FBQKB QCAQCAQCgUAgEAgEAoHAKBAI0jMK1KPMQCAQCAQCgUAgEAgEAoFAIBAYGgJBeoYGdRQUCAQCgUAg EAgEAoFAIBAIBAKjQCBIzyhQjzIDgUAgEAgEAoFAIBAIBAKBQGBoCATpGRrUUVAgEAgEAoFAIBAI BAKBQCAQCIwCgSA9o0A9ygwEAoFAIBAIBAKBQCAQCAQCgaEhEKRnaFBHQYFAIBAIBAKBQCAQCAQC gUAgMAoEgvSMAvUoMxAIBAKBQCAQCAQCgUAgEAgEhoZAkJ6hQR0FBQKBQCAQCAQCgUAgEAgEAoHA KBAI0jMK1KPMQCAQCAQCgUAgEAgEAoFAIBAYGgJBeoYGdRQUCAQCgUAgEAgEAoFAIBAIBAKjQCBI zyhQjzIDgUAgEAgEAoFAIBAIBAKBQGBoCATpGRrUUVAgEAgEAoFAIBAIBAKBQCAQCIwCgSA9o0A9 ygwEAoFAIBAIBAKBQCAQCAQCgaEhEKRnaFBHQYFAIBAIBAKBQCAQCAQCgUAgMAoEgvSMAvUoMxAI BAKBQCAQCAQCgUAgEAgEhoZAkJ6hQR0FBQKBQCAQCAQCgUAgEAgEAoHAKBAI0jMK1KPMQCAQCAQC gUAgEAgEAoFAIBAYGgJBeoYGdRQUCAQCgUAgEAgEAoFAIBAIBAKjQCBIzyhQjzIDgUAgEAgEAoFA IBAIBAKBQGBoCATpGRrUUVAgEAgEAoFAIBAIBAKBQCAQCIwCgSA9o0A9ygwEAoFAIBAIBAKBQCAQ CAQCgaEhEKRnaFBHQYFAIBAIBAKBQCAQCAQCgUAgMAoEgvSMAvUoMxAIBAKBQCAQCAQCgUAgEAgE hoZAkJ6hQR0FBQKBQCAQCAQCgUAgEAgEAoHAKBAI0jMK1KPMQCAQCAQCgUAgEAgEAoFAIBAYGgJB eoYGdRQUCAQCgUAgEAgEAoFAIBAIBAKjQCBIzyhQjzIDgUAgEAgEAoFAIBAIBAKBQGBoCATpGRrU UVAgEAgEAoFAIBAIBAKBQCAQCIwCgSA9o0A9ygwEAoFAIBAIBAKBQCAQCAQCgaEhEKRnaFBHQYFA IBAIBAKBQCAQCAQCgUAgMAoEgvSMAvUoMxAIBAKBQCAQCAQCgUAgEAgEhoZAkJ6hQR0FBQKBQCAQ CAQCgUAgEAgEAoHAKBAI0jMK1KPMQCAQCAQCgUAgEAgEAoFAIBAYGgJBeoYGdRQUCAQCgUAgEAgE AoFAIBAIBAKjQCBIzyhQjzIDgUAgEAgEAoFAIBAIBAKBQGBoCATpGRrUUVAgEAgEAoFAIBAIBAKB QCAQCIwCgSA9o0A9ygwEAoFAIBAIBAKBQCAQCAQCgaEhEKRnaFBHQYFAIBAIBAKBQCAQCAQCgUAg MAoEgvSMAvUoMxAIBAKBQCAQCAQCgUAgEAgEhobA7KGVFAUFAoFAIBAIBAKBQCAQCAQCPSLwyCOP pGuvvTb96le/SjvssEPad99909Zbb91jbnHb+oZAkJ717YlHewOBQCAQCAQCgUAgEJiCCHznO99J H/nIR9LixYvTggUL0gc+8IH07ne/ewq2JKo8CgSC9IwC9SgzEAgEAoFAYMogcOutt6azzz47XXHF Fenoo49Oxx57bJo/f/6UqX9UNBBohcCKFSvSr3/96/Sb3/wmrVq16imXzZgxI82ZMydtsskm2aqy 7bbbprlz5z7lmmH/cccdd6Sf/exn6Z577knqd/vtt6c1a9akmTNjtcawn8VULC9ITw9PzcBgoJg9 e/bIB4Aeqj/lbgm8p9wjiwqPCQLGqYcffjitXr06bbrppiGo9/hc7r///nTVVVeliy66KD372c9O b3jDG/qK5eOPP54Fzg022CDPKz1WM24LBLpCAFn4t3/7t/TJT34yecebJcQCofBuPuMZz0ivfOUr 01FHHZWe9axnjYRoqLPxbO3atfnwd6RAoFMEBk56brzxxvT1r389/eIXv8gvaL1is2bNyh1pq622 Ss9//vPTS17ykvTMZz6z447ULu96OY3fFy5cmCetvffeu/Gnpn8TGviQfve7380ahvvuuy+ZpJCe zTbbLO26667pxS9+cdp///3Tzjvv3HH964U99NBD6dxzz03nn39+JlLHHHNMet3rXtc1qWqHiYGL dhLeu+22W9pvv/3ywOU5jFMaBt7j1N6oy+QQaPfOT3aMaVWzbvvrTTfdlL72ta+ln//8562y7Oq8 PkzwfsUrXvG0+2htCec/+tGP0p133pn4wBMQNtxww7TLLrukl7/85WnRokU9j1VPK7DJiW7xaZLF WJ0iZK1cuTITE5/9FLTMLaeffnq65ppr0pFHHpne8Y53pO22226s2h+VmZ4I6KfGie9///st32lj h+STlaeQ/xNOOCG98Y1vTBtvvPH0BCdaNS0RGDjp+d73vpe1CEySjYkGgVCiI9FCMp2akP/Lf/kv CSHxe7vULu929xH4n/Oc5+Qy2l2H2HBn+OxnP5t+/OMfp3vvvTdrTWlPTXrqh/hstNFG6bzzzks7 7bRTOuSQQxLCIv9u0nXXXZe+/OUvp3//93/PpAkmiOAee+zRTTapHSZ1vNXZxEpr87a3vS298IUv nBDvrirSw8XDxLuH6sUtY4pAp+98L2NMqyZ3219vvvnm9I1vfCOPI63y7OY8ZcvCSnlTJz2UMcr4 4he/mJVMDzzwQFq+fHnWisqb0uPKK69Ml1xySXbVMs6++c1vzoqbbsru5Npu8ekkz+l6zfXXX58u vvjidMMNN2QB8qCDDgrSM10f9pi1y/jw2GOPPc2trV7NIjcgPWSf3/72t8lY43Pp0qUJ+bG2JlIg MBUQGDjpQRR0DuRgr732yhM1YEoHooXkS+ogGJgAWIXe//73ZwLBn7RVapV3q+vLecICF4V2icDw +c9/Pp1xxhk5SoiBgdD0ghe8ID3vec/LZt5ly5Zlf1KaZtpVft/q/9Of/jSdcsopyeTVSUKgrr76 6vSTn/wkDyruoX35z//8z65JTztMDHBLlixJt9xyyzrMTbS//OUvc31f/epXj8y1Yph4d/JM4pr+ IaBf/Md//EeeKF/1qlflaDv9yz1lZcSgxphm9eylv7IAv+Y1r0k77rhjsyzzOWOgPm9MNFYaa1ol lp7678YiluJ//Md/zOMoUnTwwQdnxY5r/e45GGMQEkooY7Jx8IADDmhVTE/ne8Gnp4KmyU2s71yH zImERxa5ZmnQ/ahZmcM6N53bNiwMeynHO+coieKZ6xovEElfRmyMFyw8rJKPPvpoVqaQeyiEKXtf +9rXliziMxAYawQGTnp0GoeJ9y1veUt22YJI6WxcBRAKROcLX/hCuuyyy5LoHPPmzUtbbLFFeulL X9oSwFZ5t7zhdz+YYAgFrRLf1s985jPpX/7lX3KEENcef/zxWStqULCoTx5cHggTiARBgtBx+eWX Z9cSAgl3vVYTWL1sA77B5MEHH8zuZrBBAJ0zmHRjPm6Hid/gTaiCN40wy9K3v/3t3BbWJW4vw07D xnvY7VvfyxNa9HOf+1zWZHvHhBjtZ2r1zvdjjGlWz176K7eyd73rXVmAaJancxdccEG666678jUs xu973/taXZoXF2+++ebrftePzzzzzEQQIbD8/u//fraaG7tgbqwivFAuID76Pq2tsbffqRd8+l2H qZQfa93f/u3f5mfPuu9daZYG3Y+alTmsc9O5bcPCsB/lkG28j7xVJGNokXPM09/61reyIphy11pb Cl4yz8te9rK2MlU/6hZ5BAL9QGDgpKdUksVmm222aTmgc+PiEvZP//RP6Stf+UomPlyuWFUmEvon yrvUoZNPHZnw8a//+q/ZIkJDe9JJJ6XjjjsurzeiHW1MBobdd989EzSDAsKEXHSaRCJBcBCqN73p TdkyxnLkHEuM9ULdpnaYqC9cufkhZdYa0MTTLu+5555pyy237La4nq8fBd49VzZu7AkBwjYLpPUl FASDSu3eeWVOZoyp17mX/op46N/tkvFRGySEppXw25gHzesPfvCDbC02XlHQiDDWOG7q19ZMWoNI mYTwuL7fqRd8+l2HqZQfhSCvAGMhZV+zOUZ7htWPRoHddG7bKPDstcwSsKBx7DAeCWKw/fbb56hp vEUofClOyCj+Jq9FCgTGHYGxifFH+NZpuL/oWGUxO5ePYSZaUKSLxhQp+KM/+qP0nve8JwsHrSYj Pq/WyCBt/FsRpt/7vd/rKLqPdSyF3CAiLDtwMMhwdfFbv5P6wptGmPa5CEACNdDcDDMNG+9hti3K Gi8E+jHGjKK/ToTi3XffnS3S6kZxQVPbKLSUPPR9vxlrXvSiF/V9U79xxKe0fZw/kR3vZ6s5Zpzr HnVbfxBA0MkL3GKNJazsXIsptDpJFK4UXzxZKEcEeGFB6kZJ3Ek5ra5RPk+XxdUeP6xV5Et/a0cv CVln2eY5oy3kVmVEGl8Enm62GGFdaTlZTGgib7vttmzu5+5R910fZPVoLriJEP69uAgYywsNbCfJ IMAlr7id+HuiVCw6hAVWln322ScPALTS1vUgPYSaibTEE5XT7HcTLVcj+IreYiBwDCuNAu9htS3K GU8EJjvGjLK/tkLUGOmQBCehNJooGZsGEbVxHPGZCIv4PRAIBDpHgCxinBGJkusbi/FEbrL21Lms WrrAE8YY4Xr3lkBWZCzLAY444ogsj/R7bBJ4oSw9oNCul28dnfDbouWS+dotfYAS6xa57Ktf/Wp2 FRYBj5WWlUxelOXWb7Lebr311p0DG1cOBYGxIj1azN2iuFxg4I5hJQv6f/jDH2a2zmpjfcsOO+zQ dfGdkJ2SabHmcDtBPgRLQH5obNVF5zK4DIL0qINOaSGizmpgcCB83bShtKXbz0Hjze2HNgdpfO5z n5sHo4nqSOPEXE8ThXx7D4rLUf1ehE3ehE0E1bWSwd2CT5of2iPY0oxxVTIoSpO5N2dQ+8ezKsEp DOYWnFoYbRCnjTM5Nat/LYuW9VF/ygeRC5FhLloFE++rdW2tkvvcYzKw3s2zUFe4UizUk3cPPp0q F+r39vJ9MmPMqPtrs/YSEIqQ4F2gbRzUeNGs/Pq5fuPTz74ikAuNNI2s99AayiKkiBaKLJY+Wm9T u+/6CE0vi3W3faTkW9pIY268qe9/0u9+1I/xotS7/tkLtpNt27iO73VcfB8U5o3lDOtv7ZHICA7z gqNZQhC4zgsIRYlrLi5zQf1694ss+c1vfjO75r797W/vSHlTz6PZd8RKdM/TTjst52++JlOWNrhH G3i4UPwK/vLud787K5+b5WfMsB7SGlXzrTWSyihJXoJSKZPC/L3vfW9Hcke5Pz4Hj8DYkR4vY3kh TUhM/sNKXlaHJHS2cM5FmBhEHeoufBYuIzsmXUQE6SGwMgETJGggBlEX7hSETRYqAjOLk4m8WVnO MwfT1KijyXkyz2fQeCMvH/3oRzN5PPnkk3NEwFaDc3m+SIsBjRbHPih/+Id/2DTiFh/mT3/601mA F2nQonMk1TnrK8raFe+wwc/vhRhN5t5ST5/WyZxzzjl5TZbJxGDu+Xl23C0dLHnvfOc7sxatlUDX WB/tIYAJoS4Esu80Y+6Xp8WutFhcIxG+xuTaL33pS+nMamG9vqxe6ooA2bNLGPh68g7B58QTT6yf Htj3XseYceivzUDRfwth9CwJ3yzmw06DwKfx3eymn9XbT0Eh0tRllbaZZtY7SiArfcV6BQLPW9/6 1gkje5Z8Ce299pGSh8/SRgF87NEj8iflV7/7Ub/Gi3rdfe8F2360bVzH9zo+/ca833Nwva6dficD eGcJ+4R8Yw+3t8ZkLjKPfuxjH1sXldI1+pz7tMWng7IRITH/yp/Lm2AslIa9JvWzPvvDH/5wVkSa k5VlHjMH1OUcc5T3yTxqHPvABz6wLoJdKR+xt5Grdefabz4r+ZW2yNu7TbGCwFmPzfITaXwQGDvS 46VzSDpSs840CPho22j/CP60pITFXqw83dTNZMGSo8Ow8hQBEhFBgPjd04q7xkBQhOZuyujkWoOT 9hNmuea1Eo6RLxHtaDGQHpOziHy9pGHgTaNECysykMEUzhMlA5t3wD2FBDa7hy8vocdAaWJjOhcu mFAl0RobdGmWDZDqUtJk7pWHAZv1BMFCItQTcTC4eoeU5V028LKm0UghfVwHkLDG1FgfGrdPfepT ee8Qz0m+NOEmBhYspFf+yJB3wKa89cSy5DApwNNRsDe5Ka+eECmulsNKvY4x49JfG3GiHCEcIPTe C4FJKCQGNV40ll/+HgQ+je9mN/1Mvby/9sCxzpJSgqaWggc++gJByxihr3i3WdW905Re7RJrLsIj 7176SD3v0kZjjvroN1K/+lG/x4tS98lg24+2jev4Dp9BYd7PObg8x24+zSXIuT6jjYR+fcnRmC69 9NJMeFhBzQGuLWuCuPGTN7xD5igyxe23357nCfMKy5DAKywl5odeknmMhYeSTTkS5YYQ/crX/1lq /K4/IzvGB4o+Yyr5z/UlwR6RKYTP2kjjBAWgunofbTBMBiCvFbmq3B+f44HAWJEeTJwplKmREEfQ GhZLNtkQYk04OibiM8hFpQYMZMbBtQfJqXduoUtZe3QgHYkwMwghhrYTIdDhYa3dBqdmyaDk2RBu CAmHHXZYs8s6OjcKvDupmOfSbSIsGeSsBRMcgmXF85NXISSt9mfp5V7vwz//8z9nwoOgCpphk0kD NZcz77DnaXI666yz8oRCsCIUv/71r2/bPBMA66L3ThtYXyx4924iLPoIjTkNHsKlXd4bJLgkAg2N OUspskNQRdAQJW4L8qwnhKc+udR/6/f3XseYcemvzfDgzshKQXAwfrL+GbsQXSS4VX9ullev54aB Ty99BSYf+chHsmBjbIOJcYvfPowIJgQ4GmECjcNYTEPbyipMQCKoEeZ67SOd4NyvfjSo8WIy2Par bQXHTsftTq8r+frs5b0bFOb9nIPrbZzoO3Lgedu70BYXSIy5h7IWiWhUTiPw5gjygmsl1wkKZY7U /7wDFIPGZBhTTFx44YV5niGT2AJE/zr88MMnqt7Tfne/+ckcWAgPbxnWI2uHSv9XN3MVonP66adn BaG5070CStnAuSSeKVz0zK+sVeZcga6Kwsl53iHuQfiMH71E3i3lxedgEBgb0kMIFjVNp9LBbJRp cqINGEaikVcHSYcowQgGVbayaA50TppyE21dOFEHpEeHMoAgR/Ag4PQzqYOBSYdlnWgnfKpfsQLV v/dSn2Hj3UsdO72HNQ4unuOf/Mmf5D0LCoFFKgn+rQSobu9FXmiXCWcUA8KpI1nIR52km9yt6fFM ufh5xhaRsmBaj9Mq0Y4hTmWfGISnHgmMRg/BISwSrpEjk4mFmyV5N5TrkDxrWjXnlW3SG0WazBgz Lv21GW5wNZEjlLSkLHFnn312FsxN6BboFve3Zvf349ww8Om2r6gTIYq7qXVcXOPgAQuYlcSiTsCx 1wjcCDSOVokCarJ9pFXe9fP96EeDGi8mi20/2lbHapDfu33vBoW5NsKtX3NwM8wo6SgJCP0SUoI0 IAI8GvyOpKgDWeFtb3tbVrg09hfrY5Aj96qzda1cxc0TZW4s5ZtPWFXMM0iIecqciWRQwlGemeu6 SRQSFEDFwwL5oPAwFjbmZTxgqSF38mTh0cCag+CQuRA68ylZzeE7a7G5kdxWbzu5TVucd518I40X AkMjPV5mL5KXUfJC8H00eNIAe8EsmNaxmAs/+MEPZgFNh5koWXxvDQEBvl0iFB544IFZSKNlqCed w8suITxe3kGmspcFYVgHaTQPG1Scp0mBG9LDtIwI9SvxmzW4GViQS4OLMlslv1mf4lpChOt7TcPG u9d6dnKfwZLQaQEkTOrEtBXZKfl2e68+gvSYhGiVrAFYuHDhU4Q4ees3JhPXcMFzFIJC8GuV9FNh 0//rf/2v2dLa6Ham33gn9VHCJAHQ5IQk1UlXq/wHeX6QY8w49Nd22JnI7c1DGP/4xz+ex1PP23NH kE32BI52So12+U/02zDw6bavsDASoCh0CC/ee9aexuQdp1yiuSWcEb7qgkzj9fLzvk+FPjKo8WJQ 2DZiPQ5/d/veDQpzWPRzDm6GrXlZ/Y3pEjkN8XFI5BJ9Q2AgVhtjTqNgT6Yj51HASMYm/eXQQw99 GuHJF1T/GLf0PVYdVjIuyMZz7qa8Snj9dJooGin5zE3qr38vqoJSybuR8JQ8zZXmNGTNvIZ0kUsX V+sjkR7zqXMOCR7ybjZOmCN5XUQaTwSGRnpoez/5yU9mcgKK0plojIsAbELmT23yIdy3ekEbobQw lVaBe1G75MVVng7kJa8nGgm/SQjPIEmPSROJ0aG5BhnImq21EMkHDoRc1yN1/SA9Oi4hhd8sEzIB mtsT3NtZuDwfi9ff+MY3ZsF+MtrjYeJdf86D+E6Qgp2BvU54Oimrm3spCWivKAi4LRHkCGvtFAMm JPu26B+euXfOe26SaZYoBbgA8HluRdgM6twOWJII1rRf6mbx9SjToMaYUffXTjE1OVNKUEhQAlFo cLskQBBirPXRd5Hafk7Kw8Knm75C8OKOQ2AyjnKtaRzzG3GlzOnEs2Cq9JFBjReDxLbxmYzD3928 d4PCvODQzzm45Fn/JJdxY3Y0S2QH3gKsNhQp5IXG+QdRoKgtpIAlFaGZaH4wdxbrCeW3shAPeXVD eox37mFxUzfLAlhy28l0rqN4di3iI3F75U5YXNTU32HdD2sXCyDvDr83YtAMuzg3HggMjfRg7SZg R7NUtNK05V68RktMs3vKOYRBx2q1bqJch5UjDY3mVb+rn0OSXzMSkn/swz/FcoNs0L7SnDdLSJ/6 IkYmb8TnyCOPbEtMSj4GX9qO0lYDiPJoX5RP+LU2R+fVcU+s1lnAsF3npcknLPVDYBom3gWTQX0S qDyXiQb1ZuV3cy/LnAmFRVJ0Ls9rIuuK51kWZHofEBTvQSvSY+BHaFoRntIG5n2HVJQWvbS/5NeP z0GNMcPor/1ovzwI7RbXGjOMLeedd1666KKL8rhLWDWGIMDFKjnR+9NJvYaFTzd9pQQnoPU1hiLx xS2okza1u2aq9JFBjReDxLYd7qP6rZv3blCYl7b3cw4uedY/WUXM78gM4sPKpU2FBCEyiAgriiUI ZQ6o50HGM0+ROSRrlo1HnaSFldcCRZ5yHEhHsRh1cr9rXE8BVvq7T/WlnGmXyELuVa6E3FCol2Qc Qb4oHuGB9PAy4k1B2aTupcxyT3yOHwJDIz0IyfHHH5/NjF4qL5PB0xoCGjl/n3/++Zm4cNlpZ3Fo hBFh4s9O8GyXCIDybSbwGUyKqbJuhWiXX6+/6YCED6SGlceg0Cypr98dFvq5B1GZKLKQvAi3Qi/T 7pako2obQkQLYs3FCSeckN0+EK9GV6Zy3yA+h4n3IOpfz5Mm0NFL6uZek49BVipEppMy65ZLA7mj VX0pGzpROCDTZa0PEob4jDoNaowZRn/tJ3YIKyyMiyZpVkjjgMX6BBLvEcHlD/7gD/JvnVrUW9Vx WPh001esPXBIhLhW73urNrU7P1X6yKDGi0Fi2w73Uf3WzXs3KMyH1XYyAUs/hQk5jSKJUsPeNGWN jvnD3+QWypNGuQFRKvv9qTcL9ERW1tI+1zoK8ehlbiFLOkoegu9YK95M7ivl+uSypm3kLvfyiCAv lcQKddRRR+VlBkiVMkSENJZSLrFmsaSzhA1SaV7qE5+9ITA00uMlILxzAfJCEcAJ3hgy5sz1jR+o Ty45SEwhIRM1zSRkYGpcFzPRffXfddzSKWjCvdCDSAgH8sJywy92IrLB6kXDQGDh3uZeC251zHaJ VkMblCchGQgfVw+aFAOWTuyAnd+HmYaF9zDa5Fn0quHp5l4TqglFor2nTeukjxi4RZuSTCI0WpNN +kqZ7GjTi5V0svlO5v5BjDHD6q+TaXerez2jhZX2kSBjDDH2fuYzn8njLb99i3ZZ57ipTDSetCpj mPh001e84951/YP1a7LErlX7250fdR8Z1HgxDti2w73fv3Xz3g0K8363qVV+xnTusSyjJVGc8CpA XL7whS9kuY0LmfVyXLsI+/VErnOUpO91SgK4uBU5zP3mFkc3SdmUcMXS1A1xIps6PPPGehtHBG6Q r2ikZDhEqViWzLGitsFEBDdu5WWO7Kb+ce1gERiqpFsfPExGXm7mUWtDvDxeTov1sWZkoN7xBgvD Ey5tZT0GsoD4DCKVSGwEUaTHuoiylqhVeYgK83DRqOpk7SJwycfvQhkTdCTY0wBrowFIh9aJ6wNM vnBI/6jDMPAeUnOGUkxxNVAY7RLS02nSv7wDRZPW6X2trqv35TJRtLp2mOfr9erHGDOs/jpIjIog 49lToojmJ1KmdT72mnGulYvtRPUaV3yKltY4xyLZq1Jiova3+73+Lo6ijwxqvBgHbNvhPsrfBoX5 KNtknjY+cIHnbobsmE+sfeGlw7JR9w7wWyEcpd76QifJdfVrG//uJA99rZTvfnKPoxMFYcmfbEQZ 1OhVY00VHCjwWc95J7F8KhPhdZiXKajJX8iPvCKNDwJDJT2tmu2lYBbEnMvmlzqTjjYsCwQtRlmY P0hLT7HWwEIMeeFl6wNGM4yQMK6ABhOWHgvSJyI9BipkibZhHNOw8B7HtvdaJwO5wVXifmBQ7kaY K5MX17j1LfU6xgyrvw7jeSAAFvRyayOcmbBZ163v65X0jDM+RWCqC1HDwHlcyhjkeLG+Y9vqGQ8S 81ZlDuM8wsArxPYE9qniBkZOYjGm+LAOtKRG98+yfrcoOct1zT5dW7fsUNggLN0k91DmekfNj9Ys 29aBPNRpIndyiy3bLpT75El2EelNm4855phM/gSNIZfxYGIJFYGOcokbeDdeS6Wc+BwcAmNBejTP i2RhHLJjnY+wgawUolQNIxEEizDIXxN7N4B1I1ROVE9+rkgLS42kHEc3ydoegobNCCciS93kO+xr h4F3Y5sKYWg8P1X+JrgXrRH3RKSn/N1JG0xc3Wq8Osl3qlzT7RgzHfurMQPxsVcSpQvNLZ93faNb cjDO+LDuOESB4urSS/umynvdqp6DGi/GFdtxGN8HhXmrZzzM80iLoA7GDet7yEdkNcSnTnqKWxhS ZEyhtEWS2kVPK+2gjHGUxP22k/vK9T7r1l3lm/NYsxutNvV7uv2OWFk3WVyHrScXxt06ahZ05IfX Enc321kIPBRpPBAYG9Lj5eQLiZXrRMLy0kIOi/QYrPiyWvfCRKl8cd07jTrSyeMswQh0iCOOOCKv Z+rUvcxiQjsc0yAgTtybutFcdFK/YV4zDLwNdkVLxCWDFqkTbdMwceimLK6gJcCH9pjkS3S+bvJZ X6/tdoyZrv3VmIM0m7AXV64YyAt320797sv7M874EJQITEXzys+fMLQ+pUGNF+OC7TiO74PCfFze W2sDyWkEfBYZShNRQYXBL54yxhVKTet+JApk1xlzJko8WlxbXNHIZBN5tTTmqR4UXOZHxIxSp1vl cmOerf5mEVKWdeiIlbb/8z//cyaDxh5jJPJ7r9U7AABAAElEQVQTpKcVgsM/PzakR9MNGDqUl4eQ j/QgHnzRB510Mgv2+Grq0CxOrE39Ij06HwuNdTk6JSuWRXGdWpJoP4ScRXoc8prKpGfQeHtfEIJC Ciy4pvHtVms06Peum/wRnkJ6vA/IebFOdpPP+nxtp2PM+tBfCQUmbWSgKAc6fTfGHR/9vPR1/UR/ Wd9Iz6DGi3HBdhzH90Fh3mm/HPR1rHzW8FBGc+fics+yQRFr81GJBcSBDBljyDzkFZaWQmaa1dOY Ii/yje8SWbDbAFXmRGtvlO0QsVKQAYqdQSk9yXGe/aJqE1SBuUR1k1i4HJHGB4GZ41OVJ3b75Xoh gAEtAtKjswwrKZfbBwFAR/Hy0oT2I9FeGBhMwAIYKMugTbvayUGDgJTRerDyyGscwgRPBptB4q1e 8DVIS0ztjokSrYxjHBOyzM/YAKtfDLNvTAYPLlX6FM0Xa1uZ0CaTZ6/3wq6TMWY691eCgJD2XL9o Kb1T3a6dHHd8tKtongldjqmeuu1HgxovBoFtt23zLMdxfB8U5uPy7rKWIz3m7kIqyCK8c8paHIpi ClljimtYkrnEua5dQnhsxG5sch9vEEpo1p5ukvvKvo3qa86xp07ZdLSbvMq1yF3Zf2ii/X7UvSRu cI5I44PAWJEesGD2hBKuCYQ6xKd0pkHDRoPFssQHk4D2zW9+MwdWEGyg00QY+NjHPpbOOOOMp/im mnR1eh3CouG6D2wnedOQMC27j2uTvG644YZObh3bawaJt0bT6jM7G/hoekrY5laAWKB5+umnj62A ZDDn/ok0G4AN4kz3454IJ7Ts3n1EvYRRH1W9Oxljpkp/NTZSgpR1OZ1gSkPLF99zoBHtxVo47vhQ DplHCOhcTFjtJwrVjoxblG1cHSUxb/UMu+1HgxovBoFtt22D0TiO74PCvNU7MYrzrDhkEZaNMqaT R4qy0LM0TyEslExIAtLD7Qs5auxbftc/Tz311ExOCqmwNceiynLSLWlQpvIpsNXPwer04Q9/OJMq JKhZMjfx8PmzP/uzHOzlsssuW3cZOfQv//Ivkz0k/+Zv/iaPE43tIDN+97vfzYEe1MGhr/Qyvq4r OL70HYGxcm/TOi+4yQpTZyL0sonq5u9Bp9JZROQgVCIwZ555ZvZNFfEIGXJNs8R9gmXIpl1XXHFF 3ihVsAEDs05mULCxKIsN0kMY7zbBwGBjESFCKE8RVYaV+MUKdUtrsrDa/0M4RgNLr2lQeJf6GHwN vIRcA7IBTTQ7mu16Mnh5Zv/0T/+UFx6WPQYMluOUEF/Rc5Ad7RF9S1tOOumkCf2eLSZlZTRReSeH mQgCDmlxZTl1eC6jShONMVOpvxqjPv7xj2dXExEwX//61+cxphW2sDemEUIQUe9Tt2PIVMDHuqUD Dzwwt1M/EV6Wm8zRRx+9zuW1jpHtElxnHyNjxCmnnLLOPa5+3Si/d9uPBjVeDALbbtvmOYzj+D4o zMt71+85uOTbzSerPWsPzxMyj3mSEsU6aEpZSkYBD6zzoTDmYWH++cY3vpFlIPdR3Hl+FBFlbSDl jevIBaxFxjPyTi/JViA2EpU3JQZCUzx35Gn+IYuxRqmfepLPjKcwplhmYdIOz1TdyKOUIg4WKfmQ 5XiTaAdFEPJGXoUJ66Xfp/IyhF6wH/d7xo70AEyn0Kl0JKQHS29Hegipwq6ayDtJOptFdbSAjckL /Na3vjXvGfSpT30qa1DtG6TjIGN8Wb3ENKQ6hkhsOgErgZfeoj1+o/IvxEaHQlBoVmkgdAQdqduk bjoawmHNkzyZgosbR7f5dXu9AUQwBUK3uqjHZEiP8geBd2kXjGmLkFWbqiFsBN4Tqzj7BCADnnVS LHpnn312fn7WlNGe09gYvMctedaCYOgXBmGb+XoXCLsGclol7pLM8XyJvbcInQMe73nPe7I1c5jt 8p5YyGmyVA/vkL6HsHF9MNlYt2ciHFZqN8ZMtf5qwbCxT/8899xzs++8fmkTYjjTnBqXjFE2tfVJ uHjDG96Qw6k2GwfbPYepgg8BjOJJX9EP/v7v/z4LL4Qh/R/p4+Lnd2MAZQ6c9KNexud2mPXjt176 0aDGi35j20vbxnV8HxTm3qFBzMG9vJvGT4f1z5SGyAJ5xHhuLKdcO+644zKBsBcY2ceYo6/xuODJ Yz6gQEE6yHCIAsJj3KLIs3F9t8FVSlsQc/MkAvOJT3wiy3EUG+RE49dllRVH/1deqYPfi5WJbOC7 3yXXklUk461xg8VcO8kU8jDfIlfFAkTpYl52TaTxQWAsSY9Og2Awo4rmYWGbF7hRQ23Q81J6CbmT mfA7SUjJ+973vrx5VLPri/acMHDaaaflxXXMsgYcGikvv07l5bY4TmfRof2t3mLCm1hLhy1WGXVF eNoRuGb1KecI4SZkB02/QUYnHhbp0aG1kxnXZydrZErd2332G+96WcjnCSeckIUZZI37GksZ0mqw 8u4srrTfnqNnhvASypGecUzeIZroD33oQ1nDf8kll6wjoiYSh/fOIOx5eTfLQm6CsMF82El/UWe4 89tG1ITydL7U8b3vfe9QSU+7MWYq9VfvMY2qCdh4YJKHsbHSe+AdJ0x4v1mjCSWEDVrU97///Vkz Wyb2Tt+LqYKPcV5/JrzYQR3xIQBRYukn+gJhi7BC+WFcO+ywwzIZ/P/snQewFVWaxz/JGSRnHhkF REGCiIA55zzGmdEdnV1nampmd6amaqvW3draXasmO1EdddQx5wAqCiKCIoIgOSM5p0d+4J7fwY85 tH3zfe/dd+93qvr1fd2nT/h39+nvf75wdOxOF5OqyJfNe1RZ40W+sc2mb2BeiON7ZWFOf/P9DUam CN9/fqdD+DFNR9bBigLNBpNsyGpMAjO2Ui4TCz/+8Y+lXbt2flJRTbH5JtEPTUp2eB/ROjMxh7yX aDImrs0ciyau//a3v+3HQt5/xi3ayTvPeKjXUD+bypMQHOpnLNA8TJwyZjK+MjFCQv5Bw0MeLQP8 GHNZx+eHP/yhD8wV4htto/1f9QhUugSEio+HWffpdJGHjxl3XgAEUGayeZmipIfZYzQvfOQ5z5ZO opzwpYtew0OMIH7jjTf62QxmABEuESqidfBAM7uOwDzW2Z8OHz7cv+x8VCmHDykEBXM51KU4ADJg ZJtQ2zLYoF5Fw0TZvGCaFGfd6/F87FEH01dwyNYXIK4d+cQ7Wj4CHipqPtKYrowbN84/L/SBe8cG EcVUj3vIx5cVp0k8t2xxSc/RdrBO50Oh5eRyLWXQRmaRsBeGyLAwGs8CM1i0hz5BwNl41tCgYIuM vxoa1GjKpj16DWXxGwwSJdpDe3/60596fze0PQiZtJWPBe9xLu+EPuu6T9SO8HiiMQZsq/J9Dduk OGbSDyZfID0If8xe6jiFgB8msGbChnfh+uuv9/eDGVU+0Jmkqh7P9DnL5j2jX4xTCD70FW0v5idM FPFukHj+GKt5L9B8EYEKQS76PmfTDr2GevTe8juaNF+qPmb7HuV7vND25wtbysu2b4U4vtOfysI8 399gtBBYQ/A9hPyjGeV7mCpxv8Y6eQfZ7MUXX/TZkdeQmzTxXDO2Yyo6atQoP5GIZgjNPmSByQjy QJLQGhHRlu8EljS8k4kS8g95Madj3OMbyLsTTRxTOQ65i0lPxkj6ymQnFh28/4yh5GMyGrmTsQAM Ql8cJVCUg5k8GxorMNN+UAbXM4YwzmKiV4iTJ1GcSu3/E9xNr1THBWbR0ZBw83mo0tVKYDqGIMdL xYuO4MZAEiYeOMgEjDuTbjBQQkDChzosN/ytZkKYkWnEI2ZMedB5MTFhg0Sx58WgjQwImvi4IkTx ojPAgEGiGQy9JtWePoMpZVMeL76mbPHW65PtUVFzT6ifvlM3szj5TLninagtaD50loY9s1LUVVZW 5kkqQhH3h2MIjBAIjkGqGRSjCdLMPWXWh4EdMsoAnk7K5dqwfO4/Whz6wzvAQM5sGjNZmHDynPHu 8FHhN88pz340ZdMehF+eBWb5IF/gxAxZssQMH7jzjGIOwf+0Cfx4v9UcNFkZceeyfebjxhj6UJXv a9gfTCZ4r7kf0fc6zBf3m+cW7SvPABvPBOMVzwJjEveI54CNcY9jcYJCXNnhsaoez7J5NsP26m/K ARMwBh/GMO4/zxzvOVYFvCuMa+H4HV6f6fue7juSaR+zfY/yNV4oJrrPFVsth322fSuk8T3sT74x z/c3GLkJeYbvGCSA8QHhPZ3JEMYcxhgmsEjIAmzRCQPOqfkXmmYID/9zPd9Mvq9MeiEb8v7FXU8Z mhjTaC/fPORKxjMmdJIl6qJe3n/GSd593k8Sk0xMilIGMgBtSNR/MFKNOc9q2A/K4Hr6EZUDk7XN zlUtApVOenipIAh8YNMVChUCBgweVj5CqV4EvaYy97SHF0VnCHhZECJTtU37kQ0Gcf1RTDlH3eFH Ws/lq65o/fSF+0mdmd7PaFmp/s8W72Tlgg/3j4GTxEDFABcKgHq/Uj13PJvkjd6DZPXruVyu1TLC vfYLtb3OPNEvtvD5CK8Jf2fTnnRxCuvhN+3TduoHJ9U7FC0j/D+XZz6uD3osX++Qto82p3pWwIb8 vFvhMxn2N9Vv2s/HmI3yFGP22ZYZ1lnV+GTzbIbtDX+DLWM47z/l8n4gdKUzlmXTDsWqMsaSXN4j cGAc1PeQ/mcyXoSY6u9csNUydJ9t37Rf1T2+az/CvbYtV8x5psCnKr7BYfvz+RssNOVjTNKyMtlr G3KpPx9lZNJmy5s7ApVOenJvopVgCBgChoAhYAgYAoaAIWAIGAKGQPYI/MMOK/sy7EpDwBAwBAwB Q8AQMAQMAUPAEDAEChYBIz0Fe2usYYaAIWAIGAKGgCFgCBgChoAhkA8EjPTkA0UrwxAwBAwBQ8AQ MAQMAUPAEDAEChYBIz0Fe2usYYaAIWAIGAKGgCFgCBgChoAhkA8EjPTkA0UrwxAwBAwBQ8AQMAQM AUPAEDAEChYBIz0Fe2usYYaAIWAIGAKGgCFgCBgChoAhkA8EjPTkA0UrwxAwBAwBQ8AQMAQMAUPA EDAEChYBIz0Fe2usYYaAIWAIGAKGgCFgCBgChoAhkA8EjPTkA0UrwxAwBAwBQ8AQMAQMAUPAEDAE ChYBIz0Fe2usYYaAIWAIGAKGgCFgCBgChoAhkA8EjPTkA0UrwxAwBAwBQ8AQMAQMAUPAEDAEChYB Iz0Fe2usYYaAIWAIGAKGgCFgCBgChoAhkA8EjPTkA0UrwxAwBAwBQ8AQMAQMAUPAEDAEChYBIz0F e2usYYaAIWAIGAKGgCFgCBgChoAhkA8EjPTkA0UrwxAwBAwBQ8AQMAQMAUPAEDAEChYBIz0Fe2us YYaAIWAIGAKGgCFgCBgChoAhkA8EjPTkA0UrwxAwBAwBQ8AQMAQMAUPAEDAEChYBIz0Fe2usYYaA IWAIGAKGgCFgCBgChoAhkA8EjPTkA0UrwxAwBAwBQ8AQMAQMAUPAEDAEChYBIz0Fe2usYYaAIWAI GAKGgCFgCBgChoAhkA8EjPTkA0UrwxAwBAwBQ8AQMAQMAUPAEDAEChYBIz0Fe2usYYaAIWAIGAKG gCFgCBgChoAhkA8EjPTkA0UrwxAwBAwBQ8AQMAQMAUPAEDAEChYBIz0Fe2usYYaAIWAIGAKGgCFg CBgChoAhkA8EjPTkA0UrwxAwBAwBQ8AQMAQMAUPAEDAEChYBIz0Fe2usYYaAIWAIGAKGgCFgCBgC hoAhkA8EjPTkA0UrwxAwBAwBQ8AQMAQMAUPAEDAEChaBOgXbsgQN2717tzz77LMyefJkady4cYJc dtgQKCwE9u7dK2PGjJEbbrhBmjRpUliNs9YYAoZAySBw8OBBef/992Xq1KlywgknlEy/raM1GwGe 2/79+8uFF14obdq0qdmdsdZXGwI1jvSsWLFCVq9eLb1795aTTz652oCzig2BTBCYO3eufPnll7Jq 1So/cGdyreU1BAwBQyBfCKxdu1ZmzZolBw4ckH79+uWrWCvHEKhUBJjwXrx4sbRr107OP//8Sq3L Ci9eBGoc6WHGvG7dujJkyBAZPXp08d4Z61lRIcAzO2fOHNm3b19R9cs6YwgYAjULAcagw4cPy8CB A+WSSy6pWY231pYsAsuWLZPx48dLeXl5yWJgHc8dgRpHeugyKvl69eqZeVvu999KqCIE6tevb6Yk VYS1VWMIGALJEeAbinl4y5Ytk2e0s4ZAgSCwYcMGqVXL3NAL5HbU2GbYE1Rjb5013BAwBAwBQ8AQ MAQMAUPAEDAE0kHASE86KFkeQ8AQMAQMAUPAEDAEDAFDwBCosQgY6amxt84abggYAoaAIWAIGAKG gCFgCBgC6SBgpCcdlCyPIWAIGAKGgCFgCBgChoAhYAjUWASM9NTYW2cNNwQMAUPAEDAEDAFDwBAw BAyBdBCokdHb0umY5mFNn/nz58uuXbv0kO0NgSpH4PPPP5fly5dLnTp1hLWmUqUuXbr49XyaNm2a KqudNwQMAUOg0hDYtm2b/4auX7++0uqwgg2BVAisWbNGWO9ux44dUlFRkSq7dOjQwa/laBEKU0JV UhmKmvTwcjz55JOCwGkLmZbUc11wnT106JC0bt1atm/f7gWIZA3kuWWAv+qqq+SWW25JlrUozx05 ckS2bt3qw5O2atUqaR9ZswFMCb/bokWLYyFNEdS++uorH5K3pq46z3NAH+hXVfWBVc9JLAlQrKk6 cK3JWL7wwgvy7rvvSp8+fYr6uajJ96gU2s5iunxDGROZyE6W+N4+//zzct5558k//dM/Jctq50oM gaImPXzA9+/f7xdhK0XhscSe5YLvLoN1OsLrpk2b5JlnnhFWoC61hEZ26tSpHqeTTjpJPvvsM3n1 1Vf9R653795yxRVXyMiRI6Vhw4Z+oTomNSCIaMRYaPGmm26Sjh07euHs008/9STo9NNPT7qmFwRp 5syZ8vrrr/sFZNHGaRks5NirVy+54IIL5LTTTvP1pnNPNm7cKAiL48aN89fceeedcumll37jUmbP n332WXn77bd9vjvuuEOuvPJK3++HHnpIaNvdd9+ddAVyMHvllVfk5Zdf9s8Mdd16663fqCudA7SD WdTLL7/cayUTXbNz505/qnnz5sdlSXT8uEwZ/pNLmdFreZ7SxTXDZhZtdkgimufbbrtNWG/MkiFQ XQjwDSWl+o5CkP7yl7/4CbHqaqvVW5gIFDXpAXJmLNu2bSvdu3cvzDtgrTIEIgigtWBGq3bt2pEz xf0vs3MffPCBQPouvPBCjwFC1nvvvSezZ8+WoUOHypAhQ6RJkyYyZcoUmTBhgpSVlXkt7uTJk+UP f/iD1K1bV7773e9Ko0aNpF+/fvLGG2944gBZSoQn5bE6/TvvvOMJF4Tqnnvu8eTjqaeekr/+9a/+ 3L333is33HBDWoIfZKBBgwayaNEigThBmuLSiSee6AnZkiVLPGE5//zzfTY0WBwDCxXc467nGO2l D5jygtPZZ5+dKGvS419++aUnadQNdpDOuIRm7cUXXxTafu211x7Lkuj4sQxZ/MilzLhrM8E1i+YW 5SW8N2hcedd4pi0ZAoWOAKSHZzbRmF/o7bf2VR4CFsig8rC1kg0BQyADBKZNmyYzZszws8poWhCw 2rVr57Uu2GUz24ydNrN8mL8NHjxYfvSjH8m//Mu/yF133SUQDbREK1eu9Boeru3Ro4esWrXK24In agoTI+Rlg2Sx6jf1Dx8+XEaNGuW1SGiNIF8Qg3QSbccsDUKSLJGPjzMkLUynnnqqPPDAA362cuzY seGpb/yG6IEPxCeXRB8hk2zTp0+PLYpZ/6effloeeeQRWbdu3bE8iY4fy5DFj1zKTHRtJrhm0WS7 xBAwBAwBQ6CAESh6TU8BY29NMwQMga8RYFYev4G9e/fKgAEDjvnmcJrZOkzO1KQBs9VBgwZ5DUmn Tp18CWeddZa8//77smHDhmNmgZCXU045xQvxaHEwU0OLlihRvtZBHq6HEFE3Jl/8j6bgueee8+SM 42hwIEuUDyFiNhwtFf4PYULj89///d+yYMEC6du3r1x99dW+n5onrBdzPbDAaVeJDJo/SAamfl98 8YUnVBCmMWPG+I1ytAzM3WgjpnUQqhtvvNFrybSuuP2WLVtk4cKFwp7t448/lnPOOccTTc1P/Y89 9pg8+uijglneSy+95Mkn92vx4sXfOA42mCJy3fjx43354HnGGWfIueee60ltoj5hyhhXl5ZJW9Hu US9moGCK+SD7RO3Er3PPnj3fwJX+ce/efPNNWbp0qSeqlDPWkU2INgSKZ+uTTz7x/gQjRozwzwP4 QmzBl2OWDAFDwBAwBAobAdP0FPb9sdYZAiWBwJw5c7wpWNeuXb05arJOI+xDLtq3b38sG6QAAZ89 myY0IJhhzZo1ywc00ePp7A8fPuy1RJAQhFtMviBOmOEhBD/xxBNegEb7hA8PQjqC89q1a48rHkKH II6ZLTbpaEn++Mc/eoH9uIxf/0M/MM9AqMbfBwGfhKYJ8oDwDtmB4Om5ry8VgkCgMYMwUScEBb8n tF/JEmSM9lEuBI8y8H8JExolNGHgQsJkGJNDiEHcce4PWNBX2o1PFKQHM0RIIilRnxLVRZmQj//9 3//1ZUM4qPs3v/mNxxUTv0TX9u/fPxZXsPn973/vTfa4vxAu/LG4T2AMUQZXNGCYOv75z3+WefPm eXwff/xx+fvf/y6UYckQMAQMAUOgsBEw0lPY98daZwiUBAKQHsgFgjcalGQJzQ/Cc2ivvXnzZi+Y otlR7Q9lkAcSREAAZvHTSWiSMJP76U9/Kg8//LAnV//2b/8m119/vTd1g0Sh9UEDQKAUzOqaNWvm tVRoHSBFYUJoxqwK7Q7aCPK+9tpr8uGHH4bZjv3GJA6yhuaGOiBAtB/ihgYGQVw1EZjhRROkiMAt aFToC9hi4pcoob2CmHXr1s2THvBDMwXxoV5N9BuiAwGEWODzgzYEzOOOQ4bw0ULrBFEdNmyYJxTc Z8gOxCFRnxLVRZmQMQghBId7S7tpP+Z5hIVPdC3atyiukBnaiI8SbYTEYTZJ/yC1kDN+cx3PEvVg Mvmtb33L94f7j+bNSI8+JbY3BAwBQ6BwEUguXRRuu61lhoAhUCQIIDhiLoUAGo0Glk4X0Z7ggwK5 uOiii7zwGl5HZDcEezQf1AFhSZYgG5iVIfwS+Q3tE7P/aGBICL9KuMjLxv9aLv+HCYKGII6AXva1 hoqQqwjoBDmIS2EdnEcghwxBgtAu0B9IWDQUP22AtNBeBHUEdky6yJ8oIbRD1Ogr10DQCAABwSLc P2ZuJMiokk36yG81F4w7Tp1onFiXirIhXhAV7jfHIBCJ+pSsLsgW5BETR+4nxIy99jPZtVFcCRKh pBATNZ4/MOP+017uE/0AV73HEE19HtAyYZLJZskQMAQMAUOgsBEw0lPY98daZwgUPQIIngjACNDq w5JJp4lYhh8KUcuivjSUQ5kIwmhIqEfJS6I6yItQi2CNMI9gq4Qm0TXpHlfygokYvjcI6ukkyAHE AYGf/qKFIJjDD37wg2/469BWbS/kBELAFpfQBGEiB+nETA9CAkEDAwgPxAeNEfVnmiBoRJ+DUHGP MXVDk0d0PczUOnfunHafwrrRxuBHhcYHczP29BfyqyFtw/zJfkOY0BJi0gfZ4X6DGeVxj8CF82FS fMmXCt/wOvttCBgChoAhUL0IGOmpXvytdkOg5BFAwGZLJpwnAmnZsmXevAiSQrQ1CEo06Qw9gq36 o0TzhP8jyCLkZ6N1CstJ9ps2UX66JI82jXWmZGgUfvvb33pTLkzkMHOLanui9SYjAvjy4I9E+QQF IC/EpMxppMAWEzeCB0C4Mk0QPDYS9xaSQ9ADEgSDiHVgkGmf0Lxg3oZ5oIb4ThRtzleW5E+o+QED NtqaDLNocZnkjV5r/xsChoAhYAhUHQJGegKsmZFkdrIUF4UMYLCf1YwAM/jMQDOjjAlUqoSgz+x8 NOxxqusK5TyCL4I2pCQTMyEibjHLz6w/pkloiiA1vMcIswjWJMrEjAwzN7ZckwrKCLuqQeF3IuE3 PI5/DtoUtE2YScWRtLj2MSZhGgZpuP/+++XBBx/0/ib4KUU1EXHXxx2j7ZhvYdJ28cUXHzPZgzyi mYH04CeDtocgBPRbiUHYJ8qOO47vD0QHYse9QhvXpk0bjxltRutGvxL1Ka5M2vzWW2/5YAisrcR9 /+ijj3z9YR/jrg3P62/ug/qRofVio2/s6S/tBZ9kPlFalu2PklvuK8+PJUOguhDg/eUbyviazjeU d51vKP6WloobASM9wf2dOHGi/O1vf/MmJ/bwB8DYzypFgAEb/xNMbaLRueIaAknCFAuzIa6paQkt D6ZVkLY4cy8ISzRAAMI+mg5IBAuWIrzzG80FPjiqAQALzMggkJhUqeYhDiNwpwzaw+9ECSEe8kRe PqwEPYAccA2Eiy1M9In2I7BjLoVmhfV/zjzzTC+sQ/b0Or02eoxrGZ/A6KabbvKmYixeyjhFWzQ/ +fit+2i5YbsIVgCxQVNEgABNkEiCDrz99tu+HkgFfj3ko360YPQdXGkDz1yi4zj9cz8QPIgipxo9 CCkBEJL1Ka5M+oNGChLCeRaPpWyIJBsmjExcxV1LOxUnxQWirGaDXIfADmFCaMdUkmcLfCFCYMrG tengq3iW0p5JiIceesgHJYEwWjIEqgMBJr+YJGLcj0bTjGsPEzKMyaz3Zs9tHELFc8xIT3AvEUhw Nr755pu9EBacsp+GQJUhgIClM+kM2qkSi0UyaCOM1UTSQ/8IFYwADyHQhABKeOJJkyb5/mHOhKBM PsIEE3GLGTrV3iCIQmy+//3ve+FaywEbSBXXItBGE6QR0oJwr8SFunCUR+hlpj9MhK6GsHAN2CMg c78Q5IlMRmAA/GBIRBbjIwopI6wyjv09e/b0BJVyILczZ870wjrEiN9EE0N4BAs9RihphHJCWKM1 YazCv4fADfSJOjkOBkRFw/yLPVouiADnR48e7cc32sX/hI5mrZuxzmwO80BIDXiudOGXIZUIDpQH MUErdc899wjalfPOO88Tj9dff90TmssuuyzhceqEpBHmmXLAh+sJNY2WJVGf0BLF1YVGCjICkYJw kqiDPtJuBBzeg7hr0VZFcYUwQei4/pVXXvEkCjwhUPfee68nz9wD/KggWuABsUbbxL2EkHMvwJO1 ovh+lHICC97H22+/Pda/rpSxsb5XLQK8q6R0vqFEk2QShzHFSE/V3qeqru0E97H+qqorzaU+TC14 QDFrYIG7ZAknWmadMF+4++67k2X15x5z62zw0bzzzjuPC3ub8kLLYAhUIwL4eODngFN7uj4i1djc 2Kr54CAYMxP/ve99zxMNCAgfIYgB5xGEEb7RFnAMMhNNCFxlzh9FgxWQ7xe/+IXXTvz4xz/2JgzR a6L1cB6TO+rC5CFKJBkyKZeoX5AKSAx5IE8IzERPY0MAZAxC64C2h7wQI9qmZl8IzcxIQnAgGQjN aFroN9fqMTQxlMcGMUGwJy+aFLRXjFsq8EPS+HBTBmZk5Kcv1KnmdBA1hHhwpY+cg0zSfp4lxRds EBqoC6JBXyAIajIC1hBKrkt0nL6hnWHP/YFggQ+YoSmK6xP5EFriyqRfkDKeFcURDCEntJFj9Dl6 Lc8PGIW40n60Pdw7SBN40BewgLByr6gnGb6qqQzxjT5jhfQ/BPzll1/2JJcw6qkS7w8kkPcnmaaU ciiX8ik3la9ZqnrtvCFQVQjYc1tVSFd/Pabpqf57YC0wBEoeAYRMNAasizJjxgzvPI9QjOaGLZqi 2pfoef2f2XgEV8zdEHrjUrJ64vIrsWEyBcGc6zkWTUp+EIrVrIrf6mtEfkzF0FxEo85BWghSECYI LYQBIqSaJZ3FRHhnCxNkJFGC1KH5ikvUE9cmzQuB0rLDfic6Tl712aK9Yf/pT6I+kTeuTLBRjYrW H/2ftsZdC6ZRXMnL9TxTkDwS5FDLpr2Z4usLsT+GgCFgCBgCBYWAkZ6Cuh3WGEOgdBHAxI1ZfLQI +JvECaeZoAPhweRr5MiR3txJhdhMykiWNxTe4/JBcDTxO/xfj2eyR3tB0n0m1+Y7byIsEx2nzXHt 1mO6j2tnXJnRY9H/tZxEx/V8uIdkpdJkhPnttyFgCBgChkDNQuAfX+Wa1W5rrSFgCBQZApAIFsbE vAtzMEyzsrWvxpQK0zEIDyZPJswW2cNi3TEEDAFDwBAwBDJEwEhPhoBZdkPAEKg8BPCvwJRIo6hl WxPmWwQKgOyk0shkW4ddZwgYAoaAIWAIGAI1BwEjPTXnXllLDYGSQCAfpmCQHdPulMTjYp00BAwB Q8AQMATSQiB1PNy0irFMhoAhYAgYAoaAIWAIGAKGgCFgCBQmAkZ6CvO+WKsMAUPAEDAEDAFDwBAw BAwBQyBPCBjpyROQVowhYAjUDAQIS6yhiWtGi8Uv4slirYW2rBq+V2xxKZ84Z1tWsvbFtdmOGQKG gCFgCBQvAkZ6ivfeWs8MAUMgBoG3335b3nzzTb92Tszpaj/EwqFsmj777DP52c9+5hdtnTBhgh6u 1j0LrU6cOFFeeuklv5BpXGPSxTna31zKil67Zs0aefHFF2XSpEk+ml/0vP1vCBgChoAhUDoIGOkp nXttPTUESh4B1u0ZN26cXzl+yZIlBYcH2pznn39eQnJTXl4utHXBggXHkaHqavzu3bvl73//u7z/ /vvSs2dPH2I82pZ0cY7rb7ZlRa/jfxa27datm1/09plnnvGh0OPy2TFDwBAwBAyB4kfASE/x32Pr oSFgCHyNwKeffipTpkzx2/Tp0wsKlx07dsjTTz8tjzzyyHHaE9YueuCBB+Qvf/mLjB07tlrbfOTI EXn99dc9MevYsaNf9LVRo0bfaFM6OCfqb7SwdMqKXqP/EwL9tNNO8+s9Pfnkk77t9MGSIWAIGAKG QOkhYCGrS++eW48NgZJEYMuWLbJw4UJhz/bxxx/LOeecI126dDkOj3Xr1smrr74qX3zxhbRo0cKH vh4zZoywpTo3fvx4X0e9evXkjDPOkHPPPddfj3bkgw8+kKlTp3ofmPPPP1/atm3ryQOC+ahRo/y5 Rx99VNavX+/NxrZu3Sonn3yy107MnTtXmjRp4tvZunVrv0ebgpne0qVLpWHDhtK3b19PiugPhAJN zCeffOL9gEaMGOHN+dBy0acbb7xROEZK1iefIfhDXZit4VvUv39/X29w2v9MB2fqfOyxxyTa3wsu uMAvKKtlplMWeZP1AVIG8Xnrrbd8208//XTp1auXVmF7Q8AQMAQMgRJBwDQ9JXKjrZuGQKkjgHkY RAPyUlFRIdOmTRP8ZaLpvffeE8gLhIO8GzZs8ESGfInOrV27Vv74xz/66xCwIT1/+MMfvFkV10FK WCR1xowZXtD/29/+Jn/+85/l8ccf9+Z2q1evlvr168vhw4fJLt27d5ehQ4d6YoEzPmTl2WefPdaO lStXyu9//3vvr4IA37t3b3nhhRe8loj2QqTQaKDV+utf/+rrmjdvnicH1Il5GmWQEvXJn4z8QTv2 0UcfeRw7dOgQOXv033RwBou4/mKOFqZ0yiJ/qj506tTJtxnSWWgavrC/9tsQMAQMAUOg8hAw0lN5 2FrJhoAhUCAI4BeD/wj+HRAZhOBFixZ54rNt27ZjreT3rFmzvBYI8qDaE0y5Ep1D+EeL89xzz3mt zrBhwzwJwYkeYZxyWHC1efPmUqtWLd8OSM6QIUPk5z//uXzrW9+S4cOHe6KDFgZCcNJJJ3mtTZ8+ faRly5ZywgkneO0NBAgyQ3046LMAK+Ro8ODB/ronnnjCEy3K4LratWv7+nr06OHroW379+/3WixI T6I+0d9ogpCtWLFCaHvTpk2lWbNm0SySLs4nnnhibH9DrVu6ZaXTB9rKRp+XL19+jFx+owN2wBAw BAwBQ6BoETDSU7S31jpmCBgCigCmaocOHZIBAwYI5k34ySD8Y+L2+eefazZPItDKYB6GRuTXv/61 J0iYn0Ew4s6h2cH8DEIAMVi1apUnBpTPMbRAJIgLpIeEcD969Gi57bbb5KabbvIEAO0QJIV8/EZb A3nhGJsmop3NmTPH1wNJgkxBQjB/o+758+d78kFdXMceEoM2qFWrVl7DQvQ1tkR9or/RhIkeJneE j0ZLQxujKV2cIYGJ+qtlpltWOn2gvWy0nT5AqCwZAoaAIWAIlBYCRnpK635bbw2BkkMAQRdfHjQ7 K91M/65duwRNA4I3hAfis2/fPo8LpAZShKYFTQ2akz/96U/H/GbizuFov2nTJk+qICSQHMzovvvd 78p1110n6oMTAo8ZFxoiCAtEBHKTbkKzsXnzZm+ix3WQB4gNG6QLnyDOh0nPQ6jY0BaxJetveD2/ IQpKFsCOLUyZ4BxeF/c7k7LS6UPYXsgbmyVDwBAwBAyB0kLg+K9WafW9pHuLIzJOyQiCCAT9+vWT srKyksbEOl+cCOAXsnHjRi/sL1682DvhQ0p43pctW+ZN3HCgh9BACMaOHeu1IL/97W8FQvPaa695 Mzd8fOLOQWp00VCIROfOnb1GCTQhJXHRzTiGJiebFGp+QhKjbUinTM2bqr9hG9GUoFUhQa7oa5gy wTm8Lu53JmWl04ewvZDEOC1VXDvsmCFgCBgChkDxIGCkp3juZUY9YRab0Lgvv/yynyHGr+Cf//mf vR9ARgVVQmZmzXH4ZvYdf4WuXbtWQi1WZCkggGCOuRf+LRdffPExMzF8aNDKQHogNmh7MFPD5Auf Fczg7r//fnnwwQe9jwwTBPiCQBai54gwhmkZGxHV+L9NmzaeFKhGJqrtUc1LeA+UwCghCc+Fv9EM QdqYrEAjwsY17CFE1E1/MXVLldB4JOovbQ9JD1opNtpJIAjMBTVlijPtTNTfTMtKds+0D7SVjTrV JFDbbntDwBAwBAyB0kDASE9p3Odv9BJBcPLkyX7RQ05++OGHPrzuyJEjv5G3qg8gXOJPgfD4ox/9 yEhPVd+AIqoPTSbEBi1N6CTfrl07wamf8MuYoxGRjPDVBDiYOHGi187ga8M5FgbFCR4CwBo1aGnC c5jKYQ4HOefZZT0YCAnCO5qes846yyPK/2gcSJAU/of8aKJcTLUIVoAJHvWikVCCoYI77VAzO3yP CNCAMA+JI/ABARLw8dE6qIdr2UfL4lii/lJGmOgLvkEQOMzc9uzZc8x0L1OcuR+J+guJydc90z5Q Ju2FDGJaaJqe8M7ab0PAEDAESgMBIz2lcZ+P6yWCD47X+DkMHDjQC0f8j+NwSHoQ0BC8mAnH+RdB kbU9CKeb7ByV4cSNiQqRsJiBJqwuzuM6483MOcSLsjhPHbQFoRMBlLYgxBH9CrMahCTOZVsu7WZ2 2VLpIMAzRNhoyD1maTjy8xzxHODbwzOoZk8I/gj0d9xxhw9iQHhotDb4x0BoLrroIq9BgWTEnRs0 aJAn6YShpiw0qeedd55fDwfBG5Iwe/ZsT4q4A/gSzZw50xMUfS55/rkGEzzIFSQK7RNhtTHPQyvD NRArCBpR4V555RV56qmnPOnh3bj33nuFNYDIS31oeyA2vIusU8N7jgaVfoEP5ClRn9CIhAliRXt4 jxkP2IiGlw3O99xzj3/fo/2lPPDN1z3TPtBWfKG4T/SBvlgyBAwBQ8AQKC0EjPSU1v32vUWYQ1DB Pv/yyy/3TtgsEohAhHAFuUFQQkhiLRCEQ4gSM73f/va3BYEFYhJ37vvf/77PyzogrC5PeZTF7PSF F14od999txciEWp+97vfeSLDeer+zne+4wW9Z555xgul1EkZtPUHP/iBJz/ZlotAGRditwRvf8l0 GdIACbjlllt84AJ8bVSzwjNOoIErr7zSk26OQ8gh1izcSWQ1yAgaEo4T8hnNRKJzPN933XWXv45n HqIDyaI8tD68a5dccomccsopvj7MxBDwtT3cFLQQtOnss8/296jM+RwhtHOM9xSCRlvQVFDfzTff 7BdARSuEEH/rrbf6MjF/49256qqrvHkofaBszN6YZIDY0SYCKVBeoj4pGQsfGN6jM8880/s5MWlC qOxscKZu8Iz2l2O0NV/3TPuA5giSyBgE8bFkCBgChoAhUHoIGOkpvXvuNSyQDIQy1ixBeEHQ4Bgz wgiEmJaxoju+NTfccINcc8013vYfXwJmhhOdQ5iaMGGCXxARU50f//jHXuDTBRER9BAgKQNBBLMY THIwNdJFFhGq8OvBHIVV7ZnV7tmzp0yaNCnrciFslkoLAYgFJCMu4X/Dc8cWTZzj3YBkYCLGs6Pk hOOJziHI835AOMgfPnO8F5ADtkSJa9A2UQ5JtRGsFcQWTRAW3ls0pSQ0onoNdUOa2MKkZYfHkvUp zMdvsCEiHRMnaKt4NyFh2eBMeXH9pU9xKdt7hpaHtvbv39+3XU3e4uqwY4aAIWAIGALFi4CRnuK9 t7E9Q0BCc4IJDTPDCCvMhiJUsWI7xIdZbmaHIR2YybAxS4wpDHkhLInOcR1EifLR3Fx22WV+Vhli xXFIFUKIJmaev/e973mTHHwjmOllpvyTTz7xxAuzouuvv94LoIQPzrZcBEJLhkA6CKh2QPfhNXpM 9+E5fnM80blo3kT/K3FJdD48DlHSiGrh8Ux+a3t1n+xa2gZRRGM7fvx4b36KFioXLWom/U3UNm27 7jUfY9e7777rCSiaOMa5fNSn5dveEDAEDAFDoOYgYKSn5tyrvLQUXwaIDTPYEBT8BdDqIDhBRiBE 69atO0Zy0NqMGzfOa2TQCkGUCG8NAYo7h/CDGQn+Bfgl4NODkIFDOIQLUxxd64MOMcuMvw1aHk3M 6OJojADDbD0zvyzymGu5Wr7tDQFDIHsE0CLhF4OGB98gfGVyIT3ZtyT1lbQN7TLR+tAqWQCD1JhZ jpqDAEFM+F7z/eb5xrrCkiFgCCRGwEhPYmyK8gyEhw1n5jfeeEOmTJnitSgQH/WtIcAA65ZcffXV nvzgLI1z9l//+ldPZn74wx8mPIdmh3KYgYbIYKqmCRJDZKnQxCZc+0Pzxe0pszLKjavLjhkChkBy BHhvIROY8xWy5oT2oaVGGCzkdiZH284WKgIQDqwYINNMBmJyGiY9j0kl57M1reT7+9JLL3kTTUzN ea4xMX/ooYf8hCT/47/I5EM0X9ge+20IlDoCRnpK6AmA6EB4CEyAMy/+MjrziRaFtUogPOTBmRoN C46/zOriwPzHP/7R28ajdcGWP+7cqFGjvHYGgoIfDpohjaCE0IH5GluyBDmCNNFeNhIaH7Zcyk1W p50zBAyBzBDQ9zmzq6o2t818Vy3epVYb30oC8hBp9L777vOm2IoBPoFYOxBBkiiFnM+G9GCVgcUE QX2IzMg3lu8gk5aUz3cWX0EmIqL5IEOWDAFD4B8IGOn5BxZF/4tQt5iv4VSNRga7fMgFCT+aX/7y l0J0NPKwbg8DKOpz7OC5Fvt4Bm1MRn7961/HnmMtFAgVgzAzUajdIUysk0H4a0zk8NFJlpitYqNN aJcgWWieci03WZ12zhAwBAwBQ8AQyAQBIiVC/vFBxaoBH1QlNmh58GMlWA/fWzSO2STKZxISs1J8 YIlCiZk630UmEAk0RLRDJhcJQhTmy6Y+u8YQKGYEjPQU892N9A3SgZYHR+ShQ4f6wVOzMCCj0cF/ h3ys0g7peO655zwxgrQQfpfITazTgS9Q3DkCI0B8WAmdiG2sIYKPDjNTfCCwrSehzQk3bQd7zOJY 0JG1e9jwPSI0LpqlXMoN67DfhoAhYAgYAoZALgjwLWXtL4J6YObG5KCGRIfscAwzUCIHMsHIRCIb /q1858K162gH3+e49euwcmAikFD1fJcxS4f0oAWCXOEzSx4mGTUf5IeUam078iSq19a3Ax1LxYSA kZ5iupsp+oI524MPPujV4GHgAC5jgGSVeQIUYPLGQA3xYIaJAAfMKEFmUKUzk8VaPXHnIDjkZf0N VPoMxmiIOI4vD+GqSdgl83HABppyw0RezOLw/4HkkAdtEaQpl3LDOuy3IWAIGAKGgCGQCwJ8qyA0 WDZAcIhOyncNMgLpYcMcDQ0M/jfJ1q6jHYnWryOyKWvpYSnB9/KFF17wk5OQJ34TIIi17DC3+81v fuPz8Q2HAKVa2y5ZvXx3KcOSIVAsCBjpKZY7mUY/GHjR6KAuZ4smor8QkYmkZm8M5mha0MpAjPQ6 yEuic1yrDsTMZHE9JnXh9QzcqOlJWqb/5+v/aQdtja55kku5Wr7tDQFDwBAwBAyBXBHg2wXpQdtD aHSID36oTPTxm6UdOLdmzZqUa8zhk5No/bpVq1Z5LRKm5iNHjvREirXsMD/HegJfHyYVMUtH20S+ AwcOyKQ01rZLVq9qi3LFya43BAoFASM9hXInqqgdSmYSVRc9D1lhi0vJzpGfDwKDZqKBM0p2onWo +Vv0eK7lRsuz/w0BQ8AQMAQMgWwQYNkFiI+auOFvg98rpIfJPTY0QKnWmGPSUVN0/Tq0PJogNJiy YfpNsAQIz5VXXulN3zQPe7Q/6ayZl6xeCJElQ6CYEIiXZouph9YXQ8AQMARKCAE0q8wAY/tPKHp+ IwCxMQPN7DOzwORDk8qGzx0THkxQqFYW/wDMdzBnZcPMhYiOaFvRGvM/ExOWDIFSRkBN3DAng+iw QXowbcN3FquFadOmpb12HVhG168LJyMhIryPmKFznPcQEhRNmKVnsrZdXL3RMu1/Q6CmI2Ckp6bf QWu/IWAIlCQCBBfBiRmHZmaXMYHBjIbwuZAXojkhDOH8DIEhfDOEBaGJ86pJZY/2FOLDzDEbvyFF mOpQD755ODuzsDAmONSB34L65CHwlZWV+ehSECINhV+SN8Y6XVII8O6oidt7773nl37A14bJBkzb MAXXSYV01q4DPN5R3tlcEnVWR725tNmuNQQqGwEjPZWNsJVvCBgChkCOCEAwdPYYZ2UiPDGLi3CE 7xsbAhX2/cwCE0xEBScITqjBQZPDDDHCmu75TR1sCErsIT9ogUKNEMIc0aDYIEOQH2aUifY4c+ZM H3iEa/H3U0GQdsXNROcIiV1uCBQMAqGJ21tvveXbhc8q7wC+Njz/vFfZrl2XTUepszrqzaatdo0h UFUIGOmpKqStHkPAEDAEMkAAE7Rly5bJ9OnTfYh4TNXQrBA6niiL2OKjzUGTA8nRvZq9ZFBVVlkh RbQR8oPJnO4hZ2iGVjrtE6F10Q7R5mHDhvmIjPg4JPITzKohdpEhUM0I8O6h1UHjie8O6fLLL/ek h3e0OtaYq656q/lWWPWGQFIEjPQkhcdOGgKGgCFQdQigSWGdLKIusRYWxALzGDQ4aE8I244NPxuC VnWSB8ziIFtskDFNaIYgOupHRNh5TPDQBL3yyiteE0X4fELi0yfzC1LkbF9TEUBTSnjnAQMG+PeX d4L/0ezwjqazxhx9D01Ow/ciejz6v+IWHkfTm2u9Wq7tDYFiQcBIT7HcSeuHIWAI1FgE1q9f74nO Bx984P1oWPTwiiuu8KSA4AFskJxQECrUzmJKx7oibCRM5Ahdj48DpnAQoC+++ELeeecdb5ZH9ClI kOYv1H5ZuwyBZAjwzv7Xf/2XX8MOooNZJ+SHhKYz1Rpz5Eu0fl30OMER/ud//sdrVyFWmqL5ID65 1Kvl2t4QKBYEjPQUy520fhgChkCNQgAtDqYw48aNk9mzZ/uIaGPHjvWzwwg1aE8IPlDTEwKgEje0 VpgBEdWKIAz0Hx+IF1980ROfCy64wBO9mt5na3/pIcC7yrN90kkn+c6HEdf4nWqNOS5KtH5d9Dh1 MZGA/1xYTzQfZeZSL9dbMgSKCQEjPcV0N60vhoAhUPAI4NCMsI+gT0Q0ZoRvuukmH6aWyGdodEJB puA7lEEDMQMixC8b/g84eo8YMcKH+cWc7z//8z9l8ODB3h8CAc6SIVCTEOD5ZkuUOKeBRZLliTsX LTdRXdF8lJVLvXFtsWOGQE1FwEhPTb1z1m5DwBCocQjg3P/yyy/LnDlzPMm5/fbb/R6tTq4hamsa GJjqqRlcmQt3fdppp/modKwq/x//8R+C1uuiiy7yJnA1rW/WXkPAEDAEDIHCQ8BIT+HdE2uRIVDU CBw8dFh2lO+Tbbv2yM49+6R8LxHA9svBAwflsDuHyQYCcd36dZ15VwNnF19fmjVqIC2bNfJbowb1 ahw+RDebOHGiN+XC1Ovmm2/2Wg5CTduaNuJ9H1iFHrM+zIPw+SGYA8EPrrvuOm8OV1Nwco+vHHDB HPbsOyj7DhySQxVuvZSvjrjZdpE67rmuX7eONGrgnu369dz/tWrcs2wNNgQMAUOgpiJgpKem3jlr tyFQAxA47Ey5tuzYI8vXuAheqzbImg1bZefufVJn/z5pUr5LGu/aIfV375L6e8qljhMUax+ukBOc 0FjhhMODzhdke8NGsr9JM9nXrLnsdtu+hoRnbiAdWzeXbl3bSU+3dXC/G9Qr3KGMsNPPPvusXzx0 9OjRcuaZZ/q1O3AytnQ8Avgq4PcD+cHsj8AOjz76qNeMXXvttd4/4fgrqu8/yPnOPftlzaYdsmb9 VuejtFk2b9stOx3ZOVxxWBpUHJS6hw5KLee7VZu1jxzrOeKe60Puud5fp54cdvvG9epKq6YNXX9b SqeObaSr27c9sYnUrVO7+jpmNRsChoAhUKQIFK6kUKSAW7cMgWJHoMIJeas37pDZC1bJwmVrZd/m rdJm3ZfSdtVyGbJpg7Qo3ymNnEBYzxGcum6r47ba7ppaToh0S2S6TcTNi3sh8bBzAK6oXcdvB9ye bZcjPttatpUVXcpkWtce8lXrVlLWtb0M6l8mvbq0lcYFogkiUAFr7Dz33HM+xDRRlPr27WsLdabx AhD1Co0PPk5ExSLYw+9+9zu55ZZbpF+/fmmUUDlZ0FKu3rRd5i76UhYuXyd7tu6Q5ls3S8u1X0rL jeukbOd2abq3XOpXHJI6TrtTm+fZP9dH28PTfdiRH7ZDJ9SSvfUbyq6mLWRHqzYys1NXead9J/nK Rb3r1rGV9O/bVfqUtZcWTWp+MIvKuRtWqiFgCBgCmSFgpCczvCy3IWAIJEAAM7UvFq+WaZ8vkT3L V0nnJQtk6LKF0m7nVml6YJ80dhtkp74jORCcbBJXHapVR/atWyF7lsyW8noNZUuT5rKmc5mM7ztQ Knp0l1NO7i7DBvWUdi2bZVNFXq5hrZq3335b3njjDS+8s1Aha9JU57o6eelYFRZCMAd8nUaNGuU1 PKzx8+CDD8qNN97o1/ipwqbI5u3lMnPeCkfkV8qBL9dK56ULZPDyxdJm1zZpdnCfNHSLtDaoOOCf bch87TSeb57lilq1PZHfX6eu7JvdQPbUrS/bGzWVdR26yId9+sv4bmXSrWcXGX5qL+nRyZlC1jUN UFXed6vLEDAEigsBIz3FdT+tN4ZAlSOwZ/9BmTVvpUydsUBqzZkrJ30xQ7ptWC2t9+6SZgf2OmHw kNfe5KNhaIHqHamQegcrpLkTNkW2S9n2jdJv02rZNn+mrHMaoAUnnSYPDRwkJw/uJ6OG9PPmQvmo O90yiM72zDPPeA0PIZgR0vHdiYuqlE6ZrHODKRWEKdsy0qmnMvMsWrTIF4+mK9NEgAdCATdv3lx+ 9atfyS9+8QtfBIubVnbasG2XfPTZYlk0e5E0nz9PBs+bJZ23Om3l/j2eyDc4fChrAs+zXPfIYb81 OXRAZF+5784hR4TK3fO8c9Fs2eS0QMvL+siL/U+VZv37yZhh/aRf945Gfir7xlv5hoAhUJQIGOkp yttqnTIEKh+BI04QX/rlRpkwdZ7smfKxnDJrmvRev0raOrLTyAlx2WpzMm15PSc4tnQCI1vnXVul 16Y1smrOkbc5gAAAQABJREFUdJk9Z6g8tmCEjBx5igwZ0N05jtfNtOiM82PShoYH0kPoZQgP62Rk kw4ePOjLev/99+WA0yQMHz7cL1jKAp8kfF5qSpoyZYpvajakhwshfGjK7rvvPvn73/8ur7/+uidB p5xySqVAQBCC6XOWyvSpc6TZZ5/KmLmfSdftm6Tl3t3S0GkrISyVlSBCJzpSxdbJPc89t6yTDQs/ l8Wf9pa3Zg+XT0eeLueNOFm6dWhVWU2wcg0BQ8AQKEoEjPQU5W21ThkClYvAgUMVMm3WEvl4wsfS ZeqHcu6CmdJp9zZPdipTIEzVqwbOtKjj7u3Ses9uJ6RulLnLF8pHS0bJhsvOlfNGDqh0/4hPPvlE WG8GsnPuuedmTXjoJ+GtFy5c6H1YTj/9dO8XhMZn/PjxArm68847/Xo3RIbbvXu3P9+0aVNB0wRJ 2rdvn8/Huj+sDQJZ4lyrVq2EIApokDi2f/9+vwgq1xJIwDvo79zpj6Nd4ZgmzPai5Wh9tImyiLzX okULX86OHTt8nVzD8VwSWi6CHHznO9/xpJLQ32iB8PnJZ/pywzZ596O5sv3dSTJs5kfSZ8MqaeXI DmaZVZ0gQK0cmYcAdXamdD1XL5fPnFndcyvOklHnDJXTB/SwoAdVfVOsPkPAEKixCBjpqbG3zhpu CFQPAkRkm/jpQvn4uXFy+ieTZcSqBU4oK68yzU46vcYErpMjPy2WzpETd26TCTt3yc4DFXLl6IHS unmTdIrIOM/q1avlvffe80QEHx7WoMklQRKUYBDOGSLx+eefy+TJkz3J6dSpkyc38+bN89VACjCn Q/sBIfjoo4+kZ8+e3idm48aNsmDBAtm1a5cPpnDhhRfK1KlTfVQ0iAn+M7feeqsMGzZM3n33Xfn4 4489gYEgXXbZZZ54kY9zYTnXXHONv5b6ZsyY4ckUQQhox/bt231bIVyffvqpUGeuiT527NjRa7we f/xxTwCJ9NasWX78txav3CDvvjdD6jpiefGsqdJ952av2cm13blej9a0uTMVPXnzamn/yQ6Zunmj vLxmo2y86jy57Mz+Fvo6V4DtekPAECgJBIz0lMRttk4aAvlBgOhVEz9dILOefkNGfjRBRqxdIk0P 7s+scKc9kL5udr5rF+fH4Pxy5s4X+fJLcaqBzMpJI3djZ2Y3aOMqqTPtXfnAEaG3XUStC0cPktYt 8kt80HYQXrm8vFwgPBCUXBOk5rzzzhMc+H/+858LIZtPPfVUT1rQ0nTo0EFYyBPtx8iRI+XNN9/0 WibM6VatWuXDPl999dXen4g8kCEWRV2xYoUnRJs2bZKBAwd6AgVhg6xwHdqlzp07y4ABA7wZ2bRp 0zzpQWN0xhlnHFcO+cm7Zs0ar9W66qqr5MUXX/TXQUYwZxs6dKjHJVc89HqIDyQQnx5M/yBokKxc 0/LVm+XFSbOlwRtvyWUzJ3mNIRHY8pYcftKsqYjTzMmu3VkVS3va7tkpZy+eKfXKd8vn7vluVPsE 7+vD+j+WDAFDwBAwBBIjYKNkYmzsjCFgCEQQ+GLxl7Jg3Ady6ieTZOSaxQKpyCidOkjkjlvFrczp LnMkx5knyabNIo/9TWTc2+LssTIqLp3MmCUN2LpO6n38nkysdYJMa9ZYLjxzYF6dwZcuXSpshFMm 1DKCea4J0y1IBqTinXfe8QI+5maqQUI7Qz0QCxz90fgsX75c0Mg0adLEkx3ag6kbmha2DRs2+Gsg TJAe2qz+MtSzZMkSWbx4seBPRF5IHHWSMF9j0dCwnL179/pzECaCNQwaNMhruygH8kX9ELVu3bp5 jZDPnIc/tBlsaA8LmGL+x6Kv2aaNbn2dyR9/IS1ffUUu/OwD6Vy+LTPNZTpEfshgkcsuFpk8RcQR q1xScxcJcfSaRdJw6lcyt2E9ada4gQwf1Mvd21xKtWsNAUPAEChuBIz0FPf9td4ZAnlDYLtbVHTe /JXSevo0GblqYeaEh5Y0cbPdS5eLsyES2ezIDoLgjdeLXH6pyJKlIosW5629YUGYu/XZtl42ffGZ LJ3SS5a69XxO7tkxzJLT71mzZnlSgPCdr0VH8dUhQWowc8OXhz0+N2yQInxsdjr/G/7HdI09vjmQ AszKIEUQEEzSevfu7YMfoMmhHK7HfK2/I6CcU/8dyAMmZGeffbYnKoSNJsWVQ30kTPGok/rYKBtt FL5G+BZBntAU5TNh0gbJwtxv7ty5wsKv2STMNT+b60KgvzZOLpj9kXTJlPCkS+RbOPLYs4e4lyib Zn7jGiK+DVu9WLbPaCnz+vWRzp1aS+c2uWsYv1GRHTAEDAFDoEgQMNJTRTcSsxLs6jExYcE9S/lF AF8HnKiZVUbgyjZlWw6z4KRcnbWzbXdVXLdkxTo58NHHMnTlIr82SVZ1upDWstARGyegO3WCyPoN R7U+vXqKdGj/D9LjFhx1agKRdm3FScwi8xeIrFmbkwkcUd5OXb9CVroFQxcMP036dm8vtZ22JN0E sYFYnHbaacf5kKDtwMwL0gB5yFcikMFrr73mTceoAw0SBGWzI4tvvfWW1KtXz5OSl156yUd5Q/OD 3wykBeKhCa0P2h/GIAgR+dDqrF+/3pMFyExZWZn3k8EMDj8gTNoweaOssWPH+n1cOVpHWB/lUw4m fizMigkepIvADvlOjKeYt0HksiU96zbvlPXzHAZL50u3nVsy0/DQoWoi8lTtzTdXLpQJH0yWBf3K qoz04NvFM3/++ed7LR5tsWQIGAKGQKEjYKSnCu4QwjgfCcxMsG9nZpJFCwlBi5MwM8Pbtm3zq44j ZFx8sTOBSJGYBaY8Zk9znVnGjAW/Adpw5ZVXesEqRfUFdxqn7S1btviZ7FxITzblQHhwqqb+O+64 o2hJLVGt6ixaKD12bMr+/kN2wnTwkFtt1JEft5aPHPo6OtYZw0Vu/ZZI2zZHfR/cO+FUBiKPPi4y 8YPw6ox/tziwR9ps2Sjb1m2S7bv2Od+e9LUPkJ5HHnnERwu74YYbfIAASATkAY0LZCGXZy/aGUI0 4yNDQADINNoXzNIuuugib86GpoP6eO7QqtAW8mBqhv8Pmh4SvkE8l7zfHCMaG30h/50uAhz5J06c 6E3FIFaXXHKJnzygT5yjzETlMIHDGBTWx280QNTFGEfb+R/zt3wntFCQTfqGVok+ZZq+XLNZvpo9 R3psXufXzMn0ekmXyGvBJzii3b1M5CRH6t0YLvMcoXdjcLapiyNqzVatdEVsk30HDlVJaHZI7B/+ 8Ad54YUX/PNyxRVXeOKcbR/sOkPAEDAEqgIBIz1VgPKyZcv8bC327XyUmVllphaHYoQYnJCZyWUm lhnYdBKRl7BnZ6YNZ+RsE+F1cTzGTh+h5Mwzz8y2qGq9DhMfBB/VuGTbmGzKYWYbDRNmPNkIXdm2 Va+jz5DqtWvXHiPAOvOue/LyO/q/Hk+1/8qtTLKuvJ6cvWtndmZtVBCXejpzH6cVkBUridF8NEe5 M+t6+11xqlGn5XG/T+orcvNNImeNEpn5uTh7rriS0jpGFKyme3bJ9OmfyEPbVkqzeq5nDhdSqj1O 87Nnz/bvKaGpR4wYIZAfzLp4BvIt1PMsMWYQJIG2UQcJXxk1OeNYly5dPKnQ8+ThmCY0QmhecP6n HDbGGwRXxiGIE+VRF4ny6Uu03rhytI6wvvA3wQxIiq3mz9ceQoWPE+PY73//e/9bTe50T136O7rn 3KotFdLL+UK1Lc/yuUqHyFMRyd0LuewSkTFniWusSKOGIstXHCX0n3x6NE+Gf9FgNnORCt92Y8C8 WZOkrrgJBJe0r+FvjkGSWSwWX6jpTuup+aJ7vY5vA6QaDaNqsonUh/8Y3zBMCwmiAVnmmbFkCBgC hkChImCkpwruDB8YBFNs8/lo4CRcVlbmbfEJcUuUJD4WHOfjoomPEI7GmG9gVsMsLAse8tFiAURM sfgQ8bHhOLOyOCFjmoIWCP8CzD/QNOksaFQox2QF4oSGiXam+mip+Rf94DezwMzmqhCmbcdJGsGQ DyPraJCHOvjQ0jbai4YKwQuigcC10gm9nKPflA0h5DoEJ/5PdE7rZA+hZMPMiFlocEcgIg0ZMuTY R5v/OUf9tJN+UxfHuAe0k4hU0f7RL4QA7gsz7ThT0z+uYVPhLl2caEeuiTZDgJm91/p1Hy070XHy JTrnj7vZ6XZ9RsiYw19lbv4TbYT+f6LzPzh7jEjDBkeduzd+rUFy2Moy5/ezf5/IEeczsnWbyChH xhGg8YvIgfRQ9RGnVZrn8Jo98TU5tHuLtiZ5/10u9U/hWeG54fng3cRJn3eT9y/fCexV0AzLDgkO eRLdO70mmof37U6n5aFPnENbEprdciyu3mg5Wn6iPfkrOzGOzJ8/3xN/CGhcUoE+7lzLssHS63At aeQWHc1LiiPyWjChtfc77c4bLpDBnC9EBp8mcu3VIhe66HNLlombudGcGe3ru3dlpStv1obFcmDX 5m9cG/af8YJvDfeXiIPhueiFnOP7QSJQht5PjjHecZ7JFsZF3gnGy2zNDKN12/+GgCFgCOQbgfgv RL5rKfHysI3nIxHOBJc50gMBUVKjs6whVJjBPf/8816YwuH40Ucf9cI/M8x8tNiYsYUMkPiAYTaH AINghvkBZgfM5EKSsPePrpVBOxDaIE9opFIlzL9YkwMyhZA3YcIEb9vNgoFq2oPTMu2GgJEPDQz+ TJAe7Psx16G/CCsI6pAU+qdl45yMPwD9R5i5++67k54LCRcfXwRRNFaY6n3pQiGDCX3EtDBMEE5W d+c+0DbaTVsgPAgGlBv2D3Md2sh5TIYgNvgS3H777Z4IQUbxucB8SPuSDKewLbn8RgBmJp8+qtAX CjL8jv5PfXosutdzxx8/QQ416iSHVq+Xg7VqC7PLOSX3TMpllx7V3rw3UWTSB87E7WvCz96RCBk9 ymmBuh+dER/QX+Tz2eJspnKqlov31q0vR5o0lTZftZSvmtT9Bg7koe/H9/8oSWbyQRMCILijaUUL wjNTUxLPKJqfYkjcJ95NND6MKSqYR/f0NXqM/+u797/CmToecs91g8NHtSRZ45KIyGuBBKf44EOR l189St7xU8PMrf/JImXdsiY9FXXqSnPn/zaoXX2pXeEmC1yK9lWPQXQxyWTcYxzTlCg/4zjfE520 Iz8TZGh4ID46/mDWqMEstEzbGwKGgCFQSAgY6anku4EghJDPBwUyoomP9DnnnOMFcoRvhO4w4XiM OQ2zcXe6GVm0Cq+++qo3r4EwIGhBeHAORqMD8YH08NG55ZZbfFG/+93vvPDNAoKsY4HPQTQhJGSS 0MpAdiiPjyBEjA8gfkFljkCR+KhCoLD1h2QhEOoseNR8jLyQIggc5/Qa+oifESZ/EJ9k58KZRdoA DhAT1jjhWspHI6MfddrIPQFf2nbXXXcduzeQJs5BmGhD2D9IBYQT7LkfU6ZM8eF56Wu0X/yfCifa kY/EMzJ27Fi57bbbPH6UqQJ7tPxMj4dlfbZgnex+9lVZ/+VC6bZ7a7To9P+HuFzkZravv0bks5ki zzx/VJujJbioYXKLM2dj1huiQ2qan3V1DtSuIzuatZRzrr7KrW3SS2qd4DRJLiXCJTwHQf7zn//s nyPWiLn++uv9Yp6QXQh6SIh8ofanShBgsgITYfwjNZx3tOLw3Y+em79ii+x+ebxsciGgm+48qtWI 5knr/2REXgtAa4LZphsffHLPjmMgLmiHM+HE3C2LdNh9W3Y0aS7DnMb/3DNPkrpu3Z5oCvvPRBvm sL169fJa/vBc3HX4sfF9+e53v+tJJXk4RjmQJr4vjPOMl0xq8T2wZAgYAoZAISJgpKeS7wozYXww EK6ZXQ0T/jujRo3yEZoQoMOE5oWwshAVPibMpiFsQwIQypmlgyCgPUIrguC90pmHYeYEASEh8GPS hY0+2hPVAoT1JPrNtU8//bQnWWg8br75Zv+BJD82+7SFDx6/IWgIHpoQPIhwhZPr//3f/x0TDvV8 sj2YoC2hbF17BC0RKdk5LRMTHcgYphiYW7CH2KFxCRP4giMffswL1ZQHXHEgJ3+0fwgHbJjLqYYK QRcBOC6lwinummyO0SaeAWbuMVesrFS/aSsZv3qTzFu6QLo40nPUwyTD2jA/Ov88kdscMSeK29+e dFHZ1sA6jhaEidjQIUd9HZ4YJzLDmSY2dn3i/rGwY45pcauOUj7oVBk8pL8MOqWPu5/pF4g/D4t9 MtEwbNgw/3yAN+8bgQAw86mqBEljXOHeZzJxEV7Hb3wy0NBmqvUJy8mk/nzjgwYd0sl7D/FhnM00 tWjrgsis3iKL57lgBjs3SwaPxD+qSkXkNSfPuT7rHHMaFP8/+yy1p6vde7mrrIf06dtDTnahq3km kiUCVKBZx3w4nWiD5AVntJqqzccUmO8P3y/GW74RfF90HE1Wv50zBAwBQ6C6EHASiKXKRICPAB8D PhpsYeLcmDFjvFZCSQ8CNwmhAi0RH7DQfp9rEn1YED4QwL/1LRf5yiUIFx8s7Kz1Y+VPpPEHgnHj jTd6jQ7louXQRH+UQNEW2of5gybqws8IQQphkMhmRJsjKp32Jcyv17EPywYD8mt/k53TMshDUAHI H2Zt1Es7Qn8F8mrZCElaflhGXP8gd8z248uBpgtfHmY2KSsuhe2NwynumkI+1tGtAdJ9UD9ZdOow me8iRg3YtDrz5o4aKXL3d45e5+6R99FhnRMwJHz1ju0u7rejU+65dVKVc/x2msixjlQOO92RpNxm kDc2aiafdDtJGp8xTAb06pwR4aHBRE3j/eJZQuDTxDsG6URLiFYxqrXVfJnuEU6ZeGBWHjKOdhHC haBJ0AzeLepiPZ1oYhaeBKkPE0Rfr4PY4/9H+9MhPWGZYTlx9Yd1VuZvwiYzriJ4Z0N4aFuH1s2l vSMMK3v0lVWb10iZIz4ZJTfmJCXyYWFMfKHxh5w57ba7geJmrkT2uEmjHV9rf8L8KX5jajqrYw85 cuZI6d+bZzo54UlRXNqn0a5DMpng0rEy7YstoyFgCBgC1YSAkZ5KBh5hF7M2bKjRCqA9CBMzZGOd aRIaCWykNXoa2hmuw1SADzuCFoI8RAYBhVllBB/MqEiUg/BCHTj+o2VQ7QtaDfJDZNjSSQhYaEAQ 6DP9kFIv1xCsAEHkoYcekpVOC0VCeCO4AXhg2kYUoJAM4ifDMTBB24TZG23GdybROV9w8AdNEVhg HseMPFqp6IcZDRmz9PjwQGJoF21iU2IWFOl/onkjPzOkCJ4Io2Hbo/mL7f+6dWrLkIE9ZNM5Z8lr O8vl4OdTZPCmVZl1E/+F006VE/B/6dD+mB+PJ45PPSPy+N9EpkwV9/CJ/PQnzg5xh8hKV4d7hp1q 4yg5yqxGn3tb/UbyRnfnX3bRxXLVmadIi6bHa13TKTJKnPUaTFUJZDBp0iT/jjKRkY/EpMe6dev8 mEGUOEgHPmY8cwQfgbQwIYHGh2eTdvDc8z8LmXI9/mYc5z3if8YjvY7/GT94VyFs5OO9p3zeATTT ukAq/2uZdzpzWyY2tBz6yrjD+8z1vEtMatAO6qA86oUYZjqWpMIRjStjIu94tonn+vRTesqGc8+W 97dslksXfirt9v7DdytluamIfBiOGrJ81RWO5OwVmfaxI/POz3C42/BpI3hHBsnF9JMJ3frLrDEX yvnDBkqHNv8wn86gmKyyJjIjzKowu8gQMAQMgSpCwEhPJQPNRx5NC+ZnkA+EI44hROgePxF8UBCo VThHeEAzgpbk3nvv9eQBAYd1O9RZno/9/fff78vGv4D8TzzxhNx3333HzJwwx0FAIZAB56Okh1nf p556yteP4IQQgY02fkEQtKiQom3W4+x1UygphxlqTPEQfCBkmNeRICGYh/3whz/02iOEpbKysmP1 4KeEHw3+SGBE+8EMYS/ROcoN2wV2mMZpUAfIWzRBKNHWUBdBGPC/wWSD2XWEvbj+QZQwNxw3bpwn ZAiJCHfaf72n0fbo/5ov2paa9H/L5o2dtmGoPF1+QB6pOEH2LawnI9ctceJXmun1N0XcmihfuXt7 XEJZhnnYATf7Pf1Tt26JM2ns4gg6GkScvd1z5iRocSzguMvS+Wdzw6byZs9Tpfyaa+Xyq86WHp3a HLu/6VyfTh7MOYnqRwhgNI2h/14618flUW0k7yETCJgiYY7GBAmEg/eI549nlvEF8yOeYUgGPkaQ ENqB9olreHaZVIHYqwkqpAcfOCYYSNRD4p2FWLE4KgkTWy2TCRWtn/K5lnMknnHeK84T8IQJDMYt 3i/GHyYL8pXAAhNW8InzV8yknvZO2zP6/OHy2u698srBCrl62Uxpu293ekWkIvKsL+XGQa/NXOW0 o1+5ZxqfttucRt6NITJzlsgrDmd3v9JN+PF81LmvzB17oYy6dLQMPrlM6jhiWZMT3wtbwLuw7yCT GCQmMSwZAjURASM9VXDX1AwKUoNZwOWXX+4FeCUgCOksHojjPVoEEgI00cbQ2jDbi3CDIIL5GxoK BKCf/OQnXoPDRx/hQ/13EGpUeO/utEIMUFwXN1MNgbrnnnt8e1TIQsuUyEQH3x7K1pk+HFgRZCB2 mrgecgbBIXFOzfYgPz/72c+8HwQmQhAM9tpvCApmdbSZPiHIqZ9KsnNhuxC8ICj0DcKkbdX2sad8 ghvQNvBVjCCS/NZrwv4huGE6qKGtmbnW2XWIa4hL2B7qC8vh/5qawBYB8YYrRsk7zRrJe+80kYOf 1ZMRaxZLw4pDqbsFgWFLlsr3iCxYKLJ4ydFc7p540sN/CUwJ44pDMFzUqpNM6DNYal9wrlxwxRjp 07WtEw4jhCvu4gyP8bzwXLDuDQQAp3qwymdCg8I7jGYSPxbecyYYIBUQEczMaAfvMeZePMuQsWef fdaPI0wg8LxqdELaRht5J6+77jo/ScA5fd84Tx0kzFW1TJ51xiPOMabx/vKeYu7Eei2QMcYA2qlj AWuB4ROVL9KD5ooAMEyqYHKYqfmu71Twp7Z7Jnp1aStX33CevFu/rjz3agO5dMlM6Z6OqVsqIu/G S5+mfeLCUi912k0nOBJ6ncV33SSP12Suczin+WzvqVNPPnJmmjNHnSenXn6OnDm4jzRp5MxAa3CC qKM5537mYwHvfC7ezeTBO++8I6+//rqfUOAZJtAN71y2iYkGfF55j/kG8m279NJL/TsWlslkH/Vi 1orckGxMYRKAiQZM5fmGMclA9FbkhnwkCE8pLMKdD6ysjMJFwEhPFdwbZkkRrlc6Ey9mXZUg6ADG nmN6XJuEkI2goXb5DGSaGCgR6DnP9ZAkEgSLWU8lMHoc4UPr0zLYc5wt3aS+PVqWkhX9n3JoW7Td ep4+0W4wIelx3UMAEcJoU6g5IW+yc2G7EMiY+UYYY8ZZMaCMMCHcQYy0LeALbiRtT7R/3CMlj2F+ LVevC9vDuWg5mr8m7uljJ2dKc9UFw5w/QWuZ0bGDLPx4qoxZMVd6b9uQ3ar2USC4D5AdTWkKhJp9 g/PfmVQ2QJYNOl36nnOGDBs5SDq2bVEphIc6ecYg+ZhuInQwoQHhyHdCKCTxjpGY8OB5RGOLuSvC GM+eknaeO34zCcBzjrY5TLwjvGuYh2E+C4lSkzby6fvABISWyTuAORyJmXmEP953DTwCBvi/8a5T L++zEhR/UR7+IDSivcKUMB1n/HSqxMytZyfnkH/12TK5SUN5/r0OMnTepzJ0zVJpcugo7rHlpEPk udAJuA7go+SG8Zrx3I1VXoMZW/DxB11OWXZie5nQc5DscURv1MVnyaCTukmTxg2Oz1gD/2O8hiTz jELuIdO5LOCdr8W7gZJ2QMgg9XyDIEBMcH3ve9/zz3g2cNM/3kUIO+8g7wfvFFYd+u3ACoLlF9C2 YiZOlNaojKB1886+9NJLXvOpPr1YjWAdka/EGFedi3Dnqx9WTmkjYKSnCu4/gxozvzj/IkSoYJxu 1SHZCa+hnLhzcccyrTOsJ/wdLSf6v+bluJrq6THdcy7uOoREZtUgI9E+JDtHuWF5fJAQ9jCzUUKj dcftw7rCcqLl6rXJ8muedMrRvDVxT/9atmgiZ5zezwn4bWXOwN7y8uRPpeXCeTLShbTu48hPwwpn qlaFqcItoLq2SQuZ1rWfLO3eT9qfMUQuOmuw9OzWTpo3beTCU+dX8xLtGs8ts6sIM08++aQnQgj8 +Ur49ODfh1CElpGEgDh27FhPPPC5QdjjPOOMbryHaHiizyTXQ5QQrtCc8O4h2JCf4/jmQV5U86Pl sdcE+eJ9w0yO45TFnnbxnlAW9cbVrWVkun/uuee8uSvvN33PNoBBXL21Xf+7dWgpl14xWub27iqf Tegps2Z8JiNXzpeBG1ZK41yfacUOssOWRjri8FvlIrR9WHayrDnpFOkxZpice8Yg6dqhlTR0Wqli SPiuokmAPPPc8DyWlSVfwJvnjHci18W7eTd49tl4btk0EZkRs1UsLjAh51mDnLF2EeQ+ajqd7qLU vDNMJKA1hbTznqEhZV05JT1gwvuE5os9JD8R6eH9gzgyyUDAFTBkggQNKDjFLVpOv2kvZaNpQ+uE TyDyCm1iMoV7QrtIWJKgPWbjfeYc5qXh4t5MIjKGJKoPYhe3aLniTXtoN23mN99xNOjgn0k/wBXt syVDIIqAkZ4oIpXwPwMEs6AMFpiiWIpHAH8DBlIG3WhKdi6al8EcM0IG37iyovnt/+wRaNSgnvTu 2k7atmwq/U7tK0u+WCLjPpol45xA0HfjlzJw3XLpWr5N6rn7WhkJZ+5NjZrK/LZdZU77MtnVpat0 GzpIzj+9v5Q5c6VWjpgxg19ViY80izTik4YZJ75rCCHZJJ5fhBFMxhCA+B8tKcK+kgmOIzBh2qIm sNSF8MMMNWMP50NtbkhAKJOZa7Q8XI8fD/kxq0HIonzMbsMyH3vsMT/rTDlolWkLs8z4DVIeppyY x0br8YXk+OeZZ57xCx+DKSY/Sv5yLPa4yyE+bVo2k+FD+jmz3PayaMQgmfLhDJk4f4EMWLtcBq9d Ju1doIPaX6VHWo4rPIN/dtVrIAudeeaMTr1ka/ee0m3EaXKRC1hQ1tktU+BMS2lnsaRsFvDGjDQf i3ejHWWyIG4BbzSZTABgQaGaTky1IVuq7QzvQSaLUvOu8K1CmIe08Dt8nvFx4nt40003eU0T/2PC yvsWTWigeMfRMjNe8H5oWQRYUf9W3nFdtJx+014wZHKQsQUCBJnDhA/TOO5LuLg3BBByBLkhcml0 cW9IIUQxrj7e10SLlmt/FD8mi2g/9xifQRYoJ9BTXLlx/cinhkvbZvviQOCbb09x9KvgegHZMcKT /LYwcCdKyc5Fr+Fjoh+o6Dn7P/8I1Kp1gpzYrLE0cyZBXdq3lIFDTpZ1azfLyi8Wy7NzFkjFhk3S aedW6b5lnXR2oa477NkhTZ25UDZ6l/2168imhs1kbdOWsrJ1B1lxYls52LKVtD/JrWd12snSucyZ HzqBtYVrT726VUd2FFWePYgAwURYwBEbe2zqmSUNSYDmT7ZHCCL6GiQCYQJhB8GG8hBeIFeQIiZT dJYaczcSQg8TLZiYca1qa3gvuI6y+X3rrbd6EoVwhdYGgY5Z9rC9Spi0TN5FJXeUQ78IgEA7mCVn Npp6tR7aw+9cEm3ChI8gIvji4TNY2e84hL6HIxhtWzWTfv17uFn4DbJkxlx5ePZCabRpg/TevFb6 uBDXXXdvS27+lmbHD9WqLRsdgV/W0pmLtu0i61q2k2Y9u0nvEafKWX27uehsJ3qyU5UkPs2m55SN Zw8rCJ4jtB+aeLYSLeANMc/X4t1MqPHOMpnAPky8V7SP51mTmpbGCdaQF/JSFlqrcHHrMqe5ChMa D53M4B3DLE3rh1BBrHjXwYDopZARNL2aJyyLyT0iPNLWP/3pT37Cg7ED825MQRk7oouW02/ai1zC u41Gif5CMtCy0Ad+Y5KP5oT7Q37+h/jELe5NPYnqQ/OiZuc6poW40h/Kpy+ch4jpAuWE1sffMN1+ KOELMbLfhgAIGOmx58AQMATyggAzzy2cGRmmZF2ciVC/vl1l54UjZdv23bJx9QZZsWSlzFi5RnZt cQKOM2FoWXFAWhzYK4337ZVG+/ZIPUeE6ny9QGOFEwAPO4Kzr0EjKW/YSHY1aCxb6zaQA3XrSePm TaVllw7SuleZjOre2QkGLaR5s4ae6DSqX89pG7KhU3mBwBeCaQnmIdj8Q3oefvhhP/uJEAEBSTdB oBCU2KKJOtSRGgLEbDH5lVgpOeI6jmtCkNTrOIYpDUSH67k2vJ7z+j+/o2WGZkCc0zaQlxTWE/4+ ejb9v8w+o0liFpiZbgS0fDlnp2oF/W/aqIELFNBAWKeqb+8ustX50mxYt0XWLlwuby5cJjvWb/LP cPu9O6XNzm3SqnyHNOe5ds9zw8OH3DN9RGpzj1xZh929OFCrjuypW1/K3bbdRRbc0vxE2dCspWxp 4LSSLdyMfS9HcE7uLYO7dZQ2rZtJy+ZNfKCCYtLshLhDljFp4t1QQqHn8Y1D64Bfi65lxzlMSPE/ gwAgHPOM45eGNgQCxbOJ8IzGEwEYYXul86lFoxldvBvywnvAhAFCdZh4z3iuaaMm/uc4fjn//u// ftwC3uThWactlMdvCJouH6FlsIcE8DzTLszBQnIF2aCd9APyQ//4H20HWMUtHI42Cp8gfI8gC4w7 aFeS9VvbwaQF7aWf+BBDxtjQ9kKKIE9hAn9wji7unQxnTO0wU0+1aDn3HE0S7VE/QdqRST/Cttpv QyBE4Pg3PDxjvw0BQ8AQyAIBKEeDenWlQau60s7Nkh9ys+V73cKJe0YMlL373CK9Byvc/oCUu7V+ 9u4ql33le6R8j9NYuHDVhysOHRWenfBRxwlB9Ro2kBMbN5SOTnPTuAWCTENp5Mpu6GbhGzlBtHFD p0F1Gp1QOM+iyXm/hPaUObLC7CpOykRgwv4dvwCO5zOFpCYsN9HxMA+/aWsUv+j/ek2iMuPK0Guy 3UPmEPLw4YH4oN1By4OGJ1H7sq0r1XX+mXb+Mx0c8SF6YQ9nOrl7QA/33J4p5XsPuBlq5/+0cavs 3OjIkNv2bdsh+91aPIfcM11RcdhFqT5KKiHkdd3zW889uw2bNZHGbVpJ0/Zt5OR2reTE1idKM/d8 N3aR2Jo6rSnPdmVEGkzV16o+D4GAbKC1ZAsT5+IW8IZ4QBJ4DsJnkvxscQnhPW7xbgg7kwFs0YSG lOeQ50+T/kYgRzBnMoOyIU6Yf9EXJU+0hfZRRjRByHieIfG/+tWvvG8SBI/nG/IG6YCEQHYgTpiw cpxr4hYOp060rEwI0BdID+QpWb9pE2STPCTKgLAxVqFVRavDeIVPTZh0goNro3gnqg8CiNlrdxdR Fq1tuGh5WHaIn9ZDHYnK5f6Rwn6E5dlvQyBEwEhPiEYN+s2AT4oOONqFVOc1XzHuS7nvhXg/Mcdp 7oQ4Nk2HDx+Rg04YPOS2CvcsVxz+So44HwmEQ9JRYeaoQIPgV9d99DBX43dVC7za5kz3CDsICwQx 4YOP78wDDzzgwz+PdQ74anKWabmlkJ9ZfOz3md1nNpm1w5jRj5rDVAcWPH+YvrFB6hHMeJb3Hzjk lplyWouDh6TCOapXVByRw+555ryGfnCXSm33hxDZddx7UQ8C5MiUnySoW8cfr44+VWedfMMwayME OoQCIhEmhHjeF2b7dQFvBF2ugRjkung3GgiCE7ChZWDThBYUQR3yQJABNFEQD95dtCMQF+5vtmMS An6ZIxVoQPCRoWy0V2hMIGi33XabL5s6WE+PvmL6RgCFsF4WH8f/COxoE+agtImyOQ6ujEWMQ6p1 ShTmnbLxByTMfKaLe4NbokXSCd5Am8ANghIuWq54s8e0LrpAOVHjIH6Z9CMs034bAoqAkR5FooD3 0TUHEOrDePkMwKi8UeczGxI9ryGWC7GLul4BQg6qfGbL+MARnpOBMdNUk/qead+KKT9CX0O2Iok+ lezeaJQmBA5s09H6oP3RtayiJj3Jyir2cwg2jAk4lfP+szYJvgYIcgiIhZgQ5Oo7wsJmKXMEwA8N BYI+ZlM41HOMSQPd41MSLuCNXxmREvOxeDfrV2H2hmaDMkPSwzeJNaoec8E7MFflmaStrMOma9nR Rk3aXj3GXjfNwz7MB+nDhw6Cz+LgBE7ge47pWxgdDhLEmlsQP45rHZQHyYGoEJCBhGYJnx3W/oFM xi1aTr/DdvgL3R/6hT8Skw7IFGEbND8mg2i4oot7E3QBDOPqg+zQfogd/YPMxkW3xNwwukA55Itx Mq7cRP3Q/tjeEAgRsFE6RKNAfzOQMSgTWQnVMx+DMF4+tu7Jzhdot3yzsItm5ooBnRkiZvN++ctf +g8NH5ZMBcIoNoXcd2tb6SCAsIRZBwIFQh1mMHzAIUAI9gg9paz5YdKDcYz1UJi4wMwHTBBAEbws FTcCmS7gzTgPGUZ7kevi3Qjy+qxFJwij9ZAX0sNzGWdlke6i1LzzkBolWJCMf/3Xf/Uhpnne8fdR sy298/jqlDnNTRjsQc8RWATCQR4IBaSQCUTwob2UBflB28I3lbGIvkTbS3n0i/Yha0BMlNxxTvNz HDM7yg4X96Yd1BlXH0RJJ3ooi2vRpEUTJCu6QDn94R7FlZuoH9Fy7X9DAASM9FThc4A6OlH8elS6 2DMz4PCbAYH49Mx8MuvJMWbBmHVixgRbXzZmx5KdZ0BIVi+EI1ncfOChbgZSyuE3A1u+YuczCDMY MpPHwM/sFMLgJBdmE7MWyFAcZtg30/a49QQQmsCGvpP4P7qeAIIn0XCYeadvaJZw1oyz66YehFQc Shl8Gez5SDNjhbqd+0Y0G/rAxySuvXHl+sbZn5JCAIGF2U0+9kxcMLOL2QqOyURpwn8hKngVK0DM RmMyhNkfa60g7DGugA8CG7Ps+g4XKwbWr6MIYLrIN2+lc+pPdwFvTB35ZvCdIIUkBMGeMZ7zPEOQ FxLjNuZjfMs4pscRptEmxj1vWg/fGpJe4/+J/OG5JWk5fCvD//0/7g99DY9re/U87dEy9BjfyTjC w3lM1cCB70+0b2hIE/U72l6tizGINpDCdoT5+aZFF/fW6xPVF71fYdl6Ld9YxgDqB2vNA0aJyg3b peXY3hCIQ8BITxwqlXQMs41kceaJ9ITgzSDLOhnY7yJgo7pmQ+2LgE7SePkISsnOMyhBauLqTSdu PnVVdux8BjZmwhFy2BD8IA6E6UQwims7WiEi+sStJ4B5ADPH9J2BElOi6HoCaM8gMXxEqCNcu4A+ a4Iw0X9MK7CXhvTRLsKBcjxc44D7k+wea5m2L20EeN55fhFiEMAgy/gMTJ8+3T/TCC6819j5k6fY Ej4GjElMbDChwKw2a20g0CAMIvSooFNsfbf+xCMA4c12Ae+Q7ISl8wzFnYs7xnWpnrlkZEfrjZYR /T9RvnTqTydPor5xbdy5RO1LVFdc/rhyk9WXzEw11SLkycrlnCVDIBUCRnpSIZSn88SfRyDmhU8U Lx+yg50ssyEa3x8VOGpmBGpIChoJZnU0Xj7q8WTnmTVLVC/CBpoiPjiJ4ubT/aqOnc8MDzihzUEl H4cZanY0LJAQMENopK8IkBzjN4SFsJrR9QToD9qkuHLRNKG618SHjjLBGGEMu2tIFLhRDj5UusYB HwScP9MpV8u3fekigLAA+cF8hHeRdxvNB6QaMs0YwOwtxxEGmH1NR/AqNETRurLIISu7M1mD0zXv OGYsEB3GMP5n/LNUmggwdtoC3qV578Ne8/3lu41MYskQqAwEjPRUBqoxZWL+hOo+0ToBXIKjM8I1 GgV+Y9rGAID2g0EA9Xt05hdBIdn5ZPVCnhCmUsXNp20IJlUVOx/NFR9BoswQrjMOMzQ0CIRx6wlA ejTFrScAYUETFFcu5DJMtIMNgQ1TJHyQMGnD7I6EsIq5IfeMclPd47Bs+20IgADPl2o5y5zNPtpe NCCQA54pSPaTTz7p332IAsIh5kBq/lFoKGKyymQFExG6oX3FpI8JHSYJ0OjQfiYSEs0UF1q/rD2V iwATSGyWShcBxgNLhkBlImCkpzLRjZTNgI6wzMrLJGZAmenl409CQ8BGQhBgVhfTq1xTonohVswy Y06TLG4+9YdtU5th2piobO0TZmuZfsjQ8KDFgVAw8x2HGUITBDHb9QRStVsxh3hiGkc4UzRKzEwT WhQMSNH+pVuulm97QyBEADt5JjfY8CFgUgKtJeQdEoTGBDNYJgMw3eQdwZ4dssR7jBMxz2RVJcgM 7eKdZcMkl43JGp28IYIU76tqtRBsdJyrqnZaPYaAIWAIGAKGgJGeKnoGMJnio59NnHmEGIQLzKni UrLzyepNN24+daI9qezY+Wh20KiwGCFCHzbehLhMhBmz3tmsJ4AQSd8RMBESIX+J1i5AI4R2B4dU /IeILgUhi0vJsE60JkJcOXbMEAAB3mslQGg1dQzgfYCMo8XFPwbSgRaS/9FUohXGFE6dkVnsUDVJ EA7OUzbEg3eAjQkWiArvBRu/8R/cvXu3f//Y847w7kC4qBdtFHkok2efiQ6IGu8J/3McjSx7CBoa LUuGgCFgCBgChkB1IWCkp4qQR+hIFL8+Ls68mlWxR+BBK3T//fd7cxfCOXIcQSXVeQSORPWmGzcf iBCmKiN2PsIXTs0IbQhKCElocJgdxhQmUdvBDC0VeaLrCYTYUF50PQFi/uMoPnnyZLnvvvuOhQqm TLbQbwKhE2dz1nDAVAcBEe0bdYT1gFGqexyWS35LhkC6CKBVJaQ1GxoUNI0QDtbw0o13lN+QIiZI 2CAomMhxDtLExnWMJxAb9jzPlMfzTD1sSojQXEJY2DClhTAxeYOGiXeLZ55jeo7fSqrS7ZvlMwQK EQGic0LuMTdlAiEuMUHAd4TvwujRo+Oy1OhjjBEkxgQmPpnwI+pkdBIv2TkFoNix0n7avrARMNJT RfcHgTeTOPMEFmDGFLMQrv3JT37iZ3QReBA0NF6+zuImOo+AgnDCLGw0Tj/+QenEzQeiyoqdD7nB VwhBDEELgQntCwSI/5NhBi5x6wmE2DBYx60nAC6s8xDFBMEvTGCNOSKhdPkAgBkfOK4nwAEDOfeA lOoeh+Xab0MgFwR4ThE82HgWNUFgeCYRTnin2PCRg9xwnL0SHSU77DXxDLOFBIjnXUkQkxQQIepl z7noO6Nl2d4QqG4EMLnEHJQANHwLmES74oor/PcF02kmszBX5j2B3DDpxbeO9wetPsf5ThAMCN9X tKmayHvNNdd4s07IEabPfLuKJfG9CxdBJ1op/WcSNkp6kp1TPMCf+1GMWGkfbV/4CBjpqcJ7xGwp A2PcOgHROPPR+P7RNQfC/Ageqc4nqhdNCYMYiUEpkQCDxqgyYufzkUj2oUiGGW1WEx5+a9tDbDjO 7DjECudvEv0kQVbi7oU/+fUfyoR46kwf16o/j+bTevk/VXv1GtsbApWBAIQFMsJmyRAoZQTQer70 0kve71P9aCHvaD3Rfj788MNeE0pUVMZt/EOJnMh3gvP4cfKbiS9dRBttDt8XxnxMOfkeYB7NdQTG SfYtq2n3grEkXAQdzbFGRY32Jdk5zUt5xYqV9tH2hY+AkZ5quEcqdIdVh4Izx+P+D6/L9Dxlhtfz P4ly+BAkS4UQOz+u7drmOCz0XLiPKyPuWHiN/g7zRevTPOE+zB8et9+GgCFgCBgClY8AgjjkBRNl IgYyJqO5QVvJYsArXTTVG264wS8FwTeQcMmcIx9RQdF0MCnI/2hJ0fKj3UcTROIavgXkGT9+vMyb N0/OP//84zqWaGFrCAAmYZiiolVCg0LZBCNJZ3FrrqUvTMDxO7pgOGvQseAv5TMhiim7Rn6lTdEF ydH+Ro9hPq6aYf3moTVmPTH8CJkMxAJCJwS147QpUR+SYaXX294QqEwEkku7lVmzlV1jELDY+TXm VllDDQFDwBAwBBwCWCdg1o1p25tvvumJD4I/QUDwz+QcJuTkI4XrRBElETICYdIEAUB7RFAPrCvI DyGiHDSrmG3hM4fWiARpSrSwNZYHuSxuzbWY7WF9QZ/wK6JPd999tydfrPNF+zB9xRcXYvTtb3/b t5tzkBLM+dDcLF++3BOe8Bh9gfToIui0l0Q9JAiP1nnXXXf5Y/on2QLdibDSa21vCFQ2AkZ6Khvh IihfPwpF0BXrgiFgCBgChkAJIIB/KJocyMef/vQnH+nz9ttv92vOsWg1ZmoI9tFEfs6j3cAfVhPE AQ0HxzB7u+6663zQHUgOJnAQBQiVkh60OYkWtoZEoImCLGWzuDXX0j98f2nLK6+8IgRemDp1qo+A Chm78847PaF79dVXZfbs2X5D04L2S69Fs6UasfCYEkDOhSZtmIPjB4z2SOuEbGkif6LF0Jk8hYTF YaXX294QqGwEjPRUNsJWviFgCBgChoAhYAhUKQKQFnxZ7733Xhk5cqQX0vHjgShwTgN6QBDCxHE1 g1MCw3l8eAiCgA8sgjtBhUiURT5Mv9AChf64nEu0sDXX5rK4ddyC4XPnzvULb0NOIEMQL6KhQogg bJCw6ILkaIuix4hwGpdYYBjzPvrOIsmY9EH2NGGmh9lgooW/CVAUh5Veb3tDoLIRMNJT2Qhb+cch wCwaiQ8NM2eYEFgIzOMgsn8MAUPAEDAE8oAAfjeYYiFsY5KmwQvQ8Kxbt84TgTK3sG+Y+DZxHd8m Nk0EvkHgxywsmsiH309IoFItbE0ZGg1Ry0PzE7cYN2Zh0UQb2Uj40UBw2PjGQrb4rYl2sRF17ZJL LjluQfJrr732G8cw4yPSXTQpNhzXOsM+czxVH+Kw4jpLhkBVIPCPt6IqarM6ShoBBmNCYP7iF7/w s0PYJb/99tvHFgYNwUl2TvMx2BICk5CjrEdiyRAwBAwBQ8AQAAE0GzNnzvTfGsgBmhjIAI73LIWA hoLobps3b/a+OHxHMA/jO4UJG0I9gQBSJfx4yId5WGgOpwtb43OD7xCkKSRR0XIhZph/oWkiChyh stHS/D97dwJtV1HmC7ySmzkhIQkzBMIogoAiCihoAEUQFUXFWVHR1rbb1a39XG9Yb73uZfdbb/V6 3ba27djOiijPAScGUZFRQEBmZEoYwhwSMs95+7e1wubkjPeee3POvV+t7Oxz965dw7/2rvr+9X31 FdJW6yLasyYNbRiOoDAxUz8aG2XgiOH+++8v86N1kSYnCTYYhgHHBjReiBFtTe012pp6gZkczZU8 ebuTJ41TDq3q0Air/HycA4HhRiA0PcONcKS/FQEdbLjA3ApH/AgEAoFAIBAYJgQI5L/4xS9KIiML +1FZV7JgwYJyGwNEhYMDm1ubQOO04B3veEepPUE0rH1BiKxfoZHhtcwm2rZAQBKsF7JGCLnhBhtR yR7S5NdsY2v3pWFMdBaYzDXbjLuquRFfnrUbhjNfQ5BMLjLry5ok63CsI1JWnuuYuzHhQ1KQli99 6UvPusbkTaiWMZfz3HPPTZ/5zGfKsuf1Pb/61a/Kv63/bVaHRliVmcV/gcAIIBCkZwRA7ocszBqF C8x+aKkoYyAQCAQCgUArBKyteetb31qu5zG2Ecg5L0BOkBxmXdauWIeCECEA7rtnLRDNj/157M1T 3URbvggAssBkjtczmhTPZHMzcZCYRhtbu1/dRNvfSE2zzbjFqQamdm95y1vK8tLuWB+kjjRE6sh8 L9fLWhxkTd1qNyRHzpC7vI4H4RNfqJbRb4SGJgx5yXlKN8ejqXKdOV69jb8bYVWtV/wOBIYTgSA9 w4luH6UdLjD7qLGiqIFAIBAIBAJNEaDx4HSAWVdef1LVlhDQHYiB+whBDpwAEP6ZefFehkQ4aoNn mZbJi2lZNSBG0sj72EhfPjkgWELWoPhtkX+jjcTdrwYEp96G4Tyv8dJW3XQ8Pyf92nvyt8apGj+X qVpGvx3q4BAn41mNhwjWq0MzrHL54hwIDDcCQXqGG+E+ST9cYPZJQ0UxA4FAIBAIBNpGoEpm6j2U BffqPetzXvOa15Suq6tEpRrHb4I8xwbW3mTtSG2cav6ZTIhT/d3smdp7/kaweIrL2pt6car5Vu/L t6qRcq/etXw9P5vLm8/5em28fL02/3awys/GORAYLgT6jvSYqaByZl+bN8pqBE5ebKfzitAagXCB 2RqjiBEIBAKBQD8jwLvWQw89lK6++upyMXyruhhrjz322FbRRtV9gj2XzMzW4NUoEOyZpCFONBwj Ffpxw/DthdVItUnk0x8I9B3poYK12BDxQYCaBQsV2bXWm5lo9txYvWf2J88Amd3SkTvCBeZYfSOi 3oFAIDDaELDHirUud955Z7nQvVX9rMMYiwHZaUZ4YEK2oBUa6cC0rd/C9sKq33CK8g4vAn1HenQw 3D+aXWkVLM6zSLFWzdrqubF6P7vAXFB4t6m6wLTfQHaByT65kQtMnmK+/OUvly4weZHhFjNfYxtd L2QXmC9/+cuf5QLTgCxkF5gILJvqefPmbXVxzY46XGDWQzWuBQKBQCBQHwH95tFHH12aZTUz3cpP 0wrVMwHL9+McCAQCgUC/INB3pAewNDyttDziUU3r4CO0h0C4wGwPp4gVCAQCgUA/I2BcbHdstDC+ 2f4y/YxDlD0QCATGFgJ9SXrGVhONXG3DBebIYR05BQKBQCAQCAQCgUAgEAiMHAJBekYO657PKVxg 9nwTRQEDgUAgEAgEAoFAIBAIBAaBQJCeQYA2Gh8JF5ijsVWjToFAIBAIBAKBQCAQCAQCEAjSE+9B iUC4wIwXIRAIBAKBQCAQCAQCgUBgtCIQpGe0tmyH9QoXmB0CFtEDgUAgEAgEAoFAIBAIBPoGgVFP etatW5duvPHGdN5557VslBtuuCHtuOOOLeNFhEAgEAgEAoFAYCwgsGHDhnILgx//+Mctt3+4/vrr xwIkUcdAIBDoUwRGNelBYI4//vh01VVXlZ12qzZ65JFHtstGY63KFfcDgUAgEAgEAoHtgcAJJ5xQ bsJp77RWG33b02fnnXfeHsWMPAOBQCAQaInAqCY9NsY89thj08EHH1zu2dMKjR/+8Idp1apVraLF /UAgEAgEAoFAYEwgcMQRR6S99967rb16fvnLX6aHH354TOASlQwEAoH+Q2BUkx7NMWPGjPJop2nm zp3bVsfeTloRJxAIBAKBQCAQ6HcEbGK6++67t1UNWp4nnniirbgRKRAIBAKBkUZg/EhnGPkFAoFA IBAIBAKBQCAQCAQCgUAgMJIIBOkZSbQjr0AgEAgEAoFAIBAIBAKBQCAQGHEEgvSMOOSRYSAQCAQC gUAgEAgEAoFAIBAIjCQCQXpGEu3IKxAIBAKBQCAQCAQCgUAgEAgERhyBID0jDnlkGAgEAoFAIBAI BAKBQCAQCAQCI4lAkJ6RRDvyCgQCgUAgEAgEAoFAIBAIBAKBEUcgSM+IQx4ZBgKBQCAQCAQCgUAg EAgEAoHASCIw6vfp6QTMLVu2pA0bNpT7DKxbt66TRyNuILDdEFi8eHGaOHHidss/Mg4EAoFAICNg HDV+xkbfGZE49zoCq1evbmsD+16vR5SvNQJBeioY2XX6yiuvTP/7f//vNHXq1Mqd+DkUBNavX59W rFiRnHfYYYe2N4sdSp5j6VmbAZ522mlp0qRJY6naUddAIBDoMQRsTnr77beniy66KNnsO0Ig0A8I PPjgg2nBggVpzpw5/VDcKOMQEBhXzMpsGcLzo+rR5cuXJ7PmZqjGjw/Lv2417m233Zb+8z//Mzmf ffbZ6cwzz+xW0pFOgcC4cePKHdN33XXX8neAEggEAoHA9kDA5NaiRYvSsmXL0sDAwPYoQuQZCHSM wKZNm8oxdJ999gmriY7R668HQtNTaa+ZM2cmR4TuIsBkcNq0aWWie+21V9nyEngAAEAASURBVDry yCO7m0GkFggEAoFAILDdEaDJP+yww7Z7OaIAnSNg/puZ19q1a0tLF9YuJtQiBAKjCYFQZ4ym1uzR umRlog40OtEebaQoViAQCAQCgcCwIHD11VcnRy8Hli5f/OIX02tf+9rSMiPWZPVya0XZBotAaHoG i1w81zYCSI8jCE/bkEXEQCAQCAQCgVGAgPUi3//+98uasHSYN29eT9aKRcZ9991XkrOjjz46MfmK EAiMNgSC9Iy2Fu3R+mTSE8SnRxsoihUIBAKBQCDQdQRoeDh2EI499tieJT1dr3gkGAj0IAJh3taD jTLaipQ1PeoVpGe0tW7UJxAIBAKBQKAeArQ8l156abr33nvLw2/XIgQCgcD2QSBIz/bBfUzlmkkP whOkZ0w1fVQ2EAgEAoExiwAtD6JjuwaH372+tmfMNlZUfEwgEKRnTDTz9q0k0iME4dm+7RC5BwKB QCAQCIwMAlUtT86RxgfxCW1PRiTOgcDIIhCkZ2TxHpO5haZnTDZ7VDoQCAQCgTGLwMKFCxOPaHvu uedWF9B+u+ZehEAgEBh5BMKRwchjPiZzRHzCvG1MNn1UOhAIBAKBMYeA/Yr+x//4H+mCCy5IX/jC F8r6f+hDH0qnnnpq2m233cYcHlHhQKAXEAjS0wutMMrLkDU9qhkmbqO8saN6gUAgEAgEAmn27Nnl cccdd5SaHpDMnz8/Pfe5zw10AoFAYDshEOZt2wn4sZRtdU1PkJ6x1PJR10AgEAgEAoFAIBAIBHoD gSA9vdEOo7oUWdMThGdUN3NULhAIBAKBQCAQCAQCgZ5FIEhPzzbN6CpYrOkZXe0ZtQkEAoFAIBAI BAKBQKCfEAjS00+t1adlzZoexQ9tT582YhQ7EAgEAoFAIBAIBAKBPkYgHBn0ceP1ctE3bd6c7n3o ifS7G+5O1918Xxq321Fpj2n7plVbpqflq9ammdOn9HLxo2yBQCAQCAQCgUAgEAgEAqMIgSA9o6gx e6UqGzZtSpdf98f0+wuvSHvdeG1668K70tvXrUsPzJiV/nDlrencuXul048/LO06d2avFDnKEQgE AoFAIBAIBAKBQCAwihEI0jOKG3d7VG3d+o3pZ1fdlq780SXpuOt+m152/+1p5trVafyWzenQpZPT c5Y/lS5avTqdu25DOmPBEWnerrO3RzEjz0AgEAgEAoFAYBsE1q7fkJ5YujI9+tSK9FhxfmLZqrRs 5Zq0cs36ZHzbsHFT2lyMZ+OKJ8ePH58mThhIUyZNSNOnTk6zZ0xNu8yennadPSPtVkzqzZ01fZv0 e/nCuPEDafyESUW9Bnq5mFG2QGDQCATpGTR08WA9BG7+4wPpjxdfno793a/TiffflmatW7M12g4b 1qZDn1qcJl97SboobU5Xz5qW5ix4fpo+ZdLWOPEjEAgEAoFAIBAYKQRWFWRm0aNPpdsXPZbufujJ tOTpVWn95nHFMT6t3lCcN41LG7eMT5sKmrMlTUhbthRi0ziURyg23S7+H1+cx49bnSaMW5kmDzye pk7YkiaP25QmDYxLTz3+WEpz9k+TN61MW8b13jJqpuh3PfhEuvh3d6SFm/dMB59ydrp30+7p+7+9 LZ384oPTPrvNKWsa/wUCowGBccUi8y2joSJRh+2PwCNLlqcLfn5lmvatb6ZTbrn6WYSnWrqNRcd/ 427z0+9f+bp05HvflI55/oHV2/E7EAgEAoFAIBAYNgTWFJYGdxdrTq+57YF09+IlafnazWnFhglp 9aaBtGnchELTURCbQouDzpQEpxizSic8W8nOM6SnLGQhRpWiVKEB2lJqgQqxanOhESqOTetWpZVP Lk6bVz+VnrPvHum4Fx6ajj5k77TfHnPT5Inbd9558+Yt6dIb70nnX31XemRFSqs3TyqJ2fgtm9LE jcvTvFnj0xsLi4zjjtivIHW5zsPWLJFwIDDsCGzfL27YqxcZjCQCd9z9YFrz2yvSsQvvbEh4lGdC MSgc8sRD6a7bbkl33nNseu6B89KscGwwkk0VeQUCgUAgMOYQWLp8dbr2jgfT726/Py1+am1aVhCd dalwqjMwKY0bGEjjChIygTambQH/z0SgONWjBOMLMjR+0vS047Q5BQdanx7fvDFdeHPh4OeOh9Pe O01PLz183/SCA/fcLo59mOn9/Krb07m/viWtSDPSpJk7p4njJ5bkDnHbuGFaunvJY+nC6+4uzPRm pOfO3yWIz5j7YkZfhYP0jL423S41WrpidXpo0cNpl3vvSvsue7xlGaZtXJ8OXnxfuvHa69O9h8xP RxZHhEAgEAgEAoFAoNsIrFyzLl17+wPptzctTAufXJuWb5qStgzsWJCciWn8wIRC0B8ms7OCPEk/ FUex8qfUAq3dtDE9sqEgQIvXprsfuzVdcfPCdOKRB6QXHLRnsTZoYrer3jC92xY+mi675cH0dOFR dXJBeMYVxC8HeEyYNDWNm7V7uuuJpekX1/wxTZ08odRO5ThxDgT6EYEgPf3Yaj1Y5sWPLU3r77w7 HfjkI4Xt8saWJTQrhhzddPvtadHil6cXPHd++5NrLVOPCIFAIBAIBAJjHQHG+/cUZmwXXHNnuv6+ pwqyMzVtnjAnjS/WkW6PxfrIxLjCUUDBKNKWgng9VWh/rl+8Kt332E3p6HsfSaccc3DaewSc+3DM cN2dD6X7l21Ok2ftWhCz+mRrYOLktCHtmK67b0mat9MDac+dZqXJhdOGCIFAvyIwTNMb/QpHlHuw CDz48JNp/G23pX3qaXn23jullx6b0l57PSv5WetWpznLlqQVjy8pvOOsfta9+CMQCAQCgUAgEBgs AtarMGP76gU3pCvuXp6WbtkxpSk7FpZshQajB7yTjaP9mTQtbZk8Oz2xaVa65NYn0n/+7Np0412L B1vltp+7feFj6caFT6X146c2JDw5sYEJk9OaLZPTzYuWpHuLcT5CINDPCARl7+fW65GyG1yeKszb xj/5ZJq7ZuUzpdphh5ReeVJKZ74ppenTUvrPr6X00ENb7w8U03BzVy1Pyx59rPCYszrN3qGIEyEQ CAQCgUAgEBgCApsLj2QXF3vFnffbO9KSDcWanSlz0gTajLbX6rTOfMrE8WnapIG0dsPmtHr9ptYP NIhRkp8pM9K6jRPTzQ8vSasv+UPpFvuo584bljU03G7zUvfw0xvTwPQ2PLMVmA1MnlmY4j2Z7rz/ 8XTI/N0a1CQuBwK9j0Boenq/jXq+hCsKe+mNy1emmevXpomFt5oy7LF7Sh86O6U3nZHS1GLQmVVs RIoE1YQ5K5elcQ8+mJYuK1zHRAgEAoFAIBAIBIaAAC9q1xTrd376u3vSo2sKBwVTC3M2JmWDJDy7 zJyUDt1zRtp5h2fWvCjegbtNT2e8aLd02Lxtx7VOi88z3MDEYpyctnO6d+m49MsbFqZ7C69ywxEe fWp5emjJqrRpfGHiZ71RG2H8hIlpXeHCe/GTK9JThTOICIFAvyLQ3hvfr7WLco8IAqsK0rNlReH/ pXBOsNWDTeEJJ91+Z0rXXZ/SoYekdNqpdcsywz4+S55KKwtNUYRAIBAIBAKBQGAoCDxQrC+9/JYH 0uIVxcahO8wtFujXX6/SKg9anCP3mZle9ty5iVbngsLr2hMr1m99bPrkgbT7jpPT/U8+sxfd1puD /IGcbZ4yO9300NK00w33lF5Ndyk2Ou1mWPTI0rLM4yZM3ZqsusybMyXtPHNyWldoru5fsiY9vrwY 1/OGJgUp2zJhSnqo8Hi3+Illac7MsMrYCl786CsEgvT0VXP1ZmHXbSgcF6xZkyYXHmm2hscfT+m3 l6e0vri2267FngWbt96q/iidHqxeXUSrPFuNEL8DgUAgEAgEAoE2EGBq/Ye7H043LlpWrJWZkwYG SXjmzpiYTjxkbjpg18Kz2YRxCSmYNmlkDGMQn7Ubp6Xf3fVk2m/3h9MrX3RQGzVvP8oTy1amJ1cW E5RTZ5UP7b/LtPTK5+2U5u9UrC8qrkwq6rts9cZ08S1PFA4Mnk6b/8x8eHd7bPmK9OjSlemw9rOL mIFATyEQpKenmqM/C7NhQ7FX9Zq1adLGDc9UYF1BYhwtwqRi34JxBeHZsLE+KWrxeNwOBAKBQCAQ CARKBJYsX5UWPvZ0WrWpcBLArHqQwUac9y9Zm+56ZHXaZ6ep6ej9/0QQ6iXHumG3WZPT3nOnpg2b Ci1Jofl5alVlLKz3UItrA8XePktWrEwLHymsIApLihlTJ7d4or3bG4vyMUe3BGninwkhLdbDS9em GxYV62tXbyjN9hYU2q1jDtgxLS6u0+4ITNyeXrUx2esoQiDQrwgE6enXluuhco8fT/Vd7GQ9CI84 mwoXnlsKUzhpRAgEAoFAIBAIBAaLwCNLlqdHCkF9y8DkYgnP4McUwv8tD64oSczs6RMKbUf9Ek0c GJ+OLsjB4XvPTDOmDBRaofHp0WXr0kW3FIv+H6k49an/eMOr48YXWqVC48PEjGamW6Rn7foNhfla MUnJdfaf8VlYkDTEZlXBhDZuKpwSFYRtfkH09pg9Jc2ZPnEr6Rk3fkKhgdqc1qwbGqFrWOm4EQiM AAJBekYA5NGexcQJxWs0ZUpa79xhWF90pGny5DSxIE0RAoFAIBAIBAKBwSKwYtW6tHxtocYYPzTN yIZC+N+wqbVHNut+Nmwal665Z1la+MSadMBu09LxB81JR+07q9SSrFjbes+6RnXdMm5CWlnUZeXq dY2idHx9fUF41K3qsnv1umfXE/HZWLC8TeXxTBZ/IknjCmK0OW0qjoGC8EUIBPoNgc6l1H6rYZR3 2BGYYrOy6dPT2onP9m7TTsZrC5V5mjGj4ExDG6TaySviBAKBQCAQCIxeBCYUmpbiX3pmBf7w1pW7 6lseXJ6uvHtpWlWQB44OmLkxidu1MHkbCukp7CcKN9tFfbpILjZs3FQQloIT0iQ1CHsUzhk4aHj0 6XXpseKohoHiOWt8mPEF6akiE7/7BYHGb36/1CDKud0RmDWj8AIzc1ZaVix0bGAF0LCMy6btkLYU 7q13nD10t58NM4kbgUAgEAgEAqMeAV7FOCEYt3lkTLDWF+ZeSwtzMIRHWL5mQ1qyckOaWmiAdijM 3YYUNm1Is6ZOSDvO6J6nNKQF3+HWu15gondE4bFuUsEcmfctLcz8qgHhYRU3EOboVVjidx8hEKSn jxqrV4s6eeJAoegpzNumTU+rJv5ZYzOx0ODw2nbggcW52MxsWtFx77pL8fcBKc15ZkO0pdNnpXF7 7JFmz5zeq9WLcgUCgUAgEAj0AQK7z52Zdttxatq8oVjX08BjaDersaWY5qvSB2t/EApHo3VA7eS/ uSA84zavS7sWdZk7q3tj46RirJ5QEJbNeT+9SmF4bTtm/x3TYXvtkP5w//J00wPLSxO3SpQC0y1p oFgP1E3tUzX9+B0IDDcCQXqGG+ExkD5b3912npU27rtvenjG7D/VeO95KX3kw2nclz+Xxr33PWlc QX7GveddKX3pcymd+aZiw9KpaX2xMdpjhaZnoCBDO+3Y3b0IxgDsUcVAIBAIBAKBCgLTp0xKz917 57TXrIG0ed3gHQlUkmz6k+MC7qwnDPzJacIOUwrNzLSJaU1h9rZy3eDX82xetyLtv/PkdOj8XROi 0q0wZfLEUouzqWa9EiJ01L47puOfMzfd9eiqdOkdSwovb88u/+bC0+rEop6TJxWatCE4iehWXSKd QGAwCMSansGgFs9sg8C8PXZKf3zeoemBG65JBy19NKVHH0vpnHPTlosu3iZuWvxwuX/Po9NmpbV7 7ZX22XV20ZHGq7gtUHElEAgEAoFAoF0ECONHHLhHunvxkvSLGx9Omwq3zAOTntmEs910kIAdCtMy e/PMLszlJhdunWcXZGbP2ZNLRwmZEEwpCMlLDpydrO25Y/HK9Jzdp6eDd5+RbirW+TxSeHEbTNiw enmaumlFevFB+6WDC9LTzcDb3PSpk9LE8YUmatPGNL6YeBwoMDty/qz0ikN3Sg8+tSb98rYny7VJ VQ2WMmwutqRgsjdrxuBdgXezLpFWIDAYBELSHAxq8cw2COyx045p1r57pwd22iMteeieNHfVqpTu uHObeNULd+yyd9r44henA+bvngbvXLSaYvwOBAKBQCAQGMsIzCpMrV9VbOi5dMXa9Ns7Hktbpu+c JkzpzERsl5mT0isP2zk9rzD1IujPLAjQrKk7l+6pf3vHU+niW58sIeZSGjngrQ1psNblnsdWpavu Wlq4dv7TOp9O2mLjmuVp3bKH08uev2c68cgDEs1VNwNSOHuHqWV9nt64viQ9z9trRjr1iJ3LbBY+ sTrNKDRXBxQblqrXU8X6pK17DhUmd3NnTkw7d9Hcrpt1i7QCgXYQCNLTDkoRpyUCVPAHHrR3uvKY Y9KdDy9KL33gjqbPPFJoeR7ca37a5Tn7pT132bFp3LgZCAQCgUAgEAi0gwDBfo+dZ6a3v+KIYtPr 69OvbnkgTZuzR5o4dWbxeHvTawT939y+JP1+4dPbZLmk8NDGrTPNzuJifxtrd5i4MWtbV2h8Hi2I 0JKV65+11mebRGoubNlSbM69YU2aunlFOvnofdMbjj8k7bxjZ0StJsmGf+5djLc8zN3yGE3UtDSv 8DR3wK7TS69sc2dM2rqOx7qkXxcYXHTLE6Wb6y0b16a9Zk9Pe+3SeKPWhpnGjUCgRxAI0tMjDTEa inHQPruk+446PN1y661pj6efTPs+/UTdaq0p3FRfvffBacNJJ6YjD9u/sFmO17AuUHExEAgEAoFA oGMEeCnbY6eZ6Z0nv6AkD5fdujg99fSaNGH6nDRQbPrZKjBXe2DJmqbRni7WvDiEgmel8cV/BU8o yUPTB2tubiqcLmxcuSQVVnHp5GPnpwXP368s83Ctm9mrID02Hr3pwSXF2tod0++KPYbue3x13XU6 TxYEz349TOF4xNtt9rSibLH+tqYJ488+QiCkzT5qrF4v6rTJk9KLXnhw+vlDJ6XzV65Jp915bTpw 2ePPKva6wob45/MPT3846dXp1JcemfYs1vNECAQCgUAgEAgEuokA0jCvEPDf+PLD0nMK5wYX/f7e dOsDD6UNk2amgSmz0nh7xHUpIDub/NdB2LShIBRrlqVJm1elF+8/N73yqP2Lcu6SZhbmee3pozrI rBJ1xrTJaf895qSd7lmanlq/Oj25YlxxrK/E2Pbn5vWr0vy5k9JB83aOjcS3hSeu9BECA39fhD4q bxS1xxGYPnVy2mXPXdLtaUq68ulNaUZhN7xTsTBzfKG+Z9J24YFHpkWvPDUdf/oJ6ahD5yfeZCIE AoFAIBAIBALdRgDxmVqMMbvN2aEgFDuleXOnpZVPL0tLnnw8bVy/Lm0eN1CuaxkurUptfZixbVy3 Km1c8USasH5pOnyv6enNxz8nnfyiA9P+e85N04o1PMNJeJRHXadMnpAefvypdP8TK9P4ydPqanly 2Wl5Nq1emo45YHa5zmhK4b0tQiDQrwiMK+w2O5ue6NeaRrlHDIHNhTr8gceWpmuuvS3ddfnv0/KF D6QN6wo76GIfgP2OPTKd8NoT03P226Ps4EesUJFRIBAIBAKBwJhFgKCzZu369PjSlWnho0vT7+96 ON14z+Np2ZpNafykYv3MpGlpQnHwaNbNYM+djWtXpw2rl6UtxbodJmJHHbhresEBu6f5u88uHQOM 9OTfxk2b0xU335e+99s/psVrpqQJ0xqsqy3Ew/UFQTt4p3HpHa84LB1xwB6lGV838Ym0AoGRRCBI z0iiPYbysnPzipVr05NLV6Sf/eLC9NWvfS1NK7RAH/voR9Lprz011vGMoXchqhoIBAKBQC8hsG7D xsK725q05OlV6aEnnk633f9kuv2BJemxpavT5jQ+jZs4JW0ZX2hdBiaVZnBM4caNHyg0IvW3NrQR 6pZiw08EZ3Nh3bDlz5uLbl6/tpjwW52WP/5gmlRodt5w8nHp1ScdX3hBm1a4fp7a1T14OsV3+aq1 6ceX35Z+dOUf07qJc9KUWX/y4LY1nWIMX1esNZozsLLQRh2cTn7xQSm0PFvRiR99ikB3pzT6FIQo dvcRsKhzVuEa07HrjpPSuuWPFrbLM9K0yeOD8HQf7kgxEAgEAoFAoE0EJhfOc5i87Tp7RrG+ZW56 fqHBWL56XUIEnli2Kj28ZEVavGRlenTpqvTUiqVp5fL1af2GTYWjgi0l8RlfOEpIhX+2zQXZMcE3 vnBVPaVIc4diD5y5M6em3edMT3vO3SXtMXdGuuWG69LXr/hV2rBlY9pnx5en5xQOf4bbhK0dGHaY NiWdesxz0qq169KFv1+Y1i7dUDh6mF1ouiamTRvXFSZty9Ku0zal1xx9UOFCe78gPO2AGnF6HoEg PT3fRP1fwNKCshwseqGr7388owaBQCAQCAQCQ0fgT+tbJpZrS3ctSBDTbFqgNes2pLXrHRuLvzcV Lqo3pU2FSZhjQ3GIJyA7EyeMTxMGBso9epx5I51arJmZWqx9sZ7o6ftvLezqliW79owr9Ei9MgoW 85KlJ7Y3LzgiHbjXTum3Ny1KN9x9T7E3z5q008zp6SWHzCs9yR2y767J3kcRAoHRgECQntHQin1Q hz/NkI1rumCyD6oRRQwEAoFAIBAYpQggMYiKo14wjtHsFP/KgDiwamjmCEGcXg47FfsBHXf4vmn3 WZPTIzf9Kl3+g/PSO97+tsKk7RVp3h67JFqxCIHAaEEg3ubR0pI9XA8DRantKcrYbHDo4SpE0QKB QCAQCATGOALGr4FeZzGDaCNrdXYtNh6dUrjPXvHowuK8utwrKAjPIMCMR3oagfqr8nq6yFG4fkMg kx4DRpCefmu9KG8gEAgEAoFAIBAIBAL9j0CQnv5vw56vQWh5er6JooCBQCAQCAQCgUAgEAiMagSC 9Izq5u2NyoWmpzfaIUoRCAQCgUAgEAgEAoHAWEUg1vSM1ZYfwXrPmTMnHXLIIWnu3Llp5syZI5hz ZBUIBAKBQCAQCAQCgUAgEAikFKQn3oJhR+Coo45KO+20U5o0aVLaZ599hj2/yCAQCAQCgUAgEAgE AoFAIBCoIhCkp4pG/B4WBHbeeedE28OJwZ82dRuWbCLRQCAQCAQCgUAgEAgEAoFAoC4CQXrqwhIX u4kAohNkp5uIRlqBQCAQCAQCgUAgEAgEAp0gEI4MOkEr4gYCgUAgEAgEAoFAIBAIBAKBQN8hEJqe vmuyKHAgEAgEAoFAIBAI9AMCnPfsv//+ZVF72ZHPwMBA2n333dOhhx6adtttt7DO6IeXK8rYMQJB ejqGLB4IBAKBQCAQCAQCgUCgNQKHH354+sQnPlFG3G+//Vo/sJ1icDTEy+opp5ySDj744DRhQoiH 26kpItthRCDe6mEEN5IOBAKBQCAQCAQCgbGLAM+ls2fPLgGgTenVsH79+nTTTTelH/7wh2nHHXdM J554Yq8WNcoVCAwagSA9g4YuHgwEAoFAIBAIBAKBQKAxAv3iyGfTpk3pySefTAsXLkxLlixJmzdv blypuBMI9CkC4cigTxsuih0IBAKBQCAQCAQCgUAgEAgEAu0hMGY0PWYtzF6YdZk7d25LdDZs2JDW rVuXJk6cmCZPnlzGf+qpp9KWLVu27jnTMpEejbBs2bKyHlTY9s5pFTqN3yq9Xr0/WurpPfW+M6no ZXOKXn0PolyBQCAQCAQCgUAgMPoQGBOkZ/ny5emqq64qBfznPve56frrr0/nn39+uv3229OBBx6Y Xve616WXvOQlJZmh4r311lvT9773vbTDDjukt7/97WmfffYpW95Cv+uuu64kTkcddVSaPn16wzeC 4HnDDTekn/70p+nmm28uFwXuscceSRpr1qxJBxxwQDr55JPTC17wgjR16tSG6XT7hrp/+ctfTsr3 gQ98IL3yla9smkWn8Zsm1uLmI488kq688sp00UUXpXvuuackm/vuu29iE628M2bMSK94xSvSMccc U7ZNi+Q6ut3tejIT+P3vf59+9rOfpdtuu60siwWtr33ta0vPOHfeeWfX6wkz7zWsEPVddtmlXJQ6 f/78jrCIyIFAIBAIBAKBQCAQCIw2BEa9eRuNzW9/+9u0ePHi0hUjQfCII44oBWiL9mg7XvjCF5Z/ a9wHH3ywJDaEb6SItieHadOmlV5N7rrrrnTxxRcnBKlRIKAfdthhpfCJcCFL3EG+733vK/P86le/ mv7u7/4u/b//9/+elUej9Lp1feXKlenuu+9Od9xxR3r66adbJttp/JYJNolAMwEzuF566aXpD3/4 Q0IU3/KWt6SXv/zl6Y9//GPpBeff/u3f0gMPPNAkpc5vdbueCLP3jKbF++cdQETUb968eV2vp/Jb gHrLLbekl73sZSWhfvTRR9Pvfve7zsGIJwKBQCAQCAQCgUAgEBhlCIx6Tc/VV19dzri/9KUvLQVo 5m1Tpkwpf8+ZM6cUQJGRHJCiF7/4xaWgWktqPLvrrrsmbicJlzRCBNt6gUZHXAdh17ME+KOPPjrd f//96Te/+U1JhA466KBSc0HjNBLh+c9/fvrnf/7nxFNLO3l2Gn8oddAue+6551bzQ6aF2uZ5z3te oq1AQD/1qU+lz33uc6Wp4oc//OH0nOc8ZyhZbn222/XU5sq+8847l8RHXfz2PgjIUDaz7EY9ERzv JLKlLswWmWLSOEUIBAKBQCAQCAQCgUBgrCMwqknP0qVL0y9/+cu0evXqUnBGPHIgdPJDX7umhTaH sDpr1qzSTCjHz2dpMFO64oorSm0PM7VmZm7Sr+bheYRI3hs3bizJEALCDIo2gGDP5Az5Ou+888q0 zzzzzIQc0W78/Oc/L02/mMQR+BcsWFASNyZ0tE9MxOR35JFHlulYx+S6PGw6RjhG1miiBKZjDz/8 cGkWRWim+UI+aFZsqAa/2viea1YWa2N+/etfp2uuuaYUvJmjqesFF1xQpk9z41q9UItXjqO8xx13 XLrkkkvSjTfeWJaXcJ9JjzpceOGFidkYfI899th00kknpayVGwwu8vYcDGgFvTNI7gknnFASWPcb 5QtDIdcnn8uLlev573xuVc8cr/bsvVm7dm2pJaPBe/zxx8s2Zx4YIRAIBAKBQCAQCAQCgbGOwKgm PYgAkyhaHiSi3YCYEFIbBRoiplhMh5hgSb/dQHtE0/PQQw+VBMAmYPMLLYa/rQFxELTN2FsPRGi1 fogg//nPf75cj/TGN74xIWdM4+699970oQ99KO21114lufv+979fCuf+tvszcrVixYqyPgR2eSMf FrrLFzn41a9+VRIGZIv2x7oQ5IHGizBdG3/RokVNy0KDIX3EEP4IA5KTyRUM7Pgs/06CZxwCvJjp IbTI7Re+8IUyrze84Q3lddog+SBK4gwGF+3wpS99qcQCgbLu5x//8R8TUzJmiohFo3ytExtsaFRP bd4oIK80STD/7Gc/W5Ja5JzmDOlFiLxDSGIQoUYoxvXhRqAThzJMk02gmGwwGZMnraxZG6pDGZNA gm9itIbR4JhlNNRhtL5fw1GvTvqHnL9vWZ/gWyabDbV/iL4hIzs6z6Oe9BCOEZ5u7i5sEM6L6y0e b4f0+JBocmhIkAiC7Tvf+c705je/udTm0CwZ1Anw1hW9613vKtd9IF+IiHUhP/jBD8o1RS960YtK kzmk6Fvf+lZpbie+69LOxAlhWbVqVamVIPzSYOkUpGkwcV8HQXOCwFlv8prXvKbUHtEkOWrj65Ra leXd7353+Ryc1Ic5IIcQnr388stLMyzEqVPSQ3tCE5K1ZMrOSYXyIDVMBxE1AVbIHEwGg4s0lFW6 tGaZPP3oRz8qyy/vZvkqRyZo0uok1Ksn4tqM9CC42pgmD7H94Ac/WBJaTjM45UA+c7t0UpaIGwh0 C4F2HcogOL4tfRtNrW+edthkj/eccNOuQ5lGZecshfaZY5FmY0Ne96h/roZG16txOv09lDRrn+22 Y5ZmdWFCe+2115ZWCNbB6vf1+RwAGWOMecbh448/Pr3nPe9pu99vVQfjCesE7wmnQcbJs846q+z3 mpU37vUmAu32D2SSatBX/PjHPy4tW17/+tcPuX+IvqGK7uj7/Yy91yirm5ltM/U6xtoBqxtVpYkx 4097IY9WAdEweBOg/+f//J+lB7Wzzz57q2c49/NMpoXuFqMjMm9961tLrQ+tFWGWQKA+8peeawYa 5IZGiIBvFlR812mCxJWvPAxIjhwI2MgNEvSNb3wjcRJAeCbkC7XxDa6tygIXdfGss7VMBiQaIGtd aF4cgwmwzngTfswGM7+zoVrWoiGN2t817TMYXHTAyCBSq5O1Fgch/Nd//deSqBKUmuXLccZQQm09 rftpFNT3K1/5Skl4aHJ4i3viiSfK98Rz2oHWR5sSGiMEAiONQCcOZWiZTYoQkn1zJk6++93vlt+j ciP/NOTZdNV330nIE08mMGiLGwX5MjFmUlsNja5X43T6eyhp1ntWH9yJw5pOy1uNb3zhhVR/fNll lyXraI1TZ5xxRklW3/ve95am1fok41S7oVUdjGeIlTEM6UKSmHNH6D8EOukfqrUzPpvgZE6f234o /UP0DVV0R+fvUavpIZwbDKy3QQ66HaRJ8DWzLp+8KL1RPuIS/E877bRycMjODerFpyHI64rcR1wM GGYmCbEGl0ySDPjInfsGAAI+8yUzX7Q38wsTsqyxqZeXe57hypsZmlkzncdHP/rRkkDVPkPD0U5Z qs8hPg5ldlQF+mq8Vr9pLZAlz8MB5urPzEynqc2RDZq997///aWmhUZOvE5xQQIfe+yxcl2MfB3w RX6QCLObrfJtVZ9G9+vVsxFZ8W4gPDAhXGjzf//3fy9nvqzhomHce++9S5fssIgQCGwPBNp1KGPC xvfFFNeaQn2eb5spLyHeWkN9ie+wHYcy9epKS8QMlFBNWNb31QbfP6KlP6SlzqHR9Xx/MOehpNno 2W47ZmlWr+y0Rf+S+3p9MFxNOum7TOAhs52EVnUwliBXzHqbTQp1kmfE3T4ItNs/VEuHQHvOmF+V v4bSP0TfUEV4dP4etaQHyXAMVsBu1dxZi2FQbmemUQeNYLSjdTJTUXWOIC+HUCUOBIRq8LHT9NDq EBIczOfsB+RevSC9BYUzBGTiM5/5TGk28pOf/KRc+3HIIYds80i7ZdnmwcqF2nJXbjX9iXA5BII8 cod8mukTtLW1TLy9CQZCWA4Wl4wZkuegscrtIs9W+ZaFGMR/9erpXa4XmOAxZ2QqSZtD2OCOXNv/ x3/8R+mOnfDBEUaEQGB7IGBSqF2HMvojkwtC/r5odbzD1lHm4NvsxKFMfs5kBeHb2WGS4MQTTyyd weQ4BPWvf/3r6Wtf+1o5ocQVvIkg/QrtUu11/at93jxXz5mKerhnrWStsxgTYfXyymkqK+2JfJm4 0uSaOHNuVE79NoFwJB3QZOy0Xw76eWteXeP8JWtlWAoM1umOtM3uM+2miTcGmPSr5pvzb9QerAA6 cbQj/aE4s8nliXN9BDrpH6opmLgw0cms3TdSDYPpH6JvaOwoy+RKJ99MtS167Xd9SbjXSjmI8iAX BECkZLCmVM2ylaYZeap9RzeDDzYL3NI1i6EuBF8z9w6zn85IiJmubOdq9pNWwwzYfffdV6bjWqNg IGUeZUD/h3/4h/TqV7+6rJeBhaBfGzopS+2zQ/2b2ZaBXJ2Z/zHXUk9EB/mhmtZxwUM52ZMzUxM6 xYWAJQ15GVwRi0xu4Y5MtZPvYOpcr5710qFpotGjbSRYeT9oCN/2treV5iY8AjJ/JFjRDgoGfEeE QGCkECDkWlNmokI/1ip4lzPhyZoeDlcQi2rQ5/lOfZ+E63aCCQFloDGStpliZlHVYLKE9iJ/7wRr k0nMjutdp5k328zRDNKTTb04UyHcC9lZDEIib98sQtMoL2nyfvl//s//KdO2pknen/70p0vNrj67 0bM0vPo+6zut58saFiaDJkKYA/E6ql8wOZJNY03omDgiTNpH7otf/GJpKos8MH0+55xzkjTaCbBj OUBQojHXnjRB+mn9pvHTekn568dog2jvjEf6V5q+enWAs/IintIxmWO9EK1dNTRrj07qifBwZgNL xFv5OLNBuozBzfKplid+N0ag0/5BSt5pY5vvyfdZj/R22j9E3zAyfUPjN2Fk7oxa0pMFQMJpPTti hEUHpuOqDTp+s1Q6bgNjvUCYRkwMTnmArhdPB67zdnY0CvLMg6y8/Z2DTjqboGHcZkbMcDh0+jZX zcTLwGiA5pSAeYhOwbUcshCh3g752DOImQeHDLyf6UQMQtKsjd9uWXIdpJ/zqU0rl6l6FschVH8j NL/4xS/KGc9TTjklnVUsWCWEaGeEhkCF5H37299ObPUdhAakRegUF+8NjZlZZgObAd9hsLu02DjV O9UqX3XPdch4l4Up/svX/V393aie+bnaszysXeIkgyDknURwaKUIRRZ4EmAIIAQ86vsgPbUoxt/D iQChZjAOZQjLzMt89/qjqqZHeX3bBGmaUZM0rQLBWN9J44B4WLuIjPkusgZZGvLRB5pQ8Q0Rdhcs WFBqlupd1w9lpybGAk5MEAp1RnZMYiBmtErIDi2N9HyjjfKSJjJG2PZdq6dyK79vWF/X6FljAoGP IGi8MP7oJ5QR4VHGbBGgfjBGzvz2HFzlo39j2qc++gxaqnZIj3HuO9/5TvrLv/zLUkOSxzXlcSi3 /JEWfStioYz6VJgY6+o53dE2SJR1Vt4H2iNaL/10ntQRR2jWHrR27dYzO7Mxzphk8y7ABhbemWb5 aOsIrRHotH8ge/k2yCLeI+9tvdBJ/xB9w8j0DfXaaaSv1beZGelSDFN+ZrN0jgbPHHRYhGGCK62A To2ZhI5TZ6yjMlD5EH1cfhP+DULV4Fkds2frzTLoWA1OV155ZUl2CL3yMoOFpOh0c/DBEUoNZIJZ SzP44vlwCbJMMJSNEGtAkaeByAadXE2Lk4M8uIg22PidgwFGZwEPhE8eBn8DoxlBArcBSMeOWBiE auMrY6uySFt9zMQYbM2gEFxoaZBNeRg0LFQ2mOfgOrxpVQSDyrnnnlsKJspoMP3EJz5R1lcZDUQC rQ+HD2YmETjCxite8YpyEW0mg+J1gkuup7TMjhJY4MbshCaFJrFZvgZxeyoRqBBAZUdMeIYhbGnj TuupDtXgfTXoE0TMMHtnvZPee56uTj311FKgMUsLfzPQzOAMFhECgZFAQB/lu9YPtGPam8vk+/Ht ITNIg5ldwro9y/SJOfi+9Z+0EfKo9oM5Tj7rc/TDhGr9rzUjtKG+bd+jfk3QrxCi5aOf9Tt/M/Wu yz87NZG2fg9RUXcTEsacqrMY8Zkdm5Bqlpc+zvet31I3/aGzflkazZ5V9ipOJsj0D8pmbNAWhEWa F9c4vZEm/DznjIAgbzTeJo1oZ9qxmlAuBMGkG5JSG2AKJwKrMVK55K/NtaexWJzaOrhvXZfymtSj 0a+3pqdVexgH26mn8R9Z9Q4aT7IzG2OWPlw9m7W7fEyKRmiMQKf9g7HUOOo9fNWrXrV1srdRDu32 D9E3dKdvIPeSnfQ3OehrTKDoR3ohjGrSo/M0S0UIN2AY6AxeBrtPfvKT6b/8l/9Sdpo69zyo6UQR AbNxSANTiNrGMsBaQE4LQJCsF3xs8mEy9vGPf7yMovHlZaCpBoM5szIEinAsnlm96gCu7IRtZh46 Y4MCAVa82vKpA/fEOogqufLbAn9uWtVN543MMZ0gwBtkCAWue0l16rXxdeKwalYWmguuIw1q0pOv AcosKZel0iWcw6gaCPEZewO7QFgw4Brs/dYe8JFGDq7xhKcOiIl0DdZ5YMrxOsEl19MCXDbDBjD1 li7MCD/N8tV2SOs//dM/pf/6X/9rWQTlVu+8tss71kk9cz3ymdCCOGor76P3QtvReqm7MjBbRDq1 AzJEEGk0M5bTjXMg0C0EDH6Eft9Obb/XLA/vqPdV/4McMDG6tJioIkxXJ6CkqS8wISSf2r4w56Ff RZwQMN8gYUt/41mEB/HRt/o2Ow0mZJo5NaHRIOQjMSaDWjmLyfnrPwnaJp5oa5190/p1RyfB+DdS DmiUUV9/VqGNhyeteW3QTjARr12nOwQq/bvxpTZd42EOrdpDH0kmyEF5HdJwGGsc0pGfd8dkncN4 q02MlSY+m7W7fCI0R6DT/sEEiG/Itwt/37xJP+1posFv7ZO/43b6h+gbutc3kDVMEmujHEzafOQj Hyn77nxte56fkRy3ZymGKW9aHi5Pqe7NqpulJ6wSaBvNwCAgBilHo2B2R6dNw0KQrhda5VN9xsBL UHU0CjpjnSgC4SMVkIFqZ5+fdY2Jg6Azz0FHQNB2VIOOgTCPCBlMCRz5uXrxPdusLJ6fX3iNc1QD YaNZgD2BpirUNIuf7ymrtJEQA6K/6wn2neIifWmqK8wNdNV0W+WL4DrqBQSo03rWS0fbaSPER92V r0oI3SNYaFfvZL33pV66cS0Q6AYC3kVHFiTbTdO35Rtx+P7MxFrMTwitfje+SXG9+/qvRsFg7Fnv v3R8D75tfZQJAxpZ4wNBvNOg33II6mnsqHWmoh5mp9txFpPzp7Fg3sZCwFgjMEMeTICTQ4CBQ1k7 IU+dxJW+MbJqaUAgVaf5Beb6LaTOxKR1PY5WTnf0X7n/VZZG5WmnPWjgGoWcrjp4t4SRdmbTqGyj 7Xqn/QOtG3kO4clkGhlGPn3fJjNMlJBnhHb6h+gbutc3mNwix5ogyMHfua3yte15HtWkB7BmC81y Ubmx364V+DsFH+FhBmZRLRW7jnEkg044D7DN8q0Kvs3iuZcHw3xuFT/fb7csOf5wn5W/VR06wSWX t1U928k3pzVcZ8JAFghq8yAsRAgEtgcChP08GdGOaVS9MhKQTS4hP7WTTNI0wNLu1mqOc1qEe+ZT JoyYfOY+ggbXTDPSw8yKtofm3n39uiMLwDmteteVCdFRTmMDgYxmW76EZbPRZqKzs5jPfvazpeBG gHO/XpqeZZLKGYJxhkkaU2lxq6Hes9X7+TcCoh30fyZwHOqWJ3OUFz5Mx7oZMumRl4lH5DSPwSZq kEz7IBmf9bOuNQpwpsEmWMGTZjuHaju1ag9laCfQJsDN+5Cd2WhDf8ONINes3eXjnY3QGIFO+wdy F8yrQjUTSqbkzFNZuFQnGlv1D9E31HeUNdi+wWT7X/3VX5XkM7c6eVXf0ith1JMegiAzMypPpkQG GR38YIKZBB+bDw97bYd8DCafeCYQCAQCgdGAACGbFpaAmE05q/XSnxJgmV8KBlvmw7Q2ntN/IyWE F6bKVS2P+ARfwjLNfaP+2GSXNJjJVZ83JkjTOjvmq0gFwUk85aUZt45EHtaSmDxodJ2wbkwgvHOm ot4EKuVntmytoWetPZSX9FgiIGr10oQHjRQS4r51nNI2k+1gzsf8qt6zyknglkY+EIVsYuc5RAxh QvqqznDgr9wOzzrXpgX32pDjias9kALXEEEYWqtJm8McN0/OVJ3LaG+4u5ZDbb4wpbXWhtnDJWGK FpAGKWMjXrP2UIZ26glbmihm7N4hjmxgi1QpJ4LcKp9clzjXR6DT/gFxd1QDk1XrfGh3vEPV0Kp/ iL5hQzmJ0K2+QT/j6OUw8PdF6OUCdqNsOioDjFkFA5kPbTDBczrZqs3oYNKJZwKBQCAQGCsIEDws VjfrjWQIhO7s+Yr2nBDpvr7avjhcNdO+WO9BS0NjYDG5PrwapEGzwoy5npaAQEyzYiaYoIuYyIdg zsQp77+ijCbECNrSsXaDhYDnEQwEzCw/gavedYI4QV9ZCVKEcnXKM9NID6GfgMachmBgLaU0jU21 aaovsx228QR68Wh81BUppC2xZtBYVPssDQUixywOoTTJ51kCIXzhbQJP3aRlbejpp59e1p1DFM8i RtIm+MPYeiLEZH5hmsYltus5wE39tBvtFbKjfa2hosX55je/WRJBOFqzWV0Hqz0ROxoczldyuogh D5zVOsCA5QbyrDy0L8rPtMlZ3bSvdYvK2ag95MlEqlU95YdkeVe0aW5Xmh6med4R70OjfJTFs/0S TCxcWqyb893RLC5YsKDhREI369RJ/+Ddzut1chl8a94F7yWSWg3N+ofoG4a/b6i2Ra/8HlcMBJ2t iOyVkkc5AoFAIBAIBHoeAUINz4oIxV/8xV+UE0cERcI6YdV9s+fMUmg+MjEgMBIqkQLnWsLj2X/5 l38phSDOYghEtYEmg1AtD/eZxkiPlgOZkAYioTzyQ4gIq4RvQjrtikCIRnw81+g6IpHXHamHmWfC PGGcZke9CMw0KPJBrsRDEuqlCR8kAm7ZjMpibURGGV2TXu2zsEQakAFERV7Kj2ghUouKtTXwUBdY ZGc48vGcQxlN8CFMyoHY5Fl5+VY1MjQ50lU/ZRPUGYbyoIERxzPKgUzlQPxAAp05esgkgQaQqWBt HaQpH4KuOiiLZ5E09Za2dpJXo/ZQj3brqR7qrl09A0PtiuQqi7ZrlE+tcJ7r3Ktn38HfF3PgFqL/ zd/8Tfm79psbjrJrx3b7B22sTarBO+Ib8K5q+xxa9Q/RNwx/35DbopfOQXp6qTWiLIFAIBAIjEIE CLZm1wm2HAa0CoRuAjtTKIJ9vZAd1FjkzzyDgN3tkOcEa9NudF2ZkQfCezbjUibX89mz7mUBv7xR /FcvzdprtX83ezbfqz0T1JE8ATmorVtt/OH+G15CJxYYnnHAESaOKt65zI3aI99v95wx8y4OZz7t lmc44m0v0qMunfYP7dR/uPuHTr/FRu9i9A3ttGb34gzOzqt7+UdKgUAgEAgEAqMcgU4dyhAs6wmX GaaRcijTiBA0uk4orkfS8rV8zvWonuulWXut9u/8fKPr+X71jGw1Wv9UjTdSvzshO7lMnmnnuUbt kdNp99wKs27l0255Rlu8TvuHVvUfif6h0TfX6HqjdyT3Cflcr2710qy9Vvt3TqfR9Xy/em71nlfj 9uvvID0j1HLU72YGqGc7eQm7Wbw8u1erHh5MHt1MazD59+ozvdDOvYpNlGvsIoDAhEOZsdv+UfNA oBkC0T80QyfudROBID0dosm+114J3IlatIpAsO9lv+secwGbZJ5yyimlPbfkLbr88pe/XNpGf+AD H9i650KHWZf2wxbf2dzOAl+2xWcVG8DZVK+dYOEmkwCbkzabJWPrKjSz5203rXbKleO0k2+O2+jM 3psXJuVjD689LEZl1842nTchC6It1GRP383QrXbuZpkirUCgVxCwHsKaDus7mvU/rcqrX+JRi7ai mTaoVTpxPxAIBHoHgegfeqctRnNJ+se1SI+0goWfZiypInkG4TXEYtX3ve99paceROiTn/xk+tSn PlW6SVVsC2YtZGW3mgX7wVSHhsiiU4M94kXItoC0nWBRqI3ueMRRlkaB153zzjuv9LrTKE67aTV6 vt71dvKt91ztNYuVeSpiJ3tp4YnGbusWSPOUxHMQDzyf+MQn0r/927+VC2Vrnx/K391q56GUIZ4N BHoZAWSHcGMyYrBB/2fCIgjPYBGM5wKB3kQg+ofebJfRVKrQ9HTYmgZrQjRPIewfkR9/c8NJi4CM 2ISNK1TuSrnPRJL++Z//uVw8Sjsz2ID0MI+Td6cDPjeUV1xxRUnAlNGC4trANOu73/1uqUl6+9vf Xnt769/tpLU1chs/2s23jaRKQoiE2lROgFN2N5tnmRFSm/4hjB/+8Ie3bpbXTvrN4nSrnZvlEfcC gUAgEAgEAoFAIBAIBDpHIEhP55iVa3LqrcuhXcieOGiEHA899FBJgCysQ4oEsxl2Eb7mmmvKdT5M rZid0cQgNbQSruXATOunP/1pqVViqsWEq17+OX7tmVcWeyY4O+w8bhM+Znk5cO/49a9/PX3ta18r 07fnAlLA0xLylkM7aYkrvfPPP7/cC0KdzM7StDiqoVW+tEr22IABE0L7Uywo9g+olr2ant+wqYcP /I877rhSi0VDp3yISt4hXFnsUwErZovMBk866aTSXSlPMBl3ewHwGAUf161vskcAt5nVdmZSJ3gu 7weCJNuD44QTTijJsvuN8oVZhEAgEAgEAoFAIBAIBAKBoSMQ5m1Dx7Dch8CO39///vfLnYHtv/CG N7yh1P7QOLBhR2i+973vlQI18w4uMGlevvrVr5Y+6u07QPj9xje+Ue78vKjYS0GwN8BXvvKVkozY k8Du2YgUU6p2A7M6+1wgHMjV1VdfXZrGVZ+nEaHFyqQNubIBm53Oq6GdtMS3AzcCYUM8+SIEyERt aJYvDOwZ8IMf/KDclI6WzAZ/8JDeYIL65DrBkamfTdng/PnPf74sM60d0kMbhNTAXRztK3/7AiC0 9oSwLwXSg8jUtrPyITxf+tKXyvanXRP/H//xH0sSyy1vs3wHU794JhAYqwjo26yrNEFi75Tcl/l2 HRFGBgH9oKNe0FdmJzj17g/1Wqt3oFnZhpp3PD92EGj1no0dJPqvpqHpGWKb2VjrO9/5TinEEurN zr/5zW9Op556arkZHhM4m7zRPDDj0ukS9F0z628tC5LEnAwRsgM1ZwUEfuZYNELW2BDUaQcQEcTj sssua6vkyJE8rAVCPhAt61oQHw4XlEOwFgbRoZURn4BOo1L19NZuWhwG0KTQKFlfY7d0adXbrK1R vjBiaofwWLSs3kgZjRdHDjB797vf3RYG1Ujah8aHtk3Hpaza0PospOboo4/eumu8vJE3eTsQV6aL iIx2tDM400bmdEzoattZvtpTurRDtEyEL+uqtLG8m+Vr9/pM0Kp1iN+BQCDwDAK+Q/2h79XEkb6O CbBvzdofkwv28Tn99NPraoCfSSl+DQUBeLNeMCHFUsF4UhuaOcBhRcD0mmbf2ljjo35ee+pvaf1N VB1//PHpPe95Tzk+5vTbfQee97znlXnot/X19caknGacO0fAZAPZwoQnOcN4a7LSmKv9eLBlXfHq V7/6WZvRdp5TZ08Ys006e/+0ufdHf5BDXmvdzHmTuO2+Z9HXZGR77xykZ4htYldmJlA+YgKygddB kP7gBz9YagB03o5qyOuBnHXAOgZaIYK9wcOho6eJsKM48mAg73RND+E6D/qEch3Oz372s5KQWOTP zE1AAhAc5UTQ/KaRqoZ209LR6ViQPJorZAkRpPWpDY3yRbxuvvnmsu4GUJ0RIqTzhIdBUbr+7jQg lw5BPeHDLG3hwoWlcCR9O5/bSdw1ghShCfGxnkm55K99CFUIDcxq29k7gPyZeeYxjmYIAWT2hiip e7N8aYGC9HTauhF/LCFAs2PSST9j4uGtb31r2cfpK9asWVP2c9/+9reTfvp1r3tdkJ5hejlosAmV +k7eQfV1tSE7wNFvm8iqXVeqL6VlZwqMxBpH9K1nnHFG2V8jRcyutTnhM4dO3gH9MBKFWOnbzzzz zG3GuZxunDtHwDitDZGLSwtHQt6Dl770pSXBQIZ9p9bUat+//uu/bmuj4s5Lse0TJlfJM+Qp7yrz 9BzIGmQ2cd74xjfmy9ucO3nPoq/ZBr6euRCkZ4hNQXCdX2hkzOIjLjrmL3zhC6WWgsBab7arNkvE x0FwdmSh3JoRMyc0EkiEgTsH8VoFZgS0T2Y5CASEeB+2MiM8NDHWrbQz29VJWtJDEgxqN910U6mZ UZePfvSjJXFoVW73aUF0MupOgEFO1BlOzFbUyf1OSQ9BCKGEsXQRTekxWUN+zPggG8wB3//+95ek A0kRT520J3fhsJtftLu6Zm1Zbb2QPu0HO/k6DLgGAgTJu9Iq39o04+9AIBD4EwK+U6auTIR9g297 29tKs+LcJ5hV1gczPdbnRRgeBPSlNPAsEl7/+teXE3T1xpRWDnBM+Bmn9Ld5TNQPG0dMPDEpfte7 3vUsM+lO3wFjKKGcRgkZVk7ER34Rho5Up3bjAABAAElEQVQAosoc3AStYIz1DZq0RXTvuuuu9Jvf /KacIHaNtq2VdmXopUolgTaGa3+kJ4d2nSh1+p7l9OPcewjESNClNiGQE2Z10D4uwqwP3LnTYLAW CPo6DcG1fL280MZ/zOAI3cqmLJ43iBDWCQLU0BwVEOZbhU7Skt+CwpwNufjMZz5Takd+8pOflA4D aHtqNUj18q5qTaTnMLh2ikFt2siUQ9h7771LEkNI0lkL8tBpM4MQ4K+jNCjS9Jh5tK7HQXsFv0YD pjLnewiag1Yv11+erfItCxH/BQKBwDYI6L8I2jQIJm+Yg2bCI7Lvj8D1zne+s/ztb0H8Rs5RCEHt OJmh7W3l3ORVr3pVKewR2Os5SNGnmhHXL+jvCOM0Efpsaevr9C+EQ5NXZsf144Q2zldOO+208txu mcvKF/+ZMOqmYxWabPVQXg5d6hEeEzzq4Oyo50wnl885t5Xf0jVJ5xoTbxNHud8czDuQiY+99pTb +HfAAQfIKkIXENBO1fbLSRpLEVfvh2/Ce8taIodG34m2dq+eYyTjNAsbZucmNnwv5DDfj+98fiHr +A6thRaq5ZLm19tw3uS5wbxnnou+prt9DUyHGoL0DBXByvM+KLP6+UPWuToGG5iyMYMiJBvomEvl 0Er4J7wzwTIDan2RQVUws0KbgfSYeTP4GGzdz51VbdqdpoXsMA/TIf3DP/xD+uxnP1t2QgZHA3wW +nNd6uWLOCJoOjKYOpTLWVnNJDXSsOR06505jGBSJg1rmmjo4IzoEJh0UgZl6au38tI2mX1kX26A vOSSS9J9991XEhrXGgVaNfWQFzM3HTNM/K0e3o128m2UflwPBMYqAvoYWmTmKvoFkwmO2mDSgSAu jn5mUbFWksMSe5wxZfENmsDQH37oQx8qv1fffV77KA/mtVnoohVGpHy3ymC9nu/Z3wQ6/ZW+Wl6u mSGm+be+gXMb5eUgRTq8YtK+S8Nz+nppEA6NIcrMS6V1MspM2OfZ05rGT3/60+XaGSZCytNOmQmA CA/HKggIs2w4cKzC5MxecybpGpWXyU69QGtiQ2g40dTUCwie/ty6UmZwhEh5N/PCKR04aQNEVN9J AKYREgb7DngW1spz1VVXlVqfID1QGd7gHfP9GVONrzDPWp5m34n3LjtGYpbGogYB8g6b7GCh4f0w WaAPYMLvN0JjotJ7k0lPtYa+M++Sd0xgxSG+76kaBvueqWv0Nd3ta6rtMtjfodMdBHI+EkKrgcbZ IZj904lmm2UCtY+b0OzDzIe4BjTPO1x3ro1nIPQhGhiysG5wtrZGHgZMR71gkBWXsO75LBSYITQj akDW+RisxBUIAGZhDLgIVl5P1Gla6kKFbTBkz2uwVw8DOrvt2lAvX8QDwaA5MyPE7hZZc+jAXvjC F9ZNS9pwdNT+RmjM7pktPeWUU9JZZ51VYgNn5IXmB5lh9sDZgIPAQagRdJA6RTOv9l+itcoDcM4r t7GzetEMUevr1M8555zyYArC3pldejv5lpnHf4FAILAVAX0CAV1fRRA2uVA7mZIj05j7TvVLHIew 3/dM1twSfhAJs8N+m0zxzetzfJ+czOgz9bX6XsKMCQ3PZ2KDTCiLb1pfq+8ymZIdlchPGgQ2i/EJ ccYNRCGnoY+Qh3IiOCajCIXIAScqJpL05+4pm0kr/VW7ZYZHdqyizzM+6V+lpV5Vxyr1ylvPY6ax 0NoYZdO36+Nrg7FKHsqN9CAcxhTEJ2vda5/xN3ys1/rLv/zLUjOVhdM8STaYdyDno5wObQnDnHa+ H+fuIMCkmxzw5S9/Of23//bfSrN/4+zf/u3flqaQefxs9p2QfbJjJO9g3rbCd+bb9i2a3PA++H58 M9oWWTEBYSyuFzxHLvGd+oZ8CwsKC5VaIj6Y9yz6mu73NfXacDDXQtPTIWoGWsSGhgRxQQ54GUN4 zC4gEu94xzvKxZcGFfENWu75AK0H8bfZK4s+fRxmwQjjNBA6CQOoQYiXGtoIM5L2z/mXf/mXcqCz PoZWwgdOgDcLqQPIwbNmE5lD+IgNtAR0A7lOnsZFJy9v5MSzZjkJ88wrpEkw1zkZqMzMdZIWzyg6 Cs8hGuqjQ0E0dDC1oV6+FvxzsqCT+/GPf1wOfgY7dbahqBmfbDpWTU9eWd3tukH13HPPLQdZZTKQ fuITnyifVyaDvwBni6C/+MUvlpgQTGBhZrVK1LimJqjAz+8cCCy17WwwVQdpcb3tnfEeUMFbf6Bz bjffnE+cA4FA4E9mqFlQrU5yNMPGhIl+Wr/rG/b9EXb0pa5l5yj6FX2ls75R/4lUEdAIUg59EWKD +DRyboIANXNUoq+SBu07LbAxgYCnT0LgzFjLRz/FlE1/o8/WpzlLH6EQ2inzcDhWMaYZj/Sr8CGE 1gbjEcFTXRHKRs50ap/LxMwEk5n82gCDTt+BnIayOpRb+eHofYjQXQS8v77PS4tJPjKO9rJW1tqs rBWEfbPvBGE2GWv8rucYybfqEOTnyN9vvlberPnP++V9FdczftebOBnMexZ9Te86cQrSU/MhtPpT x2jGzmzAf//v/72MrvM0ePo4fEAGSHalPlQkxkfOo40P3kydmS5xDJgGAwMBjZBZB4TBx6hDIGxL l5BPODZomRVEtniGQyDkY8aiGpAVzyBf7nkmEwTxlYdLRR2+68okP5oJ99hNC/MLcwjXlK+TtNQP WVBmeKijPMya+rs2SL82X3VTNuSAClvddUzs8xEx+NUL6ms20WwQoUDQDtpI+/jNrEE7wjkH184+ ++yyzIgJ7Ak76lKNp1xcZWsD5c4h16HaztTkOlEdPMEGMfK3dL0/Otl28835xDkQCARSOZObtQqE KkIG4Slfq4cRspDNVfWrvj99in5G34yEuF8N7jnEc+hDHII+iCCv367n3MRklEkv/Z/y+f597/o6 fYM+Ub9hHNA3ZhNY6clTXMF9/bZJFU4bnN3XBzlqQ6MyExr1bfp945JDXypt/TLteqvy1uYFc4eg n6z2la7JixkSbI0xJq300eK1cqajHrA4q9DI67eNRdWgrXN7t/sO5OerZUXcHEF6MjrdO/vGTGoa T723JlyRYGdyieC9bPbeiec7Q/5NDNDKduoYaSg1Gsx7Fn1N9/uaobRh9dlnpL7q1fjdEAHCs9m/ qmalYeTihs6aAO6oBh3//IJUVEOe+ahe85vgbWDSsRus82Dnd72g8z788MPr3SpnNZmH1bNx9YB6 5XIY5IWqcF9e+PN/ZkgbpeUe4Z4wobzKahCrF1yvl6+4WTAweArwz+UqL9T8xywDoahVUddE2+ZP ZVBvggac/V0PX3ln7Kr1adTOMpKmeqgD4aKabrv5blPguBAIjGEE8uSBb5ZATWAnCGUhuB40vr08 6eI7diAw9YhDveddq8b17SIkjZyb6IscgnwIb9YXCPoAQrw0CHTMdWnGOViw8JpZcC4rUsG8jWla drXLZKjdkMusvrnPQu4c+t08u91OeWvz1B/nOurrMyHM8TpxgJOfqZ6VGbmsatUXFdYKMNHHG2M6 eQdy2tWyEswdEbqPgPcN4TEZyKTRejEWD1yPZ9Pudt47Mg0Naz3HSN0v9bNTjL6mN/qaZ7fK4P+q L4UOPr14cpgQMDOlczAQ+l0VnLudZRYIhpJuFjAMJgbGPNg2S7NRvp7NHaM4wxmUW3mb4VudJWy3 LLkOjdJtJ99284p4gcBoR8D3QpNMK+2bYmJm/V0W8HP9/c1sjfBNeDYB4fs1AeGghcmTEbTtjSZ4 cnq1Z4Ib0kIDzJzVd+6a4BqiYwKo6iBFOfK6SfFoM6Qhb/WgdciTZEgEsyDmygKzPBNgg+kHTbTJ G3ZZq0T4F2CAhLVT3vKBP/9HGHUoj8kieOag7NmZDg09s16EjsOEBYXZtaC+hOBcjvJinf+QHof2 ZArIHEp5O30HctLK6VBu7aQOEYYPAd/Wm970prK9WGDw5orI+w5afSc0pFXHSPZEpKXMjpG8zw7v RibdfjtaBe3vaBY3+prOZa7h6GtatWW790PT0y5SES8QCAQCgUCgZxAwy/+Rj3yknAHmgtnaP2SB lpugQgi/tFhLQMAnZJuxzWYyTGqsFSDwMD2jvc3OUbLwRIAiGDtngT4LyxkEEyS0PUx4CO5V5ybI VZ7NRog4SHFNeoiaNZuCiSFpKLe1RUhQ1lgR7qyxdJ2Qb2G/tJiJOax5VJd2yuz57FjFrDvHKvIm dKoHxwntlDfX3Vk9aItosmlfCLR+C9kBDkyqmnekjYk4d9EEWs50rH0UL2Odte3ImGuIIwHZek3e 9mAn707fgbJgxX+0BsqKaDI1DE1PRmboZ23mELSZ3yYDkFbEh4MlhMVaW+2n7Zu9d74La4+9v9bd emc4WfKN0CJ5N5zlxazMmmtkWr7V77XeNyxNVhqeZUIvXe8Cs89q6PQ9i76m+31NtT2G8nvg74sw lATi2UAgEAgEAoFAYKQRQGxobuYXZsIEYOQA+SH08AxmNpkgbo0fgZq2OAu4NAXWt1hfYO0NTYR1 jgQje+oQyJEJAjrBiHcpaxIQG/lxg+26QEuAlDBDzm6wMxY0K4QvGg8kgKMCBIO7amsvCYMC4kEY JCwRDLOJsfscoVjLoC7M4xAs5nzKjeRx/cv0rVWZPZvXCylLLg8ckS6CHjzbKW+uH9IIM+t2CJjW Lio7XG1VwFwPIVNXZEh9eHvL+wQRNPM6K0KsejJ9IhQjO4iptG0T8M1vfrMkjoieNs1bLXTyDsBe QBy1sxlp60Zrhdxcv7F0RgQvLSYJEAYaxQXFRIFvppOgbXhB5FJ6UWGG6N1AKnxH2t+3493VzsiL tncPIRK33ndC+4j0ILtMWWltfSfWDXunvTfytUZMH2CiAKH1PXknvfPa2ffhO6ZJpXnyrHZHlLyv 0vDuup6/7Vz36Gu2f1+T22Ko53FFh9RaBzjUXOL5QCAQCAQCgUBgGBAwS5vXqDgjB2Z+EQmCFk1E FnYNd9b+EMiycxRCE+EHQSF4EcYcBCaaAAJSXphMU0MwIohV0ySISdti60xkVJXgjlwRxmodpBAG c/AsL6AENkJ4VehSJyRA2bL5GXMfwhsyQWi0ELydMpvFlp7yiE94NItNEyPPdsuby+2sHP/6r/9a ksyPf/zjpYtv2jNEEMYETuWGM5KkfRA2wm/WAmgn9dCWBFtpCsqrXJ6j2XIf7oRn8XPo5B3wDAH6 //7f/1ua2ymzso31oD3MgfM0+jd/8zfl707N/rSRdBAI7azdfIe+QWfkAYln7ul9pqXxDvv2vMP1 vhPvAA2M98LzvkvvC+2Q79y3433imRFx4+3PM75z+ZuMkL4y+QZNXGQC5t1yHQkWvFe+b/nUC528 Z9HXdL+vqdcmnV4L0tMpYhG/IwR8+GZdHAZ5g2yjDqWjhCNyIBAIBAI1CBCksiBNOCb01AuEe/GE ZvHqPVvvmnwFpKheIGiJgxDRSgkENFopghSthdlvM+vZe2Y1Hf2okOtT+3c1bju/c/31xbk81efq lbd6v/pbWczQIz6Ey4997GPbbPBYjT/cv1u9A4ThT33qU6UQTbg3s59xHe6y9XL63SA9Q61fo/fO dcHZ++adrU4uuIcMea8Rnk7bczDfU6v3TJmE/K35HX3Nts63GrU5vIYj1O+hhyOnSHNMIuCF/tnP flaqu5kkMN0wyxIhEAgEAoFuI4B0NCIe1bwITJ2a7lSfr/3dKk/konayhybEugaaF97abGJsXVG9 UCvE1f5d75lm11rVv155G6WnLNZEfeADHyhNxqy74a1re2lPmr0DNEhM6wjNtihgHjhULBvhEtc7 R6DRe5e/nXyul3I98l4vXr1rg3kHmr1n1TxafWvVuO38Hst9TTv4tIrzJ4PiVrHifiAwSATMcrDJ Zl9P/Uz9HSEQCAQCgbGOgLUo1hqZMTZLjTjQlPRjIHDSVp1V7KnD7Ig5YC8G5WLKaK81Th1oBSIE AqMdgdHU1wy1rULTM1QE4/mmCFAbMyNhyuGc1chNH4qbgUAgEAiMcgSsdbHpMzfOtCIEk2Yz2b0O B9MdhEI9BjNzPhL1UzZrtJha92oZRwKHyGNsITDa+pqhtF6QnqGgF8+2RADJyUTHIBMDTUvIIkIg EAiMAQSYvViMX12Q3+/V1r9XnTD0Wn2qziN6rWxRnkBguBAYjX3NYLEK87bBIhfPtY1AkJ62oYqI gUAgEAgEAoFAIBAIBALDgECQnmEANZJ8BoGqpsfV0PQ8g038CgQCgUAgEAgEAoFAIBAYGQTCvG1k cB6zuWQtDwDCvG3MvgZR8UDgWQhYUG4vF67s7edhPxB7udh3Q+DG2X4ePJtZ5+Ke/TNGItgQM+8L Ym8RzgasA2kVrFnktMWeOvbrcbQb4GHvHfv01IZabGrv+9s+I/Y4sREjj2TVYB8SmzLamJUHzbEW mmFTi0UncWufjb8DgUCg9xEITU/vt1Ffl7Cq6QktT183ZRQ+EOgKAgsXLky///3vSwEfmbDHy//6 X/8rff/7398q9PMGxjXrlVdeWe5fY3+vZkE/gzAMxTsk9/qXX355+trXvlZuYmiTQ4Ts61//ermb e97Xp1E53Oehkktkmy92EtTP5ov//u//nn7xi1+U+5Hw6ubaFVdcURKaZumJy1kML3DVoE42fbzw wgvTtddeu3V9ZTVOv/5ut80bYVOv3p3Erfd8XBtdCJh8cdQLvvdWfUK95zq55n3MmxPnjVU971t3 NCtfJ/mMpbih6RlLrb2d6pq1PaHp2U4NENkGAj2CAI0GIZ6nr+OOO648c9V8/vnnp69+9auly+bX ve515caDNBMOBMjO7c2CGXqaIUSFVmgwARH70Y9+VLqOPvbYY0uPanaSJ2woHxJ20kknNUzavj95 b5pOhSF40CrRfNFsHXbYYWU+hBp1a+UcYN68eSV2tQv1LWBGLKUv7dEU2m3zRtjUw6KTuPWej2uj AwGE4pprrkm0pMccc0ypQa2t2UUXXVS6m7cnVe3eOfqMq6++upxs+OMf/1juCXbggQeW/ZgJETLR 85///PTqV7+61Aj7TqvBt3rZZZelH/zgB+nhhx8uvSL6jpWLNtzkxlFHHVVurGsyQz919NFHl14J q+nE720RCNKzLSZxpYsI+Lgz6ZFsaHu6CG4kFQj0GQIGaJtynnrqqVsFeeZbCxYsSJdcckn61re+ VW5enAlRJhFZKECamHEhFcy4eD4jFHhu8eLF6YwzzigFDBsgu85Mzd43BA6Cv1lTabhf3RNn+fLl pYBCK8KNdN5Aec6cOaXQQwN0wQUXlEIG7QkNEO2MPBCNAw44oMzX77xJIoFJmexVtueee5YEzt/y IKTUmuspH+LknOvNBJAbaBqsG264odQAeU69aYGefPLJMi2kyG/PZYKkrupPQKr2wV6Zetjk643q 5j5hDv7yQFazOWKj9DyTQ6Nn67Vpfka69crjmdo2RxqZCHq/tC0CrJzqX8WmUZqw7ySuMiobzaV3 Yu+99y7NNL2rMc7lFuy/sw1sv/e975XvEUJTz7si4qI/0P42Fa41ZdWn2bcKMbr00kvLNGxAfPrp p5dE6hvf+Eb61Kc+VRKbv/7rv04nn3zyVqB8t9/5zneSOL71t771rSVB0q/QZv/ud79L3/72t8t3 +xWveEXZP/z85z8v38Mzzzyz7Je2JhY/tkEgSM82kMSFbiJQJT2h6ekmspFWINBfCOTZUwP3/Pnz n1V4f7/97W8vNzE22BNaawWJW265Jd1xxx0lIbn33nvTxRdfnF7zmteUgz5BBUHIwj1ytWjRopJo EE5+/etfp7e85S3p1ltvLde30NhU17cgKGZkkQaEpBoQFgK1+8jP9ddfXwouZloJ0ISUN77xjeV+ O9XnmKbQECnXBz/4wVKAISBnobwat/rbLC9i5CyvvLEg8z9C/Xvf+96yjAQvxMcGmwShG2+8sSwH QQlWZpppveBtrVEmWY2w0T5f+tKXGtZNHkwRrRuyRuhXv/pVeuc731lq2OphXRUWGz27ZMmSum1q dh1Wjcpz+OGHp2qbIx20dMuWLSsJ6DnnnFMSVOT6hz/84VZskMdGab74xS8uZ9Yzjs3i2lvJu3TT TTeVGKv/pz/96ZIIEmytA4vQfwiYoPjpT3+azjvvvPT617++1LjWak/V6rrrris11kiP76m2r0Kg fXt5LSDCQmtNg4skmTj4zW9+U35DrtHSIEomRb7yla+UWm8TLm9729vSG97whq2abv2bdPR/tEtI PXKlDIiQsiI+eZKo/1pg+Ev8bJ3a8OcXOYwxBLIQotox+zXGGj+qGwhUEDDbTmgnpBvgq8EA/sIX vrCc1UQkDOAE+hwQByTHtSOPPDK96EUvKgmH9TMGeoIA7QytiNl6Aj+ChDjI96qrriqF1COOOKLU 5Dzvec/LSZdnzgschIja9UNM62g0lEHZ5YfQSINQLb/bbrvtWen5g8BDG0IwUm/9H41SLu82DxQX CF1IkbVMCBYBnFYD6dpvv/3K+jDjI9TQdikXwoisEdLVVzkJbuLBilBFCyHAohE2yFWjuiFhhDR1 kSbTHPVTr0bplRkW/zV6FtFs1Kbq0aw8SHG1zbWL+sPp0EMPLX8jJXCqYtMsTe3eblzjmjbS7kzi lAVpzMJurnuc+wsBTkhoZ7Sv98j3UBt8QyYRnH1jCL3voDY0muRFgLxn0jYhgajndUO+JYTLhAZN NiJeNe2VpnfNZAPtkL8z8fGuKzuzzwiNEQhNT2Ns4k4XENB5ZOLTqBPoQjaRRCAQCPQ4AgZ3gqFB utYGXtEJjDQwzKDYshv8ERmCPSGAQGKGn2BrttRMKmJD8CD0EiYIEoRsabjPrI3GgUCMHEgvm65V 4SLwOgghDkJJDkgNgkH4kBbCZofzrAFSPmSgNjBTo01CXKwXYgKH1BCS1bVe0Ee6T9NBe4HoyA9e rmXHDgQyAZlRLuXJZA1pciBlhHzYmDUWEMpG2Hi+Ud0IdTRa2YTLzLS2MOPcKL0yw+K/Rs8Szhq1 KS2P8jcqjzpV21wbwJowSgulnjR28Kxi06yO0ms3rnQRM3X3TssfNvP/TEBz3ePcXwjQmPjGfGtZ M1pbA32O78r7xgwOUaGR9d22E/QVNIO+JxMH+gXvufeI5pBJKpnJ+1urdZY+cuP7F8d7KOiLlMnk jjpIM0J9BIL01MclrnYRgSA9XQQzkgoE+hQBhAQxoSVpFJAN63IIBLQVBn2mY/oQWhJaD2QAaTDI 0/z4uxqkz0yEQEEQzQIqBwGNgnwIrAR0GoiqaZYZXYQNAaFJssCZ4OGQpnPu42rTJzjRLhGMvvvd 75a/EbZGQVkJ0FngQtDUh0CEuBB2rO3h4Q0pYGomeC4LQAia8hLKlUv58j0Erhk24tWrG0JAWGOO Jk3kwRmZbJaesjV6Vru1atNG5ZFuNSgHYVWdFxTrw8y+S18ZpZHr75lmaXYS94QTTihJz49//OOS YNOAMXmM0J8IeF+QbX3AK1/5ymdNfOQa+QZohPUDSA+nLMxefd8ve9nLtk4u5Pj5bCIFGfE+8vDI NFTfxKSXGZ0JEkTdhA2tj/6NNjNPZOR08tk3VQ36TQcyZTJBXZr1d9Vnx9rvMG8bay0+wvX1kTty qA4++VqcA4FAYPQjgKQYyAnw2ZxDrQ3QhHFnAVnhTICATwDRfxAyzGbS6iAliABBQpquE9Q9T+hF DggLBAtCCdLChh5Bsg7E8+JVg5lWi4IJCuz1c1loZvytDNZxICGuOar9mt/VI6dNQ8MpAyEFWSLM VLVIOZ6z53O++br4tBcEJYSRWZ+8aY6QSEd+NpdpfkHekCYzxjRk0swHvBphI51GdYO/upvRJuQh pdJXvmbpSVN56j0Lh2Zt2qw8sKq2uTLBV/m9P8YZvxFA71bGplWa0m03LmLJfJG3QUIyc6NMVuUT ob8Q0Dcg9d4ZJKSWWKiNtXLeJxMOCC4zT4Qbyf7DH/7QsMLeR33WpYVTA6a7+jH9zbve9a6yb/Og 9y5//+I62g3K61B2daineW43rdEeLzQ9o72Ft3P9DCI51M6i5etxDgQCgdGPAA0G4ZlJkNlStukG aDOgDsIE4RgBEe/d73536VENESEgWz/DnMRCX7OkhBLelZgk0dRYc/KTn/ykXMh72mmnpc9+9rPp Yx/7WGmGZTaVjbwZWYIHAZVGIAd58K6kvyI8W+xOi0I4MftqMfFLXvKSkjARsAn8zFyUy8yquhF6 mHtZ50HQV0dlY/aCwCFjylBv4gcOCAVzL0KU/JUJYTMDTEBCoDxP0EbamO4JhDXPWcOizEiWWecv fvGL6eMf/3iZt7LKXz7c5P7Hf/zHNtioa6O6IYrHH398+tznPpfOPvvsMk2YyqsR1hlb5nf1njVT 3qxNm5VHfattTuvifeC0ABnRZrCzLoomKmOjbRrVkRliFcdmccWTLi9bNHjq6N1FjL1b3uEI/YUA opDJgm/NUQ0IhQkIkyfIre/U9y2ebx/x4eo+T0RUn/VuWlunn8jfOQLlPWKGK+hLHALCY22e8uRr 5Y0G/1XLqz9wxDtYH6xnt2r9OHE1EBg0AoSITHzqDfaDTjgeDAQCgb5CwMw84ZTdOaKA9BACTjnl lFJYoAWy3kcg8JtNNWtPYNB3WNRL0M3OAAgcnhEXgWF+RuCgPZC2M8Jg8EcQCA/SJJy6VxuUBVlg fkbY0G+JR6DNGhLalo9+9KOllomwIu9PfvKT5dnf0lbOqmmKZ5THPeWvFzIO1smIb92SOtOImf1l budvmhXmf2aF1V9QZ17scr7SOvHEE8uyE5zEI4ybCYYRe39lrcUGzo3qptzqAAeEAoGSTsasHta5 nsqNUNY+q62btSkMG5WH0KkMuc2VD0YItfoiU7BznQApf+l5plGa6uB9yzg2iyueNnrTm96U5hcE l/bSeyl/grE1TxH6CwHfh+9L8M35xqrBxIH29T7THOsfvNPa32SHCRWEt56Jo77Pt2KSBun+whe+ UJIkJN07bBKHxlQ/5d1GrJB2kxTtkJ5qeX3Hjgj1EQjSUx+XuNolBGpJjw4jQiAQCIxNBGgq8oBO SDSgG/DrBQN3ngV1n1BAy0GI1Y9UZ2KzQCte7mOspUFy/I2cCAR3wjEhpF6QB22JPAgSnqvmg2DU uqeVdw4E4bygmTZmUWFj7yCAKwtCUy+oq+fys/Xi5GsZr1wH5at9VjmYwqmD+mdMMg71sGlVN/lz j0sYlHfOnzBXL71cXmftXO/ZZm3aqjzIKGIiqJ9yaLtc13zdOWPmd60QWW0/hKnaBo3imqW36JyQ SmMlz2xOmMskrwj9g4DJEYe29P3TPOfgneeuXdsi1Pk7Qm5NLCA9zGBpe7zn+X5+Pp+RZURZWtbl 0UzTAp911lnlpIRJFxNDnLhIj9Z5fkGqqu80mQoBcy33RcrqcM23H1qejPi25/o9/7bx4kogMGgE fKQ5VD/efC3OgUAgMDYQMJtKUCBYWq9jhrxZ0F9U+wy/EYcqEcnP14srXlUAIaj7u5pmfr569pyy 1sunGq/Zb2SHmZrZXDPCBPJuhCrhaJaeeBkrda7ioP612DRLK9+Tpuecq6Gd9Jo9m8tZTbOd39U2 91se+ZrzcAXCK/JMcP3Qhz5UmgpeWphNMsusEqzhyj/S7T4C3kGaQRpZmt7quj/aGcTGPX2XeA6T ODSDJmesc+NMQ1yBOZxDMOnht/fTBAHi41kmnOeee275nHhI9Ec+8pHSZNR6PE4ymM6ZvBCQMWsV bUaaTfFc148qL1JmYic0PVCpH0LTUx+XuNolBELT0yUgI5lAYJQgYCaSCZkBHLEYrYHw+773va80 gyEoZdOZ0VrfsVQvpIcDAwKvtR0IJS0RgXM0v9OjuY2RZFoazgmYlTmQWFo9a9kuu+yytKAwo0VM bD6rzU1sWJeTzcusK0SGrAFkPkpTI9AGcaVO24v00BZZM2bdHY3OZz7zmZKsWyNnv7K/+7u/K4mU dWZ/+7d/W5qSeues1UGwlKPqBVJZebaUtjoMJ+Hv93cgSE+/t2CPl79WyxMfY483WBQvEBgBBJgu jfbA3IpwFGH0IUDgpb1zRBg9CHA2YP0XszNrs7ghN3nx4Q9/uPQoidgiHVnTSdv3/ve/P51++ulb NTm0QXmtj/U6NDLkHpM9CJG1bPoGa8s4AzH5w1RTPt4rGifrghAu2iOHNDwjjbw2sEquaaE4G7F2 D/GJ0BiBID2NsYk7XUCgVtPThSQjiUAgEAgEAoFAIBAIBLqKAPLB9IxpGbMyDkFo7zgYqRfEt87Q US9U1yTW3kdyHPUCQuNZB1KUTeNcr504puVRVmuDlB05itAYgWcb5jaOF3cCgUEjkLU9PtbaD3bQ icaDgUAgEAgEAoFAIBAIdAkB8gkC84EPfKDUyFg/w+HK9gzW0NEOMY+tlZ+Yu/3yl78stUNcyVsn VBtne5a9F/MOTU8vtsooKlNV06Na8UGOosaNqgQCPYwAt9hcy3IgQBgQeDhy3eaebOAt/GVKku/X VscsKle0Zljt08PbWA5mX5nAsOnnRSl7Usr32zlbgMx0hVBj1rjdMNjn2k1/LMdjJmT9hRl+beqd Ya7E7CjC6EdAO1sXo/15mtRP1Hrx6xUUlI0ZHOcwTOfCgUHrlglNT2uMIsYQEMhaHkkgPEF6hgBm PBoIBAJtI8AsBDkgtOZAmL355pvL2dz777+/3DOIZ6VGgUekSy65pNz41IL1akB6pGWmlTnMYILF zOecc07p/rj2eX3nmjVryoXytfeaPVcbN/5uHwEL0u1DdOGFF5Yb5jIVWrhwYUl8q9682k8xYvYj AiY5kAnrY6zb6dWAjCvj/MKttTJHaI1AaHpaYxQxhoBAVdMThGcIQMajgUAg0BECPKbZgyU7TUBa eEMyG2qTQFoehEi8RoFQQbvDjKQ6gSM+c5M8A4wAdRoI2MrzjW98o0ybJ7CqNoFGikvb/fffv7Tt z+m3ei7Hi3PnCFigzksWARLJ0ca8dXFHfe2115Z7qHSeajzRjwiQV2hgeznkvq2Xy9hrZQvS02st MsrKU0t6gviMsgaO6gQCXUTAjueLFy8uXcDamdwsa97MlPkGkxOuYG0EidAQSAmorjET098gIHvu uWe5n4xdzRETmwtyPUsz47lFhatZs/i0QWz2ERu/7R1EAyQOskHoIVgQgOVhU0FC8QEHHFASFPeq RAUU9cpXDyKkRtmRLhtdZjO5nMa3vvWtEoszzjijFL55bRKaPec+zZW0eH1C7CyGdq6GRnWth6Nn 262T9mNSCDdrI/KiamY4rmsbpoR59jznB3+/4QlbLn47fQ+WLl1aPqOttb93RRo0N94d71OzesDL e4UIVwmu9rau4oYbbihn/3nkihAIBAL9icDA3xehP4sepe4HBMyQmiUzYHAFabfhWiGhH+oRZQwE AoHhR4A25gc/+EG6/PLLS6GZsHrrrbeW5mOEd2toEBfCtH6F1yLhm9/8ZrrgggtK0oLc0IaYmT// /PNLkiIdZMa+GQRsguvFF19cPkOo5UXpRz/60dZd120KSFC3r4ay6L8QH3nYGBCRIrwjIIR5BMnf 8qwtH9OTeut1lMUkEOKmHtzRZi9RCJz6EdjtG0KIz7POzZ5TbxskEuARKmWh2fJ8DuLUq6syfv7z n38WjuqJyLRTJ7vRX3XVVeVu8H7DwnoqBNNv/T5SAXd1QS7kx5QM8bRfiX1O3FPeTt8D7oS1t3R4 sqKly2RSetqpUT28M8wUYaUs2ljZ7YdC+2Nt1/XXX1+SskbrvzK+/XpGhNUTBi972cvKdzHG6n5t zSh3IwRiTU8jZOJ6VxAITU9XYIxEAoExgQDBHyFBMJh2EThpB7LGgFOBO+64o7xPi0PIJpQTlGk4 LOh917veVW4aSWBHoqTlPtJEW0IDgMw45/t57Yz8CcyuI1vOAs3EySefXO6WTvNxxRVX/H/27gTY sqLME3jWvrIUxY5AgewCCgjKXqyNILK1bKKgtnarrT22PTETMRPTY3T3REdHjN1Mi7Q4iIwoCCKI gGwi+yI7sikCxQ5FAUXte835JWRxuNz73n2v3nLfqy8jzrv3nXtO5pf/PMv3z2/JxLJQL4hGM/nU 01iQGW2q98ADD8wKOmVdXxSWJvKRV2zBOuusk/d3dx5MyGDdDso5wlSwyxVUf1r11XGNOCIO7fSJ XAgLsmZtE+0ik5ICIDmsdfbvueee2dqCYCBZLDuUbeNhwUZESLxSb68D1iUysNghlAiMNqx/0qof rEq/+tWv8vVGRmu1NKYShr+61DtcC7zKOjFlHZrh2tfo15qLQLi3rbljPyA9r7sJeKjaogQCgUAg 0AwBbkQf//jHs7XCLD0ColBCKfRIAfLCOoIwICXTKksKKw6CwDWK4quY+WfVUShz4jPMYvukxDq+ /G4f8sGSJNkBNyjWIUq4QglnzVGnzG8sBgLc68U5reSrH+e7vqmHDNpEoFiWWHwsMEhOm5n2ugtd d+cheuq8+OKLsxXKuh0FwyJDq75qTz/rOGqvnT4hA0ifcYIt8slqxRLG1c53dVtF3vghrup1LExZ YvyOeCEtvb0OSrwTbF0LXN24D8K2VT9cOzbEC8mDQ6M7oOsE+UbuXBPD0QKif3/4wx9y4g7YIaNR AoHhhkBYeobbiHZYfxotPR0mXogTCAQCHYYACwdFnXXg6quvzhMlXI0oYWI0WHQo12bkd9ppp1WW DMTGVkp3kyz135EnbmGysElXSzFvfHY5njJOAeY61li6k68cL6Mct1/yH3fccemwww5Lp59+enaZ Y+1hiWlW2jmPMn7UUUfldUZYWc4666zsWlavr7u+1nFst0+IArLCPQpuMEKukBAWEqTDd/tKcgj/ w5RVwaZdn2WirDfXgbgd2axcJxdeeGHuNqLVVT8o+7Nnz84WQW2TgVz1Yj8CZX/9GqsfM9S/66Mx NLngs4zDUO9XyB8I1BEI0lNHI773CwLl4emF0fgy6ZcGo9JAIBAYsgggFtygKJlm7Fk6bJRgyrQF A7mXUc7EaSBHiuNtpRRFtTx//EbBpQAr9d9ZbcTKOIZbludU4/HOKQqyY7idqaPU3518zldYcxCb vffeO7vyTassVdOr2BFET9wI64pC+UYMuOdpt53zYMEtEHH7+te/ni0W4mjqpbu+6rdNabdP+sBC RH7WgpIUgOWJFYdMSBjs9R3xsb+0VTDUZsG0N9eBc/bbb79srTGeSBYZuuoH2ZElOCG9MK9vZDIG yA5rlHGJEggEAkMTgUhkMDTHbchIzV/6pncCjvfff/+cyGC4zpQNmUEJQQOBDkeAcsk1irvTEUcc kWNNSmwGZVaQu+BzLmjcowTD+59FCBlhzfDcEWeCoFBskQaB7ixFlGD/S1Lgdy5xzncOqwRiQFF3 nucVIsKKIT4HAeGC5rxbbrklnyMGB9FAyhrlY9GhfCtcvX7wgx/kT/EjlH8Ei3sbWcS/sOhwpdMH MUusQpTwSy65pNvzKPgsVuJiWF+0y/JRj1FBPJDJxr4iDNz2nFtwVJ/+d9Un/dIWty94cK2DE2uZ 2B7j5n9950am/YMPPjhby4wHklQytkkgwMrAHQ6mPbkOCs5ihVh6yH7ooYfmOlpdO87RBiLmWrG5 7qQSNw4sidwoueMhlBay5Vo5HIv+uiZYG7mYIuLluh2O/Y0+rZkIjKhmVVaumV2PXg8EAl5y/7NK EPijH/0o/bf/9t/ydy/XKIFAIBAIdIWArF8sAYhHmV1HAATpi58RD0IBRTTElFCWKdrIiNcaJVUM RkkKYALGcVzTkCV1ITJ+Rz4cL+4DiaKYI0cIlIIAUeqdK97D8chAvQ11OqdRPvIUCzcZPRPJp+6S ZMB5ZGMN0S+/aY/lgcKuTdaT7s5jbeFOpm+SElD89QdGpegbGRr7Sk6KL6tGwVEfm2Fe71OpV7us JTAnLyIDW/XBz+/6Qh779cUYIxza05bjfBrzkvHOMe1cB3WZrrjiijyG1mMq8Tdd9YN7G/LlGiGf 8TDWyDAMvb/064wzzsgkqPR5OH2ynHpXc4n8T//pP+XvrsUogcBwQiBIz3AazQ7sixfWt7/97fzS +O///b+nv//7v89+8R0oaogUCAQCHYRAcbEqhKeIRllm+UAkKMh9VdRrKwRFveU7WZAFsnQ3adOX 8qmrLkf+p4s/5Xj4+E7W0of6aX6z1X+rf68f67tj28EcTjY41cfN+fDTRnf4Nbbd7nWAXLHweOcg LxIT7Ljjju+prqt+aKf0sWDh+uJCyW2P9W2PPfbo02vuPcIN8j9BegZ5AKL5AUEgptwHBOY1txEv GZviRVJeJmsuItHzQCAQaAeButJcP743inP9/Fbfu3o+kYULVzulL+Xr6fOyHN8dseiqr8362G6f GslOqcv5xeJS9rX72e51gOycd9552eJ3yimnZBe9xja66kcz2VnDWAO52yE9fUmyG2WL/wOBQKD/ EQjS0/8Yr/EtBOlZ4y+BACAQCAQCgX5FQNzSF77whTzJJk11X8SjcO8S16OuZhn7+rVDUXkgEAj0 OQJBevoc0qiwjkDd0mO/mbYogUAgEAgEAoFAXyIgPgpB6cuC7PQFeepLmaKuQCAQ6D0CQXp6j12c 2QUCXAJkAZINSNCsIlBUgKnMQFYLj5mzLgCMnwKBQCAQCAQCgUAgEAgE+gyBID19BmVUVEeAf7SV zflYC5BUbrjhhhxk+tWvfvV9q4TXz43vgUAgEAgEAoFAIBAIBAKBQF8iEKSnL9GMulYhwNWARUfw r1ShCuuPdQ6kAY2A0FVQxZdAIBAIBAKBYYqAFObWOVI+9rGP5YQIw7Sr0a1AoOMRCNLT8UM0NAWU PchipPvuu29eu0E6UGszHHTQQTkTztDsVUgdCAQCgUAgEAi0j4CU1zweFGsAyQIXJRAIBAYHgZGD 02y0uiYgsNlmm6UDDzxw1UN+r732yqTHonlRAoFAIBAIBAKB4Y6AxVctbGrzPUogEAgMHgJh6Rk8 7Id9y3Vrj8XiWHksGBclEAgEAoFAIBAIBAKBQCAQGEgEgvS8g7bUykuXLs3bQA7AcG+LOZ8f84QJ E/InnK2cHaVvEJAwQtxUxEj1DZ5RSyAQCAQCgUAgEAgMTwSC9LwzrnfeeWf64Q9/mJ577rkU7ld9 e7HL3sasL6AT+YnSdwjA9bjjjkuf//znIwV438EaNQUCgUAgEAgEAoHAMEMgSM87A/r8888nGce+ 9KUvJbEoUQKBoYDAL37xi+wrvmjRoiA9Q2HAQsZAIBAIBAKBQCAQGBQEgvS8A/uyZcvS+uuvn/bc c880bdq0QRmMaDQQ6CkCDz74YHrzzTeT7HhRAoFAIBAIBAKBniDwxhtvpAsvvDBdeeWVeQFx51pE XNa5o48+Op1yyilpnXXW6UmVcWwg0LEIRPa2jh2aECwQCAQCgUAgEAgEAoH+Q2Dy5MlJbOhjjz2W nn322dzQjBkz0hNPPJFjRcPdv/+wj5oHHoEgPQOPebQYCAQCgUAgEAgEAoHAoCMgEc5+++2XFw4v HgM+eb1Ya2/MmDGDLmMIEAj0FQJBevoKyagnEAgEAoFAIBAIBAKBIYbAdtttl6ZPn5423XTTLPkW W2yR/996662HWE9C3ECgawSC9HSNT/waCAQCgUAgEAgEAoHAsEVg3LhxmeR8/OMfz33ce++98/+s QFECgeGEQCQyGE6jGX0JBAKBlghw2Xj99dez//rUqVNbHucHa3bNnj07+7Svu+66+Rz7Bf1aa2q9 9dZLI0aMsKtHZcmSJfn44axMwA1GcOsNRj0CtB8PHi796EeIouphhECx9rz44oth5RlG4xpdeS8C QXrei0f8FwgEAsMQgTlz5qQ77rgjK+E77rhjuu+++9Ivf/nLHLy77bbbpk996lNpn332yYr6zTff nH784x/n7EWCfE866aR0wgknpLXXXjsvBHvPPfdkEvTRj340TZo0qUdoXXvttUmmSFmRRo9u/fh9 6623cr2NWZNa7e+REA0Hr06djefC9Qc/+EEmh9L/H3bYYQ2t9e2/1gD73e9+l6666qo8lhbp5ZKz 5ZZbpsWLF+d111544YUcm3D66ae3nZmzu34g0L///e/zdXL//fcn19AZZ5yRzJBHaR8B98L111+f brjhhmGbgfJPf/pTeumllzIo5513Xrr11lvbB2iAj7R0h4mKG2+8cVUmtwEWYcCaM7F14IEHpk9+ 8pOxfuCAoT74DbV+6w6+bCFBIBAIBAKrjYCXGyIzc+bM9Gd/9mc5NT13jt/85jfpoYceygG7e+yx R0JwZCySuUgAr5nPyy67LKdzpUh7QcpktMMOO+T0rqw+yBJFu51i4eNf//rXad68ebkO5KtZkYL8 0ksvTVOmTMlkqxzTan/5vTefq1Nns3P17cknn8xYF0LUG7naPcfaarvttltWnG+55ZY0fvz4tPvu u6fjjz8+K9FIkbWsXnvttTR//vx2q81j1FU/KIaIlfaQLqQakY3SMwTg5h50j5p0GI5FZrSHH344 d80zRYKATi177bVXvm/IPJSttO3ga0z+8Ic/JM/+iF1qB7HhcUyQnuExjtGLQCAQaIHAnXfeme69 996077775kBdL3TKqqBdbmqbb7552mSTTbJLFgLz4Q9/OH3wgx/MFhnK2M9//vOsyCM9zt1oo43y S9JM/yOPPJKPb9H0e3azEN12221ZoaYoNyM9XKqsmcHSdOqpp646v9X+VQf04svq1Nnq3I985CPp X/7lXxI3PtaP/i7Iq7GzxpqxsW244YYZW7PrrHOf/exnM5ntiSzd9YNCyH1vgw02iOxWPQG24ViW HhsycNRRRzX8Ojz+Xb58eWLhVRDy4drPoTZaXHCfeuqpZGHvKGsOAkF61pyxjp4GAmscAqwR3GcW LFiQdt5556wUFxAQHC5mZUazzN77HSlSWHWQE1aXUijWu+66ayYw1113Xdpmm226dXNjcWBF8mm7 66670sEHH5wJV6mXkv6jH/0ocYF5+eWXs4VCDBK5LRTYuP/www/Ps+POu+aaa3L9YoW4WB1yyCG5 D37jxoegUdL1C3lDSJq1VeokK8uJdufOnZu23377rKz5bCXnTjvtlK0piCCrmYKMKKxcXNC4+kyY MCHXN73KFoVwIlDcae6+++5MPAVTU4RZxcjMvbAEWOfKWvwp4+hnCo2Fe+076KCDVlllzO4aM/j6 jRLKBQ/O9iNrH/rQh9Irr7ySCW1jP8j/q1/9Kj3wwANpq622WlVPo0itxoSC1ZO+ktP1yxpSCLn+ lCxbrdop12+jXJ34v3FAXlnthmNxvRdrsO/DtZ9DbezcI/VnxlCTP+TtHQKRva13uMVZgUAgMAQQ KC4MUrCyAHRXvAiLwkjxZulBIhpdb1iIECHKL+W6u/L444/n9hEO9bI+iRupF+thUP7MDCuUaq4w iEGz/RtvvHESdHz22Wdn0sPNC+n53ve+lxV4dXDhQ4gQEm1T5hGaVm2pE/n453/+51w3wqHtM888 M5177rmJz3+rc5EFcTTIys9+9rNV1pUZlbvgWWedlV32EESEi/VMfeQRFyVGhhXshz/8Yfr+97+f Hn300Uyuzj///PTTn/40qaPdAj8kAbl49dVX83giXwjMBz7wgUyAL7744iwDl0fWINY75A7pYelr 1g9Ykxn5VA/rhHghLn310tWY9KSvCM8555yT8US8yfeP//iPmXS5Lrtqpy5PfA8EAoFAIBB4G4Eg PXElBAKBwLBFAOmhmCI8XSUOaASAsszF7Oqrr85Kcd3S41gztxRpcT1m/7sqlGIWJzEgiMdmm22W fckRH+eXog1Eh3UDsaDosoawKjXbjwyJVaLAI2r88REK/UV2EAekjFUJuWClUR8rQau21ImMIS4I jj6Sm/zc855++umW5yIBJasd6w3igMyQUYwSGZE41hX9gy/riu/Og6l2+Ndz7dMflhFWqnZJD9Ly k5/8JH31q1/NFpJCIM3o2vSbDEgL0oBYkFO8D1wkp+Au19gPY4REXXLJJfl6YG3hpqQvjZn4uhoT FqV2+yrg3di6bi0e6XqADzxcN121Y7yjBAKBQCAQCLwXgSA978Uj/gsEAoFhggCFmVJL8W7MgtZV FynBiAMygziwUkhoUBToci43FYSGi5E2WhVKqpl5bmqUavEiZENG6lYiyi0FmvJPQfedZYBLTLP9 5ORK9swzz2TZnn322UxU1G0fBdm5CAiLyb/9279lwkWBbtVWIVsUehYP/aJg+0QM9Lerc8luK0Uy A8STbMiccYAbq4t9jz32WK6Ty6DzfCIfyJu04qxMXBNt7ZRCEGTbQ2waC1yNAeLDBY5sZODbTy4k xjGN/YC1xAZkFsdj05/GmB74dDUmiFY7fRXgj7C6BpEklihZpr7zne+kT3/603kMumunse/xfyAQ CAQCazoCEdOzpl8B0f9AYJgiQOGm+CMOJTajna5S/LlhffGLX8xuYVyMbrrppjzbzhJSijop2WbV tdNs7R+WB+5kyBcLAkLC2uA8hAfx4T6HnPS0IDPcsxAqfaVQs2iRm5sapZ+Cz0LA3YtlhaXhG9/4 Rlb6W7WHEFCyWXy4m/mkqCMJtp4UhEnmNC59cEXekAr1IZFw8Xu9+M3mOBvC1RWpbDyXVeyMKn00 TGXbayzGCS6Ok27aGEybNi0fj2A0K3Bj/dOPxnrJWEp3Y8Jyxk2tlFZ9VY/2XD8LFy7MG4ubcUHI xIV1NfbaiRIIBAKBQCDwXgSC9LwXj/gvEAgEhgkCiIWtJ0qzrlNEWSRslEeWGgH9lNA66SmWCYpw oxWoQCiWx3kUY3UgDYgJJZt1gYub5AGU8J6WevyRPiI5rEkKgkHh1wdWkv/zf/5Pdk+74oorspub GJ9WhbWCexv3qrLOjmxzvSl1i0mdxPSEPPXkWDJqB7FhqSqFe5x+wR1ZLW52YotsrCfGwdg3K8ga TBXytJKpnTFhhWtVSr36UGRBCm0sYAi80k47rdqI/YFAIBAIrKkINH/Cr6loRL8DgUBg2CBA4Ucw kJJ23aMaO09B5saE/PisF3WahecWZWssiAjXKdaD0047LSvV1gn6whe+kKZXsTWKOBmWhkKaCjEo ym8+qPrTbD95EB0yyo5m9p+7FYWfOxbLj7gcROjb3/52OvLII7O8XKYo0c3qJLM4JskQFFnTWBcc Wy/Nzq3/Xr6TpcRTsVrYWKZ8IkTkbWVdKXX09hPpscFSynLuYNzlFHFDiCYMxSkhGF2t1eE4sVhI B0sN97NS6mPV3ZjUzyvnN/tkDYQdjLi5kb9cI7BDaLsa+3bbadZ27AsEAoFAYLgiEJae4Tqy0a9A YA1HgJWHSxkFsdnClAgLBZYSrlBexedQLp1nZp81BrkRVF+38jieYklZ5kpm5r2xWPjO+awq9XOR CPVZuwMxuf3223P6aseRlfsU0qJ+cSSsDK32U9RlpqO4X3DBBassW2SXAOG3v/1tPvfkk0/ObalP tjIkrVmdsGCRErvid0kB1M0tz8aVj+tVs3PJiWCqo2xIQnGxcx43QISJO57EBxYGJAvsi0XOub43 1tWIb/m/HOt444EU2IcMwlFSB9YcC84Waw3yw9qzyy675PGGfSFE6m1s27XEHc44ivNCoJA1VkAW pIKP47oaEzK001f4ii+SMt11JIMdfJEqcsrU1107BZ/4DAQCgUAgEHgbgVH/syoBRsovLy9lioIX y3AvXrxmfLnXUGq8rNeEfg+3cWUpoHBR4HoTFzLc8GjsD+IgWJ2lBtFQKN4l81WZ/fc7pfIXv/hF TtcMV/EeLDWsBYceemh2FavXrw7WFQHmjVYCyvB3v/vdvDaNew0x0QalnHtTWXuFfKwulGx1iNsQ B+N8W9FfTgAAQABJREFUBAP5YqlhLWm2nxJOyScn5ZhCTimWYpslAOmh8Iud4WqHhEhDrU7kp7FO fRW/IgaIMu84xEA/EUIZ4BAVxK3xXNYJRI5bHDLJiuNchAK2sObqp2/qYv065phjct+l1XauZ7C6 Kf3wFU+EhE6r3NKkxLa/XmCnj8bN8wzZMb7iqG644Yb0//7f/8tkEJYy5yELpbAEIncsOBIflLoR UYkr6v2Agzgv5JlMrC/6IK7Gp/4ZY4vakrXVmGhTxrru+qo9JMv1YlzL2LL8uNddJ66JVu2Qxbmd XuDpPnNduq6GY3HfuZaV6ZWFV4xdlMFHwDPC88N4eFZFWTMQGFG9kHsWmTpMcTGjOaPy+/7MZz6T X1rDtJurusXtpWSl8nKUIvZrX/vae1xNvNC5VZgR96L1IlVa7V9VeS+/9Fe9vRRnSJzGDYmSJ0Uv pTPKexFAKqz7glT85V/+Zb6+KYoUdsqq35F98RIsDoUcuCcolYiBT8pqvTj3f//v/52J5re+9a33 Yc+SQaFWv3FBQNTFyoFMOB+RIIu2ECL3F8Wbgm4iQqFAIz7Oa7UfkSgxR/og8xlFniLOsqNPlGUW FO0gV45DEJrVCRsEAmbFhcrzApEho33qazwXjgiD+xhR0Rb5KbSIlOcrPPQFFhR3LlzacZ6NjCwo lBByUEqKxU67dWsMfFhy1K2P5FP0G47aMSHgGOeRBaEqxauPQuqT4lNIgucdd8HGfqhTO4ilfpDH uYiavqvbWGmr1ZjoS7t91Q/9N7bOgaOxRXTJYvxatTNUJkBg/IMf/CDfY1/60pfK0AyrT4Sce6ny 93//9+n4448fVv0bqp0xsWGy6LjjjssTM0O1HyF3zxAI97ae4TVsjnazW3GdUqSY1bSKe30RRoqX VLeUs29+85urSE+r/asLTn/Vu7pyxflDFwHKNUuM2XUEXrA6ZZJLmq2xIASUSko7VyjKfbPCakFh F+jfzEKKJLEaNyvcrrh22ZoVBIzyrFDcS2m137GIGfJAcS8uXM6jJNv0h4Lut6Lc+2xWJ8KBsCil /cb//dbsXJYgW2NxPjKD5CmIQambTAiJrV4KBvV9jd/VQw5bT4v2yxgUTNSBMLTqBzKJ3MCa3DAt uNbb72pMetJX4wo7uLkW62NL5q7aqcsT3wOBQCAQCARSCtKzBl4FXtiUNuZd7ide2v7ndlJIj5ld sQb2mbXmF0/BMEPcbD8XFgqBmVWzp9w/vKi5hFiXpChNlC9Ei/uQGVoKhGBpM6CrU6+ZaUSOS4h2 1a9v6m6luK6BQ79Gdtk1yGqAVHMTaqaU14GhWNaVy/pvvrtXWALcK66xorw3Hrc6/7eqs9V+13iz 67zsK5/NZGpWZ+O+xv9LPa32l9/rn5T0ZrFP9WMG+rvnTk+Lc9o5r9WY9LS97nDrq3Z6KlccHwgE AoHAUEOg50/8odbDkPd9CFDYkBkKyNFHH53dOM4777xVPveIyN13350uuuiiNKNySUGSLrzwwnyO GVWkpnG/tT+QIgG3juV2wf2CS4aMVVwXKJsyQ3GrK+4zlMvPf/7zeaa6WXvt1Ms1hdXq3//93zPx 0i7FVJYsSqnZ/ihrLgKuMcTbdS2GgMtQb324XdfcnxAerl6dpsSvuaMcPQ8EAoFAIBAIBLpGIEhP 1/gMy19ZRJACbi+Ce1l8uJ7Yh9BQDv227777ZkJEUbSA4sEHH5xdehzLF7u+XwDvTdUCjhYz5B4i zoFCyD0OEeK/z63nxhtvzG5GJ554YvZtZlHiwiHuoVl77dTLJYlfvUxZZvK5rAhaN8Pf1Yz9sBzc 6FRTBJBvbkXiO9qZpW9aSbWT25qMWq7tuLZaoRT7A4FAIBAIBAKBzkMgSE/njUm/SsT1i5VHcKzs SeIOuEewwpRUrAcccEBW7JAcFh8xPUcccURewI/CiLw07ue2ZsV39bKwiKNwLEIllgKZEviMKAk4 LtmdpLPVvmO105t6ucmVwr1NwLpYC0SK9SlKIAAB15htdQqyE9ad1UEwzg0EAoFAIBAIBAYHgdXT AAZH5mh1NRDglsaiI45HpiTpV5ENihzygBDJLFWyNgn6RkrMcLPwKEhP435peJEaMT2/+tWvckwP f39ZhxAt2Y60geRIJWvFd1YZlibkS6rc3tYrG1YpLFTieFh5ogQCgUAgEAgEAoFAIBAIBAIQCNKz hl0HCI9NXMKVV16ZbrvttpzZCfEpsTDc35CenhTn2gTdIhxc1UpBmqzBwL1IxizxFJdffnleX4M7 HKL0N3/zN+Xw93y2U289yxPLTszEvwfC+CcQCAQCgUAgEAgEAoE1HoEgPWvQJYDoIDySCLCsiNNh sVFYae66666cAc0x0lcjK0iM82ylNNvPEmRDUsThsN6UVL4sPtaVQEZ8SmxgkUBJBs4+++z04IMP 5jVNuB41ttdOveqMEggEAoFAIBAIBAKBQCAQCLRCIEhPK2SG4X4pe7mvIRdibmRUQzIUWam+853v 5KQDjpHhTdYzm99YZLiwHXnkkU33W/8EkZLRSrICBAepWbBgQU5RzY2Na5uF2iymKYaIPGJ7pMG2 CQxvbK+dej/96U8Pw9GKLg0lBGQ4dF1L7+5alqLd5IDrXwli3v+jKUmF0iyOj4utUiZ58j99+Ke7 8XctKM1k60MxoqpAIBAIBAKBLhAI0tMFOMPtJ+vjsPLIbrbnnnu+x4WNyxnri1ibcpzYmP333z+v eWPdGzFAu+++e7YCNdvPgiMdsIxtP/nJT3KMDsuPRRw/9rGP5Rc+AnXxxRdnskUhtLbPn//5n+cV kcUZ9aZe40SpqG/DbeyiP52JgMQc0qVfeumlORZOlkL3kmsb+XHPIPvHHHNMv6zn05moDKxUsJYA hbXaM0syk8Zy7bXX5tT7UvQ3JrPg2vu73/0uXXXVVdnS7TkiI6SxRKRMAL3wwgv52XT66adnN91S f7vjv/POO+c2pPz3LJThMkogEAgEAoHAwCIQpGdg8R7U1rizffe7383kozHQn5Xl5JNPzgqa2VC/ SyzATU08DjJj9pr1ptV+5OaLX/xiOvTQQ3MCA1Ycx4q5oUTIpvZXf/VX6aCDDspJE8x+b7755tkd znFIT7P2uqsXqMcff3y2NJFRnVECgf5GwD2B3CP5rnH3j/WA3EvcQbmLXnDBBdnK86lPfSpITz8M iGfMz372s+wei9BIt99YkBaTORKeSDduXa96QU5N+Fx//fWZwLJSm9zxTDFpgxSxUBtvJKeUnoy/ ZyIShVixmEvZL416lEAgEAgEAoGBQyBIz8BhPegtUQjMQouxabaSullIiQaU4vZWEg9w37CvrE3S ar81d7RB+TPLbVbVOaU95IcLnN/MqNZ/c0xv60V0SvKF0tagAx4CDFsEZCU899xzs9unrIannHJK Ou644zLJ12kE3rVs7ahGy8KwBWWAO4aQyBR5ySWXpGOPPTZPyDSzoLBSS9iC9LDoNJIeLmdIqwkT zzib55jjZLLkcvvZz342p98vXezp+JvgQay0jwiTE/Epz9lSb3wGAoFAIBAI9B8CQXr6D9uOrLm7 l2yz34vbWGOHWu1HOpCZQpAaz6MEdqUI9rbeIDuNSMf//YXAnXfemZVtVgQWVIvhslaWUgg8y6Xv 5dp0vNl+bqYUX7Ft06dPz9ZJC+yKh+OqhTRx1TLZwEohKchJJ52U9z388MPpuuuuSy+//HKul1XC ulRSztsvfoWrKasspf2aa67JCjsLLlklKbFuFpcv1gr3G4WcNYL7qTq0L55OHdba4sJnDS6WFTIf ddRR+bNdmQsuZGZReeihh3K74gBZfk24KK3kbZaREYb6QNYPfehDTV3GWGnI79PG+mb9sVbW4DJO ZFGvJCv2kZGlpsjRm/EvxOfqq6/OcnN7bLS4azdKIBAIBAKBQP8gEKSnf3CNWgOBQGCYIiCGhNIu 9o1iTGEvSnu9yyYQKOOOoThbI0u2QmtjnXDCCdnt7ec//3m2BnH75MbJesEqYQ0rbSA+iMAvf/nL nFqe9YhFkwxi4xAW/7NGmEhASrRlH2vEf/zHf+S6WKHI+73vfS/Xs88+++RU8epwntg6dZioEMdC ZsQAASMzhR/psgDxmWeemeNnvv71r2drVjsyT6vS1SM855xzTiYhiBcc/vEf/zFbYCxoPHPmzJby cg9sLKwmt99+e8aonra+fhxyx2ojkQo3OGRFu61ITznXYsvwR0LF4yA7JQlBb8df3XAmzx133JGt PkF6CuLxGQgEAoFA/yMQpKf/MY4WAoEhg8Dy5SvSG3MXpJdmzUmvvDEnzXxjXvX/wjRv4ZK0eOmy tKxSBtNK7o+VNa9SlieOH5PWmTQ+bbDOpLTRelX81tS108brrZUmjH87FfqQ6XgPBGXdoKAjB5Rh ZKVVfEbJFoYY3HzzzTnhgbgSiUQo0dyzEAlun5/73OfyAsCIjExw9p166qmZCN1666058yLiRIF3 PgvQvffem8kEWcSbIF8Ua5YhvyM1AudZohQJF37zm9/k2D2EiqUECUCQrJdFTgRH/J108X5TD8sO 9y+/kY3LmOyLyAP3vu5kRnr0gTwsU/vtt18mbpdddlnu1xtvvJHxaSUv+RG+UpASsTHPP/98tnIh bI2FOxtZyQyzQiYRnwMOOGDVYsuN57GUidVCNGFa3OGKFag341/aIKfNOMJPP2AXJRAIBAKBQKD/ EQjS0/8YRwuBQMciUE3op9fnzE9PzHg1PfLMK2nGK2+mBYuXpaUrq3TLy0amRctHpGUrR6YVK0ek FWlUxXfeVtBGVN9GVL0amZakUSMWpbEj30gTR69M40atSGNHrcwkaIctN0y7bL1x2nyjKWncmOHz qEEMKKsK9zNbd0Uqa25pzz77bLZMIBSsKlzi7LMgMCWddYgS7BOB2XbbbTOpQpBYGGyUb65RiA/y oV7nIz6C8pEKyrr1thADx2oDQUBs7GN1sR8hQpxYNR599NFs9UHgxORph8KP8HBD02/kxKf6yau0 I/OcOXPSAw88kN36uNGJL5Q2H5FC0libupIXKauTHhYt7nwICmwKuayPg9T7JXseYqZPFmTm4sZt jZtbs0IWpMx6Yyw9jaU341/qIKuN3OSHoWshSiAQCAQCgUD/IzB8NJH+xypaCASGDQLzFy1Jj1Yk 547fz0jPvvpWmrNkRJqzdFRavHJcGjFyUrVV5GZEtYbT6GqrPinA1d/qew2CijGteGdburJShCtl OFWWopXLl6Vn5i5Nj77yXLr+/mfSBmuNTR/ZdrP0sZ22yJagMmNeq2lIfS2z9YRGeBAaymsza0Pp GLIgfsbxyA4lPWNakRsECgnxe70gEzbH2SjbNoV1CWmRnvn+++/Pivy0ypoiToiCzyWONYrSTz6k gVuV7IrIA7LhOMSJRQkhQX7Up03HKn5HUFh8rNXl0+/c32yNpZXMrCPihSj7ZbFjFhh1I3nibbqT t94WvAvpQlJs9aIdsTxw5fqG7LFeOQ7hQXzENzVLfKAPcDjjjDPy741rLPVm/ItsdVkRN1uQnoJO fAYCgUAg0L8IvPdN0b9tRe2BQCAwyAjMmb8o/e7x59LtFdl5/vVFafbSMWnpiIrkjK7c0caOTqMq sjMC2WmnNHCgVadkhXhFmrdiWZq7ZGl6aebi9NTrz6abH5qRPrz1RungPbbJ1p+RlSI/FAtLCAsM ZZpSTWE3a98V6aHYFzemOolpRhxaYVI/lmKOkLDqiAuyWaRX8gG/cbsrQfeIkhgfsSkK0kWRdxzi JCW9eBcJFiRA2HfffVfJilhwb+OaJlmCIpam3VJkLgTPecidjSWruAW2I2+9TdaS0j+ksZDBcoxY HiRLuxIwkAORQwxl1OPiBiv9b1ach1iycJUyo3JJgweXvp6Of6mjLivi28xCVY6Nz0AgEAgEAoG+ RaBN7aZvG43aAoFAYGARWFophvf/8YV09uV3pB/f+Hh68JWV6bUVU9KycVPSqPFrp5FjJqSRo6QW 74NHQqUwshSNHD0ujRo3OY0Yv26aN3JKemb+pHTt719LZ156Z7rs5t+n1996d82TgUVj9VpDXsSE yOiFQHAxKxnX6jVTtLmdUcAp0JRuM/2sEDZWGJ/qk+ad5aUnhYWG0i5+R3wIEmOfYh+iw31OxjjE TBvk4AbH3Uxh0VCHtvWD5UF2NgWRkGlM8gNFDBDLDELQ08LKom19LVal4iIIAySsHXlLu6wjNrKw nsGyFHLDXZ9kz0NukDnJEqZPn54P01fWniJDObfxE+mxGUuWMC54ZO3p+Jd6yWkjtzEKK09BJj4D gUAgEOh/BMLS0/8YRwuBwKAi8OacBemG+55MNz74XHptUWXZGbVeGjm+IiRc2AagIEC2lRUJWrR8 QnqqiiF69a4Z6cUqWcJRe++Qtt50/UoJHABB+rAJM/1f+9rXcoyNFMyXX355Jgu77rprVuwp4jfd dFNW8CnaLBrIhRgZrl4C7Cm+XM+22267bG0Rj0O5prTbKMc+i1JfFObSDdYO1h5ppSnvO+2006oM Y8gVAmRNLITI2jD2qQ9R23///XM1LA3qILe4HySoWKy4obGS2E/RF9yvLq5itldeeSX3pR2Znc8q JYmDzHQ//elPs5WD4q8fUma3I2/puz6wFHHTY30RY+S7on7WHHjUs7QhbBIiSN7A3U/mN3E9jis4 wxp5RMTsQxqRRMkfWNPgpu2ejn+RW0wWWREyboZh6SnIxGcgEAgEAv2PQJCefsDYC5XCI2DYCzTK 0ECA8iaoWqYnyt9wKK++MTdddedj6TcPv5LmpsnZ8jJq1ODc9pR8bnQrR45O85aNT7f9aU566fV7 07H77Zg+/qEthxTclFVuYX/3d3+XLRSsF9/85jfzuissKiwmLBcID0Xfc4CCjSggSAgEPJCHr3zl K9l1zDkSCiAZFG4WIpYW1gUEhCud4HyKd1HwWSFYYJCeuisWMFkjTj755PT9738//fa3v00vvPBC XotH6mkEqxSEByEjtzrKMwsZQcgQJzFJijr1YUbl6uU5x4LUrsz6T4azzjorW1m4n7HCWNiVxaNd eckBO0RJcgKuhTYxQvBhmbKuEOyRE6SGhYnM1vaBFXxhgjj9+Z//ee4HlzfPAIRHljsxRogimVmO nMdipPR0/PNJ1R9ywhLO5NePKIFAIBAIBAIDg8DgaD8D07dBa4XbhODiadOmxUzeoI1Czxum1HBh oSANB9Izb8HidO3dj6er7nshLRk7NY0eJ0HB4JNwMowaOyEtWT4qPf7qrLTkpkcqq1MVo7Lj5j0f tEE8AylAFijbJU6F1QGhYMFATCjVjlPM7lPwBdBzL6Pwcr9yPtcvVoZjjz02W15YdRyPiLgWTz/9 9KyAiyOqExbtSHVNWXd8vXCn+4u/+ItMJhAM5yEBJVtaOZZlhxKO4Pi9FAr/0Ucfna1TZCvuZ8gE goYMsZ60KzOi8NnPfjZnjEOYSmwUa4zf2pW3yMfCJf7oiiuuyEkLWJLIhER+5jOfyYkLyFxIHFkl cjjmmGMysbHfGNlvDP7pn/4p/df/+l9z9eRhnSrElLXHOHqml9LT8XceCxTSiDw1ktRSb3wGAoFA IBAI9A8CQXr6AVcKAbcIM5te5FGGBgLGzWx6iXcYGlI3l1J2tl/f/US65sGX0+Ix66Ux4yvC08N4 nQ3XHpszr82csyS9NndJ84ZWY+/IUWPTiknrp2dmv5GuuedPae1J49L2Wwyt+4XiS7G2IQasBJRp +xtn8f1PyUZOHKfUj+M2Ram21UurhTcdo05kRSnKff7nnf+d6xlU3La0oXCzskAmZZ7FQcyNYyn6 9YJ0FatS6U/j/z2RmSzO13+TC0UebZK/lbx1mcp3z1hWGjFLJQU1lzGWq2bF8bAqeDUeg6D2tPRk /Fl5yGnBWnLXyWtP243jA4FAIBAIBHqOQJCenmPW1hlmCs3CUhqiDA0EzGzLCFWUu6EhdXMpH/rT S+m3v38xzV0xMY2ZVCUT6AHhmTh2VNp9y7XTATtOTePHjEy/frjKttUPpIfkIyt3txXjp6SHnn89 bfHYc2mzDdZJkye8bRlp3rPO3ev6sXVXKPcl81h3x7bze3dtIhe2euFCd9FFF2ULFWsJFzzues1K 4/3Q+H+zc7ra113/m8nbrD5yIDBf+tKX0jXXXJPjblimSkxSs3P6c19X429CRewXksf6JlnE6uLY n32JugOBQCAQGI4IdP+GHo69jj4FAsMYAW5tjz3zanrpreVp9KSpPSI8UyePSQfvNDVts9GkNG70 iDRp3Kg0cWz/usQhPotHTEgPzXijWsz0tbT7dh8YxqPTGV1jcRHrIkCfKx3ywMVuqBUkgqWKhYeV VrzMYJGerrAjFxc6i8GyKJkUixIIBAKBQCAwsAgE6RlYvKO1QKDfEXh+5uz09Mx5afmo8WlMD5MW WDvn2Wr9nj++vCBtuf6E9LEPNl8tfu0Jo9MWUyekKZPGpIVLlqdnZy1Msypr0PuXq2ynuyOqBAuT 0ozXZqY/vTArSE87kK3mMdzZxL2ILUESkKBGa9BqNjFgp3MxQyj0oVOtJ2Rj9bcYaqfKOGADFg0F AoFAIDBICATpGSTgo9lAoL8QeOG1t9JLs5dUmdIm97iJ2QuWpt8/PzctXb6iIjRViuMmLGanTSen Qz40Na0zcUxasHh5WqsiQIiPNXgeem5uj9t0gjWClqbR6c25ixJL1eSJQ9PFrVedH4STuJgJ4LcN h4JINMYjdVK/kJ0ogUAgEAgEAoOLQJCeQcBf8PAvf/nLdMMNNwzZ2dVBgK3fmxRcbV0SridS3zYr UgxPr7JXCUQuq8k3O24w981buCTNr8jIiHE9v72XLl9ZEZ7lXYq/cGmV5e6Zt9Kb85emhUtXpC3W G58O2mn9tMvma6c/vVqtQ1K13eNSKa3WDVpU1b1g8ZIgPT0GME4IBAKBQCAQCAQCga4Q6LlW1FVt 8VtbCMji8+STT+a1KayxEaUzEJD297DDDsvuJ62Cw61JMmPGjLx2R1m5vjOkf1eKUSMRiBGpymP8 7s4+/Pbim4srS9LitGTZitzE3IXL0s4fWCu7uokB6hXpqeSDP/c66aujBAKBQCAQCAQCgUAg0JcI BOnpSzTbrItFgYJndfYjjjiizbPisE5AgBuNhQpZfDq1rDt5fFpnfEU+Fi1No8b0vZvY8srnbcup 47NlZ+N1x6W1xo9O06r4n6dmLkijka3elOp+WLZsaRpfJU3oa9c2i0xalJKFVcC79NIlXbB9Fp+0 zo6YFr91lSK6N11rPEdQ+/PPP58XHG38zSKddfkafy//P/3009kqaQ2fRvJtHZibb74599VCu0O1 SKtt3SNua9JNt1t6e1679bdzXF+NQVfj3I4ccUwgEAgEAoHAuwgE6XkXiwH9RnkWgNupLlIDCsYQ aozrW6cHIkv7/IH1xqWXn0fM2lcW2x2Gj1TprA+u0lnPWbSsSpiwIJ82YTUzvC1fWsXxjB2RNlh3 cho7+r3plduVq9lxzzzzTCYHlGbE5+yzz87B+6eeemoOKpf9i1Xv9ttvz5bXRgLRrE4TFkiv66A3 qafd8zKN/fjHP04f/OAHszzqRLy4VVpks1X66CKPdXco9zKv1YsFdpE8KZxlZzvggAM6/nqty1// /uijj+Zx2XPPPfMipPXfuhqDrs6r19Hqe1d1tzqnvr8vx6DVONfbi++BQCAQCAQC7SEQpKc9nOKo QGDIILDZBuumaRutne5/9oW0fGm1COSYvkuPO65at2e7jat01tXn7x6dnf74yvw0oVrXZ+sNJqaJ lWtbb8uKJfPS9ptOTDtu2XcZuFhUbrvttjy5sM8++2Tr6pVXXpl++MMf5vTMn/rUp/KCmKw/NgSo HYuC2XfWIYSFVaanxWSHNbzmz5+frUu77LJLroLVSd3tBORvvvnmuQ+NAfISFMgSpg31D9WCODzw wAPp/PPPz+O21157vWch01Zj0N157eDRqu52znVMX45Bq3FuV5Y4LhAIBAKBQOBdBIL0vItFfAsE hgUC48eOTnvtuHn644tvpgeqbeSoDdKINuNkuKfJxmZtninVmj3IzZQqS9tmU8ZVlp3laVGVpU3c jZTV48eMqlJij0i7br5W2m6TSemFN3rn8rd0wVtprREL0m4f3CZN22S9PhuD3/3ud8kinJ/4xCey OxvXselVEgoJRFhZ1l9//bTffvtlglDWdqGwloI0SWzBHZUFSKazl156KZ/74osvpuOPPz5betRj vzg9a91su+22uU6WG3X4vXENHKSElchnafutt97KqZfJ+eqrryZtUOK522mbdWjWrFl5nRfEyHfn FpKkPTKw/rBW1Esz+ezjPsby5DsCtc0226yyXpFB/9VvHZ/iEtisrnpbrBPNZHAMfJHL7tJjIx6w ofSLo2Ol4w6saN/4NY6B37o6z++Ipbpgtd5662XS6rOUVnU3uxbKOfXPno5Bb8a5t+NSlzO+BwKB QCCwJiIQpGdNHPXo87BHYKtNpqaDd5uWZs15PD0/7400ZrJFSruPt9lw7bHpsF02yIkJ1qrigpCb dSZskD62zbrp5sffSNc/Ois9+sLctNUGE9JJH98kzVu0YXr1rcXprQWVoluluX6vqt09zMsWz08L Z7+S9tt1k2rbqiJZffNI4vp1991357iZadOmrRLEd65tV1xxRbYiICNFmV51UPWFm9njjz+eCctT Tz2VrrvuuvTJT34yk5K5c+cmBKUQC+RqRpXcgrXo17/+dbrxxhvTSSedlB555JEcW3PIIYekVrE1 rDHc0Xzed999ea0ZLmn+R87E/nz+85/PROe5557LxIeL5V133ZUtISeccEImReS98847sxK/cOHC 9MQTT6yKTWomn0UyL7/88iT25KMf/WgmEhR29Vm7R/1i18QMiQ+yiOlpp52WLVzN+lpPfY143H// /QlOjQXB4L6n3q4K8oaMyZJ42WWXZWzKOLmOG8eg1NXVeQgkjGDLouf64KbIilRKs7pbXQuNSWh6 OgauEeSvJ+O8OuNS+hif/YOA655r5RZbbJE+9KEPZbfZ/mkpag0EAoHeItA3GkZvW4/zAoFAoF8Q GFtZYfbcYfO0uLLMXH77H9MLc2dVxGe9yuLTtQvaG1Ua6t8+9npOSd0o2OvV4qNLl61MT7w8L6er 3qAiSNbxsSgpPiXBwevz3htj0lhH/f/li6t4oAWz0p99ZLN00kG7pvXXmVT/ebW+s4IgDJtuummO 1SmVid8RL8N68X//7/9NF1xwQfrrv/7r8nP+RGiQHMcefvjh2SJAWb7++uvT17/+9UxuEAsLYrJo +G327NnZEqJd1iVKz4c//OFMQlh6mpUVK1bkY8UTUeL/8Ic/JPErCve3rbfeOpMXrnSIAosTawvi VpJpUODJ+6tf/Sor8Fz25syZkxUv9ZCnmXzqYNlhldl5552zrOeee25W2nbbbbf029/+NpMO7SJ3 +gRPSnezvtZJD8zh2xhvRB6ETd+6KkggfNVJgYTPPffckzMr2oeoIphlDFjGlO7OK1ggUyeeeGKW sdGdsbFu9ba6FrglqkvpzRi4RpDhdsdZ/1ZnXLKg8affEJCV9eKLL86WRBMdn/70p/NzoN8ajIoD gUCgxwgE6ekxZANzwlVXXZUuvfTSjs4SNjBIdFYrZsYplXfcccd7lOkiJXehXXfdNZ1++unZzans 769Ps9cUUTPWjfEd2pxbLfQ5b/aytGTl1LR0yrQ0ft2Nqhif8S3FWVStu/Pc6wtb/u6HRUsrJbg6 5oU333ZnQ3Z6UlZWyv7yhW+lccvnpAN23Tgds++OafMN123LEtVuOxRz1h7Kd2P6cW5llBJuQu6x Sy65JFt0ivsWiwoXKONIQd9hhx0yeWH5QUAo7ly04E0RVY/YHm5tlHJjgVQgO60Ij36wKnDfYjEw jpTfosCT2X4KP/cuCrKCBFDUp0yZskrhRkhsyMuGG26Y5SsuW9y1WsknyYN6Nttss9xP/Xf9Ijes PtoiD6sQLFi8WtWVhXvnD4xYl1pZelhWxEO1Kvp77733ZuxYrN58883sJvjggw9mKxT862NgLJTu zuMKaDwopmblWZEKrkWWxrq5FLa6FuAHc6W3Y9CTcV7dcSl97O9P43XrrbdmS2d3bbnejDXy6Job ysX4uO7dJ64Z1lHPGdenCY666+xQ7mfIHggMZQSC9HTo6FGwPCzNFkXpHATMetsorLbGQuHjYuOl Rwnu70JZ5hbFVafVS3VFqqw7E6ak9bb7WNpgu73SpPU/kMavNbWK9XlbWeytjD0lO9VKPGnZogVp 2fzX0xZTRqUjPrp92mfnLbOFpxmWvZXLeQiJ+4clo1mhAIvJoWixkrBOcO1SjC9iK44DvkgSMkEB 9n+9qF9sieQBSIJ+sL50F7OiDsciGiVFNoVcfcgaZZg1g1LOVezqq6/OCnZxC3NuwYwFCMnTLtld B+U31pZW8jnGsTby+nQ+xZ8yauba/xRSn8hcq7rqmCBRLBitLD2FkNXPKd/1HVliRUH6yGRsWKFY e7j+NSP37ZznejjqqKMykfvFL36RzjrrrPSXf/mXaXoV59Wq6Hc710Jvx0C77Y7z6o5Lqz729X54 sYqaTOiuIAMsdsaZRXIoF9e7+8YzglUR+fMecF97Nuy99955YmMo9zFkDwSGOgJBejp0BCk/Zo8P Ouig/ELoUDFDrAYEuCiZ/acgDkShuFK4KZKUulaFW9vYSZU72dzH06LKwjJv3kZp7OT1q21KGjm6 77K7NWs/W3aq2J1lC95M601YmfbdY9O0X0V2JC1Ya2LfryNEBiSFqxJlWPC6oHjKCMWkEBe4feYz n8nK/cMPP5wVe+dyW6O4I7Ase6w3FDN12k9BUweSAXekwKwudzZxJ2Z8iwuXYxCb4galfoUyXeR4 e0/K5Mqst3ufCx7iw93NPpvvReF3PoXR57TKqoQ4IdusVAidum1kbiWf80sdRQb16T9FDZl2PcMR Fshfq7qKlUw9vtf/L3W388maA2vZ9grBM06smeRhzSlkqIwBwtHOecYOceW+5/tPf/rTjFkj6amP L1y7uhZKn3o7BnDqyTivzrgUWfv7EzljwWQd7K4YO0TaOXAeyoWLIyuPyQLF85iV+OSTT84p1z1H ynNhKPczZA8EhjICQXo6ePTMvnpwtjNr3MHdWKNEG+ixojAdeuihOUaBsttdWTFiVOXqNrpyYVuQ 7nzsxfTEi8+nRWlMGjlurTRq3KQ0qo8I0MoVy9OyJYvSysVzq21e2nCdcWmfvTZLu2+7adpy4ylV ZrgJ1XX9bqa07uTu6e+USco7dywzru4jric2xIfyyHXLMZ/73OfyujZl7OAo49vPfvazbGEwS0sp O/roo7M7GMuD2ArJEMSGsB5897vfTX/7t3+bFb1jjz02Z3szc33TTTfluKC6Yk0posCbBUaOzznn nHyPmx3mjmY8jasia5zMachTsRyyhDhXogTEQAY6FpDvf//76Vvf+la2DrEUI2TaOvLII7NVoy4f 8oLQIEqO1WcuX3BD9Pbff//0ve99L/3FX/xFrk+ftNOqrz0dn2bH6xMiAhMKMwKG1Js9R1wRvx/9 6Ed53OpjUJIydHce2ZEjdcIUttYyaiz1uiW96OpaKOfCuqdjUF8Tqp1xVv9gjEvpY7ufSLKkF+6X 7gprKouQc7gbDuXi2cJ66F6VHESiCuPlGeNZ47qLEggEAoOLQJCewcU/Wg8EVgsBL1IKFyVOfEY7 hTK5/eKlabdtN0svzZqTnnhuVnrw6ZlpxqvPpUUrKpenKuZn5ajx2QLECjRy1OiWCRBWrqysDRXB WbFsabUtSWnZ4iqjQUV2qu9T1xqXdtlu/bTr1tukLTdaN204Za209qTxaXQ/kp3Sf7P1rKRiryjz lJAjjjgiu5hQsMT6KIiOuAzWBMRGgam4E8ovVx3WFdg6z/EIjPgb+81Oc0/yibBQbpATJEK9yFXj DDZiQRaKPTJm9lebFHvWCzPCRUFiXeGGxyJTxle7MsmRkUzqO/jgg3M7ZpsdJwMb6xY5paFmNa7L h/R84xvfyFYVv+nXP/zDP+RP/dYnViJWS9eXOrRD8W7W1wzcav7R5le+8pVMdiiKBQP4fPnLX06S NMBX+2QrY0A+FplipWp1nrFwnyCNxp81qWBaF70+vsZCW62uhXKe662nY1CfpGhnnI3ZvvvuO+Dj UvrY7qf7CF627orry70H45Kdr7tz+vJ3EyJ164xxdI2ZTHC9lGupnTZNcIjt4sb2zW9+MxOe7siO yROultxY3edw6K/iWWZiocROmVjRnnutfi32V/tRbyDQCQgE6emEUQgZAoEBRMCLfOL4sWmLatt0 /XXS9ltsmA78yFbprXkL06tvzkvPzZyTt5feeCu9OW9xWrBoSc7SRjEeMeJt6wyyU1yjxo4emcnM hutMTJtvUFlPNto8bTZ1rbTe2hPTOpVFZ92K6Iyr1g7qiQLRF3CYPS9r27ACsNg0K5Q0in+9UDAp yFzNyF0sL45BNCjaSukT1zYkx/9wUijxlGaKVL1oj/uPrZ1S5C71kKXxfMSA+xvSRIYiV5GlmXyN SqZ+1Qs3MGOs3dI24tOsrvp5vf0uQUNjYgF1IW9Il61e6mPQTFlsPA8pMiYw8h2OBad6vc3Gt9W1 UD+vN2NQP7+dcUaSB3pc6jIOt+8ShbDSIiuK6wHGSLR4WkSkGTFuhgNXWhsSJ1GH66Gr4hq0AO+F F16YMxOypDa7jruqoye/WahZXyXgUPQV2XZtf/azn80WZvdMbwsCyxrLPdWzqFzPva0vzgsE+gOB ID39gWrUGQgMEQRYXaasVVkyqm1F9RJesnRZml+RnAWLlqZFlTVoybLKTa1af8f+8r06rFKCR6Sx o6s4obxAaeWGWX1HbCaOG5MJ1YTqcyAsOl3B7AXO9clLXpyN2dti4Wk8r5nyWxSgxmP933i8/+vE yDGFKPi+OqXdeurkpLG9ZvI1HtP4f6v6elNXY9198X/jGHRXZzm+cZyanVeOLb/5nzLcXWmFmfPU 0VXbqzvO3dXfnexr4u9cSmUI5PLK8oewcFO75ZZbspUTcSkJTrrDB/42pXx2dY5jWKNdV55NjRMv XZ3bm9+QEq6sLMri4vRNAhyJXFiBTPRMr6zYvS0s6ueff35O4sDSFaSnt0jGef2JQJCe/kQ36g4E hhACI6uX8PixY/I2tSE8aMWKKnC+Yju2apo8v9QRH+e084IfLBi82AUTs9iszizmYMkf7QYCgUD/ IcDaYuOKh9xwH2T9OfPMM3PWROthHXPMMZmsshYjDawzEjCwPH7kIx/JbnDNJJRUROIN1lGurMUy iRyIx2N1RIK5liEchVRzQdNucSlFTLjhsSSrx7GKBBAyO0oy4tmmHcTZ844Vt5FE6yfLrb6yYnHD s5jyv//7v+dEIZK5iEEySSTmkDssq7R29ZOrnlLkQ9TgIKsiaxhrmQV6udhK7EIm1lvEsisMZGos CVpyA/EnEOhHBIL09CO4UXUgMFwQyAQnDc1A3HihDperMPoRCPQPAggHUsJtlDJvsqS4QSIPFHdJ NriiSY6CPCAfYue+9KUvNY1HQlwkA1HP3/zN3+QkIEgCy8rZZ5+dEzcgA+qU4l1sjTg1ViZERGwg UoRUOI+r7F/91V/ljJPI1H/8x3/kmMWS8vtt9+MR6Ywzzsj9aBWng8hw4Zw2bVpODY8EIWISMFx5 5ZVZZnFOpV5k55RTTslJTchQ5BNbB4dC4FjLZsyYkSeY9AkB4jqHRHWFATniGd0/13XU+n4EgvS8 H5PYEwgEAoFAIBAIBAJrCALWuUIuWFRYKVhzZPYTY8aSfVOVpOCHP/xhVs5lSBQLw5ULESpkpREq cUGOu+6663LmQwuVcrMV9yLWkBWE9QXhEH/I7UwhC9JhEz/nPASCfOpi7bnhhhuylUZmRklNLrvs spwFj4se17V2SAQiwjrDYsRSg/SJSUKCJFpBAKWKl8XSYunidA4//PBV8sn+iNRIqOKThUc2PuSJ FUliD+RKX7vCAMGMEggMFAJBegYK6WinKQJmhzxQPRS9ADq9cHHg9yy9anEz6HSZQ75AIBAIBAKB 1giwULCccMlCfFhZvva1r+WYG9n+EJU//vGP6Qtf+EImGSwwYoHs5/JW1uapt6AObmHebawhSAyr h+O5riFUUsa3KlzUZDOU4ACp4cbG5Yx7GaLifbn77rtnC5J4HZngEDB1F1e5ZnUjOtLbs8Ygd/qO PCFLCI84SCRI/CPS4hhyIy/1wiJmcd/DDjssHysWirsdqxjSxIWOlUwfu8KA5SlKIDBQCATpGSik o52mCHiheAl4SEuH2+mFW4GXhBdQfZ2NTpc75Ot7BCg61uKhKJlhbSTBZnApSpSDnlwr1sm5+eab s88/t5fe1tPXPR4sOShR7jcTDopZbEqZlMKtElPU++4Z43wz0c2K2Aqz2iXTnaBuyqz2zG4Lbl+d QiE1uSMzV1fK6Oq0EeeuHgKUe9YJ14p7mrXF9cAKgSS4J10PXNOQANYfxIPbmevFWlKNxbWJ9LCC sNRYIwpxQAKse9Ud6XFNineREMDmmicDwuWaZBm69tprs+uYzGxkQFr0paviekRCipubzG3WKhML pA79Y+3Sb8ciPCxWruF6QeoQJSRL4U6nTrhxiSsxTN1hUK8zvgcC/Y1AkJ7+Rjjq7xIBAeb8gr0Y zA51evGy46tdFLBOlzfk6z8EuHFwM6HcmHFtJD2ube4ijcpCVxJxOaFoXHPNNdm9xkRAb+rpqo3e /jZYcnADooCZmRbzAGszyvA3myz4vKtkGtxwKIWUMs8arkpcj8ygU0Z9r6cmpkzeeuutmSQhq6tL erSLRJnp32OPPd53nfR2POK8vkMA8XUNuL6+853vpF/+8pf53ra+FyXedcNqQcF3vZXiN2PqGmpW uKdR+l277mkkST0IT3fZ2tSN4Ci+O48cvheC4bpGUvzGWmNB2O4mAvQB0UHyxBQh42J11M2VTVpr dZDdtW+ywHOs0RPDZA8y1F1ZHQy6qzt+DwR6ikCQnp4i1gHHe8jxtS0+wEQys2LWxcPJbxQtioAH jv2PPvpo0/3tPLTqXTa7RSFg7WB+9wKgkDRrsyd1myFqVBrr7XbKd3J2pWB1ipwhR/8jQFlwzZod blQItG6m1qxrO/71RVrKC0WDQkGp7209pb6+/OxNf/qifViYcTfRAG8Zpihr55xzTrr00kuzJa1x Adh6uxTHMtvMNejqq6/O+Hp2TauCqM1u14mptrRjEUckdHWL56BZcWSLC5A0xVE6C4GSyMAaSGJR vM+853w3Gef9ihRYf+e0007L16MeeBcgCK2IhuvSO7i4cDvHtYD0eJf0prBa8o7wbEH6xdS4Xt2f 2vMM6aqwGJk4mF65adffZSw64oa40H31q1/NCwJrR3tc+borhZhJgGArpT8wKHXHZyDQUwSC9PQU sQ443gOWwsXVSlpM5IOrB+WKuZv/MD9bDzQvcA8jD/Bm+3vSHUGKVo9m6hdM6cEmk01f1N0TOeLY QKATEKDMuueQE4oCCyDCUnzqKdJcs8zKumcdQ8GmoPjuXMeWyQFKNtcX59VJVE/r0QYFhsLOLYbC RhEqCo62TV6Q1aZdclJOzFibTEEO7OeiYkbaZ1/LYQxZjwR3mzihxFEqGxVIcsPK5jez0p55nm36 wr2I7IpnFJdCM+qsNI6lZCpw10/Kpno8M9Xh2DKj7jgKsDHx3FS4JGnHMdpxnv+NFZnVLw4EphRj x7Ac+J/VjssROZzPQtUq8D03Fn8GFQFjj0QgycgxkoocIC7upRtvvDFfG9zOTDC6BrigIh/NivrU JSmCrGcKi4w00L0t5VpFRsT6SGltEsB96r1fJgW6qr/+PCjHqdc173nGOsqKjfxJZd0OQfOcs9EJ JH3wDCqxQn2NQZE5PgOBniIQpKeniHXA8WYnvUQpNRQU5nW+55QCpmgvZQ8/DzazpB5mrfa36g5F wsMUUWLyF7NAofCg9dKWqpMS1FWbreqO/YHAcELALOjll1+eZ18RDilsKR6sEKyy1v9gpWCZMGHA ZYbSjFT4zb3EzUosAcXFZII6ERCxBT2px/1qMkQ9MyprrPVGuI5aa4TipVD4BT17dpCVzNxv/H5G le6WHBQfbmWeAWSn2Pe1HJ5flDZ9RP5kwqIMSo/b1Ww1eckIQzgXwgNDM9Oef1zJxC3IbMXS3ap4 NhYlstUxyCxLOcsQTCjCsEVsrHNCEeYqxyXKc/bLX/5yHjtKXyFz+mOiihJZnqmt2ov9A4cAJb9c A4XkIsvep+4RCr8JAPeo+1XGtp/85Cf5OkBwkV6B/4rz61vpBYLkHX3HHXfk81h5EOFW59TrKDKV fa4jBEe7JgPcw97DxYXT9fV3f/d3TRdUVUdjX4uMPukUhx56aHbF1HcxSO57+gYi0yhLkanU4R52 P7IW2cjFoqR0hUE5Pz4DgYFAIEjPQKDcx20gMjYvYDOSHoJmc0sxw+ihY2bTzGnxN261v5xXPs18 XnHFFVlxoAh5WFPWjjrqqNwWNw2KxvRqBowMSrt1lzbiMxAYLghQFqRy5Qrzgx/8IMePUITMeiIM CASF1wQBywbF3szxueeem5VpSrkAacd+6lOfypYLs8qKe7jdeshgYUWKNn999ZmN9oxAgkpRHzlY IRAPzw7H+p8lBKHQ7oknnpgJknu8P+RA7rTL2kIR9MxBCOxrtPaQnRKFhFFCyWp2nTLq+YdsIDmU OjiwTOnH9ddfnxUu8ve0sLaxzPhEeCjD9UB37cIL3pRD5JKyyHKlPyaOjDlypMDZPr9H6QwEXCve kd6nlHbFmJ1++ul5zH23n0vYF7/4xUwKvOtcB+4L71aTgoqYIPc10s3VrBTnuv9cg64R9z8LkNLs nGb7PCPOOuusfA7vDsSbtdO6PQiaa9CaQK53EyYIWePEQbO+5grf+cOa437SH224lxAe179nWHf9 hAfXPwQPQYQDsqN0hcE7zcdHIDAgCATpGRCYB7YRWaXM/FAmuK8U0tNqf6N0XspmNxUPMg9QioYH n1lYdV5yySVZwfJyUNqtOx8cfwKBYYSA+4zi5MUuYN3sMMXI/0XZ9knptc+EgXMozawWFBYbZQg5 onyUzEeUo3brMfPrHjUri+yoH3miuCA6pVCGKDRFKdJGUcIcR1m5+OKLc9Y4qdlL/EFfy4GMcQ2i pMlWx3JjBhy5aVbMLJeZ55///OfZIuZZpN+UNM8obrewlYmKosnyw+IC254WBIzyxlrkfIoxCxJ8 1U0WhBdJgzECybLnGqAoe25SfvVTcQ2YUELY9LFg3lO54vi+QwAhNYaK66gU41usMeU+cW+63rhq GT/3kDEs5xlr5ylln+/G2zXo3nQdlWvR9eE+Vz/SzkLr04Yce45wsTM5YHNPu9ZmVFZG17X74bzz zsvWUnW7/rXLYuoaLJYYn2S1uYZdj65FhM53Ewz+d+97RnnnF/dRz4Li2lb61KqffocnjEyq6Fe5 xlthAJ8ogcBAIhCkZyDRHqC2vPClxPTA8RArpdX+8nv55G5iJstDjD+7hz9FjdLjIWiG1UPxggsu yKktPbzbrbu0EZ+BwHBBwH1io1RQHigWStlf+ul/ioCNIuLTLCpF2D1HcfG//Y4tpd16HC9InlLO 3Y4Cxr2EO127xTODRddzQ/ye2WVrcUyvrLp9LQcFjmVKv9XPNQdxgEGzAhdK4nHHHZcVSbGELNH6 7ByKIhdcdVDmKKmeX/7vTaHAaZOMZqwRKsocQkuxQyhhQn7jSYk008/CxF3Qd8/FUsjoWekcx0fp DASMR7Ni7BuLY90jRZlv9nvZhxiZDJTEwLXqueDa+dd//dccA4bcuB5cN4hH+SyEBNkwccGVzXdt uq7JVZ4ThdDYZyOf38q1pn6b4tr1rGncuMi5d5AmxKq++Y3cZCikz7XvO7JIN0CW6liRqfH6NoFg QoAO4T4q1s+CVXwGAgOFQJCegUJ6ANvxEKLw1B9Emm+2n9uah2J5wTvOTKmHsIcbk7gHqQcy5YFS 4cFl9ld9Zqr93m7d6o8SCAxHBAp5cd+Ie6PwuLcoIEpRQMr/9vnuWNZYQdEsFu4l91rZigJTzmtV j9+RJy40XF4oKpSk+sSHNhX7KTQUL88JblomNJAEmyxWJjrMGpNrekVK+loOs9/c1RAXmHmO6Bsc KWhIZCmwKPs9f8RCiS8kX8GbvPZ5plHIzI5TzuwvRT2UUZ/6o81WRTssUVzWLrrooky4PCcppdYx QWpM/rCMe2bCXWzPfffdl/tVXBxL/YUcObbx2VyOic+hh4DrjJXS9ez+dQ0iNyVpBgLANZLL6VbV ml2uIfc4QuO96jovRMongmNfIQ+Nn64d122rzXXduEHVvVWeKc0+3RfNNiSoWJ988iJhSfKsoQ+Q 1fOLzmHzPNNPz5NyDyP//+W//Jcss/um7B96ox0SD3UE3n2rDPWerIHye+iVB2DpvoeJ4GAPYEWc AatPq/1moVh1+Ct7CCseXPxyBen+8z//cz7XA5s7h+PNCHmAUqasI8I1pVmbzerODcSfQGCYIODl Lsj9xz/+cVZgdMtaGRQV94kZznIMZQGB4JpC6bHYp3uO4uA+skr6t771rTyh4BhWDb77zmmnHu1R tgRaszRwU6F48NM3eVEnP+5l9637G0FCKGQ942JjRtazhRJPWUNKPCPa7U+7cugfBY9FiQLFBYai KIC6ntbZfuSIyy2yBgvuhJ5rZ599dvpf/+t/5XVHJFuxFopYKVYYdRsL5EVBQuGpn56b+snVyHH1 Qmnlcme8DjnkkIwBdz9EzPomn/jEJ3L8xN/+7d/mWWtywEnh+mNCSN/sg2MpxhlBK8eW/fE5dBAw yYfYuIa4Otq4QJokRLBNNCAArgHXnfvbNWtjMalvrjvPib4u9WuuL+p23ZsgsbHOelaU7whRsbC6 vzyrxACzNrvH3A/uVc9A1z3LEKyiBAKDhUCQnsFCvg/alVrTDIoHbSleyohOeZh6EHvINNtPkfHA 9oI241SKB7MsLup2DMJUzNh8/J3jwWo2FUGiYDS22aru0sbqfFLW+PRTkMhNceGS050yQSFynhnX ejHzpl+ClaMEAj1BAKFACsyQum/cS+45959YEPeo+9P+b3zjG9n64J7x+z/8wz/kT5YI95JPM6mU JfWqT/AwxYHVoLt6KNSsCK7ladOmZTcVCgkFhBJfskzpH4JAJsqL69+kBiXFfY4QuX89NxxHHrK0 25925dBnrnPk0wYyQR4zxfWZYGRN9jnyI3KeN5RIspGXIgY7+1he9NlzQZ0wK89CCqg2zDTrG1zr 7ZRxd85f//VfZ/yMlVlxzwbnaJt8zjW7TzZ4IbGKmXp4IptkK8XM+4wqFgPmJaNV+S0+OxcBRNW9 g2jbXKssfYiN63d6ZQF1vbsO7HeNuPZsrsdy7XVuD7uXzD1i079mxbOvxB2V2CPkEHbwsllKgwVZ Ee/mnc1l1HMKVlECgYFCIEjPQCHdD+14OdvqxUvZ1lia7TejiigIzGx8+Xs5UxpYdJTy8PZwNwNc 39fTuvPJq/HHbBLiJT1mcTUxG/yVr3wlKyStqia3zDjIEvJDCaIgUlg8fKMEAj1FgHLrXjEbijTU 7yOKsa2UohiX/xvvXRYXCrYJhTJb675zXDv1SNnMUkMJ55alDveKmWky1ov7WKwPZZzcPku7lDly 2Kc/RZZ2+9OuHOpG6swClzbIWP/uf4TLMbZ6ce+bUa8X/TIW6qiPhWPMrDd7VtXP950SVo/FsY+S Wy+IE8VNO8bIRAorG2KDuPkNASrFOFCCWbBcM1E6EwFKO0sl9y2WQJRQhsIAAB+sSURBVO8Z70FE VwY1hNa95N3h+kPCXS/l/ThQvTI5Qj7XOlfUxmfJQMmhHde5rfH5xiLEEoQA2UykePe6TxBISRrI 7xnAs8RkgImCgcZyILGKtgYfgSA9gz8GgyaBh42HeePDqghUXujl//LZzkOpu7pLXb35NLNEufES ouBxjeFHT7mj1HhpCYo242vm18PUDLi+mhFGkJjgvSistt2orPZGpjhnzUXA9dPoItUbNNRj620x 44ywUCakwKaUuf4p2u6LxtLVfdxIGBrP7er/nsjhGWPrq6KuOtnoq3ob69FOHSNkRyYtyp0Ml3WC Zqab648Abq4+XeHe2E783/8IeE8g6hJWUMaNj3FiWUT0kRzvD+9Jlpz6uPeVdN5pXFKlnPZuQ4wt 7MlS3KyIKSMrt1iTE51YPBNtsCsFEUJ+kDabdzFXfO9jLqQwNvnDskqHGIh7ucgWn2sGAkF61oxx btrLVmSn6cE93NmfdROFcuiB6IHv4em7h6tVr6XT9nJCaigiLFqf//zn84ydF5qZY59eXmZf+1Lp 6iFMcXgg0GcIIBvW+aEocflyjZulNjvtmh+o0ilyDFR/tYNUfuELX8jPI4qy50oplFgukPYN5DiU 9uPz/QiwQIjFs7As8uB9YYLgpJNOytYGRMe9Y+LAfdTfhWWVu6RJOTIgCyYwWJ78Vu5n7zjfxZv5 rLtWIm8IhXcvuVkcy/n+Z5EyQeg89fi/vD/tc53a159Fv7yXi2UKCWLlefPNN7MVyMSlvonTIwu3 W8TOhOXqTAj1Z5+i7qGFQJCeoTVeIe07CAhs9nD0IBRDceqpp+bZMW5rXlJnnHFGfvhbJZ3Lj216 5X8dJRAYrgi47t0LtsEsnSLHQGLA3QmxaVaQnToJanZM7Os9AsuXVxn/li1Po0ZWVr7sjtm6Lkkq ZOO77bbbsmsV90jvDkSVdQXRGQxiinx4l3GjZBE0EWcyj/WHqx2ZEDMxaVzqTOQhOd5r3LyRNxN+ inNZS8TUsF6xWjlPlkEWIu0gGuIGLb7LKwLpQUTE7TW6drZGc/V/QYLgbiOnOB8eHNwKJXqxVhGZ 4UJeLrn9PaG6+r2KGjoZgSA9nTw6IVtLBJi+ue3MqNxKZNIxG8a1hBuJh6cHt4e7h2hZLLJlZfFD IBAIBAKBwJBC4KVZb6VbHqwU46deTgsXL60mu0amLTdaNx20+zZpxy03yv/rkHeDCbIrrrgiJyWg QEvUw0rCmsKqMxhEpxFscWGS7bB2ID5idZA0kxgyBF566aWZ5Jx22mlZdvEwyIsU7TIbeidK7iFr 6j333JPfh6y81rVCali2xLWynCAO3pWSNEjWIQaNS6w1pgaS9NQx8L5G6EqyEnIgb2KA9I8HBxc4 8Yre/foWJRDoKQJBenqKWBy/CgEkw6wS0/lAFy40TN9iciz2ZrbKPi84MnmAlmLm2RYlEAgEAoFA YOgjgOhccftj6bGX5qf5K6sUyCMnVq5aK9IzlZvUfU/emo7Zd4d05Md3TH968o85Jbq4EUl7PvOZ z2RygOx4b3lXdEpBvLimignjfkY21h3vNYkzWDy4rHFDY5FS9INFREyQ/rE2IjdiXFmPEDvkAZlR WLZMBCq8JUwYcjFDnLzP1d0JRd/rBIjrofc9kuZdDwvkjfUHBlECgXYRCNLTLlLD8DgzS9I/e/ib PWmnlHM8lAToeiifeOKJ7Zza58eIyZlWZV0zI2bFa/J4aJvVe/bZZ/PDUICqGbF6YHGfCxIVBgKB QCAQCAwIAg/96aV04fX3pcdeXZpGTt4ojRw9tiII1SRXpeQvXz4hvTJnVrrk5sfTtdU6c8tmPZ22 2/aD6fTTT8+pkhEILlWdWLzPxPQgOIogf5N19nvf2poVsS9ID3c4RIfbW1lHT6yr87hXmhAUy+Q3 5MnEICuXjGksJ/7nZtZpBQZc78jqPQ4flh/vfAkQLFdBfiQpSiDQHQJBerpDaBj/7mHqYdIT0345 x+wQf2C+7ANdPMQ9oH16IDLx89G2UJyZHwtFSl/t5aZvXAPqqW2dW84faNmjvUAgEAgEAoHeIfDq m3PTrQ8/k554bVlKkzZMI8e8mzCieiFkAjR+nQ3T7DmvpXlLJqdPHHhEOubgj2VrSSdnAvM+4oIm 86JJO5Yc8St1ouOYUurfuXNz9bLIr/Vw/CZjqbiYUqyN411/0UUX5UXH1T19+vTsCs4KJN4HqbDP ZycWWCA2XPS45LFqsWhxCWS1kgCipJHvRPlDps5AIEhPZ4xDj6Vgiua3K6DRw2y//fbLZnszPszb zPlmfpi3y6KbVnln2TEbxDTsNw9aMz/lPGZuAZD+9+BkPWFSRizKQ9g5ZopKcb4HtZkXbTpPuk+E o5Us5dzefFpl3cyOB5/CrP+f//N/zrNZTN1mrmTCIZeZK5mV6rNArEEWHyyzYL2RIc4JBAKBQCAQ GDgEVqxYme55/Pl015NvpBXjp6bRY5tnGhs5anQau/b6aeXIFWn5hPXS2EnrdHzqY++iz33uc3nS zmSd/727vEsLWTvhhBNWgW19uVK827wTHcurwUQki5bMbeVc+0z+eYd7L3pPim2SFts6fd73vDbq C+qW+jvxk6z0F2TP+1+q7+9+97vZ3d3Ep9+jBALNEAjS0wyVPtjHlMwVDIFoLNJGIg3IR28KK4ug RiZerl38cs3UcDPz0PIAYPZFdvyuCIi84YYb8gPPQ8KsiQed7C8emgInr7vuupwpBiGy1s1ll12W M6l4SJqBYuUxu+KcuuwersW1jBldJhkyqqeZLL3pc/2c8mAus2DM+3x+Ffv0z8yW0iyWx4ugLLCa D4o/gUAgEAgEAh2NgMQFj854Lc1ZOjqNmtyc8JQOjBw1Ji0du1Z66Nm30s5Pv5Km7/bB8lNHfrLO TKtctW2tigxzpdS/e+chMRIeeC/XrUDleMcgOSX+pRzjHATJO94xZX85r5M/ySshA3c3fTOhS4cx 8frpT396UGKNOxmvkO1tBIL09MOV4CFSMqHULQylKWTI1ts4E/EqM6qsZWY6zGogAUiJ9QbMfMjV T6ln7i0+uh5qL7/8cn6wmd1hJTEr5FjF7/x91Xn88cfnTDdIEeJk5unKK6/MbQqKLOeU/rDoIE0I nswzAg1ZmlifmslSzuvtp4ddY2nc14zs1M9pPL7+W3wPBAKBQCAQ6CwEHn92Znr8pSp5TkVmcgxP N+KNHjcpzaw8Ip566fW0146bp4njOzOWp5tutP2zd1p377VmpMY53b0v2xZiEA4ke7FamZiV5Y0u 8sUvfrFjEjMMAizRZAsEgvS0AGZ1dksbiVQgNs0eJsiHtQLcoL0pLEVmdNzofH+1hXgUMoKk8Mut zwaZ4bFwIcvLmWeemfP2IyX1Qh71IVE+1Y9E2a9+1ptmhbsbv1pJA5AsqTARJqWZLM3qiH2BQCAQ CAQCgUAzBBYvXZZemDk7vT5/eRq9dtdWnnL+iJGj0opR49Lzs+YnVqJtPrBB+Sk+hyECrD6HH354 nsD9dZXEwpp9Jn6bTTwPw+5Hl9pEoHdad5uVr6mHIQy2VmVGZaUR69Js1qXVOfX90lkiIOJvWGjE r7DaFKuOmZvGuv0vyA+hOf/883P7JUtMqbs+U9T43TF1l7Zyjk+WpyeffDJbrvgV+7+UZrKU3+Iz EAgEAoFAIBDoDoGZb8xNr761KI0YPS6NqN5lyuRxo9LmUyekDdYamxYvW5GenVW5Wc/hNv5ubSNG T6j2z0szXnkzSM+7sAzbb4iPhVhNtoox5vImu1uUQKAgEKSnIDGEPllw5Nrn0ibzivghAYo2BdFo LHL5W7QMIXmzWstgepWlRSxM/dj691JP2eez/r1eP4KHfLEiiQXSRomZKefUj4/vgUAgEAgEAoFA uwjMnD2/IjRLquQEY/Ip22w4MR268/pp0ynj05KK8EyqCNCipSvStQ+/ln739OxU5TzIRTrrN+Yt SbOq86OknLiI67nY2+JebzJTjLF3NY+OoV4kbTjkkENyHLPsbjK3TusiVmqo9zfk7xkCQXp6hldH HO2BJZZH8L44HLMa8vuz9HiAnXrqqe9zq/O7GRCEx4MNcZLFrBwr20n5rpPW7bFQGrc4D0OLumm3 HFeA4L4nGPKMM87IlifHKOKayrHNXPzK+fEZCAQCgUAgEAh0hQDS8vrcJWnEqLXzYaNHjUxPz1yY 7vzT7DR3UbUO2/oT0sE7rZ8+uvW66dnXF6aXZ7+dXXRk5eK2ZOXING/RksRFbtyYvlN5LJBpIlES H5N+rAxc21kWitdFV31q/M2EoVKS8DT+3tv/6/VyuTdRKuNrIT10Au72XOJlRR0OBfExFtJ4W1oj SM9wGNW+6UPfPQH6Rp6opU0EPKBYWJAcpKRuUdlyyy3fVwu/VkkIPJwdW9zfyrH2le9OLlleSkX1 h0b9OL871wO07C91+63s8z1KIBAIBAKBQCDQUwSQlgVLlqeR40flUxGbF95clBZW+5ZXZp23FixL 2286OU2dNCatNX50ejm9s6RCfteNqgjP8rRw8dI+JT28LZAbirU422OOOSYvG+FdK6OpTWyr96F9 PCuQDsWC4Kwr4l9lEzVBKC6W14YJRBOF3qvO4bquHpOb6hJD63cTjBYiFcuLcFH0vd/Vq211Ob5e L7d42c3snzVrVq5H2xIRmQwt5zu3tMOdXnGefSZLyaXU+4BIkbP0yf/aGaxC34Gz9fv0G35RAoEg PYN0DbgJpZy2mFizYnZmWjcmWQ9FW2Npts8x9jdaXerH1r831ln/v9VxzR5wrY6t1wcLawi1wqJ+ 7GB/l467vLgGW5ZoPxAIBAKBNQGBpZWVZulyE3xvK9HITr2sVZEhZGdOZfWx1YsYIOcuqeroy8LD wXbvvfdm0oI4IEEsJ5Z7uP3223MiIMo2q8Nhhx2Ws6KSQcC9jKgU8q233jor5LfccksmMLwwJA9C MpxnOQptTK9c0inx1uazLMPMmTOTcxTvWXWSobRt0VIeHvV6eYeo176HH344k5ePf/zj+Z1mEhVx cr72kCCEiFcJEiUrK9KDzHzyk5/M3hz1PrBQ6U/pk7X6ylISWcgB/kN242GRVn3mfRIlEAjSMwjX gAclP1Nr6VCimxUxONO6IT3Nzhtq+8waWRxN0GErLDqpTwiP2KmwYHXSqIQsgUAgMJwRWFZZMJZX Xg1japaDjdap3LSnjq+sO2PTjpWVZ2Q1/3f3U1WGt8oNrl4QpWUV6Vlaxf4MRGHtENcq8ykiIpie VUWRuVVBWCzvgOBwKTNhaOKPVQcJcZxFwS367VjZyHhfsBhJYKRuk6YIE2LEzU78Ct2itH3cccdl kmQCtdRbPD1YqSxNYb0/BIc1h3WH7Nb0U4/FTP1+xRVXZDlliZUMqSzHQc56H8hV/7+rZE4ZhAH4 g7ghhCZWowQCEAjSMwjXAdPwoYcemldQ9hBqVsrDqdlvw2mfWTAPfTNUHrpDoXAtRNaiBAKBQCAQ CPQ/AiMrxRWpyanZ3nFu2Hy98Wn/7dbL2dumTh5bxfEsysSmJDEoUnEBd+6oXEHZ27+fyAnLgnXv kJFSyKKwwJj4FEvDisI1rpAEGVa9X2666ab0wAMPrCI7LEgIELc2JAlBYfGxYLhssCZKudmVtrl3 Ufjr9TqftYhssreKS2IJqRcWkvrvFj8nI+KA2Myr1j4iX2MfDj744Pf1idvdYBaTlDDXpyiBAASC 9AzCdeBBRHG2tSpMyK0IUatzhuJ+WJhlKn7DQ7EPIXMgEAgEAoFA/yEwZvSoirSMTCvFpFbJCZQn X5mfZlVWnTFVUoNNp4xLe28zJR22ywZV+uqV6ZEX3l5023ErV65IY0aPTGP7MImBersq3NPE6pjU Y2VBGpCFQkq4kU2v3NVYesTc8PqgnJeNks6yw+WbS/oBBxyQXnzxxVwH6xHSgfRw23KO2B6f6i1t e7cqpU6fivoc4/dyTP7hnT+Nv5OFroKMFasUt7HGPnCXO+KII97Tp8H0iIC1RUrJaYsSCEAgSE9c B4FAIBAIBAKBQCDQsQhMHDcmTRgzMs1fwRvg7bTVby1clmzK828sTGtPGJ0Or0jPVhtMeA/pWbG8 ytpWkZ4JVR39URAHlpc6gSjfkRME4YYbbsjWGO5qvDy4rrGySB9tctMxSIxlKH70ox+lI488Mi/7 wLWMteLEE09M55xzTo6pYd1hZeHiJokCYqR9sTfISWm79JXVptTLNbv+u/Naye58v4kN4tom65v4 Im1Mfye+qN4Hff3pT3/6nj4VGQbjU+wT7Pbcc89M8gZDhmiz8xAI0tN5YxISBQKBQCAQCAQCgcA7 CKy39sQ0pcrMNnfe0lTlLXsfLtboWbBkRWXVqBT1dywcDlpZkaQRaUVCmsaN7R91h3WDNae4cnEn O+GEE7Klh7VHCmuuZIVsiJdxrLVkZF5jhUBiJAngquY3BIL72//4H/8jJxtAOr7+9a9nF/Bp06bl JANHH310dpHXtjpYYlhlStsFJPKVejfZZJP3/O5YbmssUmSty+58v7MQcakTe4uYaUNbLEL1PpBB f+p9KjIM9Cc3PIkkeJDsscceA918tNfBCPTPU6CDOxyiBQKBQCAQCAQCgcDQQWBqRXo2WGtMemHu 0jS6is3ZY6vKgrLW2PTYi3PTnMras+m649Pu09ZO8xcvSy9WqaxLWbFsaZpcLVy6zuQJ7yFD5fe+ +EQA6gV54LZWCjc1REcpxMd3sTcIRbG0IDssPop9CuKjOE98UPnus9Rb6sg/Vn/qbdun7Xq9dVev xmMdX99X/85iVGKNi3yNffB7kafeV/UOVEG6LrjggpxU4ctf/nKXYQQDJVO00zkIBOnpnLEISQKB QCAQCAQCgUCgAYFN1l8nbbj2uLRsxrw0ulKsWXN233LtdOAO62XrzuhRIzL5uf6RWemJl+atOnvl skVp8/XHpy02GtzEM80IQCEOq4StvjTuq59X/17Osa/Z/vJ7+Wyst+zvyad2WHfqpbHexv/rxw7E dzFO5513XpKx7pRTTsmksR18BkK2aKMzEAjS0xnj8D4pmKwfeeSRnDIybtr3wdOxOwROSjfa16tq d2yHQ7BAIBAIBPoZgckTxqaNp66VJo15vVpodHGO2Xn1rcVp3crlTbzOwmrx0TfnL82JDeYvfjcL 6Iqli9IH1lu3Ij1T+lnCqH6wEZCF7qKLLsrxUrLhSanNLS9KIFBHIEhPHY0O+n5wlf7RrInc/VGG DgLSbu++++7JwmxRAoFAIBAIBFYfARN/O265YdruyVfTw1XWtrljxqe51SKko15/O5X18mrlhxXv ZCcrrS1bvCCtM25l2mrjKWntSRPK7vgchgjIHHfhhRemxYsXp5NPPjknLwjCMwwHug+6FKSnD0Ds jyp22223tNVWW+Xgxv6oP+rsPwT4TJe1Efqvlag5EAgEAoE1B4GtNlkvbbfZlPToSy+m5UuXpFFj xqbl1aI879p1alhUBGjF4rkVUZqYdtl64wFdo6cmxYB9lQRBJjiLcYoxQhJ9H+6FZ4XMdBaAFfP0 iU98In8G4RnuI9/7/gXp6T12/XqmBUxtUQKBQCAQCAQCgTUdgfFjx6S9d94yPfXy7HTv82+kkWtt WK3Z83bAfyM2i+e9meY8/1iauXREeusjVQD+Ruu+L16m8ZxO+l+WNK5a119/fc6WNq3K2MZla8cd d2wqptTMUkojOxIiSCttTZ3hWhYsWJCzs0npLc5IJjupqSVtaIw7Gq4YRL96h0CQnt7hFmcFAoFA IBAIBAKBwAAiMK1yVZv+4S3Ti689nJ6f/UqauO5GqxYrLWIsmvNaGrvkjXTEntum0XOeSf/2r9/J s//HHntsXvvGwpydXrhJW4yU1YbcV155ZbruuuuSxT6ljLYYqSxlCA7PAscL4pfqetddd11l5ZFJ zSKdLEHSN/vfpg4ECVny6f+hUCzwetddd2U8LPi69957p7322ivjMmnSpKHQhZBxkBHo/Lt/kAGK 5gOBQCAQCAQCgUBg8BEYM3pU2nPHzXPq5Etvezw9Nev5NHat9StXt/FpZbUIKZe2SSvnpsP23Dp9 cu/t08qle6Y/PLFruueee9K//Mu/ZBJR1s2RbrlTS0n7bP0eSv3dd9+diQ7ycsstt+SN7AjL4Ycf vsoCxAJy3333Zfdq51511VV5EVTxwdar4fKG6IgZRv5uvPHGjIn/O7lIDqTf3NikxYZJCQFA9OAQ JRBoB4EgPe2gFMcEAoFAIBAIBAKBwKAjMHnCuMrNbVqyYOktDz+b7v/TzPT664vShHGj0w4fmJL2 3+XDabdtN03rrzu5Wph0StqgWvtmhx12SE8//XT6/e9/n84///zcB9m9DjzwwBw7O9iplpuBatHQ J598Mp177rk5IxmrxqxZs9Jjjz2Wtt5667TPPvtkUoPklHWAuMUhCCw/M2bMSI8++mi2bh1wwAHZ KuQ3REdmWATIIp5lLaBmMgzmPuTMeP3mN79Jf/zjH3MfjZeFVi3Wiux04rgNJmbRdvcIBOnpHqM4 IhAIBAKBQCAQCAQ6BIGJ48emnbfeJH1gg3XTEXstSEuqlNWjRo1Ma00cl6auMzFNHDd2laRjx47N 1gzEAPlBFqzjIuPXt7/97ez2hVDYLMbZKTEhrD2ykVHurTkjnofciM3222+flX+kBpnjwtZYXn31 1bwLqdlll13yd4uU3nHHHZlEsPRYSHW77bZrPHXQ/ueyJmPtbbfdlh588MFswSH7aaedlqZVcU0b b7xxXtQ1LDuDNkRDvuEgPUN+CKMDgUAgEAgEAoHAmoUAV7cNpkzOWzs9p+RT+qdOnZrXUePuxfLx 1FNPZYsCVzAub/Zzn7LW2mDGiSAkiM6hhx6a5WCZEeeD9IjfQYrE9vgU19NYZDBj8eHyxiUMgYIB KxFrj9+4tQ1mPA/ZWa8QUC6ICA8ZkTqxTGKYNtpoo5yYAXmN8v/bO3ucxqEojHpmBylS0NAgUiFB gUSVmoaOIvvKNiLRIgQFW0AgREogVSSUDaQYzhsuMtaMBia28xzOk64cO459fR4//nJ/LIFVCSh6 ViXo5yUgAQlIQAIS6AQBogSIGWx7eztFTIjy8HDLp6enFE0Zj8ep+J/HRtAYACPS0GYrZCJOdHCl E1uMnZ2dFO04OzsrLi4uUnrX8fFx2qca/UC0IfDoAnd+fl4cHh4WJycnxf7+fmqKQPrc3t5e6/Uw i8UipeuRunZzc/OamviShA3XNhqNCmqREKdctx1sY+Zd1kVA0VMXSY8jAQlIQAISkEBnCFATQvoY hsBBBPDsF27M5/N5EkHcnPMsGCIldFOjpoSUMCImpMwRkal7ENVBAFRrVohE0Z6ZB2Avl8sU4cEn ojWnp6fvbuAT0R+iJYgdIj1ETNhGJIXXCDiEXJODupzZbJaiadPpNNUjEZ1C1CA4h8PhB5FDhzmu 3SGBpggoekpkI4eWX1SHBLpAgBxo0hQcEpCABCTw/wQQGIgKjBty0shoC029DOlkRCRILyMljnQs ama4Z6ConqgKoomaICIVtJKuCpaveMZn8aE6iOYgWBBbnLt8Ds5dHVtbW2l/tse+iA+iXNTK1CUw YAUfBM7j42OKlpE2iICEJ35Qj0NUKtLVQmwi2HKpo6ryc33zCCh63uaUMPBkMimurq5SYePmTbVX tIkEnp+f00Pr6vrntYmMvCYJSEACXyVAtIQUq0gv48aeL0QRQjwvBiMihPghKnR9fZ3qU9hGNIUb fYQIkRhu9Pv9/nva1qp/rxE/1XS2v11fiJ14nzoZokgIs88OBBa1QaQAYtTh0PmN/z8IQda5ZiI4 GNdKK21eI24QPkSZMFLWqj591g/3k8CqBBQ9bwSPjo7SNxH8QfNbh1V/rPx8mwT4ZrHNXPM2r81z SUACEsiBACKI9CssBkIIMYAAYhlGChdRDoyIB22l2YbxrB1u/BFCvV4viY+IeiBEOH6IA/bD+Pte Vxodx0Z0kSVA1Ap/EHNEs8oW/hLBQeiQUYB4wUf8xU+EHd3huA7eI2qDEUliHb+9n4qfFpc5EFD0 vM0Cv7SYQwISkIAEJCABCfyLAEIkBEt5X8QQoiKMeqAwRAYiKSJGCCUiJURNEB+8z+dY0mwA43hE dhBACBYiJYiJshFpYR/ESdWo6aEGiONyPPajGxrG8bAQWCFaEDfRIprXbI99WSJo4jOKm/Ls+zpn AoqenGdH3yQgAQlIQAIS6BQBxBCGWKgOUsUQMYigEDQIEraFsY6VxUvsE9sRMmXjuBiCBkMYhYU4 QhghdGI9lmzHwu/yEoHDZ3jfIYGuE/CnuOszqP8SkIAEJCABCXSCQDnK8hWHETSIoBA6IXJYMmI9 RM+flogchBDvOSTwHQkoer7jrHvNEpCABCQgAQl0hgBCxWhLZ6ZLRzMl8DNTv3RLAhKQgAQkIAEJ SEACEpBALQQUPbVg9CASkIAEJCABCUhAAhKQQK4ETG/LdWb0SwISkIAEJLDBBCiYp03y5eVlcX9/ v8FX6qXlRuDu7q4YDAapA11uvulPcwR+vBa//a6Ca+4cHlkCEpCABCQgAQl8IEAnstvb2+Lh4cHi +g9kXGmaAJ3ydnd3i4ODA59z1zTsjI6v6MloMnRFAhKQgAQk8J0IcPNJ62a6kjkk0BYBGkPEs4ra OqfnWT8BRc/650APJCABCUhAAhKQgAQkIIEGCdjIoEG4HloCEpCABCQgAQlIQAISWD8BRc/650AP JCABCUhAAhKQgAQkIIEGCSh6GoTroSUgAQlIQAISkIAEJCCB9RNQ9Kx/DvRAAhKQgAQkIAEJSEAC EmiQwC9WHEkQZtYuPwAAAABJRU5ErkJggg== --Apple-Mail=_A79754EC-5B98-44A5-9AA2-5D00728C51B9-- --Apple-Mail=_75488829-F1F1-4CFA-BC7D-4CB2D13AB21C-- From nobody Fri Aug 23 12:03:23 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E5F4E12025D for ; Fri, 23 Aug 2019 12:03:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vauUVy0cBX0W for ; Fri, 23 Aug 2019 12:03:12 -0700 (PDT) Received: from p3plsmtpa11-01.prod.phx3.secureserver.net (p3plsmtpa11-01.prod.phx3.secureserver.net [68.178.252.102]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 17A641200F5 for ; Fri, 23 Aug 2019 12:03:12 -0700 (PDT) Received: from [10.17.0.50] ([45.56.150.72]) by :SMTPAUTH: with ESMTPA id 1Eq7imoKocB8Z1Eq7iUe7f; Fri, 23 Aug 2019 12:03:11 -0700 From: Laurence Lundblade Message-Id: <8CF426EA-B2E7-44FA-A5C6-888E54DE641B@island-resort.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_F42E20FD-20FA-4726-865A-310F79624C8D" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 23 Aug 2019 12:03:10 -0700 In-Reply-To: <79E5AD05-85F9-47F6-936F-E5BB5762DB83@cisco.com> Cc: "rats@ietf.org" , "teep@ietf.org" To: "Nancy Cam-Winget (ncamwing)" References: <79E5AD05-85F9-47F6-936F-E5BB5762DB83@cisco.com> X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfAR3NvG0G7MkAv5ZpTilb21eIRCheRZ0GfjMTdzVCKymDdhyb6dABDzFz7a2tuaBpj1erT3xLDuzUBlycq+fvxwBrhXLU2NMRAQFkCoXhkYzx0rYrwxO /jcOi5fUUxbgJcCezVK2GpR2XehtklxaZF+yugG0X1BcXmJ0zV+z5OTbw5if6DBfjGva7mPwvsIfvKpv+FHLL7FLsHO7bi8vKSQ= Archived-At: Subject: Re: [Rats] RATS Virtual meeting (1st hour with TEEP) X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Aug 2019 19:03:15 -0000 --Apple-Mail=_F42E20FD-20FA-4726-865A-310F79624C8D Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Nancy I=E2=80=99d like to see consensus on what we are doing about data model = and information model. I=E2=80=99ve written some proposal and have seen = no response. I would be happy to present my proposal on that. I did a = little of that in Montreal, but wasn=E2=80=99t very well prepared. I=E2=80=99d like to see us get to consensus on end-end trust is = establishment, use of the term =E2=80=9Cattester=E2=80=9D and the role = for roots of trust. It sort of seems we have consensus around what = I=E2=80=99ve most recently proposed for that (use the term = =E2=80=9Cattester=E2=80=9D widely; an attester may optionally be or = contain a root of trust), because no one has written any objections, but = that seems presumptuous. I think there might be some over focus on TEEP in this agenda.=20 I think getting consensus on data/info model is important because it has = an effect on claims definition work. I think getting consensus on the end-end trust model, attester and roots = of trust is important because it is about the fundamentals of how RATS = works and getting clear on will reduce general confusion. I think the FIDO and Android Key Store use cases need to be as important = and prominent as the TEEP use case. FIDO and Android are clear successes = and deployed in millions of devices. Similarly network function (router) = attestation is pretty important. So I=E2=80=99d prefer: 30 minutes on data / info model 30 minutes on end-end trust, =E2=80=9Cattester" and root of trust 30 minutes on TEEP LL > On Aug 23, 2019, at 10:52 AM, Nancy Cam-Winget (ncamwing) = wrote: >=20 > RATs and TEEP participants, > We will be holding a Virtual Interim on Sept 10, 2019 7-8:30am PST. =20= > =20 > The first hour is to hold a joint discussion on the TEEP use cases and = requirements. > Please provide other suggested agenda items by responding > =20 > Information about remote participation: > JOIN WEBEX MEETING = https://ietf.webex.com/ietf/j.php?MTID=3Dmefed41895b6dc942bf92a1b4c121d907= = > Meeting number (access code): 646 390 311 =20 > Meeting password: hPrEtxQc =20 > JOIN BY PHONE 1-650-479-3208 Call-in toll number (US/Canada)=20 > Tap here to call (mobile phones only, hosts not supported): = tel:%2B1-650-479-3208,,*01*646390311%23%23*01* = > =20 > Warm regards > The RATs and TEEP chairs. > =20 > =20 > =20 > _______________________________________________ > RATS mailing list > RATS@ietf.org > https://www.ietf.org/mailman/listinfo/rats = --Apple-Mail=_F42E20FD-20FA-4726-865A-310F79624C8D Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
Hi Nancy


I=E2=80=99d like to see = consensus on what we are doing about data model and information model. = I=E2=80=99ve written some proposal and have seen no response. I would be = happy to present my proposal on that. I did a little of that in = Montreal, but wasn=E2=80=99t very well prepared.

I=E2=80=99d like to see us get to = consensus on end-end trust is establishment, use of the term = =E2=80=9Cattester=E2=80=9D and the role for roots of trust. It sort of = seems we have consensus around what I=E2=80=99ve most recently proposed = for that (use the term =E2=80=9Cattester=E2=80=9D widely; an attester = may optionally be or contain a root of trust), because no one has = written any objections, but that seems presumptuous.

I think = there might be some over focus on TEEP in this = agenda. 

I think getting consensus on data/info model is important = because it has an effect on claims definition work.

I think getting = consensus on the end-end trust model, attester and roots of trust is = important because it is about the fundamentals of how RATS works and = getting clear on will reduce general confusion.

I think the FIDO and Android Key Store = use cases need to be as important and prominent as the TEEP use case. = FIDO and Android are clear successes and deployed in millions of = devices. Similarly network function (router) attestation is pretty = important.

So I=E2=80=99d prefer:

30 minutes on data / info = model

30 = minutes on end-end trust, =E2=80=9Cattester" and root of trust

30 minutes on = TEEP

LL





On Aug 23, 2019, at 10:52 AM, Nancy Cam-Winget (ncamwing) = <ncamwing@cisco.com> wrote:

RATs and TEEP participants,
We will be holding a Virtual = Interim on Sept 10, 2019 7-8:30am PST.  
 
The first hour is to hold a joint = discussion on the TEEP use cases and requirements.
Please provide other suggested = agenda items by responding
 
Information about remote = participation:
Meeting number (access code): 646 = 390 311   
Meeting password: = hPrEtxQc    
JOIN BY = PHONE 1-650-479-3208 Call-in toll number (US/Canada) 
Tap here to call (mobile phones only, hosts not = supported): tel:%2B1-650-479-3208,,*01*646390311%23%23*01*
 
Warm = regards
  The RATs and TEEP = chairs.
 
 
 
_______________________________________________
RATS mailing list
RATS@ietf.org
https://www.ietf.org/mailman/listinfo/rats

= --Apple-Mail=_F42E20FD-20FA-4726-865A-310F79624C8D-- From nobody Fri Aug 23 12:53:51 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1F28D120047 for ; Fri, 23 Aug 2019 12:53:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z8G0l61cjvwe for ; Fri, 23 Aug 2019 12:53:43 -0700 (PDT) Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E36E9120122 for ; Fri, 23 Aug 2019 12:53:41 -0700 (PDT) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga007.fm.intel.com ([10.253.24.52]) by fmsmga105.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 23 Aug 2019 12:53:41 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.64,422,1559545200"; d="scan'208,217";a="180773354" Received: from orsmsx105.amr.corp.intel.com ([10.22.225.132]) by fmsmga007.fm.intel.com with ESMTP; 23 Aug 2019 12:53:41 -0700 Received: from orsmsx158.amr.corp.intel.com (10.22.240.20) by ORSMSX105.amr.corp.intel.com (10.22.225.132) with Microsoft SMTP Server (TLS) id 14.3.439.0; Fri, 23 Aug 2019 12:53:41 -0700 Received: from orsmsx109.amr.corp.intel.com ([169.254.11.172]) by ORSMSX158.amr.corp.intel.com ([169.254.10.29]) with mapi id 14.03.0439.000; Fri, 23 Aug 2019 12:53:40 -0700 From: "Smith, Ned" To: Laurence Lundblade CC: "Oliver, Ian (Nokia - FI/Espoo)" , "rats@ietf.org" Thread-Topic: [Rats] Use the term "attester" instead of root of trust Thread-Index: AQHVVGg+OnGyLZ7bikigtz9osO2brqcBNEoAgAB6dQCAASiKgIAFIqqA///62QCAAH3LAIAAsU2A Date: Fri, 23 Aug 2019 19:53:40 +0000 Message-ID: References: <3F5C57F7-C75F-4C27-9898-25AF98237DE9@island-resort.com> <10825C3E-81E0-43A9-B529-28E7C501E098@intel.com> <910BEC2B-AA72-4106-9E5E-5DDEC6B9CFED@island-resort.com> <7F4FC12D-8F77-46BD-A025-C223F670826C@island-resort.com> In-Reply-To: <7F4FC12D-8F77-46BD-A025-C223F670826C@island-resort.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1c.0.190812 x-originating-ip: [10.254.69.14] Content-Type: multipart/alternative; boundary="_000_DB36880D0F61424694641FE88BBF5FF8intelcom_" MIME-Version: 1.0 Archived-At: Subject: Re: [Rats] Use the term "attester" instead of root of trust X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Aug 2019 19:53:47 -0000 --_000_DB36880D0F61424694641FE88BBF5FF8intelcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 W3NuaXBdDQoNCkkgdGhpbmsgdGhlIG91dC1vZi1iYW5kIHRydXN0IHJvbGUgaXMgbXVjaCBtb3Jl IGltcG9ydGFudCB0aGFuIHRoZSByZWZlcmVuY2UtdmFsdWUtc3VwcGx5aW5nIHJvbGUuDQpbbm1z XSBJIG1heSBub3QgdW5kZXJzdGFuZCB3aGF0IHlvdSBtZWFuIGJ5IHRoZXNlIHRlcm1zIOKAnG91 dC1vZi1iYW5kIHRydXN0IHJvbGXigJ0gYW5kIOKAnHJlZmVyZW5jZS12YWx1ZS1zdXBwbHlpbmcg cm9sZeKAnS4gR2VuZXJhbGx5LCB0aGV5IGFwcGVhciB0byBmaXQgaW4gdGhlIOKAnEFzc2VydGVy IHJvbGXigJ0gc2lkZSBvZiB0aGUgZGlhZ3JhbSBIZW5rIGRpc3BsYXllZCBhdCAxMDUgc2Vzc2lv biAjMi4NCg0KWW91IGNhbiBoYXZlIHJlYWwgYXR0ZXN0YXRpb24gd2l0aG91dCByZWZlcmVuY2Ug dmFsdWVzLiBGb3IgZXhhbXBsZSwgbW9zdCBjbGFpbXMgY2FuIGJlIGltcGxpY2l0LiBUaGUgZW50 aXR5IGhhcyBzZWN1cmUgYm9vdCBhbmQgY2FuIGJlIGFzc3VtZWQgdG8gcGVyZm9ybSBjb3JyZWN0 bHkuIE1heWJlIHRoZSBvbmx5IGNsYWltIGlzIGxvY2F0aW9uLg0KW25tc10gSSBhZ3JlZSB0aGUg VmVyaWZpZXIgcm9sZSBuZWVkcyB0byBzb21laG93IGtub3cgd2hpY2ggY2xhaW1zIC8gYXNzZXJ0 aW9ucyBvZiB0cnVzdHdvcnRoaW5lc3MgYXBwbHkgdG8gdGhlIEF0dGVzdGVyIGFuZCB0aGF0IG5v dCBhbGwgY2xhaW1zIG11c3QgYmUgY29udmV5ZWQgYXMgRXZpZGVuY2UuIEEgZGVmaW5pdGlvbiBv ZiBpbXBsaWNpdCBhdHRlc3RhdGlvbiBtaWdodCBzdWdnZXN0IGFsbCBhc3NlcnRpb25zIG9mIHRy dXN0d29ydGhpbmVzcyBjb3VsZCBiZSBjb252ZXllZCB2aWEgYW4gb3V0LW9mLWJhbmQgY2hhbm5l bCAod2hlcmUgb3V0LW9mLWJhbmQgcmVmZXJzIHRvIGEgY29udmV5YW5jZSB0aGF0IGlzbuKAmXQg dGhlIG9uZSBjYXJyeWluZyBFdmlkZW5jZSkuIFJlY2FsbCwgdGhhdCB0aGUgUkFUUyBXRyBkZWVt ZWQgZGVmaW5pdGlvbiBvZiBBc3NlcnRlciAvIEFzc2VydGlvbnMgb3V0IG9mIHNjb3BlIGZvciBu b3cuIE9mIGNvdXJzZSB0aGUgYXJjaGl0ZWN0dXJlIGNhbiB0YWxrIGFib3V0IHRoZW0uIEhlbmNl LCBpdCBpcyBpbiBzY29wZSB0byBzYXkgdGhhdCBFdmlkZW5jZSBjb3VsZCBiZSBhcyBzaW1wbGUg YXMgYSBOb25jZSBjbGFpbSBhbmQgYSBWZXJpZmllciBjb3VsZCBjb25jbHVkZSB0aGF0IHRoZSBO b25jZSArIE9PQiBjbGFpbXMgPSBlZmZlY3RpdmUgY2xhaW0gc2V0LiBNb3JlIGNvbmNyZXRlbHks IHRoZSBFdmlkZW5jZSBjbGFpbXMgc2V0IChFKSArICh1bmlvbikgdGhlIEFzc2VydGlvbnMgY2xh aW1zIHNldCAoQSkgPSBlZmZlY3RpVmUgY2xhaW1zIHNldCAoVikuDQpJ4oCZbSBub3Qgc3VyZSBp ZiB5b3UgYXJlIGFsc28gc3VnZ2VzdGluZyB0aGF0IGltcGxpY2l0IGNvdWxkIG1lYW4gc29tZXRo aW5nIG90aGVyIHRoYW4gZXhwbGljaXRseSBkZXNjcmliZWQgQXNzZXJ0aW9ucy4gRm9yIGV4YW1w bGUsIEFzc2VydGVyIGFuZCBWZXJpZmllciBjb3VsZCBtZWV0IGF0IGEgY29mZmVlIHNob3AgYW5k IGFncmVlIHRoYXQgd2hlbmV2ZXIgYSBjZXJ0aWZpY2F0ZSBwYXRoIHJlc29sdmVzIHRvIHRoZSB0 cnVzdCBhbmNob3IgZm9yIHRoZSBBc3NlcnRlciB0aGF0IGNsYWltcyBzZXQgKFMpIGFsc28gY2Fu IGJlIGluZmVycmVkLiBIZW5jZSwgViA9IChTICsgQSArIEUpLiBUaGUgY2hhcnRlciBsaW1pdGF0 aW9uIGltcGxpZXMgd2UgY2FuIGRlZmluZSBkcmFmdHMgdGhhdCBkZWZpbmUgRSBmb3IgdGhlIEF0 dGVzdGVyIGFuZCBWZXJpZmllciByb2xlcyBhbmQgUyBhbmQgQSBmb3IgdGhlIFZlcmlmaWVyIHJv bGUgb25seSBhbmQgbm90IGhvdyBWZXJpZmllciBvYnRhaW5zIChTLCBBKS4NCg0KSWYgeW91IGRv buKAmXQgaGF2ZSB0aGUgWzFdIG91dC1vZi1iYW5kIHRydXN0LCB0aGUgbWVhc3VyZW1lbnRzIGFy ZSB3b3J0aGxlc3MsIHNvIHRoZSBhcmNoaXRlY3R1cmUgaXMgaW5jb21wbGV0ZSBpZiBpdCBqdXN0 IGhhcyBhIHJvbGUgdGhhdCBwcm92aWRlcyByZWZlcmVuY2UgdmFsdWVzLg0KICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBbbm1zXSBSaWdodC4gVGhlIGFyY2hpdGVjdHVyZSBzaG91bGQg YXNzdW1lIHRoYXQgcm9sZSBlbnRpdGllcyBoYXZlIHZhbGlkIGNyZWRlbnRpYWxzIChlLmcuIGNl cnRpZmljYXRlcyArIHByaXZhdGUga2V5KSBhbmQgdGhhdCB0aGUgVmVyaWZpZXIgY2FuIHJlc29s dmUgdGhhdCBpdCB0cnVzdHMgdGhlIHJvbGUgZW50aXRpZXPigJkgY3JlZGVudGlhbHMgKHNvbWVo b3cpLiBJZiDigJhvdXQtb2YtYmFuZOKAmSBbMV0gbWVhbnMgQXNzZXJ0ZXIocykgdGhlbiB0aGVp ciBBc3NlcnRpb25zIChtZWFzdXJlbWVudHMpIGFyZSBleHBlY3RlZCB0byBiZSB0aGVpciDigJxw cm92YWJsZSBhc3NlcnRpb25z4oCdOyB3aGVyZSBwcm92YWJsZSBtZWFucyBzaWduZWQgYnkgdGhl IEFzc2VydGVy4oCZcyBjcmVkZW50aWFsIGtleS4NCltubXNdIFdlIG1pZ2h0IHdhbnQgdG8gcXVh bGlmeSDigJxBc3NlcnRpb25z4oCdIGFzIOKAnFByb3ZhYmxlIEFzc2VydGlvbnPigJ0gaW4gdGhl IGFyY2hpdGVjdHVyZSB0byBtYWtlIGl0IGNsZWFyIHRoYXQgdGhlcmUgaXMgYSB3YXkgZm9yIHRo ZSBWZXJpZmllciB0byBhY2NlcHQgdGhlbSB3aXRob3V0IGJsaW5kbHkgdHJ1c3RpbmcgYW4gYXNz ZXJ0aW9uIGdpdmVuIHRvIGl0LiBUaGlzIHdvdWxkIGFsc28gcXVhbGlmeSBpdCBpbiB0ZXJtcyBv ZiBhbiBJU08vSUVDIHRlcm1pbm9sb2d5IHRoYXQgZGVmaW5lcyBBc3NlcnRpb24gYXMg4oCYYSBz dGF0ZW1lbnQgdGhhdCBpcyBub3QgbmVjZXNzYXJpbHkgcHJvdmFibGXigJkuDQogICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIFtubXNdIFdlIGNvdWxkIGhhdmUgYSBkaXNjdXNzaW9uIGFi b3V0IHRoZSB2ZXJhY2l0eSBvZiBBc3NlcnRlcihzKeKAmSBjcmVkZW50aWFscy4gQnV0IEkgdGhp bmsgaXQgZW5kcyB1cCBiZWluZyBhIHJlY3Vyc2lvbiBvZiB0aGUgUkFUUyBhcmNoaXRlY3R1cmUu IFRoaXMgaXNu4oCZdCBhbiBpbnRlcmVzdGluZyByYXQgaG9sZSAocHVuIGludGVuZGVkKSwgZXhj ZXB0IGZvciBiZWluZyBjb252aW5jZWQgdGhhdCB0aGUgcmVjdXJzaW9uIHRlcm1pbmF0ZXMuIEZv ciBleGFtcGxlLCB3aXRoIHNvbWUgc29ydCBvZiB0cnVzdCBhbmNob3IgcHJvdmlzaW9uaW5nIHBy b3RvY29sIG9yIG1hbnVhbCBwcm9jZXNzIChzZWUgW3NuaXBdKS4NCg0KSSBob3BlIHdlIGNhbiBn ZXQgdG8gYSBjbGVhciBhcmNoaXRlY3R1cmUgd2l0aCBhbGwgb2YgdGhpcyBsYWlkIG91dC4gSSB0 aGluayBpdCB3aWxsIGhlbHAgY3V0IHRocm91Z2ggYSBsb3Qgb2YgY29uZnVzZWQgY29udmVyc2F0 aW9ucy4NCltubXNdICsxDQoNCkxMDQoNCg0K --_000_DB36880D0F61424694641FE88BBF5FF8intelcom_ Content-Type: text/html; charset="utf-8" Content-ID: <04655F16BA3C2446BD667A4DCB203B65@intel.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3Jt YWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAubXNv bm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6 bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47 DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQt c2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5h cHBsZS1jb252ZXJ0ZWQtc3BhY2UNCgl7bXNvLXN0eWxlLW5hbWU6YXBwbGUtY29udmVydGVkLXNw YWNlO30NCnNwYW4uRW1haWxTdHlsZTE5DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5 Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7 fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1z aXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJ bWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFn ZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IkVOLVVT IiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+W3NuaXBdPG86 cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0Oi41aW4iPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPkkgdGhpbmsgdGhlIG91dC1vZi1i YW5kIHRydXN0IHJvbGUgaXMgbXVjaCBtb3JlIGltcG9ydGFudCB0aGFuIHRoZSByZWZlcmVuY2Ut dmFsdWUtc3VwcGx5aW5nIHJvbGUuDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluO3RleHQtaW5kZW50Oi41aW4iPltubXNdIEkgbWF5 IG5vdCB1bmRlcnN0YW5kIHdoYXQgeW91IG1lYW4gYnkgdGhlc2UgdGVybXMg4oCcb3V0LW9mLWJh bmQgdHJ1c3Qgcm9sZeKAnSBhbmQg4oCccmVmZXJlbmNlLXZhbHVlLXN1cHBseWluZyByb2xl4oCd LiBHZW5lcmFsbHksIHRoZXkgYXBwZWFyIHRvIGZpdCBpbiB0aGUg4oCcQXNzZXJ0ZXIgcm9sZeKA nSBzaWRlIG9mIHRoZSBkaWFncmFtIEhlbmsNCiBkaXNwbGF5ZWQgYXQgMTA1IHNlc3Npb24gIzIu IDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 Oi41aW47dGV4dC1pbmRlbnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+WW91IGNhbiBoYXZlIHJlYWwgYXR0 ZXN0YXRpb24gd2l0aG91dCByZWZlcmVuY2UgdmFsdWVzLiBGb3IgZXhhbXBsZSwgbW9zdCBjbGFp bXMgY2FuIGJlIGltcGxpY2l0LiBUaGUgZW50aXR5IGhhcyBzZWN1cmUgYm9vdCBhbmQgY2FuIGJl IGFzc3VtZWQgdG8gcGVyZm9ybSBjb3JyZWN0bHkuIE1heWJlIHRoZSBvbmx5IGNsYWltIGlzIGxv Y2F0aW9uLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0Oi41aW47dGV4dC1pbmRlbnQ6LjVpbiI+W25tc10gSSBhZ3JlZSB0aGUgVmVyaWZpZXIg cm9sZSBuZWVkcyB0byBzb21laG93IGtub3cgd2hpY2ggY2xhaW1zIC8gYXNzZXJ0aW9ucyBvZiB0 cnVzdHdvcnRoaW5lc3MgYXBwbHkgdG8gdGhlIEF0dGVzdGVyIGFuZCB0aGF0IG5vdCBhbGwgY2xh aW1zIG11c3QgYmUgY29udmV5ZWQgYXMgRXZpZGVuY2UuIEEgZGVmaW5pdGlvbiBvZiBpbXBsaWNp dA0KIGF0dGVzdGF0aW9uIG1pZ2h0IHN1Z2dlc3QgYWxsIGFzc2VydGlvbnMgb2YgdHJ1c3R3b3J0 aGluZXNzIGNvdWxkIGJlIGNvbnZleWVkIHZpYSBhbiBvdXQtb2YtYmFuZCBjaGFubmVsICh3aGVy ZSBvdXQtb2YtYmFuZCByZWZlcnMgdG8gYSBjb252ZXlhbmNlIHRoYXQgaXNu4oCZdCB0aGUgb25l IGNhcnJ5aW5nIEV2aWRlbmNlKS4gUmVjYWxsLCB0aGF0IHRoZSBSQVRTIFdHIGRlZW1lZCBkZWZp bml0aW9uIG9mIEFzc2VydGVyIC8gQXNzZXJ0aW9ucyBvdXQNCiBvZiBzY29wZSBmb3Igbm93LiBP ZiBjb3Vyc2UgdGhlIGFyY2hpdGVjdHVyZSBjYW4gdGFsayBhYm91dCB0aGVtLiBIZW5jZSwgaXQg aXMgaW4gc2NvcGUgdG8gc2F5IHRoYXQgRXZpZGVuY2UgY291bGQgYmUgYXMgc2ltcGxlIGFzIGEg Tm9uY2UgY2xhaW0gYW5kIGEgVmVyaWZpZXIgY291bGQgY29uY2x1ZGUgdGhhdCB0aGUgTm9uY2Ug JiM0MzsgT09CIGNsYWltcyA9IGVmZmVjdGl2ZSBjbGFpbSBzZXQuIE1vcmUgY29uY3JldGVseSwg dGhlIEV2aWRlbmNlDQogY2xhaW1zIHNldCAoRSkgJiM0MzsgKHVuaW9uKSB0aGUgQXNzZXJ0aW9u cyBjbGFpbXMgc2V0IChBKSA9IGVmZmVjdGlWZSBjbGFpbXMgc2V0IChWKS4NCjxvOnA+PC9vOnA+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW47dGV4dC1p bmRlbnQ6LjVpbiI+SeKAmW0gbm90IHN1cmUgaWYgeW91IGFyZSBhbHNvIHN1Z2dlc3RpbmcgdGhh dCBpbXBsaWNpdCBjb3VsZCBtZWFuIHNvbWV0aGluZyBvdGhlciB0aGFuIGV4cGxpY2l0bHkgZGVz Y3JpYmVkIEFzc2VydGlvbnMuIEZvciBleGFtcGxlLCBBc3NlcnRlciBhbmQgVmVyaWZpZXIgY291 bGQgbWVldCBhdCBhIGNvZmZlZSBzaG9wIGFuZCBhZ3JlZSB0aGF0DQogd2hlbmV2ZXIgYSBjZXJ0 aWZpY2F0ZSBwYXRoIHJlc29sdmVzIHRvIHRoZSB0cnVzdCBhbmNob3IgZm9yIHRoZSBBc3NlcnRl ciB0aGF0IGNsYWltcyBzZXQgKFMpIGFsc28gY2FuIGJlIGluZmVycmVkLiBIZW5jZSwgViA9IChT ICYjNDM7IEEgJiM0MzsgRSkuIFRoZSBjaGFydGVyIGxpbWl0YXRpb24gaW1wbGllcyB3ZSBjYW4g ZGVmaW5lIGRyYWZ0cyB0aGF0IGRlZmluZSBFIGZvciB0aGUgQXR0ZXN0ZXIgYW5kIFZlcmlmaWVy IHJvbGVzIGFuZCBTIGFuZCBBIGZvcg0KIHRoZSBWZXJpZmllciByb2xlIG9ubHkgYW5kIG5vdCBo b3cgVmVyaWZpZXIgb2J0YWlucyAoUywgQSkuIDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW4iPklmIHlvdSBkb27igJl0IGhhdmUgdGhlIFsxXSBvdXQtb2YtYmFu ZCB0cnVzdCwgdGhlIG1lYXN1cmVtZW50cyBhcmUgd29ydGhsZXNzLCBzbyB0aGUgYXJjaGl0ZWN0 dXJlIGlzIGluY29tcGxldGUgaWYgaXQganVzdCBoYXMgYSByb2xlIHRoYXQgcHJvdmlkZXMgcmVm ZXJlbmNlIHZhbHVlcy48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyAmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsgW25tc10gUmlnaHQuIFRoZSBhcmNoaXRlY3R1cmUgc2hvdWxkIGFzc3VtZSB0aGF0IHJv bGUgZW50aXRpZXMgaGF2ZSB2YWxpZCBjcmVkZW50aWFscyAoZS5nLiBjZXJ0aWZpY2F0ZXMgJiM0 MzsgcHJpdmF0ZSBrZXkpIGFuZCB0aGF0IHRoZSBWZXJpZmllciBjYW4gcmVzb2x2ZSB0aGF0IGl0 IHRydXN0cyB0aGUgcm9sZSBlbnRpdGllc+KAmSBjcmVkZW50aWFscyAoc29tZWhvdykuDQogSWYg 4oCYb3V0LW9mLWJhbmTigJkgWzFdIG1lYW5zIEFzc2VydGVyKHMpIHRoZW4gdGhlaXIgQXNzZXJ0 aW9ucyAobWVhc3VyZW1lbnRzKSBhcmUgZXhwZWN0ZWQgdG8gYmUgdGhlaXIg4oCccHJvdmFibGUg YXNzZXJ0aW9uc+KAnTsgd2hlcmUgcHJvdmFibGUgbWVhbnMgc2lnbmVkIGJ5IHRoZSBBc3NlcnRl cuKAmXMgY3JlZGVudGlhbCBrZXkuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbjt0ZXh0LWluZGVudDouNWluIj5bbm1zXSBXZSBtaWdo dCB3YW50IHRvIHF1YWxpZnkg4oCcQXNzZXJ0aW9uc+KAnSBhcyDigJxQcm92YWJsZSBBc3NlcnRp b25z4oCdIGluIHRoZSBhcmNoaXRlY3R1cmUgdG8gbWFrZSBpdCBjbGVhciB0aGF0IHRoZXJlIGlz IGEgd2F5IGZvciB0aGUgVmVyaWZpZXIgdG8gYWNjZXB0IHRoZW0gd2l0aG91dCBibGluZGx5IHRy dXN0aW5nIGFuIGFzc2VydGlvbg0KIGdpdmVuIHRvIGl0LiBUaGlzIHdvdWxkIGFsc28gcXVhbGlm eSBpdCBpbiB0ZXJtcyBvZiBhbiBJU08vSUVDIHRlcm1pbm9sb2d5IHRoYXQgZGVmaW5lcyBBc3Nl cnRpb24gYXMg4oCYYSBzdGF0ZW1lbnQgdGhhdCBpcyBub3QgbmVjZXNzYXJpbHkgcHJvdmFibGXi gJkuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsg W25tc10gV2UgY291bGQgaGF2ZSBhIGRpc2N1c3Npb24gYWJvdXQgdGhlDQo8aT52ZXJhY2l0eTwv aT4gb2YgQXNzZXJ0ZXIocynigJkgY3JlZGVudGlhbHMuIEJ1dCBJIHRoaW5rIGl0IGVuZHMgdXAg YmVpbmcgYSByZWN1cnNpb24gb2YgdGhlIFJBVFMgYXJjaGl0ZWN0dXJlLiBUaGlzIGlzbuKAmXQg YW4gaW50ZXJlc3RpbmcgcmF0IGhvbGUgKHB1biBpbnRlbmRlZCksIGV4Y2VwdCBmb3IgYmVpbmcg Y29udmluY2VkIHRoYXQgdGhlIHJlY3Vyc2lvbiB0ZXJtaW5hdGVzLiBGb3IgZXhhbXBsZSwgd2l0 aCBzb21lIHNvcnQgb2YgdHJ1c3QNCiBhbmNob3IgcHJvdmlzaW9uaW5nIHByb3RvY29sIG9yIG1h bnVhbCBwcm9jZXNzIChzZWUgW3NuaXBdKS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyA8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj5JIGhvcGUgd2UgY2Fu IGdldCB0byBhIGNsZWFyIGFyY2hpdGVjdHVyZSB3aXRoIGFsbCBvZiB0aGlzIGxhaWQgb3V0LiBJ IHRoaW5rIGl0IHdpbGwgaGVscCBjdXQgdGhyb3VnaCBhIGxvdCBvZiBjb25mdXNlZCBjb252ZXJz YXRpb25zLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdp bi1sZWZ0Oi41aW47dGV4dC1pbmRlbnQ6LjVpbiI+W25tc10gJiM0MzsxPG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6 LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+TEw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_DB36880D0F61424694641FE88BBF5FF8intelcom_-- From nobody Sat Aug 24 03:51:29 2019 Return-Path: X-Original-To: rats@ietf.org Delivered-To: rats@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 894A4120088; Sat, 24 Aug 2019 03:51:27 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IETF Meeting Session Request Tool To: Cc: rdd@cert.org, rats@ietf.org, Kathleen.Moriarty.ietf@gmail.com, rats-chairs@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.100.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <156664388748.21483.16683328120187748484.idtracker@ietfa.amsl.com> Date: Sat, 24 Aug 2019 03:51:27 -0700 Archived-At: Subject: [Rats] rats - Update to a Meeting Session Request for IETF 106 X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 24 Aug 2019 10:51:28 -0000 An update to a meeting session request has just been submitted by Kathleen Moriarty, a Chair of the rats working group. --------------------------------------------------------- Working Group Name: Remote ATtestation ProcedureS Area Name: Security Area Session Requester: Kathleen Moriarty Number of Sessions: 2 Length of Session(s): 2 Hours, 1.5 Hours Number of Attendees: 40 Conflicts to Avoid: Chair Conflict: secdispatch saag mile acme tls sacm teep suit netconf Key Participant Conflict: cose anima dprive People who must be present: Ned Smith Kathleen Moriarty Nancy Cam-Winget Roman Danyliw Resources Requested: Special Requests: --------------------------------------------------------- From nobody Sat Aug 24 04:51:34 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2D2BE1200A1 for ; Sat, 24 Aug 2019 04:51:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LY8nd9ZAEFVy for ; Sat, 24 Aug 2019 04:51:29 -0700 (PDT) Received: from mail-ot1-x32d.google.com (mail-ot1-x32d.google.com [IPv6:2607:f8b0:4864:20::32d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CC768120018 for ; Sat, 24 Aug 2019 04:51:29 -0700 (PDT) Received: by mail-ot1-x32d.google.com with SMTP id p23so6969650oto.0 for ; Sat, 24 Aug 2019 04:51:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=/ScM6g6sGW8bAGIJW8jIEZJMQBNc805YVVoptv+d6mw=; b=TatXPuFoihaxMEnTrw7WyVT7L8pIgaz/zeOaSaLElwwSh3wJgGv99YVIzpdR9Dw5bz q+Pp1zZpzt9tcVncA/b9csm8Q6245LahaQh+LtObFL1DrRiQMdjyxf2CpRKjV6tvr64I kQWfFUKiYDkkJcGdjvRBtt+iDEISpzxLrBPtmH84Z2QDy/WBDtX9+/PfI6Bd3dpeIV8N lga8q0Kk/RGD5RCAYzplNKgKGIKIhSxgsqH9YQ/G00npjeKU+qK6Ft5GoIF6knW8tNAJ WSMeexZgJCpD4kEzrBorFWYApViPbRQd+BhPz/Agy0LQebOtM8YqSGdsdgKI8plbsZti jXOA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=/ScM6g6sGW8bAGIJW8jIEZJMQBNc805YVVoptv+d6mw=; b=KzTZdhAnRyzu2uEis/rv22nE9tx1GTiG4lxq6s40xHWzm6VUeDwpyR3CQdzpnEbLdF 6vmX/dLMzQMkjXMw/llDLfoc7NVV51tBuucf3TBMTPjH0X0eHvpvNcl5a6L24k9XCFjg ZURUdmI2AkKWFSQAjdDYnMeJXiB5V2vCi83UFhLF034pRU4cR9f0is4Hdy3zg8JOvVl5 15i6pe/vJCzZ99aQFD0FnjXUPNbbPSlkQ5F0LTiOGw7Jibx5fJuSBb0ugDa7fn5noUi5 W75jcqDr05xXhyLU8c+fSeHi5sK//tq1SaBSGoKRJsBmtjaFsqsTGF84teYz8Z8hVB2k Zg0g== X-Gm-Message-State: APjAAAWemoUGMFcgAHRmbEZFU6M9CIcLHbR5uzbhfzTYY9tAaSiPcMEP JGHmaTDaE+UIwwYT84Icj/FfE+znNyhTF0+EBY0d5J00QEM= X-Google-Smtp-Source: APXvYqzqCimiBSegP2HPfeqRZEXGEjMf4rQa6NSYYAuwCT3q73M0ahEGt9xaQ/yW5PVEPkk3WznkFc+X5VKRip2tENM= X-Received: by 2002:a9d:7d12:: with SMTP id v18mr409220otn.342.1566647488921; Sat, 24 Aug 2019 04:51:28 -0700 (PDT) MIME-Version: 1.0 From: Kathleen Moriarty Date: Sat, 24 Aug 2019 07:50:53 -0400 Message-ID: To: rats@ietf.org Content-Type: multipart/alternative; boundary="00000000000010c7500590db8b21" Archived-At: Subject: [Rats] Architecture document review X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 24 Aug 2019 11:51:33 -0000 --00000000000010c7500590db8b21 Content-Type: text/plain; charset="UTF-8" Greetings! Thank you very much to the authors of the RATS architecture document. It is clearly evolving and the current discussion on list should help to shape it further. Acknowledging that it is a early draft, the flow could be improved and consistency in writing style could be as well. General comments: By referring to this as the RATS architecture, are we including EAT in that? I'm just questioning this use of terms early as sometimes the WG name just goes away and is not the same as resulting protocols specified. What does RATS architecture mean in this sense? Is it all things the WG develops or just RATS work? A diagram of how the components fit together would go a long way towards having the document feel more like an architecture document than a terminology document. It would also help with removing the text on "RATS Roles" being a "building block". That text seems to just be from one author based on writing style, so I think it can easily be removed. The diagram setting forth the relationships between architectural components would be really helpful for the reader early in the document to see how each of the defined components fit. This was likely already planned, but is worth mentioning. My comments are focused more on earlier sections and I tried not to overlap with active discussions. My intent is to help improve the document and move it towards something the WG could adopt near term if updated. Abstract: First and second sentence: Remote ATtestation ProcedureS (RATS) architecture facilitates the attestation of device characteristics that, in general, are based on specific trustworthiness qualities intrinsic to a device or service. S/qualities/factors/ I don't think qualities is the right word. Factors or something else leaves this a bit more open and to things that we may be able to nail down (or others defining levels, etc.). On the general comment, should we look at terminology usage in cases like this sentence: The RATS architecture maps corresponding attestation functions and capabilities to specific RATS Roles. s/RATS Roles/Roles/ I'd recommend cutting the following sentences out of the abstract as they are a bit confusing since there's not enough of an explanation to understand what it means. If it makes sense, these could go to the introduction and be clarified. The RATS architecture maps corresponding attestation functions and capabilities to specific RATS Roles. The goal is to enable an appropriate conveyance of evidence about device trustworthiness via network protocols. RATS Roles provide the endpoint context for understanding the various interaction semantics of the attestation lifecycle. And Example usages include, but are not limited to: financial transactions, voting machines, critical safety systems, network equipment health, or trustworthy end-user device management. Introduction: The first sentence reads as if this will be an operational guidance document. Maybe add something about the architecture and how things fit together? In general, this document provides normative guidance how to use, create or adopt network protocols that facilitate remote attestation procedures. I suggest a re-write of the introduction to better explain the problem being solved. This is meant to be an introduction to the problem space and later the architecture is described to help solve that problem. Perhaps starting from a diagram would be helpful to establish a cohesive set of thoughts for the later described architecture that may help structure the document. Once the WG agrees to this architecture, then update the structure and written prose? The problem in this document is the architecture to support remote attestation procedures - explain what that means, what problem is being solved. Section 1.1 - I think you can remove the word "Unfortunately" and still get the point across. This is a crisper write up to help a reader get started and maybe should come before any other introduction text. Section 1.2 - This reads as if the architecture document is all about setting terminology and it is really a terminology document undercover as an architecture document. I'd strike all of this text. Section 2 - Since no other goals are discussed, I suggest removing that part of the first sentence: OLD: One of the goals of the RATS Architecture is to provide the building blocks - the roles defined by the RATS Architecture - to enable the composition of service-chains/hierarchies and work-flows that can create and appraise evidence about the trustworthiness of devices and services. NEW: The RATS Architecture provides the building blocks, including the roles that enable the composition of service-chains/hierarchies and work-flows that can create and appraise evidence about the trustworthiness of devices and services. Question: Is the architecture really all about the roles? The emphasis on roles is important, but I think the wording puts too much on it and then takes away from the architecture structure and definition intended for this document. I think this perception from my read goes away if you remove the suggested text and make the change to the first sentence in this section or just have this section start from the sentence: The RATS Architecture is based on the use-cases defined in [I-D.richardson-rats-usecases]. The bulleted list seems to be a mix of what's in the architecture and requirements for the architecture. That should be cleaned up/separated. The bulleted list that follows removes this focus on roles. First bullet: OLD: o The building blocks to create remote attestation procedures applicable Actors, Roles, Duties, and Interactions, NEW: o The building blocks to create remote attestation procedures including applicable Actors, Roles, Duties, and Interactions, Section 3.1: The notion that a "role" is a building block is confusing. I'd recommend removing this terminology. Wouldn't the attestation (claims and signature) be the building blocks? Everything else is needed to support that in the architecture to attain a trustworthiness level. I have more thoughts on definitions, but will be brief for now. Attester definition - Would like to see evidence defined first and you can remove "attester" that precedes evidence in the first sentence. Authentication checker: Please reword, run on sentence that is difficult to read. There are too many thoughts within the same sentence. Section 4.1.5 Suggested change If more than one RATS Role resides on the same RATS Actor, a network protocol might not be required. s/Role resides on the/ Role is performed by the/ Section 7 - This gets difficult to read again. The last few sections were much better. A lot of text in 7 can be deleted as it doesn't aid in understanding the scope before the "In essence" paragraph. Somewhere in this section, there should be a discussion of the expected bounds of a protocol in that an attestation may be legitimate, but there may be compromised software that was undetected. The responsibility for that software sits with the attester, which is a key attribute for attestation users. Having the responsibility for the integrity and security of attested code sit with the originator or the attester is a key feature. Thank you again for all of your work on this document to date, it's much appreciated! -- Best regards, Kathleen --00000000000010c7500590db8b21 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Greetings!

Thank you very much to the a= uthors of the RATS architecture document.=C2=A0 It is clearly evolving and = the current discussion on list should help to shape it further.=C2=A0 Ackno= wledging that it is a early draft, the flow could be improved and consisten= cy in writing style could be as well.

General comments:
By refer= ring to this as the RATS architecture, are we including EAT in that?=C2=A0 = I'm just questioning this use of terms early as sometimes the WG name j= ust goes away and is not the same as resulting protocols specified.=C2=A0 W= hat does RATS architecture mean in this sense?=C2=A0 Is it all things the W= G develops or just RATS work?

A diagram of how the components fit to= gether would go a long way towards having the document feel more like an ar= chitecture document than a terminology document.=C2=A0 It would also help w= ith removing the text on "RATS Roles" being a "building bloc= k".=C2=A0 That text seems to just be from one author based on writing = style, so I think it can easily be removed.=C2=A0 The diagram setting forth= the relationships between architectural components would be really helpful= for the reader early in the document to see how each of the defined compon= ents fit.=C2=A0 This was likely already planned, but is worth mentioning.
My comments are focused more on earlier sections and I tried not to o= verlap with active discussions.=C2=A0 My intent is to help improve the docu= ment and move it towards something the WG could adopt near term if updated.= =C2=A0

Abstract:

First and second sentence:
=C2=A0 =C2=A0= Remote ATtestation ProcedureS (RATS) architecture facilitates the
=C2=A0= =C2=A0attestation of device characteristics that, in general, are based on=
=C2=A0 =C2=A0specific trustworthiness qualities intrinsic to a device o= r service.
S/qualities/factors/
I don't think qualities is the ri= ght word.=C2=A0 Factors or something else leaves this a bit more open and t= o things that we may be able to nail down (or others defining levels, etc.)= . =C2=A0

On the general comment, should we look at terminology usage= in cases like this sentence:
=C2=A0 =C2=A0The RATS architecture maps co= rresponding
=C2=A0 =C2=A0attestation functions and capabilities to speci= fic RATS Roles.
s/RATS Roles/Roles/

I'd recommend cutting the= following sentences out of the abstract as they are a bit confusing since = there's not enough of an explanation to understand what it means.=C2=A0= If it makes sense, these could go to the introduction and be clarified.
=C2=A0 =C2=A0The RATS architecture maps corresponding
=C2=A0 =C2=A0= attestation functions and capabilities to specific RATS Roles.=C2=A0 The=C2=A0 =C2=A0goal is to enable an appropriate conveyance of evidence about= device
=C2=A0 =C2=A0trustworthiness via network protocols.=C2=A0 RATS R= oles provide the
=C2=A0 =C2=A0endpoint context for understanding the var= ious interaction semantics
=C2=A0 =C2=A0of the attestation lifecycle. = =C2=A0

And

=C2=A0 =C2=A0Example usages
=C2=A0 =C2=A0includ= e, but are not limited to: financial transactions, voting
=C2=A0 =C2=A0m= achines, critical safety systems, network equipment health, or
=C2=A0 = =C2=A0trustworthy end-user device management.

Introduction:

T= he first sentence reads as if this will be an operational guidance document= .=C2=A0 Maybe add something about the architecture and how things fit toget= her?

=C2=A0 =C2=A0In general, this document provides normative guida= nce how to use,
=C2=A0 =C2=A0create or adopt network protocols that faci= litate remote attestation
=C2=A0 =C2=A0procedures.

I suggest a r= e-write of the introduction to better explain the problem being solved.=C2= =A0 This is meant to be an introduction to the problem space and later the = architecture is described to help solve that problem. =C2=A0

Perhaps= starting from a diagram would be helpful to establish a cohesive set of th= oughts for the later described architecture that may help structure the doc= ument.=C2=A0 Once the WG agrees to this architecture, then update the struc= ture and written prose? =C2=A0

The problem in this document is the a= rchitecture to support remote attestation procedures - explain what that me= ans, what problem is being solved.

Section 1.1 - I think you can rem= ove the word "Unfortunately" and still get the point across.=C2= =A0 This is a crisper write up to help a reader get started and maybe shoul= d come before any other introduction text.

Section 1.2 - This reads = as if the architecture document is all about setting terminology and it is = really a terminology document undercover as an architecture document.=C2=A0= I'd strike all of this text.

Section 2 - Since no other goals a= re discussed, I suggest removing that part of the first sentence:

OL= D:
=C2=A0 =C2=A0One of the goals of the RATS Architecture is to provide = the building
=C2=A0 =C2=A0blocks - the roles defined by the RATS Archite= cture - to enable the
=C2=A0 =C2=A0composition of service-chains/hierarc= hies and work-flows that can
=C2=A0 =C2=A0create and appraise evidence a= bout the trustworthiness of devices and
=C2=A0 =C2=A0services.
NEW: <= br>=C2=A0 =C2=A0The RATS Architecture provides the building
=C2=A0 =C2= =A0blocks, including the roles that enable the composition of service-chain= s/hierarchies and work-flows that can
=C2=A0 =C2=A0create and appraise e= vidence about the trustworthiness of devices and
=C2=A0 =C2=A0services.<= br>
Question: Is the architecture really all about the roles? The emphas= is on roles is important, but I think the wording puts too much on it and t= hen takes away from the architecture structure and definition intended for = this document.=C2=A0 I think this perception from my read goes away if you = remove the suggested text and make the change to the first sentence in this= section or just have this section start from the sentence:

=C2=A0 = =C2=A0The RATS Architecture is based on the use-cases defined in
=C2=A0 = =C2=A0[I-D.richardson-rats-usecases].

The bulleted list seems to be = a mix of what's in the architecture and requirements for the architectu= re.=C2=A0 That should be cleaned up/separated.

The bulleted list tha= t follows removes this focus on roles.

First bullet:
OLD:
o = =C2=A0The building blocks to create remote attestation procedures
=C2=A0= =C2=A0 =C2=A0 applicable Actors, Roles, Duties, and Interactions,
NEW:<= br>o =C2=A0The building blocks to create remote attestation procedures incl= uding
=C2=A0 =C2=A0 =C2=A0 applicable Actors, Roles, Duties, and Interac= tions,

Section 3.1:
The notion that a "role" is a build= ing block is confusing.=C2=A0 I'd recommend removing this terminology.= =C2=A0 Wouldn't the attestation (claims and signature) be the building = blocks?=C2=A0 Everything else is needed to support that in the architecture= to attain a trustworthiness level.

I have more thoughts on definiti= ons, but will be brief for now.

Attester definition - Would like to = see evidence defined first and you can remove "attester" that pre= cedes evidence in the first sentence.

Authentication checker: Please= reword, run on sentence that is difficult to read.=C2=A0 There are too man= y thoughts within the same sentence.

Section 4.1.5
Suggested chan= ge
=C2=A0 =C2=A0If more than one RATS Role resides on the same
=C2=A0= =C2=A0RATS Actor, a network protocol might not be required.
s/Role res= ides on the/ Role is performed by the/

Section 7 -

This gets = difficult to read again.=C2=A0 The last few sections were much better.=C2= =A0 A lot of text in 7 can be deleted as it doesn't aid in understandin= g the scope before the "In essence" paragraph.

Somewhere i= n this section, there should be a discussion of the expected bounds of a pr= otocol in that an attestation may be legitimate, but there may be compromis= ed software that was undetected.=C2=A0 The responsibility for that software= sits with the attester, which is a key attribute for attestation users.=C2= =A0 Having the responsibility for the integrity and security of attested co= de sit with the originator or the attester is a key feature.


Thank you again for all of your work on this document to date, it's m= uch appreciated!
--

Best regards,
Kathleen
--00000000000010c7500590db8b21-- From nobody Mon Aug 26 10:44:32 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 23F24120B06 for ; Mon, 26 Aug 2019 10:44:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tEbc0WWn9LTj for ; Mon, 26 Aug 2019 10:44:28 -0700 (PDT) Received: from mga06.intel.com (mga06.intel.com [134.134.136.31]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2AB8A120B01 for ; Mon, 26 Aug 2019 10:44:28 -0700 (PDT) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by orsmga104.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 26 Aug 2019 10:44:27 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.64,433,1559545200"; d="scan'208,217";a="197101668" Received: from orsmsx104.amr.corp.intel.com ([10.22.225.131]) by fmsmga001.fm.intel.com with ESMTP; 26 Aug 2019 10:44:26 -0700 Received: from orsmsx162.amr.corp.intel.com (10.22.240.85) by ORSMSX104.amr.corp.intel.com (10.22.225.131) with Microsoft SMTP Server (TLS) id 14.3.439.0; Mon, 26 Aug 2019 10:44:26 -0700 Received: from orsmsx109.amr.corp.intel.com ([169.254.11.172]) by ORSMSX162.amr.corp.intel.com ([169.254.3.73]) with mapi id 14.03.0439.000; Mon, 26 Aug 2019 10:44:26 -0700 From: "Smith, Ned" To: Kathleen Moriarty , "rats@ietf.org" Thread-Topic: [Rats] Architecture document review Thread-Index: AQHVWnJLOM5PqJuIm0yDWRJ0MvqDpKcNtucA Date: Mon, 26 Aug 2019 17:44:25 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1c.0.190812 x-originating-ip: [10.24.14.155] Content-Type: multipart/alternative; boundary="_000_C97787227FE749C181E05E720797B5F1intelcom_" MIME-Version: 1.0 Archived-At: Subject: Re: [Rats] Architecture document review X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Aug 2019 17:44:30 -0000 --_000_C97787227FE749C181E05E720797B5F1intelcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 UmVnYXJkaW5nIEthdGhsZWVu4oCZcyBxdWVzdGlvbiBhYm91dCBzY29wZSBvZiDigJhSQVRTIGFy Y2hpdGVjdHVyZeKAmVsxXS4gTXkgdmlldyBpcyBSQVRTIGFyY2hpdGVjdHVyZSBpcyBpbmNsdXNp dmUgb2YgRUFULiBUaGUgRUFUIGRyYWZ0IGNvbnRhaW5zIGluZm9ybWF0aW9uIG1vZGVsIGVsZW1l bnRzLCBpbmZvcm1hdGlvbiBtb2RlbCBiaW5kaW5nIGVsZW1lbnRzICAtIGluIHRoZSBmb3JtIG9m IENXVCBhbmQgSldUIHRva2VucywgYW5kIGEgbGl0dGxlIGJpdCB0aGF0IGlzIHJlbGF0ZWQgdG8g YXJjaGl0ZWN0dXJlLCB0ZXJtaW5vbG9neSBhbmQgY29udmV5YW5jZSBwcm90b2NvbC4gVGhlIEVB VCBkcmFmdCBhcyBhbiBhcmNoaXRlY3R1cmUgc2VlbXMgbGVzcyBnZW5lcmFsIHRoYW4gaXMgbmVl ZGVkIHRvIHN1cHBvcnQgdGhlIHVzZSBjYXNlcyBhbmQgdGhlIG90aGVyIHByb3Bvc2VkIGRyYWZ0 cy4NCg0KDQoNCkl0IHNlZW1zIHRoZXJlIGlzIGdvb2QgcHJvZ3Jlc3MgYmVpbmcgbWFkZSBvbiB0 aGUgbGlzdCBhbmQgdGhyb3VnaCByZWFkZXIgZmVlZGJhY2sgcmVnYXJkaW5nIHdheXMgdG8gaW1w cm92ZSB0aGUgYXJjaGl0ZWN0dXJlLiBJIGFudGljaXBhdGUgdGhlcmUgd2lsbCBiZSBhIHJldmlz aW9uIGxhdGVyIHRoaXMgd2VlayB0aGF0IGlzIGFuIGltcHJvdmVtZW50IG92ZXIgdGhlIGN1cnJl bnQgZHJhZnQuDQoNCi1OZWQNCg0KT24gOC8yNC8xOSwgNDo1MSBBTSwgIlJBVFMgb24gYmVoYWxm IG9mIEthdGhsZWVuIE1vcmlhcnR5IiA8cmF0cy1ib3VuY2VzQGlldGYub3JnPG1haWx0bzpyYXRz LWJvdW5jZXNAaWV0Zi5vcmc+IG9uIGJlaGFsZiBvZiBrYXRobGVlbi5tb3JpYXJ0eS5pZXRmQGdt YWlsLmNvbTxtYWlsdG86a2F0aGxlZW4ubW9yaWFydHkuaWV0ZkBnbWFpbC5jb20+PiB3cm90ZToN Cg0KR3JlZXRpbmdzIQ0KDQpUaGFuayB5b3UgdmVyeSBtdWNoIHRvIHRoZSBhdXRob3JzIG9mIHRo ZSBSQVRTIGFyY2hpdGVjdHVyZSBkb2N1bWVudC4gIEl0IGlzIGNsZWFybHkgZXZvbHZpbmcgYW5k IHRoZSBjdXJyZW50IGRpc2N1c3Npb24gb24gbGlzdCBzaG91bGQgaGVscCB0byBzaGFwZSBpdCBm dXJ0aGVyLiAgQWNrbm93bGVkZ2luZyB0aGF0IGl0IGlzIGEgZWFybHkgZHJhZnQsIHRoZSBmbG93 IGNvdWxkIGJlIGltcHJvdmVkIGFuZCBjb25zaXN0ZW5jeSBpbiB3cml0aW5nIHN0eWxlIGNvdWxk IGJlIGFzIHdlbGwuDQoNCkdlbmVyYWwgY29tbWVudHM6DQpbMV1CeSByZWZlcnJpbmcgdG8gdGhp cyBhcyB0aGUgUkFUUyBhcmNoaXRlY3R1cmUsIGFyZSB3ZSBpbmNsdWRpbmcgRUFUIGluIHRoYXQ/ ICBJJ20ganVzdCBxdWVzdGlvbmluZyB0aGlzIHVzZSBvZiB0ZXJtcyBlYXJseSBhcyBzb21ldGlt ZXMgdGhlIFdHIG5hbWUganVzdCBnb2VzIGF3YXkgYW5kIGlzIG5vdCB0aGUgc2FtZSBhcyByZXN1 bHRpbmcgcHJvdG9jb2xzIHNwZWNpZmllZC4gIFdoYXQgZG9lcyBSQVRTIGFyY2hpdGVjdHVyZSBt ZWFuIGluIHRoaXMgc2Vuc2U/ICBJcyBpdCBhbGwgdGhpbmdzIHRoZSBXRyBkZXZlbG9wcyBvciBq dXN0IFJBVFMgd29yaz8NCltzbmlwXQ0KDQoNCg== --_000_C97787227FE749C181E05E720797B5F1intelcom_ Content-Type: text/html; charset="utf-8" Content-ID: <173A3736FCA4444CA2E54CF4B9C29A5E@intel.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseTpIZWx2ZXRpY2E7DQoJcGFub3NlLTE6MCAwIDAgMCAwIDAgMCAwIDAg MDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0x OjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJp Ow0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCi8qIFN0eWxlIERlZmluaXRpb25z ICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjow aW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1m YW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0K CXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246 dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXttc28t c3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRl cmxpbmU7fQ0KcC5tc29ub3JtYWwwLCBsaS5tc29ub3JtYWwwLCBkaXYubXNvbm9ybWFsMA0KCXtt c28tc3R5bGUtbmFtZTptc29ub3JtYWw7DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFy Z2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVm dDowaW47DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1z ZXJpZjt9DQpzcGFuLkVtYWlsU3R5bGUxOA0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBs eTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0 O30NCnAucDEsIGxpLnAxLCBkaXYucDENCgl7bXNvLXN0eWxlLW5hbWU6cDE7DQoJbWFyZ2luOjBp bjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjkuMHB0Ow0KCWZvbnQtZmFt aWx5OkhlbHZldGljYTsNCgljb2xvcjojMjJGQ0YwO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1z dHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNl Y3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAx LjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5 bGU+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBs ZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9InAxIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6YmxhY2siPlJlZ2FyZGluZyBLYXRobGVlbuKAmXMgcXVlc3Rpb24gYWJvdXQg c2NvcGUgb2Yg4oCYUkFUUyBhcmNoaXRlY3R1cmXigJlbMV0uIE15IHZpZXcgaXMgUkFUUyBhcmNo aXRlY3R1cmUgaXMgaW5jbHVzaXZlIG9mIEVBVC4gVGhlIEVBVCBkcmFmdCBjb250YWlucyBpbmZv cm1hdGlvbiBtb2RlbCBlbGVtZW50cywNCiBpbmZvcm1hdGlvbiBtb2RlbCBiaW5kaW5nIGVsZW1l bnRzICZuYnNwOy0gaW4gdGhlIGZvcm0gb2YgQ1dUIGFuZCBKV1QgdG9rZW5zLCBhbmQgYSBsaXR0 bGUgYml0IHRoYXQgaXMgcmVsYXRlZCB0byBhcmNoaXRlY3R1cmUsIHRlcm1pbm9sb2d5IGFuZCBj b252ZXlhbmNlIHByb3RvY29sLiBUaGUgRUFUIGRyYWZ0IGFzIGFuIGFyY2hpdGVjdHVyZSBzZWVt cyBsZXNzIGdlbmVyYWwgdGhhbiBpcyBuZWVkZWQgdG8gc3VwcG9ydCB0aGUgdXNlIGNhc2VzIGFu ZA0KIHRoZSBvdGhlciBwcm9wb3NlZCBkcmFmdHMuIDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJwMSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0icDEiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+ SXQgc2VlbXMgdGhlcmUgaXMgZ29vZCBwcm9ncmVzcyBiZWluZyBtYWRlIG9uIHRoZSBsaXN0IGFu ZCB0aHJvdWdoIHJlYWRlciBmZWVkYmFjayByZWdhcmRpbmcgd2F5cyB0byBpbXByb3ZlIHRoZSBh cmNoaXRlY3R1cmUuIEkgYW50aWNpcGF0ZSB0aGVyZSB3aWxsIGJlIGEgcmV2aXNpb24gbGF0ZXIN CiB0aGlzIHdlZWsgdGhhdCBpcyBhbiBpbXByb3ZlbWVudCBvdmVyIHRoZSBjdXJyZW50IGRyYWZ0 LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJwMSI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2Nv bG9yOmJsYWNrIj4tTmVkDQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPk9uIDgvMjQvMTksIDQ6NTEgQU0sICZxdW90 O1JBVFMgb24gYmVoYWxmIG9mIEthdGhsZWVuIE1vcmlhcnR5JnF1b3Q7ICZsdDs8YSBocmVmPSJt YWlsdG86cmF0cy1ib3VuY2VzQGlldGYub3JnIj5yYXRzLWJvdW5jZXNAaWV0Zi5vcmc8L2E+IG9u IGJlaGFsZiBvZg0KPGEgaHJlZj0ibWFpbHRvOmthdGhsZWVuLm1vcmlhcnR5LmlldGZAZ21haWwu Y29tIj5rYXRobGVlbi5tb3JpYXJ0eS5pZXRmQGdtYWlsLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+R3JlZXRp bmdzISA8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0i bWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OjBpbjttYXJnaW4t cmlnaHQ6MGluO21hcmdpbi1ib3R0b206MTIuMHB0O21hcmdpbi1sZWZ0Oi41aW4iPg0KVGhhbmsg eW91IHZlcnkgbXVjaCB0byB0aGUgYXV0aG9ycyBvZiB0aGUgUkFUUyBhcmNoaXRlY3R1cmUgZG9j dW1lbnQuJm5ic3A7IEl0IGlzIGNsZWFybHkgZXZvbHZpbmcgYW5kIHRoZSBjdXJyZW50IGRpc2N1 c3Npb24gb24gbGlzdCBzaG91bGQgaGVscCB0byBzaGFwZSBpdCBmdXJ0aGVyLiZuYnNwOyBBY2tu b3dsZWRnaW5nIHRoYXQgaXQgaXMgYSBlYXJseSBkcmFmdCwgdGhlIGZsb3cgY291bGQgYmUgaW1w cm92ZWQgYW5kIGNvbnNpc3RlbmN5IGluIHdyaXRpbmcNCiBzdHlsZSBjb3VsZCBiZSBhcyB3ZWxs Ljxicj4NCjxicj4NCkdlbmVyYWwgY29tbWVudHM6IDxicj4NClsxXUJ5IHJlZmVycmluZyB0byB0 aGlzIGFzIHRoZSBSQVRTIGFyY2hpdGVjdHVyZSwgYXJlIHdlIGluY2x1ZGluZyBFQVQgaW4gdGhh dD8mbmJzcDsgSSdtIGp1c3QgcXVlc3Rpb25pbmcgdGhpcyB1c2Ugb2YgdGVybXMgZWFybHkgYXMg c29tZXRpbWVzIHRoZSBXRyBuYW1lIGp1c3QgZ29lcyBhd2F5IGFuZCBpcyBub3QgdGhlIHNhbWUg YXMgcmVzdWx0aW5nIHByb3RvY29scyBzcGVjaWZpZWQuJm5ic3A7IFdoYXQgZG9lcyBSQVRTIGFy Y2hpdGVjdHVyZSBtZWFuIGluDQogdGhpcyBzZW5zZT8mbmJzcDsgSXMgaXQgYWxsIHRoaW5ncyB0 aGUgV0cgZGV2ZWxvcHMgb3IganVzdCBSQVRTIHdvcms/PGJyPg0KW3NuaXBdPGJyPg0KPGJyPg0K PG86cD48L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs IiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+ DQo= --_000_C97787227FE749C181E05E720797B5F1intelcom_-- From nobody Mon Aug 26 11:15:14 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9AF9D120B76 for ; Mon, 26 Aug 2019 11:15:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RY2-_uCHOZSo for ; Mon, 26 Aug 2019 11:15:10 -0700 (PDT) Received: from mail-ot1-x333.google.com (mail-ot1-x333.google.com [IPv6:2607:f8b0:4864:20::333]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C51B9120B3B for ; Mon, 26 Aug 2019 11:15:10 -0700 (PDT) Received: by mail-ot1-x333.google.com with SMTP id c7so16133451otp.1 for ; Mon, 26 Aug 2019 11:15:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=iWH82WYXkbXBx1XaZRmi476WX+1ZKMHXd8UTJK9A/5U=; b=gpVyZ2YhFbd5wJFzMMg/xqNMmBD1UCSbcwjZbwr7IOw8dwRzehxgO1kL1gUI1CkRgj QP+VUMIQLNaEZvyOIt2lKd3LGD/mX+/UZMa6UHhwNGvW3YFqWHylWFTgIr/OXDKavPoK Zqi7/zg2xVUTbKKWVXKkAW1IsZUkFNZRnro+I/x8tgfsRoPl8OynT2YEvm2I9gH/nEbj ubQGRlbEBc+tTK4tHlp/ALFBO5OOQvn/VEW1lHUvGkQQ4GiyKh+xgT7dJqOPu1hK5OdN gaaPYsm6Ah0FwvWVONFt0o0T72LZRuT8SJe8ggGMzrVDxMynxhS86wPncJyzeZwiCml+ pq4A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=iWH82WYXkbXBx1XaZRmi476WX+1ZKMHXd8UTJK9A/5U=; b=N0F2fZ1cOM7nFIPA9qucB+8fOe+WwSFaCK3fkM/9Rp4Yle+PhS//PM3eRsZ18OEzYi lOMcr9ieULq0o6QnIGlV0naD/Gsg/LHppAxk5Dd3YWXQkF53nvaIcfyjGRf/moQDhdDb mV8dww6irFEoTIIGeRtNuW6uQeQMuzzTeBECZQlwgJ6JU/y4a0erXqHm8WntW7HwjjJD EOjwCCu8Nsgvn0kIX/aFBIx4xrdhscJlf8Qd3RawBr2XLwIO38DcBaFP0GM89FIOhCSq EgJrUOpWFxLvTt6+HXf55VwDh6QnXneaRBc4rwZkgzZVHn5FkE0Vh/8MPeB4VjrhIlHK YOgQ== X-Gm-Message-State: APjAAAWb92HshnNji78CquhIVgQwire5Xled9bAPS70Ps3qzkm8WY/SO F3mZ2pfBeAkjpiuEa2YM16TTJxSBmushmnIW+Mg= X-Google-Smtp-Source: APXvYqywRTVLUoKqCYSUM8VDHQgpUwfanXMNgjVhM/jZwsN3d7x4bSoB3rO0L9WQU4YnnX/F/GGMqnFdM+3JtN53Sqw= X-Received: by 2002:a9d:68c5:: with SMTP id i5mr1660468oto.250.1566843310207; Mon, 26 Aug 2019 11:15:10 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Kathleen Moriarty Date: Mon, 26 Aug 2019 14:14:33 -0400 Message-ID: To: "Smith, Ned" Cc: "rats@ietf.org" Content-Type: multipart/alternative; boundary="000000000000ec77280591092255" Archived-At: Subject: Re: [Rats] Architecture document review X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Aug 2019 18:15:13 -0000 --000000000000ec77280591092255 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Mon, Aug 26, 2019 at 1:44 PM Smith, Ned wrote: > Regarding Kathleen=E2=80=99s question about scope of =E2=80=98RATS archit= ecture=E2=80=99[1]. My > view is RATS architecture is inclusive of EAT. The EAT draft contains > information model elements, information model binding elements - in the > form of CWT and JWT tokens, and a little bit that is related to > architecture, terminology and conveyance protocol. The EAT draft as an > architecture seems less general than is needed to support the use cases a= nd > the other proposed drafts. > > > > It seems there is good progress being made on the list and through reader > feedback regarding ways to improve the architecture. I anticipate there > will be a revision later this week that is an improvement over the curren= t > draft. > Thank you very much, Ned and the other authors. Yes, the dialog has been quite productive and I look forward to seeing the updated document. Best regards, Kathleen > -Ned > > > > On 8/24/19, 4:51 AM, "RATS on behalf of Kathleen Moriarty" < > rats-bounces@ietf.org on behalf of kathleen.moriarty.ietf@gmail.com> > wrote: > > > > Greetings! > > > > Thank you very much to the authors of the RATS architecture document. It > is clearly evolving and the current discussion on list should help to sha= pe > it further. Acknowledging that it is a early draft, the flow could be > improved and consistency in writing style could be as well. > > General comments: > [1]By referring to this as the RATS architecture, are we including EAT in > that? I'm just questioning this use of terms early as sometimes the WG > name just goes away and is not the same as resulting protocols specified. > What does RATS architecture mean in this sense? Is it all things the WG > develops or just RATS work? > [snip] > > > --=20 Best regards, Kathleen --000000000000ec77280591092255 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Mon, Aug 26, 2019 at 1:44 PM Smith= , Ned <ned.smith@intel.com>= ; wrote:

Regarding Kathleen=E2=80=99s que= stion about scope of =E2=80=98RATS architecture=E2=80=99[1]. My view is RAT= S architecture is inclusive of EAT. The EAT draft contains information mode= l elements, information model binding elements =C2=A0- in the form of CWT and JWT toke= ns, and a little bit that is related to architecture, terminology and conve= yance protocol. The EAT draft as an architecture seems less general than is= needed to support the use cases and the other proposed drafts.

=C2=A0

It seems there is good progress = being made on the list and through reader feedback regarding ways to improv= e the architecture. I anticipate there will be a revision later this week that is an improvement over the current draft.

<= /div>

Thank you very much, Ned and the othe= r authors.=C2=A0 Yes, the dialog has been quite productive and I look forwa= rd to seeing the updated document.=C2=A0=C2=A0

Bes= t regards,
Kathleen
=C2=A0

<= /u>

-Ned

=C2=A0

On 8/24/19, 4:51 AM, &qu= ot;RATS on behalf of Kathleen Moriarty" <rats-bounces@ietf.org on behalf of kathl= een.moriarty.ietf@gmail.com> wrote:

=C2=A0

Greetings!

=C2=A0

Thank you very much to the authors of the RATS architecture document.=C2=A0= It is clearly evolving and the current discussion on list should help to s= hape it further.=C2=A0 Acknowledging that it is a early draft, the flow cou= ld be improved and consistency in writing style could be as well.

General comments:
[1]By referring to this as the RATS architecture, are we including EAT in t= hat?=C2=A0 I'm just questioning this use of terms early as sometimes th= e WG name just goes away and is not the same as resulting protocols specifi= ed.=C2=A0 What does RATS architecture mean in this sense?=C2=A0 Is it all things the WG develops or just RATS work?
[snip]

=C2=A0



--

Best regards,
Kathleen
--000000000000ec77280591092255-- From nobody Mon Aug 26 13:05:54 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 89D05120F2A for ; Mon, 26 Aug 2019 13:05:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z4faUJg-DOGt for ; Mon, 26 Aug 2019 13:05:47 -0700 (PDT) Received: from p3plsmtpa06-07.prod.phx3.secureserver.net (p3plsmtpa06-07.prod.phx3.secureserver.net [173.201.192.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 122A5120F63 for ; Mon, 26 Aug 2019 13:05:47 -0700 (PDT) Received: from [192.168.1.108] ([76.192.164.238]) by :SMTPAUTH: with ESMTPSA id 2LFJiNjycwuRt2LFKiVvZb; Mon, 26 Aug 2019 13:05:46 -0700 From: Laurence Lundblade Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_A099C557-8057-44F5-96EC-8DE2B77A5C5A" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Date: Mon, 26 Aug 2019 13:05:45 -0700 In-Reply-To: Cc: Kathleen Moriarty , "rats@ietf.org" To: "Smith, Ned" References: X-Mailer: Apple Mail (2.3445.9.1) X-CMAE-Envelope: MS4wfCDr3P+ecyzmyERO6DmnKzOxhMKo682LQW9Jp9pOfz+EelxCtXKs259GYNVuDF+vTjtaUK7IlXdTxPDKk2Yj4cz9tE0/cpyjdr2k37MDhdQ4NMcHA/XZ 36yz1BsoEjwCbAoIXLwPYhFRuMuN5CxBIVVSmMbhFfKGXED1xs5ZANJhwM3f0NKJ2TMPqaH1v8cYdBMx8+3BfsnCgeoeSRHDHnbkxgxu9F+4EhC4zyoY+NSh 2QdGBQ8jAUsJGVGSL1fIjw== Archived-At: Subject: Re: [Rats] Architecture document review X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Aug 2019 20:05:53 -0000 --Apple-Mail=_A099C557-8057-44F5-96EC-8DE2B77A5C5A Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On Aug 26, 2019, at 10:44 AM, Smith, Ned wrote: >=20 > Regarding Kathleen=E2=80=99s question about scope of =E2=80=98RATS = architecture=E2=80=99[1]. My view is RATS architecture is inclusive of = EAT. The EAT draft contains information model elements, information = model binding elements - in the form of CWT and JWT tokens, and a = little bit that is related to architecture, terminology and conveyance = protocol. The EAT draft as an architecture seems less general than is = needed to support the use cases and the other proposed drafts. I generally agree with this assessment. It is my thought to take most = architecture that remains in the EAT draft out of the EAT draft. It = would be good to wait until architecture draft is more solid and = complete before doing so. The architecture and terminology that is in = the EAT draft is there from when it was not part of RATS and not even = inheriting from CWT and JWT. I don=E2=80=99t really think the EAT draft has any conveyance protocol = in it and that is a good thing. It is should be neutral and usable with = any conveyance protocols. LL --Apple-Mail=_A099C557-8057-44F5-96EC-8DE2B77A5C5A Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
On = Aug 26, 2019, at 10:44 AM, Smith, Ned <ned.smith@intel.com>= wrote:

Regarding = Kathleen=E2=80=99s question about scope of =E2=80=98RATS = architecture=E2=80=99[1]. My view is RATS architecture is inclusive of = EAT. The EAT draft contains information model elements, information = model binding elements  - in the form of CWT and JWT tokens, and a = little bit that is related to architecture, terminology and conveyance = protocol. The EAT draft as an architecture seems less general than is = needed to support the use cases and the other proposed = drafts.

I = generally agree with this assessment. It is my thought to take most = architecture that remains in the EAT draft out of the EAT draft. It = would be good to wait until architecture draft is more solid and = complete before doing so.  The architecture and terminology that is = in the EAT draft is there from when it was not part of RATS and not even = inheriting from CWT and JWT.

I don=E2=80=99t really think the EAT = draft has any conveyance protocol in it and that is a good thing. It is = should be neutral and usable with any conveyance protocols.

LL

= --Apple-Mail=_A099C557-8057-44F5-96EC-8DE2B77A5C5A-- From nobody Tue Aug 27 10:38:19 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 61540120130 for ; Tue, 27 Aug 2019 10:38:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=juniper.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TuvzITY6MsSm for ; Tue, 27 Aug 2019 10:38:15 -0700 (PDT) Received: from mx0a-00273201.pphosted.com (mx0a-00273201.pphosted.com [208.84.65.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 728061200C7 for ; Tue, 27 Aug 2019 10:38:15 -0700 (PDT) Received: from pps.filterd (m0108158.ppops.net [127.0.0.1]) by mx0a-00273201.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id x7RHYxg1011782 for ; Tue, 27 Aug 2019 10:38:14 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; h=from : to : cc : subject : date : message-id : content-type : content-id : content-transfer-encoding : mime-version; s=PPS1017; bh=OvbwN0pWOqy2xupIp3buVdvBb01sVNjhJaXLai9Ir1c=; b=McIx7eLNcmki+BUvMauuIPtyz/vS8rv5l8uPlJ6JDudES0/jvsglzBxleugLZFdHBW3Q lqa3SBoBj6Gfgvr7FxFq35IAOp1AzAzHCExeo3bqs3paV3Deb3FDCnOVMVArTsu64mIK 9aJZOTzzIj4T/ZUMwjINqTg8WsI/ks3sa2dzXJlEyCSOCkfozLvuMACv2Ac30lC7kPma 0sXDeAU6/GNGqb5CiiZ9tz1dt1ZT2rdOKy1XO5BJlSADIF7jTqRxdSr0jY3B3lYpt9fi F/bojARi+TeijThAV9n5avayDbyKdB1gYQb/mrU5p9J6u9MuaGJTurFIht4f4WGPaTlx bw== Received: from nam02-bl2-obe.outbound.protection.outlook.com (mail-bl2nam02lp2052.outbound.protection.outlook.com [104.47.38.52]) by mx0a-00273201.pphosted.com with ESMTP id 2ummnm21uj-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT) for ; Tue, 27 Aug 2019 10:38:14 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=NgwU3zPdsdbxHp/WnlvReQg3OIYyGkJbdT6AwTMgC5Myj5IX8iu0JK/UA03tX7MGbeOCsMsHYcs6Smvp/PsuOXMNN/67zjy3bZRBekB7+WRbJHHRrMLq9/g05KQtTn/W0SCmMYFBd7XCMOt7Xr0XWJQ/Pb5JjkUkgNl4fas1pyXELoO/YVN+W+62WHfKR8qcBTq2zzcBAyiCNTBFesAKIqVSnY5pwVX5DtLiScwQcgC8g6gezIkOHWAiD0GvOUThoEA9j2OpecYsLtO90SrliQ1Q43azlzxLevRnQbdntnHIn1YEcFirIZyTdQof1jzui3HJU2Enp4KcM73et2rWsA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=OvbwN0pWOqy2xupIp3buVdvBb01sVNjhJaXLai9Ir1c=; b=MKQyX1rEQeWe+pKIMKum+ufxVmBOwj+mV/hpe6dwNuG/RFFEbhgdq0XZ8oJTIbMXqrL4N62Bc/Wyn+0j65CWxYwGSQRSPj9YgsC8mzwxvdUIn335eiFNg2a6NslKmJD/JS6d4U34mehkwc731SArfMyZ/GOh38C6+cqotMgbyfPmbXCw5F7fo+D+0e9ZRqcF342YoyKrrFABVuxUAKpXE4cmw2c756t1jMirzRvSnrlc7KUL4DfBgMfHt+c4ZPb8wbvCsM8CTjVq9Quokcjjq9Uv0qITYAa2dc98Vtl42BafvJp7i2Az7xfJTMFhPWwjdY0izioGhd6Qvrbl+ibjZA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=juniper.net; dmarc=pass action=none header.from=juniper.net; dkim=pass header.d=juniper.net; arc=none Received: from MWHPR05MB2829.namprd05.prod.outlook.com (10.168.246.149) by MWHPR05MB2797.namprd05.prod.outlook.com (10.168.246.13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2220.14; Tue, 27 Aug 2019 17:38:12 +0000 Received: from MWHPR05MB2829.namprd05.prod.outlook.com ([fe80::688b:af35:b5e3:d1ab]) by MWHPR05MB2829.namprd05.prod.outlook.com ([fe80::688b:af35:b5e3:d1ab%8]) with mapi id 15.20.2220.013; Tue, 27 Aug 2019 17:38:12 +0000 From: Puru Kulkarni To: "rats@ietf.org" CC: Guy Fedorkow , Mark Baushke , William Bellingrath , Subramanian Swaminathan , Kavitha Sivagnanam Thread-Topic: Comments on YANG Module for Basic Challenge-Response-based Remote Attestation Procedures Thread-Index: AQHVXP4yS12tuYfxm0G/Sl9wbmgdCw== Date: Tue, 27 Aug 2019 17:38:11 +0000 Message-ID: <932C6C0B-C482-4667-B91E-AAF8071115E8@juniper.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_9784d817-3396-4a4f-b60c-3ef6b345fe55_Enabled=true; MSIP_Label_9784d817-3396-4a4f-b60c-3ef6b345fe55_Name=Juniper Business Use Only; MSIP_Label_9784d817-3396-4a4f-b60c-3ef6b345fe55_Enabled=true; MSIP_Label_9784d817-3396-4a4f-b60c-3ef6b345fe55_SiteId=bea78b3c-4cdb-4130-854a-1d193232e5f4; MSIP_Label_9784d817-3396-4a4f-b60c-3ef6b345fe55_ContentBits=0; MSIP_Label_9784d817-3396-4a4f-b60c-3ef6b345fe55_Method=Standard; MSIP_Label_9784d817-3396-4a4f-b60c-3ef6b345fe55_ActionId=3d94202e-fc9e-4c2b-ab47-00008e887301; MSIP_Label_9784d817-3396-4a4f-b60c-3ef6b345fe55_SetDate=2019-08-27T17:28:05-0800; x-originating-ip: [66.129.239.14] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 0cada65e-6447-4675-a0aa-08d72b155534 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600166)(711020)(4605104)(1401327)(4618075)(2017052603328)(7193020); SRVR:MWHPR05MB2797; x-ms-traffictypediagnostic: MWHPR05MB2797: x-ld-processed: bea78b3c-4cdb-4130-854a-1d193232e5f4,ExtAddr x-ms-exchange-transport-forked: True x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 0142F22657 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(4636009)(396003)(346002)(376002)(39860400002)(366004)(136003)(199004)(189003)(30594003)(7736002)(71190400001)(478600001)(6436002)(66066001)(71200400001)(86362001)(1730700003)(81156014)(81166006)(6506007)(8676002)(6512007)(5660300002)(5640700003)(64756008)(76116006)(66556008)(91956017)(66946007)(6116002)(33656002)(36756003)(66446008)(6486002)(8936002)(186003)(2351001)(2501003)(2906002)(66476007)(107886003)(486006)(2616005)(25786009)(476003)(26005)(3846002)(102836004)(14444005)(305945005)(14454004)(99286004)(4326008)(54906003)(6916009)(256004)(53936002)(316002); DIR:OUT; SFP:1102; SCL:1; SRVR:MWHPR05MB2797; H:MWHPR05MB2829.namprd05.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: juniper.net does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: KnkEjSezH8IUKf4RtYQb84wFonK43LpVts+KtSpfkiXmv6CZERKUWzFPIGTBcMQzA6hJB9/DPYoHYkT1Ng4odWaQ3PoP/EloJjaFERIupUxlPAK4KNXBciaFM/VC1TCNyXdl6mlEkcDY3McC+EqL9UrnFtjudJypnal0qb/ACbZsnDhu2P5iaXnU8nM/fbsrXKbm0prdtBUXNbmh+OxNMJ58K4FAeEMNpYuRFjdmHa7KpUpmlF0PXk8C7LITKWvWn86DjPd/oRqb2lAngN7rg21OanpromL4mOKsZlh7jP2xe3QMXVUS0IziK7v6Tu7RcPhMA3jJPRb7W1HsVvAMRkhBD/xabaWQHdSkUzgdHCEjvWn7GwNZahMFxi0xbdC8tuyQ/uVC7xx+JJ3HsgdxnKKAnVudSrW60b23rXZQN00= Content-Type: text/plain; charset="iso-8859-1" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: juniper.net X-MS-Exchange-CrossTenant-Network-Message-Id: 0cada65e-6447-4675-a0aa-08d72b155534 X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Aug 2019 17:38:11.7995 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bea78b3c-4cdb-4130-854a-1d193232e5f4 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 35kfBtAZSsduzRSehZjIO1nc/3OTwty4HVOAmBWmEN32gkfQ2XGRojkiErPNO5AyAAhjW7V2ZILhiMsh7yW81w== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR05MB2797 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:5.22.84,1.0.8 definitions=2019-08-27_03:2019-08-27,2019-08-27 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_spam_notspam policy=outbound_spam score=0 mlxscore=0 lowpriorityscore=0 suspectscore=0 adultscore=0 malwarescore=0 mlxlogscore=999 phishscore=0 clxscore=1011 spamscore=0 bulkscore=0 priorityscore=1501 impostorscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-1906280000 definitions=main-1908270169 Archived-At: Subject: [Rats] Comments on YANG Module for Basic Challenge-Response-based Remote Attestation Procedures X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Aug 2019 17:38:17 -0000 Hello RATS Working group, I would like to submit the some comments on the RATS working group draft fo= r the YANG Module for Basic Challenge-Response-based Remote Attestation Proce= dures. I feel that this module should be taken forward for adoption. Please find m= y comments Below. They have been split up to correspond with sections of the document: GENERAL COMMENTS ---------------- The IETF draft titled 'YANG Module for Basic Challenge-Response-based Remot= e Attestation Procedures' should be moved forward for adoption. However, one note is that Attestation is applicable only for TPM-enabled systems. Theref= ore, this draft, for instance, does not cover attestation for Apple devices, whi= ch do integrity measurements using the Apple T2 security chip. I feel that sin= ce the attestation performed here is dependent on a TPM being present on the device under attestation, it should contain the string 'TPM' in the title. Additionally, there are multiple references that the module defined by this draft requires a TPM 2.0. However, the defined module also has provisions f= or performing remote attestation using a TPM 1.2. All references to 'TPM 2.0' need to be changed to 'TPM 1.2 or TPM 2.0' 2. THE YANG MODULE FOR BASIC REMOTE ATTESTATION PROCEDURES ---------------------------------------------------------- The RPC named 'basic-trust-establishment' uses the 'tpm20-signature scheme'= , this may not be compatible with an implementation of this module on devices only having a TPM 1.2. Additionally, the output for this RPC uses the 'tpm20-attestation-key-identifier' which may also have the same problem. Therefore, two new RPCs such as 'tpm12-trust-establishment' and 'tpm20-trust-establishment' may need to be created to prevent ambiguity dur= ing implementation. For the RPC named 'log-retrieval' the log should allow selecting the Canoni= cal Event Log (CEL) format. (I don't know if both TPM 1.2 and TPM 2.0 support C= EL format). A new grouping such as 'cannonical-event-log' may also be defined (or introduced through a separate RFC) which can then be used in the output container for the 'log-retrieval' RPC. 4. SECURITY CONSIDERATIONS -------------------------- Security considerations should mention that the nonce exchanged in the RPC = for tpm*-challenge-response-attestation is intended for providing freshness, an= d to prevent replay attacks. Security considerations also need to mention that this YANG module is inten= ded to be used over NETCONF (RFC 6241), which is a clear-text protocol. If quot= e information modelled according to the BRAT YANG module is served over clear= text NETCONF, then it is opened up to a Message Modification Attack on the quote in-transit. Additionally, if NETCONF over SSH is used, quote information ma= y be spoofed if the SSH key of the device under attestation is compromised su= ch as in the Asokan Attack (RFC 6813). It must be noted that this module does not solve these problems. I hope that this draft goes forward to implementation. Regards, Puru From nobody Fri Aug 30 12:36:14 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C2DAE120872 for ; Fri, 30 Aug 2019 12:36:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DrDN35ug6sjC for ; Fri, 30 Aug 2019 12:36:08 -0700 (PDT) Received: from p3plsmtpa06-04.prod.phx3.secureserver.net (p3plsmtpa06-04.prod.phx3.secureserver.net [173.201.192.105]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 605D812097F for ; Fri, 30 Aug 2019 12:36:08 -0700 (PDT) Received: from [192.168.1.76] ([76.167.193.86]) by :SMTPAUTH: with ESMTPA id 3mgpiKkx3uLel3mgpitAVY; Fri, 30 Aug 2019 12:36:07 -0700 From: Laurence Lundblade Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_8A02F7CD-9DC4-4E8D-B497-58E1AEDBABED" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) Date: Fri, 30 Aug 2019 12:36:01 -0700 In-Reply-To: Cc: "rats@ietf.org" To: "Smith, Ned" References: <3F5C57F7-C75F-4C27-9898-25AF98237DE9@island-resort.com> <10825C3E-81E0-43A9-B529-28E7C501E098@intel.com> <910BEC2B-AA72-4106-9E5E-5DDEC6B9CFED@island-resort.com> <7F4FC12D-8F77-46BD-A025-C223F670826C@island-resort.com> X-Mailer: Apple Mail (2.3445.104.11) X-CMAE-Envelope: MS4wfHZ02NkgGbN9DqILxQw3tNh0t9Y9y15TaCNU09Ww5fz6D26DuKa36ROI0/+xJyBSNjLnQf6zNOySm3H49dcYlF+w/SHgg05nQljAG312h4/F7Ga7ksQR vvzywSsalws+EtkMYMkMV4a6l3GwEfK/oKQEP5ckvHsNMHk4LujLzoTbu8FFBOzbTYTgNNDvQdQBLooD/Ijs658nm16/hRc2mIM= Archived-At: Subject: [Rats] attester vs measurement target (was Re: Use the term "attester" instead of root of trust) X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Aug 2019 19:36:12 -0000 --Apple-Mail=_8A02F7CD-9DC4-4E8D-B497-58E1AEDBABED Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Changed the subject as I want to reorient the discussion a bit. = Apologies if this is all obvious to you.=20 When measurements are being performed there is the subsystem that is = doing the reporting / measuring and the subsystem that is being = measured.=20 I think the attester is the subsystem that is doing the reporting. It = generates and formats the claims, has the signing key and does the = signing. I am calling the subsystem that is being measured the measurement = target. I am proposing that the attester measures the measurement target = in RATS architecture. For the measurement to be of best value, there must be isolation between = the attester and the measurement target. For example the attester doing = the measurement should be a TEE, TPM or such. The measurement target is = usually the HLOS like Linux or Windows. The point of measurement is so that attacks against the measurement = target can be detected. If there is no isolation, the attacker that = succeeds against the measurement target is likely to be go on to affect = the attester and then the evidence (e.g. measurement claims in an EAT = token) can be manipulated. In some architectures the manufacturer of the attester will be different = than the manufacturer of the measurement target. For example a TPM is = made by a TPM chip vendor. A TEE is made by a SoC vendor. These are = different than the HLOS vendor, the vendor of Windows, Linux or the = router=E2=80=99s OS. The verifier role primarily needs two thing to successfully verify = measurement evidence.=20 1) They need the public key to verify the signature generated by the = attester and to know that the key is trusted and probably some implied = claims. 2) They need the reference values for what is being measured. For = example, the expected values for Linux kernel 5.x on x86 or such. I think 1) and 2) are likely to come from different manufacturers and = thereby might be depicted as separate roles in the architecture. 1) requires the out-of-band trust role. A RATS system without 1) is not = very secure and not something we want to put in our architecture. 2) requires the reference-value supplier role. Some RATS systems will = have 2) and some will not. You can have a RATS system without 2). = Android Key Store and FIDO=E2=80=99s use of attestation are examples. The verifier has to have a trust relationship with both the manufacturer = of the attester and the manufacture of the HLOS. Or perhaps I should = call these two the attestion asserter and the reference-value asserter. = (I prefer manufacturer because =E2=80=9Casserter=E2=80=9D is too close = to =E2=80=9Cattester=E2=80=9D, is fairly abstract and has some confusion = around it for me). LL > On Aug 23, 2019, at 12:53 PM, Smith, Ned wrote: >=20 > [snip] > =20 > I think the out-of-band trust role is much more important than the = reference-value-supplying role. > [nms] I may not understand what you mean by these terms =E2=80=9Cout-of-= band trust role=E2=80=9D and =E2=80=9Creference-value-supplying role=E2=80= =9D. Generally, they appear to fit in the =E2=80=9CAsserter role=E2=80=9D = side of the diagram Henk displayed at 105 session #2.=20 > =20 > You can have real attestation without reference values. For example, = most claims can be implicit. The entity has secure boot and can be = assumed to perform correctly. Maybe the only claim is location. > [nms] I agree the Verifier role needs to somehow know which claims / = assertions of trustworthiness apply to the Attester and that not all = claims must be conveyed as Evidence. A definition of implicit = attestation might suggest all assertions of trustworthiness could be = conveyed via an out-of-band channel (where out-of-band refers to a = conveyance that isn=E2=80=99t the one carrying Evidence). Recall, that = the RATS WG deemed definition of Asserter / Assertions out of scope for = now. Of course the architecture can talk about them. Hence, it is in = scope to say that Evidence could be as simple as a Nonce claim and a = Verifier could conclude that the Nonce + OOB claims =3D effective claim = set. More concretely, the Evidence claims set (E) + (union) the = Assertions claims set (A) =3D effectiVe claims set (V). > I=E2=80=99m not sure if you are also suggesting that implicit could = mean something other than explicitly described Assertions. For example, = Asserter and Verifier could meet at a coffee shop and agree that = whenever a certificate path resolves to the trust anchor for the = Asserter that claims set (S) also can be inferred. Hence, V =3D (S + A + = E). The charter limitation implies we can define drafts that define E = for the Attester and Verifier roles and S and A for the Verifier role = only and not how Verifier obtains (S, A).=20 > =20 > If you don=E2=80=99t have the [1] out-of-band trust, the measurements = are worthless, so the architecture is incomplete if it just has a role = that provides reference values. > [nms] Right. The architecture should = assume that role entities have valid credentials (e.g. certificates + = private key) and that the Verifier can resolve that it trusts the role = entities=E2=80=99 credentials (somehow). If =E2=80=98out-of-band=E2=80=99 = [1] means Asserter(s) then their Assertions (measurements) are expected = to be their =E2=80=9Cprovable assertions=E2=80=9D; where provable means = signed by the Asserter=E2=80=99s credential key. > [nms] We might want to qualify =E2=80=9CAssertions=E2=80=9D as = =E2=80=9CProvable Assertions=E2=80=9D in the architecture to make it = clear that there is a way for the Verifier to accept them without = blindly trusting an assertion given to it. This would also qualify it in = terms of an ISO/IEC terminology that defines Assertion as =E2=80=98a = statement that is not necessarily provable=E2=80=99. > [nms] We could have a discussion about = the veracity of Asserter(s)=E2=80=99 credentials. But I think it ends up = being a recursion of the RATS architecture. This isn=E2=80=99t an = interesting rat hole (pun intended), except for being convinced that the = recursion terminates. For example, with some sort of trust anchor = provisioning protocol or manual process (see [snip]). > =20 > I hope we can get to a clear architecture with all of this laid out. I = think it will help cut through a lot of confused conversations. > [nms] +1 > =20 > LL --Apple-Mail=_8A02F7CD-9DC4-4E8D-B497-58E1AEDBABED Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8
Changed the subject as I want to reorient the discussion a = bit. Apologies if this is all obvious to you. 

When measurements are = being performed there is the subsystem that is doing the reporting / = measuring and the subsystem that is being measured. 

I think the attester is the subsystem that is doing the = reporting. It generates and formats the claims, has the signing key and = does the signing.

I am calling the subsystem that is being measured the measurement target. I am proposing that the attester measures the measurement target in RATS = architecture.

For the measurement to be of = best value, there must be isolation between the attester and the = measurement target. For example the attester doing the measurement = should be a TEE, TPM or such. The measurement target is usually the HLOS = like Linux or Windows.

The point of = measurement is so that attacks against the measurement target can be = detected. If there is no isolation, the attacker that succeeds against = the measurement target is likely to be go on to affect the attester and = then the evidence (e.g. measurement claims in an EAT token) can be = manipulated.

In some = architectures the manufacturer of the attester will be different than = the manufacturer of the measurement target. For example a TPM is made by = a TPM chip vendor. A TEE is made by a SoC vendor. These are different = than the HLOS vendor, the vendor of Windows, Linux or the router=E2=80=99s= OS.

The = verifier role primarily needs two thing to successfully verify = measurement evidence. 

1) They need the public key to = verify the signature generated by the attester and to know that the key = is trusted and probably some implied claims.

2) They need the reference values for = what is being measured. For example, the expected values for Linux = kernel 5.x on x86 or such.

I think 1) and 2) are likely to come from = different manufacturers and thereby might be depicted as separate roles = in the architecture.

1) requires the out-of-band trust role. A RATS system without = 1) is not very secure and not something we want to put in our = architecture.

2)= requires the reference-value supplier role. Some RATS systems will have = 2) and some will not. You can have a RATS system without 2). Android Key = Store and FIDO=E2=80=99s use of attestation are examples.

The verifier has to have = a trust relationship with both the manufacturer of the attester and the = manufacture of the HLOS. Or perhaps I should call these two the = attestion asserter and the reference-value asserter. (I prefer = manufacturer because =E2=80=9Casserter=E2=80=9D is too close to = =E2=80=9Cattester=E2=80=9D, is fairly abstract and has some confusion = around it for me).

LL



On Aug 23, 2019, at 12:53 PM, Smith, Ned = <ned.smith@intel.com> wrote:

[snip]
 
I think the out-of-band trust role is = much more important than the reference-value-supplying role.
[nms] I may not understand what you mean by these terms = =E2=80=9Cout-of-band trust role=E2=80=9D and = =E2=80=9Creference-value-supplying role=E2=80=9D. Generally, they appear = to fit in the =E2=80=9CAsserter role=E2=80=9D side of the diagram Henk = displayed at 105 session #2. 
 
You can have real attestation without reference values. For = example, most claims can be implicit. The entity has secure boot and can = be assumed to perform correctly. Maybe the only claim is location.
[nms] I agree the Verifier role needs to somehow know which = claims / assertions of trustworthiness apply to the Attester and that = not all claims must be conveyed as Evidence. A definition of implicit = attestation might suggest all assertions of trustworthiness could be = conveyed via an out-of-band channel (where out-of-band refers to a = conveyance that isn=E2=80=99t the one carrying Evidence). Recall, that = the RATS WG deemed definition of Asserter / Assertions out of scope for = now. Of course the architecture can talk about them. Hence, it is in = scope to say that Evidence could be as simple as a Nonce claim and a = Verifier could conclude that the Nonce + OOB claims =3D effective claim = set. More concretely, the Evidence claims set (E) + (union) the = Assertions claims set (A) =3D effectiVe claims set (V).
I=E2=80=99m not sure if you are also suggesting that implicit = could mean something other than explicitly described Assertions. For = example, Asserter and Verifier could meet at a coffee shop and agree = that whenever a certificate path resolves to the trust anchor for the = Asserter that claims set (S) also can be inferred. Hence, V =3D (S + A + = E). The charter limitation implies we can define drafts that define E = for the Attester and Verifier roles and S and A for the Verifier role = only and not how Verifier obtains (S, A). 
 
If you don=E2=80=99t have the [1] = out-of-band trust, the measurements are worthless, so the architecture = is incomplete if it just has a role that provides reference values.
          &nb= sp;     =             &n= bsp;   [nms] Right. The architecture should assume that role = entities have valid credentials (e.g. certificates + private key) and = that the Verifier can resolve that it trusts the role entities=E2=80=99 = credentials (somehow). If =E2=80=98out-of-band=E2=80=99 [1] means = Asserter(s) then their Assertions (measurements) are expected to be = their =E2=80=9Cprovable assertions=E2=80=9D; where provable means signed = by the Asserter=E2=80=99s credential key.
[nms] We might want = to qualify =E2=80=9CAssertions=E2=80=9D as =E2=80=9CProvable = Assertions=E2=80=9D in the architecture to make it clear that there is a = way for the Verifier to accept them without blindly trusting an = assertion given to it. This would also qualify it in terms of an ISO/IEC = terminology that defines Assertion as =E2=80=98a statement that is not = necessarily provable=E2=80=99.
          &nb= sp;            = ;         [nms] We could have a = discussion about the veracity of Asserter(s)=E2=80=99 = credentials. But I think it ends up being a recursion of the RATS = architecture. This isn=E2=80=99t an interesting rat hole (pun intended), = except for being convinced that the recursion terminates. For example, = with some sort of trust anchor provisioning protocol or manual process = (see [snip]).
          &nb= sp;            = ;         
I hope we can get to a clear architecture with all of this = laid out. I think it will help cut through a lot of confused = conversations.
[nms] +1
 
LL

= --Apple-Mail=_8A02F7CD-9DC4-4E8D-B497-58E1AEDBABED-- From nobody Fri Aug 30 12:58:03 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A1F03120924 for ; Fri, 30 Aug 2019 12:58:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.298 X-Spam-Level: X-Spam-Status: No, score=-4.298 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=qti.qualcomm.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sZfAiPlHHDzR for ; Fri, 30 Aug 2019 12:57:56 -0700 (PDT) Received: from alexa-out-sd-02.qualcomm.com (alexa-out-sd-02.qualcomm.com [199.106.114.39]) (using TLSv1.2 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A4B0A120922 for ; Fri, 30 Aug 2019 12:57:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=qti.qualcomm.com; i=@qti.qualcomm.com; q=dns/txt; s=qcdkim; t=1567195076; x=1598731076; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=lsg+/+atOG5pK3KDdb+PHddjQQxIjnOvXwQWCXgkwWQ=; b=lOwUYNZaVejCkJ0ndVEBwfNDpCuraf+bp/lAR3iG5WAsI1Fp6uGGuyNy DhiYOA41uuExKRyB9zLkr2WHk3eaHWP+x7IicFs7wutL+waviVt49QMgu TV7J5Pjq9f68p+BDkU32uQVdKjbk/LstTUTLoybFNDqp5lTHHG1yq41Zx 8=; Received: from unknown (HELO ironmsg05-sd.qualcomm.com) ([10.53.140.145]) by alexa-out-sd-02.qualcomm.com with ESMTP; 30 Aug 2019 12:57:54 -0700 Received: from nasanexm01c.na.qualcomm.com ([10.85.0.83]) by ironmsg05-sd.qualcomm.com with ESMTP/TLS/AES256-SHA; 30 Aug 2019 12:57:54 -0700 Received: from NASANEXM01C.na.qualcomm.com (10.85.0.83) by NASANEXM01C.na.qualcomm.com (10.85.0.83) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 30 Aug 2019 12:57:53 -0700 Received: from NASANEXM01C.na.qualcomm.com ([10.85.0.83]) by NASANEXM01C.na.qualcomm.com ([10.85.0.83]) with mapi id 15.00.1473.005; Fri, 30 Aug 2019 12:57:53 -0700 From: Giridhar Mandyam To: Laurence Lundblade , "Smith, Ned" CC: "rats@ietf.org" Thread-Topic: [Rats] attester vs measurement target (was Re: Use the term "attester" instead of root of trust) Thread-Index: AQHVX2o3UCpkfmuM10ap3lJLjkHwAKcUFuuA Date: Fri, 30 Aug 2019 19:57:53 +0000 Message-ID: <774847aefd954c00970af8fba8659d5a@NASANEXM01C.na.qualcomm.com> References: <3F5C57F7-C75F-4C27-9898-25AF98237DE9@island-resort.com> <10825C3E-81E0-43A9-B529-28E7C501E098@intel.com> <910BEC2B-AA72-4106-9E5E-5DDEC6B9CFED@island-resort.com> <7F4FC12D-8F77-46BD-A025-C223F670826C@island-resort.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.80.80.8] Content-Type: multipart/alternative; boundary="_000_774847aefd954c00970af8fba8659d5aNASANEXM01Cnaqualcommco_" MIME-Version: 1.0 Archived-At: Subject: Re: [Rats] attester vs measurement target (was Re: Use the term "attester" instead of root of trust) X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Aug 2019 19:58:01 -0000 --_000_774847aefd954c00970af8fba8659d5aNASANEXM01Cnaqualcommco_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SSBhbSBub3Qgc3VyZSB3aHkgd2UgYXJlIHRyeWluZyB0byByZS1kZWZpbmUgdGVybXMgdGhhdCBo YXZlIGFscmVhZHkgYmVlbiBkZWZpbmVkIGluIHRoZSBsaXRlcmF0dXJlLiAgSW4gbXkgcmV2aWV3 IG9uIHRoZSAtMDEgdmVyc2lvbiBvZiB0aGUgYXJjaGl0ZWN0dXJlIGRvYyBbMV0sIEkgY2l0ZWQg YSBjb3VwbGUgb2YgcGFwZXJzIHdoZXJlIHRlcm1pbm9sb2d5IGhhZCBiZWVuIGFkZHJlc3NlZCBb Ml0tWzNdLiAgSSB3b25kZXIgaWYgdGhlIFJBVFMgYXJjaGl0ZWN0dXJlIGVkaXRvcnMgZGlkIGEg Y29tcGxldGUgbGl0ZXJhdHVyZSByZXZpZXcgcHJpb3IgdG8gdGhlIGNyZWF0aW9uIG9mIHRoaXMg ZG9jdW1lbnQsIGFuZCBpZiBzbyB3aGV0aGVyIHRoZXkgY2FuIHByb3ZpZGUgYSBqdXN0aWZpY2F0 aW9uIGFzIHRvIHdoeSB0aGV5IHJlamVjdGVkIHByZXZpb3VzIGFwcHJvYWNoZXMgdG8gZGVmaW5p bmcgYXR0ZXN0YXRpb24gdGVybWlub2xvZ3kgYW5kIGFyY2hpdGVjdHVyZS4NCg0KSW4gcGFydGlj dWxhciwgWzJdIGhhcyB0aGUgZm9sbG93aW5nIHRleHQ6DQoNCuKAnFRlcm1pbm9sb2d5LiBBbiBh cHByYWlzZXIgaXMgYSBwYXJ0eSwgZ2VuZXJhbGx5IGEgY29tcHV0ZXIgb24gYSBuZXR3b3JrLCBt YWtpbmcgYSBkZWNpc2lvbiBhYm91dCBzb21lIG90aGVyIHBhcnR5IG9yIHBhcnRpZXMuIEEgdGFy Z2V0IGlzIGEgcGFydHkgYWJvdXQgd2hpY2ggYW4gYXBwcmFpc2VyIG5lZWRzIHRvIG1ha2Ugc3Vj aCBhIGRlY2lzaW9uLuKAnQ0KDQrigJxUZXJtaW5vbG9neS4gQXR0ZXN0YXRpb24gaXMgdGhlIGFj dGl2aXR5IG9mIG1ha2luZyBhIGNsYWltIHRvIGFuIGFwcHJhaXNlciBhYm91dCB0aGUgcHJvcGVy dGllcyBvZiBhIHRhcmdldCBieSBzdXBwbHlpbmcgZXZpZGVuY2Ugd2hpY2ggc3VwcG9ydHMgdGhh dCBjbGFpbS4gQW4gYXR0ZXN0ZXIgaXMgYSBwYXJ0eSBwZXJmb3JtaW5nIHRoaXMgYWN0aXZpdHku IEFuIGFwcHJhaXNlcidzIGRlY2lzaW9uLW1ha2luZyBwcm9jZXNzIGJhc2VkIG9uIGF0dGVzdGVk IGluZm9ybWF0aW9uIGlzIGFwcHJhaXNhbC7igJ0NCg0K4oCcVGVybWlub2xvZ3kuIFRvIG1lYXN1 cmUgYSB0YXJnZXQgbWVhbnMgdG8gY29sbGVjdCBldmlkZW5jZSBhYm91dCBpdCB0aHJvdWdoIGRp cmVjdCBhbmQgbG9jYWwgb2JzZXJ2YXRpb24gb2YgaXQu4oCdDQoNClsxXSBodHRwczovL21haWxh cmNoaXZlLmlldGYub3JnL2FyY2gvbXNnL3JhdHMvOWlJcm5EOVlpeEtDdXdPR0t0dkdaSXpkX2JV Lg0KDQpbMl0gQ29rZXIsIEdlb3JnZSBldCBhbC4gICJQcmluY2lwbGVzIG9mIFJlbW90ZSBBdHRl c3RhdGlvbi4iICBJbnRlcm5hdGlvbmFsIEpvdXJuYWwgb24gSW5mb3JtYXRpb24gU2VjdXJpdHku ICBWb2wuIDEwLiAgTm8gLjIuICAyMDExLiAgcHAuIDYzLTgxLiAgQXZhaWxhYmxlIGF0IGh0dHA6 Ly93ZWIuY3Mud3BpLmVkdS9+Z3V0dG1hbi9wdWJzL3JlbW90ZV9hdHRlc3QucGRmLg0KDQpbM10g Si4gR3V0dG1hbiBldCBhbC4gICIiQXR0ZXN0YXRpb246ICBFdmlkZW5jZSBhbmQgVHJ1c3QiLiAg TUlUUkUgVGVjaG5pY2FsIFJlcG9ydCBNVFIwODAwNzIuICBNYXJjaCAyMDA4LiBodHRwczovL3d3 dy5taXRyZS5vcmcvc2l0ZXMvZGVmYXVsdC9maWxlcy9wZGYvMDdfMDE4Ni5wZGYuDQoNCg0KDQot R2lyaSBNYW5keWFtDQoNCkZyb206IFJBVFMgPHJhdHMtYm91bmNlc0BpZXRmLm9yZz4gT24gQmVo YWxmIE9mIExhdXJlbmNlIEx1bmRibGFkZQ0KU2VudDogRnJpZGF5LCBBdWd1c3QgMzAsIDIwMTkg MTI6MzYgUE0NClRvOiBTbWl0aCwgTmVkIDxuZWQuc21pdGhAaW50ZWwuY29tPg0KQ2M6IHJhdHNA aWV0Zi5vcmcNClN1YmplY3Q6IFtSYXRzXSBhdHRlc3RlciB2cyBtZWFzdXJlbWVudCB0YXJnZXQg KHdhcyBSZTogVXNlIHRoZSB0ZXJtICJhdHRlc3RlciIgaW5zdGVhZCBvZiByb290IG9mIHRydXN0 KQ0KDQoNCkNBVVRJT046IFRoaXMgZW1haWwgb3JpZ2luYXRlZCBmcm9tIG91dHNpZGUgb2YgdGhl IG9yZ2FuaXphdGlvbi4NCkNoYW5nZWQgdGhlIHN1YmplY3QgYXMgSSB3YW50IHRvIHJlb3JpZW50 IHRoZSBkaXNjdXNzaW9uIGEgYml0LiBBcG9sb2dpZXMgaWYgdGhpcyBpcyBhbGwgb2J2aW91cyB0 byB5b3UuDQoNCldoZW4gbWVhc3VyZW1lbnRzIGFyZSBiZWluZyBwZXJmb3JtZWQgdGhlcmUgaXMg dGhlIHN1YnN5c3RlbSB0aGF0IGlzIGRvaW5nIHRoZSByZXBvcnRpbmcgLyBtZWFzdXJpbmcgYW5k IHRoZSBzdWJzeXN0ZW0gdGhhdCBpcyBiZWluZyBtZWFzdXJlZC4NCg0KSSB0aGluayB0aGUgYXR0 ZXN0ZXIgaXMgdGhlIHN1YnN5c3RlbSB0aGF0IGlzIGRvaW5nIHRoZSByZXBvcnRpbmcuIEl0IGdl bmVyYXRlcyBhbmQgZm9ybWF0cyB0aGUgY2xhaW1zLCBoYXMgdGhlIHNpZ25pbmcga2V5IGFuZCBk b2VzIHRoZSBzaWduaW5nLg0KDQpJIGFtIGNhbGxpbmcgdGhlIHN1YnN5c3RlbSB0aGF0IGlzIGJl aW5nIG1lYXN1cmVkIHRoZSBtZWFzdXJlbWVudCB0YXJnZXQuIEkgYW0gcHJvcG9zaW5nIHRoYXQg dGhlIGF0dGVzdGVyIG1lYXN1cmVzIHRoZSBtZWFzdXJlbWVudCB0YXJnZXQgaW4gUkFUUyBhcmNo aXRlY3R1cmUuDQoNCkZvciB0aGUgbWVhc3VyZW1lbnQgdG8gYmUgb2YgYmVzdCB2YWx1ZSwgdGhl cmUgbXVzdCBiZSBpc29sYXRpb24gYmV0d2VlbiB0aGUgYXR0ZXN0ZXIgYW5kIHRoZSBtZWFzdXJl bWVudCB0YXJnZXQuIEZvciBleGFtcGxlIHRoZSBhdHRlc3RlciBkb2luZyB0aGUgbWVhc3VyZW1l bnQgc2hvdWxkIGJlIGEgVEVFLCBUUE0gb3Igc3VjaC4gVGhlIG1lYXN1cmVtZW50IHRhcmdldCBp cyB1c3VhbGx5IHRoZSBITE9TIGxpa2UgTGludXggb3IgV2luZG93cy4NCg0KVGhlIHBvaW50IG9m IG1lYXN1cmVtZW50IGlzIHNvIHRoYXQgYXR0YWNrcyBhZ2FpbnN0IHRoZSBtZWFzdXJlbWVudCB0 YXJnZXQgY2FuIGJlIGRldGVjdGVkLiBJZiB0aGVyZSBpcyBubyBpc29sYXRpb24sIHRoZSBhdHRh Y2tlciB0aGF0IHN1Y2NlZWRzIGFnYWluc3QgdGhlIG1lYXN1cmVtZW50IHRhcmdldCBpcyBsaWtl bHkgdG8gYmUgZ28gb24gdG8gYWZmZWN0IHRoZSBhdHRlc3RlciBhbmQgdGhlbiB0aGUgZXZpZGVu Y2UgKGUuZy4gbWVhc3VyZW1lbnQgY2xhaW1zIGluIGFuIEVBVCB0b2tlbikgY2FuIGJlIG1hbmlw dWxhdGVkLg0KDQpJbiBzb21lIGFyY2hpdGVjdHVyZXMgdGhlIG1hbnVmYWN0dXJlciBvZiB0aGUg YXR0ZXN0ZXIgd2lsbCBiZSBkaWZmZXJlbnQgdGhhbiB0aGUgbWFudWZhY3R1cmVyIG9mIHRoZSBt ZWFzdXJlbWVudCB0YXJnZXQuIEZvciBleGFtcGxlIGEgVFBNIGlzIG1hZGUgYnkgYSBUUE0gY2hp cCB2ZW5kb3IuIEEgVEVFIGlzIG1hZGUgYnkgYSBTb0MgdmVuZG9yLiBUaGVzZSBhcmUgZGlmZmVy ZW50IHRoYW4gdGhlIEhMT1MgdmVuZG9yLCB0aGUgdmVuZG9yIG9mIFdpbmRvd3MsIExpbnV4IG9y IHRoZSByb3V0ZXLigJlzIE9TLg0KDQpUaGUgdmVyaWZpZXIgcm9sZSBwcmltYXJpbHkgbmVlZHMg dHdvIHRoaW5nIHRvIHN1Y2Nlc3NmdWxseSB2ZXJpZnkgbWVhc3VyZW1lbnQgZXZpZGVuY2UuDQoN CjEpIFRoZXkgbmVlZCB0aGUgcHVibGljIGtleSB0byB2ZXJpZnkgdGhlIHNpZ25hdHVyZSBnZW5l cmF0ZWQgYnkgdGhlIGF0dGVzdGVyIGFuZCB0byBrbm93IHRoYXQgdGhlIGtleSBpcyB0cnVzdGVk IGFuZCBwcm9iYWJseSBzb21lIGltcGxpZWQgY2xhaW1zLg0KDQoyKSBUaGV5IG5lZWQgdGhlIHJl ZmVyZW5jZSB2YWx1ZXMgZm9yIHdoYXQgaXMgYmVpbmcgbWVhc3VyZWQuIEZvciBleGFtcGxlLCB0 aGUgZXhwZWN0ZWQgdmFsdWVzIGZvciBMaW51eCBrZXJuZWwgNS54IG9uIHg4NiBvciBzdWNoLg0K DQpJIHRoaW5rIDEpIGFuZCAyKSBhcmUgbGlrZWx5IHRvIGNvbWUgZnJvbSBkaWZmZXJlbnQgbWFu dWZhY3R1cmVycyBhbmQgdGhlcmVieSBtaWdodCBiZSBkZXBpY3RlZCBhcyBzZXBhcmF0ZSByb2xl cyBpbiB0aGUgYXJjaGl0ZWN0dXJlLg0KDQoxKSByZXF1aXJlcyB0aGUgb3V0LW9mLWJhbmQgdHJ1 c3Qgcm9sZS4gQSBSQVRTIHN5c3RlbSB3aXRob3V0IDEpIGlzIG5vdCB2ZXJ5IHNlY3VyZSBhbmQg bm90IHNvbWV0aGluZyB3ZSB3YW50IHRvIHB1dCBpbiBvdXIgYXJjaGl0ZWN0dXJlLg0KDQoyKSBy ZXF1aXJlcyB0aGUgcmVmZXJlbmNlLXZhbHVlIHN1cHBsaWVyIHJvbGUuIFNvbWUgUkFUUyBzeXN0 ZW1zIHdpbGwgaGF2ZSAyKSBhbmQgc29tZSB3aWxsIG5vdC4gWW91IGNhbiBoYXZlIGEgUkFUUyBz eXN0ZW0gd2l0aG91dCAyKS4gQW5kcm9pZCBLZXkgU3RvcmUgYW5kIEZJRE/igJlzIHVzZSBvZiBh dHRlc3RhdGlvbiBhcmUgZXhhbXBsZXMuDQoNClRoZSB2ZXJpZmllciBoYXMgdG8gaGF2ZSBhIHRy dXN0IHJlbGF0aW9uc2hpcCB3aXRoIGJvdGggdGhlIG1hbnVmYWN0dXJlciBvZiB0aGUgYXR0ZXN0 ZXIgYW5kIHRoZSBtYW51ZmFjdHVyZSBvZiB0aGUgSExPUy4gT3IgcGVyaGFwcyBJIHNob3VsZCBj YWxsIHRoZXNlIHR3byB0aGUgYXR0ZXN0aW9uIGFzc2VydGVyIGFuZCB0aGUgcmVmZXJlbmNlLXZh bHVlIGFzc2VydGVyLiAoSSBwcmVmZXIgbWFudWZhY3R1cmVyIGJlY2F1c2Ug4oCcYXNzZXJ0ZXLi gJ0gaXMgdG9vIGNsb3NlIHRvIOKAnGF0dGVzdGVy4oCdLCBpcyBmYWlybHkgYWJzdHJhY3QgYW5k IGhhcyBzb21lIGNvbmZ1c2lvbiBhcm91bmQgaXQgZm9yIG1lKS4NCg0KTEwNCg0KDQoNCg0KT24g QXVnIDIzLCAyMDE5LCBhdCAxMjo1MyBQTSwgU21pdGgsIE5lZCA8bmVkLnNtaXRoQGludGVsLmNv bTxtYWlsdG86bmVkLnNtaXRoQGludGVsLmNvbT4+IHdyb3RlOg0KDQpbc25pcF0NCg0KSSB0aGlu ayB0aGUgb3V0LW9mLWJhbmQgdHJ1c3Qgcm9sZSBpcyBtdWNoIG1vcmUgaW1wb3J0YW50IHRoYW4g dGhlIHJlZmVyZW5jZS12YWx1ZS1zdXBwbHlpbmcgcm9sZS4NCltubXNdIEkgbWF5IG5vdCB1bmRl cnN0YW5kIHdoYXQgeW91IG1lYW4gYnkgdGhlc2UgdGVybXMg4oCcb3V0LW9mLWJhbmQgdHJ1c3Qg cm9sZeKAnSBhbmQg4oCccmVmZXJlbmNlLXZhbHVlLXN1cHBseWluZyByb2xl4oCdLiBHZW5lcmFs bHksIHRoZXkgYXBwZWFyIHRvIGZpdCBpbiB0aGUg4oCcQXNzZXJ0ZXIgcm9sZeKAnSBzaWRlIG9m IHRoZSBkaWFncmFtIEhlbmsgZGlzcGxheWVkIGF0IDEwNSBzZXNzaW9uICMyLg0KDQpZb3UgY2Fu IGhhdmUgcmVhbCBhdHRlc3RhdGlvbiB3aXRob3V0IHJlZmVyZW5jZSB2YWx1ZXMuIEZvciBleGFt cGxlLCBtb3N0IGNsYWltcyBjYW4gYmUgaW1wbGljaXQuIFRoZSBlbnRpdHkgaGFzIHNlY3VyZSBi b290IGFuZCBjYW4gYmUgYXNzdW1lZCB0byBwZXJmb3JtIGNvcnJlY3RseS4gTWF5YmUgdGhlIG9u bHkgY2xhaW0gaXMgbG9jYXRpb24uDQpbbm1zXSBJIGFncmVlIHRoZSBWZXJpZmllciByb2xlIG5l ZWRzIHRvIHNvbWVob3cga25vdyB3aGljaCBjbGFpbXMgLyBhc3NlcnRpb25zIG9mIHRydXN0d29y dGhpbmVzcyBhcHBseSB0byB0aGUgQXR0ZXN0ZXIgYW5kIHRoYXQgbm90IGFsbCBjbGFpbXMgbXVz dCBiZSBjb252ZXllZCBhcyBFdmlkZW5jZS4gQSBkZWZpbml0aW9uIG9mIGltcGxpY2l0IGF0dGVz dGF0aW9uIG1pZ2h0IHN1Z2dlc3QgYWxsIGFzc2VydGlvbnMgb2YgdHJ1c3R3b3J0aGluZXNzIGNv dWxkIGJlIGNvbnZleWVkIHZpYSBhbiBvdXQtb2YtYmFuZCBjaGFubmVsICh3aGVyZSBvdXQtb2Yt YmFuZCByZWZlcnMgdG8gYSBjb252ZXlhbmNlIHRoYXQgaXNu4oCZdCB0aGUgb25lIGNhcnJ5aW5n IEV2aWRlbmNlKS4gUmVjYWxsLCB0aGF0IHRoZSBSQVRTIFdHIGRlZW1lZCBkZWZpbml0aW9uIG9m IEFzc2VydGVyIC8gQXNzZXJ0aW9ucyBvdXQgb2Ygc2NvcGUgZm9yIG5vdy4gT2YgY291cnNlIHRo ZSBhcmNoaXRlY3R1cmUgY2FuIHRhbGsgYWJvdXQgdGhlbS4gSGVuY2UsIGl0IGlzIGluIHNjb3Bl IHRvIHNheSB0aGF0IEV2aWRlbmNlIGNvdWxkIGJlIGFzIHNpbXBsZSBhcyBhIE5vbmNlIGNsYWlt IGFuZCBhIFZlcmlmaWVyIGNvdWxkIGNvbmNsdWRlIHRoYXQgdGhlIE5vbmNlICsgT09CIGNsYWlt cyA9IGVmZmVjdGl2ZSBjbGFpbSBzZXQuIE1vcmUgY29uY3JldGVseSwgdGhlIEV2aWRlbmNlIGNs YWltcyBzZXQgKEUpICsgKHVuaW9uKSB0aGUgQXNzZXJ0aW9ucyBjbGFpbXMgc2V0IChBKSA9IGVm ZmVjdGlWZSBjbGFpbXMgc2V0IChWKS4NCknigJltIG5vdCBzdXJlIGlmIHlvdSBhcmUgYWxzbyBz dWdnZXN0aW5nIHRoYXQgaW1wbGljaXQgY291bGQgbWVhbiBzb21ldGhpbmcgb3RoZXIgdGhhbiBl eHBsaWNpdGx5IGRlc2NyaWJlZCBBc3NlcnRpb25zLiBGb3IgZXhhbXBsZSwgQXNzZXJ0ZXIgYW5k IFZlcmlmaWVyIGNvdWxkIG1lZXQgYXQgYSBjb2ZmZWUgc2hvcCBhbmQgYWdyZWUgdGhhdCB3aGVu ZXZlciBhIGNlcnRpZmljYXRlIHBhdGggcmVzb2x2ZXMgdG8gdGhlIHRydXN0IGFuY2hvciBmb3Ig dGhlIEFzc2VydGVyIHRoYXQgY2xhaW1zIHNldCAoUykgYWxzbyBjYW4gYmUgaW5mZXJyZWQuIEhl bmNlLCBWID0gKFMgKyBBICsgRSkuIFRoZSBjaGFydGVyIGxpbWl0YXRpb24gaW1wbGllcyB3ZSBj YW4gZGVmaW5lIGRyYWZ0cyB0aGF0IGRlZmluZSBFIGZvciB0aGUgQXR0ZXN0ZXIgYW5kIFZlcmlm aWVyIHJvbGVzIGFuZCBTIGFuZCBBIGZvciB0aGUgVmVyaWZpZXIgcm9sZSBvbmx5IGFuZCBub3Qg aG93IFZlcmlmaWVyIG9idGFpbnMgKFMsIEEpLg0KDQpJZiB5b3UgZG9u4oCZdCBoYXZlIHRoZSBb MV0gb3V0LW9mLWJhbmQgdHJ1c3QsIHRoZSBtZWFzdXJlbWVudHMgYXJlIHdvcnRobGVzcywgc28g dGhlIGFyY2hpdGVjdHVyZSBpcyBpbmNvbXBsZXRlIGlmIGl0IGp1c3QgaGFzIGEgcm9sZSB0aGF0 IHByb3ZpZGVzIHJlZmVyZW5jZSB2YWx1ZXMuDQogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIFtubXNdIFJpZ2h0LiBUaGUgYXJjaGl0ZWN0dXJlIHNob3VsZCBhc3N1bWUgdGhhdCByb2xl IGVudGl0aWVzIGhhdmUgdmFsaWQgY3JlZGVudGlhbHMgKGUuZy4gY2VydGlmaWNhdGVzICsgcHJp dmF0ZSBrZXkpIGFuZCB0aGF0IHRoZSBWZXJpZmllciBjYW4gcmVzb2x2ZSB0aGF0IGl0IHRydXN0 cyB0aGUgcm9sZSBlbnRpdGllc+KAmSBjcmVkZW50aWFscyAoc29tZWhvdykuIElmIOKAmG91dC1v Zi1iYW5k4oCZIFsxXSBtZWFucyBBc3NlcnRlcihzKSB0aGVuIHRoZWlyIEFzc2VydGlvbnMgKG1l YXN1cmVtZW50cykgYXJlIGV4cGVjdGVkIHRvIGJlIHRoZWlyIOKAnHByb3ZhYmxlIGFzc2VydGlv bnPigJ07IHdoZXJlIHByb3ZhYmxlIG1lYW5zIHNpZ25lZCBieSB0aGUgQXNzZXJ0ZXLigJlzIGNy ZWRlbnRpYWwga2V5Lg0KW25tc10gV2UgbWlnaHQgd2FudCB0byBxdWFsaWZ5IOKAnEFzc2VydGlv bnPigJ0gYXMg4oCcUHJvdmFibGUgQXNzZXJ0aW9uc+KAnSBpbiB0aGUgYXJjaGl0ZWN0dXJlIHRv IG1ha2UgaXQgY2xlYXIgdGhhdCB0aGVyZSBpcyBhIHdheSBmb3IgdGhlIFZlcmlmaWVyIHRvIGFj Y2VwdCB0aGVtIHdpdGhvdXQgYmxpbmRseSB0cnVzdGluZyBhbiBhc3NlcnRpb24gZ2l2ZW4gdG8g aXQuIFRoaXMgd291bGQgYWxzbyBxdWFsaWZ5IGl0IGluIHRlcm1zIG9mIGFuIElTTy9JRUMgdGVy bWlub2xvZ3kgdGhhdCBkZWZpbmVzIEFzc2VydGlvbiBhcyDigJhhIHN0YXRlbWVudCB0aGF0IGlz IG5vdCBuZWNlc3NhcmlseSBwcm92YWJsZeKAmS4NCiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgW25tc10gV2UgY291bGQgaGF2ZSBhIGRpc2N1c3Npb24gYWJvdXQgdGhlIHZlcmFjaXR5 IG9mIEFzc2VydGVyKHMp4oCZIGNyZWRlbnRpYWxzLiBCdXQgSSB0aGluayBpdCBlbmRzIHVwIGJl aW5nIGEgcmVjdXJzaW9uIG9mIHRoZSBSQVRTIGFyY2hpdGVjdHVyZS4gVGhpcyBpc27igJl0IGFu IGludGVyZXN0aW5nIHJhdCBob2xlIChwdW4gaW50ZW5kZWQpLCBleGNlcHQgZm9yIGJlaW5nIGNv bnZpbmNlZCB0aGF0IHRoZSByZWN1cnNpb24gdGVybWluYXRlcy4gRm9yIGV4YW1wbGUsIHdpdGgg c29tZSBzb3J0IG9mIHRydXN0IGFuY2hvciBwcm92aXNpb25pbmcgcHJvdG9jb2wgb3IgbWFudWFs IHByb2Nlc3MgKHNlZSBbc25pcF0pLg0KDQpJIGhvcGUgd2UgY2FuIGdldCB0byBhIGNsZWFyIGFy Y2hpdGVjdHVyZSB3aXRoIGFsbCBvZiB0aGlzIGxhaWQgb3V0LiBJIHRoaW5rIGl0IHdpbGwgaGVs cCBjdXQgdGhyb3VnaCBhIGxvdCBvZiBjb25mdXNlZCBjb252ZXJzYXRpb25zLg0KW25tc10gKzEN Cg0KTEwNCg0K --_000_774847aefd954c00970af8fba8659d5aNASANEXM01Cnaqualcommco_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDb25zb2xhczsNCglwYW5vc2UtMToyIDEx IDYgOSAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWws IGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1ib3R0 b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixz YW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZp c2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5 Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnByZQ0KCXtt c28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhUTUwgUHJlZm9ybWF0dGVk IENoYXIiOw0KCW1hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6 ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpwLm1zb25vcm1hbDAsIGxp Lm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsN Cgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0 Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uYXBwbGUtY29udmVy dGVkLXNwYWNlDQoJe21zby1zdHlsZS1uYW1lOmFwcGxlLWNvbnZlcnRlZC1zcGFjZTt9DQpzcGFu LkVtYWlsU3R5bGUyMQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZh bWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4uSFRN TFByZWZvcm1hdHRlZENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkhUTUwgUHJlZm9ybWF0dGVkIENo YXIiOw0KCW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiSFRNTCBQcmVm b3JtYXR0ZWQiOw0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KLk1zb0NocERlZmF1bHQN Cgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFn ZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGlu IDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0K LS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpl eHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0 ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6 ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0t Pg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUi Pg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgYW0g bm90IHN1cmUgd2h5IHdlIGFyZSB0cnlpbmcgdG8gcmUtZGVmaW5lIHRlcm1zIHRoYXQgaGF2ZSBh bHJlYWR5IGJlZW4gZGVmaW5lZCBpbiB0aGUgbGl0ZXJhdHVyZS4mbmJzcDsgSW4gbXkgcmV2aWV3 IG9uIHRoZSAtMDEgdmVyc2lvbiBvZiB0aGUgYXJjaGl0ZWN0dXJlIGRvYyBbMV0sIEkgY2l0ZWQg YSBjb3VwbGUgb2YgcGFwZXJzIHdoZXJlIHRlcm1pbm9sb2d5IGhhZCBiZWVuIGFkZHJlc3NlZCBb Ml0tWzNdLiZuYnNwOw0KIEkgd29uZGVyIGlmIHRoZSBSQVRTIGFyY2hpdGVjdHVyZSBlZGl0b3Jz IGRpZCBhIGNvbXBsZXRlIGxpdGVyYXR1cmUgcmV2aWV3IHByaW9yIHRvIHRoZSBjcmVhdGlvbiBv ZiB0aGlzIGRvY3VtZW50LCBhbmQgaWYgc28gd2hldGhlciB0aGV5IGNhbiBwcm92aWRlIGEganVz dGlmaWNhdGlvbiBhcyB0byB3aHkgdGhleSByZWplY3RlZCBwcmV2aW91cyBhcHByb2FjaGVzIHRv IGRlZmluaW5nIGF0dGVzdGF0aW9uIHRlcm1pbm9sb2d5IGFuZCBhcmNoaXRlY3R1cmUuPG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPkluIHBhcnRpY3VsYXIsIFsyXSBoYXMgdGhlIGZvbGxvd2luZyB0 ZXh0OjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0idGV4dC1hdXRvc3BhY2U6bm9uZSI+ 4oCcPGI+VGVybWlub2xvZ3k8L2I+LiA8aT5BbiA8Yj5hcHByYWlzZXI8L2I+IGlzIGEgcGFydHks IGdlbmVyYWxseSBhIGNvbXB1dGVyIG9uIGEgbmV0d29yaywgbWFraW5nIGEgZGVjaXNpb24gYWJv dXQgc29tZSBvdGhlciBwYXJ0eSBvciBwYXJ0aWVzLiBBDQo8Yj50YXJnZXQ8L2I+IGlzIGEgcGFy dHkgYWJvdXQgd2hpY2ggYW4gYXBwcmFpc2VyIG5lZWRzIHRvIG1ha2Ugc3VjaCBhIGRlY2lzaW9u PC9pPi7igJ08bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJ0ZXh0 LWF1dG9zcGFjZTpub25lIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJ0ZXh0LWF1dG9zcGFjZTpub25lIj7igJw8Yj5UZXJtaW5vbG9neTwvYj4uIDxi PjxpPkF0dGVzdGF0aW9uPC9pPjwvYj48aT4gaXMgdGhlIGFjdGl2aXR5IG9mIG1ha2luZyBhIGNs YWltIHRvIGFuIGFwcHJhaXNlciBhYm91dCB0aGUgcHJvcGVydGllcyBvZiBhIHRhcmdldCBieSBz dXBwbHlpbmcgZXZpZGVuY2Ugd2hpY2ggc3VwcG9ydHMgdGhhdCBjbGFpbS4gQW4NCjxiPmF0dGVz dGVyPC9iPiBpcyBhIHBhcnR5IHBlcmZvcm1pbmcgdGhpcyBhY3Rpdml0eS4gQW4gYXBwcmFpc2Vy J3MgZGVjaXNpb24tbWFraW5nIHByb2Nlc3MgYmFzZWQgb24gYXR0ZXN0ZWQgaW5mb3JtYXRpb24g aXMNCjxiPmFwcHJhaXNhbDwvYj48L2k+LuKAnTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9InRleHQtYXV0b3NwYWNlOm5vbmUiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9InRleHQtYXV0b3NwYWNlOm5vbmUiPuKAnDxi PlRlcm1pbm9sb2d5PC9iPi4gPGk+VG8gPGI+bWVhc3VyZTwvYj4gYSB0YXJnZXQgbWVhbnMgdG8g Y29sbGVjdCBldmlkZW5jZSBhYm91dCBpdCB0aHJvdWdoIGRpcmVjdCBhbmQgbG9jYWwgb2JzZXJ2 YXRpb24gb2YgaXQ8L2k+LuKAnTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5bMV0gPGEgaHJlZj0i aHR0cHM6Ly9tYWlsYXJjaGl2ZS5pZXRmLm9yZy9hcmNoL21zZy9yYXRzLzlpSXJuRDlZaXhLQ3V3 T0dLdHZHWkl6ZF9iVSI+DQpodHRwczovL21haWxhcmNoaXZlLmlldGYub3JnL2FyY2gvbXNnL3Jh dHMvOWlJcm5EOVlpeEtDdXdPR0t0dkdaSXpkX2JVPC9hPi48bzpwPjwvbzpwPjwvcD4NCjxwcmUg c3R5bGU9ImJhY2tncm91bmQ6d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpibGFjayI+WzJd IENva2VyLCBHZW9yZ2UgZXQgYWwuJm5ic3A7ICZxdW90O1ByaW5jaXBsZXMgb2YgUmVtb3RlIEF0 dGVzdGF0aW9uLiZxdW90OyZuYnNwOyBJbnRlcm5hdGlvbmFsIEpvdXJuYWwgb24gSW5mb3JtYXRp b24gU2VjdXJpdHkuJm5ic3A7IFZvbC4gMTAuJm5ic3A7IE5vIC4yLiZuYnNwOyAyMDExLiZuYnNw OyBwcC4gNjMtODEuJm5ic3A7IEF2YWlsYWJsZSBhdCA8YSBocmVmPSJodHRwOi8vd2ViLmNzLndw aS5lZHUvfmd1dHRtYW4vcHVicy9yZW1vdGVfYXR0ZXN0LnBkZiI+aHR0cDovL3dlYi5jcy53cGku ZWR1L35ndXR0bWFuL3B1YnMvcmVtb3RlX2F0dGVzdC5wZGY8L2E+LiA8L3NwYW4+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5z LXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3ByZT4NCjxwcmUgc3R5bGU9ImJhY2tncm91bmQ6 d2hpdGUiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6YmxhY2siPlszXSA8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMyMTI1 MjkiPkouIEd1dHRtYW4gZXQgYWwuJm5ic3A7ICZxdW90OyZxdW90O0F0dGVzdGF0aW9uOiZuYnNw OyBFdmlkZW5jZSBhbmQgVHJ1c3QmcXVvdDsuJm5ic3A7IE1JVFJFIFRlY2huaWNhbCBSZXBvcnQg TVRSMDgwMDcyLiZuYnNwOyBNYXJjaCAyMDA4LiA8YSBocmVmPSJodHRwczovL3d3dy5taXRyZS5v cmcvc2l0ZXMvZGVmYXVsdC9maWxlcy9wZGYvMDdfMDE4Ni5wZGYiPmh0dHBzOi8vd3d3Lm1pdHJl Lm9yZy9zaXRlcy9kZWZhdWx0L2ZpbGVzL3BkZi8wN18wMTg2LnBkZjwvYT4uICZuYnNwOzwvc3Bh bj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OkNvbnNvbGFzO2NvbG9y OiMyMTI1MjkiPiZuYnNwOzwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250 LWZhbWlseTomcXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzJGNTU5Nzttc28t c3R5bGUtdGV4dGZpbGwtZmlsbC1jb2xvcjojMkY1NTk3O21zby1zdHlsZS10ZXh0ZmlsbC1maWxs LWFscGhhOjEwMC4wJSI+PG86cD48L286cD48L3NwYW4+PC9wcmU+DQo8cHJlIHN0eWxlPSJiYWNr Z3JvdW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTom cXVvdDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzJGNTU5Nzttc28tc3R5bGUtdGV4 dGZpbGwtZmlsbC1jb2xvcjojMkY1NTk3O21zby1zdHlsZS10ZXh0ZmlsbC1maWxsLWFscGhhOjEw MC4wJSI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wcmU+DQo8cHJlIHN0eWxlPSJiYWNrZ3Jv dW5kOndoaXRlIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDtDYWxpYnJpJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzJGNTU5Nzttc28tc3R5bGUtdGV4dGZp bGwtZmlsbC1jb2xvcjojMkY1NTk3O21zby1zdHlsZS10ZXh0ZmlsbC1maWxsLWFscGhhOjEwMC4w JSI+LUdpcmkgTWFuZHlhbTwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQt ZmFtaWx5OkNvbnNvbGFzO2NvbG9yOiMyMTI1MjkiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcHJlPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdiBz dHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6 My4wcHQgMGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+RnJvbTo8L2I+IFJB VFMgJmx0O3JhdHMtYm91bmNlc0BpZXRmLm9yZyZndDsgPGI+T24gQmVoYWxmIE9mIDwvYj4NCkxh dXJlbmNlIEx1bmRibGFkZTxicj4NCjxiPlNlbnQ6PC9iPiBGcmlkYXksIEF1Z3VzdCAzMCwgMjAx OSAxMjozNiBQTTxicj4NCjxiPlRvOjwvYj4gU21pdGgsIE5lZCAmbHQ7bmVkLnNtaXRoQGludGVs LmNvbSZndDs8YnI+DQo8Yj5DYzo8L2I+IHJhdHNAaWV0Zi5vcmc8YnI+DQo8Yj5TdWJqZWN0Ojwv Yj4gW1JhdHNdIGF0dGVzdGVyIHZzIG1lYXN1cmVtZW50IHRhcmdldCAod2FzIFJlOiBVc2UgdGhl IHRlcm0gJnF1b3Q7YXR0ZXN0ZXImcXVvdDsgaW5zdGVhZCBvZiByb290IG9mIHRydXN0KTxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPHA+PHN0cm9uZz48c3BhbiBzdHlsZT0iZm9udC1zaXplOjguNXB0O2Zv bnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2s7YmFja2dy b3VuZDojRkZFQjlDIj5DQVVUSU9OPC9zcGFuPjwvc3Ryb25nPjxzcGFuIHN0eWxlPSJmb250LXNp emU6OC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjpi bGFjaztiYWNrZ3JvdW5kOiNGRkVCOUMiPjogVGhpcyBlbWFpbCBvcmlnaW5hdGVkIGZyb20gb3V0 c2lkZSBvZg0KIHRoZSBvcmdhbml6YXRpb24uPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPkNoYW5nZWQgdGhlIHN1YmplY3QgYXMgSSB3YW50IHRvIHJl b3JpZW50IHRoZSBkaXNjdXNzaW9uIGEgYml0LiBBcG9sb2dpZXMgaWYgdGhpcyBpcyBhbGwgb2J2 aW91cyB0byB5b3UuJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPldoZW4gbWVhc3VyZW1lbnRzIGFyZSBiZWluZyBwZXJmb3JtZWQgdGhl cmUgaXMgdGhlIHN1YnN5c3RlbSB0aGF0IGlzIGRvaW5nIHRoZSByZXBvcnRpbmcgLyBtZWFzdXJp bmcgYW5kIHRoZSBzdWJzeXN0ZW0gdGhhdCBpcyBiZWluZyBtZWFzdXJlZC4mbmJzcDs8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SSB0aGluayB0 aGUgPGk+YXR0ZXN0ZXI8L2k+Jm5ic3A7aXMgdGhlIHN1YnN5c3RlbSB0aGF0IGlzIGRvaW5nIHRo ZSByZXBvcnRpbmcuIEl0IGdlbmVyYXRlcyBhbmQgZm9ybWF0cyB0aGUgY2xhaW1zLCBoYXMgdGhl IHNpZ25pbmcga2V5IGFuZCBkb2VzIHRoZSBzaWduaW5nLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JIGFtIGNhbGxpbmcgdGhlIHN1YnN5c3Rl bSB0aGF0IGlzIGJlaW5nIG1lYXN1cmVkIHRoZSA8aT5tZWFzdXJlbWVudCB0YXJnZXQuDQo8L2k+ SSBhbSBwcm9wb3NpbmcgdGhhdCB0aGUgYXR0ZXN0ZXIgPGk+bWVhc3VyZXM8L2k+Jm5ic3A7dGhl IG1lYXN1cmVtZW50IHRhcmdldCBpbiBSQVRTIGFyY2hpdGVjdHVyZS48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Rm9yIHRoZSBtZWFzdXJlbWVu dCB0byBiZSBvZiBiZXN0IHZhbHVlLCB0aGVyZSBtdXN0IGJlIGlzb2xhdGlvbiBiZXR3ZWVuIHRo ZSBhdHRlc3RlciBhbmQgdGhlIG1lYXN1cmVtZW50IHRhcmdldC4gRm9yIGV4YW1wbGUgdGhlIGF0 dGVzdGVyIGRvaW5nIHRoZSBtZWFzdXJlbWVudCBzaG91bGQgYmUgYSBURUUsIFRQTSBvciBzdWNo LiBUaGUgbWVhc3VyZW1lbnQgdGFyZ2V0IGlzIHVzdWFsbHkgdGhlIEhMT1MgbGlrZQ0KIExpbnV4 IG9yIFdpbmRvd3MuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPlRoZSBwb2ludCBvZiBtZWFzdXJlbWVudCBpcyBzbyB0aGF0IGF0dGFja3MgYWdh aW5zdCB0aGUgbWVhc3VyZW1lbnQgdGFyZ2V0IGNhbiBiZSBkZXRlY3RlZC4gSWYgdGhlcmUgaXMg bm8gaXNvbGF0aW9uLCB0aGUgYXR0YWNrZXIgdGhhdCBzdWNjZWVkcyBhZ2FpbnN0IHRoZSBtZWFz dXJlbWVudCB0YXJnZXQgaXMgbGlrZWx5IHRvIGJlIGdvIG9uIHRvIGFmZmVjdCB0aGUgYXR0ZXN0 ZXIgYW5kIHRoZW4gdGhlIGV2aWRlbmNlDQogKGUuZy4gbWVhc3VyZW1lbnQgY2xhaW1zIGluIGFu IEVBVCB0b2tlbikgY2FuIGJlIG1hbmlwdWxhdGVkLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JbiBzb21lIGFyY2hpdGVjdHVyZXMgdGhlIG1h bnVmYWN0dXJlciBvZiB0aGUgYXR0ZXN0ZXIgd2lsbCBiZSBkaWZmZXJlbnQgdGhhbiB0aGUgbWFu dWZhY3R1cmVyIG9mIHRoZSBtZWFzdXJlbWVudCB0YXJnZXQuIEZvciBleGFtcGxlIGEgVFBNIGlz IG1hZGUgYnkgYSBUUE0gY2hpcCB2ZW5kb3IuIEEgVEVFIGlzIG1hZGUgYnkgYSBTb0MgdmVuZG9y LiBUaGVzZSBhcmUgZGlmZmVyZW50IHRoYW4gdGhlIEhMT1MgdmVuZG9yLA0KIHRoZSB2ZW5kb3Ig b2YgV2luZG93cywgTGludXggb3IgdGhlIHJvdXRlcuKAmXMgT1MuPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoZSB2ZXJpZmllciByb2xlIHBy aW1hcmlseSBuZWVkcyB0d28gdGhpbmcgdG8gc3VjY2Vzc2Z1bGx5IHZlcmlmeSBtZWFzdXJlbWVu dCBldmlkZW5jZS4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBz dHlsZT0ibWFyZ2luLWxlZnQ6MzAuMHB0O21hcmdpbi1yaWdodDowaW4iPg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjEpIFRoZXkgbmVlZCB0aGUgcHVibGljIGtleSB0byB2ZXJpZnkgdGhl IHNpZ25hdHVyZSBnZW5lcmF0ZWQgYnkgdGhlIGF0dGVzdGVyIGFuZCB0byBrbm93IHRoYXQgdGhl IGtleSBpcyB0cnVzdGVkIGFuZCBwcm9iYWJseSBzb21lIGltcGxpZWQgY2xhaW1zLjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4yKSBUaGV5IG5l ZWQgdGhlIHJlZmVyZW5jZSB2YWx1ZXMgZm9yIHdoYXQgaXMgYmVpbmcgbWVhc3VyZWQuIEZvciBl eGFtcGxlLCB0aGUgZXhwZWN0ZWQgdmFsdWVzIGZvciBMaW51eCBrZXJuZWwgNS54IG9uIHg4NiBv ciBzdWNoLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPkkgdGhpbmsgMSkgYW5kIDIpIGFyZSBsaWtlbHkgdG8gY29tZSBmcm9tIGRp ZmZlcmVudCBtYW51ZmFjdHVyZXJzIGFuZCB0aGVyZWJ5IG1pZ2h0IGJlIGRlcGljdGVkIGFzIHNl cGFyYXRlIHJvbGVzIGluIHRoZSBhcmNoaXRlY3R1cmUuPG86cD48L286cD48L3A+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4xKSByZXF1aXJlcyB0aGUgb3V0LW9mLWJhbmQgdHJ1c3Qg cm9sZS4gQSBSQVRTIHN5c3RlbSB3aXRob3V0IDEpIGlzIG5vdCB2ZXJ5IHNlY3VyZSBhbmQgbm90 IHNvbWV0aGluZyB3ZSB3YW50IHRvIHB1dCBpbiBvdXIgYXJjaGl0ZWN0dXJlLjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4yKSByZXF1aXJlcyB0 aGUgcmVmZXJlbmNlLXZhbHVlIHN1cHBsaWVyIHJvbGUuIFNvbWUgUkFUUyBzeXN0ZW1zIHdpbGwg aGF2ZSAyKSBhbmQgc29tZSB3aWxsIG5vdC4gWW91IGNhbiBoYXZlIGEgUkFUUyBzeXN0ZW0gd2l0 aG91dCAyKS4gQW5kcm9pZCBLZXkgU3RvcmUgYW5kIEZJRE/igJlzIHVzZSBvZiBhdHRlc3RhdGlv biBhcmUgZXhhbXBsZXMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPlRoZSB2ZXJpZmllciBoYXMgdG8gaGF2ZSBhIHRydXN0IHJlbGF0aW9uc2hp cCB3aXRoIGJvdGggdGhlIG1hbnVmYWN0dXJlciBvZiB0aGUgYXR0ZXN0ZXIgYW5kIHRoZSBtYW51 ZmFjdHVyZSBvZiB0aGUgSExPUy4gT3IgcGVyaGFwcyBJIHNob3VsZCBjYWxsIHRoZXNlIHR3byB0 aGUgYXR0ZXN0aW9uIGFzc2VydGVyIGFuZCB0aGUgcmVmZXJlbmNlLXZhbHVlIGFzc2VydGVyLiAo SSBwcmVmZXIgbWFudWZhY3R1cmVyDQogYmVjYXVzZSDigJxhc3NlcnRlcuKAnSBpcyB0b28gY2xv c2UgdG8g4oCcYXR0ZXN0ZXLigJ0sIGlzIGZhaXJseSBhYnN0cmFjdCBhbmQgaGFzIHNvbWUgY29u ZnVzaW9uIGFyb3VuZCBpdCBmb3IgbWUpLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5MTDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48YnI+DQo8YnI+DQo8bzpwPjwvbzpwPjwvcD4NCjxibG9ja3F1b3Rl IHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPk9uIEF1ZyAyMywgMjAxOSwgYXQgMTI6NTMgUE0sIFNtaXRoLCBO ZWQgJmx0OzxhIGhyZWY9Im1haWx0bzpuZWQuc21pdGhAaW50ZWwuY29tIj5uZWQuc21pdGhAaW50 ZWwuY29tPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9Im1hcmdp bi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+W3NuaXBdPG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+ DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkg dGhpbmsgdGhlIG91dC1vZi1iYW5kIHRydXN0IHJvbGUgaXMgbXVjaCBtb3JlIGltcG9ydGFudCB0 aGFuIHRoZSByZWZlcmVuY2UtdmFsdWUtc3VwcGx5aW5nIHJvbGUuPG86cD48L286cD48L3A+DQo8 L2Rpdj4NCjxkaXYgc3R5bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9InRleHQtaW5kZW50Oi41aW4iPltubXNdIEkgbWF5IG5vdCB1bmRlcnN0YW5kIHdo YXQgeW91IG1lYW4gYnkgdGhlc2UgdGVybXMg4oCcb3V0LW9mLWJhbmQgdHJ1c3Qgcm9sZeKAnSBh bmQg4oCccmVmZXJlbmNlLXZhbHVlLXN1cHBseWluZyByb2xl4oCdLiBHZW5lcmFsbHksIHRoZXkg YXBwZWFyIHRvIGZpdCBpbiB0aGUg4oCcQXNzZXJ0ZXIgcm9sZeKAnSBzaWRlIG9mIHRoZSBkaWFn cmFtIEhlbmsgZGlzcGxheWVkIGF0IDEwNQ0KIHNlc3Npb24gIzIuPHNwYW4gY2xhc3M9ImFwcGxl LWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJ0ZXh0LWluZGVudDouNWluIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdiBz dHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Zb3UgY2FuIGhh dmUgcmVhbCBhdHRlc3RhdGlvbiB3aXRob3V0IHJlZmVyZW5jZSB2YWx1ZXMuIEZvciBleGFtcGxl LCBtb3N0IGNsYWltcyBjYW4gYmUgaW1wbGljaXQuIFRoZSBlbnRpdHkgaGFzIHNlY3VyZSBib290 IGFuZCBjYW4gYmUgYXNzdW1lZCB0byBwZXJmb3JtIGNvcnJlY3RseS4gTWF5YmUgdGhlIG9ubHkg Y2xhaW0gaXMgbG9jYXRpb24uPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9Im1h cmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9InRleHQtaW5kZW50 Oi41aW4iPltubXNdIEkgYWdyZWUgdGhlIFZlcmlmaWVyIHJvbGUgbmVlZHMgdG8gc29tZWhvdyBr bm93IHdoaWNoIGNsYWltcyAvIGFzc2VydGlvbnMgb2YgdHJ1c3R3b3J0aGluZXNzIGFwcGx5IHRv IHRoZSBBdHRlc3RlciBhbmQgdGhhdCBub3QgYWxsIGNsYWltcyBtdXN0IGJlIGNvbnZleWVkIGFz IEV2aWRlbmNlLiBBIGRlZmluaXRpb24gb2YgaW1wbGljaXQgYXR0ZXN0YXRpb24NCiBtaWdodCBz dWdnZXN0IGFsbCBhc3NlcnRpb25zIG9mIHRydXN0d29ydGhpbmVzcyBjb3VsZCBiZSBjb252ZXll ZCB2aWEgYW4gb3V0LW9mLWJhbmQgY2hhbm5lbCAod2hlcmUgb3V0LW9mLWJhbmQgcmVmZXJzIHRv IGEgY29udmV5YW5jZSB0aGF0IGlzbuKAmXQgdGhlIG9uZSBjYXJyeWluZyBFdmlkZW5jZSkuIFJl Y2FsbCwgdGhhdCB0aGUgUkFUUyBXRyBkZWVtZWQgZGVmaW5pdGlvbiBvZiBBc3NlcnRlciAvIEFz c2VydGlvbnMgb3V0IG9mIHNjb3BlIGZvcg0KIG5vdy4gT2YgY291cnNlIHRoZSBhcmNoaXRlY3R1 cmUgY2FuIHRhbGsgYWJvdXQgdGhlbS4gSGVuY2UsIGl0IGlzIGluIHNjb3BlIHRvIHNheSB0aGF0 IEV2aWRlbmNlIGNvdWxkIGJlIGFzIHNpbXBsZSBhcyBhIE5vbmNlIGNsYWltIGFuZCBhIFZlcmlm aWVyIGNvdWxkIGNvbmNsdWRlIHRoYXQgdGhlIE5vbmNlICYjNDM7IE9PQiBjbGFpbXMgPSBlZmZl Y3RpdmUgY2xhaW0gc2V0LiBNb3JlIGNvbmNyZXRlbHksIHRoZSBFdmlkZW5jZSBjbGFpbXMgc2V0 IChFKQ0KICYjNDM7ICh1bmlvbikgdGhlIEFzc2VydGlvbnMgY2xhaW1zIHNldCAoQSkgPSBlZmZl Y3RpVmUgY2xhaW1zIHNldCAoVikuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9 Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9InRleHQtaW5k ZW50Oi41aW4iPknigJltIG5vdCBzdXJlIGlmIHlvdSBhcmUgYWxzbyBzdWdnZXN0aW5nIHRoYXQg aW1wbGljaXQgY291bGQgbWVhbiBzb21ldGhpbmcgb3RoZXIgdGhhbiBleHBsaWNpdGx5IGRlc2Ny aWJlZCBBc3NlcnRpb25zLiBGb3IgZXhhbXBsZSwgQXNzZXJ0ZXIgYW5kIFZlcmlmaWVyIGNvdWxk IG1lZXQgYXQgYSBjb2ZmZWUgc2hvcCBhbmQgYWdyZWUgdGhhdCB3aGVuZXZlciBhIGNlcnRpZmlj YXRlDQogcGF0aCByZXNvbHZlcyB0byB0aGUgdHJ1c3QgYW5jaG9yIGZvciB0aGUgQXNzZXJ0ZXIg dGhhdCBjbGFpbXMgc2V0IChTKSBhbHNvIGNhbiBiZSBpbmZlcnJlZC4gSGVuY2UsIFYgPSAoUyAm IzQzOyBBICYjNDM7IEUpLiBUaGUgY2hhcnRlciBsaW1pdGF0aW9uIGltcGxpZXMgd2UgY2FuIGRl ZmluZSBkcmFmdHMgdGhhdCBkZWZpbmUgRSBmb3IgdGhlIEF0dGVzdGVyIGFuZCBWZXJpZmllciBy b2xlcyBhbmQgUyBhbmQgQSBmb3IgdGhlIFZlcmlmaWVyIHJvbGUgb25seQ0KIGFuZCBub3QgaG93 IFZlcmlmaWVyIG9idGFpbnMgKFMsIEEpLjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3Bh Y2UiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0K PGRpdiBzdHlsZT0ibWFyZ2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJz cDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0ibWFy Z2luLWxlZnQ6LjVpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JZiB5b3UgZG9u4oCZdCBoYXZl IHRoZSBbMV0gb3V0LW9mLWJhbmQgdHJ1c3QsIHRoZSBtZWFzdXJlbWVudHMgYXJlIHdvcnRobGVz cywgc28gdGhlIGFyY2hpdGVjdHVyZSBpcyBpbmNvbXBsZXRlIGlmIGl0IGp1c3QgaGFzIGEgcm9s ZSB0aGF0IHByb3ZpZGVzIHJlZmVyZW5jZSB2YWx1ZXMuPG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsgJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IFtubXNdIFJpZ2h0LiBUaGUg YXJjaGl0ZWN0dXJlIHNob3VsZCBhc3N1bWUgdGhhdCByb2xlIGVudGl0aWVzIGhhdmUgdmFsaWQg Y3JlZGVudGlhbHMgKGUuZy4gY2VydGlmaWNhdGVzICYjNDM7IHByaXZhdGUga2V5KSBhbmQgdGhh dCB0aGUgVmVyaWZpZXIgY2FuIHJlc29sdmUgdGhhdCBpdCB0cnVzdHMgdGhlIHJvbGUgZW50aXRp ZXPigJkgY3JlZGVudGlhbHMgKHNvbWVob3cpLg0KIElmIOKAmG91dC1vZi1iYW5k4oCZIFsxXSBt ZWFucyBBc3NlcnRlcihzKSB0aGVuIHRoZWlyIEFzc2VydGlvbnMgKG1lYXN1cmVtZW50cykgYXJl IGV4cGVjdGVkIHRvIGJlIHRoZWlyIOKAnHByb3ZhYmxlIGFzc2VydGlvbnPigJ07IHdoZXJlIHBy b3ZhYmxlIG1lYW5zIHNpZ25lZCBieSB0aGUgQXNzZXJ0ZXLigJlzIGNyZWRlbnRpYWwga2V5Ljxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJ0ZXh0LWluZGVudDouNWluIj5bbm1zXSBXZSBtaWdo dCB3YW50IHRvIHF1YWxpZnkg4oCcQXNzZXJ0aW9uc+KAnSBhcyDigJxQcm92YWJsZSBBc3NlcnRp b25z4oCdIGluIHRoZSBhcmNoaXRlY3R1cmUgdG8gbWFrZSBpdCBjbGVhciB0aGF0IHRoZXJlIGlz IGEgd2F5IGZvciB0aGUgVmVyaWZpZXIgdG8gYWNjZXB0IHRoZW0gd2l0aG91dCBibGluZGx5IHRy dXN0aW5nIGFuIGFzc2VydGlvbiBnaXZlbiB0byBpdC4gVGhpcw0KIHdvdWxkIGFsc28gcXVhbGlm eSBpdCBpbiB0ZXJtcyBvZiBhbiBJU08vSUVDIHRlcm1pbm9sb2d5IHRoYXQgZGVmaW5lcyBBc3Nl cnRpb24gYXMg4oCYYSBzdGF0ZW1lbnQgdGhhdCBpcyBub3QgbmVjZXNzYXJpbHkgcHJvdmFibGXi gJkuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4m bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsgW25tc10gV2UgY291bGQgaGF2ZSBhIGRpc2N1c3Npb24gYWJvdXQgdGhl PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxpPnZlcmFj aXR5PC9pPjxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj5v ZiBBc3NlcnRlcihzKeKAmSBjcmVkZW50aWFscy4gQnV0IEkgdGhpbmsgaXQgZW5kcyB1cCBiZWlu ZyBhDQogcmVjdXJzaW9uIG9mIHRoZSBSQVRTIGFyY2hpdGVjdHVyZS4gVGhpcyBpc27igJl0IGFu IGludGVyZXN0aW5nIHJhdCBob2xlIChwdW4gaW50ZW5kZWQpLCBleGNlcHQgZm9yIGJlaW5nIGNv bnZpbmNlZCB0aGF0IHRoZSByZWN1cnNpb24gdGVybWluYXRlcy4gRm9yIGV4YW1wbGUsIHdpdGgg c29tZSBzb3J0IG9mIHRydXN0IGFuY2hvciBwcm92aXNpb25pbmcgcHJvdG9jb2wgb3IgbWFudWFs IHByb2Nlc3MgKHNlZSBbc25pcF0pLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZl cnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPkkgaG9wZSB3ZSBjYW4gZ2V0IHRvIGEgY2xlYXIgYXJjaGl0ZWN0dXJlIHdpdGggYWxsIG9m IHRoaXMgbGFpZCBvdXQuIEkgdGhpbmsgaXQgd2lsbCBoZWxwIGN1dCB0aHJvdWdoIGEgbG90IG9m IGNvbmZ1c2VkIGNvbnZlcnNhdGlvbnMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXYgc3R5 bGU9Im1hcmdpbi1sZWZ0Oi41aW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9InRleHQt aW5kZW50Oi41aW4iPltubXNdICYjNDM7MTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjxkaXY+DQo8ZGl2IHN0eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2IHN0 eWxlPSJtYXJnaW4tbGVmdDouNWluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkxMPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjwvYm9keT4NCjwvaHRtbD4NCg== --_000_774847aefd954c00970af8fba8659d5aNASANEXM01Cnaqualcommco_-- From nobody Fri Aug 30 14:21:52 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D2B241207FC for ; Fri, 30 Aug 2019 14:21:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wePfw7E7w5_t for ; Fri, 30 Aug 2019 14:21:47 -0700 (PDT) Received: from mail-yw1-xc35.google.com (mail-yw1-xc35.google.com [IPv6:2607:f8b0:4864:20::c35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 980F4120100 for ; Fri, 30 Aug 2019 14:21:47 -0700 (PDT) Received: by mail-yw1-xc35.google.com with SMTP id z64so2866333ywe.7 for ; Fri, 30 Aug 2019 14:21:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=bHJ8/8fGGe6wMBH40lLLhXvy+Rlk+Qr5F+p5A0yI7H0=; b=uDdBRhdBiYkw2i2sWYNVZe2Bq4ZcXTdVCVmc47D0LfGnmbNuRN2u3VIC4Yzcm6xS1t HFnx77i6/2fD3ybbyWpvQ5g4PIcmVRIcaPlbafzltvaOUsdzwUCjxP2ajGPCDjrhKBKC gbsCW8xpucasr/QcFzgznIP/lLXzVGDq9aK5f0pm9EjCDk2CQPvOzH7jclnt79U/1Hmf TDCBsdpz9K9e+iAzbhlsrdoTSfWtzOwKsRe8FXAVfpc3OAY2KM4oruCcYmcquWJMz5O6 Hw61l6yzCqPm+76HjsNGP2q0zXQvKOiJw6oeG8ZNcaN5KlPrkRZc8JX1OvhgqaROTLcR Mw8w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=bHJ8/8fGGe6wMBH40lLLhXvy+Rlk+Qr5F+p5A0yI7H0=; b=PTnWhQLr7YEEJDfcEscFv+ha3I66HOqsSrt41teYhd19/KzmW8TVr8v0gIa2hLOLY+ T7HHLAlkqjHIE8kMNRMmz/RWTldeTXLjeq59BeDHdxgvC+1czLa+AkKOWe0Bm0wuUKqC V7kWxOo1gDxCIKnnwFqBd6KlpBToUJ/2yI3+PQM4doSHg6mNWEfZmmHV2pWc1zLAD+1V eoL/kBpo6mEFXriy/TRWjF/vNNTLXJjCK/Mkgu8FYdRYMgonNOoXhCNy6YgwMqOh3ubL zZkxOaO0RegNgNaY1kcFFGKkzBK/V/5gKEzisvhI+pWMjnruAUQQ8JEOZwmILgvCns/q FwbA== X-Gm-Message-State: APjAAAUDGqMvnHJ0j7GXJYTNc3FsE0+DECkLdkQIAXUwmJT4J0UABtDo WkR22hBHQNx/ElYSahI4HZukunhrwK6y3fckLF4= X-Google-Smtp-Source: APXvYqz9x0vIiccchLYCeSsas4nfH/oN8BnvJeerOKh6z9yhf33eT78UcLwo3aiQEtGcbMUoJj6unok4aqKDInmqnis= X-Received: by 2002:a81:1d05:: with SMTP id d5mr12287153ywd.299.1567200106848; Fri, 30 Aug 2019 14:21:46 -0700 (PDT) MIME-Version: 1.0 References: <3F5C57F7-C75F-4C27-9898-25AF98237DE9@island-resort.com> <10825C3E-81E0-43A9-B529-28E7C501E098@intel.com> <910BEC2B-AA72-4106-9E5E-5DDEC6B9CFED@island-resort.com> <7F4FC12D-8F77-46BD-A025-C223F670826C@island-resort.com> <774847aefd954c00970af8fba8659d5a@NASANEXM01C.na.qualcomm.com> In-Reply-To: <774847aefd954c00970af8fba8659d5a@NASANEXM01C.na.qualcomm.com> From: Ira McDonald Date: Fri, 30 Aug 2019 17:21:35 -0400 Message-ID: To: Giridhar Mandyam , Ira McDonald Cc: Laurence Lundblade , "Smith, Ned" , "rats@ietf.org" Content-Type: multipart/alternative; boundary="000000000000a926ae05915c35ce" Archived-At: Subject: Re: [Rats] attester vs measurement target (was Re: Use the term "attester" instead of root of trust) X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Aug 2019 21:21:51 -0000 --000000000000a926ae05915c35ce Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi, +1 to Girii's comments and suggestions. Reinventing terminology (the curse of the computer industry) leads to automatic cognitive disconnects and confusion and benefits no one. Cheers, - Ira Ira McDonald (Musician / Software Architect) Co-Chair - TCG Trusted Mobility Solutions WG Co-Chair - TCG Metadata Access Protocol SG Chair - Linux Foundation Open Printing WG Secretary - IEEE-ISTO Printer Working Group Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG IETF Designated Expert - IPP & Printer MIB Blue Roof Music / High North Inc http://sites.google.com/site/blueroofmusic http://sites.google.com/site/highnorthinc mailto: blueroofmusic@gmail.com PO Box 221 Grand Marais, MI 49839 906-494-2434 On Fri, Aug 30, 2019 at 3:58 PM Giridhar Mandyam wrote: > I am not sure why we are trying to re-define terms that have already been > defined in the literature. In my review on the -01 version of the > architecture doc [1], I cited a couple of papers where terminology had be= en > addressed [2]-[3]. I wonder if the RATS architecture editors did a > complete literature review prior to the creation of this document, and if > so whether they can provide a justification as to why they rejected > previous approaches to defining attestation terminology and architecture. > > > > In particular, [2] has the following text: > > > > =E2=80=9C*Terminology*. *An appraiser is a party, generally a computer on= a > network, making a decision about some other party or parties. A target is= a > party about which an appraiser needs to make such a decision*.=E2=80=9D > > > > =E2=80=9C*Terminology*. *Attestation** is the activity of making a claim = to an > appraiser about the properties of a target by supplying evidence which > supports that claim. An attester is a party performing this activity. An > appraiser's decision-making process based on attested information is > appraisal*.=E2=80=9D > > > > =E2=80=9C*Terminology*. *To measure a target means to collect evidence ab= out it > through direct and local observation of it*.=E2=80=9D > > > > [1] https://mailarchive.ietf.org/arch/msg/rats/9iIrnD9YixKCuwOGKtvGZIzd_b= U > . > > [2] Coker, George et al. "Principles of Remote Attestation." Internatio= nal Journal on Information Security. Vol. 10. No .2. 2011. pp. 63-81. = Available at http://web.cs.wpi.edu/~guttman/pubs/remote_attest.pdf. > > [3] J. Guttman et al. ""Attestation: Evidence and Trust". MITRE Techni= cal Report MTR080072. March 2008. https://www.mitre.org/sites/default/file= s/pdf/07_0186.pdf. > > > > -Giri Mandyam > > > > *From:* RATS *On Behalf Of * Laurence Lundblade > *Sent:* Friday, August 30, 2019 12:36 PM > *To:* Smith, Ned > *Cc:* rats@ietf.org > *Subject:* [Rats] attester vs measurement target (was Re: Use the term > "attester" instead of root of trust) > > > > *CAUTION*: This email originated from outside of the organization. > > Changed the subject as I want to reorient the discussion a bit. Apologies > if this is all obvious to you. > > > > When measurements are being performed there is the subsystem that is doin= g > the reporting / measuring and the subsystem that is being measured. > > > > I think the *attester* is the subsystem that is doing the reporting. It > generates and formats the claims, has the signing key and does the signin= g. > > > > I am calling the subsystem that is being measured the *measurement > target. *I am proposing that the attester *measures* the measurement > target in RATS architecture. > > > > For the measurement to be of best value, there must be isolation between > the attester and the measurement target. For example the attester doing t= he > measurement should be a TEE, TPM or such. The measurement target is usual= ly > the HLOS like Linux or Windows. > > > > The point of measurement is so that attacks against the measurement targe= t > can be detected. If there is no isolation, the attacker that succeeds > against the measurement target is likely to be go on to affect the attest= er > and then the evidence (e.g. measurement claims in an EAT token) can be > manipulated. > > > > In some architectures the manufacturer of the attester will be different > than the manufacturer of the measurement target. For example a TPM is mad= e > by a TPM chip vendor. A TEE is made by a SoC vendor. These are different > than the HLOS vendor, the vendor of Windows, Linux or the router=E2=80=99= s OS. > > > > The verifier role primarily needs two thing to successfully verify > measurement evidence. > > > > 1) They need the public key to verify the signature generated by the > attester and to know that the key is trusted and probably some implied > claims. > > > > 2) They need the reference values for what is being measured. For example= , > the expected values for Linux kernel 5.x on x86 or such. > > > > I think 1) and 2) are likely to come from different manufacturers and > thereby might be depicted as separate roles in the architecture. > > > > 1) requires the out-of-band trust role. A RATS system without 1) is not > very secure and not something we want to put in our architecture. > > > > 2) requires the reference-value supplier role. Some RATS systems will hav= e > 2) and some will not. You can have a RATS system without 2). Android Key > Store and FIDO=E2=80=99s use of attestation are examples. > > > > The verifier has to have a trust relationship with both the manufacturer > of the attester and the manufacture of the HLOS. Or perhaps I should call > these two the attestion asserter and the reference-value asserter. (I > prefer manufacturer because =E2=80=9Casserter=E2=80=9D is too close to = =E2=80=9Cattester=E2=80=9D, is > fairly abstract and has some confusion around it for me). > > > > LL > > > > > > > > On Aug 23, 2019, at 12:53 PM, Smith, Ned wrote: > > > > [snip] > > > > I think the out-of-band trust role is much more important than the > reference-value-supplying role. > > [nms] I may not understand what you mean by these terms =E2=80=9Cout-of-b= and trust > role=E2=80=9D and =E2=80=9Creference-value-supplying role=E2=80=9D. Gener= ally, they appear to fit > in the =E2=80=9CAsserter role=E2=80=9D side of the diagram Henk displayed= at 105 session #2. > > > > > You can have real attestation without reference values. For example, most > claims can be implicit. The entity has secure boot and can be assumed to > perform correctly. Maybe the only claim is location. > > [nms] I agree the Verifier role needs to somehow know which claims / > assertions of trustworthiness apply to the Attester and that not all clai= ms > must be conveyed as Evidence. A definition of implicit attestation might > suggest all assertions of trustworthiness could be conveyed via an > out-of-band channel (where out-of-band refers to a conveyance that isn=E2= =80=99t > the one carrying Evidence). Recall, that the RATS WG deemed definition of > Asserter / Assertions out of scope for now. Of course the architecture ca= n > talk about them. Hence, it is in scope to say that Evidence could be as > simple as a Nonce claim and a Verifier could conclude that the Nonce + OO= B > claims =3D effective claim set. More concretely, the Evidence claims set = (E) > + (union) the Assertions claims set (A) =3D effectiVe claims set (V). > > I=E2=80=99m not sure if you are also suggesting that implicit could mean = something > other than explicitly described Assertions. For example, Asserter and > Verifier could meet at a coffee shop and agree that whenever a certificat= e > path resolves to the trust anchor for the Asserter that claims set (S) al= so > can be inferred. Hence, V =3D (S + A + E). The charter limitation implies= we > can define drafts that define E for the Attester and Verifier roles and S > and A for the Verifier role only and not how Verifier obtains (S, A). > > > > If you don=E2=80=99t have the [1] out-of-band trust, the measurements are > worthless, so the architecture is incomplete if it just has a role that > provides reference values. > > [nms] Right. The architecture should > assume that role entities have valid credentials (e.g. certificates + > private key) and that the Verifier can resolve that it trusts the role > entities=E2=80=99 credentials (somehow). If =E2=80=98out-of-band=E2=80=99= [1] means Asserter(s) > then their Assertions (measurements) are expected to be their =E2=80=9Cpr= ovable > assertions=E2=80=9D; where provable means signed by the Asserter=E2=80=99= s credential key. > > [nms] We might want to qualify =E2=80=9CAssertions=E2=80=9D as =E2=80=9CP= rovable Assertions=E2=80=9D in > the architecture to make it clear that there is a way for the Verifier to > accept them without blindly trusting an assertion given to it. This would > also qualify it in terms of an ISO/IEC terminology that defines Assertion > as =E2=80=98a statement that is not necessarily provable=E2=80=99. > > [nms] We could have a discussion about th= e > *veracity* of Asserter(s)=E2=80=99 credentials. But I think it ends up b= eing a > recursion of the RATS architecture. This isn=E2=80=99t an interesting rat= hole (pun > intended), except for being convinced that the recursion terminates. For > example, with some sort of trust anchor provisioning protocol or manual > process (see [snip]). > > > > I hope we can get to a clear architecture with all of this laid out. I > think it will help cut through a lot of confused conversations. > > [nms] +1 > > > > LL > > > _______________________________________________ > RATS mailing list > RATS@ietf.org > https://www.ietf.org/mailman/listinfo/rats > --000000000000a926ae05915c35ce Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi,

+1 to Girii's commen= ts and suggestions.=C2=A0 Reinventing terminology
(the curse of t= he computer industry) leads to automatic cognitive
disconnects an= d confusion and benefits no one.

Cheers,
- Ira

Ira McDonald (Musician / So= ftware Architect)
Co-Chair - TCG Trusted Mobility Solutions WG
Co-Chair - TCG Metadata Access Protocol SG
Chair= - Linux Foundation Open Printing WG
Secretary - IEEE-ISTO Printer Worki= ng Group
Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG
IETF = Designated Expert - IPP & Printer MIB
Blue Roof Music / High North I= nc
http://sites.google.com/site/blueroofmus= ic
http://sites.google.com/site/highnort= hinc
mailto: blueroofmusic@gmail.com
PO Box 221=C2=A0 Grand Marais, MI 4983= 9=C2=A0 906-494-2434



On Fri, Aug 30, 2019 at 3:58 PM Giridhar Mandyam <mandyam@qti.qualcomm.com> = wrote:

I am not sure why we are trying to re-define terms t= hat have already been defined in the literature.=C2=A0 In my review on the = -01 version of the architecture doc [1], I cited a couple of papers where t= erminology had been addressed [2]-[3].=C2=A0 I wonder if the RATS architecture editors did a complete literature review= prior to the creation of this document, and if so whether they can provide= a justification as to why they rejected previous approaches to defining at= testation terminology and architecture.

=C2=A0

In particular, [2] has the following text:=

=C2=A0

=E2=80=9CTerminology. An appraiser = is a party, generally a computer on a network, making a decision about some= other party or parties. A target is a party about which an appraiser needs to make such a deci= sion.=E2=80=9D

=C2=A0

=E2=80=9CTerminology. Attestation is the activity of making a claim to an appraiser about the propertie= s of a target by supplying evidence which supports that claim. An attester is a party performing this activity. An appraiser's dec= ision-making process based on attested information is appraisal.=E2=80=9D

=C2=A0

=E2=80=9CTerminology. To measure a = target means to collect evidence about it through direct and local observat= ion of it.=E2=80=9D

=C2=A0

[1] https://mailarchive.ietf.org/arch/msg/rats/9iIrnD9YixKCuwOGKtvGZIzd_bU.= 

[2] Cok=
er, George et al.=C2=A0 "Principles of Remote Attestation."=C2=A0=
 International Journal on Information Security.=C2=A0 Vol. 10.=C2=A0 No .2.=
=C2=A0 2011.=C2=A0 pp. 63-81.=C2=A0 Available at http://web.cs.wpi=
.edu/~guttman/pubs/remote_attest.pdf. 
[3] J. Guttman et al.=C2=A0 ""Attestation:=C2=A0 Evidence and=
 Trust".=C2=A0 MITRE Technical Report MTR080072.=C2=A0 March 2008. https://www.mitre.org/sites/default/files/pdf/07_0186.pdf. =
=C2=A0=C2=A0

=C2=A0

From: RATS <rats-bounces@ietf.org> On Behalf Of = Laurence Lundblade
Sent: Friday, August 30, 2019 12:36 PM
To: Smith, Ned <ned.smith@intel.com>
Cc: rats@ietf.org=
Subject: [Rats] attester vs measurement target (was Re: Use the term= "attester" instead of root of trust)

=C2=A0

C= AUTION: This email originated from outside of the organization.

Changed the subject as I want to reorient the discus= sion a bit. Apologies if this is all obvious to you.=C2=A0

=C2=A0

When measurements are being performed there is the s= ubsystem that is doing the reporting / measuring and the subsystem that is = being measured.=C2=A0

=C2=A0

I think the attester=C2=A0is the subsystem th= at is doing the reporting. It generates and formats the claims, has the sig= ning key and does the signing.

=C2=A0

I am calling the subsystem that is being measured th= e measurement target. I am proposing that the attester measures=C2=A0the measurement t= arget in RATS architecture.

=C2=A0

For the measurement to be of best value, there must = be isolation between the attester and the measurement target. For example t= he attester doing the measurement should be a TEE, TPM or such. The measure= ment target is usually the HLOS like Linux or Windows.

=C2=A0

The point of measurement is so that attacks against = the measurement target can be detected. If there is no isolation, the attac= ker that succeeds against the measurement target is likely to be go on to a= ffect the attester and then the evidence (e.g. measurement claims in an EAT token) can be manipulated.

=C2=A0

In some architectures the manufacturer of the attest= er will be different than the manufacturer of the measurement target. For e= xample a TPM is made by a TPM chip vendor. A TEE is made by a SoC vendor. T= hese are different than the HLOS vendor, the vendor of Windows, Linux or the router=E2=80=99s OS.

=C2=A0

The verifier role primarily needs two thing to succe= ssfully verify measurement evidence.=C2=A0

=C2=A0

1) They need the public key to verify the signature = generated by the attester and to know that the key is trusted and probably = some implied claims.

=C2=A0

2) They need the reference values for what is being = measured. For example, the expected values for Linux kernel 5.x on x86 or s= uch.

=C2=A0

I think 1) and 2) are likely to come from different = manufacturers and thereby might be depicted as separate roles in the archit= ecture.

=C2=A0

1) requires the out-of-band trust role. A RATS syste= m without 1) is not very secure and not something we want to put in our arc= hitecture.

=C2=A0

2) requires the reference-value supplier role. Some = RATS systems will have 2) and some will not. You can have a RATS system wit= hout 2). Android Key Store and FIDO=E2=80=99s use of attestation are exampl= es.

=C2=A0

The verifier has to have a trust relationship with b= oth the manufacturer of the attester and the manufacture of the HLOS. Or pe= rhaps I should call these two the attestion asserter and the reference-valu= e asserter. (I prefer manufacturer because =E2=80=9Casserter=E2=80=9D is too close to =E2=80=9Cattester=E2=80= =9D, is fairly abstract and has some confusion around it for me).=

=C2=A0

LL

=C2=A0

=C2=A0



On Aug 23, 2019, at 12:53 PM, Smith, Ned <ned.smith@intel.com&g= t; wrote:

=C2=A0

[snip]

=C2=A0

I think the out-of-band trust role is much more impo= rtant than the reference-value-supplying role.

[nms] I may not understa= nd what you mean by these terms =E2=80=9Cout-of-band trust role=E2=80=9D an= d =E2=80=9Creference-value-supplying role=E2=80=9D. Generally, they appear = to fit in the =E2=80=9CAsserter role=E2=80=9D side of the diagram Henk disp= layed at 105 session #2.=C2=A0

=C2=A0

You can have real attestation without reference valu= es. For example, most claims can be implicit. The entity has secure boot an= d can be assumed to perform correctly. Maybe the only claim is location.=

[nms] I agree the Verifi= er role needs to somehow know which claims / assertions of trustworthiness = apply to the Attester and that not all claims must be conveyed as Evidence.= A definition of implicit attestation might suggest all assertions of trustworthiness could be conveyed via an o= ut-of-band channel (where out-of-band refers to a conveyance that isn=E2=80= =99t the one carrying Evidence). Recall, that the RATS WG deemed definition= of Asserter / Assertions out of scope for now. Of course the architecture can talk about them. Hence, it is in scope= to say that Evidence could be as simple as a Nonce claim and a Verifier co= uld conclude that the Nonce + OOB claims =3D effective claim set. More conc= retely, the Evidence claims set (E) + (union) the Assertions claims set (A) =3D effectiVe claims set (V).

I=E2=80=99m not sure if = you are also suggesting that implicit could mean something other than expli= citly described Assertions. For example, Asserter and Verifier could meet a= t a coffee shop and agree that whenever a certificate path resolves to the trust anchor for the Asserter that claims set (S) als= o can be inferred. Hence, V =3D (S + A + E). The charter limitation implies= we can define drafts that define E for the Attester and Verifier roles and= S and A for the Verifier role only and not how Verifier obtains (S, A).=C2=A0

=C2=A0

If you don=E2=80=99t have the [1] out-of-band trust,= the measurements are worthless, so the architecture is incomplete if it ju= st has a role that provides reference values.

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 [nms] Right. The = architecture should assume that role entities have valid credentials (e.g. = certificates + private key) and that the Verifier can resolve that it trust= s the role entities=E2=80=99 credentials (somehow). If =E2=80=98out-of-band=E2=80=99 [1] means Asserter(s) then their Assertio= ns (measurements) are expected to be their =E2=80=9Cprovable assertions=E2= =80=9D; where provable means signed by the Asserter=E2=80=99s credential ke= y.

[nms] We might want to q= ualify =E2=80=9CAssertions=E2=80=9D as =E2=80=9CProvable Assertions=E2=80= =9D in the architecture to make it clear that there is a way for the Verifi= er to accept them without blindly trusting an assertion given to it. This would also qualify it in terms of an ISO/IEC terminology that defines Asse= rtion as =E2=80=98a statement that is not necessarily provable=E2=80=99.=

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 [nms] We could= have a discussion about the=C2=A0veracity=C2=A0of Asserter(s)=E2=80=99 = credentials. But I think it ends up being a recursion of the RATS architecture. This isn=E2=80=99t an interesting rat = hole (pun intended), except for being convinced that the recursion terminat= es. For example, with some sort of trust anchor provisioning protocol or ma= nual process (see [snip]).

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0<= /u>

I hope we can get to a clear architecture with all o= f this laid out. I think it will help cut through a lot of confused convers= ations.

[nms] +1

=C2=A0

LL

=C2=A0

_______________________________________________
RATS mailing list
RATS@ietf.org
https://www.ietf.org/mailman/listinfo/rats
--000000000000a926ae05915c35ce-- From nobody Sat Aug 31 18:02:17 2019 Return-Path: X-Original-To: rats@ietfa.amsl.com Delivered-To: rats@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 37D0E120154 for ; Sat, 31 Aug 2019 18:02:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.898 X-Spam-Level: X-Spam-Status: No, score=-6.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qE0BOx5t7308 for ; Sat, 31 Aug 2019 18:02:09 -0700 (PDT) Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1E73312011F for ; Sat, 31 Aug 2019 18:02:09 -0700 (PDT) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga003.jf.intel.com ([10.7.209.27]) by fmsmga102.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 31 Aug 2019 18:02:08 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.64,453,1559545200"; d="scan'208,217";a="184168526" Received: from orsmsx107.amr.corp.intel.com ([10.22.240.5]) by orsmga003.jf.intel.com with ESMTP; 31 Aug 2019 18:02:08 -0700 Received: from orsmsx155.amr.corp.intel.com (10.22.240.21) by ORSMSX107.amr.corp.intel.com (10.22.240.5) with Microsoft SMTP Server (TLS) id 14.3.439.0; Sat, 31 Aug 2019 18:02:08 -0700 Received: from orsmsx109.amr.corp.intel.com ([169.254.11.172]) by ORSMSX155.amr.corp.intel.com ([169.254.7.26]) with mapi id 14.03.0439.000; Sat, 31 Aug 2019 18:02:07 -0700 From: "Smith, Ned" To: Ira McDonald , Giridhar Mandyam CC: Laurence Lundblade , "rats@ietf.org" Thread-Topic: [Rats] attester vs measurement target (was Re: Use the term "attester" instead of root of trust) Thread-Index: AQHVX208NneNHeJOyUWWeJZbtBcvJ6cUqEuAgAFamIA= Date: Sun, 1 Sep 2019 01:02:07 +0000 Message-ID: <7BE04939-B8F6-43BF-9F04-0B3D5DFB60EC@intel.com> References: <3F5C57F7-C75F-4C27-9898-25AF98237DE9@island-resort.com> <10825C3E-81E0-43A9-B529-28E7C501E098@intel.com> <910BEC2B-AA72-4106-9E5E-5DDEC6B9CFED@island-resort.com> <7F4FC12D-8F77-46BD-A025-C223F670826C@island-resort.com> <774847aefd954c00970af8fba8659d5a@NASANEXM01C.na.qualcomm.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.1c.0.190812 x-originating-ip: [10.254.37.186] Content-Type: multipart/alternative; boundary="_000_7BE04939B8F643BF9F040B3D5DFB60ECintelcom_" MIME-Version: 1.0 Archived-At: Subject: Re: [Rats] attester vs measurement target (was Re: Use the term "attester" instead of root of trust) X-BeenThere: rats@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Remote Attestation Procedures List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 01 Sep 2019 01:02:15 -0000 --_000_7BE04939B8F643BF9F040B3D5DFB60ECintelcom_ Content-Type: text/plain; charset="utf-7" Content-Transfer-Encoding: quoted-printable I recommend reading Practical Principles for Computer Security, Butler Lamp= son, Microsoft Research, January, 2007 +AFs-4+AF0- This is very relevant to attestation and introduces useful terminology, muc= h of which aligns with the goals of attestation architecture. It predates some of the references given below. At some point consistency is a hobgoblin. The most important objective of t= erminology for RATS WG (IMHO) is to be able to not talk past one another. A= fter that, we can agree on whatever industry term is most appropriate. Specific responses to Laurence+IBk-s remarks are inline below prefaced with= +AFs-nms+AF0-. -Ned +AFs-4+AF0- https://www.microsoft.com/en-us/research/publication/practical-= principles-for-computer-security/ On 8/30/19, 14:21 PM, +ACI-Ira McDonald+ACI- +ADw-blueroofmusic+AEA-gmail.c= om+ADw-mailto:blueroofmusic+AEA-gmail.com+AD4APg- wrote: Hi, +-1 to Girii's comments and suggestions. Reinventing terminology (the curse of the computer industry) leads to automatic cognitive disconnects and confusion and benefits no one. Cheers, - Ira Ira McDonald (Musician / Software Architect) Co-Chair - TCG Trusted Mobility Solutions WG Co-Chair - TCG Metadata Access Protocol SG Chair - Linux Foundation Open Printing WG Secretary - IEEE-ISTO Printer Working Group Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG IETF Designated Expert - IPP +ACY- Printer MIB Blue Roof Music / High North Inc http://sites.google.com/site/blueroofmusic http://sites.google.com/site/highnorthinc mailto: blueroofmusic+AEA-gmail.com+ADw-mailto:blueroofmusic+AEA-gmail.com+= AD4- PO Box 221 Grand Marais, MI 49839 906-494-2434 On Fri, Aug 30, 2019 at 3:58 PM Giridhar Mandyam +ADw-mandyam+AEA-qti.qualc= omm.com+ADw-mailto:mandyam+AEA-qti.qualcomm.com+AD4APg- wrote: I am not sure why we are trying to re-define terms that have already been d= efined in the literature. In my review on the -01 version of the architect= ure doc +AFs-1+AF0-, I cited a couple of papers where terminology had been = addressed +AFs-2+AF0--+AFs-3+AF0-. I wonder if the RATS architecture edito= rs did a complete literature review prior to the creation of this document,= and if so whether they can provide a justification as to why they rejected= previous approaches to defining attestation terminology and architecture. In particular, +AFs-2+AF0- has the following text: +IBw-Terminology. An appraiser is a party, generally a computer on a networ= k, making a decision about some other party or parties. A target is a party= about which an appraiser needs to make such a decision.+IB0- +IBw-Terminology. Attestation is the activity of making a claim to an appra= iser about the properties of a target by supplying evidence which supports = that claim. An attester is a party performing this activity. An appraiser's= decision-making process based on attested information is appraisal.+IB0- +IBw-Terminology. To measure a target means to collect evidence about it th= rough direct and local observation of it.+IB0- +AFs-1+AF0- https://mailarchive.ietf.org/arch/msg/rats/9iIrnD9YixKCuwOGKtvG= ZIzd+AF8-bU. +AFs-2+AF0- Coker, George et al. +ACI-Principles of Remote Attestation.+AC= I- International Journal on Information Security. Vol. 10. No .2. 2011.= pp. 63-81. Available at http://web.cs.wpi.edu/+AH4-guttman/pubs/remote+A= F8-attest.pdf. +AFs-3+AF0- J. Guttman et al. +ACIAIg-Attestation: Evidence and Trust+ACI= -. MITRE Technical Report MTR080072. March 2008. https://www.mitre.org/si= tes/default/files/pdf/07+AF8-0186.pdf. -Giri Mandyam From: RATS +ADw-rats-bounces+AEA-ietf.org+ADw-mailto:rats-bounces+AEA-ietf.= org+AD4APg- On Behalf Of Laurence Lundblade Sent: Friday, August 30, 2019 12:36 PM To: Smith, Ned +ADw-ned.smith+AEA-intel.com+ADw-mailto:ned.smith+AEA-intel.= com+AD4APg- Cc: rats+AEA-ietf.org+ADw-mailto:rats+AEA-ietf.org+AD4- Subject: +AFs-Rats+AF0- attester vs measurement target (was Re: Use the ter= m +ACI-attester+ACI- instead of root of trust) CAUTION: This email originated from outside of the organization. Changed the subject as I want to reorient the discussion a bit. Apologies i= f this is all obvious to you. When measurements are being performed there is the subsystem that is doing = the reporting / measuring and the subsystem that is being measured. +AFs-nm= s+AF0- +-1 I think the attester is the subsystem that is doing the reporting. It gener= ates and formats the claims, has the signing key and does the signing. +AFs= -nms+AF0- +-1 I am calling the subsystem that is being measured the measurement target. I= am proposing that the attester measures the measurement target in RATS arc= hitecture. +AFs-nms+AF0- The semantics of +IBg-attester measures the measurement targe= t+IBk- seems correct to me. Based on the definitions I+IBk-ve seen for +IBw= -entity+IB0- it seems correct to say a +IBg-measurement target+IBk- is an e= ntity. It seems correct to say the +IBg-attester is an entity+IBk- too. But= they are different entities. Since an entity can be lots of things and we = need to disambiguate what is relevant to attestation, the architecture intr= oduced the idea of role names. We chose +IBg-attester+IBk-, +IBg-verifier+I= Bk-, +IBg-relying party+IBk- and +IBg-asserter+IBk-. There are many possibl= e alternative synonymous or nearly synonymous choices to be found in an Eng= lish dictionary and in computer security literature. The role names are jus= t place holder names for now, IMO. If RATS WG prefers using different strin= gs then these then some alternatives can be proposed. I+IBk-m OK using thes= e for now as place holders that allow the group to discuss RATS roles seman= tics. Going back to measurement target, I don+IBk-t think +IBg-measurement target= +IBk- conceptually would be a RATS role since it is being acted upon rather= than doing something. Note: Butler Lampson+IBk-s paper +AFs-4+AF0- uses +IBg-Principal+IBk- to na= me entities that can +IBg-say+IBk- something (e.g. +IBw-X+IB0-) or can +IB= g-speak-for+IBk- another Principal. Using Lampson+IBk-s terminology, the se= mantic is +IBw-the Principal named +IBg-Attester+IBk- measures the Object n= amed +IBg-Measurement target+IBk-.+IB0- Since the goal of the architecture = is to provide a meta model for attestation behavior, it makes sense to use = place holder names +IBg-Attester+IBk- and +IBg-Measurement Target+IBk- rath= er than actual instance names. BTW: Lampson clarifies that Objects are also= Principals because of the identity property. This allows anything to say w= hat it is. I.e. X says X. Ultimately +IBg-measurement target+IBk- is just a= placeholder name for an Object that is +IBw-the target of a measurement op= eration+IB0-. Maybe the RATS WG is happier with a different string than +IB= w-measurement target+IB0-, but we should have some alternative suggestions = first (so long as they don+IBk-t change intended semantics). For the measurement to be of best value, there must be isolation between th= e attester and the measurement target. For example the attester doing the m= easurement should be a TEE, TPM or such. The measurement target is usually = the HLOS like Linux or Windows. +AFs-nms+AF0- +-1. I think it is obvious that the Attester, though isolated= from the Measurement Target (MT) is nevertheless able to observe it. The point of measurement is so that attacks against the measurement target = can be detected. If there is no isolation, the attacker that succeeds again= st the measurement target is likely to be go on to affect the attester and = then the evidence (e.g. measurement claims in an EAT token) can be manipula= ted. +AFs-nms+AF0- +-1 In some architectures the manufacturer of the attester will be different th= an the manufacturer of the measurement target. For example a TPM is made by= a TPM chip vendor. A TEE is made by a SoC vendor. These are different than= the HLOS vendor, the vendor of Windows, Linux or the router+IBk-s OS. +AFs-nms+AF0- +-1 The verifier role primarily needs two thing to successfully verify measurem= ent evidence. 1) They need the public key to verify the signature generated by the a= ttester and to know that the key is trusted and probably some implied claim= s. +AFs-nms+AF0- Verifier needs to trust Attester. The trust path can be model= ed using Lampson. See Figure 4 in +AFs-4+AF0- as it seems pretty close to d= escribing how this works for your example involving both keys and implied c= laims. 1. They need the reference values for what is being measured. For exampl= e, the expected values for Linux kernel 5.x on x86 or such. +AFs-nms+AF0- Verifier also needs to trust that +IBw-Asserters+IB0- who cla= im that their assertions are +IBg-golden+IBk- or +IBg-known good+IBk- or +I= Bg-reference+IBk- values. This is another conversation the Verifier has tha= t needs a trust path as exemplified in +AFs-4+AF0-, figurer 4. I think 1) and 2) are likely to come from different manufacturers and there= by might be depicted as separate roles in the architecture. +AFs-nms+AF0- I disagree that RATS roles need to change because the entitie= s performing the role differs. It is a case of multiple entities performing= the same function (that produces the same class of output). 1) requires the out-of-band trust role. A RATS system without 1) (abov= e?) is not very secure and not something we want to put in our architecture= . +AFs-nms+AF0- The idea that +IBg-an entity is more secure than X+IBk- is ac= tually a determination a Relying Party should make. Attestation should supp= ly it with information that allows the evaluation to take place. 1. requires the reference-value supplier role. Some RATS systems will ha= ve 2) (above?) and some will not. You can have a RATS system without 2). An= droid Key Store and FIDO+IBk-s use of attestation are examples. +AFs-nms+AF0- Currently, the RATS architecture is using +IBg-Asserter+IBk-.= Though in past revisions it was +IBg-Claimant+IBk-. Neither of these seem = perfect. Although, it seems the majority of cases where Assertions from Ass= erters will be supply chain entities, there are cases (e.g. virtualized env= ironments) where non-supply-chain entities take on the Asserter role. It wo= uld be great if RATS WG could find single word role names as this makes tal= king about them easier and reduces the need for acronyms. The verifier has to have a trust relationship with both the manufacturer of= the attester and the manufacture of the HLOS. +AFs-nms+AF0- I don+IBk-t recall what HLOS means (expands to). Or perhaps I should call these two the attestion asserter and the reference= -value asserter. (I prefer manufacturer because +IBw-asserter+IB0- is too c= lose to +IBw-attester+IB0-, is fairly abstract and has some confusion aroun= d it for me). +AFs-nms+AF0- Are you suggesting +IBg-Supplier+IBk-? Some have suggested +I= Bg-Endorser+IBk-. LL On Aug 23, 2019, at 12:53 PM, Smith, Ned +ADw-ned.smith+AEA-intel.com+ADw-m= ailto:ned.smith+AEA-intel.com+AD4APg- wrote: +AFs-snip+AF0- I think the out-of-band trust role is much more important than the referenc= e-value-supplying role. +AFs-nms+AF0- I may not understand what you mean by these terms +IBw-out-of= -band trust role+IB0- and +IBw-reference-value-supplying role+IB0-. General= ly, they appear to fit in the +IBw-Asserter role+IB0- side of the diagram H= enk displayed at 105 session +ACM-2. You can have real attestation without reference values. For example, most c= laims can be implicit. The entity has secure boot and can be assumed to per= form correctly. Maybe the only claim is location. +AFs-nms+AF0- I agree the Verifier role needs to somehow know which claims = / assertions of trustworthiness apply to the Attester and that not all clai= ms must be conveyed as Evidence. A definition of implicit attestation might= suggest all assertions of trustworthiness could be conveyed via an out-of-= band channel (where out-of-band refers to a conveyance that isn+IBk-t the o= ne carrying Evidence). Recall, that the RATS WG deemed definition of Assert= er / Assertions out of scope for now. Of course the architecture can talk a= bout them. Hence, it is in scope to say that Evidence could be as simple as= a Nonce claim and a Verifier could conclude that the Nonce +- OOB claims += AD0- effective claim set. More concretely, the Evidence claims set (E) +- (= union) the Assertions claims set (A) +AD0- effectiVe claims set (V). I+IBk-m not sure if you are also suggesting that implicit could mean someth= ing other than explicitly described Assertions. For example, Asserter and V= erifier could meet at a coffee shop and agree that whenever a certificate p= ath resolves to the trust anchor for the Asserter that claims set (S) also = can be inferred. Hence, V +AD0- (S +- A +- E). The charter limitation impli= es we can define drafts that define E for the Attester and Verifier roles a= nd S and A for the Verifier role only and not how Verifier obtains (S, A). If you don+IBk-t have the +AFs-1+AF0- out-of-band trust, the measurements a= re worthless, so the architecture is incomplete if it just has a role that = provides reference values. +AFs-nms+AF0- Right. The architecture shoul= d assume that role entities have valid credentials (e.g. certificates +- pr= ivate key) and that the Verifier can resolve that it trusts the role entiti= es+IBk- credentials (somehow). If +IBg-out-of-band+IBk- +AFs-1+AF0- means A= sserter(s) then their Assertions (measurements) are expected to be their +I= Bw-provable assertions+IB0AOw- where provable means signed by the Asserter+= IBk-s credential key. +AFs-nms+AF0- We might want to qualify +IBw-Assertions+IB0- as +IBw-Provabl= e Assertions+IB0- in the architecture to make it clear that there is a way = for the Verifier to accept them without blindly trusting an assertion given= to it. This would also qualify it in terms of an ISO/IEC terminology that = defines Assertion as +IBg-a statement that is not necessarily provable+IBk-= . +AFs-nms+AF0- We could have a discussion ab= out the veracity of Asserter(s)+IBk- credentials. But I think it ends up be= ing a recursion of the RATS architecture. This isn+IBk-t an interesting rat= hole (pun intended), except for being convinced that the recursion termina= tes. For example, with some sort of trust anchor provisioning protocol or m= anual process (see +AFs-snip+AF0-). I hope we can get to a clear architecture with all of this laid out. I thin= k it will help cut through a lot of confused conversations. +AFs-nms+AF0- +-1 LL +AF8AXwBfAF8AXwBfAF8AXwBfAF8AXwBfAF8AXwBfAF8AXwBfAF8AXwBfAF8AXwBfAF8AXwBfAF= 8AXwBfAF8AXwBfAF8AXwBfAF8AXwBfAF8AXwBfAF8AXwBfAF8AXw- RATS mailing list RATS+AEA-ietf.org+ADw-mailto:RATS+AEA-ietf.org+AD4- https://www.ietf.org/mailman/listinfo/rats --_000_7BE04939B8F643BF9F040B3D5DFB60ECintelcom_ Content-Type: text/html; charset="utf-7" Content-ID: <9C6112726857D44CA0498565E9BBF73B@intel.com> Content-Transfer-Encoding: quoted-printable +ADw-html+AD4- +ADw-head+AD4- +ADw-meta name+AD0AIg-Generator+ACI- content+AD0AIg-Microsoft Word 15 (filt= ered medium)+ACIAPg- +ADw-style+AD4APAAh--- /+ACo- Font Definitions +ACo-/ +AEA-font-face +AHs-font-family:+ACI-Cambria Math+ACIAOw- panose-1:2 4 5 3 5 4 6 3 2 4+ADsAfQ- +AEA-font-face +AHs-font-family:Calibri+ADs- panose-1:2 15 5 2 2 2 4 3 2 4+ADsAfQ- +AEA-font-face +AHs-font-family:Consolas+ADs- panose-1:2 11 6 9 2 2 4 3 2 4+ADsAfQ- /+ACo- Style Definitions +ACo-/ p.MsoNormal, li.MsoNormal, div.MsoNormal +AHs-margin:0in+ADs- margin-bottom:.0001pt+ADs- font-size:11.0pt+ADs- font-family:+ACI-Calibri+ACI-,sans-serif+ADsAfQ- a:link, span.MsoHyperlink +AHs-mso-style-priority:99+ADs- color:blue+ADs- text-decoration:underline+ADsAfQ- a:visited, span.MsoHyperlinkFollowed +AHs-mso-style-priority:99+ADs- color:purple+ADs- text-decoration:underline+ADsAfQ- pre +AHs-mso-style-priority:99+ADs- mso-style-link:+ACI-HTML Preformatted Char+ACIAOw- margin:0in+ADs- margin-bottom:.0001pt+ADs- font-size:10.0pt+ADs- font-family:+ACI-Courier New+ACIAOwB9- p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph +AHs-mso-style-priority:34+ADs- margin-top:0in+ADs- margin-right:0in+ADs- margin-bottom:0in+ADs- margin-left:.5in+ADs- margin-bottom:.0001pt+ADs- font-size:11.0pt+ADs- font-family:+ACI-Calibri+ACI-,sans-serif+ADsAfQ- p.msonormal0, li.msonormal0, div.msonormal0 +AHs-mso-style-name:msonormal+ADs- mso-margin-top-alt:auto+ADs- margin-right:0in+ADs- mso-margin-bottom-alt:auto+ADs- margin-left:0in+ADs- font-size:11.0pt+ADs- font-family:+ACI-Calibri+ACI-,sans-serif+ADsAfQ- span.HTMLPreformattedChar +AHs-mso-style-name:+ACI-HTML Preformatted Char+ACIAOw- mso-style-priority:99+ADs- mso-style-link:+ACI-HTML Preformatted+ACIAOw- font-family:Consolas+ADsAfQ- span.gmail-m-8360330693709964158apple-converted-space +AHs-mso-style-name:gmail-m+AF8--8360330693709964158apple-converted-space+= ADsAfQ- span.EmailStyle23 +AHs-mso-style-type:personal-reply+ADs- font-family:+ACI-Calibri+ACI-,sans-serif+ADs- color:windowtext+ADsAfQ- .MsoChpDefault +AHs-mso-style-type:export-only+ADs- font-size:10.0pt+ADsAfQ- +AEA-page WordSection1 +AHs-size:8.5in 11.0in+ADs- margin:1.0in 1.0in 1.0in 1.0in+ADsAfQ- div.WordSection1 +AHs-page:WordSection1+ADsAfQ- /+ACo- List Definitions +ACo-/ +AEA-list l0 +AHs-mso-list-id:75439949+ADs- mso-list-type:hybrid+ADs- mso-list-template-ids:-1725816128 67698705 67698713 67698715 67698703 6769= 8713 67698715 67698703 67698713 67698715+ADsAfQ- +AEA-list l0:level1 +AHs-mso-level-text:+ACIAJQ-1+AFw-)+ACIAOw- mso-level-tab-stop:none+ADs- mso-level-number-position:left+ADs- text-indent:-.25in+ADsAfQ- +AEA-list l0:level2 +AHs-mso-level-number-format:alpha-lower+ADs- mso-level-tab-stop:none+ADs- mso-level-number-position:left+ADs- text-indent:-.25in+ADsAfQ- +AEA-list l0:level3 +AHs-mso-level-number-format:roman-lower+ADs- mso-level-tab-stop:none+ADs- mso-level-number-position:right+ADs- text-indent:-9.0pt+ADsAfQ- +AEA-list l0:level4 +AHs-mso-level-tab-stop:none+ADs- mso-level-number-position:left+ADs- text-indent:-.25in+ADsAfQ- +AEA-list l0:level5 +AHs-mso-level-number-format:alpha-lower+ADs- mso-level-tab-stop:none+ADs- mso-level-number-position:left+ADs- text-indent:-.25in+ADsAfQ- +AEA-list l0:level6 +AHs-mso-level-number-format:roman-lower+ADs- mso-level-tab-stop:none+ADs- mso-level-number-position:right+ADs- text-indent:-9.0pt+ADsAfQ- +AEA-list l0:level7 +AHs-mso-level-tab-stop:none+ADs- mso-level-number-position:left+ADs- text-indent:-.25in+ADsAfQ- +AEA-list l0:level8 +AHs-mso-level-number-format:alpha-lower+ADs- mso-level-tab-stop:none+ADs- mso-level-number-position:left+ADs- text-indent:-.25in+ADsAfQ- +AEA-list l0:level9 +AHs-mso-level-number-format:roman-lower+ADs- mso-level-tab-stop:none+ADs- mso-level-number-position:right+ADs- text-indent:-9.0pt+ADsAfQ- +AEA-list l1 +AHs-mso-list-id:1190528005+ADs- mso-list-type:hybrid+ADs- mso-list-template-ids:-1501253376 67698705 67698713 67698715 67698703 6769= 8713 67698715 67698703 67698713 67698715+ADsAfQ- +AEA-list l1:level1 +AHs-mso-level-text:+ACIAJQ-1+AFw-)+ACIAOw- mso-level-tab-stop:none+ADs- mso-level-number-position:left+ADs- text-indent:-.25in+ADsAfQ- +AEA-list l1:level2 +AHs-mso-level-number-format:alpha-lower+ADs- mso-level-tab-stop:none+ADs- mso-level-number-position:left+ADs- text-indent:-.25in+ADsAfQ- +AEA-list l1:level3 +AHs-mso-level-number-format:roman-lower+ADs- mso-level-tab-stop:none+ADs- mso-level-number-position:right+ADs- text-indent:-9.0pt+ADsAfQ- +AEA-list l1:level4 +AHs-mso-level-tab-stop:none+ADs- mso-level-number-position:left+ADs- text-indent:-.25in+ADsAfQ- +AEA-list l1:level5 +AHs-mso-level-number-format:alpha-lower+ADs- mso-level-tab-stop:none+ADs- mso-level-number-position:left+ADs- text-indent:-.25in+ADsAfQ- +AEA-list l1:level6 +AHs-mso-level-number-format:roman-lower+ADs- mso-level-tab-stop:none+ADs- mso-level-number-position:right+ADs- text-indent:-9.0pt+ADsAfQ- +AEA-list l1:level7 +AHs-mso-level-tab-stop:none+ADs- mso-level-number-position:left+ADs- text-indent:-.25in+ADsAfQ- +AEA-list l1:level8 +AHs-mso-level-number-format:alpha-lower+ADs- mso-level-tab-stop:none+ADs- mso-level-number-position:left+ADs- text-indent:-.25in+ADsAfQ- +AEA-list l1:level9 +AHs-mso-level-number-format:roman-lower+ADs- mso-level-tab-stop:none+ADs- mso-level-number-position:right+ADs- text-indent:-9.0pt+ADsAfQ- ol +AHs-margin-bottom:0in+ADsAfQ- ul +AHs-margin-bottom:0in+ADsAfQ- --+AD4APA-/style+AD4- +ADw-/head+AD4- +ADw-body lang+AD0AIg-EN-US+ACI- link+AD0AIg-blue+ACI- vlink+AD0AIg-purple+= ACIAPg- +ADw-div class+AD0AIg-WordSection1+ACIAPg- +ADw-p class+AD0AIg-MsoNormal+ACIAPg-I recommend reading +ADw-u+AD4-Practic= al Principles for Computer Security+ADw-/u+AD4-, Butler Lampson, Microsoft = Research, January, 2007 +AFs-4+AF0APA-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-p class+AD0AIg-MsoNormal+ACIAPg-This is very relevant to attestation a= nd introduces useful terminology, much of which aligns with the goals of at= testation architecture. +ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-p class+AD0AIg-MsoNormal+ACIAPg-It predates some of the references giv= en below. +ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-p class+AD0AIg-MsoNormal+ACIAPg-At some point consistency is a hobgobl= in. The most important objective of terminology for RATS WG (IMHO) is to be= able to not talk past one another. After that, we can agree on whatever in= dustry term is most appropriate. +ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-p class+AD0AIg-MsoNormal+ACIAPgA8-o:p+AD4AJg-nbsp+ADsAPA-/o:p+AD4APA-/= p+AD4- +ADw-p class+AD0AIg-MsoNormal+ACIAPg-Specific responses to Laurence+IBk-s r= emarks are inline below prefaced with +AFs-nms+AF0-.+ADw-o:p+AD4APA-/o:p+AD= 4APA-/p+AD4- +ADw-p class+AD0AIg-MsoNormal+ACIAPgA8-span lang+AD0AIg-NO-BOK+ACIAPg--Ned+= ADw-o:p+AD4APA-/o:p+AD4APA-/span+AD4APA-/p+AD4- +ADw-p class+AD0AIg-MsoNormal+ACIAPgA8-span lang+AD0AIg-NO-BOK+ACIAPgBb-4+A= F0- +ADw-a href+AD0AIg-https://www.microsoft.com/en-us/research/publication= /practical-principles-for-computer-security/+ACIAPg- https://www.microsoft.com/en-us/research/publication/practical-principles-f= or-computer-security/+ADw-/a+AD4- +ADw-o:p+AD4APA-/o:p+AD4APA-/span+AD4APA-/p+AD4- +ADw-div+AD4- +ADw-div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-margin-left:.5in+ACIAPg-On = 8/30/19, 14:21 PM, +ACY-quot+ADs-Ira McDonald+ACY-quot+ADs- +ACY-lt+ADsAPA-= a href+AD0AIg-mailto:blueroofmusic+AEA-gmail.com+ACIAPg-blueroofmusic+AEA-g= mail.com+ADw-/a+AD4AJg-gt+ADs- wrote:+ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-/div+AD4- +ADw-div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-margin-left:.5in+ACIAPgA8-o= :p+AD4AJg-nbsp+ADsAPA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-div+AD4- +ADw-div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-margin-left:.5in+ACIAPg-Hi,= +ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-margin-left:.5in+ACIAPgA8-o= :p+AD4AJg-nbsp+ADsAPA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-margin-left:.5in+ACIAPgAmAC= M-43+ADs-1 to Girii's comments and suggestions.+ACY-nbsp+ADs- Reinventing t= erminology+ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-margin-left:.5in+ACIAPg-(th= e curse of the computer industry) leads to automatic cognitive+ADw-o:p+AD4A= PA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-margin-left:.5in+ACIAPg-dis= connects and confusion and benefits no one.+ADw-o:p+AD4APA-/o:p+AD4APA-/p+A= D4- +ADw-/div+AD4- +ADw-div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-margin-left:.5in+ACIAPgA8-o= :p+AD4AJg-nbsp+ADsAPA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-margin-left:.5in+ACIAPg-Che= ers,+ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-margin-left:.5in+ACIAPg-- I= ra+ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-margin-left:.5in+ACIAPgA8-o= :p+AD4AJg-nbsp+ADsAPA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-div+AD4- +ADw-div+AD4- +ADw-div+AD4- +ADw-div+AD4- +ADw-div+AD4- +ADw-div+AD4- +ADw-div+AD4- +ADw-div+AD4- +ADw-div+AD4- +ADw-div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-margin-left:.5in+ACIAPg-Ira= McDonald (Musician / Software Architect)+ADw-br+AD4- Co-Chair - TCG Trusted Mobility Solutions WG+ADw-o:p+AD4APA-/o:p+AD4APA-/p+= AD4- +ADw-/div+AD4- +ADw-div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-margin-left:.5in+ACIAPg-Co-= Chair - TCG Metadata Access Protocol SG+ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:0in+ADs-= margin-right:0in+ADs-margin-bottom:12.0pt+ADs-margin-left:.5in+ACIAPg- Chair - Linux Foundation Open Printing WG+ADw-br+AD4- Secretary - IEEE-ISTO Printer Working Group+ADw-br+AD4- Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG+ADw-br+AD4- IETF Designated Expert - IPP +ACY-amp+ADs- Printer MIB+ADw-br+AD4- Blue Roof Music / High North Inc+ADw-br+AD4- +ADw-a href+AD0AIg-http://sites.google.com/site/blueroofmusic+ACI- target+A= D0AIgBf-blank+ACIAPgA8-span style+AD0AIg-color:+ACM-3333FF+ACIAPg-http://si= tes.google.com/site/blueroofmusic+ADw-/span+AD4APA-/a+AD4APA-br+AD4- +ADw-a href+AD0AIg-http://sites.google.com/site/highnorthinc+ACI- target+AD= 0AIgBf-blank+ACIAPgA8-span style+AD0AIg-color:+ACM-6600CC+ACIAPg-http://sit= es.google.com/site/highnorthinc+ADw-/span+AD4APA-/a+AD4APA-br+AD4- mailto: +ADw-a href+AD0AIg-mailto:blueroofmusic+AEA-gmail.com+ACI- target+A= D0AIgBf-blank+ACIAPg-blueroofmusic+AEA-gmail.com+ADw-/a+AD4APA-br+AD4- PO Box 221+ACY-nbsp+ADs- Grand Marais, MI 49839+ACY-nbsp+ADs- 906-494-2434+= ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-/div+AD4- +ADw-/div+AD4- +ADw-/div+AD4- +ADw-/div+AD4- +ADw-/div+AD4- +ADw-/div+AD4- +ADw-/div+AD4- +ADw-/div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-margin-left:.5in+ACIAPgA8-o= :p+AD4AJg-nbsp+ADsAPA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-/div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-margin-left:.5in+ACIAPgA8-o= :p+AD4AJg-nbsp+ADsAPA-/o:p+AD4APA-/p+AD4- +ADw-div+AD4- +ADw-div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-margin-left:.5in+ACIAPg-On = Fri, Aug 30, 2019 at 3:58 PM Giridhar Mandyam +ACY-lt+ADsAPA-a href+AD0AIg-= mailto:mandyam+AEA-qti.qualcomm.com+ACIAPg-mandyam+AEA-qti.qualcomm.com+ADw= -/a+AD4AJg-gt+ADs- wrote:+ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-blockquote style+AD0AIg-border:none+ADs-border-left:solid +ACM-CCCCCC = 1.0pt+ADs-padding:0in 0in 0in 6.0pt+ADs-margin-left:4.8pt+ADs-margin-right:= 0in+ACIAPg- +ADw-div+AD4- +ADw-div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ADs-margin-left:47.55pt+ACIAPg- I am not sure why we are trying to re-define terms that have already been d= efined in the literature.+ACY-nbsp+ADs- In my review on the -01 version of = the architecture doc +AFs-1+AF0-, I cited a couple of papers where terminol= ogy had been addressed +AFs-2+AF0--+AFs-3+AF0-.+ACY-nbsp+ADs- I wonder if t= he RATS architecture editors did a complete literature review prior to the creatio= n of this document, and if so whether they can provide a justification as t= o why they rejected previous approaches to defining attestation terminology= and architecture.+ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ADs-margin-left:47.55pt+ACIAPg- In particular, +AFs-2+AF0- has the following text:+ADw-o:p+AD4APA-/o:p+AD4A= PA-/p+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ADs-margin-left:47.55pt+ACIAPg- +IBwAPA-b+AD4-Terminology+ADw-/b+AD4-. +ADw-i+AD4-An +ADw-b+AD4-appraiser+A= Dw-/b+AD4- is a party, generally a computer on a network, making a decision= about some other party or parties. A +ADw-b+AD4-target+ADw-/b+AD4- is a party about which an appraiser needs to = make such a decision+ADw-/i+AD4-.+IB0APA-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ADs-margin-left:47.55pt+ACIAPg- +IBwAPA-b+AD4-Terminology+ADw-/b+AD4-. +ADw-b+AD4APA-i+AD4-Attestation+ADw-= /i+AD4APA-/b+AD4APA-i+AD4- is the activity of making a claim to an appraise= r about the properties of a target by supplying evidence which supports tha= t claim. An +ADw-b+AD4-attester+ADw-/b+AD4- is a party performing this activity. An app= raiser's decision-making process based on attested information is +ADw-b+AD4-appraisal+ADw-/b+AD4APA-/i+AD4-.+IB0APA-o:p+AD4APA-/o:p+AD4APA-/= p+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ADs-margin-left:47.55pt+ACIAPg- +IBwAPA-b+AD4-Terminology+ADw-/b+AD4-. +ADw-i+AD4-To +ADw-b+AD4-measure+ADw= -/b+AD4- a target means to collect evidence about it through direct and loc= al observation of it+ADw-/i+AD4-.+IB0APA-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ADs-margin-left:.5in+ACIAPg- +AFs-1+AF0- +ADw-a href+AD0AIg-https://mailarchive.ietf.org/arch/msg/rats/9= iIrnD9YixKCuwOGKtvGZIzd+AF8-bU+ACI- target+AD0AIgBf-blank+ACIAPg- https://mailarchive.ietf.org/arch/msg/rats/9iIrnD9YixKCuwOGKtvGZIzd+AF8-bU+= ADw-/a+AD4-.+ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-pre style+AD0AIg-margin-left:.5in+ADs-background:white+ADs-background-= attachment:scroll+ADs-background-position-x:0+ACUAOw-background-position-y:= 0+ACUAIgA+ADw-span style+AD0AIg-font-size:11.0pt+ADs-font-family:+ACY-quot+= ADs-Calibri+ACY-quot+ADs-,sans-serif+ADs-color:black+ACIAPgBb-2+AF0- Coker,= George et al.+ACY-nbsp+ADs- +ACY-quot+ADs-Principles of Remote Attestation= .+ACY-quot+ADsAJg-nbsp+ADs- International Journal on Information Security.+= ACY-nbsp+ADs- Vol. 10.+ACY-nbsp+ADs- No .2.+ACY-nbsp+ADs- 2011.+ACY-nbsp+AD= s- pp. 63-81.+ACY-nbsp+ADs- Available at +ADw-a href+AD0AIg-http://web.cs.w= pi.edu/+AH4-guttman/pubs/remote+AF8-attest.pdf+ACI- target+AD0AIgBf-blank+A= CIAPg-http://web.cs.wpi.edu/+AH4-guttman/pubs/remote+AF8-attest.pdf+ADw-/a+= AD4-. +ADw-/span+AD4APA-o:p+AD4APA-/o:p+AD4APA-/pre+AD4- +ADw-pre style+AD0AIg-margin-left:.5in+ADs-background:white+ADs-background-= attachment:scroll+ADs-background-position-x:0+ACUAOw-background-position-y:= 0+ACUAIgA+ADw-span style+AD0AIg-font-family:+ACY-quot+ADs-Calibri+ACY-quot+= ADs-,sans-serif+ADs-color:black+ACIAPgBb-3+AF0- +ADw-/span+AD4APA-span styl= e+AD0AIg-font-size:11.0pt+ADs-font-family:+ACY-quot+ADs-Calibri+ACY-quot+AD= s-,sans-serif+ADs-color:+ACM-212529+ACIAPg-J. Guttman et al.+ACY-nbsp+ADs- = +ACY-quot+ADsAJg-quot+ADs-Attestation:+ACY-nbsp+ADs- Evidence and Trust+ACY= -quot+ADs-.+ACY-nbsp+ADs- MITRE Technical Report MTR080072.+ACY-nbsp+ADs- M= arch 2008. +ADw-a href+AD0AIg-https://www.mitre.org/sites/default/files/pdf= /07+AF8-0186.pdf+ACI- target+AD0AIgBf-blank+ACIAPg-https://www.mitre.org/si= tes/default/files/pdf/07+AF8-0186.pdf+ADw-/a+AD4-. +ACY-nbsp+ADsAPA-/span+A= D4APA-span style+AD0AIg-font-size:9.0pt+ADs-font-family:Consolas+ADs-color:= +ACM-212529+ACIAPgAm-nbsp+ADsAPA-/span+AD4APA-o:p+AD4APA-/o:p+AD4APA-/pre+A= D4- +ADw-pre style+AD0AIg-margin-left:.5in+ADs-background:white+ADs-background-= attachment:scroll+ADs-background-position-x:0+ACUAOw-background-position-y:= 0+ACUAIgA+ADw-span style+AD0AIg-font-size:11.0pt+ADs-font-family:+ACY-quot+= ADs-Calibri+ACY-quot+ADs-,sans-serif+ADs-color:+ACM-2F5597+ACIAPgAm-nbsp+AD= sAPA-/span+AD4APA-o:p+AD4APA-/o:p+AD4APA-/pre+AD4- +ADw-pre style+AD0AIg-margin-left:47.55pt+ADs-background:white+ADs-backgrou= nd-attachment:scroll+ADs-background-position-x:0+ACUAOw-background-position= -y:0+ACUAIgA+ADw-span style+AD0AIg-font-size:11.0pt+ADs-font-family:+ACY-qu= ot+ADs-Calibri+ACY-quot+ADs-,sans-serif+ADs-color:+ACM-2F5597+ACIAPg--Giri = Mandyam+ADw-/span+AD4APA-o:p+AD4APA-/o:p+AD4APA-/pre+AD4- +ADw-div+AD4- +ADw-div style+AD0AIg-border:none+ADs-border-top:solid windowtext 1.0pt+ADs= -padding:3.0pt 0in 0in 0in+ADs-border-color:currentcolor currentcolor+ACIAP= g- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ADs-margin-left:47.55pt+ACIAPg- +ADw-b+AD4-From:+ADw-/b+AD4- RATS +ACY-lt+ADsAPA-a href+AD0AIg-mailto:rats-= bounces+AEA-ietf.org+ACI- target+AD0AIgBf-blank+ACIAPg-rats-bounces+AEA-iet= f.org+ADw-/a+AD4AJg-gt+ADs- +ADw-b+AD4-On Behalf Of +ADw-/b+AD4-Laurence Lundblade+ADw-br+AD4- +ADw-b+AD4-Sent:+ADw-/b+AD4- Friday, August 30, 2019 12:36 PM+ADw-br+AD4- +ADw-b+AD4-To:+ADw-/b+AD4- Smith, Ned +ACY-lt+ADsAPA-a href+AD0AIg-mailto:n= ed.smith+AEA-intel.com+ACI- target+AD0AIgBf-blank+ACIAPg-ned.smith+AEA-inte= l.com+ADw-/a+AD4AJg-gt+ADsAPA-br+AD4- +ADw-b+AD4-Cc:+ADw-/b+AD4- +ADw-a href+AD0AIg-mailto:rats+AEA-ietf.org+ACI-= target+AD0AIgBf-blank+ACIAPg-rats+AEA-ietf.org+ADw-/a+AD4APA-br+AD4- +ADw-b+AD4-Subject:+ADw-/b+AD4- +AFs-Rats+AF0- attester vs measurement targ= et (was Re: Use the term +ACY-quot+ADs-attester+ACY-quot+ADs- instead of ro= ot of trust)+ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-/div+AD4- +ADw-p style+AD0AIg-margin-left:.5in+ACIAPgA8-strong+AD4APA-span style+AD0A= Ig-font-size:8.5pt+ADs-font-family:+ACY-quot+ADs-Arial+ACY-quot+ADs-,sans-s= erif+ADs-color:black+ADs-background:+ACM-FFEB9C+ACIAPg-CAUTION+ADw-/span+AD= 4APA-/strong+AD4APA-span style+AD0AIg-font-size:8.5pt+ADs-font-family:+ACY-= quot+ADs-Arial+ACY-quot+ADs-,sans-serif+ADs-color:black+ADs-background:+ACM= -FFEB9C+ACIAPg-: This email originated from outside of the organization.+ADw-/span+AD4APA-o:p+AD4APA-/o:p+AD4APA-= /p+AD4- +ADw-div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ACIAPg-Changed the subject as I want to reorien= t the discussion a bit. Apologies if this is all obvious to you.+ACY-nbsp+A= DsAPA-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ACIAPg-When measurements are being performed th= ere is the subsystem that is doing the reporting / measuring and the subsys= tem that is being measured.+ACY-nbsp+ADsAWw-nms+AF0- +ACYAIw-43+ADs-1+ADw-o= :p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ACIAPg-I think the attester+ACY-nbsp+ADs-is the= subsystem that is doing the reporting. It generates and formats the claims= , has the signing key and does the signing. +AFs-nms+AF0- +ACYAIw-43+ADs-1+= ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ACIAPg-I am calling the subsystem that is being= measured the measurement target. I am proposing that the attester measures= +ACY-nbsp+ADs-the measurement target in RATS architecture. +ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ACIAPgBb-nms+AF0- The semantics of +IBg-atteste= r measures the measurement target+IBk- seems correct to me. Based on the de= finitions I+IBk-ve seen for +IBw-entity+IB0- it seems correct to say a +IBg= -measurement target+IBk- is an entity. It seems correct to say the +IBg-attester is an entity+IBk- = too. But they are different entities. Since an entity can be lots of things= and we need to disambiguate what is relevant to attestation, the architect= ure introduced the idea of role names. We chose +IBg-attester+IBk-, +IBg-verifier+IBk-, +IBg-relying party+IBk- and = +IBg-asserter+IBk-. There are many possible alternative synonymous or nearl= y synonymous choices to be found in an English dictionary and in computer s= ecurity literature. The role names are just place holder names for now, IMO. If RATS WG prefers using different strings then these then some = alternatives can be proposed. I+IBk-m OK using these for now as place holde= rs that allow the group to discuss RATS roles semantics.+ADw-o:p+AD4APA-/o:= p+AD4APA-/p+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ACIAPg-Going back to measurement target, I don+= IBk-t think +IBg-measurement target+IBk- conceptually would be a RATS role = since it is being acted upon rather than doing something. +ACY-nbsp+ADsAPA-= o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ACIAPg-Note: Butler Lampson+IBk-s paper +AFs-4+= AF0- uses +IBg-Principal+IBk- to name entities that can +IBg-say+IBk- somet= hing +ACY-nbsp+ADs-(e.g. +IBw-X+IB0-) or can +IBg-speak-for+IBk- another Pr= incipal. Using Lampson+IBk-s terminology, the semantic is +IBw-the Principal named +IBg-Attester+IBk- measures the Object named += IBg-Measurement target+IBk-.+IB0- Since the goal of the architecture is to = provide a meta model for attestation behavior, it makes sense to use place = holder names +IBg-Attester+IBk- and +IBg-Measurement Target+IBk- rather than actual instance names. BTW: Lampson clarifies that Objects are also P= rincipals because of the identity property. This allows anything to say wha= t it is. I.e. X says X. Ultimately +IBg-measurement target+IBk- is just a p= laceholder name for an Object that is +IBw-the target of a measurement operation+IB0-. Maybe the RATS WG is happier with = a different string than +IBw-measurement target+IB0-, but we should have so= me alternative suggestions first (so long as they don+IBk-t change intended= semantics).+ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ACIAPg-For the measurement to be of best value,= there must be isolation between the attester and the measurement target. F= or example the attester doing the measurement should be a TEE, TPM or such. The measurement target is usually the HLOS like Linux or Wind= ows.+ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ACIAPgBb-nms+AF0- +ACYAIw-43+ADs-1. I think it = is obvious that the Attester, though isolated from the Measurement Target (= MT) is nevertheless able to observe it. +ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ACIAPg-The point of measurement is so that atta= cks against the measurement target can be detected. If there is no isolatio= n, the attacker that succeeds against the measurement target is likely to be go on to affect the attester and then the evidence (e.g. meas= urement claims in an EAT token) can be manipulated.+ADw-o:p+AD4APA-/o:p+AD4= APA-/p+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ACIAPgBb-nms+AF0- +ACYAIw-43+ADs-1+ADw-o:p+AD4A= PA-/o:p+AD4APA-/p+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ACIAPg-In some architectures the manufacturer o= f the attester will be different than the manufacturer of the measurement t= arget. For example a TPM is made by a TPM chip vendor. A TEE is made by a SoC vendor. These are different than the HLOS vendor, the vendor= of Windows, Linux or the router+IBk-s OS.+ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD= 4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ACIAPgBb-nms+AF0- +ACYAIw-43+ADs-1+ADw-o:p+AD4A= PA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ACIAPg-The verifier role primarily needs two th= ing to successfully verify measurement evidence.+ACY-nbsp+ADsAPA-o:p+AD4APA= -/o:p+AD4APA-/p+AD4- +ADw-p class+AD0AIg-MsoListParagraph+ACI- style+AD0AIg-mso-margin-top-alt:a= uto+ADs-mso-margin-bottom-alt:auto+ADs-margin-left:47.55pt+ADs-text-indent:= -.25in+ADs-mso-list:l0 level1 lfo1+ACIAPg- +ADwAIQBb-if +ACE-supportLists+AF0APgA8-span style+AD0AIg-mso-list:Ignore+A= CIAPg-1)+ADw-span style+AD0AIg-font:7.0pt +ACY-quot+ADs-Times New Roman+ACY= -quot+ADsAIgA+ACY-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADs- +ADw-/span+AD4APA-/span+AD4APAAhAFs-endif+AF0APg-They need the public key t= o verify the signature generated by the attester and to know that the key i= s trusted and probably some implied claims.+ADw-o:p+AD4APA-/o:p+AD4APA-/p+A= D4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ACIAPgBb-nms+AF0- Verifier needs to trust Attes= ter. The trust path can be modeled using Lampson. See Figure 4 in +AFs-4+AF= 0- as it seems pretty close to describing how this works for your example i= nvolving both keys and implied claims. +ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-ol start+AD0AIg-2+ACI- type+AD0AIg-1+ACIAPg- +ADw-li class+AD0AIg-MsoListParagraph+ACI- style+AD0AIg-mso-margin-top-alt:= auto+ADs-mso-margin-bottom-alt:auto+ADs-margin-left:0in+ADs-mso-list:l0 lev= el1 lfo1+ACIAPg- They need the reference values for what is being measured. For example, the= expected values for Linux kernel 5.x on x86 or such.+ADw-o:p+AD4APA-/o:p+A= D4APA-/li+AD4APA-/ol+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ADs-margin-left:4.8pt+ACIAPg- +AFs-nms+AF0- Verifier also needs to trust that +IBw-Asserters+IB0- who cla= im that their assertions are +IBg-golden+IBk- or +IBg-known good+IBk- or +I= Bg-reference+IBk- values. This is another conversation the Verifier has tha= t needs a trust path as exemplified in +AFs-4+AF0-, figurer 4.+ADw-o:p+AD4A= PA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ACIAPg-I think 1) and 2) are likely to come fro= m different manufacturers and thereby might be depicted as separate roles i= n the architecture.+ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ACIAPgBb-nms+AF0- I disagree that RATS roles ne= ed to change because the entities performing the role differs. It is a case= of multiple entities performing the same function (that produces the same class of output). +ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-div+AD4- +ADw-p class+AD0AIg-MsoListParagraph+ACI- style+AD0AIg-mso-margin-top-alt:a= uto+ADs-mso-margin-bottom-alt:auto+ADs-margin-left:47.55pt+ADs-text-indent:= -.25in+ADs-mso-list:l1 level1 lfo2+ACIAPg- +ADwAIQBb-if +ACE-supportLists+AF0APgA8-span style+AD0AIg-mso-list:Ignore+A= CIAPg-1)+ADw-span style+AD0AIg-font:7.0pt +ACY-quot+ADs-Times New Roman+ACY= -quot+ADsAIgA+ACY-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADs- +ADw-/span+AD4APA-/span+AD4APAAhAFs-endif+AF0APg-requires the out-of-band t= rust role. A RATS system without 1) (above?) is not very secure and not som= ething we want to put in our architecture.+ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD= 4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ACIAPgBb-nms+AF0- The idea that +IBg-an entity = is more secure than X+IBk- is actually a determination a Relying Party shou= ld make. Attestation should supply it with information that allows the eval= uation to take place.+ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-div+AD4- +ADw-ol start+AD0AIg-2+ACI- type+AD0AIg-1+ACIAPg- +ADw-li class+AD0AIg-MsoListParagraph+ACI- style+AD0AIg-mso-margin-top-alt:= auto+ADs-mso-margin-bottom-alt:auto+ADs-margin-left:0in+ADs-mso-list:l1 lev= el1 lfo2+ACIAPg- requires the reference-value supplier role. Some RATS systems will have 2) = (above?) and some will not. You can have a RATS system without 2). Android = Key Store and FIDO+IBk-s use of attestation are examples.+ADw-o:p+AD4APA-/o= :p+AD4APA-/li+AD4APA-/ol+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ACIAPgBb-nms+AF0- Currently, the RATS architect= ure is using +IBg-Asserter+IBk-. Though in past revisions it was +IBg-Claim= ant+IBk-. Neither of these seem perfect. Although, it seems the majority of= cases where Assertions from Asserters will be supply chain entities, there are cases (= e.g. virtualized environments) where non-supply-chain entities take on the = Asserter role. It would be great if RATS WG could find single word role nam= es as this makes talking about them easier and reduces the need for acronyms.+ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD= 4- +ADw-/div+AD4- +ADw-div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ACIAPg-The verifier has to have a trust relatio= nship with both the manufacturer of the attester and the manufacture of the= HLOS. +ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ACIAPgBb-nms+AF0- I don+IBk-t recall what HLOS = means (expands to).+ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ACIAPg-Or perhaps I should call these two the a= ttestion asserter and the reference-value asserter. (I prefer manufacturer = because +IBw-asserter+IB0- is too close to +IBw-attester+IB0-, is fairly ab= stract and has some confusion around it for me).+ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD= 4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ACIAPgBb-nms+AF0- Are you suggesting +IBg-Suppl= ier+IBk-? Some have suggested +IBg-Endorser+IBk-. +ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ADs-margin-left:.5in+ACIAPg- LL+ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ADs-margin-left:.5in+ACIAPg- +ACY-nbsp+ADsAPA-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ADs-margin-left:.5in+ACIAPg- +ACY-nbsp+ADsAPA-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -margin-bottom:12.0pt+ADs-margin-left:.5in+ACIAPg- +ADw-o:p+AD4AJg-nbsp+ADsAPA-/o:p+AD4APA-/p+AD4- +ADw-blockquote style+AD0AIg-margin-top:5.0pt+ADs-margin-bottom:5.0pt+ACIAP= g- +ADw-div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ADs-margin-left:.5in+ACIAPg- On Aug 23, 2019, at 12:53 PM, Smith, Ned +ACY-lt+ADsAPA-a href+AD0AIg-mailt= o:ned.smith+AEA-intel.com+ACI- target+AD0AIgBf-blank+ACIAPg-ned.smith+AEA-i= ntel.com+ADw-/a+AD4AJg-gt+ADs- wrote:+ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ADs-margin-left:.5in+ACIAPg- +ACY-nbsp+ADsAPA-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-div+AD4- +ADw-div style+AD0AIg-margin-left:.5in+ACIAPg- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ADs-margin-left:.5in+ACIAPg- +AFs-snip+AF0APA-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-div+AD4- +ADw-div style+AD0AIg-margin-left:.5in+ACIAPg- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ADs-margin-left:.5in+ACIAPg- +ACY-nbsp+ADsAPA-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-/div+AD4- +ADw-div+AD4- +ADw-div style+AD0AIg-margin-left:.5in+ACIAPg- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ADs-margin-left:.5in+ACIAPg- I think the out-of-band trust role is much more important than the referenc= e-value-supplying role.+ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-div style+AD0AIg-margin-left:.5in+ACIAPg- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ADs-margin-left:.5in+ADs-text-indent:.5in+ACIAP= g- +AFs-nms+AF0- I may not understand what you mean by these terms +IBw-out-of= -band trust role+IB0- and +IBw-reference-value-supplying role+IB0-. General= ly, they appear to fit in the +IBw-Asserter role+IB0- side of the diagram H= enk displayed at 105 session +ACM-2.+ADw-span class+AD0AIg-gmail-m-83603306= 93709964158apple-converted-space+ACIAPgAm-nbsp+ADsAPA-/span+AD4APA-o:p+AD4A= PA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-div style+AD0AIg-margin-left:.5in+ACIAPg- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ADs-margin-left:.5in+ADs-text-indent:.5in+ACIAP= g- +ACY-nbsp+ADsAPA-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-div style+AD0AIg-margin-left:.5in+ACIAPg- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ADs-margin-left:.5in+ACIAPg- You can have real attestation without reference values. For example, most c= laims can be implicit. The entity has secure boot and can be assumed to per= form correctly. Maybe the only claim is location.+ADw-o:p+AD4APA-/o:p+AD4AP= A-/p+AD4- +ADw-/div+AD4- +ADw-div style+AD0AIg-margin-left:.5in+ACIAPg- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ADs-margin-left:.5in+ADs-text-indent:.5in+ACIAP= g- +AFs-nms+AF0- I agree the Verifier role needs to somehow know which claims = / assertions of trustworthiness apply to the Attester and that not all clai= ms must be conveyed as Evidence. A definition of implicit attestation might= suggest all assertions of trustworthiness could be conveyed via an out-of-band channel (where out-of-band refers to = a conveyance that isn+IBk-t the one carrying Evidence). Recall, that the RA= TS WG deemed definition of Asserter / Assertions out of scope for now. Of c= ourse the architecture can talk about them. Hence, it is in scope to say that Evidence could be as simple as a N= once claim and a Verifier could conclude that the Nonce +ACYAIw-43+ADs- OOB= claims +AD0- effective claim set. More concretely, the Evidence claims set= (E) +ACYAIw-43+ADs- (union) the Assertions claims set (A) +AD0- effectiVe claims set (V).+ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-div style+AD0AIg-margin-left:.5in+ACIAPg- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ADs-margin-left:.5in+ADs-text-indent:.5in+ACIAP= g- I+IBk-m not sure if you are also suggesting that implicit could mean someth= ing other than explicitly described Assertions. For example, Asserter and V= erifier could meet at a coffee shop and agree that whenever a certificate p= ath resolves to the trust anchor for the Asserter that claims set (S) also can be inferred. Hence, V +AD0- (S += ACYAIw-43+ADs- A +ACYAIw-43+ADs- E). The charter limitation implies we can = define drafts that define E for the Attester and Verifier roles and S and A= for the Verifier role only and not how Verifier obtains (S, A).+ADw-span c= lass+AD0AIg-gmail-m-8360330693709964158apple-converted-space+ACIAPgAm-nbsp+= ADsAPA-/span+AD4APA-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-/div+AD4- +ADw-div+AD4- +ADw-div style+AD0AIg-margin-left:.5in+ACIAPg- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ADs-margin-left:.5in+ACIAPg- +ACY-nbsp+ADsAPA-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-/div+AD4- +ADw-div+AD4- +ADw-div style+AD0AIg-margin-left:.5in+ACIAPg- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ADs-margin-left:.5in+ACIAPg- If you don+IBk-t have the +AFs-1+AF0- out-of-band trust, the measurements a= re worthless, so the architecture is incomplete if it just has a role that = provides reference values.+ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ADs-margin-left:.5in+ACIAPg- +ACY-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJ= g-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-n= bsp+ADsAJg-nbsp+ADsAJg-nbsp+ADs- +ACY-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-n= bsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp= +ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADs- +AFs-nms+= AF0- Right. The architecture should assume that role entities have valid cr= edentials (e.g. certificates +ACYAIw-43+ADs- private key) and that the Veri= fier can resolve that it trusts the role entities+IBk- credentials (somehow= ). If +IBg-out-of-band+IBk- +AFs-1+AF0- means Asserter(s) then their Assertions (measurements) are exp= ected to be their +IBw-provable assertions+IB0AOw- where provable means sig= ned by the Asserter+IBk-s credential key.+ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4= - +ADw-/div+AD4- +ADw-div style+AD0AIg-margin-left:.5in+ACIAPg- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ADs-margin-left:.5in+ADs-text-indent:.5in+ACIAP= g- +AFs-nms+AF0- We might want to qualify +IBw-Assertions+IB0- as +IBw-Provabl= e Assertions+IB0- in the architecture to make it clear that there is a way = for the Verifier to accept them without blindly trusting an assertion given= to it. This would also qualify it in terms of an ISO/IEC terminology that defines Assertion as +IBg-a statement that is not necessa= rily provable+IBk-.+ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ADs-margin-left:.5in+ACIAPg- +ACY-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJ= g-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-n= bsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp= +ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+AD= sAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADs- = +AFs-nms+AF0- We could have a discussion about the+ADw-span class+AD0AIg-gm= ail-m-8360330693709964158apple-converted-space+ACIAPgAm-nbsp+ADsAPA-/span+A= D4APA-i+AD4-veracity+ADw-/i+AD4APA-span class+AD0AIg-gmail-m-83603306937099= 64158apple-converted-space+ACIAPgAm-nbsp+ADsAPA-/span+AD4-of Asserter(s)+IB= k- credentials. But I think it ends up being a recursion of the RATS architecture. This is= n+IBk-t an interesting rat hole (pun intended), except for being convinced = that the recursion terminates. For example, with some sort of trust anchor = provisioning protocol or manual process (see +AFs-snip+AF0-).+ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ADs-margin-left:.5in+ACIAPg- +ACY-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJ= g-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-n= bsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp= +ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+AD= sAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAJg-nbsp+ADsAP= A-span class+AD0AIg-gmail-m-8360330693709964158apple-converted-space+ACIAPg= Am-nbsp+ADsAPA-/span+AD4APA-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-/div+AD4- +ADw-div+AD4- +ADw-div style+AD0AIg-margin-left:.5in+ACIAPg- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ADs-margin-left:.5in+ACIAPg- I hope we can get to a clear architecture with all of this laid out. I thin= k it will help cut through a lot of confused conversations.+ADw-o:p+AD4APA-= /o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-div style+AD0AIg-margin-left:.5in+ACIAPg- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ADs-margin-left:.5in+ADs-text-indent:.5in+ACIAP= g- +AFs-nms+AF0- +ACYAIw-43+ADs-1+ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-/div+AD4- +ADw-div+AD4- +ADw-div style+AD0AIg-margin-left:.5in+ACIAPg- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ADs-margin-left:.5in+ACIAPg- +ACY-nbsp+ADsAPA-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-/div+AD4- +ADw-div+AD4- +ADw-div style+AD0AIg-margin-left:.5in+ACIAPg- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ADs-margin-left:.5in+ACIAPg- LL+ADw-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-/div+AD4- +ADw-/div+AD4- +ADw-/blockquote+AD4- +ADw-/div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-mso-margin-top-alt:auto+ADs= -mso-margin-bottom-alt:auto+ADs-margin-left:.5in+ACIAPg- +ACY-nbsp+ADsAPA-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-/div+AD4- +ADw-/div+AD4- +ADw-/div+AD4- +ADw-p class+AD0AIg-MsoNormal+ACI- style+AD0AIg-margin-left:.5in+ACIAPgBfAF= 8AXwBfAF8AXwBfAF8AXwBfAF8AXwBfAF8AXwBfAF8AXwBfAF8AXwBfAF8AXwBfAF8AXwBfAF8AX= wBfAF8AXwBfAF8AXwBfAF8AXwBfAF8AXwBfAF8AXwBfAF8APA-br+AD4- RATS mailing list+ADw-br+AD4- +ADw-a href+AD0AIg-mailto:RATS+AEA-ietf.org+ACI- target+AD0AIgBf-blank+ACIA= Pg-RATS+AEA-ietf.org+ADw-/a+AD4APA-br+AD4- +ADw-a href+AD0AIg-https://www.ietf.org/mailman/listinfo/rats+ACI- target+A= D0AIgBf-blank+ACIAPg-https://www.ietf.org/mailman/listinfo/rats+ADw-/a+AD4A= PA-o:p+AD4APA-/o:p+AD4APA-/p+AD4- +ADw-/blockquote+AD4- +ADw-/div+AD4- +ADw-/div+AD4- +ADw-/body+AD4- +ADw-/html+AD4- --_000_7BE04939B8F643BF9F040B3D5DFB60ECintelcom_--