From nobody Tue Sep 1 03:59:34 2020 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 7DE903A0F56; Tue, 1 Sep 2020 03:59:31 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: =?utf-8?b?TWFsacWhYSBWdcSNaW5pxIcgdmlhIERhdGF0cmFja2Vy?= To: Cc: bess@ietf.org, last-call@ietf.org, draft-ietf-bess-evpn-na-flags.all@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.15.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <159895797147.16761.14408621518778897643@ietfa.amsl.com> Reply-To: =?utf-8?b?TWFsacWhYSBWdcSNaW5pxIc=?= Date: Tue, 01 Sep 2020 03:59:31 -0700 Archived-At: Subject: [secdir] Secdir last call review of draft-ietf-bess-evpn-na-flags-05 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 01 Sep 2020 10:59:32 -0000 Reviewer: Mališa Vučinić Review result: Has Nits I reviewed this document as part of the Security Directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the Security Area Directors. Document authors, document editors, and WG chairs should treat these comments just like any other IETF Last Call comments. The document specifies an extension to an Ethernet Virtual Private Network (EVPN) MAC/IP advertisement by defining an EVPN Extended Community carrying flags relevant to the ARP/ND resolution. The abstract of the document does not include enough background context for it to be useful to the general audience. Otherwise, the document is well written. The security considerations section should be further elaborated. For instance, the section includes a discussion on a possible misconfiguration of Router (R) /Override (O) flags but the discussion is limited to the fact that the misconfiguration of an IPv6/MAC binding on a given Provider Edge device (PE) will propagate, through the means of IPv6 Neighbor Solicitation messages, to other PEs in the same broadcast domain. I would like to understand better the effect of each flag, i.e. what kind of behavior in the network can an attacker cause by changing one of these flags on a particular device or in transit? From nobody Tue Sep 1 07:10:58 2020 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 5A5EA3A08EC; Tue, 1 Sep 2020 07:10:51 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Sean Turner via Datatracker To: Cc: last-call@ietf.org, draft-ietf-lamps-ocsp-nonce.all@ietf.org, spasm@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.15.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <159896945131.15022.6534989576417116403@ietfa.amsl.com> Reply-To: Sean Turner Date: Tue, 01 Sep 2020 07:10:51 -0700 Archived-At: Subject: [secdir] Secdir last call review of draft-ietf-lamps-ocsp-nonce-03 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 01 Sep 2020 14:10:52 -0000 Reviewer: Sean Turner Review result: Has Nits The is short little document that put size constraints on the OCPS nonce extension. In particular, it requires the nonce be between 1 and 32 octets long. Since there's no bits on the wire changes, I think it's fine there's no new ASN.1 module. My technical nits include: 0. s2.1: Consider also throwing an error if the OCTET STRING is zero bytes in length. You throw one if it's too long, but not if it's too short. 1. s2.1, 4th paragraph: Consider adding reference to RFC 4086 for randomness requirements. My editorial nits include: 0. Abstract: missing period at the end of paragraph. 1. s2.1, 3rd para: missing period at end of paragraph 2. s4: I think the indentation is off by a couple of characters. From nobody Tue Sep 1 08:09:29 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 735973A0BC1; Tue, 1 Sep 2020 08:09:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EBBdpyq3c1np; Tue, 1 Sep 2020 08:09:16 -0700 (PDT) Received: from mail-io1-xd32.google.com (mail-io1-xd32.google.com [IPv6:2607:f8b0:4864:20::d32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 239C93A0BCC; Tue, 1 Sep 2020 08:09:10 -0700 (PDT) Received: by mail-io1-xd32.google.com with SMTP id b16so1597757ioj.4; Tue, 01 Sep 2020 08:09:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=7PVIQdZs6PVMiOjEx64a2yWzswNEDm3B1mdZrptLqs4=; b=SS6q8y4E3d+Nmb+dLXTV62tAuRyDMGW1XkwkKhxn9vm7Zd0af79DZLnXgPVAIopRRE cdw/Cqt7QMUdZVYLHIxpj9lCwLyLtbZyRJt3Vbl3VSmVzjWSemH97w+CzFSb2QcSBVt0 P9vvRs5K5TC/bfxzqoVzgcytAbFfU8gDKEOlPE4yh0I6cpmrOBkkVUQX0aOt84BVui10 WTjHc/U+K17wHmHM5sOWBY5pkkTVpCGjLhC7s/d9jta1FoLaoBCvj/YVzDuOrKlHhZyb bpuH5AsMbNwN19wHgmB+0atPYH7eXlDbco/rL6cdC/7lprdM10u/GwWVzfxe6+2jjka+ P5+g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=7PVIQdZs6PVMiOjEx64a2yWzswNEDm3B1mdZrptLqs4=; b=pmxMxOKaignlo1jLLuPWMXpo5YTuAyKt8IrcDSg2SVBk0igVU7mh1pV3axtzuT+MHC DyRRguEFQfl7bLeplIGCsPPr+LcgZ2v+uQ3X2byehRnGlp5tICDMCFwevN/kvQiXbsUX ZlXPpgO8EpBi8wJcWrNDJiA9W6LRe0LeJDxRQzgulT86G3FExKf0aoGzGYWB0nUoZdUi 2rsL7tw9+MhnzrUUzbYtWvxPgHxxrM17gQGSh6NNJNlZtKK+d8t+EWX7s1nIhjeTmiMq gdqAPsyvBGZEjo2CttAsS7qm+tc/5KwUstZ5RpSqTQyYSEt2zZZgUrWE7IdtRmgir1YA 7VIQ== X-Gm-Message-State: AOAM531ZdbSRQpj6P2vLgEP45YpTfoygtkbgq+DyFDW1o7MG/LKVVREE M4G2EU8rjAZKqf0CPLkXgfNI6/Zpl87EVGz5fqEfDzTcO84= X-Google-Smtp-Source: ABdhPJwhlDaM/ZHWzOxw0Jvs9imFmJy+XT8nSvRiVZc5ICwChnfZ/ABN1u2+28Xfpoy00H9JMmwMtrzdruevpcE5LkM= X-Received: by 2002:a5e:c309:: with SMTP id a9mr1844222iok.105.1598972949198; Tue, 01 Sep 2020 08:09:09 -0700 (PDT) MIME-Version: 1.0 References: <159896945131.15022.6534989576417116403@ietfa.amsl.com> In-Reply-To: <159896945131.15022.6534989576417116403@ietfa.amsl.com> From: Mohit Sahni Date: Tue, 1 Sep 2020 08:08:58 -0700 Message-ID: To: Sean Turner Cc: secdir@ietf.org, LAMPS WG , last-call@ietf.org, draft-ietf-lamps-ocsp-nonce.all@ietf.org Content-Type: multipart/alternative; boundary="000000000000a47e4d05ae41e6d2" Archived-At: Subject: Re: [secdir] [lamps] Secdir last call review of draft-ietf-lamps-ocsp-nonce-03 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 01 Sep 2020 15:09:25 -0000 --000000000000a47e4d05ae41e6d2 Content-Type: text/plain; charset="UTF-8" Thanks for the Review comments, Sean. I will make these changes and submit a new version, I will wait till the deadline to see if there are any more comments before publishing new draft. Regards, Mohit On Tue, Sep 1, 2020 at 7:10 AM Sean Turner via Datatracker wrote: > Reviewer: Sean Turner > Review result: Has Nits > > The is short little document that put size constraints on the OCPS nonce > extension. In particular, it requires the nonce be between 1 and 32 octets > long. Since there's no bits on the wire changes, I think it's fine there's > no > new ASN.1 module. > > My technical nits include: > > 0. s2.1: Consider also throwing an error if the OCTET STRING is zero bytes > in > length. You throw one if it's too long, but not if it's too short. > > 1. s2.1, 4th paragraph: Consider adding reference to RFC 4086 for > randomness > requirements. > > My editorial nits include: > > 0. Abstract: missing period at the end of paragraph. > > 1. s2.1, 3rd para: missing period at end of paragraph > > 2. s4: I think the indentation is off by a couple of characters. > > > _______________________________________________ > Spasm mailing list > Spasm@ietf.org > https://www.ietf.org/mailman/listinfo/spasm > --000000000000a47e4d05ae41e6d2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Thanks for the Review comments, Sean. I will make these ch= anges and submit a new=C2=A0version, I will wait till the deadline to see i= f there are any more comments before publishing new=C2=A0draft.=C2=A0
<= br>
Regards,
Mohit=C2=A0

On Tue, Sep 1, 2020 at 7:= 10 AM Sean Turner via Datatracker <n= oreply@ietf.org> wrote:
Reviewer: Sean Turner
Review result: Has Nits

The is short little document that put size constraints on the OCPS nonce extension. In particular, it requires the nonce be between 1 and 32 octets<= br> long. Since there's no bits on the wire changes, I think it's fine = there's no
new ASN.1 module.

My technical nits include:

0. s2.1: Consider also throwing an error if the OCTET STRING is zero bytes = in
length. You throw one if it's too long, but not if it's too short.<= br>
1. s2.1, 4th paragraph: Consider adding reference to RFC 4086 for randomnes= s
requirements.

My editorial nits include:

0. Abstract: missing period at the end of paragraph.

1. s2.1, 3rd para: missing period at end of paragraph

2. s4: I think the indentation is off by a couple of characters.


_______________________________________________
Spasm mailing list
Spasm@ietf.org
https://www.ietf.org/mailman/listinfo/spasm
--000000000000a47e4d05ae41e6d2-- From nobody Tue Sep 1 08:38:10 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DBA9D3A0B92; Tue, 1 Sep 2020 08:38:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.598 X-Spam-Level: X-Spam-Status: No, score=-9.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=SZUnxY8U; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=nAngNxZu Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ePqTm4ZGtz5G; Tue, 1 Sep 2020 08:38:05 -0700 (PDT) Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7A78C3A0B93; Tue, 1 Sep 2020 08:38:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=7324; q=dns/txt; s=iport; t=1598974685; x=1600184285; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=VoRwsZwQ3bqvoGIr3Cu45WJ+sGIdDd1TWwT2Uhkr9E8=; b=SZUnxY8UnU/kesANfZ0K61rcTit612dFYB3lvoEAKG0Qpins4rH8jNnj MveSte1pcQ67FooOGPvCkNNPzS1DcoCc4L0Ms+PydAti8qXC2yA4DIk3S NwVtjrQWBNc1aR8VnsLDvYWmkPerqs/a0w4KBdgsqic5OwIHqTAsap7PU g=; IronPort-PHdr: =?us-ascii?q?9a23=3AZxge6x0l0lHm+hQXsmDT+zVfbzU7u7jyIg8e44?= =?us-ascii?q?YmjLQLaKm44pD+JxWGuadiiVbIWcPQ7PcXw+bVsqW1X2sG7N7BtX0Za5VDWl?= =?us-ascii?q?cDjtlehA0vBsOJSCiZZP7nZiA3BoJOAVli+XzoPk1cGcK4bFrX8TW+6DcIEU?= =?us-ascii?q?D5Mgx4bu3+Bo/ViZGx0Oa/s53eaglFnnyze7R3eR63tg7W8MIRhNhv?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0CuAABeE05f/5NdJa1gHAEBAQEBAQc?= =?us-ascii?q?BARIBAQQEAQFAgTgFAQELAYFRIy4HgUgvLAqELoNGA411mHGBLoElA1ULAQE?= =?us-ascii?q?BDAEBLQIEAQGETAIXggwCJDYHDgIDAQELAQEFAQEBAgEGBG2FXAyFcgEBAQE?= =?us-ascii?q?DEhERDAEBNwELBAIBCA4DAQMBAQMCJgICAjAVAgYIAgQBDQUIGoVQAy4BpGY?= =?us-ascii?q?CgTmIYXaBMoMBAQEFhUsYghAJgQ4qAYJwg2WGTxuBQT+BVIIYNT6DdUoFM4J?= =?us-ascii?q?dM4Iti0iEEh8KgxiiS4EICoJllEVthSGDCYlvk16SUZ9XAgQCBAUCDgEBBYF?= =?us-ascii?q?bDCeBV3AVGiGCaVAXAg2OHwwXg06KVnQ3AgYBCQEBAwl8jUmBJAEwYAEB?= X-IronPort-AV: E=Sophos;i="5.76,379,1592870400"; d="scan'208";a="810177629" Received: from rcdn-core-11.cisco.com ([173.37.93.147]) by rcdn-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 01 Sep 2020 15:38:04 +0000 Received: from XCH-RCD-004.cisco.com (xch-rcd-004.cisco.com [173.37.102.14]) by rcdn-core-11.cisco.com (8.15.2/8.15.2) with ESMTPS id 081Fc1M6021890 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 1 Sep 2020 15:38:02 GMT Received: from xhs-aln-003.cisco.com (173.37.135.120) by XCH-RCD-004.cisco.com (173.37.102.14) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Tue, 1 Sep 2020 10:38:01 -0500 Received: from xhs-rtp-002.cisco.com (64.101.210.229) by xhs-aln-003.cisco.com (173.37.135.120) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Tue, 1 Sep 2020 10:38:00 -0500 Received: from NAM11-CO1-obe.outbound.protection.outlook.com (64.101.32.56) by xhs-rtp-002.cisco.com (64.101.210.229) with Microsoft SMTP Server (TLS) id 15.0.1497.2 via Frontend Transport; Tue, 1 Sep 2020 11:37:58 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=IUM8y0jbgFGB647QhmihiImiX3uejSKMV4f8xO9VvNy5WSgXcc9YFXcxZuFEOGqg9d2RF/YHBWr1+RaDaxi+IIYW1qmXZtmAVk++3Px7CX1VvFUpPzxrI0llIWB4wOtaJNwR4oxiM5RfdPOQBk419D+si2NFDID2EYQFsI/t8NRx8DqSx8HmgWC0+FPew44O8uZYD9PE+BlSOQysEKR4mwjSgWkpoSvhe2gAmu91w90kqAcotLRuczqwXQeR6aVhIpnFnAxggaTCK5KBjNMtBS9chWZl6Iqo92Y9Eb+IsY5qP7ok/1+XwbpHP2Z1aJgJNDJulp8ksrSr77S5K35PDw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=VoRwsZwQ3bqvoGIr3Cu45WJ+sGIdDd1TWwT2Uhkr9E8=; b=OrIDMss577QEtrWVkaFbi6QXJatot18WfGxVUPI08JVy3ZWHKyDwlgRKaBqUNNyMWiyrQZ2ggoyWzcJqpgYH0zaK8/leZwuaJCM8jD8XzpHL+H5cbJlGWP0nybDEZj1+DPVI/3vr0TepArxW/4caAD2enuM5eIG72Qkerf3lbzjgmYEAfGlGcj8XNdw3RvaTLgrk92GdhkNdFZN56iAVe1rg5nDYgqFtcWIjQmHL7IqKZKqjdiyFsafMqPBDBGXE8DAvCWoX58J0apSIxubtoSx4f0iBg1UAHofuHQi81dPr4TqK9BRj4en44IKKjJBj9hxSlmYJy5oBREXXK/ineQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=VoRwsZwQ3bqvoGIr3Cu45WJ+sGIdDd1TWwT2Uhkr9E8=; b=nAngNxZuBEnlOm+pFot79b0cNXVVOusELcTR0ZdoEgyvhd/l6y2E1GRs1nfb/dYrV64RCbzMiZQiCmfYw6YYtIhGkiPHjSQQW+c3s3f4JusMSOGTBrFUzHTTLAKTc3kwu22ToR1keSNVF4rtKcuLayAzzt4dipCNptNLQ2JCe48= Received: from MWHPR11MB1374.namprd11.prod.outlook.com (2603:10b6:300:24::8) by MWHPR1101MB2191.namprd11.prod.outlook.com (2603:10b6:301:5a::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3326.23; Tue, 1 Sep 2020 15:37:57 +0000 Received: from MWHPR11MB1374.namprd11.prod.outlook.com ([fe80::c0dd:2d6e:c8ef:261e]) by MWHPR11MB1374.namprd11.prod.outlook.com ([fe80::c0dd:2d6e:c8ef:261e%12]) with mapi id 15.20.3326.025; Tue, 1 Sep 2020 15:37:57 +0000 From: "Pablo Camarillo (pcamaril)" To: Brian Weis , "secdir@ietf.org" CC: "draft-ietf-spring-srv6-network-programming.all@ietf.org" , "spring@ietf.org" , "last-call@ietf.org" Thread-Topic: Secdir last call review of draft-ietf-spring-srv6-network-programming-17 Thread-Index: AQHWfCAs7si/IaQjAUGLemDRAKxyiKlTzVOQ Date: Tue, 1 Sep 2020 15:37:56 +0000 Message-ID: References: <159849805983.7699.460089427690333419@ietfa.amsl.com> In-Reply-To: <159849805983.7699.460089427690333419@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=cisco.com; x-originating-ip: [173.38.220.56] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: f0d2aff1-1c07-45a6-6f8c-08d84e8d001d x-ms-traffictypediagnostic: MWHPR1101MB2191: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: ixeYgFTpyBUIqHY5r6jfR+GMR7rYYR16qEU6rv9D2fvRY1+vqSW19azitLMb0UrpWwZTGj1k825J50P14K8tzzk1ycV+yiOSV48tUWiBpBtHVdoYyNHG6iv6OqbSLFyYjRDL6a5vPq94X4JUZHT0olPRKKh+4163strg9PQbr7+mu6aTvtsrrYjwqWQrzQ1imevBYemwMlNYQHK74jjS6pqZNcwBHmwoxwi+j9lS3I++xOJiUpTbrTq/zQUJSGsfww6PfnH0Oh8OUw5GAZv5bX0UY5B7uAo0GU7Kipd/oRU7FJIo/vQYBquV3cGpRDm7PhFLLiLt+5ouylaifJaA4g== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:MWHPR11MB1374.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFS:(136003)(346002)(39860400002)(366004)(396003)(376002)(7696005)(8676002)(186003)(52536014)(76116006)(4326008)(66946007)(71200400001)(64756008)(66446008)(66556008)(66476007)(26005)(33656002)(2906002)(53546011)(5660300002)(6506007)(8936002)(83380400001)(54906003)(316002)(478600001)(86362001)(66574015)(9686003)(55016002)(110136005); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: khPy9l5Ei3g2wRihJ/e3U9eOohpKjTp5wjlPZKjsFIpcCFw6uxZljyDYMZNYGzOjhGHDbrvNIb6+Xrp674qxh1WqECBgy0fV6jQ/DjYhg6OdkB/Y+7WbsrFTTqUP+XOhsWzmw36mQpOTpQ/8zxMEXNQCDwf9YwnP4F3DSDgs432ZkSGgXoplLHDocGSfgvSywqpLBpWuZCWZRbSozX5BUbbBMxmbiTmILhTe21svFo2+9u5gWT5jEKrlQcodiYdF9RfgIwQAGt94Kt9RbetEY8+Q2BOQ/H8DpIAe1HfuhGDl8kZxQSvscpWzeoDWHWz0XyLl7opI98bs2BgGL7NOEY41fvPj7NjDW5t8yc4kCaJrAR+DCsM7koeQ1aS3DNZTwcgAfI/D7JDZt7Z+EOH/gcdkw19oPXgZ8LlFaaEEWAZP3y/6+x/TGIwOfHYIo20hXlW8qNqB7I/U1VeMoX3TA23hgwd6hDZbY7e16KvTIeVKYffCIbszqX8jfcwV5NzKZ8/IItchjzWlBrn+pj592XnJitVg01lMDH7ysNUxUcaTs7zvmuBlprmsmz6ZiOXRRb3yBQ2fdbrCSLxx/eaKWGUjL+OIQkQDdU9n5+vX4aZkJwJak1tvPFMFImxUrnxxsxNY1njqZyImCdhC0NObHA== x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: MWHPR11MB1374.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: f0d2aff1-1c07-45a6-6f8c-08d84e8d001d X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Sep 2020 15:37:57.0010 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: n7nMvbrA5lqqVAJilj0YMx24J+rM7s/QUvC3l8+xkKDbXr66ZNemwEoPJUjRuC8VZ1rXInKiZiiW+s7QqR6UwA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR1101MB2191 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.102.14, xch-rcd-004.cisco.com X-Outbound-Node: rcdn-core-11.cisco.com Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-spring-srv6-network-programming-17 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 01 Sep 2020 15:38:08 -0000 SGkgQnJpYW4sDQoNCk1hbnkgdGhhbmtzIGZvciB0aGUgdGltZSB5b3UgdG9vayB0byBkbyBhIHRo b3JvdWdoIHJldmlldywgcGxlYXNlIHNlZSBpbmxpbmUgYmVsb3cgd2l0aCBbUENdLg0KDQpDaGVl cnMsDQpQYWJsby4NCg0KLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCkZyb206IEJyaWFuIFdl aXMgdmlhIERhdGF0cmFja2VyIDxub3JlcGx5QGlldGYub3JnPiANClNlbnQ6IGp1ZXZlcywgMjcg ZGUgYWdvc3RvIGRlIDIwMjAgNToxNA0KVG86IHNlY2RpckBpZXRmLm9yZw0KQ2M6IGRyYWZ0LWll dGYtc3ByaW5nLXNydjYtbmV0d29yay1wcm9ncmFtbWluZy5hbGxAaWV0Zi5vcmc7IHNwcmluZ0Bp ZXRmLm9yZzsgbGFzdC1jYWxsQGlldGYub3JnDQpTdWJqZWN0OiBTZWNkaXIgbGFzdCBjYWxsIHJl dmlldyBvZiBkcmFmdC1pZXRmLXNwcmluZy1zcnY2LW5ldHdvcmstcHJvZ3JhbW1pbmctMTcNCg0K UmV2aWV3ZXI6IEJyaWFuIFdlaXMNClJldmlldyByZXN1bHQ6IEhhcyBOaXRzDQoNClRoaXMgZG9j dW1lbnQgaXMgdGl0bGVkIOKAnFNSdjYgTmV0d29yayBQcm9ncmFtbWluZ+KAnSwgd2hpY2ggaXMg YXR0ZW50aW9uIGdyYWJiaW5nLiBJdCBmbGVzaGVzIG91dCBob3cgU2VnbWVudCBSb3V0aW5nIHJv dXRlcyBJUHY2IHBhY2tldHMgYnkgU2VnbWVudCBJRCAoU0lEKSwgYXMgd2VsbCBhcyBkZWZpbmlu ZyB0aGUgZm9ybWF0IG9mIGEgU0lEIGZvciBJUHY2LiBUaGUgSW50cm9kdWN0aW9uIHN0YXRlcywg 4oCcQW4gaW5ncmVzcyBub2RlIHN0ZWVycyBhIHBhY2tldCB0aHJvdWdoIGFuIG9yZGVyZWQgbGlz dCBvZiBpbnN0cnVjdGlvbnMsIGNhbGxlZCBzZWdtZW50cy7igJ0gV2hlbiBvbmUgY29uc2lkZXJz IHRoaXMgc3RhdGVtZW50IGFsb25nIHdpdGggdGhlIGRvY3VtZW50IHRpdGxlLCBpdOKAmXMgYXBw YXJlbnQgdGhhdCBuZXR3b3JrIGRldmljZXMgYXJlIGluZGVlZCBiZWluZyBnaXZlbiDigJxpbnN0 cnVjdGlvbnPigJ0gaW4gdGhlIHByb2dyYW1taW5nIHNlbnNlLCB3aGVyZSBlYWNoIOKAnGluc3Ry dWN0aW9u4oCdIGlzIGVuY29kZWQgaW4gYW4gSVB2NiBhZGRyZXNzLg0KDQpBbiDigJxpbnN0cnVj dGlvbuKAnSAoaS5lLiwgU1J2NiBTSUQpIGNvbXByaXNlcyBhIGxvY2F0b3IgKHdoaWNoIGlzIHVz ZWQgdG8gcm91dGUgdG8gYSBwYXJ0aWN1bGFyIG5ldHdvcmsgZGV2aWNlKSwgYW5kIGFsc28gZGly ZWN0cyB0aGUgbmV0d29yayBkZXZpY2UgYWN0aW5nIGFzIHRoZSBsb2NhdG9yIGhvdyB0byBwcm9j ZXNzIHRoZSBJUHY2IHBhY2tldC4gV2l0aCB0aGUgaGVscCBvZiBhbiBJUHY2IFNlZ21lbnQgUm91 dGluZyBIZWFkZXIgKFNSSCkgaGVhZGVyLCBhIHNlcmllcyBvZiDigJxpbnN0cnVjdGlvbnPigJ0g Y2FuIHNvdXJjZSByb3V0ZSBhIHBhY2tldCB0aHJvdWdoIHRoZSBuZXR3b3JrLCB3aGVyZSBlYWNo IG5ldHdvcmsgZGV2aWNlIGFjdGluZyBhcyBhIGxvY2F0b3IgbGVhcm5zIGhvdyB0byBoYW5kbGUg dGhlIHBhY2tldCBiZWZvcmUgcG9zc2libHkgc2VuZGluZyBpdCBvbiB0byB0aGUgbmV4dCBTSUQg KGlmIGFueSkuDQoNClRoZSBlbmNvZGluZyBvZiBhbiBJUHY2IGFkZHJlc3MgYXMgYW4gU1J2NiBT SUQgaW5jbHVkZXMgYSBsb2NhdG9yLCBhIGNvZGUgaW5kaWNhdGluZyBhIGNlcnRhaW4gZnVuY3Rp b24sIGFuZCBvcHRpb25hbGx5IGFyZ3VtZW50cyB0byB0aGF0IGZ1bmN0aW9uLiBBbiBpbml0aWFs IHNldCBvZiBjb2RlcyAoYW5kIHRoZWlyIGFzc29jaWF0ZWQgYWxnb3JpdGhtcykgaXMgZGVmaW5l ZCBpbiB0aGlzIGRvY3VtZW50LiBNb3N0IG9mIHRoZSBjb2RlcyBkZXNjcmliZSBob3cgdGhlIGVn cmVzcyByb3V0ZXIgc2hvdWxkIGRlY2Fwc3VsYXRlIHRoZSBwYWNrZXQsIHdpdGggbWlnaHQgaW5j bHVkZSBkZWZpbmluZyAgd2hpY2ggcm91dGluZyB0YWJsZSB0aGUgcmVjZWl2aW5nIHJvdXRlciBz aG91bGQgbG9vayB1cCBhZnRlciBkZWNhcHN1bGF0aW9uLg0KDQpUaGUgU2VjdXJpdHkgQ29uc2lk ZXJhdGlvbnMgc2VjdGlvbiBwb2ludHMgdG8gdGhlIFNlY3VyaXR5IENvbnNpZGVyYXRpb25zIG9m IHRoZSBhcmNoaXRlY3R1cmUgZG9jdW1lbnQgYW5kIHRoZSBTUkggZG9jdW1lbnQuIEJvdGggZG9j dW1lbnRzIGZvY3VzIG9uIHRoZSBmYWN0IHRoYXQgU1J2NiBpcyBpbnRlbmRlZCB0byBiZSB1c2Vk IHdpdGhpbiBhIHNpbmdsZSBkb21haW4gKGUuZy4sIHByb3ZpZGVyDQpuZXR3b3JrKSBhbmQgZGlz Y3VzcyByb3V0aW5nIG1pdGlnYXRpb25zIHN1Y2ggYXMgZmlsdGVyaW5nIGV4dGVybmFsIHRyYWZm aWMgYXBwcm9wcmlhdGVseS4gVGhleSBzZWVtIHRvIGFzc3VtZSB0aGF0IHRoZSBib3VuZGFyaWVz IG9mIHRoZSBkb21haW4gaXRzZWxmIGFyZSBpbnZpb2xhdGUgc3VjaCB0aGF0IHRoZSBkb21haW4g Ym91bmRhcnkgZGV2aWNlcyBhcmUgbm90IHN1YnZlcnRlZCwgYW5kIHRoYXQgdGhlcmUgYXJlIG5v IGJhZCBhY3RvcnMgd2l0aGluIHRoZSBkb21haW4uIFRoZXNlIGFyZSBjb21tb24gYXNzdW1wdGlv bnMgZm9yIHNlcnZpY2UgcHJvdmlkZXIgbmV0d29ya3Mgd2hlcmUgU2VnbWVudCBSb3V0aW5nIGlz IGludGVuZGVkIHRvIGJlIGRlcGxveWVkLg0KDQpIb3dldmVyLCBpdCBjYW5ub3QgYmUgY2VydGFp biB0aGF0IGFsbCBuZXR3b3JrcyBkZXBsb3lpbmcgU2VydmljZSBSb3V0aW5nIHRvIGJlIGZyZWUg b2YgYmFkIGFjdG9ycywgYW5kIHRoZXJlIHdpbGwgY2VydGFpbmx5IGJlIHNvbWUgYmVuZWZpdCB0 byBhIGJhZCBhY3RvciBjaGFuZ2luZyDigJxpbnN0cnVjdGlvbnPigJ0gZW5jb2RlZCBpbiBJUHY2 IGFkZHJlc3Nlcy4gUGVyaGFwcyB0aGVyZSBpcyBvcHBvcnR1bml0eSBmb3IgbWlzY2hpZWYgaW4g Y2hhbmdpbmcgdGhlIHJvdXRpbmcgdGFibGUgYXJndW1lbnQgaW4gYW7CoEVuZC5EVDQ2LCBmb3Ig ZXhhbXBsZS4gQWxzbywgYXMgb3RoZXIgU1J2NiBmdW5jdGlvbnMgYXJlIGRlZmluZWQgKGUuZy4s IHBhY2tldCBpbnNwZWN0aW9uIGZ1bmN0aW9ucyksIGl0IHdvdWxkIGJlIGltcG9ydGFudCB0byBl bnN1cmUgdGhhdCB0aG9zZSBTSURzIGFyZSBub3QgbW9kaWZpZWQgdG8gYXZvaWQgb3IgZGVjcmVh c2UgdGhlIHF1YWxpdHkgb2YgdGhvc2UgaW5zcGVjdGlvbiBmdW5jdGlvbnMuDQoNCltQQ10gSW5k ZWVkLCB0aGUgYXNzdW1wdGlvbiB0aGF0IGEgZG9tYWluIGlzIGZyZWUgb2YgYmFkIGFjdG9ycyBp cyBhIGNvbW1vbiBhc3N1bXB0aW9uIGZvciBuZXR3b3JrcyB3aGVyZSBTUnY2IGlzIGludGVuZGVk IHRvIGJlIGRlcGxveWVkLiBUaGUgc2VjdXJpdHkgc2VjdGlvbiBvZiBSRkM4NzU0IGRvZXMgdGFs ayBhYm91dCB0aGVzZSBiYWQgYWN0b3IgYXR0YWNrcyAoNy4xKSBvbiBzdWNoIG5ldHdvcmtzLCBh bmQgb3RoZXIgdHlwZXMgb2YgYXR0YWNrcyB0aGV5IGNhbiBsYXVuY2guDQoNClRoZSBTUkggZG9j dW1lbnQgZG9lcyBkZXNjcmliZSBhbiBITUFDIFRMViB0aGF0IGlzIGludGVuZGVkIHRvIG1pdGln YXRlIHRoZXNlIGtpbmRzIG9mIGF0dGFja3MuIFNpbmNlIG5laXRoZXIgb2YgdGhlIHJlZmVyZW5j ZWQgZG9jdW1lbnRzIFNlY3VyaXR5IENvbnNpZGVyYXRpb25zIG1lbnRpb24gaXQsIGl0IHdvdWxk IGJlIGEgZ29vZCBpZGVhIHRvIGRlc2NyaWJlIGhlcmUgdGhhdCB0aGVyZSBhcmUgdGhyZWF0cyB0 byBjaGFuZ2luZyBTSURzLCBhbmQgcG9pbnQgb3V0IGhvdyB0byBtaXRpZ2F0ZSB0aGVtIHdpdGgg dGhlIEhNQUMgVExWLg0KDQpbUENdIFRoZSBITUFDIFRMViBhbGxvd3MgYSBzZWdtZW50IGVuZHBv aW50IG5vZGUgdG8gInZlcmlmeSB0aGF0IHRoZSBTUkggYXBwbGllZCB0byBhIHBhY2tldCB3YXMg c2VsZWN0ZWQgYnkgYW4gYXV0aG9yaXplZCBwYXJ0eSBhbmQgdG8gZW5zdXJlIHRoYXQgdGhlIHNl Z21lbnQgbGlzdCBpcyBub3QgbW9kaWZpZWQgYWZ0ZXIgZ2VuZXJhdGlvbi4iICBXZSBjb3VsZCBj YWxsIHRoaXMgb3V0IHNwZWNpZmljYWxseSBpbiB0aGUgc2VjdXJpdHkgc2VjdGlvbi4NCjxPTEQ+ DQpUb2dldGhlciwgdGhleSBkZXNjcmliZSB0aGUgcmVxdWlyZWQgc2VjdXJpdHkgbWVjaGFuaXNt cw0KICAgdGhhdCBhbGxvdyBlc3RhYmxpc2htZW50IG9mIGFuIFNSIGRvbWFpbiBvZiB0cnVzdCB0 byBvcGVyYXRlDQogICBTUnY2LWJhc2VkIHNlcnZpY2VzIGZvciBpbnRlcm5hbCB0cmFmZmljIHdo aWxlIHByZXZlbnRpbmcgYW55DQogICBleHRlcm5hbCB0cmFmZmljIGZyb20gYWNjZXNzaW5nIG9y IGV4cGxvaXRpbmcgdGhlIFNSdjYtYmFzZWQNCiAgIHNlcnZpY2VzLiAgDQo8L09MRD4NCjxORVc+ DQpUb2dldGhlciwgdGhleSBkZXNjcmliZSB0aGUgcmVxdWlyZWQgc2VjdXJpdHkgbWVjaGFuaXNt cw0KICAgdGhhdCBhbGxvdyBlc3RhYmxpc2htZW50IG9mIGFuIFNSIGRvbWFpbiBvZiB0cnVzdCB0 byBvcGVyYXRlDQogICBTUnY2LWJhc2VkIHNlcnZpY2VzIGZvciBpbnRlcm5hbCB0cmFmZmljIHdo aWxlIHByZXZlbnRpbmcgYW55DQogICBleHRlcm5hbCB0cmFmZmljIGZyb20gYWNjZXNzaW5nIG9y IGV4cGxvaXRpbmcgdGhlIFNSdjYtYmFzZWQNCiAgIHNlcnZpY2VzLiBBZGRpdGlvbmFsbHksIFJG Qzg3NTQgZGVmaW5lcyBhbiBITUFDIFRMViBwZXJtaXR0aW5nIG5vZGVzIGluIHRoZSBTUiBkb21h aW4gdG8gdmVyaWZ5IHRoYXQgdGhlIFNSSCBhcHBsaWVkIHRvIGEgcGFja2V0IHdhcyBzZWxlY3Rl ZCBieSBhbiBhdXRob3JpemVkIHBhcnR5IGFuZCB0byBlbnN1cmUgdGhhdCB0aGUgc2VnbWVudCBs aXN0IGlzIG5vdCBtb2RpZmllZCBhZnRlciBnZW5lcmF0aW9uLCBwcm92aWRpbmcgZnVydGhlciBw cm90ZWN0aW9uIGFnYWluc3QgYmFkIGFjdG9ycyB3aXRoaW4gdGhlIFNSIGRvbWFpbi4NCjwvTkVX Pg0KDQpBbHNvLCBpZiBJ4oCZbSBub3QgbWlzdGFrZW4sIHdoZW4gdGhlcmUgaXMganVzdCBvbmUg U0lEIHRoZW4gaXQgaXMgcGxhY2VkIGluIHRoZQ0KSVB2NiBEQSBhbmQgdGhlcmUgaXMgbm8gU1JI IGhlYWRlciBvciBITUFDIFRMVi4gDQoNCltQQ10gVGhlIFNSSCBNQVkgYmUgaW5jbHVkZWQgd2hl biB0aGVyZSBpcyBqdXN0IG9uZSBTSUQgaWYgZmxhZ3Mgb3IgVExWcyBhcmUgcmVxdWlyZWQgKFJG Qzg3NTQgc2VjdGlvbiA0LjEgcGFyYWdyYXBoIDEpIHNvIHRoZSBITUFDIFRMViBtYXkgYmUgdXNl ZCBpbiB0aGlzIGNhc2UuDQoNClRoaXMgaXMgYSBnZW5lcmFsIHByb2JsZW0gd2l0aCBlbnN1cmlu ZyB0aGF0IHRoZSBEQSBvbiBwYWNrZXRzIGFyZSBub3QgY2hhbmdlZCBpbiB0cmFuc2l0LCBhbmQg b25lIGNvdWxkIHVzZSBJUHNlYyB0byBtaXRpZ2F0ZSB0aGF0IGlzc3VlLiBJdOKAmXMgcHJvYmFi bHkgd29ydGh3aGlsZSBtZW50aW9uaW5nIHNvbWV0aGluZyBsaWtlIHRoYXQuDQoNCg0K From nobody Tue Sep 1 18:04:13 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AB5143A08EC for ; Tue, 1 Sep 2020 18:04:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BJb47sGmE656 for ; Tue, 1 Sep 2020 18:04:10 -0700 (PDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1186C3A08EB for ; Tue, 1 Sep 2020 18:04:09 -0700 (PDT) Received: from kduck.mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 082142eN001221 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 1 Sep 2020 21:04:06 -0400 Date: Tue, 1 Sep 2020 18:04:02 -0700 From: Benjamin Kaduk To: Kyle Rose Cc: secdir@ietf.org Message-ID: <20200902010402.GC16914@kduck.mit.edu> References: <159708526736.13725.2565339809870274299@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <159708526736.13725.2565339809870274299@ietfa.amsl.com> User-Agent: Mutt/1.12.1 (2019-06-15) Archived-At: Subject: Re: [secdir] [Last-Call] Secdir last call review of draft-ietf-cbor-date-tag-05 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 02 Sep 2020 01:04:12 -0000 Thanks, Kyle. I had no other comments to add (but I did mention the leap seconds topic once more in my No Objection ballot). -Ben On Mon, Aug 10, 2020 at 11:47:47AM -0700, Kyle Rose via Datatracker wrote: > Reviewer: Kyle Rose > Review result: Has Nits > > I have reviewed this document as part of the security directorate's ongoing > effort to review all IETF documents being processed by the IESG. These > comments were written primarily for the benefit of the security area directors. > Document editors and WG chairs should treat these comments just like any other > last call comments. > > This document is ready with nits. I see no issues of interest to the security > directorate. > > I do have three comments, however: > > * In the security considerations section, a better example might be the > potential inappropriateness of using an imprecise mechanism for specifying > certificate expiration. > > * It's not clear how this is intended to work for dates prior to the start of > the Gregorian calendar in 1582. What do negative integer values mean when they > imply a date before 15-Oct-1582? Is the Gregorian calendar defined for all > time? In a brief investigation, I've been unable to find the answer to this. > > * In a very gross sense, this specification *is* actually tied to the > prevailing timescale, leap seconds and all: if the whole world were to > transition from UTC to TAI and stop adding leap seconds, presumably > implementations would continue to generate dates for this specification by > truncating the local timestamp to the date, which would cause it to drift along > with TAI away from UTC over time. There wouldn't be a huge practical effect > here given how little they are expected to diverge over the foreseeable future, > but it would mean that dates encoded in this format today would not carry > enough information to precisely indicate a date in the far future even if the > target timescale were understood throughout since the source timescale isn't > part of the encoding. > > > > -- > last-call mailing list > last-call@ietf.org > https://www.ietf.org/mailman/listinfo/last-call From nobody Thu Sep 3 09:39:14 2020 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id DC82B3A0FCA; Thu, 3 Sep 2020 09:39:02 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Derek Atkins via Datatracker To: Cc: last-call@ietf.org, draft-ietf-i2nsf-sdn-ipsec-flow-protection.all@ietf.org, i2nsf@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.15.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <159915114284.18250.13963885423309139336@ietfa.amsl.com> Reply-To: Derek Atkins Date: Thu, 03 Sep 2020 09:39:02 -0700 Archived-At: Subject: [secdir] Secdir last call review of draft-ietf-i2nsf-sdn-ipsec-flow-protection-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Sep 2020 16:39:03 -0000 Reviewer: Derek Atkins Review result: Has Nits Hi, I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written with the intent of improving security requirements and considerations in IETF drafts. Comments not addressed in last call may be included in AD reviews during the IESG review. Document editors and WG chairs should treat these comments just like any other last call comments. Summary: * With Nits Details: * NB: I did not review the Yang Models or Appendices * Awkward sentence in section 8, top of page 21: Moreover, the startup configuration datastore MUST be also pre-configured with the required ALLOW policies that allow to communicate the NSF with the I2NSF Controller once the NSF is deployed. Specifically "that allow to communicate the NSF with ..." should be changed, possibly to read "that allow the NSF to communicate with ..." * at the end of 8.3 at the bottom of page 23 there is a space for "the subtrees and data nodes and their sensitivity/vulnerability:" but there is no list, it just goes onto the next paragraph at the top of the next page. -derek From nobody Thu Sep 3 12:01:01 2020 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 957D73A11D7 for ; Thu, 3 Sep 2020 12:00:52 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Tero Kivinen via Datatracker To: X-Test-IDTracker: no X-IETF-IDTracker: 7.15.1 Auto-Submitted: auto-generated Precedence: bulk Reply-To: secdir-secretary@mit.edu, Tero Kivinen Message-ID: <159915965259.32537.9437228213029968026@ietfa.amsl.com> Date: Thu, 03 Sep 2020 12:00:52 -0700 Archived-At: Subject: [secdir] Assignments X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 03 Sep 2020 19:00:59 -0000 Review instructions and related resources are at: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview For telechat 2020-09-10 Reviewer LC end Draft Tirumaleswar Reddy.K 2020-08-18 draft-ietf-roll-turnon-rfc8138-12 Vincent Roca 2020-04-23 draft-ietf-detnet-ip-over-mpls-07 Last calls: Reviewer LC end Draft Nancy Cam-Winget 2020-09-24 draft-hardie-dispatch-rfc3405-update-03 Linda Dunbar 2020-09-16 draft-ietf-avtcore-cc-feedback-message-08 Donald Eastlake 2020-09-14 draft-ietf-dnsop-dns-zone-digest-09 Shawn Emery 2020-09-11 draft-ietf-detnet-flow-information-model-10 Stephen Farrell 2020-09-10 draft-ietf-detnet-mpls-over-udp-ip-06 Daniel Franke 2020-03-09 draft-ietf-regext-dnrd-objects-mapping-09 Dan Harkins None draft-ietf-rtgwg-policy-model-03 David Mandelberg 2020-07-14 draft-ietf-idr-rfc8203bis-06 Kathleen Moriarty 2020-07-20 draft-ietf-ace-oscore-profile-11 Russ Mundy 2020-07-20 draft-ietf-ace-dtls-authorize-12 Yoav Nir None draft-ietf-netconf-trust-anchors-13 Tirumaleswar Reddy.K 2020-08-18 draft-ietf-roll-turnon-rfc8138-12 Vincent Roca 2020-04-23 draft-ietf-detnet-ip-over-mpls-07 Stefan Santesson R2020-09-14 draft-ietf-extra-imap-fetch-preview-09 Klaas Wierenga 2020-09-09 draft-ietf-v6ops-slaac-renum-03 Klaas Wierenga 2020-05-26 draft-ietf-kitten-krb-spake-preauth-09 Christopher Wood 2020-09-09 draft-ietf-v6ops-cpe-slaac-renum-04 Paul Wouters 2020-09-08 draft-ietf-i2nsf-capability-data-model-09 Paul Wouters 2020-05-25 draft-ietf-capport-architecture-09 Dacheng Zhang 2020-03-12 draft-nottingham-how-did-that-get-into-the-repo-01 Dacheng Zhang 2019-11-05 draft-ietf-mpls-ri-rsvp-frr-07 Next in the reviewer rotation: Daniel Franke Daniel Gillmor Phillip Hallam-Baker Steve Hanna Dan Harkins Russ Housley Christian Huitema Leif Johansson Charlie Kaufman Scott Kelly From nobody Fri Sep 4 06:26:13 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9A1F03A080F; Fri, 4 Sep 2020 06:26:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.102 X-Spam-Level: X-Spam-Status: No, score=-2.102 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HFMM6c_hAUzI; Fri, 4 Sep 2020 06:26:04 -0700 (PDT) Received: from EUR04-HE1-obe.outbound.protection.outlook.com (mail-eopbgr70079.outbound.protection.outlook.com [40.107.7.79]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 53C253A0100; Fri, 4 Sep 2020 06:26:04 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=IQCTOi9mEZ44YA3GCAUOjAyqakReRlVvDr0BJ9nhrJbfUVz47b7tO/49JpigjyW62Rj/JRVMyqOU/28VxbF6SIzkSednTC9rjtH1onNsIkEbPxw2lZ5Uv3Szp0o+eMNx3OM1I+ytVVXG7W9rn4mpJnoUh8ae6iy0biLxHr7bp4T8Si3lNYSy/8kLKpFn0PF4mRLe+RWUIpjq6ammZY98d40dXUaMoVduEswED4qzB5eLQW3qdAI77kVyyIjHW0HXWIbrrFNjwvoMf26/mRQ1bvfWw5T18VYCLHFDGSC3XsrnFEB+wteqTd5QhKKYwcFTcznO7s0T58zPrEojxwU0uw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=miaaLWybYLgZ/N2RtctbnkZ28kMehD6utcSYNjFelXs=; b=fM6em+OVbkNexwTX87iJJ21/kka5UQcXa0Qw5+II3Nso+ny5q7zBCZT1Llst4CRjCSV2xxAALnF94LysomNcbtesYT2nln1XnQV141SSe6oL8PJCj8Q0nByfdaMaRZFCcUISNOixTuvoKjk9GocKJrD6BXwHNJ3Vt8gtsknX1HR4XUL2yKTN6b98C6jNcVwB791CHY6cPs3ycA4Bk0emNBf2Gb9rkC0O/aU2eYUEj6ZmeYaFE0fyDtA4NJ7vadRna6k6PSvDFWW/JcO4B//JgK6r21SjAFReZCCJ4kd9NfUmjEtAV7q05XucJZqYZadG9KCwnmoxKG9QIU4KODIqAw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=miaaLWybYLgZ/N2RtctbnkZ28kMehD6utcSYNjFelXs=; b=lGuGVW28X1b7neZ8hEKFoeVH7QFqQ7gBzUCVstBFgIhja4S/YRfLtIOrOA9z8/yxIZCh68NvZ9UHBaSRf05oGcOjhUYJNWhe2p856WjUQGr9KPNYkLqUpcDDXPnYUjBBAd7V2CwtzFzLR6/YkLRZacoaQ4+0t9a5wWQQYSNLIYI= Received: from AM0PR0702MB3603.eurprd07.prod.outlook.com (2603:10a6:208:22::25) by AM0PR07MB6419.eurprd07.prod.outlook.com (2603:10a6:20b:144::13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3370.7; Fri, 4 Sep 2020 13:25:58 +0000 Received: from AM0PR0702MB3603.eurprd07.prod.outlook.com ([fe80::59ca:540d:b7f3:58b9]) by AM0PR0702MB3603.eurprd07.prod.outlook.com ([fe80::59ca:540d:b7f3:58b9%6]) with mapi id 15.20.3370.009; Fri, 4 Sep 2020 13:25:57 +0000 From: =?utf-8?B?QmFsw6F6cyBWYXJnYSBB?= To: Watson Ladd , "secdir@ietf.org" CC: "last-call@ietf.org" , "draft-ietf-detnet-mpls.all@ietf.org" , "detnet@ietf.org" Thread-Topic: Secdir telechat review of draft-ietf-detnet-mpls-11 Thread-Index: AQHWflA0s8APESY0XUuIlxpo+lji2qlYfMlg Date: Fri, 4 Sep 2020 13:25:57 +0000 Message-ID: References: <159873859265.10254.15047947315298424271@ietfa.amsl.com> In-Reply-To: <159873859265.10254.15047947315298424271@ietfa.amsl.com> Accept-Language: hu-HU, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=ericsson.com; x-originating-ip: [193.226.240.82] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 755d7bbe-2714-4360-053f-08d850d60f1f x-ms-traffictypediagnostic: AM0PR07MB6419: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 1dKP2R5WaNS2Gz90jikvj68NwqhCOMBYY6vNYSR/cj3xnRqIMGs9Vgln04hSbGsyzDjt8T4NSKFDdlT7/WOE9ks2VQbkmUnIglYtur5viaaM84adaYDqpp3NyQOciv1NB4XaCvq7C3AGyguHPkl/0imiyJw071oHcrPCjMPeZ1DP2+JJfa9rnCtBqo7fvST0wRS5cuU+Iio9JDA7cQJI+NUNQDdFvczTkb0NHNToMstUoJaVYyk5xkXbat6Y+aPimwwkI7iWKPNyLj4PR4k5E3OTm6oXHd3Gut3N6MNnm7OpAONxI9cefVYSeFEc8J10G+Ufi8my31zAs7nBWqFyDQ== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM0PR0702MB3603.eurprd07.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(136003)(376002)(346002)(366004)(396003)(39860400002)(8676002)(8936002)(5660300002)(2906002)(66946007)(33656002)(52536014)(478600001)(26005)(71200400001)(66556008)(66476007)(64756008)(76116006)(66446008)(86362001)(110136005)(6506007)(316002)(7696005)(186003)(53546011)(54906003)(9686003)(85202003)(55016002)(4326008)(83380400001)(85182001); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: IgUfWFVNRvmVAvAURKiot0+eHmA3Y3JTCRAdmNTzOxdK02h39Q8+oyD/iZ4XPYzE+puyEens6cv3dDs3BTDexUhviZOOtHG+0z6IAHeeZNJSTbCfsoYeamYfc+XsY6SrV9qK7ndLggSC1xFkoxAbQQxiiKT+vSxINtoFeidarsAtE1C/iTZUbR7unLV5KKthQgz7RNBjaDv+LBBV9/Vvnj1+k+oAMGkKl51GRY+vbg3OXDrpHtSXMUhp3uF/fwIYUkZDZn+ff0vCI/IJ0XW5fyN26uJDsyee0LA/xDx4XBgFQUM06ntHj0Y3kyXFAekRSy7cBW8YBfajqCxyae6IG9KtQ+7WZBhtgp5Pn3pvASBksLaKjDNjPgAnXJQTIyJlPY/coto1F9LS2MgjSCFHn/kBYDhCCjyf629yBIT2ycesrIaxG+lZPWcfj8g7ZsvbYCkCD94lc9X4+GLDKVGXHLZFCkzbMImfkB3G18Xh2THoGxUeYyZQaLs4nEWYhkYFrx1bnfv2tDqgH162WAUmAw5eO8hQ9L6+q7r/4SchyvvOBCC4t1D++FNs9mcSK42+B597QXbUuVqEG0toyEEl9Ul6tuEtYCRXDC1YYKKpOLJ7kYH3eCNFTZMJFcnFcF3hPNYxuzYmjl+xQ3R4oPboyQ== x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: AM0PR0702MB3603.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 755d7bbe-2714-4360-053f-08d850d60f1f X-MS-Exchange-CrossTenant-originalarrivaltime: 04 Sep 2020 13:25:57.8580 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: do7nyyL8MLhs+7Vh90FtEqX3vKb96jPFPrDGEbvy3XHISlzNIlla0U0vUG7WQ8Hls+LaPSUlLM98K36kBIOUssBdNqMyx+pOladXnBXhN0o= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR07MB6419 Archived-At: Subject: Re: [secdir] Secdir telechat review of draft-ietf-detnet-mpls-11 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Sep 2020 13:26:07 -0000 SGkgV2F0c29uLA0KDQpNYW55IHRoYW5rcyBmb3IgdGhlIHJldmlldyBhbmQgdGhlIGNvbW1lbnRz LiANCg0KUmlnaHQsIGEgY29tcHJvbWlzZWQgbm9kZSBjYW4gbWFrZSB0cm91YmxlIG5vdCBvbmx5 IGZvciBEZXROZXQgZmxvd3MgYnV0IGFueSBvdGhlciANCk1QTFMgdHJhZmZpYyBhcyB3ZWxsLiBJ biB0aGUgZHJhZnQgd2UgaW50ZW5kIHRvIGluY2x1ZGUgImV4Y2x1c2l2ZWx5IHNlY3VyaXR5IGNv bnNpZGVyYXRpb25zIA0Kd2hpY2ggYXJlIHNwZWNpZmljIHRvIHRoZSBEZXROZXQgTVBMUyBkYXRh IHBsYW5lIi4gDQoNClNvLCB3ZSBoYXZlIHJlZmVycmVkIHRvIFJGQzU5MjAgKFNlY3VyaXR5IEZy YW1ld29yayBmb3IgTVBMUyBhbmQgR01QTFMgTmV0d29ya3MpIA0KaW4gc2VjdGlvbiAiMTAuIFNl Y3VyaXR5IENvbnNpZGVyYXRpb25zIiBhbmQgbm90IGluY2x1ZGVkIGdlbmVyYWwgTVBMUyBzZWN1 cml0eSBjb25jZXJucyANCmFuZCB0aGVpciBtaXRpZ2F0aW9uLg0KDQpJIGhvcGUgdGhlc2UgY2xh cmlmaWVzIHlvdXIgY29tbWVudHMuDQoNClRoYW5rcyAmIENoZWVycw0KQmFsYSd6cw0KDQotLS0t LU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KRnJvbTogV2F0c29uIExhZGQgdmlhIERhdGF0cmFja2Vy IDxub3JlcGx5QGlldGYub3JnPiANClNlbnQ6IFN1bmRheSwgQXVndXN0IDMwLCAyMDIwIDEyOjAz IEFNDQpUbzogc2VjZGlyQGlldGYub3JnDQpDYzogbGFzdC1jYWxsQGlldGYub3JnOyBkcmFmdC1p ZXRmLWRldG5ldC1tcGxzLmFsbEBpZXRmLm9yZzsgZGV0bmV0QGlldGYub3JnDQpTdWJqZWN0OiBT ZWNkaXIgdGVsZWNoYXQgcmV2aWV3IG9mIGRyYWZ0LWlldGYtZGV0bmV0LW1wbHMtMTENCg0KUmV2 aWV3ZXI6IFdhdHNvbiBMYWRkDQpSZXZpZXcgcmVzdWx0OiBIYXMgTml0cw0KDQpJIGhhdmUgcmV2 aWV3ZWQgdGhpcyBkb2N1bWVudCBhcyBwYXJ0IG9mIHRoZSBzZWN1cml0eSBkaXJlY3RvcmF0ZSdz IG9uZ29pbmcgZWZmb3J0IHRvIHJldmlldyBhbGwgSUVURiBkb2N1bWVudHMgYmVpbmcgcHJvY2Vz c2VkIGJ5IHRoZSAgSUVTRy4gDQpUaGVzZSBjb21tZW50cyB3ZXJlIHdyaXR0ZW4gcHJpbWFyaWx5 IGZvciB0aGUgYmVuZWZpdCBvZiB0aGUgIHNlY3VyaXR5IGFyZWEgZGlyZWN0b3JzLiAgRG9jdW1l bnQgZWRpdG9ycyBhbmQgV0cgY2hhaXJzIHNob3VsZCB0cmVhdCAgdGhlc2UgY29tbWVudHMganVz dCBsaWtlIGFueSBvdGhlciBsYXN0IGNhbGwgY29tbWVudHMuDQoNClRoZSBzdW1tYXJ5IG9mIHRo ZSByZXZpZXcgaXMgaGFzIG5pdHMuDQoNCkZpcnN0IHRoZSBnb29kIHBhcnRzOiB0aGlzIGRvY3Vt ZW50IGhhcyBhIHZlcnkgd2VsbC10aG91Z2h0IFNlY3VyaXR5IENvbnNpZGVyYXRpb25zIHNlY3Rp b24gdGhhdCBkZXNjcmliZXMgdGhlIHRocmVhdHMgdW5pcXVlIHRvIHRoaXMgc2V0dGluZyBhbmQg bWFrZXMgYSByZWZlcmVuY2UgdG8gYW4gdXBjb21pbmcgYXJjaGl0ZWN0dXJlIGRyYWZ0LiBIb3dl dmVyLCBJIGZvdW5kIGFuYWx5c2lzIG9mIGhvdyB0aGUgcHJvdG9jb2wgc2hvdWxkIGJlIGRlcGxv eWVkIG9yIGNvbmZpZ3VyZWQgb3IgaXMgZGVzaWduZWQgdG8gYWRkcmVzcyB0aG9zZSB0aHJlYXRz IHRvIGJlIGxhY2tpbmcgaW4gYSBmZXcgcGxhY2VzLiBUaGUgZGlzY3Vzc2lvbiBvZiBET1MgYXR0 YWNrcyBpcw0KZ29vZDogaXQgc2F5cyB0byBhdm9pZCBpbXBhY3RzIG9uIHRoZSBEZXROZXQgc2Vy dmljZXMgdHJhZmZpYyBtdXN0IGJlIHBvbGljZWQgb3IgZHJvcHBlZCBhdCB0aGUgZWRnZS4gSSB3 b3VsZCBsaWtlIHRvIHNlZSBhIHNpbWlsYXIgc3RhdGVtZW50IG1hZGUgYWJvdXQgdGhlIGNvbnNl cXVlbmNlcyBhbmQgbWl0aWdhdGlvbnMgZm9yIGludGVyaW9yIG5ldHdvcmsgY29ycnVwdGlvbi4g SXQgcmVhZHMgYWxtb3N0IGxpa2UgYSBzZW50ZW5jZSBvciB0d28gd2FzIGluYWR2ZXJ0ZW50bHkg ZGVsZXRlZC4NCg0KSG93ZXZlciwgaWYgSSB1bmRlcnN0YW5kIHRoZSBNUExTIGFyY2hpdGVjdHVy ZSBjb3JyZWN0bHkgYSBjb21wcm9taXNlZCBub2RlIGNhbiBpbmplY3QgYSBsYWJlbCBzdGFjayB0 aGF0IHJlc3VsdHMgaW4gaW50ZXJmZXJlbmNlIHdpdGggdGhlIERldE5ldCBmbG93cywgYW5kIHRo aXMgaXMgcXVpdGUgZGlmZmljdWx0IHRvIGF2b2lkIGluIHRoZSBnZW5lcmFsIGNhc2UuIEknbSBu b3Qga25vd2xlZGdlYWJsZSBpbiB0aGlzIGFyZWEgYnkgYW55IG1lYW5zLiAgUGVyaGFwcyBpdCdz IG5lY2Vzc2FyeSB0byBzYXkgdGhhdCBhbGwgdGhlIE1QTFMgbm9kZXMgYXJlIGFzc3VtZWQgdG8g YmUgdHJ1c3RlZCBhbmQgb3RoZXJ3aXNlIHRoZSBEZXROZXQgc2VydmljZXMgY2Fubm90IGJlIHBy b3ZpZGVkLg0KDQpJIHRoaW5rIHRoaXMgY2FuIGJlIGFkZHJlc3NlZCBwcmV0dHkgcXVpY2tseS4N Cg0KU2luY2VyZWx5LA0KV2F0c29uIExhZGQNCg0KDQoNCg== From nobody Fri Sep 4 15:27:47 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 577413A0C77; Fri, 4 Sep 2020 15:27:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oKeUieCjJ7jW; Fri, 4 Sep 2020 15:27:41 -0700 (PDT) Received: from mail-ej1-x630.google.com (mail-ej1-x630.google.com [IPv6:2a00:1450:4864:20::630]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C49083A0C78; Fri, 4 Sep 2020 15:27:37 -0700 (PDT) Received: by mail-ej1-x630.google.com with SMTP id a26so10574203ejc.2; Fri, 04 Sep 2020 15:27:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to:cc; bh=vd1mwzU/xsH6JejQGp8a16TiIfbCpCuKE0Lacmqc56g=; b=FEDrjnFkImq0zMXRqG0dsnDGBHbTKTwXeYcV0boY3tatus+HpOjsn35yN3sc0sCPoH 3xYkHCJ+qLeg6Ct52/R3C5C7EnwJKm5QzudF9fzbIMQH/v/dj8bErCgA7oPM7hBsfpGh J0LEwFCsqegs+JvGXqeFoMbOH7ZbzC94bt1E4i+7ebb24mJNrSIQCv+RFUQB5ZmlEZ9G 1HqVL1o0L47vcoxEgnDVXMnsWdbZuY6N5KR1qArzOtUAII1/JCbaCzZisi0ZukD9iXps RRb2Hzy8LpDBrhf3UGx/i/JYFEzq3MfFLw/35njg3EyvlMX6iWAwCKlxZc+do58t/eFh QzzA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc; bh=vd1mwzU/xsH6JejQGp8a16TiIfbCpCuKE0Lacmqc56g=; b=bTA8ow2k50Zn10JqZ4EXe/y5XIRna2mCsl4WLT/RcJcWEWajaAGDaTpsVNeQiHarHf 8qOCWbgmBmUEZJgpLvfvX9I76X2PAwphRQe1SQopKfAkHNBO+yW9ktvWxV1b7fGLPqSh BDDc08Ty27mwugTg/GFsaYhoqtWhboC5EPFehobml92RswVrdgghYwPFIMemClgSn/1S f9eDGuhidNeC40KWbpXy/Oy4sDm/fReV8Ck2cX83mMO2J/rgl7KPcX8GgaOS0iT5YAjb +D2ZlNXYa8xOVmnlFqRJ5EbQUmIeOhGxijHnc1pWUQvo1OIlSIuTBfyKUG8viBPg5Oyv e+5w== X-Gm-Message-State: AOAM530W8fZ+SOFMobSCxpw8ijLs4M2/8+LpDOvZwIyWOi02rNqX74nD v1EiicpVD2NqcshBq0DzrlTq5ACE/dtbeb+23NmmNl0ZK4s= X-Google-Smtp-Source: ABdhPJx5oo3uiUTzDCiYZrx7LAd2kfeTLNixNqdb8f/7G3MR2caT+cmi+HzOHvzzcaRXkVJAtKR3S9QlaQ67JoTqkHM= X-Received: by 2002:a17:906:7c82:: with SMTP id w2mr9385659ejo.87.1599258455682; Fri, 04 Sep 2020 15:27:35 -0700 (PDT) MIME-Version: 1.0 From: Shawn Emery Date: Fri, 4 Sep 2020 16:27:17 -0600 Message-ID: To: secdir Cc: last-call@ietf.org, draft-ietf-detnet-flow-information-model.all@ietf.org, Shawn Emery Content-Type: multipart/alternative; boundary="00000000000027b25105ae8460bf" Archived-At: Subject: [secdir] Review of draft-ietf-detnet-flow-information-model-10 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Sep 2020 22:27:42 -0000 --00000000000027b25105ae8460bf Content-Type: text/plain; charset="UTF-8" Reviewer: Shawn M. Emery Review result: Ready with nits I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. This informational draft specifies an information model for Deterministic Networking (DetNet), specifically for data at the IP/MPLS layer. The security considerations section does exist and recommends confidentiality for DetNet's external interfaces and that the knowledge of flows and services associated with customers and network operators could be used by an adversary to launch attacks against these networks. The section defers mitigation of said attacks to the ietf-detnet-security draft and defers to RFC 8655 for DetNet's overall security considerations. These documents provide some coverage in regards to the data model presented in this draft, but unfortunately does not describe how draft specific attributes, e.g. DnServiceRank could be used as a DoS attack. Having said this, when the data model does become a YANG model then DetNet will need to explicitly call out each of these attributes that have security implications, per YANG model guidelines. General comments: Having the draft-ietf-detnet-security draft is a really good idea to help augment this and other DetNet drafts. Having a comprehensive set of threats and how to mitigate against them provides a good foundation for other authors to think about. Editorial comments: s/can distinguished/can be distinguished/ s/flow using,/flow, using/ s/result data/result in data/ Shawn. -- --00000000000027b25105ae8460bf Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Reviewer: Shawn M. Emery=
Review result: Ready with nits

I have reviewed th= is document as part of the security directorate's
ongoing effort to = review all IETF documents being processed by the IESG.
These comments we= re written primarily for the benefit of the security
area directors. Doc= ument editors and WG chairs should treat these
comments just like any ot= her last call comments.

This informational draft specifies an inform= ation model for Deterministic Networking
(DetNet), specifically f= or data at the IP/MPLS layer.

The security consideratio= ns section does exist and recommends confidentiality
for DetNet&#= 39;s external interfaces and that the knowledge of flows and services
=
associated with customers and network operators could be used by an ad= versary
to launch attacks against these networks.=C2=A0 The secti= on defers mitigation of said attacks
to the ietf-detnet-security = draft and defers to RFC 8655 for DetNet's overall security
co= nsiderations.=C2=A0 These documents provide some coverage in regards to the= data model
presented in this draft, but unfortunately does not d= escribe how draft specific attributes, e.g.
DnServiceRank could b= e used as a DoS attack.=C2=A0 Having said this, when the data model does
become a YANG model then DetNet will need to explicitly call out ea= ch of these attributes that
have security implications, per YANG = model guidelines.

General comments:
=

Having the draft-ietf-detnet-security draft is a really= good idea to help augment this
and other DetNet drafts.=C2=A0 Ha= ving a comprehensive set of threats and how to mitigate
against t= hem provides a good foundation for other authors to think about.
<= div>
Editorial comments:

s/can d= istinguished/can be distinguished/
s/flow using,/flow, using/=
s/result data/result in data/

Shawn.
--
--00000000000027b25105ae8460bf-- From nobody Fri Sep 4 16:37:01 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 625F53A0D24; Fri, 4 Sep 2020 16:36:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id auPY3CvbK2Ex; Fri, 4 Sep 2020 16:36:54 -0700 (PDT) Received: from mail-pl1-x635.google.com (mail-pl1-x635.google.com [IPv6:2607:f8b0:4864:20::635]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7BD5B3A0D17; Fri, 4 Sep 2020 16:36:54 -0700 (PDT) Received: by mail-pl1-x635.google.com with SMTP id k13so1829970plk.13; Fri, 04 Sep 2020 16:36:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=p3GXccWW7VGhOM6CbJVjKgZd9e1JU59ovNvpUursJsk=; b=Crdig9/y7RePNHjlIW0wsMk8XQqYAekJtGPWznwibIt6U+IfH3H0RwsC3uqDyJk7LA wZ/H+kWgHDqjyfjshrBouvwAPL3iRlCv6UU1m20jUoA4FQYePvKbfhmVmSX1iK+Mhfc3 hxzb384y2kwu9j+lQ5h9Gcv6F9FXuYyPP4OqdUFg1KYcDwDqxytAnyFDi2AFw/Pxbypx oB8vpsVlBYOaEpOeGQdOkwGzoGsAe2Fm6Tfs7UKqgNpz+3sXSS4s63ORuCF0Abyoa5S4 GFJOC+t0B7bX61xMcSnQkmN8PYDbYe4jbCn1qUkDnsWTPep/tnzw2ojiriWwq+faQI8+ EZEA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=p3GXccWW7VGhOM6CbJVjKgZd9e1JU59ovNvpUursJsk=; b=JVTdgTjhBGWsn5VgQIA+3t/bjcNmabPz635FojHP2QcA3Kr2DRiRo6LumR5JNeuJLs SzWC/wFZUMeqdztMDhcasZPu4hb0DnIw7ur7BX7j9MZ5+xOACiCP2ReBiemS8xfb2nyj X9EiFLEyvGmCUi66aQiNlRnoIiwBDCT7TVJt7TfDu/hGfIWgFBUzKy9u3HL+cqBPsTcg Oz370EJ7nn60XQ8TcxOLMiaUdvjdmkKHw/CJXYginUyBU9J1ZB8W7avN98Ph9B4H9A3k NUZdNjiMGLXpZ4sldoTFrqLiGSWF3OPECfakzPG3jfhdT8zfC7MoTpdoztI9zg28/sC9 BTQw== X-Gm-Message-State: AOAM531GZRfLuHYnlpnNDgqdV4xIrdmlIT0kXG7LCmkk75PwlU8WitQ9 7LZ9b3oxV5m2pPVU1lUeE0E= X-Google-Smtp-Source: ABdhPJzdBNVY62QTPWdiPH0ZkzJVos8OsF3D22KUfYAUfWEKz4btNcePxvBN83RXlGVaiVjQHFZMoQ== X-Received: by 2002:a17:90b:30cd:: with SMTP id hi13mr10399544pjb.82.1599262613943; Fri, 04 Sep 2020 16:36:53 -0700 (PDT) Received: from [172.20.3.239] ([50.225.161.130]) by smtp.gmail.com with ESMTPSA id i14sm6084674pjy.24.2020.09.04.16.36.52 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Fri, 04 Sep 2020 16:36:52 -0700 (PDT) From: Brian Weis Message-Id: <38FBDE44-D2F4-44AD-BFF4-FBE9B6FC42DE@gmail.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_2BF700F4-6844-4184-A992-E70A00C08793" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.15\)) Date: Fri, 4 Sep 2020 16:36:48 -0700 In-Reply-To: Cc: "secdir@ietf.org" , "draft-ietf-spring-srv6-network-programming.all@ietf.org" , "spring@ietf.org" , "last-call@ietf.org" To: "Pablo Camarillo (pcamaril)" References: <159849805983.7699.460089427690333419@ietfa.amsl.com> X-Mailer: Apple Mail (2.3445.104.15) Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-spring-srv6-network-programming-17 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 04 Sep 2020 23:36:56 -0000 --Apple-Mail=_2BF700F4-6844-4184-A992-E70A00C08793 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Pablo, > On Sep 1, 2020, at 8:37 AM, Pablo Camarillo (pcamaril) = wrote: >=20 > Hi Brian, >=20 > Many thanks for the time you took to do a thorough review, please see = inline below with [PC]. >=20 > Cheers, > Pablo. >=20 > -----Original Message----- > From: Brian Weis via Datatracker >=20 > Sent: jueves, 27 de agosto de 2020 5:14 > To: secdir@ietf.org > Cc: draft-ietf-spring-srv6-network-programming.all@ietf.org = ; = spring@ietf.org ; last-call@ietf.org = > Subject: Secdir last call review of = draft-ietf-spring-srv6-network-programming-17 >=20 > Reviewer: Brian Weis > Review result: Has Nits >=20 > This document is titled =E2=80=9CSRv6 Network Programming=E2=80=9D, = which is attention grabbing. It fleshes out how Segment Routing routes = IPv6 packets by Segment ID (SID), as well as defining the format of a = SID for IPv6. The Introduction states, =E2=80=9CAn ingress node steers a = packet through an ordered list of instructions, called segments.=E2=80=9D = When one considers this statement along with the document title, it=E2=80=99= s apparent that network devices are indeed being given = =E2=80=9Cinstructions=E2=80=9D in the programming sense, where each = =E2=80=9Cinstruction=E2=80=9D is encoded in an IPv6 address. >=20 > An =E2=80=9Cinstruction=E2=80=9D (i.e., SRv6 SID) comprises a locator = (which is used to route to a particular network device), and also = directs the network device acting as the locator how to process the IPv6 = packet. With the help of an IPv6 Segment Routing Header (SRH) header, a = series of =E2=80=9Cinstructions=E2=80=9D can source route a packet = through the network, where each network device acting as a locator = learns how to handle the packet before possibly sending it on to the = next SID (if any). >=20 > The encoding of an IPv6 address as an SRv6 SID includes a locator, a = code indicating a certain function, and optionally arguments to that = function. An initial set of codes (and their associated algorithms) is = defined in this document. Most of the codes describe how the egress = router should decapsulate the packet, with might include defining which = routing table the receiving router should look up after decapsulation. >=20 > The Security Considerations section points to the Security = Considerations of the architecture document and the SRH document. Both = documents focus on the fact that SRv6 is intended to be used within a = single domain (e.g., provider > network) and discuss routing mitigations such as filtering external = traffic appropriately. They seem to assume that the boundaries of the = domain itself are inviolate such that the domain boundary devices are = not subverted, and that there are no bad actors within the domain. These = are common assumptions for service provider networks where Segment = Routing is intended to be deployed. >=20 > However, it cannot be certain that all networks deploying Service = Routing to be free of bad actors, and there will certainly be some = benefit to a bad actor changing =E2=80=9Cinstructions=E2=80=9D encoded = in IPv6 addresses. Perhaps there is opportunity for mischief in changing = the routing table argument in an End.DT46, for example. Also, as other = SRv6 functions are defined (e.g., packet inspection functions), it would = be important to ensure that those SIDs are not modified to avoid or = decrease the quality of those inspection functions. >=20 > [PC] Indeed, the assumption that a domain is free of bad actors is a = common assumption for networks where SRv6 is intended to be deployed. = The security section of RFC8754 does talk about these bad actor attacks = (7.1) on such networks, and other types of attacks they can launch. >=20 > The SRH document does describe an HMAC TLV that is intended to = mitigate these kinds of attacks. Since neither of the referenced = documents Security Considerations mention it, it would be a good idea to = describe here that there are threats to changing SIDs, and point out how = to mitigate them with the HMAC TLV. >=20 > [PC] The HMAC TLV allows a segment endpoint node to "verify that the = SRH applied to a packet was selected by an authorized party and to = ensure that the segment list is not modified after generation." We = could call this out specifically in the security section. > > Together, they describe the required security mechanisms > that allow establishment of an SR domain of trust to operate > SRv6-based services for internal traffic while preventing any > external traffic from accessing or exploiting the SRv6-based > services. =20 > > > Together, they describe the required security mechanisms > that allow establishment of an SR domain of trust to operate > SRv6-based services for internal traffic while preventing any > external traffic from accessing or exploiting the SRv6-based > services. Additionally, RFC8754 defines an HMAC TLV permitting nodes = in the SR domain to verify that the SRH applied to a packet was selected = by an authorized party and to ensure that the segment list is not = modified after generation, providing further protection against bad = actors within the SR domain. > The new wording sounds good to me, thanks. >=20 > Also, if I=E2=80=99m not mistaken, when there is just one SID then it = is placed in the > IPv6 DA and there is no SRH header or HMAC TLV.=20 >=20 > [PC] The SRH MAY be included when there is just one SID if flags or = TLVs are required (RFC8754 section 4.1 paragraph 1) so the HMAC TLV may = be used in this case. This might be good to point out too. How about putting it in context of = this section something like this: =E2=80=9CWhen modification detection = is deemed important, an SRH header with an HMAC TLV SHOULD be included = even when just one SID is required. This ensures that the SID is = protected just as when the SRH is used to carry multiple SIDs.=E2=80=9D. = I recognize this is adding a new normative requirement, but it is = dependent on the first clause being true so might not be so = objectionable. Thanks, Brian >=20 > This is a general problem with ensuring that the DA on packets are not = changed in transit, and one could use IPsec to mitigate that issue. = It=E2=80=99s probably worthwhile mentioning something like that. --Apple-Mail=_2BF700F4-6844-4184-A992-E70A00C08793 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi = Pablo,

On Sep 1, 2020, at 8:37 AM, Pablo Camarillo = (pcamaril) <pcamaril@cisco.com> wrote:

Hi Brian,

Many thanks for the time you = took to do a thorough review, please see inline below with = [PC].

Cheers,
Pablo.

-----Original Message-----
From: Brian Weis via Datatracker <noreply@ietf.org> 
Sent: jueves, 27 de agosto de = 2020 5:14
To: secdir@ietf.org
Cc: draft-ietf-spring-srv6-network-programming.all@ietf.org; spring@ietf.org; last-call@ietf.org
Subject: Secdir last call review = of draft-ietf-spring-srv6-network-programming-17

Reviewer: Brian Weis
Review result: Has = Nits

This document = is titled =E2=80=9CSRv6 Network Programming=E2=80=9D, which is attention = grabbing. It fleshes out how Segment Routing routes IPv6 packets by = Segment ID (SID), as well as defining the format of a SID for IPv6. The = Introduction states, =E2=80=9CAn ingress node steers a packet through an = ordered list of instructions, called segments.=E2=80=9D When one = considers this statement along with the document title, it=E2=80=99s = apparent that network devices are indeed being given =E2=80=9Cinstructions= =E2=80=9D in the programming sense, where each =E2=80=9Cinstruction=E2=80=9D= is encoded in an IPv6 address.

An =E2=80=9Cinstruction=E2=80=9D (i.e., SRv6 SID) comprises a = locator (which is used to route to a particular network device), and = also directs the network device acting as the locator how to process the = IPv6 packet. With the help of an IPv6 Segment Routing Header (SRH) = header, a series of =E2=80=9Cinstructions=E2=80=9D can source route a = packet through the network, where each network device acting as a = locator learns how to handle the packet before possibly sending it on to = the next SID (if any).

The encoding of an IPv6 address as an SRv6 SID includes a = locator, a code indicating a certain function, and optionally arguments = to that function. An initial set of codes (and their associated = algorithms) is defined in this document. Most of the codes describe how = the egress router should decapsulate the packet, with might include = defining  which routing table the receiving router should look up = after decapsulation.

The Security Considerations section points to the Security = Considerations of the architecture document and the SRH document. Both = documents focus on the fact that SRv6 is intended to be used within a = single domain (e.g., provider
network) and discuss routing mitigations such as filtering = external traffic appropriately. They seem to assume that the boundaries = of the domain itself are inviolate such that the domain boundary devices = are not subverted, and that there are no bad actors within the domain. = These are common assumptions for service provider networks where Segment = Routing is intended to be deployed.

However, it cannot be certain that all networks deploying = Service Routing to be free of bad actors, and there will certainly be = some benefit to a bad actor changing =E2=80=9Cinstructions=E2=80=9D = encoded in IPv6 addresses. Perhaps there is opportunity for mischief in = changing the routing table argument in an End.DT46, for example. = Also, as other SRv6 functions are defined (e.g., packet inspection = functions), it would be important to ensure that those SIDs are not = modified to avoid or decrease the quality of those inspection = functions.

[PC] Indeed, = the assumption that a domain is free of bad actors is a common = assumption for networks where SRv6 is intended to be deployed. The = security section of RFC8754 does talk about these bad actor attacks = (7.1) on such networks, and other types of attacks they can = launch.

The SRH = document does describe an HMAC TLV that is intended to mitigate these = kinds of attacks. Since neither of the referenced documents Security = Considerations mention it, it would be a good idea to describe here that = there are threats to changing SIDs, and point out how to mitigate them = with the HMAC TLV.

[PC] The HMAC TLV allows a segment endpoint node to "verify = that the SRH applied to a packet was selected by an authorized party and = to ensure that the segment list is not modified after generation." =  We could call this out specifically in the security = section.
<OLD>
Together, they describe the required security = mechanisms
  that allow establishment of an SR domain of trust = to operate
  SRv6-based services for internal traffic while = preventing any
  external traffic from accessing or exploiting the = SRv6-based
  services.  
</OLD>
<NEW>
Together, they describe the required security = mechanisms
  that allow establishment of an SR domain of trust = to operate
  SRv6-based services for internal traffic while = preventing any
  external traffic from accessing or exploiting the = SRv6-based
  services. Additionally, RFC8754 defines an HMAC = TLV permitting nodes in the SR domain to verify that the SRH applied to = a packet was selected by an authorized party and to ensure that the = segment list is not modified after generation, providing further = protection against bad actors within the SR domain.
</NEW>

The new wording = sounds good to me, thanks.

Also, if I=E2=80=99m not mistaken, when there is just one SID = then it is placed in the
IPv6 DA and there is no SRH header or HMAC TLV. 

[PC] The SRH MAY be included = when there is just one SID if flags or TLVs are required (RFC8754 = section 4.1 paragraph 1) so the HMAC TLV may be used in this = case.

This = might be good to point out too. How about putting it in context of this = section something like this: =E2=80=9CWhen modification detection is = deemed important, an SRH header with an HMAC TLV SHOULD be included even = when just one SID is required. This ensures that the SID is protected = just as when the SRH is used to carry multiple SIDs.=E2=80=9D. I = recognize this is adding a new normative requirement, but it is = dependent on the first clause being true so might not be so = objectionable.

Thanks,
Brian


This is a general problem with = ensuring that the DA on packets are not changed in transit, and one = could use IPsec to mitigate that issue. It=E2=80=99s probably worthwhile = mentioning something like that.

= --Apple-Mail=_2BF700F4-6844-4184-A992-E70A00C08793-- From nobody Sat Sep 5 03:45:05 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E75F83A08AD for ; Sat, 5 Sep 2020 03:45:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mcafee.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iajAu4GmIEgt for ; Sat, 5 Sep 2020 03:45:02 -0700 (PDT) Received: from us-smtp-delivery-140.mimecast.com (us-smtp-delivery-140.mimecast.com [216.205.24.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6D79B3A0832 for ; Sat, 5 Sep 2020 03:45:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mcafee.com; s=mimecast20190606; t=1599302701; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type; bh=NvC4ZKwK/0T5S1BR76CrZrmWullKYnV4gOP3fkKc5NY=; b=RK0mIpijUTDIfumvLtvhRlgcKn1TN9UiAOyMbOZQrys3VqMg1yzfV/2mj0q0C0BCem/ZjX 9+dVamUWZWzifeoW+4JkQFnHeKhHjoMn28Bh7AG37oIFU+sQPwtFvjxuItPkrv+EFHpheb fWkqB6PCBJRj5tl7NQfWLuLTm16vEgw= Received: from NAM02-CY1-obe.outbound.protection.outlook.com (mail-cys01nam02lp2053.outbound.protection.outlook.com [104.47.37.53]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-173-rJSp-UC1PZi3EEcnL1Uufg-1; Sat, 05 Sep 2020 06:43:50 -0400 X-MC-Unique: rJSp-UC1PZi3EEcnL1Uufg-1 Received: from MWHPR16MB1535.namprd16.prod.outlook.com (2603:10b6:320:27::22) by MW2PR16MB2331.namprd16.prod.outlook.com (2603:10b6:907:c::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3348.15; Sat, 5 Sep 2020 10:43:48 +0000 Received: from MWHPR16MB1535.namprd16.prod.outlook.com ([fe80::2c6f:d09b:e22a:4a47]) by MWHPR16MB1535.namprd16.prod.outlook.com ([fe80::2c6f:d09b:e22a:4a47%11]) with mapi id 15.20.3348.017; Sat, 5 Sep 2020 10:43:48 +0000 From: "Konda, Tirumaleswar Reddy" To: "secdir@ietf.org" , "draft-ietf-roll-turnon-rfc8138.all@ietf.org" , "roll@ietf.org" Thread-Topic: Secdir last call review of draft-ietf-roll-turnon-rfc8138-12 Thread-Index: AdaDbUeaqdHV2jK6QYKG8VqxeX1QTw== Date: Sat, 5 Sep 2020 10:43:48 +0000 Message-ID: Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-version: 11.5.0.60 dlp-reaction: no-action x-originating-ip: [49.37.200.126] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: e6d523a4-66ac-4c81-df56-08d85188925a x-ms-traffictypediagnostic: MW2PR16MB2331: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8273; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: HE3Qv6ym2jskfJLXNJExUEsW+n4cINFHIxOQSVsKJ7eChZSy27PnuZ2lGZr0L1AQNrJvz9FeSFG4oCB7UGY2DMQHs/j39j1PQhbeB7zWp3tXiLCh7XpLx5pg9pYYq/ZZBCP+1BJisbAbnR++0LWOnICtPIugJhn1zc+9IlIrQyBZW6GwDhSks2e8yI2CNZZf6nUq2bDihcQ2zl6KG7eGg5b3GXan3qENrky7rArfdE+qEJhYLgbH+1OY+FyP0E5hwGe9Y3fyn/MWlP4zGY/E3DLZI2+9pbMWDDQBsYMBZJZzGHDZ5nP8WtYZ8lcZPCDU9ymxu4PpKn9QFEG67TlbA8QJGWRQgZQZcI4pslEwJEl3XZydwhvye3ctr9JzLXIxmd6pKqPn3fVeuNpuRviOdQ== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:MWHPR16MB1535.namprd16.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(396003)(366004)(346002)(376002)(39860400002)(136003)(32952001)(26005)(33656002)(2906002)(8936002)(186003)(8676002)(316002)(6506007)(55016002)(7696005)(110136005)(9686003)(450100002)(76116006)(478600001)(66446008)(66946007)(64756008)(66476007)(83380400001)(66556008)(66574015)(71200400001)(52536014)(5660300002)(86362001)(85282002); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: l8kOVj9k0ZGo0NuaJWburuUAueP/X30k1m55PhjpdxfZLsfBIsSofCDoym3dHm/l2joIfMC+gOXE6T6BPhoTTzlWKMXrseSxHEaN4foQjzIjL6UpbY78RPj05IypPsCltmpCiiGGexxZ3Pk+SsXAxHz4fEPMG+aZ3ME6AbyjjDWrV4ccogVk1sFLZfUejeAu/04riPvGSJK9gmVH7VwTkKEYzuO3Kqt4b5DieBHuhmr5PjN1Qd5egRSsUUcE2WJp3J8Hd3wVcml/X5/XPJvI6Z+QdLp/vz5a8WxtcWTz3rjbRgSOaLTFuvtVvibYQAP41DKpUpvEeyNP+f4wKTRY25bWJo9Cgy8uX6ghVohRABUaVXchwgkt3x/BTQbOZZNEEPSaHo608IDCK4VMVXtmU31jhzENXtTdWWTkrsS7tHwQt6R2b5HFzWAc2+VMJCfefsOtl1yp3w8ZxZ7y6mykU0jQpeYHkdmvjjDwpcVmvFmOxxDdQocf+07HauPvWo1S8t5WQxT7U0IAZT/yBAMWmCqvwye7U4rXdbnC3sZTuDGTx1W5hRgWUn1Q2jkNLY9g9afEGkGgzSPHrJp8iGm/kfBlgNT239m3dAZMfgDJC7JuBUPDuoh+Qx1hZtIZKux4SPOhELHU86+fjIxFVs3JpQ== x-ms-exchange-transport-forked: True MIME-Version: 1.0 X-OriginatorOrg: mcafee.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: MWHPR16MB1535.namprd16.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: e6d523a4-66ac-4c81-df56-08d85188925a X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Sep 2020 10:43:48.4696 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 4943e38c-6dd4-428c-886d-24932bc2d5de X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: QgL8jCXTOjAihPJ7X07mucdM5LFbz7tnM7nUOnHfbh6w18i/zPTWjSNDks/B6sh1Hatl/LJ5Soy3P0Tf775cOfHgo3Xxwc3VcxRlkrXPggiVYmexEsbOrXIsQT0CLb2S X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW2PR16MB2331 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA40A35 smtp.mailfrom=tirumaleswarreddy_konda@mcafee.com X-Mimecast-Spam-Score: 0.002 X-Mimecast-Originator: mcafee.com Content-Type: multipart/alternative; boundary="_000_MWHPR16MB15352A9604389BC647A87A5FEA2A0MWHPR16MB1535namp_" Content-Language: en-US Archived-At: Subject: [secdir] Secdir last call review of draft-ietf-roll-turnon-rfc8138-12 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 05 Sep 2020 10:45:04 -0000 --_000_MWHPR16MB15352A9604389BC647A87A5FEA2A0MWHPR16MB1535namp_ Content-Type: text/plain; charset=WINDOWS-1252 Content-Transfer-Encoding: quoted-printable Reviewer: Tirumaleswar Reddy Review result: Ready with nits I have reviewed this document as part of the security directorate's ongoing= effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area = directors. Document editors and WG chairs should treat these comments just= like any other last call comments. Summary: Ready with nits [1] You may want to clarify how the attacker manages to modify a protected = configuration including the "T" flag introduced in this spec. [2] Is it possible to identify the attacker (or compromised router) who set= the "T" flag to remediation measures ? [3] If due to an human error one or more of the on-path routers are not upg= raded or if the router sees both settings, I presume an alert could be sent= to the network management for troubleshooting. You may want to add text to= discuss the same. [4] What do you mean by "subDAG" (I don't see any definition in this spec a= nd RFC8138) ? Cheers, -Tiru --_000_MWHPR16MB15352A9604389BC647A87A5FEA2A0MWHPR16MB1535namp_ Content-Type: text/html; charset=WINDOWS-1252 Content-Transfer-Encoding: quoted-printable

Reviewer: Tirumaleswar Reddy

Review result: Ready with nits

 

I have reviewed this document as part of the securit= y directorate's ongoing effort to review all IETF documents being processed= by the IESG.

These comments were written primarily for the benefi= t of the security area directors.  Document editors and WG chairs shou= ld treat these comments just like any other last call comments.<= /p>

 

Summary: Ready with nits

 

[1] You may want to clarify how the attacker manages= to modify a protected configuration including the “T” flag int= roduced in this spec.

[2] Is it possible to identify the attacker (or comp= romised router) who set the “T” flag to remediation measures ?<= o:p>

[3] If due to an human error one or more of the on-p= ath routers are not upgraded or if the router sees both settings, I presume= an alert could be sent to the network management for troubleshooting. You = may want to add text to discuss the same.

[4] What do you mean by “subDAG” (I don&= #8217;t see any definition in this spec and RFC8138) ?

 

Cheers,

-Tiru

 

 

 

--_000_MWHPR16MB15352A9604389BC647A87A5FEA2A0MWHPR16MB1535namp_-- From nobody Sun Sep 6 09:35:02 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 86BBC3A0C9B; Sun, 6 Sep 2020 09:35:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id byJUUCmuVk4i; Sun, 6 Sep 2020 09:34:58 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 634493A0C9A; Sun, 6 Sep 2020 09:34:58 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id B4F45389BD; Sun, 6 Sep 2020 12:13:46 -0400 (EDT) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 0b6jFDXGSdQy; Sun, 6 Sep 2020 12:13:44 -0400 (EDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id AB580389B4; Sun, 6 Sep 2020 12:13:44 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 9EE44FB; Sun, 6 Sep 2020 12:34:52 -0400 (EDT) From: Michael Richardson To: Routing Over Low power and Lossy networks cc: "secdir\@ietf.org" , "draft-ietf-roll-turnon-rfc8138.all\@ietf.org" In-Reply-To: References: X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [secdir] [Roll] Secdir last call review of draft-ietf-roll-turnon-rfc8138-12 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 06 Sep 2020 16:35:01 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Thank you for the review. Konda, Tirumaleswar Reddy wrote: > [1] You may want to clarify how the attacker manages to modify a > protected configuration including the "T" flag introduced in this > spec. Every router within every routing protocol can do wrong things :-) RPL is an IGP, so all routers are within the same security control, and at the same level. An attacker would have to introduce malware into the device to modify data. RFC7416 lays out all of these threats: they are no different for the T-bit than other bits. > [2] Is it possible to identify the attacker (or compromised router) w= ho > set the "T" flag to remediation measures ? Maybe. Probably not. There are few things we can do within any routing protocol to identify mis-behaving routers. > [3] If due to an human error one or more of the on-path routers are n= ot > upgraded or if the router sees both settings, I presume an alert could > be sent to the network management for troubleshooting. You may want to > add text to discuss the same. At present, RPL does not include a standard off-path alerting mechanism. This remains a todo item for the WG. Some use NETCONF or HTTP to collect statistics in a proprietary way. We can send ICMPs, but since the affects how the packets are encoded, we likely can't send an ICMP to a relevant router, just one hop in the directi= on it came from. > [4] What do you mean by "subDAG" (I don't see any definition in this = spec and RFC8138) ? It's a sub-portion of a DAG. A sub-tree. =2D- Michael Richardson . o O ( IPv6 I=C3=B8T consulti= ng ) Sandelman Software Works Inc, Ottawa and Worldwide --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl9VD6wACgkQgItw+93Q 3WWCtQf9Gtw30DmX89Oldz88VDG6tAhX2Sjn/iNO+Z0BOMRUZLkYYMTlrz3Bv8fx Wg5XahYseuT7Z9cAhYIrTb4tNs3vMM8iKe8qPa1fJ6aVgMfvJPDiuSGaRUsDhkal y/PC7jlbE+3wN+bEzduq1b/hhPFV7rUTkFEkKbwKw/hCr4EUr9yyIdQRmotRsL8f 5V8HG2Nz1owLweXYBcxwL9HO9sXufjnKUs2mjir8RUi3UI9H2qicdyCKUf3ek4X7 9a0ENXTr+ZoPirS4ImALN0+O4Ofg9/CvXITe6HCgfRbtlDw7+kliL7hX1aU8UG6a rnFhjvQh+kpx7DmLFdN4YmhqVezBPA== =Ae+/ -----END PGP SIGNATURE----- --=-=-=-- From nobody Sun Sep 6 23:24:30 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 800AE3A15AC for ; Sun, 6 Sep 2020 23:24:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mcafee.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id O6fU7C-oKcI7 for ; Sun, 6 Sep 2020 23:24:21 -0700 (PDT) Received: from us-smtp-delivery-140.mimecast.com (us-smtp-delivery-140.mimecast.com [63.128.21.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BC2193A15AB for ; Sun, 6 Sep 2020 23:24:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mcafee.com; s=mimecast20190606; t=1599459860; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=RzoMIbHxk6nWZR5ygJJhG1CBjaaYZDHVIX95zWqwKPs=; b=DwfkXlzPjj90KMFTwCCGfRTnuralAJA2v6oX4/MA+gaRHjqD+960bBLP3rGSLbDEBrjRLo PKw7dZaOZwTpZwh2WNse3YQNE/ezJT4of7vCsrfqOIFTTkUcI6fiY7C0liBZOENwPhLlgX HkZyDiKt6BJPelZ1AD/knGxU0b4gD9Y= Received: from NAM11-BN8-obe.outbound.protection.outlook.com (mail-bn8nam11lp2174.outbound.protection.outlook.com [104.47.58.174]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-204-A52VRWzMN2aWKHBU0_JtDw-1; Mon, 07 Sep 2020 02:24:18 -0400 X-MC-Unique: A52VRWzMN2aWKHBU0_JtDw-1 Received: from MWHPR16MB1535.namprd16.prod.outlook.com (2603:10b6:320:27::22) by MWHPR1601MB1181.namprd16.prod.outlook.com (2603:10b6:300:eb::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3348.16; Mon, 7 Sep 2020 06:24:17 +0000 Received: from MWHPR16MB1535.namprd16.prod.outlook.com ([fe80::2c6f:d09b:e22a:4a47]) by MWHPR16MB1535.namprd16.prod.outlook.com ([fe80::2c6f:d09b:e22a:4a47%11]) with mapi id 15.20.3348.019; Mon, 7 Sep 2020 06:24:17 +0000 From: "Konda, Tirumaleswar Reddy" To: Michael Richardson , Routing Over Low power and Lossy networks CC: "draft-ietf-roll-turnon-rfc8138.all@ietf.org" , "secdir@ietf.org" Thread-Topic: [secdir] [Roll] Secdir last call review of draft-ietf-roll-turnon-rfc8138-12 Thread-Index: AdaDbUeaqdHV2jK6QYKG8VqxeX1QTwA/l14AABwPsvA= Date: Mon, 7 Sep 2020 06:24:17 +0000 Message-ID: References: <1440.1599410092@localhost> In-Reply-To: <1440.1599410092@localhost> Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-version: 11.5.0.60 dlp-reaction: no-action x-originating-ip: [49.37.200.126] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 2a5ceeae-74a0-4049-9962-08d852f6a5f4 x-ms-traffictypediagnostic: MWHPR1601MB1181: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: 2lwu/nN0tYcyhZp+TXFG0Sq8e+UFX5g4bm4C4dCXgMcf460gfFtSUq8zi/m5aSK+TcJkN6xwseVkEVHNAP9ry5cQq7+wtf/JRp43Yw1DXUZn/AZ6h/kuAkZdFaYyBKZPvDmYrO+xhBy/O+XKGFI2ffTPAJqybqE4saRIHBOMobbzEIjKdJjVDR/FMDzyN9g7PCLQSSVthDpJZLt0wgxL1StkTLift6oaZDk06uXEl9ZL6Yqs/hgxvWp01KOor2gtJKakA52s68/NzbGGLTRKMdqsAo1A5W8OR07jYlNOAlk8M1kLdfCdsijG1NTEY3E3KKvAi07r2GAHUd7dkbQLv9hyziII/43UmmRN/sqP8LbSIuaMUst96ehFTonCozQN0FEt6xV2EqYIn2G4D8mpsA== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:MWHPR16MB1535.namprd16.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(376002)(136003)(346002)(39860400002)(396003)(366004)(32952001)(9686003)(8676002)(7696005)(55016002)(66946007)(186003)(2906002)(76116006)(66476007)(66556008)(64756008)(66446008)(8936002)(5660300002)(6506007)(53546011)(52536014)(110136005)(316002)(478600001)(26005)(54906003)(86362001)(66574015)(4326008)(33656002)(83380400001)(71200400001)(85282002); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: aLvBnW0YzYEpjagCT7X1cmI/++ACBTu6ckzUhYQrsIO8u5HJcHpvV8HWwIp5rsTry0ZUNxUGcLEfQxbX9xSPJ/FL03XCWRcbY8pQPiZ6ArFWGWZ5imJVxkXRCExX+j1vQpuQrltKAO1zqmRyY+MjQVKmR1sQwUAJ8MENSi07El3PoOpcmOzr7MxVHVkCO4JberBzQHCDVc3uoj9x8L2+hV57/oyCnGmQHKktUDUE1qfVu11tQ4mDKSQbcwgK5jKiCN0g+qopeWxW3bYo7OJSy9p40PhjTXVD/Og54O36MhwWAaJt6wZDK/oHzOxmIRQsp0BH6XZv1zLkX3KlWVm3ErFLS6dqGlnYCRgUGH9lLQSfkiV7JyacF/8I51lQRikc56grClMlQZ8bC1hsg442hFZDaGF5+9iFcUZVltbyVx/qUlI25pHU/mK/Bp1H1gqoa897uv4mh+SzyMVEKKNlQVtkfpnduVuo1m+yAv3i4IO8dNoQrTR/MbhdA53bahgkKD6UeaFoV0r7dA3gOb9kfikk+kaKNMUrWKl7Hi0pGp3VFOkHobTd6XEzM6ZZ3asJvIpuSW/+oMKW7fx/OC+ov02DTTfiDUUhSgMpdJN8NS25vUSRufASDmrvPmj90uutqFtv0WON7cxDAL3wMaeuiQ== x-ms-exchange-transport-forked: True MIME-Version: 1.0 X-OriginatorOrg: mcafee.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: MWHPR16MB1535.namprd16.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 2a5ceeae-74a0-4049-9962-08d852f6a5f4 X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Sep 2020 06:24:17.1548 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 4943e38c-6dd4-428c-886d-24932bc2d5de X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: nNHA+IVHanad/F2pGbpPqTBPMTLFNH/5zaf1VngQkwRYNM2WMBCmUdj40PkktK/hiIXY4MGTT9HrfmwgvuTgARdm/+GoPCzLFYLzXJADPwu2G/yMN+T69z10AFDc2I0y X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR1601MB1181 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA40A35 smtp.mailfrom=tirumaleswarreddy_konda@mcafee.com X-Mimecast-Spam-Score: 0.004 X-Mimecast-Originator: mcafee.com Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: base64 Content-Language: en-US Archived-At: Subject: Re: [secdir] [Roll] Secdir last call review of draft-ietf-roll-turnon-rfc8138-12 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Sep 2020 06:24:24 -0000 PiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KPiBGcm9tOiBzZWNkaXIgPHNlY2Rpci1ib3Vu Y2VzQGlldGYub3JnPiBPbiBCZWhhbGYgT2YgTWljaGFlbCBSaWNoYXJkc29uDQo+IFNlbnQ6IFN1 bmRheSwgU2VwdGVtYmVyIDYsIDIwMjAgMTA6MDUgUE0NCj4gVG86IFJvdXRpbmcgT3ZlciBMb3cg cG93ZXIgYW5kIExvc3N5IG5ldHdvcmtzIDxyb2xsQGlldGYub3JnPg0KPiBDYzogZHJhZnQtaWV0 Zi1yb2xsLXR1cm5vbi1yZmM4MTM4LmFsbEBpZXRmLm9yZzsgc2VjZGlyQGlldGYub3JnDQo+IFN1 YmplY3Q6IFJlOiBbc2VjZGlyXSBbUm9sbF0gU2VjZGlyIGxhc3QgY2FsbCByZXZpZXcgb2YgZHJh ZnQtaWV0Zi1yb2xsLXR1cm5vbi0NCj4gcmZjODEzOC0xMg0KPiANCj4gDQo+IFRoYW5rIHlvdSBm b3IgdGhlIHJldmlldy4NCj4gDQo+IEtvbmRhLCBUaXJ1bWFsZXN3YXIgUmVkZHkgPFRpcnVtYWxl c3dhclJlZGR5X0tvbmRhQE1jQWZlZS5jb20+DQo+IHdyb3RlOg0KPiAgICAgPiBbMV0gWW91IG1h eSB3YW50IHRvIGNsYXJpZnkgaG93IHRoZSBhdHRhY2tlciBtYW5hZ2VzIHRvIG1vZGlmeSBhDQo+ ICAgICA+IHByb3RlY3RlZCBjb25maWd1cmF0aW9uIGluY2x1ZGluZyB0aGUgIlQiIGZsYWcgaW50 cm9kdWNlZCBpbiB0aGlzDQo+ICAgICA+IHNwZWMuDQo+IA0KPiBFdmVyeSByb3V0ZXIgd2l0aGlu IGV2ZXJ5IHJvdXRpbmcgcHJvdG9jb2wgY2FuIGRvIHdyb25nIHRoaW5ncyA6LSkgUlBMIGlzIGFu DQo+IElHUCwgc28gYWxsIHJvdXRlcnMgYXJlIHdpdGhpbiB0aGUgc2FtZSBzZWN1cml0eSBjb250 cm9sLCBhbmQgYXQgdGhlIHNhbWUgbGV2ZWwuDQo+IA0KPiBBbiBhdHRhY2tlciB3b3VsZCBoYXZl IHRvIGludHJvZHVjZSBtYWx3YXJlIGludG8gdGhlIGRldmljZSB0byBtb2RpZnkgZGF0YS4NCj4g UkZDNzQxNiBsYXlzIG91dCBhbGwgb2YgdGhlc2UgdGhyZWF0czogdGhleSBhcmUgbm8gZGlmZmVy ZW50IGZvciB0aGUgVC1iaXQgdGhhbg0KPiBvdGhlciBiaXRzLg0KDQpHb3QgaXQuIEEgcmVmZXJl bmNlIHRvIFJGQzc0MTYgd2lsbCBiZSBoZWxwZnVsIHRvIHVuZGVyc3RhbmQgdGhlIHRocmVhdCBt b2RlbC4NCg0KPiANCj4gICAgID4gWzJdIElzIGl0IHBvc3NpYmxlIHRvIGlkZW50aWZ5IHRoZSBh dHRhY2tlciAob3IgY29tcHJvbWlzZWQgcm91dGVyKSB3aG8NCj4gICAgID4gc2V0IHRoZSAiVCIg ZmxhZyB0byByZW1lZGlhdGlvbiBtZWFzdXJlcyA/DQo+IA0KPiBNYXliZS4gUHJvYmFibHkgbm90 Lg0KPiBUaGVyZSBhcmUgZmV3IHRoaW5ncyB3ZSBjYW4gZG8gd2l0aGluIGFueSByb3V0aW5nIHBy b3RvY29sIHRvIGlkZW50aWZ5IG1pcy0NCj4gYmVoYXZpbmcgcm91dGVycy4NCg0KUGxlYXNlIGFk ZCBhIHJlZmVyZW5jZSB0byB0aGUgdGVjaG5pcXVlcyB0aGF0IGNhbiBiZSB1c2VkIHRvIGRldGVj dCBtaXMtYmVoYXZpbmcgcm91dGVycy4NCg0KPiANCj4gICAgID4gWzNdIElmIGR1ZSB0byBhbiBo dW1hbiBlcnJvciBvbmUgb3IgbW9yZSBvZiB0aGUgb24tcGF0aCByb3V0ZXJzIGFyZSBub3QNCj4g ICAgID4gdXBncmFkZWQgb3IgaWYgdGhlIHJvdXRlciBzZWVzIGJvdGggc2V0dGluZ3MsIEkgcHJl c3VtZSBhbiBhbGVydCBjb3VsZA0KPiAgICAgPiBiZSBzZW50IHRvIHRoZSBuZXR3b3JrIG1hbmFn ZW1lbnQgZm9yIHRyb3VibGVzaG9vdGluZy4gWW91IG1heSB3YW50DQo+IHRvDQo+ICAgICA+IGFk ZCB0ZXh0IHRvIGRpc2N1c3MgdGhlIHNhbWUuDQo+IA0KPiBBdCBwcmVzZW50LCBSUEwgZG9lcyBu b3QgaW5jbHVkZSBhIHN0YW5kYXJkIG9mZi1wYXRoIGFsZXJ0aW5nIG1lY2hhbmlzbS4NCj4gVGhp cyByZW1haW5zIGEgdG9kbyBpdGVtIGZvciB0aGUgV0cuDQo+IFNvbWUgdXNlIE5FVENPTkYgb3Ig SFRUUCB0byBjb2xsZWN0IHN0YXRpc3RpY3MgaW4gYSBwcm9wcmlldGFyeSB3YXkuDQoNCkkgdGhp bmsgYSBwcm9wcmlldGFyeSB3YXkgY2FuIGFsc28gYmUgZGlzY3Vzc2VkIHRvIHNob3djYXNlIHRo ZSBjdXJyZW50IHByYWN0aWNlcyBmb3IgdHJvdWJsZXNob290aW5nLg0KDQo+IFdlIGNhbiBzZW5k IElDTVBzLCBidXQgc2luY2UgdGhlIGFmZmVjdHMgaG93IHRoZSBwYWNrZXRzIGFyZSBlbmNvZGVk LCB3ZQ0KPiBsaWtlbHkgY2FuJ3Qgc2VuZCBhbiBJQ01QIHRvIGEgcmVsZXZhbnQgcm91dGVyLCBq dXN0IG9uZSBob3AgaW4gdGhlIGRpcmVjdGlvbiBpdA0KPiBjYW1lIGZyb20uDQoNCj4gICAgID4g WzRdIFdoYXQgZG8geW91IG1lYW4gYnkgInN1YkRBRyIgKEkgZG9uJ3Qgc2VlIGFueSBkZWZpbml0 aW9uIGluIHRoaXMNCj4gc3BlYyBhbmQgUkZDODEzOCkgPw0KPiANCj4gSXQncyBhIHN1Yi1wb3J0 aW9uIG9mIGEgREFHLiBBIHN1Yi10cmVlLg0KDQpPa2F5LCB5b3UgbWF5IHdhbnQgdG8gZXhwYW5k ICJzdWJEQUciLg0KDQotVGlydQ0KDQo+IA0KPiANCj4gLS0NCj4gTWljaGFlbCBSaWNoYXJkc29u IDxtY3IrSUVURkBzYW5kZWxtYW4uY2E+ICAgLiBvIE8gKCBJUHY2IEnDuFQgY29uc3VsdGluZyAp DQo+ICAgICAgICAgICAgU2FuZGVsbWFuIFNvZnR3YXJlIFdvcmtzIEluYywgT3R0YXdhIGFuZCBX b3JsZHdpZGUNCj4gDQo+IA0KPiANCg0K From nobody Mon Sep 7 01:21:54 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 84EB83A08BB; Mon, 7 Sep 2020 01:21:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.598 X-Spam-Level: X-Spam-Status: No, score=-9.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=aQGG0nPV; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=tJukb5AZ Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dOKkABy1pO5D; Mon, 7 Sep 2020 01:21:48 -0700 (PDT) Received: from alln-iport-3.cisco.com (alln-iport-3.cisco.com [173.37.142.90]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CE9923A0816; Mon, 7 Sep 2020 01:21:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=4106; q=dns/txt; s=iport; t=1599466907; x=1600676507; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=m8w/dw4JP5Q/DkS16IT+KHXEyJrDDb12REplQHT/cpo=; b=aQGG0nPVLLEQ4DelWGsjrf6uFjza4cA2lX0wM1hAq0PVilhdvqU2oKEg eCiMNFD3mDuNYqi9Eq+Dvj+R3Q96tE7dZ2bK5c2yIZTPtkC8he3JC3Xb8 U7JfYErkW4mP/D60p/l8yhRgLHqoLEQCuw4OrBKxbjYjFUdBeaz3GkL6u o=; X-IPAS-Result: =?us-ascii?q?A0D3AABT7FVf/4sNJK1VCh0BAQEBCQESAQUFAUCBPQYBC?= =?us-ascii?q?wGBUVEHcFkvLIEvgwmDRgONb4Uok0mBLhSBEQNVCwEBAQwBASUIAgQBAQ+EP?= =?us-ascii?q?AIXgiECJDYHDgIDAQEBAwIDAQEBAQUBAQECAQYEbYVcDIVyAQEBAQIBEhERD?= =?us-ascii?q?AEBNwEPAgEIGAICJgICAjAVEAEBBA4FCBqDBYJLAw4gAQ6nXQKBOYhhdoEyg?= =?us-ascii?q?wEBAQWBMwGDWRiCEAMGgQ4qAYJwgltLQoQGeIFTG4FBP4FUUYFOLj6CXAKBM?= =?us-ascii?q?hQKETYCgl0zgi2QLoJto1MKgmWIaJFrgwmJb5NeklGKTpBhgSSDBAIEAgQFA?= =?us-ascii?q?g4BAQWBWwopgVdwFYMkUBcCDVaNSQwXg06KVQF0CywCBgoBAQMJfIxBgkQBA?= =?us-ascii?q?Q?= IronPort-PHdr: =?us-ascii?q?9a23=3A6IRybhZw4H87p8bBB8D2lsz/LSx94ef9IxIV55?= =?us-ascii?q?w7irlHbqWk+dH4MVfC4el21QWRD57S7f5Jj+/ftebrUD9I7ZWAtSUEd5pBH1?= =?us-ascii?q?8AhN4NlgMtSMiCFQXgLfHsYiB7eaYKVFJs83yhd0QAHsH4ag7Jq3u+4DoXEx?= =?us-ascii?q?O5PgMmbujwE5TZ2sKw0e368pbPYgJO0Ty6Z746LBi/oQjL8McMho43IacqwR?= =?us-ascii?q?yPqXxNKOk=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="5.76,401,1592870400"; d="scan'208";a="528768617" Received: from alln-core-6.cisco.com ([173.36.13.139]) by alln-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 07 Sep 2020 08:21:46 +0000 Received: from XCH-RCD-002.cisco.com (xch-rcd-002.cisco.com [173.37.102.12]) by alln-core-6.cisco.com (8.15.2/8.15.2) with ESMTPS id 0878LkIb031300 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Mon, 7 Sep 2020 08:21:46 GMT Received: from xhs-rcd-002.cisco.com (173.37.227.247) by XCH-RCD-002.cisco.com (173.37.102.12) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Mon, 7 Sep 2020 03:21:46 -0500 Received: from xhs-aln-002.cisco.com (173.37.135.119) by xhs-rcd-002.cisco.com (173.37.227.247) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Mon, 7 Sep 2020 03:21:46 -0500 Received: from NAM10-BN7-obe.outbound.protection.outlook.com (173.37.151.57) by xhs-aln-002.cisco.com (173.37.135.119) with Microsoft SMTP Server (TLS) id 15.0.1497.2 via Frontend Transport; Mon, 7 Sep 2020 03:21:46 -0500 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=FY4QjJs9XJRHAbfVJMRM/Q1Ua7G/yOZAzOA6R/ZJVae3iKdS6wi5O9h5RU7QtsFbkh72FesKzGW18Bp/+OZAn+UmnS25nYDM0L94ioaI1xhng3kHcZblcamNmqazw0vSEHh3/Binx0EDJ+HIpbWGBRlwsg6FcYLdNuy9GV85D+aO7X79+w8iDq3JxiQHjhStIW5QWGsT+XV+fVqeEmdJeVc9F4f43jLUNxsbLLSizOEkZQwRQfnlZBT+CW1UefOEhIDriioAHfyQvlMBfK0zr6OxazNgN77wiXfmHgjem+18CSwAAdvAJXHJuY/ie9S4U12mS4inzG0ZH5AdxiYCIA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=m8w/dw4JP5Q/DkS16IT+KHXEyJrDDb12REplQHT/cpo=; b=Ta+66Xv9YAx9gRRAqb4/8W3cJNuZUo3sFA1RJIpjybJsGhNDuN5XmxID5jFAUnNHIxrWOlsWT4Zv1FqZicLdKojaNfbfpQjt3rRMORy1HVGMv0yB0o+rQBWPSIpzbi+0V8MOlUZ3uaXURiatbE8PoSJFGM4qQckA+ktltcIylZQQQDe+oPgysFsXrc6W+JdrvO6WPuSGi02ZdeuMrCMzFgSQAzrZyQyFdecJi7kTQ4e0DiRN6JDJcskwsMIi2dpSnSxM/+DDq616TDJUhBsKhVWHNAGtEYuoSpLsKDgbv56VfnGDayLFIwIbIYGjVZLsdp/QFaXFEVTTJHF/l0ozjg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=m8w/dw4JP5Q/DkS16IT+KHXEyJrDDb12REplQHT/cpo=; b=tJukb5AZKYAGUSRdKPVkLg4oMl5X/PVjcC546uXd9znDEFxbc6T01TO/JUR0hWXZb5xSejRhlgyLIrP1qQOHQlTY9s3JniH6QXof4MUFhROIQmxObffAS+pBA+oPaWPFVYicBPEWdiAvK3z1Msr7FPLE4SIkNCR0fP8EHF28Nxs= Received: from MN2PR11MB3565.namprd11.prod.outlook.com (2603:10b6:208:ea::31) by MN2PR11MB3776.namprd11.prod.outlook.com (2603:10b6:208:ee::28) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3348.16; Mon, 7 Sep 2020 08:21:45 +0000 Received: from MN2PR11MB3565.namprd11.prod.outlook.com ([fe80::119:f851:5860:da95]) by MN2PR11MB3565.namprd11.prod.outlook.com ([fe80::119:f851:5860:da95%4]) with mapi id 15.20.3348.019; Mon, 7 Sep 2020 08:21:45 +0000 From: "Pascal Thubert (pthubert)" To: Michael Richardson , "Routing Over Low power and Lossy networks" CC: "secdir@ietf.org" , "draft-ietf-roll-turnon-rfc8138.all@ietf.org" Thread-Topic: [Roll] Secdir last call review of draft-ietf-roll-turnon-rfc8138-12 Thread-Index: AdaDbUeaqdHV2jK6QYKG8VqxeX1QTwA/l14AAB9ma/A= Date: Mon, 7 Sep 2020 08:21:36 +0000 Deferred-Delivery: Mon, 7 Sep 2020 08:21:03 +0000 Message-ID: References: <1440.1599410092@localhost> In-Reply-To: <1440.1599410092@localhost> Accept-Language: fr-FR, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: sandelman.ca; dkim=none (message not signed) header.d=none;sandelman.ca; dmarc=none action=none header.from=cisco.com; x-originating-ip: [2a01:cb1d:4ec:2200:dc20:a9e9:3036:821a] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: e7320352-fdc6-42d7-7f87-08d853070ee2 x-ms-traffictypediagnostic: MN2PR11MB3776: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: UGpTpSVln0fltMq8xb8KHmanpYRPXqCVutXqKs6QE7ADzfzfrTRYfVQV/mz0DX/i0YWwBm9EsAMhDS/Rsq+LXD0199h3PBhP4xAJO2xNcFpD0v72TqTM9HpQbbn35efWZi17mApy4L1XHW+G7FkdFlk0qIXyv6ppiPdJfhtultn2ngMEMYZdkqJzsKC7ZJFgxvL38sa+26+/QX2fWJA0rmg0BWmd6QQE/7mC8XXGtUcgSmRPsnZmkTTIpPsj+GIFaQTw29cGTzVYtZy3IruZ08WvT+4LXyq85ItOSVaAs7atUQT9fgYB4uXoH8oXgl7oWqNXqmbDixaQuRh2jlWgcRsEGvoxzA36MDyJHKwY0sz8M8eSU14z6Lo2w1dJyN9OwfVRrnkc9GZtKrn2Nem0Eg== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:MN2PR11MB3565.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFS:(136003)(376002)(39860400002)(346002)(396003)(366004)(9686003)(2906002)(54906003)(8936002)(110136005)(6506007)(7696005)(316002)(186003)(8676002)(966005)(478600001)(55016002)(4326008)(52536014)(64756008)(33656002)(66476007)(76116006)(66446008)(66556008)(66946007)(66574015)(83380400001)(5660300002)(86362001)(71200400001)(6666004); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: pdZRCfTTp7N7JiZV6k2cz4OGXIxkYH5NixMGYwVazNVjv863v7GUJSpe2/zpzS5kNs7By6eJ8aRDettbl6EpEJp3osj/hn5OsFwInjyZxjP71mOcSIQI4GFHfmwG9/iptraMEBeDHH0SYlqT6dFuZot5Bns2grHiZiXGfVCE2pCD2Q+9iyDmNT7Mn/38z9W7/gOPLmT5JONAHFDSQ0QGjxrKw/HuEVW6vZnOQoH1GY3prOWlIIUkcUR5hnL8aiYzXrA+MHrxR7aYvj/c3EUDtxZ9xMjFz9rIrSkcbwCL2BfucN8YeiWIXg7YFzVksT0ASjJObxHnPSeP1eHzZmUm3Asx4tjxeaEHOMlAyql6+8oY7Ej+xzVUYfQF00P8P43C5w6zgkydtvUFRcOqzpxR3RYFz4pXI7zsYZoel178GCwvU712OxVYYVzBHb6Bh1O5Ol19LdpOvexYA6FaiIaYZ00xj3GL4r6O4pFJxVEP3NVvDuiBhnD4MY2Ua9FQsRq8WFEdagBV21+hzHfvvVn/oODTERcFOAehP7ngzhtmBfiQB8z4MuAE53SNaU2bRQJ0aBAKQ52dW3XJgX+lKBRxxiwXETuYop/dAvb11yqK8mLRqTlI1V0Tdg/wh4LFCE4INdklk3HWtsg2wrs3lc4mReEHY5CRu88XvqKXmFzOb9/sSVupAIObOp1A2yGnOrZJFRTut5XYGOVOrAiBuFkOAQ== x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: MN2PR11MB3565.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: e7320352-fdc6-42d7-7f87-08d853070ee2 X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Sep 2020 08:21:45.0037 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: cEUtd8KhO7kLt1I4GtoN7g5YJoFbEE6RPrNGheHP4QNH197M574Zeo0a5+ncGVdOw8tFz/yIPgqfP80ei/qJcA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR11MB3776 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.102.12, xch-rcd-002.cisco.com X-Outbound-Node: alln-core-6.cisco.com Archived-At: Subject: Re: [secdir] [Roll] Secdir last call review of draft-ietf-roll-turnon-rfc8138-12 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Sep 2020 08:21:50 -0000 SGVsbG8gVGlydSBhbmQgTWljaGFlbDoNCg0KTWFueSB0aGFua3MgZm9yIHlvdXIgdGltZSwgeW91 ciByZXZpZXcgYW5kIHlvdXIgaGVscC4NCg0KTGV0J3MgZXhwbG9yZSBob3cgd2UgY2FuIGltcHJv dmUgdGhlIHRleHQgdG8gcmVkdWNlIHRoZSByZWFkZXIncyBwdXp6bGVtZW50cy4NCg0KDQo+IA0K PiBLb25kYSwgVGlydW1hbGVzd2FyIFJlZGR5IDxUaXJ1bWFsZXN3YXJSZWRkeV9Lb25kYUBNY0Fm ZWUuY29tPg0KPiB3cm90ZToNCj4gICAgID4gWzFdIFlvdSBtYXkgd2FudCB0byBjbGFyaWZ5IGhv dyB0aGUgYXR0YWNrZXIgbWFuYWdlcyB0byBtb2RpZnkgYQ0KPiAgICAgPiBwcm90ZWN0ZWQgY29u ZmlndXJhdGlvbiBpbmNsdWRpbmcgdGhlICJUIiBmbGFnIGludHJvZHVjZWQgaW4gdGhpcw0KPiAg ICAgPiBzcGVjLg0KPiANCj4gRXZlcnkgcm91dGVyIHdpdGhpbiBldmVyeSByb3V0aW5nIHByb3Rv Y29sIGNhbiBkbyB3cm9uZyB0aGluZ3MgOi0pIFJQTCBpcyBhbg0KPiBJR1AsIHNvIGFsbCByb3V0 ZXJzIGFyZSB3aXRoaW4gdGhlIHNhbWUgc2VjdXJpdHkgY29udHJvbCwgYW5kIGF0IHRoZSBzYW1l IGxldmVsLg0KPiANCj4gQW4gYXR0YWNrZXIgd291bGQgaGF2ZSB0byBpbnRyb2R1Y2UgbWFsd2Fy ZSBpbnRvIHRoZSBkZXZpY2UgdG8gbW9kaWZ5IGRhdGEuDQo+IFJGQzc0MTYgbGF5cyBvdXQgYWxs IG9mIHRoZXNlIHRocmVhdHM6IHRoZXkgYXJlIG5vIGRpZmZlcmVudCBmb3IgdGhlIFQtYml0IHRo YW4NCj4gb3RoZXIgYml0cy4NCj4gDQoNCkdvb2QgcG9pbnQsIEkgd2lsbCBhZGQgYW4gaW5mb3Jt YXRpdmUgcmVmIHRvIFJGQzc0MTY6DQoiDQogICBJdCBpcyB3b3J0aCBub3RpbmcgdGhhdCBpbiBS UEwgW1JGQzY1NTBdLCBldmVyeSBub2RlIGluIHRoZSBMTE4gdGhhdA0KICAgaXMgUlBMLWF3YXJl IGFuZCBoYXMgYWNjZXNzIHRvIHRoZSBSUEwgZG9tYWluIGNhbiBpbmplY3QgYW55IFJQTC0NCiAg IGJhc2VkIGF0dGFjayBpbiB0aGUgbmV0d29yaywgbW9yZSBpbiBbUkZDNzQxNl0uICANCg0KIg0K DQoNCj4gICAgID4gWzJdIElzIGl0IHBvc3NpYmxlIHRvIGlkZW50aWZ5IHRoZSBhdHRhY2tlciAo b3IgY29tcHJvbWlzZWQgcm91dGVyKSB3aG8NCj4gICAgID4gc2V0IHRoZSAiVCIgZmxhZyB0byBy ZW1lZGlhdGlvbiBtZWFzdXJlcyA/DQo+IA0KPiBNYXliZS4gUHJvYmFibHkgbm90Lg0KPiBUaGVy ZSBhcmUgZmV3IHRoaW5ncyB3ZSBjYW4gZG8gd2l0aGluIGFueSByb3V0aW5nIHByb3RvY29sIHRv IGlkZW50aWZ5IG1pcy0NCj4gYmVoYXZpbmcgcm91dGVycy4NCg0KQW5kIGR1cmluZyBhIHRyYW5z aXRpb24gdGhlcmUgd2lsbCBiZSBwYXJlbnRzIHRoYXQgYWR2ZXJ0aXNlIGEgZGlmZmVyZW50IHNl dHRpbmcuIA0KQXMgTWljaGFlbCBzYWlkLCB0aGlzIGlzIHRydWUgZm9yIGFueSBvdGhlciBpbmZv cm1hdGlvbiBhcyB3ZWxsLCBzbyB0aGUgYXJ0IG9mIGRlYnVua2luZyBhcHBsaWVzLg0KDQo+ICAg ICA+IFszXSBJZiBkdWUgdG8gYW4gaHVtYW4gZXJyb3Igb25lIG9yIG1vcmUgb2YgdGhlIG9uLXBh dGggcm91dGVycyBhcmUgbm90DQo+ICAgICA+IHVwZ3JhZGVkIG9yIGlmIHRoZSByb3V0ZXIgc2Vl cyBib3RoIHNldHRpbmdzLCBJIHByZXN1bWUgYW4gYWxlcnQgY291bGQNCj4gICAgID4gYmUgc2Vu dCB0byB0aGUgbmV0d29yayBtYW5hZ2VtZW50IGZvciB0cm91Ymxlc2hvb3RpbmcuIFlvdSBtYXkg d2FudCB0bw0KPiAgICAgPiBhZGQgdGV4dCB0byBkaXNjdXNzIHRoZSBzYW1lLg0KPiANCj4gQXQg cHJlc2VudCwgUlBMIGRvZXMgbm90IGluY2x1ZGUgYSBzdGFuZGFyZCBvZmYtcGF0aCBhbGVydGlu ZyBtZWNoYW5pc20uDQo+IFRoaXMgcmVtYWlucyBhIHRvZG8gaXRlbSBmb3IgdGhlIFdHLg0KPiBT b21lIHVzZSBORVRDT05GIG9yIEhUVFAgdG8gY29sbGVjdCBzdGF0aXN0aWNzIGluIGEgcHJvcHJp ZXRhcnkgd2F5Lg0KPiBXZSBjYW4gc2VuZCBJQ01QcywgYnV0IHNpbmNlIHRoZSBhZmZlY3RzIGhv dyB0aGUgcGFja2V0cyBhcmUgZW5jb2RlZCwgd2UNCj4gbGlrZWx5IGNhbid0IHNlbmQgYW4gSUNN UCB0byBhIHJlbGV2YW50IHJvdXRlciwganVzdCBvbmUgaG9wIGluIHRoZSBkaXJlY3Rpb24gaXQN Cj4gY2FtZSBmcm9tLg0KDQpBZ3JlZWQuIEluIGFkZGl0aW9uLCBJIHdvdWxkIG5vdCBhZGQgY29k ZSBpbiBhIGNvbnN0cmFpbmVkIHJvdXRlciB0byBkZXRlY3QgdGhpcyBtaXN0YWtlLCB0aG91Z2gu IA0KRWl0aGVyIHlvdSBrbm93IHlvdXIgbmV0d29yayAodGhyb3VnaCBtYW5hZ2VtZW50KSBhbmQg eW91IGNhbiBkbyB0aGUgbGl2ZSB1cGdyYWRlLCBvciwgZm9yIGEgc21hbGwgbmV0d29yayB5b3Ug ZG8gdGhlIGZsYWcgZGF5IGFsdGVybmF0aXZlIGFuZCBjaGVjayBldmVyeXRoaW5nIGlzIGJhY2sg dXAuDQoNCg0KDQo+IA0KPiAgICAgPiBbNF0gV2hhdCBkbyB5b3UgbWVhbiBieSAic3ViREFHIiAo SSBkb24ndCBzZWUgYW55IGRlZmluaXRpb24gaW4gdGhpcyBzcGVjDQo+IGFuZCBSRkM4MTM4KSA/ DQo+IA0KPiBJdCdzIGEgc3ViLXBvcnRpb24gb2YgYSBEQUcuIEEgc3ViLXRyZWUuDQoNCkkgbWFk ZSBhIHNtYWxsIGNsYXJpZnlpbmcgY2hhbmdlOg0KIg0KICAgQW4gYXR0YWNrZXIgaW4gdGhlIG1p ZGRsZSBvZiB0aGUgbmV0d29yayBtYXkgcmVzZXQgdGhlICJUIiBmbGFnIHRvDQogICBjYXVzZSBl eHRyYSBlbmVyZ3kgc3BlbmRpbmcgaW4gdGhlIHN1YnNldCBvZiB0aGUgRE9EQUcgZm9ybWVkIGJ5 IGl0cw0KICAgZGVzY2VuZGFudHMgKGl0cyBzdWJEQUcpLg0KIg0KDQpUaGUgZGlmZnMgYXJlIHZp c2libGUgaGVyZTogaHR0cHM6Ly9naXRodWIuY29tL3JvbGwtd2cvcm9sbC10dXJub24tcmZjODEz OC9jb21taXQvODg5ZmFjY2VjMTkwMzhiMmI2ODY4NWJiMGUzMWU5Y2I5MWQ0ZGE2Mg0KDQpBZ2Fp biwgbWFueSB0aGFua3MhDQoNClBsZWFzZSBsZXQgdXMga25vdyBpZiB5b3Ugc2VlIHdlIG5lZWQg dG8gZG8gbW9yZS4NCg0KS2VlcCBzYWZlDQoNClBhc2NhbA0K From nobody Mon Sep 7 04:38:19 2020 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 61C123A0C29; Mon, 7 Sep 2020 04:38:13 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: Vincent Roca via Datatracker To: Cc: last-call@ietf.org, detnet@ietf.org, draft-ietf-detnet-ip-over-mpls.all@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.15.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <159947869329.11456.14733447920077619501@ietfa.amsl.com> Reply-To: Vincent Roca Date: Mon, 07 Sep 2020 04:38:13 -0700 Archived-At: Subject: [secdir] Secdir last call review of draft-ietf-detnet-ip-over-mpls-07 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Sep 2020 11:38:14 -0000 Reviewer: Vincent Roca Review result: Has Nits Hello, I have reviewed this document as part of the security directorate’s ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. Summary: Has Nits I have no major concern. However I think that the Security considerations section could and should better leverage on [I-D.ietf-detnet-security] (currently it is mainly cited but that's all). Indeed, the [I-D.ietf-detnet-security] document is all about DetNet security, it introduces the problem in a clear manner, then it discusses with much detail both security risks and mitigation technics, providing high level synthesis tables, and sections 9.1 and 9.2 are even dedicated to IP and MPLS DetNet security. This is a MUST read document that provides valuable discussion (perhaps more than in the present document, sorry). I also think the [I-D.ietf-detnet-security] reference (""Deterministic Networking (DetNet) Security Considerations") should be a Normative Reference (it's currently in the Informative Reference list). Minor comments: - Section 4.1 uses the S-PE acronym when refering to the Relay Node, whereas S-PE is not expended in the Abbreviations list of section 2.2. Regards, Vincent From nobody Tue Sep 8 00:30:55 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 189FB3A0E2A; Tue, 8 Sep 2020 00:30:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.102 X-Spam-Level: X-Spam-Status: No, score=-2.102 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rnkzzF3RILds; Tue, 8 Sep 2020 00:30:47 -0700 (PDT) Received: from EUR02-VE1-obe.outbound.protection.outlook.com (mail-eopbgr20058.outbound.protection.outlook.com [40.107.2.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4D6C33A0DF7; Tue, 8 Sep 2020 00:30:41 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=l+TGO4cj4Wkl6c6OFk+A+zzHMP5tDbKtFAihA7PYkBvx+2/yqUto3B4HtG9o1u/OFFZBqL+uX3iKiX3OZbo9pLAmMndLHGO54rnRh1RhG12O30ol1jNyRElfBpvlbuHzBvoKEFD0I++PzSiny4q+9FskFMa/LZlQaV8IUU6jct0X+O5F+noVA+rFiAu2aVgJhJQMQ1Frl8rqBotIXDrVXPZlu5+hk8K6wdWfbcflClxXX0xghZP08Bh5vmbef69vkmOGc+NRHD2yb+u5a8LcS9RlD8HikK/h2l1hU3NsUcS2bo+mtwdZ4jxXpwVPOG28bxgmCBgy/2uKTDym15pUXw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=raKs0K0tn1Jj1cvCntmfWxZlPXPEofWpgb3cmmvZcJc=; b=UV5pEnV1y+6AnHd1uWPNd0lUk3BMKUZBDAERGF2E+0bBFdRDsbpwstXFb806zk3neW1tKQqPw0CYgwU8zimkrPxbBfTRGQgHBPjfy+L89/3aMMXfI97714U7hkFtg+i29v67dwwIMXIn5Z+7moLfHGYCS5dAs4XhWUYM/seCs0StYvr/0g5GAHRs1iVkuqsC2o8XE/YNZ72/BZOB8LrQT1FCJfcrnp9buwz1G3bYSEt96GBVqZ8gXnMwSdDmqKTiUDv52kQh5fWq8ngT3N/d6H3AgjEau6UTmPK9sHhr2zSfvksKSZXXHDfkdUhME/BWTMyJ4rKnojVOm3jvh7bfDw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=raKs0K0tn1Jj1cvCntmfWxZlPXPEofWpgb3cmmvZcJc=; b=dYSHXc+x9MtZicDrTKrBxgZlQX3/olI3EkKPKD5FqN+yjfGdDhw8VEdQrKXsSgE2E6y21YJ3nsrUgxacN3uyOE8hmh3+KJ+i4WVrUF198oAplkDyOdSKZuofaxEGdhH6sdY+o4MGhwetX1eMsKiuRRg9iiv4j790yCZ11RojidI= Received: from AM0PR0702MB3603.eurprd07.prod.outlook.com (2603:10a6:208:22::25) by AM0PR0702MB3602.eurprd07.prod.outlook.com (2603:10a6:208:18::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3370.9; Tue, 8 Sep 2020 07:30:34 +0000 Received: from AM0PR0702MB3603.eurprd07.prod.outlook.com ([fe80::59ca:540d:b7f3:58b9]) by AM0PR0702MB3603.eurprd07.prod.outlook.com ([fe80::59ca:540d:b7f3:58b9%6]) with mapi id 15.20.3370.016; Tue, 8 Sep 2020 07:30:34 +0000 From: =?utf-8?B?QmFsw6F6cyBWYXJnYSBB?= To: Vincent Roca , "secdir@ietf.org" CC: "last-call@ietf.org" , "detnet@ietf.org" , "draft-ietf-detnet-ip-over-mpls.all@ietf.org" Thread-Topic: Secdir last call review of draft-ietf-detnet-ip-over-mpls-07 Thread-Index: AQHWhQvEpaQcAJaMg0OYoTWKmQ4VEqleWRdA Date: Tue, 8 Sep 2020 07:30:34 +0000 Message-ID: References: <159947869329.11456.14733447920077619501@ietfa.amsl.com> In-Reply-To: <159947869329.11456.14733447920077619501@ietfa.amsl.com> Accept-Language: hu-HU, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: inria.fr; dkim=none (message not signed) header.d=none;inria.fr; dmarc=none action=none header.from=ericsson.com; x-originating-ip: [185.29.82.162] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: c1ac9333-ad6e-47fe-5ced-08d853c912fb x-ms-traffictypediagnostic: AM0PR0702MB3602: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: qTL4bP4xhMwAsVEoUUJAwcGQtsfBmNlJkeGFcGtn9T5i79lel8gM5fpieNT/Gp8YKPtvZ0x2geYrQSewVxfIq8jEBcEW8I/ty0EX71PtkpVlD281RRDJAAMHCXe8aQxTa+A9v9ADCiUfzwN49uq0mWw0u7aDPBsyLtYr4lGIbu+7Ol4+AXBizbhrjed2rOdkYyo3trWvgNRS4aqhAMzzjig7MEcAxAYI8mohx3pb2WEzGNpgC2Qu1Agk4RVMmgAoIsEa5n4zyMKQ9NNQ6dG3r+1fHPKRdVXsKmmfwa5GRwfntX6BJ5TysKLuJs3Q5pVx x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:AM0PR0702MB3603.eurprd07.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(346002)(366004)(136003)(376002)(39860400002)(396003)(55016002)(66446008)(66556008)(66476007)(64756008)(66946007)(316002)(8676002)(4326008)(26005)(8936002)(86362001)(186003)(71200400001)(33656002)(52536014)(7696005)(76116006)(5660300002)(478600001)(85202003)(54906003)(110136005)(9686003)(85182001)(53546011)(2906002)(6506007)(83380400001); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: dYvmuKBDR7IkKtN2wEt7UoCifqYs9EXB18ARbx4ohUdh82YfXxv49rcyQRw4LLTbZE39cqQxI0wsbQQ3JmJd6h2kh+oJuqB6lHLI40+BmMGvWP62TrvFykWAvfR5w+sXJQMz7Qmv/VNMTQp/OSrKhXV5mXd1mpougJ45AkiYQ/mef23yAhN7uDZoiKIkQudIBTcf4tA2PXQH14HxshNiXSPej4uOuzPogFOeW1COoGSoW5/yX5N+OcelKNBAfldvNSybwxBJa3ZteWI1jUVL0FdFyNUsYMyuNbqEvc8gFjU7Tp0olnAHyNFus6iDgUZLp6JJjwVpe57jFzKIAwGhOiuqB5urqFtTeX+ZOLx91kHPdFcGlsaKGotcnCtOLvRLGl2tl+jfupKszViYlXhsj6N6OeE6TzQhbnnl/uDpmIa9LlQHQTXIVaWdmKT/cPqFVl05lliE6xVC9iKMOCTqA5umdGUotg+voqdWrEPpbZEnRAnuJbwFl5cHpwjOjoqlAMEVE27XNHSe2/uX2rdejwNcHUjNN7QW+9K86DUceTZQctwXgSQau7dSeGATaiDgl4rBv6Jd+O3obmygcEt+nrGg0iNE4sGFWEmeycGed8nHQYPgV4GDmcx0UlcS2c6uEzcQPsbvVJ6qYSyJ5NU4QA== x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: AM0PR0702MB3603.eurprd07.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: c1ac9333-ad6e-47fe-5ced-08d853c912fb X-MS-Exchange-CrossTenant-originalarrivaltime: 08 Sep 2020 07:30:34.3940 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: GlbkSAWgXTiy7nH/6nnYUpjCl/ICRgQQ6tzQEJ0Lhiqo+O1Vu7jEFz3CiyKYMjAhpANimhyUAKBS4EfKhoxmwZVE5dSVYF22CVmgFjZ9ibg= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR0702MB3602 Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-detnet-ip-over-mpls-07 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Sep 2020 07:30:48 -0000 SGkgVmluY2VudCwNCg0KTWFueSB0aGFua3MgZm9yIHlvdXIgcmV2aWV3Lg0KSSBoYXZlIHVwZGF0 ZWQgdGhlIGRvY3VtZW50IGJhc2VkIG9uIHlvdXIgY29tbWVudHMgDQooaS5lLiwgY2hhbmdpbmcg dG8gbm9ybWF0aXZlIHJlZmVyZW5jZSwgZml4aW5nIGFiYnJldmlhdGlvbnMuKQ0KDQpUaGFua3Mg JiBDaGVlcnMNCkJhbGEnenMNCg0KDQotLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KRnJvbTog VmluY2VudCBSb2NhIHZpYSBEYXRhdHJhY2tlciA8bm9yZXBseUBpZXRmLm9yZz4gDQpTZW50OiBN b25kYXksIFNlcHRlbWJlciA3LCAyMDIwIDE6MzggUE0NClRvOiBzZWNkaXJAaWV0Zi5vcmcNCkNj OiBsYXN0LWNhbGxAaWV0Zi5vcmc7IGRldG5ldEBpZXRmLm9yZzsgZHJhZnQtaWV0Zi1kZXRuZXQt aXAtb3Zlci1tcGxzLmFsbEBpZXRmLm9yZw0KU3ViamVjdDogU2VjZGlyIGxhc3QgY2FsbCByZXZp ZXcgb2YgZHJhZnQtaWV0Zi1kZXRuZXQtaXAtb3Zlci1tcGxzLTA3DQoNClJldmlld2VyOiBWaW5j ZW50IFJvY2ENClJldmlldyByZXN1bHQ6IEhhcyBOaXRzDQoNCkhlbGxvLA0KDQpJIGhhdmUgcmV2 aWV3ZWQgdGhpcyBkb2N1bWVudCBhcyBwYXJ0IG9mIHRoZSBzZWN1cml0eSBkaXJlY3RvcmF0ZeKA mXMgb25nb2luZyBlZmZvcnQgdG8gcmV2aWV3IGFsbCBJRVRGIGRvY3VtZW50cyBiZWluZyBwcm9j ZXNzZWQgYnkgdGhlIElFU0cuIFRoZXNlIGNvbW1lbnRzIHdlcmUgd3JpdHRlbiBwcmltYXJpbHkg Zm9yIHRoZSBiZW5lZml0IG9mIHRoZSBzZWN1cml0eSBhcmVhIGRpcmVjdG9ycy4gIERvY3VtZW50 IGVkaXRvcnMgYW5kIFdHIGNoYWlycyBzaG91bGQgdHJlYXQgdGhlc2UgY29tbWVudHMganVzdCBs aWtlIGFueSBvdGhlciBsYXN0IGNhbGwgY29tbWVudHMuDQoNClN1bW1hcnk6IEhhcyBOaXRzDQoN CkkgaGF2ZSBubyBtYWpvciBjb25jZXJuLiBIb3dldmVyIEkgdGhpbmsgdGhhdCB0aGUgU2VjdXJp dHkgY29uc2lkZXJhdGlvbnMgc2VjdGlvbiBjb3VsZCBhbmQgc2hvdWxkIGJldHRlciBsZXZlcmFn ZSBvbiBbSS1ELmlldGYtZGV0bmV0LXNlY3VyaXR5XSAoY3VycmVudGx5IGl0IGlzIG1haW5seSBj aXRlZCBidXQgdGhhdCdzIGFsbCkuIEluZGVlZCwgdGhlIFtJLUQuaWV0Zi1kZXRuZXQtc2VjdXJp dHldIGRvY3VtZW50IGlzIGFsbCBhYm91dCBEZXROZXQgc2VjdXJpdHksIGl0IGludHJvZHVjZXMg dGhlIHByb2JsZW0gaW4gYSBjbGVhciBtYW5uZXIsIHRoZW4gaXQgZGlzY3Vzc2VzIHdpdGggbXVj aCBkZXRhaWwgYm90aCBzZWN1cml0eSByaXNrcyBhbmQgbWl0aWdhdGlvbiB0ZWNobmljcywgcHJv dmlkaW5nIGhpZ2ggbGV2ZWwgc3ludGhlc2lzIHRhYmxlcywgYW5kIHNlY3Rpb25zIDkuMSBhbmQg OS4yIGFyZSBldmVuIGRlZGljYXRlZCB0byBJUCBhbmQgTVBMUyBEZXROZXQgc2VjdXJpdHkuIA0K VGhpcyBpcyBhIE1VU1QgcmVhZCBkb2N1bWVudCB0aGF0IHByb3ZpZGVzIHZhbHVhYmxlIGRpc2N1 c3Npb24gKHBlcmhhcHMgbW9yZSB0aGFuIGluIHRoZSBwcmVzZW50IGRvY3VtZW50LCBzb3JyeSku DQoNCkkgYWxzbyB0aGluayB0aGUgIFtJLUQuaWV0Zi1kZXRuZXQtc2VjdXJpdHldIHJlZmVyZW5j ZSAoIiJEZXRlcm1pbmlzdGljIE5ldHdvcmtpbmcgKERldE5ldCkgU2VjdXJpdHkgQ29uc2lkZXJh dGlvbnMiKSBzaG91bGQgYmUgYSBOb3JtYXRpdmUgUmVmZXJlbmNlIChpdCdzIGN1cnJlbnRseSBp biB0aGUgSW5mb3JtYXRpdmUgUmVmZXJlbmNlIGxpc3QpLg0KDQoNCk1pbm9yIGNvbW1lbnRzOg0K DQotIFNlY3Rpb24gNC4xIHVzZXMgdGhlIFMtUEUgYWNyb255bSB3aGVuIHJlZmVyaW5nIHRvIHRo ZSBSZWxheSBOb2RlLCB3aGVyZWFzIFMtUEUgaXMgbm90IGV4cGVuZGVkIGluIHRoZSBBYmJyZXZp YXRpb25zIGxpc3Qgb2Ygc2VjdGlvbiAyLjIuDQoNCg0KUmVnYXJkcywgICAgVmluY2VudA0KDQoN Cg== From nobody Tue Sep 8 14:26:41 2020 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 758823A1157; Tue, 8 Sep 2020 14:26:33 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: Nancy Cam-Winget via Datatracker To: Cc: draft-hardie-dispatch-rfc3405-update.all@ietf.org, last-call@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.16.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <159960039336.12619.2048589782212544165@ietfa.amsl.com> Reply-To: Nancy Cam-Winget Date: Tue, 08 Sep 2020 14:26:33 -0700 Archived-At: Subject: [secdir] Secdir last call review of draft-hardie-dispatch-rfc3405-update-03 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Sep 2020 21:26:34 -0000 Reviewer: Nancy Cam-Winget Review result: Ready SECDIR review of draft-hardie-dispatch-rfc3405-update-03 Reviewer: Nancy Cam-Winget Review result: Ready I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments. This is a very short document that updates RFC 3405 to remove its requirement for URI.ARPA to be from the IETF URI Tree. The document seems concise and I did not find any issues. From nobody Tue Sep 8 23:29:02 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9B9443A0F8C; Tue, 8 Sep 2020 23:28:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nokia.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aFJ8Jw3RH7Uj; Tue, 8 Sep 2020 23:28:52 -0700 (PDT) Received: from NAM10-DM6-obe.outbound.protection.outlook.com (mail-dm6nam10on2090.outbound.protection.outlook.com [40.107.93.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CEB643A0F8A; Tue, 8 Sep 2020 23:28:51 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=HGwXBJhjth94cwGHiJP6GCH9LtSD6MpqWG5Tjv4aaMTQjf1h2MZw2WvXlebTz/Vamb6YGJweOkhp5Nn+1z17hPIx09pZMo241VsHYlyEXWYkrdgBE05o8SPTYS0j9/48tqluN13/OefJDNVjcQXHUE4VoZcoaPrYPsY0R/1HTM0ADz6TsCEGPxFz2oOMNFiFcg5LWTqnjeA5H2fINTvroFZgn7QTE4sd1w7e5wwo+zidY5h9cqcmSHk4GmMmnper5gC8RHQp3hCuLXuqRCGkSkhOjUDRJM86U7xagqmNiGouzipmVs1bJAnFPLV4gm7Idfv0r5ZoDSlJzCZ6Z1ICCg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ItwNG8r6H07JbO31Nyabw/7SW3iFzNRiYc0QZQKO0Eg=; b=DGAtOIIfWuHxtcr2ZkB+9B74LrHZa5nyIGTF/lgJyHLGX63vB3CHEYjmoK/yXGo8fGwfOnP6v1H4uX3N03AYhtYmxn6xBW1p8RQK9ATP0U5sx18ibIXuvGJsHPTdaQvkhMXmE+WyjquGEtcK5HN2YdeDv3ZZ6d+1+Bj2mew4WV5rQFGKtBILtvNzjAN9WEVlfCc5/7cetUPX+aeBzwQlIJ5c0v9fqAzFAwyFjCvqBO1p5wGLXAwmdDs7D3J/A+oJ3KPKkmVrYqqnNEU2ONl0uz0rgUnD9U2tqB4vdX9EQeeGsslysX1k31bzcQ8fBO/sfVM9mjI5nAOjyFFNl6iV2Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nokia.com; dmarc=pass action=none header.from=nokia.com; dkim=pass header.d=nokia.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nokia.onmicrosoft.com; s=selector1-nokia-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ItwNG8r6H07JbO31Nyabw/7SW3iFzNRiYc0QZQKO0Eg=; b=A7K4dpl6cBszXtWTmTzkzt5YjnVc5OKppgfWlunCmePslpK6a3Ppl1O6FBXtyfbFmNhP50BL30ypMFDy2yZRJc+2s6kGMQOyQJ627Xrjv7b+JRy1tTFr1UCZGIBG4/mW1aOIUCAHtX1vGr0Cbjs8AHa+vQyOsNkq+06oAUwK9Hw= Received: from MWHPR08MB3520.namprd08.prod.outlook.com (2603:10b6:301:61::15) by CO2PR0801MB2326.namprd08.prod.outlook.com (2603:10b6:102:8::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3348.15; Wed, 9 Sep 2020 06:28:48 +0000 Received: from MWHPR08MB3520.namprd08.prod.outlook.com ([fe80::19d8:bf7f:5bfa:e391]) by MWHPR08MB3520.namprd08.prod.outlook.com ([fe80::19d8:bf7f:5bfa:e391%4]) with mapi id 15.20.3326.030; Wed, 9 Sep 2020 06:28:48 +0000 From: "Rabadan, Jorge (Nokia - US/Mountain View)" To: =?iso-8859-2?Q?Mali=B9a_Vu=E8ini=E6?= , "secdir@ietf.org" CC: "bess@ietf.org" , "last-call@ietf.org" , "draft-ietf-bess-evpn-na-flags.all@ietf.org" Thread-Topic: Secdir last call review of draft-ietf-bess-evpn-na-flags-05 Thread-Index: AQHWgE77COUFMwYRw0S3pallL7w4Fqlf43N4 Date: Wed, 9 Sep 2020 06:28:48 +0000 Message-ID: References: <159895797147.16761.14408621518778897643@ietfa.amsl.com> In-Reply-To: <159895797147.16761.14408621518778897643@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: inria.fr; dkim=none (message not signed) header.d=none;inria.fr; dmarc=none action=none header.from=nokia.com; x-originating-ip: [135.245.20.5] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: da996268-1420-401b-64d1-08d854899c82 x-ms-traffictypediagnostic: CO2PR0801MB2326: x-ms-exchange-transport-forked: True x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: enZhwSjkbRP3KyfAZ8WsDFKKkwyisuYCcldiFBjS72QbnZYXO8UyoIap9ueMUjgxP0Fhxj9onU4DROsSO32AhMKHt6d4QWTh43++kq22QP0nno7LQI4JGP7MSuODxsp5Nv7HiGRWqRijCltNzQjlAxmTCTjk/30Xl9M7FxKPXyKvQCP4s2ZIpqAL9j9/VxU6eJSB9n4xkLjfRlaYYh4py85yvkrXT/LWZ0EvRBILYKnnLI4bh8ONcQS6lZDaF1g/A+vABfmIQhwjW+U5WUOqL6kJ4oinIU15vbZkCmgXjOgaUVPj7K6exgCKlqpRxmXtPQA8jaI8TY9ZzJnFTzToDg== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:MWHPR08MB3520.namprd08.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(136003)(346002)(396003)(376002)(366004)(39860400002)(66476007)(66556008)(64756008)(53546011)(6506007)(55016002)(66446008)(76116006)(91956017)(66574015)(8936002)(8676002)(9686003)(71200400001)(316002)(83380400001)(110136005)(7696005)(66946007)(86362001)(478600001)(52536014)(26005)(54906003)(33656002)(186003)(5660300002)(2906002)(4326008); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: P4wss+psZW/6ZsBfDI/UzNlF1VaPsoUrwUsO45LaQ9stjHrbWSPbY6XsK/ClL/M45WmySz9qNoZjcy3sbRbbGfY7xpMH9QB+V6hV0+ac8abzybHGfMGNCHiKDy0QPZQtM45RLkL1RnI0OXM2pkBPteArhPH+9SY6rY8v0tpKKC41/93Vncrwwe39pnfjtGfpw5Rcc2VZ2iot/MCFJjhyEtqytHnBtjSqTzLoSCtNiyGWNrhYgyWX9XEyNhzSMTj1ZV2288VKuoRPTcLbY3mGnTScvVV+KkmjMWMLeZCmFKjR46hJsOZpkGG+bnGI88Doh6cxMYjCJjxdmZGFpIrTo+V8Wxamj7EpgWqGEXKe5lmu/F1+vMp5wfuf9rOXuO50BAscd0p2NWW6Qswlo/iewdYtIHNp8AMPJusWmCLScBv9+lQsH0nr5GipwXT+DL4vtSom+2QDgoDfwscCnnAuBWFjLaVTvNSFBOm/G6SO4FUSovMugbMCfyz/Mfy0+SlZhxd0u66SBSHwWEb8uYKOGYN76rMCW/WPX2tEn/vPIdqPj8Bq0qfKasqv2wZYl+UO/nfClbok1ORr53kseQxP2K6yDOlWf1EoR0fPkfrLAJqjO8VuFm5GgySEjaRBVQnVP9/o6iOKlD5NjQnvh67YRg== Content-Type: multipart/alternative; boundary="_000_MWHPR08MB352094152D6D5FEBB95F259DF7260MWHPR08MB3520namp_" MIME-Version: 1.0 X-OriginatorOrg: nokia.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: MWHPR08MB3520.namprd08.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: da996268-1420-401b-64d1-08d854899c82 X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Sep 2020 06:28:48.3390 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5d471751-9675-428d-917b-70f44f9630b0 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: u7ICBqvKHyqawgOaslkV+Xr1Hz844W9I/oegZheDguB6jc+xsVPzaX6ZfgN5H9X6ndrImDSrLTY6HULaDmWbqA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO2PR0801MB2326 Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-bess-evpn-na-flags-05 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Sep 2020 06:28:54 -0000 --_000_MWHPR08MB352094152D6D5FEBB95F259DF7260MWHPR08MB3520namp_ Content-Type: text/plain; charset="iso-8859-2" Content-Transfer-Encoding: quoted-printable Hi Mali=B9a, Thank you for your review. The effect of receiving the wrong O or R flags will mean the receiving host= will trigger the wrong RFC4861 procedures. I added this text, hopefully it= is sufficient: For example, as specified in [RFC4861], the receiver of a NA message wit= h O not set will not update its existing cache entry for the IP->MAC, hence the communication between the owner of the IP address and the receiver of the NA message with the wrong O flag will fail. Similarly, the receiver of a NA message with the wrong R flag, may update its Default Router List incorrectly adding or removing an entry. Let me know if you have further comments. Thanks. Jorge From: Mali=B9a Vu=E8ini=E6 via Datatracker Date: Tuesday, September 1, 2020 at 12:59 PM To: secdir@ietf.org Cc: bess@ietf.org , last-call@ietf.org ,= draft-ietf-bess-evpn-na-flags.all@ietf.org Subject: Secdir last call review of draft-ietf-bess-evpn-na-flags-05 Reviewer: Mali=B9a Vu=E8ini=E6 Review result: Has Nits I reviewed this document as part of the Security Directorate's ongoing effo= rt to review all IETF documents being processed by the IESG. These comments we= re written primarily for the benefit of the Security Area Directors. Document authors, document editors, and WG chairs should treat these comments just l= ike any other IETF Last Call comments. The document specifies an extension to an Ethernet Virtual Private Network (EVPN) MAC/IP advertisement by defining an EVPN Extended Community carrying flags relevant to the ARP/ND resolution. The abstract of the document does not include enough background context for= it to be useful to the general audience. Otherwise, the document is well writt= en. The security considerations section should be further elaborated. For insta= nce, the section includes a discussion on a possible misconfiguration of Router = (R) /Override (O) flags but the discussion is limited to the fact that the misconfiguration of an IPv6/MAC binding on a given Provider Edge device (PE= ) will propagate, through the means of IPv6 Neighbor Solicitation messages, t= o other PEs in the same broadcast domain. I would like to understand better t= he effect of each flag, i.e. what kind of behavior in the network can an attac= ker cause by changing one of these flags on a particular device or in transit? --_000_MWHPR08MB352094152D6D5FEBB95F259DF7260MWHPR08MB3520namp_ Content-Type: text/html; charset="iso-8859-2" Content-Transfer-Encoding: quoted-printable

Hi Mali=B9a,

 

Thank you for your review.

The effect of receiving the wrong O or R flags will mean the receiving ho= st will trigger the wrong RFC4861 procedures. I added this text, hopefully = it is sufficient:

 

 

   For example, as specified in [RFC= 4861], the receiver of a NA message with

   O not set will not update its exi= sting cache entry for the IP->MAC,

   hence the communication between t= he owner of the IP address and the

   receiver of the NA message with t= he wrong O flag will fail.

   Similarly, the receiver of a NA m= essage with the wrong R flag, may

   update its Default Router List in= correctly adding or removing an

   entry.

 

Let me know if you have further comments.

Thanks.

Jorge

 

 

From: Mali=B9a Vu=E8ini=E6 via Datatracker <= ;noreply@ietf.org>
Date: Tuesday, September 1, 2020 at 12:59 PM
To: secdir@ietf.org <secdir@ietf.org>
Cc: bess@ietf.org <bess@ietf.org>, last-call@ietf.org <last= -call@ietf.org>, draft-ietf-bess-evpn-na-flags.all@ietf.org <draft-ie= tf-bess-evpn-na-flags.all@ietf.org>
Subject: Secdir last call review of draft-ietf-bess-evpn-na-flags-05=

Reviewer: Mali=B9a Vu=E8ini=E6
Review result: Has Nits

I reviewed this document as part of the Security Directorate's ongoing effo= rt
to review all IETF documents being processed by the IESG. These comments we= re
written primarily for the benefit of the Security Area Directors. Document<= br> authors, document editors, and WG chairs should treat these comments just l= ike
any other IETF Last Call comments.

The document specifies an extension to an Ethernet Virtual Private Network<= br> (EVPN) MAC/IP advertisement by defining an EVPN Extended Community carrying=
flags relevant to the ARP/ND resolution.

The abstract of the document does not include enough background context for= it
to be useful to the general audience. Otherwise, the document is well writt= en.

The security considerations section should be further elaborated. For insta= nce,
the section includes a discussion on a possible misconfiguration of Router = (R)
/Override (O) flags but the discussion is limited to the fact that the
misconfiguration of an IPv6/MAC binding on a given Provider Edge device (PE= )
will propagate, through the means of IPv6 Neighbor Solicitation messages, t= o
other PEs in the same broadcast domain. I would like to understand better t= he
effect of each flag, i.e. what kind of behavior in the network can an attac= ker
cause by changing one of these flags on a particular device or in transit?<= br>

--_000_MWHPR08MB352094152D6D5FEBB95F259DF7260MWHPR08MB3520namp_-- From nobody Wed Sep 9 00:22:18 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C4B1E3A104C for ; Wed, 9 Sep 2020 00:22:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mcafee.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o01sOhbUbdWs for ; Wed, 9 Sep 2020 00:22:14 -0700 (PDT) Received: from us-smtp-delivery-140.mimecast.com (us-smtp-delivery-140.mimecast.com [63.128.21.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D61373A1077 for ; Wed, 9 Sep 2020 00:22:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mcafee.com; s=mimecast20190606; t=1599636132; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=kbmdSmS2YGb8JtvcfXGe+J2s+Gw0z0HMIdqGa7BW4Zc=; b=gBEiZUeGTzn+UujwBTg7UQ+bDh5yqLgTazaRB3hR5+pu3ejAm8q54TzqOaa4+vpVEXVf7m 3f9MRrrCqgB34F6cIo2p+HsNCEkJ9M6kVBCHnn14WhWP3fDoIQjyI/u8w1JkC4vZV1qXko MTDRv+wOY4EnyOl5pL7HS8sOi6hEO+0= Received: from NAM10-MW2-obe.outbound.protection.outlook.com (mail-mw2nam10lp2103.outbound.protection.outlook.com [104.47.55.103]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-344-gu7VoNiONsGwFnub7WXudA-1; Wed, 09 Sep 2020 03:22:11 -0400 X-MC-Unique: gu7VoNiONsGwFnub7WXudA-1 Received: from MWHPR16MB1535.namprd16.prod.outlook.com (2603:10b6:320:27::22) by MWHPR16MB1630.namprd16.prod.outlook.com (2603:10b6:301:1d::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3348.15; Wed, 9 Sep 2020 07:22:09 +0000 Received: from MWHPR16MB1535.namprd16.prod.outlook.com ([fe80::2c6f:d09b:e22a:4a47]) by MWHPR16MB1535.namprd16.prod.outlook.com ([fe80::2c6f:d09b:e22a:4a47%11]) with mapi id 15.20.3348.019; Wed, 9 Sep 2020 07:22:09 +0000 From: "Konda, Tirumaleswar Reddy" To: "Pascal Thubert (pthubert)" , Michael Richardson , Routing Over Low power and Lossy networks CC: "draft-ietf-roll-turnon-rfc8138.all@ietf.org" , "secdir@ietf.org" Thread-Topic: [Roll] Secdir last call review of draft-ietf-roll-turnon-rfc8138-12 Thread-Index: AQHWhO//Jg/t27q1LUCtpEEpCp1Ds6lf6dHQ Date: Wed, 9 Sep 2020 07:22:09 +0000 Message-ID: References: <1440.1599410092@localhost> In-Reply-To: Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-version: 11.5.0.60 dlp-reaction: no-action x-originating-ip: [49.37.200.126] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: e15c1ca1-a05d-4efe-9993-08d85491102e x-ms-traffictypediagnostic: MWHPR16MB1630: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: Go/+x3wEUaVqDfv3sZosjqqqyZ/z0fzu6lbq4KKVNBVqJNiky6EPFQ3C5mp/Z6oOVq7H5nDSxayS4hOydB9lS/mbM/sK74nsVe9S1oCCCUjloxSSGN9hePULnfQ5+yTQWDtRoEClUl8MFCtihe6iWseJTAFazbIegJMRNOv/uxhgl9tBU24zTrGBGqjEJY4dVYVnd7nPD8pAbNzxFiHXJfWLmoQweX+LGM/Qoou9v1AMMr3qDYDl7bdSABFKWJ69NepwYvsv1fAWYsLQUguFyZFZbsLBttLEhsUXOhirii+mc6AxDGmhIlsFUk9RimSSSqezXvWeQ0Ab0dOxoj7MAIUXSnySqUdY/el4yS7JaTrIv4BvJAUMDh1g5xrBU59RZ88WiMI+scC3iIiqVMpAItYJOmFFXDCxyJWucy3r/h2mj2Q2B87qRHx5+hrsl9MQE736ZNjYsBdj/mYY7KRgrCDDulLQDBR+MQewsMTBsjk= x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:MWHPR16MB1535.namprd16.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(136003)(39860400002)(366004)(376002)(396003)(346002)(32952001)(186003)(316002)(4326008)(76116006)(66946007)(110136005)(5660300002)(71200400001)(83380400001)(64756008)(66446008)(54906003)(9686003)(66556008)(66574015)(52536014)(86362001)(55016002)(33656002)(66476007)(26005)(478600001)(6506007)(53546011)(8936002)(7696005)(966005)(8676002)(2906002)(85282002); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: J7zzBhvvOSbhV9AFczO15HUmMC/z+laUx4bMJYJAcbnKD/LfEIWLAIDFXlKAcfD9s/H/9u30OGICLWAU+WRRPHe+hzwYnQF63KZ5QICo66J7GwMIRImclUM2+0WYGZvjAfa4N4Zw+82f7kJnlZfbh6wFTIy7tKgUY+qVyqNuljvJdkO0enHDshfhqe78rHvY7vKVZXC7CLhAMGnIy5i2G7lwhMY+FdXXZhCoGFPGvWshTb8Gjpx8ZrIIDGqgFV5iAgT69ukOWTiGG+OslscwX/mRZv41p+c26GElkhB7ssO57lXnsGR3zAVKZh7uyB1HMCVMKIO/y9mo1K0QPOT1VA4ZJXp/14CD4kR5NJ1TLc2kz87l4EGHaoRV4wA+aTs57fokc2qee9X2GUw7ENNQOv4hT3ZrUVMbH4yT4qXAke1s/fyppYsVX8HY2mh8tHGUlgM05o1JwgHhoYH2CxdfyZ0Sval/DWw5EE89bpFnMvFF+d7s2w7g48SHA5lHxCcXmcppgGFTKRwUb3xjIygYkZ3riMGBuHXfPqgC5+RlTXjU7yJDvgZDn/cJqmiNtZqTJ1MO0JTY6jFWq1WHqujoFmdGDXkTi17TVfjdtjwICuDtRZ3oJaSknPRjc6XhW4JQMPYFELJ4nt2z/LYgobdEpQ== x-ms-exchange-transport-forked: True MIME-Version: 1.0 X-OriginatorOrg: mcafee.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: MWHPR16MB1535.namprd16.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: e15c1ca1-a05d-4efe-9993-08d85491102e X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Sep 2020 07:22:09.0626 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 4943e38c-6dd4-428c-886d-24932bc2d5de X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: u32pp1zLpGnWZqN+1PybK460ACwaYhmRgSGATefb49Zl7XXB3nTQXpz7LhFN9hbUnITIAmQjh5Q92W37OCoo+DwvAwUcEq25/gOXVYJ8BbytzqysJGS9eqzm27NPqpFt X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR16MB1630 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA40A35 smtp.mailfrom=tirumaleswarreddy_konda@mcafee.com X-Mimecast-Spam-Score: 0.004 X-Mimecast-Originator: mcafee.com Content-Type: text/plain; charset=WINDOWS-1252 Content-Transfer-Encoding: quoted-printable Content-Language: en-US Archived-At: Subject: Re: [secdir] [Roll] Secdir last call review of draft-ietf-roll-turnon-rfc8138-12 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Sep 2020 07:22:18 -0000 Thanks Pascal, update looks good. -Tiru > -----Original Message----- > From: secdir On Behalf Of Pascal Thubert > (pthubert) > Sent: Monday, September 7, 2020 1:52 PM > To: Michael Richardson ; Routing Over Low power > and Lossy networks > Cc: draft-ietf-roll-turnon-rfc8138.all@ietf.org; secdir@ietf.org > Subject: Re: [secdir] [Roll] Secdir last call review of draft-ietf-roll-t= urnon- > rfc8138-12 >=20 > CAUTION: External email. Do not click links or open attachments unless yo= u > recognize the sender and know the content is safe. >=20 > Hello Tiru and Michael: >=20 > Many thanks for your time, your review and your help. >=20 > Let's explore how we can improve the text to reduce the reader's > puzzlements. >=20 >=20 > > > > Konda, Tirumaleswar Reddy > > wrote: > > > [1] You may want to clarify how the attacker manages to modify a > > > protected configuration including the "T" flag introduced in this > > > spec. > > > > Every router within every routing protocol can do wrong things :-) RPL > > is an IGP, so all routers are within the same security control, and at = the > same level. > > > > An attacker would have to introduce malware into the device to modify > data. > > RFC7416 lays out all of these threats: they are no different for the > > T-bit than other bits. > > >=20 > Good point, I will add an informative ref to RFC7416: > " > It is worth noting that in RPL [RFC6550], every node in the LLN that > is RPL-aware and has access to the RPL domain can inject any RPL- > based attack in the network, more in [RFC7416]. >=20 > " >=20 >=20 > > > [2] Is it possible to identify the attacker (or compromised route= r) who > > > set the "T" flag to remediation measures ? > > > > Maybe. Probably not. > > There are few things we can do within any routing protocol to identify > > mis- behaving routers. >=20 > And during a transition there will be parents that advertise a different = setting. > As Michael said, this is true for any other information as well, so the a= rt of > debunking applies. >=20 > > > [3] If due to an human error one or more of the on-path routers a= re not > > > upgraded or if the router sees both settings, I presume an alert = could > > > be sent to the network management for troubleshooting. You may > want to > > > add text to discuss the same. > > > > At present, RPL does not include a standard off-path alerting mechanism= . > > This remains a todo item for the WG. > > Some use NETCONF or HTTP to collect statistics in a proprietary way. > > We can send ICMPs, but since the affects how the packets are encoded, > > we likely can't send an ICMP to a relevant router, just one hop in the > > direction it came from. >=20 > Agreed. In addition, I would not add code in a constrained router to dete= ct > this mistake, though. > Either you know your network (through management) and you can do the > live upgrade, or, for a small network you do the flag day alternative and > check everything is back up. >=20 >=20 >=20 > > > > > [4] What do you mean by "subDAG" (I don't see any definition in > > this spec and RFC8138) ? > > > > It's a sub-portion of a DAG. A sub-tree. >=20 > I made a small clarifying change: > " > An attacker in the middle of the network may reset the "T" flag to > cause extra energy spending in the subset of the DODAG formed by its > descendants (its subDAG). > " >=20 > The diffs are visible here: https://github.com/roll-wg/roll-turnon- > rfc8138/commit/889faccec19038b2b68685bb0e31e9cb91d4da62 >=20 > Again, many thanks! >=20 > Please let us know if you see we need to do more. >=20 > Keep safe >=20 > Pascal > _______________________________________________ > secdir mailing list > secdir@ietf.org > https://www.ietf.org/mailman/listinfo/secdir > wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview From nobody Wed Sep 9 04:42:51 2020 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 854503A0822; Wed, 9 Sep 2020 04:42:39 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Stefan Santesson via Datatracker To: Cc: extra@ietf.org, draft-ietf-extra-imap-fetch-preview.all@ietf.org, last-call@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.16.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <159965175945.12389.9199002087498642486@ietfa.amsl.com> Reply-To: Stefan Santesson Date: Wed, 09 Sep 2020 04:42:39 -0700 Archived-At: Subject: [secdir] Secdir last call review of draft-ietf-extra-imap-fetch-preview-09 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Sep 2020 11:42:40 -0000 Reviewer: Stefan Santesson Review result: Ready This document seems ready to go. I find no obvious shortcomings with regard to security. From nobody Wed Sep 9 16:16:12 2020 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 423333A043A; Wed, 9 Sep 2020 16:16:11 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Christopher Wood via Datatracker To: Cc: last-call@ietf.org, v6ops@ietf.org, draft-ietf-v6ops-cpe-slaac-renum.all@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.16.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <159969337123.15697.6820068156665930267@ietfa.amsl.com> Reply-To: Christopher Wood Date: Wed, 09 Sep 2020 16:16:11 -0700 Archived-At: Subject: [secdir] Secdir last call review of draft-ietf-v6ops-cpe-slaac-renum-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Sep 2020 23:16:11 -0000 Reviewer: Christopher Wood Review result: Has Nits Summary: Has Nits Comments: - Section 3: is it possible for an attacker to send DHCPv6 Prefix Delegations with lifetime=0 to CE routers that support LAN-side DHCPv6 and amplify Reconfigure messages to supporting clients? (I don't know if this is a concern or part of the threat model, but this did seem to be a case of possible request/response asymmetry.) - Section 4: rationale for these default values, if available, might be worth including. (Why not make them shorter? What are the tradeoffs?) - Section 6: it might be worth noting what happens if stable storage is unavailable or otherwise compromised when trying to store prefix information. What happens if the "A" or "L" bits are modified? (I suspect nothing dangerous, but it's not clear to me whether or not integrity is important.) Nits: - In some places "\"Valid Lifetime\"" is written as "valid-lifetime" -- should these be made consistent? From nobody Wed Sep 9 16:32:09 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 278E03A0824 for ; Wed, 9 Sep 2020 16:32:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3Fd4JV2JNUZc for ; Wed, 9 Sep 2020 16:31:59 -0700 (PDT) Received: from mail-qk1-x72e.google.com (mail-qk1-x72e.google.com [IPv6:2607:f8b0:4864:20::72e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 59EA83A081D for ; Wed, 9 Sep 2020 16:31:59 -0700 (PDT) Received: by mail-qk1-x72e.google.com with SMTP id p4so4272452qkf.0 for ; Wed, 09 Sep 2020 16:31:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=2wNo5gCisSNSY4DpBonESfuBtu+nKV+NqWJSlcqNP1k=; b=gXPgQb8CQEvDiE3XgZa4/ENGWfBpCdq7cIxq6ezXRA+zCe0ioMLd4Wx2cJWwyDil4f 5Qp7IFW4ExFZH++RwhGlHGBC6Ac6LWtZ+yJUKGeAx0q1m/ok3fRMfmUqjANZZi9uHgy6 SQwrOXgI3nBw5iDyrlDxyw6RcwDj0sHTjYdPG+PlrSevmfr/blwbQJOdvcR0ZIkQrO5M 6xcEr+K3q0vc1Kz1ShiLCeLMeed6fCcdtCGKMlKo+WGW8qZEE3Mj6sekcabHgVind8Rb IJxuUcac1+MDhGIZ2aIYNeebpTkeenur5iK4+cpKkf9RvZ4FIoAX/Xpga5NPZM6IK2+o ndVA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=2wNo5gCisSNSY4DpBonESfuBtu+nKV+NqWJSlcqNP1k=; b=Ymc20Xi12CLt/GH6FXLi1vuV+mVsfmPVdzjZ85sZAz/vGHpVlgbnL8oX/dELrg2NCw FRgQFdja18fCdbuvagPtSYvYaCzBncUFXZq4LaOLxD/Uz42xXPGqFkYn6LvYucdDklUs KTDT5ZKWS8ZUlJ4UZm2QAJ5AD8SPtBEbNtzv/hFvGUdF6XjG4xzKXiemzrY2XSMN6KKD MyH2uR41OKlLeniiieq+o1orhv0uBZPLU9d7tWtf86MGnHAI80a8XRSAo51gPbLzXcc+ 5aQ7lPXz4j0fcAigWx97nuD1q8/PohPZI97Azd6hIfGdSPqOB8IQ5B726gZPEy9A58yY /RNg== X-Gm-Message-State: AOAM530qpdJ60iQ6hdpR3icbRTNRWmENIGck5Y0ZWWCEOv9RhoEUZODR BOXoMm9VY9RPzD66lLqTEop5uw== X-Google-Smtp-Source: ABdhPJz7nFbl740B20WwTHMpq/K4K23JnkAR/8/z4A/ermW2Jt4CmpG2l4kc/K3jqNqzIXOHV/nGYw== X-Received: by 2002:a37:d91:: with SMTP id 139mr5446106qkn.455.1599694318194; Wed, 09 Sep 2020 16:31:58 -0700 (PDT) Received: from localhost.localdomain ([2601:18b:300:36ee:8c6:61e3:cd71:8bf3]) by smtp.gmail.com with ESMTPSA id l5sm5059867qtc.28.2020.09.09.16.31.57 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 09 Sep 2020 16:31:57 -0700 (PDT) From: Ted Lemon Message-Id: <4FC30E5B-EF9F-4238-A683-CE8235BDD2EF@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_79F0E0F9-1A86-4FE0-9FEE-29E22D7F63DF" Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.0.3.2.26\)) Date: Wed, 9 Sep 2020 19:31:56 -0400 In-Reply-To: <159969337123.15697.6820068156665930267@ietfa.amsl.com> Cc: secdir@ietf.org, last-call@ietf.org, v6ops@ietf.org, draft-ietf-v6ops-cpe-slaac-renum.all@ietf.org To: Christopher Wood , Christopher Wood via Datatracker References: <159969337123.15697.6820068156665930267@ietfa.amsl.com> X-Mailer: Apple Mail (2.3654.0.3.2.26) Archived-At: Subject: Re: [secdir] [v6ops] Secdir last call review of draft-ietf-v6ops-cpe-slaac-renum-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Sep 2020 23:32:02 -0000 --Apple-Mail=_79F0E0F9-1A86-4FE0-9FEE-29E22D7F63DF Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Sep 9, 2020, at 7:16 PM, Christopher Wood via Datatracker = wrote: > - Section 3: is it possible for an attacker to send DHCPv6 Prefix = Delegations > with lifetime=3D0 to CE routers that support LAN-side DHCPv6 and = amplify > Reconfigure messages to supporting clients? (I don't know if this is a = concern > or part of the threat model, but this did seem to be a case of = possible > request/response asymmetry.) - Section 4: rationale for these default = values, > if available, might be worth including. (Why not make them shorter? = What are > the tradeoffs?) - Section 6: it might be worth noting what happens if = stable > storage is unavailable or otherwise compromised when trying to store = prefix > information. What happens if the "A" or "L" bits are modified? (I = suspect > nothing dangerous, but it's not clear to me whether or not integrity = is > important.) The attacker on the southbound link would have to know the transaction = ID of the DHCP request/confirm/renew message, which is only sent on the = northbound interface, and would have to know the DUID and IAID used by = the client, again never seen on the southbound link, and would have to = know the server=E2=80=99s DUID, again only visible northbound. I don=E2=80= =99t think this is a feasible attack. It=E2=80=99s hard to see what the = benefit of such an attack would be=E2=80=94in order to effect this = attack without knowledge of the exchange on the northbound interface, = the client would have to be continuously spamming the southbound link = with attempts, so that would be a negative amplication factor of perhaps = 2^256, perhaps less if the identifiers can be predicted and renewal = times can be predicted. And this assumes that the DHCPv6 PD client on the CPE device will even = accept a DHCP Reply on its southbound interface. :) --Apple-Mail=_79F0E0F9-1A86-4FE0-9FEE-29E22D7F63DF Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Sep 9, 2020, at 7:16 PM, Christopher Wood via Datatracker <noreply@ietf.org> = wrote:
- Section 3: = is it possible for an attacker to send DHCPv6 Prefix = Delegations
with = lifetime=3D0 to CE routers that support LAN-side DHCPv6 and = amplify
Reconfigure = messages to supporting clients? (I don't know if this is a = concern
or part of = the threat model, but this did seem to be a case of possible
request/response asymmetry.) - Section 4: rationale for these = default values,
if available, might be worth including. (Why not make them = shorter? What are
the tradeoffs?) - Section 6: it might be worth noting what = happens if stable
storage is unavailable or otherwise compromised when trying = to store prefix
information. What happens if the "A" or "L" bits are = modified? (I suspect
nothing dangerous, but it's not clear to me whether or not = integrity is
important.)

The attacker on the southbound link would have to know the = transaction ID of the DHCP request/confirm/renew message, which is only = sent on the northbound interface, and would have to know the DUID and = IAID used by the client, again never seen on the southbound link, and = would have to know the server=E2=80=99s DUID, again only visible = northbound. I don=E2=80=99t think this is a feasible attack. It=E2=80=99s = hard to see what the benefit of such an attack would be=E2=80=94in order = to effect this attack without knowledge of the exchange on the = northbound interface, the client would have to be continuously spamming = the southbound link with attempts, so that would be a negative = amplication factor of perhaps 2^256, perhaps less if the identifiers can = be predicted and renewal times can be predicted.

And this assumes that the DHCPv6 PD = client on the CPE device will even accept a DHCP Reply on its southbound = interface.

:)

= --Apple-Mail=_79F0E0F9-1A86-4FE0-9FEE-29E22D7F63DF-- From nobody Wed Sep 9 19:17:44 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DFFE23A0A83; Wed, 9 Sep 2020 19:17:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z5xtf1NCJ5qT; Wed, 9 Sep 2020 19:17:41 -0700 (PDT) Received: from outgoing-exchange-5.mit.edu (outgoing-exchange-5.mit.edu [18.9.28.59]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AE6D63A0A82; Wed, 9 Sep 2020 19:17:40 -0700 (PDT) Received: from oc11exedge1.exchange.mit.edu (OC11EXEDGE1.EXCHANGE.MIT.EDU [18.9.3.17]) by outgoing-exchange-5.mit.edu (8.14.7/8.12.4) with ESMTP id 08A2HWBS031219; Wed, 9 Sep 2020 22:17:33 -0400 Received: from oc11expo31.exchange.mit.edu (18.9.4.104) by oc11exedge1.exchange.mit.edu (18.9.3.17) with Microsoft SMTP Server (TLS) id 15.0.1293.2; Wed, 9 Sep 2020 22:17:32 -0400 Received: from oc11expo31.exchange.mit.edu (18.9.4.104) by oc11expo31.exchange.mit.edu (18.9.4.104) with Microsoft SMTP Server (TLS) id 15.0.1365.1; Wed, 9 Sep 2020 22:17:33 -0400 Received: from oc11expo31.exchange.mit.edu ([18.9.4.104]) by oc11expo31.exchange.mit.edu ([18.9.4.104]) with mapi id 15.00.1365.000; Wed, 9 Sep 2020 22:17:33 -0400 From: Uri Blumenthal To: Ted Lemon CC: Christopher Wood , Christopher Wood via Datatracker , "last-call@ietf.org" , "v6ops@ietf.org" , "draft-ietf-v6ops-cpe-slaac-renum.all@ietf.org" , "secdir@ietf.org" Thread-Topic: [secdir] [v6ops] Secdir last call review of draft-ietf-v6ops-cpe-slaac-renum-04 Thread-Index: AQHWhwF7e7SlyDtnvU2s/txTJbnRbalhZh8A Date: Thu, 10 Sep 2020 02:17:33 +0000 Message-ID: <54DA4651-1C55-4DF9-BF3D-7E851B6692F4@mit.edu> References: <4FC30E5B-EF9F-4238-A683-CE8235BDD2EF@fugue.com> In-Reply-To: <4FC30E5B-EF9F-4238-A683-CE8235BDD2EF@fugue.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted Content-Type: multipart/signed; boundary="Apple-Mail-20FE2E7B-F5C2-485D-A9F8-CE4E520C868A"; protocol="application/pkcs7-signature"; micalg=sha-256 MIME-Version: 1.0 Archived-At: Subject: Re: [secdir] [v6ops] Secdir last call review of draft-ietf-v6ops-cpe-slaac-renum-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Sep 2020 02:17:43 -0000 --Apple-Mail-20FE2E7B-F5C2-485D-A9F8-CE4E520C868A Content-Type: multipart/alternative; boundary=Apple-Mail-C0A38F14-FCC0-4638-8512-E3AC1AF078A0 Content-Transfer-Encoding: 7bit --Apple-Mail-C0A38F14-FCC0-4638-8512-E3AC1AF078A0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: base64 Q2FwYWJpbGl0eS13aXNlLCB3aGF0J3MgdGhlIGxpa2VsaWhvb2QgdGhhdCB0aGUgYXR0YWNrZXIg d291bGQgYmUgcHJlc2VudCBvbiB0aGUgc291dGhib3VuZCBpbnRlcmZhY2UsIGJ1dCAqbm90KiBv biB0aGUgbm9ydGhib3VuZCBvbmU/DQoNClNlbnQgZnJvbSBteSB0ZXN0IGlQaG9uZQ0KDQo+IE9u IFNlcCA5LCAyMDIwLCBhdCAxOTozMiwgVGVkIExlbW9uIDxtZWxsb25AZnVndWUuY29tPiB3cm90 ZToNCj4gDQo+IO+7vyBPbiBTZXAgOSwgMjAyMCwgYXQgNzoxNiBQTSwgQ2hyaXN0b3BoZXIgV29v ZCB2aWEgRGF0YXRyYWNrZXIgPG5vcmVwbHlAaWV0Zi5vcmc+IHdyb3RlOg0KPj4gLSBTZWN0aW9u IDM6IGlzIGl0IHBvc3NpYmxlIGZvciBhbiBhdHRhY2tlciB0byBzZW5kIERIQ1B2NiBQcmVmaXgg RGVsZWdhdGlvbnMNCj4+IHdpdGggbGlmZXRpbWU9MCB0byBDRSByb3V0ZXJzIHRoYXQgc3VwcG9y dCBMQU4tc2lkZSBESENQdjYgYW5kIGFtcGxpZnkNCj4+IFJlY29uZmlndXJlIG1lc3NhZ2VzIHRv IHN1cHBvcnRpbmcgY2xpZW50cz8gKEkgZG9uJ3Qga25vdyBpZiB0aGlzIGlzIGEgY29uY2Vybg0K Pj4gb3IgcGFydCBvZiB0aGUgdGhyZWF0IG1vZGVsLCBidXQgdGhpcyBkaWQgc2VlbSB0byBiZSBh IGNhc2Ugb2YgcG9zc2libGUNCj4+IHJlcXVlc3QvcmVzcG9uc2UgYXN5bW1ldHJ5LikgLSBTZWN0 aW9uIDQ6IHJhdGlvbmFsZSBmb3IgdGhlc2UgZGVmYXVsdCB2YWx1ZXMsDQo+PiBpZiBhdmFpbGFi bGUsIG1pZ2h0IGJlIHdvcnRoIGluY2x1ZGluZy4gKFdoeSBub3QgbWFrZSB0aGVtIHNob3J0ZXI/ IFdoYXQgYXJlDQo+PiB0aGUgdHJhZGVvZmZzPykgLSBTZWN0aW9uIDY6IGl0IG1pZ2h0IGJlIHdv cnRoIG5vdGluZyB3aGF0IGhhcHBlbnMgaWYgc3RhYmxlDQo+PiBzdG9yYWdlIGlzIHVuYXZhaWxh YmxlIG9yIG90aGVyd2lzZSBjb21wcm9taXNlZCB3aGVuIHRyeWluZyB0byBzdG9yZSBwcmVmaXgN Cj4+IGluZm9ybWF0aW9uLiBXaGF0IGhhcHBlbnMgaWYgdGhlICJBIiBvciAiTCIgYml0cyBhcmUg bW9kaWZpZWQ/IChJIHN1c3BlY3QNCj4+IG5vdGhpbmcgZGFuZ2Vyb3VzLCBidXQgaXQncyBub3Qg Y2xlYXIgdG8gbWUgd2hldGhlciBvciBub3QgaW50ZWdyaXR5IGlzDQo+PiBpbXBvcnRhbnQuKQ0K PiANCj4gVGhlIGF0dGFja2VyIG9uIHRoZSBzb3V0aGJvdW5kIGxpbmsgd291bGQgaGF2ZSB0byBr bm93IHRoZSB0cmFuc2FjdGlvbiBJRCBvZiB0aGUgREhDUCByZXF1ZXN0L2NvbmZpcm0vcmVuZXcg bWVzc2FnZSwgd2hpY2ggaXMgb25seSBzZW50IG9uIHRoZSBub3J0aGJvdW5kIGludGVyZmFjZSwg YW5kIHdvdWxkIGhhdmUgdG8ga25vdyB0aGUgRFVJRCBhbmQgSUFJRCB1c2VkIGJ5IHRoZSBjbGll bnQsIGFnYWluIG5ldmVyIHNlZW4gb24gdGhlIHNvdXRoYm91bmQgbGluaywgYW5kIHdvdWxkIGhh dmUgdG8ga25vdyB0aGUgc2VydmVy4oCZcyBEVUlELCBhZ2FpbiBvbmx5IHZpc2libGUgbm9ydGhi b3VuZC4gSSBkb27igJl0IHRoaW5rIHRoaXMgaXMgYSBmZWFzaWJsZSBhdHRhY2suIEl04oCZcyBo YXJkIHRvIHNlZSB3aGF0IHRoZSBiZW5lZml0IG9mIHN1Y2ggYW4gYXR0YWNrIHdvdWxkIGJl4oCU aW4gb3JkZXIgdG8gZWZmZWN0IHRoaXMgYXR0YWNrIHdpdGhvdXQga25vd2xlZGdlIG9mIHRoZSBl eGNoYW5nZSBvbiB0aGUgbm9ydGhib3VuZCBpbnRlcmZhY2UsIHRoZSBjbGllbnQgd291bGQgaGF2 ZSB0byBiZSBjb250aW51b3VzbHkgc3BhbW1pbmcgdGhlIHNvdXRoYm91bmQgbGluayB3aXRoIGF0 dGVtcHRzLCBzbyB0aGF0IHdvdWxkIGJlIGEgbmVnYXRpdmUgYW1wbGljYXRpb24gZmFjdG9yIG9m IHBlcmhhcHMgMl4yNTYsIHBlcmhhcHMgbGVzcyBpZiB0aGUgaWRlbnRpZmllcnMgY2FuIGJlIHBy ZWRpY3RlZCBhbmQgcmVuZXdhbCB0aW1lcyBjYW4gYmUgcHJlZGljdGVkLg0KPiANCj4gQW5kIHRo aXMgYXNzdW1lcyB0aGF0IHRoZSBESENQdjYgUEQgY2xpZW50IG9uIHRoZSBDUEUgZGV2aWNlIHdp bGwgZXZlbiBhY2NlcHQgYSBESENQIFJlcGx5IG9uIGl0cyBzb3V0aGJvdW5kIGludGVyZmFjZS4N Cj4gDQo+IDopDQo+IA0KPiBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXw0KPiBzZWNkaXIgbWFpbGluZyBsaXN0DQo+IHNlY2RpckBpZXRmLm9yZw0KPiBodHRw czovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NlY2Rpcg0KPiB3aWtpOiBodHRwOi8v dG9vbHMuaWV0Zi5vcmcvYXJlYS9zZWMvdHJhYy93aWtpL1NlY0RpclJldmlldw0K --Apple-Mail-C0A38F14-FCC0-4638-8512-E3AC1AF078A0 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: base64 PGh0bWw+PGhlYWQ+PG1ldGEgaHR0cC1lcXVpdj0iY29udGVudC10eXBlIiBjb250ZW50PSJ0ZXh0 L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPjwvaGVhZD48Ym9keSBkaXI9ImF1dG8iPkNhcGFiaWxpdHkt d2lzZSwgd2hhdCdzIHRoZSBsaWtlbGlob29kIHRoYXQgdGhlIGF0dGFja2VyIHdvdWxkIGJlIHBy ZXNlbnQgb24gdGhlIHNvdXRoYm91bmQgaW50ZXJmYWNlLCBidXQgKm5vdCogb24gdGhlIG5vcnRo Ym91bmQgb25lPzxicj48YnI+PGRpdiBkaXI9Imx0ciI+U2VudCBmcm9tIG15IHRlc3QgaVBob25l PC9kaXY+PGRpdiBkaXI9Imx0ciI+PGJyPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPk9uIFNlcCA5 LCAyMDIwLCBhdCAxOTozMiwgVGVkIExlbW9uICZsdDttZWxsb25AZnVndWUuY29tJmd0OyB3cm90 ZTo8YnI+PGJyPjwvYmxvY2txdW90ZT48L2Rpdj48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48ZGl2 IGRpcj0ibHRyIj7vu78NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij5PbiBTZXAgOSwgMjAyMCwgYXQgNzoxNiBQTSwgQ2hy aXN0b3BoZXIgV29vZCB2aWEgRGF0YXRyYWNrZXIgJmx0OzxhIGhyZWY9Im1haWx0bzpub3JlcGx5 QGlldGYub3JnIiBjbGFzcz0iIj5ub3JlcGx5QGlldGYub3JnPC9hPiZndDsgd3JvdGU6PGRpdj48 YmxvY2txdW90ZSB0eXBlPSJjaXRlIiBjbGFzcz0iIj48ZGl2IGNsYXNzPSIiPjxzcGFuIHN0eWxl PSJjYXJldC1jb2xvcjogcmdiKDAsIDAsIDApOyBmb250LWZhbWlseTogTWVubG8tUmVndWxhcjsg Zm9udC1zaXplOiAxNHB4OyBmb250LXN0eWxlOiBub3JtYWw7IGZvbnQtdmFyaWFudC1jYXBzOiBu b3JtYWw7IGZvbnQtd2VpZ2h0OiBub3JtYWw7IGxldHRlci1zcGFjaW5nOiBub3JtYWw7IHRleHQt YWxpZ246IHN0YXJ0OyB0ZXh0LWluZGVudDogMHB4OyB0ZXh0LXRyYW5zZm9ybTogbm9uZTsgd2hp dGUtc3BhY2U6IG5vcm1hbDsgd29yZC1zcGFjaW5nOiAwcHg7IC13ZWJraXQtdGV4dC1zdHJva2Ut d2lkdGg6IDBweDsgdGV4dC1kZWNvcmF0aW9uOiBub25lOyBmbG9hdDogbm9uZTsgZGlzcGxheTog aW5saW5lICFpbXBvcnRhbnQ7IiBjbGFzcz0iIj4tIFNlY3Rpb24gMzogaXMgaXQgcG9zc2libGUg Zm9yIGFuIGF0dGFja2VyIHRvIHNlbmQgREhDUHY2IFByZWZpeCBEZWxlZ2F0aW9uczwvc3Bhbj48 YnIgc3R5bGU9ImNhcmV0LWNvbG9yOiByZ2IoMCwgMCwgMCk7IGZvbnQtZmFtaWx5OiBNZW5sby1S ZWd1bGFyOyBmb250LXNpemU6IDE0cHg7IGZvbnQtc3R5bGU6IG5vcm1hbDsgZm9udC12YXJpYW50 LWNhcHM6IG5vcm1hbDsgZm9udC13ZWlnaHQ6IG5vcm1hbDsgbGV0dGVyLXNwYWNpbmc6IG5vcm1h bDsgdGV4dC1hbGlnbjogc3RhcnQ7IHRleHQtaW5kZW50OiAwcHg7IHRleHQtdHJhbnNmb3JtOiBu b25lOyB3aGl0ZS1zcGFjZTogbm9ybWFsOyB3b3JkLXNwYWNpbmc6IDBweDsgLXdlYmtpdC10ZXh0 LXN0cm9rZS13aWR0aDogMHB4OyB0ZXh0LWRlY29yYXRpb246IG5vbmU7IiBjbGFzcz0iIj48c3Bh biBzdHlsZT0iY2FyZXQtY29sb3I6IHJnYigwLCAwLCAwKTsgZm9udC1mYW1pbHk6IE1lbmxvLVJl Z3VsYXI7IGZvbnQtc2l6ZTogMTRweDsgZm9udC1zdHlsZTogbm9ybWFsOyBmb250LXZhcmlhbnQt Y2Fwczogbm9ybWFsOyBmb250LXdlaWdodDogbm9ybWFsOyBsZXR0ZXItc3BhY2luZzogbm9ybWFs OyB0ZXh0LWFsaWduOiBzdGFydDsgdGV4dC1pbmRlbnQ6IDBweDsgdGV4dC10cmFuc2Zvcm06IG5v bmU7IHdoaXRlLXNwYWNlOiBub3JtYWw7IHdvcmQtc3BhY2luZzogMHB4OyAtd2Via2l0LXRleHQt c3Ryb2tlLXdpZHRoOiAwcHg7IHRleHQtZGVjb3JhdGlvbjogbm9uZTsgZmxvYXQ6IG5vbmU7IGRp c3BsYXk6IGlubGluZSAhaW1wb3J0YW50OyIgY2xhc3M9IiI+d2l0aCBsaWZldGltZT0wIHRvIENF IHJvdXRlcnMgdGhhdCBzdXBwb3J0IExBTi1zaWRlIERIQ1B2NiBhbmQgYW1wbGlmeTwvc3Bhbj48 YnIgc3R5bGU9ImNhcmV0LWNvbG9yOiByZ2IoMCwgMCwgMCk7IGZvbnQtZmFtaWx5OiBNZW5sby1S ZWd1bGFyOyBmb250LXNpemU6IDE0cHg7IGZvbnQtc3R5bGU6IG5vcm1hbDsgZm9udC12YXJpYW50 LWNhcHM6IG5vcm1hbDsgZm9udC13ZWlnaHQ6IG5vcm1hbDsgbGV0dGVyLXNwYWNpbmc6IG5vcm1h bDsgdGV4dC1hbGlnbjogc3RhcnQ7IHRleHQtaW5kZW50OiAwcHg7IHRleHQtdHJhbnNmb3JtOiBu b25lOyB3aGl0ZS1zcGFjZTogbm9ybWFsOyB3b3JkLXNwYWNpbmc6IDBweDsgLXdlYmtpdC10ZXh0 LXN0cm9rZS13aWR0aDogMHB4OyB0ZXh0LWRlY29yYXRpb246IG5vbmU7IiBjbGFzcz0iIj48c3Bh biBzdHlsZT0iY2FyZXQtY29sb3I6IHJnYigwLCAwLCAwKTsgZm9udC1mYW1pbHk6IE1lbmxvLVJl Z3VsYXI7IGZvbnQtc2l6ZTogMTRweDsgZm9udC1zdHlsZTogbm9ybWFsOyBmb250LXZhcmlhbnQt Y2Fwczogbm9ybWFsOyBmb250LXdlaWdodDogbm9ybWFsOyBsZXR0ZXItc3BhY2luZzogbm9ybWFs OyB0ZXh0LWFsaWduOiBzdGFydDsgdGV4dC1pbmRlbnQ6IDBweDsgdGV4dC10cmFuc2Zvcm06IG5v bmU7IHdoaXRlLXNwYWNlOiBub3JtYWw7IHdvcmQtc3BhY2luZzogMHB4OyAtd2Via2l0LXRleHQt c3Ryb2tlLXdpZHRoOiAwcHg7IHRleHQtZGVjb3JhdGlvbjogbm9uZTsgZmxvYXQ6IG5vbmU7IGRp c3BsYXk6IGlubGluZSAhaW1wb3J0YW50OyIgY2xhc3M9IiI+UmVjb25maWd1cmUgbWVzc2FnZXMg dG8gc3VwcG9ydGluZyBjbGllbnRzPyAoSSBkb24ndCBrbm93IGlmIHRoaXMgaXMgYSBjb25jZXJu PC9zcGFuPjxiciBzdHlsZT0iY2FyZXQtY29sb3I6IHJnYigwLCAwLCAwKTsgZm9udC1mYW1pbHk6 IE1lbmxvLVJlZ3VsYXI7IGZvbnQtc2l6ZTogMTRweDsgZm9udC1zdHlsZTogbm9ybWFsOyBmb250 LXZhcmlhbnQtY2Fwczogbm9ybWFsOyBmb250LXdlaWdodDogbm9ybWFsOyBsZXR0ZXItc3BhY2lu Zzogbm9ybWFsOyB0ZXh0LWFsaWduOiBzdGFydDsgdGV4dC1pbmRlbnQ6IDBweDsgdGV4dC10cmFu c2Zvcm06IG5vbmU7IHdoaXRlLXNwYWNlOiBub3JtYWw7IHdvcmQtc3BhY2luZzogMHB4OyAtd2Vi a2l0LXRleHQtc3Ryb2tlLXdpZHRoOiAwcHg7IHRleHQtZGVjb3JhdGlvbjogbm9uZTsiIGNsYXNz PSIiPjxzcGFuIHN0eWxlPSJjYXJldC1jb2xvcjogcmdiKDAsIDAsIDApOyBmb250LWZhbWlseTog TWVubG8tUmVndWxhcjsgZm9udC1zaXplOiAxNHB4OyBmb250LXN0eWxlOiBub3JtYWw7IGZvbnQt dmFyaWFudC1jYXBzOiBub3JtYWw7IGZvbnQtd2VpZ2h0OiBub3JtYWw7IGxldHRlci1zcGFjaW5n OiBub3JtYWw7IHRleHQtYWxpZ246IHN0YXJ0OyB0ZXh0LWluZGVudDogMHB4OyB0ZXh0LXRyYW5z Zm9ybTogbm9uZTsgd2hpdGUtc3BhY2U6IG5vcm1hbDsgd29yZC1zcGFjaW5nOiAwcHg7IC13ZWJr aXQtdGV4dC1zdHJva2Utd2lkdGg6IDBweDsgdGV4dC1kZWNvcmF0aW9uOiBub25lOyBmbG9hdDog bm9uZTsgZGlzcGxheTogaW5saW5lICFpbXBvcnRhbnQ7IiBjbGFzcz0iIj5vciBwYXJ0IG9mIHRo ZSB0aHJlYXQgbW9kZWwsIGJ1dCB0aGlzIGRpZCBzZWVtIHRvIGJlIGEgY2FzZSBvZiBwb3NzaWJs ZTwvc3Bhbj48YnIgc3R5bGU9ImNhcmV0LWNvbG9yOiByZ2IoMCwgMCwgMCk7IGZvbnQtZmFtaWx5 OiBNZW5sby1SZWd1bGFyOyBmb250LXNpemU6IDE0cHg7IGZvbnQtc3R5bGU6IG5vcm1hbDsgZm9u dC12YXJpYW50LWNhcHM6IG5vcm1hbDsgZm9udC13ZWlnaHQ6IG5vcm1hbDsgbGV0dGVyLXNwYWNp bmc6IG5vcm1hbDsgdGV4dC1hbGlnbjogc3RhcnQ7IHRleHQtaW5kZW50OiAwcHg7IHRleHQtdHJh bnNmb3JtOiBub25lOyB3aGl0ZS1zcGFjZTogbm9ybWFsOyB3b3JkLXNwYWNpbmc6IDBweDsgLXdl YmtpdC10ZXh0LXN0cm9rZS13aWR0aDogMHB4OyB0ZXh0LWRlY29yYXRpb246IG5vbmU7IiBjbGFz cz0iIj48c3BhbiBzdHlsZT0iY2FyZXQtY29sb3I6IHJnYigwLCAwLCAwKTsgZm9udC1mYW1pbHk6 IE1lbmxvLVJlZ3VsYXI7IGZvbnQtc2l6ZTogMTRweDsgZm9udC1zdHlsZTogbm9ybWFsOyBmb250 LXZhcmlhbnQtY2Fwczogbm9ybWFsOyBmb250LXdlaWdodDogbm9ybWFsOyBsZXR0ZXItc3BhY2lu Zzogbm9ybWFsOyB0ZXh0LWFsaWduOiBzdGFydDsgdGV4dC1pbmRlbnQ6IDBweDsgdGV4dC10cmFu c2Zvcm06IG5vbmU7IHdoaXRlLXNwYWNlOiBub3JtYWw7IHdvcmQtc3BhY2luZzogMHB4OyAtd2Vi a2l0LXRleHQtc3Ryb2tlLXdpZHRoOiAwcHg7IHRleHQtZGVjb3JhdGlvbjogbm9uZTsgZmxvYXQ6 IG5vbmU7IGRpc3BsYXk6IGlubGluZSAhaW1wb3J0YW50OyIgY2xhc3M9IiI+cmVxdWVzdC9yZXNw b25zZSBhc3ltbWV0cnkuKSAtIFNlY3Rpb24gNDogcmF0aW9uYWxlIGZvciB0aGVzZSBkZWZhdWx0 IHZhbHVlcyw8L3NwYW4+PGJyIHN0eWxlPSJjYXJldC1jb2xvcjogcmdiKDAsIDAsIDApOyBmb250 LWZhbWlseTogTWVubG8tUmVndWxhcjsgZm9udC1zaXplOiAxNHB4OyBmb250LXN0eWxlOiBub3Jt YWw7IGZvbnQtdmFyaWFudC1jYXBzOiBub3JtYWw7IGZvbnQtd2VpZ2h0OiBub3JtYWw7IGxldHRl ci1zcGFjaW5nOiBub3JtYWw7IHRleHQtYWxpZ246IHN0YXJ0OyB0ZXh0LWluZGVudDogMHB4OyB0 ZXh0LXRyYW5zZm9ybTogbm9uZTsgd2hpdGUtc3BhY2U6IG5vcm1hbDsgd29yZC1zcGFjaW5nOiAw cHg7IC13ZWJraXQtdGV4dC1zdHJva2Utd2lkdGg6IDBweDsgdGV4dC1kZWNvcmF0aW9uOiBub25l OyIgY2xhc3M9IiI+PHNwYW4gc3R5bGU9ImNhcmV0LWNvbG9yOiByZ2IoMCwgMCwgMCk7IGZvbnQt ZmFtaWx5OiBNZW5sby1SZWd1bGFyOyBmb250LXNpemU6IDE0cHg7IGZvbnQtc3R5bGU6IG5vcm1h bDsgZm9udC12YXJpYW50LWNhcHM6IG5vcm1hbDsgZm9udC13ZWlnaHQ6IG5vcm1hbDsgbGV0dGVy LXNwYWNpbmc6IG5vcm1hbDsgdGV4dC1hbGlnbjogc3RhcnQ7IHRleHQtaW5kZW50OiAwcHg7IHRl eHQtdHJhbnNmb3JtOiBub25lOyB3aGl0ZS1zcGFjZTogbm9ybWFsOyB3b3JkLXNwYWNpbmc6IDBw eDsgLXdlYmtpdC10ZXh0LXN0cm9rZS13aWR0aDogMHB4OyB0ZXh0LWRlY29yYXRpb246IG5vbmU7 IGZsb2F0OiBub25lOyBkaXNwbGF5OiBpbmxpbmUgIWltcG9ydGFudDsiIGNsYXNzPSIiPmlmIGF2 YWlsYWJsZSwgbWlnaHQgYmUgd29ydGggaW5jbHVkaW5nLiAoV2h5IG5vdCBtYWtlIHRoZW0gc2hv cnRlcj8gV2hhdCBhcmU8L3NwYW4+PGJyIHN0eWxlPSJjYXJldC1jb2xvcjogcmdiKDAsIDAsIDAp OyBmb250LWZhbWlseTogTWVubG8tUmVndWxhcjsgZm9udC1zaXplOiAxNHB4OyBmb250LXN0eWxl OiBub3JtYWw7IGZvbnQtdmFyaWFudC1jYXBzOiBub3JtYWw7IGZvbnQtd2VpZ2h0OiBub3JtYWw7 IGxldHRlci1zcGFjaW5nOiBub3JtYWw7IHRleHQtYWxpZ246IHN0YXJ0OyB0ZXh0LWluZGVudDog MHB4OyB0ZXh0LXRyYW5zZm9ybTogbm9uZTsgd2hpdGUtc3BhY2U6IG5vcm1hbDsgd29yZC1zcGFj aW5nOiAwcHg7IC13ZWJraXQtdGV4dC1zdHJva2Utd2lkdGg6IDBweDsgdGV4dC1kZWNvcmF0aW9u OiBub25lOyIgY2xhc3M9IiI+PHNwYW4gc3R5bGU9ImNhcmV0LWNvbG9yOiByZ2IoMCwgMCwgMCk7 IGZvbnQtZmFtaWx5OiBNZW5sby1SZWd1bGFyOyBmb250LXNpemU6IDE0cHg7IGZvbnQtc3R5bGU6 IG5vcm1hbDsgZm9udC12YXJpYW50LWNhcHM6IG5vcm1hbDsgZm9udC13ZWlnaHQ6IG5vcm1hbDsg bGV0dGVyLXNwYWNpbmc6IG5vcm1hbDsgdGV4dC1hbGlnbjogc3RhcnQ7IHRleHQtaW5kZW50OiAw cHg7IHRleHQtdHJhbnNmb3JtOiBub25lOyB3aGl0ZS1zcGFjZTogbm9ybWFsOyB3b3JkLXNwYWNp bmc6IDBweDsgLXdlYmtpdC10ZXh0LXN0cm9rZS13aWR0aDogMHB4OyB0ZXh0LWRlY29yYXRpb246 IG5vbmU7IGZsb2F0OiBub25lOyBkaXNwbGF5OiBpbmxpbmUgIWltcG9ydGFudDsiIGNsYXNzPSIi PnRoZSB0cmFkZW9mZnM/KSAtIFNlY3Rpb24gNjogaXQgbWlnaHQgYmUgd29ydGggbm90aW5nIHdo YXQgaGFwcGVucyBpZiBzdGFibGU8L3NwYW4+PGJyIHN0eWxlPSJjYXJldC1jb2xvcjogcmdiKDAs IDAsIDApOyBmb250LWZhbWlseTogTWVubG8tUmVndWxhcjsgZm9udC1zaXplOiAxNHB4OyBmb250 LXN0eWxlOiBub3JtYWw7IGZvbnQtdmFyaWFudC1jYXBzOiBub3JtYWw7IGZvbnQtd2VpZ2h0OiBu b3JtYWw7IGxldHRlci1zcGFjaW5nOiBub3JtYWw7IHRleHQtYWxpZ246IHN0YXJ0OyB0ZXh0LWlu ZGVudDogMHB4OyB0ZXh0LXRyYW5zZm9ybTogbm9uZTsgd2hpdGUtc3BhY2U6IG5vcm1hbDsgd29y ZC1zcGFjaW5nOiAwcHg7IC13ZWJraXQtdGV4dC1zdHJva2Utd2lkdGg6IDBweDsgdGV4dC1kZWNv cmF0aW9uOiBub25lOyIgY2xhc3M9IiI+PHNwYW4gc3R5bGU9ImNhcmV0LWNvbG9yOiByZ2IoMCwg MCwgMCk7IGZvbnQtZmFtaWx5OiBNZW5sby1SZWd1bGFyOyBmb250LXNpemU6IDE0cHg7IGZvbnQt c3R5bGU6IG5vcm1hbDsgZm9udC12YXJpYW50LWNhcHM6IG5vcm1hbDsgZm9udC13ZWlnaHQ6IG5v cm1hbDsgbGV0dGVyLXNwYWNpbmc6IG5vcm1hbDsgdGV4dC1hbGlnbjogc3RhcnQ7IHRleHQtaW5k ZW50OiAwcHg7IHRleHQtdHJhbnNmb3JtOiBub25lOyB3aGl0ZS1zcGFjZTogbm9ybWFsOyB3b3Jk LXNwYWNpbmc6IDBweDsgLXdlYmtpdC10ZXh0LXN0cm9rZS13aWR0aDogMHB4OyB0ZXh0LWRlY29y YXRpb246IG5vbmU7IGZsb2F0OiBub25lOyBkaXNwbGF5OiBpbmxpbmUgIWltcG9ydGFudDsiIGNs YXNzPSIiPnN0b3JhZ2UgaXMgdW5hdmFpbGFibGUgb3Igb3RoZXJ3aXNlIGNvbXByb21pc2VkIHdo ZW4gdHJ5aW5nIHRvIHN0b3JlIHByZWZpeDwvc3Bhbj48YnIgc3R5bGU9ImNhcmV0LWNvbG9yOiBy Z2IoMCwgMCwgMCk7IGZvbnQtZmFtaWx5OiBNZW5sby1SZWd1bGFyOyBmb250LXNpemU6IDE0cHg7 IGZvbnQtc3R5bGU6IG5vcm1hbDsgZm9udC12YXJpYW50LWNhcHM6IG5vcm1hbDsgZm9udC13ZWln aHQ6IG5vcm1hbDsgbGV0dGVyLXNwYWNpbmc6IG5vcm1hbDsgdGV4dC1hbGlnbjogc3RhcnQ7IHRl eHQtaW5kZW50OiAwcHg7IHRleHQtdHJhbnNmb3JtOiBub25lOyB3aGl0ZS1zcGFjZTogbm9ybWFs OyB3b3JkLXNwYWNpbmc6IDBweDsgLXdlYmtpdC10ZXh0LXN0cm9rZS13aWR0aDogMHB4OyB0ZXh0 LWRlY29yYXRpb246IG5vbmU7IiBjbGFzcz0iIj48c3BhbiBzdHlsZT0iY2FyZXQtY29sb3I6IHJn YigwLCAwLCAwKTsgZm9udC1mYW1pbHk6IE1lbmxvLVJlZ3VsYXI7IGZvbnQtc2l6ZTogMTRweDsg Zm9udC1zdHlsZTogbm9ybWFsOyBmb250LXZhcmlhbnQtY2Fwczogbm9ybWFsOyBmb250LXdlaWdo dDogbm9ybWFsOyBsZXR0ZXItc3BhY2luZzogbm9ybWFsOyB0ZXh0LWFsaWduOiBzdGFydDsgdGV4 dC1pbmRlbnQ6IDBweDsgdGV4dC10cmFuc2Zvcm06IG5vbmU7IHdoaXRlLXNwYWNlOiBub3JtYWw7 IHdvcmQtc3BhY2luZzogMHB4OyAtd2Via2l0LXRleHQtc3Ryb2tlLXdpZHRoOiAwcHg7IHRleHQt ZGVjb3JhdGlvbjogbm9uZTsgZmxvYXQ6IG5vbmU7IGRpc3BsYXk6IGlubGluZSAhaW1wb3J0YW50 OyIgY2xhc3M9IiI+aW5mb3JtYXRpb24uIFdoYXQgaGFwcGVucyBpZiB0aGUgIkEiIG9yICJMIiBi aXRzIGFyZSBtb2RpZmllZD8gKEkgc3VzcGVjdDwvc3Bhbj48YnIgc3R5bGU9ImNhcmV0LWNvbG9y OiByZ2IoMCwgMCwgMCk7IGZvbnQtZmFtaWx5OiBNZW5sby1SZWd1bGFyOyBmb250LXNpemU6IDE0 cHg7IGZvbnQtc3R5bGU6IG5vcm1hbDsgZm9udC12YXJpYW50LWNhcHM6IG5vcm1hbDsgZm9udC13 ZWlnaHQ6IG5vcm1hbDsgbGV0dGVyLXNwYWNpbmc6IG5vcm1hbDsgdGV4dC1hbGlnbjogc3RhcnQ7 IHRleHQtaW5kZW50OiAwcHg7IHRleHQtdHJhbnNmb3JtOiBub25lOyB3aGl0ZS1zcGFjZTogbm9y bWFsOyB3b3JkLXNwYWNpbmc6IDBweDsgLXdlYmtpdC10ZXh0LXN0cm9rZS13aWR0aDogMHB4OyB0 ZXh0LWRlY29yYXRpb246IG5vbmU7IiBjbGFzcz0iIj48c3BhbiBzdHlsZT0iY2FyZXQtY29sb3I6 IHJnYigwLCAwLCAwKTsgZm9udC1mYW1pbHk6IE1lbmxvLVJlZ3VsYXI7IGZvbnQtc2l6ZTogMTRw eDsgZm9udC1zdHlsZTogbm9ybWFsOyBmb250LXZhcmlhbnQtY2Fwczogbm9ybWFsOyBmb250LXdl aWdodDogbm9ybWFsOyBsZXR0ZXItc3BhY2luZzogbm9ybWFsOyB0ZXh0LWFsaWduOiBzdGFydDsg dGV4dC1pbmRlbnQ6IDBweDsgdGV4dC10cmFuc2Zvcm06IG5vbmU7IHdoaXRlLXNwYWNlOiBub3Jt YWw7IHdvcmQtc3BhY2luZzogMHB4OyAtd2Via2l0LXRleHQtc3Ryb2tlLXdpZHRoOiAwcHg7IHRl eHQtZGVjb3JhdGlvbjogbm9uZTsgZmxvYXQ6IG5vbmU7IGRpc3BsYXk6IGlubGluZSAhaW1wb3J0 YW50OyIgY2xhc3M9IiI+bm90aGluZyBkYW5nZXJvdXMsIGJ1dCBpdCdzIG5vdCBjbGVhciB0byBt ZSB3aGV0aGVyIG9yIG5vdCBpbnRlZ3JpdHkgaXM8L3NwYW4+PGJyIHN0eWxlPSJjYXJldC1jb2xv cjogcmdiKDAsIDAsIDApOyBmb250LWZhbWlseTogTWVubG8tUmVndWxhcjsgZm9udC1zaXplOiAx NHB4OyBmb250LXN0eWxlOiBub3JtYWw7IGZvbnQtdmFyaWFudC1jYXBzOiBub3JtYWw7IGZvbnQt d2VpZ2h0OiBub3JtYWw7IGxldHRlci1zcGFjaW5nOiBub3JtYWw7IHRleHQtYWxpZ246IHN0YXJ0 OyB0ZXh0LWluZGVudDogMHB4OyB0ZXh0LXRyYW5zZm9ybTogbm9uZTsgd2hpdGUtc3BhY2U6IG5v cm1hbDsgd29yZC1zcGFjaW5nOiAwcHg7IC13ZWJraXQtdGV4dC1zdHJva2Utd2lkdGg6IDBweDsg dGV4dC1kZWNvcmF0aW9uOiBub25lOyIgY2xhc3M9IiI+PHNwYW4gc3R5bGU9ImNhcmV0LWNvbG9y OiByZ2IoMCwgMCwgMCk7IGZvbnQtZmFtaWx5OiBNZW5sby1SZWd1bGFyOyBmb250LXNpemU6IDE0 cHg7IGZvbnQtc3R5bGU6IG5vcm1hbDsgZm9udC12YXJpYW50LWNhcHM6IG5vcm1hbDsgZm9udC13 ZWlnaHQ6IG5vcm1hbDsgbGV0dGVyLXNwYWNpbmc6IG5vcm1hbDsgdGV4dC1hbGlnbjogc3RhcnQ7 IHRleHQtaW5kZW50OiAwcHg7IHRleHQtdHJhbnNmb3JtOiBub25lOyB3aGl0ZS1zcGFjZTogbm9y bWFsOyB3b3JkLXNwYWNpbmc6IDBweDsgLXdlYmtpdC10ZXh0LXN0cm9rZS13aWR0aDogMHB4OyB0 ZXh0LWRlY29yYXRpb246IG5vbmU7IGZsb2F0OiBub25lOyBkaXNwbGF5OiBpbmxpbmUgIWltcG9y dGFudDsiIGNsYXNzPSIiPmltcG9ydGFudC4pPC9zcGFuPjwvZGl2PjwvYmxvY2txdW90ZT48L2Rp dj48YnIgY2xhc3M9IiI+PGRpdiBjbGFzcz0iIj5UaGUgYXR0YWNrZXIgb24gdGhlIHNvdXRoYm91 bmQgbGluayB3b3VsZCBoYXZlIHRvIGtub3cgdGhlIHRyYW5zYWN0aW9uIElEIG9mIHRoZSBESENQ IHJlcXVlc3QvY29uZmlybS9yZW5ldyBtZXNzYWdlLCB3aGljaCBpcyBvbmx5IHNlbnQgb24gdGhl IG5vcnRoYm91bmQgaW50ZXJmYWNlLCBhbmQgd291bGQgaGF2ZSB0byBrbm93IHRoZSBEVUlEIGFu ZCBJQUlEIHVzZWQgYnkgdGhlIGNsaWVudCwgYWdhaW4gbmV2ZXIgc2VlbiBvbiB0aGUgc291dGhi b3VuZCBsaW5rLCBhbmQgd291bGQgaGF2ZSB0byBrbm93IHRoZSBzZXJ2ZXLigJlzIERVSUQsIGFn YWluIG9ubHkgdmlzaWJsZSBub3J0aGJvdW5kLiBJIGRvbuKAmXQgdGhpbmsgdGhpcyBpcyBhIGZl YXNpYmxlIGF0dGFjay4gSXTigJlzIGhhcmQgdG8gc2VlIHdoYXQgdGhlIGJlbmVmaXQgb2Ygc3Vj aCBhbiBhdHRhY2sgd291bGQgYmXigJRpbiBvcmRlciB0byBlZmZlY3QgdGhpcyBhdHRhY2sgd2l0 aG91dCBrbm93bGVkZ2Ugb2YgdGhlIGV4Y2hhbmdlIG9uIHRoZSBub3J0aGJvdW5kIGludGVyZmFj ZSwgdGhlIGNsaWVudCB3b3VsZCBoYXZlIHRvIGJlIGNvbnRpbnVvdXNseSBzcGFtbWluZyB0aGUg c291dGhib3VuZCBsaW5rIHdpdGggYXR0ZW1wdHMsIHNvIHRoYXQgd291bGQgYmUgYSBuZWdhdGl2 ZSBhbXBsaWNhdGlvbiBmYWN0b3Igb2YgcGVyaGFwcyAyXjI1NiwgcGVyaGFwcyBsZXNzIGlmIHRo ZSBpZGVudGlmaWVycyBjYW4gYmUgcHJlZGljdGVkIGFuZCByZW5ld2FsIHRpbWVzIGNhbiBiZSBw cmVkaWN0ZWQuPC9kaXY+PGRpdiBjbGFzcz0iIj48YnIgY2xhc3M9IiI+PC9kaXY+PGRpdiBjbGFz cz0iIj5BbmQgdGhpcyBhc3N1bWVzIHRoYXQgdGhlIERIQ1B2NiBQRCBjbGllbnQgb24gdGhlIENQ RSBkZXZpY2Ugd2lsbCBldmVuIGFjY2VwdCBhIERIQ1AgUmVwbHkgb24gaXRzIHNvdXRoYm91bmQg aW50ZXJmYWNlLjwvZGl2PjxkaXYgY2xhc3M9IiI+PGJyIGNsYXNzPSIiPjwvZGl2PjxkaXYgY2xh c3M9IiI+Oik8L2Rpdj48ZGl2IGNsYXNzPSIiPjxiciBjbGFzcz0iIj48L2Rpdj48c3Bhbj5fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzwvc3Bhbj48YnI+PHNw YW4+c2VjZGlyIG1haWxpbmcgbGlzdDwvc3Bhbj48YnI+PHNwYW4+c2VjZGlyQGlldGYub3JnPC9z cGFuPjxicj48c3Bhbj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NlY2Rp cjwvc3Bhbj48YnI+PHNwYW4+d2lraTogaHR0cDovL3Rvb2xzLmlldGYub3JnL2FyZWEvc2VjL3Ry YWMvd2lraS9TZWNEaXJSZXZpZXc8L3NwYW4+PGJyPjwvZGl2PjwvYmxvY2txdW90ZT48L2JvZHk+ PC9odG1sPg== --Apple-Mail-C0A38F14-FCC0-4638-8512-E3AC1AF078A0-- --Apple-Mail-20FE2E7B-F5C2-485D-A9F8-CE4E520C868A Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Disposition: attachment; filename="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCCGsw ggQkMIICjKADAgECAgRbkXGgMA0GCSqGSIb3DQEBDAUAMBoxGDAWBgNVBAMMD0ZvcmVzdCBDQSBS U0EgNDAeFw0xODA5MDYxODI3NDRaFw0yMTA5MDYxODI3NDRaMA4xDDAKBgNVBAMMA1VyaTCCAaIw DQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBANJi8+lfrSCcWThbn0vQzXsW7AYTyTZSo/pv/274 xD/t1rpn/X/vegP2lSfr+SRJ4oJ+51MFJvRl/sAveroDN8gGrFyYaCg5ZsOMqksCmLha4Ttgk04L I/aqrPGuzF1OVgjhi6WrnFr80KS6sy3MWzYIYV6G1FycKEup5snMr1B1WWzFKOwSslnJwvCuHu2W Tc5OzJKPtxMcDIS9y6VOZTzsJUFe0bRiw0LICDBcB3fgKCvYMcDfke0pw13I4O7wEG40s9E6rTIj Q0H1LVk69pSo1ikzpikl5W8pXUQQrSmjHqhFn/Q+PwSzHSOralN0p1UMziUv57lgvvZbTaH1ooqq MZBuTed0xLye3w+h9+/iqDY4B7lFqbegzseBh7/Q6KdtfpkwwI7xSpZEME/V77KAMw+ipb+Itbij Bi3r/t81fDW8eitIAbVtalpFROlYIaZnIIohOZRyVjn2unZ+lj3jDKsDq53g+oleo+Ruszlt8nju 6uKhzE7bdX1xJuvCtwIDAQABo34wfDAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIFIDAWBgNV HREEDzANgQt1cmlAbWl0LmVkdTAdBgNVHQ4EFgQU2p+nwSyQFM6byFBhc7oIZephJbcwJQYDVR0l BB4wHAYIKwYBBQUHAwQGCisGAQQBgjcKAwQGBFUdJQAwDQYJKoZIhvcNAQEMBQADggGBAH/zzG9P gU+ogFbc75JpUK0amUUtmtSsGDe4599GolCDiuPHrnbCGcaNc9aQjRaP3Q3aU7BB3aOjwssjQSN0 tsfZD8p+XPny/odhDSwS/25jCg0dVasd8q+Jd1S1g34RGUqPQ+5ofTrBSEkHBdLdJOnxBGo9GRzA yiDg34r6zK6BXNYv2GdqRk+GGGvL/w3CDR+ih36ZDBxw/EO19oH/aV4+mVlcRI6aoj4KMb+h4zMY S8jLDArIZSce4EWzJqxKVcX6Q7CE/0Br/7R8Ixs+vt5YKPUVpEbFM6koH624GDQYKM2kzXBnwYgS /jvl02KUx6uNmIgo+ufK2l7sc83vRLxBTJKhT0/USVkwu9uzg2zHJeGBZ4pmDhkIVkGcamW7KPYZ dgOz8zAOy8Ntk7GebPn85XuPcQS9UntdO61X1EyEXg4Ixl/qapidfJQfdCqEeZZXpaV3WKWE8u1l fNB00mC0/xhG3bikQxl3O20nyPjXvl6VZFzglsPRy1Xh5L//rzCCBD8wggKnoAMCAQICBFuRckIw DQYJKoZIhvcNAQEMBQAwGjEYMBYGA1UEAwwPRm9yZXN0IENBIFJTQSA0MB4XDTE4MDkwNjE4MzAy NloXDTIxMDkwNjE4MzAyNlowDjEMMAoGA1UEAwwDVXJpMIIBojANBgkqhkiG9w0BAQEFAAOCAY8A MIIBigKCAYEAtZvms8stf9xj5w7pjYzgmHe7TH0eX/q3buMBqdLufhFuqCizZPhXJmSbue8WHm8H HO7SHQPUqIqbPOMIQfAL8nwWhuTfsN5nrtFW77eiNsEexRNkbhw/U6RzamCGl6xQmUxOD0nabEmd Xdces+rjtzlvjpNHI7xrR32ee4JuGTjwAWlAHPtBC8TqiOR/ysR2K2umk5BkjCEWV9kDfGklfKmu IhuCzzpTvN3AnLMX9kP9IY6E9B8OsLOhkOFBbAMzyqkXibtPWluqOnYW3V3MVc9H1ir6sGLF5onW lHLEorI51WuHlfVO8WJRYwhrzQIIAWAYheZaH2wdb87Kw6o4JbHDLTDJHHrBDwfqa5OtFTeQNWCD JPdHa4xfFpjnMTzP18POa5C6QN5XBpTFsfccWyEdt+ykGB2FMzhB3GgMVRfWPgo8TgxVwU9MHt8s vmxj8KMUd7afSJBOjMIRPZ6gi8Vja9SR9+Hj/YWgpKZMHhI7irJVpWF++7hhfxxDbgDBAgMBAAGj gZgwgZUwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBsAwFgYDVR0RBA8wDYELdXJpQG1pdC5l ZHUwHQYDVR0OBBYEFK3WLENy4CH330dGZEWchN+L1r28MD4GA1UdJQQ3MDUGCCsGAQUFBwMCBggr BgEFBQcDAwYKKwYBBAGCNwoDDAYJKoZIhvcvAQEFBggrBgEFBQcDBDANBgkqhkiG9w0BAQwFAAOC AYEACYbThcFo+JTQNP5UacMtYogWU/yOx5GBLSNNa5cpvoRrOJc9CUDfzfnrd7IhDLXvnFUYNt3i oyU13LKRoPsp/YYuZ2CBI1om9g27SSqqEcOom0eojIKkPNw+sJzYVl7Dz2I7f9DHN6nEC9BeT8Do rjuq67UOlZZw0YvlvCmtMI4xJ7CUM8NrphoeRN18OnbwmkHWIYnYwdxipTJ8oLWi5EbKaUEYyLlC JWd6o9vH8cFNzsViPUl9POxBtX++o5KxtW7/JQwrQt3uFubF6rHQag6HDeXcXSyI0DmL8MrfVtHi Ma2bN+7z8N9Wnuvx8v0qlqfwd+uhmP7OvD32PuzjQxuGyPd43DZazlMhY9IRpSSCPhdbxzS3YwKr jnTZlKGwPiYCmiQ0XSEW3K64Exe4t+jrkBReocr9ccslB4d4XhxQPdAvUdI43xGMbnFea7pyTDyP b0z1vMrYt6dAguU0QTgRZsPFoIldK70ILvncq9amhxuQ4Uw+u2WUXiYba2R1MYICoTCCAp0CAQEw IjAaMRgwFgYDVQQDDA9Gb3Jlc3QgQ0EgUlNBIDQCBFuRckIwDQYJYIZIAWUDBAIBBQCggdEwGAYJ KoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMjAwOTEwMDIxNzMyWjAvBgkq hkiG9w0BCQQxIgQgyX5idzpumbowyffVQVHiF5Vdloidcj7j4apkEEDB4G8wMQYJKwYBBAGCNxAE MSQwIjAaMRgwFgYDVQQDDA9Gb3Jlc3QgQ0EgUlNBIDQCBFuRcaAwMwYLKoZIhvcNAQkQAgsxJKAi MBoxGDAWBgNVBAMMD0ZvcmVzdCBDQSBSU0EgNAIEW5FxoDANBgkqhkiG9w0BAQEFAASCAYA76xiq FmaAA2PL1SMxvz6wFEdj0Gmq9sA2/CydV2Lz52SN9rAtWZVH0bAJudCaxIjAoTocON5ynu6uQvVg C8sktcj6MEzyFpc/C96GSXpCIo06X5d1qwO8u7i4naFExa9yp1KixbaGrzhQJedIcShYTXa9KPXq 07qpiDyHZt2UzM0AcDQpPblATARM3YWPwKu+jgQVFGfZGg6A2h9HH7ZPpoiNRhRNpVHVrBp7TWQM sqsXlfq3IepzD31DsuuzjnJLfte6sWZj/iDmR6ViDSYWZq3+GU8PyW30gmU9xQ/wNu0D9ILCFIpI c5oQvZP2UANtDgfW7xXKLnGxlQvfCnYVQq5tA74YoR9Yenl2q0ffefG2aMM9oWjjQwz65ZTErMHB eO0CVDJcYZGgh9kZjim2pbJo71Q7fI2U73FGSa2J7ZLQFVlGXfDOxxgXTPVxWwPg+Dqt5zv/XMQ3 Uau/dbgiXT2+OCA+2bFemIda4iSoCNjrAGI02GrS3hQHnG5gG5AAAAAAAAA= --Apple-Mail-20FE2E7B-F5C2-485D-A9F8-CE4E520C868A-- From nobody Wed Sep 9 20:42:49 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6DFB63A0BD1 for ; Wed, 9 Sep 2020 20:42:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qL684JJOFfrQ for ; Wed, 9 Sep 2020 20:42:45 -0700 (PDT) Received: from mail-qk1-x72d.google.com (mail-qk1-x72d.google.com [IPv6:2607:f8b0:4864:20::72d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9A5BD3A07F2 for ; Wed, 9 Sep 2020 20:42:45 -0700 (PDT) Received: by mail-qk1-x72d.google.com with SMTP id n133so4661218qkn.11 for ; Wed, 09 Sep 2020 20:42:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=content-transfer-encoding:from:mime-version:subject:date:message-id :references:cc:in-reply-to:to; bh=SOtFKDnRQQXFxFswILV9a5wbEVrA1Q5vb3lCY9H6hTo=; b=PPEPL1v5fSTP2CGom2PVY9zKpP1eT+nPfHDbzkkFYOOK8lcuM+AvIWjScQP396MaUQ gW//CFWtmWfbpL3+fBBNi4F000ACDxfZoPwipDJigcRZ6/Ph6N2B1CE6sbL2fY3ILzQK OU5Fp1sbNCVjQLLRazMIgJx80+Zx3fwJBXbI2zpJyibE9K9jZjo4ByaZ98uUbd0eHudd WnVMLYvLW8luODHyG4hScGSJXSmlkTDW/rKxsER7Ohdq9f5yNg6qcItPQ7TlXQbft3Dy 9Qtz3ZDv4ihYcUWljcNjLzcNV0o2TGpD6fNnYBhyHAOE7oj7B1QnINaaF/p901TxkN1g hMtQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:content-transfer-encoding:from:mime-version :subject:date:message-id:references:cc:in-reply-to:to; bh=SOtFKDnRQQXFxFswILV9a5wbEVrA1Q5vb3lCY9H6hTo=; b=LBHy1tUIsKv6sqg0DQk4Vy+GRbTJdolxU3QwO92uI8Bfvbc9iG/GdcthXrvxI0eP4P mRcOgJ8wixhZZmDQoSU0bE5n7O+JRsrzlGIdrFsfE78Y63qNAZyorEndDxZ66H0xwYi5 pgmpMdnRQPv1eSYVtI21EZJKGsi/0TMw7R4IbLVayDMXl1jSEgeVMikfntTtp+WzR2JA o/mh4y5tPTK4VxsbnktCl47aWKeIf9af+QVV2GTmRC2jl9KKZG0bjlPOcxwU6OI1nFy1 qE7aOIrGTgnaYAIjwYd8Lql+BXIN4HL0Y1pM0Kbu4obqvv4wDVl4w2Kbs4UTk9av4bRA gFiw== X-Gm-Message-State: AOAM530K/ipdmKYAUFyBX72h3fUf9qXcjk+ZePAH7waL6sJJKwNEFLiK bmh/34khBN6nDL/imTyACRqt3Q== X-Google-Smtp-Source: ABdhPJxaM1vF5XtApbo8JppbaFjOkRroCCcb0+9AZQ6SoGcmrUWEZpbyABZlIg/kJAW21b72F6npDQ== X-Received: by 2002:a37:9d84:: with SMTP id g126mr6266756qke.473.1599709364654; Wed, 09 Sep 2020 20:42:44 -0700 (PDT) Received: from localhost.localdomain ([2601:18b:300:36ee:4ddf:4132:f1df:3766]) by smtp.gmail.com with ESMTPSA id e7sm5521781qtk.17.2020.09.09.20.42.44 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 09 Sep 2020 20:42:44 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-359C6358-7A0C-456E-8A8D-679DDF3674C9 Content-Transfer-Encoding: 7bit From: Ted Lemon Mime-Version: 1.0 (1.0) Date: Wed, 9 Sep 2020 23:42:43 -0400 Message-Id: <90FF05E0-CA1A-4EA1-80D0-351D94C0EC5C@fugue.com> References: <54DA4651-1C55-4DF9-BF3D-7E851B6692F4@mit.edu> Cc: Christopher Wood , Christopher Wood via Datatracker , last-call@ietf.org, v6ops@ietf.org, draft-ietf-v6ops-cpe-slaac-renum.all@ietf.org, secdir@ietf.org In-Reply-To: <54DA4651-1C55-4DF9-BF3D-7E851B6692F4@mit.edu> To: Uri Blumenthal X-Mailer: iPhone Mail (18A366) Archived-At: Subject: Re: [secdir] [v6ops] Secdir last call review of draft-ietf-v6ops-cpe-slaac-renum-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Sep 2020 03:42:47 -0000 --Apple-Mail-359C6358-7A0C-456E-8A8D-679DDF3674C9 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable There is roughly zero chance of an attacker that is willing to reveal its pr= esence listening on the northbound link. This is a CPE router. The northboun= d link is a point to point link to the ISP. State actors do not do DoS attac= ks on home networks. They snoop, or censor, the uplink.=20 > On Sep 9, 2020, at 22:17, Uri Blumenthal wrote: >=20 > =EF=BB=BFCapability-wise, what's the likelihood that the attacker would be= present on the southbound interface, but *not* on the northbound one? >=20 > Sent from my test iPhone >=20 >>> On Sep 9, 2020, at 19:32, Ted Lemon wrote: >>>=20 >> =EF=BB=BF On Sep 9, 2020, at 7:16 PM, Christopher Wood via Datatracker wrote: >>> - Section 3: is it possible for an attacker to send DHCPv6 Prefix Delega= tions >>> with lifetime=3D0 to CE routers that support LAN-side DHCPv6 and amplify= >>> Reconfigure messages to supporting clients? (I don't know if this is a c= oncern >>> or part of the threat model, but this did seem to be a case of possible >>> request/response asymmetry.) - Section 4: rationale for these default va= lues, >>> if available, might be worth including. (Why not make them shorter? What= are >>> the tradeoffs?) - Section 6: it might be worth noting what happens if st= able >>> storage is unavailable or otherwise compromised when trying to store pre= fix >>> information. What happens if the "A" or "L" bits are modified? (I suspec= t >>> nothing dangerous, but it's not clear to me whether or not integrity is >>> important.) >>=20 >> The attacker on the southbound link would have to know the transaction ID= of the DHCP request/confirm/renew message, which is only sent on the northb= ound interface, and would have to know the DUID and IAID used by the client,= again never seen on the southbound link, and would have to know the server=E2= =80=99s DUID, again only visible northbound. I don=E2=80=99t think this is a= feasible attack. It=E2=80=99s hard to see what the benefit of such an attac= k would be=E2=80=94in order to effect this attack without knowledge of the e= xchange on the northbound interface, the client would have to be continuousl= y spamming the southbound link with attempts, so that would be a negative am= plication factor of perhaps 2^256, perhaps less if the identifiers can be pr= edicted and renewal times can be predicted. >>=20 >> And this assumes that the DHCPv6 PD client on the CPE device will even ac= cept a DHCP Reply on its southbound interface. >>=20 >> :) >>=20 >> _______________________________________________ >> secdir mailing list >> secdir@ietf.org >> https://www.ietf.org/mailman/listinfo/secdir >> wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview --Apple-Mail-359C6358-7A0C-456E-8A8D-679DDF3674C9 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
There is roughly zero chan= ce of an attacker that is willing to reveal its presence listening on the no= rthbound link. This is a CPE router. The northbound link is a point to point= link to the ISP. State actors do not do DoS attacks on home networks. They s= noop, or censor, the uplink. 

On Sep 9, 2020, at 22:17, Uri Blumenthal <uri@mit.edu> wrot= e:

=EF=BB= =BF= Capability-wise, what's the likelihood that the attacker would be present on= the southbound interface, but *not* on the northbound one?

Sent from my test iPhone

On Sep 9, 2020, at 19:32, Ted Lemon <mellon@fugue.com> wrote:
=EF=BB=BF= On S= ep 9, 2020, at 7:16 PM, Christopher Wood via Datatracker <noreply@ietf.org> wrote:
- Section 3: is it possibl= e for an attacker to send DHCPv6 Prefix Delegations
with lifetime=3D0 to CE routers that support LAN-s= ide DHCPv6 and amplify
Re= configure messages to supporting clients? (I don't know if this is a concern=
or part of the threat mode= l, but this did seem to be a case of possible
request/response asymmetry.) - Section 4: rationale for= these default values,
if= available, might be worth including. (Why not make them shorter? What are
the tradeoffs?) - Section 6= : it might be worth noting what happens if stable
storage is unavailable or otherwise compromised whe= n trying to store prefix
i= nformation. What happens if the "A" or "L" bits are modified? (I suspect
nothing dangerous, but it's n= ot clear to me whether or not integrity is
important.)

<= div class=3D"">The attacker on the southbound link would have to know the tr= ansaction ID of the DHCP request/confirm/renew message, which is only sent o= n the northbound interface, and would have to know the DUID and IAID used by= the client, again never seen on the southbound link, and would have to know= the server=E2=80=99s DUID, again only visible northbound. I don=E2=80=99t t= hink this is a feasible attack. It=E2=80=99s hard to see what the benefit of= such an attack would be=E2=80=94in order to effect this attack without know= ledge of the exchange on the northbound interface, the client would have to b= e continuously spamming the southbound link with attempts, so that would be a= negative amplication factor of perhaps 2^256, perhaps less if the identifie= rs can be predicted and renewal times can be predicted.

And this assumes that the DHCPv6 PD cl= ient on the CPE device will even accept a DHCP Reply on its southbound inter= face.

:)

_____________________________________= __________
secdir mailing list
secdir@ietf.o= rg
https://www.ietf.org/mailman/listinfo/secdir
wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview
= --Apple-Mail-359C6358-7A0C-456E-8A8D-679DDF3674C9-- From nobody Wed Sep 9 22:10:30 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5504F3A0DFE; Wed, 9 Sep 2020 22:10:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.845 X-Spam-Level: X-Spam-Status: No, score=-2.845 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, NICE_REPLY_A=-0.948, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rKUxZ3TEy4vU; Wed, 9 Sep 2020 22:10:26 -0700 (PDT) Received: from fgont.go6lab.si (fgont.go6lab.si [IPv6:2001:67c:27e4::14]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 570643A0DF9; Wed, 9 Sep 2020 22:10:26 -0700 (PDT) Received: from [10.0.0.134] (unknown [186.19.8.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by fgont.go6lab.si (Postfix) with ESMTPSA id DCEB02800FF; Thu, 10 Sep 2020 05:10:18 +0000 (UTC) To: Christopher Wood , secdir@ietf.org Cc: last-call@ietf.org, v6ops@ietf.org, draft-ietf-v6ops-cpe-slaac-renum.all@ietf.org References: <159969337123.15697.6820068156665930267@ietfa.amsl.com> From: Fernando Gont Message-ID: Date: Thu, 10 Sep 2020 02:09:41 -0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.9.1 MIME-Version: 1.0 In-Reply-To: <159969337123.15697.6820068156665930267@ietfa.amsl.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-v6ops-cpe-slaac-renum-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Sep 2020 05:10:30 -0000 Hello, Chris, Thanks a lot for your comments! In-line.... On 9/9/20 20:16, Christopher Wood via Datatracker wrote: > Reviewer: Christopher Wood > Review result: Has Nits > > Summary: Has Nits > > Comments: > > - Section 3: is it possible for an attacker to send DHCPv6 Prefix Delegations > with lifetime=0 to CE routers that support LAN-side DHCPv6 and amplify > Reconfigure messages to supporting clients? (I don't know if this is a concern > or part of the threat model, but this did seem to be a case of possible > request/response asymmetry.) Not sure what you mean. PDs with a lifetime of 0 are orthogonal to Reconfigure messages. If the client asked for reconfigure support, yes it will be accepting server reconfigure messages. However, Reconfigure messages are required to be unicasted (RFC8415, Section 16.11), so there's no possibility for amplification (i.e., single server packet triggering actions on multiple clients). > - Section 4: rationale for these default values, > if available, might be worth including. (Why not make them shorter? What are > the tradeoffs?) I suggested to add this in response to Dale's comments: " However, while the aforementioned values represent an improvement over the default values specified in [RFC4861], they represent a trade-off among a number of factors, including responsiveness, possible impact on the battery life of connected devices [RFC7772], etc. Thus, they may or may not provide sufficient mitigation to the problem discussed in this document. " ? > - Section 6: it might be worth noting what happens if stable > storage is unavailable or otherwise compromised when trying to store prefix > information. What happens if the "A" or "L" bits are modified? (I suspect > nothing dangerous, but it's not clear to me whether or not integrity is > important.) Compromised as in "an attacked intentionally caused different bits to be stored"? If so, I'd say that's probably the least of your concerns. Since DHCPv6 exchanges are not encrypted or authenticated, your first concern would be forged packets. If the attacker has essentially hacked the CE Router, then all bets are off. > Nits: > > - In some places "\"Valid Lifetime\"" is written as "valid-lifetime" -- should > these be made consistent? We use "Valid Lifetime" for SLAAC PIOs, and "valid-lifetime" for DHCPv6 options, since that's what the respective specs use. Please do let us know if you think this should be clarified. Thanks! Regards, -- Fernando Gont SI6 Networks e-mail: fgont@si6networks.com PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492 From nobody Thu Sep 10 00:18:30 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7F10B3A0FA0; Thu, 10 Sep 2020 00:18:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.836 X-Spam-Level: X-Spam-Status: No, score=-2.836 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, NICE_REPLY_A=-0.948, SPF_HELO_NONE=0.001, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pfxuYc2Wtc4o; Thu, 10 Sep 2020 00:18:20 -0700 (PDT) Received: from fgont.go6lab.si (fgont.go6lab.si [91.239.96.14]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BEBED3A0F9E; Thu, 10 Sep 2020 00:18:18 -0700 (PDT) Received: from [10.0.0.134] (unknown [186.19.8.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by fgont.go6lab.si (Postfix) with ESMTPSA id 24342283B9E; Thu, 10 Sep 2020 07:18:10 +0000 (UTC) To: Uri Blumenthal , Ted Lemon Cc: "v6ops@ietf.org" , "last-call@ietf.org" , "secdir@ietf.org" , Christopher Wood via Datatracker , "draft-ietf-v6ops-cpe-slaac-renum.all@ietf.org" , Christopher Wood References: <4FC30E5B-EF9F-4238-A683-CE8235BDD2EF@fugue.com> <54DA4651-1C55-4DF9-BF3D-7E851B6692F4@mit.edu> From: Fernando Gont Message-ID: <67d44e29-942a-9d32-5bdc-9746c245eed4@gont.com.ar> Date: Thu, 10 Sep 2020 03:11:25 -0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.9.1 MIME-Version: 1.0 In-Reply-To: <54DA4651-1C55-4DF9-BF3D-7E851B6692F4@mit.edu> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [secdir] [v6ops] Secdir last call review of draft-ietf-v6ops-cpe-slaac-renum-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Sep 2020 07:18:22 -0000 On 9/9/20 23:17, Uri Blumenthal wrote: > Capability-wise, what's the likelihood that the attacker would be > present on the southbound interface, but *not* on the northbound one? I'm not sure I could talk about "likelihood" in any measurable way. But I'd argue that, generally speaking, anyone that shares the same LAN/Connection will be on the southbound interface (e.g., think of a cyber-cafe, university network, enterprise network, or whatever) whereas in order to be present on the northbound interface you'd probably normally be: * A rogue ISP * A state actor, or, * Somebody that managed to get to the right cable. For the "normal" attacker, I'd say it's much more likely to be present on the south-bound interface, whereas for other cases, I guess it could be both. Thanks, -- Fernando Gont e-mail: fernando@gont.com.ar || fgont@si6networks.com PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1 From nobody Thu Sep 10 15:16:44 2020 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 6D3703A0EB7 for ; Thu, 10 Sep 2020 15:16:43 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: Tero Kivinen via Datatracker To: X-Test-IDTracker: no X-IETF-IDTracker: 7.16.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: secdir-secretary@mit.edu, Tero Kivinen Message-ID: <159977620305.20500.198464925152545401@ietfa.amsl.com> Date: Thu, 10 Sep 2020 15:16:43 -0700 Archived-At: Subject: [secdir] Assignments X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Sep 2020 22:16:44 -0000 Review instructions and related resources are at: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview For telechat 2020-09-24 Reviewer LC end Draft Phillip Hallam-Baker R2020-03-09 draft-ietf-calext-jscalendar-30 Mališa Vučinić R2020-08-28 draft-ietf-bess-evpn-na-flags-06 Brian Weis R2020-08-26 draft-ietf-spring-srv6-network-programming-18 Last calls: Reviewer LC end Draft Linda Dunbar 2020-09-16 draft-ietf-avtcore-cc-feedback-message-08 Donald Eastlake 2020-09-14 draft-ietf-dnsop-dns-zone-digest-09 Stephen Farrell 2020-09-10 draft-ietf-detnet-mpls-over-udp-ip-06 Daniel Franke 2020-09-18 draft-ietf-jmap-mdn-15 Daniel Franke 2020-03-09 draft-ietf-regext-dnrd-objects-mapping-09 Phillip Hallam-Baker R2020-03-09 draft-ietf-calext-jscalendar-30 Dan Harkins None draft-ietf-rtgwg-policy-model-03 David Mandelberg 2020-07-14 draft-ietf-idr-rfc8203bis-06 Kathleen Moriarty 2020-07-20 draft-ietf-ace-oscore-profile-11 Russ Mundy 2020-07-20 draft-ietf-ace-dtls-authorize-13 Yoav Nir None draft-ietf-netconf-trust-anchors-13 Mališa Vučinić R2020-08-28 draft-ietf-bess-evpn-na-flags-06 Brian Weis R2020-08-26 draft-ietf-spring-srv6-network-programming-18 Klaas Wierenga 2020-09-09 draft-ietf-v6ops-slaac-renum-03 Klaas Wierenga 2020-05-26 draft-ietf-kitten-krb-spake-preauth-09 Christopher Wood 2020-09-23 draft-ietf-6man-rfc4941bis-10 Paul Wouters 2020-09-08 draft-ietf-i2nsf-capability-data-model-11 Paul Wouters 2020-05-25 draft-ietf-capport-architecture-09 Dacheng Zhang 2020-03-12 draft-nottingham-how-did-that-get-into-the-repo-01 Dacheng Zhang 2019-11-05 draft-ietf-mpls-ri-rsvp-frr-07 Next in the reviewer rotation: Daniel Gillmor Phillip Hallam-Baker Steve Hanna Dan Harkins Russ Housley Christian Huitema Leif Johansson Charlie Kaufman Scott Kelly Tero Kivinen From nobody Fri Sep 11 12:17:08 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id D25DC3A142A; Fri, 11 Sep 2020 09:41:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1599842511; bh=g8EiQogs6LEZM6KWhWMRMKE/0bBGE0lb4S6BZgODnDQ=; h=From:To:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe:Reply-To; b=sQ9Lgzv8s+RvYo6pbTUNFEVEwioMC23tLdwt6wTlUSrm+6lev8rAbxQHapZa51Qx7 DZt5NyAL3R5KZYIWAGD4O2kScxD7OBrnCMS6wPmgYOdMokWrjvA1tC/61af+CchuDI vMqeGHWQoVLrouv8MnIqvnMksC1knlG8CpYfDHQI= X-Mailbox-Line: From new-work-bounces@ietf.org Fri Sep 11 09:41:43 2020 Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 59C833A144A; Fri, 11 Sep 2020 09:41:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1599842484; bh=g8EiQogs6LEZM6KWhWMRMKE/0bBGE0lb4S6BZgODnDQ=; h=From:To:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe:Reply-To; b=BHFODlnx83QyRnYr+99HgAOQf6gAkGDiNsNvI+4uSLDbTNV3yJk09OMjt3ImLSK7J wnK0i3ofagpTdJrs1vnaI2LdJD/By3AjjnIOpgJNyMzs59fCdS90SHuz2B9V7nTkhe YRgTl4+6MgSXHt/IYIHCmH4shEgiWtAjjyiMXBIA= X-Original-To: new-work@ietf.org Delivered-To: new-work@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id CE26A3A1416 for ; Fri, 11 Sep 2020 09:41:17 -0700 (PDT) MIME-Version: 1.0 From: The IESG To: X-Test-IDTracker: no X-IETF-IDTracker: 7.16.0 Auto-Submitted: auto-generated Precedence: bulk MIME-Version: 1.0 Reply_to: Message-ID: <159984247782.22475.16680233907147570138@ietfa.amsl.com> Date: Fri, 11 Sep 2020 09:41:17 -0700 Archived-At: X-BeenThere: new-work@ietf.org X-Mailman-Version: 2.1.29 Reply-To: iesg@ietf.org Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Errors-To: new-work-bounces@ietf.org Sender: "new-work" Archived-At: X-Mailman-Approved-At: Fri, 11 Sep 2020 12:17:08 -0700 Subject: [secdir] [new-work] WG Review: Revision of core Email specifications (emailcore) X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Sep 2020 16:41:59 -0000 QSBuZXcgSUVURiBXRyBoYXMgYmVlbiBwcm9wb3NlZCBpbiB0aGUgQXBwbGljYXRpb25zIGFuZCBS ZWFsLVRpbWUgQXJlYS4gVGhlCklFU0cgaGFzIG5vdCBtYWRlIGFueSBkZXRlcm1pbmF0aW9uIHll dC4gVGhlIGZvbGxvd2luZyBkcmFmdCBjaGFydGVyIHdhcwpzdWJtaXR0ZWQsIGFuZCBpcyBwcm92 aWRlZCBmb3IgaW5mb3JtYXRpb25hbCBwdXJwb3NlcyBvbmx5LiBQbGVhc2Ugc2VuZCB5b3VyCmNv bW1lbnRzIHRvIHRoZSBJRVNHIG1haWxpbmcgbGlzdCAoaWVzZ0BpZXRmLm9yZykgYnkgMjAyMC0w OS0yMS4KClJldmlzaW9uIG9mIGNvcmUgRW1haWwgc3BlY2lmaWNhdGlvbnMgKGVtYWlsY29yZSkK LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0KQ3VycmVudCBzdGF0dXM6IFByb3Bvc2VkIFdHCgpDaGFpcnM6CiAgQWxl eGV5IE1lbG5pa292IDxhYW1lbG5pa292QGZhc3RtYWlsLmZtPgogIFNldGggQmxhbmsgPHNldGhA dmFsaW1haWwuY29tPgoKQXNzaWduZWQgQXJlYSBEaXJlY3RvcjoKICBCYXJyeSBMZWliYSA8YmFy cnlsZWliYUBjb21wdXRlci5vcmc+CgpBcHBsaWNhdGlvbnMgYW5kIFJlYWwtVGltZSBBcmVhIERp cmVjdG9yczoKICBCYXJyeSBMZWliYSA8YmFycnlsZWliYUBjb21wdXRlci5vcmc+CiAgTXVycmF5 IEt1Y2hlcmF3eSA8c3VwZXJ1c2VyQGdtYWlsLmNvbT4KCk1haWxpbmcgbGlzdDoKICBBZGRyZXNz OiBlbWFpbGNvcmVAaWV0Zi5vcmcKICBUbyBzdWJzY3JpYmU6IGh0dHBzOi8vd3d3LmlldGYub3Jn L21haWxtYW4vbGlzdGluZm8vZW1haWxjb3JlCiAgQXJjaGl2ZTog4oCLaHR0cHM6Ly9tYWlsYXJj aGl2ZS5pZXRmLm9yZy9hcmNoL2Jyb3dzZS9lbWFpbGNvcmUvCgpHcm91cCBwYWdlOiBodHRwczov L2RhdGF0cmFja2VyLmlldGYub3JnL2dyb3VwL2VtYWlsY29yZS8KCkNoYXJ0ZXI6IGh0dHBzOi8v ZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2NoYXJ0ZXItaWV0Zi1lbWFpbGNvcmUvCgpUaGUgYmFz ZSBkb2N1bWVudHMgZGVmaW5pbmcgSW50ZXJuZXQgbWVzc2FnaW5nIOKAlCBjb2xsb3F1aWFsbHks IGVtYWlsIC0tCmFyZSBSRkMgNTMyMSAocHJvdG9jb2wpIGFuZCBSRkMgNTMyMiAoZm9ybWF0KS4g VGhlc2UgYXJlIHJldmlzaW9ucyBhbmQKY29uc29saWRhdGlvbnMgb2YgcHJpb3IgZG9jdW1lbnRz IGFuZCB3ZXJlIGxhc3QgcHVibGlzaGVkIGluIDIwMDguIFRoZXkKY3VycmVudGx5IHNpdCBhdCBE cmFmdCBTdGFuZGFyZCBzdGF0dXMsIGEgc3RhdHVzIHRoYXQgbm8gbG9uZ2VyIGV4aXN0cwphY2Nv cmRpbmcgdG8gdGhlIGN1cnJlbnQgSUVURiBwcm9jZWR1cmUuCgpTaW5jZSB0aGVuIHNvbWUgZXJy YXRhIGhhdmUgYWNjdW11bGF0ZWQgKGJvdGggc3VibWl0dGVkIHRvIElFVEYgYW5kCnJlcG9ydGVk IGRpcmVjdGx5IHRvIGVkaXRvcnMpLCBhcyBoYXZlIGNvbW1lbnRzIG1hZGUgYWJvdXQgdGhlc2UK ZG9jdW1lbnRzIG5vdCBuZWNlc3NhcmlseSBkZXNjcmliaW5nIGJlc3QgZW1haWwgcHJhY3RpY2Vz LiBUaGVyZSBpcyBub3cKc3VmZmljaWVudCBjcml0aWNhbCBtYXNzIHRvIHVuZGVydGFrZSBhIGxp bWl0ZWQgcmV2aWV3IGFuZCByZXZpc2lvbiBvZgp0aGVzZSBkb2N1bWVudHMgZm9yIHRoZSBwdXJw b3NlIG9mIGFkdmFuY2luZyB0aGVtIHRvIEludGVybmV0IFN0YW5kYXJkCnN0YXR1cy4KClRoaXMg d29ya2luZyBncm91cCB3aWxsIGNvbmR1Y3QgYSBsaW1pdGVkIHJldmlldyBhbmQgcmV2aXNpb24g dG8gdGhlIGJhc2UKZW1haWwgc3BlY2lmaWNhdGlvbnMsIGFuZCB3aWxsIHB1Ymxpc2ggbmV3IHZl cnNpb25zIG9mIHRoZXNlIGRvY3VtZW50cyBhdApJbnRlcm5ldCBTdGFuZGFyZCBzdGF0dXMsIHBl ciBSRkMgNjQxMC4gVGhlIGxpbWl0ZWQgcmV2aWV3IGlzIHJlc3RyaWN0ZWQKdG8gY29ycmVjdGlv bnMgYW5kIGNsYXJpZmljYXRpb25zIG9ubHksIHdpdGggYSBzdHJvbmcgZW1waGFzaXMgb24ga2Vl cGluZwp0aGVzZSBtaW5pbWFsIGFuZCBhdm9pZGluZyBicm9hZGVyIGNoYW5nZXMgdG8gdGVybWlu b2xvZ3kgb3IgZG9jdW1lbnQKb3JnYW5pemF0aW9uLiBJbiBhZGRpdGlvbiB0byBwcm9jZXNzaW5n IGV4aXN0aW5nLCB2ZXJpZmllZCBlcnJhdGEgYW5kCmVycmF0YSBtYXJrZWQgYXMgImhlbGQgZm9y IGRvY3VtZW50IHVwZGF0ZSIsIHRoZSBXRyBtYXkgYWRkcmVzcwpuZXdseS1vZmZlcmVkIGVycmF0 YS4gSG93ZXZlciwgbm8gbmV3IHByb3RvY29sIGV4dGVuc2lvbnMgb3IgYW1lbmRtZW50cwp3aWxs IGJlIGNvbnNpZGVyZWQgZm9yIGluY2x1c2lvbiBpbnRvIDUzMjFiaXMgYW5kIDUzMjJiaXMgZG9j dW1lbnRzLAp1bmxlc3MgdGhleSBhcmUgYWxyZWFkeSBwdWJsaXNoZWQgYXMgSUVURiBTdHJlYW0g UkZDcyBhbmQgYXJlIGF0CnN1ZmZpY2llbnQgbWF0dXJpdHkgbGV2ZWwgdG8gbW92ZSB0byBJbnRl cm5ldCBTdGFuZGFyZC4KClRoZSB3b3JraW5nIGdyb3VwIHdpbGwgYWxzbyB3b3JrIG9uIGFuIEFw cGxpY2FiaWxpdHkgU3RhdGVtZW50IGluCnBhcmFsbGVsIHdpdGggNTMyMWJpcyBhbmQgNTMyMmJp cywgdG8gY2FwdHVyZSByZWxhdGlvbnNoaXBzIHRvIG90aGVyCmRvY3VtZW50ZWQgYW5kIHdpZGVs eSBkZXBsb3llZCB3b3JrIChzdWNoIGFzIHJlY29tbWVuZGVkIGV4dGVuc2lvbnMpIGFuZApjdXJy ZW50IGVtYWlsIHByYWN0aWNlcywgaW5jbHVkaW5nIHRyYW5zcG9ydCBzZWN1cml0eSBhbmQgb3Ro ZXIgaXNzdWVzCmZyb20gdGhlIFVUQSB3b3JraW5nIGdyb3VwJ3Mgb3V0cHV0LiA1MzIxYmlzIGFu ZCA1MzIyYmlzIHdpbGwgYmUgc3VibWl0dGVkCmZvciBwdWJsaWNhdGlvbiBiZWZvcmUgdGhpcyBk b2N1bWVudCBpcyBmaW5hbGl6ZWQsIGFuZCB0aGUgImJpcyIgZG9jdW1lbnRzCndpbGwgaGF2ZSBw cmlvcml0eSBmb3IgdGhlIHdvcmtpbmcgZ3JvdXAncyBhdHRlbnRpb24gdW50aWwgdGhleSBhcmUK ZmluaXNoZWQuCgpVcG9uIGNvbXBsZXRpb24gb2YgdGhlc2UgdGhyZWUgbWlsZXN0b25lcywgYW5k IGFzc3VtaW5nIHRoZXJlIGlzIHN0aWxsCnRoZSBtb21lbnR1bSB0byBkbyBzbywgdGhlIHdvcmtp bmcgZ3JvdXAgbWF5IHVuZGVydGFrZSBzaW1pbGFyIHJldmlldyBhbmQKcmV2aXNpb24gb2Ygb3Ro ZXIgZW1haWwgc3BlY2lmaWNhdGlvbnMuIFN1Y2ggZnV0dXJlIHdvcmsgd2lsbCByZXF1aXJlCnJl Y2hhcnRlcmluZy4KCk1pbGVzdG9uZXM6CgpUQkQKCl9fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fCm5ldy13b3JrIG1haWxpbmcgbGlzdApuZXctd29ya0BpZXRm Lm9yZwpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL25ldy13b3JrCg== From nobody Fri Sep 11 13:56:50 2020 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E00E63A099E; Fri, 11 Sep 2020 13:56:38 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Linda Dunbar via Datatracker To: Cc: last-call@ietf.org, avt@ietf.org, draft-ietf-avtcore-cc-feedback-message.all@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.16.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <159985779887.14617.12448394308192973611@ietfa.amsl.com> Reply-To: Linda Dunbar Date: Fri, 11 Sep 2020 13:56:38 -0700 Archived-At: Subject: [secdir] Secdir last call review of draft-ietf-avtcore-cc-feedback-message-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Sep 2020 20:56:45 -0000 Reviewer: Linda Dunbar Review result: Ready I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. The summary of the review is draft-ietf-avtcore-cc-feedback-message-08. The draft is very clear in describing the RTCP feedback message intended for enabling congestion control for traffic using RTP. Best regards, Linda Dunbar From nobody Sat Sep 12 10:20:21 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F0FCE3A0C48; Sat, 12 Sep 2020 10:20:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.839 X-Spam-Level: X-Spam-Status: No, score=-1.839 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_FREEMAIL_DOC_PDF=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id b6tJAgFkcER5; Sat, 12 Sep 2020 10:20:16 -0700 (PDT) Received: from mail-io1-xd44.google.com (mail-io1-xd44.google.com [IPv6:2607:f8b0:4864:20::d44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5F7893A0C45; Sat, 12 Sep 2020 10:20:16 -0700 (PDT) Received: by mail-io1-xd44.google.com with SMTP id m17so14427599ioo.1; Sat, 12 Sep 2020 10:20:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to:cc; bh=+mGaDWEfta8vyAhBoJJzUUgD6EceYZj+gn3xoJnh1NU=; b=WnFGmf4vbJnnDq7QsfIWzGZh4BTqhVH1JDJ37IJRKJ42OKW4a7bzspAFOK6UHGduFW CVlZB558MJkPv8IYW2oMg9mVQ0frcKL0b//OtO+rhr6nj3fFOxfqaaK6A03ST7c9XTyU v7MMQ1eMPcoeUvIBflCVuEhJq65g8ogfhT5l+AGeVl5UKpbWtgebVsCyn+RT9j+NXclh 8n4xDtXNOpnABqJ6UT6kidzjWczI4IkAdZCOH0wFAHXSL9fQTnSmT6bhyYP0VDMop3mV 5tYnlRQBn8+cNVIMzyIZMklRTP+jE2MCPCj0XFI9x2pujsMgfT7LFk92oI1OTFpUqSy3 DnkA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc; bh=+mGaDWEfta8vyAhBoJJzUUgD6EceYZj+gn3xoJnh1NU=; b=GYjPgzUIzno9w9vmA3ma/SooXdVCT1pYZmZsGrtZMCjMiWuWliMDywQ9DnRd1na15W BOUDfnYsTKKWAsTgkSUcxMNREPPpRXURN8fj9Sng4c9R4bjcu1XTfkmT7aL7cio1Wx9f CiIhhs+vAHYM28wtVxApAi3pm0Qxo9ug42cMtzGznpad/EgGqKAyP+b3TNvZ5zKY9UkK i5imPioKkiyR8XbyyE7bbyK66ouZjgdmauS7u9hLBUpxltgWZ6hAWRIT3+cAruZ7yeNi vzox7M48x7v8+XJQqxxgutQ3Smjl3+JSaHsLnr7CPC2c8kkRFpW3L8yf4IIspC0T8M3C lPvQ== X-Gm-Message-State: AOAM530bcHtWxZWDJ5yBKiK8bFRCYWCmTkavi+FPCaIJiVh4G42hE8ee QP+ivt3IrBcPojYRWUJSeHfhoTxEODOBD0gP7VsFZVvQNh542g== X-Google-Smtp-Source: ABdhPJzFv2it7ltASC8He4154KXFCLDTCrGKyBHaiMbaPVPOgYn/OkeZQC8JCw/aTJUG130Y18K8qwnOdRPB5O+SR9w= X-Received: by 2002:a02:69d1:: with SMTP id e200mr6693070jac.96.1599931212970; Sat, 12 Sep 2020 10:20:12 -0700 (PDT) MIME-Version: 1.0 From: Donald Eastlake Date: Sat, 12 Sep 2020 13:20:01 -0400 Message-ID: To: "iesg@ietf.org" , draft-ietf-dnsop-dns-zone-digest.all@ietf.org Cc: secdir Content-Type: multipart/mixed; boundary="0000000000009d662c05af21034d" Archived-At: Subject: [secdir] SECDIR review of draft-ietf-dnsop-dns-zone-review-09 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 12 Sep 2020 17:20:19 -0000 --0000000000009d662c05af21034d Content-Type: text/plain; charset="UTF-8" I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. Document editors and WG chairs should treat these comments just like any other last call comments. The summary of the review is Ready with Issues. Notwithstanding that I have a lot of comments below, I think the idea in this draft is a good one and look forward to its approval by the IESG. SECURITY ISSUES 1) The document claims that the presence of ZONEMD enables someone holding the zone data to be able to determine its "authenticity" even in the absence of DNSSEC. While it is not clear exactly what is meant by "authenticity", I think this is misleading. I think that, at best, without DNSSEC, you can test the data's "integrity". This is still useful to protect again corruption and errors. But as I understand it, "authenticity" takes a lot more machinery to test, such as the DNSSEC mechanisms. OLD (Section 1) It allows a receiver of the zone to verify the zone's authenticity, especially when used in combination with DNSSEC. NEW It allows a receiver of the zone to verify the zone's integrity and, when used in combination with DNSSEC, its authenticity. There is a similar problem with the first paragraph of Section 6.1. 2) The minimum size of the Digest Field, 1 octet, seems too small. Typical minimum size for such a field in IETF protocols seems to be 96 bits or 12 octets, so that, at least with a strong hash function, you have a reasonable resistance against brute force attacks. Also, while it is fairly obvious, you might want to mention how a receiver determines the length of the Digest Field. OLD (Section 2.2.4) The Digest field must not be empty. NEW The Digest Field MUST NOT be shorter than 12 octets. If it is, the ZONEMD RR containing that short digest cannot be used to verify a zone. The length of the digest field is determined by deducting the fixed size of the Serial, Scheme, and Hash Algorithm fields from the RDATA size in the ZONEMD RR header. 3) SHA384 / algorithm agility -- here are some thoughts/comments on SHA384 and algorithm agility: 3a) SHA384 is a strong hash algorithm and is excellent for integrity checking and the like but initially I was wondering if an algorithm with a cryptographically stronger structure would be better if one is trying to protect against active adversaries, even if the hash were shorter. For example, HMAC-SHA2-256 which takes about as much computation as SHA2-384. (Could be keyed by the "ZONEMD" concatenated with the zone name.) But on further thought, DNSSEC strengthens things a lot. ZONEMD will be covering not just the SOA serial but also the Signature Expiration and Inception fields in the DNSSEC signatures. So, while I haven't done a deep analysis, the more I think about it the more it seems like a strong straightforward hash like SHA2-384 is OK. 3b) The draft lists only SHA2-384 but never says that it MUST be implemented. Although it's fairly obvious, it seems to me the draft should explicitly say that somewhere. 3c) The draft never says how long the Digest Field should be when you use SHA384 -- presumably 48 bytes -- and what to do if the Digest Field is the wrong length -- presumably not use the ZONEMD for validation. (Presumably just add some text to 5.C. in Section 4.) 3c) SHA2-384 is just SHA2-512 with some different initialization values and with the 512 bit output truncated to 384. Thus the incremental effort of providing SHA2-512 in tiny if you have SHA2-384 (and vice versa). So, if SHA2-384 is mandatory, then you might as well make SHA2-512 mandatory also since you get it for probably <1% incremental effort. Having two mandatory algorithms with some people using one and some the other would provide some real confidence that implementations were actually looking at the Hash Algorithm Field, could handle Digest Fields of different length, etc., and the algorithm agility mechanisms might actually work. It currently looks a bit like only lip service is being paid to algorithm agility. 3d) On algorithm agility generally: There is a reasonable provision in the ZONEMD RR for a hash algorithm identifier. But, given that this is Standards Track I would have expected there to be hash algorithms specified of different types with one a MUST implement and one a SHOULD implement -- possible more but at least that. Blake or SHA3 would be example of a different algorithm type from SHA2. But I admit that SHA2-384/512 is very strong and a break in it significant enough to make much difference seems very unlikely. 4) There is no mention of local policy. If at some point there are multiple hash algorithms and/or schemes specified (which could include private use algorithms and schemes), a ZONEMD zone validator would likely need a local policy as to which algorithm/scheme digest it will pay attention to. See, for example, the first paragraph of Section 4 which assumes any good digest should be good enough to validate the zone for any verifier. 5) I'm not sure about the choice of "resilience" and "fragility" in Section 6.3 without a bit more context as, at first, they seem contradictory. See attached for one suggestion on this. It is great that examples are included but I did not check them for correctness. IANA CONSIDERATIONS A number of points: 6. For both the Scheme and Hash Algorithm registries: 6a. Value 255 should be listed as Reserved. 6b. Values 2-239 should be listed as Unassigned. 6c. Having a "RESERVED" mnemonic seems odd, I don't think I've seen it before. People usually just put a hyphen in the mnemonic column. 6d. In the rightmost "Reference Column", for things like Reserved or Private Use, the usual thing is to either just put a hyphen ("-") or to just say "[this document]". I don't think I have seen RFC 8126 given as a reference. 6e. Actually, 240-254 seems like a lot of values for Private Use. Why would you need 15 private hash algorithms within one administrative area? If you think there are going to be lots of private/proprietary hashes (national vanity crypto?) that get used moderately widely, there should be a provision for "vendor specific" hash algorithms where the "Digest Field" actually starts with a "vendor" identifier. 7. I don't think all the references to RFC 8126 are needed. These are all standard IANA terms. It would seem adequate to rename the "Requirements Language" section to "Terminology" and add one sentence saying "The terms Private Use, Reserved, Unassigned, and Specification Required are to be interpreted as defined in [RFC8126]." Then all other references to 8126 can be deleted. (You might need some DNS related entries in a Terminology section anyway. I have significant DNS background so I didn't feel any need for acronyms to be explained or the like but that might not be true of a general reader.) GENERAL 8. Sub-optimal ordering/grouping 8a. The sentence immediately before the Section 1.1 header, which give the implementation requirement for ZONEMD, seems a little confusing right after the preceding paragraph on DNSSEC. I think the sentence should be moved up before the DNSSEC paragraph. 8b. In Section 1.1 on Motivation, I think only the first paragraph is reasonably described by the section title. All of the rest of 1.1 is "1.2 Alternative Approaches" or something like that. 9. Chronological terminology I don't like all of the occurrences of "currently" or "at this time" in the document. How likely are these phrases to be true 20 years after this is published as an RFC? In many cases, this can be replaced by using "herein" or the like except in Section 7 (Performance Considerations) where some specific year or part of a year could be given. 10. There are a number of instances of "must", "must not", or "recommended" that I think should be in all capital letters. See attached markup. 11. Verbosity The document has a generally conversational style with some empty filler words that don't add anything scattered here and there. While this is all a matter of taste, I suggest the following: 11a. All occurrences of "certainly" and "Note that" should be eliminated. 11b Instead of saying "x can be used to y" or "x is designed to do y" just say "x does y" or the like. 11b. There are three statements in three different parts of the draft (Sections 2., 3.1, and 4.) to the effect that "When multiple ZONEMD RRs are present, each must specify a unique Scheme and Hash Algorithm tuple." I'm not sure what the best thing to do about this is but as long as the validation section makes it clear that such redundant occurrences mean none of them validate the zone, you are OK. 11c. See other instances of what I think is unnecessary wordiness and suggested changes in the attached. 12. Having an Implementation Status section (Section 10) is good while a draft is going through the approval process, but I think it is, as indicated in RFC 7942, inappropriate in a resulting standards track RFC. Furthermore, all of the disclaimer text given in RFC 7942 is missing here. So, I believe similar disclaimer text should be added and the RFC Editor should be requested to drop this section before publication. TYPOS 13. The only actual typo kind of errors I found were "the the" -> "the" in Section 7.1 and "can not" -> "cannot" in Section 4. ATTACHMENT Taking into account the above and to make other editorial suggestions, I have done an editing pass over the draft the results of which are attached. I hope you find it helpful. Thanks, Donald =============================== Donald E. Eastlake 3rd +1-508-333-2270 (cell) 2386 Panoramic Circle, Apopka, FL 32703 USA d3e3e3@gmail.com --0000000000009d662c05af21034d Content-Type: application/pdf; name="draft-ietf-dnsop-dns-zone-digest-09-de.pdf" Content-Disposition: attachment; filename="draft-ietf-dnsop-dns-zone-digest-09-de.pdf" Content-Transfer-Encoding: base64 Content-ID: X-Attachment-Id: f_kezxoxh50 JVBERi0xLjMKJcTl8uXrp/Og0MTGCjQgMCBvYmoKPDwgL0xlbmd0aCA1IDAgUiAvRmlsdGVyIC9G bGF0ZURlY29kZSA+PgpzdHJlYW0KeAHNXFuTm0YWfudX9NvaVTMamjt58y1Z15aziT27qUr5hZGY EWtJKALZnv31+x2gLzRYgISqNnmwfCzO6T73G/qL/c7+YndvCs6WBbOr/4slQPbC8eq/04do4cZ2 wPzYXYRB7LHllr2+Z55TfQN/OGG8iOM4Yl4UW/dbdnd/zxln94/sBXvJ7v/D3t1XhM7F6jlXwOrG /jWweuGlWG/thW17IbtfWj0sdm2btVn8flemh11asne7p2yXpods98Tuk+IL+zk/LFN2+r+3C/ZH WhTppnhpnS0pO4JoY5dph7POlL+6fZ+COb5rsFfc/nw983B423Vc1kV+OxWrOr0mO9/2QSDwiIAh u7eH5LE8LaCef/1twV4nh4f0MIPItDNdSWR20COy3SpdsaJMymPxE/tUJrtVclgV7P6QLL/03LgF +jdUvMiednPcHm6tsabr3J77pkd8932fHVLc+kNyWK4Zv2GO7XDtgqN1zqr9sNI5zWI4h9Jx12M4 gLihcMkaLfPjVJb2045A2/Eiom2I/gN5m2wH1X0afc1uuBHupot/crhRF9AMVsYzzuHF2vHM5Njk v8/D4tiFxw3AYs4NFr/aJv/Nd3Nwt4N6Zu7CI87K3Hk4G/lQXj9ggWcw9o8F+8dxmxyyGXjbQT4z aznSh/9vvTXTpF/yfLJLaIzXul9qns+xyTQin3V4sElHS65xrVr+JX1Oh7NTkSqXo59apNC3rpnf TfYw+gMz2UTj0HG4rlH8HZE7+YJk5PxMXzC3i39mu7gNO+LTuXXO53k4HBOH4RBxQIPD//r05u79 p/dzcLeDe27ucsefy+/Mw9aQ2Oo67BYnM/j66vh0LErmRFUCZk/hr9WufqX29lx/NNqux5EegYeO ydU50Dq8kxlORTvgypxAZtcnc89ZZB3B7dsRitBbkDVk/QEVbvKUsreTY3dviOEkcV5TMiTzlEKn HvMDe/vrJ/ZnvkuLqTxVMYf7FMnsXjrjLfdUlSAT3VsX1xnKGGYRU0hiCnEnUDSktKJieDS7OmUB JW52jJKnB/U8hXxEnYI4rCkY7MrS8nH02TvGHpNCcTeszm5gHn/2U6LmNlwh51EfhdWuyPfnHx4H J3PoRT3T4Tlky2EZPXqKw19wdIeO7vdKdKajO3R0FOE9R0eddkFKyl3CHPp9mGc6u0tqGfaefZWR q7uA89K5dV3PTKf3wR/H7rUpO77g5AElFbyX75PdsvL2mi8OOl2HqacdCMyeHRlO5tVDUaL3pgvU QvCZMASQbdTbLnY2NXT0scXzZXJ5nV7drW93Bg1svESbgKRYr3WUyFRtDv8FEgbn79dZwVb58rhN dyVbpcXykD2kBUvY/pCX+TLfMHRH2S79VuUUH9MiP1Jb/2O6zA8rVq6T8gLuimJZP9i1uOuZ3UCU W0qx7UXE48CGt6mSntjhAX2qYBEbnkqdCn6K/Z6Z8y6THXtI2bFAP7rMq/NY1bhq4jRMiV2r6mWy 43fuDuF+zVYpxLw8PO/L/OmQ7NfZkm2bVLX2ryz/mta5pBYrLBraTTNO2RS5xUmUAlrGiO7uF0wC nzAJHJIFJoE+jQS9wFsEHkaCW4tHJmzDWjBOo8MN0x9tQGv2qIaPOINj4QzjrtjLduVK/dgsp1s6 N5VGr0XHZkthlZTJgrH7dcr+/Oev7z68ha02RivV3ZpKWtMqTkbLHfImFW1Lm7c2XmGZ776mzwW8 Q8oaTaJTsWxXgTRlGh7MdpJVRxa8Nf3z5r2n7FUJMPB6msSSi0NKcoqG9AldElmJeegjRPjHOt3B QoldbH982GTFGuaY7ZabIxw1/LIQ8KFyxjcMf2b7DI78omkq5S0Rsi7tZFfyyUFsjg9mtw+QUA6n 2gkglwu3lj0+S2VkUNiS2FbVzslyeUQy8lwFvmW+3W9S/CMcY2VV2QW85VRoOWEA3qpjXYm3oRsZ Be7svAUJg7dNWIFuFgV4uEOiQBkCKWaafUWMq3S58gXbpFyuocVCsVeMwDeXJBOUGEccTUx1rmsx NzL7eXouMc65qiTTpaYEpR63YRfvaG8zKgEEAUNkh/QJHfQN1Jvlj2ydf1NWUclpnRTIUOCIkKDv im1WlhAjpYRCpotZRKbOda7IFD+V/45cs8ujpXzjxKRCvBZ+NQpRz8BktMxGRQj0fQyZNXEdmfsu r5J2rCPUCeQh3W8SWB36f5/evaljyCGFCGtAldSny8vigzAz7VznykwxV0swFHNj5+r5E0gYzM12 qwy58THZsI8fP6UICp9fUDu1soZvWYl0EXtODBnz7rjBPLZ8/vzyRkRiKpqIvyy5xCooSlArWTvc tTgcmnPm2aMEdSzbvV0KAn9D1UkpIVQzYd/WuT4dlfk/9QBsd3It1vGEmnLRpIvb1D7BuYwAeYOD pMhZD5QPFKiIV+O9xSlLRnOyaWR1efGANONYrnPoUVIiRLJdsk3P1x0uJ3kaqa7uiErLcfy6knID p6mkUFSZsI2EWfS9pmxqPauVUlRBURU34F5PMUx5AE7LSW3tmaKgp4jIDLyHRpEekCIWVUZ9PBRC LkzCMWJJds8sr7Ql2e832RLig9ZcIDqxt3TbHEgvrMYr4inlR0EMi/JpIAm+GtpPYyO6kwpeQks8 jzda4gUL16F6m3Zt2zALWqJg/iKiuhww9ayEUcEdCiXz+cKl0hwom69aroDpj/vwClGFUj0qQYRx Zr0LtEZFXTfUPkEtGlgTezQqQVHNSm5XdHRRL5QABkyoEbXCK1c9Id+g0+5SeIVgpaP9UdOrYbXl ut4isispcadptEgYGi06rFKQjRIwHm1AkJLi2Uhxde6o+QbOzUmrprzjeKcSkN7sDhR6BpOKkQNE xrmfLo1XBSv2qOUfMxWC0HYbFNfAcdquob23FCBE2eilwTV0z4MKrqQ+cZkhNo3dszl1eTVw7KGG AIwlTUXHrpRmuAXbvh4W2LWwr4aERNDwfDJ7wxU1skNdyAFun7o/96iHFmE41HP/Vk5PXhndYW2E IYzX8YQhcgejkso4yTiqzqgrYJvq9YgGxqsXKOCptWdrGDw1+VAeCk/PQ2oCkVvWvtvA1POWy4Pa McAJqGcljHCSN2/oS5ye+q7AaWkw+bz2rITN7+sdbhZYuvpdIGZV2PMeGts9jbyQOGyo7USKd1br X7l/WjeieIJ1I25uymmKPXChjhlpnlFOFHrug1roKb1R9jNApjEPdXq13tCDXDu+0H/pDX9UJURh o3e2vYjrFIOHJoz0VoMhhfFgH/qjBGrMQ2YedoCGTWUd6psNSH8YOQ6yJeBTD9agBp9MIEYGw1Mu RYuLjm/WtPPnzF0aq2eULhghUXWH4u6I1l9e9ZIoajQdo3oOUaB39NcRryGsqn5rM8s/+/0fLrbR ac2Obq5nU5riDChkR++18KEx17W7rb8LiGjGpQoS0DCKHjiJJboNVGKgqaOMTBqByuDIHEaPLU9d WrmT7p1puqROMYmz7byDih47qkqS7q3/nn9LUYeNJnTKPrSUo0vohhR1KhnluuTrLrfYRTJFp/FJ 2vsAw07dQ8tkurSaxiDNg5rbjJ7WqkxY03vuUbskQiuKLmakTRj/K5b1KCKp5GhFPHllqpd4jJ5N D3vFysKqni7q2wyqFhcxw7GbXMQJo7qPgfxG5EwSpuVMDoJDUMcE7dkaJnOmJn44GEE7dVRQ3xUw 4GxoW07kLEKqorXYo8GqnClocjsNp8+b3E7CNpYGkzhd9ayEEU6pfPMGGxe2227QYEI2sUZQlqRl TF3EmrpdYEC6L4/NIr8VKKVO/yjDGDjFKeeqOfvYrNSh0nVDfzQf25TaHtanys6LMHTkbue+6XeM NovsQW+/DtyqsVQlM7X63ENAk5lUwHEEeh2S2rLtoVVQvoFalZaVmrWDAjNG7LSwbfJMezbKI0jZ qsA5yV+B47SH33tIrvb+uxxfIaJt8r0q7GkFghRscNmtn1ZM43qs6Avp6slPssJ7rlOVSAlWbVoQ sw3vrwl2QJ5t5TReLKcXRR3skYjj69scWBdRhxcunHvC3eLiAdytBRfOhbtsYHCtLRhv3K3+bAMj 1+g1JYBF27KEE2Wv34OzBWueF8/i9WqEypoOcFpi0cgJbNFZV0cXMEQAeSTAjB0lepRAKCCqU6Im rwppDaWirlC2YA1Kr3nWEjib4KVuJJ7HzcVQQNLZtGE1TgQfwXV1dDrnyPjSVou2z9J8tOeZb3Eg VWOPx/J40FNQ5VzOtyXa2LWJ3i2vqeq2VIqManhlqbmZMiRa2bV9TBorxD82JKHjg85J9GXR9hHd cy4a7RJGyiXSHS8yu+d4Q1qASF0l/86SXrvZpksvNpttrQh7gedQAdTDqLSdgRTH/T4/lKxuSbBW ZSra66MTYyVG+eINb5E01xjHXUqh1djle+ZURvOA4/CqKKGVljqJyFzawe8f4HcQaPujWgb+kG7H q3onGQjJhsIQWzjc71Aaf5kOXu0GgXuixBpg0qkyQycRmUntFLU9RUSpbdChUbHf+EWRM9RUa+W3 aFR6Ov7lhrZ/blu4ag2AguHP6h8VQR1WHB+adSEE8sfjZkNjdXQ6t9VeWLVJcVnVTR1Dh7x165oT f/jnlLA0jUDBZjiZ+TWiS6Papytorkzm+frNbyyMqlba6zcqlR1Q+VNyVLu8eMvTzPBALBbe8oyg x+VbUz24x3uCTjDVhXL9V4oj5OXt4DK/3Ls0DCcwukRQQUXLZUz01ot5nIBWWIJEnxfAbg+StG/5 4Qv9KJR4y6TSZUrixC2Z9tNRlPDXY5Bxaq1urJZruXbj7u7LOLwqjGrtME31orATqfW+7FQiWqxW EQI0DN3Tflfr84v37+5//vwS7eBfsXNWV771PsrTIT/u65o32aAoXmV4uyp7OJazLBZhbEnH0nPj ydY8xN2YX315mYOGwd2uomI7TShpU4meEY9V2tgiOWM41vrPXc5V8bjeXU8Z3iEoKZRgw/1AL3wZ txt2893ETL7D1cPR8Y6mBy8yyeo9hB684xVuZHiPg05OOcGcTxFR5tylUYuGIVdC12pdlvvip7s7 WouklyHxmyYLeq17kc8T6qm1ihk90iUcxPDWh6e76vX34q5RjLvxgb8jOa4W2bpXniw55eCV90Ur 3Sz5JuMdcEGOHZhLAbMH/h4aPfY4qp+huKQCfwf9/IGfSBiq1Og0Bf5KpbSw/zXZZPXIN0FD9nu2 PW7JFxXZd7bFCzjrC5YnVauyufU1wxO2K66+l040jPBEL100fezjHl4iXdF+arXvj0/YE8ofCuxR 0/sZ2CquUwGVc8HDYLtzqitReuXYwh83R7uIwxpe+UMzeKndzCI1qxa9MRcdL5/e/QzthVe3aj0M OEIdhL3RGmR5vuxyyQcViLqVAuwGkYlPghQ+WnpsthnlgwrUwoedSLveyhLnw6981iANH3ZTmgUT iU+BdHxOFIktFoFPghQ+Ma9Ee1fg00AtfEFg3he/XFODNHxYMms2eSU+BSJ8v/8PLfD6tQplbmRz dHJlYW0KZW5kb2JqCjUgMCBvYmoKNDEzNQplbmRvYmoKMiAwIG9iago8PCAvVHlwZSAvUGFnZSAv UGFyZW50IDMgMCBSIC9SZXNvdXJjZXMgNiAwIFIgL0NvbnRlbnRzIDQgMCBSIC9NZWRpYUJveCBb MCAwIDYxMiA3OTJdCj4+CmVuZG9iago2IDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBd IC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4gL0V4dEdTdGF0ZSA8PCAvR3MxCjkgMCBSIC9H czIgMTAgMCBSID4+IC9Gb250IDw8IC9UVDEgOCAwIFIgPj4gPj4KZW5kb2JqCjkgMCBvYmoKPDwg L1R5cGUgL0V4dEdTdGF0ZSAvQUFQTDpBQSBmYWxzZSA+PgplbmRvYmoKMTAgMCBvYmoKPDwgL1R5 cGUgL0V4dEdTdGF0ZSAvQUFQTDpBQSB0cnVlID4+CmVuZG9iagoxMSAwIG9iago8PCAvTGVuZ3Ro IDEyIDAgUiAvTiAzIC9BbHRlcm5hdGUgL0RldmljZVJHQiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+ PgpzdHJlYW0KeAGdlndUU9kWh8+9N73QEiIgJfQaegkg0jtIFQRRiUmAUAKGhCZ2RAVGFBEpVmRU wAFHhyJjRRQLg4Ji1wnyEFDGwVFEReXdjGsJ7601896a/cdZ39nnt9fZZ+9917oAUPyCBMJ0WAGA NKFYFO7rwVwSE8vE9wIYEAEOWAHA4WZmBEf4RALU/L09mZmoSMaz9u4ugGS72yy/UCZz1v9/kSI3 QyQGAApF1TY8fiYX5QKUU7PFGTL/BMr0lSkyhjEyFqEJoqwi48SvbPan5iu7yZiXJuShGlnOGbw0 noy7UN6aJeGjjAShXJgl4GejfAdlvVRJmgDl9yjT0/icTAAwFJlfzOcmoWyJMkUUGe6J8gIACJTE ObxyDov5OWieAHimZ+SKBIlJYqYR15hp5ejIZvrxs1P5YjErlMNN4Yh4TM/0tAyOMBeAr2+WRQEl WW2ZaJHtrRzt7VnW5mj5v9nfHn5T/T3IevtV8Sbsz55BjJ5Z32zsrC+9FgD2JFqbHbO+lVUAtG0G QOXhrE/vIADyBQC03pzzHoZsXpLE4gwnC4vs7GxzAZ9rLivoN/ufgm/Kv4Y595nL7vtWO6YXP4Ej SRUzZUXlpqemS0TMzAwOl89k/fcQ/+PAOWnNycMsnJ/AF/GF6FVR6JQJhIlou4U8gViQLmQKhH/V 4X8YNicHGX6daxRodV8AfYU5ULhJB8hvPQBDIwMkbj96An3rWxAxCsi+vGitka9zjzJ6/uf6Hwtc im7hTEEiU+b2DI9kciWiLBmj34RswQISkAd0oAo0gS4wAixgDRyAM3AD3iAAhIBIEAOWAy5IAmlA BLJBPtgACkEx2AF2g2pwANSBetAEToI2cAZcBFfADXALDIBHQAqGwUswAd6BaQiC8BAVokGqkBak D5lC1hAbWgh5Q0FQOBQDxUOJkBCSQPnQJqgYKoOqoUNQPfQjdBq6CF2D+qAH0CA0Bv0BfYQRmALT YQ3YALaA2bA7HAhHwsvgRHgVnAcXwNvhSrgWPg63whfhG/AALIVfwpMIQMgIA9FGWAgb8URCkFgk AREha5EipAKpRZqQDqQbuY1IkXHkAwaHoWGYGBbGGeOHWYzhYlZh1mJKMNWYY5hWTBfmNmYQM4H5 gqVi1bGmWCesP3YJNhGbjS3EVmCPYFuwl7ED2GHsOxwOx8AZ4hxwfrgYXDJuNa4Etw/XjLuA68MN 4SbxeLwq3hTvgg/Bc/BifCG+Cn8cfx7fjx/GvyeQCVoEa4IPIZYgJGwkVBAaCOcI/YQRwjRRgahP dCKGEHnEXGIpsY7YQbxJHCZOkxRJhiQXUiQpmbSBVElqIl0mPSa9IZPJOmRHchhZQF5PriSfIF8l D5I/UJQoJhRPShxFQtlOOUq5QHlAeUOlUg2obtRYqpi6nVpPvUR9Sn0vR5Mzl/OX48mtk6uRa5Xr l3slT5TXl3eXXy6fJ18hf0r+pvy4AlHBQMFTgaOwVqFG4bTCPYVJRZqilWKIYppiiWKD4jXFUSW8 koGStxJPqUDpsNIlpSEaQtOledK4tE20Otpl2jAdRzek+9OT6cX0H+i99AllJWVb5SjlHOUa5bPK UgbCMGD4M1IZpYyTjLuMj/M05rnP48/bNq9pXv+8KZX5Km4qfJUilWaVAZWPqkxVb9UU1Z2qbapP 1DBqJmphatlq+9Uuq43Pp893ns+dXzT/5PyH6rC6iXq4+mr1w+o96pMamhq+GhkaVRqXNMY1GZpu msma5ZrnNMe0aFoLtQRa5VrntV4wlZnuzFRmJbOLOaGtru2nLdE+pN2rPa1jqLNYZ6NOs84TXZIu WzdBt1y3U3dCT0svWC9fr1HvoT5Rn62fpL9Hv1t/ysDQINpgi0GbwaihiqG/YZ5ho+FjI6qRq9Eq o1qjO8Y4Y7ZxivE+41smsImdSZJJjclNU9jU3lRgus+0zwxr5mgmNKs1u8eisNxZWaxG1qA5wzzI fKN5m/krCz2LWIudFt0WXyztLFMt6ywfWSlZBVhttOqw+sPaxJprXWN9x4Zq42Ozzqbd5rWtqS3f dr/tfTuaXbDdFrtOu8/2DvYi+yb7MQc9h3iHvQ732HR2KLuEfdUR6+jhuM7xjOMHJ3snsdNJp9+d Wc4pzg3OowsMF/AX1C0YctFx4bgccpEuZC6MX3hwodRV25XjWuv6zE3Xjed2xG3E3dg92f24+ysP Sw+RR4vHlKeT5xrPC16Il69XkVevt5L3Yu9q76c+Oj6JPo0+E752vqt9L/hh/QL9dvrd89fw5/rX +08EOASsCegKpARGBFYHPgsyCRIFdQTDwQHBu4IfL9JfJFzUFgJC/EN2hTwJNQxdFfpzGC4sNKwm 7Hm4VXh+eHcELWJFREPEu0iPyNLIR4uNFksWd0bJR8VF1UdNRXtFl0VLl1gsWbPkRoxajCCmPRYf GxV7JHZyqffS3UuH4+ziCuPuLjNclrPs2nK15anLz66QX8FZcSoeGx8d3xD/iRPCqeVMrvRfuXfl BNeTu4f7kufGK+eN8V34ZfyRBJeEsoTRRJfEXYljSa5JFUnjAk9BteB1sl/ygeSplJCUoykzqdGp zWmEtPi000IlYYqwK10zPSe9L8M0ozBDuspp1e5VE6JA0ZFMKHNZZruYjv5M9UiMJJslg1kLs2qy 3mdHZZ/KUcwR5vTkmuRuyx3J88n7fjVmNXd1Z752/ob8wTXuaw6thdauXNu5Tnddwbrh9b7rj20g bUjZ8MtGy41lG99uit7UUaBRsL5gaLPv5sZCuUJR4b0tzlsObMVsFWzt3WazrWrblyJe0fViy+KK 4k8l3JLr31l9V/ndzPaE7b2l9qX7d+B2CHfc3em681iZYlle2dCu4F2t5czyovK3u1fsvlZhW3Fg D2mPZI+0MqiyvUqvakfVp+qk6oEaj5rmvep7t+2d2sfb17/fbX/TAY0DxQc+HhQcvH/I91BrrUFt xWHc4azDz+ui6rq/Z39ff0TtSPGRz0eFR6XHwo911TvU1zeoN5Q2wo2SxrHjccdv/eD1Q3sTq+lQ M6O5+AQ4ITnx4sf4H++eDDzZeYp9qukn/Z/2ttBailqh1tzWibakNml7THvf6YDTnR3OHS0/m/98 9Iz2mZqzymdLz5HOFZybOZ93fvJCxoXxi4kXhzpXdD66tOTSna6wrt7LgZevXvG5cqnbvfv8VZer Z645XTt9nX297Yb9jdYeu56WX+x+aem172296XCz/ZbjrY6+BX3n+l37L972un3ljv+dGwOLBvru Lr57/17cPel93v3RB6kPXj/Mejj9aP1j7OOiJwpPKp6qP6391fjXZqm99Oyg12DPs4hnj4a4Qy// lfmvT8MFz6nPK0a0RupHrUfPjPmM3Xqx9MXwy4yX0+OFvyn+tveV0auffnf7vWdiycTwa9HrmT9K 3qi+OfrW9m3nZOjk03dp76anit6rvj/2gf2h+2P0x5Hp7E/4T5WfjT93fAn88ngmbWbm3/eE8/sK ZW5kc3RyZWFtCmVuZG9iagoxMiAwIG9iagoyNjEyCmVuZG9iago3IDAgb2JqClsgL0lDQ0Jhc2Vk IDExIDAgUiBdCmVuZG9iagoxNCAwIG9iago8PCAvTGVuZ3RoIDE1IDAgUiAvRmlsdGVyIC9GbGF0 ZURlY29kZSA+PgpzdHJlYW0KeAGtUcsKwjAQvPcrxpuCpnnZZK+KR0Eh4EE8lBBftKDGg59vrZUq eKpuDrvZXSaTmTOWOCOdRgEfwesTfdXiTOrn/VFYpohnGJNiJiMNX2LioGW9USVpiBGRhbaUuBKp cwICbos+BnBHzFz9UFdULX9FHXHGuTZwPvlCW9EYn7RXIcZQxCHCFXnB0MbsdjpcQsQ8v/g9xBCS S9GOm2q9yHcBYjNIOv+e20ouUngjl/xPU6VNo6lqnOp1d8q+/G9Rv/i/vAPdpYO0CmVuZHN0cmVh bQplbmRvYmoKMTUgMCBvYmoKMjAxCmVuZG9iagoxMyAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFy ZW50IDMgMCBSIC9SZXNvdXJjZXMgMTYgMCBSIC9Db250ZW50cyAxNCAwIFIgL01lZGlhQm94Clsw IDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjE2IDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBd IC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4gL0ZvbnQgPDwgL1RUMSA4IDAgUgovVFQzIDE4 IDAgUiA+PiA+PgplbmRvYmoKMjAgMCBvYmoKPDwgL0xlbmd0aCAyMSAwIFIgL0ZpbHRlciAvRmxh dGVEZWNvZGUgPj4Kc3RyZWFtCngBvVxdc5tKEn3Xr5i9L5tURQrDl2DfHNvZTVU+fG1t3aq72QeC RjL3yqAAcuL76/c0SAwMYxkkWKcq8UeKnjndffr09ODv7Ff2nb29zDgLM2YUf7IQ3zJmpl1+TZ94 M8s3XOb41mzu+jYLH9i7BZsaM8Ow52wRMtss/jP+Mef+zPd9j9meP1k8sLeLBWecLVbs1Yc4F2ks 8tds8Qe7XhSmu9iRD7c9mLRMS/Pwad+nytVPpAHHcGDAtckAa67+Kg06m5gcAcihPdieqzGxylnz 4+rzHfs9iQW7itYiU3/K2MVuvcO3TcM0Xk9OBdU0sCLTL0A97HlSeox13vE+JCSSMg5sU4mDIZ5q +c65T9UGQLVsiwK7Eb5wTWc4jgWA5SDGuMnaFvLoQcwY+5CzKGNRHGy3abJNoyAXLE/YLhOsSqGT vc1thDj3rLr5vbfPSKEaAXDbMmBgTgYUFyGFVnnGgoylYiVSEYeiL6IywLiPjZhI1TaOw/hJhoJh jB0KLQsPcDo8v2FJSr4PI4qBe/HAEvyNb90HMeH4y48k/ROhwhAp61Rk2eyX04mAe4So7TFLLmdA IjAdS4mH7n5qVZwaZ1d+MlGixk3ZtoXFPVK1ysqysE2opvYrbC4VBdf2QeXNPUxeDZOVcypsbvF8 xQlFUrIf0WbDxM9tlAqWxOxTkIb3jL+h0sJnZyQpVTuT89a+2Kvuzt+TqUz9yuPcUat076fKKlDj MGkAS2+G1GWyfUqj9X0uLU26eVtryQFZGqBkxgtLk5pc+pzkUQ+CbFXgKqbwaMXncu29I7WCxrXP fagERJfNfOz62zIgXfv1Vfj1dSGr2IfrxXu2SElmBfGSOJhtRZolMSr0UsR5tIrEkqgYPzmDen3E gel6TC7qVOaVqOoCemoZqtt6yJpjNHyQNbCgpMwyCXcPgIoFu/w+STNInAuwTZFFJAUykT6K5ewM 9CySHHPOarZPhU/DMtO5KmR65490ii7Up9x0FMyGFpsaE0XpqnyDMpbtvv0hwpz0xrvLGzb3qoiX SfD3jH0U62BzhrM8Kgkuq6/oVGdJWLWxzuet1mPoYIcJxXM3afIYZRERxK3YBHkUrwnRAsKrfSZk Z8BnAj7uWsBPmh4JP5OrLXyfsOxEFjCh4Pf11X2eb7N/vH2bE+sKMYtEvpol6frtJtorkc4KSxsg 3EAHxikE2xsMRZx1b0paNZdDQ8+4rX30GUKuRhrcpP7NKdauIBfFqwRlC92AWK0okSHkqF4tqYFM Vn2xk0zIfQBmItwIMGl0Qoc6Z1ChNmdN1x27QMGE3ERxMrXdfdtEIXIViCUrgAY2PDAjqtXNRgRo vlPxGIkfBCm+OPz4nFT2CFaHgkWuaKRUtnir+RqaCmFCgTUM0OfvNpunN3uB9MSWIgvT6JtgT8ku PUgAElaQAXkaheSCDN1Ifk/f2SKKT6fK6mBrWlvaWPi6LY09OL6u2ougrKihepksBbtMHrY4NYxx 1iJ+5mkQ5pCoqzR5aP539gB+PQdeCl+ck04tubKR4LUNb2xWgAklfKM43OyW3atBq0+tmrtp++Hd efPYWaIDFxg21Zu2hbvoYbsp25N3d1fsI5pJ1DaWIyQoHQ+ZuKSCcYdEI/KzZ0WlOPl00TToCMmD Eq+tZ6yYcFpHwEOnnO2oupzqadkNFjKY1dQesRgIj47iHtEaLgsWS3Y5+xGkaRDnT0D99Gzjhw5x WlvUSMg6xui6GSaUbGvEI8Gsj9+z2kRkC59DO9WsnwqhVEfVicjUsVt6ufPR2TG1XLPgq6cii+Db hnIWpI/xGii/s8UWXR3OCKdOy0pvttLB49q24vPej9XqeQmP66slsk/Dcoxoq9ONtglOI5s4T5Pl riRRNuvxpy8jaBGoZiFTLE8plLQYxqzOYdHqaaSMaj+8uwO7xffcUosw1t6D1Y+5kAZfGJSiNrWt 8Bl58RNOXB/LLqCHB0uA7b6OrGXIYQBbX9ipvKSND5khc09TNHsA3HTjpDH6rwHsqXWTz0wAfCWy aB2zL4848aNWqnuiMOYOArBc2EgAe5am0RocYFhRqJTPLAD8bwi8S/SqWQ9oSycMBHBtYWMB7GlO sHuRxNEYJkFtYjw+xTGlBmKiidskyctrGQRdjVgnXYZ+2gTlpJtxeHQwW58DdU0S8mDXmzWt2i9J vr3v+haPzzWP0a/kIN9URUxB8o0kOR1KyOO9B0s7dSgpSYiHCtW+xBjnDXU+SbwM0kjgC5LwF/FT GGDa04Z9oBSpbX+kFPHnrdlciXDn+OiWIrCjSRHioVuc3eAgR7CbBAdrT0W2vMxJjM2HIPnaskYC mGMqrsisdggfT5VuCJMhDcQ2IL6E2E+DTfQXOs3yjliQBwhnVNZQaKIX8Xw6uLL73K+onlXd+aG5 6ebFQXnIrEEX+0VsdGW3vRmdwtI8+4zl187lJb1xumfRvDTQNziO8ajkN40hIjgHYP1TxALBwW52 6TYhTYATQXAcxtbs8l6EfzJtgAyUf/t1DR8iNYw514wJGhXkjPSrGgXcnFBHBXxGyXcrvu9wVYam 2hiIBvF6F6yfSToF6aEwLlc2LsauRsr2TUIpd2rJUnXT2IUqZKk+L3D88/uXz9efrqiSYFIARrtF oU6X+sBt1urBIC7WNirEJteK2RNBfq4d4zCjMJJZNLyfk7izqZZkdOnqkoM7K5jkt57ffdh5jOtc 0nIuDuZ1JoKt+CmjJKSNTHrcKpeBWZtDcoNukpiYdNKelBKP8HtZw1Cl8k4HVepwDajdK9UxUGss ajpaJd53+Voo5WkAbreoZsxChh9S/OpiccF+o6uH75MUN19fTnLC+IwhBd1AwYV3uoJCKxs1xS1D e+IyVK2quh0OQ60kL9Oc6BTCkK4Tv4/EphOJlnE8BMblusbF2NEMLEh0dY7kpjJViLSGsaOOLSiS DyXrLsQNbQRxV4z7hrA2z2q62WrBQF70+4Kg1c3tZ58KLmR/TQrU2Mjy/0+6uW2IfEh9K2XKv4Ls HhcU10mKWwgPXbxJGA+SKQUAo2YKZsVKVaM0wUffINnH4rOZQkPpZhNEGJN2Joz37zN1zpQyjofA uFzXuBj7Gt08FMKyN7FRwVSEKYb3VfUG92fQnpTjjG51dag4Llc2KsaOrT2AGSaKJcYw08KYYniP 8fXPAHcsRKlX9raHupvI21tstjnPfcW40RmGlqiv6c/23ruTREf96XiacV/fxWurouww2zYoSS6D Tbg73M6VhKQ068cgHoKMyrWNmiiupZWfnUE+KoxkosCMkihW0WFeLHE6WXbyN5sgFPfJBufuLwt8 uAhhPATG5crGxdjTys/BMfZU8VlOM75s6e5WgHuWuDOD8WqOeC5OhF+K5r74ajON+9RNzXEFjbsa HE4EQRGJ1JabmN0WNpRAG4jusHjlwYPT3dzUCtzOEB1j1Vq73TZjFeK2bE/21jqXKdkNVPeD8OZB bSPFNfDu5z1NQmnOAOZ0pDQv321Qr1Ld4TIwbjOGNLwL8aYrvVfxQoDjpbrTd1urhO3tdg+NY9ut 9T7z9jtG4+hyGFLCnIKDxtrFKcGHTzcfr9m+kX2u/NW/TxgPQdPlukalac98Ziw6kDavfnnElMOU FmXC+a6B8e3t4dCrjmrz86EwLlc1LsZzrS4frMOsY4wX/pr9TxnJdBrTwLji144v6krG43QzC681 wKGKsclAL75wvIwEC3ZpQmnNERtfUsglorpmRMivJMe9/PtUjql9dYN93uxpP/fwS2Cm3MellqaX unPn0ee6quAc5Lm4H6h21b2fq5VJkuvxir86jfkN9UxscAFF4Gr+BvFbfVwXr+RnzRfyq58ePvnP DY0fzf8OwcT75Z3FEjKDatvmxuE1Wmv/C4H+VmVm79fQvSrCMKc5PPfwi4ZqHvv1f7w4hqEKZW5k c3RyZWFtCmVuZG9iagoyMSAwIG9iagoyOTQxCmVuZG9iagoxOSAwIG9iago8PCAvVHlwZSAvUGFn ZSAvUGFyZW50IDMgMCBSIC9SZXNvdXJjZXMgMjIgMCBSIC9Db250ZW50cyAyMCAwIFIgL01lZGlh Qm94ClswIDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjIyIDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAv VGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4gL0ZvbnQgPDwgL1RUMSA4IDAgUgov VFQzIDE4IDAgUiA+PiA+PgplbmRvYmoKMjQgMCBvYmoKPDwgL0xlbmd0aCAyNSAwIFIgL0ZpbHRl ciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBvV1bc+M2sn7nr8BbPFWxQvAm8lHHmZy4dneSeJw9 W3smD4xM29rIkiPKc8mv369BAmgSFEXK1GxqK56OgQYaffm60eD8KX4Rf4rvrkoplqXw1T/lEiR/ FkTVn+mHdBZmfiLiLJzNkywSyyfxP7fi0p/5fjQXt0sRBeqX8a9gns2yLEtFlGbe7ZP47vZWCilu 78XF9WZf7DbF/o24/Y94e6tYD+FjJ49SsAyDsGPyy7Gz2tV7lkHsx2CQRMRANFf//S6/34vm/75/ 9178e7spxPerh6Js/1chFi8PLyAHfuC/8U7ddOBj10GmNq3X5FUSFWM3bXdqzykKWuc0xaxhFr92 1s4DMssOSfEa6mWOZrBQvB49NprgMgpn4Uzi/0K8v/7Hz39/K94vH4unQlxvluuXcrXdfPf2c/2T uHlZF6WYidnp5y/TEOcfB4Kt5NTztzJlJivTOAaDhBi0Dg0Lxz9CysEyrX0DUzStvu7soxXNLp/Z rFUJ3/9KKuEwqlQiclSi9gtX+Xr5ss730A2hJFrJVUs3OF05jHMI7ZomVQ4j3SAOW8qhDG6sYtRH 6DWCRkRuN/ClAJPWEYYzkuqvz3f5vhD//und2398L25uXClyifKfhZxCumxdZ5Kun7jSPVG2CMjM PEIYty8RmBHAmw6TBPvPYre6/7LaPDTiGBdg388TCdeu7DzClXEbikB1JxUuOLSEG0O414t3C3G1 3ZSru2KnrL8czLWOTdaPZogC0oeXdnkN30tfxMugKNLP5h0M+nSg+d+EjCZwZmyLZ9IIKV1zO1kn DjgzKYHSGhAFAoZaGC+2//JcOOGgKc/mnyaSrl3XeaSbROcXLjB6W7aBlW2NyJrS6//TNLK1yzqP aGUboZ0hCMs2so4V2K3V9se8fBSL9cN2t9o/Ph1R37G+wAK8LnzqbL46UTq5k1NKA6CcyYd7VScf ZuHX4KfLsAOdDl53n+PWEd7lkMAi3hfLFxzVl1YgOnJw2lYQDMaeoQ1ZRrZsZecxi8v5V7ALMGn5 nET588V+ny//KMXiIV9tkO7vH4FUWVVAy9L990TStes6k3Rl4GTz5HcGa2/TQA6Ey0twceRLPl3L 99f9ar36S2HVKg/45QXoFen1QV2eSL5sYecS8NwpwpxDwPPAETCVMW6KEpItNstC5Js78QM7V29I ga7Taxs4eSkVW49VAnf5AxjCJx08OW0rQiZsNf1lSQcyW/9TLYEXI4crb5/rtd49kO0MYIyB9PEw 7t1lMcfh/Vzs7re7p5xOr5lrHJcuhkO+r69MXrKlnclCgqQjQZ7cBYFLy0LmysXrQt+PizCNjiqt Vl7691QCtgs7k4BD2VHfGWx7TQ/fXYG4BIuWdFNS4N3qY7508MlxKZ+uuDKlknoi+IomFavMUNEK kAwQh1YyVGnFfKxoO2GVM/lwt9Z3YtathUk7h53crbksMmjFYvnHZvtpXdw9PBWbvSqhH9cI8xtC zk/XDhs22NImVQ8r38hPW+oxRr59Z2jCBli0rE76M3H99LzGpcVmX1Wl3+PfL8OlPJF82dLOJd/4 ayDXKG4jV4iYSj2Ll/3jdld+0xa3UVQeKvjPUwnYLuxMAo79r4FcwcXVYcoN3j/muH79W7HbfVOS kI1X9V5xh50hOkgZzsVlxZdDV240vacoZGoWc+xCvQe5ujsf7uL7UKV1QXHUgVxHIKs+LuZi59Ll AhOh5OPd9ZW4elytC/H3/Hd1hgNFTAKeALqyhZ3LRLKO4sRg3Rjk42OU7ZvlUAn3cwXjeIBctw9D UgHufiqMkk0iX7u0M8k3iTrqzdPKFyza8oX3uSnuix2lzT0liLZUqz+PFWxnhm1BpisBdYDBFHXR S3fy4R6oT3mtB0qyDpA5uQdyuchABel3lD7vVx8LfqDd59akCgh4Ag/EFnYmC5mHHShzhICbx3io fgcurpFQkL7eqArFeBGjH2AKAbOFnUvAaQfMnNYFzdM2xlw8Pxebu9VnsYCM337OCdGrwnMp/g93 M3VTWh+oR7feJPK1SzuTfNOwnUVTefRUP3RIgcGlpcCLqvqzUqJ9+6+FavdCbd8c7WtgpvRRJJAy FZcVYw4zh94L0wkOvfvqQZnuzofLtg//WR+PiktLtuNOsI+LRZkul8WMPNDVlk7ws2BHWAzDRBOZ CFvYmUwkCzpQ5uQmAi6tY1woFN8Q7CfyPk8v6/2KPNKd6o09CJFEMAmMZws7l4DnHTBzegHP20hz oTrgbnGp+OvN9Wxx8/Oiul1sYpEDfzrdvUtqOAoSeKfMLmlS0Uq6IgpwOUQcWlUw2GyQDfZsNT7p KpG6Uw/3bE3Y0yxqW88m/eBrwNcONosZdZmRZtz89NMtScs7qa1+Ti2C87kUl5xJfdavaKxnPRxz 6txP0YaoWLQO+/3bm3++vXk/e4fVq4vzA8ps6i0iDGrd8Oj9wpA7yi7d4LsVaAjDG4VXKAfbLVeO 5Ny9h5Bo0q7gmLrj4u5uV5Tl+AwVzeCn+w5bQa/XxqHNaBGzo9OPSy7RW+fcB451Fzap7uzXAYc2 HKSSLl6x7LZ3L0tq5h7M0YFeCdlDgsobduKwGS4hZ16meYF0ENfY9VoJdSt3ELfRwBhQ3gfpzO0F ei/aPK43qsUGj2++Fbn4izptVqUiLbfrdaFORmzvRa6K7yu64UBuDzPYvuyWxelabest9aJepdXH ZBv6Z08pJXi00NyuWG53d6X4cHFzU354I0Y3LHduaw4o4c9DKLvL8THfUUtPLpbbpye8jyAdrcKY P0tllvjzjBy8H2aBTOgnRUvF0GdqXueKUN5HjR8Fi64lobXxYVWtZNA7tT5Fph3PZIK7hI6958/F 57E2ab2hpLwHr4M6p2Y+ZOizvt5tRCSvtHsbHy7+/+aHqzTKst8+vIGLpBheinxXwAr3xeZ0iwsk kAmpjBbeAYv77n/xgPEBDxiPaUwYyFlMTxmDeYpTySLvSYRxiybWnDafJSmePIJmxxrao7jHVJma 0wvSEHqK38Wc5nc1jY9Pg9k8UHPqsUiCDA1zeubIsLOAdjYM5HSqOgsJYdxxWTdYAfvgsPXX4NHy KeV+uyvuRF6Ke1zzlFwz9XlRm9nJFt79EJWBWnfb8DN3q/IPvpThb1+9Q29fWcubKwU4FGoMLbdM 3oO665jBS7qYjNC3ItvzexfT4HQZkE9RBufoyjJHdL0TT3mJd7zqLEVV12U76sfiDlwxbxvdHTWw uGPghxRGppUxwirlLCMjexJBONdGX9PWTVoUwRGscZ/IxhINRk8GPtYY+/woN8asjdqnB0+hw4M8 tfTD6Dfjp8e6504nk0Jt/BSmj4PM2hkPRYKHYoM3UOv1FzK8/W71+8uefAIi/oPY5Hg9Wxa7j8Wu FHhBu3kwGjWwvmptBPqLogJeb6uFNDyRN312F0VOFnJyRahZX7AOFTwa2xAX5EcW//rhhrsv7Ukt ViITGYmVuj1pTLlKlJLbcff74UIB8P0uN2c2MFjZM2PK4zIYnmQ5VSB6OO2neDnftfDhyLYv7tHT aT8L0ehHsmmdE26H+RENjDB97oNFGJcdmTY+0ZD8Zk4CKjAFhGbJH64rdAhyj+rDG8PZOs1RyKV5 M2ODkbtZpH5oVb/+elYg6eMTKFl2KtOHi9Vmuav66dZVSgqLGK66fWcOYARLxhVbl4qVTR2jOOkB LspIh7womoXtMKhpPAxG4QwAnkIeG1vREBoVzs00TtbjEVqzNh/MaWlmzqAe6wWWD80ZJmEdmu2c sdRhWNPWgtH0nB4bq2knhWuY90FEx8J1BD/SbLFRoTTLYmtvNgE5hE+GWYN1jeYzFDj8rH0H+gp7 YxzISSKTJPVyODD3NWzlFhywmlpMTpJMWLFoSfF5t91vUbgpAUiY+3Ad12TxjPtsZ8eq/qzyFLuY UVtvuTA82UadQcUHR4FQuf9iuRiYeYSdC6INZnd1lIl02LT2ALnXDyj7j7t3sRzv56z2sfJI7+KH JwCB9h5hCKVTCQCypdrLaBq8nKUFs5gqAaDZsRWtTgCCufZSejz3fJpmPZ8XhGY8G2toyptKM2dK IEUlKpZPTVt7bDyqDlRdAB871tDOmKjEUcf9ltXbV+iVBbkuj3xdbsXvdH1s0wWbqkwAbA46feYf 3GVtX/b0OQeqLxMMV0Vouu+2SzsiDwdNcjtDIzkwBl3EgXPrlkzdquebL1XmPVj+Fb8DVVBC3kFE VVB3pwRgyvvBfPogjL3p7eDTAMkawISxBhZUSasADL7JVZuxpq3pO12WpsydindsLNE0gDFmEyTK 5KlQZ3+3pjXGJ5VpWpPzAoxV5lqBIqx3wvpcnLb79HR0tMcwNEzUsMa6WvPxNBx22u7UmyZOMLTi sihflo+MjbHg10GlzniVEKaJqXeBttqyIy3SRiFygtyM3pTh8ykUJN3No/j5w+3P39pj/JO2ffQT e/b0gCPgGujNmjN7o67hBEpbEKCfbEFgrmMi+vCDOk4GVUzycHVY0Sgm6jjlZ9XH/9bCDLUkCj/4 aktti1KVYBDSMFObRrZkaNEsrUIaG2toTkijzOYV3pWB+SQ8/+UaeLSg7o+3UIEuE7BnNBnIZabo bpZSZ6uKIzwKPvvYHUkSqv/FaA67xHV2e9+78stm2bnxM9g+6zQ5tvFRutTE9czY3f1ud1a4R3g4 YN585qlLkCccWl9YZtUkdxPFx4JfgZ7TXUv6RCDeBqstt7x1Pk2djt33ulv9uMqZZMeeGDykTo7c qdm8Q82s78TQeEDXM1TddnkVT/lqbTVvohNjISikY8J1fNc5sY0eEaADgFmlgF1pu/vL6Tsrj+o5 MNvlBJFbUjdOEBBccLmiLHH1ssMznz3uLgD5cZdhsf7gaGtinszSWUbf0LX3Up6hITbquyqiAdxW 6V4dLxlNpZBJjXPNeMTb+jJaGBrm5DQ9Jx9b02jO0K/DvR5PF+QI8+rSXNOQgjZo9fjGWD5nWI23 +3wSEd6nteds0PSc9Vi1HzunZ1N1P8JXiJU8ZWygSk0DfLE0/Mfq0p2NrWh1foAspcYvdk5zboGm cfxCwqrnrMd6qNZqmjojLXsznuSJX1FNCHZORtPj7Vm25jSOZHjycTDX5ZgobV/co6tqsxXlHnAh 393VNndCxyWD4wlncp6OS7RWtGLImHvVPu9kyxXg0cJ2n3J4h63AFSa+p6lKA9R+Bq+xWtKHbqgd rZKkdR7D/GSn/634826Yia7/bUuRK8Z8Ta12dN03s/539Casr3U5jA4iVjhMkefux8DGrtdmlSw4 MRYpUrfmZcAYHeuL8FbHXB63j7DIu+3yhWKgktX5G+XmBOzRX3wp3fWs6lZYavYSm+KTkfLoW3tp y+RtNt7FKxAgr63Zjj+waHmI52K5uqdPifFatvGzR3TcwfAMxbR30+hqGTav1UW+G9uP57LA95HV p0X3j/nXUhNJ7VYwii41UZ0dvNrymn2bVykd+jgiV+gzQcAcwME5lVpc2T6Pzu06z49d6ro8th9X xpSOFTwc5UPtBieBR/ddq9dB/PjfvdAnINw/4NsN+Fx3F4uCmauyIG9opy5T74DaDIAxmxzc10fD 8be+WiFASNcohGujGu9pGuFaTgNQVPibj61phO0i9HYSjvPM+CcRhxrX1nwwZ4NWj9djFUC1c3py rjF9nM7wPqBxLYTKX0UjTF9jSKJRIyv4NMaq5taqRh3pay0zHvi7Xjv4mzkbtHpOPRZ7NHxo78Y3 Dseg7K8MadZSeFzFI6RmXEVf+O7L8377sMufH1fL0+0igYPyE3wLCUrrcBkOPHrtAmBf/d0nl7jD cSrs/Hr7FR7QAgSXxxOe+uT44kf15FLfUeHT+blA+2n1VgL57PVeoBNv+4nCNhr+CzyP2NW/fDo6 Deg1c5CSU6gWxtHpcPk6+Jt7BSbf5PwF3CxpFzKrVrcGyifSNyy4oaI5SctVHTWalmJfjKOO314c zzfGmklnjGJ38y43YL/igb4rbFiNB30xwggCIWlMazfeBbsqMb7miNXUqmNzArwegEr6FArBoAX5 mEq+9sj6fAL8JjaJL667mxQXRUnAU3XF1mIcnF13n5j+m1y6Nowsngl1tCzNY90jshxYj2vaeUvN LQBrK4a4+ISkmp2dgwAOXSmYJxkS10/qb7ECAtA3WYYGBMBpaCSm2+PGWKIh2ioEoKtLZjyPrJoP 3VJrpABaPT7iY9mcuIurK2NBfROGdernJFLT1l6Dplr8gAr42JpG67R70uMxZ6qRSk2jfXJaPb4x ls+ZaqRi59R7QnnO3OJpGm4S61ZE4sPGsjmNpRtUQad59Ja00xYsqsBfLEOtezwevZRoPl8N7890 XAs1avh48CMuafbDrmWYmdkNdJYb8Fe3OE85p0YTHTzwIO/31ab6PqRqPkGzy/u3VxYivNZvQqoH C5P2HqxjZd+KFT4J2g54dTHkJAeE5nsGNPAwsL7pIOat0z3Wp9i8Zj+iAL2hw3QDdYhA1YL2xfJx s/rzpcCjnD9QvUDB0Z7OEc5NB9zcv31E0bH/WzAxn5wxFjuIG9duk0N2bK7Pvx+6Kw905pUldMES ZtTdo28PDA2+h9FwoYDfg9+sx3r4PU0jvxn7tY8045Hh6e4FQ2PtyXa8x8fyOU3HEb4+oG8uzO8a GubUvCX9gEyU/LPuVtK0Og6ZUzB+k6R02G/2aR3zmxLQqZmN1YkFO3+Ndg+F3UF60f3uhPlYrKRl hahxoRjKFjLc7A/6HNvEgCJKe+u5eM53e6RJlufYHh77HsWZ/7QeHinrOJrG9EpV6by+8fIMjd2C gYYXqkrn+VhN687sJ4nB1D3cjMFjKuZ9zsokxHgt3K7rwiHWHwjYl8X6Ho9GKO+l9+bsFE+3FZuP Ee+WrairoNWyip96IdY9TxQ8ebaj06mOxUy0X5NQdbBAi1suPj1u1zo8IJcxjukVbgClQGgtNal2 HPC3dEOJrzfiRergE3XAnP1cSQcHJjkn17CxiH5CYuTP1YcJNGb2ULDAQ1Jll1FUxxJDQ15gaKop QNmlHivwQr2KYyrXsE/CEb/CmJ6wp6aTIELn4ZyTMLUmJQhpVY9dPdDDX3KgSSo50PMB0qpKJHIY PViT7HzUA1Dfw+v5GInPJ5OoYmPnMyQ2H9Kguv5p5rOkxnxQb2rUR1zX6yMMoUhsPoRn3Qdcbcyj 5KwmNebz5zoPNPNpkp0PdVY8I65Opp6PkWi+X/4Lxx+mKQplbmRzdHJlYW0KZW5kb2JqCjI1IDAg b2JqCjU0MjQKZW5kb2JqCjIzIDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMyAwIFIgL1Jl c291cmNlcyAyNiAwIFIgL0NvbnRlbnRzIDI0IDAgUiAvTWVkaWFCb3gKWzAgMCA2MTIgNzkyXSA+ PgplbmRvYmoKMjYgMCBvYmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2Ug PDwgL0NzMSA3IDAgUiA+PiAvRXh0R1N0YXRlIDw8IC9HczEKOSAwIFIgL0dzMiAxMCAwIFIgPj4g L0ZvbnQgPDwgL1RUMSA4IDAgUiA+PiA+PgplbmRvYmoKMjggMCBvYmoKPDwgL0xlbmd0aCAyOSAw IFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBtVLLCsIwELz3K8abgsbNwzZ7VTwK CgEP4qGE+EJBjQc/31orVfBUNXvIvphdZvaEGU7oj6KEj6DSoi9SJJR5xHfHCs2UYsBaZCkb+AOG DkaVHcWnMhbMbGEsJ+6AvnMSEm6FNjpwO4xdOagpqlF/QNU8+Ba1R4LIZHA++UCGvlfeyJiHGMM+ dhEuyPcC9Rtfj9tziJjkZ7+B7EKRknW58hbTfB2gl52kMadkCxFY42W55HdKaaKKU13p32quv31e VY364apmNxqJlVEKZW5kc3RyZWFtCmVuZG9iagoyOSAwIG9iagoyMDUKZW5kb2JqCjI3IDAgb2Jq Cjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMyAwIFIgL1Jlc291cmNlcyAzMCAwIFIgL0NvbnRlbnRz IDI4IDAgUiAvTWVkaWFCb3gKWzAgMCA2MTIgNzkyXSA+PgplbmRvYmoKMzAgMCBvYmoKPDwgL1By b2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0NzMSA3IDAgUiA+PiAvRm9udCA8 PCAvVFQxIDggMCBSCi9UVDMgMTggMCBSID4+ID4+CmVuZG9iagozMiAwIG9iago8PCAvTGVuZ3Ro IDMzIDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAHNXFmT2zYSftevwKNdZSkE L5H75o2TrKuysWMrtVtZ54Gj4Yy40RWS8mTy6/drkDgIcCRSR9UmVfG4M0ID3Y2vT+gP9jP7g33z bcXZsmKe+LdaguTN/LD5O/2QzILUi1mUBrN5nIZsuWF/X7CpN/O8cM4WSxb64pfxhz9PZ2maJixM 0sliw75ZLDjjbPHAXr3f1nm5zevXbPFf9t1CsB7CRy8eJmAZ+EHP4tOxq+rdTzSDyIvAIA6JAevu /l2ZPdSs+8+7nz6zX3fbnL0rHvPK/r+MvT08HkD2Pd97PTn30L6HU/upOLTc06SRKBt7aH1SrafQ t/R0jVWDNLp01V4FqW0HZHgd84JqBotjcsSCgwg2wH3mcljtnlhRs6JidZltq01R1/n9DGyVbr1Z wtPYm6d0gbwg9XlMPwlawgbdrMlLNyvFvriXzns29v2hrFd5udmV+RuGn1o5TOhyj7thnE7P55HD ZPJqMVi6x/CBB7BmDgFBvJaFqH0DGUZCkbZrHgZYPxFSstYfbh7OAQyI4CFJKOWOhNir+wYFtJx6 zGEy0hxeBFoe46CwrB5BwkDvsiq/1xsZbQYJLR6JS3AbKSaQoh/FPVLcbQfv+9g15imw3AeUu/f4 UOWV5iFMbTLobpIytKn5HnFILEuYkKu7wNQ6DEgLibiMlhZwyQ0e3/wAB/4IB34KfoIgmEVw5ZN4 Hs7iEK58w4KICxpTtHWXxsnlg9Z+VvxeS1uxh0kYR9bnN+Q+Ldq6S2s/3/ks0SZrhjWZH8zl59NZ nDT71PxbWmdPKQBX7FN+FmdUNFozSNWe1JoGf7Vmh9asOel8tuVDayqYggZ80sDpi/YivmvX5nmW a3sqSonpp6Om9lJoOyXE9XgMO3UWNmzoxM6PXTW1cz8KrJ1f2ym7HB525Sar2e6B/UWR2H1WZ1f3 x1qWhItegmDM3ch1ZEm46KVB2MOg2F6HRYozcA/Y654huxIH8vE8mPdwWGbb3bZYZmu2K+/zkmB4 MiIX0EGhgZMqaMGBLJwsto8W0g+LwoD0k35eMr5whYdIcLE6VG/aGLHY3uf7HP/ZCuvURjkYrX1P omDkk9WZaD2JJc1Ea0B53KKg/qyi9SMWRSQX5no+ksM2GG8zk32ZVzh4Vhe7LWuu6ButiBNY04Rf Rsw1JwRLEJMbjNqk8joGqxCMR3bed20EczlUh+WKZZVxEuXHSTfnpREvxo0RAUwYxgwbsS7LcpVt kceyDtAoF3dCaccchEJN9/BPq6LOq322ROayzPZFna2Lv4TZvGHZ9p4td5sNDKnS10cJ57IcS2M6 l8GuuztDJxccn8tg12WwK6/EgkDdjxPSqryK7Q3pDRUnYSixxUdY5Ats0VGbpJlRG2geRYygmZ8l Whu18VBGkkE4iyhq3ODGSj6Stu7SBK6tmfzsJMbvtTTCq+GB1YsWry8355bFCx8EH0Hhw6dPdlIw wFU4wVZM1yv2oAiOGk2nQDEbDIDuqgSAiNd7VjXs54hj6aadcxmx8wQlPKEnrqJ4SYNONA1KJBtZ s/ajk5grknAryOn9KEyBFrMgCQNy/hq7kFwN1KNzcqU8ZHJdcRoHv+BuqvX5retJDoPFCol6tc+X xQMCIuEpQfjwcfH+w09vf2T1jhWb/Ton+GN3z+xuV6/Y/nC3LjQWnji4U8cwgyZyqn4YMm7XYSqU kioC38H22vLRkKpSY2dxQ2vSXKU1Rmksc1KFRIqmkWhCtLCJcsyPtiSyRk1Ggt7Yt7FiS+usGM7S JsvVH1WkETB0zAkqS5sGdn537RjD5bDcbavDhvRqJkqzsZakNaySCIOXW5V2VJxEs6B1DEHrLCJJ g2MwaRyAA8eiFIJfIxIwqKPiJJiljfsyPt3SOisGopDQWbEhtSuejCsuhrDp3MEYfcWuEWdpE+N+ ZMPllcvjU5cF2iGfv/uW7cvd1+IecWS9KvOcVXW5g4et8uWhLOpn9njIUD2vc/xCma/zr/iZsK4G Gp5vjjwlNJvHzNyWa48X4KUh27nTMRkhWweTjTxHth6mcKaW+iDUerfcrf+mLebEYRxXGlEQESYk I2d5A5bHLqsFQ9Xom/roqR+rRFPmfyNEfwydlehdFhyJ/dMqpw4LihZsu6uNjs8JaTnaNjywyoro WFZgiguR/4nQoGbtpSrzJYJVkZtRQE+1ruEJtWMK6PDAC4asT6DnG5i2BMR/N7aEAPVMy9aubQku C9+1BK2ojP364afv/vkOqEaqoiw6Y1XxuM3vG3WJkEq1CocZjna4KqSaGvs6F+GMZWW/fhp6iWWE w0HBMXMD1LRVoHN2a525LIIeneECdXW1QvnlLs+hsTVmFKCwqtgucyrkPWUXeCWtM2Nf5+qstxyp hRt5PV4JgeW5Spx0xjqo6en5ScCm4GMpsbHxS7JbKqpHKF70LG5sn/rGVo5p1MfOaeAp20fmemPb j9C4vzFeuSz+TzLMKXZmifeaOWbP8obV2ClIiLp52/lUOaGiGTkh0doupUxBDJKZgoQR8ggry1S0 zoqBzGD0iop09SwzRm5/Y4tzWdwwzzSYuRDqaBmlSDvRDCXNSAvDEGkfOitGWihJVqIZhv4ssBJN ReusyGdJUxNVWgZjIslEU7SNr1ETm8aYQ7F0PDZ8O+FW5kFiceAzCoj/uauLr6JoRQzHtPB07BHL qubU4OLqdnSkpGB9ntx4Cm2aBE6gO8LjDkpIXBYLxC8bJX9qr4nsmRJvkSOyfItOzrKpHNK0Gn4f +TiGCIzE5WS547TYXxxlUB2VHvk0u71gnEEHVa5kenBfNSsCKhvSVTfGUyQNN1M5A6KJojhostFh 0AycnpwW0emmxDRJqBw4MQZlzw/aurO4KqcFC8v/ZnfFmooxGi2G1p8Q6r+od9VbbA9lTv8iUfqa l8XDszDH7ACj3NbFkjaBkiQypZoqzmenR5xmg3kaMZN1iyUXzAYb6Tqn4WCepoKDLc41zZ6IpBzp 32NW3q/zymgnnTAUJz/3PcrPMYNsnkZWPLTOpNfrucv9DZ8ARdS2IC4bbkzRdBMOtHA2b4qtrROb GCS6AspcBlZFuxliN7nQSUzq3zxKdlnA/F6a7H2L/nNTOO/UzVm12h3G2mqvo+Vz6tsGqMlhX5ZR re+Rk7Lsbp2jPqqVfsKWGkGb+beyJffoxv0/sewxV2Xob37zmDN1WChYwRiYcHUYAaMh7Usyd06z nZwjJTX4XRdOPBrD8n3BwdK86PIhRYIBNHApRtt2+7zM6l15QabNExpZDbvHcnHlJJ6cMJb2sutI T1sI93y7CT/cCLsgAmdnmrmK+rgX23VoPlpmvbc1oEIFTfdPe3igOPiWqkdbRMVfc/Z2j3AsW64w any2U1Mj/5JfJ0rQkCD9gEw4AsxQJE1GKqdhMb7b0ihXaWYyJkQTOY1usxmkc2De9WRaLRyPIW6b rIDDzcPxHh4f4PuzVt3UysLw21cKbtD1onFUVmcbXF36azPRVJaHvWz349dFZyw/30rUA6Fpu7cX rGTYpe01fOP++tyOJS8KV40brMJVDh6WpQhcL9BKLO4OQnQ0q7bN18hEF8hu6CEW1XAztj1s7qhP 88Ae8qw+YAwRPgGOAXOnl0hYhmPt1m4r4ciOBG4g4cgOtLJ1mWf3GDPJGd5H3IusshUyWSiBzZgs v9eMMBMMn4eKAnVp7UOK7jD0+TEvV9m+yVo3Ozyfe0Izef0sdqUh74QxuzhE7pbeUgjWlnUN90DD wiAc8+adjh4eiHnoIojHadlSXBOqzbfX4Murxef3P7D/fPr+Wz8Jo9++vKbLQyR6D4OQNkPj4/w7 YnTgm9Pf9I4EUU+3Y7B1HIsjNAqBh2UnuAdlXrPf82cxHwW42SDNyx5RXmmefgnw39XUt8X4d4Ex iAMm3f845OXzZd0/ZLYI3NC2n2LYnbZ1W+mmTjtkRFVroHSRSXejAWD1HtkWaluNUCvY53vx3PIx 3yL0XbcgQC5W1Q+yGr4Xc8JfMTcMZ3sdN4rnPrcWMSawraD/+iBPU95dEf/y8d3bxXeD74mDoup9 9JS7i18HRSOKsUPgZx8LAV48iH97w97++/tPAszwKp3+TkbwXtJQpol+03Z0CapRwoTZU7mbi+5d b0IUpvajleGCPHbVjJgtCp02wYj7fMznabR0eZAv+pQD/ODDSTsLejTd+qXPpl+CD/ryyvvyuvFN acDhm0QCj1EbDN2crz1dRuPN9i7SXm9IY0o5cQYoRkj5mCoNKSd2O0YX/f+s821F722o1i/GTmyg NHwSlHO+XHUZgUdiQzeVaxw4XZyryxU8LKg0oihyRP+CIebIMChekrNYTyBhIqx4LLbCOWm5jxVt r2lxlO2BPYAeVwI7FCZR9xqM5K11GQCkqoI9q18dgOLEDqXGeLthAOTykLP1eNrB6ud9jqd5CmoQ K4s0h/JvXBYAFLpmNbXICLbaCOSC+WgjYGs2dtMrglr9zaMJ8LCuyC/bdfF7LnIIQ7IimxAVzCVF ymxZPu/r3WOZ7VfPDAVMGqNESr69OOPAyziZ0jV7u62I53bCOsaEh6H73BkQbzKOanT5Ul903ZPj 7vLDL7oTChqOL8EkaTfOHL1uLwCaLOa3j2AShweVlkTUst+VNfsxe4bpfpZz7MrxVgc8YRTxyrra mc53rBfQSuPyOd8UX2VCJ7+paaf89oELeFg2AvnRMwFmFJnaEpDyagMb7IbcVNsG39DSZTi50pdy cNW3IRYW6lIlGJVGhkihQLZabDLEBmjf0QCGWb3cPagznvrKCPfiye+DmjpnHPPFI8ecqnHx0tgO jMbA3jEmOqh1eVC/C0+VEOGwfywWHz+TtMZUH7VF0KC7N8cdgrT0Ua7ayVOv0wULyyLyLTVw79lT focyaokTIQpBHPmUr9f0J8XhONyg70NzTAEPNJGd0hy/ebi2nzd86uGYljgNafk+lWwN+bUsRoWg 7u7lC8S+pa+0e9Xv7Nm9sqwzha8x2pXMtR2g77kvKkYkQcc0rO5hDw+qtyRhErb1FXSxRGme2lso fj4cqMFCYz0i7UTP5bKsUn6j1bTdien0htuDE2qZMzzqwhAL66qOsmYnodJPatyVL9i80R/j6r70 aGrx4yU4Ir+gQEreHNy6vinHdnfv6i4F3xNi8/jyiowZE6EJdT7OdyjqgT9kpZlcc2oV3U8n1Rjs IxzrNwxIu3Uf9TArHLu+Dlwev2wx/Vkf0JFCQ098U6GYWUW7BGWrSj4clVMv6ASYseHYaLo3pVA1 FZKAdf/pdepYOetAQ/e/epY27pCc1QjSWRDhe3NijOSFNByOsVRUvucmCROoDUl8X1v7GkF9EF/h 1pJoUkORY19MtJvrSZKxnv6mIPVBTeqshy20c+9qf5Kk14vm6rWEXM8gmeuFc695va/Pq0h6vTCI 5WSKXM8gddbzfEw0deQXSpJeL8AYivgeOXxbUit4g2SuF0Tz5pWG3p8iGevpyRm1nibRej//D7a/ PXYKZW5kc3RyZWFtCmVuZG9iagozMyAwIG9iago0MTI0CmVuZG9iagozMSAwIG9iago8PCAvVHlw ZSAvUGFnZSAvUGFyZW50IDMgMCBSIC9SZXNvdXJjZXMgMzQgMCBSIC9Db250ZW50cyAzMiAwIFIg L01lZGlhQm94ClswIDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjM0IDAgb2JqCjw8IC9Qcm9jU2V0IFsg L1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4gL0V4dEdTdGF0ZSA8PCAv R3MxCjkgMCBSIC9HczIgMTAgMCBSID4+IC9Gb250IDw8IC9UVDEgOCAwIFIgPj4gPj4KZW5kb2Jq CjM2IDAgb2JqCjw8IC9MZW5ndGggMzcgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVh bQp4AbWUMW/CMBCFd37F6wYSDY7jkHhtxVipSJY6lA6WOZpUwUBsqvbf16FAKGIBSjLEdqx3d9/z eYUxVhg8uhjGgW1eZ8ISi7j4nTeDPEokGyKVSZQNpYCZ40HhnkWMiQzKQPDN5vDhmYyklDlELjtq joFSMWKoGboAelAfGKlN1PNCdNoQSZpGLOZNBPyN4MkUtlytyUHXhEm3tFjW2vjS0KQHWhY0p1pX 0Ha62WEXHjV5XVoKCzNPNXxBvc55WbapcZaHsmRymFtnW/3ltZ/EK/it8Yay/uKdaq/ha23dLIAq HcxivqzIUwSogr5htAVZtw7sfaF9wxKmKsk2lA2Vn+SuYRt858Fz0SZ2KdsDx3bnNZHpMdBzHTul KrJbqDJ2rWrbvAedtW9eniZH3r+Qc1S5PshDV8Hw/TP6WpZ16LgnXZsCcR+c8Xj/dzd4fdbvBPF2 jf/b3jpI7h/952y4ZZps76u7y/3Pd6eqVd3fgq3q+Ad4UjrSCmVuZHN0cmVhbQplbmRvYmoKMzcg MCBvYmoKMzc2CmVuZG9iagozNSAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDMgMCBSIC9S ZXNvdXJjZXMgMzggMCBSIC9Db250ZW50cyAzNiAwIFIgL01lZGlhQm94ClswIDAgNjEyIDc5Ml0g Pj4KZW5kb2JqCjM4IDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNl IDw8IC9DczEgNyAwIFIgPj4gL0ZvbnQgPDwgL1RUMSA4IDAgUgovVFQzIDE4IDAgUiA+PiA+Pgpl bmRvYmoKNDAgMCBvYmoKPDwgL0xlbmd0aCA0MSAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4K c3RyZWFtCngBtVxLc9w2Er7Pr8DRqZLGBJ/D2sNW1layPthJbFVlK4kP1AxH4ppDTkiObO2v369B EgBBekRqyKQqsSERDTT6+XUDf7Pf2N/s9ZuSs23JLPFvucWQtbbd+u/0h83aCS2feaGzDvzQZdsD +9ctu7bWluUG7HbLXFv8Mv5nB+E6DMMNczfh6vbAXt/ecsbZ7Z69epdVcZHF1Q/s9r/s5laQHkNH Te5uQNKxnYHJr6fOqla/UgQ8ywMB3yUCrLv6t0W0r1jnn9EkVzXDFJ0QG+HcCQbosKmzqo1ox8At 7IRzcQzmRj58Yn/kWczeJvdxaWwJ+/vxdH/CsG3Z1g+rl56UbWGHdihOqqW/qsVg/AYbOVNsU8Ll 2oZwzTGrE3qXzqoOQ5MquWyHtKWjE+D3LOfteBBcbrM+heohZruoiti+yA+M/hZ/O8bbKt6xMi4e 4+KKRdkOP4gq8VPxu2WcVezuiQZeLgM8xKLsoLOol8qA4qsm5IqvlmUe3AS+9syZdnSSr5ZlnFzN PJaULMsrdsh3yT4BT3enIsnuWVVEWXlIyjLJszVj/86/xoLVYOgT2+X0zSWMJeUKfOaoVS3DWNtz FmYsKBiMvT9FYF4Vx0omG143TK1KJahRyfIiuU+yKE2f2PF0lyblQ7y7ejlzpeXSVrYQcy1/aebC aXftDal6LX7sWOSPyS6G9j+xQ1w95DvwNWcQ02QPGSWTIYwCJLyIox2D+4uLl/NVWgNbLWoZvnLP jDymWNkx1gAUDL7q+k42YZsfjmlcxdD9n/ICJjeiv8PUsiw6xI3lZWke7chalNFjvHs5a23LgT3Y eExb10Ks5XxhkeUcUULHRf6PYhUhjqdjnkEWyyoqKraNMjK8A9Yiz17OSu4TK3nItHU0rLwgwtR8 FvfJKSKmBgGDlbuk/FJv9AFmjTzEhEB5hYBcC5Ta8EvbRhOFzxNvSNeLWLl7XFN0rYmLB51763l7 BO7iONM2Ya03PPStIFzh4CwntLlP2YsY27DLkhmZb/iucVbbvChORwqioN3qnMZmUOc2vqEcZOPZ rLfzNshojApiiTIm21zmWXnFkgqG5xLJp6DC3mhkZ7UhPMC+bIe2ZfDyWMT7uIjuUnj8XGPm65+R lt4jLW1PmM7VPOEVTpjbztqjBNW3/HVgI0E9IH3hxljaHbNd/F7a/ZbGVil7YHuVC2MVNq1ijpyY B8bWy3h7KijQiZUMjSOkdN2DxbJcC9bfnF3j5bhJlSJqIbBU9WvHjIHn1vU+BWH3k6qM0/1asmg1 bjeKRWRzLd/aMJPA6tVkHqlZFWMCSutWGtQxeVbFed2Kt1jKNbd7menMCQ6RMCz57w9PIrcpE8Qu TzA0+A8c8NsPnz7dvLliXx+S7UMbRSLiiYsqSrLagQm5Tqqnl5sjGdPoC5vVIKnj40EPTZidu0iD u35SBi7lP3ViA8aOHNss7syHhbd8N2TX/R2/qY8PR7zPC6lp46zealB6JQRF1IzNIyZWNCY6TaWA nKIc7ojtGATGK+A5V8w5oWiOO0SBwlJKRAGbRDDhZXKfIe9EgF/E2+SYEICyzU/pJWE9UbfDoEO9 rwKj3CQFQvButUv0PMjBBq4ObtIPumNwiWoMH/iWcJPqWzVGbpIHtZtdeTCxvHG9ik4zhjnVmLuG CArX23zLPE+OYc6VlIc5Xe81VMhwvlO815iskEgYYvgYpQlcGJLsNGX5XuAWtaSwjx8/xVWJUO7H 3S6pABMRgnHFdnGWROnL7SYPKL+AxGqLmTeBCShOdGsKBkfzvdLqqT6abyjzQtg7cFIXpF5aIMM3 xBrP7/CmyYrib0lZxdl29Pp7kL5t0ewoG+icb2e/ZFpiN4D0gWnnMXLKD9q+CRdNUZFzhrRN5q77 JGAu8wLQE/J5EUw0sF+tHuwByIgIQkTWF+12dcZVxIcckMn6Aj3ZEF9JFtSm+7Z1nBAPuj/FVocv DaJeg4RheSTirERvydDCAzctdwN+9ndLMA3Zv+ZIESNGTIA6ym/CDN5SnSIm40iGsg4yX368KnzU WNM/39Z3crd1gzYnJaYM0g29xjW2Y6kcW3k2uFm7Ru1bOUaucaT3Oqc2mgz5Jiw2u2o6PRJllRxP KdxXE+eQKK1E4Va66AsUhByVFQQcIuP3oLA4je8j8ool++tVBkTvxVAY56DDETQSGUNJxvuVc6eE MivCUJdkv0chOsbfGAqujZX76wcRLJJG1GGAkvAB7ZyKY3UxQAm4DyxrHs/BqYxNdagBCigeqjNr 1GzlBq2aWW4L1Cg1a8eUmjEPYwTKICrtfEtjDVATtFpqhXVzwoHxTRvotmPAefQxoeEp0z+loWbG kYrbCwkHM3fX2hhBUmPapEBP0CU64EFn4xIGZJOQg54h5KK+q87iGY3txTUU2FsuSXd/6v4RD4F1 3fy1ZbqLZhKXjhbnxRusTo7hvNSYvQ6p6USe18oN5dDlUN1quH3l2vVMPGR2i9snkcUJsMBCGAmq y92nJ0J4RYQEH/nHLx9u3r+lMGly9XhQbDhgwzUCb5ytZwJMaBGo66wJarH3BcAc+OWXixEPKbz3 AcH1d62J0TjpHNyMcpaeZeINsx9dn8ROuqwrcWx1W0UujrONcSVaQA5A/OhrAgh/i1i2QGB7dxFe RraY8gRtaf2A5xn+jrNpnrt4Kg0ShhmrzSaVPk4FMfWQF6inaihMDJQyf4KzvXnjsK/QI5YfJ6uJ Bi619YprbS0zZ9KkEg4sa5+h+UnASqP1rTk4bfkhgUcoIQ1MPl7fevKgpdOavgGj6oKb8+tbj0R5 KrfxsUqashFEAoYSWWEEoAUGtAFVKJeginvJ7uLqK1UO6RfN2GucVijm2tRdZ28QunpqXQspm++a 9bIpzD13gDIpBwnj/LIcqRh07XcoGuqLbTomY5ZnGNYLIkgYucU9dt2nNV4azwXh5F6Al0KZ+hTQ j3EskkNUJIC36xwT1ha1RnKk8HMwwFl5OsQFmon2KiJ/ZpM9lVMIkLaEpaQiNFOm+aUiNNMlmGDo WIkuDDgt6FQZoYH0CholGJxX+TZPqfnlLIsv4W/r4ny1tIX4Gzhm2D47f0HC0DrYKuHPVKXzufpL T9EUDtOffrKiaQZPViIDtBkZtn60kzqnv8qbbBwTy5rC+nM0pMHrk7glQyfCboEEixbOPE9L0RtL ZoJku4FB2sY5UZtuK50XdRy23kRb10JyDdTTSEenMHeUNwEJQ0LKEwrF8CK/HOPs159/ZX9+/OmN i1/7LLj76fX7d+9vxKAXePwz3M5UGzGYD3DSBRvtZNf9Tb/L2D7aVmS7pnZeaBEQx8QCQ+5vebKu DW5BKUVoLx5i9UlQ5ldkyXaNSxuImVDGahtsS0bnSGFUVKGBBWqS5tl9Se2kIhDLkd+QKZt6kJrF kSGWtq6FlCIMFg+xQMJQCurErbPDfZISBx+jJK2boMgWQQskhC8cLPxqBM9aRVv0N7+cr1JmtRUt xFZu2YsHKUTDYKyUyjoJzHJWVgWkExaozLeJQJUp+CNBpTY+EdCINlxRlKDTeDl7Vd2hWdmiXUGW v3gizkHDYHAttcAyMvQcwicmCAUr9DdDZD9IpH5FF8tgHZ+9RaZUXuu26BBd0eWx8VB9z0lpuCzu XFHHCFAo2pfhCaFco0OZHhHdLSARWFOuM8A7ob0dw0koBgI/9IoUZXxFC6hLLFO5p3JSnexSqs35 0ncXroEAm+XoY44LNUj4r9gd8BEoMPKQLN5SJiJyuy1k8r52QehiOqA1B5wlPSelBgKAsG4W1a5X tqhqoxHdEM/ZAzXswoy00YJeFQmYCxcjk/2BylQX0h8nqoMRDrXbI2snhezvGAbllvqrklLoxcvu jCroYYDCP7RdTrv8qsyWQh4GCIyPA89ZFLpIxy3RCdY/s6aYXmNatc9rA20AYU10DS9IEdolF3hs 1Y5WL+I78t8U+4YqQd2Cpm03pTuH26LKR/1oTlMKaseoH02N8brEhzH1rRwT/WheXfpbOTxoC/na 7zZjne99WchvvmUOl2PL9aNx8HNxDQcNw3mnef6lZGnyBdkuwXpNJwaCUdGtKHptdgkKFhWwsrtY XFECWIZUIMcHBKVeYkHbRJc2j4V9R4IusCcqY0I/c68fXm+0nUpEc/ASRyAaBn/rq4rKrDxD5hxc IS+jUwu0SQe28ZdsK8+HnJwKfOuueRxzXiLHLXO6G6KObcCedxXzmTXDUn23EM2DtqYxsOZdjjxn yr2mHrylqogD02u2trVBbnszBJ2pouEAJsZt207bMdFc0JgdGmsbDvRvmzGtr2fkJYRBr6dJqWOZ hdf5/TxomFJ6Kh4TdNbt61oaAeHHqG64kaJ7yQY53UjkNvoREHCbG2xu7sG4SFojc4WGmd2SPbeB wpBHErSMjTYbHE2oL3EoV6858Oah2cdv4Jyec7pmhm6dQRLtyciADInVhI4ReqdDhSqadvaPZTzq 3IQq+rxgEjUdD5y2xqNWK581QDamowtdKzvY4Gjrdjypju0YeoLUWLD2qW0Pnr35Fi+RyDHy4m3f ib1xcItMTKl+tR3TP9/YdYuS7DthdjN02RUxxTbdDHi9KyijZfZc5KiTCM1EfoqlOSfAyh86PRrv gBzG8aFuJaHCEGB25Gbda0IIL2QsUrKvgIrj7DGhtxMQekQXXGpUJTleL23RiANdUotHdNSJ1a2/ 7KOC3UXbL4Sw8zAMEBkQwI5r9t5nqsYBpsnvypxuo+PJDzz9gYcqtjUKVmfHKjJ43vEb9kQ2APJ6 XcuyN1w+JUYHmsnepMBrOPdxhiuq1JAqauGjdfOc2lD1AEkdmc0+2Zs37BNdDqW+q5tvuJpA2kAl eSgU1GiLLJ1A4wtRdtXB2Sxh0QP03OXxYNAwDlA8zYALxio+RmvWl4j9+J+fPrJP735ubzJCVXDT ERh80aLD6A14yJK/TxelPBQPo2Z6zeuVLcvgzeJVa1TVzLI1hSh5CeMiHgyi+n++RTdFVmn4DWUg ze/Riy07PDJCiHx6yU2ntvqmL2kpvNN3zCh2ivM856GV8wQNQ3T/elWjOmgbNy9PXOFqTPkg6tQP cVJQCwuMRIV2jPo1J3Q60bdzIZ712hYVXn/TC4Gm5+squNL42pt4HpzfIfvN0fJ/zbF24+iQj4ty Ep2S0INYGpymRUaYcNQAs/rOLTsBzG5ej5qrdNqsa9Fjw3sLiwc9oGGwtzXqrUdMdgK5gh2qxI0V gfpnMYwScCt5C1OcCIEjl4Q8ZNAFYF2valnmBstjWIF4vUB/qFGrAjA0ooqyflNIAWIIae604FIN EB0eVIXJiwvaYNT1TF4vaVHObuzFa/4cNAyxFYG553ifUfM7iOIp7EQnEEGdqnmIr6SHoqi4iuxo qrwOok7yajAtzNBZVMh3p63wyZPuWiEf0IBRLd3q710DAp7JM84FzVpCu8HdsW4qNMUnnyOifEef xrsmbFRwyUigTLkm1aTHzflnepAEgFUvEhyds/TgHY3nod+Lg+aYF6/19HK7eeb1e0WWWeblVs8w T51X6aiuQbLR0kbCYIj37zCxcYoQD+1YUQo7LP+5+XYEsFKy91GBVjt+Ra+3cvnT9g9//oqGXeZ9 nmpNlOTKxxFxG10s7zs2ukX6nHDtePQwE6pxXv06hIugKdCHAOPVQyt6vqkB2uWHaoiw93bY84Eh Ntd0m/nkkJoP1yra9yvkh2qoM58d4JJbjTO287VDaj7t3lk7nzakz4c3is355JCaz8EdN/Gecio3 pg115rOsNZ4kFteSm/Xh7c96SM2nIZ7t+rQhmu+3/wOpHRhDCmVuZHN0cmVhbQplbmRvYmoKNDEg MCBvYmoKNDM2MQplbmRvYmoKMzkgMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCAzIDAgUiAv UmVzb3VyY2VzIDQyIDAgUiAvQ29udGVudHMgNDAgMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJd ID4+CmVuZG9iago0MiAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFj ZSA8PCAvQ3MxIDcgMCBSID4+IC9FeHRHU3RhdGUgPDwgL0dzMQo5IDAgUiAvR3MyIDEwIDAgUiA+ PiAvRm9udCA8PCAvVFQxIDggMCBSID4+ID4+CmVuZG9iago0NSAwIG9iago8PCAvTGVuZ3RoIDQ2 IDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAErVAhUKFTQdy42VEguVjAAw+Jk oJCBnpEJhA9iWOgZWxqYKZhaGuuZm1maKCTnKjiFKJgYgVUAKSNzSz1LS0sLBRMLS66QXAX9kBBj BUOFkDQFDUVNhZAsBdcQsEWkmWqBaaoh1FQFhKmBAA2fKXYKZW5kc3RyZWFtCmVuZG9iago0NiAw IG9iagoxMTMKZW5kb2JqCjQzIDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgNDQgMCBSIC9S ZXNvdXJjZXMgNDcgMCBSIC9Db250ZW50cyA0NSAwIFIgL01lZGlhQm94ClswIDAgNjEyIDc5Ml0g Pj4KZW5kb2JqCjQ3IDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNl IDw8IC9DczEgNyAwIFIgPj4gL0ZvbnQgPDwgL1RUMyAxOCAwIFIKL1RUMSA4IDAgUiA+PiA+Pgpl bmRvYmoKNDkgMCBvYmoKPDwgL0xlbmd0aCA1MCAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4K c3RyZWFtCngBxV1Lk9tGkr7jV9TRjhBpFF4kjh7Js6vDzI6t3tiI8fgAkehu7JJEGyDVbv/6+bJQ jwQKIsGX1nOYVqpRWZWV70fpd/Gz+F388L6VYtWKUP2vXQEUzqOk+zP9sJzHeZiJNI/niyxPxGor /vIgZuE8DJOFeFiJJFK/jP+LFvk8z/OlSJZ58LAVPzw8SCHFw6P47uNuXza7cv+9ePhf8dODQj0F j1s8WQJlHMUji8/OXdXtPnAI0jAFgiwhBKK/+w9N8bgX/f8+/P2T+Ge9K8WH6qlsh38rxI+HpwPA URiF3weXHjoKceooV4c2ewo6iopzD+1O6u4piQb3dItV4zy9dtXRC7Lbjonxeuwl544a4Xwp8yxc 5MTIYZxHMqOfFGwZTOZwR644JmbHej28AbF15NBOkxu2agp2kxEtOqBW7Ba9TCqDnlTGJDgyk/3t K6mcC/GhbKunnfivL2XzpSpfHeoT5wk6PeDOsyQqLcGqPSopNIypfvgPqJsnqBv/kgJ7SQKXBHWT kt7JFsk8S6B3tiLPB6BNDyRJOwHUfRjQhxr0LB7FcmE+zufZslvPotAg+zGw5uAdtZ7+EOtZEK1n bwYniuhEJ+il9aajl+PmMBwwAKPXtFWPi0uUxgNxgSY796IdCqbwY83DPoaH56oV63p12Ja7vUEW /Dx270446d7POnCf0RekwLNc+LupdvumXh9WZWu2ctoAaQYfPXcOkZIyXoygal/KVfVYlS0jMHH2 SYvqOENGOIhMRxYXzpJY/juLYH17LSPIrEwTwjRgwULsylfxS9nWh2ZV4odV3azF/o2diu7t66c6 Rj5JuiJK4TB4nPlSshuySoIIONTkZzPL4Ow5iBzB2vtnXyuVWK75TiZ6R8dOHUmcOg7lyKn39bl0 ddwSSTBjHI6xPTvAZL0bJUYrphHpc1K8cTiEbThMzrNOVZpvgyy1MNKVcmGUb7qYy0itaX5XZAa2 EQyWdUp/E7BvDUzQmkmWaoVuvt+KVBoLYWAbDuu+Dzb8296aVqYm6vSjt2184QhGrO+s3Fz7ehhW 9e5L+SYKsS3btngqxbrzUetHsX8uBf56T2oZfyzEn/Bh4Qc8AK5/q2qdmpmmXRw3yhwmIVpAtN2m LnVYR1WvNZsyHcYY59DVC2NYIGCsGjAMbm5VbFaHTbGHbij2ipT7alsSHYmK4uXweVOtin1V70BR R0Srx0hlXqbHgq/FXJLiIlBd+Lv9uC6LzeaNaYETt3mMn2UGPFG0HMPzeLn2kgsyBXE2sizbtxXM aw6wIM5MRhCRSKj7A+Ob8DQ4gcl350I6yNK/h+A7dpAjarjvBiVSavUWQad1KjOhH+ETB5mBQZVp mCBYSH4yYPxbDSOVGWdGjcfJPCVveRu43zUw/j1gygRA3fNvNcxzg4PJbvAJ0ZZy4I7cXLQlguhe BElREMT6tdo/C4T2n356b3kBN6Mjyuv8EKcll+SpLuEASe+k7xjaiU6Hx4s2FPOXZ7xoT3WhVjqm LZYUGOQxpM0j9L4WT4eiKWCCSqhQ6FGmKM878SgXwcuC95wtRmhb7N7Etl7DPe+UdEuam6S/M3yO 8ieEX5/c3adN0/jHZQQ/Ivz92DcKjfDLJTIPnb8UGh/KwOAvORj+kpQEwbpvg0xaGAkqvE+jUOJO UcCviwyeSMMg6A4WdUpiE7BvDUz5YFYtT/SXwKhftWPWrsMl70vmObJ/jCeNWfcQrIqd+AwmKPfl CqZdO0MvTb0q14fGcecJrvBcChYoS0lMCXnIkoFmQ0j6WDfG9TIOBjwIUezWniY6sYURxqQoZymB d0jVc7l9VNjsrclhRu7Wt+YhIIVd7Z5E0ZSirbbVpmhwc3+pob+b8vdDBfC62BcC+gaXq26zbaHh K1BWvJabzbkX68RdUvwfLeC02FNrH/fsTLRbNAr1VclhPpCpkBP377Eg82rtVc3icMgLN04H+RjW 5WNF5hVJhLJRnA2m3xb7b+cmk3smo0j4e/u4E20NL35VtBDGypQokKw6l9pc4BPCt1wQvoHEfzQY kIOyGnQaKsct1u33178Nu0gqh8g8HyHYtnhTIlW3bfV5AyN+RfbCxov+vbBzTLacMRIPKm2cLnX2 F1bOuK4WxtzZdBl36WDA9LcBgynLCV9Gr6kzwFjT4bFZYQZbzhfKGgeR+9bA7mc5ZwurjnTV7dZK 2MfwUjYkydpQQRFrpQzbpbMJ3KRB977A9dtsys38CvVL7nOULAXbzqU5BidRTj/K6M71q5lEguS+ Ts4ICsrwqDDXpHnIAwjOqMWOegALmMJwiToWYRxoOlQATCq1s8IHMsBwbWgbrXb+TcTtoiwXj/Td 4mk6cnSXNnsxsktyIJoSWZ3qS7mZnuDubC03sCYDMEL7EV1mI+8UOoKSosFWJLlRNRpG0byD6UoY i9DT1MJIVWk/fGLyYpRSTgxQMQWTBqyIf4468VwRZhyNJz4DiiHL7AsyKeT7Ogd1qpU85v1nsMdh mkFpdOfizQnPxZcSfuEj+Y2UFz28wHMsWzgnP6JgZIv31wbMIMlXwx9JNJGLdGx7q0PTYFu9TF4Y EFHOrZcNSiAZ6VEUmsbuQZex1uwWTBbEySf91NXVJ2zFC05sGWjkStjtnxD7Y5cuKQ8RpdkYVZ/L pqx27HiCaHodRa0PP0LRd5RpcOhOnEqLDzNPpno0sjQj1hFPqX9ZSdLlE4I0Xs6XXY4BjS/a0zEw qBoOi7scg/lW0LcaBvUTLIz2Qg1p2dXskZXWSxrYhjKwDhZ3VXv+KYFQpSGFFsc6a5Gaz+F7mdYA C4PvxmF6SfNtQL+nYbSm1SbTsxas46lfcmbaMrt3mWcWeSiMJW9hwDRrTQ5bHGtlEJIwC0k1cgyq weXsgHbUqFDtIEQXh8Iw0PjGPyTPAE0oKh8HbUfxu/JWTLGqLFbPgsotKj/TperP8V7ceW22jp/3 Ugdy9LyOLWI5rKxfZUSZu2GNKFAMnEndg9AlOdGFAV9rV+8pB/KlWpNxFeUjcqAV2bptuXoudlW7 VWmob2TsrAPv713ZXsrr7J+ZsiRH8Ou9Bsd8DXfZHS7uz/BeA6M4k8REkDIDTpV7TU3uNDUwqit3 milIZdo1RkJXum8tjLllp/IJxywZ4yh0cvVjByUmz4UrXonfJ9HLSYTtrZzF3urPjifOtVm2o5Iv e1NBS8mrS0K4MNj4QLEgznAcZJX+pDMEo1JN7lKYRpTT8ahU7VYO2Qkcx+7ZaUofR1NSM1WxYYjO vOcl6eF8kYydgDm6RhZOOrzWaodJl/HYwrgbuTAwMvjGigOmZGoj+KcadIlxPkZLJzMJjFtfZs7R wsdwWC3so9BRhO0OoGw0bNfHvajad+K5fi1h7t6J8g/0YnSJtLZml3CS+Ce47Gi0YYr5M3/bXUnO ReW6JHdNTIkOJZ2w6dBxHfx42B+s83K6K8/zi10CEWsPNACT/8ksbcLyIMmXczi/1P9k9bqFMV1P MFWjY2E5g4GpVaimQouLPM5+0MaYOvXSVGfk8T2bOeZaJGk6kJt29QwthNxNLdrDy0vdgJt3K6OZ evmlYvNUNyinb1vxr+/K+dNcHFoY9svNiS27zNi+bmpOHHHTcJjMOkdjTCIuUAyI+7ey+T/Kpzdl 2f7rexQkVF2yWK3qLcrW1HZ0TdZUd5XOGN5Liec8B0axZJjLYeJ3WlexEAsMz5iRYcjvnt9OPRRK XUNJIx9CbV9KO0Jv2x4C10RnEt6Owe+rwk3yxt/za33Y8PzZCeofs29ISZHqFrMRLBVqqNZOTMPh GMelZvyVGeNM9duOnoHcnghJIB/TZxM2n7Y8GgM7QQ7nM6KMor8uO8ERy9NPb9tWriSBRdGWx6RK LAxWxsEWpvPWfBtQakZ345I7ZfMiCVww3XlrfhcLaRjWNG1kCbp+1bjFJmDfGtgda1dZ4nUonGHN jl2/ddF8FNX2ZVNuz2Xi0eDAxTo+GnjtUB0ofu0K1JlbTNogz9HWj/tX1B5UOgNdUOQUouue/Qb0 v9MlJ+TriF/E9nOpvh89sVPMWT6MvW5uLIFiYCyVEn5T6aKuqkXNHtVevBateEIpp2ugacpHFJ2U u0Jk1/3O4vW5Wl0R2Lo8L9vXnYi7iD239gzBmOSJAMWAuI9FtWkFt3Ng07+iT0m3SaoCnspo9zh2 V5brFjTeNxh9vJx34anA6GAKc8Z2di/yLu/uRS/QFdyPPovd6hnEhBM9qJ9/KTYVHL2ugZzRe1df owoowRuREWc70eS8TX7XlVeBYRCENTVSj45fJitbcC5Vy5y9ZVzhEZTZ2xOK8pilcBptGQ9zqudo tGM4rDXyUXDdTz02JE2d5kI1FJXJBlNl9GfNJKTMkLuFWaEuVpK4K6IDp9HYvu4kcnDHBjxyDnEn aTSgGIjch24Chqs0zMGQn1xskHehFsGulQU0p5RMs6PZiSsoaicbZmwzl1KUSYGZK5rl0b0bBSlT 2Fdc32bOetZDrOpQbCb6hIB7npCVOKw64LvEaaOpgUaf/frVQDtp3T+AGbX+bzgi76nJ0GE9cRYv 5nDp4R6Jrp6yjjEwp8IGN2VtQW7KmkAqiLCD0gEDUbxhpqzjTIcMWE/nfi3IfozOvMiMaJspawa6 JB3sXb5T6TKMPC918kX0b/1rCQpJ08f/LwLDMWsdcwuJoWW/lcjwI+j2xbmE1/kL+Q//RMPY5Mvy pIZmzMJFjBY1/4KY5zA5Urcsjfko3Tph3iaIDYhJDUC6SUJ/GNBvub4JJzVxbvomHAoNYlKD39Lt DFZqHOjWUiNlNuAARrET6mui1Mjs7s4WTjHEQe2Q1jcVv6oHav7+8f1vCMTRoqiGOmk0aFvjEZdX lM3RfrWu2n1TfT5QNI8ZsWsCHEreYSxjpjfGKyJX0Jd7y9ZPkJG8u79FOAaaTwXlqMESEc3rP++6 5MdafKZBLHR4IJ26EzIMUR0pqTN4T3147R7xEaykbbybxmbOR3KFAr2v+5I39fywWwfo6Egepr5/ Jb34SaWS2t+G08h7en3jFcUX1FugQn9cr/FjrTzad2KLMbhraEusi3Gimd7UXWmLWb6h9rk5bYFj wLp184SWmD9VHN7StPxj9YQiJbFy1Yj6tZfI62phKrlErG5VyuUkdi0rNMuIvd2XxOndK11obh2W ujY1+r4QX8G+l0Vb7/QUXE2dPwjHUFPcHNCq9NJUX4oVXjI4l5qjGUtJrdYYmgTvYkcDxkKM3WDe DzN/AhU3vJsw2d+AmetnKpj+8U8+Xb0fSyMwvzbGkE7f6TwnnD6GxEZO0sehO/F+/eWv7xHfZr9R q/8KxhEpCvLVrO6+aw3MTFXiPj0ivBMw1KrvjcSy3m3e3rFd6a6GUy1ZXjwhU6olYahZoRyw0PSr PeYZSduWPXKqV+SFkAJa11BGVdehPplPPb+YKxqPfuwwnmNMhauxdyyihQ72oiw0r3bFJia0MLTr chg90oV239637OEuG5hPbJ44xtBMapLk7v260sfRsxCifWnKAgnzz+VbDfVT7WFLmsLYakjUy6Z+ Uw9ofa4Pu3VBCUDGxOe6Rbgy3BtypzO9s7valSS/e+erBI6B6iMCO4E4qnymPwU4akzQgzIPoyVF lf5RVeoWg3F8LxNVzjH+demfkaP3Upv6YQN0jqDCiQYz2DPz2IFyzHVX9RVOtssY6718hZs85fG1 8RFJDxbQk38Rpgqo/o2BKLnQ3bgGhoEoBrO1bvathfFIOJioPDy9PB5RpYmXSrq5WwocA97+jEfY qPfqKH/3ewqmqYhR/iZfKSQNNsMLccPjqp6vgtq5elNJk9CNN9fCidCtqYRucHKKFd2pT2DxzJx9 rU+dZLA0p+YNJBSxLOa4JJpCRo6BdgM0zOHlE/Na6QXDGoi6gAAvUw0QqCw5O8xkscMAlxY7evmj m0NEQ24fRg+LcJh+Vaj3LXtpSOpG+CCKMv3SEB4gsWtqGNbkMP2qkPlW0LfupaFLmyhdVoAZ/3Tp 1dQns5enIkZ71ZBvGkaV36h2wjHfMhWMAw3c3btVT/gRTCo4Qqj4j26ApUGnzCfoQuMRqWnRH3dv eMDhiqYDSdUbiVd+Zxr9tfbMpHARDc5z8nFdbcWAIFYmcUwg1W7sEr0MxGsrEZroqeGY1jPutgbR ehaEH7pxPets0zOOHYjbRjU1PP3prlGBypY2wL+0xDlqhJjM4kWFAf+dE+Yek1oX5gLHwDx8gqVD ThKe+WQFcdSBg3XoRkgwLT/EBQfuTZRFY4fQLzAP9uEtGkJnCIbm4YQN9cjF/CBmqf07WRdvkE7y wtcYb9jUKKpbx5NeTG8gt3gi4k/qbDhjHNaz6SyW6Z1zWAk9cc5jd8V57/4va+Cd02GK17gLYEC4 863WeOgLcT2CaLZC4EgdhRV+a422t6at9pRW+089X+JyHidIoa+cibd5ex6spPb2FYU4bd1T4r2M hsX5nngfjeQmTG0fu2gn/9jEQP7BpChVUDMOqpDqnQC4bxidfFGPgBKfdyHWH6A63ZIjt81bXEEf lrD06YORgOlOcV+g+20L0vaHSZ8AzY5KXYbFnBK0F/K1XNC0Y3N2szUx/6zTtW//oINKvUuA+AfF ACXDYtxnO/5OM2zUIQGra0Y/1VybbrbuwXSPRO9bDSPDq010gFyiS5LpONfCKEnGYP3H7YF5aTon sOKNo9vlYhjuaR5ntz8xVMJt9FPjLGsCNANhG6G/ZTOXNehHuGaOUCZRV1JH0sAkEiwMSQMHk12N 3Y4gBhRxqOcKujcHrOBelDPoixazITmCwnun6X0caua7Re2PCiuq61mNFZn6yvaw2VfIEFE2uVk7 5XWu8LrnyGS3B24rbtRjah8kIxQDVxC1Y+hfPeAOjwNW0THricN4vgX8buRJ8bzfTB+GvxXDeHTa uqcMX54NA8We4bsCibNrPo5n5JNR7lK+GerBFDq5yjvch4+owiM3TSatoOcViUdQjNsWzTW1Y/Pu PwirTn0HLrEvvhCKAZec8VCd5w1J8+8FqL0PFj6bw53Zk3aKaGTD05nN26/TPHgR1svETxaOo+tm Xl/JTdaVoddQce66TuhGszN49Gjo6P0PMuTlBrFLuUdHMCTA/vfTHy94jKQVfysavEAi39E/6STt 35offv0HvbOf/Xa5DnXVOL09Lh2ME4xrQj1fKdLl2TKdJ91DFQn1uXEQJrs6EP/ncOyH/X8hx4LR lbnU42dmPQNi67l/4sF+6EDk5lgwtqCa3TBIbdYzILaee67YfuhAfL00T1Q+hQaz9XoW5NZjjzia 9Riotx5qlYPzpgbE1nNPHdn1HKi3XrQwDyzb/RmQWy/Jo+4U9HhRd5EMxNdL4OsN9mdBbD03+GfX cyC+Xpwh06QffNL0syC3HmvsNesxUG+9JDW9w+a8sQGx9VzLo13Pgfh6eIRouD8LcuupNHiXzDLr MVBvPfd0lNkf/UMj2uPTIGSqZXdr7j4YqLdemHcPvjj+wz8VZd+A6UgasOSd2R8D8fVklgzPa0Hu vMxJtev1/daf/w3HWoZ2CmVuZHN0cmVhbQplbmRvYmoKNTAgMCBvYmoKNTY1MQplbmRvYmoKNDgg MCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCA0NCAwIFIgL1Jlc291cmNlcyA1MSAwIFIgL0Nv bnRlbnRzIDQ5IDAgUiAvTWVkaWFCb3gKWzAgMCA2MTIgNzkyXSA+PgplbmRvYmoKNTEgMCBvYmoK PDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0NzMSA3IDAgUiA+PiAv RXh0R1N0YXRlIDw8IC9HczEKOSAwIFIgL0dzMiAxMCAwIFIgPj4gL0ZvbnQgPDwgL1RUMSA4IDAg UiA+PiA+PgplbmRvYmoKNTMgMCBvYmoKPDwgL0xlbmd0aCA1NCAwIFIgL0ZpbHRlciAvRmxhdGVE ZWNvZGUgPj4Kc3RyZWFtCngBK1QIVChU0HcuNlRILlYwAMPiZKCQgZ6RCYQPYljoGVsamCmYWhrr mZtZmigk5yo4hSiYGIFVACkjc0s9S0tLCwUTC0uukFwF/ZAQYwVDhZA0BQ1FTYWQLAXXELBFpJlq gWmqIdRUBYSpgQANnyl2CmVuZHN0cmVhbQplbmRvYmoKNTQgMCBvYmoKMTEzCmVuZG9iago1MiAw IG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDQ0IDAgUiAvUmVzb3VyY2VzIDU1IDAgUiAvQ29u dGVudHMgNTMgMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9iago1NSAwIG9iago8 PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9G b250IDw8IC9UVDMgMTggMCBSCi9UVDEgOCAwIFIgPj4gPj4KZW5kb2JqCjU3IDAgb2JqCjw8IC9M ZW5ndGggNTggMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4Ab1c25LbxhF951dM 6cmuWtIY3EjmbbNSHFfJkqxdVRKn/ACR4BIxCdAEKXn99TkNYGYaMzAJ3hxX7FVrMY3p6+meHvwm fhK/ie8eSilmpfCqf8oZSN7ID+s/0w+TUTD1YhFNg9E4noZithZ/fxJDb+R54Vg8zUToV7+M//jj 6Wg6nU5EOJkOntbiu6cnKaR4Wohvfsh36TZPd9+Kp/+JN08V6z58zOLhBCwDP+hYfHjqqubtB4ZB 5EVgEIfEQLTf/vU2WewE/19vjoMD8ppG0Uh603EHRyGuwkF62JSUlUbsPb17FD8XeSpeZ89p2d4d 7fR+/7wH2fd879vBuUrzPWjNn1ZKU/wHtUX032BjckZTxs5C37Kza6waTKNLV+00MP3aATlOyz0g 76voO4BFedIXLocynRX5PNm+iD9I6fOs3G2zz/tdVuSifCl36fpO7Ip58iKynchKsSnKMvu8SkEU y+RLer4NSDJzf9x6qXNtwMi1K+wEnmcr7gS5OpGNxQYtV8+zNLfer3bZBnJapV/SVXknNGGTbHdZ CkqSzxl1W+yKWbEqRZZ/KVZf0jl+OF+42sGwd/VmtxGuHwU3Fi44qC00WWO3tCy1WDTmm+ySkRBP S1jqrFhD/r9nO5huvtsW8/0sLUWefhWbU+XaaV7afl0JrBKw6u24bhxT0dFduX84OGS2OuL4yOC3 jTguh0WxFZttgRiyLimKJNusTCulpSoGVYkHv7NLZzv8DrQNDabPW9JlsThVeyZByCmlnXGM7KX3 fRuvkJGNdE4J5Yd0p0IOOFiqm8P4IaxkJxar4ivJbVvsn5ei3M/wryqWl6MLhOdDeDIOBON8rvCM SrQpSintOHKqBxk3ZSFaMwCCa5u6HBkG3mgip7E3nhLK9YKpL2P6qaJNBr3hr9lXEBASxnoW28E3 geHaD1OzRZs0Xq05YDA6NGueB9gHLcAeEKaWsbRfXnwzCuCpH9NyU+RlKj4Uq2z2UsFFE+4Gp+5K epCV9H2XmzDW+t33qEeeUY8cUpSAolCPRFSYxF48GvsoTNZiOq1IA01aKVL1W36I3wKJPdiQlmIh JuNmPSnrQgfr1b85iBWJPQySP6nW4w82JFpP6wc78mlHR8TVFArGCLRBSwctGivot6hxmC7YNAw0 dGjy7ikx7FCBo2KYy+E1qo9O8yLs+SoR63S3LOZIAiL9fbNNgUXzZ0EP4efKJo3FHBGBk3V1cmBv dW58OyLY8dgOdVfGo8OxbRub2lWzHOl3nVTwPsvLbJ6KcpPOsmS1emHe1k92nbuUPlWvSE54B2uX qDRQXexnO4Bb0hlVHOVoNHol/vvxw8+/sHB8hL/rEx7VEqjP3Y33R0yHLFY73RD7s/LI1b3CZXEv 8v36c7olwydcm+SoIAhFfSENQnhikaZz1BRflxmS/SzJxecUv5mX+zWE/fnlGm7BXutGfiHHTt1+ bccAC0t9ebKGE6TbLxAvlWSLbJt+hT+QeFEz7EpkPCO+o/nniOki7Az+rE9mXMd9y8csn6HoXqZI u8m2RsrQ9/2///ERodG833H21KZj2YQ6Qf5EiiHj6apXpd/Aq3OpiMjL6/SKvlidIjVtRZ2rOudG UTiK6wTLntU0yoinJcLOoGPcE5DN0u/V3dNlUSx2aX4n0DYReYH/pyj/StQ1iKn7Ev5HJc9um+Tl OkPGKvK2RV2hwwpYXqFVMcTLWVH3X8sMbQiKEVW87Y0RGkvtMhVXAizKKlPp8JSBhtSE1MZRYzZh MJqQiaxF0EA1ESnaqk0LqNW8Uo8O6Nca0jnYql1ntTEwM6lYF4u3wkG+w4JCuFGVliVJ0C5PSJb9 3L7Td0IqKvxJANuJY8t2Zul2l6APdWJ3vuHTFiiZqBfFk4qP5aMEPjQPjZCPbOpQvh5T0z4GHnAl i8RYZs853PJrtlsSEHl884AmJ/WUqIIG0CQn/m2fbrN0fn5klRPCJFHceoc/j6xaxV0VKKlYyqYS iQJ/FMEPBmshxxYNvtGieXUt0nq2oXGHGfSMwW2H+ZNTnmEgb90SJBaWCc2Rtme71UvdV/1a7Ffz So+k7v3n/+HvqNlUa1t8SVYZlE2h+AIFj0nBoeAv4+r3iBE3EmVRVh2WDYP4xh2RYehNLCn+NT2R NuMBHQReoStCq1rx61Z9kfYGqpPMUYis/pCi0wzb+gPRpT5Eo4jyCHCZzS45KvGpQxLB1JjGXFM7 kHlNM4v3SEJ0MkJkXkQSlXgViRoiDawLp/5oWudd1SNhJAojqtURTicjIL9qvaabokiswUIkz2v1 SBiJh6UKGg6O90gOOBGymzHxytJYpunnm51Z08CDyLt50QIWZhP1ufnD/bt3otik22SHSpCS10Hb E/99+Pn14y+qQESOS84PfEAggCGTSAzZi7nmeB3phjaePQXPO/mKNYZ1EyoK7ZJhm+KYM9sVOBVF wb0rNgacHNmU05kYUyt1gqPXocum/3zCIagzIagziTo5VIePYl6sAeLEH7SLwQlDFp2GLyVVfshX tCEr3NIJ8gLVBpXMn1BSl8zXjuGbnm3j7neKqYiVZJCVLnlrfJsCyWFgIZlRUQZl9tZlbTzMYpjd OybDdqrCcKCjZVzXuwiz4bQpesKGhrjYosk60LaebWgUGRucdomwWOTCiMnTmgvrIt9iXQXjW1O7 CUihSg0WULsFoCzL5xkaWftkVZeoFYTrraZDviHpReSYDKPaKx89qk7KaIQBrbI0F8+oz3enxsRu a9TAH0wtDwEuqA3RbO/EcochRXVM3LE5Zo79IlbnTnxJfgXJdXCgJpTZBNk8JepjXi6CQAGDECiA qpO1iLymigkb2mDFaeNRXKMF9qymkVOoRkIYBaonpX51oGloJGjWka96UuZRTWJudqysPmR6xs3i 0D55hA+0qnvhDbxLq3jKAr6HPh7YWUaXNPM68+JrviqSuVHbEdtABKRmpTE5k2vcTVnW8CeHdd0t oDCUqgVEJlcd4GkaSlpOs1pA9Gs3bwHFUwyn3XQya+iyqAeyUEAYfWn3uqwPZBQaETwJJ2hSgL9l Nkyhx+2kPfzJkialZi/yEUPcHVJftGkxUaPUnCGbU9LfaKfnjZ3qIceGM090ACj38zkdHiatoRNk IzgneuxVA8EI/ogAHNinh4M6ds3kqqCC1qtp/rQdRYYqRAJ6U/MHYROH1I2nKNqqTVPNn+bZQYjf 62j+KFBxLNq1wXS7uWei3TiwewqngIpDEVWDCpeFOgmjIocsCcizau4lZblHXqfBryrdE/iomnzL pO7yUeo/Nekb75ETuI8P52FvdKM6aDxxhk+vfTQGFlaQWxfzbIEmKJ1XmPasO4HRttUjvtI2o3YP 0fSI3f2+K06eEjeghgUk3Rp290sHbBifYnvteTZzyGzJRjDMjeaNy/Dn9+/e/PgaB7XUrUSnMpnP gRARhCpDNgng7EFr04RmzF0TPRCH2p0jHOw3McermzioaXAa1KahpmE0BC46J0QWN89qGu/2XLcJ PQlu3oQGC8thUMmkmxT/ytGJrnoHCDiVGqsDZjqJV8fKNGDNjp4vmszTBQd7I1fJ/fzSRDcT02HC N8EGhsMUAKENsP6iTnSL8dU60VjVEtjNOtGtDdSd6Ajx+vs0R29wJT7st+hloTtIUyOYtIXVPSzT 2a8XJL0AiE7GAHSMtWttvUOK6pIE8WQ0aZrHTUBRJGoeM1JYl4P8wYZE4UQ1o4NxMJoi8lBzu6k5 FYnWYyRqgYPEH2xIPDxdoRlNWUBb+U2a0dLzHRjPk3e/GNCZNzX8Ih5mG5XJ6emUFpieJavZflUP m80LYDA6V60DpIAd0vweAmX19xeYo5rpHjbvxWE+S+Wn7pxVvSZMSZwpW459Crp1oA+DJUy8OLfW VlKJt57Zu6MrOBoqVIMlQAoz1dAc0LW984slqrFlAJTSsUcKHam5qzIrNjR+htZ4XTwZvHTkBdwy SQFoYmptur/uDqEvpjuJme62XE/R3SEmRncuD5xKpxld51lsizXuVy0W6RZWL8piv0VdcieoBq4F +lzFbJqOBEzQv3kV16jf66augRmkm7sGXT9oqxCVH/X1ceRwvhWaFgXEZDM42Qy7AJREJ9V68ZPX NUG5OzT5US8Ida3Okb7gQBOxB9DOkZDQhEQjNONL7rKR0XHfrnk75LabFvqaQ7UFSz9/Wc1r5q86 BPkRp1cYbFkjYpTibZI/75Pn1EjhiHAPxSxKm1IGgHHE1tr8U7pdZ3mxKp5fGmbILieK3KiUzbW6 OmV+cCpkHGDiexTXZwgKH2qSgYxE8tuQkZEI4vkYI6SeM19QT6uyFVu0Zkn1rGivOVBoEghU30Np MKcmGRhKpObSCX+QSDgMoXfUI1z6aeoAuiu2aM2S6tkBY+NA2x53URxnZdkVVYEd/nvbadtJ0RJi uIizwCF3O/pfP4EHDo8nlPC/pi/oCG/nuIPy46fHp1d39X/Fu/fVzx/f/PTph49vXhP98Z/3b9/q H+rfOD+FmyNnHGXS7m+awjF+a+vw6sUDeFhKhMjef3rbCI9+MmJ9eP/jj2/evYZkTxVhZ7aU6grj ULpbhe6gTvHxjWFKar7/D5SJg+rexuyAXF9fTiGu1uZZ+LsgmDMnCcPbo1yXx6v3H55+eP/u/u0r nOaji4oBo3kxw+UTIF2qHVCooL1Jt3i3KPsI4qIBP0/LGT42gD/gmb8/fDhVxybD6OvuQ1m/203d BDNyN3cT8LAsRYa4JvWPB1/K6S/VTxM5Dn/BjR+6ekCTFEWOnmP9R5xzvIhks0mTLckWt1nOl62c ojL0ceUUsq1e6qayjcLb9y/Aw5LtLNlku4Q+0wCzLJc4JxdLlGmsptAndNfCz/ojL0MMdjp77h1t DqXkaGLPw/aPNj1TchzYZ0bXT8kuD0rJiCT4fsCHbfYFE5CYNjvVwDsTBDXSvWnVBQFXy8nTO4Gr qXRRbH53qiAZoMFnd4C8EaWHKDZt6X3qrfhD2F4i5WBeuJNDjjPR6vqD3sOFjSP6ABOOu2tmlsgo LD3S/dJFNqv7gFTQXGWPDBm5YkTJNO+vIjdj04wjAG2nANm6qmBRU0S4QlxNSqPlHKlDMUUTmGni NJqTBo0/2pAImWPl+nI4hZvzxh8YJognDnS8BNex/oOp1sHDVr7K+7317QQzM54i3fWZIo5Ap0PB jDV/ajHxGUEHsCwyujjEbkT1nMQ0UEXqWX7aUisPDb65YEtMKazedqVGGALzyDG/bt23snccRdLH 0SRALWKZtRnBN6Mc5WgW1e6AKrip7DHcVR8vS0XDKB+nUSGOIpk/2tTm59S4zh6ZH+F7Ei2FtfZ4 xAYPxWvOwrm576MTRQmvmRVACqo6x8hFM1Skp6Y9Zojqsxu4+VsxvQjXmXXZZia+PYp4gYGzFMpZ jG0sd30AMnF4VB+YwqfTqu8oqDLmVFV0IxA9LQJzt2FhfdGj2xBwOpTPVvtqpi3bsVG6fnZp9GdG 1+gNbm3vU3yE8NY9HZcHhppW1ecSABTodja+iFHXUPxMsvmLxv2eXjYp3RvcVw/QlOCp+jYiZuVq /W4XuV6nHTEXmcY2kj3FRQ7lTpP9wcNSo7JS+jyBiOmzQTyIVdTZClgUZqtnZppf+vj6/ukex4uX CFjdUMIXnOjNbilgTF3fvB9APCwBwwLpqzd1MsApI5IBDhLxTZcSRwU4m13gb3Abhwz9b3QFEd94 uROPsyUOE+7EP5Nyeb54zadymve6rXhjZ/roEvTK8oi2X3wPzj6fu189F/jg3BLfv6Qqpv4aKmsI nBpWqYsiPSrKOpj1T4sH4AnOGO1znCuti5unVow2kF5Bu2A6CiL67hZdU8c5A112wuDjmJFQ7mgS vs7VHE7oBw2JcJsiRzFAYz0WpB5WJLYeBswxx15VVPpBQ2qt59UnLez9oobE1mMXXNV6jMTXC8fe iKaP2HqKxNfz0Vhov19oSK31ZP1BZb5eQ+Lreb4tv9CQ+HoB7pMTkmbrKRJbjyatmhkqtV9Gaq3n Yb/Weg2JredP6koYJLUeI/H1fHzNIGjbiyKx9Qj7N6BercdItN5P/weNEfj0CmVuZHN0cmVhbQpl bmRvYmoKNTggMCBvYmoKNDU2MQplbmRvYmoKNTYgMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVu dCA0NCAwIFIgL1Jlc291cmNlcyA1OSAwIFIgL0NvbnRlbnRzIDU3IDAgUiAvTWVkaWFCb3gKWzAg MCA2MTIgNzkyXSA+PgplbmRvYmoKNTkgMCBvYmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IF0g L0NvbG9yU3BhY2UgPDwgL0NzMSA3IDAgUiA+PiAvRXh0R1N0YXRlIDw8IC9HczEKOSAwIFIgL0dz MiAxMCAwIFIgPj4gL0ZvbnQgPDwgL1RUMSA4IDAgUiA+PiA+PgplbmRvYmoKNjEgMCBvYmoKPDwg L0xlbmd0aCA2MiAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBnVHLCsIwELz3 K8abQo151WavikdBIeBBPJQQX7SgxoOfb62VKvZgzR6yu1lmZidnLHHGaBoEXACvIriyxZnUz/qR GKaIj5GQYumYNFyBiYWW1UR5yZQYERloQ5EtMLJWQMBu0ccA9oiZrYh+QR1yxrlOYV3URlD2PglW PgSfhxj+iixnaM7sdjpcfMA8u7g9RAzJpWie62y9yHYe6WYQddP5Jo6bcjFS0I246M/t31BfnipK ak9V7Wmvq6cNqvlGbfmp5R2M73ICCmVuZHN0cmVhbQplbmRvYmoKNjIgMCBvYmoKMjAzCmVuZG9i ago2MCAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDQ0IDAgUiAvUmVzb3VyY2VzIDYzIDAg UiAvQ29udGVudHMgNjEgMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9iago2MyAw IG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBS ID4+IC9Gb250IDw8IC9UVDEgOCAwIFIKL1RUMyAxOCAwIFIgPj4gPj4KZW5kb2JqCjY1IDAgb2Jq Cjw8IC9MZW5ndGggNjYgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4AbVdTZPb xhG981dM5ZK4oqUw+EZuimUnPlhOpE25EscHiotdIiHBFT8sK+Ufn+4BiG6iRxTABqUqS4KXb968 menp6R6iP5i/mw/m5dd7a5Z7E7jf+yU8CuZh3Pwb/5LPoyJITVJE8ywtYrPcmD/fm7tgHgRxZu6X Jg7dD8MfYVbMi6LITZwXs/uNeXl/b40194/mD9/Vh3JXl4evzP1/zDf3rukh7RB4nEOTURh5wO/G ohL7GTWQBAk0kMbYgDln/3q3eDyY81+v37wz/9rWpXldPZX7/v815tXx6QiPwyAMvppd2+kwgF6H hev0idOsUdSM7TT1lMYpDnvjNAVqVCRaVO8AdbQjnHhn0wuGZrAcswszOEpgDtjQyBZemf/hYH// 6p9mua0Pi6o2m+P6UD2vS/OvH9588/1r8/bt3hy2Zn98ft7uDmaxftruqsNqYxZP1bo6fNJMgwim QZ5wXtdOA5LWt3KjIOiP3QhphXFgy6uTNgh6g/fT20nGLsb1GwbWQB96LXz7NZiu9GezqB/Mbrte b38pd/u5MT+uSv8wLnaled6V+7I+vDDlYrnSjB3MqRBMCqN1m7ELk+jGYwct9JTdoI3bP5fL6vGT WZhjXX04lubdclVuSif3Xxf7lXnVLYXDERYMKP/dwVT760W1OdrF1DBCN9I0SG+tKWyu58ZsVy63 m01ZP5QP5rBagCVpbE9VL9fHh9Js6/Un+A+zOy9A+HW5B/OzKt3PXq9sGLSmJiRet5HWJn0nYYwV H2JqoIWetM/H9+tqvyp3MPsMmHDU63m3XaJ220dz2C3qfXWotnVVP6EtX5ixSnrNq03BNoU2MbLP dfnxtFwGW8Hzvs/OfLDTypB93+4MLsbBrbT7JHMbgtaSSexpdt9ug7cWfJybbvCyhc5GzZlCs3E+ Kg5zkISZkfCjJxLT/eRWg2/aqnKjFZn1bF04t2Cr32xrJsmg4wGR77xq2wefyGsHcxXA1m9s3ydc PJe/dq4ZmNTdw35wN8TctwEMrbW5bGb01Cdtuvl+F/U9ltGoXrtDDWR9dcbY2iEe851o4X4FNpYU D+a5LdIgK3BNBVER2hSnknuWG93BszsbAoveFG58k2q5QKtujgfwxP9Xjp4IXnUtbpU2DI3s+8N2 eYQd/OQaVeUD7SMjT9o0XSx20xYJttfrJdN57PmduegWF6stCk+H2BFnvQUxwTUBxwS3Txrhl3/Z 29kThBJOI43j6xvpEPaRxAUVsnCe5xBU2Jgojc6fzdbnz+IAfm4NHh/7bPtsZR6NDbvPZ/MidJin n50lWfvs7PPZPI4d5tln22eI2Y0U9Cw00LMPg/YD72ShpWjDBMz4jAVH3MkSzRXfesba2ZMdvAP8 m8wO1oMsPG1EbXhncmtiRRNjdiFhvmNUJ4SldCeBh+9Dl+xgDPMyCPPI18LZTgRBAjxd1tuDedzu 3lcPD2X9wrw/HkZ7CN55ZrGrNs8cj948WC1+wYbNplw4B9c5wHAMGxqTE7KGuCuGufV1mhmGL5ik S7LSpIOdQj/pyJiewhF3EvfdWEG8AxFhvNKmoI1swZ2X2z2pbWyGwdgh3qa3sRQbS2Ow3NBYb9S1 HlyOayeHGKQHe/jaOT+zQNyY7Ts5rp0iin1S9dfO9/94d2/e/HBv3pfmeJq6OvG605mng7DPwSod PCHaXtI0sxn0DaLoHujhC+SSdmyBpP1AwuRWORRNQCCtemxn8mn3GjwaJBObv7yJGaYORutEsCRO ZEVsbOyg0sJjU5e1AEv9tmfWu0g08fq4w0jFQ5OCWC7Wy+PaebovwM7X5HMOMy0knLXoCeKKZG22 h07FmmcRZ2txn4py10LPYvXXPO6Xg0fr0m5iU2gUzTHvVuvCHHalc2upoc6PvcGJxaJVDRNwSEDg XvfX1X8xdvqJmIwdvi6I50FnSqLDjm5tHGet7x0UTZJvY+Li5Gefnq27Z7MEnkFIG/3xs8+2z9B3 7lzmy5vapdGitRUHuX5t0ezu9n6J+8Ng0S8xp71ftgBnpuH7yaVG6NArG1nwk/cXZs+lNhLcmeM4 NXeyDQioVPVix6ZpMMMT0+CjPA0IbpJBloGvxJqZNMaVoYOUQ2YPW+itN8jbgY90vyohgwGWpjGm eMA9uRdfzla3GlKPyA1nPWotzXADemloLJ44bHGuWdsCBF4w1YXH87dvMdSNp41d+bxeLKFftC2c DEBn6T53Yu9OyDFcA3An5I2xeeGsxqx7tu6egakI5wVeF4Bnp5M5e4YWImsNTFzkc0i5QxBgxn60 fXb28RzuHDhI/tH2kTivYyTiCzNf+FVsf2LGJ+mfp9/DRBlsJ4RLyIyDQGbGeSx3r1OSBDc/qcsm 3DRbbdcPkGZ5+9Z5hbOrrnxkePLI4ODB2rjWKtDSpJFN4v5ZaXL9i5vHXRPRxD+aXGD56/O6WlYH SBbuD8612eLe87Haly/M75qA3u/glsLHxac9GIdHSIm7lBfEochCDJuFTNwuIsB4XTtm5HF7F2Ya xz1LPubAIxY/W0CdgwBN9BwPTM5CJgFs6257fFptIW5zwED3KeKrmO6QXgCXGDdb1uy12rEhOaWP 7tKi72pOPd8zcOjPD0HhPITN9RQ+fv3q/pX5sYJd9tvtbrM4XQe74sTIgu+8zelOjFneN/tTi5VH /dsUY+bvJd+gm7+yCXBzzkfjI44GxDhgNNBTKOvlFi8egAf5iDdlPu7/dL01oPMWIzLljIZrIH0T MHZjJiPDDADtEQVkc89nNAyS9xdr+Po0Ad5rCYoMDt5NwzxNgHcp+7/h0qX4HZmIcRl0/iJrAfkl CFhB9L0lwC9xDl8AlyYn0xb6KbUdy50GkO0S5GShmOeNBKAiXPEzsUlMajKTmwKOLQOeKRZCjoHy GKIdjM61C8HbYQooQAu9NeG6N1hW4bCyKSGgh0+JS/stTQkbhBOE0Wg6d5bQA/zHwZKI4x1NLw/u 6PMd0e3uMN55cBV8Wf5LCqzhiwf3JuslcTV80QziZW+fDgq+3W0UH66Cb4InFbyF4sPV8EV9Xfxl 2vmQoL5xDq6mB1fBt7sA5cNV6Itx2yBJwX5OzBf1TSG66MPV8EV9XT5uWr4ZbCNBCvFrD6yCbnfQ 9sAqZgOF9Ty4GrqorgvmeXAVfHGTDnIMyntwFXwpg+rB1fDF2evyph5cDV/U1zmhHlwF3wKTSgFc g51Y3wKsAySsJrdm6ApbEGJyvqAv5L/8uAp9u0uKE+tLZ+1p5wOMGQgM1/gn54sCT+48UFLUI4Ni uVEq1IOrmQ4W5QXncmp5uzjVxHxDtA+TWwdIKsBsSOBIPTVdlBe+YuDD1UyHEGdvOv30jVDe1G91 NHwj1BeTdxPri2c3uD/jxVXxRX0z/7hplhse3uAYPjlfutEnz1gqvqgvJhA946bRt7um7MHV8O1u J3twNXzx8AY3Jrw6qPiCvmEw/XrDw1sI35DxjZuG7+lLSj5cjb7dpRvPuKn4or54t86Dq+KL+ob+ M6GGLx7ewmj67RhPb2Hk96JUfFHf6eXFqxgh5NV8w6ah24VYJ54O3U0tD66KL8r7mUOLZvq2X42d Wl48vIXwDTQfroYuHt7C6SM7FLT2DJuKL07fzL/ahkfDhyVILMZ6zpMXkHoaG7b25gtYYFy08Zs3 v3V6+A6u/C7Wp3/5/vxNkSgpSF7HiyfAhvdcJBtYaoglG6yd4NvdFL0nTSXw8Ckn8i8s2SBxh1sg gcuSDRJXwZclGySuhi8YzDbZIHE1fGHKtckGiavgy5INElfBlyUbJK6GL+rbJBskroYv6tskGySu gi9LNkhcBV+WbJC4Gr6ob5NskLgavqhvk2yQuAq+lGyQsAq6lGyQsBq2qK67Qwxfvu+bdQ1dVLdJ NkhcBV+WbJC4Cr4s2SBxNXxR3ybZIHE1fFHfJtkgcRV8WbJB4ir4smSDxNXwBX3bZIPE1fAFfdtk g8RV8GXJBomr4MuSDRJXxRcFdskGiaviiwJj9EjCauh238Dy4Grodt+78uCq+KK8LtkgdVDxRXnx UuzEfLtkw7R0KdkgcTXy4rsMmmSDxNXIS8kGiavhS8kGiavhS8kGiavii/q6ZIPEVfHF6euSDRJX w5eSDRJXw5eSDRJXxRf1dckGiavii/riO1EmNg+UbJiWLyUbJK5GX/ymXpNskLgafSnZIHE1fCnZ IHE1fCnZIHFVfFFfFw2XuCq+MH+bZIPE1fClZIPE1fClZIPEVfFFfTG6LGFVdFFel2yQuBq6lGyQ uBq+lGyQuCq+KK9LNkhcFV/Ud3rnjJIN09KlZIPE1cjbfWli4ulL0XDJVxEN937TBVq4+feRPG24 ZEP7wlhMJvzWe2Nsm4wYm1LwJj0s8x5T8UIQXyoDn43Nt1BCgCWhpLi/aXBx2bkklMQdzdcrFcuS hFa8nVAjCmVJJPBwU3TpKxkSd/jaFrgsSyJxFXxZlkTiaviCpW+zJBJXwxemXJslkbgKvixLInEV fFmWROJq+KK+TZZE4mr4or5NlkTiKviyLInEVfBlWRKJq+GL+jZZEomr4Yv6NlkSiavgS1kSCaug S1kSCathi+o2WRKJq6GL6jZZEomr4MuyJBJXwZdlSSSuhi/q22RJJK6GL+rbZEkkroIvy5JIXAVf liWRuBq+oG+bJZG4Gr6gb5slkbgKvixLInEVfFmWROKq+KLA7kQncVV8UWDMkkhYDV3KkkhcDV3K kkjc0Xy9Dralb2fIJv74ubNI+3yaG1ZNuze9YRUm4lXVI84O4hoXO7iyY0TSf0XD5QtsnynYxCSf SF7H66byQpal913/MefVYfJCG707iC+ZVNf89eXYwzw/UYMdaU6+Da/bypuI+liTz94Ivm96fsXT I+/YUIHX4jCfRzY6ahw14wf7i3u9iG048PF7Obib4i6jpUgZ4PbXxFhcko8ZHBYRieAd+edjNmbZ iRADmTIJrNjE2L1RiTt6E6M1yCIiElfBl0VEJK6GL/rkzUsqJK6GL/rkzUsqJK6CL4uISFwFXxYR kbgavqhvExGRuBq+qG8TEZG4Cr4sIiJxFXxZRETiaviivk1EROJq+KK+TURE4ir4UkREwiroUkRE wmrYorpNRETiauiiuk1EROIq+LKIiMRV8OXegdjeNHxR3yYiMi1f1LeJiEhcBV8WEZG4Cn1ZRETi aviCvm1EROJq+IK+bURE4ir4soiIxFXwZRERiaviiwK7iIjEVfFFgTEiImE1dCkiInE1dCkiInFV fFFed29U4qr4orzu3qjE1fDt7o1KWA1dujcqcVV0UV73kgqJq+KL8rqXVEhcDV+6NypxNXwp8y9x VXxRX3dvVOKq+KK+7t6oxNXwpXujElfDl+6NSlwVX9TX3RuVuCq+qK+7NypxNXzp3qjE1fCle6MS V8UX9G3ujUpcFV/Qt3lJhcTV8KV7oxJXw5fujUpcFV/U111slLgqvqive0mFxNXwpXujElfDl+6N SlwVX9QX741KWBVdlNfdG5W4Grp0b1TiavjSvVGJq+KL8rp7oxJXxRf1xXujElZDl+6NSlwNXbo3 KnFVfFFefNm2RwcVX5TX3Q+UfEffD6TILwuBY7yvFwIfHGUf+PILqCvTawKLCWBFanyJffsaim+r cs2K646tV0HvW7dNczwfMVwpkY9gSiXxrasu2CTvl124Ih9BSQ/2sgxKTcg22Cg84ihg+YCFicLr s0PshZtNc3w0hq8zkddkHcI8URvWgCZ6iaL31cEc6331VEMFhKo+lE9QwgaqpNbl4eN29182HzwV k/Cl/5NUs7b0hiQPxU8HXgyvK1E8aOLPvGNsyWrKQYZiJ+UOltx3p1odVxTDCvGqA6Zr73wzlcyG KEf1ucJ7cdTWjoIbDLBNY+0oE6f9Z1CcrnvWFrGDotL0WSpsJ4pHuWLPgyoneBVlqz+N+tnz6Zem bANWIsnazdXPyTlo7hhvT1nODlj0llP54QgvCjpsORdXVPvLJeIubREpzKY2HyJ7DiWOzL55Q1F9 3LyH9fu4226aSuWz+/+YEYWovB1mXyGQHcZC3r/fm3c/vIKCSlgnyPz7Dz+9/fZriE0mP9OAfEFv kR+mco4QcRHTiXAHrx/4lkpT8DEM4qamGpRzo7XSPoPaa/QMqqtDUXVYP+yzzTMo8XbL9ZP3r0fc YP2INvbl8lBtaxPNI4jR/vsrLJBjPq6q5crNJFewvS26+hEq5TyVdbnDElvz6/e+rlKwTYnOtSVC vC5bFt663JnNsv5VrLPR6iyRr87g7MtW4dLGTp4KkOgZIvRU2rV5Zhto6Qxbkl6LwJwW2X2+bbq9 engvaQxZyoS1cO3c8HaCZU+kfLCbVPVyfcS6UFBBrkSXyPkFaNs3C6hW+/rN6KLprHv07TnWPSjI 06v+PNi8hVFbz9am8Tx3pSUNeAmNyeuerc+fxVBaEszb2WfxWWveoO5lUgQpmMRiXoAlBI+D/Wj7 jD4+w59zhTLXhn+0fXRDg5lDNKR3MBtxZ+3SvksrTLaxK/fP23pfmk253y+eyr3ZPprDp+eu2Nim XNRQqvrxuAZn8sfq0FbOO23WCrtJs6ehxc8MzPP4wgq/ZFqYO5dn4jA3Ql3RCLtextSFd2mfj2Dj ybyA0xVUcqwfxpotWmp0hwI60mtk+Pnq0iRhNT9kE4s1OEin8nPYizF1QT9jt/A8h1lUOTLtBr2C DbreQkG7/XZZueLorszliPrawiGz3TtWZR+HT7lLMrIpV9jbH+5lG8+L3aHCavJ4AMZZtyxxSS/c Pqpxcyg/3TSqWq40s7lgaf8gMnxM2hXqww0DK74yPHglXsRN1UUMvXxt0PeDRutAa45ZKpIaDvb9 zeZHsP/lev/ClAeoLQu2vvv1za/PUGpyb75f7MCNti9MiK+z7//66W+we5j85+s3hDDA4CfEDu9a ep+ZYSd3IirmUQI7e5JH87RxFmK4WpTxRxA2aB7NkgxCkE1h6+6D9Aj39e6xhYBE4yl0eKdHhMeK Yp8+yB5xvDC0cB2yiXW0/LpHhAcXoZtq2uuOCHvE8eDA0e9v94jhgQvVukEnfuhBMc/o7/8HHE65 vwplbmRzdHJlYW0KZW5kb2JqCjY2IDAgb2JqCjUzMDkKZW5kb2JqCjY0IDAgb2JqCjw8IC9UeXBl IC9QYWdlIC9QYXJlbnQgNDQgMCBSIC9SZXNvdXJjZXMgNjcgMCBSIC9Db250ZW50cyA2NSAwIFIg L01lZGlhQm94ClswIDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjY3IDAgb2JqCjw8IC9Qcm9jU2V0IFsg L1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4gL0V4dEdTdGF0ZSA8PCAv R3MxCjkgMCBSIC9HczIgMTAgMCBSID4+IC9Gb250IDw8IC9UVDEgOCAwIFIgPj4gPj4KZW5kb2Jq CjY5IDAgb2JqCjw8IC9MZW5ndGggNzAgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVh bQp4AStUCFQoVNB3LjZUSC5WMADD4mSgkIGekQmED2JY6BlbGpgpmFoa65mbWZooJOcqOIUomBiB VQApI3NLPUtLSwsFEwtLrpBcBf2QEGMFQ4WQNAUNRU2FkCwF1xCwRaSZaoFpqiHUVAWEqYEADZ8p dgplbmRzdHJlYW0KZW5kb2JqCjcwIDAgb2JqCjExMwplbmRvYmoKNjggMCBvYmoKPDwgL1R5cGUg L1BhZ2UgL1BhcmVudCA0NCAwIFIgL1Jlc291cmNlcyA3MSAwIFIgL0NvbnRlbnRzIDY5IDAgUiAv TWVkaWFCb3gKWzAgMCA2MTIgNzkyXSA+PgplbmRvYmoKNzEgMCBvYmoKPDwgL1Byb2NTZXQgWyAv UERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0NzMSA3IDAgUiA+PiAvRm9udCA8PCAvVFQzIDE4 IDAgUgovVFQxIDggMCBSID4+ID4+CmVuZG9iago3MyAwIG9iago8PCAvTGVuZ3RoIDc0IDAgUiAv RmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAHFXFmT28YRfsevmEe7SqQxuAjkTbHs2FXx qXW5ynEeKBK7RIrHmsRKln99vgbmaMxAIMAjsR6sbS2mMd1fn9ODP8RP4g/xxZcnKVYnETZ/TiuQ wnmUtD/TX/J5XISZSIt4vsiKRKx24u8PYhbOwzBZiIeVSKLml/G/aFHMi6LIRZIXwcNOfPHwIIUU D4/is2/3dXncl/Xn4uE/4quHhvUYPnbxJAfLOIp7Fp9NXdW+fWAZpGEKBllCDET37d8cl4+16P73 5vu34rfDvhRvqqfy5P6rEK9fnl5AjsIo/Dy4dNNRiF1HRbNp/U5BK1ExddN2p1ZPSeTo6RarxkV6 7aq9CjKvHRPwOvCK5vRHiIdNKd6uNuWuFF9X5XY9WkZBC2sro5zgViwS4TMbLyNvVbuFMHS2MHlV K6M+E4zS2GUgbsMiTmEnEtbucWilP1XmvfswxuhzabT7SNoV1Uks9yK/3L4K7EVCzXwzyr6ucCpM HwVgJGXcMHCM4l1Vi5f9qXral9gJ/ONTeRT1ZlmLal3u6wpbPOHncqo8LYYlcY8WGd+d8se3gYKB c4QI0bVIOMupL94LBIM2j8OurDeH9Um8+yg+bKrVRqyX9ZIgsTpst8saQl3u1+L5WJ4gTfrpBCk/ v9SiPjRivdgpyyKGWLMcvt3s+lKn3LtnI1aZunF0ili9UM2CnRYrODiK2yxPm2r/JB5f9qu6Ouzn U9Vo8bcgH5rDVfhcJoPDrmqlIxEJO2Fg8qrD4kcu4KzPQR3Oc1lk4aIIgIYwLiKZUerU0HJxXSal 1ZMljtN4DfgixtUVItzhEX8H3j8cqxoam6qn3r3LENiWUSS8vb+6jXAlZTQy9tf/pjyW1Z4xaTLS 4Do5yogcPDDuCfLtt9/9+M+vXokPVb0R75fbl1LIV+Q9SLyH/fbjVHEygOqkzZMh290X/0De/YS8 W6OIsNOiiPBkURRli3lKGXgWZvNFhAx8J+KwcGjbLi1K8HtboZ8N6FlF24hHgVy+XVLKNqnfmV8V mabZxxtalNOSAX+0JQla0ZQP2FdE+zpfRgRnywjppnlTvJ/KvXpRrs3LY3CqETOWx3X1FwKGSiTX 5WNFIfrxcBS//fD9V9+9sflGj/am+gASg8WOjFGFyGwhvFdj2DkjWy/rlDEZ9QK1mCvQ5VSU94pT kjzlIvXXRwBGlvPdL28fxLtSVLvnLVJzisZWhGc2o4IYk5BOauxm/OCrrSuOZIv0tEjnCRnFDuWd Qr+hbQ0tSItkXlCZC4OyzxoaQX0kwofwZ0LYLHbLgGO5OhzXJ6sXWFYQXhlOEkrZozwW4OcElG7R dCyfqlN9vML5yZAALHNi5UZPuymtnx776Xq/Rar0lxdwj43+pFQOMdW0rWC0vHWSW6EeDdLckC70 VKzhEfQ3PGYL17Ju7ap8DohVjy9HhKujWJen1bF6ByeFCPq2bPI2kc6vMLKItJgKxtU3sqmWa1GP sOzAcLx3G8pqGYdF5KKP525nXn3IdnXsmEmPhQoYTTZxElESEuCDi7pdJnXmbG5amebU7srTSBAH RxtRmojlsRTL7fawakopCn4/Hqv3+MFa8TgpMtedUuEUwg35shsPgCHlyBSeLgoXfRx+OZWMifE8 d8jeZUZvgd5pj2hRhXJrHS1MwL6bKUCOEGYOGx0Upva0CdTd5HwkIYk0MkAkRFDs0BD1GC2ZZ20a yZ41NBYJgzM48CyW5TvWYpHywmID1jOe4kKHeBiLBQsH6P/6+esvUaBm/7Z6MJnsmV15WVZK1W6S Z2LWboW3v68oojOy0zQCpP1lGZ61ng2uP1VPmIiaxPO8zYhkoiOqpiGiclrcZkQmouLXFOmKiGr9 AgNBljkaYls8oxAPAqzdYTnEqD27RT11jmOVBn2D5od4vX06oKTe7GwP+TInrmvdGWN6yzAaZ/LO 0krC3JHWFKMc8tTGKH0WD6jAHUXcqN0rER/mEsCbMa43jarIfFFqJXAC4OAoZ7jhaz3QGZwPSdW0 JvkGVcu37ShPZcOsVLc1etYeb6VDb2+tFAXL3XHnsaDOz+r48bk+PB2Xz2gpC+qFIgnS7uDlhAwb 3ePVYY8i6WXV9uLWzfnfNcl2ARcfoVk0Y9u+pZ9IQzfBG6+vcV41Tdw2csdP9AQl2ya5ssVnHAne wTG4gWbpq6l20N/4CJtkCtbuC6DtZ1o2E+t4a3dS12KMx6Xo6N9FRO0hpPy0C0eEb795HefJndqk lCXjrL1HeAyfoxObKFO9niQt5lnbK4gKldkYGrqanEaZcNMobZ8N6PcUjVIb3e1MMpX4UqNUs9E0 apQymmySJdMopUdb0v0apbMUR5jdrKZjf1dEFGteHotOs9QJ2P/bpimdFsuCkOS9JEPSFVKQpnL1 OdAp462bnBGlEejyd3bkG722DSTjbSGXJDmK+qZNlsYak5q2FZoWJMjuGxNBm9M+a2isuDvXyB8X z7PEPUrz+5zoct6uzwmGjidDhs+csX/qYgPSiGbr0K4JKiFKZjHzd/3rpkSDrvGpdNZECcWr5sTp hBOH9kDPDBQ1Ayz0W0mOM+66PM2FbeiNrVK98M1rb0l5ByyGXtSRFuXgVlwaZ4NxnMSGk4AGiEES Z/O89cGpVP12QwMQOS1ufbB+VtDvKRqAGOiCNUmkKVh1C9jQWAuYaN2CVWhSsL3UB7MW8Cdm3mZZ 4VZj5BOtEM+4H6UpG/dj6ifITEI93spMN+OWtYG/typexHev83wWts7Wxw6E9v6etkX+1P0ywEs6 B5EFJIqXcQBvm+YXTyjKDBqLIhx9+MtPVpjFga2KFvm92+Z57HZHbp5H+Cyc1IG1zy8e0TFjVzPG 7raFvjnnAgcHSyPb54PedHxVZJEiF9QSjlGOsF0LeCUM4E4GoPUY3IIWlLOjUvA3Te31JTu3HGen 7OVNFeyvzV5eh6IkUlElLrI5Jnabk91M9bMNDf1sRQuIFlJEAo0/q2g3T3kwQHrvlNxnwY8WhG1u GzuamDZY7ZByZEgngmDqwH18c9uLcTRJhyyEEOst26P0QYuh/EN3qOMcMFUlYKRBoWmo1ywtcY6L BcpdTaLsw0gMwBs52EK5gpWcdd9FtHAkx7Y4zlysUfaGcZpX7paB1NxOVHNbDao3eSVLS+gA7Oy8 v90PFNUORs98bixBHbcfu6wVkwwjmuvrnASx16U8/ezrWjn1akKGmdvomBLnvKSaKcPUy8TDUQYl 1UoJtqGN4bNjtXy31eeqAd3KGLNHKztJibyM6byxw7Rx/LeZY8YMMywVWWLDwoHxttw/YYruVP7x Uu5XTR1zWNVlTaO4+3pZ7S+YTrS7Ywednd0190rGW9BQycbAJzHF2TWhKcgYYmKR4fOg1vPhpabp 5Gaqs3Raz1S8Wid+ZfEK+HaPkqVpAEr/1W4v4ezuOSZ24fJgttcW1s1Q2vc/NINpp83hiPtJqMRx nQDzyi165+LbR+rsVKemRrcKmGqfEeWKUY66Q73YJ3ybzm10xRtLuG89tKY6PIZGQ2stLYjtyKZ9 VE12thXvyOA1BF9mI5F0U5t2LlL8/DOzeJJmLRrRivaMhGF4nAh73biZ6Z1JvIjjirRWpwYM625s kdiz/HhjGIoRku6yyYJGN3xRYk5SnzO9L4/V40cxeUiTbYYuuEQYVOrjxDbjIS8MmzFIGhJZqBZ6 rGiUQHNak3ybcTvMIYdtPu4gb1Sa0atwjryU+tzcfP7CFTyV36gwpByoglwbaFewawh2XcLKd800 L26NrMs1zvAoNhnXOg6WXL5U8uOGDeTrvRqT79R1mcfAug7Gs8vBzWKpvy57XxcPOKaZZ6rI0kND hgY8KFpAtCbvtnhgpOk1lpU0AwFGpJ0Q/ftno0Uy5OJo9joMmyTH50Eh+rH6EyfAtlc7FTi98GaD eODq6BrXGeEElttXahr9VXOpyemYNBgfX3orEVjZSsrpIwKxv+3fP58qWrauKel7FmZoO2MdQyqz Aw89LB6Ph93lb89sxRcLe3vPVhZ5c+DHB+wiReMDdhGcaGNTzFYsqWMrN/GdMWY9u76TIP3zm9cP r1tIY3aYKDaWb8rlujyOL+8HFaVv4gBkzYvw8TiWnDVYnmpXDHJ29NLfL1PaGch50ZuVkbbNSztx 7HVHd773hxrRZjTyFDO2CRu1fQ5sEx7yMhy6tF7a3BCKNM3eEAqIlrStMJ0vMhIhzz6+kPOivXRk gn6kadugQ2vuV1g2+ByAbO9cOJnAcHU7BCIeBHDce+86LfZ4lLvn+iMzCHSHrr6cYa46wzIKvy0x FUY2xrCuBA39hgmNpREPR3D6wkBsJpNPYnP40Ew6LberF7pM23gGnVJhFnwpmsTrckPl3rV5I57U 9WB8bOsPsxhhM7cM94tBjvZYXNPgfjs0NZdhjQBpeTvqSkagW38B7GxC688qgDkNhlyowXEaUzoM nmdiWrYdBlJ11zq0khNfySg3uHox4KYKD4oG1MHBja0T9SWW16ibUgx8yGIm23f7hLqv8MtcxIV7 JHMHEWMzXRG3FjH2+NDLwswHTiAib21mEWdE5K3L5JImd74xPZO4beWIpZ2uVlnFj+11/CXdLBdf H467ZX05qMx8NefqT8mcEZgXfpnAsthNyMcrYshSOYv8/jeVMo8HZVzq0witLnDBB7rQ3cc2K3xG V4z0hFN5XFt5nKqoXkfI7sbgrRxHiA83HD6c/jY15LHMKacT0OZSk7/6ZNXZdZm+cAXbeevJ61rB MOfNWdz/NqFceDwIEm2xiTpXfV3lWHa+n4EuivliybpcVbvlVn+55Kr5Z1IavqeBm0zNW10VG3qV lkfugNPNlZbjfnU3HkyJOUNZrw3rPo9Gae0Hj/5vSmvf6vZKK6Q7pHNzpRWZ20q6vdJ8HqS0vhYO OdrzFjfVDVuDkLYf077UVTqzXqw3z41CefckjHg4Rqc+pMRqtDPh38uXbK3Us/x4BHrrWgeP7wa5 ByiT1z0nfYlLsHd2Rzi7cHkQstUJt4/lqcDt3aLJ+Yi7E4iXnSPo1fI0vgfjactOfPdsc/yZ+pBf t5eVe1hUe3y26oQP+7zXm7hkMMCkQ10ON5wIY6jGFRJHIVOc6VC6bCJgRNdUurDelH+iS9nmImhQ VDXmpMWvmwoD089LDCNQ8kppJRr39K0f1eRkT02FJfen+vRHvdcn/Knu08XFPE7pSz40vqyaahim WXASDlNaEr5bEev+sH6QkZounVovRctD9f3Uw8KQ2HoxPuXZjlqb9SyJr5cscITXTk/p9QzJrsfG tPV6jNRZL7Tn2Gq/iSbZ9WJ8PVT1w/V6jMTXi+Ok3QlOJ9V6hmTXaxrO3f0yEq33038BnCij6gpl bmRzdHJlYW0KZW5kb2JqCjc0IDAgb2JqCjQwMTUKZW5kb2JqCjcyIDAgb2JqCjw8IC9UeXBlIC9Q YWdlIC9QYXJlbnQgNDQgMCBSIC9SZXNvdXJjZXMgNzUgMCBSIC9Db250ZW50cyA3MyAwIFIgL01l ZGlhQm94ClswIDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjc1IDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BE RiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4gL0V4dEdTdGF0ZSA8PCAvR3Mx CjkgMCBSIC9HczIgMTAgMCBSID4+IC9Gb250IDw8IC9UVDEgOCAwIFIgPj4gPj4KZW5kb2JqCjc4 IDAgb2JqCjw8IC9MZW5ndGggNzkgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4 AbWTS0/DMBCE7/kVw41KxV2vnYevoB6RqGSJA+IQRQZatRKtc+jPx0nzaChCaSnxwYljfbNez2yx wBazBy9ReFA9fBGWSLA+fFcvmVCGEsRGiTQxGsUG9xZ3JIh0CltAc705TJwaYYzJoDMT2Q1m1kpI 2DfcApjArjC3tep5ElEvoeJYkORKAUOF0u1LMVojOhyjB+ssnEix+oE8vvITat+RoDSs9xpUZeL/ oFb3Ory9y/vadUAR/ZX6u+k4Vt8Enp33bu2ncCXytQgebJ/5/nO5cx6P+a74gJyCiWX7s5tfnvJ3 B/M6ic5zbu8qpmArNgpHxUVNIkb3tIncEbXNGVPS5Ew1Obu5nJqdUrv09tTFFyJt4mMKZW5kc3Ry ZWFtCmVuZG9iago3OSAwIG9iagoyNzkKZW5kb2JqCjc2IDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9Q YXJlbnQgNzcgMCBSIC9SZXNvdXJjZXMgODAgMCBSIC9Db250ZW50cyA3OCAwIFIgL01lZGlhQm94 ClswIDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjgwIDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4 dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4gL0ZvbnQgPDwgL1RUMSA4IDAgUgovVFQz IDE4IDAgUiA+PiA+PgplbmRvYmoKODIgMCBvYmoKPDwgL0xlbmd0aCA4MyAwIFIgL0ZpbHRlciAv RmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBvVxbc9s2Fn7Xr8C+JTMWQ4D3fbMtueuZjZPG2ulMN/vA SrSlHUpURKlO+uv3O7wBJBiJFKVNZ9oUJnGAc/3Ohf7GfmXf2If7lLN5yszsn3SOJdMQdv7/9Bff sALTZU5gGZ4b2Gy+ZnczNjYN07Q9NpszW2QP4z/CC4wgCHxm+8FotmYfZjPOOJu9sHePm32020T7 92z2XzadZaS70JGb2z5IWsJq2Xzcd1d5+pEk4JgOCLg2EWD100924cue1f9Mnp7Z78kmYpPVa5Q2 f8rY7eH1gOX3o34XlkdTGMsDXF54bsvdhSnMvteXdxYmbRy0MZUN2LXSA1s09OASu1qBM3RXyWVF ASr1tUixa+orDNtg7PdPT9OPEzb9Hq63cdSZP6PcZCTXPVJlnwumE+rOH21XeXzTbBy/966SP4oW VgSEYzUJsMuQsBzYIBijU5gtI/aSxHHyttq8sigXAUuXyVvKwlIyX75IczMNnweu6QXkz0wrENyl v2VrPuvk6EZwdFJq3LJMg3u85XCXuTyn23PPaSGw2rDtLkqjzT7cr5INOLFbh/u/y9t289rKZQJc Rri+SmuUu2pDKnbPoKBuj6sILxPkz231wy+IPa+IPadEZQnPcBCFRq4jYDmIQmtmezxbY9VarK5x wzXxXMzKd/FctbZkLyPlfc/gotgzp4NnizXas1pzDdfO9lTezddGMcOeMojiZoJu1lcs0sRw2boL 6q5jWohu83HcaQY5hDcp+RMHL5xPq5sobVinUFitMU/WBvNdG37q8am0XWFy37S4g0UCDV/fDVBu wgo8cJhyhEK5u19R46LiCioxcc6bYspRQmdO1smManjKJm8ofIuBTMPhPkzvptbEvp+K6b14eLi1 726DYGK79xM3mLgTEXicTx1HcM90vLvpdAAzXTJlAEHlENdhpmv/P3gJgFc3LG96x2+9O9fmt7Z3 d+s9TCdiMnHuAu92agfBwy24+yDEvXs3cW1vMmVf3w/gJuRhCEsweYxzmSm9rVRHr8nBM/UQuL7N aYytJrKwAIvuw3h+iBGYEJj3y84Uj/kQD9HJ9CymEyzxdl8yklsU+bjpuC2bd/cOP0dfY68JHnvv 2upWKyGPuXAaKmwZHHK4XSxKZ/o5DufRMokX0e58XaWkg3PLYyrFC2rrmHuD0wPJqlZ9BdxrsOrS UW6sk3jMwNo23FVYjc1rJhKxvyhxXGSJ4w0LNz8AaFdpZkB5jnG+0AB1Aex8h6kHO1dokrttwW8s XA2k9MAQ9chX9zglhiASDQHuonmyW6QACOFmwebJn9GOHM+XL8+Pv6Rf37NwDydUcDjcRt9ZuEPm sNohF19EcbSPFsb53K0ScfVg53JXuiRp2xa3ru3C3SaWuLhJWBqJz7tVsmP7RBoCkpjkJZOUNIMF kpziuXT1uiGxvq32S4ZSy/P0/uZ8sVVljrFytHPFdsIobNNvSrB7AChsQmoG5ZwmJbHjln07x8BO pgYCDVMjJwWxrRNY0FZGlDLIlJZIBhYuFtGCBFyzvQGWJkwCSj7PLl6e61oic7SC0qX9GKB8eYmi IjpbrlIWbdID8npwDW5rEW1WYdxZqBoECah8YAaI1zq17iXSY7BMIgKdQvJy/sk5BS0uxPVODsAH 5giAPv3kWeyNNvMIMeWJHA2jf1uIJYqGn+98eFlqUUlfSZMdU0NUl9ZkkGho8nwXhQiriMU7MGwf /2Cr3LNnKAdaTs4cP1d8OdDq44vqU9Lz+Sudu3K0a/HXbjY2asHzZCHrAmWVsWM3MS054L7G1xrF YBt5waGFyFu0G1Dydmhn24b96cdXzt614HjMSTlUXbf9VlKbZF+EqibSuMkiF7LYaEdP9FXHVnZy l2IYBxbHpRugYJXVcQGBiqZC4Wr6ilEiBYHymWGZQApHOXyk5jqqlcc5L+qethPktdQ143ZzLa6v ZXVUrBXvjujdYo3qo+ghUhmX2a6dl1KxZUWmXJOvZ89xajrGI/XVfOnciitV9VvFJVG4gyBaLxLV zPwiVqyReEsO8YKFcZog7nw7rGDUh+2iLKtEbPZjG7G71Z59DLcpMpoIT0N/KHvM8hwKWh/66q2i P2UrcKzc/kpu1LVbSn2dVb8TmgWJhgizoI48Mb1hb8vVfEkGv2GrzZ9hvAKbMxQWVQkK4lWemDD8 /BANQLI8IC+Aet9YOdO5jFXkVTZZx26gFaEvwktpD57VTA0ubg86id9IPOtDvF+h2Vq6SYgvS+i3 hz/iVbqElNAaK3OOGxYZr8YNWxyykkC4GWINZRlFOdi5QjvhbTz/6ukHSDSsIYxfkx2S6zXbUVcV VZTOOnMs+PrQddN3gOR1khBPCLOTdCq4RJHnvBbtT2dRZKqis3edDWb0nEQphFjv0HDkFQa3YNv6 dT/+63km79otZkjz5oJ2BnTQN1Y52HFq55jIuKDky2m9Q7qN5qsXBBh22Ky+HSL2PF9Ga6T7KL39 I0yXFzEwqZu6gR2BK/VuvvBKbGEKIwBmGK2ZZTbWqB2srmHSh1rEtXeLNYIrws7fH6E0gipM1iJW ni3Wau8DH1ErGWvFu8w2qzVqO1cIt1+L+IQL8S2tbHjpvA8kGi7ktnIh+wNctDI30FfZPcoOPIxW jHUqirb33VYGMN9vNq56b3tCAoG4OmTUSTzuGdJr6WSu6VCr8bgxztFIZih5Wa+jDdUA5WlOiCuH caNWvsowol/6y/T+08eP06fJdNKZVuH/FPdKaJejwajvr9ygMtYTVznqXqsQoZPKyn6EXmazf5bl 8Fo+yDDlkyNVZZCwu080ixEZy/UNPx+bKf3XqFpT/Bet2fnYDMYx8lxNWSOfiGyuWIfDDbKxmZF8 tlzDntX7WLPzsZnau8Ua7VmxmXziqPPYTKvmSJsPvGaSkXO5s9JoxXibivECSjTW91a05oSyHEtf 5Om5Ka7ep2mhQcr4/OlW9eUEzk7OA0vLkpUebfvRu95ckvuqrHGb1ZTe+0rdae0bY9al2Xe8eMbT QgOdYxKA2mvJ60J5deoZrc4wLlJ/qqtG6HXmLZf5AbXXzZ5kNwSTwSnSNPC4ONtImeAewOLW5jE4 fHXMQjQaoCXnIerPM9L0HM3mtRQZSUc0GN9F66UWKVfkZWhpuaEisaysQIOcmcjnywTTnZ1dkx7P fEAoQUMtLXfuLrpjgUwxQME1ONUDbh4jUjX+uU5jjkQ1H6lIM7kVQqQ8hEksWgmzjddDbKMsCBQn u6ptCKcJsfq4n2MRRmGw00Ss5HtyRWRLYmpVIwCnn1fUIKuBk7wSE32fxwcCfi+7ZD2Ev1Qlo34v xpvoYFflr2VeveTCQaPhe4qCYjUMlGxyv567gmIcYpJ/TpKr8SJBWZKaFsCBWWdiP4TD5CLwbcu4 ONp1OexcvROJeflmK3JPTfVtsurrSFsduYJkdEqItUXlcbtL5lGaDqkQ06wD5z5JJrvSIMm0QiYr uDpkou5evWliGQKe49OWWl1hjL7wMxrBWbijD6dIRqOzPgWT4wJcIaoXj7oF8VZ+2YEGTjrr1DH3 qwRRx74+wNdpPFTf0KDLWTUhdcSJLgmFg6yFvw5/sD+ioo1/vgOSw3OoNtLdB6l5q8mq7PX1Oazu QOiYDGUIdfxmX6Q+4yBVpqrMEK7MS931dms3XW29NI2Umy75dZynUZl5SvYRBInpoje0U+R5OpFr r83IURqi1zB5atpIKlVi/61nEsk5YhWHZWZ3qtE4I4ls5Rr8LSpANJHQwjZSfT1aU7ENhS7UOvcR je0u5E1P8FPD65gKcNCtR32/hYmKmmq1np+1SoRb1GuAm5Gv57Vq38lrNdUa6jLVmhlkH/Ti0yX5 brGG+nVW6yk/fcJpCTnQZ1fy2XJNvj8S3Db8vH7E5bvVmlbr6fCJ1LFkQbF212qCrT6A+RgRae06 DVKTGiQmDcma9tEi9580+hTuMeP39R0NJ5fpXvZSX0/arsYy8cP5GtY/obHoIR9dy2lyZNLN3RU1 PaH+x7ypKkS/ieeuIESNBvXpKLyh0lJM6SOZoQZXIUgWpuwtiuM83dxFkCGsn0SfzbXtIPO+klQg RzWuz93sZFeNiZ7QUGCPvP2YFKWVgEbNX7N3lL8UEy3ZiHDFZrQVK/tg1ILOuKpjEcz0D+Fwlfbk R7suh73rJ+6e9oVRlvak+2jbyElu2B8H5ClZl2gZ7tYx8hSqGC4SliZDEpbyKzZ8wpMdZhBPFWuo Zlq4L5rV+97upn1fb/CwTOu+AW9Cr8ucN3AHu92286I9MzjBad/XNRtBqDcfZJxrrc0DzDQLV79B r6MYKQsK4iE56urP9PsWg3QpZuZ26KPxvm5EHkUt8AK3GdzFnD0dpXHbG3S+0Llp/Pn35/A1Ytz8 zwDEWM3ntTCgO491JFrZHFBeOTOHT46zX9vyt/PP67ftW/46GOW8JcK1AsNyMBvquiLrVWJ+w6aP QJUlwNJqSX7MX70olwholsu2Z2Y9TWW/cknZz3aKDikmRIqDKEu1/Xj+i3DU/YoldT9MoWQoXNlP Lqn7WeCTC2yt7FcuKfspXdjyfMqSup8QHOPPtf3KJWU/IZF+uZ+yRPv9+j8hTdsiCmVuZHN0cmVh bQplbmRvYmoKODMgMCBvYmoKMzQ0NgplbmRvYmoKODEgMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1Bh cmVudCA3NyAwIFIgL1Jlc291cmNlcyA4NCAwIFIgL0NvbnRlbnRzIDgyIDAgUiAvTWVkaWFCb3gK WzAgMCA2MTIgNzkyXSA+PgplbmRvYmoKODQgMCBvYmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0 IF0gL0NvbG9yU3BhY2UgPDwgL0NzMSA3IDAgUiA+PiAvRXh0R1N0YXRlIDw8IC9HczEKOSAwIFIg L0dzMiAxMCAwIFIgPj4gL0ZvbnQgPDwgL1RUMSA4IDAgUiAvVFQzIDE4IDAgUiA+PiA+PgplbmRv YmoKODYgMCBvYmoKPDwgL0xlbmd0aCA4NyAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3Ry ZWFtCngBtVxbc9vGFX7Hr9jpS+0ZkcYu7pnpg2srrWeSJpGY6bRVHmgSktghAYUgo7qTv9n/0+9g F9jFLiwCJBTPxNYRsWex5/ady/JX9hP7lb37UHG2qphf/6lWIPlzEcqf6R/pPMj8mEVZME/iLGSr Hfvzgs38ue+HCVusWCjqD+MvkWTzLMtSFqaZt9ixd4sFZ5wt7tmbT8Uh3xf54S1b/JtdL2rWQ/jo xcMULAMR9Cw+G7uq3r2nGUR+BAZxSAxYd/cf98v7A+v+9/Fvt+yfZZGzj5uHvLJ/y9j748MRZOEL /6137ksLH28tsvqlmz158kTZ2JfWb6rlFApLTlOsGmTRpav2CqjddkCK11GvYB7MGbtdPea7fPC5 eFKV9blEpGJhGjOXwXAVU6vqNzAMJCYVi0TSw+D2KV9t7jcr9uO+XOVVtSkezlcbTmrDA5PNhFoT +P7ryldEgSVfmN5YsfYKIIggAA5P5XB4f2CHx03FDptdfsXKYvsFP+fs9tP3P353zVbldrs8bMqC VbWOMXxynd9vinw9v0BMKfRBhKm5nXPl1Pu6rcUIP7ZFNuJEHZ9veM32RBEjujb5fr3e0JEtt+rQ KrZbfmGf8+bk2KZg98fDcZ+z49N6OfYce9+YR5Cw8BP4XfuNDzmkW0opr8vVcZcXh/lYrdLOonXN 4GS9+WhdNVZtQiiP7CA0etXeA2pVgnPEEceJcrjRhdZ75VHPjl8ZFJz7PGIGt3M1vOeQ4tDW6sHy fEmn9RnZcWZqP8RtBt+We9PvSG9zVZPWEmfA86yW29UR/ihfs/K3XD7wX4Iiy4qNNiPjWH1yRykg W7urc2X1surNAieATOyNwMFS7ufHcpvXyo0D3OXLAs7gcXlgS7Z6XBYPObmGJaOwu83ZzQ35JvL/ 9bHu81+Pm31ejfVQ5tGSWwKuNDb2SmebJLZNTH22SaseCtxvgO0RHYsHqY7L7RYnWHWOEKe7z1u9 NfR5dPjsVS2eEk6O2azn7SdxCTwLiEFKHCzNkhBhMBcHdbaBxF16Ypc/4yKyNj+1Q+thAXtbsoey XMPSys0qZ/fwcWRXjQUi/lc7UpplsX6H31WH5ectQNjn44E97cvP+OnLJaanUihza69kezxx8qmp jQ8sLBEW5UEeb8+5bpd7uDZ1rusvxXK3WY22OO3GOGVIAsBhZmzj3LPUy7bxdia4XTgYbgKDIvpM xA5aGyGil5K7Bgn3sPigAjYlEOU9zKEOKyqg31z/9POnm+vb2mfCTwIgQ+spB0R8Rxi6IKJzwl8C JQ1zT+fKq9fxatEFPHjtwAMWlu6vyqLaVAcgefIqO4rnBUDRfp3vEY4Q7skte3W9yZ+nPIv9JKP6 lh9kgsf0r5qWIkMZVvjyek+Bc8q3Q8Qfd4sfyj0i36HdFFurUOFR+Q07OK/WxmMKSJwQhXPw+VNe rCsksezuDb97Ozg0wYI81Pa0YfKMYAs8Ts97GYb57i+oIT5UTGR8HtXFQsEJ7YTejoVJ0qWxrUmD VHwUFbfmsy3tkd0zrC2wtnfBURk6GlPO4xl1yTHxz3Ewxkm1xh/E3DKDRhvJ8svnAngdbjivriAc cfdW6wV+fXNzmx8q9rw5PNYQqcIH5TOXxD9SlDSCDOu3r6uyrg9oZJhESlx+Juu9EGFm0yBCk1aL esvMR4kEqRoSHKfsXn9heRb6qeUCxkhwkPt2WZC8rmrPcvcmcEQm5UWOupACvCjAUsKcwaqNXbjC usAYeETq4Ac1B0tTF4+bMb6i2wcwakKc6pwCWb/5FipXqFilKp2ynnasgAM1V1JDD64kiDOphyH6 DmEIZdqxiAcWbWvSxDyj/sTWfFbSPKmIjX6GWTpHjZ+WNNgoWufxFE2OeknzUSKpFZVzGqfaX+mZ zMLILpujxXB7/UEfzjCxa/cdQtS+wM89a/9v7LI68BmSxp7BISVtiuzUguoURVlskPUhFA1m5+RH VCT100i+hWX805TlUzqnFF2WnrdAEeD8rbflr56Fp9k6paXcj4A8XAE8o2YBj9Qgo7s3FFdKJFXk z1DSHhtTtAYYgY8nZOtBr47tnlA0qQB64TMJl+mDtKNNmIo5J+uFlfsSRHgtDVauaGjN8XksQ0tr kpo0Itq8FAk0Xoh8O9lqgzlKbcqRSZR+C4yHN53mTFX7Zgb+louuWDznV/ifoICkD3SQa/gKeCU3 wdOEETvLvtbgFBhyO8HmpVPVuaPLBtDnXzffmp7OOx8YJ4RZkfIYbFQEDeEMf9HoSp+eo44JMKiM EDroKBpcf4cWWhECH1Ok6dUxtHsCS91jQc7424aMra5raj0c2djX0UM7ryh8IStvzu5kfqUM1guj bB7Toe2YEApZtjQkAiaNi274xaOKhMP12lcbF4f1KxqWnjllU60eJ1/tArPQW4jD0LI+6mpz/EFn W7YhZTuGfDr6BMh2tZRP7EClLvrNOYIGOsQwE4OtCzQb4bbONuTzVKIxkTRorKFBdiYN2Ipwkvko kc7KCvTGjfPK7ExruKNyUjkD02gOSfDqyYbLAiC8DS0riZGX6/IJaaGEg3+0cNXZvTmdCRibUCow HJw4J2lig6YZOwMHK5CNwVWu9rbFD3fhC7ZuKAGPKYpQGDEOR6UwXVyl3cQJG3SArWj6bT08DFV2 bJBnbXElbbIkRYNxIbNRWRJPm+JKa4Oa1AlO50dbw1hQYnjl2kqS2hlSB9MOloTUp340RHL3Y1QZ ZuBm+WMCzR1M2xqqxICEYUI/CH/55gLHHFOJXXT5D3DMvspVUa7hqgqHEkKTvxo0lOMQVE3H7EvS ZI45DZxK8EjRGOOFhk1qXUO3zxLN5FUgl8XNzd2bDTKZP6kq3u/s8OUpZ7+z1XZZVfh7sfgO/7/5 +H7xnm3z4gFFPPXjBeqQkDoAGcyMDZ1WhyCF95IYKwwUxmpp8BGaFs6TrjoEqSRNpg6ZeAFanfCZ TnTpVYcssZHT5Orgsnh+zJFe/+H3P2CcCS04VLHQjEDAzos6aF9SBMQQE7oJSKkNrgNkHot5rLAZ xF8X4oOGBmxm0ijXNlwAfaxOv8+p2PZhM+6L1wZn3I/tbEjiZdGHl39QLaELLLGViuLcaSNoB2eH 6yDIWsjciqChabF49DmFj5twbZA64frlrpGLM5qZshmmsJzup975CVt8KbnXrhkc7Cbd5MbYw2Mc albKUE8i1M2YC9SiHQxRuxqqFjypURyy4DBRATtoaNQiU1WwgMc2ijNI49Wit4hniE/wVw+t3OVx 90bWzwxlPB+TUofDD320HxQnUyQFFdCoFdeCtbu3srdjVKtN/aBJJiqc1g2e8/VE+JRQ0ARYz6Ze QPuBH0sQpyujrKXpyqgXIJ8nYIew3boPTXoFPYnsOajpzVw4POoGKRqnqtpaVye7soTz/4QpgG2F cb6vpc3TSLHenKlaL0gRgqlxllHfRse7BVpNfdsjmqAYrqVokKaXIrTmtYE0d3monkRHjsKyyUvw k6CCdgTMrHgPFVIaNKA58FVxC70tSUNfUNE8gWYFgWZTSJo0Xki9ACpAw6s7nm2o1zSROkCf2WIx 9SgUd3n8tXzOMbR8RbO2GAaURS22LgGgaZJN3qqgsVzdPOy6YxqRuMSCKaGiXp/a21DliP0GXUeU MNOYi2ho5IclzSOagtKNHzZI45XjVLwOMXX02kJ0eTwuf6MLSkMv8zmQtL1rN+Pu4tMouoECXBY0 2q2Ha+qGKA3ZY36sbfChCqtu+DDK9BBXUHOnqZxLdA+OqR7FUW89VPdClRoYsziIEk260MzieLhK JNtWRvTQpFfQPZjRq+uew+PpuH8qaWoEgb+ZKKfZc5KpMVd5xbSg2kbRCcfplBvMYnZAM34YH4TK ZnaBSw1uSbOod6K163wr0ZPhxNI+ar1uk3K2fSrCzn0jjq1HClAZVBMwSDulM2toiHSaltStOqNU IAJJUuWh9mSxB5rTOzUKMzCJjEL7ctL06NLlUc9FfP/z7YJmcAtcENvT8ApuAtZOIV9f1eO41QrT lfVlB4pLGFOvbwpu9lrdhmmZDvt6TBeoxZlQ1HIetu6piBGldi9mzNk6JmJU5NohSPT67c6ZOk7q XS7+8eP1BRfvqL/vJwkNobtsRscOLQUjCY4DBxYPlsJADY9TG9/J6pXmc9Kah6mDfkE9DsbB3erH BZrx6HVJIPUQWM+6XK/b+ophDJQedydB228BmBEvyyU6hb9PxWp7pJmId7QLOQc+inl3Vo/rEqB7 gNf/UbzYzXGLu2JDsREMyhq6bic0e17R0G/H6+vBdvL/erCdo6xUu3gM+cjpqR3jQiU4LW3bpdXd A9DUsx59TtEISKCSqNbMVDKENVs+DU0/zzhoMrP1Os+qbJfWbPVjYCxxTs6wYORnlnIYJ3dCBQZa cOLcBBvjR19iov2oy+Pvj3nBrAt3uF+ACNW5cCevjN7j2nr5TLEKuVZjCecPDGSUOiWYNeRyX1+B ryeO14kgBsgyJJgK53LviOzUYdIbpsDD0pK8teI9WTFbPj1tv3wz2JiVVLXP1UNU3GU2WiX1uuZB IRRaKHzsfk9Bhozb4Xx6VXd5lPgSFdwK7NXuWp9rFPawPebNZ65Yg97k7y/6dgYDfcu9XaTuvaLL YnugYbhKvKThWjuE79yZmlx0PTwguh9W8DhrDEasl4clSn1Ub8eXCMW/sKZ4iwiEdvqEEsMtLBr9 xOyE2tLkEsN3PThX1wcbm5JYnyagI3Jxk7x/3cjxonq/DYKgzmNE3/EkEjROUNhEnQEtlMQkoSUl SZjfbKsMzYMGiQJ5Sw5VrqjXCxuSXg/D4/NAllObBw2SuR7XFzea/bUkvZ6BVJr1DBKt99P/Af0F kOQKZW5kc3RyZWFtCmVuZG9iago4NyAwIG9iagozNjQ2CmVuZG9iago4NSAwIG9iago8PCAvVHlw ZSAvUGFnZSAvUGFyZW50IDc3IDAgUiAvUmVzb3VyY2VzIDg4IDAgUiAvQ29udGVudHMgODYgMCBS IC9NZWRpYUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9iago4OCAwIG9iago8PCAvUHJvY1NldCBb IC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9FeHRHU3RhdGUgPDwg L0dzMQo5IDAgUiAvR3MyIDEwIDAgUiA+PiAvRm9udCA8PCAvVFQxIDggMCBSID4+ID4+CmVuZG9i ago5MCAwIG9iago8PCAvTGVuZ3RoIDkxIDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJl YW0KeAGdkTsLwjAUhff+iuOmoGluEtvcVXEUFAIO4lBCfKGgxsGfb219VJxqMuTmwfnOuTljjjPS cST4CFnN6MsjKZSp94/CCs0yw5C1yDM28EeMHAZSSGlyOA+jqsflonIWzGxhLCfuiNQ5AsGt0V2E GHtwe0xchW3BSL4Y2pZkyujBwDcjHGIf4YriIPAZk9tpdwkR0+Lit6A+lFT0ua6r5azYBBCtekk7 j43wsnSmWDeNJXV4tE3eUH231KhnS/WzpZ3/Ve2v6uujGl7nd2KLdCAKZW5kc3RyZWFtCmVuZG9i ago5MSAwIG9iagoyMDkKZW5kb2JqCjg5IDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgNzcg MCBSIC9SZXNvdXJjZXMgOTIgMCBSIC9Db250ZW50cyA5MCAwIFIgL01lZGlhQm94ClswIDAgNjEy IDc5Ml0gPj4KZW5kb2JqCjkyIDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBdIC9Db2xv clNwYWNlIDw8IC9DczEgNyAwIFIgPj4gL0ZvbnQgPDwgL1RUMSA4IDAgUgovVFQzIDE4IDAgUiA+ PiA+PgplbmRvYmoKOTQgMCBvYmoKPDwgL0xlbmd0aCA5NSAwIFIgL0ZpbHRlciAvRmxhdGVEZWNv ZGUgPj4Kc3RyZWFtCngBtVxJc9tGFr7zV3T5MnaVCKOxEUjVHBTbk7hqYk8kZQ4ezwGiIIkpEmQI Moqn8uPne+gV3QgJbknFYV7Y/brfvjV/Yz+z39jbdw1n04aF7d/NFKAwiBLx3/QhD+IizFhaxMEk KxI2XbDv79g4DMIwmbC7KUui9sv4VzQpgqIocpbkxehuwd7e3XHG2d0je/2x3lTrutq8YXe/sg93 LeoheMzmSQ6UcRT3bD4+dFdz+pFBkIYpEGQJIWDd079fl48b1v3r/adb9mVZV+z97Klq3P/L2PX2 aQtwFEbhm9Gxl45C3Doq2kurM40ERdmhlzY3NXxKIodP59g1LtJTd+1lkD52TILXES+wZjA5Rjsk OE4hAzxiPoYlYx8f2ea5WlesxD8P29V8Ni03Fbu5adjLbPPMqt+25ZwtX+pqfcWm87Jprtjm26q6 YmX9cLwM8AKHiiadQx0rA4aufWobh6HLuFbmB5O2axxGHeOQxNDfCEIILA73bt5f311fsWU9/4Y/ Kjarm01ZT/GhwefpfPtQnUK/GJj5hNuIz0o/TlLDJykhcOj39fV/bv7xLgnj5L/stppuZsuaZUH8 9Y2QiaHGUIqspcEhyQTslE/M8yiC1rUojR1uCTM4WCZ2qZuWCR8LNM3oWMN++uX2jt1XbLmYbTbV Q3CCOkWw8zxlFspjpcHih/J8UZg5IjCcH13tgWu1nJPmB09d53Ru2+djgO27AztW83JaPS/nD9Wa ffn86cNP72H7vr5uvr4R7Pn0uWWR0thTeJSR24tyZp3ljEzinF+WSQgiLuufPATaPbH/tRa0Yc3s qa4erhjilNsP71ovpZRIceiKVX9Mq9XmuxO0qYA2RTiOOdE5GTW5LJ/GseuKzq1MPgapTDc3tx9/ YNPl79V6Vj8pfWo55OgRzN603DYV2xzKpl5vz3O4wyiNGI7mUBc63h5rsG2XFsuygyFtnqc9m5/Z Do4nPTHgubin/ZKP5WU2n5Mj2q4eEPw9MCQGMIclgA9tHtCw5/L3Ct+oajYt59PtnL52ii3MScOS nFlnOaOKjXl04Wh9zBG7ds1hHMQBD4yYhUHOiyycFJR7hnER8WyETy0sZ4OTUiOHhoFA7kh5YvAO y3WtbSk9iPKY0Z2cbSOz7XG5tBMuq3S3h3wBY7cff/rXPz+w2+lztdAp6Dspb4gyDzUV5o46mrUR +wL39gfUDZ5QN/BZR0w0rON8EqRtBSFFApAXyWjBeBR3YWxuwZIiyEJUGgDTaw3smT0Cztv1o5Qi 7wjfxZ76uwpmr0+TIEvknmItSw0Me44003CziG52qHDoEG2M2zvCcW7jF2WZo1LnMn0qAx77KK5F bCHsHNs25LcoTJey2AhZRM5m7B67/wYfV1OeXJcbLDheLhG2i5THPpkvl8O41usZDQNjHrsMPKDA sCuO1+QFCoeD5EOoljCrW6pSHHel/uNxuV6UG2aot1ft9tNh9FdlPGgnEuY0gRP3D1k/sOWaMgDL 3LW6M9hK99KeU3kPlY4Wp0P7h6qZrmf3cLYgjcqiDfpBlmiE48Whsjo8g0dtrUacubA5s2CpqHkC ZtYK2GjOyBIdaTV6aWDJX+YmKK3HNHc+lf07k3Kqg0YhBysylBo7dbaAW2eQFePRflH7y4pxoh2q wDWySsZXtojt8zJ7zrDrvrru23PfWW3uOwyFcaTkm8IkyfroaF1NiS8H2YWfDItW6shPap8mYR2f CBhKQK2ftNdKWOsno0L6SbUeeybK/ykY/KQNU3vKtSw1eMhPHuYe9wh6EuaOsh/ixwYZWqBwhJh8 lrBhvZZFBKcRxE+X7bWW75EB70BWldXEVf6lm+39r6gOss2yNf1tft4gint7vPTxgkooE0ifT4Ae 6esxKN0IfCKlMynyAA0SirjiWNpODYOdtGGhiOLk0hF9TYJON53daNmYTlgUh92HSNQuO6Fdt48C ZZQ54iEUd9fbedWwHXJlCdWJNg3CRi7cGBxOWQ/PJ2C5R4T4BEkiI80L+AN/2x53sC9u3kViEwX4 qNqKOalHzcrVav5NRp+GnsN005DLBJQWMj+gVPa5R0O6iU6cykQnyaOAo1UKA65DCQWDAbdgPMiE AbfWahjpSJzKRCfJJ8iMhdoZPBKGPQ0sCyaUEBFMGvok1zAy4NqYndWSp6GbEB+id57htErfWu+A wlHt2x+vj5drUyPwNx7eUd4lzqQ4olzgY4jzBFWjp+UancPFd3SL0VFtcaoOhTmV8ywcvhQfrByq oTFOk0sns2nRU8o7lK+9gYYRHQ+FzGL/ziBD4MXX120vg6OX8Wf7KdKf0K0DLAgC9vXN8daGU5jJ iwJ8Mmc5J5+yJHFDqcE03KV+xrVm8AHddOAQFd+lKJpPPoqXtuP+6s9XcKr1cgPnatUTlvUphVVO fg3+YGxhPSdHJrEX3J6ZIxNU2rscia2q6h6d38kQRBIh1WPHPooE5cdf2uq36lrc3ByvF9SNQFUQ JVUL0zm5kMdeLefMXMjznV2knYED1SX28MlTTivk04qDMzja/5kGKMojr9qNrk2G7F8VjeHBOKTE mRAspSI3whM29je2kpQ9BNolyBm5xzRCTOxjMGVKfQMTHO3BKZlirpKTry9iFM0EIruSMfwqu3iN fYFhIjA4zG6bvtKl6cvsr83vueQuwnJOBTuqbviEfS4b0QDTRzmlRsQT8pzUdPEp28PCw9SpK+g8 AxcjDD32XAqzXDQDsb2fz5pn1CL13ZjMEEZoRIgKTkykoVnJBYu4zJE1bG7BEGTJBMCslTBZX8TU ZVsUinMcTMT/5qsKRs0TjTpR8b9ZKkByx6iQaYG1ZVLI7F7D5syC6S3V2hEiJoWG0pSzZhJF5Hb9 5bDJupqibGPovkd6hS5ZiYSxBUDh+E2fnUxVPOJJHBRIqagelyp2SBjV42xYInpM9lIJ6pCJSisn jtiOyRLcLTpm5pQeRZ9TAQrHzqC58zirS6gANAC9HUzqVWvq65ByGM7oFHMPizyHwGneFU0HeTt7 gtjiUI9H7Rar9qDdZWU51WE52fHe24sLd9R/ELJRb35iTJvgpn1f35qfod7OyeNGHLUcX3xmtSw/ 2nNehqeD6iAUzkTQDWGzUJRoG7mogyTKwCgY6hM2DAaMahadtQSTRksrVBaJPi4saybLLbGCYbkN ay3w3KgxvtZWZUTjxmBXy3FKFFnEyRUMp7Rhcku1dkSoJYz0W4v9Ufaw64pM2sXDyM27hEE8ONQ3 0YqpTPTsbmnaHtneFSDYF8guPbM45qGH46ZaVeiZonXKqnL6LOdz2OyRLbbzzWw1x4CpHNmhgW4I P8Z6tH8/JbEskNNEGSZ25Kk6Rtpo1B7ieiGmRVGOAZlu4jecaZ71s1ykjSJzG9Rnz/ZxCxeHmLF3 hhjZy6H5Za+1JbbAuiNkJcQO/WiAX4xKikBPzOeJkEPMuOpZvY6r28NEz8NhvAnCQRNyPbcfzsSB mhfxnanpsMP3ElNnntzHoYeDb6uNGA0GyWpSr/IBo/xovqnxOZQSvlfTjYiuxcJDmW3MGjeaJ051 kub13tvSkCh1A9VDNGSXGlrETd1I1fbOL0i0BElX6xmoChtGY7+Ix4QQt2lhO7FYztdV+fCtHU48 nr5RiOAoyhE+YGqQDnZR+sahN5l4SoRrmTlDX+BwMgHK8tBgWi9BUnreg7LjrJwPttqewtOANA/x 4GDMfWTn6TNYhs1HsXw84ewUjfMY1ZOLnZ2TSKGY0Iui+mPWYHIMhayvrz9hiv2K0Z9UkBeGuTnF S+u5Wnm3k2TZ2CDLQMSp1xMbzItd5sFGgY6CEwgcoCO7vIilIx6O2yUNnX66tW5zfEpr5mR43GKy GUFPF2YLxGqLqt5ggnBZN5CFqllVU2gl3ou9wquxGd6MSbv3CrKxmD09b+Bt6HTHNdUsOyeO1CZm x1al9/kRzAg5wcj5/QjNIXXlBDMK7QsR1mwRHG+eESqT6bv9fM2Q04O4rN4u7jHoh5xfDbujGVNX eLHASlZXBwdllo4YPyIOZrN8eBDk6YhVxLB0JCncYO8C9EUHo0tfom652SKzAAEX5UOFWOduyVbr CuTFCwEitilfylTkij2BwutW0Bkst55A2hOpSUrYFKZKJh4Ijjmuj6NdlMJp4s4rnp/CwOFQuKxV A8rQ2lgkXSQiyyTeFHTnNYaRtFd5TbEfY7Lu1Rf07ButSnOUgzB1ywDIV+AeI8pZfAKo10IGk65A 7EHpRSmI54AHbwv78AzXyF0OhUdtWZweT/hXKefNEk69QWZOU74lmz6X9VN1vAJw4lHUJnsC2/kV gFNHRrHGseCylAZrapizhye+DiMwCWIaxO2RMosngypz9IomyuQ0URThA1XcUPPCdGdb89Iw1Lxs WChK2moto+9JGE0T6QZHFGVBKpseEg++K2FUmpNtB4LRMxCq9qnmiIJddKgatU+vH39ArOQ5m958 AjgcK9VxpuQDdJ6LORP6ZYDWE2C6f/pMdXTyv+qdpi5GHa8GZsiNrn9pP5DFl8/YgMOhsIxcmhJB 6Wa2qE6oi06g0WGOH4AYo0Lk4rFUbo8qe+bVikay3J1iO3jfXp9kocAAoEMimtn4N6K6x3Zs8ov5 2ZLjJcvKawW+kwysFbnoyTM+mXgFlkOtqSGVpa4WqXL04bpx2yGRyy53Z/InHwfZAGSws9UMWQ3i PPi7tlTTRuHUPS9VZAMTMUWcQ6+EH7+1lqL94v234xlnVSDFyU5inCFwf/CdT9z46BACDzO6wOEw UQXWsjOpav+g7ONyPl++NNAHlJp1I+DLoeTsvbbprmEK2722+sEEMHdttUr3WBJBAEt2uXpwPyYc zrXPbkkKFGYurR4+jjZHgmJ0XsJVwVNwhZ8EaZ/LQyX08CxbE0uhIZgQR6IFP3ooM43x0b+1M8bA +8XdZZFd3l0Ch8NB8XCzrMVv7cD4UCaqrdHf8MsR29VquabH7eJ5MSQWUcqPZXMKYfWvDuBlMJ3o kkYHj9cunvETDoew12qcG284iYqPj7Npa+CRDDgG/JS6JfVu2+cY8ggnUdKIvnGK+A0bd5hwuGHx sxjtz9GSOdmf954X6ZGTflnnVdlRXARxSj9kl6EyIB4wJQj2JjYIU08CNMLUu3qErhcaEDX7NTia iHxooRYzzBuqFEntl+T6XYdaaIHs/fBre0Eh8ih1Pg0y56MHH3JmQu1ngez9ojgKYpHrqf00yOxn ZXVqPwtE+/38f7vYkOoKZW5kc3RyZWFtCmVuZG9iago5NSAwIG9iagozOTM0CmVuZG9iago5MyAw IG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDc3IDAgUiAvUmVzb3VyY2VzIDk2IDAgUiAvQ29u dGVudHMgOTQgMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9iago5NiAwIG9iago8 PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9F eHRHU3RhdGUgPDwgL0dzMQo5IDAgUiAvR3MyIDEwIDAgUiA+PiAvRm9udCA8PCAvVFQxIDggMCBS ID4+ID4+CmVuZG9iago5OCAwIG9iago8PCAvTGVuZ3RoIDk5IDAgUiAvRmlsdGVyIC9GbGF0ZURl Y29kZSA+PgpzdHJlYW0KeAGdkjsPwiAUhff+iuOmiSJQ2nJXjaOJJiQOxqEh+IpNrDj48y2tWo0O pjBweZ3zXS4lligxnnoB68Hr7m21xJlUzTwEmsXEUyQUsywlBVtgYjDijHOVwVgoWR+uBpkRIyIN pSkyBcbGCAiYLfor5707+SHcFfmJoW2z2/lwcR7z/GL3EENILkW7XUWDyBwxMzVuZzaR6XBX/WAL FuhqEbXpC50kTCZpsMBn+utFvnMQcvO3UdS8c6sueUiA4h/q/+N/q75KVjk1zPGjZL3urPpb9fkR 3liXd8qjh/sKZW5kc3RyZWFtCmVuZG9iago5OSAwIG9iagoyMjEKZW5kb2JqCjk3IDAgb2JqCjw8 IC9UeXBlIC9QYWdlIC9QYXJlbnQgNzcgMCBSIC9SZXNvdXJjZXMgMTAwIDAgUiAvQ29udGVudHMg OTggMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9iagoxMDAgMCBvYmoKPDwgL1By b2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0NzMSA3IDAgUiA+PiAvRm9udCA8 PCAvVFQxIDggMCBSCi9UVDMgMTggMCBSID4+ID4+CmVuZG9iagoxMDIgMCBvYmoKPDwgL0xlbmd0 aCAxMDMgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4Ab1cW5PbthV+169An2rP rGSCN5F9c7J245k4bnY3k5k0faAlasVWEmWR8iW/vt8hQQIEKIqkJCcPiWEJBziX71yhT+xX9om9 +jHjbJExq/g3W2DJmtlu+Wf6n2DmhJbPvNCZzf3QZYst++GJTa2ZZblz9rRgrl18GP+x5+EsDMOA uUE4edqyV09PnHH2tGIv3u3y+LCL85fs6b/szVNBug8dubkbgKRjOy2bT4fuKk8/kQQ8ywMB3yUC rHn6+0O0ylnzn/tfHtkf6S5m98lznOl/y9jr4/MRy7ZlWy8nYy9tW7i1HRaXrs40KTnKhl5a3lTK ybU1OV1jVyf0Lt21VUD1sR1SvIZ6QTS92THp0GDHgw5wm5kU+Iyxp3XMPseHZJXEB/b+t8cntkoO kPEyhnJvE+jCl3Wcr/GX6YHt0pzlKYu/7uNFzqAtj29+vIIiKCcbqwiSuW2261iWLr1S8XszuAkR kwZEuMRgO3AYyGgyPMSL9LDMWLJj4CH7C7ZV8DzJ2CLasY8xW5K5ffwGnkbgdrJ7Zpt0EW0238bz lYcODMwP1PPchq+253wPvoKMxtdFulslz8dDvGT5gSAp2vUWZZetEOe45fmsheQ6PWR3ZAWfjvHh G0lqhT/8+SLaLdnnaJMsoxyLf75k94/s4SEbL78aIJVD3Eh+lv9d5Adf28Q2YQ/76BDv8sos3oKd ZCEZbCWCSA8x2x/Sz9HHzTcYUBYvIO9CAMnqEubCWm14Q1se6jbM5Z4eMAhn21tTe4EOyGjMLXG5 1sl0p/gRaxbw0Lfm4QQQYTmhzX2KjYq1gF0WKoUINrjFPWbenMAOzuMqN+cUP3CHqGgXB5UGkb7x n0AEGUxwm3DAc1toKLw8E1V24Qy3oYV0AfMS8An7+ABo2cbLO7YsA7EKX9LdJZpPbiEoxFMxztT8 V/9E7PyM2LlSFFKPNkWx/fnMoyjat8OZZ4fuZAuH4zTX2Ka5ZrmItjes8V2xtmYrZtte8f2J77gz jyLzrfLZak39PtasoNxTfJfRd8Ua9pzUSoCb2XSzM2JrGt2JZIBz/j2AE2QqSYmcA44PXuYIjARC Znm8Zy6iiE36ZSZsa0IJEER2NttRtB0eDwYFbdfITV7013bBNrlrHdki+3jaTpS8afCm3cEdn5ui GAk0kLaSPFWBM9cjcxsxXJezymKiPxmQErbekNskF9irfsHSEVJAGX9NoAS7RczSVRFhRvv4a+/L m7gXUmo290FS07v+MuuCvVonpo4eKQ/1jV1k6oDcJPPHh1/evL9nZVxe5jsAXJEALSHXdyUfm5+r wpBLwBeytAPOlCOZ4NvPcluVRbJ2rqvLUNY2EfBErjOd6yqyTIFKlCEWSildV5FcLhAcIxApPXSV 99TsHs/XOtdRznMjvsJnm0BDvO1tb/0YCzqa8TWVseBzpZEVsz8ec4akkti/So/ISJSM8248e4FA ZbQ8VU51K/7OjcJNqbnX5u/c1vhbBVm9CXWBj0/VAN8K2JQbhFRTKGotv3x4ImOAV8+SZUzpbHZc LOIsWx03s/Fi4wGhjds8w1ixtbj0KRIG3RZ6M69pBU2XK1HM9vWccYildQmocutTk4Rz1rFL1/v4 4TWqDksmjPPh4THOL0j6eeV61WONFdkZD+Hw71K2mYKOZmmF0q+jz3C5VDFhWfK8i3Lk9aisLNZR WQA77qnIGNWVnQUqL4WrGG8QtlW7X3mmW3HX/y65wdTx9eTATPxFVEi6iuJKw49kbBUlG/C9RL/x vOUh+QhgnXqisbxtAxvXCm4CNg50wrIcoCQoaIo60PN04Y2MRk0yZeApgqObegSfkn8eNu56VSF5 RnR0ZY/gWbrfvrpHMEm4AJ7f1/GObY+bPNlv4sqIUOEVFco4Qw3zjsXRYs2kFZ2tn5yP9SenepLc I2FaDpuaB95SNbw357v0llMkY6OQ0EKFVHUoEWnafE47t26sHL0u3JzhVOcd5pTQuq2kMjSxktU3 OJrjLkFNn+4zJGeX97ERb80cC8alyMM0rt6lNRfAVJTW3DnUCOUtlNZcR1tDGa2x5lpFGazxXbFG pTVnLkprLv4nRLkOpTXls2INe0ra3swty3XVdxl9V6zdrLQ29VwjthyIxs0I81QCCzoa6D8u1vE2 LqK6n6JszV5vntNDkq+3LD/C9Ot0VWIAYj4K3nNELhfEfjI6Uc5k6s8ZO2je+kThcuqF36c8ADoa d7cpGjro7OwYtTwfHtgXsLYoWmURuN7KfImnF1xewo1xdxJuHQENG+NQCoUySzZvrQDamSt04ZjM i3yAWbOXVhqHSod6O2frv605goxVSjpq2bYRq0jwv9TRdV2b0NsKMLswNa+NDok8RD/WSsQOKEkP UfJu2VjlZHclvevoAR09nLdSyNdpFl+HDLeoU2W3cuiPD0MZ1KoTVb+thVU/UC2VIiFJyCoaLpc1 EjlF5tyfF9LRQv8eQXJfOxbik1phc6gFaJ/Rig4/TpYne6nIjIQfd/xZQP4ZLTKba2tokalrDvnm Dau+O3HxXbFGfryOioa1s5RLVgNtUz80ElUpxzMWZTgbFQ5rCnMkVwZY9abRZV51Ecck4cFP/5ym e5YCsRhGaRg1RaTPRtyOso3osRb+Z5Vu0EGjiQ7qqGX/GOp1FObWdQblXGM9ubKt5Ghw6zQrcPSi jelgxsOidDAmndcQHI2jUbXiEaXSaINZtHizLNs0GJBa5JgE2UY5Ei1qfolyRvnR8TKTlTflSGNl 1oqg0nvDK2h4JphL/+ltGE3ja8a3Hnk21/XZFLQ04yu4KaPY4o8ZJtCKtkHB1zslgx2KAMrgHScx 8xDdLvPCVbFdr4X3vr0J23WTwrxyf6Z2oY0UYGjrYa0pwN4t+FZlkQIELU1ZutoFVTiNLlBdkq6G Amg0uVdQKCGH15lzy5XHG5vCScRGwjfcyNi4ZRsOrpRWb13rsjQJZUSououY0/ihwrIypVRwjNo9 63jxv1jpNov+8wG2WPZQL2AwBYQ05TMVp1JD+P7W0Lz4qWSSW/6JXP0GeEbENC5nx/0+PWAmGd7g OfmMMl1W8PuOJTl7/OnDbz9Tq198BAMz9LmHh79fkKrLYrc4zk3Zy/mJ+cxbsBfENPYKqF6kRzhh ai1/LIpkvd46GCgtMxWMGemU+itmF0xjjglux4bvayEhbGzJlkeUIdBf2qHuJxSI+q6F4lzQc5VF HEH8Is2QQCwRE2wz+nYjkexU15XbXA8ahH/rTahLQApkmoR+FJCpld56QucliIlssxjNEbe/SHCt Pl2Roe3pTl0w+BYmDWK6SVdDOiZ0rqnkGVUlT8nPSws8cCXUyZAazT0qymPWkIZK9ANeCQl8kilm 59pIoBNKjuA+qXV6ckmsG5DD9VCBodtoAVvxiuptkcTUxFhVP3ACMUGLcfSZT1OsW+ZZ2tpk01yz yzJ/47tijcoDPasCXUaqKCvVQpr5e5b8RW9WxKRX9HyI8UAIVVSpLv1YKbUBMbsolFHZB+Sub371 YPqUSGgiqmIH1sQdKa664nLmZl085fTSD7EDlMTkqRmtjOemnIfr5malg2eNW7SN8A4yQEmunPL2 xZR3tUZT3nJtXuryhsmv1ktqBWvSU1d7hqKOd2J87BbACmKaYRRPVqr4shrbVyOneshUBiAXiJkK 2DbeKUGfiqNc32hUGAhPR/nSTs6YhxCjNHxqYltoN9IdTAJD95V+V6lEylyaSGgSU6M/6fbq4nFt GZe9lJH3revoN7surwb5C45q14XX683TTiijZjenAlMLT78cUnrBGO+e0dq7L9+uvE2G6rmUpRo1 zMnPOoKuBuJUJcQQGT1LRRqIx5NSjD3fgIsrS3HZAFA0AyhKMXVHLaz0Koaq+8J0yQm07auIyEDo U3pYP6ahN0V+2WXwON7k0OOceg1hhLrG6cGO8pCmeI9Udh5UjB4YTyi3rCvWnIqRzSBCueUZ0OhS RAWgXLwm10iUUbXUg371r1bNU7KWkpAKtvcia6GHixXs0+vedLs/5sgriyYE+YXyA1EesQg11zhb HJKP8XKoaSgcloUe81T9OdzTu3ruiVLaLbwriGnixDT7I9k2nhA4M+eOHTPq1hBbW8cGipkNNIjp E1fhcHkiVe7X53BgTDmWOnwTDgd6Yw6DzcVb3Nba8UCI49QF45zGzz2DUH/GmZAsQcV39Mxk8L6t tq6Aih/oMZ6Qx7VBpSSkKtcbASo1iohKnAAWvIzGu/e00H+8ZIrh8pZDDyWBhEvHql95xAPAVq7W EzgcFDTXXV4NF363Uu7QrXFGLIlhyKrqbVLorxkGGCqxpKIZc1uPJaWl9ifW5duUwNUkRrCXf0kr b4NJenoPKvp3jSmdQl+qpyXjgVBJKsvTqLra/8IGd5XoTuXuqQdstwDCufGMTXmAw9gH8PrwJcnw uwMNxrZPoYznsKK/5YluyuHAdjUjHKO/TXGe6kJzENOcueRw8Qsa+brZshz9w0JU8SjHhgTRi5go AVLRzWBuhEEXgJZ0ZyE3nP919vX1ctdgc23jg22ZL4iucV78JocxHzF0X+mAWsEbfQe95Pw73tvF 9BIGw7zRBp6o/ufN132CtJK9jw6YOeF39MtXvP5bTGwM1FV5NgX6pP+ls7UZ5kgWNE2S1yWjFhb8 +1/Rc8y485/epMzgrPpZLzwONFjcX+vMfWsrQT2/ghL8+kfxE2x/G3/eoG3f6qfdlPNWebgTzhyP fu7CRVmAsmean59Zc2WJRvKrJTsoJ/5QGq2+KJcoxa6W3YAXBVNlv2pJ2Y9eAohp/vqLcqmxn4tq K6oA6n5iSd1PThXW+8kldT/8qNUMvx6n7lctKfvZ87rGW+2nLKn74dVlcRPlfNWSul/RyS0mIev9 5BLt9+v/AXOuo24KZW5kc3RyZWFtCmVuZG9iagoxMDMgMCBvYmoKMzY3NQplbmRvYmoKMTAxIDAg b2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgNzcgMCBSIC9SZXNvdXJjZXMgMTA0IDAgUiAvQ29u dGVudHMgMTAyIDAgUiAvTWVkaWFCb3gKWzAgMCA2MTIgNzkyXSA+PgplbmRvYmoKMTA0IDAgb2Jq Cjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4g L0V4dEdTdGF0ZSA8PCAvR3MxCjkgMCBSIC9HczIgMTAgMCBSID4+IC9Gb250IDw8IC9UVDEgOCAw IFIgL1RUMyAxOCAwIFIgPj4gPj4KZW5kb2JqCjEwNiAwIG9iago8PCAvTGVuZ3RoIDEwNyAwIFIg L0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBxR1rkxu37bt+Bcef3GmkLPelXX9zY7fN TO0k50tmmscHWd7zqb2THEkXj2fuxxfYJQkswVtx9UgvM4mD3ALEGwRJ5Hf1g/pdff3NTqvlTiXt X7slgJJZmnf/jn+oZlmdlKqos9m8rHO1vFd/u1bTZJYk+VxdL1Wetr8M/0jn9ayu60rlVT25vldf X19rpdX1jXr+7XrfbNfN/i/q+j/q9XVLOoYOIc8rIJmlWQD5dCxWWv2ECBRJAQTKHAmo/upfbRc3 e9X/efX2nfp5s27Uq9XHZuf/V6VePnx8AHCapMlfJscynSbAdVq3TNs1TTqJqrFME6ekpzz19HQO rFldnIo1qCC37AwNr2dexUypb1++fam+2ax3qw/NdrFfwZ+iRTTprJpEVBVgDHWWK0krXkQCK3GQ JB4Ho7GSiEIemBaZR6CYaRDSz9+9ff3mlbq62n/51Bxvl3MUz3yuFaNzRrtMk/KyFqQL38XBucda S1ADGUpGp0pSuL5d7dSHzfLhvlnv1YfmZrVudmqh1s1nhcHk6kqhUr4yOvpKfb7d7Br1x+LuoVFl pm4Xu+MVliYZBJKq4Os6VmFBvp1pa6193Y0QrUgvLEA70WqIgD33f980a7W4u9ssF/vmg3r/pQsG N9vNvdrfNurZVbPbPGyXjboabfRBbnUOatY1ZDfB7XKz/aB+fX519SvY07+/f717NtauKAppDENp USIZj+XzWKvTGqS9vkjP7Q+CwO7h/bb5uNrtt1/U5qZT06vN/WK1Vm8X941692W3b+5BkuAbIMrv F1uAQhGxe6bsdy9O8QfI9mmlFa3rWHcgdTlp6rnvAtE2MOQADv80E+ljhI+ZtBQ0bOtjksI1xKYX JjY5biZx1SKJqMTwWCaV8glMnsdbtJERYSXBzLEymLDCczTWoFiIgE5FcTNC9EPadaIHEp4z/oQ5 4AUkASf4Q2W6KD0KLJ/zqlRTiT5eRgItE8w89VY9Gu0B0af60kl7Kkm8aRbr1frjC/Wm2e0WH125 /90fzdbU/4v94vhApDMIRLqcK077jKFompYXrqWmmfZrzXMnjwCJq+am2TbrJbhFr7A6XhM1pvSk Bk0whs6piawUlVG0Pw8FDvLBHAJrP41DkqOq/93ytrlvomkKZ3dV/1QSGu3soegNVZW3/tFoD8SQ IhFRiofvZFbpukzm9QSq5SSrU11iO6SFVeq07oiL77AGrzzoWbBa7P67Y3zHdmaG0noF1X9SQR9h KgXQ7pvJKC4pAnIxKQPYHG2b3x+glQIVPFtOZF9qiHudQvLTsIUKcL/fqOW2gW2D2Ykh5UnboHKC QAs42hbY/kWX2MxJofaRShi9SQjauZ5jVZulIQpm59/FgGethDs+v/4HdAA/7lSazWcFtvryObBe QavvXmW68GB3fViewO/duW8n+K2B3aobBU1Dg7KY1WmLMk0cGQODzzkszxHlhH/agRRizLUWKIvE h92pHgy/n9z1v2U4nYeBKFIUxYGqdsjWKBgXuV+u2H0LmTeEGRNwTjIy246d9NqxrqE5lUvZrNsd F/lZHMsUtNGWkxJYDCA/jzGjLSdlkMBT+8SxyT/sRBQtcr+N3duIRguvS948EmA1nsKe/hzCI53o Et1fFyG0ZHOnWDcE0TYdhih8bt6rT1ghO7lE7g7DWrCtDyMivqf7vNrfOiKH2BGbRY1ZKIXdCmL2 EjGtXdmwqNPaBJyinpUY7u5VXti4ZmEQXAxskgMMPsKw2PvWwNog5r4v8xk4UYtzbuOihd1BNGUw jacvREfl8HsGhjjPG7ugDO4Xkmcv6QtBYrVe7VeLO7XcwGHRet/VQCYXR1YBokxmvfE5RqwKWrNT IO3pfbFTNxvoH37evTjBsBLcQaSwxZYEAoZ1MPTPu9wLBpV1BnWvwHatMRoYGBnB0s6Y7pT5FIzS gcBGJpE2IlyGklqZu0bhsVujoLszCrXYJfEK/UCeEgbAoq4rwEto3Pat+8p2IrH1GG8CQ4WAS1+S 2gh+BilgLw0PYaaSxM/fRdvxEIkKc3BVgM9IEu1BUldO2oO2CZ4oQ4I4eHzMcpYGEhoO2voUJnho HHAaZ9gpOIIpKOc2GFsYFJQclnTVH/8UQRBLR8TNvmH1Cy0y3nnmb8DPHjclCTjTiD1VH9J1jrpO EzAnSaLt04+lQkoucPsJ+EOoF2PRBuNHgb6Q5xB75eLxKFh9v90smw8P2867u6wSZ6tBejVwBJbb 0fOSyRiV980KrlOweKUTdA0N+0XJ07tPzXJ1s1qOFR7pRKeI/YIq0SnKqADPlstvVXIF2/3Vtvlg eDgmeKDaYfPokTgYPHQOMaqturLKbh0tDDa4BOvuvMDW0QUPba7BXCJ4wPFsPy2NsaQh13aZby5I YB91rBEFPQJPRJO0giaLJNI2as9ChY4xJJUXIK5f9vyU/bexG0LmHq6YY4RkyWN3Cc4+knRWY6F+ r9LSmpaFQV7iMLhnhF0J/imCTF46silBHFBWqjLRoD+LMhiF6gwHkrR0Z6+VwPvXs6w8w72ALiHX SQpT++MoRe5jaf24D0+KFOKSj37yPJ4BkRvYZgb34ZB+IDcABS//2PXzfzpeDhVoJowQLxpOqKBA 6yh58Smel6HopDWEDg0UhbTUc+LBcTBaGxorG42R6VLa0DnKqOr0/bQ2HAuHlGA0z5TgGrtS3fFK EAbFi405sJBmUND4QuJKAHVEMyEsCQoOyNZwuTJAIp6JAFpspuHZhlw520EcKPaGDJTiXA0+feEU LUk8qvb8H7Lbo3rV7Jbb1ae2fgIA/jyqN+vmfrNeLeGP7/aL/cOuA7sjUvyl4zOhu4M6ZUuTmfCA fIXtsWDG5DvPPfeBtUdbnHAbl0dqgTfe4MTKmddQHgEKnmW40BW9fmHalEck+ngGhkyb8oik4Bhg fzjejCiPMErGjOJ5EcpgZkR5BCh4ZkQsRGtDWBPlEYn/BA6YOVEeYTIyN+jHR95gma7xHj20DNU0 RMKIyclofK51icpHf67KR7tEJbVAWoY/OSbisi1TAyUqnwk1onwT3swCqQgW8UFuyJspkOok9Xuc YyLpEBEXVAM0HqFP3/08wlXbXbP9Aw7z6edRUfw42P4+nFAmTz1EgaYJGDl2gwJrvHr97vXVT69f kX3AVmuSxN/uYGUZxn89h4qG0zlrbqSggyS8qPao3n790gqc+DksOXjCw+ydXIqzYeIOs8xBlU1O ux2j8XIRNI5bSXpsApPEnNsXx3EZDoJ4HybFtnaIYWuvRPMAqYCn20o3gP/xFLy21A3gZYqyXQmn sKeuM6W16VFkhZ5lXd8iy8yBp4NBS4xggLPrW7BvO5hpXOT2wNR9DwemuTnIdDA4yDSwSVa479m3 DoZNeqf0yBOsofjFgyRcL7hwOa/xCkOfxiN4VvcD9frq/tNdY5/ltFAAfvvm+3+9hn+B0n6x/rDY b+CO/GN3z9F+SYH0gHGKMobSkFkbP1pnRhSHN+hfTMRai+un4yt6IsKiFuUhoCFEbOQEYlvCwW77 HMyCUK7uh/0RwO55Dvx3tmUCW+yuBR5/SwdzFSUOpgO5+HgdRJo5Xn3rmyCwNzYKkQ4YH0wHggYk +5HHUiQfOosC8fiLT0/AC3E/SYHONIA3vmIckjv1wQMk0qxGy1I/rhe73erjmlVHvDaKcz0SF6t3 OnFxl45na3BzZY+LkCsvP1tnitZLn1D/MJUVPFL1p9iUe7N1Od3T5iqgeyslcovI3VXQ8+iqZ0Ah I8Qk0gMVYlLRJ5gSC9wab+KkcJEkpAgnpfERivyBNnABPbD6y5UVBxwuUOC5QkwaKSnYXSJzCeSp QsweAmU6tUeThb0U62B4q9XWUXANFp/js/OjzIBOOz8KGhvL56k+w0lPkAjlEknjUaV5Eh1ehLrc 7AB4/CTWH2/UQ2GfLtsGSKRFfvzi6cgzgJnZWpwNB0VPfcYAiUe4O7H6A2/I/wjPkc0P23myP0Jm o7rU2fxpRVNwwRSkpD5/ufr7N3DNr/yNRD5ygx8mWaPLz7GnADRlBiRqBxQhIi6LVhIzj1YnVqHC LVgVKsXILMtuJ2l3lpQw/gOiD+zsKnP7KjMwCD8MZm5pAcztCuEwrr251btBcUoq5NGp8G92gr2O 1QypnyUtFp0K/wwIohM8XMIf6npFEx0KKm4KBT7a9Km2BLu/GWLRN2iIQ1bLU4MeiXkGflJFQd04 iTg++vaLRu+qlKtOn5bTWI1QOcFKUomeOegBxxf+R+3+kHrHrjesVDuoIGRBrHloneREE3JNPKno nqVGz/8xTHlbhBpiSAov90NMjaQjlMKjsfC5E5TNg63Aa8UPcrHB1laEcGA+K7Hjdk/Vn4VBrHUV IcLS7jUW/9SAeBNt5DXwoF2xmAsPmL1gASqINl6RDSnQSsTnOWWjQ1t8fO11RtwRUjQHwoJYNSXx x7MwlBjo2HaIBccLHIYdPYKKpYWOG95biOdGRO9e5rEXgJAbz5iIiWiNCJtiAVwSOIEHVh+wWC6V TjzEpzthVmzHLynEMzFkVuwgSJJgTHSHq2MuUVMyZfGV0Tj2IgDH67bkgNczohPiEY90hf9wezRe CqbMdjiJ2j8t6PKZ//doXxhSN70K15mge714DwcT2o58Ud1LDzjV7Wb2nBBQMD62rxQNVR5QRguU GYCdPjjV8BDgaQM4dV86JFGmyRxupF266S5pXMO0q/ZB/6fN3Wr5BV61bWGeALaaYYhJO2qsnSe2 U/DuHSdj9V6Fn6BTuHoHFRkUZGxJ8hxc1DZZhWMJuieV5tQxtTB86uhg8/bpJet24Wv19jVmbxsZ d9WDpR6msCL3j9dHG2PQuyEawWYZL9DCYwh5KeMsnkxFkyThXp3vbmFEmnoPo7XM45HuVMw9wxhZ IhCzTJ4aVwLdmY5Zzwm/AlOEwXd4g/E9nHzApC/Xq5mNFQPze3etNCRfwiuMLy1nBbZQsbA2x+Cp gbWFNYO1RkpX9fHXDOiEwpqxQKGrqPAF2UkhMagYZuhl5qfHYpbRlJh/Lna36uXdx80Wnlnfk/zG 7m5p2Ae0yP0yO961RB3EOanENJex6z0krHkaSMhExCWTpxr7B6Q2VBaTU8MiPFf6EyfGaCmC/8vI GFyHJ4U/ZWZMgH8xNMaFTmcPl2h6u/kxgSU9M5m89V5jn9DMsUHPDXfR87Ib0MKGuzgYG+4CMbyb 2MKGuzAYhj07oUXDe7l2mgq8ebLnUw7GhrtgG7B9G0XDXQjUH+7iPmcNZgdjDWb7PRQGbjCMhZlz MJBAzEyXviP2+00s4szbAYN8srWLlKOnnlD8p/exWhJgodJq0zZ4YPxDqyRIYZB4u8kAFgbs92Bm 3g3/NDAC58y9oSr1L2If0RuiEM32TBQcgYZXaLuKJxCnyS8xYp9lsBc7oJP8jh20I3oXNHRNS+zx Nte37373nCZjIAlPmE/O2qHLPSjJg0/+SYvhcrGjzAufX/nUV1JlXEYl59I4czRtr5aeQYAcL+55 cJxXQDHMaePWS+JhRs5aPlIxct7Ood3P0M5V44v2FB8UBmwAB+4wjjAMTWBMlra3OjVMKLGjceam bHYwCM0cZkfj8G8RBiEckwr73cqNxrETTnRhYICTw+xoHENngr83fjSOcBFmqCwFVHN/nxgcXNP9 Xw5G3jAhK2C03SQReGHo7x/l4JroExyyZDzZhjYvPF/sU3jqHf3BIsclGVByd6t4AonN5CcLg/xE sLKbOEdbLLi9b0F8i9WOOULbi/Mq4pEpsIaRCqYzI1sUB3k7QHjIx/gaSrEjGnFoMkSEEmMtaNjm XTthux1zM6aHe8A4gZxXno/gSPgei4IsA0qWzj7oBkoCXzXtpJvoBDSkHBobEiAjN95jtEOmTuMu ORFj6nZUT/QJLMOLnax2VDHi9XVN8hFVqq67/3UMbDlSmx0sDLYcBjbRAINTTByA4AIIgTAKRNby QxogH4RRNxfv0AZonH1aT4DG2cb1BHCfe15PgMRlB/YgQd94zxSpaGJPgCvbdSVHiUslzAHtLZcA 9vOohWb2BEiIoT1Hhic3tIfTkJlYhJGksldj3YQebWFsao+GHoR3NdaCLtESgP9XzcVvxAZoXGBu T4DKJQb3BMhcaHKPocT3lN4uBof92lxTl9idggcabHSPg9HongnAYEwP/B6lKQYSxWr8PGFydJak wHRtsSofZI4NIBwvDObyjicpMFnXg1d/8DgPJkJDh8/cQcrhAc2cgUAKDgRzjtqxWuCM9kMCoWAs OCvm7URLvD9q8FkQw5flhT3icx8SqIcvy2cZ7iEZPgNi+NKqMv1HtxAG4vjSPJtVODWQ8FkQxweF ixkkaNeXEojjg21VezeL4bMghk/nuqUKIIuPgXr4YK9ujq6s/HBKD4IYPmaVFh8DIb4f/gd+PK5T CmVuZHN0cmVhbQplbmRvYmoKMTA3IDAgb2JqCjQ4MTQKZW5kb2JqCjEwNSAwIG9iago8PCAvVHlw ZSAvUGFnZSAvUGFyZW50IDc3IDAgUiAvUmVzb3VyY2VzIDEwOCAwIFIgL0NvbnRlbnRzIDEwNiAw IFIgL01lZGlhQm94ClswIDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjEwOCAwIG9iago8PCAvUHJvY1Nl dCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9FeHRHU3RhdGUg PDwgL0dzMQo5IDAgUiAvR3MyIDEwIDAgUiA+PiAvRm9udCA8PCAvVFQxIDggMCBSID4+ID4+CmVu ZG9iagoxMTEgMCBvYmoKPDwgL0xlbmd0aCAxMTIgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+ CnN0cmVhbQp4AbWUzWoDIRSF9z7F6S6F1NyrzoxuW7IsNCB0UboYxPSHBJLYRR+/EydlUiaLMEVd eBX5zkU8Z48V9lg8JEZIoDxT6I5IKtPvj4WV2lGNymnZ1M4gbHHvYVS+0S2qcdI5Z2GsE36LhfcM hl9jhlv4Tyx9FppKNaoAVbuqBNU0JahEBaiq0iWoVBegclXiZzHzf3u9I0lkGvggLhiiNvjrh+eY UtykOeIX2o3EMJbfu4+TWcTRldeYZRA/cyOTJslKIYuLMzMeYsJjewjv4DkUKR7U++rlqX2LYPN6 tWvFKAvIdp073atPi4Ix9DdguHvonC/6lC830zu1I+iF0Fr9ACVkEk4KZW5kc3RyZWFtCmVuZG9i agoxMTIgMCBvYmoKMjYxCmVuZG9iagoxMDkgMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCAx MTAgMCBSIC9SZXNvdXJjZXMgMTEzIDAgUiAvQ29udGVudHMgMTExIDAgUiAvTWVkaWFCb3gKWzAg MCA2MTIgNzkyXSA+PgplbmRvYmoKMTEzIDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBd IC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4gL0ZvbnQgPDwgL1RUMSA4IDAgUgovVFQzIDE4 IDAgUiA+PiA+PgplbmRvYmoKMTE1IDAgb2JqCjw8IC9MZW5ndGggMTE2IDAgUiAvRmlsdGVyIC9G bGF0ZURlY29kZSA+PgpzdHJlYW0KeAG9XUt3G7cV3vNXYNfk1KIH8+JMd6rtNjmncRpLzqJJFzQ1 ktjyofBhRTn68f3uDICLAaDhDEnVWVi50eAC9/0C8pv4Sfwm3r7bSjHbiqj+ZzsDKBrHafPv9EMx TsooF1mZjCd5mYrZUvz1WlxE4yhKJ+J6JtK4/mX8FU/KcVmWhUiLcnS9FG+vr6WQ4vpWfPP9aldt VtXuW3H9H/HhukbdBw8vnhZAmcRJYPGLoavy7keMIIsyIMhTQiDau3+/md7uRPvP+49X4l/rVSXe z++qrftfhbjc3+0BjqM4+nZ07KHjCKeOy/rQek+jhqJi6KH5pMynNHb4dI5VkzI7ddUgg8y2ExK8 lniBNb3JMWokmMmRZGC8jIW/7J+HLsr7ttQiIcmVuQwguNB/LESjYXqRk9hm8SSw+p+HCl5w+3mC 7Wd5QQgcvurdt/+2ztJtSzxOSAlSyTQPnqWv5VCrBs8iY1BLZoH1+QjW9geyQqaQJFmGGH0eVkgy grKs9/8yK6wDdNNf2XLWBDnBAWDzfU731wTPQVgmVk7InKU1AkeDmf79rbknP+Au9g/zfQZVZqoY I+yvOtjqBKWSDVsUOWQ5wrAFURgb52F4Fj9PF/sKiJ7F+2o728wfdvP1ip3ds/hhVS3Xq/kMv3G1 m+72W/qPz+JTdRb7IgtiWgaljyJHqG+rTbWaVeL5eJFm5nmr92del0wb5sVZcjrzWOo0x/xl++ti lyk0XslHYHTRIvtAU2i8kr/6eUyh8UpA4EiN2X7rB+ss3VbRsyrGK4XOck6v5K/PJ7C2P5AVxiv5 y5+HFcYrdbLCOkA3/V/0Sv7y/TWhS4ONV/IJxPQ/h1fy1+9/AE8qjWHzV+1v2LoMBBs2pH8nh9ud Xin2MDwjp2z+kJ/ZVpuv1Y0CKPBQ38OWVQeBFlY/p4rGhSzzaFKSsEZJGcucfqphhTicJ3dRVsYI qWWWIjl0Kfvpw9WHTz9/eM/aEo0oNT+M0FeblLAUExuLf84T0n02LFHumOBn8fHtpWGg9TOf6wDi Dnn3iGbJ+9u/o5xxh3KGzz4ym8y+JErGGRU28jQbFykKG0uRZNKBLdqwhAoggKlvR/Stgt2L26Zm QqzCLmLaxYEzto3SKFxLkZlbjQBdh5KxU/t8DM+o2ig1Y1Sg32kq0XXcHDFglEeF8DdzfV/xJpjG B2jbpX+U5USTCWpTHm2vvrscSls2LAVlygWqNf66g91HkGMUKUdlkgYQJEVqU0mzioT+COvVZlW7 yldiEzIqJ7QJR+3vp9v7Wm6Yhn3ril38MgGYT1dkJN9d0tkpIflhurqZ7tabJ/z8C/uHM8jt6KWS pySex1kc4Mjufr5lOvQTV5YlWdLCqLr4Z7b4rM1dmk6U5YrLcRaX6Wgp0om2ZgoGy9WCRWT1ALO/ VTCyZjLP6jVHeZKOM7J8SyELLF9bTQ1btGEQf1pTfyvoWwXDmqM40fvU3y9FXOp9atiiDVPft74l 2GghaJ9HGdu2SJtQR0rpiDQEqzcTPa2xSh86nQMGJ5h6bixtLcHmx/5IuxSnpGpXhHqXj5UxMarR ASH1zmcVOVlH6wOOrNo/HxB6yX/6J/VdRzTBu3/Em/Vsv6xWds+hV+oUNL2ypNLVJLdJqaKpT397 l8dJymLS1+a16en4fwkzm0Qh1v2bOUbC3y/emTTKLHJZoHNTK3Na6BBIw2AMGAZNhSGBMqtPR7k0 INI7/tU4Gdd2YymyWKPRsIUNixs7shhZ32pYrcuGcv2Vmkwzm02jyejjtHOWweLGi4INoFlSIFZ0 FrU4cUB3umTYbFqeoa8RlF5jfVwErJDPfJb/U6Tn7mW6uFtv5rv7JWwEK9MJdOVIxUVlrBDjGZhn BcnMRtDtlDCd2zbQbATxi7UXHb5x8kmWi7OXA0RRhoUl2BQLagmzjbNFaW1L2HlH0RjNUHL87KQ1 jJ30KAestim242fYACfdS0sukteukvsYnkXM7DlAfXUIpj4l4lGMf/fXPU9eQH2nKC6SAII4KSFj z+Lzarrdzu9WrTIKdP7o1rQpYliHUg6x/6HaHrAdlMmYEg1kaEDgB2W14vRmSRtP29OaMoZ1EDW1 YNnEQ7m8x3RJ8wSyrLfveI3+9OnSB5lRhhCFmG6sikWgE0If1RW06KMYPYA+nklCq5d6jUWAvf3p 0+Yr5MeKuE1qZu1b8TVEHzK1L4+9eOw1rUZ/dduQ1/WKw8W7wPIUbqKU4C8fsNiBDLftL3T0lxXp WDapXBapVMzAEKoxLBnnTSqno78MkaECkUE/IlKz5obaGmjin4tJwFFbMtyLR0HPrAMgHwMsexoN xWHZdvCpHkvyV+4vxl1qbsaSfAQxSsjP4p+b+dfprhKft9TEVX+sAqz1I36bDX5AaIi+Q4KMjrKI Vm6Po78gXSpknP+baQ5ZQpH7sJZ4NgTWDzsuMmHR5tgSN7OUVXvihXHWpv0YbRD5OlTeo1lA5dNU VU2yyWRcqopPqbIvDaPqjg1LdcXH+lbBrCDtlDIAqzLcN9xeK9QcENZ7ht3K8YwuA4UTGECZs6xW gRfaRsy/fkFc0JiYMP+iOaQ96DjAJXoSwCGVv+55jAnWVTGVj0GbDotEJ8QMehRKkciWgwEk8jSe oyocwGF+fxJ50mWHDSaseplElj6eIkY6rvIRDSCRL0UmsPLX7U+iLpfEkZWPQUsRk6inOQnZX3f5 0TdHxFaeDJlkmGTTkSHedldprW3oTYSUy6YbiDqYCaQ0zA6ucrjeVnAlMgbBENcd39oh9i+DWcFV O42yLPLEm/YdbpGZTWyGvXX7jzV0aaKZULqQk9hNofRkhmWtekWHvH8zohRYvv8BuvTEzCgFMOj9 t//m6OyAXfGE2vJJTCwVC/U/jccOy+3qsQk6jKM1fIje7PAPwB7DW/+EA9iWXU/PdrOj9xF8y2sM OrNAZZz9T9AlUKbZ0esEI7rf0ZnVekzg0LelciO6wtH/CIFldTbry45lcQfvVt83uUDW4ojk4GU5 0rNEho1nnLujOsbTmR+GSg6jtNRsQsXCCRJ/H+P19MuiEvFfxL9+/Pjhh/fiO2q3X5qq+afqbr7d bZ5OMCITStsSFCot5GdIqAyfEukOa1p8OjUh7dIcZmSCixjtzhD4N5Rz7EWMF/TXvR66alAe2Av6 GDAZ8/3lx0vxsF7MZ0/idr0RTZV3vroTq+pRfKXR7q3YrcUOvxsUm+OlheMoa2e+tOi2gqlBRWVz k8wOkzTMDpMAwyw/tfntTwmEvNbKV3taOUXdl0pPKYaPTpaLMAepOo/7RRc+io1SWbG9ny4W4ksl rh6q2fx2PpvWQ/ifqt/28011M5RJwX1IklVc8ag34pjLNxAccVOP/39Bi2C+EqZOMx4qxqwc7E78 o1s650pIWhZ13wlDLFmkShUaBta3YKrvpCWEfk2B7CrlaFggbZ3AmC6EJ1o+fBnv57mCXGHLlEVu XJWPhbiqZnt0RZ/Eu/VqO7+pNrVknDBZZLqiF0Coj6QL4yfw2lAqS72JxaHLHqIUps/aupqPJWh1 udtNZ//disu76XyFy5e10eM7mkO1iMXAxL4ZYz5WCnhVZn2epo5CWuoxVLiC8UuOa2ltkh3h9oJs MR7QR0Gjm38Q/W+aO7KwcetHuCOAN9Wsmn+tNuSb8Nd8KG+CW5F65PkCe3EIevsEvNNGJlgcXzPm kBTKxUkuaDcO8ee4D31Xq/X6VrMa8brpqgzluRVAstH1iVAzg0+vDe9BKqQY56G5P4gWSsw0FmSb Zg2zTTNger5QfYstGtjrFTkmSeEwfrYGrVe7/hbTS1/M1fMLf3XNvN432llwg3o6QTejQ087OTXq 3ULhTViCYxQZe3BoeD/9Wq3+tEOAUq3Ecn2DCAVRAgtSX7ntCtHNsOKFT4PtnK4Bkt0wEjyqXxHo pEfvltIoSA8ZI2uVOVIxf0OPCJfuqhV54+rm7cP+y2K+vT9XnKYvRBJehxG1IWW6DzIT7cjXDDQG TrcTdD5Go+1EmmkzEMXjUvWRpZoiTDUMZsCG1RNEaESpbwX9noKRGcC7EvVEMSJEPZgYk0GhKWMD w7ARw8wUIn/agNRAcCLdzzEMzdhNgGjBzJL621FKFdxm/vHoVOOlQmyRuFnwbL182EOSmOR9NQrG qj0BycYKaBxTckIoz21of9mApAT0MjyRkGD6u25BYrhcOwoDwzwZw6JG4kw2OMK7JBpkx/rHDYS3 lYMjs6LoHDY7eM5BGtoWGGOPsQfHDPyMiMkkifOtQNlnvaqfIXm8h4U2hhL/abrYroWa/HrEdKXA wyVXH96dJd6KI6oXFVJc+Fv8fhUQC+h9o9lU1TCDKCrFM7DFyKR4CbIKNXXC3zKM+K6tQFJgL3qy 2aBpYLAM/DlmYCaNZvOnBjRA2bucGQtQiac52g4dAQnr+QH5UDg4ZzBC4a/7n6GrBr0e15t8DPvV rC5LnCBHfBJzmenCQqSSqje9j+IFa5BE3JGapIKWddTGksgDdFfLMoWsYI0DFWvjKoFupTaz6UpM 9wCtdlTQoQCGEpCzqB6Pz/nH1GEStH8oHdWBHWuoXyGyOaUOHIwTdDUmyYu600mFHKlVUsGokGPD UlJdY9wFfapALZU8fiTBUklIR3s0xQRw4guliSrMxDT63XxFN8qYjH39sqe4kogoEUySbLYNguWW z+RPWMukhImWuDJIeF9WBx3hGc5lk3HeGNM4RyRE0ViiYYjGFGxEMNkYU/tTBTrGLXuEY77JKHbz 6P4C3s9ayyj3ilfD2wNsNkLpVQDHJQxFXbuqNm/E4/0ao3x36+lCQINRH6kTrqcm9VHZLDIxVPsr Md/R7+y3w1MPFhGeolM7s4d1+hPYM5nW2S0eSuleFh9SiPKQWHbZuEZcBXObdUqtv87hwJZvxHL6 JGas1AecQZfosBcLYFUVWzEVq/3yC4pdKPYgd66ftdmJ6cPDZj2d3Vfb8VCXwMyT5O9i1Jhs9Ocs TYKWbrZygkxY7LJkIpadQfYJ7GGZ8HFcw85rrRPL+d39TjxUG6jVEgy7WT+u7jbTG/0rpIdw53vU 4OtLFFSHOIFtHDnLZmOvqnNx5kVCA4xaP50DDsetXeMCNFmnx/sn6mLUkWMqdtMFKvTTL+v9Dg0n vAq5nK+oXYnEBY4XKrIRqzWipPUJOqHvTtOAF+3qVYmL24GuXz07cekiaDtmqH5Ho3Cnkrk6v8PD XBv0eqkJbCIY9PG2u+pByBNEFRdRKYmawMQ02ziJmmy5LP1PMrfzdXYTk+AmTpuCQ9xOlwdgE+Pj CJmYoXIdDCYstwOsjvy9bMTgBjd4y+0rKRz1ZSArS4QRlifsFV9bTDSpgXRPP/rmBCaGY4c0ff3Y ATgcQVFjE+hYrTc3W2rJ7mf3cBE1JZsgjQzZbFeP56xXiydxlgRZUqIZ487xhWw2dZLiBcXI0sG0 9Nz82c0YcDi0xYDKHG920IODeLyj21sgUpr9lyT3plrNp4uhesRCa80vNzuyCdt/RNrzi5bQmkcN wTuPsOtbS+EGTujZQuEtPHjvFk3YZ/obPkGRwwFflnqJ3ABh62eNfRzV75iPqx+UROC9vkVwotxj XAsfRXa1E6WxKS2V+leSUzwoK3KzKVveBtOWeWZpb1a4bc/B67KBCPMsT9wY5Pwe1McBD9pbWZRc MIH44jWSGG/3Q9dlAlmKzlevAyic7GK6QLhbB2dXsGXL6o0zwfmG/LF6ThwN1sXN9ngbx8N5al8n yVzw6Jb45YUXwA3QZ8+QWgLI0RVwOM4D2TRFui3/rN1z06RuxuiQbqBUEvLRp9BXtz5ks7FXpS/6 FU6MN0T3+tEXOBz6Np0iyxpahcp+OTmrIl1Kigo8lEWj6y6i/rbKU3FLCCdd9yb77feQnBe4It7O IvJxbA2efd7NF/M/KEZRQvnTHp266gQ9tu4ENshPkjPmh0W3YuLOSvXnR5doWShK+erDtXh33cXx cY032MAL+HB6jE1sW7O1D5sKQy27rZgt5vXft5v1UiyHmoSgyMAmoCoX43ED2pajulMKYjFwu7La /QfEU5GZ2WeehwshOD/7cs95DjDv/cK10sNRv/q6QUWD+ILSxsN6dUPs3K3faPX6rVEvMvr0RCx+ +eq7Hz//4734+OP1UEaGiVvv6iSdCwoI60Yc+XciBhC3SwGN7yQcjt2aTRez/YKaktaAJkbAn1bT JZqVCySxv35DtaQKFWpBdH769VsaEq81iTqbXwY//84U5vKn2trrUjh35yfO7j3xkq9bwqamDBFs Kt798zPJ73q/wRBb9fv9FP9jmDrjrVs+pyQW9cgE3ii+UPhPIqPFHjPLjeK0VzruHTd3yaalAPQS ctup2vIf6Ijy9dv+E498uIQuWNHDzrg1xpiPbZkEtZsVDxgc6/8jym5NswGtvHqgX9yvH8Vjhfsf TNmBbebgLtD5ReuXekP2QVXf3gTNZFa3qBvP1vvFDd1AqeV2qPEMb0A/jlpvwKEDnPKUz3u8/6Oz OUtbdNR97U4pojnRomlyjyD5GEfDo1l48wx3t+vGt4FR41vDCpo9w+8t9KdiwiA0vvkSd1KOk4xe msbz0qqnntIdPxuE+SQN4lcW1Yfuw4tmvQjBZ/NytflYg3g962q5Xs8CUYder5fR3GQz263XMyBe Ly3V6CfewW4ONrJA9nppko+T9noGZK3HU+FmPQa11sNUaf2/IMM4pyJWqkG8njWRoNezQPZ6zbxY zWq9ngHxepOEnlepGa3Xs0C03k//AwlNe54KZW5kc3RyZWFtCmVuZG9iagoxMTYgMCBvYmoKNTA3 OAplbmRvYmoKMTE0IDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMTEwIDAgUiAvUmVzb3Vy Y2VzIDExNyAwIFIgL0NvbnRlbnRzIDExNSAwIFIgL01lZGlhQm94ClswIDAgNjEyIDc5Ml0gPj4K ZW5kb2JqCjExNyAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8 PCAvQ3MxIDcgMCBSID4+IC9FeHRHU3RhdGUgPDwgL0dzMQo5IDAgUiAvR3MyIDEwIDAgUiA+PiAv Rm9udCA8PCAvVFQxIDggMCBSID4+ID4+CmVuZG9iagoxMTkgMCBvYmoKPDwgL0xlbmd0aCAxMjAg MCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4AbVWy3KbMBTd8xWnu2bGIZIQBi3b 2sukTcJMZ9rpQsVyooaHg5RO2q+v8AOwzQKcGhaIx5xz79G59/KMWzzj6pOhSA3I+jSpe0R8xjf3 9SL2A0GmCEXgR1PBkeb4mOCS+ITwCEkKztYfuwuLhC+EiMFj4SU5rpKEgiJZ4j2ACyS/ME/WrOMo vJYiCEOfUFYzYJ9hoY2t9M8XqxZYqELLbDCht8mpZYmJY4nDPprLsai9SsWB0y8WQU8e5XIsQyfu 2MGKiPfA/p+4hROGEhr2EBhV/dapgsxXmV7qVFpdFpDWyvTJB5JHhW+fb+bXM9zdQZsLb5wb2iQZ cVmyfe28rcsGSzfMxpyd28YurX0b5+VCVdKq7A+M/qsWE+Qv6SMy/aRgnYaze6ef0/ODe108ZB1R T1eU1n5n3NVtG855FA1EeGZFHcOBomlZbBuDgVytqvJV5xuBOYEtMQ1RplZZU99IzG7uUSmzKguj JliW1Rt0Fa5bsYihE9Spunb8v+uyAY8OxRzr/z5UQs6AysLgrahtI+3Mg2bkMDej9ivpqzJGZWYC ZSEzVzLNMX9dabfFuJaVKy06ASNjN7kNpjP/KK/bYxw4vOlBtow27NvF9y/yQYGGPwbv2dGYajrh cfLDp+0x6s5fNNzN2GA7xd+dHmt8jNr8G7Sot/8AI9ziWAplbmRzdHJlYW0KZW5kb2JqCjEyMCAw IG9iago1MTIKZW5kb2JqCjExOCAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDExMCAwIFIg L1Jlc291cmNlcyAxMjEgMCBSIC9Db250ZW50cyAxMTkgMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3 OTJdID4+CmVuZG9iagoxMjEgMCBvYmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9y U3BhY2UgPDwgL0NzMSA3IDAgUiA+PiAvRm9udCA8PCAvVFQxIDggMCBSCi9UVDMgMTggMCBSID4+ ID4+CmVuZG9iagoxMjMgMCBvYmoKPDwgL0xlbmd0aCAxMjQgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVj b2RlID4+CnN0cmVhbQp4AbVcSZPjthW+61fglnFVSya48+jM2IkrXmc6lYrjHNgSJTGRRJnLTHp+ fb4HggAEciRqYXKIjbTwgLd+bwH/YL+yP9jXbyvOlhVzxH+rJZacheu3/07/EC+8xAlZkHiLKEx8 ttyzPz+zubNwHD9iz0vmu+KP8T9ulCySJImZHyez5z37+vmZM86e1+zN94c6Kw9Z/RV7/g/79lmQ HkNHb+7HIOm53sDm82t31aefaQKBE4BA6BMBdnr6d2W6rtnpf9799IH9Vhwy9i7fZJX9/zL2TbNp sOw6rvPV7NZLuw5u7Sbi0t2ZZi1H2bWX1jfVcvJdS06P2NVLgnt3HRSQOrZHineiXhDNaHbMzmiw F0AHuMv6FJZNWWaHevfKVtk6P2QrtmrlXr8es2oB+krIziLmSehECVmS4yUuD+mfxFrMRpnY7Esm xjkUgvvhwAnfZmWd5gecsKi3WSn5MSMjH2NpmuWGRfMADHGdiMhZMv3ZIAJzvs5/GGbHQ1JxNx64 0WNkyiMYtusNCfX9eybE98SqZrllaUVMm93knlzuOQvP4eY1+pb69V/gbTfwtpdUxIv5IiC/G0b+ IvQTf7ZnPrfW2O50jZN/3rGT38q1LVszN2l/Pwvhp8MYf7s3/1aunfw+gfDFnt1vcR61hj1nSuy4 mUs3u0PZtH07jqVs19h3L0IZyqbs23EsDwJ3/rdv//nElumBlVnV7GqWH9guLTdZydL9cZev82Va 58WBZet1tqyrhbb4cZfWDpiHUBY4BObpc/SV5dpdFf/cwLP5N9o7nuOeJgDFPHXA4cKDD3yfVfku zw7LjKWHFfuuTDcG4dnNbiiBBXOHB4imirDkF+jVrwaRUb7OkIQDSXAX2MUJ7+WZ3lUxigc2EBrv 00ZJgnOggUlDYZ/Cbz//9O2P74SlvGSsqRAL6wJhsYZVwGiWBawF/8KKki2LsmyONf7iM0GlVVqn 7FjmRXm77bgOhSRANONgt9rOYMxTwgt9WyOuQBnnpNd5IWDNU9mBjXldEUufGIXX7OWVGFpmaZUf NuSXpHlp9l2MJJe9CIENrbvcI4QB8NI73XjVPQexuE/GHHv9/XHZ0YZ8ngLdIAn6FA5FDeaClQad UV7JYE+HJgbYoxDgZZ5/MYfiEYUGD4Hf1j5pS8KI9PlVAL5A8xzDAFJBMx5g2BN7aWpDKoRfZqPw i5dI/OKEi8gVWMNPgtO1GfCLueYC5xB+MX8r1wi/qKuOxBpnr9ylqtxOJdJdBSs81GWxapZkdVWx zya0t5jSzjhwWe8kBt/vEG4M2ToxUsje/qvskKc7rUrjiGhTSMjMuBf1dx6fkJ+TEXfIU/C4v3+x vv3UnOIHd8P+ro86NbFlgN1VVn7Ml5k+udDn2ah8kNyFZjx36QoBQuCp8s7eGCozOtVwHZlWBLBF n0wQaYHTmu9MrcEs5RpKQf4iaVMN47dqbdhUR7nZ8/F47inQ3gX8ewKywdAuIIOCFfLXgLAWxLw3 4kqV1+IMoDCOH4fMuKAsmxnyHGedgxwMycUEbjRAADF3n/6X3NymKFDTIICWH7S7u0BVohx9F46K AeoTrkmqE5bW/HG7Dt5FFUD6skpbkHkjmdlJKZOTSvAoMO8hZdIc0o9pvktfdoYtX7hRT+YqA5xK 5jzEBVzUb/sE8vXVamUIuMMn/X1F9WRUcfes14/o4EPnLvajRXuWAEVc148HOJNdzZhhHY3pCsGQ QYvS3GOouBQe3ZgP3IPM+FpeaRG7CJEoOg+5iwedvKuV9XUorwwSMoTNuB+1wDGI/YUoaO1Z4HVR q1vbmWteW+DaMeO37RpAJ0WokRiyl8YZUUMlivPILo7u88pKM66sS/jQIMdFltTf22DQBa/TO7xR CVPtFBCwslCdt2sdUtj7Aslzhkeew4nElSyKKB390rzs8go5byVKR8viUDV7+rdiLdx6hVrCgerb FKvaCsTtUUq1VYzL96PUaAQVybwmiNxFjLoqarVIcKXKyjXkNSdrfltXNX8ql0z8NHuomgI3WvDm 0XXVOUhYsi0zJK6rilXbotmtGCpG6ae0RHVoTSWOKmP11cWgYafrQr14gMDRv2a6yor1mro0/9jm O5DcZpTioZ9D9dz86sBl+MoudR64+XhDPWc12svwyLV4e434ztFQ+LdPAiWpKkPzq2WaquI9Mbg4 WOQ63zSlKIvDUkuWU+lvD762lfKXBrUCCPsRlmocrW+qF7xSzxEOenEU5Kc2D6r5n5b8NtkhK9Md unb5YZVXNdxbAz9I6JKty2Kv9TTdsRqNiKzEnzxJJwmLup23nBJ4NwJMMY41FW/DXnn9ntzNCGRK d91Q9QYkUt9lqShNy8ybrQHbockV+7TNDuwjOKl6OsAd4Oy6KPfZPRxV4Ng4zEQc9XivyfNojoKE pa1pUxd72PaSNHah4cEF+5O+R7tNKqI6YQLo2iNxtdfUu2pX6YW9tsi1hx0MMpqC78QWbx7ujPsk xLzJUSOlffrKPqWHuu2/HHfFq4RGbFOmq4aE9ER6vU2PFXt5vcdVUIU4RM5kHGoixQb0ndoNg4Ql vKZGleczYUvqU7XYhDpVH1M0stCPYdu0woDAblOUeb3dVwxgldpad9VKVCJqnGcipgZOb9Ln0d4C JCymfkBDkABWIJrDH/I9qiYlqSQwYX5Enxi9LlOFAe5rVKQRCztkcRdyIJVFU2NuHGwq7vqTI4fA t5HDSfxSoa2gAaAUqAuOoaRkqYUKO+gx5hgoubrDC3SlGeMwD+UojwiR+MDwoGA5gawsATAxh6dG m24YIlTN4wEC4wNPD04acERHiAAVlFOs9/AI0SexkRly9j8CimoSQ9gT+j0YzPgE/yUSoHWW1kBD jxhjmRsHuVUhhsJ46NtN0EcLKUxsoBBRMaKFginx6y0qEfkKGJ1cWZcpjp6q07fi3aTJ/ITmjKZj r76V3lbrW+TFlslcva3GPIMaHcGbTqzRfRLPW2BzpKAyVUdQLj5CHgLYo3WRtUV/AxSZ5YU7fF1M rgi5kXGiW1Vbs3Uw74y9yZE8SFiSk9mOUPEy+6PJS5G3t9U3SuPltJsowGEGZdesCB3J2Z/376u7 oI/2w8bJpmJvbDf1rvHD53y9Sj2hKxZ7217UHRlSQMVSjMqweX/z8XbdS7y0u0jQD7SM+cEpUhLZ 803RgsO7PoSMT/xx4QfnfTIfvv/xlx++ZR/++o0X+5LaDR6b0I4TRWiwnJB4nMfmjssndtmcsmxL zA+SgNL+ARrfANi31VU46mOZfcyLpiLkT5VXKZ5quYXLEQmAdtP3Ntdhrl+enSebwqwTKsR9rtBo mFbMrt0xu1DY6HkHw8HrFi+Rs+SMMrhB7dI0+IVTnCvtqun3oUunR0RTZLmU5Go76foeXtecoIGs WA6GJHKuS61hMMRc8+QMuvztjP5OrlFjw+eylad+j7n2rlei1jAXZq61v5+d/NbY86YeyWm7X7tF TJXaZUREwzIF/kDRS8tsnEg0TqOHFI6PhxvzAQod8694R3FO5nqgZIAWapy334KGCpwQpa8Lt+hU SJkzjf8MPYVRKuaiX9aOCaqOLR57tWtGF5fWHHoOsWPmT2kJHTazdTa2w3uOkaZahDaCugZFnCOi /Sg8huWrqfKEZwjUdqngO9OauiksQwqHbF48TqCuyzbfbJH1r14P6T5fIsJSnVD71AuqKn2YVlX0 KSEtTCRCyOJEM+Mhn6Gq4/a9AH45pg0s33gNY3sO2EhcNGNBw2KskS/IxuQSnF03svgkMj4RrEgC KAdK3AtZiJdCQiBPt7NYN6Dp/jjbtCwO7PmECVgc2HASAxBIn/MancLNtsZzAWIlChGir6+jzR1a xOl1JBoI1Hu1b6gGB9qZtt/fZIvNAu+80I0+rNLylcFW7pnfUr0zom0p13gbOecXDOfjIQ+YGsT1 aVDbDBMYv39F7QUqKOFJD7pnRVMu4Y1Q15UvIBEXlw0KjKiPELpXU/DK+dPsy5Dzvyz6L2O57tXg HLNENnO+a0pykPuixDsKGe+uedU37LK6p7iCouWyvjODagcex72FMxyWS8OTdJ2hSxlK1YuumsEU Z/VD08CRaMuNYjU45cppFbWGwSm9FnWDU91vZ26k1loEJwevMJ3Uvg7EMJai061hT73mti8AdkBw 6rfd2k0x+xzKN80GMWxys+nREAFC+Lq0yqon8oCoYNEYzB45kahcUSCXEUXU67tnVNSX1vZz2Tys sfCE4jY16TC9SjefNKgA9VtG8PigAhqWAPsuh9U5skiqEeabg2joi1fau6wSiOlABcNjumkHUuhv q9s5rMtWvD3apBxGtjA5hykjOTURerh5bYIw6DD1CCPvU2mOmFFth7DKj3hyc0cXggq1DlVo5pLO XULRMNhwJH7Sq9COZtE5hGqQCHy7EXGNOZ3DERoG92k8oxyDmY5tUVZ/soe3fn/T9W85UBZQQFsF RujHE+niKOrxdXG7MeGFHsaMMdM2x9QeXf4uuQ2qoMnfuNcduaIOdk6IBn9jeyakHX4Uw1pldizK mr395e+YJ0g3Iqugx54FKvEddiJxVMW6FgOSn9CtRRi5YxzJcFeBONqkHA69yec2kI7aWA/QtB2h gzdpg0NFkI8R+KOM+cBiemP/wzuZRKu3G2K67h7tpSF5PAKdy0NNy9t48vENfIfDRkv/evvbuw// BqYnvazFSOJLtis+IQfunmKMLqsP2qd6iwcm9m64T8v8syh7qOIk1cemrJWSKYtHPwPMQEZhxEVg fHz7YvTbveHbU4TkaEAP3R6JFr5B0eoykW6L5qOjjgwIRjRTr0UG7mZcrJdbfKly53lywp0nEsvj 2WAg8w21huqwuUaveVG6O/nt1C9855gctmHk42Nrn4bsbxCeajtR1gwZZvSK5oj+CN7gUT0JAPZz Jo3tPcDRPb5JRdb2WJP6pqj3+uUa7o6LrKBhwdRlsWv2NLsvqnT7DI4+3RcNZiFpeI9SAsRVRh/4 KVB6agsU7Qx7GyXuKN7puWnenmtS9sZubwbm4cAFNCz2ls1BvLRBlYfy1mKFr6xAf8uVgCa6enev Oz4V/2lThtM7NO5RiO0fEBk0uUUhaTGuCU34hNlMDCnQ6e4u9+hRNCJu5WEoA+/zVfttN/VBu7Fl nwHXTOaKL5oM3fOOEQKjyNzn3y0u3/dk6YgHeEtHD5io9CNLOmqNSj/GGkdXhz70YP6W1mS7xo26 MBLE4kNX2NP4W7mmfz/j+Dv5UauT3xofulKSGNkZ7Euk+zoEJIL+/2mCbHDuQoXm3L4Jvmswyb6h jZAfcl489Ld7Uw/aN6T2h/mpyMfsy/HRukn2xQuzL+7bgSfqeQf08ba4/aICfbyN3j4aS1B/tYRP vEntVT/US1RzVcvUPSd7MvaTS8Z+9AzR2s9YMvfz/EDYsbFft2Ts1/VcsdQdxFgy93PjWHwZwtiv WzL2MwrK3X7GkrkfIu0CX+M079stGfvBRttCtD6fsXSyX+gv6JWlcT4ul8z94N2kh+rOR87NcFq/ /h8EY+PiCmVuZHN0cmVhbQplbmRvYmoKMTI0IDAgb2JqCjQxNTMKZW5kb2JqCjEyMiAwIG9iago8 PCAvVHlwZSAvUGFnZSAvUGFyZW50IDExMCAwIFIgL1Jlc291cmNlcyAxMjUgMCBSIC9Db250ZW50 cyAxMjMgMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9iagoxMjUgMCBvYmoKPDwg L1Byb2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0NzMSA3IDAgUiA+PiAvRXh0 R1N0YXRlIDw8IC9HczEKOSAwIFIgL0dzMiAxMCAwIFIgPj4gL0ZvbnQgPDwgL1RUMSA4IDAgUiA+ PiA+PgplbmRvYmoKMTI3IDAgb2JqCjw8IC9MZW5ndGggMTI4IDAgUiAvRmlsdGVyIC9GbGF0ZURl Y29kZSA+PgpzdHJlYW0KeAGdkUtvwjAQhO/5FcOtSOCsnU3ivbbiWAkkSxwQh8gyfQikgjnw8xsS wFTqgWAfvH5oZj/PHgvskb9FDR9B3Yy+PSJluN+fC6sKoQqlFKquhOF3eHWYkiLiGs6DTfe4XUwt SkQs2Ermdsid09BwG7wsQ4xhGycIxzHcN2auc3/EKumXZamIufpHH0NVE0B2Z2BbLLadAf4CNFuF NGann69DiHhvDv4TegJDRqfrvlrNm48AXa3H2bPEhtqOjBRn4mtDWf+jg4kTZsqJzSWn4pLTaOg/ JlV7S/+mek3/rtfFL/JRhbQKZW5kc3RyZWFtCmVuZG9iagoxMjggMCBvYmoKMjMwCmVuZG9iagox MjYgMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCAxMTAgMCBSIC9SZXNvdXJjZXMgMTI5IDAg UiAvQ29udGVudHMgMTI3IDAgUiAvTWVkaWFCb3gKWzAgMCA2MTIgNzkyXSA+PgplbmRvYmoKMTI5 IDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAw IFIgPj4gL0ZvbnQgPDwgL1RUMSA4IDAgUgovVFQzIDE4IDAgUiA+PiA+PgplbmRvYmoKMTMxIDAg b2JqCjw8IC9MZW5ndGggMTMyIDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAG9 XFtz2zYWftevwPTJmVoKwTv7lmuTXrap7ZnM7GYfaIm2WEukQlJO3emP3+/wBhBgZVKiNnmwDcs4 wDnf+c4FIL+y39lX9vJNztkyZ0b5P19iyFiYdvUzfeMvrMBwmRNYC88NbLbcstc3bG4sDMP22M2S 2Wb5YXwxvWARBIHPbD+Y3WzZy5sbzji7uWMXH5MiypKoeMFu/mDvbkrRQ+SIyW0fIi3T6pl8PnZW sfqZEOAYDgS4Nglg3dW/zcK7gnX/vf3XNft3mkTsbXwf5epvGXu1v99j2DRM48Xs2E2bBnZtBuWm mzXNKo2ysZsWOxV2sk3FTlPMagXOqbP2GqhdtkXA68Craxr8NFg5swrPQjkewcANmC7k+7GTil1I TuJZwLFn9cw/7/t3PHa46TgL7nR2UmNn+E4OuTs3AU7ulltRDK7uZLDmIG8GehHm4C55gOn36Gv4 LjQjc7KyaZk9s46GTq+VBVYNYwhWZyM4sVdgC1vDUGzxd+kcJVVdx39F7MvF1VX+5QX7m12FBf24 zaPly6srGhpspwMa1Td8/KytGk3HUtU4dtZetVnk7Yblsx4BCqmQvDFmEhhubNORMaOwOBzChxyx oRTMr9he9cPy57GKExtpKaWzkzLAD99JDZ1ec7SUogtQt3K8OVpKkYQcS4ySbhpK0a0wnFI0K0v5 ifAFpGMTh79eY7Sw1eRVlNL4BzfKDR7nG5wjHnJyQCGlNsbotE4yBqfYh58xq+IS0xiDc4p9tisv u051gwDUWv+jLNn1rUmIVVJQLWn4Vg75XIsryhUG4GqMnQ/iCvIU27R6g/o44shgptLTBg5i55bN 9E0Nh5Ue5Bqw6rMOX+shW/AGt7oAFFZdXDkOB66OLi3aFEgSdWxp0WtmgSvOFTs37tF+HWvoXoEN X3GOCqlTHghcAVUSrGbDil2JV6ge4xbTRcxPsESLVbHwSS3RciyWrVgCqFJhZTiT0JWuomlcpIUV KvWulVs0Nd+MTREOosq1FdU1oBqDXal1Muu0TgKiK4M7TNsVIVaC7HP9GZ2zDAqFpqvPfAoR1n6g rXYaG/PGI7T5Ca8KYF3DnIQHhaxJna/FK/cUADUwbb+OQRJVyQfxytUeSYXXEk4dPM3G9eG4QQmb aTJNwCkU2IBUTDqpEXjD26oNSjwpgPLtiRhQtcA0ztECam79f1sLkKcgmCBVAaqDqCEdZKmwwQxg KO4zfUMnUVSNU33WaewAjqqIVRdQoUqCFTRiAIOT8JQkblIfEbjyVC9pGar5ZlKmmnuqo/zdoGoE rLTAF1Cqxi2P6fOfBKsGrNqqp4JVg1tNQA0rFVf2RLgS8s6EK7SPFAJp8NR+HQsskZo32f8cUpTE cJreVNNl6xGg9qaqNtvxpVnTuZdF1TYZvhetlyR31ZvWPUlQbNJuZowt/jGx5XSsxpGzyXup+xe1 pMFyNBdvO3k9kw9XlD5t08rrmXa0kwuECoLlnqlAdPS0vbmfkGDynl7OWEX3yrAQ9Qxusrku4n2a sejPcLvbRJfsNsyjFUsTVqwjFt6mjxErwlv6TVzgu4coZ+Ful6V/xlscQ2yeECK5dXwRbVISYfq8 s64z8Zjpak3FESeOml9KqZBQrqv2eHFIkyarnBUpW4ab5X5Dhzchu/7466df3rHrD68s32ar6iz6 DoYI2V90Ov0tLtbMNC9RRE6iXLGuMynX4uohBoLDYOQOUi5EKO6HE7FLFiYrAuoeh/YLhzX6VnVp GQYpk+FPFsdrlFM0MS0XOa9YzLEa7aMYy1VbPdMoUVCMjXxWa8AMNlRNuocpRhdxs47yiN1GyXK9 DbMHcEhRRNsdGCVl0bZxim9plhcnGMemFMxH5igtoDbO8NRRg6Icf22qHQKwFSQo8XcJ4mT5MkrC LE5LUBJbjlWshImWGaXdnOcEYY5tnR0Tmog4gfHD5TLdJ8ABok0RbyOWRV/3cYYQVBJmkiYxaJPO v+kTJTXCs0/AiE8O7CAOSns+1oF7vUB4mmNo13SmpkSIUAyH0LyM8jxO7heMvQuXa5belbrzDeP7 UoE5+xZlEdtGYb4vFb3Ookr5FZker1wRzKV1nUu5tnoKNXm8cWw1GQMGExY+Rll4H60uqyAdInrf 3UGjQHGGWJRuWZ5mBQzQaD5OdghOq7AIj1ctD8A8JvLPubSqc6k26GkkDCYyjT/78iQnUHsHO7Bm VoYDwmwNzi2UupAkj+55NkW/Lo8dbwvh4a7dHmacyRZuoOYDPvz6UxY/hssn9iZN8ngFOBYxvpMU dbiVp1VOAQVOw0FaA3kKoQzPP7RphaI83BRQko6xq32GbD3/7CFMF3GzjnOW76JlfIcwRUZg6zBn Scri7S5cFlRH7fMoY0A3GeyUzNOhC3U4aZxLyzgWdFKW0dz9nfuWlsAPNtEhnxcg8H218R0Ay6+W D0n6bROt7snbTwCxRxWu50FDuqBJQByYKmmNnvYZEAdeyydNpjciYxiUm+sikJuzcF+skXwjouVr IuFiHSYP7G34GK/Y6024fAgv2fUyLQr2Id1souQ2Wj5UlddVvHw4gUrbJFda17Gofka53DBVLp08 ZSAZCtF9jjfraLNlVJAiOYNGKTW4i6LVLfRKDBGFGfooK7qsnlc5A1hllS73Vfg7vh/Z5gz1smbS zf7h0NWcWyqIhHNzXL5WKqIzaBcXvLth5NVqFRPvhpvN02C6OuQoLrGIixp5TjtSpF1SJv1Ue8dP acReoTP2dMl+RU3LXiWrLPqGHPoq3OzW7G262YZJfnm8c4icr17KWe3H+dm7Y7hborbHQB/rMFux H+PbPE0u2W+b8G6fsR/3q+0ebbNy7HV6yz6EWbpByv0p3G/AQXd30O0le/cYJsfrV5Qr9cLOq19X i68juF1zwr6sGupVO2QfUFyDutf7LYjmw/7rHo3cm7DYP4XspzjZRjHAGz9E7LpYsJ/SNfDKXu+z gv2Mojt/iKdBb7Wss2rX5Ooh9/TsAxkKH1wjTEbs5yjLiAMQHX8JsxKypEr2S/QYJ9D3uxW+RWSt P/MJDY88KoqTdEtdc9x8wUlHuajpdcupJjBd4kFdt7/uH+Cdg/m2Bq+UdTbPR/VNfkJkkpxCikym o+VtIzzvULBo+/44jlNlXCPjz8KSpj5FRcauURBESJp+ozDxB7veZwgcSA420ZbdpGmW7i7Z+02a xWHCPkdohWUnAMSk2z4mSiI6CqOVTQ8QScF4GuPsoR8yFOe7ibfQ3zJOHnKw2GccAKDQ+hz/kdyH WbaCt5WxohrHT3RMkCJ8Z2gubG8jJLvp3Smxo1VwtbLzKtg5eyeRW2iKdnMrKIutkjzdMTTmHyhr vc/S/a7MZPG7OGNlZ+uUopYciHsE00r8SVqU+KWtarkVaGnpWN4SdUU/v9h4nqCrOW6gsP1IB6qU wleNgWt83YvyFq0snweu4QXUqzGswERuRBU+jfk4SHjuxqhGqqKJw7Ei1SHHbrpXmXag5TBj531O mY6tFlBjArnWghIMrU/85WLw4g8GATRmDO6i78B1GVfv3yD+x0Wa/cA+bdBypxOObXmqXvaOomXZ NbqNUB5Go3uSQplSTcYdoibDqtaj4GC3v93UrSq5sXq4X1hBTQI/b09Rerb85cVYtQqscZ/a3NSI 7JlYSgxe/ojH3+9z5jkLhx5zN02+cMzAnm2Z7VjdMbbpjhk2HoffdP60HlqzO4aZTZr568hesxQO Hb/b7JxdSCsf9uhCr2ElEa51/ogLGQqtVe3OGrKrOF/u8xz3QShO5CW7UfcCnU+J9ui3YYGu6GN0 fLDldM2+SnerRf1DmFBRwQN/EdDLD4AKt0ZKOwZU1GMzGsPbA2RUSEMdVBx2lEM0IVvPV0PtERzX CxFBd64mo2o+4WQ1TkA2uL1D7WrKish+Bd6F0B5Zof2EDxfpMt3goL76PZ3NnpYwkWfjFQ1z3P6i 7Q+1oe8tXLLNljkGnJy8HWf81dimHZvRmGl0bSiGprehZ6rNoeltqMvYpV0zte/nOLpJSD1CbuA4 bo7bbbQl2S7T3JoQN3pJhBKQ3maDo8WhHkj7eEOzDfktJmisVvk/gN253waUQ6PhBi5xCju1lbKu QYn5NXby3IVNiAU7eQ2ymzGwUz02Q368CBDbpJglDZ0B2eJC8bkOIbinyfgPMiUvsM3/4s0G3yF1 pk45Ko5X30KcrONCA4WWq32S0OCbdBX9wG5AW90c+3gbSvVytTTZCw7Z0LUXfsVOdtBEmGYMNqzH Zhxjpa1F3iENTW9DH28A6pYk07OTLqMqcdh1lSF89+XFojTSKsqXWbyjeHO8hdont+e8EixbSJRV o6smbtIdAapAMa3CTZLhx6ZtcrJsgh+QzlYiFLP0JEwx3b2lc+VKjcerrH0LUZ/KpL1pxIQM2q2I yTG8OuQ2YxRyq7EZCg08UdYlJjF0BlDjbPfsoNZkgH8GRyit/KQbiYaJ+gYm0GaWTPAMvA7llXQl 0TDxsoI+EbhjFyWr6jZdiFtheLMV4AVyre+ITVRxiscSsEvFiUosD9ZgN8Z3H7blNrnqP+y0Pj7F 2TUCyWBxmsHEBd8egw2vmHvmpfS35IBDONBc0TYXVl3XmkHtivUY1bVijC/8bl3L7Xao44rH17UB nvWT/e8MdW3gnr+uhYzONthF3ZhJUlzNL8tVqohw/tVURGHyBLdZxTi731Oy2KlwGV1bQ/U0CU9X a5NDm0QSGjh4UL3bj0qjhqebMZmnMYbKq5NAiqEOOKYob01DXI0/VwLZIyOL8v0GFyjQ4UfbOkVf AvYsbfXEwIG43VI2Y9ktnd9P3mqjBSnE9/HdzXuAYzAXaQ3d9lUf857ZJVw8Ezy6lIpXP8q5Sfs8 Q49GSzUNffHjoRAl2oU9UqhDeh1lMQxWq2pGL7hEC/PZt1mKviGOKEGvVMV2JZRv62rmxdsrNRcy fMgpazDhQs2YcCE81+qVrjaT8vd6CDQ8woW6xujGN9EhwjuD1KPmyfP3HhlVo3owYLUg176KE1bQ NzB23t4GF/W2DeQBZGhNBF6Rd/2u034eGezE5R9t9tnF8OiveTK9DNFwcZ28XLXCExI8h8FeKEby 5PY5Wm3l7OI9bnSAFrc4Yriky6nRHRqA1JRFOyTCjXbcYKVHMFKGm+3x3dPxkYzj5iUatV3j6Nf5 VC8MXGrTWgF1Qpw6y2nHkOVIY2jTWoHkhfhYOXQWL4TXK5nC9F6oyyDalVq05DZj3t0lSLF98hns 2G5Et8ZY0ElHTeLKLYlQcL1DRAauUHyUIblMrL4Bcvl+t9vEGEYkxrORRRbf7nE+hsfyRKwZ6bfo 1gN3HgFP2mqZfHSSVBV4vkN95Ap4fn1s1I4BeNIYessd4OFj5dB5gIdugZxps4szAE+TUR7voPGA vKk2xRGR2CWCdujekEk9j3YXaiQ+AXUSS0OEgrq24g3rOx9bep0zpYK3EcEtL7J9VQ/fggxDPJRb hJv0/ngvE61DecO6m6nY88qOYIW9pnXYjonWIfMs6v52sNcM1dhr3wFuBQvLodNQ6ulTYwZ8Cmt4 8hBmroZm0izNH0pDlNP8/j+a5hYBCmVuZHN0cmVhbQplbmRvYmoKMTMyIDAgb2JqCjQxODUKZW5k b2JqCjEzMCAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDExMCAwIFIgL1Jlc291cmNlcyAx MzMgMCBSIC9Db250ZW50cyAxMzEgMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9i agoxMzMgMCBvYmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0Nz MSA3IDAgUiA+PiAvRXh0R1N0YXRlIDw8IC9HczEKOSAwIFIgL0dzMiAxMCAwIFIgPj4gL0ZvbnQg PDwgL1RUMSA4IDAgUiA+PiA+PgplbmRvYmoKMTM1IDAgb2JqCjw8IC9MZW5ndGggMTM2IDAgUiAv RmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAG1mEtzmzAQx+98iu2p6UxMJAQI9dZHptND n8NMZ9rJgdiyoYPBRTh9fPqubIx4ODbYTjKTgGy00u5v/7viF3yBX3DzRlGYKiB2QIVPuMArhzDh UF9fbcYCUFP8Kt66QPSvvghsJogPnmA294VrTZfwOoQJsQlxOYRTcJ3Nl/Gfw4UthAjADQSES7gJ QwoUwjlcAcALCH/CbbhZzckmmOfZhDp7LORziB6iJI3uU1mbso7sBra7MVvw9fw+6W/Buhq+gWrW vT7yA/Sc7wq9A6vto2S5SuVSZmVUJnmmIC+gjGWCf6Uqk2yhB+YyKtdFvb9zokU5wzAwf48vpbIB vspoJgtV2bI0RAfD1vMl4oUPBF7PQMuXN+8QzIUC7tmeBo2TwOaOcGEJruiOpe0xx0Ug09ajeghS iGEOOLOjZx627ipa1iNEIyLtaF2c6J6FqJAQzR4SJWdQ5qfHgRPNNBLXsdAKwygntdNec0Q40/N3 iM7yUiLDUQk5klxAl/Bl9Bfkn0SVtiF6IzwoRKNTl3JMLcd1D+9zh9tRHdzx6Atuuxoq5JFtebTq MeSxGgNf+LZAgUT4zKP1kOZxt7OhYFZSa8Sp1lcmvC6NxoFHIjlIwJmW9paAU2JTFIVX6zLOC/Uc 3rfE6oU1UNt7IkG1SFDHgYZJq6oZg/fUm9V4ipAOk6NlfI//HY+dO6spDpYxwHSmEhYAGuj4/8L1 s28gjFFtttGFOHrAmwzylcxA5etiKju5C0kGb65hrXRdwtyGdJap0ymoS0VjXadSYDy7rzVxiN8N 3QjX9ip7M3hVa4IWOrFLk/siKv7Cj42TRrZBho66dehbmAxOlUPpvysU/fn/5Zlpqo4V1J5uBRrr wMMGseeayyw80BUoEGyPgVmywO7pDqUrjBPVo1iB7hexvMJKFvO8WF6CYbPLp2GYet3WcUwzMoRh tNBhWOf4PE/T/LfO+Pk6m26a1JdjwTM4C8wXSgSHvrHhGt1jrVZ+SrGKtErY6FkPK4nvducfISSH 0nB3xukZyLdNuVbmJFutS9BpiXczyNelvo+2I7+TMt6I8vdPH28/vIVVGk1lnKfYztvn8I0Bc/Bk Z9Z1Kt4GAhMu3pXlwWQ9Xv0n7Cmq/4Q/yVqp453rAgNsoy7VLp5Q3j3EfJNKyVRdw2h1N6YaVdbT OuwSD/aYQjpTVOH65/bPKimkgg9RMY2BXqN2O7T+tLr48TlaSKD87hxs9bEAa0NzTRcEd4LvTqq4 seplx7PT0Q12r1Aa09bvUMy0u1MMEzbz9KGZCturDs36MNYcwjPKdgiPLfV5ZPdgY0gfUb78B53z /r8KZW5kc3RyZWFtCmVuZG9iagoxMzYgMCBvYmoKOTk4CmVuZG9iagoxMzQgMCBvYmoKPDwgL1R5 cGUgL1BhZ2UgL1BhcmVudCAxMTAgMCBSIC9SZXNvdXJjZXMgMTM3IDAgUiAvQ29udGVudHMgMTM1 IDAgUiAvTWVkaWFCb3gKWzAgMCA2MTIgNzkyXSA+PgplbmRvYmoKMTM3IDAgb2JqCjw8IC9Qcm9j U2V0IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4gL0V4dEdTdGF0 ZSA8PCAvR3MxCjkgMCBSIC9HczIgMTAgMCBSID4+IC9Gb250IDw8IC9UVDEgOCAwIFIgL1RUMyAx OCAwIFIgPj4gPj4KZW5kb2JqCjEzOSAwIG9iago8PCAvTGVuZ3RoIDE0MCAwIFIgL0ZpbHRlciAv RmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBzVvbcts2EH3XV2zz0mbGVADe2bfWdltPmlujaWeSyQMj URZbiVRIKm769V1QFAEBiMwL2GnyEFvx4AB7OXt2AX+CN/AJnl2XFJYlkPpvucSPyNx2j9+zL8K5 ExEfvMiZB37kwnIHPy7AInNC3AAWS3Dt+ofxHzuI5lEUheCG0Wyxg2eLBQUKizV8d5dVSZEl1VNY /Am3ixq6Cw5f3A0R0rEdzeJW31X57mccwCMeAvguA4Dz3d8U8bqC8z83L9/CuzxL4Ca9T0r5fwF+ ONwf8GOb2OTpbOihbYKntqP60Kc9zY4Whb6H5iflfnJtyU8mVnUib+yqWge123ZY4J2FF7qmszlm FyLY8TAGqA0qQg5wne/2hyqBf5jXV0ev55+TAsr0PktWx8/jbAWH/SrGn6s2Cbx79fL2xQ0UyTIv VnMDgSDszGAgOIRM6zLbcyZ2mYqALvst6RsWPEtawlFX7k44l4KtJRwVYNmEGpLM29vrOsDi6lAk UMcbBtbwSKKOQ+Y0oCCgDo0knqZCFaAsiWjgMQApqKRs6FcLBKqmAXK17WDFUcNquMNbfrGx3kn8 0ndVrWVaAOrJFcY0gakImA2/J0W6/lLzkshh6yLfQZxBmiG91Sw2gqgoSxsaeSDsYGh48VzklqNU iqnuxK9IFyGiWgCs/5LrDZcWBWCxSUtId/ttskuyKq7SPINVnpSQ5dX3I/KcSQfqAMcz6YZgWi9Y DpnYDSoCJsjrpFjnxQ4a2v0cb1Os5Mwh+Vot57A6FGl2P8JFATIlSmxhL0N9dJlvrEDxVy1mO7Pa eerMzlS/i/WE2JiriCI5DcVRuk6XtQnnncGamsmzn5mJBFiyVITu2a+s2qa8RW1P2njvZR+xPw1s CYGirp8DvN3EKCafJ0XxbQl3ZyQwIq4oK/FOCJaAOzSyuBu4wWwq93fdDXYeSthA6ljYsn2lBBvm YQ0EdwY8FDkqeFYUz3wCfZ2ijQtqM/94mPh4TIlIa6LBglDuk2WbOw3TMAoankU2QVQ79GpUKRq7 u++SoOUB4mDhmbaMWirE3e3iJ6DEhk28/CuuNkjb71mHfmzQfzl9+AHTTldzWRXO+vpXyA7CyBxH B+LOhiadNmwE8/qKCuqRHZcy8NQAW46PY4azHvv1l9qkrMFFU8Uft9jh5rBvSiZrdtf5dps/YEmE 9SFbsrpZjhEwJ5Ev7mWoQQU/nYZUlktCKfm6p8ElG3I/uZ5SWHr46VKqtX5SIeq2N16dK3r8bgX5 oWIKPz5OKh7SamNsPkFDRi4eigBhQyad5ZHRoyqeVNqS47lTN2WWCvHVrmw4EUVM91MnABFuqCu4 zcQOn2D7TSnqCzyQlEK6ZrJrn69ItLaZFI/STJS756qyLE9QL5Ila+9ltRbiCL47dUNpqRAYVa+O ua7MILHGQVqVsErWKRta7oukbNtO1vzE1ZjuP2I04GNkCJsaGns6zvYjpfJ1VkTdODtA3Xxe+EzP ZiwVQqdHDM4AREST3gjCiSf9VuhMLiRViLqCdg4rhV7awbFm94YnxxqER0fH5mp+K9AEE5oMrzCc +FbCimyF/00LNBUCw6vfoGkMIftsUk6x6RP2YdJHUeBKCqB7Be1GyNjRya0IDk8c7OJe3l3D9SbF RuTXvtmqrdoBFi8SODg2USHjjybnM0yiuX4LNBNuynubT1cmKfFlYdZ7XW4irVymlE4+otFgCD5n LvnanEY/RolL2MdFNVxb222T32xtlOe4hQVxzaUjGli+QOsjRS5lV9s+MgxJ7qDpnqyysm9G8TD0 WBq5BDlHs7qhAsgmwm6dQeoBqjzflk+gPKQ4wnt/k5UL9sGHK3jYpMsNfEzKdIXXK8cbfJxWXMES B33xtszHBAbj2RBH1M2ZJw0MmyqFsUfZ6hYYiCEFBnvmUM8R6rH+l3qKUF4apsHPef3zfFw0xsCs s2DTS3rc2bQG9jQXJp0zoqOBPVl76GZpnUEvTYtCli6RgwNnvOqQUc+mdcdWfcZehqG5H30GxpOe UsSg+L0EMWOvv3rXHr6uQIcOmbrbwKcL8j1NH8a95ALOuCoGCsL/xdsiqzn/qNTSuy6aXI6wajBx 305VDHTdf/qqwmr2YN5FbqSIjc7cc4nwhAT2XFnIm88uFaN3u2XuXh/v+NoTD226HhOJXqjcYqBV B8uBr93tU8SR8sv47b4Go3vlUMYwQuD5jnIP0zm2L5G6CBFOXzl8BQNj28gTR4uqaxtS6qiL61fV OohLs6q+UlGbJxQbNrxpR1GC55PmFIX6omfEG5X2SaLunGaiOLCVC6q+UawtzoHybsfMfkPUj1JF NrLfEF8CTbFuhDdak6zrj2Yfnd9soj6y6GtfbdJwVsOHsHIT+EdSlsm2vIIEL5K32P21f27/3qd4 mQQv4gK7bHrFfvWBtv/bfPH+dXyfAA0/9E1vwQKn34mwmu0Z10LYYJ7aP6e5bfyms2UbLcT3G7YP DoR1T78XI2Tam38BrbhZdAplbmRzdHJlYW0KZW5kb2JqCjE0MCAwIG9iagoxODc1CmVuZG9iagox MzggMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCAxMTAgMCBSIC9SZXNvdXJjZXMgMTQxIDAg UiAvQ29udGVudHMgMTM5IDAgUiAvTWVkaWFCb3gKWzAgMCA2MTIgNzkyXSA+PgplbmRvYmoKMTQx IDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAw IFIgPj4gL0ZvbnQgPDwgL1RUMSA4IDAgUgovVFQzIDE4IDAgUiA+PiA+PgplbmRvYmoKMTQ0IDAg b2JqCjw8IC9MZW5ndGggMTQ1IDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAG1 W9ty20YSfedXdJ7WqQppzOCeN6/s7KZi52Jza6uSygMEQhLWIEDjEsX5+j0DkpjhDCIPBFB+MAVJ fXqmL6e7Z/CJfqFP9PKmYZQ25PT/mhSPnA33jt+LD9HGjZ2A/NjdhEHsUbqnf25p7Wwcxwtpm5LH +1/GfzyMN3EcR+RF8Wq7p5fbLSNG2zt68X3ZZnWZtV/T9n/0ZttD2+BI4V4ESJe7I8LXU6VK7VcS wHd8AASeAKBL7V/XyV1Ll1+vf/xAv1ZlRq/z+6zRf0r0qrvv8Jg73Pl69dxFcwer5nG/6LNOq+OO 0tRFy5VKO3lcs9MSUt3Ynyt11ECD2q5wvAv3YmxDdPOQlPcZva3urbdmdfRmuTWBDycInIhMDPut MaRKzR1H03yyVLk1Y5HHfVcHoGUgXLEzDEFuILz/7obe7PK2qr+ln4ssaTKqs331R0btQ95Qk6Vt XpUyCJxNxOLACWORaRw35iwQn/pnEVmloBVSkDQacxG6LAhHdFtm7cx1nQ0L2QjAbXZX1Rkdutsi TxNtodNyqrKgUIS95wk8LZQ21r59ytSK1AjbxL1oRKqyTS//BUK4ByF8yUouZxsf1LAKfL5xIlDD njzX75/R8KxQn7FN4OD3Cjr/LX5vePZAd6uBhaAFF1rYsZFc4xBpHIpd5ghljXZSZaQpLDEAMF9n CfCDtXFOKUJCKO58jjQTYavEExUnsJWgceEuz+LsULBeENMRbKVQdt60CN7utmmTss2TgtI+vzbU VgjsjHZV2u2zsqWkobwlRPptlpfn3GutlWK7M9npC1+9sN9Yq/qEMaY7xwTbGRCKewy2Y2DpC4p6 rOqP2Y6q0j6CDR4JhLF8HhIWoIm33yFD6uDSqH0udZ4sdNSfB/lMp+3FI0YH+K6u9pMXIT1yqDkN ze1LzqcifSg5DfmoExBmU9OJ1HyoYwzJy2geiGo88JA39C132LfPVzsURUYIojXEztiLwf/W7pWr r3Wo78bSHm4iVETv+2prh6rrU5ej9BJJGd7TVHVLt5/p/Xu6efvqw4eNLMHsCEO6E/NEARSFpOAv 2IesGb9yy7BmIdeT24SU/1QQn1P+CARs82q3Q9b/odsndU5JuaN/J/Uu+ZjVgjbTKunah6puZplG FL+RSyr+krZBYa6TpXWAP0WVMix5EFzbNibEYBvZNp5blTnWcJDBGA9orSAuaQ2X6R2BfWa0s4Yb GLXF0pFiQsAa7/KyqiktECh3p1aq6SPmvk72+6m5a7QSYQy0xTxYBxpoTo3eLUWRm6GRRThOG1Mp BSATnM7iuIfQvdpa7N/XaGsPw4mrVmlrz/d1hKUdwIRYqlIb0X6Zimeo1UYQHLZQtTYiexnth3pt BMHhS1RsI4LtM9MT/u47BnFPDaPRXCDpx0cZq0XU0v5uQiDhvdkfHpIm/wutdNagbiNMkmiXtIng oa7O28+EIRpSIvruMiuGp3PoKQI9cR8JUNFoSXry41DLq/ZOYEdPAcZiV7aWCSGs9ecB5RtquX3V 5n/0kz7KS5TZ4AuqHst+VHIcdc4xkI9CG0NRWitKLGmgINaJb2kDha5BUEuHkwkBA527oF3epF3T YOSMpHzIU3p8yDCvqgnRVVZ9Z5SXadHtMkRULQZbeTm1ulA6o1gYLIjQGcl1P9dgX0hUYWR0Sf2Z lHU+vIyw1cXhnejwHI6FrQGjRdivP/345t1r+6rISOfD4GpEuL3/GWJlDo9c49zDeldOYr+w+VFk DA+WdmsTAm59cyyIkXjah6SlqZ46uipxEOBEPmwNSC1fJ/QXTjX/0RDON+ssreodqvDiMfmMYXA/ UDgeeIgJ8IefXk3dZDVwBBWhKxc6aP422SVGVym9I8bI1OCMpUYzMnBMmOMGqoGzspnUy12SgWMK n+wLUqyyNeFAp1fKWszhBuVMiJzLnIULB0qzJUcvwNAsbIZOUhSDR+cgB3iwcHXai3P6BPXXrj/J z3bfUPZnmh3aqbGm7K8jWAF5dC1WD83UgxV77zbWrpwSSRMynN9oQdzTwnNx/o4XBI62yZhhNYcs RcOO/HTaU+xd0fX0W3dFNmu0dT52xS720LN2UbHO+Z7KGucoVz4mBERgUNME93+KnKT7mxhw/+Po sW8qZElUdTPcmgm3Zhw5+7Qq1SD2jepTbs2GAZqA0Ny6urPmmxOGNDqD5A1zvaPumuAZuivpiOEi AiBQC44YvU81YgBcpX3xKcb1PbtKdlhNHsuf7wmYgM84M5V7peQWzvQC4blp5TJ1qxD+CDtbG9ou QLiBcckPAm414V7aaMFxPksXxxl6Gyxqt+6A7j6j6o6OBTU1+X2ZtB2op+cg0Z2kSYf7M2IEIFqT 0y486zBdlFe4ydYrI9P2StzGm2HCcQbCBRwtoq7DQMCRS+kvFpbd/vY0I7nPZCh96UqE0UqISHIi 3G9ai9tEGoj9fhlyFT93UXBrVegiXq5CYPCsQSzONa6BMXDNIaubquxviCTpx7J6LLLdvTiOnFUF cHGkgts2sEwPrZKOvWUMQlC2zfOuXgV4uMR5bcuYGItN1Zkp254zn0rRcqw+AoHR7+UtiKndEzyn v825NoSvXtjr/1S9IgfrAkJLgo5rP1k3/HO4C9Err0lexu99z+jMrDOSsSlKIaSElh9dfRrITIwh I4kaa48MBOI9DgRBrO2Zfrfbt8K/MMYgfJwztRVewLko/I66LJ+iAtdg2KVNFUQGPy1OHibGZR0m yqRjG4528tChZmqyhroSVjzUWdOgzSyT/byuMhS9uYszEHbUZnljhdxoyJc2Vnj9q0bMxICx/tMX sTv6fn8o+qtGfWQN17znRBEX7ZMvOrQj8vKGibh3lUQahbMT6Wj3FbPoKvrGwexsMqYvd65+OwX3 uvVp8X9FXigaTO0wxivwIsjwhTM7nKs29C6p0wdi34i3cdjw09OH335O8NYIi3+fM+4T+R8V3vqk 3uKeizb83FG6p1eqvpqaUqTFomEApsg9v6qllBbndwHceOP6eAksCPgmOt30R7sUqo9w0f/4CO8D DHf6hz+Uj3DNn375PwPKy4YKZW5kc3RyZWFtCmVuZG9iagoxNDUgMCBvYmoKMjMwMAplbmRvYmoK MTQyIDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMTQzIDAgUiAvUmVzb3VyY2VzIDE0NiAw IFIgL0NvbnRlbnRzIDE0NCAwIFIgL01lZGlhQm94ClswIDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjE0 NiAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcg MCBSID4+IC9FeHRHU3RhdGUgPDwgL0dzMQo5IDAgUiAvR3MyIDEwIDAgUiA+PiAvRm9udCA8PCAv VFQxIDggMCBSIC9UVDMgMTggMCBSID4+ID4+CmVuZG9iagoxNDggMCBvYmoKPDwgL0xlbmd0aCAx NDkgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4Ab1bWZObRhB+16/o+MmuWm0Y LkHeNl7neLCd7CqVqhwPLJqViCWQGdjDvz7fIARohqxBQOwqe6+a7pn+ur++9jP9Sp/p27eCUSjI KP6KEF8yLk378Ln8wLu0fMMlx7cuF65vU7ij75c0Ny4Nw17QMiTbLH4Y/5kL/9L3fY9sz58td/Tt csmI0fKeXv8cZzyNefaGlv/Qu2Uhuouc+nDbg0jLtFoOn/c9tdZ+VgtwDAcCXFsKoFPtr9PgPqPT P9cfbumPJOZ0Ha25UL9LdJWvc3zZNEzjzezcS5sGbm36xaWPOs0OL0p9L13ftLaTbSp2GuNUy3eG ntpqoEptSwLvBF4wTefnmL2AYMsBBphJuoSE6O0miNd8RRGwHK/wgciCLBd0nyY7us2CeBWkK0HL NAg/UZbQu6c9T6NdX+vXd2+4FvOATtP2pGbK4/I4C7YE6Z1foPThBiAMCzDznJbTu7+rFhkavlWb zjB0041lPRu3MExcy9KkBCtpsNsw2XNK7o+mwdOR4GEWJfFlXzPVr8dMOClzrabYEZ3UdCzF4iPb xER4n9addAlwp9/2qyCDUd4nWfQQSBtcEGgiTVZ5YZELiWm65iJax/TxgacPEX88mkvAC8+3mGnA z02E+YZi51qs1V0rvDNHZcIDi/T11VLK7IRvK7xDimLBlIt9Egsu49Bjkn6K4jWt0yTf0yoSYS7E QMjLQMkWDjUkn/uAtSPVr8bYtJAHy0+LeE0AAP9j8MDpj48f3r2/hhWKpCF73nNB2YZHKSWPccko F0D5PkjhHQduub4tf34I4stEolbsXHt9BfAqPU2Cd5X/i3e8HCkJcCWNOK5HTBVzwz/nMtf7+erD lfSsMOXSSAGlfB2JLH0ewiIywWU+XKqSeq6FWjxqbhnTetR8UaldpvxjsfoxJ9MlwKeuCl6/4QL0 AC65j/gW/yYp3edZnvIi9pHI9/skzWQMXD3HwS4KKS/IRwywl3nMmRp6jWkwZk6cRc/Zwpw4CraI gM2+57RLYJs0WiegJEHBXZJntAkepIX+kVUTguQxUqY8TFKZdMswSV9QcQ0yWkn8Tc3GtJrJNL4/ k+pRWrcl0HPTnTpbaxEBq6GaQT4GH8uRVYSB4EOcx0c1wwzmUFPWmHaw2MRJ89xyUYdPWoS2iPhB lpqdAVVWujUdVD2UlqO7N1FeKqCrJkqLBMOSnHm+9q4szl3Do5azx9HeBQUbru23STDs785XfSFV XyxY28EDXqRKmOc2nkVBY19tX87r5rbjqBJGyrcqgtdFVAwfxBTs92i7RE/0GGV9E+HWu/myhjH8 Bcm7KdnRhvhTsNtvD4wDikIpesjZEfa69jA1/2MSwiaaqm2vef6xNQwcQ6P0vse2PlVDArxDAdrY MHA0EYDB222QRkjvVkgDgoySePsMRPCnY5pwcyNIbILtlu447dMk5ELw1YBUoeq4zRv6jElRjq+V Sp1t1anXNnftqcvcFhGjUZSu/ThBvqYoXYJhj0VR+tnjaF9TlC7BcEahKP3gUSjK9bWEqTPeX0o5 6ti0sDQSHDs26SIQm94HK063P11ZHuCDIqUITmXRiYClt3yGhCUJANNEEtRQZcywtPBULuxu/W5h ybOsqSlEFwEzXUciECIJo6LtrFulnORU3TY6dJX65hp1ul1TSEOfMW3leVN3dXxz8raOLgK2OgwH 0BpNiplAXxu0JjFyhGZ4jklziFTyvePQge5Q2a7gwbRFQ4/uOV/dYZw3KOeTkztZ6uoX7e5ZWipZ Rz1/obH8yHGVGaYWuscOrC0yZNZXjlxfyb4Puntb/kpCovj0FXEMhZ4fNzwd0hJiSP7Rd0VpVqow a6wtdDeQPlM9LkPgXHfqphBjbPKuUIsMWAit1wzNPKTl/CkrO3mPm+cj6W0C1E50izk4ZtRFd3YU 7it1Gd9UGOMqkaE3BOrY09q/YyZrGYGP4rFVId0iQzpTVUKhoQqLoNmKUfjNzS3PxLH7KoId8pfH mKfSz1BKxfkOPxqisHruG4RrIqx75aVmgwxXP3BjQaKOh2icq9F9ihnUXMpR8phAhLJFEa8H8EWd 4LcI6A7GFwiDWYbWyhkFfw0bWKDZidsETJdxAvKiTyAbAqu+wG0FmI+pIMNYEDwBwUqQyPdb+AhG gbIN8dfrOMkOc4zbj1d/vaGdHGnAl2RJgME8EozGc8/6rcFVG2GFGidvPHvdHR5apt7uSpavMVfh Sw39+6wL/sf6Aq7iq10lzHvKGTliT5hviwWR2q1m3dYU6xDky+kqs9Ds04Sd8W71uQ3M27arwGKA Pdq5w8Yq4NRupcvQ3UpWucrQtQI5zyR1fOFpUnRNww0PPwHxA3YgZdMUyzpzdlBtUvJwbG31ZBLE Q45iSTm1Ll4N0Edii2YnIkqxpnPoN8/kum6/YIF4hdzWlDHrRN5MruT2Bmcr6B3Pmxr0rqXR1ejV hy5DB30ShttcTkCxtxZUQT2KD18dktc6sqfDZAly0GMQwlvN5HoqZfU2f82K7bFpYaoxfPQNEGws qDJOzCT7/n0DTX2tBgUu5CDQwyKw3BNQKZCv5GaJdNemm15gMC5T6ozvsGwSpM+0TQ4OLH+0JMwz fLhB+Ce3P8+HW2/b4LDF4v/JnSFHCX/Y8+CR3OE50H5N9V+Lelqm68n9LQ9MCeNpYrrDXju38Uwe ZngKD3dOicpzv2YJD9NiRcToUU+XAXfCosc2iGJYQtbxCstHgry+HlYHJFQ04CMsq87ZQXQz0HWf j7yUvFbL2IUIhZruoqzH+FZr6TBbrq14ElhQXzm7O7C0cxvA8tlgOq2fu3muO7ir33auaUy+Z4MV bbVf8rusobbigpBqBlusfVZ/gN0IFRYmMmm4IXYhf/2GVd8tP/jzl2DN8Z2/zwdyHZRL9ZpAHgUJ 6BIdI7FVLlR+0znEaAjzqmZk49zj72Y19P31X8ie31YKZW5kc3RyZWFtCmVuZG9iagoxNDkgMCBv YmoKMjIxNwplbmRvYmoKMTQ3IDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMTQzIDAgUiAv UmVzb3VyY2VzIDE1MCAwIFIgL0NvbnRlbnRzIDE0OCAwIFIgL01lZGlhQm94ClswIDAgNjEyIDc5 Ml0gPj4KZW5kb2JqCjE1MCAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JT cGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9Gb250IDw8IC9UVDEgOCAwIFIKL1RUMyAxOCAwIFIgPj4g Pj4KZW5kb2JqCjE1MiAwIG9iago8PCAvTGVuZ3RoIDE1MyAwIFIgL0ZpbHRlciAvRmxhdGVEZWNv ZGUgPj4Kc3RyZWFtCngBtVvfc9s2DH73X4H1ab2bXJL6vbe0aW+9W7s28W537fVBtRlHmy25kpwm ++sHyrZIk1wqRVR6vbpJC0AE8OEDQH2Dj/ANXryqKSxrIO2veonfInMWHP4uPiRzPyURhKk/j6M0 gOUWXi7AI3NCghgWSwhY+4/xDxan8zRNEwiSdLbYwovFggKFxQ38/LZoeFXw5jks/obXi1Z1Hz1S eJCgSp/5FuHeUKnS+plUEJIQFUSBUADn1l9W2U0D51+X76/hU1lwuMzXvFZ/+nw27BmlNcpZ0igM 5wzP3zzLgx1PfObZmcdogg/NgtZj2jNf7Nd7fCxGGOmtanYIDnmmjKDXWNo6TZMPI6R2cYaazj3l QqqfhmOlWl3apYcvEucsPdClQ4/DqsLHoCGUgamhBHh78f4CXpVFna94lTU5foKaL8UHKMrvsC0r DvWOL/ObfDkfGsXS6TQUTqdUtWJ2gIH+T3nEGSlVnh4hGrgMlirPTsn/TgEL/YndY2pA91ysVnwF y3K72/B7+FdAS1MCv8/EN+ox/mCY5DQERatDdzASTesOGupw/IRskXF0ShFTbDk0BRWhojjRCKud aezTpXYRSTGZNMAYKlWGvFJkOgVY9TT5jgHJUPCmKrf989YoLB0bMAT3JwNHodaT6ciAIZ+EIi2H Hr8MFVHXSUQSMCS7sTwSoRgFqSmfRL8+3exYmB3H1BQ74iy6+KNGQRxqqdWLnXzPJxMHuKkBIf3q CpqHHUdQX3GIfPie1ZDVdb4uEOkxij798f71u0v4+tDW5jEQHwkehxivmOEQ4704nhbjPcoMzuUY gSwqXGGQRbSbXO5QyKIBezI3OGSR7cb6DoksGkjsAossgl2gkUfj0X3FD/CIUQekxqrjxG88UwUi 0pv8HqFnm9dN9g+vIS9OGOSEZ2LpoQhzqmqXKMSiiamm59Opqb9FRcf9d1V+lzUc9nU3VViI8nGX bfboLBaQEU1Z4KNzkhgrhHzGo3P6p/tj0x8aIEWgKW01aOWChcG8d0U3Wj8aomRGDrZrkvvnuyFW YQcRHStW5qKtpfQCJHzTMmyLCgysV5uswnZe0I3brDnNqvAbG0QBMd8pyga+cuDbXfMwhoCcen7V DJe5j8E1sYtCYoC+awpiqnBGQUzR/bO6VyPkmRowI5GCrMRw9JjcMzFSHjbXjUW/kuDM6lzBTEyN +z/CY8AkZpwkCQ8atCDKeXPzdGBKxWCFCNqNh6NJHmG7giCpQG0SRtrptDP1VVGXu97GGy00ikXr mVV0f+Mfix0qpr9Ybc49e7J9hOVYEOYUW2qLYEeW42AcNVjPRkzmRtjOTiTJzCdHtvsiKiOslqaG VburGGF9V+NN2Y6sF5MdihN4i/WEjGgaJIkwTe9PIowskiQixJmLVuKHHrQkEbYhnRemxpjEeYUy VLTstNw1SCFwTtFizgiekGDmktQP0L1Sk0ueEAWBBsT9nWsUEQWIpZ8jpLian117wVRxRuVu9lVz y6sDpSvKYkRXcEJoRaPbpgCrDJYA9Ddq0ByT7XDPcRyBXV3VcJvdceSjsOVZkRfr/g2DkZRUFGaG A1ahVXfW0KSUo1sZA7Fv0PmhYn+Q63FiDsSGqpCW+0gjCIlT8Cxyh4q1Wt6NHUwFInZvs2KNCPJs V5V32dfNA3zeF18Og9BngkQqP8jxB3y5r/izETjTLbbVB3aJM4nva+HsGmeSZPKZtalCoP1mI5bB +02T4+JRTVD0U73f7cqqgWyzLqu8ud1Cts43efPwoirx/93xasymEheVmLd4/cJTLHPptZRNPchO 46lXaZ6pAr12yetllWMnjy4Q+/t2vw/fb3mBZYLjYj/D3xanjsox4S3RmygWufQWJUyvGa6TjJLI YG2uq7lFh7O23yLbDQ9XVg/mERGi7R5mw3r+bgfqGfbPHDX9yvIB7degmtD+jYQxNuw2oa3xmuTB 8SlrtGQXuO6fetCNGiafdFt0IFBd53if5TCSrPi3fV7xLS8a3ItW5b5YjaCyXct+1DtTrh8OdouV 49DjRRpPaNAc38LuA9JWCbKHZrueY0ktHoaSLCUuiCCzCc7VLQfa/8EeG9QooceohXWcX7jplezW AxQ7CMLw0XBx1+pRfSQuPG2zZnkLOd5L299gEcsxMsa0AURMz5hUp95IHXxyikdO9w/F/tFoyYd6 2npSikdwnKO3MM4rlKkDM/XP3Qq3USsQCdsm6YFT4MZg3HW0bnpHD2rVIOjvFQOX1SML9WnsYLnS K9YhAPXT6XmDqQO98rJsMEPOXFIDtlWr/RLXOPd4fVP4rOI1Evga8GrnabML6/wO2WA+YlzQXef1 js8/ynXyiK3TLhoERhVsrz73TrDzec75zWcFilCPlmDNLULQqlzuRWkaAUBytyEeRlPSPySN+YYS 6gFertamUb3Pp2dJCANjhuIcgEwd7iiyKds5RTZVEOqMIuvCJ6DIqELjM4S5ocim5P5x/xjEh0mi WTxYrsQfO8RH/vSF19SBEH+almHjDkW25VDeiCYernjNqzs+lCPL51RwVnJZNEE7yRUcLgjgvOdD VqEB+O7OCBSkMdIw5uOcAGmzcaRD0cpKw6LE2N0PlWs9JQVoYzZ9wTd1/E80HN85am8HUbgRd6mv f7vwk0CAzuHT0CiR5ypnp3gPTjy0WuX7Q+d59T1/U4wmIiTESl6o0MLvenHx8vfX/QPOhAnZMZnS B8OEPBg1Gqa/EZvgy19aZXdedk0dGHALhJrjDuaEPB0MHJFBvC604jterFqKqYTjmHliiqtfFguc ONilxp0btyWxXufcyE3p6GpkDbM00rHZib2MUH1+MViuxEtr9cTXgvRBwl+8rvmm/gW42B/gWKT7 en2/wzlQDe+yCtt/+ot465B2Pz1++PwhW3Ng9MvTkU32L0fznEcYjjVOGwb/+OrrT70rkQFkSTdo UOSeXqlVPPbxP3kE2W4KZW5kc3RyZWFtCmVuZG9iagoxNTMgMCBvYmoKMjIyNAplbmRvYmoKMTUx IDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMTQzIDAgUiAvUmVzb3VyY2VzIDE1NCAwIFIg L0NvbnRlbnRzIDE1MiAwIFIgL01lZGlhQm94ClswIDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjE1NCAw IG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBS ID4+IC9Gb250IDw8IC9UVDEgOCAwIFIKL1RUMyAxOCAwIFIgPj4gPj4KZW5kb2JqCjE1NiAwIG9i ago8PCAvTGVuZ3RoIDE1NyAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBtVtb c9u2En7Xr9jm6XRquQR4z5trO21mEje11clMz5wHmoItnlCkwosV99d3QVIkRCAqKJLOQ2zZg13u Lr799sKv8Ad8hZ+vcwJhDkb1Lw/xI+OSWvXP/Bvv0vQNB2zfvHQd34JwC7+sYGlcGoblwioEi1Z/ jP9R17/0fd8Dy/MXqy38vFoRILB6gv+8TwqWJaz4EVb/h9tVJVpHTne45aFIk5qKw5dDT+20X3QC bMNGAY7FBcCx9jdZ8KSv+uKEiRwTn8J2KhP1hMDxF3+mxQBLdc8keIQY+FCEqDxyc/cAf6UJg5vo meXFsXD86ap8LvFjalBD27zNk3c2pQZ6jfqV0/qPO+LUNs5Q0rGnYIJTTd8ee6rSGe31MPnFOboe aO+hiitFmDbGMKEgS0gB7lKI0+SZZZCxr2WUMfgUZMGW4c2Ep4jFayhSeGTwN8tSiBJ4YVn0FIVB EaXJ5Y+Lcy8u8VEp6h4ptahRQf+hG9gRIusQA6Zh9LBm8KmdKQU4aL1FbXNmb8kS0Ft/7tZBwdYQ QFbGDJ6ydAssyOIIvYWeydEpORSboIA8iNawLeMi2uEf/vX73e3HG7i/z893WXttBc3OdVlnXAGX OuMaTt97FRJp34bjfLQ4ykcWB1uKMUMxgR1fuD3D8E/SAoI4TvdsfaktUMI4j98537QUUvQjUTq1 tRCx+9lo8KmnXUAIXsZZ0UiW8I5H8/kmb7mAfLI+FziVplsuIAswKIfJ83V3eLg4hgfy0dPo7nCi 5Fi+QoBhvj1fcZcr7rrI6OSAOf/UNs6RePWicOih/xLmc+dc0heAIH49yTNY3PLUM0ESsQkwn2Pe 3iCYYSaH9OlA51avO4bcu0obD79dmZ51fjogNipADVeQ32QD/Yg9xunjuoHYnCViVBG3lwweVle/ fLjFC6dtR4koEA8pMLXwvvUP17/EkvIqnrA0jX4ED0tlpwCpTWWylMa7uoWVlGm48Q3Lc0A+Wt+9 p3R3eGFlU1ch4OH9x08fbkckX5cr7yHjlZXXd69kkhaUlm7/Ug8+9TQqLQmVio2JawGFCI5MDXSs 07DcsgRZZBEUZV4Dxu23HXJ//nEQ82z3UATJOsjWOayyIPwyRTEganUutVRUA0vi0h6G6HtM75pT IhGyqT0mi0CP3bNt+oJg/xCmCO2I9IKXeIkGOQvHlmo80xCfwFLQYErvUEei+0ORvbtPahAmc1dr S1MSMRWdVRw9DQS3fFYhwTAnIrSKs6fRvmW0CgmGNQWlVRysDxsn0ofpSLWVdryfSqldgrKwkujx 5qnRSBaBaHS1Xmcsz6PkGT7/+uEanhhbP47MDQZHH4pERJA4Jfogus2cG2ysDmf2hixi+jpjKQtp 6EJVT7xpWsZVjfFT3UXEJuIbjiNvHsINw0rkJ/gtyDcjao4DbRd1OTcYupyh6kEtbas/rqiIuz4C HBOH7zShuJhecFzFz2kWFZvtm0uA1SbKId+kJTZit8EXBlEB2xTbVOnjS5QiNduk+0N3LwwS7NSe b13K5wLUw0QvKDWXdX2p8BpWF2la1+9TdfZth7QVGRP2snmF/FQWJZpzjwaHhO0hryI1B/wj2GCw Yi+wcUd+AftNFI8yMC9pcfCxtDu9ZjKwY1l9WJvDwCimF755EFYTAp4E8rRuP1SGjtm36DGKo+K1 7lDzD5tZw9CYVV5d4mJnl5qYKeRnx/b4Psi1s2wTXF0pQTzuOeXR5wICdjuUXNVBpi1lC3SdtvKn KELXMZDFRDiNrW4GAvYuS1+iNRtR0/noDIJDTfRG90DnxnrniI7juKbXD3BtEx2Dx/c84XqzV+Gy CMzbd2nB3kKKiH9/c7W6qsdw+Vt4wPI7iC/EZt7F4Qax7PD5CJ91CUDQa0qfeaY5s8/wnsq3Rzsu Tl2dwxR1KYtofcYTiNpnNQG6qPgPtBl+Up8Jek3pM59KmVrbnnr3zHf7OWQquGt9Jouoq5Uq5b+/ urs6TL+rrtdTmuGEteGsGXuO8iJ7HXGvCG92UmLDUtBjSh8Rg5KZLxYxnD5RndxLChnopnsccGf1 SKPiE/lgBqakCzyjG9wfSy62Z72qZ1aTwJztcCGCD91raqgd/FIHoJ2YVBJ7MDVNU6QdmqhE5DsW 8t0NCPh3xYhVAOJzOuRicm9cthC2uvSZigQPykIMJ4tSf3AOKsvl9JxSFbbPLGEZtrwbq/Em67re jgqDOCzj0aswvA9HfB+NWWswypgqqoTHzp13CSWzJ16FDISHzxuWoEPysKwbT4qdl4t6oQM4rh8S cZDDnsXcq0OLD8HCvDdFcTEQ5xbV44/ynBKlOr6LMyEpEc9yDVBO7xrwpo1IWgqE4zyqxwoDFxI7 4xGsDi4JbsjwoU8rcdKsaBpzt/aIac/e21PIqMkLpqRPLMOg3gZJyOAad7+wZsNcVW2BNYOfurMx OMiVwdjxGK5TL2XyUv+RJeFmG2Rfcv3pLSaBBe4OC4HRJReFdc9Pv8JVMhFtezX20HOVBhJEWFY/ mUxPl2QZGBjvygw7KxmEcdBtaiKVeUzLApfbkvPhjlBe09v8xtaSRbjT5y+nsj5CAYICLrdVInoR FuzYt0OvEzcZx4QY37eiuMd+eBJxK12fv0gMT/Q/tvlmDjHbUnSKJonjtm5Cb/dlYIhd16FVNVHD uORbp80+KibYdbmL+X4w49umY4qmjhbVSojRpu+jJto6eBF8ZHtzt5CQeM3eQ1LIQB8dFgPQI3yX NQuDnJcwHKWjJNhhg2+H3aSCxa9Q8t/cv7sG3Lby4Qt7HQERvO1H8U2GZaPVKKf9G8Y6Xj8JVYRo cHA0cr43oiEop3eX9ynuvegDkAQU3XqV4nB9/aVzheB26ew5zpUXoSbqU3cAJMs4AqBq1x3XtYW8 cAHsBUsCTvbLJC+HBrMy6IjN4xqXInCVyO3T8N0uzXh/gI+LtOG3xiVhAkA8LgLpZCWiF2+DQ0L5 FEJ0eJj8eumpX0wsUJ3zXvnqpgykliOigDhP2/KXiZqXS6K/0YTrMuNzI1V9Xa8yLvjraTqKdYDf 7nouG22aZL/gr6DpG/ZUIvHc0e23Tl/BSz4ZnaDU5zqjCyPVudQgc/cZ8KWNfp/hM26csBins4y/ uIEz8/YLd+HwhaYcPgZZuAFywd9bI+1vm2/++yl4ZkDp/4YChWCBwwtty0Y9Md4niTBsLxxQBxe+ q5cnfxgINUKF5R1ek8KNvvbcw0uZgr5//AMkjbUNCmVuZHN0cmVhbQplbmRvYmoKMTU3IDAgb2Jq CjI0MjkKZW5kb2JqCjE1NSAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDE0MyAwIFIgL1Jl c291cmNlcyAxNTggMCBSIC9Db250ZW50cyAxNTYgMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJd ID4+CmVuZG9iagoxNTggMCBvYmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3Bh Y2UgPDwgL0NzMSA3IDAgUiA+PiAvRm9udCA8PCAvVFQxIDggMCBSCi9UVDMgMTggMCBSID4+ID4+ CmVuZG9iagoxNjAgMCBvYmoKPDwgL0xlbmd0aCAxNjEgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2Rl ID4+CnN0cmVhbQp4Ab1b23LbNhB911ds85JkJnQA8N631nbazCR2YruTmTR9oEjIYkORCknF9t93 Qcm8AIxDimCbmVaxOnsA7O7Zq7/BR/gGr08LCmEBpPpThPgjcsKs/d/FB+/E9IkDtm+euI5vQbiB 32/AICeEWC7chGCx6n/G/zDXP/F93wPL8xc3G3h9c0OBws0KXrxNS56nvHwJN//C+U0FPQSnEW55 CGkys0e4MVZqc/pFA2ATGwEcSwBA9/RnebAqofvP2cU1fM5SDmfxLS/kbwF+293u8MeMMPJyceyl GcFbM7+69OOZFvsXhbGXbm7a6Mlikp50SDV9e6rUXgXVxzaF4XXMC1Uz+DkWT1iwaaMNUAYqQoYa jSIewRUv4iTmacghSCMYq9vmZi3H8RGWEt8VuNLTvcmDW8QrH6DMoODhLhefwywt4ojnQRnjp5Ox d29MgXrCwJyeC49+0EZooyhCZEWNPWrve9UAzDZlAM2WoCKgJfy1jYISbYHfB5ttwgsoYmEP4TpI kQsgTqFcxwV853mB+oGcF7ukFD+O4tWK5zwtx5pN63EfKaF1smMp4SePSxzJGPcMOFiF3Vix6MQK y0Q6Z3gthsGl68zroFjD9yDZ8SmW7QoA1+yRr8OyqS3HiNFSn358SpHmZ+U4FeFNnm1GX6OxzDpC q5KHR+in2LmO0CoAsQQ/DrbMA0pzdkcQv0M8UEXrObsj0hfH8nsAiP3r8Qd3xcFdF/Ms1WCOl1oT LKZDkhWOFfoTM587klMZAOn7NAnyeBWH++gJwTLblZBm6fGkTAmyDWUMGrgDJw+3ni5bdjNrSkSG gHGayvlBsOX3VSKywRATYzCCz5cX5+/P4OpqCntSV+QFltW60CGTn+BktVUZ5sx5geHKatedIaoI PzKsJeaK602Qf63ygLE21us+1MRahTou4CmkEJ2UI9R+MLmGBqklBHtmj+DhelekNnqnbObSwKAu kxlLc0bYA4GqP8vS5yXm5Zvtrqx9cBqlCFVQD9p4mknlQFoCQTKjcs0HE72ib4p0dUJNqzq6JHgC H7ZqdYoegAjdxzkQ1Cp5mFIQMSHZ3p9dtqTBT6LkF40LMDpz5mgwR86otZOfCoEucL3lYbwK4yqs Yp38bRfnWCStshx2VcFUiBztEJ62eVZmYZYgKd7GRZnHItmf0CfB+Miwb9O+/LFVUUOHjdZMakqG PJoPGyZvGXILwZk74TdMBQK1domunqMW7rI8itNbWAYFKg2r1k9/vDuFFefRMgi/TtBNE1Na+Dp1 YxFvZt1Yti1Tge6gokKgbh77DFdvTiHdbZbYT6jcqcg2HFVWtRLCSY5DRR1OPcwkWgfQqRybyKFF t+PYWFRJNYpu5agQQjkFhygLdxts5+wp7+0HCKIIuz1F1QQqSj6W0RqOaHUHqSl0hCWegeeQLD1A V11BkmXbvZeOaK8vsI3fUB11MWYzk1Ug8nvqiHs2tjclNY0V2/s6DYM6WK5ICLoNQYVoeWndDaz6 f9ge3m55GsX3U7iTiboPe01GC1mnezo+lSxKt3u6mKXNrBUVQlcny1BFD09gB7WyehCIramX1SNb z+nrZlYPAnF0dLN6BA83zCeyb9dTIrlmFvLMuUcShgqBLPQBs7hPf0CxuxXjSBw7vMKWFkYGnEjk OHoIk10kJlYPSEvYMTpk4TkPMe3Dr8cGqlbg8EWnyHWgfaxjKeonDI/DKpmtqpHEYBV2e2w/mEgY CCNRVrSf8YZBEu6SKthPKDF9UR0TauOLKUBajNxnc4da35091KoQ/1eobSEfa8eNezTpCSVs7lhL iTN7LtyDgYo5tNSxcsShZ91bB6zyQx7tcg7LsQzTSwWUIdlQB/uT4hgSFzxAxIswj5eijA2qpBgy PA4ESTKYIZTYQWt+67n5aHftvVXLRijt6d102zcL0Zg/aj+nnrkaOCwSOIvWhs4xYwOl8yeKCGGD FYCknuFvpYhtP5AzdyOGMirTf1cBTy9IPZX1Pa6XGD0Y2lLWHtl6sr56/Np3fJzidwewg8y04cl6 AKsKX7wYfv5ugO8O0ZqsVTyRZJ3EHZ62KvZZD2Grw0uS9dg9s+VJz2i5Dff0NiDFUElKe/TbvYqB wWO/WHXx9hRO1zFOMN8FS1yiEZs1dW9lSg1dt08ON2yz3uhHbCy2RUqmPXeTi5r+/JFdxdBHSqrs 4U79FKW2SEmFIK42UpKFz0BKCCFRB/H0kJIqWY/dW5ayITY40VKYup+ULFx+nbl9RFWMutTAihmC XbnO8ucFBKsVrmIeyr+jZ1WUifoPq782rtZCw7ZmLzRsb/auHlUxOoXG3foBtkkQ8nWW4CqsWHiB ACsNbH4kiQgfWV4GaQlfXogJ5MX1+enrsTVIQ/bUxx48c8TAeX+sSUGkicStDnwrnjimsiYxR58D Cyk54otnMr+8nNDdcEQJYGMHwugRP5x2lDqs/TyesuMxmHaekusyJcaOldurWbGtQ8hhW0GBGP0m /RhiDxA318UuhwyBbvMeC+EIm4NLXCEXzUH0imeXuXAbHB9dXV3zsoA/g++icsZ5MFwHOGC8vEvx +wv8+OzLy+NdhxG8PvNwfHU42qyu4yobUZXnDH/kblz6UYuQIo4Ul+7ici0WwW8xgy1wJlj9isA2 wP39PNiucQUC26xYIuFP8Euxyi/0MCWvfVzRw3etDjPpXRuqazmaxywpIzn2HbES64/vHs41547v Koa+vFaVrT2vVSFwT1lXsS0LnyGvRQjJioivJ69VJY+2z1679+nkjZJ+uY4S1wcHGKXp0PgpI7Nv J+FvachNsU9izyEpXgEvscN6sqfZ6t/n91vc/CrgfZCHa6CvxC/B0db31ce/PwS3HJj5z5TIIkZP WCAYh+NpZ0DsEz22XczDeuEvx2vMe/z9SKMl9/E3JFuW+/E/plltkwplbmRzdHJlYW0KZW5kb2Jq CjE2MSAwIG9iagoyMTk1CmVuZG9iagoxNTkgMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCAx NDMgMCBSIC9SZXNvdXJjZXMgMTYyIDAgUiAvQ29udGVudHMgMTYwIDAgUiAvTWVkaWFCb3gKWzAg MCA2MTIgNzkyXSA+PgplbmRvYmoKMTYyIDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBd IC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4gL0ZvbnQgPDwgL1RUMSA4IDAgUgovVFQzIDE4 IDAgUiA+PiA+PgplbmRvYmoKMTY0IDAgb2JqCjw8IC9MZW5ndGggMTY1IDAgUiAvRmlsdGVyIC9G bGF0ZURlY29kZSA+PgpzdHJlYW0KeAG9W1tz27YSftev2JMnZ0aSCfB+5syZcWL3JNM4SW13OtOm DzQN2zyVRIWUcumv7y5FESBAWxBFxZ1pZNrGB+z1213wM/wCn+H0dckgLcGp/itTfORMubf5nj5E Uzd2AvBjdxoGsQfpHF7dwMSZOo4Xwk0KHq9+Gf/hYTyN4zgCL4pHN3M4vblhwODmHk7eLlaiWIjV S7j5P1zcVNA2OHJxL0JIl7sdi0/2XVXufiQBfMdHgMAjAGjv/rxI7legflkjjp6RV+z7U+bEYQci wCAIzMFDMVZpRD/T+2v4PV8IOM8eRNk+HZ30bP2wxsfc4c7LUV+lcQe1xuNKaVv80cYi7A9Ym5zU lLQzj2t2NsSqbuwfumqngTXbdslxWu6B8h5E3y5alMM4mAg5wGX+RdzBfV7Mk9UY8uJOFNniYQzZ Ip2tyyxfnIpv9Sd8tsohgXJ9C6VIV/jD/kbAYjKCMFB31dcIpGC74o7rOLrmKqe1lm07uo1a0c1z MQBxtEJE0dRXLkWa3WcpoNBWjwKu315+fHcBZfoo5mJK6KNeMQ8915kyDyUnIftKrsN9uO/q4uop KcwDSiRtDJ1j4jiuoZsIaOg/rQvUQgHpLClQLWj0xXomSkhu8/UK5uvZKlvOBPz+4f3F5TlcXZXw 6eTsHNJ8PheLVfnp5bS/sXMHzYRHPgbO5uwDqoz5ema1Dxxt435CZYxheD5qbDIRUGXS7pxpxOLA CeMRytFxY84CYiTVswhd6hCC0rgw7kGz/CvxNS/kLuxYkPQpnwKvh55qriz2XVXGOMWnfKI/XlQB aAq6E3fWEM/RkYDOEDgRnUGDqKTTwnFGxBit1SElFRFK7HoqSl8HkZJSskFEkorDCkBTshoGltYy 2/jNqBOMcSJYvnqYmvEWeSrKEhMs5Pdwt17OsjRZCfibKNc25BwSZiinIrFSdGVK8fR/SO4fkNxv fYo8qcunWOBPfaL5AYuQ2MfeaA6cue1nMFOfhVOfYzkwA+Vvm2ePcE87q/5+FHAXTRd/d6787vaZ +vecT30qMfBZ/bcQyGe4ZmVzldXhyTidzM5PO1XXZKnA08yk4gxKSNoL5AnSgHVFO6yq2ca2KKq9 VzpTQLYeeDEYy9tv31i0EQwzaKq1zzwXZ5r1J65OpIbmwSYC5porMa+YcInJXixSUfOCfEk0N5nB 36LIt367qY2WRZYXSO76+yujqMQDUDZkuutedvZE6T0Jwx9gzYiim3MyS9ezhERosqmNfY+o34BS 2NlckPbNqH5kLuh4oxN7+366fJwwfuRKb8JCrglqcBM3IdDGP1QEeJ4t0G7Tx2SBJb6plt5lPeOk lgD1ooD3tWepbRkYkO7pVmwdeqxo7oQHDT2vEzbjU4oN96KgoFBa4xnxs+FRHSD2ZmssK6Xjoke0 k8neyz6fESduoDNAlA5D+byvugfZF+QwUlK97ahpgKmAQ9qR50RHtiPP93VdqNXMjoD3XJrc9nIm JsQfVz+9Zo7r/YlNndpOrYNrp+alySKYJrE8/StZilWRlWP4OB3Di/N8nmQLWCRzDCr93YR5RJ0j DCLmAe07uoabMCryWBR2Lbv3bjuFxXC/UxazLoQ0x9ixXGGvYYGttiTNZtkqE+WLcX/q0PRQVTn1 dZLOA8nI4jtGQ3VDhuv/W2v7uZopoEaaH0QwQTjNea5vzoG5Y0ADB7LwMZx/eIufpiz0ovC0tvsx xqEvYn6LPR5sLoYHCLfpTap7OZZwPSOpHVW4WBa0s8R/HlerZfnv09OvX79Oi/u00eZoR5gyKBSq BlXCOapQQxmd2PuukamVKp455GTEmBFBi0jiLlvlxTQvHk6zxX1+ikchW/lv1Wm1mi6ZUYMqKc7J JrUDwR5U01hW8Swc87S1MUwwkgiBp5eYg1NNE6LORD5loh2JojdLkIlCwa99dG9jk2xTJgpcVrMw e90YNqz07GSiUDZes81sji1oajdvSiZMF4037qqSDCtjMWZSji2AiYljf5J62R0ZIsC8p9kxBbF9 N9+JQoQAx42YWJ9AaSFZBq1OJJmCNkgjZVS9HeZUinkxBi0l+Z0pyR/XErDmYdIQOQ1peaQfe0Rz c3vBGoaoBFMZJELXIMQk1ObLWo8buO6mqJQuwmnW0k7cYKSkAaKEAto3SnQajQwYphS7U5J/SErC zjKZRYzND0OK9mZhBAvFFnBKpbmytfrtgkXkGoXqQKGiKY5MCEpJnLEYU9KrIrlbiAJ9mOqWn8V3 wCHPXUkzcFiXAqfcRDRLGtu+XdxVDfr+PF1GYWVPR6KS2E3UM1bjwvTBWo92boxwmqVcic/rrKgS GLwTX8QMSxx49fojMKTsRN5JA4fwcpp34RowUbCPJMyYd7dMtxIdWJgIpwlTL3Eq2cFlUqSPWN/E B9U3Ta2qwB5LjqFBo7YirP4dWo444muHLyOZbOcqllRBpmRZ39AgUUUZvr5BBM2XO5IJmcQhyYQ1 9Y1+oH04xjPJhDncIIbWCrfLJswJ9Ip2n1D3HEiTTjowKJ94m2bbGbaG77ANdoXp5Axvx4lssfnm XVKUOX6+xB9cJmUpviNLxM/UBbo+6DbJlhrWG1OJ6r5RfselzQkOXQPNElv+uy/eLnJIeC3fgpOr vBSYqa9Ema8LnMxdibRJ2HSx6hwvLV6LdF1kq+9w8Q3Hd3Rv7cD22pZm1fs5rogD48rVRsbWvtLm +dq0GY/icGqpomg7qBdBWQM95y+S4XcAUfonhzELpc3TTWKjqucQghCSZ7jYgap3cFS1cfZD+RZD PM0znshtPcpNmdvaMFW9uXc/pbtSapp3BKHFlI7sRnYxTHZrH6m6er63xUsaIGslnBTrrG3vdTtF pUC4jlGPDeSuMr2ZGJTe8IYOzZIuknI1S/4S4BZ3lL+q9HUzhTfJAu9KYFz+tY6+Ah+Vj3A2e8gx Ej/Oy/5Vk5xusM3ejurHrv9D5xsM8TQ//nRy/eZswwvenCmxmG477nExIqb+Ow5RMPzpGEMxVDmc JQjNiW+TEq/Vvrk8e12d5c3P5z99eoklIMV+sqZtO2z3ix4Gp2QhJWRsZhon60FVd/pc3EEpFdZD Gtrn7nYnnpIt3VgfZujFXyU9JJHf8QYxY4fIsZmvMkTVzHDw4EV3X9U6CXXV+hpakIinmeQTGXK3 BSKjGuErTTLsKxnSPJZ9hnyOQMnxFjMhOjIkWQVmyP7d0ab+q/EOCrNSVEr68mKD2irxzeril/Qe ZYqiQPieUWMOniFNDMqQEc6fMUO+E9ltgo0uLO1enM1vs4c1FSJ4wffX5VIUKQZF+FLCu/xr/c2m wXiA2ravzkzYZl8HqU2KVzF2VbzRDx0OMD/SpwPU5gDq0/5GZZ/WUiQdmDVF9bS/hJv3NVDC1XaO KuHA1W/XtIKkfVS269tiEahTyjqxhGMcvSjuaUU/Ou1HYSIbNFWAT9w32DXhrGtcGWaUC4emCO0j crt2br8BQ/QT7zTivaEOqXVEZLI7pWbZv8VIguN0C8bAG+p2axDptG1fA+uOEyHXScxA65p3lxUT tcog0mSUuBZxvcM6zH6jUH+LaJh1Y2bE4UHkEAdG9BliXeSpx878+DKd3hD5Dd+uwbHTGMQKkhle TW2+Lr4tcTRVbgcoY3qHmTU/rT/88TF5EMC9Pw9JHTSjwndwJvX21Mg3iCVg82Q7msI3fapuxr/6 ayzavp4/UdbdvqCv7Hf71pAbT12f3gni0TTCd4Lw/R0Pb+6F6qPZ9tEoYM3bP80fykf0QtAv/wDH 3dRHCmVuZHN0cmVhbQplbmRvYmoKMTY1IDAgb2JqCjI4MzIKZW5kb2JqCjE2MyAwIG9iago8PCAv VHlwZSAvUGFnZSAvUGFyZW50IDE0MyAwIFIgL1Jlc291cmNlcyAxNjYgMCBSIC9Db250ZW50cyAx NjQgMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9iagoxNjYgMCBvYmoKPDwgL1By b2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0NzMSA3IDAgUiA+PiAvRXh0R1N0 YXRlIDw8IC9HczEKOSAwIFIgL0dzMiAxMCAwIFIgPj4gL0ZvbnQgPDwgL1RUMSA4IDAgUiAvVFQz IDE4IDAgUiA+PiA+PgplbmRvYmoKMTY4IDAgb2JqCjw8IC9MZW5ndGggMTY5IDAgUiAvRmlsdGVy IC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAG9XG1v2zgS/u5fwcunBLBlkXo/LA5I4+wi3WvSbby7 uCb9oNpKoqstu5LcNv31N6ReSJM8W7Jkp0BqKzGHHM4888wMma/oD/QVja8yjGYZMtm/bAaPTIPY xXv6wjeswHSRE1iG5wY2mi3RmykamYZp2h6azpBN2C/Df8QLjCAIfGT7wWC6ROPpFCOMpk/o/CbJ ozSJ8gs0/S+6njLRTeTwwW0fRFrE0gw+ajsqn/2AC3BMBwS4NhWAtmc/ScOnHG1/TW7v0cdVEqFJ /Bxl8k8Rutw8b+AxMYl5MTh00cSEVZOALbqa06DQKGq7aL5Svk82kfapj1GtwOk6qnaD6mlb1PC2 zAsTgxgI3SRPq3QZ5vG3CH2InqI0SmZRVipqQM29nc1hE2wCYx/JEgfnvSjKNGEdA8FNWo/KFaXz Q+JY8k6gDiIEZ7EccBYMLu9Y0lY8XH2c3H9ivlI5PbpapY2tdbADYALLNLDpuBqx61UK+75KEFgA usyy+DmJ5ug2XEYZChN4tVl+jtJseLgvYiqduL4o/FBf3LNtpqtum4A+jXVZgPVAK82F1YAqYTmA 7tvedHYVJXkaLuKfoMIC48I8RPdR+i2eRWdDdDfLV6BN+Cj2u2jUo+hm2+IUjqNR7MgBSVAnvOxX oyBN0ugvL3m+zv45Hs9+zjMjnoVJYqzS5/G/jA72SEB72LWQIO5Q7WliA8ZYNsKWWhJIgoAcNYpD pN02uzb7sAslKmxSBDxMkmy6Wi2yT8JKBu1CgktZgkM8pIyO2m6l1i1r9WBPVv+WyQoraBLU9mAA lgPq7c0VunqJFxH6d/g5G6IzSndyqjsGsD8p8aEYG+abNEKP50/wq12QoMJWPpFDTXm3VkeWeUK1 gjTJxtdfZhnGjTevNHPunhQxTR8Crzp0cxa8y3l8at++oxPwki0fL1gw/VYvYNCMUmk3BSI5sCvi lmsReRDEnjkL50Mmj5nbvODZj+cf726v300eL86G9TT2MTtFjzigocerZIupSvNgsEuPtR+PPNm3 tvy4ktaYnWpVWQdzkCbZ9+U6jRcsDRmiOgw9x/nL5rMxWy3HSTxbgIuP50lFlPcnZ6o6PTAbYoHV KKvtxyyxR8mXBfulCGCoBIG0aWapTj6gkwc8V8euducAlXADwMSRUKD1sNpNFyR4RJbQgtPsMuMq lo6wIuKB0XsIFDyaNkQDDmd1NFXGPyDD2qMkgk/JAUcgTtqTm6vL21sIpZXe0K/T9xBEc8qo34Wv ndm0A3BKTA+Joo8URYl7ygxlBOIkXf7ylK+BTsN3I2alpXhmQHlpPF8twzjpxqttGpYCDHrkYg/V Izd17q0WVrLyxuCllN90zHpkuVAj2iqQ9M2tNSIeFp1CSF3f0wzdTwypC3waCZRhNN4EJYJwGFM1 38/ceYBXJRTEiKMw+toypxE4n2o4/WY1I9v0JYKipUP7A26j2gYVJ3nCX1Ea08yFAvFyvYiWUOso KkerJ/QuyrLwuarpFrlOVejN2mpC8P2qjCvO51BI2RPmAL1OqmBHJjebLE6eUf4SIQoIaBF/TsP0 FWLc282ihyAHXA0HARrBOqudPZImHVOpjm/ZamO8aGaqIK5aUNk00dH1b6X5jhnaHtxYwHWQE8SW emyOWEo0EorQmAI6Dhw0UvXYCm1LIdybsENzNwwBWh25w9yFSIopoBNczF3alAJtO+UbFG+J7bP5 S6O3zgy4WjjBcGyZerYedg/IOIEmqW3sD40SDlXEw4dfr8D1HWgu3L3kIZBmg7HpWVqA+KKoVU/T MMmg94PiBAF2A/DA5xD9YIcCFaGdIOJTm+NLPxLuuLZ9SgQHcZIRTu5uEAbn9WzfG5dKH1YNTVCk 20GRHBYEucdSZKCUsI8J4C7kDNusuwbw79+/G+nTrPaQ1okyNmnri0CBRZYyOO+AeSJe19U4kCDZ XzSP81XKOhYxtFjHsBTqT51A0KUgTgAE5QWhFr1VhYlzEPQsmfn1DYKeXzOQMmD3nmWpIigIQseO guB1mOWL8EuErHQ+RBODlUqvDPR7uHlahpTgTlg2zLqg6P41y6Pl4Ry2bn+OhEkdyXF9S8mQj+m4 IE5y3Ptotknj/BVd/8ijJIO+clbGEap7ULaEkOxpF93S0g1U2EbCVI6lW/+kHRDfl1sgb8NkAwkB jcjeUPTJRlmrlpjQYj7GFpS+CnFiK+H/YvC+nkHJ2jnBwhYV40HuoS6qOQbvIj/YptmNb+kkaDCY Wl2XDjKhQYUAiokLOtTsuJ44BgdE7kaI+92kb7mnhzwKPJm89I7BqgiGwdhyAYP/in/E0RC9ByZ6 PYdv05fVMlsB9t7Dmw/Rlxc49jZE/4E39BDKWwO9WW2SeQf+xImoMK9D90zrTHz7sElkJrAFw203 c08TekTlSUB8NnlNwmU8Q3+uoSEIZ3mA1NPSghrZoAlNKzV/vp9cTq9Zc/Dg5JhQKkTgFGA1IxFP 2i5asGCBbYlKdk/al8CmK2eHND8iYM+auMaeFi1EhtcdYlzdIixncFSlYryrQVHz8IYxQOsntAph 2j60JOGojNyf6Kn9xsu+GhlKZDvY4Hl2UYoR96Z5aNtZDqrTCypif35B7bGf/EKjueY+vCPBgGXI tLH1uFrDErCBYJk99R7esCqDxTfH0uUY2qQCTgYWdLkLOtB0ECoRo3I+ogU2V+suCxTV6ii8ZCuw 9YIPgu8SRy6XqXkF6FuDv+zpuzCdvVC+HHQiDhXZg/MIdDpH1bBlnrQLgUGexBwUdCzOhzQ+Z8P5 rICOW2IG9GJD7+ioak7H/MEuekLHrSWxuxrN3W0XOlpwhmy7GtZ63H3oaEEfSBLRU9zlx15UGQwd fZuiY8H+D0c9fpoPF3L690ne26UipLhL05bfNvMlpCQZy1ru4IFcVipSlzedDlhR6IGj5qNymcc8 bodtWyVjIrpTcB+0uIKktUIB3EGepNa/o8UCeqA5zQPPIDamUY5+j14R60yEM3ZN4XIDaUySw1Hw +tYCpC+Hm1J9U2hUKqB/UxICqB2ctECHQZ7k6Y/n0/ub32iex9o7BBxSEz7Z0+JslWl2CJ4YKj5g wWDAwkyOlXU79mmzbpAnKfcosXNLzHFip6o5XewEo+gpdm4tqcfY6fjH7l1A7iITpv4zC1UGi52B hT9xLtC6FcYPWymL6OvQqIDusAYJ3dX4yC5HfIi+bug9UFrnE4H+vrolwY5Xtwk8nIEKBSlBp8fC H9c/6bkXDPIk/Hk8RxTcz83HiwxxjAfD0WA8e3ofraG7BXfSukTQqsVfzuioEdQjMhkTOUoLGlu2 KfaxFJAnKRkqyaZwJaBqUR9eRMK0PQLki57lpsJE/fWUJoEjGPRYDpUguaUO6cE0OiG9T3krvQtT rqgTbxXcubonD+Mq1xk4Mu4rTu7Kvny4uS+lRo2LGjvH9WSu0M98A7hkfYz5Bq4S5vrQA1x8lQlp az1oPZZzbGjuybW/v+F0arSA23iQT4QLuO9ef13/WMcpdEfKStGQ3vfB9U8BTVp6tXZu/A4OnZvk fkxYY9Vu1+kGW39FAvu0+wKXvEcaFTy8p8dziSOedt7dR1StuT6Mqxm/9S7qvBoqqlW9D27nMl74 j8aqUebr12ghjFv9XQ1hvn/8D988jG8KZW5kc3RyZWFtCmVuZG9iagoxNjkgMCBvYmoKMjczNQpl bmRvYmoKMTY3IDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMTQzIDAgUiAvUmVzb3VyY2Vz IDE3MCAwIFIgL0NvbnRlbnRzIDE2OCAwIFIgL01lZGlhQm94ClswIDAgNjEyIDc5Ml0gPj4KZW5k b2JqCjE3MCAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAv Q3MxIDcgMCBSID4+IC9Gb250IDw8IC9UVDEgOCAwIFIKL1RUMyAxOCAwIFIgPj4gPj4KZW5kb2Jq CjE3MiAwIG9iago8PCAvTGVuZ3RoIDE3MyAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3Ry ZWFtCngBvVxbU9tIFn73r+jKE6myjVp3TW1tFYFkkgwkBFw7WxnmQWMEaMa2GFkOy7/f7+jWrW6N kSyb5CFOB+v0uX3nqvzNvrG/2fHpmrP5mhn57/UcR8bUtIu/0wd/agWGy5zAmnpuYLP5kr2bsYkx NQzbY7M5s838h/GH6QXTIAh8ZvvBaLZkx7MZZ5zN7tjRp1UWpasoe8tmf7L3s5x0Fzri4bYPkpZp tTx80vep4vYjQcAxHBBwbSLAmrc/S8O7jDV/nX25Zt+TVcTO4vtorf4rYyeb+w2OTcM03o52Zdo0 wLUZ5ExXdxoVEmV9mRacCj3ZpqKnfTzVCpyhT21VUH1tiwyvYV5QTWdxjLZYsOXABrjJdAq/XX04 tX3f+J2x03CxCNdj9nk6ZmfJahWlD+H8r2jMznHwIcbB85h9xOfrh/AJP4JP4eqWXU2H2AEuZsIu pYvtagdCtm2uaxmGqryG3XcWcwEUo1ZqrgVfdlyfgZqiydlD+BylY/bm62O0uvz5kl1E63V4H7EP SboMszdjBkXARX1jvLs4uQdfNy3oWdA/jDhNx3pFcYKaIs6zr58YN6bcs33vuDThUoUjgv8uGNyq Qs6hQ275TOdwzL4kP6LlH1EK9DO8cR+TGSG2CKDiDoiYhkVEFMb24+81pJgIcRqkSIa/F5nVZg9q ilX86yHLHtc/HR8/PT1N07v5AJkZpBgT0VhjqXuc3IaR3AAWcdNtIRDdxlmSTpP0/jhe3SXHYIQ8 9d8DkI+7FAFN2JlgZ1dXFYZV6507aqbS3bC0VEhKJgQBjnB90FjFNQoUqxzP4YhVV+FyfRstFmP2 bppHoespm22QiRHEXkfzTRodX2wWWfy4SR+TdcTqRG1AzlLGKuliu2qsFXpq2bq24kWSw/bJCDqF KiSGTT1ehPGCvf9fFq3WcbJas5uj6+OLTxfvb96y/0QpnTFralbxa0iwIhC0XCZucBhxcu8VxcnV FO76MZrHd/E8zCC5MsyTESOBqmNYXyG2mk8dVDR+ixBZEP0crjZh+twZh0vElCDGoBzDRwGkctod YbbBcO0FE0vNoVrdYFi4r0MXqClWYhrcGLOdA5gmOM6B+Nx2mc7YngKYCc1wp+X5LfGLrGFQ/PLJ ex1Tprar+0rGVVXaE09z2s4m2yl+TbjpKMDXB1q3WXBVbLWQyCNYYLmIYOfRU4xi630Rvk6m7GMS rSI6uUVh9aYuw2dpuFrfIee8TJMsmSeLvmAhSZcyHKq25JvtqrRWDBLOyz2tBG+4b09tvlBvTUBO 0ebN0cl/P1zdvK0gF1KXIbfExPz08wbtjtzdd5ctDwgWEcrkqxxItibXkrtDyhbkFNn+IyiOulVe wiR5ldVPVCqjo+6oqHm8XGtVaT1RUCAeuNjTDqUGoZQV10WjxgU7UgsHNBxdAG/XfqEeRqrCoYVW 7wgsFCE813S1krHvbV/ABotrVe+e+1wTnQRBLxq9BL0fk816Qc2sK0LanzcxKokY2MvukpSdps+P WXKfho8P8ZydLO6TNM4elkOQgSIlmkLypQ6EDJbLFRNvAEN3++hUOkxATkGGk/t4EWfPRUkWLaJ5 Fq/u2QX6hCEc4XmAFG1KbnwLUhRESynuCShsajD4Xk5BkWKWdHaBEouEZ3Hq8POA8jJNOwNuLsMP tfh5gLguyaYaUCwfF9EyWmXClNdvureuNPhBjlnmEDqt7ua1LX0SSGQbvmJeujWPegxdWmFJVAAg p6j93ekl5QVFb5bAQ88gilOpMcidXLp97iVsBX3ForiaSLwfCCtsRxtnNMTb0+JfytBATlFmnUV0 prTNbHzYpRFYSMB0SnrzcQRIfnEYKPQi0hT94ZO+oNZqhnX3ka6vmGFL+UZmt58sQmeotxsLOQnf dQw1Ie/92FY5SRRsNS2F+e7FlOoCztFI5FmE7/iURWzG7DsSiO8P+EAjso8REolluFoVIzQEvb9i fD7BP/2KYU+0QHGHoVlfc5GkS8my6SOSSBc7EDo4gVaAHxIdQE5BBxotXlJVfHcHmVJXV26k5aka 1ciYyKQsr5EfkzTbXbYI0EBeVJET6SoHkq1rv2aDdwJyimzPaRbJ8jY5JWs3R7Pz67pS9mDeLXEu P70IB6Rw9dBfvtGhRBz8YyLcGSKaVeWosRJSL1VM3EDNgXM/6UxlW0wTuYlOBXkJ0pE6hlYhbufx hmhPSrRK7QxIU+VKvOpPgkCHCAeDkyOcMfV54BpeQLNdwwpM7tKn/MwfdV7wEWiKYgLfpw6mxDDD zbDW0z2OaOm+CFCepeaTvR8rQqCU7ksUEAuaw5u9h0CggUIiD4GBbSIE1kbese8j2JHMQhh5QWsk rVe9+bR8TJMfVEOePIUpNUjXLLljV5vVig5Pk9voJzZ7wHyvqnPyOUt1MwwHjn/GItj9mnnO1KGF L9swpwEtfC2ZHahni+YZNqZstqi+OqKvlkcP7I6ebNKTu/W8WnkXqvQtdaHiOguzzZpQWpocuYFv 6uBcnH7eLJ6pXLHGTMRBlX0r4FPbLtg3g0Ik9RnYF2dGIabFqJIc9uXKI7Yz+00Uldj31WGPhmw7 d8yoYWa4SOUmmNkrxtwd2bbhNK3dGG4rgZbcnbQlj156rihKCGZRx8LjOWMKolYegI3EygS2IigD gpaKHlnUsChcxDK90kaqswUTZ5jWuA0XYZY4go2Matb6+YpgUVhIYGoJaQ0/vV2wFU0DT82T9o6m OglCUx9bJ0DT0yTLEmS6FygYzqP4j5CWG4odu9mUfQlTjOS1fqXw9G4wJEQrMl7pVgdKx7hhqiG/ UU1I1tqJjZeaDURP8fRf0calkBGu2KeTLyeQNvYbbqM0jxc1zLJ4RYt4aJGxvPnj7qVcK68jR7a+ HEuDByl2CvfgwB8VAhoi7uksL0sYeNfMPSA3Rqasx6fitBqzYXNu9yy1nn4Qw7jAQWXKubrPlou0 pygr1TVjH/WzsUMN8MY+kTZxqVTXmdS28CQyrBZSWpzdXTf1LK8kI+ume6Btll3NTXzRJSMSir23 hFoyPLmIeAFcSiFKGCnMrUVJfZUjniv5LXe1YVjf576QWnKTq2kPzGsvROpOWQuNPLLZvp0P3Mom Dho6ZV/nYo7+2AYdsXzT4dsmSmMM4PJuzsfZ7PJ6AESISXzBuGyG3dneZoaS+kxHS0sq390FK16E XdBTYPfm6Cz5WHdvfEi8BYDz06/zLCm2l7k/BIPrVhl2aOg2BxWwZajt8IZ8+yr0RQGDniJgDSGL SqTz4plwezFGwJa5RCbvOewdIXXJtSEkLGNPCNlgKX87qrtyNOSVXMxCj6aZafR+7ksIaWF4qpDY O0LqNAqEDAIJijvNpVq5cWj+ZdN6IS8oyV7ZxGC8wbNZLOIf1Fan6QRB8i9T9mHzZ4wmC8oOwuS+ l5KsvG6slTcRL8yN+nfWWpmVrAMsK3nAYfGBRNw0lVmULuNVskjun6uygQfFzNi3A3wSi77F1ll+ OiTAoRY3PdJ0cRlZ091do2OAswO1MXVg+eKtwKZ8y5Vlam1BmBoa756v5n0ONJQhx5yoLMc9oXG9 tUIkFDttReMgGILGaIzDNGhCWLIkXK9PU3sbGju2Wll3N7ltRYrk0o7fsvch4dH2t7u2ERH5qk4j R2PfoE7ML5tlmMYY29bpqhhDVq3nkF0lSYb2bIoJ5ABnpr0F0yFnLq4kG2F3yW5zZo62JxbQCgqK DZ4n83DBhqw3iakeMaA8fgADrS06FEtS2lTkGA042ouVSPWyTg96j9bJAkovN4sh3baWR35atjzM IS91ip2gkvv9W4jke67/unvboKfAvQbw+0i3G2QOk27rkmsDeJjFEICvXxuc4JMque7etg3gPVPL hffiVZKReZ5axMKJ90JEALxO4zcC7AKv17+X1HYo4sQ4iTdo7DY4fim99c1X3RXhoKf4oxTmGF5e R8M8SalvI5/PovnDCu+4LcqfoBcHsWW6c2omBZXiQgfFPN973eEE6Ckyrka3WLwB/NWeMGSsHtDA jltYZ8ZOs8qf9E42fKKm122OJkVmXk8giYjCVPcUelvKxsmluUcprU5inWdf6/zN7AJWd9u7rf/j hAaRXYdhohSWMC/gg5Oj9ue6Wn+spz5b50m0RzA0mWu7L153V1+07I78ZZbb+lxuaI3YvciBOxoA i+dWo3UrmFoOLZdY7tQyi+0KLB148hGWK4qjkTQkr74oHdFuxbf/A4jvpdQKZW5kc3RyZWFtCmVu ZG9iagoxNzMgMCBvYmoKMzE3NQplbmRvYmoKMTcxIDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJl bnQgMTQzIDAgUiAvUmVzb3VyY2VzIDE3NCAwIFIgL0NvbnRlbnRzIDE3MiAwIFIgL01lZGlhQm94 ClswIDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjE3NCAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1Rl eHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9FeHRHU3RhdGUgPDwgL0dzMQo5IDAg UiAvR3MyIDEwIDAgUiA+PiAvRm9udCA8PCAvVFQxIDggMCBSID4+ID4+CmVuZG9iagoxNzcgMCBv YmoKPDwgL0xlbmd0aCAxNzggMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4AZ1R ywrCMBC89yvGmwWNedlmr0qPgkLAg3goIb5owTYe/HxrVaroQc0esrtZZmYnFRaoMJoGARfA2wiu aXEm9a2+JoYp4gnGpFiakIYrMbHQsp1oLpkSIyIDbSiyJUbWCgjYDfqIYQ/IbEv0DeqQM851Cuui TwRN75Vg6UPwRRjAn5AXDN3Jzsd97QNmee12EANILkX3fMtW83zrIZN1HP2m80kcN81ipKA7cdGf 2z+hPjxVNL57qu6e9n71tEM176gffmpxAaA4chMKZW5kc3RyZWFtCmVuZG9iagoxNzggMCBvYmoK MjA0CmVuZG9iagoxNzUgMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCAxNzYgMCBSIC9SZXNv dXJjZXMgMTc5IDAgUiAvQ29udGVudHMgMTc3IDAgUiAvTWVkaWFCb3gKWzAgMCA2MTIgNzkyXSA+ PgplbmRvYmoKMTc5IDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNl IDw8IC9DczEgNyAwIFIgPj4gL0ZvbnQgPDwgL1RUMSA4IDAgUgovVFQzIDE4IDAgUiA+PiA+Pgpl bmRvYmoKMTgxIDAgb2JqCjw8IC9MZW5ndGggMTgyIDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+ PgpzdHJlYW0KeAG9W21z2zYS/q5fsddP9owpA3xnpnMzusY3TXtJXVvTdhL3A0VSli6yqIpUa/fX 34IiCRCAZb7pmJlYkTPYxbO7z74A/AN+hj/g+ruMQpQBKf5kEX5FpqZ9/Df74E+tgLjgBNbUcwMb oif41xwMMiXE9mAegW0W/xl/mF4wDYLAB9sPJvMnuJ7PKVCYL+HiwzZP9tskv4T5f+FmXohuI4cv bvso0jItzeJG11W59hMuwCEOCnBtJgCa2r/fh8scms/7T/fwOd0m8H79mGTybwFmh8cDfm0Sk1xO +m7aJLhrMyg2Xek0OSIKXTfNd8rtZJuSncZY1QqcoatqDVSrbTHHa7gXmqY1HJMTHmw56APUBFXC l7vbz78fPeCX9fM6uYLbKYTbGH6Zwn202r/8meyv4BvmFXdJtku3WQK36WYdvRRekvX3ARqgUqbX UGpEH7AIOYu1LBZOxPIBBajW4rE0it1cC8nBcXXCHi7Qcg+X31xBzKKYiZv0IiBmBkoCT9xQaYcB BCTQZ4CxTqlVCJBM8idzudZIlRzNA55SNAa1bKa6tPIA1QXuRLVRd62x422W7lqrXganoLrJYHcC EfUyp7RX/VTIU5PB7loaAaj6AMUZl1DP0aw7kuIWU9zTIbPf/T1AcZspHtDzKc5SObKaRgBSxcPF X+n+K6y3sNunj/skyx4ur/qzp0nQM02/Iawve/KsJERtnZVMx5Jii5Mc+9TaIsfwnWil1USH0iRW /eGAxYhJqH8F367yfJe9u77O03STTddJvpym+8frVf60uT7SYO+SBF0a05ENggKjsiD10DtMuxAg 4TmUBQNkQRMLPNVS7SNSqX9FFgyYr2EWErApuWogC5qEgY51qbpye9UVbq2rS3XV9t56ilt5bGAH oVRsQniUsTFhHQmzfq/2g8cGcSXP6cLkSvb0WCXjIvbKsu2xP+U2HitePIutL4E0iMd9prbvYFum rNte71PW9ZnePjYnqgBC/jltzXeKX7IwworF1Szc2S95JVE7I6smJGfsqquWm7kAii3aWfsTqkj4 wnrRYyv6fRh9DfNVuv29f9r0kYSx1rVBkHSetOnaUqwKtDB61kTybxrmx2SPbdv9FFu3232ap/nL LoH1026TPCXbPMzX6RbSJXz+6dPNx/fQFU+tm9QJTtn5Mt1Dvkrgw8383609sqwWBD+vZgbKZjsH j1Z/7uaaLlwwXrmDkTidMmETYaJEiQmrytNZuXj7wnwe+7wfDpsXpA4shFqDqFAQdVgqJxYUcsVJ 1sggGtbJ7riSNhKKKE2KtrpUfFznq8NiGqVP19kq3LbvNlXsqpZN3ds4iadu2VQBXzGerzVUiOmo f8VblXWCuL5cKIRpNSw1PE+ySWX01lNSHqdCNVrHqUFNR6K92W6XbOP1M8ymADfPISO845wKfkU/ KGeaQ4ZWtQ8IwscEjXqDR5dvoGZSpUzo0MSdKpyqKaOhipiv1hmElXWiFHPQeptBUprob0zyGfzF TBRG0WEf5mi2Y27aJ1G6j7MBfm4S1h/5FES9+tqMg6vrlQ3TlUv07rleOIQQ3J6D68rl9HyV4FQ2 CrftA+yUGV1WYDumh3gpohYJHLIkhjwFHAyvly84K9bUFSzbM5tCXBwiDOEo1iDikFjU5Uy2s6hm 0NE61Z7qhGrboQiJsXAYlKdRuhnQVjisprV9Fwx1+c4eoSNyy1Xq/tawnHI0zuQ28SVcZlOKFH5f lKxw89vs4+1/bgom7+9LbExCCXXAEMT19SUdTjhgPHPGc7A4bBb6XejllC1qF1VFfJ/s8ViIhXRl hyK0axJHBrj/aQZHor4CPCli50ePm0NSfpeNMec0BMX6Gu0N8nZs+Xi3C7qtCABFSAZkWIXNZDeA C3ykSxLgiYihShqFCxw8KJI8cGQucHFGKkkYuz5RRZSFCFIOe3zXxok9wIdPSEHo2uzZ4n2CMH7C hoy1YMSiQTHU709H1cDZELQ5k2O7AZWJCXfU2m5Nz5407kawwxpCMUEYKES1WwHdq391BU8bvxSH yHiSVigg7RLtRIDZycX8iD+Odn24bL3zkjE52ddDDt12uy6r3Q5Pih6eOyqB0MRyFACrObCBAiUA xUBAXi8eDISuGxXwq04lmTB5d12XfQs/PB37/+Lny/lfj5/ZdaNa/NTddV32Dfx8Sy5Wm86H/xrX /1DgCf8r+0GRftktrIeLrtsW0GStjsm4Q7PXrsu+haZ/eiCmYHv8YhSEa4rE8beEcOT6JCBxQEIv TGKvfWhjUpjghTktmOpWRwYzwO70ldCuJU0GHLnVd+aMoyRxQPuKoYqva+FvnfedKsVra6m7dBeR 7QRLLPBIYsVexOT1u/VDa9cXpJyp/MDzFsnrTmFY/25kMPHQp+kyeCWJxHZs2gsvMZeRNQqYXMqZ wMTzAV0xV6P22odx0WRaSHCGNI4jsghC38NThkUwBpyimLPh6Wq6vtdQ5N+PjScexDfdMww8ai2s KAgTJ4pMbxw8uZhz4UmpZgTKcXvt08h4ohYSnp7nLQN/4Sd4L6EUNuz0ibIsQYMADDxMlvdMbDuC Dp1G2WOJ6ZRNPvHKiG71vr0b3msXRsq81UD9NbXeKCapB0saGayn5o/lYouGD+u6jz03YLFnTfHS BLWmrtW1FBKwFCxVbLSRz1tvs9kHv/KOAJ5KUbnIwk31FyIYjGOJMiT33mYmhxIaWM5mBZx4DkLf xQv/3buRsDwqMQhLbiPBGU3n7CeHeItbwm82NXH6813Kjgyf60knO3KtTdeyouR7qi/8GHiPuClw ctHZJfi6AlaWc+7zQmohxTVTUxd/PlXpcn9WZbw1dY4PO3wLgR0U3t1lV8XIGQfRaRRtDjEeUN3d DRo6s76QnRiWmx/k4280htS25eTRBV+FlLR8gTIkG7K5MzuhSw/tX15SxmH11USD7UKSMM6lCJdN tF08H9KJSJd1cLbsuHgQ1WOvs6leXYDUaV4codzdiaP+SZsbolx/gVxk7MciFzuQBzLjkJZjKy1M azsqhZJAho4vDzDH0de15MHeSOv6g8mb+4OAg2cqLc0o+GIJLTfyo6zrm8qAYJx1vfP4WUDP42eB exY/wwOrwXHMk5iQX7jL4VVpuSD9FV9xSTaYmju8HaskGIexP6M3QyOhfRCeKkL49QmNiHBTHgkW tfXN826Nb+7Ax3AfrYBeYXuCYxDp+XIbPuILK96AW8r1CwzVrgfVHzqKwNK9CmW8C1q8yvyP/iHn 13f+hHWrV6QFK/38P5z++fsKZW5kc3RyZWFtCmVuZG9iagoxODIgMCBvYmoKMjQ1OQplbmRvYmoK MTgwIDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMTc2IDAgUiAvUmVzb3VyY2VzIDE4MyAw IFIgL0NvbnRlbnRzIDE4MSAwIFIgL01lZGlhQm94ClswIDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjE4 MyAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcg MCBSID4+IC9Gb250IDw8IC9UVDEgOCAwIFIKL1RUMyAxOCAwIFIgPj4gPj4KZW5kb2JqCjE4NSAw IG9iago8PCAvTGVuZ3RoIDE4NiAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngB xVtbb9s2FH73r+D6sgaoXF4kSuqbtwRIgKUXxMCKrnuQJTpRYcuZLXdZf/0OdaUoRaFsaXOAxFEM nnO+850LD5m/0Cf0F3r764Gg8IBw9nUI4RGeUzv/Xb7x5szHHDk+m7vct1G4Rb8skYXnGNsuWobI ptmH4Qd1/bnv+x6yPX+23KK3yyVBBC3X6PVNkop9ItILtPyGrpaZaBM59eK2ByIZZR2LW0NXrbWf 1QIc7IAAbksBqKn95T5Yp6j5unx/h77sEoEu43tx0P+K0OJ4f4THFFN8MTvVaIrBaupnRpc6zXJE 0VCja0trP9lU89MYqzLfOXfVTgdVajNJvAa9wDXGcMx6GMwc4AChqC1BPAXbx42Y5yTwuI0xvL15 j9Ddh0X2MIFACqJtnIDPiYcZ8eEjX1+f7nzigjYQgYoyp/q+xrMrXBnGusNyM/u/j4I4oRB2xEGg g+ZTwBAjiSHHEPsYScyHgtlpN3FBJGXg5Zbd4LALY7OKVFjHFXFltNrgsdbC5vRsJVglRVURQB2m odVylbEZffEgkcLcR215agRAJsxeEAFDHaSARwE8wpkqaxq6U8xforsxeOCt2XPlsAIPymczXXWD R8cAr5Y1DXjE0Uv76cwzAQ/k9YD35cP7q9tLpGZc2XGclXW5zA6QkRTJE0FJyEs8bGELD4y52RfY ZdolBLqJRillJBTrFWYesdcO5lSKm53UsZEKyVrINEhy+38HEvrGJo5BROg68B2yCrBYO+vCbTPZ dA/rfCscNRmz1+ZcaFWVrj6AuM/AaEy5pphZY3dQNfCko3vrInr+bChu3SW/6DIy0TNlX+JFAQ8E c+zAJo7L3YGWKrW58lLbPONF+yK2qv0W0zul58FT/jK0uPTiCDpoVKE2X7tR6DMaihURg4CUFVRp BMq00WHoyEi6g5hYgjkukq4edDYNKMHe2qF+tOIBM7a5KKddSLYNNV7VjJOEOlr+K9Hq/TkulKCE xkoWEBJiYvssgiD3oiHtfWG4Cqfcj8GGzOqwdmw8XdrGcxQZ5RbXIi0RcgdbvxiHTRe85B433+HK PovNoUsnbBzH2QwW81wA1NUHEXM+iPhyJqV4Ss5yiO93LXxGzVSyfZ2NKdEbVMBsXE+1RSQHWjsK NTy1WGTOohiTd9HKe/cOgDx5/kQqIBUdpunhLMo7tmXGQDY7D5hLKs6qKA8itKjaheHmGIlofjiu EHIBtZLyy8/LDOJXNz9vUfkxtDqmaCvneiuBomzwJ6JXp+Nbzfek9aVqE+HLCNOy4xCiGuELIkoj irlvBmtFVRXfcYcGliJ6Kvx4x3ZtXH4yru/GouPjJg6DVGQYyiGZfMmUXPOzRUj0TTJ0l4TiDGoS X1Y7qBGWotVE0NrYm5qaIEKjZgtaY1/2tURyBIg9GCFbbYmZ70aR4sv6hmFI0SHlvyWHYuVU5HD0 rg5wNEbRKG/Zjt69rne7eQrHOvm834G/y1cD2t0xPT3xEyY9yKH1UWQXAJ5xnKX2QEw2Vy7JJGjR tSunESecwxEm57Qu9FagubbuGZor5ZrYEhuPNbAp6skPeeIWBWlQJT3xlFfwVxUlZkMHLHUVVpyR CRx9xGI5WO90R2cziNBSXbJLKnReGj+1tj2ySccUmmupu7awucP7ciagDhKkw9sSgkfxlMVedhRU BuGUc19ViYlSmmO/OETPbW5+H+rD/hEOKKF5kxMewtfadbnDbTi3Pn/0aylSpgLT1ycoTdQav40C oeyMCPYheTvwrTn2raVVogzz0QveyiSpo0tOXccFL3Gfu1zwoSldTbjVxK3DnsoMw8TRaUa9XeZw PPocYjV2rXdDK22nFuWhhwVKaJXLpRnlBcCZBYGx1T1Dtw5TjZftS5cKmL6+X2gB1/VgZDB9fV9U Z5Cco8ZW94HZNtV4WTMwXabvELqwaz0bF0xQQmNmHeA5R42t7gGzw1TjZQ3B9PSOugVc14ORwfT0 BpVWAZ5zdKR5sNu2diie9fCyDm+P6eMU832PmZs8Tz9LWswZ7HmuPi9uKwvOqV+ObB6hn0dWLkot YB9/u8pv0P0dpw/Qz2/SGG5YFWO1QyXesO7UAJLyJkkhU72HOBjAetnaLz5tVf2h2nbWJ0WC21El R5FRzUL9lohrsRdvUPogMvdL72S7rXCXpEGcHGoPFd33XoS7fXQAutzFMGuCgdPmn6EBrMCL5bwJ rl5aimYTtYwEU71mQTYyxtdopiBlaJ2O3LvehQ9iK+CGyt3NLUD89QIFSQTQCXQdHB7QYnO/20M4 bOUnrhfMs+ET8QFFYh0nIkLBOTMHX15PczmciuS6qcF4hvXK0KFmMIG+VKtkE0AMV9OazWT6AGCl 8TYjMrwtrm2iYxpv4h/iADc0oziNd0mwQU0aI5mFTqcv8SHTUe5JcDOtJgWXkMnPSuBmUHUiUQxf Cu5Kwl4HxtHSV4m4nJZy2IhaHeIa4fA92BzBfXC7Viaox338XQ7F90FyL4OJDr8aWmceuGgKmceW rsttVl1nPuFoZQUlLmCaBexwYIYiRWhxQR0I8rkxnoUcRf9qUt+x+BlxrewQlbiWVzSbMTckrvvI UJUmgEiXsXwQB6EGb8GA0wO23sQX4sb3usy3cFYuz7fBIs3rOXXzM0RIS3uBkl2Kvot9vI6DFdw0 NyZEgalCCIXQLSTNCdFaV2EB3FDRWXC6vuq6ztmtVY2Dsi6M2yfRl0FMa9EwCg4MLi9Msa5t60l9 HD7ADZtJ9HVsvYkaR1/Ha232R/EbZ9PwjHvT8Myl0/DMPf/GWWcce3D9aoq48OCgbIp1fTINz3w+ Cc/gP5fOjuMXtrYwz9JLx+/icBCbwxskUhRs8iPXfDp09fQY76Htuw324QMib+S/06l31LJP/fEx gCaQen+e3gzUJ4CFemozYJ5xWq1ZXYGgYJbHFKxop38yzjitdb3yPy0tZd3yfy0VfT/9CzBnD8YK ZW5kc3RyZWFtCmVuZG9iagoxODYgMCBvYmoKMjIyNAplbmRvYmoKMTg0IDAgb2JqCjw8IC9UeXBl IC9QYWdlIC9QYXJlbnQgMTc2IDAgUiAvUmVzb3VyY2VzIDE4NyAwIFIgL0NvbnRlbnRzIDE4NSAw IFIgL01lZGlhQm94ClswIDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjE4NyAwIG9iago8PCAvUHJvY1Nl dCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9Gb250IDw8IC9U VDEgOCAwIFIKL1RUMyAxOCAwIFIgPj4gPj4KZW5kb2JqCjE4OSAwIG9iago8PCAvTGVuZ3RoIDE5 MCAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBxVxZd+I6En7nV2juU/fJBSR5 774zZyCQ9YYkhBCS6XkwIBPSbLGBLL9+ygZjWTa0DfZ0+px0CDmq0ldVXy2SeUW36BWVjx2Ceg7C 3j+nB7/CJSqvXrs/6CXJwCpSDKmkqYaMemNUbaEiLmEsa6jVQzL1/hj+o5pRMgxDR7JuFFpjVG61 CCKoZaEv55M5syds/hW1XlC95YlOIidYXNZBpESlmMWLaVcNtC8EAhSsgABVdgWgsPY127TmKPxV a9yhp+mEodpwwJzVu18L6XYX6MGhSFxFiGHEbJTXIOWeC/GydJBFZc9iwp4ri8ECtkUxxYlFFVbO EWBKMViNGp7RhPXRAatu/AwkhS2VxaqSoRy6aizYm/CQ3MAJhQcYNi0csSIkBXyYUBSVwN7N8WzE SisX0lUZY/jxvIHQ3XXF++UEiMDsj4cTsDnRsUQM+JMfX9L6dGB8ooE2wCCcMoUVGyTfbCK6kTAW 6Ga1y198zwRxQt1oVRDoINgUMMTIxVDFwF0YrTD/8fUQQN1okgHRQFg+iFJFiiKaGK+I0TiW9T0U JAh4bfdQYFrfQ0v+Xx2Aos+vnAo5oYjVvFGEzBxmEh+fFWJ8nAco0kxRDFTIB0WiiMUE7C1TXwQJ sSgmFrLOe7GUvCkrYqTEsPHTdaN+VUM8B7s11EE8rLpJHjiK0yAnUxESdfiVJ+76ngnOPhETAjkm lFxVytSepZAupkyRu4YrrrBXDUo2SAZC8kFSlX87kFAJh3HsKpahan1F1npMloi0NlvBbSPS1fIb HAUZhS8HBDZXQm8qLaL9dhiJWOupmkENTCzD0nWmSloGMAoyMoexKP3+Agt0EPxRNqS+aVoyJj0v pr2+spDMF2OpetN5rWQVuP6V9qhvqD16142/xwCZmPx2VVUbhy9qorvtIt7Ne2mrqXj41qUw6CBE ndHvE2xh1u+SnqJaepo9F2DawPUUPgPHbDTxqrvSdYAkoZE2cIPXjh+yhRKUELCEjpoSYunQUzAm QfEFHUXSoUqkPyeq26JBj1aM2W3aZWOdgsNTizTrKeq4XTbze4oiiYjYXg7HFlpUPrDlDfAMVMmn QihSElMX73DM9VuZWNUvtlwlBFZmtK9QyVLdSkum1HTlHVht8VLyAlONadV2gZkNjBjCj1AVFakq NnIr4dmI8Yk5KsVQe4qpW7KsYq3bZcxlk5RDTJ6cfTbhBOVkMKg/BWIEwBKjtSuXbtgERIi+vXWI FsMmVD68cfPx5FTJC0/197duRUkVezdGdBmoBDNJMg0mkyzYhJOSE5gy1qPOuYtN8gh2UEJwX92A 1qNP9L7SJxKx1CzA5KTkBaYilkC/RjINF+yqLDZ5TlbEYhArVo/qkseYfv2VsPngGBPWhbMegoqi gOx7OAXTqFNmy5ggQnA5OFTYDBsRkjyXS3T+t8sq7rkC1jRALSoQJuPw5Z5rrE413EmaVMIlQqSS Kh2Q2/ypMS8zJ49X5JjKLmNLyWLdNnGCsTBaH1asgGx1Wl7E/dF6HjpoXVGjZ9NB48VoPoRTJdT3 zkCdP/bHd3NSWITd+06UF76G2KCm4YtEtYNiiH14GF9J5Ry1UvF8lWJMvvW7+rdvGTlqoMO+QAZM FfRxqhyZTWbim5wEIMTw6LFSkmFW3npm6L55Xqo0byre2XtiuZHGV3cpxJCg8VUjwpKXkZFlgz1o kph9Uy/7i35a08WUlMaLd/HrpgKOigiZ4NO9/mCzuT1kS9b3jiz2JwBC3FQIDlfkpK799oALHvzs CE5kQQJ0WyBBSIUk+SWHdfwHoUGoBOsq4EvRdQ/QnDs0heGMe8hshLBZ36yhBCKjMZ0zNHfp2fGO +ZFnGqDodYTsMaMHNoLRkA5JlrMHgiYBbvMkd+UIWXL2CIJFl3Jv5kCEwCk/vrD3tAQSG5IymB9T 13OjQmZDm/V/fEXOcDAx5wubOX+i7mKOJtPgV8ia2mA8htZNZLNZOiCMtPUdAV6ZLOlf1yNnAYlR jHgD5+OBNxhUzJ2ZE1tUxHf011//+hdc5jpFcImtJK9e/ntkvpfeLbvUnzilYc+cTEpTe4AW9rBk 2jMTmfDeAbbyb18VOX32tVWsa3KgapGsnfW8xNDEE8PvcG5NkcPsJbMdcPPFBGIhsbdEsqvuBpoO t8mKUVHJKWlX5gvwIjBlFwgjcy+MkfH9OxqMpl1zhKaz+XA6cb6ho964v7+PGW5uwgokvbU0/lQr OWiRyI3lcYLV3DsXV4ZgGD8c19cpwE58eQ0vN3fcHAjjUCiXDrtZYbg5Eg6xAVxPq1zBJWTLjDpx RIWtWAhd3nUnERgGGrAXECQgPJn2eNwSC9wVa0E0xwi0ByWvniQYazBUIHDqhVdWhZGM4TZPnokP mla7ClAF0vZafr7GU3MvccBsYo3z68hoNu/OTyFCGnf1Y6QjuDrqgnvQdaNNBbJWKFdcKYmUI27A 753btgYFCBKCwr0mC6SqQ9Oiwr301UuswWGLAkfHsgYNzaZSOKSiU9yKDi4cwRmtp0O+eCoxs5Fc 8FTEKo/Vj+W38rTzd5PUZ2+DpXxVHdbmd1Wn8/xqX7SXFw/3s25H78zYvLKsSUr3/a1xfN8a7p8c iTsGoF5ypJ46uUIrYbHr9Bw1e1cFQYKrlmeVi/Z9h1ls8MCG9rBG7Z+twXH1+Go80R7TAhhbam5G 5SS6z9vzsTToN4/OXh7LR1Op2mncTj4NzTpiaTMJ13UHtovuN3lhsytDcdWgBHkiPJKK2q6Q5BJc LHZc7l0J4v3wrFI36rXa57TRtv4mNx/tMrX6zJjX2P2ictpuv41rkmE0Tl+Nl4fHq+bswx7Snx+O jV7Lg38edJ4Lk3PYEoyZiiSqVnKIw1XHlkeGQISRf+0IMgQzRjMkf2faNXKQIb38uL7Gn8FzEd6W fXVyavsInOwLo66o4ya6vbl23K35EQT5e/EnU35+hJRI8SY/wmMhOvRWeeTHlQ588GTupXDp8P+E J/S5YcaptD7atEIr+tN0MDg+UvWFfLq4Ua6u7xfNI2rbEnu4/lnPhsxl96kWrxmIbvheUT4rZ6N+ WTsZVt9H8miSCYuDIGHDyY2XkMUVuJIRxjQaDJmw+EoQ74hy9+Pi8UNrLPr3b6Or63rHfHk9eapr tfZIv5n1lvaNdMbYqdn+vHw1H16OzIWDX7qXJ2to9xjgcsVNaN+5THCJom+58pDYN8JpYivPgCDB hlVn6dAuea09sXHV+vlZPrcqz/eti8vJfIqXd/fD3sWldT5f4NOXj8fGxfEnPX6tL05r6OG9l1mC XKnFWzy594Z3vjVBqlJM/bgnvCCEm71uDnyggxRLx2iCXB9deofsfIK86ngJ8vD+0R2qSG5fvtIm X1D1mFsR7q72BHar36q6WEFu+kcNOkZ1S37Mhs4l9+RLg/MjAmoI+Ws9yy6l3TBXigcdanT5fYEM eyhXimtUrOGiJL67otmVLbhSPCqIaWVbuuzUps8dMvpom0s2Pzm57s50q6qbnZamnk0axuXxbe39 bnI3eG5c6dL9bRvP0xqRgzboclbq5BoMWuTmflpow1S2NRhAkEDio9a8pl+0WYOMj5e9xsnTzBy8 nQ+qWue5NR+rVbawy2OlfnckL+4mbXan3qrqWfXpMhtoPXVyhVanMecvefAMCBKgrUjjpqGcz9hy 0T5/Wi4vjk57x5XbWXWqXjava4/Li3Kv/HSqOtbjw88n7XVQro+V8hE8tH9/nll+XKmVL8RazBXW tKwW9Oex+VGHW2fhCjKaH8XDB7+BhE+MSOutgTbceQtxPwqDwIcUFAmoI7D5Zf0xNMb1ryYmeEZP eNImGI9HN52c1NdcGzAax+QGEUu5jNZVxSImk3UhX+fdoVCsilPmB+Y4bATXBtgcmaPgiAuh+rt7 u8BBV6bde0bkT6ggoK8Wvv5zYw4YosZ/07oeZzH/QzyKa/UOimJuXf9jPOD5DuxPnaX18OAfaQM3 WFePW9f/IBrOE27/B6i48E0KZW5kc3RyZWFtCmVuZG9iagoxOTAgMCBvYmoKMzAwMQplbmRvYmoK MTg4IDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMTc2IDAgUiAvUmVzb3VyY2VzIDE5MSAw IFIgL0NvbnRlbnRzIDE4OSAwIFIgL01lZGlhQm94ClswIDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjE5 MSAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcg MCBSID4+IC9Gb250IDw8IC9UVDEgOCAwIFIKL1RUMyAxOCAwIFIgPj4gPj4KZW5kb2JqCjE5MyAw IG9iago8PCAvTGVuZ3RoIDE5NCAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngB xVzJlqrYEp3nV/BmVcvS5NAzqAHY930Dr94AUVFEFBBRvr4OagqC14sp5DMH2ZiLHe0+EUGggXQR A/nMWwCRLQQ9f1ky/BOaw4jL794PTA5nUQohWTxHUyyByBuEHyBZNIeiBI0MZITAzv8Mv2E0m2NZ lkEIhv0YbJDPwQAgABkskD+q+n5u6vP9n8hARYqDM3QcHP/iBAMhcQx/cPHsq1f1pf/wAUiUhAAU 4QEg99IXTGmxR+5fhVYfEbf6HCmslLkVfhdBOFux4Z8xFEP//Piu0hgKtcbYs9JfMn1cLIq8qrSv qe8nAgv5KYmr4iz57lUfOugmNu4F3l14XV0T2yQfT6KYIGEcYAyORGEwFDAAvgdI+D6M9/OvKA1o ksFgpJM0SyG2ucpJ5k7Kfd/rgPS8DkBQgu963bfko0TFUTTsqospY1vyng8+7vjAtySKhhymu7up vkTbhqXwfIfp7zFm1zh0il3cEa/YHx49xeGIhyoCAN0IYMxHVeSGsyJvD52VljH3qjrWBGFlqJ2j iDFUbL2vEeQnFWAgIEZSHmBI2fhJ9Swub+GPkXgY4EWnPYO5OS0KMykRPQPY1mJEHmmgii5ZNSyn LXWVlcSCk7adlXYNe1KgSoOyhemT8rJVXytg9EYmfBk1IEw6mYCh1E9kAoQJ+U5eVpS9o9LoZjKk sfJ8MVK2zOBolgT3aBdLHVIcdFhsz9Kl0Xg0Op1KM4ayptNeEkb1hUnHqIAM1wGvEnUseoEwIaNS BVHFbQ5zigeDHzWKeaXWMJtdVjjRTXte0/AhRyyJIuW2sZrACjt0zDpbA+UTMGpAmJSMCsBPRCqA 58/9ITsz1mtHGDjuVjkJi0VnU+ZqZRb0atjyizcT4myIHVJRruxLalGcY01dEjBFM/SViI4H7GEy mSXA2VFlE+ZsWFbeG/PVRIhF2REUu9TZoPUCO6RpTs6Ie3nPldi9JTr9Gbdt4BRZxBqQ0MUpl6mj vN7pGOVSrVdbJ5AHviwppQEdCpFXLRqPWsKVJtlDOeD8/Tfyz5/fjzvaazUoFgHhqyccdVk8Uoog yUDgXpEMMCSKcKt/r/5AEJyCFRF8VVuXP/V6/WoZ/gg7qHpRQBgEFmnev/zzxzthh8NSkbwTKJ24 y9I/EngQJsQYz5sPkoQNcqLNR0CClCwJsEijeImQ2JkVK4ezECdkS228744+ScvtquvJZioXCPoz YwZgP77feKAwuQFgkCvsR2AK0h4z61pnbfVKFc09HjfuHo5WMgVeOC3MCmUb5CQgwvPe59f9xwN1 k8n5WwOSBTQWMujFb0Gc71vw1oFccYIW1CsHc6h121QTYPbSKMwbmWmhNFKM/q51yhDYZ1sSD1Id rzFFtyOO+EqndlrXm6OrXWPXJw/6unutP7ypVlDf5+66D9RfjM2yGPiRetnDCfmPwgcMLnGrmsmd Km5bKs42biO/kzRDLhax6sbVGpW+tGhKem9RazCCfcjUCmJJfYexr/1yUJqUiAajfqS5y0KckF2x cWG8KMpD21lvquJ4AoB73GUKR8c9DbWeRh+JzHZNruriuKqQQ53nFhTPDGgyEbv60qRkVxzgP1GE ZSFOyK5jfeJqy7yDl7DdpIpKZENQaBBgz+/TD7gR+AU2SD8NfLD7PC7VFiWcWLWsVXsLkld5kp1g rinhEtYLiPCcEZ4QeFTd+ETzrE/wCRynws1dOgR+wQlasLOuomy/r9tFp3IqgU1BGpH8pms2yj09 rx6cCUcvt9gmczgQ/Q45G84mi0x5MOeSIPA7rVMhcAJlfiQhIE4oIUBlzi+S6kuy0esnHYHwkA9p ACPw1eR5OPm9tSZRiPi9Sb/NJdSY0N4xRyDZgDQpsTGJRu7mpFJOQ5yQ666tCQsAQcPh9PW+CINh 3q0ShKDhLD7Z1iQgQlrGJH6mFCOJcClm6MyJb20rBbU8G9DsEBvbieQFCztkgMIbFNkoJlutSstt HxU6bUXoMFo5Yzgd2RQB75RXlZNjb4cSlkRNEoBOy3Hsz/TnJBtu0JtHih+LmpKpFE7SUcVW7c32 mKlWje2wspwMp226OlzXSppitut5hethe6dQMSd2Inb1pUnJrhRB/MjRBnFC7MLyw27lxPa3I0A5 wgZf84Ni53Qck6XShjnIM73OlWjr2BcYfioJrV2vWlQLR4JDakP5PKd74/a7N1ViSCQbkCot+7Lh mfcrB2KkvwwsNtwORIoNV32/PxBb/WLeO0UW+13O/2+4++CdkG9N7FjvYISDhGxArJRsS+M/U5ZB nFDsNifIedz5KoP78wfKm7RSsN7LRq+eTMFEeZs1FDyHHiCc3X8d1F4m3h/f2t7xm6qAFml5m3kw VoztgFiZRENOuL+f4+fGpeZCEIYiznPvr7E3zJnzS8qtJF16g/RJL3FQGrrLl+Jqyjc2oQLrIbf9 Ew8hRPrW3DzMTSsHd7lyL9o0QEmA8TZcYCkSUOG6KZZMTPutLoOHZwfQC7Elf9ZO33g1ChE/GqaJ RUNAipSiASKkGw0BFdKKBniT5D5xk4+GCET8aJCTiwZfirSigQnvjiXMDZAjwr5KJG99bmCxcA2f eDREIeJHg/7qIfFwHgIIr/Fj4HkBZQnnL5bTJFlfye/yOe3xOazcPYy0nUaHG4TknRaBiO80ay7j OWl3s+m3mw/g29QXJ6WSCS61pt59eBih0Iha9boqcNsVgPXz+QVQZDeXl1sTVk+ypOu5ram8s2Hr DUMwyrtJe5EqOKKOXx1EasVAEeWzDICrHqG8eyViIyCBOupWgngYvzVueBHjWtcj561VOO58q52j PIvC+4rQomdRUrUoAD9zQw/uhYXv6HFOkeNkfkXv+5K5x2oky7pTYWztmq1yi0ar/HhKuCvj1BUq bHPAf47ybjI0TnsGxmHN7AkViidqfBrWYx+O14jye8zb7vKja7+RDoFIDaQDoB5U5F6Wx1bgWVUe 2B6IAtkTW3dWtdp02sWncsMYNMZFB+AET8mDZsUUd+qAm5JjzlGIiTwe2sxmJncGq8arHnxs2rPe qeYFBsI12Zk9XzDtPdv8Yp8frphAQr6vo3mNMkY9rVdAx6tSfuDawnCxdqwl6E1N2jyYx353WSLN JQ3c/s4Zkaqq7ihyfEzEtBdx0jUtGS6e0jItGa6g+rOaqlVQPpGdQ289KAyQTOYFUhxHw/ORpNLb P/GiGNFy4tcnHo3gyZ14F1FSDT+c/JmbewAChTL7fOJNW6MDZWtKb9bGQXPPzZcureJco6c6oqKN 55buHrRXc/lxv+I9iAdYr5KIKq11tc/Mku+JJtvdCrEPjAurBY6jwIkXVTj5dIDa3LNllDu+v7AS OPHwM1AwEOU2Vs0U1m2iC1r14/ZIFIbVo8r0j502XnYKdrvUYw3sM19aYW10I6rSYjoT9mP5atr3 FuYu4lyfA01l4QIQRLgWipr2+SJOzBMPAoV8iLv9GT9d4QYqO/nqkS7bZXZuaI3MTqE3szU7U2Yt cVFxeLShG4MCM582OpbZ/nw1Sx4WExdxgp6OH7X3Gv9qGREQbHjcl5Zp4QOu9+lRndFrXloZQnvR 1ER9iS12GfiUSbtdEyt7AS3UwVCzrBNPdupWEd2P3C1pUe6WTca0Z3FSNS1JPGi3Peu+yGhfz2H/ sk6DQCHTrib1OWlnmPGgKZULAsEeygxa63D1Ij13m6vKZ0uUh81VEe28aszfsXlU6Z7IFPDF1sBm gt0nX9T9MZtHFY5v02dtRaC4IZnwXb5oXiTC5hegYCCe4GIcx+AifWC4TM9ZEsOyrh7rPONuTAbF RyjX5zYV91NxKuRoiuqVTKM9dUpfj92/x+Z3eqfD5hQevt8UNW0ibA6BQnmh4c5uusuMdxvmvYd7 GO/hHsZ7FAX2n2GUxIORYsLl2iss8izi/Uo7ivF/q7QvogRTIr5FYx57NPZgWueF4Yv89FtuhkCh GLxU2o5eGkjr/EEa1q2JuiI2yuYoDmsrUD0pU70sLafrTakooQ1A1TIDeVlP4llg7+kGT5x0TftD z04BOvL0lCMr7mhhHYdlCWtu5vDxX2XNbbd53D5lzvT4yl7D45MOwHsgAFaJ0JQRPQebbdNSToxt fNY4FSMK6qrizgiqsSjEDqtrsj4sB6MKxw/XZyQQOPYYuMV6X6VFuTmRY+8CFAzEUv3TaK5mI6O0 E/qVuYGNDuRWXdtV60hs50TdkhblsdBqy25dVCqkti2rLUyqla+mfe/Yu9M7nWOPoX+oHIRAIR9u zOomk5nkd8u2tVbyVlfQKLJZde3JYuHWTkeNs/dWZi5z1dVobvQko7swmUZv+Gpx+DBqL+IEPR0/ aq9s7l83EKosiOx7xc6yp9elIuVJEteF+9KRTuvV6/qUFKiLfZPAz50ID2zhzMaaa9ZfyHyPSFru mszet+JxtzLnFtKUTHmJgL+8DzECgffPP/63Iylz+GEn//t+JNw+3Sh7FS/xSIBz4a+pLX7dKPnP q5b1I4z5+nwr+Mja7bpfn3AViNzuvzPUVLgKZW5kc3RyZWFtCmVuZG9iagoxOTQgMCBvYmoKMzM5 MQplbmRvYmoKMTkyIDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMTc2IDAgUiAvUmVzb3Vy Y2VzIDE5NSAwIFIgL0NvbnRlbnRzIDE5MyAwIFIgL01lZGlhQm94ClswIDAgNjEyIDc5Ml0gPj4K ZW5kb2JqCjE5NSAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8 PCAvQ3MxIDcgMCBSID4+IC9Gb250IDw8IC9UVDEgOCAwIFIKL1RUMyAxOCAwIFIgPj4gPj4KZW5k b2JqCjE5NyAwIG9iago8PCAvTGVuZ3RoIDE5OCAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4K c3RyZWFtCngBvVxpk6JKFv1ev4LXMx+6n8+SZOdFTMy44I6KS1ny6k2EoiguqKCI/vpJ3IDEqsES tDuiqror8t48efMu515YYxK2xlJZE2CKieHHP6YC/wl/JajTz8433CvJ4wxG8+Qry/AUpiywTBtL 4q84TrFYW8Eo4vjL8AvB8q88z3MYxfEv7QWWarcBBrC2iv0s6ZuRoY82v7D2FBPaR9Fh5LiLUxwU SRLkjcWT967qav/iCqBxGgpgKEcA5tc+Z/TVDXb+hBb28gVUHAl3w/HH3SDCohQDcLgpAI4ngojJ 1VqYvNRHWE4bj8zr7i67xNLb8Rb+M4ET+K+X7x4agcNTI/zbfDlZBBYax7PJuSfl2hlFIHYWxaok Tz+66k0Du6pNOhfHdz2iPHOKhnZMcCQWFMPuSmbV1vR3zVgZG8kYLI2EsLHmxRW/fheYdLMt5w4q NbXM2qpiVfPyZmEf8ir5fQMAHNSGoBmvMt81ABfUWz6HxHH01E6o3mtnZzEvPtfmgorjyNmNUp3y gR4Vp6tdrqXJVdYWuL4AlkAvqI1N2eZlPUMO+qv5pl+md70E/V7PVsa9B26VC6qrTDygEjT5DFCh GARUe1F+s2rSfDcU/oV9/Ap9hmef6/oKzvHqHA2DU0BGeF/xlSe/3moCRsnArb5X8Zs2Tjo3GsAt BCSom9Xr1tBe+8aq/3o0d5KBNgE/pdrJ+pvNVqkAv621hCzGYY9cZQZCSQDaq0akVgcYGBQJwDsC EKs77urjZ2g0AyEDsE4goqgba4c3g0Du48kermYAaDR7OB1EeDFfWdvVDwXFEDjgAHT8MORy0OGe fsRZwNIcATCKBTSNXW3lAY9OO0gCmNi5G43UDFwkAUDM4F4k/Qf2iUcHcC/+e1vMzgvpdcM+zHqz dJuVUlJtI40yTM+YNRihUR+pCV5a0inioI936dHuXUhL2j7PPwDqJUx6lIkHVIZ6BqYwi/ZDOs2B TqusGUsRAGmdaZEW2S8Nu6nqe71pUsKBnFSVSq0OlErRrG+76fVhISQyjUYEkLq6xIMoYJ+BKEBT xrShTrgaT0/Xk9SasVb9DN/ZiDOJJjciofY6oGAe6tUaPtPtQXGcK6YnRN8WC0VsvhbvRfVmVAK8 k9qxBBYA4K6IHXDVBO6EAY4OrhvehfovPqxSb3nqJImmctC/hA4xX3npS8AOSggGbAaHlS0M2YGA nW60m07Exs6/AcPft+uwa8bo0Sie25Bkn3IdoBjEw1zCH3BqeCfOO9EQZwmcpgk6hvDn0SAmJAER qENPATC0jfqvwSfxLwnlIFh2l1UtYcmHmd1fVg2iVJD13axpKTmVqdhaVxqCrtxIdRLprv6WYEVt bXYbcl+NoqTxahMXrmyANYgHV+gb/VGQ3yybgjEyCst8XaunWzVbnmYKZaM5ni76Vl3kO4mq3FKW eoM/GLX8kBqWtsxsRUdx8YGrTUy4wtT9GZEw6ZQIflx79lwq49ti3bKBXMxnp8w8vQHpbKe0wyl5 Iu6H7YVGsAonHoS6OFpZOqsVWYPFZuzsGKy+7VivwcqrVVz4MmhZdE+88vsCf0i8xiuCQWvYYMBC K8xjZQk1mWx8xWjtGL8eClqXBCPpUSsmbEnwFKIjCeUgtnsq0I8gPsJzsA5HwLIAuyEimqTmWpcl SQatmO4xxHCJU0BE0BDRzOlkcdixG/HjBwb/PmR9jFPnEhwE1NUlJuujcO4pnhPKQazvx2//hcD+ mUp9/Pzrv3+m/v2Pv3//+PX6+z9/O+cYL06PyGFO/l9DyGXcYAKGvwKCwJI+cS9OG+jj497cxbsu NHFAMMd1EbjuX9ctaTylAXDaFfCG+jU/NrDAb9oP7PUhKhJAbuYVkly3lo/6ikKeCDnpyK9oUASM AKGP9ysvQDnNMQKefDIoA+E70WCE0p3YhTn8doS/ModeZWLyAzT+nMwUykGs41w98TjAGdidulRP sZGHSY8KcYFJPScdpSk0He3gZE3fSCxZLXZXanXRqXC6aK5nuzezXugSlaG53xZ76elaaslWZbBZ DCy2mFkIUaT5Hm3iwpV/ToVP82iJXwSJkkbKid1GHYpyZk/3synGLA5ths+octkEjL1d7BVxnt4z JEHnKm1pUBJriUhwdbWJCVfIWiBRDbps5xPap/pT/M/KfYcd8ZdPmrrhC0Ylk2WVcTa0tK88uNNt wTnYskoGpQ2JhZlPbQ8to2fbY0osS4dMw5rPdu96jxywo3JrXnrXzExJZzFywEVVn3kUiesA+Rv9 itBw+g/vk/qM4dHMG6m6oLmgafE1JMZDKHpUiglXlnxOdgzlIBfDjYqQTHQan7Fziq4KcYHJPYdU ZCGB7/cybXbRNIb9caLbWhQSOkEsNpmWlMJ7pJUwhjldld54vFqj82uSqNEVQuvl+9M8m4/Ce3u0 iQlXjnwOgQDloLiuaGZZP+j7japUKbVohHY5X3lwzvHgPEthyaDEdV3Ad02Fr3Xr2WxnpPBZttsH 47KkzOeCNV6mxUSViYYN9giP6+C4p8wNJSGgyME1TWHaXTMJfmrNqxXxXbJwW9qK74AlSW67zKVs LZ2XWnpuoEkVe9cV129pbWHRGCubUUVFj1Yx4csTN9LF0CYaKipCEQi0waiIFooX1nLR1+abpWeI 5nHeknCGLgkOUnEexeJCl31O0uh4Ar87j5y3DIoIn/l+5clc3hJOx6Dp0z3p9VdCrgz6DRlBY0RT tCBz+UDQY5y2PCTskmdVXjxj2A+NUF0JUWdhtFSJ5EZ7j4pBq2qnFIKf0IK+Oq7rGBUEKSAIcqLO kd0iRb/PIsE29Im8PAv0ncpDrOiZsnTWRQ4lKlYUOEPk5NGiAmBFwYuSzvoM61hsYP1ozttjWACg La6ojMr1AUEZgTBzIiah6MDcx3lQM0rmEk6VOZv22lx4XAMh+Nb0dRJKeE4C7AhCQtG5TOMAgPMe zyAvzzrEiicBnpOXAigIwbNg2Ye3Kkcbwna2K6w326o9mvHaajfNiGq7ni8J+zLbV7Nc0X4TTWah 5vspXRBTDwSty/wjHP84qhMvtPSNlPSu2OK/E58xbXCwBk1MS8O8ZeXHibnSW5ZbUm/bSr/18nPS bgycwPZyx6NRbgfLcyEBcJpvkEVw5mjQXY4N+61VrcD/kbabbF4cZlO96VYW9DWtzO+Nq57GnOfw AhsO72e+itce/w2DBWKuzsnBj2cDL2E6ljfx8yQGJ0FeQ1QlRRObObZJJg66rC64IbdNmXr1jd9R ucS8nZGNcrmTGQFBVThru6At643l4LSKvOxFVbDB83X271XLu/NQvdqbO/dCTN9oQ3ngvVOIp8Hq hkgSPpLhLyiCIRJNk2NmMsFJp3ih5dEk7WS83z3DT10PyaP58zVKUoCDE3/xk5ngpEOseFLUjZko xBvcY66f4gkFIfYq9tO5zlghVYW2EgkR7y3W08KMnGaGailNN+8NhjcvJSAcd047qXdwp9sGQ0w6 rXnDzMt1akayI2NaKmTVfOirena5N115cMPhbTSkK6fgg6F+HxC8DJG48pMgryFOE2OO2isJaTxo DUd4QyqahzmvCqlEq0PL71qL7w2VwaEl2ytiZORXcr2tTIzV+Aztd8Zi3Cjp2/dxLiY8tP7M45Pn r5PQZAIV+gnb0LbhF/TpvYCCkDPkAdOmLJvRaN5UlsPpAJ8zg9xeTiw2pYahgB0zoCadfb3TNnPS Ml3u2UNV2Ipj7G1PRRYlT2p5Tzx6iLkbbalvwvtJuw/QHNqSCkbJz5jNraFHSmsCHvoignFSy5Na saLLkM/pU8FqEs0nI2c2b8gIb40hfSnDofkUvO+hrfErIW7OFpRxtMZIpFxf75AEQTFefj7Q3w6S p9GMfZ71iNXKWeJJ6SAUhLhpyHKefMmfHz9f4dDnf05fHpn85B0qEpAOkeeTF8Hop8MQwtdYHBeO ieW8jq36lT9OfxJRTH9eUzkfOMf1o7mpnhKODTwfFb07CMrwhxwn4UCD07WEi4PlPCkU64XliOf0 22CJhjbcrvUbQRIUea3f4hvRPOsQL57sk/JUDj4a4a81imMT0jaj5coEdW7b3QvVwoiZrJqpurDO 6u2i1Z/Md5o0K07qdLZ193Dm7Xru8oqDJIAKIY4Mvo9lssinu6PQAfWco9+s34Lrh3cygXU9noUH gbT3+/p612UCCV8U68JbE+hL3Luue5QeKstVHb6uAmXQuyPTHM3NP7DRBuvPT2/mcNwhhgn2SjNG Jib2DWWCgT/gPYZNaeTzV6M/HmEk+PteEsG1hOubl5Jn9R66xp51L+/4gg+84ReCmTy/5evy1Mg3 Xu/F3Vr38vYwj+VK/wPZWnxfCmVuZHN0cmVhbQplbmRvYmoKMTk4IDAgb2JqCjMyNjAKZW5kb2Jq CjE5NiAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDE3NiAwIFIgL1Jlc291cmNlcyAxOTkg MCBSIC9Db250ZW50cyAxOTcgMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9iagox OTkgMCBvYmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0NzMSA3 IDAgUiA+PiAvRm9udCA8PCAvVFQxIDggMCBSCi9UVDMgMTggMCBSID4+ID4+CmVuZG9iagoyMDEg MCBvYmoKPDwgL0xlbmd0aCAyMDIgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4 Ab1aW3PaOBh951douy/tdAFJtmQrO/tAAk1DEyjgJFua3RmwTUJTSGJDGvLr9xMY20gsYy5O01wI GZ1PR+e7yk+ohZ5Q+SQkyA0Rnn+ELvwKl6i5eC1/sEuGwBwxYZQsLkzkjtCxg4q4hLFpIcdFJp3/ MXyjligJIWxk2qLgjFDZcQgiyBmg92fjiR+M/ckH5PxANWcOnQUnWdy0AdKgxprFi9uumlhfSAAY ZgDATQmAVq2vBr3BBK3+qzY6qPsw9lF1eOuH6rsIVaa3U/g1xRR/KOy6aYph11TMN720qbBgFG27 6WSnyTmZVDmnQ6xqCLbvqmsPKDbbkMJbkVd0NJkpKWxQsclAB9Q2kA5z2bwfnVY8p/Yt6Lx+DO/P 263pmdO++PU6+zQwHy7vu8O709ldd/b6ue++XA+mVbf81SuL3QVAbLCGMp42ZlcBJKSu81kDY/XU FqxmJnU1NBRWQkNCKsbK2VU7Pxm/9fzjXzPiP4/Zr2NnFNop1EKWQLF2cwSDTxNiI9jcEjVib3bd urpvTB7v+vXPINjb9lN32quHxnm1/OTM6qz6iM6fK3+hmw8pSzaHxkhUKT/DBphuszR8FA+z+9km qcYeQZmx3N8SAB0GwpDeQCC2awjTYFyaBsNSL3jsleZS4RiCNEborLFQTrvdOTuFHxuVr04bwSmg 6C9u3h/AI1IW5eMRFPO38AiAUc6OYmITTAW24DuHFCJfYotixihDpkUYQzHzezDJZHIhBABiC/Jh kjC1HlgIJLtEM8UWgFGYrJyfdav4+fip0mpNTHzawrVB74fdPJnVxEunXW97s+fZuPy5/Kt79fen 9qcvQetbcF7p7EHqMmCnjMmJVELeQp4EBLKabKvlL9YTP7lwmi9O+2RK6/bMD7lxXR9GobIgC8vd gzaRQdswESArG+zVa9747qMXun+/du9HzVtzzL6Gt93+/fNl53r3QB1nWX2z2SWaKVBDeblK5raO sAklTrIayvHwdPLy/Mp+NMbuBX656t//6E+OZ8FzvVVpEveSjMY/q1988ml0dUym549XXkWc9c06 uru4nOfAPSrYKAcmNuXkDpYiFmA2syJWwwt0Nam+YJkBiVp06gnQ4DL9JQmw0amdyNdxsI5S4SIx 7pUFhYzdFkeJVfnQWjTepCwEGMUx5tztU31x2c8xaiF97ezC2ORucfVVtFRpwJln1t4miKX2dARd fGr1tai60Lw5f/cOwf+9BMel4KiNUqbkpDhCtf5ROtEWlK668/90IkXAUTT3rgy0HgFNWacUm86O Q+DDjANjOtD3f4/++XjzoZwCytTlJL2FLdVtM7pu9Zub3esXW1ptw8QhbXV00LBuVmJWT2B1TCQr JCwgwUsIJWiT8vAdKm3TdUVICTNQPkD9QPm65bN7pbaBVEZIHJ9YVJHQNjLdpJ7Y83WIJJvMvQK+ qHmn06zM3wrHYcmDz6HbG49LD8EtMLtP6yVAdBQSeTFlVE5BgJI3aRmKgKOc4PjBVUlbdmCYIgIT ObwgnFAsZMKfsw+ZaucaiUino9KXU9bkxStf09Tu7tYpr4gVS3ncTkbDiD//RK2pH8zQZDjyjxC8 Pwp9NzNq5CeJi0sdEkwYEKZhZXfxTe6XuLhB8h6tFHUIIKxTa1/V2keICFrCJYNCS0R/Z8bN+/Qv 9lKdPDBiAYkp/JxUZ3C1ldsmTm6KxbHqAEJxZCDx+nOtcYQ60zFqujCLl6OOI0McQRlz6ZzIwcoe TkslfTBxKKaQI/rS08tMjXAibUKhziIc8u8azjJ7zCbGEmmb2FYo2+ZUNrlPfCo6BJwKTFpQOHyF SABFQOC7D4EXQmIa+WHYg7sURP5A/dkEfjCESfaSOIMzohhagJQdOUkcmm+lltmGzE0HlpAJc7/V 6YFaCqiFQLfZqF1UUTxClAkMPvYqAizJKdQAsOGlNTlRyrB2PTUva7KH+FVa/68RAJzlTqKERagg fcv2vIHFueiTniE8TEzPtjjlfQuLPmOWZbrMszxmD3p7hBEu6ZR8pqzIi0/zbWoqZqo1lecyxk1D 2LboEez3BnxAiMchfGLcMwdC8L5ncohMjJi+aRmyAdi9nLJkmWpAOZUyZFdKk8icxE0mtFnTgSMz N9U5YaXE4JLFufNRu9l0MsNppVPSleoY2e/RN8V+KWjMIbUUdYRFUdMpNeARgGgP+w2LBYARLCDC A5gSf+XtfGaiokiRHHfSRuorL23f4TGGREVcaDXRttYml56pOjxBsIzc87sOsUaiW442ZNLGpgkN vL56cduwkFCUuvSWF19wV7lAUFSTluirfL4j8CeBP3z2vXkWzXxEmueRuN5et62sg5VNnkcMWTta UJLqCATvYbkJ/Smxwcn0dQ8TM4i8uiCCrEOgpLSH6Uy21hjKad307F6snWXKx+B6f7UmO8iytqF1 nbuTkFhr2+qY/SDWCpiy50CCsNQseBBr4WpdbRUPtC5X657DrEvgIYAc6IVlcxEZoSQXlcG0OBeZ EQPn4sMQ8NW+4jB6MEQ+OpM5Nw+dmXCdkMe6zMzHj5mt1U2HCL7gbvnojNv56Myi+ejM0u9LD8Kv DW10HjqzrXx0JuDJxDzsFTwXncG4dG8/XluOJ/UJPImmpo5rmAr6P8M/kD9BvZ+LBw0XU6Day+Mw gCnhRS9w7+TQEJ61Jou3kq/fv8JIERn0n20bh6QTjB/CLkbmFVIPtmeP6FqHmdo2wcuJghFNoH7L 7BHauvbyMXy4TorXXT6In7K39R/kESX3CmVuZHN0cmVhbQplbmRvYmoKMjAyIDAgb2JqCjIwNzcK ZW5kb2JqCjIwMCAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDE3NiAwIFIgL1Jlc291cmNl cyAyMDMgMCBSIC9Db250ZW50cyAyMDEgMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJdID4+CmVu ZG9iagoyMDMgMCBvYmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwg L0NzMSA3IDAgUiA+PiAvRm9udCA8PCAvVFQxIDggMCBSCi9UVDMgMTggMCBSID4+ID4+CmVuZG9i agoyMDUgMCBvYmoKPDwgL0xlbmd0aCAyMDYgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0 cmVhbQp4AbWdWY8ctxHH3+dTMG8S4Gnz6PttE+nBD5JjeIEEjvMwR896nT3inVXgj5/i9MEaVi/B 3i6uAUuWjPrz+FWxeDX/ED+JP8T3fzsrcTgLefnnfIA/kpnO+/+2v6kz08hSFI3JqrLJxeFR/PVW bGUmZV6J24PI9eV/hl901WRN09Qir5vN7aP4/vZWCSVuT+LDD0+v3ctT9/pR3P4uPt9epGN0nPG8 BkmjzYzx7VKrrvQbJ1DIAgTK3AqI69J/etmdXsX1z6evP4tfnp868en+rjv7fyvEzbe7b/DHWmr5 cfPeSmsJtdbNpdJjmTZ9i4qllXY1df2Ua6+fOKyaplhrdbaDpmIbC94VXtA10c2xCRBsCmBAaUEV Xp6f4+EdJFyL59aurs2M4Xh4QwWfvIOW/Ny9/K97OWfgfdnUTBvr+zEO6HoCOXptwBdrwBLU/K6e JKJ93Ekgb2zAG5VUxUyLmVLaH/HDVyF+/vHm4pa7zOugTUzlXAepAnpIy2pGbrvUfV19UJOpwnqy UjNNdtVBv36IBhlC8QZCMapEA/2iy3qmEjzu4TwQmp94oO2I6MIHYZ68hcg8nV8fjhnwfH++v3sa 1KJhdk1V22BfF+DpnsTmQ7xDhsZC5yJSei5yB854eH7MYGxQtWyUgiKoPId/V9r+VssGCBcj5r9+ RI26EGstLRE1eBEY9DqMBeuJCF0Yr5pLaCAtiSLBGJNBwauC5/LhePZ2TKaG4xEIYjxmLFTgyuWt 34ydbWMaJBaXnyGmvTt5mGIa0h+Sh/gKkp7B8WaMaSDgdT6uIMI33EW9Fup6VdugWQpUgSGf5Ak0 jl7IcD33YIplE71EgYteYji+c+PoJQK4cy+kztG770dkBnqdfiJ6ZZmWXleBNPSqwp+wQK9Ee10I gpFeqsBELzXMTC8VOHcsTVPYHDiXhaAKON+GnpjzjgOXdyD1NN4BAkm9A1UgkXdA0p02tiuiwOUd xDC3dxCBqNh+ZKPX6SeiV6m09LoKpKEX1qPSwksEmNgldpnRJfajyO24yHXyacAt86TcuuKnwVal XqEjAkzYErvM2BL7UdieuLB18mmwVf56IK5edN715kTQFT8NtltDlkmYM2mqAOBGNwxdxLBZqIZ1 LWqXY7maWmV2ByqAgXlzcnnH5Q9IP41DgEDSQI4qkMglqtShfEsUmGI5NcxNLyl5FL2/sdHr9BPR W6WN57SHeNYtpoW9rdJF4gR6RoKLX1p4boCpQhTB92wEowIkQhgU0kZgVIVEIVhVOjnERIINYmKZ HWKiEAXx73wQuwKkgrjyT2rgKkbnj28m1tsZxKKthlaQXSTWiq5SL5VwG7jGJr6yasR2xu5Ss7M7 9uPa94wAl2vQonO7BlXA3LyZX/+HzTVQARK5Biikje+oConiuy5Tbz9uqQQbxKTw7BAThSiIH/gg dgVIBXGZdg9ypv+5M22j/PMZ3LuQWyrBBTG1zA0xVYiC+JENYlSARBCDQtpIjKqQKBKbMvVm4ZZK kMOL4WMyZBFwOrk8Y5sH42mze0bBwxjvdt/Aj80x4Fibagtp2v3OdG2rW7P08JlL/FRtT2oWJax4 ur4agJbRid9wrAmb7Y8aWasexPGBcrDq0kl0lsklwrmsU8/mqAQfY9Q2N2NUIcTYJYkVQjV1lqtM ZvkKtkrLFlx62KIiDGytoAAdmUMUFP6yxJLhMkTaNHGBU+ceaMOhrNhLGIFIQ22zU0BKH6Dgyz97 DLQUj7v7hwyOB2fd8Vu2ggV7RFjnNbDgCpKIhUL6s3t2FkAiGQvUNjcLVCHAgjfqyBaGn7bdr0Ch smNDDmEBlSMVCrk/m+VHIfcXYvjCQkFss6NAFEIo9FEBBge4mZapHK54qDUc2JBgYLMVVTMVB42/ 88LPQePv7A2nEhmGh4LYZueAKAwcoBww6raEy9bQOF3Z+yElrC6iigw9PVykujrWSUNO2x5QQRYm 9Kqy1zYM5LhIPtGMp4S4lvaE2ZZK8IFGbXODRhWiAo7OjMnyTOkV8aa0446GFASVIVG8KRsy7Vlw 8iUqHQUJj7ThHClDvKG22TEgpQ9hcD3xhRTk2LbHFSRUdmICCQiqZyIQKlP7819uEEAiGQjUNjcI VCEEAkpAqqxRmVqz9DHFA1SGVBjUyaenFdxLvB55htO5DPGA2mbHgJQ+hMHNzVLnn01LlIYRQZVG bKGCnpvilTbZ7uq2XXzRBS2HjQGHNmT8QkjcvnBtku8bUAk+0qhtbtKoQoi0KeBomOwYyCIBmBVf oFAjCKgUiUIOXPb0kGaf8oCEF3KGk9UMIYfaZgeBlD4EAklBTm17WhqFZiICqmciEBqdfO4LEslA oLa5QaAKIRBQRCgym0auWQKZUhBUhlQYVP4dGPZ40FT+5Hc4Wc4QD6htdgxI6UMY+PFA6XdMSeaz knGMgCp7EVweo1dBZrbkxhV4ajc+CQlNTd1ujJLan5wugS2U6UzbMTMafLTNGOfGbUYixBsKO0rB aki5amfOLshdll6HUmzQx8VWwICW/DAMZfJFeGVXF69nP8O1AIbQM2OcHwZS/hAMJPi0bbFmJjxG HFzTRMMQ3O72z2YtCQ2h+ONCA2iko4EaZ6eBSoRomEJDnTVVphqZrYNhXC23XQXNmDQ2wOzbG+MS 0AAz/OvYMFy44IgNdvng2jg/DUQiQMO4da9g6/7PbPXNEjdQ9BXFMMRXlHgtGijc7gzg5sMwVvT5 5S5bmPrgw0Ljd7u2VsLrrvjhLpSWoOFOQ9NfE7EE6ZCIC3BU4z6+fUIS8AkWuAErlYB7WKQe646H unN1M6bjWQqV3h2sm5EYWeq/3Pj2hmN1gkN16yLolF31bYidJh63kNNg3Irk03u4kuXP7xkjKDXO DwMpfwiGaTy9pNkqrzNVrVnpmcbTvqZJaTDSX8heEnwIciiIuuADGl6AG+5+cYyn1Dg7DVQiRMN1 rm3ag64uZ27XrAJPh25VX5a0SBTJj8MpA9/+vB7zOJEgxvmRIBIhJFCAKCA4aPio9xoapuMpQzOm paFJPxk3jT8ZH27AsQQIYpyfBiKBaBjS0Oiv5M6u8U0fzN0qaCxvBgTflQ5lJ3D2QUXnwkO2hDYe piVnq+w5bXxyEsrCUHKS5/5EfMlwFBJxwxHVYKSNGmenjUog2ggLU+wxcDgfjmAq3azJTaZMtS9F 0tCTN/70bgkMcbkJaHhMD/cWOUIPNc4PAyl/CIbr3ES2DWxK5muOyE1Hs1Vf16Q8FHnyQ3IKNNLx QI2z80AlQjxMwaHJqqyGA5NrWHADRV+ItCzUyc/JwZsB/kG54TooR2ygxvlZIOUPsdDHhhVjg7GH o+wnIYaG4+9/ZVebFLzjcZHwsqDLLcfjwbStKaLTnX6QQLNW5RYwaQ+xpzul8WfGS0a4uHSHajBS TI2zU0wlQhQPEQ3e/YFMJ9MVHANfgbSDoS8FP9Io9y3r9PNu0PCGt3VrtNPLOltFTfOgML2tMyfh oXA9D/Jep1n/LfyxBBiD+EqShBRvaoxvOVwkvMh2VUmWF2rGiuA3wtiDW6XJdLH3ThSd339FCJHX C+FOmX2nJvpFJDf5RdNuEPG6ZUXPowFneqnGfgPKb7Dlb9W8G/LprZqxHLg949kIQY5iXUW+bLhk 4CMiqD3dPB80UsU6ajoehtCojWIdlbgKA9aT8Lcefvnx6+cvn+BbD0tHu9nlJpXbc8t1BYkW7Sn0 bBJcilsVj6ZL3lbG66x45kItipir4QbP9ZpzH46wEEs86oWw/5zUYScPh2Oj9seiqMyxOeVGHaTs OgnPrO11kReHpiql3ndy11QoQi69uzh9Q0HN1Hep3Vk4cJNW/mw5VZNehHCT1juzV+q4Px3UoarK Y7E3XV3uOmhbaN9yX5i82e+qk8xNLk8wLVnzkBeaFdRelTcfMD/h3hrilhtfUFM2ikxoo3sraLck G3wcdmHLnyzOLbXr6ELx2zWJlqV/MOIf3fncPZy/E92r2D3Ytc7x5/Of/71/6c7iy+7l8JtQ39mX P9X4l+Ov//r77q4Txvx7aZBEPTY+CbodioeZZCEBjgCMG/RmuHT8l6Ut68pbj4/CwncUJ7vjs7Co vD/9H8mNBdgKZW5kc3RyZWFtCmVuZG9iagoyMDYgMCBvYmoKMzA4MQplbmRvYmoKMjA0IDAgb2Jq Cjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMTc2IDAgUiAvUmVzb3VyY2VzIDIwNyAwIFIgL0NvbnRl bnRzIDIwNSAwIFIgL01lZGlhQm94ClswIDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjIwNyAwIG9iago8 PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9G b250IDw8IC9UVDEgOCAwIFIKL1RUMyAxOCAwIFIgPj4gPj4KZW5kb2JqCjIxMCAwIG9iago8PCAv TGVuZ3RoIDIxMSAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBtVrbUuNGEH3X V/RbdivIzEVXnrhWQqVI2MULVUnlQQsCO2CbleVlk69PjyxrpBmV0MgjeOBaczTdp08f9cw3+ATf 4PBsTeF+DaT4XN/jr8iEedufxTfRhMckAD/mkzCIPbhfwOkUXDIhxAtheg8eK/4Zv7AwnsRxHIEX xc50AYfTKQUK00f4cLnM02yZ5h9h+g9cTAvoPjhycS9CSM54y+Ku6ary6R0J4BMfAQJPAEDz6c+z 5DGH5sf57zfw52qZwvn8KV0Xf/3omG1OPkYtiFRslMZ+yz4bD2C4Z6cdLMJNM6/ImLLnk83TBrfF CCO9oZwtOWRMGcHNsLhImrI+7LFqxTNEambKxqocg7/nqq3BrsqDi8JplMfJJp+tsvVPcPLwkKXr dbo25ZKMecixUEIONRRnW4T9g1NWuVxUPjshSmkbryqDU6u+CoD5XAkO0t6UKxKiVlncxwKnKFMa wvkmwUK+E4F/WZdYjlBHM4kKhEQFXqwhOB/676CXwDISqFkwCJIGUctDFSTU/CZHb9Nsvp4/LU1z IUnkiwR4XoCioi7ePz6lxrRmuCIR9VUJt00iHYHiriicvmzSxWqZw13yr4iUM6jZCVkmkc+gBjO0 iN+JFKUjM4lSVJ+G2n3GfrlaHsDtCSAVaLxHgwlFyUVY1DqKMaUkUSseoRtoPrrxou9EX20E1mmq AlzP0LMcwc8UQsIh9qLhJJWxr4E4wu3tYchqei2LIFQoyhnpzxmtl8VYXJRQH6i6bv/sdkloxR6X E5U+BirdJXQ7ldYRLhbJ/OUIHt62zez4e6nak/vVYrinoASlm7IAaoDj6JEbakkxiFlXWqqYhTW6 Fi8nXz5fHmHhzfL89ejwsBEx+brimHkBSgTLaAS4IZUEw/MgqUVZZVKHJqJF71waMqXWbNcEo2O3 ZleHuJ6nOZwm2dc0q+yLY2zvhLH2A0ypCmDd37ksGNvgCQiFmBYdXsvq/YnUpXyyAjgd+0XB1SFU k2faPVvtQCh8cRhSVFfKlfLbushhI5Oqgbas2z8bXZpaywZ6X8UqGeh2V8Yr3eYaRKuRHOa4KzPj 1mBsKqtHIiW1tlPg+VVLKKdutt2kq0OM4SfrMGUKLDtKgaBkw5KnbFnZdp59ok29bJeaDlH6ytev RRO1ZiuxpVLGwK0BDi26VmmVAuV76kzapDq6RLASKIRQNHBcZ6njgQ1r6ceVYx2aizZrGXieUnK2 CyOIR+9BOsRVkuOwJ50v0Vs+leZyn9mh24AoXqf3iFPtdVqWQsi1VmQgIL1KASGUUjhZJP+t9hke ipGYOJ5x9bX7B6g0Gm38DCOtfVbvCu+Ngrv8i4x7xEd3rDpEKdyLJH8TJD1OijzsOw7YvdzW8IZq xTu6HUXagYNtsiKEQtambtdCJucB3WcDGs9iMUAhqKyujmaFvjGrVHvn/kzp21YVcTjyCNSlhI0u 2y0Yd0mWpUv4bbNIsrkN3W5ijCLclASjmxiBoVTDL6vV00s6nE3VyTrmWlvcmPzv6AUeBKhzDROj 16XkldFrwaABIXCyeJ3N81ma5FkK10n2/JYMN2RSMUo4p3afojhbGjYViMX9AspRicS6I1syRBi9 57VgXK02yzyZL+F2nr4dwBkeNMUe8bidbBRbqmejP4dL89SmtJRRrdP1rrkuUyYNCA6NtSZh0Ez7 1YaOUVqQt0Jxj58LxZ2Iy0CG92Vk1Gq1sYWznw1O1AmBnSxzf+wJO+WxquD2FVDHwOsT8GuSPSTP 1ZB9yHuQmIUGBIfszW2M00/xMoIqgAb10FV0sleICw/NyeiXm7PDy5vL3sWtmUlfnER4xMcg6av3 p2lXPddEw8P7W80N2KeTjnE9+WMCp6sfwCO2hz2TdGpAjEMn3xv7MoVLEUPJxnnyfb4um5wf0HA4 r+RBRAuMMa+kXNfI5EfqYMB43fcMYMC1F3mDou4qClnUOkbZ5PCg8fF4Vsrges8uJ53aFs9+lwui vbtRa5pDpr2o9KZll0cK9esBVtaN2N7DydY4RKGmCFaeN6baCM/OusEorgdveakHm/3LvqvNSmXB 23fqFKe80HkAePifvEywa+0+Ln68zvGeLVwl2f0M6IG45kx3f9x9/es6eUrxGu3fw31qdf/ZLR/P egXjS4N2YUYy4dP/Tf0Y1AplbmRzdHJlYW0KZW5kb2JqCjIxMSAwIG9iagoxNjIzCmVuZG9iagoy MDggMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCAyMDkgMCBSIC9SZXNvdXJjZXMgMjEyIDAg UiAvQ29udGVudHMgMjEwIDAgUiAvTWVkaWFCb3gKWzAgMCA2MTIgNzkyXSA+PgplbmRvYmoKMjEy IDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAw IFIgPj4gL0ZvbnQgPDwgL1RUMSA4IDAgUgo+PiA+PgplbmRvYmoKMyAwIG9iago8PCAvVHlwZSAv UGFnZXMgL1BhcmVudCAyMTMgMCBSIC9Db3VudCA4IC9LaWRzIFsgMiAwIFIgMTMgMCBSIDE5IDAg UiAyMyAwIFIKMjcgMCBSIDMxIDAgUiAzNSAwIFIgMzkgMCBSIF0gPj4KZW5kb2JqCjQ0IDAgb2Jq Cjw8IC9UeXBlIC9QYWdlcyAvUGFyZW50IDIxMyAwIFIgL0NvdW50IDggL0tpZHMgWyA0MyAwIFIg NDggMCBSIDUyIDAgUiA1NiAwIFIKNjAgMCBSIDY0IDAgUiA2OCAwIFIgNzIgMCBSIF0gPj4KZW5k b2JqCjc3IDAgb2JqCjw8IC9UeXBlIC9QYWdlcyAvUGFyZW50IDIxMyAwIFIgL0NvdW50IDggL0tp ZHMgWyA3NiAwIFIgODEgMCBSIDg1IDAgUiA4OSAwIFIKOTMgMCBSIDk3IDAgUiAxMDEgMCBSIDEw NSAwIFIgXSA+PgplbmRvYmoKMTEwIDAgb2JqCjw8IC9UeXBlIC9QYWdlcyAvUGFyZW50IDIxMyAw IFIgL0NvdW50IDggL0tpZHMgWyAxMDkgMCBSIDExNCAwIFIgMTE4IDAgUiAxMjIgMCBSCjEyNiAw IFIgMTMwIDAgUiAxMzQgMCBSIDEzOCAwIFIgXSA+PgplbmRvYmoKMTQzIDAgb2JqCjw8IC9UeXBl IC9QYWdlcyAvUGFyZW50IDIxMyAwIFIgL0NvdW50IDggL0tpZHMgWyAxNDIgMCBSIDE0NyAwIFIg MTUxIDAgUiAxNTUgMCBSCjE1OSAwIFIgMTYzIDAgUiAxNjcgMCBSIDE3MSAwIFIgXSA+PgplbmRv YmoKMTc2IDAgb2JqCjw8IC9UeXBlIC9QYWdlcyAvUGFyZW50IDIxMyAwIFIgL0NvdW50IDggL0tp ZHMgWyAxNzUgMCBSIDE4MCAwIFIgMTg0IDAgUiAxODggMCBSCjE5MiAwIFIgMTk2IDAgUiAyMDAg MCBSIDIwNCAwIFIgXSA+PgplbmRvYmoKMjA5IDAgb2JqCjw8IC9UeXBlIC9QYWdlcyAvUGFyZW50 IDIxMyAwIFIgL0NvdW50IDEgL0tpZHMgWyAyMDggMCBSIF0gPj4KZW5kb2JqCjIxMyAwIG9iago8 PCAvVHlwZSAvUGFnZXMgL01lZGlhQm94IFswIDAgNjEyIDc5Ml0gL0NvdW50IDQ5IC9LaWRzIFsg MyAwIFIgNDQgMCBSIDc3IDAgUgoxMTAgMCBSIDE0MyAwIFIgMTc2IDAgUiAyMDkgMCBSIF0gPj4K ZW5kb2JqCjIxNCAwIG9iago8PCAvVHlwZSAvQ2F0YWxvZyAvUGFnZXMgMjEzIDAgUiA+PgplbmRv YmoKMTggMCBvYmoKPDwgL1R5cGUgL0ZvbnQgL1N1YnR5cGUgL1RydWVUeXBlIC9CYXNlRm9udCAv SlpHRFZLK0NhbWJyaWFNYXRoIC9Gb250RGVzY3JpcHRvcgoyMTUgMCBSIC9Ub1VuaWNvZGUgMjE2 IDAgUiAvRmlyc3RDaGFyIDMzIC9MYXN0Q2hhciAzMyAvV2lkdGhzIFsgMjIwIF0gPj4KZW5kb2Jq CjIxNiAwIG9iago8PCAvTGVuZ3RoIDIxNyAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3Ry ZWFtCngBXZDBbsMgEETvfMUek0MEzi0SQqpSRfKhTVSnH4BhbSHFC8L44L8vEDeVetgDM/NgWH5u 31tyCfgtetNhgsGRjTj7JRqEHkdHrDmCdSZtp6qZSQfGM9ytc8KppcGDlAyAf2VkTnGF3Zv1Pe6L do0Wo6MRdt/nrirdEsIDJ6QEgikFFod83YcOn3pC4BU9tDb7Lq2HTP0l7mtAyI0y0TwrGW9xDtpg 1DQik0IoebkohmT/WRvQD1vy2ChZRghxqvlfp6Dli69KZokxt6l7qEVLAUf4WlXwoTxY5wdwRnAZ CmVuZHN0cmVhbQplbmRvYmoKMjE3IDAgb2JqCjIyNAplbmRvYmoKMjE1IDAgb2JqCjw8IC9UeXBl IC9Gb250RGVzY3JpcHRvciAvRm9udE5hbWUgL0paR0RWSytDYW1icmlhTWF0aCAvRmxhZ3MgNCAv Rm9udEJCb3gKWy0xNDc1IC0yNDY0IDI4NjcgMzExN10gL0l0YWxpY0FuZ2xlIDAgL0FzY2VudCA5 NTAgL0Rlc2NlbnQgLTIyMiAvQ2FwSGVpZ2h0CjY2NyAvU3RlbVYgMCAvWEhlaWdodCA0NjcgL0F2 Z1dpZHRoIDYxNSAvTWF4V2lkdGggMjkxOSAvRm9udEZpbGUyIDIxOCAwIFIKPj4KZW5kb2JqCjIx OCAwIG9iago8PCAvTGVuZ3RoIDIxOSAwIFIgL0xlbmd0aDEgNTg0IC9GaWx0ZXIgL0ZsYXRlRGVj b2RlID4+CnN0cmVhbQp4ATWQ3ytDYRjHn/dszraS2bIzP9dmx9nM/NrOMWpOiaZISZKkOGYz5SBN US4kKRfKHbmiXPoH3Ej5C9y7FDdKihQj33N2vKfP+32/73Oe532ft7ixmSMn7ZKNKKtr62QONg+p X1rZzlt+H3peyGmLZU8laE8BG1ZchooFvbhl+Wmoc2Ut+x/fged1bcuqTw/wwVVNz5X/50SoaEwt QAIREAWtIAbaQBy0gw7QCbpAN0iAJDAuoYAekALEAEe3SDohHqtqpB0QuS49UfTLzDj/lO99nZyd c6c/qMFpZNH102m/ofdH7PFdfhkR3mpfYV2oUB6o6zj77SPyz7zLP5fCm1nJCprCVQzRDbsz1+Vz iCpxh0rshKyTjeA4PiI73WA6qJhEy3G0hUaYIqtcSrUpshRuruIcYUVlyUSA89XAVNmamN8XVpgn 5DHgUrwQE/1Sg3tADXaJda759OFgJqs2usV0PCj5HN5jVvrhbVqplz0LQktMidR1JvvCoxM1YiKw F+hoSmZaJbU/0x6KR6KN/OrFxe+j/ew7b//8usKtjJf0Wj3yWNHIzPDQ1GjboKYvbCxrY1qx8Acy V1lLCmVuZHN0cmVhbQplbmRvYmoKMjE5IDAgb2JqCjQ0NQplbmRvYmoKOCAwIG9iago8PCAvVHlw ZSAvRm9udCAvU3VidHlwZSAvVHJ1ZVR5cGUgL0Jhc2VGb250IC9ETUpHUFQrQ291cmllck5ld1BT TVQgL0ZvbnREZXNjcmlwdG9yCjIyMCAwIFIgL0VuY29kaW5nIC9NYWNSb21hbkVuY29kaW5nIC9G aXJzdENoYXIgMzIgL0xhc3RDaGFyIDIxMyAvV2lkdGhzIFsKNjAwIDYwMCA2MDAgNjAwIDYwMCAw IDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwCjYw MCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAw IDYwMCA2MDAgNjAwIDYwMAo2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAg NjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAKNjAwIDYwMCA2MDAgNjAwIDYwMCAw IDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwCjYw MCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCAwIDYwMCAw IDAgMCAwIDAgMCAwIDAKMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAg MCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMAowIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwCjAgMCAwIDAg MCAwIDYwMCBdID4+CmVuZG9iagoyMjAgMCBvYmoKPDwgL1R5cGUgL0ZvbnREZXNjcmlwdG9yIC9G b250TmFtZSAvRE1KR1BUK0NvdXJpZXJOZXdQU01UIC9GbGFncyAzMyAvRm9udEJCb3gKWy0xMjIg LTY4MCA2MjIgMTAyMV0gL0l0YWxpY0FuZ2xlIDAgL0FzY2VudCA4MzMgL0Rlc2NlbnQgLTMwMCAv Q2FwSGVpZ2h0IDU3MQovU3RlbVYgMCAvWEhlaWdodCA0MjMgL0F2Z1dpZHRoIDYwMCAvTWF4V2lk dGggNjAwIC9Gb250RmlsZTIgMjIxIDAgUiA+PgplbmRvYmoKMjIxIDAgb2JqCjw8IC9MZW5ndGgg MjIyIDAgUiAvTGVuZ3RoMSA0MjYwOCAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAHU vHlgVNXdN37OuXf2mcydfd+3ZJbskwTIckNYBESCgBJCJKCIWBQQtGqt4IqCCmq1Kiq07lolhMUA KmhtrbVW69qqzyP64F7UWrRaycz7OXcmLLZ93vf35y+Ts59777nnfM93P3fleecvJEaymghEPv2c +cuI8uddQgi98vQLVoZLZaOREM11Zy5bdE6pbLuNENWSRUsuOrNU9j9IyDW/PWvh/DNKZXIYadNZ qCiVaSPS+FnnrLywVPaIuP9ZS5aeXm73fYn6nefMv7D8fPIOyuFz55+zsNT//hOQVi5bumJlqXwf 7/fnZectLPenswnRb+UPySM0ITQjEIowh0bJJHIFURFGJFJDZhEibFKdSkSUebuKkPRLT98wz9z6 tVan5VeRexLTlXH9xvCnu4uaf24Qv9dmUK1T+vMOuE790PDthIgvFjXFV8Tvj7TwVv43ZzeZWdwn 7Buc1SAPIRmtJNsq4vWrUdxmMCnpoK6ho7NG2EeWIWxBeAlBJPMQryrXCCSEXAcCr12PIJLNwh4y gLAP4WUEXrMbNbtRsxs1u1HTIQwRKjwu7ByMhzCC7ds88fovOr3CNlJEYMKNwjoSwb1PK6fzyul6 pGnUbyin1wvrBseEzJ06lCn5AnERgeHd7hycOK1+l5JpblUyG0dqNm5DTajTI9yJUd2JUd2JUd2J UX2BmOLuG1G/EfUbUb9Rqd9IqHKrSFX5VuXMnYNmZ7kGmU690COcQupxi9nl9FThlMH60N7OfmEW br1FiTcLM5Ffr8TzlHiaEq9SWlcp+aVKfqmS71DyHeU8v7ZGyZfikJI381g4WZhBqvD06cJkJe0W xpMEytNQ5ulJwiQlnSpMVNITUe9G/RRhPLEinSxMUMqTUB6H8gko83SiMGFwXKi2cxnK89DGiFng 9eMwknFYzHGYJF6zHmEzwrtKzTzEqxBeQhCUnlQYh18Xfp1CJ66QcQ8ZLTIRBBm/DvzahXa0tOFt 2hDLQiveN4S4BqEDYRrCPIR9CC8jaIRWxGEhT2oRZIRuhH4EFe6TxXVZjCuLJ2SFHInjXhF2HbEj DZfTEFtHgigH2brBYEju1LHtpBuhH2EZwmq2fVBlNXfa0Y/3rUGYhjAPYRXCJoQtCFrSgRgtsoF1 sA5hGpsmiIDuqm2trfVK2tBUSv2BUmr01ps7zxOqME1VZBOCgCFXYchVeNWRUgg5BtBJkb0ILyG8 i8AnPIXJSGEyUnjBFK5PKb3USr8vUCoiCGQp4lUIx/bhU5PCK6fwrKN34bWVqKnEPStxTSXuV4lp fBcxVa7g7d0I6xH2IvC2KNrWK3EH4mkIDPeI4g14zow4JEQHmc48hPmlo82dzZj3aQhoZNdjNq/H vF3PIQSzB9hGS0e5x3qkWxBUwi78qvBL4VeJXxS/CH5h/EL4BbF6G/Bbj98N+F2P33X4rcNq2Ldk 9mbYvPzS/Kr8+vym/Jb83rxmD5uPXz/rl/XE6QROtFq03k6JiWQuMdF/KvGjSnyeEstK7JK9c00H 5pp+N9d0+1zTLXNNs+eaTpprmjDXVDPXNEQXyK6M6e2MaUPGdErG1JQx5TOmhoypKmPqtNAeeiox kaeUeKwS1ytxVIkD9NRBE9E9QXtJRAuIp6ntkctCH0SGRDoYuiIypEVyeanUW0rG8MqdodrIolC2 VJMsJfHIkyLuQGbRXxENzchZzfOaeRpZM0pTrclpKjUpTUwT0ti1Vq2krdAatXqtVqvWilqmJVr7 UHG/DHJCiV0t8UTNaSERlbzEeB4RYsKolpHJZMAmTGFTZoylUwb2nU6mLAgPfDMjNkT10+cMqGJj 6YB1Cpkyc6x7oDkzZUhTPHmgJTNlQNfdO3srpTf0oDTArhmiZObsIVrkVVf5Bqxds3cRSrNXXe8r pz09/JrZW0V6/fU9xHlBh7vD2m4ZNWHcv4n6lcr+cZmjf+6j2UyGjyQwcOuUGbMHHg70DNTzTDHQ MwXzPCM8d/Yu1sKaxo/bxZp50jN7l341axl/Mq/Xrx6HgYz0I2HUj9tFIjxR+pEw70fCP+gXZM28 X4InpX5BpV/wuH5b2yLjx22NICr1aVP6tB3fZ9HxfRYpfRaV+wjK+JVbjNxHs59ElD4RzX5l7Mf2 CZae9b/2SfzbPsdM58KxxxT+JUt3kcn0ja1dF49fGBvfHxu/EKF/YN0FZ7kHVi8Ih3eRLvoGbwoP CMn+BaefxdP5C4foG7GF4wa6YuPCWycrlx7fPnAxb54cG7eVXDx+5uytF8sLxw1OliePj80f17Nt 4vz0o8c97tqRx21Nz//Xhw3M5zdL82dNVK77wbMe5c0T+bMe5c96lD9rojxReZYC9QBLLRnb0zW3 lG5jBj0AuN8X6RnrlJa1K9A8JuK+1LdbJPRBYsj0DBhjYwdMCBzQc525Tt6EXcabKlBtLje5Lx0T 8e2mD5abJFRbYmOJe/zicfhfsaKcKRX/r/GKFStWnrbiNCQrVir/K1aej5SvGVlBwLniDTqNCn0L ARtz3LwO4ToFRwsrVvSsJMr6rjif8Kev5NGRhx7NnY+b0xXHQgLhjzzuD600Q0oBt1txPsUY+DDO L11HV1A04ja4dGW5DjhH/AjhJuJDGhQWgGKT4rvl8H7h0lJ7YbhYZG+i88xyQKLkZpJbUIcfnVpK yRnkNXIOuZH8HHUN9I/kISITM9peIwIl4Nhbyc3kx+R1Mqv4N9RGyD3kC5Ilo8hZxQKxkFWkQH9K 7qGMzxRpIa+ShWQDaxUy4mdAjmlaKzxCLyc53GUmuZW4yEu4Y7qoR3kbC7BWXDWTvCDM02aLtcWv 6D7x+eIC8kvayt4QHyN/IAdpVCSFK4rrihuLd5IKckgIDP+6WFc8B1fNIv3kfHIJRrCa3E1epD2s je0tXosxzcYYVpHHyQs0A4DqB0d3MnpfSW4ju8hT5CXyZ/IBpdRMK+lq+ip9TUWGny08W5xUXFBc SsaTk0g3WY3WAE3QTjZHmCM8Krw5/D+F/cUg7j2TXEAuJD8h68kG8gh5k/yFvE0Fpmcz2SzhUeIj bWQOWYDZvBljeog8T96lWtpIR1OZXk1/xS4QheFnQeFF4sAMnoC7nYG+GzGn95Et5FnyMvkT7vk3 zKlAPVj8WXQu/Sm9it5Af0bvo7+ij9HPmIr9WRCEy8Tfip8V3ijqi3cUH8JzfcRPwuB1s1iDE7Ge L5JP8X5pmqUd9BWWYVmBisbhQqGhOLG4qvib4pskRlLo2wa+djyZSk7FqC+C/LWH/BbXvkj+SD4k /8AsCVRPrZiLMI3Rk+kMej5G8Sj9gg4zJ9avhS1hg+w1ISO8KJ4qPja8veAoDBa+KBSLjxQHir8u /kFZ3yY8pwsr0EeWYYvxFduB5/yGHCCfkK/xDDUNYawn0Cl439tw/3fpYYCTll3KfsWK4H43CM+L HvG2wkmFcwq3FbYVG4tTAVsCmC4PacRvNKBpFunBvS/HbN5DHsbKbAP0vEE+p24apLV0Ej2Fzqb9 9Cy6lC6jy+lP6CWY1YfodrqHvkHfpp8zkamZA/OUYaezy9nNbDt7lr3BDghEmAEZZrnwE+FmYbvw svCxKIlZsVacKvaLF4kXq8CSqZ3aPxx2HT5neMHwHcO/LlQXxhV+VFhXeLrwRuH9oqG4t/gBUZNa jLGHLMIYf4r3v5rcQDYBPh7GGN8jH5HPsOZfYS4EqqNejDikrFsXxj0VIz8VLNOZ+J1Fz8b8r6aP 0EH6BN1Hn6bP0xfoK/Qd+gWjGH01fmOwC2axM/EOd7BH2AD7C35fs++EJLj+eqEBUkU/3maNcA3e 5+fCO8IHIhMdYp04Q1wlPqcSVGeoblVtVD2r+p3qU7Wk7gWEln4l/KHEwh/Y02K7sIRshnQgCJ+y V1gr/Sn7nj7AAvRpPC0gdAvdrIuNAW+0B1B+DrFrNqoj6gizE0nTz2/Cbmc54VQxKRjJSuw3wuaw q1k/uZ8+Qb5nJwDSLhBeZJvZPGGjeJPYTt+EfPE0VAEm+g3pJJ20HWv3KlmOFcoJW8Q/8juqtMJh 1TnMVFwjfqRiwivAg22UCb+nc+hB2s2cmK0x7AYSQ1miB5FOwg78CyB/F9jOFnG/cB2bzN5G3RJy M30a77iHLGF76C+xLi3Yj+fRbnqnUEcupcsxI6PI2exnJMqWsSjgeRb5O72cOrBzv8faxNmZRBRM 7HTyGuvBqr9MrayaXgo4PYeso2tJlg7TfeQP7EbSRBcKTx32DFcyevgg3SqcQLbS78XnxefBfH+P mQwAcrVUBoTcAxwxCzszIiQBNS1ExSDHYT/1Y69b2Nf0EraELKa3CZ/Q+1gnmUYWCivYBHpr4Wux U2jAjO0GNulSj9ISVasqIDZixT8i7YDGRdCQnCW+q7qc54VXhUPFnmKkME9VUXiHXIzZOQHYbR32 0gnkLeqkp9HpYpFNEYvFU8gjbIv4TtFFjTRC/lTEDivsoK00XgzT5UUDnQ4IP43rXsR14lXi+eIl oE/fA2teTW4id5BnQE3uBd1KYR5PxGzOBe5ZDBpRC41BHm/XTsYCK01CWzc5Bfi0H1jyTHIuWQ7M exf5FdkKCjUF83EarjuTnI36FaBQPyGXYv+vIdcBB9xK7id/Yg+zTZBxr2G/YRewxeQt8pbwnCDT U8hr4rXiKjIDMvB0asOTm7FKIVx3XfFVPK2K+ID9G7FLAfnFz4pvFB8cfgn3ux9jv0k9lnym7iKV ZBr9RvRSldw5U+5ob2sdM3pUS3O+saG+rramOpfNpKsqU8lEPBaNhEPBgN/n9bhdTofdZrVI5gqT 0aDXaTVqlSgwSrLjYxP6wwPJ/gExGTvhhBwvx+ajYv4xFf0DYVRNOL7PQJhfNx9Nx/WU0fPMH/SU Sz3lIz2pFG4lrblseHwsPPDiuFh4iM6ZPhv568fFesIDB5X8VCW/QcmbkI9EcEF4vPusceEB2h8e PzDhgrPWju8fl8vSrQZ9V6xroT6XJVv1BmQNyA24Ysu2Ulc7VTLMNX70Vka0JrzigDc2bvyAJ4ZL cRshMX7+GQPd02ePH+eLRHpy2QHadXpswQDhXGBG6UK6lMcMqLsGNMpjwosH8DZkXXhrdt/a64Yk sqA/Yzwjdsb8ubMHhPm4x/gBSwbPHTfguviA+2gRNwe/uebYVp+wdrx7cZh3Xrt2TXhg8/TZx1zr i/A79PTgHriWJSb0r52AR1+HlZrCJaUBdlXP7AF6FR4JnjmhvFXp/UocfaL/7PCALjY2dtbas/ux NN61A+TkiyKDXq+8q7ifeMeH186cHYsMdPhiPfPH+bfaydqTL9rmkcOe41ty2a2SpTSxWyvM5YzR dGxmISa91KbklO48N+XkIzNL+RhjkwZkQNTpYYxkdgzv1MKjhS1k7ektWAD89VBcNXAGVmTxgK6r f600mtfjFemAKiHFwmu/JoCA2MG/Hl8zv1yjTkhfE97I4eQIqA3Q+SP5gUxmIJ3mIKLpwppijO1K OZ/LXjDEFseWSWEkEIhIN+Z2fs/oGkx/JMIXeN2QTBagMLB6+uxSOUwW+AaJXAO5gfXzln0jLY5Z vGX1SMuRy/tjgOTtYCIIcQxok0f+zZLTNv6s0QPU+b80Lyy1T5kRmzJ9zuzw+LX9ZaidMvO4Uqmd TyjmDW3l3ICta7bgY6jjOeYTlFYA5dw5R7qgMNs4ICbwr1aA+owhjRZQqdTQ8IQBqf+EUtyjj0TK e+b/dtFQ8Ut+lZIcvaz8GgOjM+WBloY9MOa48nHDM64VpswEymFTZs5Zu1Z/XNsEILO1ayfEwhPW 9q+dP1RcvSAWlmJrd4EBSa5dNh5oqLSiQ8Xd63wDE67rwaucRUcDbhkZuzVGr5m+VabXzJgzexc0 LeFrZs4eBGvT1T+2pycnvkgWIUCbTz9D0CO/B+EA8u+JL7I+pLzP+wgbkM8g3Y30RaQfInyAgL7k EYRfI7yB8CzarUhfRfgIeVupP21BeQHCQoSflerJm8hbEE5FWIVwN8JshE0IqxF+hMCfwe/fg8Dr 3AjVCGchbCun/JpdCOsRZiBICAmEboTTEV7Hu7Qh/R88txUpHzPeh/B34/e+FIHfm4/npwizEJ5E 2I6wF4HPiQNhCcKNCPw63p9f+xLCTQi9CGMQ+Hvyd7wF4SCei+fRBDYFBD/EBBYnNb0AaZjsRA1T JBeV0qImGuh5dURPDOhlgmxmht3GAlnLBp2ygzgh67nBn3sVySTA9cq4S4REIXfESYIkQf0rQWvT JAOZJUeqYfOpJXXgABrAKeVhHGoGJzAKvP0YUOc25ZntpAOUvxPcQZcitUwgE8GZTILybQp4hamQ 3KaBY5gOaW8GaPcs8A6n4jrYnP5/9tejjLcZM3AjJNXvhJgwVbhX+F58S9WiOkt1uepBVQF6y3u1 5+tO1H2iv82w3eg2xSvcFb0VW81281zz09IiyyXWu2132uc64o5/OHe5ful+x3OhN+Pb7Y8Grgpe Eno4fGbkvuhvYjfGTfH3Ey+nrqosph3pP2akzMzMjZmvs3/PPVN9UU2q5re1K+tOrJ9Rv6+ho/Hj fHvT1uZnWjaMOnf07DGR1ovaAm3vtj8r/3zs2K7F41TjasedjnEzzlOKiwAkAiBkwla1Zogat4PN UYk8IxC9WoXMTkFgXp2G1+2kxKOd9hN35iTpUOvU4daTpG9ap0rDMHK0DrfyUFfbYIlYEhFLZJFI DoeFfYdlFfmehMV9kC8+K77P3lepAHkhMk02v2H4wMC0Gj2RqG2lF7d/XLaZiNfgfExqp/r2wGO0 F6pgzRNsEqCxQE8i7oz0Td/BAwekAwdIR8dB6SC1WEfhv64WYqKgVseiyZSQzDc2NdSDfxOUWB1D LarY40nmslhdLMFqYrHqhalMW3uaR+JNw3PCXm+Y3e82RKurY/rD2rZMtrUtnWvFDFE9e0B4WnwF +8dC+rdWqIbY1bKe6nXccql/U7eb3UsM7CnZGLbstbxkedfyhUVl2U2dhLGntmkhCw2xe3fUapdC T/0Eux077m+0u/Qehw5Kw3ibQwcxd61SK+YTrxEpv8XRDJ41QR32eMJqukjJur1hlfhKwZsMhZL0 w1KKldxTvFS0qMZil02hU+SGblu3f5N9k2+LfYt3i0+DvZdMTOqUm7O5pt5Jsi0/aWfdmDpGp8Ti k7U6a8Bv6508VNw3GM0rSbyUBJRkpys/eafL5NqqZl0zZ/vkNtVmOm6zXLU5F94cp71TSO8Jcm9z R29Le3PjCY1TGq36Xouu19JuldO3NlrlaN4qO0cjY87Ps1LrEOuWc1Ore/O53qZE76R472SAauOk xu7JdHKjzddr3+De7Gb+3m77Bvtmu2Bvt2FcsgG3kmwbbJttgu0J9jdgkL9BbgE8HOrL/LXvYJ90 ELlDh/6KtPRDPf7+yguHDh06PFIN0OG/HlJTIw3zHsOt/E9SYqXu2AosSB89AkZ8aVLJfN4WK+ea bSXQamg4mmlqaoDsoBEabEdyHBbVsUgMAn3Y+oug1xt8IAJQtHgiT4WZW7J6aHgLr91hvTPk9YZ+ GSlXPqn08tLINt5a+PuTtqfYgcK3LpvNVcgG3aLZa6Z/PJrj9VSrxK8FPKLklgr19EhOuepbwOyB YqfwsWo69Idny/XRqFHqmBybHL8wdlF8L3nbq54VvTK6I7ojLs7WhiPRWDyR1KRC3dNOmnrilMma SSd3DLEXBlvemzBEewfr69OdRnYZqIGDPU8qqAl7hND/gb7MT3u3a/fiYU8pRTf2sZUYcInFYh2i pm2p+kXpIfbHnWMmtaW8pzR26tGhC2EM7nEy7tFLtOyywVDbyU+ypSANv6Bq4qZnXIXdP4xdc+jg QaCdqdg+yLfy9SY1h/paD2JhDx2s4TWHDmKjAzG4gBm6LpJbJ84MVCUSU5KBmSGZRLoRnRifJNOJ VYiCM/wynUnC06NoinZPm5ycKtN47MSpJ1ROkElVWmrNYHMeiaDjVf4uuwy2I8OMKQMJsJXbJwan 2Mc/BQEhUvwrCSAEi39tUf56yPI+aI3LOMnhdLoAF4AIDhLAVvjFomqH3eUUXU4OJ5pSQz6fTNkV hJZXLnU50dxQ35RvVK4BGAKjjeGLOm52K3VbbG63TXKK6paTly6/ubOOjmnpnjb4AG+/Y7HGabK6 XTarScfUm665/petcvrqZ6aceK/42Nkc3s5Whyo9bm/wp0Gvw1OTbLpyxoxsdIw3duGs8x61/IP3 +Id+TtZm9gbvDfpMulB+6dU9Y2b6LJ5ka+vKJQ9jueh7sF9+Jn6E9a+SJdVOVD3GbiKPrdcWFbQ3 FazHEfR9YBi4++CxqO49jtYibmA48aPhv6cjkTRuwPoKh6Et+ggcSbecqjKmJaZyVdj0VqdarZJc Tpuj3aaaqtPZNlfECZgZRjz+3++mKgCK5ypOnfqmDivAgaeBMIFIjOLEgpOKPtpotTaXaIQGikS7 lUv7WI5UkiVZX+vDKWOF1aM597TTztV4rBXGxIMy/WoFZfTkmMFt0Rt/Xxi6977C0PNGvcVjiNLJ BcxArnCYrSqPtkrHdF4P83hFPmKdVe1ySio1RqvXY9AYrxnkjxFv4N7ddOrIeL/h4z0A2FWGe9xo 7YxpOLDkG5ubrPlGpix+Q73LaXWyVf92tH9bUSgWHo0aPRjt8/SEe++jJ/weowV9K+zEaMn7TCP8 D0abo43yFXa/FJP9X3u/jau6PGtsq+1CyBeKnxgX0vF+0xm2c+J/cP3desj3ZVybTUcFUqm3V2jt EWs2nTLrVWKC5HLxRNyeSMTjwBaxuN9n9/t9Pq/P743brHabzarTauNWi91qteSgZPGrSKUXqhWd qkIbJ1ZdTiSJIUGQrRaNtVerJZr4VF/Y+iTwScUQvUM2a2XfVGtYg77id5WUDNE22TCtcmklq/RU P/eEe4jGy8utrPZwq9cjHfS6pYN9B3nOjenkSceBjlGcUwAMlBCDuKY6U/FT6dk1FdXujPZfMiJq iNK3oUGBmxIyoX192M/UUuIwLIkSEKk1qhEISo2sVHMiWWJEXKzFbbO6qcWml9wWb+GLhySPxel4 6CGHw+qxPFT43GNxmw02YT0N8b1WeK9H7bGYndqej10mqyfwyScBj9Xk+niO1mG2eNTYGbBldIlt 4lQAUa9c5+kNhQgs4A9IveIDWnOvTqf1v0N6ta5ei8XdK0la2qvRaN+pNVKjJ6ztvsydITVU2R7K fAHgOAbFngSSAwYdPsCRncT3p0XBUHlLRGGfGiIjLx0p0TN2I3+twnWcNtGVyiuu5HkWKsxV6u5V SNEvFdp1Gs9zTJEpvMb+RKuBEBpk9zPkFbKffAmCsVOkf2dPk1fMYJWZ5gl6G0SVc2igxChxjFHD R9RHI7S8EaBQtxTe9CU9MYFWD/+5PubRw52Okt1MI9rYKvCzXtlI9mGXqZhHPP0RzrAekD4kNVP5 jRyRvGg7/ABbdeGFGNOLxfcFCp2+ifjB2Q1qDeKfDZ6Kc3bRIJ6PqZqKPYmrEsezk7PiLd3Tm3n0 t2kto0/iAc//sHiq8KnqHCCkc+TROp2TenQCJCPdBDpJ16v7ke4CeqHuWu21ulvp7br76EO6nWQn fY4+r3uDfkg/0X1Dv9W5DDpqGKK/2yEY2kmvbogOYlC92idrBCq8aRmie7Y+obA9w6By5XlZ3tcH u0wJQ9ASebEL+4fnWoCk9eweg73C4lHF/zk74TEbHaoHXRUeswEI6AO898fgxj2AiEe3WZk+trv4 FRGKhwZz2qpOHfKVxUMkVfwHcSI4iv/Y6a/QVWgr2O7it0QqfjUYqMjxK9LFr+RYlcpfEaqIWs/R Bv1WUk1TKlM0VhFps2bbVFaVyuRtAyf8h5118bYKT+0vdisUPavsXBDybzDDHZyQA+9hk1p4VCLd c1i1lHR7XB6nx+Gxe1Rqvy/gC/pCPlGdSlYmq5LppKg2GPVGnVFr1BhVaiEZtcRlErZ5ZZpRJ2RI 1DUyjZkjMvV5ECWNWZlUM0ScjJeIeRp/mctIiWC3tNCRjJJCuSM7LEGbp8MetLg6LDxyBoPWjuhQ 8XtZRiZl91sQ+SREHjMiV0VHjEcpu9OEHCLBjn5C0GroyOkROXkuYPdE+E3+KruQMdtdIX5VqIPp JUu7i0dlVqPEcJRjPuwe6pAUPJNKghvI5yWFmIFBcDk1Jf4gFmXgMFB2gWmw5oWPL1t4x+QrqgPj zS7kplxeHRwnOWd2pT2VoyZev7kr464cdcJ1m9nbLxf+dvclY/KRm9pOWfEylXg+elPrKat+/GJb zBMr7N+368d/bIt64jSyj++2AxAcPxa/BY3eOmjV+oaK38pmi5podT7Z123t9ok68272EDHSjbJO MhrN0lM6LeM1KtRYqUrF6FPasrJdY/XZd8MKbmGLHicqndboYfY94C4txMX+KOvJIouFLoKkKD3J lsF8+gsYv91wt1EkwlaFFVRI50EuE7pGEWm4zTqqxk2lrw89e1yhrpb08YWlljIiO4LfVCNEtplt oGGOt4aXKJgsXPjcrjN79FqP+O33c8FJud1Wm0usPYVjapOWS4KPYCbexF7K0HBJTHrcZ8ioRDsB werdoTfa26IqYJGO4RIdgY+Qs/jfctYXbzzBfHHF1amrK6+uur/y/qo9xu1pncmqd+aNLWmxKpYO ZuypYGXMaDdwSDF9aj3o/Kd12ClWakdm8p3HyxOpepIeAGI1gImmYMB1Or3RO0S/2648ew+Yamx6 zpi/Z2lLdJrAWeeIC7VB9Dewc2DqunFkV0rfgM3+BgiGsyMHD3Zgfg9A2C7PKeFzqjDW/lDc6nYm wklHxC0TW8wiU1fILlNrHFF5d112WWm+MeVkOV2e6WmOjDDDkXy8uZ2BpQULrMGvJE2VaapaQzTD 7CpOWA6/RslXy2eGHvvJuQ971DqjZHEt3jX/rveTvRcU/rx7ZoQv0vmXfPj50rOmVS65/9I+t0bv kmrvPe2ttaPnr1hZeOcXHFZ/XXxfxEQRLPy2JS1gJIC1Gurr85bR8UnxyYmulvOIelXk6pZbxJvz t7bcl7+/ZZdtt+sF2wv2F11v2/7L9VfbP13FGgu/boc9ioWzDGEF/chUac2GTKVFqMFA3EQV8xNP MFyZzHqw9NvCYWt2iF6/LdnWAH7m+h3WNnWsrQlCkKx3tAl+/yjBO7pmN5bAzy573OAZ1aBSm/66 m64uATfQIifWUw8cOEn6EPA8lcs2AOcD+EcRYs4oji4VkOeMTQlp+hvz8YTNLqoSjTGZ2lQOCDT5 pEztolUmQCBYmsvwh6Slb3kLaVlOFdFDkUfK0kZJ1MDCKEyMSxE8lFUa2SMlYijYVl789dCSj6vN Lkmyb3z0pt/M39kX9Ho8Jyy/+Y5LTr0pK1kMFvepF92x6Q8L2CONOxb8/KO5tZJVcptXPL5syoYZ fC/Rtb2nbWhttOtcUmXbrL1XzrwVtOkNvp/AoQaghfyTbAI9D7NgRBUI+Z2Y1g93BgJPOc0OCJP9 srWi4ilHOBJZxARwygKLhGAe631cEERVJGgKIj8IhecQA70K+Pk2cBIz6pwOYYhdIZupqmJRIBAi 5iDFVgjuZueSCO2VDdhD1BMVRYcR1OoVLAf4zPJyLJ8Kxc1yrjYYbpU45wQGqlX6XOGlFFXOcKtl lAoMJphIN+Eb5+vXWkdSc13tchrJ0wbLCD8xkikjogaLJUYFYfhV+uqWCZwlnKDEhd/x/F3Zwql0 3nwhdfgPfO4KX49gIzqPvTscAZw/y+EcM5cl/y1HDT6dP6qr8ox2q3JVJ1bNqzq36raq5z1vuz9z az0ciJ0ciG3I+MIxrV0Kx50hLw0FIuRJTFSC4xHMxgFZF2gTRT1JJmxD9H9knatN722ToJrbza4i VWzJDvRclIgP0f96XPLkEqJ+BISPztnUQ1AOSgeH+0rgywWymoMQ4DkIKww2h2MFqbjdfpXOrwL9 dusQ+dQBmXq0rqOQiy2cyfQtp5YyqwOQ5HL0cZAbi5bQyQiSp6smX9N29+tfbv/xuSfJSbdksf18 8OZ996++4oqwCWLUZI5CxJsKC0Oh/97xu2/zieaI0+qxXv/8Azc8Ol5yO1mO4yGgTytm1wssEiO1 9GHZWB21xxujwUwwEkzuLn4Dw/n7ckVeHKPtEqdoZ4lztOoEJngb5jdcTkHwUY41xoeKr8l6jj1w dVxrGsKVq0RR1NpFuzYpJrVp22jbFFuv7WzbRbZrbFfF99h2xN8yvGX9zGQzUJVWE1YnPeZ4OBFZ GD49clHkosoVNctqt0X3pN8wvq//0GidowXTI1msYZs95Ag6Ay6P5DZFSdxkTBiSelpbw6qzoCJV mkxa5VJXmOJ12CP37ci1CYLON0T/W3aG2uyqVJvO5H5P3UbSUjqcrk2L6SfZi9D7x2mcGNn9j0fb aiGoeer20BZ6WQlnKcIFpx3DfYqoDwLC1/oAX2VFohpRy/gT2XBEtElmi9lqFtRGk8HE1FkxLdOw LTpEfyU7SFIPXi4Rr9SiMqPKyTRiDvEWA02YUtDOaBCVGTmoaDKZdJrjteUKgecMU5n0ZEa4Yo69 OKSA7HABuiz1x6KEa2DAKnH9CgcduuSk+xZe/fJTD5zzZFNXR+3m1y+Z2eJ2WkzWqrZfF/Z6kvcs XbZp88L5c1qZbcW5795763dXr3v0lbuvWbxpYdTssbr09sLWjyJ/2nnnluuu+NWMZuzKV4sF4Q3s SgdZvVUncBZIDdSVZmq1wJ7SGU2mRQ5idziIA8yE0WVwGIkgUbbIoLeYJb0oGQ27sRMpe3C7S+dx gj5whZjCPh+YCqUX55454gHecSm7iW8mSLaKhAseqMQLlek2zUdGdEwRBy3pmBqbhcuG7+e4RBAK j2mdFVa3WlySVLbFpqu//53X4pb0VmDhjyAzfKTIDAlSR9fI46wPRH9PPiefG0WvGHBkcqdmFjKV oUJ0+yrs7rXun9E7tHcYbk5tytyZe4jek9rB9up3G3dnXtT/PmO7iN4XYXX2HDibQX8sOFT8r8Ha WPXu4n9B2Ph2u0VbWYld8l+D6crobqjUEsVPB1PRCGeDrJlKWRtrq6pSB9psqpo2tQnO23+Rpaoq p5RsE97ztnU4pzmZc4gelA0N4TbpvWybzlP/A7GDqxK5/p2jog85c6bAqYKDanN1vpDFIWqD1rBM /HbgoWoNZIZaFchoyAKM5HMgymlrZFIHAeOoMMEJ679KEqSP9i0nyyFL7CKZ4sfbIA3gRT7eBiGB p3ItZASVGyWVGznKc5TnVG67scPhRncHr3PwOgevAwY8+tdzhH4DBzaPoEJAt0bdrDBXEAUA27Zj 8oJt8Y/2b968/0dnz02Pfv3Wn782usr0i/NX/mLTBT/e5PrV6tW/enTVqkfZuoYH+m95661b5j3Q mB81fcHal15au6B79CdLNt559oKbby5olt5777nnPfgg8KINeNEFuEiQBgr9vkYrpjUZUv1wfHdc neRIMpZFVOFGZKoI1jcao4jqnQ3ZVNbBOTFzb90H1u9if08fqlZBcVzHsSS/aogvuhPr/ympxzzl cJXavqPu2bpX68TTtKY4SVYYU4ZKXRrSH3KmJCpMojle1aZXcXwm62uA0PSRNqcpuRs4y8Tul/Xx NrM3731P05Z9kj1IGo+iLunQMBgtqJYPfQB4ULBWR0meAIwoyEuBjlSqOhoTHaYKYwVTW8DO2CS7 JKpVibQOMFJpAIykklEH6OGvZButFrmwqa1CZQWimBRB/Q6SUwNsRuDmKPIifRlwypnl9AgOQ17Z pCUCB4mOr6vCLR9D80i+EcKgokrmS93cJOzt3Hbaqff079183hONXaOSN8+99Jo5o7xui9GVanid 1tvzdy3+0S9/eeaYFQ0R9tsVK894+uw7hm9Y8+gHgxd031rTEYWuymWw0YaP0n9+4ebt11+7TcYB C1bSlQgLoCvxkTpZZx50GrSDRG3dA4uXh4jUucNg8Hj8R5UnsA6WpAhF5zvC8ihspe24EjuqUFG0 KkokLOhuHnMSD8Prj2hZGG0ppuHryUfhJrNly76Klyv+LO2v+ET6suI7SeMCk/LwtlozNQ9Rr6zD +Mx/l552ikPUKZsMjRWvmJ3U+ZaHqMujJB1UMR6V1GAHYUcqaYmPG54A1ROnHqAdbGaiZVp3M6Lp c6m28IEDGryw+pih/qFQG7UGHUYblzsWkE5xFLR1FnKFHNyqplqdLk6onej0hFsR48SCPIyL2l7K h01gPOvU0YeJHt6VRnYr5OFHiJY+MajeRYfYI4Bn3NNjJdMug+ozBpbUU0PdCsk9cPAg/onnkPug R0K0RlvWcGqh4eSqTq5Bs9Em5bU0lJap3wLhOqfB4oke/kbQRT0Wg5NNpP+E5thjK3QXum3IGMGP L6RrxcXw/+Tr3jyoiWMs38o+R9xs8HgD4jQrxb/ZWmPtsApWj79sIO4Dkwz7MJRuw99wtduIpK0o EIXjSmLdYUXWFn7GObFj8uxxznnxUHiVKxEVRSIlP8Os/kiZ1avl6F71n4xfGYXjZvPYWe6F2gwz ixnuNGBm+azy2S3PLMjqI9AV7qpRUzUmtvsnmNjIsRM7fOD/YWKPKuBomRMVf3R4pTKzgv7wP8oz W1ArM0sH6EB5ZjnmFD4T4T0Hf4qn5M5xWnpXxd0WZqrYpN9oElK6ROzy2JYKMQfVeEzoBmtv9Zqd iZVZg3OzOWsO1gRZUBSzQdrbDX5co60comNkW82VWm19gzEb8TbYet2e+nu4ohwGNEWbqWA4TvRA AFslMOQ8XwNmrYOTwlHWvrLZLOgLmyz+pBSwptDF560IGSupxWdOUVPYXAkKREuWMQiTCnXroyN8 BfBPWao/pqa0nehxu4r9DJoU99vduXsuH3v+TM5/3Fl90kkPvHBR4Q8zs20d6ZmwzzM2i8PE9dOn 58Yt2xSsOkUpjTfafnf7aTcWTj7GVk/eLF4KLYwFHigTad8u6Cj3bfMHG63cgKyzBhtNMqIOlLYh 5WZlnrqV1N3YxXu5rO7G3donZGaVakwxSThLGw7QtqZRQ7RC1jc11bdRcWL7uMCQoJJ1nrpsxTvt vfo2br2wiNlx4zx6dTzrMYQfG9XeBBl0gmxy6tvzTfH2iXG4D0Po3zTYmYWLRY1scDriOWc8152l 2SfoR3CMeY6brrgyC8IkdC/Dh/qGucAE+VI6xA1mHVgjLvZjzQ5glayjFLFSaiV9Ckk6uaMr0ahy pzNVmcpMKpPMwOBkt9otdskuqmuSDYkOXWclcSec84i51jGPmOoNlbRLhTpZ215JXRnPPGKvrphH jY0VlXSselxliTaNmDuPcNZlroPmy9iwqaHMMoMmOWDkaag/YllTeG3OjVhKCkqnw6LoGdTcfl5i SZqFXk/a+pO7fv3wNWdO7Mj4a8dvu+3WKRbJ4m7t39h9Vc5/kuS6ZsndJ68922432dzjrrzlnAWW hJ1WG0TxtiU/2Tr/3OvinnjH1isKO54p/GMibN7hZNuYxtCto6cvgw84+eXl43+xeHgfA+vu0NH9 9PKZJ56p4qfULfB72SveBI+marpTzjRZMKO+9mxzbqJ1kvfE7IQc1JfOed552e7ct2lzhqTT2WrK WE4vwZ9DdprWmzaZ2LsmaqqymEySJaC3WGNVvKkimWxIJ5NV6UAsndVBxYAqtbpBYfQDOpbz2JQq p/MUq9Nps8K4Y4n6edUJIRJaHdoQEl4O0VCVLxSCpjvq83qz6XTQ57XDoma1WIIsBx1HLh6LwSeZ 0GDGXB3CQYJqnSeXTXptSZgdvbtxaCdL22V7OumTzboOYqFmKMz3+770iRDssjtrWdKSS1p303Zi wR6w6DugytonS+hrtlBimQYflqJFBNLMbqsZvwSYo6RmXY4tD/ADdEL4zgASYVvjmg+OPvoArIob yxqVovZYA5qz5qfQfmiPKGL/1re8BrrYYyr+PxWVqzUQc3goGYNGPDNGFCe0rK6KjCCZkQYBXlnC T4b/vFzxvij8lmOQTrriW57SB+gdnTxTeI4rWDbf/HHoPbqm8OKIYkX4lJOc758ZKdM17PThu6Ce 4v5qYg9gyA/vuHp6pvzklvQjmd/qf2N4U69an16buSu8MbEp81hC/ZP4qsSKzPm59fr19nXx9Qnt LGmhtEq/TFpmWWZdZtNMDk+NTIpPyVxdoao3jwmPjoxOdKTHZMabJ0paXY0n7I/4Er60ryZmTme0 F0lPxJ+rESaEJyUuCF8dXlt7S/i+8I6wNquFagxnYANOplVlKA1oa8MVQqyyoj6cClQlnamkNhgI 1tXXO7XMqY0lzMaQscbYYZxmnGdcCtPJEL1CrsolCDYfM1s2WPZZXrbst3xpUVu8jalKKMe4kf1L znw0TL6oBBOc7Vhe9gLrU5RiXBIFNCiqHkW1U7a4jii/RlIFZwXjWatdb7AlM4m0PZejCX0sR7PW Kpx3NyRztKSoVFSV3Oa6fDnMXH19CcvIInMuQlNGKOWFtkWAfRTSA/+zeiWXjEUoWc7Xl0l3/ea+ Ky7uvm/+sGK0/A2tmjetbdzPflzYRh+afmF7z93rCq/MLC33jovvmFdz52kz1y3gmn7WFPOf3Tzt qsPOE84eJV/YjklYVXxXPFF8FF6P78oX5uy0Bt6O04igcjqcp7gW2s9wLq5eZl/hXObe7tI3+5tq JzsnN/W6evNnu87KX+W/vUbfUGcO+6I4GKWtcLqa68OxoBlaTqshtj1jTTQb1onBRKZZEFlGV5HU 9keSSe9oX9JcF6qrqeuoE+s8o9YcswhTFYeY4WE+/YodjfPcJV2LYkor6YchwYCxJSW3lTjcVnYR PyRv8J9cvIbXyg5YkPxuJ7eO4K+HE3Xs9BFt/TEOK1xZr1HDwkQUWaPEUXKCkKoW4K9iBY8p/LnE rVlcTHXKyp/NP0VOjk35qbR9ySPdFofVmTn5xcW9p51w2rX1V3205mUxNIYv0Schr9s3s7MnE8qd NG/C7JufKHx22jyH0+KqmdsX853wyI2nPnIJ5Z/KwHk9Il6AvRcAqjPKkRv01xqusV5ru9Z+nWN9 aH14beT61Nqq9WkjqFwqXOWHkL1f1t2e2hFhXVpXgONbg7eKeL0BEnBpGS/nVVWKHSWgtVSbQ0Gn MxB0aTNBnY4FtSyeNEOcMIfNzOytzgaDNIzVhstJbg8dRbUjuhg4IZVcIrEZsBTcsq5EXPN1nA3q uIKyFxrDab2jwmwyG80Gs6hOJlKJykRVQlTDhcLK1JFEWh+vpmFHrJomzJlqGrWGqjmF5noAWC/L RhZovo7dH9z8xx2NoAodwYTKruCyIpcWIzQwUUGBz569pXpaVeC8q06/vNDKazbSurN39XniY+PX TS+8VN4Us1vmnT118crLvpozlu+KtU+fdttJbT3d2UnYD/DbFWuwHnlqlb3zQkvVq9SCxVCRsVoD hqg/lI/FAn5Bp+a8ljnYwVM5a/Z0qE9hLKCze10Zmy3gbazmAM7qMvl8oDqV4zpHls4kk4EclH5L 5FYvo0lDLJ705qGJDhJi8DKDNpo0++kX/qKf+Ttx4EpHu3WbdS/r9uu+1Kl0+WSymuSkHMsNgSI6 4aQCoqk72VZj/cL6JRdVmiYvVWz8WLmD3PMPGI0jr77lEAOXl7GZwoYhwj9U+dBff933WuuRTFm9 r9RnMiMNryl9ofbn5kaYGsubaMSZouEIFit7WeSBsEb6lPwu8nQWu5rvocPz+YosV3CYsILXDN9P FX00551ZvhBS6FhhO1+UEvoqvMsvebEwZR5PC5/zeB5WaRNWaSVWqZH8TT6tX0XNOmNGkgK6iC+Y j0YDvoacuTZUy2ozjY2BHMhIEycjVo8jY7EEPMksqZKqWFUmkQhko7GkpxGa2SQhHqyKzsN02sZE LpEkWSnbnRVg82qXs3AJIjQpRZPEF/axbt9m38sKH6LynWwJS5RIq6UN0peSKHny3+zi+0hx3OIk BZOP+VbWA9sI7sUdKHIWmLPEw/8y+yN05fjVOWYR4DsyYgoY2QqlJQC3Gvlf1uDOkiG44BtZA7Mh KNzFJ374p8cvwgh/oKyASf/vlwBrsBqU4ypQjlaalFuuC98RZjVShzRNEiYZJ8RPMfQZT4nfb7g/ /oR6t1EnxlyxpDEVS8ab4uomMmoDGTWKBJryNRxhNZjraX1TdX19TXUgr9eGUlLORoMuN8hTrikd CkhCxNeabIJH35l5uLtEEhUC2L/Fcthut7F0QtQFz6yuzgUpJd72VNKsDcFXz9O2ZulR2q6QFcW9 G1YuiCAKPuPc3oGj5KVkvFEkEs5DH4PZ+kqG95IRnmsfjqE8nfD5Bs1Rwb8kC9VeFUJl8dMdcWfU GRuhPyBAcJ3kdh5OWapZmbC4Gktmn5JkydEYNx4DzYmcFo1sMJWiY1CLNf1756158YZp135+3QvX abhe2221uKj6Tz9ZuWd6EyXvnXj5qaWlotA8SHY6WLgt39S9YfDaO9ZS1dqldXb4PT4V8rgCs5Ys vKHvgtv/9E24kjZjF7qpy2ZyarCiP8KuWopd1UWfkY3WXzgfq9nm3FsjlkQFgylTlhC8Yb5qFVKA BjKRQCAcCXiz9UoV/G9qqhpqauobAtnWsbxKMnfAEaQj09XRMbYr0FqSIwzqTFmMKAkRBmdVWYbI JJT7QCivzMQrKxPxQGZMnld1wVbWkmlsack3BsbEokEY9KAHT2azmXDSm0hmMiWZoXXMGD0EioZg vDEY75L9ocZNXVu62Pqud7tY1xDbI/vGW4ORiCVYy2R8rgbfCHqZMTObx5bC3voEDt+O45/M4PLr Ieh8FI8yoM8MF2UhI2DHQjbgugYuPCDmIMSx7BEXjTKooJo7bBxf+oH7xr8C2L+96of3UAQGRf1e w5UBZnuHU0ZUA0L0eIUNBURctO2hkX8xx5YZzhHFBY43/LCm3DSCWYQrhl9V0HXhHQXzNnLB4jsF g7DcMpjHQ9/xmsYSdkYfT2gZayoEj0MhiqarcCLdXuKjQAecI+2AuQ8ggHwCmAuRN+VcjVitihnD prA97Kjx1wTbVQ3GWnuto8PfETxJ1WWU7bJjin9aYFrQwb9nBN7H2KS44wR0npBS9jcRvz9EAp4S L2QA5ufOOQGtG/7698opR5MF7oqWgDuU9FiTHjdjSa05CV9DLoRapsErxxO+7t0RSqocB+GLzVcd ePw/eOIcs5Q/WGRltX6Ar0Egy46IytaOsRt/4KOzn08wU/SHYvvRySpRRD6JXBv7CLDvFsxbknwl X3KpsMp2sf1adp2w3rbW/q1Tq2MGu8Eh3MHu0jys+Uj6wP6BUy1KZ0o7pZ12sV6bDMfwKbxA2BPy v+12B0Ias9VgEMMhZgU2dbs4KpVNFhx7glP9fgIfDqDWSvOZFUGtVsMbNLxhNdR0ntRdu+jrZXIH Fo7jWG544HK1UgDBw+QBsqGP+4H/gMIuRiUnUzucdsQWlRlY16zW2ARXjkpq4GAns+ZKzCHfehnO HXIBCiSwxMOXPTkFbvHk8tIPZlbYcuDueY8v4USOTv355JMnNfcWHucAy87kUyy2D3tv33/q6bSJ lwpfTZxYGbxhOvtwBE7x1jgTJd6OWR7LzpD73Dl3k7cz3pBvaG6aGOntXBRZ0vnjyCWda+W1nbfL Gzu3dO7pfKHBZiZNDeMbTm0UzdFM04TGzvwpdc92/Fre16n1RX11i6OL637WuCX3UNPH0e9y3zXp 68cSUjcCzZnjoLkC5w/8DWEAdDjgSddyAHaGcxtyrDZHc7kNdblcbV0gXYczBrypAs5oqobjwN0A hqcE7lUx3qU7aU6GkrU4FJmJcnoTqIpGOhvlJrFjbLSOWEkwErVHIlESqYuKYVqbTMeS6aoqT100 GsZ+wYZxs5bmZHtHh1YrJWGQgGHq4u2RiFtXP0RnPx4eO7aOjE3W46M5+EjBxbJL7q7rr1tWJ8DA UtddJ+yv+xI8cWfzHuh1wrBVNMmWcZEw33fwhvuSb72uybtxgqFsEC6L5K1wez7kHXajuNzLnYY4 0vV6FNwLd2gv56q4wVgRUHiW/7BbudQIzxXu9eghcrAV0OxvRuSpR+TKIbJXdihmq0zPGtVPS07S 7mOUOn1cq/Mf9jzHysd0relbflzfHyJtTQVUPSV3ul0kWtyP7y02ckluECmG0MPRhCKi/ieUXfbw i1lGNEMjOBwGUwhHIyWWTNFTNnIIL2xWsLSCvGk/r9nIxs3l6T94Q7RQv+iajnj/Yl7zyyu3r6G/ L6wdwcpHEc3w9zirAITDQ+H09KUrO7/knejil/jJBrIau2M2dkeELJFbICTluZDEWXDgFh+EpLfL MlGey0QsafBxMcesozovuOmgzeqJ3neRgmpL0uaHfeCOS2Y2xdFI4YGPsL4jnDHmCoSr7Lc+QqhG CFl5nujrrFrxt+vnL/u73/GYfsBjjlDpSZxQFU47KmYoSJXCBkfEfXifFpaSR78f+DDIJpDJLfvw fZxX6Z/9fwp8Q76h3wT0CZIKpILJlon+U/0PBncFXyOv4XjSp/TjgGl2kBoVQmPbxMXsEMTsKpvZ bLUFjCGFtZFItDvKolXJaDSRDIRqFObGUI8vE9bnmwI1BhXfpgZtg6jVqsSAwefgZdsmNzW7Q27m rrK73Q57wFddWdrxmW58O6YqlclUpgLVQ8V1sj9ASdgfCAQps1MeB1sIgbrMjirs1oBsCCZw3i4Y 9AeSMH0F5Mk449DSzARH0seqa1JNyZoag8Eo2pJGbTLV0hIIBgPNTUF4p7xEQ6l5qaWpLam9KVUK J1kaU7I1b06tT72c2p/6EnVD7D3ZEQjReZStpy/hmAkV/X6RMRFqiotkpy0siHYxOM32ku1d2xc2 0eYZ9UxZZp3KN7FyysEyqqb037ccpx1w9G25W/rQC0GpVMsFKEVyUoTYVuS5aIUCZ8cUtoyrbaGv hc3QnVHBVpiB39oRun38vvzBpj1uBx9X+NfLAITngadfjs8Txf7Tnm2gI9rbf9OF3d1feFLayEGy 8HseT8zz+I/4xsyoP/JN2VjylXsBKvPQRit3ivshJzCcZa9xwD22nu9KqFPEywDFWbpUhoqU6vwe P3uOUQNV+3zU6RMNFgXIKqrgcGjBjk1kSsAEprsqW1mZyQYSelHpomkQNBpRCOi9dqUM7YbLZcdm jgd5ORppCEQiwUAg7oNDGQ2WTsxQH7FlkolEMBmPgzBdvNNnT2LnwzZwMQ4AGPR6qg34g7ARZ2Uf IVk5kTdnp2XnZZdm12ffzaqz3moGB3Mf726zzrMtta23fWkTzTZq8+RG/+iIULecazoAGJzb4KzG hyVmjYt2HP0jxb/ikFemAmaqBcandosfkeRTPE96FNX+UQA5btn/c+F4gOA+xAr6jsTofwaGH6Co mMiWDN9SwtUv8AWfoODqd9gSAIUnVOJJJoquw23Ho+XvPxJ+M4KSCTR3Z4EPPAtSuIl46GG5+Lz5 Nx5m/dD5ofs76TvrIechj/o551+kv1jfcL7p/kT6xKrxSl4rTu+5xees/zR/YxPu0t1ivJc9pHpI d6/x9+rfa7VXsOtU12tXG6GEdPyMbVRpm9XN2gZdq3G01GBtcI52a9MsY6yREtaEs8Y9BqdczHul QeugbdAx4Nzr3u3RPmp+TLrP+kvbPY57nVvcD3u0p9qmO/vcm6RbbDc773Tf7tGOt413jHdOdp/o mWOeI51s1Va5R5ubbM2OUe6TzJOl8VatQa3X+tQ+bZU5ZUs5IBd7qKi1mU0i0bjApFoSeqEiwVX5 YRzg30xU5Mf2hMazzdt1sUJRoASDPZi7QikqY24I5or3su6dn33qA2eww6nHiQeYVb/ZhlSC2/82 q7sDrqTfyhV2X4fT7Qx0uHmkA7HeBjUfmj7lqWqo+MaRssHKy89sQ4p+Sgqb7DPbwCjDJWh/OT0k V4BpdsBLs90WRES52xQOY8BhUkkZTyVHh7Gcwpz7FXhtWzutQGSM8hwX7I7/KzEwmR7o5uwM2gVY PaDKdlo1jYwfneB6bat41jVfXPtC4QWaf+Haz6+d9fmTW7+nmvue/JxNeLDw3mZ85asCXx6avbnw /kMv0gmF59/5tPAmHc9haxswSS8wSYzkyJeyG45xPg2+qGDzWUMJX9433rcro09bU0PFz2XpfO+V XpbSprU3e28JKV+b5dLZCD/776WxuiPsaVaRxWIkmLCa4x1xFo+7IZJVJaAR9XtrcmARJU/1N0cN BSPqaa6d5tJFH/9+omyOy1iDOKRiRAYzl4N7OGd4nIj+n3c138fcW4ksx6EKaGuOP1ZxVNOpiG2K m3+ibJuBAnrgh/o1cBwfP/r2xPop3aNPKXxHjX33THn48sLrdH9h5fE7+g/XTr880eK1zZxxYfvp MAfwPW1R9nQ1GU2fl+etyVxdu7bx55nbGx+svD99b7XWenbd4gamTwkZX8qeseeSZHJtV2NX06RR U0b3xeckTkn11c5omNV4anPvqLmjz8icUbeosb/5sdp7Gjc3P1m7s2GwcaB51+jfZn5bG601NgPa d47W12rjPHtosE7bgETuyRhT2qpc1ah8ZUd6dG70qEnxiZnr4+tSV2SurL6y9tqmjfGNqZszG6pv qb296T5yf+bVzCej/ln7TeM3Tf8c7W9qHjVabGyoFbJJmIZIMBa14+sFgTOxR4H4Txk0nAnvgWtl m5BwtUDVXZ+oclUJMV3FmVkcM+kbpAfhdZCV3fmaBFfDhrO12c1ZVfbH+UTSMwY7XDHkKi4g2OXw McBBeLCONdxKAflzhNHW4DMAOqkx03PA84Eb9QprUPHTZ49iBMU1rWQkwgfWuFejPCHWiqNP1WfA UzFTiaiaY4imIKJGHjXx01GNPGoKol8TPx3VyKMmfjqqkUcZOzb+8VuVQB3Tp9LAmuRSJFWFXy8f FOFeurBrKA5ZzUmW5/uX72LbMTuYnbdsRtPsWa2R0RP9RnjlOia3NKV/Nr7uhIVtdp3F7drzwBfY 3NjghZffPrK9IzMtYVeN1WUzG9xhT5PRYoETpl1aU0Unf8w3fOHBwt8KXxceYGccu+2ZYgF5Crs+ R5rpL/CF3eKz8knhSHvGDo1sb/7MuvPrBE1mdN3kujne2XUrwyuzF+avz9+XfrjupeTroVfD7yZf z32RtECpUjc+NCFyYfaq0NrsjaFfhh7J/i78fOTDjCm4B8fudPiy6b/DEMcLsGOOYohQOJ2JqKO5 bAwGo6ayNJojwZpqvukRYdWqte4qiKxprs8J7WYXkxzbLJvwvX8alBoSfpKkSYDXjlX+9TCyDNFK tEVpd3Rz9OXol1Exyvlhs0WWaA10+UzytEwu+wyM2If7lh/oO8A/0QC+UznrpzCdit8AEPGIEKro kBUgO4b1/L+gnRbolK04hM+tmYMhY3g3FMqR4qHtGWPeGQJ9GmwMw5X00xKs4qRLSaUMKPuPHEcJ e8GufKx0iKOfZbMynfWvcuLhu9686s45q6+XOSu67M5Hlha+/uDcbdMfuqjwAtMXJh+Ptp776ZxN +fY7v+K11PVUfmb3kpaZt4H/3AWOxA6OZBx5W063NZzom9bQ1/Bj59XONd5rfdeNun2sflJ4Qifj IPFQ54NjX3d96PrapcGZu28Gbe4m+MsC98hVbWO8brPKTmhzRX1tTKhu5FZli4Gf1W+0JLpgV65e l2pMRLpgWk5pI4pxuTkxL7gUbmTeCfaEXJeMJeXOpVWrqtZXbaraUqWq8oy/azcNHVUvTIWXocQN zjixXrI4j5ichyFtlM3OJTf0UfxMEv88C/eIpsrR6R9Yk7n23mEPMuX7BopKPzXiMqbIqke88rnF suzvKtxc4uSsLqq658p191af2H/mI52n9nz467ev4NOKgJY9d9/9+ITxtbf9ae7cVx8dENv9fHXe wAkt38yr18+vP7khZPEHUmtP2/DCtbW86WNue57787uXjF0UdHjxbb+rrnyKywXrQc1bFWp+g5yG wSzPDWYwaTZxkyZsZHluI7N5nE2Q4j0xKwQPmMK0OKS0dKckWWClBOZeKoclf42/3/+SXzT7O/zT /PP8y7Cbtvjf9Wv9nyS4QMe1fziSDTGt9MWCESPXEUn+eLmey/Nl/cURaX7EkAVBv3x2m214i7/b sKK9eKvwIJ8e4VE+fcerSAv/xXlp+uPCtUoKPQOZAXi8BO9dS6N74CfwLQkVvx0MSX5++NcHTi/6 Y98B9Yf+T0Pfsa/VX/u+DX0f1hmYqKY+Q+gq30a12urmwo5EHJKDORo8DofbE7CW1HEV+PJArgpf DqglgbRFrwhJpiqdyaTXBSwlndvEZENZ1wZ9GhRqVVXupFWftFpYAHxsNAJl61KsDTPDED+PH/eu 93ihZ52mm6dbqlulWw/jr6fuGLkHYk9Z6inlFAXrEYHn/0WUOV56QYnzxpwUArjLmlW4upUoEoyK JS11zGIH6eI6VqXhSL0w/NcHlj12MczvFcZgSWrZ+NTlM65dpMi2pQooWsdu/XLBcxeyp7BiJj1f tuGx65458e7TlRpFv4SVkgChnPJkaI/sx6lJdy050T050x+4SXo58J37u4z+QfJggBkVYbRCkhoc OKvnCBgdzii+wnKvDAS/LMlIUkr2J1/G0aNkFWzu6UwgmiEGxYHNvVRD+cn8pRrItVVMoxFYwMBo xMOvnhQINLgDAY87EHG7HNBeBOGXA7ccfGiAwBppd7nwMc10MupJRuxJo5A0RPFlQKOBEdh74b6Q rHV3uwfcX7pFsCftssHFkjWOeY69DsGB8jZ8tNS1m14BlfbL27KKLxq8WKVDH/bh5AaMTQeh+wKj OqLF4DaHmpoRXca/cUH7occZtty/0Ugeq6IsLzNkVCwg9+xVlpD7TuPDUvgE97+pZfedX+jpdNlN JruLjnLbTBU21y/o1Wp62Wa3HQU3bSmlstiucxiNDl0pPuwUPj22zLEPZDXxXqxtJftbiT+T3Q43 c7pUangCayu9dnUybGS6OHNUlUgn59pbMSVcj1tX65NnLPUu9S31Lw1c47zatU+1z/6xU9cv9Vv6 rf028SVGJafkkp2yS3QznyvoCQWClVWuJtbkrHNNYBOcna4e2uuc7brG9aDrefY751t4LcWD0SJ1 Q/Wct0uSzR4w2R0R6LHulYPxcHxZnJG4FO+O74u/HFfFN1TG46nKQKSSGNVKF51ZF9Ixs26v7l3d F7oiNuoGlU6nVgWMKjHs5V3sgXkwkuY9gYDXA2sLzt05XeGhwj/lRsf/qexL4KOqzr7vuXf2fZ/c mcnM3JnMZLJOlgkEBpILYVGRRQoCSlwQVHAB3LdP4ldfxbqgIioule9V66tQxAQkgBZrUbHYoi3W pbYgxaUtKvpS6idk8v2fc2dCEmvf3xedu06GzD3nPOc5/+f5/x+dFPfpdbqo3we2lA9JqtEyGeAe chBEiUXLgjgOIibJpCiiI35/QEwHe8Vr1GhZGqFPoHWSzlSZVkL0fzzuTdsNabsNJHRWKwiY4TrB YRBYp9q0V2YxmclqdYus5kbk5K4sDpIVOVlNV+bktOrMxDLnZlZkVmWeyOzNfJUxZXaI12MJEoT7 HQzg1wJqFi/8akANtTgDX3Ey0tzNoppuAbhzfbc+7n8Z/5xPkPBP61id6o/52Cs+5ku79JBfm65f pd+r14HRjaQLYSJH96njY474An32S9l1COheTd9yWtaWfSq7+paHyr7ga9zlnYdwt8z1JUZG0b5h p8Vfx4BxSaOD653oMT4GDgD5FVM28XmDMXoO5w8aEN9L4vz+BQwymMYpm9JwzKrhmG0Vu8RQMBQI cVs5D3dCRZdtG4oeHe4WTUHIXL4QcBXvc0i/s3MeFLOQtznUbia93mZvSW2rZGOl92798q+33hSj qY610gy2a+lfbvnrZa/xCyPoQkxqPwEdbM1xAPiXkLIn3pH+XDrHSJuBkdaFkdYhNqtrPC1stNKa bOlQbdMD0+vHtZ5hOzfQWX9G6/m2ywOX15/f+tP6e1ufSfR6epXeXG/Hbs9uZXdud8f7wuHcV+1f dPwT6mRfuxJl+Ngm5ulwezqSrgSIP5AcZkou1+HxIJyeQ8wo15QEfSgKOg5jTSL8bBdCTRZv2pNW 0ojQj093pHPplnS+Md2URvrAdWoEfrrFFDLlxWrxqxzLpTs62ltb2yFoV1/ZQa65p32c3pVmTG+z 6cvLbUhjg/+RUd1OfVbfjn51rl6vD01sSoMwl9lSeWE5/iW6b5mOMbe0XCqXJ+xgaZ7S5td0deSp 4JK4jhKthHw+eeqhMiAHGq4s44jf5NdknOC6dpGCEpSLyJ3FL8hjLG2oA9KSMeqioJKLgkouCiq5 wJlpdznsAWxsvtJSkKBG6pn4jW2Cp39fD34HyNO+Hvwa3+M3sf8cqfzaOX6frncP/Qgnfvh8zT+n uf9r1euAmIcTqKZb76cNMCTCllQvLilluNlBG1cZsgT452PfhPtbsXc7sKYrLVU5lDRvALQuOWPD LowArF3syUWvLfm9C+JatipOXbbwDW1vKzxdePY2fn6UUlOa2U8KK3kf/4R69DlsAht/Dh19Su+J i3P6+si9o/AM+0VhvHbsCBhgGD8r9fNCJ3uydIzOCQ1IICb3o5M+RgG2z3ogPwKC8mdqCxC2FxPM nDQ3yUm5aXFycZPhLM85gXPLz1J0JmVh4oHE0wndP5Vvk8hNNCf9ipyE1gfZbiscZFL6KDdr+S72 gWQXJVHTiHf0uOpZfa/4qmptqq9vbCqvaSoGYq1wpbWkA9lLqooBes9Aknx1BX16c2VNsrKyIlle nUwkmCvhFiTZ3JT0NqZrKtI11fF0dUjxeHgePJzwZHoGUqR6xZ1bYNXTbqTu71SdSlrwTPesouS/ 5sH+IUh/BHjBp+AuhRYuQXwEPRdRSJpOMcGOGmQaSVjkpGEcLjMy+BZ5jj/8Tt4theVYycowiyQn 1yOUucuKCbjL0b++7+n/z31p9YDjL8c+LKxqoj7yGW1+hPoWzTMH+k2T6CpMGOg3L4n1pe5RqGQf lI7JE3kXGScF9BXMjOqo6yXmOd98vv+8wDLLcuuygKFX+lz83CmZRLycMSnozIhZqVVEOTFphXSt 8xrXHeJKyal5AFbzmcUJX8tjqsbaSeNCuJyi5Nbpow676MHSiZmcarzFqZbjJUdyzjTCKzeoSVnz +ZdCNyoUdqdt4+KMTUetiBXsCNMxOYRW1fIIsVIlkwXUk6ZGNKsGahJHuujwc0r0kBM+c/kH5idn /zcviA5qC8pFY7AeWyQS+QHofbCnuN8KHEuUnDEioBNipUDdYYBj7QbH2l8KvEqFE++Jz/W9Q0FW 8d2+M8Vb6QnfIL1s5Dp7bMq1J8abWYoaB6y0sYU+aQ04425hkppGnPgbQWiCXqr+G8wVJqvFZfII rMLssjRYZlgki+xZ9OzgBBzK1hsiPIFvNrBiLIG04n1vcQNzQINhdfd/t5P+Iv3f6C+kVv9L/xng e18EveDTt5gzVjkHG/k+WJRyzmyWzZezxSYdZE12bzZMhUYVaVXZoFn1chaaAO+5DG9sY3uQ5IL0 Ngwr0qvqE7iMF3p0iX1YJMux0eKTFtkdcfd1YhfWj/9ubsDiklP6Z/1WF6ZRNqbQJz7An0WbGh/+ LFxWj9lSwdrx95aewglqdUobHf4M9AMLsVLWi9i+h54BixcO0P55/TjKfPmOZ1vhEw+JB5Bp1c/5 m80Xm64zrTRJZqvZaD3bJcD7FcxGs9V4tiiAl4OVGI5Fg+R0YaezmX8pqIbtkgQBJFn1x4VNEmuX lkqrJEkKeaETAPk6dFTIkiEMJmdDU/vK4NV9oVH4kYUB/v4QYToyFCcfXEnwS7yQLYdUhS9Q+F3h d9AylD26/kJjEJmOIdZV6ApDwRCZT6JwL9bzZ0pdQgZUtAXqGc8Zn4o9Vy+ljalYXneV99rQNeEu 33+E7vetCa03rvM9FdqY3WJ8yfGCb3NoW3SP42ij34KyFNVMesT9QEi8sf4n9Y/WP+dYX/9a47uN nzSaMkABN6qhVFZJpRJKIuMp9warRijCiCrop9rMtSC/HVDPYiszgqVZkaxmhQDqZcgTrsrbbBnf Yy6l3Eg37EI8roA31+5UWFZpV6Yr5ypPKM8rO5X9ikkJtQZXNSgGur/U8IRhp2G/QWeQR1bvGIC2 O1nN1L5PadQjlUrrAkC3OZU724mj9jGc71+05khYdQ9OWSXHtWiHCVHcKRgBduT6jwgteMn9R3s8 pnoTvFT8IHREJpsUQH146w4ofh4RvP2v0B1kWnUqLRo4DfA6ECxS5LgDMBLkSHIBSmNRoowiBOo4 TjBSmrv17YeeO/De6JXTu7oWvBA3u4IWxwWPzXiiexlZhdfyt5669aJp115x2Y4Lrn9k7dIbXnS6 Vk68cJQFWa0WZ6j68Qv6ENwGsvifbtf0/MzTL55zLrV9Hdp+DkZPRMiwihdoAbdRtbqyfPGWsEcC dO6Vs35ZDvgTkahRYtZ42tYJGboLtqQVc1yBD3mBWi1FMAegu5crTjx50RCqTs4SbHG/j2hmTt9S 337o9cpV59wzuDmoEXhuGwWdkKhCixPMqfKhMuIxEjz4g+ALbwxb0Rars5aYWYO1oWJy5szMwsyz iacrtrJt1peiL1bu0u8x7dN9ZDqk/5vJHdA1sib9WGsHm249NXomm63vNHZaF7IL9ZdarxZvtNwY vT52R3R77OXEllQA1uxIt9WVAUb8QpQnHvNMuXnQlkE4AXFAUFr8Jb+tZDngdQ8Q7Vn1w+/1MkPh n1s+Ws2XG8U8/Z9+eP/9H9ILkqa/f73wj1d3FY68/jT5Zro2sq0ndj/xpz89gRcsDOUkTsHIrBaO bFEsAOQR/jym1uLgDf9HqQ8qD8QOKH9P/a3SWOGvDEyIT01NrZwd70ydVbnEuURenLpDtiG++o16 pdc3z3um/5LUhZXHQnoD8kL8ISTse1Khn7gedT1Ytib0tP9pvDcJEM0p+8KMuEdyJKghxMJKt1Jl tPboDJH/DCpJqyNvmrcuxu6NvRITY6Fan4JFr7l9XZpRKty9SIWTa3YNameMNp4tDuYL8QKhGYb/ 0MAc/+XIBLV1EQwm1IzSETEPlOBgzibVkrmLI4EPEigdIDjbkkNwR3qNzDKSrsEoMjz/wI5X//Dc gj0z/dACW/Tk7j2F48y655eSPUKj5BexUDA8uetvDz2575QZvqC7ZvwlTHpjD4NCpCjcjKe9HmMh iuf98YunVl9cjeJVNAB4ImCWu6AJUxTg5UbVFc4Gw+GyYCJqCSQy5k4LhkFPRsHzxnCIJxRfVLBZ fUZgB9A9M8e7qE4ZY6HalNIFcKSX3dVTU92lDQbXseXcGQFNjlJvaChQ5g1k1Q4dpXHwA4OAw4xT NgWKg6DHgfqXZGKmbCqNi23QXzzcHfdVEjCbhg+fNFXIAzZqYMpPcnukAVhNwVJXHiwJohM1E3P/ x1e8c/3171z50YP8fNn7ax58//0H17yv++z4ZWRbntl9/YFrr9t/w272odaT13300TrqySLnNmTR k2WkF7ytLrYE1vrFJnG8OBN1ul4XX/f+Wv7Q86H8UfgvZZ/EvgvY5Uh1JCe2Rk8Lnx6bHz4rtjR8 aezm8F3htZG10a1659WB7ZFd0i7Pm5E3owbTa+5QPA5PwF2uBI06xW21zQrl1wlsGUZQL/tEDSbi eZZf52NLfTt9e2GKdNBXrN5w0hSBk8Wpq1DNpM6JpSv5+3BIBj3M7oAP3KQjm8O+WBSZBZqGM5l6 JBoyhfJli9abJDhKPVMwkgk3GHV1J/4r8Mmz5/x2nNcBJnLDP255v7CfOXf/llnmyO+uXr0vxB5/ 8o22Zqfsdrua5rDwm1thOf77ljs3bribfK33sBo7Cz0zJ+xRU6pthr5L/2PbLY3rbN22zTWv1uyr sQSRBmjb7XIlzLl6yO9gOaWD2DK4ESZ9L1PVEGMJU0UmIaQ6q5RyQfDE5fq6MoPZZIGc0l0gsCO5 KR7ay7vmGtWe9av+Zf63/Tq/3HL1NvZWMR95KqdAjYFYKkGrY8hp7uPiTZgpB3tTIEGVLvCcZEd1 TRgNWhsTasJVMdA3GRcG+MGEABDHMcYR4NHCPtym+ouQjphlPK+nbym5ZHtepO2LG+659vZmqN+Y vA9dfPm17A66KNn7JpdWL+I26o8rljwWMAU8nqAUvHTiCs2PFYX/VbhZdzN6ZiX0aaJq40TfMp/4 kfL71GHlUOq4crTCcEnVZXUXZC9ovsF+U9Xy5ruqupofr7qveX3VuubtUYdoImuwgDKFs2a93mRO iEK0prEs7grG0ZaO6OpGJW6pUYTVaSOgGQhJsEx5nMUtFhfIaJvMktNMgYnnzXuBdoZa6pWu5L3J dclNSd3O5N7kgeSRpC4p56rPH9JZuRNDeZ0wGOTIth8ik0puPWdQDLIY3EgM6sU7EKA5KoSQlVBt AmbxbXcUKcc4qzU10K7KhlSFb7vrAmA/lEKjRZ+GPBfWUkIo3D6jQ0QCAhe0gAYgVB3IikCxETT/ waZDukWb+yrKls2fytlmX592bWXg9nd/fvz4z9+9fc/dd//613ffvUfc/Qi3GNtmja89J4OFRhk7 /dTqcSe2MbZlCxMKUx546zerH/jNbzAWZmMsXIax0MquUOvWho7HRR3zs4WGqw33sgfEdewpcRPr ES1PG35m3KzfYnzd+L5xf8gYMrkB98JuO30xn+ibj8B9sCzhrgJfCg5P7fyG2tpsQ6LKhYgT2XvQ 9+fzoFPCpfmv1tT8ov/aCthgo5psyTa2tDQ1JloZkUh1VZkMmrtV0BldFpM5Lu8vY5gnnlStowUl 3rizYS+4c73s7z2jJhebklafHFTAtmjyeezb/YMGH1DByamAgIOTZ0NOcKuUsMFAqoSQHHyZA90g awMwQGZ0x/WqKxTWGw2psB55cSFjRBuSGJPoKaWY+TbB0H90S9wW82neD1av5ABpynonfdQSqOUm zwd5FyXfdeB6sY+wmTNWn73gjvnnxGRkCn9Fc/E5P756/rjspYOJiHxkwy86PmfyxFXT+/45MH6l s2+oi1/bd7h0QXOVMK+8jN4QgK6HBA92hVqdkJtkVZ4pXyBfJd8qG71211yfL2E32Mxz9fqELRCR 1/jhx0qvib3sgRcjBrsNWjs7GIUJRSxDHDod4PfpANvl8jNWnFwzIz7IkyHbj2GEDVk6n7RzGB7+ ZIu3tH4uPoABRpB4700r2Gn0vfvKyDyx0/5Bmah69wcfFM44wYP+5APCUsGXIW9kc+FmqZV/s3Lh CbXGhZR+pFBIZzvnReDdRa5ydgldrEvsktY4HdNMq0xPmNZHtkf0EVOYUh0iGM16K9bdP39Rp0tY tS+sOqyG0Cw57vE6AqsBovSyc1U3hDGlaMxmj5eXT0fkSI5uZ1vYO0WLz0OjcEKyA+FnaMEc6ys+ BEyQcNegFMq/+cA3Hkwr1kM4T9x/0y0FOyVhipPnzh07q/AP/gDMl9xK377vBB/5F1xyb12MD/y7 LsIo34l2XY1RjpjINpAAX+lBHlAVcYShcEZ7dTp0ki/y/swr7sqxal91qr6qOpdpGVXRnhpb1Z5b 4luStF7oZUnvCK9Y45te9UHqg9zh1OHc8dTxnGl0anRuScWSlvW+9UlDBRjIqFLK7cCADY/QonUz qpbHkCvySg/yDGmvuuB5x+YnY7FEMhFBEl8ztxYNDZNyDQ3NuURdrsVt5R/kyFocDqsl4aZ8c6yg tGTzsrU82zwR9nlr03R9clXV/FRVVTqVqE1BKr8i3pLzgcyYRIFBb1xIQiM4KXhbKnz6JEvkIxF/ PmxI52ub83V1tbWiNe9xC6Y8Ey0+WkKblyIQ+UiqYnbLdrZOSOGKfVmuKyfGcw2583JSjqxR+UgI T3kw+ywzd5lFlzlubsABzUMGszxiB3scDISyohqQpt9ANon4zlD30PDPUryI5poShR2IhI4j99uw zt3XA2oI0jX39YAdwvfA5fkeuDztu0/SRBjxRLjOPmWWlw2CQr/+Xjx2iI3DyUnYdPh7sXrIDreP QwgjXuSQhipyVBu+x+kmvZ8D3dgTXg/7iCjUSQ86CQ/aZ0qRmHmu/xhf3nO8bzneVQHXewZW+NuE JPJcU3IuTqt/TjyhEAArudIDiY7NA2yTUnxqWCwAFQXYS4MWi6+xRTV8rNjJcJxfgE7Q+XRUOEJX 84WH2DWFnwxaOn7Hasl80IAqfFmYV7KWqDzNUKlXQBbRZ+BkdKq5Bf4r/T/2w/mwzSWfEV7iXPIQ PWX+NW43olNwDAUWd7vAPt7pklyyPNgakvf3b6zgD1rA+4bav2/I/pWWDie/BPm7fvytO+GTTRKr 1THOkc5WxyjnaOcY51in6uxwTjR70rYRts3h7lpdJRvBxNmRBcYFkauMV0X0I4xNkYnGiZHZRn2D aeRYPj73j2ajJ7WNHj22LTHSj1DERjUa97AZnrc9B0D11wkel0cF6D/J4fE4HQl/CsRHOApCwgVe yaRoIhGLJlIjQBaji82uZrF5Ura5uSGbGDFJpYuL9newjkntHR1qe6Iua4im6+sy5REDM1aPVPPC JEO1IoUUs1kyglCXSvktdkccgeBYS0OgC7HfE+nyaLwyTefpLlQZOdEmZOPtbQRkCW072/a2SW3y 5Oqfa3ORBlxhJFJqXHGH1qAkB837QzC3FI9AROKHaBpDhtLQkQKS7vC7JWfCQFaYOxPDnYqiVxHP VJWh2IJOb01V6SpjTG+QLUGUhNZXx1iZDUlEFLCAMJimMS2gYMaUTeHi8hW0b0v/l4IOL2P/h/A9 PhRY/+9LvifT9DGRf9oTCLVxrQjs4da80o09H7cQsPMTMBBEGgbpt5YckST3TE46Jtr5IE9lOIbz +SWXjlugtF45+uwRk7kGxqPTmusvHDeJRtyj0xvrasd28MsH6YL2DmnB7CsnTpo0MX/6WX1baNCJ D6mzJi7qgywdju/rmFNetVA7oW6uLUbQyy9FL5+DXt7KbldHvmt41yTuMuwyiU+aug3dJmm5scso XmBcaFoYlh4NP20Qb4z1sM2iFIktiSFFBjSgKMYr75VOfwyJVJN4IlXCM9yn1aYkB5VNmVSclTSf 1iWkXClxmGNrb5mkObZN+VYD284OCHEgGt5yRWeEj+sBmGi2xEP7kQJBE4qLu7f3NqyDeyuTb8vD KwTsoXdqPhPvnJCEav9ioDsO72GDPNmhvXH4G0td8Yf8Wl84Av1jk8EkGiATHWNhE9hTtNwkouvJ ztaNjAqkRb4Q9pHBFojDAC4DJISYX+s9g7qPtsRpHtaLvufezpl7z7zzpreezbvGx2SjJ/3vy350 w/LB3i2/Jy1YMW9CVfTOU/u+KplnUZp3Y8d/9H09cM5Xq+QD3gdEagx6iBXpI6eorZ6ALgA1YulN 9qb1XfGP+j8Z37UaLjEudouLxEW6xabFliX2S92LvBcGTX5FcipmwOlGm4IVHrRV5Ha+R+Sa9qrd 37JJYC5wPc6D89sr3q6WeYCf420GFe9ZCgh9r+GA4YhBb+hlB3vKYIJ4kjjWLZjcQAZZjsdaQ8At eQIcKiHEm8DxHahgcFTwIdnW5XP4gtv7D8ItONhjj7qjfEDzh06sYy1B3Bog8hASqcOkNnYMzlK0 3erDxmTBxkgbXD+slsPjM/qQmgwmtqc94HMH23y08foo8N6LrGoPDiwWOGsm2vDAG6sh6zD4Zx4j 7FZDDgUUxRgAbHVjCl8AjP2SeXa9yryzP1637mN6sedfKRxh7p2voKzMkV/+9M/7H3/swH60TR1w Axq9pHZcp7Y3WpyjKvFqqTsD8iyd9oUMbWK4xH4Vu7H6inrrrwyvWD4wfmD+sPKDxk8Nn6BgBAq5 32i8S1orbUDleXC5sAyVs+VQSC1PBLRZyurZPWRKGpfIFmcjiMtlnXl/JA+IxJFVrJYqha3WGYVY PmVIK04TM4WaawVHPOosn86zN3TlctNg8J1GKCd6aWpEHED4V/jBkAE47IS3eclT6s7YGmjdUcdT rO1xRq3e2P+nFyqTA23OWxydRhtlhO4QiF4y1N8bUoOahlVP2XD1Tb+7stD38sd3aXFJDv8UIfXH f//w2n371j60T1qw9uz5V+29Ykuhf2vBQOOJYpa6PHeIFt+39+1773t7L9quC233HNouiQDk6aS7 fKzbOQrLimNqq3PURuGZ8MaUNFM4N7RQuDy0RLlSuCl0Tf2PhbtDt9WvTT9W+1D9s+kNtT+rdz+V ZI9WrY+vr5K09YOGExdhIM02W/27i2ZZM8MzyQyXFgdCqLKuLO8hR95Rp0SgswGEqBJYUQIyqrJZ jndZmNNywHIEQdxQY7VCIoDrYptiur2xA7EjMSkmN5RAZJ5QX8LZifwJUAGoELG4ebLXUCD531vZ oQ0b0kTAsnCEU75aEuTO+Gogvv1C1bCW1VD7AYSoeDDQrICHMOgqhsFDG14jW7mM48kFCGAA0rvz 4EuFPib94sCd+x5+eB+9xDfXUgseB09Pa1H23VYAQy/2F6bct3fvffe9/TZm0/WYTc+SroW196u+ mxys1jzdssRzvecOz4OGx71GvqJTrbHdxdVb2L9d3IjFjqqai4sykkrZqE7PTOM6KYkaq8PHC7zr jXaUl/c5XJaKVF6oMVjaXZgMsRajJVnY4jQeQWGqUJ3gi1c4kzOSGoB3JGlIyrV995ycEFGmg1JS p2oLJ7QKl0ekdtE8Nuj3/ACgM2zc/dtJELOcu2iGt3h9joAnok1xiA/zuU2DVLnGF3DpYa76wEJF FJ96cuKUW2SvxeFN5uSRj+5kV1E79V1Gq/g9nFApLdj3wOxFIS9QlmRo7vpCjjcOJHTEl6ix0CJ7 +/dLBYyyCexrdaWvPTJO9JwOAYjFEzbEN4z8P61ved8c/2fvHwJ/aPvj+L97D+U+H3/CezT37XiP 1WsI6NvM42Nef8DfFh5/Z2JNbofTOsd7Vuvi1iX5G1pvzt/Rekf+aV+3z3JPfktMPMNUA5ZKozp2 TA4cB4fRbxsl5EBy0NWPcDqg/gueg5wfO1ZxKx2I07RsluKUaMQeVCPpEYoi5I2zRynTo0R1kEB1 aJyVzFf5FZVmyQDmQ3Xe0ioGrkOHUTKkLYr1nGLchlA7XoOlc+pRVkM8KcJlOfOB2pizWpD0RroK PNhV1N/ncS+ElzkQ1zpyvCceSXlTwTZ/TMiHR8XYyDg2nvE4DbSXxQTkk40dXT4GvkwoP6Y1NiIm +Ma5uStNjpUms0urTfxwH6fU+pvzvpwl8lL/Z0IQckoTMGzbfKCjHe5JBMZQn9B++Gp1OTE3twmt mGPNWHbkfdi00oxbhsy3vA+bCTTFTvBhUp3gAwQSoc/Bk6E3bSXHwkcb7Y+gLZEnOUeDJObgXxM/ Q4tkE5ljANcfXMUS/RLXEUQhBbqKYoE86SZtNUtxvdaZt989LT+p4bbnJ5x/7m/feGOFya/VrpSD ybVLn1p3xszCGytP37d6o1RTjp56bzQUkMdUto6qaRmTiTi9ZcmbTrnkmUUJnyMU/Tk6sb8+1tB+ w4Rp2Ww8d/GYS1fQqvN+eFt55DHVCm+qFcfDzI5SheJTli2WVy2/txyy6K9x3OZY4/iZ43XrH6yG oIlqnGxEhu4Vqt+k0xlNyDrzmf2oyuD2+PSyraqXPam6o/mKCmOeMcFgU2SrbyWkxp9VfbW1wIjT yutCxBWJg++xE7hdr/hJTx0t9NCJDsE4wIMuSWsRHZ+MhFYPZYiZ0OIrobDFag2ZY4IlbItB34Xi Kzxcjbp4GtsAvA96ulqCgRaiKlESRjRr8ZaAH+4+V3YotF69fPbrI3121AWJ/3P56o2cevAoNYa0 gAZ33zunLmiO26nGlTL1J1eLWbrIteboOZ6N5zhPWiBUwhLbLLotATETYCEEqLiTY8uabDazKeHU AqnW8LRiILVSofuQ+GQVk+IVFUo8UckCTl9cyQuVlmBZHhoLTpM5D0EbH9JBEPETgkhPeFI1V7nc cdNeiOcQwJ4ZDrDjQVLYmXNWMWKKiV5D4qr/ZjosYekg2quEpMeHwOgeL2n7e3XumOAx+LQnrw1D b9EIv4yCFYfhDx9EhupBjDmKGPIEEBI/Hlh6UtuMPHlanDql2zbsvlH9EQfFX7t42m/W82b4ii8j bnysY+7VYpQ3xt0zl7ykHWo4MrVBHrPh/WiDJCDexvVsvWeDV4pb4tY4iUE54s44Vm551uoZ7b1Q vMi92Lc4+Tze9JzXo8YYyZNtVP12we6yZ+2SfRqXKUtAyFibRPFtAYyehEFJgwxBE4NhPhchA5yE Ghh0qb3MyUU2pg3Anm6wQOJaxU9fUhBQgQZlQIF2omB2EeAMu/IWKW8xG5J5wJpLVKtXzGfd7e7n 3RKKZy8RvMysQq2bNXiWetYBwtF5XmbPo8+kmKJBl1h4Lv+Uc0DQ7KU8d0pz/7f0j+HJ7MPgx+G3 6ZySrpD5p/E/KGI5AOpx7sfgK+KmewrPnEneDcvT9k6WS7F6rjXLxlBEZLZkp6bkzTlZAwjomFqy tb9f9wBaMiPVqk9nApXB26TnAk8jmLUtsDloEkSXuCKwKvB84BeB/YFCwLRO3CTuFSWTzuQHccaf Eat0GX9lsFXX6j9Fd4p/jm6Ob65/rjw3cyG7RHex/6LgRfJFmRt11/kfDjwY/Jm4Xvdf/nXBLeIO Xa9/U3CrvDXzZuCN4B8D+4J/DRwK1lgD4QAEUgI1wdvl2zMbAjsCr+tf930U+Jx9HvxWPB74NujW cohAJiolEWkMkI1q7bIKJoAFolZIR+hoHUgg0rKKrgqRKCFgqK/lfJBEkQ+yUa06l9O1gFLGECSV vjKz5zk1BBeY2byWZ4omitSQjaq7vDzLeSEJ8ELWcF5I/2lqU4kXglykIi8kPogXEh/EC4kXeSE7 gXkE2VXoTQfw+P0A0pM61MRm0iydpTKvhPJxb95uyNuUeNxutxmWItL3KxmxlLvUtLBaVhvAB8nU gA+SAh9ELY9iI4ewAcAs59XzoAmygz2DNUiQ3QlCyGxRbRyVE+l9Ir1PVF3uHIJTz6h2ffw8JIj+ yqdb7ctDDuGV7oYW2vW0jsrx0xrtFP8Mv4xP4Hv8Pt/jw2ivegLBnF71t6wAcUQk/ogI7shBoWrQ iDnWyUui8wn8C+KIdBKFBD99nEDSWSKQ1BwFn+RQp1CmQY7k5XBvFuREZKsgHP3/SyEZNsqygGCW f4939a8uFnkkJcRhS8Ykm3TEEik6NOwKxShJlSWKSGlRMpgiUromrbx4W+/FG6toXH5Gm0vW9Czs XbWE0OlPyenNMDGCNIdBI/RC0dd3WOQR69IoXQR7uwSjtEO8X10Tc8c8oqfVPccthgljiSXOY5d5 lipLk+d1/Ir9yvVbz2+Vt5JvNb2ae7XDCW1T4WFUT/4XdBBOAYlrFBBODYlr1BAR6SzOPAylN+/J K/l4PtSYb8pX5JP56vH5jnxLPpfPqyX6RyX4H+3z9LleVr853vEI8pPRo8NEA1GUAKggAkqegAry iFO/FF0DBBDc70k+UokKenif8kjlPGd5tggj6EECsVhClmpD3vDpdmbEGIEA/CBH+NBAjRHyhYuM kE6ifuBFcUSqQHIo9EUZShUU+SDFfUhAZeYSEeTkEdXKKxI8fj2M4LGhRyN4HOvxJImIcbAHuBX2 f+4Oj2njfRk6ZAMUETXpGkGkktoBUokFv+aKEpMjCofXlRj4Lf5rRAvRVlpb3GV2Z64ZDI9u7OHm UoyILL8GSjf3H0QJCSvKvwKVwrsOqqfhwG0JBNvcmDLbOsZB9IDRpmMk9A4YbTpGQu+A0aaDUsYR bna2K5byeFvOiU2TTw63oW6Qn2glh0nCBN+K71GJYlePy0fI9y7VjoPkGGwU2hTXANr31raaR07O OGvScmlKi/FhYSeioGgUxubSqBhGQTEkkVlxSxqSp7HCNzQo7ixsK+zgE1jhq2jI6U2zWwrPVaAU fOwTms8WsjArX0hD6BO6W8FeK6zixeYJAGejCm9oWCdUUrEwPcVEZehpJBW+Ym7al3ltAehHCmuA 0zyMUdXEXoIzIZR5yhI1diWIJHr3dLsaPO79vwmrGbXwTktczC52X+e9LrHSuzKxzf2yd3vi9cR7 CQcmUE+Tx92ECtvkkETt9uyAMxNORLtQ1nFtIgpULZxIEgdl4+b6Br42DBZJKImaJq9ZSwLU69dq KYBmiDeCMYspJ9gAEmqWSzglQt4mYqJsVC+rrMxyKkoCVBRvEwTcuVaH2+OJU3Ufj1dgTbjhQUEF U1TvMZPrEw778qEQRrRIrk9FvroxD/VuhxCdERWXRQ9Ej9DKNDdDDwKgSx/XL9Mf0B/RG/Ryc/V2 Rn6PVvCtczlPGC+BDIOcn6LYPhX+oUgr0ab+h4DrcI9nmKkeuI0hzVxfd2ZRFH1oRNZoco0xUTmG 5Z1KkZSClUaR+/y97lVS9ir2UEW8tHCDHA3Z/QHOYVrO5rCZ3BEGw8nlq+87/GMy1QVO3WdG2GYP ynhQ1+mbLr6gdSF0rpOIEXlSXyBH+Uv0pqDwV9XiIIiYmRwW8WVUZ7QjQ9Ii6NB6VmOWS3QlLAHe ZSZ4s04vKhEmAg4mesS43QH2rgPUUAcL2EUbczjjQhCl+uIoNc06dXmnpd2ylPA6OdC5lEqrl11d xAsIoptazHcmIr+2EqHEV6IPYXEHU0c0EqI+7iNbhzTDV4jMxvewddi/3w17RaOb62wNoacMOcFj pwU+AxjGlGImrRHkk4H6ftIf+u4UW3m+RZ8gXtF3TFvcTekbexU92N1TxFevoIM3wDYhhsV9iBzb BWUbnlEzSB4CywkVRpPsKDJLgCfTYhX/rFTUF+DrfyixagPdW6bb+N3t9IH662E+0BosJd4t7sGn moXRarBWuAkukVH3IjP/UhS62X87xZgowg+6vMfChKe28YLvVI2rr5PqjCDrhgAU2I6TZd+3D5R9 RwJRqew7PpT/FJLCLBww7WzQ9iwcS6AL6QWDYEQXsApUycohOMHYcAseAcAfotEB9Jky5K6GhDDy jMqRIRwT4oIiJIAgVyACkEb2YAZ03GqhBuhBHRTjsgisNKIaZjNyNluEEcJIAbXeBay5hDGoQdSG mhCqME6YIEwUJgmTUeTnVOE0YYpwujBVmAbZghnCGcJM4Uf4m2cLZ6KayFzAZmcJZwvzhU5IGmzl fz/DX6d9HwPFyydMPW3yjFk1HUuvvmLxoiumLbp2xo+mzhL+H18C8zkKZW5kc3RyZWFtCmVuZG9i agoyMjIgMCBvYmoKMjkzOTkKZW5kb2JqCjEgMCBvYmoKPDwgL1RpdGxlIChNaWNyb3NvZnQgV29y ZCAtIGRyYWZ0LWlldGYtZG5zb3AtZG5zLXpvbmUtZGlnZXN0LTA5LWRlLmRvY3gpIC9Qcm9kdWNl cgoobWFjT1MgVmVyc2lvbiAxMC4xNS42IFwoQnVpbGQgMTlHMjAyMVwpIFF1YXJ0eiBQREZDb250 ZXh0KSAvQ3JlYXRvciAoV29yZCkKL0NyZWF0aW9uRGF0ZSAoRDoyMDIwMDkxMjE3MDIwMFowMCcw MCcpIC9Nb2REYXRlIChEOjIwMjAwOTEyMTcwMjAwWjAwJzAwJykKPj4KZW5kb2JqCnhyZWYKMCAy MjMKMDAwMDAwMDAwMCA2NTUzNSBmIAowMDAwMTcyNzM1IDAwMDAwIG4gCjAwMDAwMDQyNTEgMDAw MDAgbiAKMDAwMDEzOTkxNyAwMDAwMCBuIAowMDAwMDAwMDIyIDAwMDAwIG4gCjAwMDAwMDQyMzEg MDAwMDAgbiAKMDAwMDAwNDM1NSAwMDAwMCBuIAowMDAwMDA3MzM0IDAwMDAwIG4gCjAwMDAxNDIy NTcgMDAwMDAgbiAKMDAwMDAwNDQ5MiAwMDAwMCBuIAowMDAwMDA0NTQ1IDAwMDAwIG4gCjAwMDAw MDQ1OTggMDAwMDAgbiAKMDAwMDAwNzMxMyAwMDAwMCBuIAowMDAwMDA3NjY3IDAwMDAwIG4gCjAw MDAwMDczNzAgMDAwMDAgbiAKMDAwMDAwNzY0NyAwMDAwMCBuIAowMDAwMDA3Nzc0IDAwMDAwIG4g CjAwMDAwMDAwMDAgMDAwMDAgbiAKMDAwMDE0MDk2NCAwMDAwMCBuIAowMDAwMDEwOTIyIDAwMDAw IG4gCjAwMDAwMDc4ODQgMDAwMDAgbiAKMDAwMDAxMDkwMSAwMDAwMCBuIAowMDAwMDExMDI5IDAw MDAwIG4gCjAwMDAwMTY2NjAgMDAwMDAgbiAKMDAwMDAxMTEzOSAwMDAwMCBuIAowMDAwMDE2NjM5 IDAwMDAwIG4gCjAwMDAwMTY3NjcgMDAwMDAgbiAKMDAwMDAxNzIwNiAwMDAwMCBuIAowMDAwMDE2 OTA1IDAwMDAwIG4gCjAwMDAwMTcxODYgMDAwMDAgbiAKMDAwMDAxNzMxMyAwMDAwMCBuIAowMDAw MDIxNjQ0IDAwMDAwIG4gCjAwMDAwMTc0MjMgMDAwMDAgbiAKMDAwMDAyMTYyMyAwMDAwMCBuIAow MDAwMDIxNzUxIDAwMDAwIG4gCjAwMDAwMjIzNjEgMDAwMDAgbiAKMDAwMDAyMTg4OSAwMDAwMCBu IAowMDAwMDIyMzQxIDAwMDAwIG4gCjAwMDAwMjI0NjggMDAwMDAgbiAKMDAwMDAyNzAzNiAwMDAw MCBuIAowMDAwMDIyNTc4IDAwMDAwIG4gCjAwMDAwMjcwMTUgMDAwMDAgbiAKMDAwMDAyNzE0MyAw MDAwMCBuIAowMDAwMDI3NDkwIDAwMDAwIG4gCjAwMDAxNDAwNDEgMDAwMDAgbiAKMDAwMDAyNzI4 MSAwMDAwMCBuIAowMDAwMDI3NDcwIDAwMDAwIG4gCjAwMDAwMjc1OTggMDAwMDAgbiAKMDAwMDAz MzQ1NiAwMDAwMCBuIAowMDAwMDI3NzA4IDAwMDAwIG4gCjAwMDAwMzM0MzUgMDAwMDAgbiAKMDAw MDAzMzU2NCAwMDAwMCBuIAowMDAwMDMzOTExIDAwMDAwIG4gCjAwMDAwMzM3MDIgMDAwMDAgbiAK MDAwMDAzMzg5MSAwMDAwMCBuIAowMDAwMDM0MDE5IDAwMDAwIG4gCjAwMDAwMzg3ODcgMDAwMDAg biAKMDAwMDAzNDEyOSAwMDAwMCBuIAowMDAwMDM4NzY2IDAwMDAwIG4gCjAwMDAwMzg4OTUgMDAw MDAgbiAKMDAwMDAzOTMzMiAwMDAwMCBuIAowMDAwMDM5MDMzIDAwMDAwIG4gCjAwMDAwMzkzMTIg MDAwMDAgbiAKMDAwMDAzOTQ0MCAwMDAwMCBuIAowMDAwMDQ0OTU2IDAwMDAwIG4gCjAwMDAwMzk1 NTAgMDAwMDAgbiAKMDAwMDA0NDkzNSAwMDAwMCBuIAowMDAwMDQ1MDY0IDAwMDAwIG4gCjAwMDAw NDU0MTEgMDAwMDAgbiAKMDAwMDA0NTIwMiAwMDAwMCBuIAowMDAwMDQ1MzkxIDAwMDAwIG4gCjAw MDAwNDU1MTkgMDAwMDAgbiAKMDAwMDA0OTc0MSAwMDAwMCBuIAowMDAwMDQ1NjI5IDAwMDAwIG4g CjAwMDAwNDk3MjAgMDAwMDAgbiAKMDAwMDA0OTg0OSAwMDAwMCBuIAowMDAwMDUwMzYyIDAwMDAw IG4gCjAwMDAxNDAxNjcgMDAwMDAgbiAKMDAwMDA0OTk4NyAwMDAwMCBuIAowMDAwMDUwMzQyIDAw MDAwIG4gCjAwMDAwNTA0NzAgMDAwMDAgbiAKMDAwMDA1NDEyMyAwMDAwMCBuIAowMDAwMDUwNTgw IDAwMDAwIG4gCjAwMDAwNTQxMDIgMDAwMDAgbiAKMDAwMDA1NDIzMSAwMDAwMCBuIAowMDAwMDU4 MTI0IDAwMDAwIG4gCjAwMDAwNTQzODEgMDAwMDAgbiAKMDAwMDA1ODEwMyAwMDAwMCBuIAowMDAw MDU4MjMyIDAwMDAwIG4gCjAwMDAwNTg2NzUgMDAwMDAgbiAKMDAwMDA1ODM3MCAwMDAwMCBuIAow MDAwMDU4NjU1IDAwMDAwIG4gCjAwMDAwNTg3ODMgMDAwMDAgbiAKMDAwMDA2MjkyNCAwMDAwMCBu IAowMDAwMDU4ODkzIDAwMDAwIG4gCjAwMDAwNjI5MDMgMDAwMDAgbiAKMDAwMDA2MzAzMiAwMDAw MCBuIAowMDAwMDYzNDg3IDAwMDAwIG4gCjAwMDAwNjMxNzAgMDAwMDAgbiAKMDAwMDA2MzQ2NyAw MDAwMCBuIAowMDAwMDYzNTk2IDAwMDAwIG4gCjAwMDAwNjc0ODIgMDAwMDAgbiAKMDAwMDA2Mzcw NyAwMDAwMCBuIAowMDAwMDY3NDYwIDAwMDAwIG4gCjAwMDAwNjc1OTMgMDAwMDAgbiAKMDAwMDA3 MjY1OCAwMDAwMCBuIAowMDAwMDY3NzQ0IDAwMDAwIG4gCjAwMDAwNzI2MzYgMDAwMDAgbiAKMDAw MDA3Mjc2OSAwMDAwMCBuIAowMDAwMDczMjY4IDAwMDAwIG4gCjAwMDAxNDAyOTUgMDAwMDAgbiAK MDAwMDA3MjkwOCAwMDAwMCBuIAowMDAwMDczMjQ3IDAwMDAwIG4gCjAwMDAwNzMzODAgMDAwMDAg biAKMDAwMDA3ODY2OSAwMDAwMCBuIAowMDAwMDczNDkxIDAwMDAwIG4gCjAwMDAwNzg2NDcgMDAw MDAgbiAKMDAwMDA3ODc4MSAwMDAwMCBuIAowMDAwMDc5NTMxIDAwMDAwIG4gCjAwMDAwNzg5MjAg MDAwMDAgbiAKMDAwMDA3OTUxMCAwMDAwMCBuIAowMDAwMDc5NjQzIDAwMDAwIG4gCjAwMDAwODQw MDcgMDAwMDAgbiAKMDAwMDA3OTc1NCAwMDAwMCBuIAowMDAwMDgzOTg1IDAwMDAwIG4gCjAwMDAw ODQxMTkgMDAwMDAgbiAKMDAwMDA4NDU4NyAwMDAwMCBuIAowMDAwMDg0MjU4IDAwMDAwIG4gCjAw MDAwODQ1NjYgMDAwMDAgbiAKMDAwMDA4NDY5OSAwMDAwMCBuIAowMDAwMDg5MDk1IDAwMDAwIG4g CjAwMDAwODQ4MTAgMDAwMDAgbiAKMDAwMDA4OTA3MyAwMDAwMCBuIAowMDAwMDg5MjA3IDAwMDAw IG4gCjAwMDAwOTA0NDMgMDAwMDAgbiAKMDAwMDA4OTM0NiAwMDAwMCBuIAowMDAwMDkwNDIyIDAw MDAwIG4gCjAwMDAwOTA1NTUgMDAwMDAgbiAKMDAwMDA5MjY4MSAwMDAwMCBuIAowMDAwMDkwNzA2 IDAwMDAwIG4gCjAwMDAwOTI2NTkgMDAwMDAgbiAKMDAwMDA5Mjc5MyAwMDAwMCBuIAowMDAwMDk1 MzA0IDAwMDAwIG4gCjAwMDAxNDA0MzAgMDAwMDAgbiAKMDAwMDA5MjkwNCAwMDAwMCBuIAowMDAw MDk1MjgyIDAwMDAwIG4gCjAwMDAwOTU0MTYgMDAwMDAgbiAKMDAwMDA5Nzg4NCAwMDAwMCBuIAow MDAwMDk1NTY3IDAwMDAwIG4gCjAwMDAwOTc4NjIgMDAwMDAgbiAKMDAwMDA5Nzk5NiAwMDAwMCBu IAowMDAwMTAwNDMxIDAwMDAwIG4gCjAwMDAwOTgxMDcgMDAwMDAgbiAKMDAwMDEwMDQwOSAwMDAw MCBuIAowMDAwMTAwNTQzIDAwMDAwIG4gCjAwMDAxMDMxODMgMDAwMDAgbiAKMDAwMDEwMDY1NCAw MDAwMCBuIAowMDAwMTAzMTYxIDAwMDAwIG4gCjAwMDAxMDMyOTUgMDAwMDAgbiAKMDAwMDEwNTcw MSAwMDAwMCBuIAowMDAwMTAzNDA2IDAwMDAwIG4gCjAwMDAxMDU2NzkgMDAwMDAgbiAKMDAwMDEw NTgxMyAwMDAwMCBuIAowMDAwMTA4ODU2IDAwMDAwIG4gCjAwMDAxMDU5MjQgMDAwMDAgbiAKMDAw MDEwODgzNCAwMDAwMCBuIAowMDAwMTA4OTY4IDAwMDAwIG4gCjAwMDAxMTE5NTQgMDAwMDAgbiAK MDAwMDEwOTExOSAwMDAwMCBuIAowMDAwMTExOTMyIDAwMDAwIG4gCjAwMDAxMTIwNjYgMDAwMDAg biAKMDAwMDExNTQ1MiAwMDAwMCBuIAowMDAwMTEyMTc3IDAwMDAwIG4gCjAwMDAxMTU0MzAgMDAw MDAgbiAKMDAwMDExNTU2NCAwMDAwMCBuIAowMDAwMTE2MDA2IDAwMDAwIG4gCjAwMDAxNDA1NjUg MDAwMDAgbiAKMDAwMDExNTcwMyAwMDAwMCBuIAowMDAwMTE1OTg1IDAwMDAwIG4gCjAwMDAxMTYx MTggMDAwMDAgbiAKMDAwMDExODc4OCAwMDAwMCBuIAowMDAwMTE2MjI5IDAwMDAwIG4gCjAwMDAx MTg3NjYgMDAwMDAgbiAKMDAwMDExODkwMCAwMDAwMCBuIAowMDAwMTIxMzM1IDAwMDAwIG4gCjAw MDAxMTkwMTEgMDAwMDAgbiAKMDAwMDEyMTMxMyAwMDAwMCBuIAowMDAwMTIxNDQ3IDAwMDAwIG4g CjAwMDAxMjQ2NTkgMDAwMDAgbiAKMDAwMDEyMTU1OCAwMDAwMCBuIAowMDAwMTI0NjM3IDAwMDAw IG4gCjAwMDAxMjQ3NzEgMDAwMDAgbiAKMDAwMDEyODM3MyAwMDAwMCBuIAowMDAwMTI0ODgyIDAw MDAwIG4gCjAwMDAxMjgzNTEgMDAwMDAgbiAKMDAwMDEyODQ4NSAwMDAwMCBuIAowMDAwMTMxOTU2 IDAwMDAwIG4gCjAwMDAxMjg1OTYgMDAwMDAgbiAKMDAwMDEzMTkzNCAwMDAwMCBuIAowMDAwMTMy MDY4IDAwMDAwIG4gCjAwMDAxMzQzNTYgMDAwMDAgbiAKMDAwMDEzMjE3OSAwMDAwMCBuIAowMDAw MTM0MzM0IDAwMDAwIG4gCjAwMDAxMzQ0NjggMDAwMDAgbiAKMDAwMDEzNzc2MCAwMDAwMCBuIAow MDAwMTM0NTc5IDAwMDAwIG4gCjAwMDAxMzc3MzggMDAwMDAgbiAKMDAwMDEzNzg3MiAwMDAwMCBu IAowMDAwMTM5NzA2IDAwMDAwIG4gCjAwMDAxNDA3MDAgMDAwMDAgbiAKMDAwMDEzNzk4MyAwMDAw MCBuIAowMDAwMTM5Njg0IDAwMDAwIG4gCjAwMDAxMzk4MTggMDAwMDAgbiAKMDAwMDE0MDc3OSAw MDAwMCBuIAowMDAwMTQwOTExIDAwMDAwIG4gCjAwMDAxNDE0NTYgMDAwMDAgbiAKMDAwMDE0MTEz MyAwMDAwMCBuIAowMDAwMTQxNDM1IDAwMDAwIG4gCjAwMDAxNDE3MDAgMDAwMDAgbiAKMDAwMDE0 MjIzNiAwMDAwMCBuIAowMDAwMTQyOTc2IDAwMDAwIG4gCjAwMDAxNDMyMjAgMDAwMDAgbiAKMDAw MDE3MjcxMiAwMDAwMCBuIAp0cmFpbGVyCjw8IC9TaXplIDIyMyAvUm9vdCAyMTQgMCBSIC9JbmZv IDEgMCBSIC9JRCBbIDw0NzUzZjg0ZGIzZjQ1ZTZhZWQ2MWM1MTQ5YjRjMWJkOT4KPDQ3NTNmODRk YjNmNDVlNmFlZDYxYzUxNDliNGMxYmQ5PiBdID4+CnN0YXJ0eHJlZgoxNzI5ODcKJSVFT0YK --0000000000009d662c05af21034d-- From nobody Sat Sep 12 18:53:29 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3C45E3A08B2; Sat, 12 Sep 2020 18:53:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.838 X-Spam-Level: X-Spam-Status: No, score=-1.838 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_FREEMAIL_DOC_PDF=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SK4XgPtxIDxl; Sat, 12 Sep 2020 18:53:25 -0700 (PDT) Received: from mail-il1-x143.google.com (mail-il1-x143.google.com [IPv6:2607:f8b0:4864:20::143]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0FA463A08AF; Sat, 12 Sep 2020 18:53:25 -0700 (PDT) Received: by mail-il1-x143.google.com with SMTP id y9so4669966ilq.2; Sat, 12 Sep 2020 18:53:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=uYqqgwi9XeJvidFUfEmcxLrurD0n7RxNV+L3syRgPjU=; b=t6UFjfYwiAfFgOit/gD5ldRKP2E3RnUrZxvkmlpqLHEE47kx7DK9Qr0OySAl+qgVWu 1XV5EqXg/Cd151vZ/ggXx/w1Mq7YJiRpoLsBjvWfxIceDn4bSTbUwKvh6r7kfOwA+pny BY/pxKIuUh+y92hoDA4ewnyEjKKRpnIPcO6sk2xiQEFn3kskPJGkYFuhQPgQF+QJmq1p wtTN2367R1fP/ZMEpbUaXGRGu39mmUn+VufnTRoUUOI1ufh69P+zhO5RrzN6m9ez9K6U qZVVcLRXQJDieCugRyV9NRgMBabh6eqO1kpSuBZKr/elzAnpZ/fCLl+ospfshZqUhy8a JONA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=uYqqgwi9XeJvidFUfEmcxLrurD0n7RxNV+L3syRgPjU=; b=mWAWO/MgdSExE71vAqTER3WuzYzB/V9l1rnPZMooI0zCM6w0lZXHKPao8zisQBr7TZ mKqE0Is9FySns522CjArcQg2ZulaX8KlCltFOWCrXtcvEh3JqaYTL7naQARQxS//tGdl wMzP3WylYRDhTbN7MsmEvamY5ZbqspDAK6kuhL+1jIPZ5/uozotuv+rx/9XosMFY6qjY i8m8P5oS5ILz6AH8DJOUi7hJmAbjtI3KTcN8/5Jbye+BUc7ulNeHwFXjjmIxt+SojZhU ZZm20x1SBZExcVDFK2hvsY0cLTBlO7DFvQWHgrS9UNmORu7ci2wyWshr+Y1ILPhGOpww OnVA== X-Gm-Message-State: AOAM532aiJm0OJRfCMNxYL6biuL37jN/qoVkaQbsz3vrcsqmWECoLvxU hQua6ciR1rNVlZsT0NYpAZSWMVf5lhlTuEHWJaI1wKmqw+U= X-Google-Smtp-Source: ABdhPJwwv0blzcI1n06DgjbSbwlugPzikBu1Ta5aSvxEltZYiMTDJ+i2UhvNJ+hhSVufDOyX5gmFIWBzGpxYHj+iVgg= X-Received: by 2002:a92:a111:: with SMTP id v17mr7610552ili.83.1599962002132; Sat, 12 Sep 2020 18:53:22 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Donald Eastlake Date: Sat, 12 Sep 2020 21:53:08 -0400 Message-ID: To: "iesg@ietf.org" , draft-ietf-dnsop-dns-zone-digest.all@ietf.org Cc: secdir Content-Type: multipart/mixed; boundary="000000000000cab08505af282ed1" Archived-At: Subject: [secdir] Fwd: SECDIR review of draft-ietf-dnsop-dns-zone-digest-09 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 13 Sep 2020 01:53:27 -0000 --000000000000cab08505af282ed1 Content-Type: text/plain; charset="UTF-8" Trying again with the correct subject line. Sorry, Donald =============================== Donald E. Eastlake 3rd +1-508-333-2270 (cell) 2386 Panoramic Circle, Apopka, FL 32703 USA d3e3e3@gmail.com ---------- Forwarded message --------- From: Donald Eastlake Date: Sat, Sep 12, 2020 at 1:20 PM Subject: SECDIR review of draft-ietf-dnsop-dns-zone-review-09 To: iesg@ietf.org , Cc: secdir I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. Document editors and WG chairs should treat these comments just like any other last call comments. The summary of the review is Ready with Issues. Notwithstanding that I have a lot of comments below, I think the idea in this draft is a good one and look forward to its approval by the IESG. SECURITY ISSUES 1) The document claims that the presence of ZONEMD enables someone holding the zone data to be able to determine its "authenticity" even in the absence of DNSSEC. While it is not clear exactly what is meant by "authenticity", I think this is misleading. I think that, at best, without DNSSEC, you can test the data's "integrity". This is still useful to protect again corruption and errors. But as I understand it, "authenticity" takes a lot more machinery to test, such as the DNSSEC mechanisms. OLD (Section 1) It allows a receiver of the zone to verify the zone's authenticity, especially when used in combination with DNSSEC. NEW It allows a receiver of the zone to verify the zone's integrity and, when used in combination with DNSSEC, its authenticity. There is a similar problem with the first paragraph of Section 6.1. 2) The minimum size of the Digest Field, 1 octet, seems too small. Typical minimum size for such a field in IETF protocols seems to be 96 bits or 12 octets, so that, at least with a strong hash function, you have a reasonable resistance against brute force attacks. Also, while it is fairly obvious, you might want to mention how a receiver determines the length of the Digest Field. OLD (Section 2.2.4) The Digest field must not be empty. NEW The Digest Field MUST NOT be shorter than 12 octets. If it is, the ZONEMD RR containing that short digest cannot be used to verify a zone. The length of the digest field is determined by deducting the fixed size of the Serial, Scheme, and Hash Algorithm fields from the RDATA size in the ZONEMD RR header. 3) SHA384 / algorithm agility -- here are some thoughts/comments on SHA384 and algorithm agility: 3a) SHA384 is a strong hash algorithm and is excellent for integrity checking and the like but initially I was wondering if an algorithm with a cryptographically stronger structure would be better if one is trying to protect against active adversaries, even if the hash were shorter. For example, HMAC-SHA2-256 which takes about as much computation as SHA2-384. (Could be keyed by the "ZONEMD" concatenated with the zone name.) But on further thought, DNSSEC strengthens things a lot. ZONEMD will be covering not just the SOA serial but also the Signature Expiration and Inception fields in the DNSSEC signatures. So, while I haven't done a deep analysis, the more I think about it the more it seems like a strong straightforward hash like SHA2-384 is OK. 3b) The draft lists only SHA2-384 but never says that it MUST be implemented. Although it's fairly obvious, it seems to me the draft should explicitly say that somewhere. 3c) The draft never says how long the Digest Field should be when you use SHA384 -- presumably 48 bytes -- and what to do if the Digest Field is the wrong length -- presumably not use the ZONEMD for validation. (Presumably just add some text to 5.C. in Section 4.) 3c) SHA2-384 is just SHA2-512 with some different initialization values and with the 512 bit output truncated to 384. Thus the incremental effort of providing SHA2-512 in tiny if you have SHA2-384 (and vice versa). So, if SHA2-384 is mandatory, then you might as well make SHA2-512 mandatory also since you get it for probably <1% incremental effort. Having two mandatory algorithms with some people using one and some the other would provide some real confidence that implementations were actually looking at the Hash Algorithm Field, could handle Digest Fields of different length, etc., and the algorithm agility mechanisms might actually work. It currently looks a bit like only lip service is being paid to algorithm agility. 3d) On algorithm agility generally: There is a reasonable provision in the ZONEMD RR for a hash algorithm identifier. But, given that this is Standards Track I would have expected there to be hash algorithms specified of different types with one a MUST implement and one a SHOULD implement -- possible more but at least that. Blake or SHA3 would be example of a different algorithm type from SHA2. But I admit that SHA2-384/512 is very strong and a break in it significant enough to make much difference seems very unlikely. 4) There is no mention of local policy. If at some point there are multiple hash algorithms and/or schemes specified (which could include private use algorithms and schemes), a ZONEMD zone validator would likely need a local policy as to which algorithm/scheme digest it will pay attention to. See, for example, the first paragraph of Section 4 which assumes any good digest should be good enough to validate the zone for any verifier. 5) I'm not sure about the choice of "resilience" and "fragility" in Section 6.3 without a bit more context as, at first, they seem contradictory. See attached for one suggestion on this. It is great that examples are included but I did not check them for correctness. IANA CONSIDERATIONS A number of points: 6. For both the Scheme and Hash Algorithm registries: 6a. Value 255 should be listed as Reserved. 6b. Values 2-239 should be listed as Unassigned. 6c. Having a "RESERVED" mnemonic seems odd, I don't think I've seen it before. People usually just put a hyphen in the mnemonic column. 6d. In the rightmost "Reference Column", for things like Reserved or Private Use, the usual thing is to either just put a hyphen ("-") or to just say "[this document]". I don't think I have seen RFC 8126 given as a reference. 6e. Actually, 240-254 seems like a lot of values for Private Use. Why would you need 15 private hash algorithms within one administrative area? If you think there are going to be lots of private/proprietary hashes (national vanity crypto?) that get used moderately widely, there should be a provision for "vendor specific" hash algorithms where the "Digest Field" actually starts with a "vendor" identifier. 7. I don't think all the references to RFC 8126 are needed. These are all standard IANA terms. It would seem adequate to rename the "Requirements Language" section to "Terminology" and add one sentence saying "The terms Private Use, Reserved, Unassigned, and Specification Required are to be interpreted as defined in [RFC8126]." Then all other references to 8126 can be deleted. (You might need some DNS related entries in a Terminology section anyway. I have significant DNS background so I didn't feel any need for acronyms to be explained or the like but that might not be true of a general reader.) GENERAL 8. Sub-optimal ordering/grouping 8a. The sentence immediately before the Section 1.1 header, which give the implementation requirement for ZONEMD, seems a little confusing right after the preceding paragraph on DNSSEC. I think the sentence should be moved up before the DNSSEC paragraph. 8b. In Section 1.1 on Motivation, I think only the first paragraph is reasonably described by the section title. All of the rest of 1.1 is "1.2 Alternative Approaches" or something like that. 9. Chronological terminology I don't like all of the occurrences of "currently" or "at this time" in the document. How likely are these phrases to be true 20 years after this is published as an RFC? In many cases, this can be replaced by using "herein" or the like except in Section 7 (Performance Considerations) where some specific year or part of a year could be given. 10. There are a number of instances of "must", "must not", or "recommended" that I think should be in all capital letters. See attached markup. 11. Verbosity The document has a generally conversational style with some empty filler words that don't add anything scattered here and there. While this is all a matter of taste, I suggest the following: 11a. All occurrences of "certainly" and "Note that" should be eliminated. 11b Instead of saying "x can be used to y" or "x is designed to do y" just say "x does y" or the like. 11b. There are three statements in three different parts of the draft (Sections 2., 3.1, and 4.) to the effect that "When multiple ZONEMD RRs are present, each must specify a unique Scheme and Hash Algorithm tuple." I'm not sure what the best thing to do about this is but as long as the validation section makes it clear that such redundant occurrences mean none of them validate the zone, you are OK. 11c. See other instances of what I think is unnecessary wordiness and suggested changes in the attached. 12. Having an Implementation Status section (Section 10) is good while a draft is going through the approval process, but I think it is, as indicated in RFC 7942, inappropriate in a resulting standards track RFC. Furthermore, all of the disclaimer text given in RFC 7942 is missing here. So, I believe similar disclaimer text should be added and the RFC Editor should be requested to drop this section before publication. TYPOS 13. The only actual typo kind of errors I found were "the the" -> "the" in Section 7.1 and "can not" -> "cannot" in Section 4. ATTACHMENT Taking into account the above and to make other editorial suggestions, I have done an editing pass over the draft the results of which are attached. I hope you find it helpful. Thanks, Donald =============================== Donald E. Eastlake 3rd +1-508-333-2270 (cell) 2386 Panoramic Circle, Apopka, FL 32703 USA d3e3e3@gmail.com --000000000000cab08505af282ed1 Content-Type: application/pdf; name="draft-ietf-dnsop-dns-zone-digest-09-de.pdf" Content-Disposition: attachment; filename="draft-ietf-dnsop-dns-zone-digest-09-de.pdf" Content-Transfer-Encoding: base64 Content-ID: X-Attachment-Id: f_kezxoxh50 JVBERi0xLjMKJcTl8uXrp/Og0MTGCjQgMCBvYmoKPDwgL0xlbmd0aCA1IDAgUiAvRmlsdGVyIC9G bGF0ZURlY29kZSA+PgpzdHJlYW0KeAHNXFuTm0YWfudX9NvaVTMamjt58y1Z15aziT27qUr5hZGY EWtJKALZnv31+x2gLzRYgISqNnmwfCzO6T73G/qL/c7+YndvCs6WBbOr/4slQPbC8eq/04do4cZ2 wPzYXYRB7LHllr2+Z55TfQN/OGG8iOM4Yl4UW/dbdnd/zxln94/sBXvJ7v/D3t1XhM7F6jlXwOrG /jWweuGlWG/thW17IbtfWj0sdm2btVn8flemh11asne7p2yXpods98Tuk+IL+zk/LFN2+r+3C/ZH WhTppnhpnS0pO4JoY5dph7POlL+6fZ+COb5rsFfc/nw983B423Vc1kV+OxWrOr0mO9/2QSDwiIAh u7eH5LE8LaCef/1twV4nh4f0MIPItDNdSWR20COy3SpdsaJMymPxE/tUJrtVclgV7P6QLL/03LgF +jdUvMiednPcHm6tsabr3J77pkd8932fHVLc+kNyWK4Zv2GO7XDtgqN1zqr9sNI5zWI4h9Jx12M4 gLihcMkaLfPjVJb2045A2/Eiom2I/gN5m2wH1X0afc1uuBHupot/crhRF9AMVsYzzuHF2vHM5Njk v8/D4tiFxw3AYs4NFr/aJv/Nd3Nwt4N6Zu7CI87K3Hk4G/lQXj9ggWcw9o8F+8dxmxyyGXjbQT4z aznSh/9vvTXTpF/yfLJLaIzXul9qns+xyTQin3V4sElHS65xrVr+JX1Oh7NTkSqXo59apNC3rpnf TfYw+gMz2UTj0HG4rlH8HZE7+YJk5PxMXzC3i39mu7gNO+LTuXXO53k4HBOH4RBxQIPD//r05u79 p/dzcLeDe27ucsefy+/Mw9aQ2Oo67BYnM/j66vh0LErmRFUCZk/hr9WufqX29lx/NNqux5EegYeO ydU50Dq8kxlORTvgypxAZtcnc89ZZB3B7dsRitBbkDVk/QEVbvKUsreTY3dviOEkcV5TMiTzlEKn HvMDe/vrJ/ZnvkuLqTxVMYf7FMnsXjrjLfdUlSAT3VsX1xnKGGYRU0hiCnEnUDSktKJieDS7OmUB JW52jJKnB/U8hXxEnYI4rCkY7MrS8nH02TvGHpNCcTeszm5gHn/2U6LmNlwh51EfhdWuyPfnHx4H J3PoRT3T4Tlky2EZPXqKw19wdIeO7vdKdKajO3R0FOE9R0eddkFKyl3CHPp9mGc6u0tqGfaefZWR q7uA89K5dV3PTKf3wR/H7rUpO77g5AElFbyX75PdsvL2mi8OOl2HqacdCMyeHRlO5tVDUaL3pgvU QvCZMASQbdTbLnY2NXT0scXzZXJ5nV7drW93Bg1svESbgKRYr3WUyFRtDv8FEgbn79dZwVb58rhN dyVbpcXykD2kBUvY/pCX+TLfMHRH2S79VuUUH9MiP1Jb/2O6zA8rVq6T8gLuimJZP9i1uOuZ3UCU W0qx7UXE48CGt6mSntjhAX2qYBEbnkqdCn6K/Z6Z8y6THXtI2bFAP7rMq/NY1bhq4jRMiV2r6mWy 43fuDuF+zVYpxLw8PO/L/OmQ7NfZkm2bVLX2ryz/mta5pBYrLBraTTNO2RS5xUmUAlrGiO7uF0wC nzAJHJIFJoE+jQS9wFsEHkaCW4tHJmzDWjBOo8MN0x9tQGv2qIaPOINj4QzjrtjLduVK/dgsp1s6 N5VGr0XHZkthlZTJgrH7dcr+/Oev7z68ha02RivV3ZpKWtMqTkbLHfImFW1Lm7c2XmGZ776mzwW8 Q8oaTaJTsWxXgTRlGh7MdpJVRxa8Nf3z5r2n7FUJMPB6msSSi0NKcoqG9AldElmJeegjRPjHOt3B QoldbH982GTFGuaY7ZabIxw1/LIQ8KFyxjcMf2b7DI78omkq5S0Rsi7tZFfyyUFsjg9mtw+QUA6n 2gkglwu3lj0+S2VkUNiS2FbVzslyeUQy8lwFvmW+3W9S/CMcY2VV2QW85VRoOWEA3qpjXYm3oRsZ Be7svAUJg7dNWIFuFgV4uEOiQBkCKWaafUWMq3S58gXbpFyuocVCsVeMwDeXJBOUGEccTUx1rmsx NzL7eXouMc65qiTTpaYEpR63YRfvaG8zKgEEAUNkh/QJHfQN1Jvlj2ydf1NWUclpnRTIUOCIkKDv im1WlhAjpYRCpotZRKbOda7IFD+V/45cs8ujpXzjxKRCvBZ+NQpRz8BktMxGRQj0fQyZNXEdmfsu r5J2rCPUCeQh3W8SWB36f5/evaljyCGFCGtAldSny8vigzAz7VznykwxV0swFHNj5+r5E0gYzM12 qwy58THZsI8fP6UICp9fUDu1soZvWYl0EXtODBnz7rjBPLZ8/vzyRkRiKpqIvyy5xCooSlArWTvc tTgcmnPm2aMEdSzbvV0KAn9D1UkpIVQzYd/WuT4dlfk/9QBsd3It1vGEmnLRpIvb1D7BuYwAeYOD pMhZD5QPFKiIV+O9xSlLRnOyaWR1efGANONYrnPoUVIiRLJdsk3P1x0uJ3kaqa7uiErLcfy6knID p6mkUFSZsI2EWfS9pmxqPauVUlRBURU34F5PMUx5AE7LSW3tmaKgp4jIDLyHRpEekCIWVUZ9PBRC LkzCMWJJds8sr7Ql2e832RLig9ZcIDqxt3TbHEgvrMYr4inlR0EMi/JpIAm+GtpPYyO6kwpeQks8 jzda4gUL16F6m3Zt2zALWqJg/iKiuhww9ayEUcEdCiXz+cKl0hwom69aroDpj/vwClGFUj0qQYRx Zr0LtEZFXTfUPkEtGlgTezQqQVHNSm5XdHRRL5QABkyoEbXCK1c9Id+g0+5SeIVgpaP9UdOrYbXl ut4isispcadptEgYGi06rFKQjRIwHm1AkJLi2Uhxde6o+QbOzUmrprzjeKcSkN7sDhR6BpOKkQNE xrmfLo1XBSv2qOUfMxWC0HYbFNfAcdquob23FCBE2eilwTV0z4MKrqQ+cZkhNo3dszl1eTVw7KGG AIwlTUXHrpRmuAXbvh4W2LWwr4aERNDwfDJ7wxU1skNdyAFun7o/96iHFmE41HP/Vk5PXhndYW2E IYzX8YQhcgejkso4yTiqzqgrYJvq9YgGxqsXKOCptWdrGDw1+VAeCk/PQ2oCkVvWvtvA1POWy4Pa McAJqGcljHCSN2/oS5ye+q7AaWkw+bz2rITN7+sdbhZYuvpdIGZV2PMeGts9jbyQOGyo7USKd1br X7l/WjeieIJ1I25uymmKPXChjhlpnlFOFHrug1roKb1R9jNApjEPdXq13tCDXDu+0H/pDX9UJURh o3e2vYjrFIOHJoz0VoMhhfFgH/qjBGrMQ2YedoCGTWUd6psNSH8YOQ6yJeBTD9agBp9MIEYGw1Mu RYuLjm/WtPPnzF0aq2eULhghUXWH4u6I1l9e9ZIoajQdo3oOUaB39NcRryGsqn5rM8s/+/0fLrbR ac2Obq5nU5riDChkR++18KEx17W7rb8LiGjGpQoS0DCKHjiJJboNVGKgqaOMTBqByuDIHEaPLU9d WrmT7p1puqROMYmz7byDih47qkqS7q3/nn9LUYeNJnTKPrSUo0vohhR1KhnluuTrLrfYRTJFp/FJ 2vsAw07dQ8tkurSaxiDNg5rbjJ7WqkxY03vuUbskQiuKLmakTRj/K5b1KCKp5GhFPHllqpd4jJ5N D3vFysKqni7q2wyqFhcxw7GbXMQJo7qPgfxG5EwSpuVMDoJDUMcE7dkaJnOmJn44GEE7dVRQ3xUw 4GxoW07kLEKqorXYo8GqnClocjsNp8+b3E7CNpYGkzhd9ayEEU6pfPMGGxe2227QYEI2sUZQlqRl TF3EmrpdYEC6L4/NIr8VKKVO/yjDGDjFKeeqOfvYrNSh0nVDfzQf25TaHtanys6LMHTkbue+6XeM NovsQW+/DtyqsVQlM7X63ENAk5lUwHEEeh2S2rLtoVVQvoFalZaVmrWDAjNG7LSwbfJMezbKI0jZ qsA5yV+B47SH33tIrvb+uxxfIaJt8r0q7GkFghRscNmtn1ZM43qs6Avp6slPssJ7rlOVSAlWbVoQ sw3vrwl2QJ5t5TReLKcXRR3skYjj69scWBdRhxcunHvC3eLiAdytBRfOhbtsYHCtLRhv3K3+bAMj 1+g1JYBF27KEE2Wv34OzBWueF8/i9WqEypoOcFpi0cgJbNFZV0cXMEQAeSTAjB0lepRAKCCqU6Im rwppDaWirlC2YA1Kr3nWEjib4KVuJJ7HzcVQQNLZtGE1TgQfwXV1dDrnyPjSVou2z9J8tOeZb3Eg VWOPx/J40FNQ5VzOtyXa2LWJ3i2vqeq2VIqManhlqbmZMiRa2bV9TBorxD82JKHjg85J9GXR9hHd cy4a7RJGyiXSHS8yu+d4Q1qASF0l/86SXrvZpksvNpttrQh7gedQAdTDqLSdgRTH/T4/lKxuSbBW ZSra66MTYyVG+eINb5E01xjHXUqh1djle+ZURvOA4/CqKKGVljqJyFzawe8f4HcQaPujWgb+kG7H q3onGQjJhsIQWzjc71Aaf5kOXu0GgXuixBpg0qkyQycRmUntFLU9RUSpbdChUbHf+EWRM9RUa+W3 aFR6Ov7lhrZ/blu4ag2AguHP6h8VQR1WHB+adSEE8sfjZkNjdXQ6t9VeWLVJcVnVTR1Dh7x165oT f/jnlLA0jUDBZjiZ+TWiS6Papytorkzm+frNbyyMqlba6zcqlR1Q+VNyVLu8eMvTzPBALBbe8oyg x+VbUz24x3uCTjDVhXL9V4oj5OXt4DK/3Ls0DCcwukRQQUXLZUz01ot5nIBWWIJEnxfAbg+StG/5 4Qv9KJR4y6TSZUrixC2Z9tNRlPDXY5Bxaq1urJZruXbj7u7LOLwqjGrtME31orATqfW+7FQiWqxW EQI0DN3Tflfr84v37+5//vwS7eBfsXNWV771PsrTIT/u65o32aAoXmV4uyp7OJazLBZhbEnH0nPj ydY8xN2YX315mYOGwd2uomI7TShpU4meEY9V2tgiOWM41vrPXc5V8bjeXU8Z3iEoKZRgw/1AL3wZ txt2893ETL7D1cPR8Y6mBy8yyeo9hB684xVuZHiPg05OOcGcTxFR5tylUYuGIVdC12pdlvvip7s7 WouklyHxmyYLeq17kc8T6qm1ihk90iUcxPDWh6e76vX34q5RjLvxgb8jOa4W2bpXniw55eCV90Ur 3Sz5JuMdcEGOHZhLAbMH/h4aPfY4qp+huKQCfwf9/IGfSBiq1Og0Bf5KpbSw/zXZZPXIN0FD9nu2 PW7JFxXZd7bFCzjrC5YnVauyufU1wxO2K66+l040jPBEL100fezjHl4iXdF+arXvj0/YE8ofCuxR 0/sZ2CquUwGVc8HDYLtzqitReuXYwh83R7uIwxpe+UMzeKndzCI1qxa9MRcdL5/e/QzthVe3aj0M OEIdhL3RGmR5vuxyyQcViLqVAuwGkYlPghQ+WnpsthnlgwrUwoedSLveyhLnw6981iANH3ZTmgUT iU+BdHxOFIktFoFPghQ+Ma9Ee1fg00AtfEFg3he/XFODNHxYMms2eSU+BSJ8v/8PLfD6tQplbmRz dHJlYW0KZW5kb2JqCjUgMCBvYmoKNDEzNQplbmRvYmoKMiAwIG9iago8PCAvVHlwZSAvUGFnZSAv UGFyZW50IDMgMCBSIC9SZXNvdXJjZXMgNiAwIFIgL0NvbnRlbnRzIDQgMCBSIC9NZWRpYUJveCBb MCAwIDYxMiA3OTJdCj4+CmVuZG9iago2IDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBd IC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4gL0V4dEdTdGF0ZSA8PCAvR3MxCjkgMCBSIC9H czIgMTAgMCBSID4+IC9Gb250IDw8IC9UVDEgOCAwIFIgPj4gPj4KZW5kb2JqCjkgMCBvYmoKPDwg L1R5cGUgL0V4dEdTdGF0ZSAvQUFQTDpBQSBmYWxzZSA+PgplbmRvYmoKMTAgMCBvYmoKPDwgL1R5 cGUgL0V4dEdTdGF0ZSAvQUFQTDpBQSB0cnVlID4+CmVuZG9iagoxMSAwIG9iago8PCAvTGVuZ3Ro IDEyIDAgUiAvTiAzIC9BbHRlcm5hdGUgL0RldmljZVJHQiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+ PgpzdHJlYW0KeAGdlndUU9kWh8+9N73QEiIgJfQaegkg0jtIFQRRiUmAUAKGhCZ2RAVGFBEpVmRU wAFHhyJjRRQLg4Ji1wnyEFDGwVFEReXdjGsJ7601896a/cdZ39nnt9fZZ+9917oAUPyCBMJ0WAGA NKFYFO7rwVwSE8vE9wIYEAEOWAHA4WZmBEf4RALU/L09mZmoSMaz9u4ugGS72yy/UCZz1v9/kSI3 QyQGAApF1TY8fiYX5QKUU7PFGTL/BMr0lSkyhjEyFqEJoqwi48SvbPan5iu7yZiXJuShGlnOGbw0 noy7UN6aJeGjjAShXJgl4GejfAdlvVRJmgDl9yjT0/icTAAwFJlfzOcmoWyJMkUUGe6J8gIACJTE ObxyDov5OWieAHimZ+SKBIlJYqYR15hp5ejIZvrxs1P5YjErlMNN4Yh4TM/0tAyOMBeAr2+WRQEl WW2ZaJHtrRzt7VnW5mj5v9nfHn5T/T3IevtV8Sbsz55BjJ5Z32zsrC+9FgD2JFqbHbO+lVUAtG0G QOXhrE/vIADyBQC03pzzHoZsXpLE4gwnC4vs7GxzAZ9rLivoN/ufgm/Kv4Y595nL7vtWO6YXP4Ej SRUzZUXlpqemS0TMzAwOl89k/fcQ/+PAOWnNycMsnJ/AF/GF6FVR6JQJhIlou4U8gViQLmQKhH/V 4X8YNicHGX6daxRodV8AfYU5ULhJB8hvPQBDIwMkbj96An3rWxAxCsi+vGitka9zjzJ6/uf6Hwtc im7hTEEiU+b2DI9kciWiLBmj34RswQISkAd0oAo0gS4wAixgDRyAM3AD3iAAhIBIEAOWAy5IAmlA BLJBPtgACkEx2AF2g2pwANSBetAEToI2cAZcBFfADXALDIBHQAqGwUswAd6BaQiC8BAVokGqkBak D5lC1hAbWgh5Q0FQOBQDxUOJkBCSQPnQJqgYKoOqoUNQPfQjdBq6CF2D+qAH0CA0Bv0BfYQRmALT YQ3YALaA2bA7HAhHwsvgRHgVnAcXwNvhSrgWPg63whfhG/AALIVfwpMIQMgIA9FGWAgb8URCkFgk AREha5EipAKpRZqQDqQbuY1IkXHkAwaHoWGYGBbGGeOHWYzhYlZh1mJKMNWYY5hWTBfmNmYQM4H5 gqVi1bGmWCesP3YJNhGbjS3EVmCPYFuwl7ED2GHsOxwOx8AZ4hxwfrgYXDJuNa4Etw/XjLuA68MN 4SbxeLwq3hTvgg/Bc/BifCG+Cn8cfx7fjx/GvyeQCVoEa4IPIZYgJGwkVBAaCOcI/YQRwjRRgahP dCKGEHnEXGIpsY7YQbxJHCZOkxRJhiQXUiQpmbSBVElqIl0mPSa9IZPJOmRHchhZQF5PriSfIF8l D5I/UJQoJhRPShxFQtlOOUq5QHlAeUOlUg2obtRYqpi6nVpPvUR9Sn0vR5Mzl/OX48mtk6uRa5Xr l3slT5TXl3eXXy6fJ18hf0r+pvy4AlHBQMFTgaOwVqFG4bTCPYVJRZqilWKIYppiiWKD4jXFUSW8 koGStxJPqUDpsNIlpSEaQtOledK4tE20Otpl2jAdRzek+9OT6cX0H+i99AllJWVb5SjlHOUa5bPK UgbCMGD4M1IZpYyTjLuMj/M05rnP48/bNq9pXv+8KZX5Km4qfJUilWaVAZWPqkxVb9UU1Z2qbapP 1DBqJmphatlq+9Uuq43Pp893ns+dXzT/5PyH6rC6iXq4+mr1w+o96pMamhq+GhkaVRqXNMY1GZpu msma5ZrnNMe0aFoLtQRa5VrntV4wlZnuzFRmJbOLOaGtru2nLdE+pN2rPa1jqLNYZ6NOs84TXZIu WzdBt1y3U3dCT0svWC9fr1HvoT5Rn62fpL9Hv1t/ysDQINpgi0GbwaihiqG/YZ5ho+FjI6qRq9Eq o1qjO8Y4Y7ZxivE+41smsImdSZJJjclNU9jU3lRgus+0zwxr5mgmNKs1u8eisNxZWaxG1qA5wzzI fKN5m/krCz2LWIudFt0WXyztLFMt6ywfWSlZBVhttOqw+sPaxJprXWN9x4Zq42Ozzqbd5rWtqS3f dr/tfTuaXbDdFrtOu8/2DvYi+yb7MQc9h3iHvQ732HR2KLuEfdUR6+jhuM7xjOMHJ3snsdNJp9+d Wc4pzg3OowsMF/AX1C0YctFx4bgccpEuZC6MX3hwodRV25XjWuv6zE3Xjed2xG3E3dg92f24+ysP Sw+RR4vHlKeT5xrPC16Il69XkVevt5L3Yu9q76c+Oj6JPo0+E752vqt9L/hh/QL9dvrd89fw5/rX +08EOASsCegKpARGBFYHPgsyCRIFdQTDwQHBu4IfL9JfJFzUFgJC/EN2hTwJNQxdFfpzGC4sNKwm 7Hm4VXh+eHcELWJFREPEu0iPyNLIR4uNFksWd0bJR8VF1UdNRXtFl0VLl1gsWbPkRoxajCCmPRYf GxV7JHZyqffS3UuH4+ziCuPuLjNclrPs2nK15anLz66QX8FZcSoeGx8d3xD/iRPCqeVMrvRfuXfl BNeTu4f7kufGK+eN8V34ZfyRBJeEsoTRRJfEXYljSa5JFUnjAk9BteB1sl/ygeSplJCUoykzqdGp zWmEtPi000IlYYqwK10zPSe9L8M0ozBDuspp1e5VE6JA0ZFMKHNZZruYjv5M9UiMJJslg1kLs2qy 3mdHZZ/KUcwR5vTkmuRuyx3J88n7fjVmNXd1Z752/ob8wTXuaw6thdauXNu5Tnddwbrh9b7rj20g bUjZ8MtGy41lG99uit7UUaBRsL5gaLPv5sZCuUJR4b0tzlsObMVsFWzt3WazrWrblyJe0fViy+KK 4k8l3JLr31l9V/ndzPaE7b2l9qX7d+B2CHfc3em681iZYlle2dCu4F2t5czyovK3u1fsvlZhW3Fg D2mPZI+0MqiyvUqvakfVp+qk6oEaj5rmvep7t+2d2sfb17/fbX/TAY0DxQc+HhQcvH/I91BrrUFt xWHc4azDz+ui6rq/Z39ff0TtSPGRz0eFR6XHwo911TvU1zeoN5Q2wo2SxrHjccdv/eD1Q3sTq+lQ M6O5+AQ4ITnx4sf4H++eDDzZeYp9qukn/Z/2ttBailqh1tzWibakNml7THvf6YDTnR3OHS0/m/98 9Iz2mZqzymdLz5HOFZybOZ93fvJCxoXxi4kXhzpXdD66tOTSna6wrt7LgZevXvG5cqnbvfv8VZer Z645XTt9nX297Yb9jdYeu56WX+x+aem172296XCz/ZbjrY6+BX3n+l37L972un3ljv+dGwOLBvru Lr57/17cPel93v3RB6kPXj/Mejj9aP1j7OOiJwpPKp6qP6391fjXZqm99Oyg12DPs4hnj4a4Qy// lfmvT8MFz6nPK0a0RupHrUfPjPmM3Xqx9MXwy4yX0+OFvyn+tveV0auffnf7vWdiycTwa9HrmT9K 3qi+OfrW9m3nZOjk03dp76anit6rvj/2gf2h+2P0x5Hp7E/4T5WfjT93fAn88ngmbWbm3/eE8/sK ZW5kc3RyZWFtCmVuZG9iagoxMiAwIG9iagoyNjEyCmVuZG9iago3IDAgb2JqClsgL0lDQ0Jhc2Vk IDExIDAgUiBdCmVuZG9iagoxNCAwIG9iago8PCAvTGVuZ3RoIDE1IDAgUiAvRmlsdGVyIC9GbGF0 ZURlY29kZSA+PgpzdHJlYW0KeAGtUcsKwjAQvPcrxpuCpnnZZK+KR0Eh4EE8lBBftKDGg59vrZUq eKpuDrvZXSaTmTOWOCOdRgEfwesTfdXiTOrn/VFYpohnGJNiJiMNX2LioGW9USVpiBGRhbaUuBKp cwICbos+BnBHzFz9UFdULX9FHXHGuTZwPvlCW9EYn7RXIcZQxCHCFXnB0MbsdjpcQsQ8v/g9xBCS S9GOm2q9yHcBYjNIOv+e20ouUngjl/xPU6VNo6lqnOp1d8q+/G9Rv/i/vAPdpYO0CmVuZHN0cmVh bQplbmRvYmoKMTUgMCBvYmoKMjAxCmVuZG9iagoxMyAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFy ZW50IDMgMCBSIC9SZXNvdXJjZXMgMTYgMCBSIC9Db250ZW50cyAxNCAwIFIgL01lZGlhQm94Clsw IDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjE2IDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBd IC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4gL0ZvbnQgPDwgL1RUMSA4IDAgUgovVFQzIDE4 IDAgUiA+PiA+PgplbmRvYmoKMjAgMCBvYmoKPDwgL0xlbmd0aCAyMSAwIFIgL0ZpbHRlciAvRmxh dGVEZWNvZGUgPj4Kc3RyZWFtCngBvVxdc5tKEn3Xr5i9L5tURQrDl2DfHNvZTVU+fG1t3aq72QeC RjL3yqAAcuL76/c0SAwMYxkkWKcq8UeKnjndffr09ODv7Ff2nb29zDgLM2YUf7IQ3zJmpl1+TZ94 M8s3XOb41mzu+jYLH9i7BZsaM8Ow52wRMtss/jP+Mef+zPd9j9meP1k8sLeLBWecLVbs1Yc4F2ks 8tds8Qe7XhSmu9iRD7c9mLRMS/Pwad+nytVPpAHHcGDAtckAa67+Kg06m5gcAcihPdieqzGxylnz 4+rzHfs9iQW7itYiU3/K2MVuvcO3TcM0Xk9OBdU0sCLTL0A97HlSeox13vE+JCSSMg5sU4mDIZ5q +c65T9UGQLVsiwK7Eb5wTWc4jgWA5SDGuMnaFvLoQcwY+5CzKGNRHGy3abJNoyAXLE/YLhOsSqGT vc1thDj3rLr5vbfPSKEaAXDbMmBgTgYUFyGFVnnGgoylYiVSEYeiL6IywLiPjZhI1TaOw/hJhoJh jB0KLQsPcDo8v2FJSr4PI4qBe/HAEvyNb90HMeH4y48k/ROhwhAp61Rk2eyX04mAe4So7TFLLmdA IjAdS4mH7n5qVZwaZ1d+MlGixk3ZtoXFPVK1ysqysE2opvYrbC4VBdf2QeXNPUxeDZOVcypsbvF8 xQlFUrIf0WbDxM9tlAqWxOxTkIb3jL+h0sJnZyQpVTuT89a+2Kvuzt+TqUz9yuPcUat076fKKlDj MGkAS2+G1GWyfUqj9X0uLU26eVtryQFZGqBkxgtLk5pc+pzkUQ+CbFXgKqbwaMXncu29I7WCxrXP fagERJfNfOz62zIgXfv1Vfj1dSGr2IfrxXu2SElmBfGSOJhtRZolMSr0UsR5tIrEkqgYPzmDen3E gel6TC7qVOaVqOoCemoZqtt6yJpjNHyQNbCgpMwyCXcPgIoFu/w+STNInAuwTZFFJAUykT6K5ewM 9CySHHPOarZPhU/DMtO5KmR65490ii7Up9x0FMyGFpsaE0XpqnyDMpbtvv0hwpz0xrvLGzb3qoiX SfD3jH0U62BzhrM8Kgkuq6/oVGdJWLWxzuet1mPoYIcJxXM3afIYZRERxK3YBHkUrwnRAsKrfSZk Z8BnAj7uWsBPmh4JP5OrLXyfsOxEFjCh4Pf11X2eb7N/vH2bE+sKMYtEvpol6frtJtorkc4KSxsg 3EAHxikE2xsMRZx1b0paNZdDQ8+4rX30GUKuRhrcpP7NKdauIBfFqwRlC92AWK0okSHkqF4tqYFM Vn2xk0zIfQBmItwIMGl0Qoc6Z1ChNmdN1x27QMGE3ERxMrXdfdtEIXIViCUrgAY2PDAjqtXNRgRo vlPxGIkfBCm+OPz4nFT2CFaHgkWuaKRUtnir+RqaCmFCgTUM0OfvNpunN3uB9MSWIgvT6JtgT8ku PUgAElaQAXkaheSCDN1Ifk/f2SKKT6fK6mBrWlvaWPi6LY09OL6u2ougrKihepksBbtMHrY4NYxx 1iJ+5mkQ5pCoqzR5aP539gB+PQdeCl+ck04tubKR4LUNb2xWgAklfKM43OyW3atBq0+tmrtp++Hd efPYWaIDFxg21Zu2hbvoYbsp25N3d1fsI5pJ1DaWIyQoHQ+ZuKSCcYdEI/KzZ0WlOPl00TToCMmD Eq+tZ6yYcFpHwEOnnO2oupzqadkNFjKY1dQesRgIj47iHtEaLgsWS3Y5+xGkaRDnT0D99Gzjhw5x WlvUSMg6xui6GSaUbGvEI8Gsj9+z2kRkC59DO9WsnwqhVEfVicjUsVt6ufPR2TG1XLPgq6cii+Db hnIWpI/xGii/s8UWXR3OCKdOy0pvttLB49q24vPej9XqeQmP66slsk/Dcoxoq9ONtglOI5s4T5Pl riRRNuvxpy8jaBGoZiFTLE8plLQYxqzOYdHqaaSMaj+8uwO7xffcUosw1t6D1Y+5kAZfGJSiNrWt 8Bl58RNOXB/LLqCHB0uA7b6OrGXIYQBbX9ipvKSND5khc09TNHsA3HTjpDH6rwHsqXWTz0wAfCWy aB2zL4848aNWqnuiMOYOArBc2EgAe5am0RocYFhRqJTPLAD8bwi8S/SqWQ9oSycMBHBtYWMB7GlO sHuRxNEYJkFtYjw+xTGlBmKiidskyctrGQRdjVgnXYZ+2gTlpJtxeHQwW58DdU0S8mDXmzWt2i9J vr3v+haPzzWP0a/kIN9URUxB8o0kOR1KyOO9B0s7dSgpSYiHCtW+xBjnDXU+SbwM0kjgC5LwF/FT GGDa04Z9oBSpbX+kFPHnrdlciXDn+OiWIrCjSRHioVuc3eAgR7CbBAdrT0W2vMxJjM2HIPnaskYC mGMqrsisdggfT5VuCJMhDcQ2IL6E2E+DTfQXOs3yjliQBwhnVNZQaKIX8Xw6uLL73K+onlXd+aG5 6ebFQXnIrEEX+0VsdGW3vRmdwtI8+4zl187lJb1xumfRvDTQNziO8ajkN40hIjgHYP1TxALBwW52 6TYhTYATQXAcxtbs8l6EfzJtgAyUf/t1DR8iNYw514wJGhXkjPSrGgXcnFBHBXxGyXcrvu9wVYam 2hiIBvF6F6yfSToF6aEwLlc2LsauRsr2TUIpd2rJUnXT2IUqZKk+L3D88/uXz9efrqiSYFIARrtF oU6X+sBt1urBIC7WNirEJteK2RNBfq4d4zCjMJJZNLyfk7izqZZkdOnqkoM7K5jkt57ffdh5jOtc 0nIuDuZ1JoKt+CmjJKSNTHrcKpeBWZtDcoNukpiYdNKelBKP8HtZw1Cl8k4HVepwDajdK9UxUGss ajpaJd53+Voo5WkAbreoZsxChh9S/OpiccF+o6uH75MUN19fTnLC+IwhBd1AwYV3uoJCKxs1xS1D e+IyVK2quh0OQ60kL9Oc6BTCkK4Tv4/EphOJlnE8BMblusbF2NEMLEh0dY7kpjJViLSGsaOOLSiS DyXrLsQNbQRxV4z7hrA2z2q62WrBQF70+4Kg1c3tZ58KLmR/TQrU2Mjy/0+6uW2IfEh9K2XKv4Ls HhcU10mKWwgPXbxJGA+SKQUAo2YKZsVKVaM0wUffINnH4rOZQkPpZhNEGJN2Joz37zN1zpQyjofA uFzXuBj7Gt08FMKyN7FRwVSEKYb3VfUG92fQnpTjjG51dag4Llc2KsaOrT2AGSaKJcYw08KYYniP 8fXPAHcsRKlX9raHupvI21tstjnPfcW40RmGlqiv6c/23ruTREf96XiacV/fxWurouww2zYoSS6D Tbg73M6VhKQ068cgHoKMyrWNmiiupZWfnUE+KoxkosCMkihW0WFeLHE6WXbyN5sgFPfJBufuLwt8 uAhhPATG5crGxdjTys/BMfZU8VlOM75s6e5WgHuWuDOD8WqOeC5OhF+K5r74ajON+9RNzXEFjbsa HE4EQRGJ1JabmN0WNpRAG4jusHjlwYPT3dzUCtzOEB1j1Vq73TZjFeK2bE/21jqXKdkNVPeD8OZB bSPFNfDu5z1NQmnOAOZ0pDQv321Qr1Ld4TIwbjOGNLwL8aYrvVfxQoDjpbrTd1urhO3tdg+NY9ut 9T7z9jtG4+hyGFLCnIKDxtrFKcGHTzcfr9m+kX2u/NW/TxgPQdPlukalac98Ziw6kDavfnnElMOU FmXC+a6B8e3t4dCrjmrz86EwLlc1LsZzrS4frMOsY4wX/pr9TxnJdBrTwLji144v6krG43QzC681 wKGKsclAL75wvIwEC3ZpQmnNERtfUsglorpmRMivJMe9/PtUjql9dYN93uxpP/fwS2Cm3MellqaX unPn0ee6quAc5Lm4H6h21b2fq5VJkuvxir86jfkN9UxscAFF4Gr+BvFbfVwXr+RnzRfyq58ePvnP DY0fzf8OwcT75Z3FEjKDatvmxuE1Wmv/C4H+VmVm79fQvSrCMKc5PPfwi4ZqHvv1f7w4hqEKZW5k c3RyZWFtCmVuZG9iagoyMSAwIG9iagoyOTQxCmVuZG9iagoxOSAwIG9iago8PCAvVHlwZSAvUGFn ZSAvUGFyZW50IDMgMCBSIC9SZXNvdXJjZXMgMjIgMCBSIC9Db250ZW50cyAyMCAwIFIgL01lZGlh Qm94ClswIDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjIyIDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAv VGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4gL0ZvbnQgPDwgL1RUMSA4IDAgUgov VFQzIDE4IDAgUiA+PiA+PgplbmRvYmoKMjQgMCBvYmoKPDwgL0xlbmd0aCAyNSAwIFIgL0ZpbHRl ciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBvV1bc+M2sn7nr8BbPFWxQvAm8lHHmZy4dneSeJw9 W3smD4xM29rIkiPKc8mv369BAmgSFEXK1GxqK56OgQYaffm60eD8KX4Rf4rvrkoplqXw1T/lEiR/ FkTVn+mHdBZmfiLiLJzNkywSyyfxP7fi0p/5fjQXt0sRBeqX8a9gns2yLEtFlGbe7ZP47vZWCilu 78XF9WZf7DbF/o24/Y94e6tYD+FjJ49SsAyDsGPyy7Gz2tV7lkHsx2CQRMRANFf//S6/34vm/75/ 9178e7spxPerh6Js/1chFi8PLyAHfuC/8U7ddOBj10GmNq3X5FUSFWM3bXdqzykKWuc0xaxhFr92 1s4DMssOSfEa6mWOZrBQvB49NprgMgpn4Uzi/0K8v/7Hz39/K94vH4unQlxvluuXcrXdfPf2c/2T uHlZF6WYidnp5y/TEOcfB4Kt5NTztzJlJivTOAaDhBi0Dg0Lxz9CysEyrX0DUzStvu7soxXNLp/Z rFUJ3/9KKuEwqlQiclSi9gtX+Xr5ss730A2hJFrJVUs3OF05jHMI7ZomVQ4j3SAOW8qhDG6sYtRH 6DWCRkRuN/ClAJPWEYYzkuqvz3f5vhD//und2398L25uXClyifKfhZxCumxdZ5Kun7jSPVG2CMjM PEIYty8RmBHAmw6TBPvPYre6/7LaPDTiGBdg388TCdeu7DzClXEbikB1JxUuOLSEG0O414t3C3G1 3ZSru2KnrL8czLWOTdaPZogC0oeXdnkN30tfxMugKNLP5h0M+nSg+d+EjCZwZmyLZ9IIKV1zO1kn DjgzKYHSGhAFAoZaGC+2//JcOOGgKc/mnyaSrl3XeaSbROcXLjB6W7aBlW2NyJrS6//TNLK1yzqP aGUboZ0hCMs2so4V2K3V9se8fBSL9cN2t9o/Ph1R37G+wAK8LnzqbL46UTq5k1NKA6CcyYd7VScf ZuHX4KfLsAOdDl53n+PWEd7lkMAi3hfLFxzVl1YgOnJw2lYQDMaeoQ1ZRrZsZecxi8v5V7ALMGn5 nET588V+ny//KMXiIV9tkO7vH4FUWVVAy9L990TStes6k3Rl4GTz5HcGa2/TQA6Ey0twceRLPl3L 99f9ar36S2HVKg/45QXoFen1QV2eSL5sYecS8NwpwpxDwPPAETCVMW6KEpItNstC5Js78QM7V29I ga7Taxs4eSkVW49VAnf5AxjCJx08OW0rQiZsNf1lSQcyW/9TLYEXI4crb5/rtd49kO0MYIyB9PEw 7t1lMcfh/Vzs7re7p5xOr5lrHJcuhkO+r69MXrKlnclCgqQjQZ7cBYFLy0LmysXrQt+PizCNjiqt Vl7691QCtgs7k4BD2VHfGWx7TQ/fXYG4BIuWdFNS4N3qY7508MlxKZ+uuDKlknoi+IomFavMUNEK kAwQh1YyVGnFfKxoO2GVM/lwt9Z3YtathUk7h53crbksMmjFYvnHZvtpXdw9PBWbvSqhH9cI8xtC zk/XDhs22NImVQ8r38hPW+oxRr59Z2jCBli0rE76M3H99LzGpcVmX1Wl3+PfL8OlPJF82dLOJd/4 ayDXKG4jV4iYSj2Ll/3jdld+0xa3UVQeKvjPUwnYLuxMAo79r4FcwcXVYcoN3j/muH79W7HbfVOS kI1X9V5xh50hOkgZzsVlxZdDV240vacoZGoWc+xCvQe5ujsf7uL7UKV1QXHUgVxHIKs+LuZi59Ll AhOh5OPd9ZW4elytC/H3/Hd1hgNFTAKeALqyhZ3LRLKO4sRg3Rjk42OU7ZvlUAn3cwXjeIBctw9D UgHufiqMkk0iX7u0M8k3iTrqzdPKFyza8oX3uSnuix2lzT0liLZUqz+PFWxnhm1BpisBdYDBFHXR S3fy4R6oT3mtB0qyDpA5uQdyuchABel3lD7vVx8LfqDd59akCgh4Ag/EFnYmC5mHHShzhICbx3io fgcurpFQkL7eqArFeBGjH2AKAbOFnUvAaQfMnNYFzdM2xlw8Pxebu9VnsYCM337OCdGrwnMp/g93 M3VTWh+oR7feJPK1SzuTfNOwnUVTefRUP3RIgcGlpcCLqvqzUqJ9+6+FavdCbd8c7WtgpvRRJJAy FZcVYw4zh94L0wkOvfvqQZnuzofLtg//WR+PiktLtuNOsI+LRZkul8WMPNDVlk7ws2BHWAzDRBOZ CFvYmUwkCzpQ5uQmAi6tY1woFN8Q7CfyPk8v6/2KPNKd6o09CJFEMAmMZws7l4DnHTBzegHP20hz oTrgbnGp+OvN9Wxx8/Oiul1sYpEDfzrdvUtqOAoSeKfMLmlS0Uq6IgpwOUQcWlUw2GyQDfZsNT7p KpG6Uw/3bE3Y0yxqW88m/eBrwNcONosZdZmRZtz89NMtScs7qa1+Ti2C87kUl5xJfdavaKxnPRxz 6txP0YaoWLQO+/3bm3++vXk/e4fVq4vzA8ps6i0iDGrd8Oj9wpA7yi7d4LsVaAjDG4VXKAfbLVeO 5Ny9h5Bo0q7gmLrj4u5uV5Tl+AwVzeCn+w5bQa/XxqHNaBGzo9OPSy7RW+fcB451Fzap7uzXAYc2 HKSSLl6x7LZ3L0tq5h7M0YFeCdlDgsobduKwGS4hZ16meYF0ENfY9VoJdSt3ELfRwBhQ3gfpzO0F ei/aPK43qsUGj2++Fbn4izptVqUiLbfrdaFORmzvRa6K7yu64UBuDzPYvuyWxelabest9aJepdXH ZBv6Z08pJXi00NyuWG53d6X4cHFzU354I0Y3LHduaw4o4c9DKLvL8THfUUtPLpbbpye8jyAdrcKY P0tllvjzjBy8H2aBTOgnRUvF0GdqXueKUN5HjR8Fi64lobXxYVWtZNA7tT5Fph3PZIK7hI6958/F 57E2ab2hpLwHr4M6p2Y+ZOizvt5tRCSvtHsbHy7+/+aHqzTKst8+vIGLpBheinxXwAr3xeZ0iwsk kAmpjBbeAYv77n/xgPEBDxiPaUwYyFlMTxmDeYpTySLvSYRxiybWnDafJSmePIJmxxrao7jHVJma 0wvSEHqK38Wc5nc1jY9Pg9k8UHPqsUiCDA1zeubIsLOAdjYM5HSqOgsJYdxxWTdYAfvgsPXX4NHy KeV+uyvuRF6Ke1zzlFwz9XlRm9nJFt79EJWBWnfb8DN3q/IPvpThb1+9Q29fWcubKwU4FGoMLbdM 3oO665jBS7qYjNC3ItvzexfT4HQZkE9RBufoyjJHdL0TT3mJd7zqLEVV12U76sfiDlwxbxvdHTWw uGPghxRGppUxwirlLCMjexJBONdGX9PWTVoUwRGscZ/IxhINRk8GPtYY+/woN8asjdqnB0+hw4M8 tfTD6Dfjp8e6504nk0Jt/BSmj4PM2hkPRYKHYoM3UOv1FzK8/W71+8uefAIi/oPY5Hg9Wxa7j8Wu FHhBu3kwGjWwvmptBPqLogJeb6uFNDyRN312F0VOFnJyRahZX7AOFTwa2xAX5EcW//rhhrsv7Ukt ViITGYmVuj1pTLlKlJLbcff74UIB8P0uN2c2MFjZM2PK4zIYnmQ5VSB6OO2neDnftfDhyLYv7tHT aT8L0ehHsmmdE26H+RENjDB97oNFGJcdmTY+0ZD8Zk4CKjAFhGbJH64rdAhyj+rDG8PZOs1RyKV5 M2ODkbtZpH5oVb/+elYg6eMTKFl2KtOHi9Vmuav66dZVSgqLGK66fWcOYARLxhVbl4qVTR2jOOkB LspIh7womoXtMKhpPAxG4QwAnkIeG1vREBoVzs00TtbjEVqzNh/MaWlmzqAe6wWWD80ZJmEdmu2c sdRhWNPWgtH0nB4bq2knhWuY90FEx8J1BD/SbLFRoTTLYmtvNgE5hE+GWYN1jeYzFDj8rH0H+gp7 YxzISSKTJPVyODD3NWzlFhywmlpMTpJMWLFoSfF5t91vUbgpAUiY+3Ad12TxjPtsZ8eq/qzyFLuY UVtvuTA82UadQcUHR4FQuf9iuRiYeYSdC6INZnd1lIl02LT2ALnXDyj7j7t3sRzv56z2sfJI7+KH JwCB9h5hCKVTCQCypdrLaBq8nKUFs5gqAaDZsRWtTgCCufZSejz3fJpmPZ8XhGY8G2toyptKM2dK IEUlKpZPTVt7bDyqDlRdAB871tDOmKjEUcf9ltXbV+iVBbkuj3xdbsXvdH1s0wWbqkwAbA46feYf 3GVtX/b0OQeqLxMMV0Vouu+2SzsiDwdNcjtDIzkwBl3EgXPrlkzdquebL1XmPVj+Fb8DVVBC3kFE VVB3pwRgyvvBfPogjL3p7eDTAMkawISxBhZUSasADL7JVZuxpq3pO12WpsydindsLNE0gDFmEyTK 5KlQZ3+3pjXGJ5VpWpPzAoxV5lqBIqx3wvpcnLb79HR0tMcwNEzUsMa6WvPxNBx22u7UmyZOMLTi sihflo+MjbHg10GlzniVEKaJqXeBttqyIy3SRiFygtyM3pTh8ykUJN3No/j5w+3P39pj/JO2ffQT e/b0gCPgGujNmjN7o67hBEpbEKCfbEFgrmMi+vCDOk4GVUzycHVY0Sgm6jjlZ9XH/9bCDLUkCj/4 aktti1KVYBDSMFObRrZkaNEsrUIaG2toTkijzOYV3pWB+SQ8/+UaeLSg7o+3UIEuE7BnNBnIZabo bpZSZ6uKIzwKPvvYHUkSqv/FaA67xHV2e9+78stm2bnxM9g+6zQ5tvFRutTE9czY3f1ud1a4R3g4 YN585qlLkCccWl9YZtUkdxPFx4JfgZ7TXUv6RCDeBqstt7x1Pk2djt33ulv9uMqZZMeeGDykTo7c qdm8Q82s78TQeEDXM1TddnkVT/lqbTVvohNjISikY8J1fNc5sY0eEaADgFmlgF1pu/vL6Tsrj+o5 MNvlBJFbUjdOEBBccLmiLHH1ssMznz3uLgD5cZdhsf7gaGtinszSWUbf0LX3Up6hITbquyqiAdxW 6V4dLxlNpZBJjXPNeMTb+jJaGBrm5DQ9Jx9b02jO0K/DvR5PF+QI8+rSXNOQgjZo9fjGWD5nWI23 +3wSEd6nteds0PSc9Vi1HzunZ1N1P8JXiJU8ZWygSk0DfLE0/Mfq0p2NrWh1foAspcYvdk5zboGm cfxCwqrnrMd6qNZqmjojLXsznuSJX1FNCHZORtPj7Vm25jSOZHjycTDX5ZgobV/co6tqsxXlHnAh 393VNndCxyWD4wlncp6OS7RWtGLImHvVPu9kyxXg0cJ2n3J4h63AFSa+p6lKA9R+Bq+xWtKHbqgd rZKkdR7D/GSn/634826Yia7/bUuRK8Z8Ta12dN03s/539Casr3U5jA4iVjhMkefux8DGrtdmlSw4 MRYpUrfmZcAYHeuL8FbHXB63j7DIu+3yhWKgktX5G+XmBOzRX3wp3fWs6lZYavYSm+KTkfLoW3tp y+RtNt7FKxAgr63Zjj+waHmI52K5uqdPifFatvGzR3TcwfAMxbR30+hqGTav1UW+G9uP57LA95HV p0X3j/nXUhNJ7VYwii41UZ0dvNrymn2bVykd+jgiV+gzQcAcwME5lVpc2T6Pzu06z49d6ro8th9X xpSOFTwc5UPtBieBR/ddq9dB/PjfvdAnINw/4NsN+Fx3F4uCmauyIG9opy5T74DaDIAxmxzc10fD 8be+WiFASNcohGujGu9pGuFaTgNQVPibj61phO0i9HYSjvPM+CcRhxrX1nwwZ4NWj9djFUC1c3py rjF9nM7wPqBxLYTKX0UjTF9jSKJRIyv4NMaq5taqRh3pay0zHvi7Xjv4mzkbtHpOPRZ7NHxo78Y3 Dseg7K8MadZSeFzFI6RmXEVf+O7L8377sMufH1fL0+0igYPyE3wLCUrrcBkOPHrtAmBf/d0nl7jD cSrs/Hr7FR7QAgSXxxOe+uT44kf15FLfUeHT+blA+2n1VgL57PVeoBNv+4nCNhr+CzyP2NW/fDo6 Deg1c5CSU6gWxtHpcPk6+Jt7BSbf5PwF3CxpFzKrVrcGyifSNyy4oaI5SctVHTWalmJfjKOO314c zzfGmklnjGJ38y43YL/igb4rbFiNB30xwggCIWlMazfeBbsqMb7miNXUqmNzArwegEr6FArBoAX5 mEq+9sj6fAL8JjaJL667mxQXRUnAU3XF1mIcnF13n5j+m1y6Nowsngl1tCzNY90jshxYj2vaeUvN LQBrK4a4+ISkmp2dgwAOXSmYJxkS10/qb7ECAtA3WYYGBMBpaCSm2+PGWKIh2ioEoKtLZjyPrJoP 3VJrpABaPT7iY9mcuIurK2NBfROGdernJFLT1l6Dplr8gAr42JpG67R70uMxZ6qRSk2jfXJaPb4x ls+ZaqRi59R7QnnO3OJpGm4S61ZE4sPGsjmNpRtUQad59Ja00xYsqsBfLEOtezwevZRoPl8N7890 XAs1avh48CMuafbDrmWYmdkNdJYb8Fe3OE85p0YTHTzwIO/31ab6PqRqPkGzy/u3VxYivNZvQqoH C5P2HqxjZd+KFT4J2g54dTHkJAeE5nsGNPAwsL7pIOat0z3Wp9i8Zj+iAL2hw3QDdYhA1YL2xfJx s/rzpcCjnD9QvUDB0Z7OEc5NB9zcv31E0bH/WzAxn5wxFjuIG9duk0N2bK7Pvx+6Kw905pUldMES ZtTdo28PDA2+h9FwoYDfg9+sx3r4PU0jvxn7tY8045Hh6e4FQ2PtyXa8x8fyOU3HEb4+oG8uzO8a GubUvCX9gEyU/LPuVtK0Og6ZUzB+k6R02G/2aR3zmxLQqZmN1YkFO3+Ndg+F3UF60f3uhPlYrKRl hahxoRjKFjLc7A/6HNvEgCJKe+u5eM53e6RJlufYHh77HsWZ/7QeHinrOJrG9EpV6by+8fIMjd2C gYYXqkrn+VhN687sJ4nB1D3cjMFjKuZ9zsokxHgt3K7rwiHWHwjYl8X6Ho9GKO+l9+bsFE+3FZuP Ee+WrairoNWyip96IdY9TxQ8ebaj06mOxUy0X5NQdbBAi1suPj1u1zo8IJcxjukVbgClQGgtNal2 HPC3dEOJrzfiRergE3XAnP1cSQcHJjkn17CxiH5CYuTP1YcJNGb2ULDAQ1Jll1FUxxJDQ15gaKop QNmlHivwQr2KYyrXsE/CEb/CmJ6wp6aTIELn4ZyTMLUmJQhpVY9dPdDDX3KgSSo50PMB0qpKJHIY PViT7HzUA1Dfw+v5GInPJ5OoYmPnMyQ2H9Kguv5p5rOkxnxQb2rUR1zX6yMMoUhsPoRn3Qdcbcyj 5KwmNebz5zoPNPNpkp0PdVY8I65Opp6PkWi+X/4Lxx+mKQplbmRzdHJlYW0KZW5kb2JqCjI1IDAg b2JqCjU0MjQKZW5kb2JqCjIzIDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMyAwIFIgL1Jl c291cmNlcyAyNiAwIFIgL0NvbnRlbnRzIDI0IDAgUiAvTWVkaWFCb3gKWzAgMCA2MTIgNzkyXSA+ PgplbmRvYmoKMjYgMCBvYmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2Ug PDwgL0NzMSA3IDAgUiA+PiAvRXh0R1N0YXRlIDw8IC9HczEKOSAwIFIgL0dzMiAxMCAwIFIgPj4g L0ZvbnQgPDwgL1RUMSA4IDAgUiA+PiA+PgplbmRvYmoKMjggMCBvYmoKPDwgL0xlbmd0aCAyOSAw IFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBtVLLCsIwELz3K8abgsbNwzZ7VTwK CgEP4qGE+EJBjQc/31orVfBUNXvIvphdZvaEGU7oj6KEj6DSoi9SJJR5xHfHCs2UYsBaZCkb+AOG DkaVHcWnMhbMbGEsJ+6AvnMSEm6FNjpwO4xdOagpqlF/QNU8+Ba1R4LIZHA++UCGvlfeyJiHGMM+ dhEuyPcC9Rtfj9tziJjkZ7+B7EKRknW58hbTfB2gl52kMadkCxFY42W55HdKaaKKU13p32quv31e VY364apmNxqJlVEKZW5kc3RyZWFtCmVuZG9iagoyOSAwIG9iagoyMDUKZW5kb2JqCjI3IDAgb2Jq Cjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMyAwIFIgL1Jlc291cmNlcyAzMCAwIFIgL0NvbnRlbnRz IDI4IDAgUiAvTWVkaWFCb3gKWzAgMCA2MTIgNzkyXSA+PgplbmRvYmoKMzAgMCBvYmoKPDwgL1By b2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0NzMSA3IDAgUiA+PiAvRm9udCA8 PCAvVFQxIDggMCBSCi9UVDMgMTggMCBSID4+ID4+CmVuZG9iagozMiAwIG9iago8PCAvTGVuZ3Ro IDMzIDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAHNXFmT2zYSftevwKNdZSkE L5H75o2TrKuysWMrtVtZ54Gj4Yy40RWS8mTy6/drkDgIcCRSR9UmVfG4M0ID3Y2vT+gP9jP7g33z bcXZsmKe+LdaguTN/LD5O/2QzILUi1mUBrN5nIZsuWF/X7CpN/O8cM4WSxb64pfxhz9PZ2maJixM 0sliw75ZLDjjbPHAXr3f1nm5zevXbPFf9t1CsB7CRy8eJmAZ+EHP4tOxq+rdTzSDyIvAIA6JAevu /l2ZPdSs+8+7nz6zX3fbnL0rHvPK/r+MvT08HkD2Pd97PTn30L6HU/upOLTc06SRKBt7aH1SrafQ t/R0jVWDNLp01V4FqW0HZHgd84JqBotjcsSCgwg2wH3mcljtnlhRs6JidZltq01R1/n9DGyVbr1Z wtPYm6d0gbwg9XlMPwlawgbdrMlLNyvFvriXzns29v2hrFd5udmV+RuGn1o5TOhyj7thnE7P55HD ZPJqMVi6x/CBB7BmDgFBvJaFqH0DGUZCkbZrHgZYPxFSstYfbh7OAQyI4CFJKOWOhNir+wYFtJx6 zGEy0hxeBFoe46CwrB5BwkDvsiq/1xsZbQYJLR6JS3AbKSaQoh/FPVLcbQfv+9g15imw3AeUu/f4 UOWV5iFMbTLobpIytKn5HnFILEuYkKu7wNQ6DEgLibiMlhZwyQ0e3/wAB/4IB34KfoIgmEVw5ZN4 Hs7iEK58w4KICxpTtHWXxsnlg9Z+VvxeS1uxh0kYR9bnN+Q+Ldq6S2s/3/ks0SZrhjWZH8zl59NZ nDT71PxbWmdPKQBX7FN+FmdUNFozSNWe1JoGf7Vmh9asOel8tuVDayqYggZ80sDpi/YivmvX5nmW a3sqSonpp6Om9lJoOyXE9XgMO3UWNmzoxM6PXTW1cz8KrJ1f2ym7HB525Sar2e6B/UWR2H1WZ1f3 x1qWhItegmDM3ch1ZEm46KVB2MOg2F6HRYozcA/Y654huxIH8vE8mPdwWGbb3bZYZmu2K+/zkmB4 MiIX0EGhgZMqaMGBLJwsto8W0g+LwoD0k35eMr5whYdIcLE6VG/aGLHY3uf7HP/ZCuvURjkYrX1P omDkk9WZaD2JJc1Ea0B53KKg/qyi9SMWRSQX5no+ksM2GG8zk32ZVzh4Vhe7LWuu6ButiBNY04Rf Rsw1JwRLEJMbjNqk8joGqxCMR3bed20EczlUh+WKZZVxEuXHSTfnpREvxo0RAUwYxgwbsS7LcpVt kceyDtAoF3dCaccchEJN9/BPq6LOq322ROayzPZFna2Lv4TZvGHZ9p4td5sNDKnS10cJ57IcS2M6 l8GuuztDJxccn8tg12WwK6/EgkDdjxPSqryK7Q3pDRUnYSixxUdY5Ats0VGbpJlRG2geRYygmZ8l Whu18VBGkkE4iyhq3ODGSj6Stu7SBK6tmfzsJMbvtTTCq+GB1YsWry8355bFCx8EH0Hhw6dPdlIw wFU4wVZM1yv2oAiOGk2nQDEbDIDuqgSAiNd7VjXs54hj6aadcxmx8wQlPKEnrqJ4SYNONA1KJBtZ s/ajk5grknAryOn9KEyBFrMgCQNy/hq7kFwN1KNzcqU8ZHJdcRoHv+BuqvX5retJDoPFCol6tc+X xQMCIuEpQfjwcfH+w09vf2T1jhWb/Ton+GN3z+xuV6/Y/nC3LjQWnji4U8cwgyZyqn4YMm7XYSqU kioC38H22vLRkKpSY2dxQ2vSXKU1Rmksc1KFRIqmkWhCtLCJcsyPtiSyRk1Ggt7Yt7FiS+usGM7S JsvVH1WkETB0zAkqS5sGdn537RjD5bDcbavDhvRqJkqzsZakNaySCIOXW5V2VJxEs6B1DEHrLCJJ g2MwaRyAA8eiFIJfIxIwqKPiJJiljfsyPt3SOisGopDQWbEhtSuejCsuhrDp3MEYfcWuEWdpE+N+ ZMPllcvjU5cF2iGfv/uW7cvd1+IecWS9KvOcVXW5g4et8uWhLOpn9njIUD2vc/xCma/zr/iZsK4G Gp5vjjwlNJvHzNyWa48X4KUh27nTMRkhWweTjTxHth6mcKaW+iDUerfcrf+mLebEYRxXGlEQESYk I2d5A5bHLqsFQ9Xom/roqR+rRFPmfyNEfwydlehdFhyJ/dMqpw4LihZsu6uNjs8JaTnaNjywyoro WFZgiguR/4nQoGbtpSrzJYJVkZtRQE+1ruEJtWMK6PDAC4asT6DnG5i2BMR/N7aEAPVMy9aubQku C9+1BK2ojP364afv/vkOqEaqoiw6Y1XxuM3vG3WJkEq1CocZjna4KqSaGvs6F+GMZWW/fhp6iWWE w0HBMXMD1LRVoHN2a525LIIeneECdXW1QvnlLs+hsTVmFKCwqtgucyrkPWUXeCWtM2Nf5+qstxyp hRt5PV4JgeW5Spx0xjqo6en5ScCm4GMpsbHxS7JbKqpHKF70LG5sn/rGVo5p1MfOaeAp20fmemPb j9C4vzFeuSz+TzLMKXZmifeaOWbP8obV2ClIiLp52/lUOaGiGTkh0doupUxBDJKZgoQR8ggry1S0 zoqBzGD0iop09SwzRm5/Y4tzWdwwzzSYuRDqaBmlSDvRDCXNSAvDEGkfOitGWihJVqIZhv4ssBJN ReusyGdJUxNVWgZjIslEU7SNr1ETm8aYQ7F0PDZ8O+FW5kFiceAzCoj/uauLr6JoRQzHtPB07BHL qubU4OLqdnSkpGB9ntx4Cm2aBE6gO8LjDkpIXBYLxC8bJX9qr4nsmRJvkSOyfItOzrKpHNK0Gn4f +TiGCIzE5WS547TYXxxlUB2VHvk0u71gnEEHVa5kenBfNSsCKhvSVTfGUyQNN1M5A6KJojhostFh 0AycnpwW0emmxDRJqBw4MQZlzw/aurO4KqcFC8v/ZnfFmooxGi2G1p8Q6r+od9VbbA9lTv8iUfqa l8XDszDH7ACj3NbFkjaBkiQypZoqzmenR5xmg3kaMZN1iyUXzAYb6Tqn4WCepoKDLc41zZ6IpBzp 32NW3q/zymgnnTAUJz/3PcrPMYNsnkZWPLTOpNfrucv9DZ8ARdS2IC4bbkzRdBMOtHA2b4qtrROb GCS6AspcBlZFuxliN7nQSUzq3zxKdlnA/F6a7H2L/nNTOO/UzVm12h3G2mqvo+Vz6tsGqMlhX5ZR re+Rk7Lsbp2jPqqVfsKWGkGb+beyJffoxv0/sewxV2Xob37zmDN1WChYwRiYcHUYAaMh7Usyd06z nZwjJTX4XRdOPBrD8n3BwdK86PIhRYIBNHApRtt2+7zM6l15QabNExpZDbvHcnHlJJ6cMJb2sutI T1sI93y7CT/cCLsgAmdnmrmK+rgX23VoPlpmvbc1oEIFTfdPe3igOPiWqkdbRMVfc/Z2j3AsW64w any2U1Mj/5JfJ0rQkCD9gEw4AsxQJE1GKqdhMb7b0ihXaWYyJkQTOY1usxmkc2De9WRaLRyPIW6b rIDDzcPxHh4f4PuzVt3UysLw21cKbtD1onFUVmcbXF36azPRVJaHvWz349dFZyw/30rUA6Fpu7cX rGTYpe01fOP++tyOJS8KV40brMJVDh6WpQhcL9BKLO4OQnQ0q7bN18hEF8hu6CEW1XAztj1s7qhP 88Ae8qw+YAwRPgGOAXOnl0hYhmPt1m4r4ciOBG4g4cgOtLJ1mWf3GDPJGd5H3IusshUyWSiBzZgs v9eMMBMMn4eKAnVp7UOK7jD0+TEvV9m+yVo3Ozyfe0Izef0sdqUh74QxuzhE7pbeUgjWlnUN90DD wiAc8+adjh4eiHnoIojHadlSXBOqzbfX4Murxef3P7D/fPr+Wz8Jo9++vKbLQyR6D4OQNkPj4/w7 YnTgm9Pf9I4EUU+3Y7B1HIsjNAqBh2UnuAdlXrPf82cxHwW42SDNyx5RXmmefgnw39XUt8X4d4Ex iAMm3f845OXzZd0/ZLYI3NC2n2LYnbZ1W+mmTjtkRFVroHSRSXejAWD1HtkWaluNUCvY53vx3PIx 3yL0XbcgQC5W1Q+yGr4Xc8JfMTcMZ3sdN4rnPrcWMSawraD/+iBPU95dEf/y8d3bxXeD74mDoup9 9JS7i18HRSOKsUPgZx8LAV48iH97w97++/tPAszwKp3+TkbwXtJQpol+03Z0CapRwoTZU7mbi+5d b0IUpvajleGCPHbVjJgtCp02wYj7fMznabR0eZAv+pQD/ODDSTsLejTd+qXPpl+CD/ryyvvyuvFN acDhm0QCj1EbDN2crz1dRuPN9i7SXm9IY0o5cQYoRkj5mCoNKSd2O0YX/f+s821F722o1i/GTmyg NHwSlHO+XHUZgUdiQzeVaxw4XZyryxU8LKg0oihyRP+CIebIMChekrNYTyBhIqx4LLbCOWm5jxVt r2lxlO2BPYAeVwI7FCZR9xqM5K11GQCkqoI9q18dgOLEDqXGeLthAOTykLP1eNrB6ud9jqd5CmoQ K4s0h/JvXBYAFLpmNbXICLbaCOSC+WgjYGs2dtMrglr9zaMJ8LCuyC/bdfF7LnIIQ7IimxAVzCVF ymxZPu/r3WOZ7VfPDAVMGqNESr69OOPAyziZ0jV7u62I53bCOsaEh6H73BkQbzKOanT5Ul903ZPj 7vLDL7oTChqOL8EkaTfOHL1uLwCaLOa3j2AShweVlkTUst+VNfsxe4bpfpZz7MrxVgc8YRTxyrra mc53rBfQSuPyOd8UX2VCJ7+paaf89oELeFg2AvnRMwFmFJnaEpDyagMb7IbcVNsG39DSZTi50pdy cNW3IRYW6lIlGJVGhkihQLZabDLEBmjf0QCGWb3cPagznvrKCPfiye+DmjpnHPPFI8ecqnHx0tgO jMbA3jEmOqh1eVC/C0+VEOGwfywWHz+TtMZUH7VF0KC7N8cdgrT0Ua7ayVOv0wULyyLyLTVw79lT focyaokTIQpBHPmUr9f0J8XhONyg70NzTAEPNJGd0hy/ebi2nzd86uGYljgNafk+lWwN+bUsRoWg 7u7lC8S+pa+0e9Xv7Nm9sqwzha8x2pXMtR2g77kvKkYkQcc0rO5hDw+qtyRhErb1FXSxRGme2lso fj4cqMFCYz0i7UTP5bKsUn6j1bTdien0htuDE2qZMzzqwhAL66qOsmYnodJPatyVL9i80R/j6r70 aGrx4yU4Ir+gQEreHNy6vinHdnfv6i4F3xNi8/jyiowZE6EJdT7OdyjqgT9kpZlcc2oV3U8n1Rjs IxzrNwxIu3Uf9TArHLu+Dlwev2wx/Vkf0JFCQ098U6GYWUW7BGWrSj4clVMv6ASYseHYaLo3pVA1 FZKAdf/pdepYOetAQ/e/epY27pCc1QjSWRDhe3NijOSFNByOsVRUvucmCROoDUl8X1v7GkF9EF/h 1pJoUkORY19MtJvrSZKxnv6mIPVBTeqshy20c+9qf5Kk14vm6rWEXM8gmeuFc695va/Pq0h6vTCI 5WSKXM8gddbzfEw0deQXSpJeL8AYivgeOXxbUit4g2SuF0Tz5pWG3p8iGevpyRm1nibRej//D7a/ PXYKZW5kc3RyZWFtCmVuZG9iagozMyAwIG9iago0MTI0CmVuZG9iagozMSAwIG9iago8PCAvVHlw ZSAvUGFnZSAvUGFyZW50IDMgMCBSIC9SZXNvdXJjZXMgMzQgMCBSIC9Db250ZW50cyAzMiAwIFIg L01lZGlhQm94ClswIDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjM0IDAgb2JqCjw8IC9Qcm9jU2V0IFsg L1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4gL0V4dEdTdGF0ZSA8PCAv R3MxCjkgMCBSIC9HczIgMTAgMCBSID4+IC9Gb250IDw8IC9UVDEgOCAwIFIgPj4gPj4KZW5kb2Jq CjM2IDAgb2JqCjw8IC9MZW5ndGggMzcgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVh bQp4AbWUMW/CMBCFd37F6wYSDY7jkHhtxVipSJY6lA6WOZpUwUBsqvbf16FAKGIBSjLEdqx3d9/z eYUxVhg8uhjGgW1eZ8ISi7j4nTeDPEokGyKVSZQNpYCZ40HhnkWMiQzKQPDN5vDhmYyklDlELjtq joFSMWKoGboAelAfGKlN1PNCdNoQSZpGLOZNBPyN4MkUtlytyUHXhEm3tFjW2vjS0KQHWhY0p1pX 0Ha62WEXHjV5XVoKCzNPNXxBvc55WbapcZaHsmRymFtnW/3ltZ/EK/it8Yay/uKdaq/ha23dLIAq HcxivqzIUwSogr5htAVZtw7sfaF9wxKmKsk2lA2Vn+SuYRt858Fz0SZ2KdsDx3bnNZHpMdBzHTul KrJbqDJ2rWrbvAedtW9eniZH3r+Qc1S5PshDV8Hw/TP6WpZ16LgnXZsCcR+c8Xj/dzd4fdbvBPF2 jf/b3jpI7h/952y4ZZps76u7y/3Pd6eqVd3fgq3q+Ad4UjrSCmVuZHN0cmVhbQplbmRvYmoKMzcg MCBvYmoKMzc2CmVuZG9iagozNSAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDMgMCBSIC9S ZXNvdXJjZXMgMzggMCBSIC9Db250ZW50cyAzNiAwIFIgL01lZGlhQm94ClswIDAgNjEyIDc5Ml0g Pj4KZW5kb2JqCjM4IDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNl IDw8IC9DczEgNyAwIFIgPj4gL0ZvbnQgPDwgL1RUMSA4IDAgUgovVFQzIDE4IDAgUiA+PiA+Pgpl bmRvYmoKNDAgMCBvYmoKPDwgL0xlbmd0aCA0MSAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4K c3RyZWFtCngBtVxLc9w2Er7Pr8DRqZLGBJ/D2sNW1layPthJbFVlK4kP1AxH4ppDTkiObO2v369B EgBBekRqyKQqsSERDTT6+XUDf7Pf2N/s9ZuSs23JLPFvucWQtbbd+u/0h83aCS2feaGzDvzQZdsD +9ctu7bWluUG7HbLXFv8Mv5nB+E6DMMNczfh6vbAXt/ecsbZ7Z69epdVcZHF1Q/s9r/s5laQHkNH Te5uQNKxnYHJr6fOqla/UgQ8ywMB3yUCrLv6t0W0r1jnn9EkVzXDFJ0QG+HcCQbosKmzqo1ox8At 7IRzcQzmRj58Yn/kWczeJvdxaWwJ+/vxdH/CsG3Z1g+rl56UbWGHdihOqqW/qsVg/AYbOVNsU8Ll 2oZwzTGrE3qXzqoOQ5MquWyHtKWjE+D3LOfteBBcbrM+heohZruoiti+yA+M/hZ/O8bbKt6xMi4e 4+KKRdkOP4gq8VPxu2WcVezuiQZeLgM8xKLsoLOol8qA4qsm5IqvlmUe3AS+9syZdnSSr5ZlnFzN PJaULMsrdsh3yT4BT3enIsnuWVVEWXlIyjLJszVj/86/xoLVYOgT2+X0zSWMJeUKfOaoVS3DWNtz FmYsKBiMvT9FYF4Vx0omG143TK1KJahRyfIiuU+yKE2f2PF0lyblQ7y7ejlzpeXSVrYQcy1/aebC aXftDal6LX7sWOSPyS6G9j+xQ1w95DvwNWcQ02QPGSWTIYwCJLyIox2D+4uLl/NVWgNbLWoZvnLP jDymWNkx1gAUDL7q+k42YZsfjmlcxdD9n/ICJjeiv8PUsiw6xI3lZWke7chalNFjvHs5a23LgT3Y eExb10Ks5XxhkeUcUULHRf6PYhUhjqdjnkEWyyoqKraNMjK8A9Yiz17OSu4TK3nItHU0rLwgwtR8 FvfJKSKmBgGDlbuk/FJv9AFmjTzEhEB5hYBcC5Ta8EvbRhOFzxNvSNeLWLl7XFN0rYmLB51763l7 BO7iONM2Ya03PPStIFzh4CwntLlP2YsY27DLkhmZb/iucVbbvChORwqioN3qnMZmUOc2vqEcZOPZ rLfzNshojApiiTIm21zmWXnFkgqG5xLJp6DC3mhkZ7UhPMC+bIe2ZfDyWMT7uIjuUnj8XGPm65+R lt4jLW1PmM7VPOEVTpjbztqjBNW3/HVgI0E9IH3hxljaHbNd/F7a/ZbGVil7YHuVC2MVNq1ijpyY B8bWy3h7KijQiZUMjSOkdN2DxbJcC9bfnF3j5bhJlSJqIbBU9WvHjIHn1vU+BWH3k6qM0/1asmg1 bjeKRWRzLd/aMJPA6tVkHqlZFWMCSutWGtQxeVbFed2Kt1jKNbd7menMCQ6RMCz57w9PIrcpE8Qu TzA0+A8c8NsPnz7dvLliXx+S7UMbRSLiiYsqSrLagQm5Tqqnl5sjGdPoC5vVIKnj40EPTZidu0iD u35SBi7lP3ViA8aOHNss7syHhbd8N2TX/R2/qY8PR7zPC6lp46zealB6JQRF1IzNIyZWNCY6TaWA nKIc7ojtGATGK+A5V8w5oWiOO0SBwlJKRAGbRDDhZXKfIe9EgF/E2+SYEICyzU/pJWE9UbfDoEO9 rwKj3CQFQvButUv0PMjBBq4ObtIPumNwiWoMH/iWcJPqWzVGbpIHtZtdeTCxvHG9ik4zhjnVmLuG CArX23zLPE+OYc6VlIc5Xe81VMhwvlO815iskEgYYvgYpQlcGJLsNGX5XuAWtaSwjx8/xVWJUO7H 3S6pABMRgnHFdnGWROnL7SYPKL+AxGqLmTeBCShOdGsKBkfzvdLqqT6abyjzQtg7cFIXpF5aIMM3 xBrP7/CmyYrib0lZxdl29Pp7kL5t0ewoG+icb2e/ZFpiN4D0gWnnMXLKD9q+CRdNUZFzhrRN5q77 JGAu8wLQE/J5EUw0sF+tHuwByIgIQkTWF+12dcZVxIcckMn6Aj3ZEF9JFtSm+7Z1nBAPuj/FVocv DaJeg4RheSTirERvydDCAzctdwN+9ndLMA3Zv+ZIESNGTIA6ym/CDN5SnSIm40iGsg4yX368KnzU WNM/39Z3crd1gzYnJaYM0g29xjW2Y6kcW3k2uFm7Ru1bOUaucaT3Oqc2mgz5Jiw2u2o6PRJllRxP KdxXE+eQKK1E4Va66AsUhByVFQQcIuP3oLA4je8j8ool++tVBkTvxVAY56DDETQSGUNJxvuVc6eE MivCUJdkv0chOsbfGAqujZX76wcRLJJG1GGAkvAB7ZyKY3UxQAm4DyxrHs/BqYxNdagBCigeqjNr 1GzlBq2aWW4L1Cg1a8eUmjEPYwTKICrtfEtjDVATtFpqhXVzwoHxTRvotmPAefQxoeEp0z+loWbG kYrbCwkHM3fX2hhBUmPapEBP0CU64EFn4xIGZJOQg54h5KK+q87iGY3txTUU2FsuSXd/6v4RD4F1 3fy1ZbqLZhKXjhbnxRusTo7hvNSYvQ6p6USe18oN5dDlUN1quH3l2vVMPGR2i9snkcUJsMBCGAmq y92nJ0J4RYQEH/nHLx9u3r+lMGly9XhQbDhgwzUCb5ytZwJMaBGo66wJarH3BcAc+OWXixEPKbz3 AcH1d62J0TjpHNyMcpaeZeINsx9dn8ROuqwrcWx1W0UujrONcSVaQA5A/OhrAgh/i1i2QGB7dxFe RraY8gRtaf2A5xn+jrNpnrt4Kg0ShhmrzSaVPk4FMfWQF6inaihMDJQyf4KzvXnjsK/QI5YfJ6uJ Bi619YprbS0zZ9KkEg4sa5+h+UnASqP1rTk4bfkhgUcoIQ1MPl7fevKgpdOavgGj6oKb8+tbj0R5 KrfxsUqashFEAoYSWWEEoAUGtAFVKJeginvJ7uLqK1UO6RfN2GucVijm2tRdZ28QunpqXQspm++a 9bIpzD13gDIpBwnj/LIcqRh07XcoGuqLbTomY5ZnGNYLIkgYucU9dt2nNV4azwXh5F6Al0KZ+hTQ j3EskkNUJIC36xwT1ha1RnKk8HMwwFl5OsQFmon2KiJ/ZpM9lVMIkLaEpaQiNFOm+aUiNNMlmGDo WIkuDDgt6FQZoYH0CholGJxX+TZPqfnlLIsv4W/r4ny1tIX4Gzhm2D47f0HC0DrYKuHPVKXzufpL T9EUDtOffrKiaQZPViIDtBkZtn60kzqnv8qbbBwTy5rC+nM0pMHrk7glQyfCboEEixbOPE9L0RtL ZoJku4FB2sY5UZtuK50XdRy23kRb10JyDdTTSEenMHeUNwEJQ0LKEwrF8CK/HOPs159/ZX9+/OmN i1/7LLj76fX7d+9vxKAXePwz3M5UGzGYD3DSBRvtZNf9Tb/L2D7aVmS7pnZeaBEQx8QCQ+5vebKu DW5BKUVoLx5i9UlQ5ldkyXaNSxuImVDGahtsS0bnSGFUVKGBBWqS5tl9Se2kIhDLkd+QKZt6kJrF kSGWtq6FlCIMFg+xQMJQCurErbPDfZISBx+jJK2boMgWQQskhC8cLPxqBM9aRVv0N7+cr1JmtRUt xFZu2YsHKUTDYKyUyjoJzHJWVgWkExaozLeJQJUp+CNBpTY+EdCINlxRlKDTeDl7Vd2hWdmiXUGW v3gizkHDYHAttcAyMvQcwicmCAUr9DdDZD9IpH5FF8tgHZ+9RaZUXuu26BBd0eWx8VB9z0lpuCzu XFHHCFAo2pfhCaFco0OZHhHdLSARWFOuM8A7ob0dw0koBgI/9IoUZXxFC6hLLFO5p3JSnexSqs35 0ncXroEAm+XoY44LNUj4r9gd8BEoMPKQLN5SJiJyuy1k8r52QehiOqA1B5wlPSelBgKAsG4W1a5X tqhqoxHdEM/ZAzXswoy00YJeFQmYCxcjk/2BylQX0h8nqoMRDrXbI2snhezvGAbllvqrklLoxcvu jCroYYDCP7RdTrv8qsyWQh4GCIyPA89ZFLpIxy3RCdY/s6aYXmNatc9rA20AYU10DS9IEdolF3hs 1Y5WL+I78t8U+4YqQd2Cpm03pTuH26LKR/1oTlMKaseoH02N8brEhzH1rRwT/WheXfpbOTxoC/na 7zZjne99WchvvmUOl2PL9aNx8HNxDQcNw3mnef6lZGnyBdkuwXpNJwaCUdGtKHptdgkKFhWwsrtY XFECWIZUIMcHBKVeYkHbRJc2j4V9R4IusCcqY0I/c68fXm+0nUpEc/ASRyAaBn/rq4rKrDxD5hxc IS+jUwu0SQe28ZdsK8+HnJwKfOuueRxzXiLHLXO6G6KObcCedxXzmTXDUn23EM2DtqYxsOZdjjxn yr2mHrylqogD02u2trVBbnszBJ2pouEAJsZt207bMdFc0JgdGmsbDvRvmzGtr2fkJYRBr6dJqWOZ hdf5/TxomFJ6Kh4TdNbt61oaAeHHqG64kaJ7yQY53UjkNvoREHCbG2xu7sG4SFojc4WGmd2SPbeB wpBHErSMjTYbHE2oL3EoV6858Oah2cdv4Jyec7pmhm6dQRLtyciADInVhI4ReqdDhSqadvaPZTzq 3IQq+rxgEjUdD5y2xqNWK581QDamowtdKzvY4Gjrdjypju0YeoLUWLD2qW0Pnr35Fi+RyDHy4m3f ib1xcItMTKl+tR3TP9/YdYuS7DthdjN02RUxxTbdDHi9KyijZfZc5KiTCM1EfoqlOSfAyh86PRrv gBzG8aFuJaHCEGB25Gbda0IIL2QsUrKvgIrj7DGhtxMQekQXXGpUJTleL23RiANdUotHdNSJ1a2/ 7KOC3UXbL4Sw8zAMEBkQwI5r9t5nqsYBpsnvypxuo+PJDzz9gYcqtjUKVmfHKjJ43vEb9kQ2APJ6 XcuyN1w+JUYHmsnepMBrOPdxhiuq1JAqauGjdfOc2lD1AEkdmc0+2Zs37BNdDqW+q5tvuJpA2kAl eSgU1GiLLJ1A4wtRdtXB2Sxh0QP03OXxYNAwDlA8zYALxio+RmvWl4j9+J+fPrJP735ubzJCVXDT ERh80aLD6A14yJK/TxelPBQPo2Z6zeuVLcvgzeJVa1TVzLI1hSh5CeMiHgyi+n++RTdFVmn4DWUg ze/Riy07PDJCiHx6yU2ntvqmL2kpvNN3zCh2ivM856GV8wQNQ3T/elWjOmgbNy9PXOFqTPkg6tQP cVJQCwuMRIV2jPo1J3Q60bdzIZ712hYVXn/TC4Gm5+squNL42pt4HpzfIfvN0fJ/zbF24+iQj4ty Ep2S0INYGpymRUaYcNQAs/rOLTsBzG5ej5qrdNqsa9Fjw3sLiwc9oGGwtzXqrUdMdgK5gh2qxI0V gfpnMYwScCt5C1OcCIEjl4Q8ZNAFYF2valnmBstjWIF4vUB/qFGrAjA0ooqyflNIAWIIae604FIN EB0eVIXJiwvaYNT1TF4vaVHObuzFa/4cNAyxFYG553ifUfM7iOIp7EQnEEGdqnmIr6SHoqi4iuxo qrwOok7yajAtzNBZVMh3p63wyZPuWiEf0IBRLd3q710DAp7JM84FzVpCu8HdsW4qNMUnnyOifEef xrsmbFRwyUigTLkm1aTHzflnepAEgFUvEhyds/TgHY3nod+Lg+aYF6/19HK7eeb1e0WWWeblVs8w T51X6aiuQbLR0kbCYIj37zCxcYoQD+1YUQo7LP+5+XYEsFKy91GBVjt+Ra+3cvnT9g9//oqGXeZ9 nmpNlOTKxxFxG10s7zs2ukX6nHDtePQwE6pxXv06hIugKdCHAOPVQyt6vqkB2uWHaoiw93bY84Eh Ntd0m/nkkJoP1yra9yvkh2qoM58d4JJbjTO287VDaj7t3lk7nzakz4c3is355JCaz8EdN/Gecio3 pg115rOsNZ4kFteSm/Xh7c96SM2nIZ7t+rQhmu+3/wOpHRhDCmVuZHN0cmVhbQplbmRvYmoKNDEg MCBvYmoKNDM2MQplbmRvYmoKMzkgMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCAzIDAgUiAv UmVzb3VyY2VzIDQyIDAgUiAvQ29udGVudHMgNDAgMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJd ID4+CmVuZG9iago0MiAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFj ZSA8PCAvQ3MxIDcgMCBSID4+IC9FeHRHU3RhdGUgPDwgL0dzMQo5IDAgUiAvR3MyIDEwIDAgUiA+ PiAvRm9udCA8PCAvVFQxIDggMCBSID4+ID4+CmVuZG9iago0NSAwIG9iago8PCAvTGVuZ3RoIDQ2 IDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAErVAhUKFTQdy42VEguVjAAw+Jk oJCBnpEJhA9iWOgZWxqYKZhaGuuZm1maKCTnKjiFKJgYgVUAKSNzSz1LS0sLBRMLS66QXAX9kBBj BUOFkDQFDUVNhZAsBdcQsEWkmWqBaaoh1FQFhKmBAA2fKXYKZW5kc3RyZWFtCmVuZG9iago0NiAw IG9iagoxMTMKZW5kb2JqCjQzIDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgNDQgMCBSIC9S ZXNvdXJjZXMgNDcgMCBSIC9Db250ZW50cyA0NSAwIFIgL01lZGlhQm94ClswIDAgNjEyIDc5Ml0g Pj4KZW5kb2JqCjQ3IDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNl IDw8IC9DczEgNyAwIFIgPj4gL0ZvbnQgPDwgL1RUMyAxOCAwIFIKL1RUMSA4IDAgUiA+PiA+Pgpl bmRvYmoKNDkgMCBvYmoKPDwgL0xlbmd0aCA1MCAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4K c3RyZWFtCngBxV1Lk9tGkr7jV9TRjhBpFF4kjh7Js6vDzI6t3tiI8fgAkehu7JJEGyDVbv/6+bJQ jwQKIsGX1nOYVqpRWZWV70fpd/Gz+F388L6VYtWKUP2vXQEUzqOk+zP9sJzHeZiJNI/niyxPxGor /vIgZuE8DJOFeFiJJFK/jP+LFvk8z/OlSJZ58LAVPzw8SCHFw6P47uNuXza7cv+9ePhf8dODQj0F j1s8WQJlHMUji8/OXdXtPnAI0jAFgiwhBKK/+w9N8bgX/f8+/P2T+Ge9K8WH6qlsh38rxI+HpwPA URiF3weXHjoKceooV4c2ewo6iopzD+1O6u4piQb3dItV4zy9dtXRC7Lbjonxeuwl544a4Xwp8yxc 5MTIYZxHMqOfFGwZTOZwR644JmbHej28AbF15NBOkxu2agp2kxEtOqBW7Ba9TCqDnlTGJDgyk/3t K6mcC/GhbKunnfivL2XzpSpfHeoT5wk6PeDOsyQqLcGqPSopNIypfvgPqJsnqBv/kgJ7SQKXBHWT kt7JFsk8S6B3tiLPB6BNDyRJOwHUfRjQhxr0LB7FcmE+zufZslvPotAg+zGw5uAdtZ7+EOtZEK1n bwYniuhEJ+il9aajl+PmMBwwAKPXtFWPi0uUxgNxgSY796IdCqbwY83DPoaH56oV63p12Ja7vUEW /Dx270446d7POnCf0RekwLNc+LupdvumXh9WZWu2ctoAaQYfPXcOkZIyXoygal/KVfVYlS0jMHH2 SYvqOENGOIhMRxYXzpJY/juLYH17LSPIrEwTwjRgwULsylfxS9nWh2ZV4odV3azF/o2diu7t66c6 Rj5JuiJK4TB4nPlSshuySoIIONTkZzPL4Ow5iBzB2vtnXyuVWK75TiZ6R8dOHUmcOg7lyKn39bl0 ddwSSTBjHI6xPTvAZL0bJUYrphHpc1K8cTiEbThMzrNOVZpvgyy1MNKVcmGUb7qYy0itaX5XZAa2 EQyWdUp/E7BvDUzQmkmWaoVuvt+KVBoLYWAbDuu+Dzb8296aVqYm6vSjt2184QhGrO+s3Fz7ehhW 9e5L+SYKsS3btngqxbrzUetHsX8uBf56T2oZfyzEn/Bh4Qc8AK5/q2qdmpmmXRw3yhwmIVpAtN2m LnVYR1WvNZsyHcYY59DVC2NYIGCsGjAMbm5VbFaHTbGHbij2ipT7alsSHYmK4uXweVOtin1V70BR R0Srx0hlXqbHgq/FXJLiIlBd+Lv9uC6LzeaNaYETt3mMn2UGPFG0HMPzeLn2kgsyBXE2sizbtxXM aw6wIM5MRhCRSKj7A+Ob8DQ4gcl350I6yNK/h+A7dpAjarjvBiVSavUWQad1KjOhH+ETB5mBQZVp mCBYSH4yYPxbDSOVGWdGjcfJPCVveRu43zUw/j1gygRA3fNvNcxzg4PJbvAJ0ZZy4I7cXLQlguhe BElREMT6tdo/C4T2n356b3kBN6Mjyuv8EKcll+SpLuEASe+k7xjaiU6Hx4s2FPOXZ7xoT3WhVjqm LZYUGOQxpM0j9L4WT4eiKWCCSqhQ6FGmKM878SgXwcuC95wtRmhb7N7Etl7DPe+UdEuam6S/M3yO 8ieEX5/c3adN0/jHZQQ/Ivz92DcKjfDLJTIPnb8UGh/KwOAvORj+kpQEwbpvg0xaGAkqvE+jUOJO UcCviwyeSMMg6A4WdUpiE7BvDUz5YFYtT/SXwKhftWPWrsMl70vmObJ/jCeNWfcQrIqd+AwmKPfl CqZdO0MvTb0q14fGcecJrvBcChYoS0lMCXnIkoFmQ0j6WDfG9TIOBjwIUezWniY6sYURxqQoZymB d0jVc7l9VNjsrclhRu7Wt+YhIIVd7Z5E0ZSirbbVpmhwc3+pob+b8vdDBfC62BcC+gaXq26zbaHh K1BWvJabzbkX68RdUvwfLeC02FNrH/fsTLRbNAr1VclhPpCpkBP377Eg82rtVc3icMgLN04H+RjW 5WNF5hVJhLJRnA2m3xb7b+cmk3smo0j4e/u4E20NL35VtBDGypQokKw6l9pc4BPCt1wQvoHEfzQY kIOyGnQaKsct1u33178Nu0gqh8g8HyHYtnhTIlW3bfV5AyN+RfbCxov+vbBzTLacMRIPKm2cLnX2 F1bOuK4WxtzZdBl36WDA9LcBgynLCV9Gr6kzwFjT4bFZYQZbzhfKGgeR+9bA7mc5ZwurjnTV7dZK 2MfwUjYkydpQQRFrpQzbpbMJ3KRB977A9dtsys38CvVL7nOULAXbzqU5BidRTj/K6M71q5lEguS+ Ts4ICsrwqDDXpHnIAwjOqMWOegALmMJwiToWYRxoOlQATCq1s8IHMsBwbWgbrXb+TcTtoiwXj/Td 4mk6cnSXNnsxsktyIJoSWZ3qS7mZnuDubC03sCYDMEL7EV1mI+8UOoKSosFWJLlRNRpG0byD6UoY i9DT1MJIVWk/fGLyYpRSTgxQMQWTBqyIf4468VwRZhyNJz4DiiHL7AsyKeT7Ogd1qpU85v1nsMdh mkFpdOfizQnPxZcSfuEj+Y2UFz28wHMsWzgnP6JgZIv31wbMIMlXwx9JNJGLdGx7q0PTYFu9TF4Y EFHOrZcNSiAZ6VEUmsbuQZex1uwWTBbEySf91NXVJ2zFC05sGWjkStjtnxD7Y5cuKQ8RpdkYVZ/L pqx27HiCaHodRa0PP0LRd5RpcOhOnEqLDzNPpno0sjQj1hFPqX9ZSdLlE4I0Xs6XXY4BjS/a0zEw qBoOi7scg/lW0LcaBvUTLIz2Qg1p2dXskZXWSxrYhjKwDhZ3VXv+KYFQpSGFFsc6a5Gaz+F7mdYA C4PvxmF6SfNtQL+nYbSm1SbTsxas46lfcmbaMrt3mWcWeSiMJW9hwDRrTQ5bHGtlEJIwC0k1cgyq weXsgHbUqFDtIEQXh8Iw0PjGPyTPAE0oKh8HbUfxu/JWTLGqLFbPgsotKj/TperP8V7ceW22jp/3 Ugdy9LyOLWI5rKxfZUSZu2GNKFAMnEndg9AlOdGFAV9rV+8pB/KlWpNxFeUjcqAV2bptuXoudlW7 VWmob2TsrAPv713ZXsrr7J+ZsiRH8Ou9Bsd8DXfZHS7uz/BeA6M4k8REkDIDTpV7TU3uNDUwqit3 milIZdo1RkJXum8tjLllp/IJxywZ4yh0cvVjByUmz4UrXonfJ9HLSYTtrZzF3urPjifOtVm2o5Iv e1NBS8mrS0K4MNj4QLEgznAcZJX+pDMEo1JN7lKYRpTT8ahU7VYO2Qkcx+7ZaUofR1NSM1WxYYjO vOcl6eF8kYydgDm6RhZOOrzWaodJl/HYwrgbuTAwMvjGigOmZGoj+KcadIlxPkZLJzMJjFtfZs7R wsdwWC3so9BRhO0OoGw0bNfHvajad+K5fi1h7t6J8g/0YnSJtLZml3CS+Ce47Gi0YYr5M3/bXUnO ReW6JHdNTIkOJZ2w6dBxHfx42B+s83K6K8/zi10CEWsPNACT/8ksbcLyIMmXczi/1P9k9bqFMV1P MFWjY2E5g4GpVaimQouLPM5+0MaYOvXSVGfk8T2bOeZaJGk6kJt29QwthNxNLdrDy0vdgJt3K6OZ evmlYvNUNyinb1vxr+/K+dNcHFoY9svNiS27zNi+bmpOHHHTcJjMOkdjTCIuUAyI+7ey+T/Kpzdl 2f7rexQkVF2yWK3qLcrW1HZ0TdZUd5XOGN5Liec8B0axZJjLYeJ3WlexEAsMz5iRYcjvnt9OPRRK XUNJIx9CbV9KO0Jv2x4C10RnEt6Owe+rwk3yxt/za33Y8PzZCeofs29ISZHqFrMRLBVqqNZOTMPh GMelZvyVGeNM9duOnoHcnghJIB/TZxM2n7Y8GgM7QQ7nM6KMor8uO8ERy9NPb9tWriSBRdGWx6RK LAxWxsEWpvPWfBtQakZ345I7ZfMiCVww3XlrfhcLaRjWNG1kCbp+1bjFJmDfGtgda1dZ4nUonGHN jl2/ddF8FNX2ZVNuz2Xi0eDAxTo+GnjtUB0ofu0K1JlbTNogz9HWj/tX1B5UOgNdUOQUouue/Qb0 v9MlJ+TriF/E9nOpvh89sVPMWT6MvW5uLIFiYCyVEn5T6aKuqkXNHtVevBateEIpp2ugacpHFJ2U u0Jk1/3O4vW5Wl0R2Lo8L9vXnYi7iD239gzBmOSJAMWAuI9FtWkFt3Ng07+iT0m3SaoCnspo9zh2 V5brFjTeNxh9vJx34anA6GAKc8Z2di/yLu/uRS/QFdyPPovd6hnEhBM9qJ9/KTYVHL2ugZzRe1df owoowRuREWc70eS8TX7XlVeBYRCENTVSj45fJitbcC5Vy5y9ZVzhEZTZ2xOK8pilcBptGQ9zqudo tGM4rDXyUXDdTz02JE2d5kI1FJXJBlNl9GfNJKTMkLuFWaEuVpK4K6IDp9HYvu4kcnDHBjxyDnEn aTSgGIjch24Chqs0zMGQn1xskHehFsGulQU0p5RMs6PZiSsoaicbZmwzl1KUSYGZK5rl0b0bBSlT 2Fdc32bOetZDrOpQbCb6hIB7npCVOKw64LvEaaOpgUaf/frVQDtp3T+AGbX+bzgi76nJ0GE9cRYv 5nDp4R6Jrp6yjjEwp8IGN2VtQW7KmkAqiLCD0gEDUbxhpqzjTIcMWE/nfi3IfozOvMiMaJspawa6 JB3sXb5T6TKMPC918kX0b/1rCQpJ08f/LwLDMWsdcwuJoWW/lcjwI+j2xbmE1/kL+Q//RMPY5Mvy pIZmzMJFjBY1/4KY5zA5Urcsjfko3Tph3iaIDYhJDUC6SUJ/GNBvub4JJzVxbvomHAoNYlKD39Lt DFZqHOjWUiNlNuAARrET6mui1Mjs7s4WTjHEQe2Q1jcVv6oHav7+8f1vCMTRoqiGOmk0aFvjEZdX lM3RfrWu2n1TfT5QNI8ZsWsCHEreYSxjpjfGKyJX0Jd7y9ZPkJG8u79FOAaaTwXlqMESEc3rP++6 5MdafKZBLHR4IJ26EzIMUR0pqTN4T3147R7xEaykbbybxmbOR3KFAr2v+5I39fywWwfo6Egepr5/ Jb34SaWS2t+G08h7en3jFcUX1FugQn9cr/FjrTzad2KLMbhraEusi3Gimd7UXWmLWb6h9rk5bYFj wLp184SWmD9VHN7StPxj9YQiJbFy1Yj6tZfI62phKrlErG5VyuUkdi0rNMuIvd2XxOndK11obh2W ujY1+r4QX8G+l0Vb7/QUXE2dPwjHUFPcHNCq9NJUX4oVXjI4l5qjGUtJrdYYmgTvYkcDxkKM3WDe DzN/AhU3vJsw2d+AmetnKpj+8U8+Xb0fSyMwvzbGkE7f6TwnnD6GxEZO0sehO/F+/eWv7xHfZr9R q/8KxhEpCvLVrO6+aw3MTFXiPj0ivBMw1KrvjcSy3m3e3rFd6a6GUy1ZXjwhU6olYahZoRyw0PSr PeYZSduWPXKqV+SFkAJa11BGVdehPplPPb+YKxqPfuwwnmNMhauxdyyihQ72oiw0r3bFJia0MLTr chg90oV239637OEuG5hPbJ44xtBMapLk7v260sfRsxCifWnKAgnzz+VbDfVT7WFLmsLYakjUy6Z+ Uw9ofa4Pu3VBCUDGxOe6Rbgy3BtypzO9s7valSS/e+erBI6B6iMCO4E4qnymPwU4akzQgzIPoyVF lf5RVeoWg3F8LxNVzjH+demfkaP3Upv6YQN0jqDCiQYz2DPz2IFyzHVX9RVOtssY6718hZs85fG1 8RFJDxbQk38Rpgqo/o2BKLnQ3bgGhoEoBrO1bvathfFIOJioPDy9PB5RpYmXSrq5WwocA97+jEfY qPfqKH/3ewqmqYhR/iZfKSQNNsMLccPjqp6vgtq5elNJk9CNN9fCidCtqYRucHKKFd2pT2DxzJx9 rU+dZLA0p+YNJBSxLOa4JJpCRo6BdgM0zOHlE/Na6QXDGoi6gAAvUw0QqCw5O8xkscMAlxY7evmj m0NEQ24fRg+LcJh+Vaj3LXtpSOpG+CCKMv3SEB4gsWtqGNbkMP2qkPlW0LfupaFLmyhdVoAZ/3Tp 1dQns5enIkZ71ZBvGkaV36h2wjHfMhWMAw3c3btVT/gRTCo4Qqj4j26ApUGnzCfoQuMRqWnRH3dv eMDhiqYDSdUbiVd+Zxr9tfbMpHARDc5z8nFdbcWAIFYmcUwg1W7sEr0MxGsrEZroqeGY1jPutgbR ehaEH7pxPets0zOOHYjbRjU1PP3prlGBypY2wL+0xDlqhJjM4kWFAf+dE+Yek1oX5gLHwDx8gqVD ThKe+WQFcdSBg3XoRkgwLT/EBQfuTZRFY4fQLzAP9uEtGkJnCIbm4YQN9cjF/CBmqf07WRdvkE7y wtcYb9jUKKpbx5NeTG8gt3gi4k/qbDhjHNaz6SyW6Z1zWAk9cc5jd8V57/4va+Cd02GK17gLYEC4 863WeOgLcT2CaLZC4EgdhRV+a422t6at9pRW+089X+JyHidIoa+cibd5ex6spPb2FYU4bd1T4r2M hsX5nngfjeQmTG0fu2gn/9jEQP7BpChVUDMOqpDqnQC4bxidfFGPgBKfdyHWH6A63ZIjt81bXEEf lrD06YORgOlOcV+g+20L0vaHSZ8AzY5KXYbFnBK0F/K1XNC0Y3N2szUx/6zTtW//oINKvUuA+AfF ACXDYtxnO/5OM2zUIQGra0Y/1VybbrbuwXSPRO9bDSPDq010gFyiS5LpONfCKEnGYP3H7YF5aTon sOKNo9vlYhjuaR5ntz8xVMJt9FPjLGsCNANhG6G/ZTOXNehHuGaOUCZRV1JH0sAkEiwMSQMHk12N 3Y4gBhRxqOcKujcHrOBelDPoixazITmCwnun6X0caua7Re2PCiuq61mNFZn6yvaw2VfIEFE2uVk7 5XWu8LrnyGS3B24rbtRjah8kIxQDVxC1Y+hfPeAOjwNW0THricN4vgX8buRJ8bzfTB+GvxXDeHTa uqcMX54NA8We4bsCibNrPo5n5JNR7lK+GerBFDq5yjvch4+owiM3TSatoOcViUdQjNsWzTW1Y/Pu PwirTn0HLrEvvhCKAZec8VCd5w1J8+8FqL0PFj6bw53Zk3aKaGTD05nN26/TPHgR1svETxaOo+tm Xl/JTdaVoddQce66TuhGszN49Gjo6P0PMuTlBrFLuUdHMCTA/vfTHy94jKQVfysavEAi39E/6STt 35offv0HvbOf/Xa5DnXVOL09Lh2ME4xrQj1fKdLl2TKdJ91DFQn1uXEQJrs6EP/ncOyH/X8hx4LR lbnU42dmPQNi67l/4sF+6EDk5lgwtqCa3TBIbdYzILaee67YfuhAfL00T1Q+hQaz9XoW5NZjjzia 9Riotx5qlYPzpgbE1nNPHdn1HKi3XrQwDyzb/RmQWy/Jo+4U9HhRd5EMxNdL4OsN9mdBbD03+GfX cyC+Xpwh06QffNL0syC3HmvsNesxUG+9JDW9w+a8sQGx9VzLo13Pgfh6eIRouD8LcuupNHiXzDLr MVBvPfd0lNkf/UMj2uPTIGSqZXdr7j4YqLdemHcPvjj+wz8VZd+A6UgasOSd2R8D8fVklgzPa0Hu vMxJtev1/daf/w3HWoZ2CmVuZHN0cmVhbQplbmRvYmoKNTAgMCBvYmoKNTY1MQplbmRvYmoKNDgg MCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCA0NCAwIFIgL1Jlc291cmNlcyA1MSAwIFIgL0Nv bnRlbnRzIDQ5IDAgUiAvTWVkaWFCb3gKWzAgMCA2MTIgNzkyXSA+PgplbmRvYmoKNTEgMCBvYmoK PDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0NzMSA3IDAgUiA+PiAv RXh0R1N0YXRlIDw8IC9HczEKOSAwIFIgL0dzMiAxMCAwIFIgPj4gL0ZvbnQgPDwgL1RUMSA4IDAg UiA+PiA+PgplbmRvYmoKNTMgMCBvYmoKPDwgL0xlbmd0aCA1NCAwIFIgL0ZpbHRlciAvRmxhdGVE ZWNvZGUgPj4Kc3RyZWFtCngBK1QIVChU0HcuNlRILlYwAMPiZKCQgZ6RCYQPYljoGVsamCmYWhrr mZtZmigk5yo4hSiYGIFVACkjc0s9S0tLCwUTC0uukFwF/ZAQYwVDhZA0BQ1FTYWQLAXXELBFpJlq gWmqIdRUBYSpgQANnyl2CmVuZHN0cmVhbQplbmRvYmoKNTQgMCBvYmoKMTEzCmVuZG9iago1MiAw IG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDQ0IDAgUiAvUmVzb3VyY2VzIDU1IDAgUiAvQ29u dGVudHMgNTMgMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9iago1NSAwIG9iago8 PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9G b250IDw8IC9UVDMgMTggMCBSCi9UVDEgOCAwIFIgPj4gPj4KZW5kb2JqCjU3IDAgb2JqCjw8IC9M ZW5ndGggNTggMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4Ab1c25LbxhF951dM 6cmuWtIY3EjmbbNSHFfJkqxdVRKn/ACR4BIxCdAEKXn99TkNYGYaMzAJ3hxX7FVrMY3p6+meHvwm fhK/ie8eSilmpfCqf8oZSN7ID+s/0w+TUTD1YhFNg9E4noZithZ/fxJDb+R54Vg8zUToV7+M//jj 6Wg6nU5EOJkOntbiu6cnKaR4Wohvfsh36TZPd9+Kp/+JN08V6z58zOLhBCwDP+hYfHjqqubtB4ZB 5EVgEIfEQLTf/vU2WewE/19vjoMD8ppG0Uh603EHRyGuwkF62JSUlUbsPb17FD8XeSpeZ89p2d4d 7fR+/7wH2fd879vBuUrzPWjNn1ZKU/wHtUX032BjckZTxs5C37Kza6waTKNLV+00MP3aATlOyz0g 76voO4BFedIXLocynRX5PNm+iD9I6fOs3G2zz/tdVuSifCl36fpO7Ip58iKynchKsSnKMvu8SkEU y+RLer4NSDJzf9x6qXNtwMi1K+wEnmcr7gS5OpGNxQYtV8+zNLfer3bZBnJapV/SVXknNGGTbHdZ CkqSzxl1W+yKWbEqRZZ/KVZf0jl+OF+42sGwd/VmtxGuHwU3Fi44qC00WWO3tCy1WDTmm+ySkRBP S1jqrFhD/r9nO5huvtsW8/0sLUWefhWbU+XaaV7afl0JrBKw6u24bhxT0dFduX84OGS2OuL4yOC3 jTguh0WxFZttgRiyLimKJNusTCulpSoGVYkHv7NLZzv8DrQNDabPW9JlsThVeyZByCmlnXGM7KX3 fRuvkJGNdE4J5Yd0p0IOOFiqm8P4IaxkJxar4ivJbVvsn5ei3M/wryqWl6MLhOdDeDIOBON8rvCM SrQpSintOHKqBxk3ZSFaMwCCa5u6HBkG3mgip7E3nhLK9YKpL2P6qaJNBr3hr9lXEBASxnoW28E3 geHaD1OzRZs0Xq05YDA6NGueB9gHLcAeEKaWsbRfXnwzCuCpH9NyU+RlKj4Uq2z2UsFFE+4Gp+5K epCV9H2XmzDW+t33qEeeUY8cUpSAolCPRFSYxF48GvsoTNZiOq1IA01aKVL1W36I3wKJPdiQlmIh JuNmPSnrQgfr1b85iBWJPQySP6nW4w82JFpP6wc78mlHR8TVFArGCLRBSwctGivot6hxmC7YNAw0 dGjy7ikx7FCBo2KYy+E1qo9O8yLs+SoR63S3LOZIAiL9fbNNgUXzZ0EP4efKJo3FHBGBk3V1cmBv dW58OyLY8dgOdVfGo8OxbRub2lWzHOl3nVTwPsvLbJ6KcpPOsmS1emHe1k92nbuUPlWvSE54B2uX qDRQXexnO4Bb0hlVHOVoNHol/vvxw8+/sHB8hL/rEx7VEqjP3Y33R0yHLFY73RD7s/LI1b3CZXEv 8v36c7olwydcm+SoIAhFfSENQnhikaZz1BRflxmS/SzJxecUv5mX+zWE/fnlGm7BXutGfiHHTt1+ bccAC0t9ebKGE6TbLxAvlWSLbJt+hT+QeFEz7EpkPCO+o/nniOki7Az+rE9mXMd9y8csn6HoXqZI u8m2RsrQ9/2///ERodG833H21KZj2YQ6Qf5EiiHj6apXpd/Aq3OpiMjL6/SKvlidIjVtRZ2rOudG UTiK6wTLntU0yoinJcLOoGPcE5DN0u/V3dNlUSx2aX4n0DYReYH/pyj/StQ1iKn7Ev5HJc9um+Tl OkPGKvK2RV2hwwpYXqFVMcTLWVH3X8sMbQiKEVW87Y0RGkvtMhVXAizKKlPp8JSBhtSE1MZRYzZh MJqQiaxF0EA1ESnaqk0LqNW8Uo8O6Nca0jnYql1ntTEwM6lYF4u3wkG+w4JCuFGVliVJ0C5PSJb9 3L7Td0IqKvxJANuJY8t2Zul2l6APdWJ3vuHTFiiZqBfFk4qP5aMEPjQPjZCPbOpQvh5T0z4GHnAl i8RYZs853PJrtlsSEHl884AmJ/WUqIIG0CQn/m2fbrN0fn5klRPCJFHceoc/j6xaxV0VKKlYyqYS iQJ/FMEPBmshxxYNvtGieXUt0nq2oXGHGfSMwW2H+ZNTnmEgb90SJBaWCc2Rtme71UvdV/1a7Ffz So+k7v3n/+HvqNlUa1t8SVYZlE2h+AIFj0nBoeAv4+r3iBE3EmVRVh2WDYP4xh2RYehNLCn+NT2R NuMBHQReoStCq1rx61Z9kfYGqpPMUYis/pCi0wzb+gPRpT5Eo4jyCHCZzS45KvGpQxLB1JjGXFM7 kHlNM4v3SEJ0MkJkXkQSlXgViRoiDawLp/5oWudd1SNhJAojqtURTicjIL9qvaabokiswUIkz2v1 SBiJh6UKGg6O90gOOBGymzHxytJYpunnm51Z08CDyLt50QIWZhP1ufnD/bt3otik22SHSpCS10Hb E/99+Pn14y+qQESOS84PfEAggCGTSAzZi7nmeB3phjaePQXPO/mKNYZ1EyoK7ZJhm+KYM9sVOBVF wb0rNgacHNmU05kYUyt1gqPXocum/3zCIagzIagziTo5VIePYl6sAeLEH7SLwQlDFp2GLyVVfshX tCEr3NIJ8gLVBpXMn1BSl8zXjuGbnm3j7neKqYiVZJCVLnlrfJsCyWFgIZlRUQZl9tZlbTzMYpjd OybDdqrCcKCjZVzXuwiz4bQpesKGhrjYosk60LaebWgUGRucdomwWOTCiMnTmgvrIt9iXQXjW1O7 CUihSg0WULsFoCzL5xkaWftkVZeoFYTrraZDviHpReSYDKPaKx89qk7KaIQBrbI0F8+oz3enxsRu a9TAH0wtDwEuqA3RbO/EcochRXVM3LE5Zo79IlbnTnxJfgXJdXCgJpTZBNk8JepjXi6CQAGDECiA qpO1iLymigkb2mDFaeNRXKMF9qymkVOoRkIYBaonpX51oGloJGjWka96UuZRTWJudqysPmR6xs3i 0D55hA+0qnvhDbxLq3jKAr6HPh7YWUaXNPM68+JrviqSuVHbEdtABKRmpTE5k2vcTVnW8CeHdd0t oDCUqgVEJlcd4GkaSlpOs1pA9Gs3bwHFUwyn3XQya+iyqAeyUEAYfWn3uqwPZBQaETwJJ2hSgL9l Nkyhx+2kPfzJkialZi/yEUPcHVJftGkxUaPUnCGbU9LfaKfnjZ3qIceGM090ACj38zkdHiatoRNk IzgneuxVA8EI/ogAHNinh4M6ds3kqqCC1qtp/rQdRYYqRAJ6U/MHYROH1I2nKNqqTVPNn+bZQYjf 62j+KFBxLNq1wXS7uWei3TiwewqngIpDEVWDCpeFOgmjIocsCcizau4lZblHXqfBryrdE/iomnzL pO7yUeo/Nekb75ETuI8P52FvdKM6aDxxhk+vfTQGFlaQWxfzbIEmKJ1XmPasO4HRttUjvtI2o3YP 0fSI3f2+K06eEjeghgUk3Rp290sHbBifYnvteTZzyGzJRjDMjeaNy/Dn9+/e/PgaB7XUrUSnMpnP gRARhCpDNgng7EFr04RmzF0TPRCH2p0jHOw3McermzioaXAa1KahpmE0BC46J0QWN89qGu/2XLcJ PQlu3oQGC8thUMmkmxT/ytGJrnoHCDiVGqsDZjqJV8fKNGDNjp4vmszTBQd7I1fJ/fzSRDcT02HC N8EGhsMUAKENsP6iTnSL8dU60VjVEtjNOtGtDdSd6Ajx+vs0R29wJT7st+hloTtIUyOYtIXVPSzT 2a8XJL0AiE7GAHSMtWttvUOK6pIE8WQ0aZrHTUBRJGoeM1JYl4P8wYZE4UQ1o4NxMJoi8lBzu6k5 FYnWYyRqgYPEH2xIPDxdoRlNWUBb+U2a0dLzHRjPk3e/GNCZNzX8Ih5mG5XJ6emUFpieJavZflUP m80LYDA6V60DpIAd0vweAmX19xeYo5rpHjbvxWE+S+Wn7pxVvSZMSZwpW459Crp1oA+DJUy8OLfW VlKJt57Zu6MrOBoqVIMlQAoz1dAc0LW984slqrFlAJTSsUcKHam5qzIrNjR+htZ4XTwZvHTkBdwy SQFoYmptur/uDqEvpjuJme62XE/R3SEmRncuD5xKpxld51lsizXuVy0W6RZWL8piv0VdcieoBq4F +lzFbJqOBEzQv3kV16jf66augRmkm7sGXT9oqxCVH/X1ceRwvhWaFgXEZDM42Qy7AJREJ9V68ZPX NUG5OzT5US8Ida3Okb7gQBOxB9DOkZDQhEQjNONL7rKR0XHfrnk75LabFvqaQ7UFSz9/Wc1r5q86 BPkRp1cYbFkjYpTibZI/75Pn1EjhiHAPxSxKm1IGgHHE1tr8U7pdZ3mxKp5fGmbILieK3KiUzbW6 OmV+cCpkHGDiexTXZwgKH2qSgYxE8tuQkZEI4vkYI6SeM19QT6uyFVu0Zkn1rGivOVBoEghU30Np MKcmGRhKpObSCX+QSDgMoXfUI1z6aeoAuiu2aM2S6tkBY+NA2x53URxnZdkVVYEd/nvbadtJ0RJi uIizwCF3O/pfP4EHDo8nlPC/pi/oCG/nuIPy46fHp1d39X/Fu/fVzx/f/PTph49vXhP98Z/3b9/q H+rfOD+FmyNnHGXS7m+awjF+a+vw6sUDeFhKhMjef3rbCI9+MmJ9eP/jj2/evYZkTxVhZ7aU6grj ULpbhe6gTvHxjWFKar7/D5SJg+rexuyAXF9fTiGu1uZZ+LsgmDMnCcPbo1yXx6v3H55+eP/u/u0r nOaji4oBo3kxw+UTIF2qHVCooL1Jt3i3KPsI4qIBP0/LGT42gD/gmb8/fDhVxybD6OvuQ1m/203d BDNyN3cT8LAsRYa4JvWPB1/K6S/VTxM5Dn/BjR+6ekCTFEWOnmP9R5xzvIhks0mTLckWt1nOl62c ojL0ceUUsq1e6qayjcLb9y/Aw5LtLNlku4Q+0wCzLJc4JxdLlGmsptAndNfCz/ojL0MMdjp77h1t DqXkaGLPw/aPNj1TchzYZ0bXT8kuD0rJiCT4fsCHbfYFE5CYNjvVwDsTBDXSvWnVBQFXy8nTO4Gr qXRRbH53qiAZoMFnd4C8EaWHKDZt6X3qrfhD2F4i5WBeuJNDjjPR6vqD3sOFjSP6ABOOu2tmlsgo LD3S/dJFNqv7gFTQXGWPDBm5YkTJNO+vIjdj04wjAG2nANm6qmBRU0S4QlxNSqPlHKlDMUUTmGni NJqTBo0/2pAImWPl+nI4hZvzxh8YJognDnS8BNex/oOp1sHDVr7K+7317QQzM54i3fWZIo5Ap0PB jDV/ajHxGUEHsCwyujjEbkT1nMQ0UEXqWX7aUisPDb65YEtMKazedqVGGALzyDG/bt23snccRdLH 0SRALWKZtRnBN6Mc5WgW1e6AKrip7DHcVR8vS0XDKB+nUSGOIpk/2tTm59S4zh6ZH+F7Ei2FtfZ4 xAYPxWvOwrm576MTRQmvmRVACqo6x8hFM1Skp6Y9Zojqsxu4+VsxvQjXmXXZZia+PYp4gYGzFMpZ jG0sd30AMnF4VB+YwqfTqu8oqDLmVFV0IxA9LQJzt2FhfdGj2xBwOpTPVvtqpi3bsVG6fnZp9GdG 1+gNbm3vU3yE8NY9HZcHhppW1ecSABTodja+iFHXUPxMsvmLxv2eXjYp3RvcVw/QlOCp+jYiZuVq /W4XuV6nHTEXmcY2kj3FRQ7lTpP9wcNSo7JS+jyBiOmzQTyIVdTZClgUZqtnZppf+vj6/ukex4uX CFjdUMIXnOjNbilgTF3fvB9APCwBwwLpqzd1MsApI5IBDhLxTZcSRwU4m13gb3Abhwz9b3QFEd94 uROPsyUOE+7EP5Nyeb54zadymve6rXhjZ/roEvTK8oi2X3wPzj6fu189F/jg3BLfv6Qqpv4aKmsI nBpWqYsiPSrKOpj1T4sH4AnOGO1znCuti5unVow2kF5Bu2A6CiL67hZdU8c5A112wuDjmJFQ7mgS vs7VHE7oBw2JcJsiRzFAYz0WpB5WJLYeBswxx15VVPpBQ2qt59UnLez9oobE1mMXXNV6jMTXC8fe iKaP2HqKxNfz0Vhov19oSK31ZP1BZb5eQ+Lreb4tv9CQ+HoB7pMTkmbrKRJbjyatmhkqtV9Gaq3n Yb/Weg2JredP6koYJLUeI/H1fHzNIGjbiyKx9Qj7N6BercdItN5P/weNEfj0CmVuZHN0cmVhbQpl bmRvYmoKNTggMCBvYmoKNDU2MQplbmRvYmoKNTYgMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVu dCA0NCAwIFIgL1Jlc291cmNlcyA1OSAwIFIgL0NvbnRlbnRzIDU3IDAgUiAvTWVkaWFCb3gKWzAg MCA2MTIgNzkyXSA+PgplbmRvYmoKNTkgMCBvYmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IF0g L0NvbG9yU3BhY2UgPDwgL0NzMSA3IDAgUiA+PiAvRXh0R1N0YXRlIDw8IC9HczEKOSAwIFIgL0dz MiAxMCAwIFIgPj4gL0ZvbnQgPDwgL1RUMSA4IDAgUiA+PiA+PgplbmRvYmoKNjEgMCBvYmoKPDwg L0xlbmd0aCA2MiAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBnVHLCsIwELz3 K8abQo151WavikdBIeBBPJQQX7SgxoOfb62VKvZgzR6yu1lmZidnLHHGaBoEXACvIriyxZnUz/qR GKaIj5GQYumYNFyBiYWW1UR5yZQYERloQ5EtMLJWQMBu0ccA9oiZrYh+QR1yxrlOYV3URlD2PglW PgSfhxj+iixnaM7sdjpcfMA8u7g9RAzJpWie62y9yHYe6WYQddP5Jo6bcjFS0I246M/t31BfnipK ak9V7Wmvq6cNqvlGbfmp5R2M73ICCmVuZHN0cmVhbQplbmRvYmoKNjIgMCBvYmoKMjAzCmVuZG9i ago2MCAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDQ0IDAgUiAvUmVzb3VyY2VzIDYzIDAg UiAvQ29udGVudHMgNjEgMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9iago2MyAw IG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBS ID4+IC9Gb250IDw8IC9UVDEgOCAwIFIKL1RUMyAxOCAwIFIgPj4gPj4KZW5kb2JqCjY1IDAgb2Jq Cjw8IC9MZW5ndGggNjYgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4AbVdTZPb xhG981dM5ZK4oqUw+EZuimUnPlhOpE25EscHiotdIiHBFT8sK+Ufn+4BiG6iRxTABqUqS4KXb968 menp6R6iP5i/mw/m5dd7a5Z7E7jf+yU8CuZh3Pwb/5LPoyJITVJE8ywtYrPcmD/fm7tgHgRxZu6X Jg7dD8MfYVbMi6LITZwXs/uNeXl/b40194/mD9/Vh3JXl4evzP1/zDf3rukh7RB4nEOTURh5wO/G ohL7GTWQBAk0kMbYgDln/3q3eDyY81+v37wz/9rWpXldPZX7/v815tXx6QiPwyAMvppd2+kwgF6H hev0idOsUdSM7TT1lMYpDnvjNAVqVCRaVO8AdbQjnHhn0wuGZrAcswszOEpgDtjQyBZemf/hYH// 6p9mua0Pi6o2m+P6UD2vS/OvH9588/1r8/bt3hy2Zn98ft7uDmaxftruqsNqYxZP1bo6fNJMgwim QZ5wXtdOA5LWt3KjIOiP3QhphXFgy6uTNgh6g/fT20nGLsb1GwbWQB96LXz7NZiu9GezqB/Mbrte b38pd/u5MT+uSv8wLnaled6V+7I+vDDlYrnSjB3MqRBMCqN1m7ELk+jGYwct9JTdoI3bP5fL6vGT WZhjXX04lubdclVuSif3Xxf7lXnVLYXDERYMKP/dwVT760W1OdrF1DBCN9I0SG+tKWyu58ZsVy63 m01ZP5QP5rBagCVpbE9VL9fHh9Js6/Un+A+zOy9A+HW5B/OzKt3PXq9sGLSmJiRet5HWJn0nYYwV H2JqoIWetM/H9+tqvyp3MPsMmHDU63m3XaJ220dz2C3qfXWotnVVP6EtX5ixSnrNq03BNoU2MbLP dfnxtFwGW8Hzvs/OfLDTypB93+4MLsbBrbT7JHMbgtaSSexpdt9ug7cWfJybbvCyhc5GzZlCs3E+ Kg5zkISZkfCjJxLT/eRWg2/aqnKjFZn1bF04t2Cr32xrJsmg4wGR77xq2wefyGsHcxXA1m9s3ydc PJe/dq4ZmNTdw35wN8TctwEMrbW5bGb01Cdtuvl+F/U9ltGoXrtDDWR9dcbY2iEe851o4X4FNpYU D+a5LdIgK3BNBVER2hSnknuWG93BszsbAoveFG58k2q5QKtujgfwxP9Xjp4IXnUtbpU2DI3s+8N2 eYQd/OQaVeUD7SMjT9o0XSx20xYJttfrJdN57PmduegWF6stCk+H2BFnvQUxwTUBxwS3Txrhl3/Z 29kThBJOI43j6xvpEPaRxAUVsnCe5xBU2Jgojc6fzdbnz+IAfm4NHh/7bPtsZR6NDbvPZ/MidJin n50lWfvs7PPZPI4d5tln22eI2Y0U9Cw00LMPg/YD72ShpWjDBMz4jAVH3MkSzRXfesba2ZMdvAP8 m8wO1oMsPG1EbXhncmtiRRNjdiFhvmNUJ4SldCeBh+9Dl+xgDPMyCPPI18LZTgRBAjxd1tuDedzu 3lcPD2X9wrw/HkZ7CN55ZrGrNs8cj948WC1+wYbNplw4B9c5wHAMGxqTE7KGuCuGufV1mhmGL5ik S7LSpIOdQj/pyJiewhF3EvfdWEG8AxFhvNKmoI1swZ2X2z2pbWyGwdgh3qa3sRQbS2Ow3NBYb9S1 HlyOayeHGKQHe/jaOT+zQNyY7Ts5rp0iin1S9dfO9/94d2/e/HBv3pfmeJq6OvG605mng7DPwSod PCHaXtI0sxn0DaLoHujhC+SSdmyBpP1AwuRWORRNQCCtemxn8mn3GjwaJBObv7yJGaYORutEsCRO ZEVsbOyg0sJjU5e1AEv9tmfWu0g08fq4w0jFQ5OCWC7Wy+PaebovwM7X5HMOMy0knLXoCeKKZG22 h07FmmcRZ2txn4py10LPYvXXPO6Xg0fr0m5iU2gUzTHvVuvCHHalc2upoc6PvcGJxaJVDRNwSEDg XvfX1X8xdvqJmIwdvi6I50FnSqLDjm5tHGet7x0UTZJvY+Li5Gefnq27Z7MEnkFIG/3xs8+2z9B3 7lzmy5vapdGitRUHuX5t0ezu9n6J+8Ng0S8xp71ftgBnpuH7yaVG6NArG1nwk/cXZs+lNhLcmeM4 NXeyDQioVPVix6ZpMMMT0+CjPA0IbpJBloGvxJqZNMaVoYOUQ2YPW+itN8jbgY90vyohgwGWpjGm eMA9uRdfzla3GlKPyA1nPWotzXADemloLJ44bHGuWdsCBF4w1YXH87dvMdSNp41d+bxeLKFftC2c DEBn6T53Yu9OyDFcA3An5I2xeeGsxqx7tu6egakI5wVeF4Bnp5M5e4YWImsNTFzkc0i5QxBgxn60 fXb28RzuHDhI/tH2kTivYyTiCzNf+FVsf2LGJ+mfp9/DRBlsJ4RLyIyDQGbGeSx3r1OSBDc/qcsm 3DRbbdcPkGZ5+9Z5hbOrrnxkePLI4ODB2rjWKtDSpJFN4v5ZaXL9i5vHXRPRxD+aXGD56/O6WlYH SBbuD8612eLe87Haly/M75qA3u/glsLHxac9GIdHSIm7lBfEochCDJuFTNwuIsB4XTtm5HF7F2Ya xz1LPubAIxY/W0CdgwBN9BwPTM5CJgFs6257fFptIW5zwED3KeKrmO6QXgCXGDdb1uy12rEhOaWP 7tKi72pOPd8zcOjPD0HhPITN9RQ+fv3q/pX5sYJd9tvtbrM4XQe74sTIgu+8zelOjFneN/tTi5VH /dsUY+bvJd+gm7+yCXBzzkfjI44GxDhgNNBTKOvlFi8egAf5iDdlPu7/dL01oPMWIzLljIZrIH0T MHZjJiPDDADtEQVkc89nNAyS9xdr+Po0Ad5rCYoMDt5NwzxNgHcp+7/h0qX4HZmIcRl0/iJrAfkl CFhB9L0lwC9xDl8AlyYn0xb6KbUdy50GkO0S5GShmOeNBKAiXPEzsUlMajKTmwKOLQOeKRZCjoHy GKIdjM61C8HbYQooQAu9NeG6N1hW4bCyKSGgh0+JS/stTQkbhBOE0Wg6d5bQA/zHwZKI4x1NLw/u 6PMd0e3uMN55cBV8Wf5LCqzhiwf3JuslcTV80QziZW+fDgq+3W0UH66Cb4InFbyF4sPV8EV9Xfxl 2vmQoL5xDq6mB1fBt7sA5cNV6Itx2yBJwX5OzBf1TSG66MPV8EV9XT5uWr4ZbCNBCvFrD6yCbnfQ 9sAqZgOF9Ty4GrqorgvmeXAVfHGTDnIMyntwFXwpg+rB1fDF2evyph5cDV/U1zmhHlwF3wKTSgFc g51Y3wKsAySsJrdm6ApbEGJyvqAv5L/8uAp9u0uKE+tLZ+1p5wOMGQgM1/gn54sCT+48UFLUI4Ni uVEq1IOrmQ4W5QXncmp5uzjVxHxDtA+TWwdIKsBsSOBIPTVdlBe+YuDD1UyHEGdvOv30jVDe1G91 NHwj1BeTdxPri2c3uD/jxVXxRX0z/7hplhse3uAYPjlfutEnz1gqvqgvJhA946bRt7um7MHV8O1u J3twNXzx8AY3Jrw6qPiCvmEw/XrDw1sI35DxjZuG7+lLSj5cjb7dpRvPuKn4or54t86Dq+KL+ob+ M6GGLx7ewmj67RhPb2Hk96JUfFHf6eXFqxgh5NV8w6ah24VYJ54O3U0tD66KL8r7mUOLZvq2X42d Wl48vIXwDTQfroYuHt7C6SM7FLT2DJuKL07fzL/ahkfDhyVILMZ6zpMXkHoaG7b25gtYYFy08Zs3 v3V6+A6u/C7Wp3/5/vxNkSgpSF7HiyfAhvdcJBtYaoglG6yd4NvdFL0nTSXw8Ckn8i8s2SBxh1sg gcuSDRJXwZclGySuhi8YzDbZIHE1fGHKtckGiavgy5INElfBlyUbJK6GL+rbJBskroYv6tskGySu gi9LNkhcBV+WbJC4Gr6ob5NskLgavqhvk2yQuAq+lGyQsAq6lGyQsBq2qK67Qwxfvu+bdQ1dVLdJ NkhcBV+WbJC4Cr4s2SBxNXxR3ybZIHE1fFHfJtkgcRV8WbJB4ir4smSDxNXwBX3bZIPE1fAFfdtk g8RV8GXJBomr4MuSDRJXxRcFdskGiaviiwJj9EjCauh238Dy4Grodt+78uCq+KK8LtkgdVDxRXnx UuzEfLtkw7R0KdkgcTXy4rsMmmSDxNXIS8kGiavhS8kGiavhS8kGiavii/q6ZIPEVfHF6euSDRJX w5eSDRJXw5eSDRJXxRf1dckGiavii/riO1EmNg+UbJiWLyUbJK5GX/ymXpNskLgafSnZIHE1fCnZ IHE1fCnZIHFVfFFfFw2XuCq+MH+bZIPE1fClZIPE1fClZIPEVfFFfTG6LGFVdFFel2yQuBq6lGyQ uBq+lGyQuCq+KK9LNkhcFV/Ud3rnjJIN09KlZIPE1cjbfWli4ulL0XDJVxEN937TBVq4+feRPG24 ZEP7wlhMJvzWe2Nsm4wYm1LwJj0s8x5T8UIQXyoDn43Nt1BCgCWhpLi/aXBx2bkklMQdzdcrFcuS hFa8nVAjCmVJJPBwU3TpKxkSd/jaFrgsSyJxFXxZlkTiaviCpW+zJBJXwxemXJslkbgKvixLInEV fFmWROJq+KK+TZZE4mr4or5NlkTiKviyLInEVfBlWRKJq+GL+jZZEomr4Yv6NlkSiavgS1kSCaug S1kSCathi+o2WRKJq6GL6jZZEomr4MuyJBJXwZdlSSSuhi/q22RJJK6GL+rbZEkkroIvy5JIXAVf liWRuBq+oG+bJZG4Gr6gb5slkbgKvixLInEVfFmWROKq+KLA7kQncVV8UWDMkkhYDV3KkkhcDV3K kkjc0Xy9Dralb2fIJv74ubNI+3yaG1ZNuze9YRUm4lXVI84O4hoXO7iyY0TSf0XD5QtsnynYxCSf SF7H66byQpal913/MefVYfJCG707iC+ZVNf89eXYwzw/UYMdaU6+Da/bypuI+liTz94Ivm96fsXT I+/YUIHX4jCfRzY6ahw14wf7i3u9iG048PF7Obib4i6jpUgZ4PbXxFhcko8ZHBYRieAd+edjNmbZ iRADmTIJrNjE2L1RiTt6E6M1yCIiElfBl0VEJK6GL/rkzUsqJK6GL/rkzUsqJK6CL4uISFwFXxYR kbgavqhvExGRuBq+qG8TEZG4Cr4sIiJxFXxZRETiaviivk1EROJq+KK+TURE4ir4UkREwiroUkRE wmrYorpNRETiauiiuk1EROIq+LKIiMRV8OXegdjeNHxR3yYiMi1f1LeJiEhcBV8WEZG4Cn1ZRETi aviCvm1EROJq+IK+bURE4ir4soiIxFXwZRERiaviiwK7iIjEVfFFgTEiImE1dCkiInE1dCkiInFV fFFed29U4qr4orzu3qjE1fDt7o1KWA1dujcqcVV0UV73kgqJq+KL8rqXVEhcDV+6NypxNXwp8y9x VXxRX3dvVOKq+KK+7t6oxNXwpXujElfDl+6NSlwVX9TX3RuVuCq+qK+7NypxNXzp3qjE1fCle6MS V8UX9G3ujUpcFV/Qt3lJhcTV8KV7oxJXw5fujUpcFV/U111slLgqvqive0mFxNXwpXujElfDl+6N SlwVX9QX741KWBVdlNfdG5W4Grp0b1TiavjSvVGJq+KL8rp7oxJXxRf1xXujElZDl+6NSlwNXbo3 KnFVfFFefNm2RwcVX5TX3Q+UfEffD6TILwuBY7yvFwIfHGUf+PILqCvTawKLCWBFanyJffsaim+r cs2K646tV0HvW7dNczwfMVwpkY9gSiXxrasu2CTvl124Ih9BSQ/2sgxKTcg22Cg84ihg+YCFicLr s0PshZtNc3w0hq8zkddkHcI8URvWgCZ6iaL31cEc6331VEMFhKo+lE9QwgaqpNbl4eN29182HzwV k/Cl/5NUs7b0hiQPxU8HXgyvK1E8aOLPvGNsyWrKQYZiJ+UOltx3p1odVxTDCvGqA6Zr73wzlcyG KEf1ucJ7cdTWjoIbDLBNY+0oE6f9Z1CcrnvWFrGDotL0WSpsJ4pHuWLPgyoneBVlqz+N+tnz6Zem bANWIsnazdXPyTlo7hhvT1nODlj0llP54QgvCjpsORdXVPvLJeIubREpzKY2HyJ7DiWOzL55Q1F9 3LyH9fu4226aSuWz+/+YEYWovB1mXyGQHcZC3r/fm3c/vIKCSlgnyPz7Dz+9/fZriE0mP9OAfEFv kR+mco4QcRHTiXAHrx/4lkpT8DEM4qamGpRzo7XSPoPaa/QMqqtDUXVYP+yzzTMo8XbL9ZP3r0fc YP2INvbl8lBtaxPNI4jR/vsrLJBjPq6q5crNJFewvS26+hEq5TyVdbnDElvz6/e+rlKwTYnOtSVC vC5bFt663JnNsv5VrLPR6iyRr87g7MtW4dLGTp4KkOgZIvRU2rV5Zhto6Qxbkl6LwJwW2X2+bbq9 engvaQxZyoS1cO3c8HaCZU+kfLCbVPVyfcS6UFBBrkSXyPkFaNs3C6hW+/rN6KLprHv07TnWPSjI 06v+PNi8hVFbz9am8Tx3pSUNeAmNyeuerc+fxVBaEszb2WfxWWveoO5lUgQpmMRiXoAlBI+D/Wj7 jD4+w59zhTLXhn+0fXRDg5lDNKR3MBtxZ+3SvksrTLaxK/fP23pfmk253y+eyr3ZPprDp+eu2Nim XNRQqvrxuAZn8sfq0FbOO23WCrtJs6ehxc8MzPP4wgq/ZFqYO5dn4jA3Ql3RCLtextSFd2mfj2Dj ybyA0xVUcqwfxpotWmp0hwI60mtk+Pnq0iRhNT9kE4s1OEin8nPYizF1QT9jt/A8h1lUOTLtBr2C DbreQkG7/XZZueLorszliPrawiGz3TtWZR+HT7lLMrIpV9jbH+5lG8+L3aHCavJ4AMZZtyxxSS/c Pqpxcyg/3TSqWq40s7lgaf8gMnxM2hXqww0DK74yPHglXsRN1UUMvXxt0PeDRutAa45ZKpIaDvb9 zeZHsP/lev/ClAeoLQu2vvv1za/PUGpyb75f7MCNti9MiK+z7//66W+we5j85+s3hDDA4CfEDu9a ep+ZYSd3IirmUQI7e5JH87RxFmK4WpTxRxA2aB7NkgxCkE1h6+6D9Aj39e6xhYBE4yl0eKdHhMeK Yp8+yB5xvDC0cB2yiXW0/LpHhAcXoZtq2uuOCHvE8eDA0e9v94jhgQvVukEnfuhBMc/o7/8HHE65 vwplbmRzdHJlYW0KZW5kb2JqCjY2IDAgb2JqCjUzMDkKZW5kb2JqCjY0IDAgb2JqCjw8IC9UeXBl IC9QYWdlIC9QYXJlbnQgNDQgMCBSIC9SZXNvdXJjZXMgNjcgMCBSIC9Db250ZW50cyA2NSAwIFIg L01lZGlhQm94ClswIDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjY3IDAgb2JqCjw8IC9Qcm9jU2V0IFsg L1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4gL0V4dEdTdGF0ZSA8PCAv R3MxCjkgMCBSIC9HczIgMTAgMCBSID4+IC9Gb250IDw8IC9UVDEgOCAwIFIgPj4gPj4KZW5kb2Jq CjY5IDAgb2JqCjw8IC9MZW5ndGggNzAgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVh bQp4AStUCFQoVNB3LjZUSC5WMADD4mSgkIGekQmED2JY6BlbGpgpmFoa65mbWZooJOcqOIUomBiB VQApI3NLPUtLSwsFEwtLrpBcBf2QEGMFQ4WQNAUNRU2FkCwF1xCwRaSZaoFpqiHUVAWEqYEADZ8p dgplbmRzdHJlYW0KZW5kb2JqCjcwIDAgb2JqCjExMwplbmRvYmoKNjggMCBvYmoKPDwgL1R5cGUg L1BhZ2UgL1BhcmVudCA0NCAwIFIgL1Jlc291cmNlcyA3MSAwIFIgL0NvbnRlbnRzIDY5IDAgUiAv TWVkaWFCb3gKWzAgMCA2MTIgNzkyXSA+PgplbmRvYmoKNzEgMCBvYmoKPDwgL1Byb2NTZXQgWyAv UERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0NzMSA3IDAgUiA+PiAvRm9udCA8PCAvVFQzIDE4 IDAgUgovVFQxIDggMCBSID4+ID4+CmVuZG9iago3MyAwIG9iago8PCAvTGVuZ3RoIDc0IDAgUiAv RmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAHFXFmT28YRfsevmEe7SqQxuAjkTbHs2FXx qXW5ynEeKBK7RIrHmsRKln99vgbmaMxAIMAjsR6sbS2mMd1fn9ODP8RP4g/xxZcnKVYnETZ/TiuQ wnmUtD/TX/J5XISZSIt4vsiKRKx24u8PYhbOwzBZiIeVSKLml/G/aFHMi6LIRZIXwcNOfPHwIIUU D4/is2/3dXncl/Xn4uE/4quHhvUYPnbxJAfLOIp7Fp9NXdW+fWAZpGEKBllCDET37d8cl4+16P73 5vu34rfDvhRvqqfy5P6rEK9fnl5AjsIo/Dy4dNNRiF1HRbNp/U5BK1ExddN2p1ZPSeTo6RarxkV6 7aq9CjKvHRPwOvCK5vRHiIdNKd6uNuWuFF9X5XY9WkZBC2sro5zgViwS4TMbLyNvVbuFMHS2MHlV K6M+E4zS2GUgbsMiTmEnEtbucWilP1XmvfswxuhzabT7SNoV1Uks9yK/3L4K7EVCzXwzyr6ucCpM HwVgJGXcMHCM4l1Vi5f9qXral9gJ/ONTeRT1ZlmLal3u6wpbPOHncqo8LYYlcY8WGd+d8se3gYKB c4QI0bVIOMupL94LBIM2j8OurDeH9Um8+yg+bKrVRqyX9ZIgsTpst8saQl3u1+L5WJ4gTfrpBCk/ v9SiPjRivdgpyyKGWLMcvt3s+lKn3LtnI1aZunF0ili9UM2CnRYrODiK2yxPm2r/JB5f9qu6Ouzn U9Vo8bcgH5rDVfhcJoPDrmqlIxEJO2Fg8qrD4kcu4KzPQR3Oc1lk4aIIgIYwLiKZUerU0HJxXSal 1ZMljtN4DfgixtUVItzhEX8H3j8cqxoam6qn3r3LENiWUSS8vb+6jXAlZTQy9tf/pjyW1Z4xaTLS 4Do5yogcPDDuCfLtt9/9+M+vXokPVb0R75fbl1LIV+Q9SLyH/fbjVHEygOqkzZMh290X/0De/YS8 W6OIsNOiiPBkURRli3lKGXgWZvNFhAx8J+KwcGjbLi1K8HtboZ8N6FlF24hHgVy+XVLKNqnfmV8V mabZxxtalNOSAX+0JQla0ZQP2FdE+zpfRgRnywjppnlTvJ/KvXpRrs3LY3CqETOWx3X1FwKGSiTX 5WNFIfrxcBS//fD9V9+9sflGj/am+gASg8WOjFGFyGwhvFdj2DkjWy/rlDEZ9QK1mCvQ5VSU94pT kjzlIvXXRwBGlvPdL28fxLtSVLvnLVJzisZWhGc2o4IYk5BOauxm/OCrrSuOZIv0tEjnCRnFDuWd Qr+hbQ0tSItkXlCZC4OyzxoaQX0kwofwZ0LYLHbLgGO5OhzXJ6sXWFYQXhlOEkrZozwW4OcElG7R dCyfqlN9vML5yZAALHNi5UZPuymtnx776Xq/Rar0lxdwj43+pFQOMdW0rWC0vHWSW6EeDdLckC70 VKzhEfQ3PGYL17Ju7ap8DohVjy9HhKujWJen1bF6ByeFCPq2bPI2kc6vMLKItJgKxtU3sqmWa1GP sOzAcLx3G8pqGYdF5KKP525nXn3IdnXsmEmPhQoYTTZxElESEuCDi7pdJnXmbG5amebU7srTSBAH RxtRmojlsRTL7fawakopCn4/Hqv3+MFa8TgpMtedUuEUwg35shsPgCHlyBSeLgoXfRx+OZWMifE8 d8jeZUZvgd5pj2hRhXJrHS1MwL6bKUCOEGYOGx0Upva0CdTd5HwkIYk0MkAkRFDs0BD1GC2ZZ20a yZ41NBYJgzM48CyW5TvWYpHywmID1jOe4kKHeBiLBQsH6P/6+esvUaBm/7Z6MJnsmV15WVZK1W6S Z2LWboW3v68oojOy0zQCpP1lGZ61ng2uP1VPmIiaxPO8zYhkoiOqpiGiclrcZkQmouLXFOmKiGr9 AgNBljkaYls8oxAPAqzdYTnEqD27RT11jmOVBn2D5od4vX06oKTe7GwP+TInrmvdGWN6yzAaZ/LO 0krC3JHWFKMc8tTGKH0WD6jAHUXcqN0rER/mEsCbMa43jarIfFFqJXAC4OAoZ7jhaz3QGZwPSdW0 JvkGVcu37ShPZcOsVLc1etYeb6VDb2+tFAXL3XHnsaDOz+r48bk+PB2Xz2gpC+qFIgnS7uDlhAwb 3ePVYY8i6WXV9uLWzfnfNcl2ARcfoVk0Y9u+pZ9IQzfBG6+vcV41Tdw2csdP9AQl2ya5ssVnHAne wTG4gWbpq6l20N/4CJtkCtbuC6DtZ1o2E+t4a3dS12KMx6Xo6N9FRO0hpPy0C0eEb795HefJndqk lCXjrL1HeAyfoxObKFO9niQt5lnbK4gKldkYGrqanEaZcNMobZ8N6PcUjVIb3e1MMpX4UqNUs9E0 apQymmySJdMopUdb0v0apbMUR5jdrKZjf1dEFGteHotOs9QJ2P/bpimdFsuCkOS9JEPSFVKQpnL1 OdAp462bnBGlEejyd3bkG722DSTjbSGXJDmK+qZNlsYak5q2FZoWJMjuGxNBm9M+a2isuDvXyB8X z7PEPUrz+5zoct6uzwmGjidDhs+csX/qYgPSiGbr0K4JKiFKZjHzd/3rpkSDrvGpdNZECcWr5sTp hBOH9kDPDBQ1Ayz0W0mOM+66PM2FbeiNrVK98M1rb0l5ByyGXtSRFuXgVlwaZ4NxnMSGk4AGiEES Z/O89cGpVP12QwMQOS1ufbB+VtDvKRqAGOiCNUmkKVh1C9jQWAuYaN2CVWhSsL3UB7MW8Cdm3mZZ 4VZj5BOtEM+4H6UpG/dj6ifITEI93spMN+OWtYG/typexHev83wWts7Wxw6E9v6etkX+1P0ywEs6 B5EFJIqXcQBvm+YXTyjKDBqLIhx9+MtPVpjFga2KFvm92+Z57HZHbp5H+Cyc1IG1zy8e0TFjVzPG 7raFvjnnAgcHSyPb54PedHxVZJEiF9QSjlGOsF0LeCUM4E4GoPUY3IIWlLOjUvA3Te31JTu3HGen 7OVNFeyvzV5eh6IkUlElLrI5Jnabk91M9bMNDf1sRQuIFlJEAo0/q2g3T3kwQHrvlNxnwY8WhG1u GzuamDZY7ZByZEgngmDqwH18c9uLcTRJhyyEEOst26P0QYuh/EN3qOMcMFUlYKRBoWmo1ywtcY6L BcpdTaLsw0gMwBs52EK5gpWcdd9FtHAkx7Y4zlysUfaGcZpX7paB1NxOVHNbDao3eSVLS+gA7Oy8 v90PFNUORs98bixBHbcfu6wVkwwjmuvrnASx16U8/ezrWjn1akKGmdvomBLnvKSaKcPUy8TDUQYl 1UoJtqGN4bNjtXy31eeqAd3KGLNHKztJibyM6byxw7Rx/LeZY8YMMywVWWLDwoHxttw/YYruVP7x Uu5XTR1zWNVlTaO4+3pZ7S+YTrS7Ywednd0190rGW9BQycbAJzHF2TWhKcgYYmKR4fOg1vPhpabp 5Gaqs3Raz1S8Wid+ZfEK+HaPkqVpAEr/1W4v4ezuOSZ24fJgttcW1s1Q2vc/NINpp83hiPtJqMRx nQDzyi165+LbR+rsVKemRrcKmGqfEeWKUY66Q73YJ3ybzm10xRtLuG89tKY6PIZGQ2stLYjtyKZ9 VE12thXvyOA1BF9mI5F0U5t2LlL8/DOzeJJmLRrRivaMhGF4nAh73biZ6Z1JvIjjirRWpwYM625s kdiz/HhjGIoRku6yyYJGN3xRYk5SnzO9L4/V40cxeUiTbYYuuEQYVOrjxDbjIS8MmzFIGhJZqBZ6 rGiUQHNak3ybcTvMIYdtPu4gb1Sa0atwjryU+tzcfP7CFTyV36gwpByoglwbaFewawh2XcLKd800 L26NrMs1zvAoNhnXOg6WXL5U8uOGDeTrvRqT79R1mcfAug7Gs8vBzWKpvy57XxcPOKaZZ6rI0kND hgY8KFpAtCbvtnhgpOk1lpU0AwFGpJ0Q/ftno0Uy5OJo9joMmyTH50Eh+rH6EyfAtlc7FTi98GaD eODq6BrXGeEElttXahr9VXOpyemYNBgfX3orEVjZSsrpIwKxv+3fP58qWrauKel7FmZoO2MdQyqz Aw89LB6Ph93lb89sxRcLe3vPVhZ5c+DHB+wiReMDdhGcaGNTzFYsqWMrN/GdMWY9u76TIP3zm9cP r1tIY3aYKDaWb8rlujyOL+8HFaVv4gBkzYvw8TiWnDVYnmpXDHJ29NLfL1PaGch50ZuVkbbNSztx 7HVHd773hxrRZjTyFDO2CRu1fQ5sEx7yMhy6tF7a3BCKNM3eEAqIlrStMJ0vMhIhzz6+kPOivXRk gn6kadugQ2vuV1g2+ByAbO9cOJnAcHU7BCIeBHDce+86LfZ4lLvn+iMzCHSHrr6cYa46wzIKvy0x FUY2xrCuBA39hgmNpREPR3D6wkBsJpNPYnP40Ew6LberF7pM23gGnVJhFnwpmsTrckPl3rV5I57U 9WB8bOsPsxhhM7cM94tBjvZYXNPgfjs0NZdhjQBpeTvqSkagW38B7GxC688qgDkNhlyowXEaUzoM nmdiWrYdBlJ11zq0khNfySg3uHox4KYKD4oG1MHBja0T9SWW16ibUgx8yGIm23f7hLqv8MtcxIV7 JHMHEWMzXRG3FjH2+NDLwswHTiAib21mEWdE5K3L5JImd74xPZO4beWIpZ2uVlnFj+11/CXdLBdf H467ZX05qMx8NefqT8mcEZgXfpnAsthNyMcrYshSOYv8/jeVMo8HZVzq0witLnDBB7rQ3cc2K3xG V4z0hFN5XFt5nKqoXkfI7sbgrRxHiA83HD6c/jY15LHMKacT0OZSk7/6ZNXZdZm+cAXbeevJ61rB MOfNWdz/NqFceDwIEm2xiTpXfV3lWHa+n4EuivliybpcVbvlVn+55Kr5Z1IavqeBm0zNW10VG3qV lkfugNPNlZbjfnU3HkyJOUNZrw3rPo9Gae0Hj/5vSmvf6vZKK6Q7pHNzpRWZ20q6vdJ8HqS0vhYO OdrzFjfVDVuDkLYf077UVTqzXqw3z41CefckjHg4Rqc+pMRqtDPh38uXbK3Us/x4BHrrWgeP7wa5 ByiT1z0nfYlLsHd2Rzi7cHkQstUJt4/lqcDt3aLJ+Yi7E4iXnSPo1fI0vgfjactOfPdsc/yZ+pBf t5eVe1hUe3y26oQP+7zXm7hkMMCkQ10ON5wIY6jGFRJHIVOc6VC6bCJgRNdUurDelH+iS9nmImhQ VDXmpMWvmwoD089LDCNQ8kppJRr39K0f1eRkT02FJfen+vRHvdcn/Knu08XFPE7pSz40vqyaahim WXASDlNaEr5bEev+sH6QkZounVovRctD9f3Uw8KQ2HoxPuXZjlqb9SyJr5cscITXTk/p9QzJrsfG tPV6jNRZL7Tn2Gq/iSbZ9WJ8PVT1w/V6jMTXi+Ok3QlOJ9V6hmTXaxrO3f0yEq33038BnCij6gpl bmRzdHJlYW0KZW5kb2JqCjc0IDAgb2JqCjQwMTUKZW5kb2JqCjcyIDAgb2JqCjw8IC9UeXBlIC9Q YWdlIC9QYXJlbnQgNDQgMCBSIC9SZXNvdXJjZXMgNzUgMCBSIC9Db250ZW50cyA3MyAwIFIgL01l ZGlhQm94ClswIDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjc1IDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BE RiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4gL0V4dEdTdGF0ZSA8PCAvR3Mx CjkgMCBSIC9HczIgMTAgMCBSID4+IC9Gb250IDw8IC9UVDEgOCAwIFIgPj4gPj4KZW5kb2JqCjc4 IDAgb2JqCjw8IC9MZW5ndGggNzkgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4 AbWTS0/DMBCE7/kVw41KxV2vnYevoB6RqGSJA+IQRQZatRKtc+jPx0nzaChCaSnxwYljfbNez2yx wBazBy9ReFA9fBGWSLA+fFcvmVCGEsRGiTQxGsUG9xZ3JIh0CltAc705TJwaYYzJoDMT2Q1m1kpI 2DfcApjArjC3tep5ElEvoeJYkORKAUOF0u1LMVojOhyjB+ssnEix+oE8vvITat+RoDSs9xpUZeL/ oFb3Ory9y/vadUAR/ZX6u+k4Vt8Enp33bu2ncCXytQgebJ/5/nO5cx6P+a74gJyCiWX7s5tfnvJ3 B/M6ic5zbu8qpmArNgpHxUVNIkb3tIncEbXNGVPS5Ew1Obu5nJqdUrv09tTFFyJt4mMKZW5kc3Ry ZWFtCmVuZG9iago3OSAwIG9iagoyNzkKZW5kb2JqCjc2IDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9Q YXJlbnQgNzcgMCBSIC9SZXNvdXJjZXMgODAgMCBSIC9Db250ZW50cyA3OCAwIFIgL01lZGlhQm94 ClswIDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjgwIDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4 dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4gL0ZvbnQgPDwgL1RUMSA4IDAgUgovVFQz IDE4IDAgUiA+PiA+PgplbmRvYmoKODIgMCBvYmoKPDwgL0xlbmd0aCA4MyAwIFIgL0ZpbHRlciAv RmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBvVxbc9s2Fn7Xr8C+JTMWQ4D3fbMtueuZjZPG2ulMN/vA SrSlHUpURKlO+uv3O7wBJBiJFKVNZ9oUJnGAc/3Ohf7GfmXf2If7lLN5yszsn3SOJdMQdv7/9Bff sALTZU5gGZ4b2Gy+ZnczNjYN07Q9NpszW2QP4z/CC4wgCHxm+8FotmYfZjPOOJu9sHePm32020T7 92z2XzadZaS70JGb2z5IWsJq2Xzcd1d5+pEk4JgOCLg2EWD100924cue1f9Mnp7Z78kmYpPVa5Q2 f8rY7eH1gOX3o34XlkdTGMsDXF54bsvdhSnMvteXdxYmbRy0MZUN2LXSA1s09OASu1qBM3RXyWVF ASr1tUixa+orDNtg7PdPT9OPEzb9Hq63cdSZP6PcZCTXPVJlnwumE+rOH21XeXzTbBy/966SP4oW VgSEYzUJsMuQsBzYIBijU5gtI/aSxHHyttq8sigXAUuXyVvKwlIyX75IczMNnweu6QXkz0wrENyl v2VrPuvk6EZwdFJq3LJMg3u85XCXuTyn23PPaSGw2rDtLkqjzT7cr5INOLFbh/u/y9t289rKZQJc Rri+SmuUu2pDKnbPoKBuj6sILxPkz231wy+IPa+IPadEZQnPcBCFRq4jYDmIQmtmezxbY9VarK5x wzXxXMzKd/FctbZkLyPlfc/gotgzp4NnizXas1pzDdfO9lTezddGMcOeMojiZoJu1lcs0sRw2boL 6q5jWohu83HcaQY5hDcp+RMHL5xPq5sobVinUFitMU/WBvNdG37q8am0XWFy37S4g0UCDV/fDVBu wgo8cJhyhEK5u19R46LiCioxcc6bYspRQmdO1smManjKJm8ofIuBTMPhPkzvptbEvp+K6b14eLi1 726DYGK79xM3mLgTEXicTx1HcM90vLvpdAAzXTJlAEHlENdhpmv/P3gJgFc3LG96x2+9O9fmt7Z3 d+s9TCdiMnHuAu92agfBwy24+yDEvXs3cW1vMmVf3w/gJuRhCEsweYxzmSm9rVRHr8nBM/UQuL7N aYytJrKwAIvuw3h+iBGYEJj3y84Uj/kQD9HJ9CymEyzxdl8yklsU+bjpuC2bd/cOP0dfY68JHnvv 2upWKyGPuXAaKmwZHHK4XSxKZ/o5DufRMokX0e58XaWkg3PLYyrFC2rrmHuD0wPJqlZ9BdxrsOrS UW6sk3jMwNo23FVYjc1rJhKxvyhxXGSJ4w0LNz8AaFdpZkB5jnG+0AB1Aex8h6kHO1dokrttwW8s XA2k9MAQ9chX9zglhiASDQHuonmyW6QACOFmwebJn9GOHM+XL8+Pv6Rf37NwDydUcDjcRt9ZuEPm sNohF19EcbSPFsb53K0ScfVg53JXuiRp2xa3ru3C3SaWuLhJWBqJz7tVsmP7RBoCkpjkJZOUNIMF kpziuXT1uiGxvq32S4ZSy/P0/uZ8sVVljrFytHPFdsIobNNvSrB7AChsQmoG5ZwmJbHjln07x8BO pgYCDVMjJwWxrRNY0FZGlDLIlJZIBhYuFtGCBFyzvQGWJkwCSj7PLl6e61oic7SC0qX9GKB8eYmi IjpbrlIWbdID8npwDW5rEW1WYdxZqBoECah8YAaI1zq17iXSY7BMIgKdQvJy/sk5BS0uxPVODsAH 5giAPv3kWeyNNvMIMeWJHA2jf1uIJYqGn+98eFlqUUlfSZMdU0NUl9ZkkGho8nwXhQiriMU7MGwf /2Cr3LNnKAdaTs4cP1d8OdDq44vqU9Lz+Sudu3K0a/HXbjY2asHzZCHrAmWVsWM3MS054L7G1xrF YBt5waGFyFu0G1Dydmhn24b96cdXzt614HjMSTlUXbf9VlKbZF+EqibSuMkiF7LYaEdP9FXHVnZy l2IYBxbHpRugYJXVcQGBiqZC4Wr6ilEiBYHymWGZQApHOXyk5jqqlcc5L+qethPktdQ143ZzLa6v ZXVUrBXvjujdYo3qo+ghUhmX2a6dl1KxZUWmXJOvZ89xajrGI/XVfOnciitV9VvFJVG4gyBaLxLV zPwiVqyReEsO8YKFcZog7nw7rGDUh+2iLKtEbPZjG7G71Z59DLcpMpoIT0N/KHvM8hwKWh/66q2i P2UrcKzc/kpu1LVbSn2dVb8TmgWJhgizoI48Mb1hb8vVfEkGv2GrzZ9hvAKbMxQWVQkK4lWemDD8 /BANQLI8IC+Aet9YOdO5jFXkVTZZx26gFaEvwktpD57VTA0ubg86id9IPOtDvF+h2Vq6SYgvS+i3 hz/iVbqElNAaK3OOGxYZr8YNWxyykkC4GWINZRlFOdi5QjvhbTz/6ukHSDSsIYxfkx2S6zXbUVcV VZTOOnMs+PrQddN3gOR1khBPCLOTdCq4RJHnvBbtT2dRZKqis3edDWb0nEQphFjv0HDkFQa3YNv6 dT/+63km79otZkjz5oJ2BnTQN1Y52HFq55jIuKDky2m9Q7qN5qsXBBh22Ky+HSL2PF9Ga6T7KL39 I0yXFzEwqZu6gR2BK/VuvvBKbGEKIwBmGK2ZZTbWqB2srmHSh1rEtXeLNYIrws7fH6E0gipM1iJW ni3Wau8DH1ErGWvFu8w2qzVqO1cIt1+L+IQL8S2tbHjpvA8kGi7ktnIh+wNctDI30FfZPcoOPIxW jHUqirb33VYGMN9vNq56b3tCAoG4OmTUSTzuGdJr6WSu6VCr8bgxztFIZih5Wa+jDdUA5WlOiCuH caNWvsowol/6y/T+08eP06fJdNKZVuH/FPdKaJejwajvr9ygMtYTVznqXqsQoZPKyn6EXmazf5bl 8Fo+yDDlkyNVZZCwu080ixEZy/UNPx+bKf3XqFpT/Bet2fnYDMYx8lxNWSOfiGyuWIfDDbKxmZF8 tlzDntX7WLPzsZnau8Ua7VmxmXziqPPYTKvmSJsPvGaSkXO5s9JoxXibivECSjTW91a05oSyHEtf 5Om5Ka7ep2mhQcr4/OlW9eUEzk7OA0vLkpUebfvRu95ckvuqrHGb1ZTe+0rdae0bY9al2Xe8eMbT QgOdYxKA2mvJ60J5deoZrc4wLlJ/qqtG6HXmLZf5AbXXzZ5kNwSTwSnSNPC4ONtImeAewOLW5jE4 fHXMQjQaoCXnIerPM9L0HM3mtRQZSUc0GN9F66UWKVfkZWhpuaEisaysQIOcmcjnywTTnZ1dkx7P fEAoQUMtLXfuLrpjgUwxQME1ONUDbh4jUjX+uU5jjkQ1H6lIM7kVQqQ8hEksWgmzjddDbKMsCBQn u6ptCKcJsfq4n2MRRmGw00Ss5HtyRWRLYmpVIwCnn1fUIKuBk7wSE32fxwcCfi+7ZD2Ev1Qlo34v xpvoYFflr2VeveTCQaPhe4qCYjUMlGxyv567gmIcYpJ/TpKr8SJBWZKaFsCBWWdiP4TD5CLwbcu4 ONp1OexcvROJeflmK3JPTfVtsurrSFsduYJkdEqItUXlcbtL5lGaDqkQ06wD5z5JJrvSIMm0QiYr uDpkou5evWliGQKe49OWWl1hjL7wMxrBWbijD6dIRqOzPgWT4wJcIaoXj7oF8VZ+2YEGTjrr1DH3 qwRRx74+wNdpPFTf0KDLWTUhdcSJLgmFg6yFvw5/sD+ioo1/vgOSw3OoNtLdB6l5q8mq7PX1Oazu QOiYDGUIdfxmX6Q+4yBVpqrMEK7MS931dms3XW29NI2Umy75dZynUZl5SvYRBInpoje0U+R5OpFr r83IURqi1zB5atpIKlVi/61nEsk5YhWHZWZ3qtE4I4ls5Rr8LSpANJHQwjZSfT1aU7ENhS7UOvcR je0u5E1P8FPD65gKcNCtR32/hYmKmmq1np+1SoRb1GuAm5Gv57Vq38lrNdUa6jLVmhlkH/Ti0yX5 brGG+nVW6yk/fcJpCTnQZ1fy2XJNvj8S3Db8vH7E5bvVmlbr6fCJ1LFkQbF212qCrT6A+RgRae06 DVKTGiQmDcma9tEi9580+hTuMeP39R0NJ5fpXvZSX0/arsYy8cP5GtY/obHoIR9dy2lyZNLN3RU1 PaH+x7ypKkS/ieeuIESNBvXpKLyh0lJM6SOZoQZXIUgWpuwtiuM83dxFkCGsn0SfzbXtIPO+klQg RzWuz93sZFeNiZ7QUGCPvP2YFKWVgEbNX7N3lL8UEy3ZiHDFZrQVK/tg1ILOuKpjEcz0D+Fwlfbk R7suh73rJ+6e9oVRlvak+2jbyElu2B8H5ClZl2gZ7tYx8hSqGC4SliZDEpbyKzZ8wpMdZhBPFWuo Zlq4L5rV+97upn1fb/CwTOu+AW9Cr8ucN3AHu92286I9MzjBad/XNRtBqDcfZJxrrc0DzDQLV79B r6MYKQsK4iE56urP9PsWg3QpZuZ26KPxvm5EHkUt8AK3GdzFnD0dpXHbG3S+0Llp/Pn35/A1Ytz8 zwDEWM3ntTCgO491JFrZHFBeOTOHT46zX9vyt/PP67ftW/46GOW8JcK1AsNyMBvquiLrVWJ+w6aP QJUlwNJqSX7MX70olwholsu2Z2Y9TWW/cknZz3aKDikmRIqDKEu1/Xj+i3DU/YoldT9MoWQoXNlP Lqn7WeCTC2yt7FcuKfspXdjyfMqSup8QHOPPtf3KJWU/IZF+uZ+yRPv9+j8hTdsiCmVuZHN0cmVh bQplbmRvYmoKODMgMCBvYmoKMzQ0NgplbmRvYmoKODEgMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1Bh cmVudCA3NyAwIFIgL1Jlc291cmNlcyA4NCAwIFIgL0NvbnRlbnRzIDgyIDAgUiAvTWVkaWFCb3gK WzAgMCA2MTIgNzkyXSA+PgplbmRvYmoKODQgMCBvYmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0 IF0gL0NvbG9yU3BhY2UgPDwgL0NzMSA3IDAgUiA+PiAvRXh0R1N0YXRlIDw8IC9HczEKOSAwIFIg L0dzMiAxMCAwIFIgPj4gL0ZvbnQgPDwgL1RUMSA4IDAgUiAvVFQzIDE4IDAgUiA+PiA+PgplbmRv YmoKODYgMCBvYmoKPDwgL0xlbmd0aCA4NyAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3Ry ZWFtCngBtVxbc9vGFX7Hr9jpS+0ZkcYu7pnpg2srrWeSJpGY6bRVHmgSktghAYUgo7qTv9n/0+9g F9jFLiwCJBTPxNYRsWex5/ady/JX9hP7lb37UHG2qphf/6lWIPlzEcqf6R/pPMj8mEVZME/iLGSr Hfvzgs38ue+HCVusWCjqD+MvkWTzLMtSFqaZt9ixd4sFZ5wt7tmbT8Uh3xf54S1b/JtdL2rWQ/jo xcMULAMR9Cw+G7uq3r2nGUR+BAZxSAxYd/cf98v7A+v+9/Fvt+yfZZGzj5uHvLJ/y9j748MRZOEL /6137ksLH28tsvqlmz158kTZ2JfWb6rlFApLTlOsGmTRpav2CqjddkCK11GvYB7MGbtdPea7fPC5 eFKV9blEpGJhGjOXwXAVU6vqNzAMJCYVi0TSw+D2KV9t7jcr9uO+XOVVtSkezlcbTmrDA5PNhFoT +P7ryldEgSVfmN5YsfYKIIggAA5P5XB4f2CHx03FDptdfsXKYvsFP+fs9tP3P353zVbldrs8bMqC VbWOMXxynd9vinw9v0BMKfRBhKm5nXPl1Pu6rcUIP7ZFNuJEHZ9veM32RBEjujb5fr3e0JEtt+rQ KrZbfmGf8+bk2KZg98fDcZ+z49N6OfYce9+YR5Cw8BP4XfuNDzmkW0opr8vVcZcXh/lYrdLOonXN 4GS9+WhdNVZtQiiP7CA0etXeA2pVgnPEEceJcrjRhdZ75VHPjl8ZFJz7PGIGt3M1vOeQ4tDW6sHy fEmn9RnZcWZqP8RtBt+We9PvSG9zVZPWEmfA86yW29UR/ihfs/K3XD7wX4Iiy4qNNiPjWH1yRykg W7urc2X1surNAieATOyNwMFS7ufHcpvXyo0D3OXLAs7gcXlgS7Z6XBYPObmGJaOwu83ZzQ35JvL/ 9bHu81+Pm31ejfVQ5tGSWwKuNDb2SmebJLZNTH22SaseCtxvgO0RHYsHqY7L7RYnWHWOEKe7z1u9 NfR5dPjsVS2eEk6O2azn7SdxCTwLiEFKHCzNkhBhMBcHdbaBxF16Ypc/4yKyNj+1Q+thAXtbsoey XMPSys0qZ/fwcWRXjQUi/lc7UpplsX6H31WH5ectQNjn44E97cvP+OnLJaanUihza69kezxx8qmp jQ8sLBEW5UEeb8+5bpd7uDZ1rusvxXK3WY22OO3GOGVIAsBhZmzj3LPUy7bxdia4XTgYbgKDIvpM xA5aGyGil5K7Bgn3sPigAjYlEOU9zKEOKyqg31z/9POnm+vb2mfCTwIgQ+spB0R8Rxi6IKJzwl8C JQ1zT+fKq9fxatEFPHjtwAMWlu6vyqLaVAcgefIqO4rnBUDRfp3vEY4Q7skte3W9yZ+nPIv9JKP6 lh9kgsf0r5qWIkMZVvjyek+Bc8q3Q8Qfd4sfyj0i36HdFFurUOFR+Q07OK/WxmMKSJwQhXPw+VNe rCsksezuDb97Ozg0wYI81Pa0YfKMYAs8Ts97GYb57i+oIT5UTGR8HtXFQsEJ7YTejoVJ0qWxrUmD VHwUFbfmsy3tkd0zrC2wtnfBURk6GlPO4xl1yTHxz3Ewxkm1xh/E3DKDRhvJ8svnAngdbjivriAc cfdW6wV+fXNzmx8q9rw5PNYQqcIH5TOXxD9SlDSCDOu3r6uyrg9oZJhESlx+Juu9EGFm0yBCk1aL esvMR4kEqRoSHKfsXn9heRb6qeUCxkhwkPt2WZC8rmrPcvcmcEQm5UWOupACvCjAUsKcwaqNXbjC usAYeETq4Ac1B0tTF4+bMb6i2wcwakKc6pwCWb/5FipXqFilKp2ynnasgAM1V1JDD64kiDOphyH6 DmEIZdqxiAcWbWvSxDyj/sTWfFbSPKmIjX6GWTpHjZ+WNNgoWufxFE2OeknzUSKpFZVzGqfaX+mZ zMLILpujxXB7/UEfzjCxa/cdQtS+wM89a/9v7LI68BmSxp7BISVtiuzUguoURVlskPUhFA1m5+RH VCT100i+hWX805TlUzqnFF2WnrdAEeD8rbflr56Fp9k6paXcj4A8XAE8o2YBj9Qgo7s3FFdKJFXk z1DSHhtTtAYYgY8nZOtBr47tnlA0qQB64TMJl+mDtKNNmIo5J+uFlfsSRHgtDVauaGjN8XksQ0tr kpo0Itq8FAk0Xoh8O9lqgzlKbcqRSZR+C4yHN53mTFX7Zgb+louuWDznV/ifoICkD3SQa/gKeCU3 wdOEETvLvtbgFBhyO8HmpVPVuaPLBtDnXzffmp7OOx8YJ4RZkfIYbFQEDeEMf9HoSp+eo44JMKiM EDroKBpcf4cWWhECH1Ok6dUxtHsCS91jQc7424aMra5raj0c2djX0UM7ryh8IStvzu5kfqUM1guj bB7Toe2YEApZtjQkAiaNi274xaOKhMP12lcbF4f1KxqWnjllU60eJ1/tArPQW4jD0LI+6mpz/EFn W7YhZTuGfDr6BMh2tZRP7EClLvrNOYIGOsQwE4OtCzQb4bbONuTzVKIxkTRorKFBdiYN2Ipwkvko kc7KCvTGjfPK7ExruKNyUjkD02gOSfDqyYbLAiC8DS0riZGX6/IJaaGEg3+0cNXZvTmdCRibUCow HJw4J2lig6YZOwMHK5CNwVWu9rbFD3fhC7ZuKAGPKYpQGDEOR6UwXVyl3cQJG3SArWj6bT08DFV2 bJBnbXElbbIkRYNxIbNRWRJPm+JKa4Oa1AlO50dbw1hQYnjl2kqS2hlSB9MOloTUp340RHL3Y1QZ ZuBm+WMCzR1M2xqqxICEYUI/CH/55gLHHFOJXXT5D3DMvspVUa7hqgqHEkKTvxo0lOMQVE3H7EvS ZI45DZxK8EjRGOOFhk1qXUO3zxLN5FUgl8XNzd2bDTKZP6kq3u/s8OUpZ7+z1XZZVfh7sfgO/7/5 +H7xnm3z4gFFPPXjBeqQkDoAGcyMDZ1WhyCF95IYKwwUxmpp8BGaFs6TrjoEqSRNpg6ZeAFanfCZ TnTpVYcssZHT5Orgsnh+zJFe/+H3P2CcCS04VLHQjEDAzos6aF9SBMQQE7oJSKkNrgNkHot5rLAZ xF8X4oOGBmxm0ijXNlwAfaxOv8+p2PZhM+6L1wZn3I/tbEjiZdGHl39QLaELLLGViuLcaSNoB2eH 6yDIWsjciqChabF49DmFj5twbZA64frlrpGLM5qZshmmsJzup975CVt8KbnXrhkc7Cbd5MbYw2Mc albKUE8i1M2YC9SiHQxRuxqqFjypURyy4DBRATtoaNQiU1WwgMc2ijNI49Wit4hniE/wVw+t3OVx 90bWzwxlPB+TUofDD320HxQnUyQFFdCoFdeCtbu3srdjVKtN/aBJJiqc1g2e8/VE+JRQ0ARYz6Ze QPuBH0sQpyujrKXpyqgXIJ8nYIew3boPTXoFPYnsOajpzVw4POoGKRqnqtpaVye7soTz/4QpgG2F cb6vpc3TSLHenKlaL0gRgqlxllHfRse7BVpNfdsjmqAYrqVokKaXIrTmtYE0d3monkRHjsKyyUvw k6CCdgTMrHgPFVIaNKA58FVxC70tSUNfUNE8gWYFgWZTSJo0Xki9ACpAw6s7nm2o1zSROkCf2WIx 9SgUd3n8tXzOMbR8RbO2GAaURS22LgGgaZJN3qqgsVzdPOy6YxqRuMSCKaGiXp/a21DliP0GXUeU MNOYi2ho5IclzSOagtKNHzZI45XjVLwOMXX02kJ0eTwuf6MLSkMv8zmQtL1rN+Pu4tMouoECXBY0 2q2Ha+qGKA3ZY36sbfChCqtu+DDK9BBXUHOnqZxLdA+OqR7FUW89VPdClRoYsziIEk260MzieLhK JNtWRvTQpFfQPZjRq+uew+PpuH8qaWoEgb+ZKKfZc5KpMVd5xbSg2kbRCcfplBvMYnZAM34YH4TK ZnaBSw1uSbOod6K163wr0ZPhxNI+ar1uk3K2fSrCzn0jjq1HClAZVBMwSDulM2toiHSaltStOqNU IAJJUuWh9mSxB5rTOzUKMzCJjEL7ctL06NLlUc9FfP/z7YJmcAtcENvT8ApuAtZOIV9f1eO41QrT lfVlB4pLGFOvbwpu9lrdhmmZDvt6TBeoxZlQ1HIetu6piBGldi9mzNk6JmJU5NohSPT67c6ZOk7q XS7+8eP1BRfvqL/vJwkNobtsRscOLQUjCY4DBxYPlsJADY9TG9/J6pXmc9Kah6mDfkE9DsbB3erH BZrx6HVJIPUQWM+6XK/b+ophDJQedydB228BmBEvyyU6hb9PxWp7pJmId7QLOQc+inl3Vo/rEqB7 gNf/UbzYzXGLu2JDsREMyhq6bic0e17R0G/H6+vBdvL/erCdo6xUu3gM+cjpqR3jQiU4LW3bpdXd A9DUsx59TtEISKCSqNbMVDKENVs+DU0/zzhoMrP1Os+qbJfWbPVjYCxxTs6wYORnlnIYJ3dCBQZa cOLcBBvjR19iov2oy+Pvj3nBrAt3uF+ACNW5cCevjN7j2nr5TLEKuVZjCecPDGSUOiWYNeRyX1+B ryeO14kgBsgyJJgK53LviOzUYdIbpsDD0pK8teI9WTFbPj1tv3wz2JiVVLXP1UNU3GU2WiX1uuZB IRRaKHzsfk9Bhozb4Xx6VXd5lPgSFdwK7NXuWp9rFPawPebNZ65Yg97k7y/6dgYDfcu9XaTuvaLL YnugYbhKvKThWjuE79yZmlx0PTwguh9W8DhrDEasl4clSn1Ub8eXCMW/sKZ4iwiEdvqEEsMtLBr9 xOyE2tLkEsN3PThX1wcbm5JYnyagI3Jxk7x/3cjxonq/DYKgzmNE3/EkEjROUNhEnQEtlMQkoSUl SZjfbKsMzYMGiQJ5Sw5VrqjXCxuSXg/D4/NAllObBw2SuR7XFzea/bUkvZ6BVJr1DBKt99P/Af0F kOQKZW5kc3RyZWFtCmVuZG9iago4NyAwIG9iagozNjQ2CmVuZG9iago4NSAwIG9iago8PCAvVHlw ZSAvUGFnZSAvUGFyZW50IDc3IDAgUiAvUmVzb3VyY2VzIDg4IDAgUiAvQ29udGVudHMgODYgMCBS IC9NZWRpYUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9iago4OCAwIG9iago8PCAvUHJvY1NldCBb IC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9FeHRHU3RhdGUgPDwg L0dzMQo5IDAgUiAvR3MyIDEwIDAgUiA+PiAvRm9udCA8PCAvVFQxIDggMCBSID4+ID4+CmVuZG9i ago5MCAwIG9iago8PCAvTGVuZ3RoIDkxIDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJl YW0KeAGdkTsLwjAUhff+iuOmoGluEtvcVXEUFAIO4lBCfKGgxsGfb219VJxqMuTmwfnOuTljjjPS cST4CFnN6MsjKZSp94/CCs0yw5C1yDM28EeMHAZSSGlyOA+jqsflonIWzGxhLCfuiNQ5AsGt0V2E GHtwe0xchW3BSL4Y2pZkyujBwDcjHGIf4YriIPAZk9tpdwkR0+Lit6A+lFT0ua6r5azYBBCtekk7 j43wsnSmWDeNJXV4tE3eUH231KhnS/WzpZ3/Ve2v6uujGl7nd2KLdCAKZW5kc3RyZWFtCmVuZG9i ago5MSAwIG9iagoyMDkKZW5kb2JqCjg5IDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgNzcg MCBSIC9SZXNvdXJjZXMgOTIgMCBSIC9Db250ZW50cyA5MCAwIFIgL01lZGlhQm94ClswIDAgNjEy IDc5Ml0gPj4KZW5kb2JqCjkyIDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBdIC9Db2xv clNwYWNlIDw8IC9DczEgNyAwIFIgPj4gL0ZvbnQgPDwgL1RUMSA4IDAgUgovVFQzIDE4IDAgUiA+ PiA+PgplbmRvYmoKOTQgMCBvYmoKPDwgL0xlbmd0aCA5NSAwIFIgL0ZpbHRlciAvRmxhdGVEZWNv ZGUgPj4Kc3RyZWFtCngBtVxJc9tGFr7zV3T5MnaVCKOxEUjVHBTbk7hqYk8kZQ4ezwGiIIkpEmQI Moqn8uPne+gV3QgJbknFYV7Y/brfvjV/Yz+z39jbdw1n04aF7d/NFKAwiBLx3/QhD+IizFhaxMEk KxI2XbDv79g4DMIwmbC7KUui9sv4VzQpgqIocpbkxehuwd7e3XHG2d0je/2x3lTrutq8YXe/sg93 LeoheMzmSQ6UcRT3bD4+dFdz+pFBkIYpEGQJIWDd079fl48b1v3r/adb9mVZV+z97Klq3P/L2PX2 aQtwFEbhm9Gxl45C3Doq2kurM40ERdmhlzY3NXxKIodP59g1LtJTd+1lkD52TILXES+wZjA5Rjsk OE4hAzxiPoYlYx8f2ea5WlesxD8P29V8Ni03Fbu5adjLbPPMqt+25ZwtX+pqfcWm87Jprtjm26q6 YmX9cLwM8AKHiiadQx0rA4aufWobh6HLuFbmB5O2axxGHeOQxNDfCEIILA73bt5f311fsWU9/4Y/ Kjarm01ZT/GhwefpfPtQnUK/GJj5hNuIz0o/TlLDJykhcOj39fV/bv7xLgnj5L/stppuZsuaZUH8 9Y2QiaHGUIqspcEhyQTslE/M8yiC1rUojR1uCTM4WCZ2qZuWCR8LNM3oWMN++uX2jt1XbLmYbTbV Q3CCOkWw8zxlFspjpcHih/J8UZg5IjCcH13tgWu1nJPmB09d53Ru2+djgO27AztW83JaPS/nD9Wa ffn86cNP72H7vr5uvr4R7Pn0uWWR0thTeJSR24tyZp3ljEzinF+WSQgiLuufPATaPbH/tRa0Yc3s qa4erhjilNsP71ovpZRIceiKVX9Mq9XmuxO0qYA2RTiOOdE5GTW5LJ/GseuKzq1MPgapTDc3tx9/ YNPl79V6Vj8pfWo55OgRzN603DYV2xzKpl5vz3O4wyiNGI7mUBc63h5rsG2XFsuygyFtnqc9m5/Z Do4nPTHgubin/ZKP5WU2n5Mj2q4eEPw9MCQGMIclgA9tHtCw5/L3Ct+oajYt59PtnL52ii3MScOS nFlnOaOKjXl04Wh9zBG7ds1hHMQBD4yYhUHOiyycFJR7hnER8WyETy0sZ4OTUiOHhoFA7kh5YvAO y3WtbSk9iPKY0Z2cbSOz7XG5tBMuq3S3h3wBY7cff/rXPz+w2+lztdAp6Dspb4gyDzUV5o46mrUR +wL39gfUDZ5QN/BZR0w0rON8EqRtBSFFApAXyWjBeBR3YWxuwZIiyEJUGgDTaw3smT0Cztv1o5Qi 7wjfxZ76uwpmr0+TIEvknmItSw0Me44003CziG52qHDoEG2M2zvCcW7jF2WZo1LnMn0qAx77KK5F bCHsHNs25LcoTJey2AhZRM5m7B67/wYfV1OeXJcbLDheLhG2i5THPpkvl8O41usZDQNjHrsMPKDA sCuO1+QFCoeD5EOoljCrW6pSHHel/uNxuV6UG2aot1ft9tNh9FdlPGgnEuY0gRP3D1k/sOWaMgDL 3LW6M9hK99KeU3kPlY4Wp0P7h6qZrmf3cLYgjcqiDfpBlmiE48Whsjo8g0dtrUacubA5s2CpqHkC ZtYK2GjOyBIdaTV6aWDJX+YmKK3HNHc+lf07k3Kqg0YhBysylBo7dbaAW2eQFePRflH7y4pxoh2q wDWySsZXtojt8zJ7zrDrvrru23PfWW3uOwyFcaTkm8IkyfroaF1NiS8H2YWfDItW6shPap8mYR2f CBhKQK2ftNdKWOsno0L6SbUeeybK/ykY/KQNU3vKtSw1eMhPHuYe9wh6EuaOsh/ixwYZWqBwhJh8 lrBhvZZFBKcRxE+X7bWW75EB70BWldXEVf6lm+39r6gOss2yNf1tft4gint7vPTxgkooE0ifT4Ae 6esxKN0IfCKlMynyAA0SirjiWNpODYOdtGGhiOLk0hF9TYJON53daNmYTlgUh92HSNQuO6Fdt48C ZZQ54iEUd9fbedWwHXJlCdWJNg3CRi7cGBxOWQ/PJ2C5R4T4BEkiI80L+AN/2x53sC9u3kViEwX4 qNqKOalHzcrVav5NRp+GnsN005DLBJQWMj+gVPa5R0O6iU6cykQnyaOAo1UKA65DCQWDAbdgPMiE AbfWahjpSJzKRCfJJ8iMhdoZPBKGPQ0sCyaUEBFMGvok1zAy4NqYndWSp6GbEB+id57htErfWu+A wlHt2x+vj5drUyPwNx7eUd4lzqQ4olzgY4jzBFWjp+UancPFd3SL0VFtcaoOhTmV8ywcvhQfrByq oTFOk0sns2nRU8o7lK+9gYYRHQ+FzGL/ziBD4MXX120vg6OX8Wf7KdKf0K0DLAgC9vXN8daGU5jJ iwJ8Mmc5J5+yJHFDqcE03KV+xrVm8AHddOAQFd+lKJpPPoqXtuP+6s9XcKr1cgPnatUTlvUphVVO fg3+YGxhPSdHJrEX3J6ZIxNU2rscia2q6h6d38kQRBIh1WPHPooE5cdf2uq36lrc3ByvF9SNQFUQ JVUL0zm5kMdeLefMXMjznV2knYED1SX28MlTTivk04qDMzja/5kGKMojr9qNrk2G7F8VjeHBOKTE mRAspSI3whM29je2kpQ9BNolyBm5xzRCTOxjMGVKfQMTHO3BKZlirpKTry9iFM0EIruSMfwqu3iN fYFhIjA4zG6bvtKl6cvsr83vueQuwnJOBTuqbviEfS4b0QDTRzmlRsQT8pzUdPEp28PCw9SpK+g8 AxcjDD32XAqzXDQDsb2fz5pn1CL13ZjMEEZoRIgKTkykoVnJBYu4zJE1bG7BEGTJBMCslTBZX8TU ZVsUinMcTMT/5qsKRs0TjTpR8b9ZKkByx6iQaYG1ZVLI7F7D5syC6S3V2hEiJoWG0pSzZhJF5Hb9 5bDJupqibGPovkd6hS5ZiYSxBUDh+E2fnUxVPOJJHBRIqagelyp2SBjV42xYInpM9lIJ6pCJSisn jtiOyRLcLTpm5pQeRZ9TAQrHzqC58zirS6gANAC9HUzqVWvq65ByGM7oFHMPizyHwGneFU0HeTt7 gtjiUI9H7Rar9qDdZWU51WE52fHe24sLd9R/ELJRb35iTJvgpn1f35qfod7OyeNGHLUcX3xmtSw/ 2nNehqeD6iAUzkTQDWGzUJRoG7mogyTKwCgY6hM2DAaMahadtQSTRksrVBaJPi4saybLLbGCYbkN ay3w3KgxvtZWZUTjxmBXy3FKFFnEyRUMp7Rhcku1dkSoJYz0W4v9Ufaw64pM2sXDyM27hEE8ONQ3 0YqpTPTsbmnaHtneFSDYF8guPbM45qGH46ZaVeiZonXKqnL6LOdz2OyRLbbzzWw1x4CpHNmhgW4I P8Z6tH8/JbEskNNEGSZ25Kk6Rtpo1B7ieiGmRVGOAZlu4jecaZ71s1ykjSJzG9Rnz/ZxCxeHmLF3 hhjZy6H5Za+1JbbAuiNkJcQO/WiAX4xKikBPzOeJkEPMuOpZvY6r28NEz8NhvAnCQRNyPbcfzsSB mhfxnanpsMP3ElNnntzHoYeDb6uNGA0GyWpSr/IBo/xovqnxOZQSvlfTjYiuxcJDmW3MGjeaJ051 kub13tvSkCh1A9VDNGSXGlrETd1I1fbOL0i0BElX6xmoChtGY7+Ix4QQt2lhO7FYztdV+fCtHU48 nr5RiOAoyhE+YGqQDnZR+sahN5l4SoRrmTlDX+BwMgHK8tBgWi9BUnreg7LjrJwPttqewtOANA/x 4GDMfWTn6TNYhs1HsXw84ewUjfMY1ZOLnZ2TSKGY0Iui+mPWYHIMhayvrz9hiv2K0Z9UkBeGuTnF S+u5Wnm3k2TZ2CDLQMSp1xMbzItd5sFGgY6CEwgcoCO7vIilIx6O2yUNnX66tW5zfEpr5mR43GKy GUFPF2YLxGqLqt5ggnBZN5CFqllVU2gl3ou9wquxGd6MSbv3CrKxmD09b+Bt6HTHNdUsOyeO1CZm x1al9/kRzAg5wcj5/QjNIXXlBDMK7QsR1mwRHG+eESqT6bv9fM2Q04O4rN4u7jHoh5xfDbujGVNX eLHASlZXBwdllo4YPyIOZrN8eBDk6YhVxLB0JCncYO8C9EUHo0tfom652SKzAAEX5UOFWOduyVbr CuTFCwEitilfylTkij2BwutW0Bkst55A2hOpSUrYFKZKJh4Ijjmuj6NdlMJp4s4rnp/CwOFQuKxV A8rQ2lgkXSQiyyTeFHTnNYaRtFd5TbEfY7Lu1Rf07ButSnOUgzB1ywDIV+AeI8pZfAKo10IGk65A 7EHpRSmI54AHbwv78AzXyF0OhUdtWZweT/hXKefNEk69QWZOU74lmz6X9VN1vAJw4lHUJnsC2/kV gFNHRrHGseCylAZrapizhye+DiMwCWIaxO2RMosngypz9IomyuQ0URThA1XcUPPCdGdb89Iw1Lxs WChK2moto+9JGE0T6QZHFGVBKpseEg++K2FUmpNtB4LRMxCq9qnmiIJddKgatU+vH39ArOQ5m958 AjgcK9VxpuQDdJ6LORP6ZYDWE2C6f/pMdXTyv+qdpi5GHa8GZsiNrn9pP5DFl8/YgMOhsIxcmhJB 6Wa2qE6oi06g0WGOH4AYo0Lk4rFUbo8qe+bVikay3J1iO3jfXp9kocAAoEMimtn4N6K6x3Zs8ov5 2ZLjJcvKawW+kwysFbnoyTM+mXgFlkOtqSGVpa4WqXL04bpx2yGRyy53Z/InHwfZAGSws9UMWQ3i PPi7tlTTRuHUPS9VZAMTMUWcQ6+EH7+1lqL94v234xlnVSDFyU5inCFwf/CdT9z46BACDzO6wOEw UQXWsjOpav+g7ONyPl++NNAHlJp1I+DLoeTsvbbprmEK2722+sEEMHdttUr3WBJBAEt2uXpwPyYc zrXPbkkKFGYurR4+jjZHgmJ0XsJVwVNwhZ8EaZ/LQyX08CxbE0uhIZgQR6IFP3ooM43x0b+1M8bA +8XdZZFd3l0Ch8NB8XCzrMVv7cD4UCaqrdHf8MsR29VquabH7eJ5MSQWUcqPZXMKYfWvDuBlMJ3o kkYHj9cunvETDoew12qcG284iYqPj7Npa+CRDDgG/JS6JfVu2+cY8ggnUdKIvnGK+A0bd5hwuGHx sxjtz9GSOdmf954X6ZGTflnnVdlRXARxSj9kl6EyIB4wJQj2JjYIU08CNMLUu3qErhcaEDX7NTia iHxooRYzzBuqFEntl+T6XYdaaIHs/fBre0Eh8ih1Pg0y56MHH3JmQu1ngez9ojgKYpHrqf00yOxn ZXVqPwtE+/38f7vYkOoKZW5kc3RyZWFtCmVuZG9iago5NSAwIG9iagozOTM0CmVuZG9iago5MyAw IG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDc3IDAgUiAvUmVzb3VyY2VzIDk2IDAgUiAvQ29u dGVudHMgOTQgMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9iago5NiAwIG9iago8 PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9F eHRHU3RhdGUgPDwgL0dzMQo5IDAgUiAvR3MyIDEwIDAgUiA+PiAvRm9udCA8PCAvVFQxIDggMCBS ID4+ID4+CmVuZG9iago5OCAwIG9iago8PCAvTGVuZ3RoIDk5IDAgUiAvRmlsdGVyIC9GbGF0ZURl Y29kZSA+PgpzdHJlYW0KeAGdkjsPwiAUhff+iuOmiSJQ2nJXjaOJJiQOxqEh+IpNrDj48y2tWo0O pjBweZ3zXS4lligxnnoB68Hr7m21xJlUzTwEmsXEUyQUsywlBVtgYjDijHOVwVgoWR+uBpkRIyIN pSkyBcbGCAiYLfor5707+SHcFfmJoW2z2/lwcR7z/GL3EENILkW7XUWDyBwxMzVuZzaR6XBX/WAL FuhqEbXpC50kTCZpsMBn+utFvnMQcvO3UdS8c6sueUiA4h/q/+N/q75KVjk1zPGjZL3urPpb9fkR 3liXd8qjh/sKZW5kc3RyZWFtCmVuZG9iago5OSAwIG9iagoyMjEKZW5kb2JqCjk3IDAgb2JqCjw8 IC9UeXBlIC9QYWdlIC9QYXJlbnQgNzcgMCBSIC9SZXNvdXJjZXMgMTAwIDAgUiAvQ29udGVudHMg OTggMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9iagoxMDAgMCBvYmoKPDwgL1By b2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0NzMSA3IDAgUiA+PiAvRm9udCA8 PCAvVFQxIDggMCBSCi9UVDMgMTggMCBSID4+ID4+CmVuZG9iagoxMDIgMCBvYmoKPDwgL0xlbmd0 aCAxMDMgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4Ab1cW5PbthV+169An2rP rGSCN5F9c7J245k4bnY3k5k0faAlasVWEmWR8iW/vt8hQQIEKIqkJCcPiWEJBziX71yhT+xX9om9 +jHjbJExq/g3W2DJmtlu+Wf6n2DmhJbPvNCZzf3QZYst++GJTa2ZZblz9rRgrl18GP+x5+EsDMOA uUE4edqyV09PnHH2tGIv3u3y+LCL85fs6b/szVNBug8dubkbgKRjOy2bT4fuKk8/kQQ8ywMB3yUC rHn6+0O0ylnzn/tfHtkf6S5m98lznOl/y9jr4/MRy7ZlWy8nYy9tW7i1HRaXrs40KTnKhl5a3lTK ybU1OV1jVyf0Lt21VUD1sR1SvIZ6QTS92THp0GDHgw5wm5kU+Iyxp3XMPseHZJXEB/b+t8cntkoO kPEyhnJvE+jCl3Wcr/GX6YHt0pzlKYu/7uNFzqAtj29+vIIiKCcbqwiSuW2261iWLr1S8XszuAkR kwZEuMRgO3AYyGgyPMSL9LDMWLJj4CH7C7ZV8DzJ2CLasY8xW5K5ffwGnkbgdrJ7Zpt0EW0238bz lYcODMwP1PPchq+253wPvoKMxtdFulslz8dDvGT5gSAp2vUWZZetEOe45fmsheQ6PWR3ZAWfjvHh G0lqhT/8+SLaLdnnaJMsoxyLf75k94/s4SEbL78aIJVD3Eh+lv9d5Adf28Q2YQ/76BDv8sos3oKd ZCEZbCWCSA8x2x/Sz9HHzTcYUBYvIO9CAMnqEubCWm14Q1se6jbM5Z4eMAhn21tTe4EOyGjMLXG5 1sl0p/gRaxbw0Lfm4QQQYTmhzX2KjYq1gF0WKoUINrjFPWbenMAOzuMqN+cUP3CHqGgXB5UGkb7x n0AEGUxwm3DAc1toKLw8E1V24Qy3oYV0AfMS8An7+ABo2cbLO7YsA7EKX9LdJZpPbiEoxFMxztT8 V/9E7PyM2LlSFFKPNkWx/fnMoyjat8OZZ4fuZAuH4zTX2Ka5ZrmItjes8V2xtmYrZtte8f2J77gz jyLzrfLZak39PtasoNxTfJfRd8Ua9pzUSoCb2XSzM2JrGt2JZIBz/j2AE2QqSYmcA44PXuYIjARC Znm8Zy6iiE36ZSZsa0IJEER2NttRtB0eDwYFbdfITV7013bBNrlrHdki+3jaTpS8afCm3cEdn5ui GAk0kLaSPFWBM9cjcxsxXJezymKiPxmQErbekNskF9irfsHSEVJAGX9NoAS7RczSVRFhRvv4a+/L m7gXUmo290FS07v+MuuCvVonpo4eKQ/1jV1k6oDcJPPHh1/evL9nZVxe5jsAXJEALSHXdyUfm5+r wpBLwBeytAPOlCOZ4NvPcluVRbJ2rqvLUNY2EfBErjOd6yqyTIFKlCEWSildV5FcLhAcIxApPXSV 99TsHs/XOtdRznMjvsJnm0BDvO1tb/0YCzqa8TWVseBzpZEVsz8ec4akkti/So/ISJSM8248e4FA ZbQ8VU51K/7OjcJNqbnX5u/c1vhbBVm9CXWBj0/VAN8K2JQbhFRTKGotv3x4ImOAV8+SZUzpbHZc LOIsWx03s/Fi4wGhjds8w1ixtbj0KRIG3RZ6M69pBU2XK1HM9vWccYildQmocutTk4Rz1rFL1/v4 4TWqDksmjPPh4THOL0j6eeV61WONFdkZD+Hw71K2mYKOZmmF0q+jz3C5VDFhWfK8i3Lk9aisLNZR WQA77qnIGNWVnQUqL4WrGG8QtlW7X3mmW3HX/y65wdTx9eTATPxFVEi6iuJKw49kbBUlG/C9RL/x vOUh+QhgnXqisbxtAxvXCm4CNg50wrIcoCQoaIo60PN04Y2MRk0yZeApgqObegSfkn8eNu56VSF5 RnR0ZY/gWbrfvrpHMEm4AJ7f1/GObY+bPNlv4sqIUOEVFco4Qw3zjsXRYs2kFZ2tn5yP9SenepLc I2FaDpuaB95SNbw357v0llMkY6OQ0EKFVHUoEWnafE47t26sHL0u3JzhVOcd5pTQuq2kMjSxktU3 OJrjLkFNn+4zJGeX97ERb80cC8alyMM0rt6lNRfAVJTW3DnUCOUtlNZcR1tDGa2x5lpFGazxXbFG pTVnLkprLv4nRLkOpTXls2INe0ra3swty3XVdxl9V6zdrLQ29VwjthyIxs0I81QCCzoa6D8u1vE2 LqK6n6JszV5vntNDkq+3LD/C9Ot0VWIAYj4K3nNELhfEfjI6Uc5k6s8ZO2je+kThcuqF36c8ADoa d7cpGjro7OwYtTwfHtgXsLYoWmURuN7KfImnF1xewo1xdxJuHQENG+NQCoUySzZvrQDamSt04ZjM i3yAWbOXVhqHSod6O2frv605goxVSjpq2bYRq0jwv9TRdV2b0NsKMLswNa+NDok8RD/WSsQOKEkP UfJu2VjlZHclvevoAR09nLdSyNdpFl+HDLeoU2W3cuiPD0MZ1KoTVb+thVU/UC2VIiFJyCoaLpc1 EjlF5tyfF9LRQv8eQXJfOxbik1phc6gFaJ/Rig4/TpYne6nIjIQfd/xZQP4ZLTKba2tokalrDvnm Dau+O3HxXbFGfryOioa1s5RLVgNtUz80ElUpxzMWZTgbFQ5rCnMkVwZY9abRZV51Ecck4cFP/5ym e5YCsRhGaRg1RaTPRtyOso3osRb+Z5Vu0EGjiQ7qqGX/GOp1FObWdQblXGM9ubKt5Ghw6zQrcPSi jelgxsOidDAmndcQHI2jUbXiEaXSaINZtHizLNs0GJBa5JgE2UY5Ei1qfolyRvnR8TKTlTflSGNl 1oqg0nvDK2h4JphL/+ltGE3ja8a3Hnk21/XZFLQ04yu4KaPY4o8ZJtCKtkHB1zslgx2KAMrgHScx 8xDdLvPCVbFdr4X3vr0J23WTwrxyf6Z2oY0UYGjrYa0pwN4t+FZlkQIELU1ZutoFVTiNLlBdkq6G Amg0uVdQKCGH15lzy5XHG5vCScRGwjfcyNi4ZRsOrpRWb13rsjQJZUSououY0/ihwrIypVRwjNo9 63jxv1jpNov+8wG2WPZQL2AwBYQ05TMVp1JD+P7W0Lz4qWSSW/6JXP0GeEbENC5nx/0+PWAmGd7g OfmMMl1W8PuOJTl7/OnDbz9Tq198BAMz9LmHh79fkKrLYrc4zk3Zy/mJ+cxbsBfENPYKqF6kRzhh ai1/LIpkvd46GCgtMxWMGemU+itmF0xjjglux4bvayEhbGzJlkeUIdBf2qHuJxSI+q6F4lzQc5VF HEH8Is2QQCwRE2wz+nYjkexU15XbXA8ahH/rTahLQApkmoR+FJCpld56QucliIlssxjNEbe/SHCt Pl2Roe3pTl0w+BYmDWK6SVdDOiZ0rqnkGVUlT8nPSws8cCXUyZAazT0qymPWkIZK9ANeCQl8kilm 59pIoBNKjuA+qXV6ckmsG5DD9VCBodtoAVvxiuptkcTUxFhVP3ACMUGLcfSZT1OsW+ZZ2tpk01yz yzJ/47tijcoDPasCXUaqKCvVQpr5e5b8RW9WxKRX9HyI8UAIVVSpLv1YKbUBMbsolFHZB+Sub371 YPqUSGgiqmIH1sQdKa664nLmZl085fTSD7EDlMTkqRmtjOemnIfr5malg2eNW7SN8A4yQEmunPL2 xZR3tUZT3nJtXuryhsmv1ktqBWvSU1d7hqKOd2J87BbACmKaYRRPVqr4shrbVyOneshUBiAXiJkK 2DbeKUGfiqNc32hUGAhPR/nSTs6YhxCjNHxqYltoN9IdTAJD95V+V6lEylyaSGgSU6M/6fbq4nFt GZe9lJH3revoN7surwb5C45q14XX683TTiijZjenAlMLT78cUnrBGO+e0dq7L9+uvE2G6rmUpRo1 zMnPOoKuBuJUJcQQGT1LRRqIx5NSjD3fgIsrS3HZAFA0AyhKMXVHLaz0Koaq+8J0yQm07auIyEDo U3pYP6ahN0V+2WXwON7k0OOceg1hhLrG6cGO8pCmeI9Udh5UjB4YTyi3rCvWnIqRzSBCueUZ0OhS RAWgXLwm10iUUbXUg371r1bNU7KWkpAKtvcia6GHixXs0+vedLs/5sgriyYE+YXyA1EesQg11zhb HJKP8XKoaSgcloUe81T9OdzTu3ruiVLaLbwriGnixDT7I9k2nhA4M+eOHTPq1hBbW8cGipkNNIjp E1fhcHkiVe7X53BgTDmWOnwTDgd6Yw6DzcVb3Nba8UCI49QF45zGzz2DUH/GmZAsQcV39Mxk8L6t tq6Aih/oMZ6Qx7VBpSSkKtcbASo1iohKnAAWvIzGu/e00H+8ZIrh8pZDDyWBhEvHql95xAPAVq7W EzgcFDTXXV4NF363Uu7QrXFGLIlhyKrqbVLorxkGGCqxpKIZc1uPJaWl9ifW5duUwNUkRrCXf0kr b4NJenoPKvp3jSmdQl+qpyXjgVBJKsvTqLra/8IGd5XoTuXuqQdstwDCufGMTXmAw9gH8PrwJcnw uwMNxrZPoYznsKK/5YluyuHAdjUjHKO/TXGe6kJzENOcueRw8Qsa+brZshz9w0JU8SjHhgTRi5go AVLRzWBuhEEXgJZ0ZyE3nP919vX1ctdgc23jg22ZL4iucV78JocxHzF0X+mAWsEbfQe95Pw73tvF 9BIGw7zRBp6o/ufN132CtJK9jw6YOeF39MtXvP5bTGwM1FV5NgX6pP+ls7UZ5kgWNE2S1yWjFhb8 +1/Rc8y485/epMzgrPpZLzwONFjcX+vMfWsrQT2/ghL8+kfxE2x/G3/eoG3f6qfdlPNWebgTzhyP fu7CRVmAsmean59Zc2WJRvKrJTsoJ/5QGq2+KJcoxa6W3YAXBVNlv2pJ2Y9eAohp/vqLcqmxn4tq K6oA6n5iSd1PThXW+8kldT/8qNUMvx6n7lctKfvZ87rGW+2nLKn74dVlcRPlfNWSul/RyS0mIev9 5BLt9+v/AXOuo24KZW5kc3RyZWFtCmVuZG9iagoxMDMgMCBvYmoKMzY3NQplbmRvYmoKMTAxIDAg b2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgNzcgMCBSIC9SZXNvdXJjZXMgMTA0IDAgUiAvQ29u dGVudHMgMTAyIDAgUiAvTWVkaWFCb3gKWzAgMCA2MTIgNzkyXSA+PgplbmRvYmoKMTA0IDAgb2Jq Cjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4g L0V4dEdTdGF0ZSA8PCAvR3MxCjkgMCBSIC9HczIgMTAgMCBSID4+IC9Gb250IDw8IC9UVDEgOCAw IFIgL1RUMyAxOCAwIFIgPj4gPj4KZW5kb2JqCjEwNiAwIG9iago8PCAvTGVuZ3RoIDEwNyAwIFIg L0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBxR1rkxu37bt+Bcef3GmkLPelXX9zY7fN TO0k50tmmscHWd7zqb2THEkXj2fuxxfYJQkswVtx9UgvM4mD3ALEGwRJ5Hf1g/pdff3NTqvlTiXt X7slgJJZmnf/jn+oZlmdlKqos9m8rHO1vFd/u1bTZJYk+VxdL1Wetr8M/0jn9ayu60rlVT25vldf X19rpdX1jXr+7XrfbNfN/i/q+j/q9XVLOoYOIc8rIJmlWQD5dCxWWv2ECBRJAQTKHAmo/upfbRc3 e9X/efX2nfp5s27Uq9XHZuf/V6VePnx8AHCapMlfJscynSbAdVq3TNs1TTqJqrFME6ekpzz19HQO rFldnIo1qCC37AwNr2dexUypb1++fam+2ax3qw/NdrFfwZ+iRTTprJpEVBVgDHWWK0krXkQCK3GQ JB4Ho7GSiEIemBaZR6CYaRDSz9+9ff3mlbq62n/51Bxvl3MUz3yuFaNzRrtMk/KyFqQL38XBucda S1ADGUpGp0pSuL5d7dSHzfLhvlnv1YfmZrVudmqh1s1nhcHk6kqhUr4yOvpKfb7d7Br1x+LuoVFl pm4Xu+MVliYZBJKq4Os6VmFBvp1pa6193Y0QrUgvLEA70WqIgD33f980a7W4u9ssF/vmg3r/pQsG N9vNvdrfNurZVbPbPGyXjboabfRBbnUOatY1ZDfB7XKz/aB+fX519SvY07+/f717NtauKAppDENp USIZj+XzWKvTGqS9vkjP7Q+CwO7h/bb5uNrtt1/U5qZT06vN/WK1Vm8X941692W3b+5BkuAbIMrv F1uAQhGxe6bsdy9O8QfI9mmlFa3rWHcgdTlp6rnvAtE2MOQADv80E+ljhI+ZtBQ0bOtjksI1xKYX JjY5biZx1SKJqMTwWCaV8glMnsdbtJERYSXBzLEymLDCczTWoFiIgE5FcTNC9EPadaIHEp4z/oQ5 4AUkASf4Q2W6KD0KLJ/zqlRTiT5eRgItE8w89VY9Gu0B0af60kl7Kkm8aRbr1frjC/Wm2e0WH125 /90fzdbU/4v94vhApDMIRLqcK077jKFompYXrqWmmfZrzXMnjwCJq+am2TbrJbhFr7A6XhM1pvSk Bk0whs6piawUlVG0Pw8FDvLBHAJrP41DkqOq/93ytrlvomkKZ3dV/1QSGu3soegNVZW3/tFoD8SQ IhFRiofvZFbpukzm9QSq5SSrU11iO6SFVeq07oiL77AGrzzoWbBa7P67Y3zHdmaG0noF1X9SQR9h KgXQ7pvJKC4pAnIxKQPYHG2b3x+glQIVPFtOZF9qiHudQvLTsIUKcL/fqOW2gW2D2Ykh5UnboHKC QAs42hbY/kWX2MxJofaRShi9SQjauZ5jVZulIQpm59/FgGethDs+v/4HdAA/7lSazWcFtvryObBe QavvXmW68GB3fViewO/duW8n+K2B3aobBU1Dg7KY1WmLMk0cGQODzzkszxHlhH/agRRizLUWKIvE h92pHgy/n9z1v2U4nYeBKFIUxYGqdsjWKBgXuV+u2H0LmTeEGRNwTjIy246d9NqxrqE5lUvZrNsd F/lZHMsUtNGWkxJYDCA/jzGjLSdlkMBT+8SxyT/sRBQtcr+N3duIRguvS948EmA1nsKe/hzCI53o Et1fFyG0ZHOnWDcE0TYdhih8bt6rT1ghO7lE7g7DWrCtDyMivqf7vNrfOiKH2BGbRY1ZKIXdCmL2 EjGtXdmwqNPaBJyinpUY7u5VXti4ZmEQXAxskgMMPsKw2PvWwNog5r4v8xk4UYtzbuOihd1BNGUw jacvREfl8HsGhjjPG7ugDO4Xkmcv6QtBYrVe7VeLO7XcwGHRet/VQCYXR1YBokxmvfE5RqwKWrNT IO3pfbFTNxvoH37evTjBsBLcQaSwxZYEAoZ1MPTPu9wLBpV1BnWvwHatMRoYGBnB0s6Y7pT5FIzS gcBGJpE2IlyGklqZu0bhsVujoLszCrXYJfEK/UCeEgbAoq4rwEto3Pat+8p2IrH1GG8CQ4WAS1+S 2gh+BilgLw0PYaaSxM/fRdvxEIkKc3BVgM9IEu1BUldO2oO2CZ4oQ4I4eHzMcpYGEhoO2voUJnho HHAaZ9gpOIIpKOc2GFsYFJQclnTVH/8UQRBLR8TNvmH1Cy0y3nnmb8DPHjclCTjTiD1VH9J1jrpO EzAnSaLt04+lQkoucPsJ+EOoF2PRBuNHgb6Q5xB75eLxKFh9v90smw8P2867u6wSZ6tBejVwBJbb 0fOSyRiV980KrlOweKUTdA0N+0XJ07tPzXJ1s1qOFR7pRKeI/YIq0SnKqADPlstvVXIF2/3Vtvlg eDgmeKDaYfPokTgYPHQOMaqturLKbh0tDDa4BOvuvMDW0QUPba7BXCJ4wPFsPy2NsaQh13aZby5I YB91rBEFPQJPRJO0giaLJNI2as9ChY4xJJUXIK5f9vyU/bexG0LmHq6YY4RkyWN3Cc4+knRWY6F+ r9LSmpaFQV7iMLhnhF0J/imCTF46silBHFBWqjLRoD+LMhiF6gwHkrR0Z6+VwPvXs6w8w72ALiHX SQpT++MoRe5jaf24D0+KFOKSj37yPJ4BkRvYZgb34ZB+IDcABS//2PXzfzpeDhVoJowQLxpOqKBA 6yh58Smel6HopDWEDg0UhbTUc+LBcTBaGxorG42R6VLa0DnKqOr0/bQ2HAuHlGA0z5TgGrtS3fFK EAbFi405sJBmUND4QuJKAHVEMyEsCQoOyNZwuTJAIp6JAFpspuHZhlw520EcKPaGDJTiXA0+feEU LUk8qvb8H7Lbo3rV7Jbb1ae2fgIA/jyqN+vmfrNeLeGP7/aL/cOuA7sjUvyl4zOhu4M6ZUuTmfCA fIXtsWDG5DvPPfeBtUdbnHAbl0dqgTfe4MTKmddQHgEKnmW40BW9fmHalEck+ngGhkyb8oik4Bhg fzjejCiPMErGjOJ5EcpgZkR5BCh4ZkQsRGtDWBPlEYn/BA6YOVEeYTIyN+jHR95gma7xHj20DNU0 RMKIyclofK51icpHf67KR7tEJbVAWoY/OSbisi1TAyUqnwk1onwT3swCqQgW8UFuyJspkOok9Xuc YyLpEBEXVAM0HqFP3/08wlXbXbP9Aw7z6edRUfw42P4+nFAmTz1EgaYJGDl2gwJrvHr97vXVT69f kX3AVmuSxN/uYGUZxn89h4qG0zlrbqSggyS8qPao3n790gqc+DksOXjCw+ydXIqzYeIOs8xBlU1O ux2j8XIRNI5bSXpsApPEnNsXx3EZDoJ4HybFtnaIYWuvRPMAqYCn20o3gP/xFLy21A3gZYqyXQmn sKeuM6W16VFkhZ5lXd8iy8yBp4NBS4xggLPrW7BvO5hpXOT2wNR9DwemuTnIdDA4yDSwSVa479m3 DoZNeqf0yBOsofjFgyRcL7hwOa/xCkOfxiN4VvcD9frq/tNdY5/ltFAAfvvm+3+9hn+B0n6x/rDY b+CO/GN3z9F+SYH0gHGKMobSkFkbP1pnRhSHN+hfTMRai+un4yt6IsKiFuUhoCFEbOQEYlvCwW77 HMyCUK7uh/0RwO55Dvx3tmUCW+yuBR5/SwdzFSUOpgO5+HgdRJo5Xn3rmyCwNzYKkQ4YH0wHggYk +5HHUiQfOosC8fiLT0/AC3E/SYHONIA3vmIckjv1wQMk0qxGy1I/rhe73erjmlVHvDaKcz0SF6t3 OnFxl45na3BzZY+LkCsvP1tnitZLn1D/MJUVPFL1p9iUe7N1Od3T5iqgeyslcovI3VXQ8+iqZ0Ah I8Qk0gMVYlLRJ5gSC9wab+KkcJEkpAgnpfERivyBNnABPbD6y5UVBxwuUOC5QkwaKSnYXSJzCeSp QsweAmU6tUeThb0U62B4q9XWUXANFp/js/OjzIBOOz8KGhvL56k+w0lPkAjlEknjUaV5Eh1ehLrc 7AB4/CTWH2/UQ2GfLtsGSKRFfvzi6cgzgJnZWpwNB0VPfcYAiUe4O7H6A2/I/wjPkc0P23myP0Jm o7rU2fxpRVNwwRSkpD5/ufr7N3DNr/yNRD5ygx8mWaPLz7GnADRlBiRqBxQhIi6LVhIzj1YnVqHC LVgVKsXILMtuJ2l3lpQw/gOiD+zsKnP7KjMwCD8MZm5pAcztCuEwrr251btBcUoq5NGp8G92gr2O 1QypnyUtFp0K/wwIohM8XMIf6npFEx0KKm4KBT7a9Km2BLu/GWLRN2iIQ1bLU4MeiXkGflJFQd04 iTg++vaLRu+qlKtOn5bTWI1QOcFKUomeOegBxxf+R+3+kHrHrjesVDuoIGRBrHloneREE3JNPKno nqVGz/8xTHlbhBpiSAov90NMjaQjlMKjsfC5E5TNg63Aa8UPcrHB1laEcGA+K7Hjdk/Vn4VBrHUV IcLS7jUW/9SAeBNt5DXwoF2xmAsPmL1gASqINl6RDSnQSsTnOWWjQ1t8fO11RtwRUjQHwoJYNSXx x7MwlBjo2HaIBccLHIYdPYKKpYWOG95biOdGRO9e5rEXgJAbz5iIiWiNCJtiAVwSOIEHVh+wWC6V TjzEpzthVmzHLynEMzFkVuwgSJJgTHSHq2MuUVMyZfGV0Tj2IgDH67bkgNczohPiEY90hf9wezRe CqbMdjiJ2j8t6PKZ//doXxhSN70K15mge714DwcT2o58Ud1LDzjV7Wb2nBBQMD62rxQNVR5QRguU GYCdPjjV8BDgaQM4dV86JFGmyRxupF266S5pXMO0q/ZB/6fN3Wr5BV61bWGeALaaYYhJO2qsnSe2 U/DuHSdj9V6Fn6BTuHoHFRkUZGxJ8hxc1DZZhWMJuieV5tQxtTB86uhg8/bpJet24Wv19jVmbxsZ d9WDpR6msCL3j9dHG2PQuyEawWYZL9DCYwh5KeMsnkxFkyThXp3vbmFEmnoPo7XM45HuVMw9wxhZ IhCzTJ4aVwLdmY5Zzwm/AlOEwXd4g/E9nHzApC/Xq5mNFQPze3etNCRfwiuMLy1nBbZQsbA2x+Cp gbWFNYO1RkpX9fHXDOiEwpqxQKGrqPAF2UkhMagYZuhl5qfHYpbRlJh/Lna36uXdx80Wnlnfk/zG 7m5p2Ae0yP0yO961RB3EOanENJex6z0krHkaSMhExCWTpxr7B6Q2VBaTU8MiPFf6EyfGaCmC/8vI GFyHJ4U/ZWZMgH8xNMaFTmcPl2h6u/kxgSU9M5m89V5jn9DMsUHPDXfR87Ib0MKGuzgYG+4CMbyb 2MKGuzAYhj07oUXDe7l2mgq8ebLnUw7GhrtgG7B9G0XDXQjUH+7iPmcNZgdjDWb7PRQGbjCMhZlz MJBAzEyXviP2+00s4szbAYN8srWLlKOnnlD8p/exWhJgodJq0zZ4YPxDqyRIYZB4u8kAFgbs92Bm 3g3/NDAC58y9oSr1L2If0RuiEM32TBQcgYZXaLuKJxCnyS8xYp9lsBc7oJP8jh20I3oXNHRNS+zx Nte37373nCZjIAlPmE/O2qHLPSjJg0/+SYvhcrGjzAufX/nUV1JlXEYl59I4czRtr5aeQYAcL+55 cJxXQDHMaePWS+JhRs5aPlIxct7Ood3P0M5V44v2FB8UBmwAB+4wjjAMTWBMlra3OjVMKLGjceam bHYwCM0cZkfj8G8RBiEckwr73cqNxrETTnRhYICTw+xoHENngr83fjSOcBFmqCwFVHN/nxgcXNP9 Xw5G3jAhK2C03SQReGHo7x/l4JroExyyZDzZhjYvPF/sU3jqHf3BIsclGVByd6t4AonN5CcLg/xE sLKbOEdbLLi9b0F8i9WOOULbi/Mq4pEpsIaRCqYzI1sUB3k7QHjIx/gaSrEjGnFoMkSEEmMtaNjm XTthux1zM6aHe8A4gZxXno/gSPgei4IsA0qWzj7oBkoCXzXtpJvoBDSkHBobEiAjN95jtEOmTuMu ORFj6nZUT/QJLMOLnax2VDHi9XVN8hFVqq67/3UMbDlSmx0sDLYcBjbRAINTTByA4AIIgTAKRNby QxogH4RRNxfv0AZonH1aT4DG2cb1BHCfe15PgMRlB/YgQd94zxSpaGJPgCvbdSVHiUslzAHtLZcA 9vOohWb2BEiIoT1Hhic3tIfTkJlYhJGksldj3YQebWFsao+GHoR3NdaCLtESgP9XzcVvxAZoXGBu T4DKJQb3BMhcaHKPocT3lN4uBof92lxTl9idggcabHSPg9HongnAYEwP/B6lKQYSxWr8PGFydJak wHRtsSofZI4NIBwvDObyjicpMFnXg1d/8DgPJkJDh8/cQcrhAc2cgUAKDgRzjtqxWuCM9kMCoWAs OCvm7URLvD9q8FkQw5flhT3icx8SqIcvy2cZ7iEZPgNi+NKqMv1HtxAG4vjSPJtVODWQ8FkQxweF ixkkaNeXEojjg21VezeL4bMghk/nuqUKIIuPgXr4YK9ujq6s/HBKD4IYPmaVFh8DIb4f/gd+PK5T CmVuZHN0cmVhbQplbmRvYmoKMTA3IDAgb2JqCjQ4MTQKZW5kb2JqCjEwNSAwIG9iago8PCAvVHlw ZSAvUGFnZSAvUGFyZW50IDc3IDAgUiAvUmVzb3VyY2VzIDEwOCAwIFIgL0NvbnRlbnRzIDEwNiAw IFIgL01lZGlhQm94ClswIDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjEwOCAwIG9iago8PCAvUHJvY1Nl dCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9FeHRHU3RhdGUg PDwgL0dzMQo5IDAgUiAvR3MyIDEwIDAgUiA+PiAvRm9udCA8PCAvVFQxIDggMCBSID4+ID4+CmVu ZG9iagoxMTEgMCBvYmoKPDwgL0xlbmd0aCAxMTIgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+ CnN0cmVhbQp4AbWUzWoDIRSF9z7F6S6F1NyrzoxuW7IsNCB0UboYxPSHBJLYRR+/EydlUiaLMEVd eBX5zkU8Z48V9lg8JEZIoDxT6I5IKtPvj4WV2lGNymnZ1M4gbHHvYVS+0S2qcdI5Z2GsE36LhfcM hl9jhlv4Tyx9FppKNaoAVbuqBNU0JahEBaiq0iWoVBegclXiZzHzf3u9I0lkGvggLhiiNvjrh+eY UtykOeIX2o3EMJbfu4+TWcTRldeYZRA/cyOTJslKIYuLMzMeYsJjewjv4DkUKR7U++rlqX2LYPN6 tWvFKAvIdp073atPi4Ix9DdguHvonC/6lC830zu1I+iF0Fr9ACVkEk4KZW5kc3RyZWFtCmVuZG9i agoxMTIgMCBvYmoKMjYxCmVuZG9iagoxMDkgMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCAx MTAgMCBSIC9SZXNvdXJjZXMgMTEzIDAgUiAvQ29udGVudHMgMTExIDAgUiAvTWVkaWFCb3gKWzAg MCA2MTIgNzkyXSA+PgplbmRvYmoKMTEzIDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBd IC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4gL0ZvbnQgPDwgL1RUMSA4IDAgUgovVFQzIDE4 IDAgUiA+PiA+PgplbmRvYmoKMTE1IDAgb2JqCjw8IC9MZW5ndGggMTE2IDAgUiAvRmlsdGVyIC9G bGF0ZURlY29kZSA+PgpzdHJlYW0KeAG9XUt3G7cV3vNXYNfk1KIH8+JMd6rtNjmncRpLzqJJFzQ1 ktjyofBhRTn68f3uDICLAaDhDEnVWVi50eAC9/0C8pv4Sfwm3r7bSjHbiqj+ZzsDKBrHafPv9EMx TsooF1mZjCd5mYrZUvz1WlxE4yhKJ+J6JtK4/mX8FU/KcVmWhUiLcnS9FG+vr6WQ4vpWfPP9aldt VtXuW3H9H/HhukbdBw8vnhZAmcRJYPGLoavy7keMIIsyIMhTQiDau3+/md7uRPvP+49X4l/rVSXe z++qrftfhbjc3+0BjqM4+nZ07KHjCKeOy/rQek+jhqJi6KH5pMynNHb4dI5VkzI7ddUgg8y2ExK8 lniBNb3JMWokmMmRZGC8jIW/7J+HLsr7ttQiIcmVuQwguNB/LESjYXqRk9hm8SSw+p+HCl5w+3mC 7Wd5QQgcvurdt/+2ztJtSzxOSAlSyTQPnqWv5VCrBs8iY1BLZoH1+QjW9geyQqaQJFmGGH0eVkgy grKs9/8yK6wDdNNf2XLWBDnBAWDzfU731wTPQVgmVk7InKU1AkeDmf79rbknP+Au9g/zfQZVZqoY I+yvOtjqBKWSDVsUOWQ5wrAFURgb52F4Fj9PF/sKiJ7F+2o728wfdvP1ip3ds/hhVS3Xq/kMv3G1 m+72W/qPz+JTdRb7IgtiWgaljyJHqG+rTbWaVeL5eJFm5nmr92del0wb5sVZcjrzWOo0x/xl++ti lyk0XslHYHTRIvtAU2i8kr/6eUyh8UpA4EiN2X7rB+ss3VbRsyrGK4XOck6v5K/PJ7C2P5AVxiv5 y5+HFcYrdbLCOkA3/V/0Sv7y/TWhS4ONV/IJxPQ/h1fy1+9/AE8qjWHzV+1v2LoMBBs2pH8nh9ud Xin2MDwjp2z+kJ/ZVpuv1Y0CKPBQ38OWVQeBFlY/p4rGhSzzaFKSsEZJGcucfqphhTicJ3dRVsYI qWWWIjl0Kfvpw9WHTz9/eM/aEo0oNT+M0FeblLAUExuLf84T0n02LFHumOBn8fHtpWGg9TOf6wDi Dnn3iGbJ+9u/o5xxh3KGzz4ym8y+JErGGRU28jQbFykKG0uRZNKBLdqwhAoggKlvR/Stgt2L26Zm QqzCLmLaxYEzto3SKFxLkZlbjQBdh5KxU/t8DM+o2ig1Y1Sg32kq0XXcHDFglEeF8DdzfV/xJpjG B2jbpX+U5USTCWpTHm2vvrscSls2LAVlygWqNf66g91HkGMUKUdlkgYQJEVqU0mzioT+COvVZlW7 yldiEzIqJ7QJR+3vp9v7Wm6Yhn3ril38MgGYT1dkJN9d0tkpIflhurqZ7tabJ/z8C/uHM8jt6KWS pySex1kc4Mjufr5lOvQTV5YlWdLCqLr4Z7b4rM1dmk6U5YrLcRaX6Wgp0om2ZgoGy9WCRWT1ALO/ VTCyZjLP6jVHeZKOM7J8SyELLF9bTQ1btGEQf1pTfyvoWwXDmqM40fvU3y9FXOp9atiiDVPft74l 2GghaJ9HGdu2SJtQR0rpiDQEqzcTPa2xSh86nQMGJ5h6bixtLcHmx/5IuxSnpGpXhHqXj5UxMarR ASH1zmcVOVlH6wOOrNo/HxB6yX/6J/VdRzTBu3/Em/Vsv6xWds+hV+oUNL2ypNLVJLdJqaKpT397 l8dJymLS1+a16en4fwkzm0Qh1v2bOUbC3y/emTTKLHJZoHNTK3Na6BBIw2AMGAZNhSGBMqtPR7k0 INI7/tU4Gdd2YymyWKPRsIUNixs7shhZ32pYrcuGcv2Vmkwzm02jyejjtHOWweLGi4INoFlSIFZ0 FrU4cUB3umTYbFqeoa8RlF5jfVwErJDPfJb/U6Tn7mW6uFtv5rv7JWwEK9MJdOVIxUVlrBDjGZhn BcnMRtDtlDCd2zbQbATxi7UXHb5x8kmWi7OXA0RRhoUl2BQLagmzjbNFaW1L2HlH0RjNUHL87KQ1 jJ30KAestim242fYACfdS0sukteukvsYnkXM7DlAfXUIpj4l4lGMf/fXPU9eQH2nKC6SAII4KSFj z+Lzarrdzu9WrTIKdP7o1rQpYliHUg6x/6HaHrAdlMmYEg1kaEDgB2W14vRmSRtP29OaMoZ1EDW1 YNnEQ7m8x3RJ8wSyrLfveI3+9OnSB5lRhhCFmG6sikWgE0If1RW06KMYPYA+nklCq5d6jUWAvf3p 0+Yr5MeKuE1qZu1b8TVEHzK1L4+9eOw1rUZ/dduQ1/WKw8W7wPIUbqKU4C8fsNiBDLftL3T0lxXp WDapXBapVMzAEKoxLBnnTSqno78MkaECkUE/IlKz5obaGmjin4tJwFFbMtyLR0HPrAMgHwMsexoN xWHZdvCpHkvyV+4vxl1qbsaSfAQxSsjP4p+b+dfprhKft9TEVX+sAqz1I36bDX5AaIi+Q4KMjrKI Vm6Po78gXSpknP+baQ5ZQpH7sJZ4NgTWDzsuMmHR5tgSN7OUVXvihXHWpv0YbRD5OlTeo1lA5dNU VU2yyWRcqopPqbIvDaPqjg1LdcXH+lbBrCDtlDIAqzLcN9xeK9QcENZ7ht3K8YwuA4UTGECZs6xW gRfaRsy/fkFc0JiYMP+iOaQ96DjAJXoSwCGVv+55jAnWVTGVj0GbDotEJ8QMehRKkciWgwEk8jSe oyocwGF+fxJ50mWHDSaseplElj6eIkY6rvIRDSCRL0UmsPLX7U+iLpfEkZWPQUsRk6inOQnZX3f5 0TdHxFaeDJlkmGTTkSHedldprW3oTYSUy6YbiDqYCaQ0zA6ucrjeVnAlMgbBENcd39oh9i+DWcFV O42yLPLEm/YdbpGZTWyGvXX7jzV0aaKZULqQk9hNofRkhmWtekWHvH8zohRYvv8BuvTEzCgFMOj9 t//m6OyAXfGE2vJJTCwVC/U/jccOy+3qsQk6jKM1fIje7PAPwB7DW/+EA9iWXU/PdrOj9xF8y2sM OrNAZZz9T9AlUKbZ0esEI7rf0ZnVekzg0LelciO6wtH/CIFldTbry45lcQfvVt83uUDW4ojk4GU5 0rNEho1nnLujOsbTmR+GSg6jtNRsQsXCCRJ/H+P19MuiEvFfxL9+/Pjhh/fiO2q3X5qq+afqbr7d bZ5OMCITStsSFCot5GdIqAyfEukOa1p8OjUh7dIcZmSCixjtzhD4N5Rz7EWMF/TXvR66alAe2Av6 GDAZ8/3lx0vxsF7MZ0/idr0RTZV3vroTq+pRfKXR7q3YrcUOvxsUm+OlheMoa2e+tOi2gqlBRWVz k8wOkzTMDpMAwyw/tfntTwmEvNbKV3taOUXdl0pPKYaPTpaLMAepOo/7RRc+io1SWbG9ny4W4ksl rh6q2fx2PpvWQ/ifqt/28011M5RJwX1IklVc8ag34pjLNxAccVOP/39Bi2C+EqZOMx4qxqwc7E78 o1s650pIWhZ13wlDLFmkShUaBta3YKrvpCWEfk2B7CrlaFggbZ3AmC6EJ1o+fBnv57mCXGHLlEVu XJWPhbiqZnt0RZ/Eu/VqO7+pNrVknDBZZLqiF0Coj6QL4yfw2lAqS72JxaHLHqIUps/aupqPJWh1 udtNZ//disu76XyFy5e10eM7mkO1iMXAxL4ZYz5WCnhVZn2epo5CWuoxVLiC8UuOa2ltkh3h9oJs MR7QR0Gjm38Q/W+aO7KwcetHuCOAN9Wsmn+tNuSb8Nd8KG+CW5F65PkCe3EIevsEvNNGJlgcXzPm kBTKxUkuaDcO8ee4D31Xq/X6VrMa8brpqgzluRVAstH1iVAzg0+vDe9BKqQY56G5P4gWSsw0FmSb Zg2zTTNger5QfYstGtjrFTkmSeEwfrYGrVe7/hbTS1/M1fMLf3XNvN432llwg3o6QTejQ087OTXq 3ULhTViCYxQZe3BoeD/9Wq3+tEOAUq3Ecn2DCAVRAgtSX7ntCtHNsOKFT4PtnK4Bkt0wEjyqXxHo pEfvltIoSA8ZI2uVOVIxf0OPCJfuqhV54+rm7cP+y2K+vT9XnKYvRBJehxG1IWW6DzIT7cjXDDQG TrcTdD5Go+1EmmkzEMXjUvWRpZoiTDUMZsCG1RNEaESpbwX9noKRGcC7EvVEMSJEPZgYk0GhKWMD w7ARw8wUIn/agNRAcCLdzzEMzdhNgGjBzJL621FKFdxm/vHoVOOlQmyRuFnwbL182EOSmOR9NQrG qj0BycYKaBxTckIoz21of9mApAT0MjyRkGD6u25BYrhcOwoDwzwZw6JG4kw2OMK7JBpkx/rHDYS3 lYMjs6LoHDY7eM5BGtoWGGOPsQfHDPyMiMkkifOtQNlnvaqfIXm8h4U2hhL/abrYroWa/HrEdKXA wyVXH96dJd6KI6oXFVJc+Fv8fhUQC+h9o9lU1TCDKCrFM7DFyKR4CbIKNXXC3zKM+K6tQFJgL3qy 2aBpYLAM/DlmYCaNZvOnBjRA2bucGQtQiac52g4dAQnr+QH5UDg4ZzBC4a/7n6GrBr0e15t8DPvV rC5LnCBHfBJzmenCQqSSqje9j+IFa5BE3JGapIKWddTGksgDdFfLMoWsYI0DFWvjKoFupTaz6UpM 9wCtdlTQoQCGEpCzqB6Pz/nH1GEStH8oHdWBHWuoXyGyOaUOHIwTdDUmyYu600mFHKlVUsGokGPD UlJdY9wFfapALZU8fiTBUklIR3s0xQRw4guliSrMxDT63XxFN8qYjH39sqe4kogoEUySbLYNguWW z+RPWMukhImWuDJIeF9WBx3hGc5lk3HeGNM4RyRE0ViiYYjGFGxEMNkYU/tTBTrGLXuEY77JKHbz 6P4C3s9ayyj3ilfD2wNsNkLpVQDHJQxFXbuqNm/E4/0ao3x36+lCQINRH6kTrqcm9VHZLDIxVPsr Md/R7+y3w1MPFhGeolM7s4d1+hPYM5nW2S0eSuleFh9SiPKQWHbZuEZcBXObdUqtv87hwJZvxHL6 JGas1AecQZfosBcLYFUVWzEVq/3yC4pdKPYgd66ftdmJ6cPDZj2d3Vfb8VCXwMyT5O9i1Jhs9Ocs TYKWbrZygkxY7LJkIpadQfYJ7GGZ8HFcw85rrRPL+d39TjxUG6jVEgy7WT+u7jbTG/0rpIdw53vU 4OtLFFSHOIFtHDnLZmOvqnNx5kVCA4xaP50DDsetXeMCNFmnx/sn6mLUkWMqdtMFKvTTL+v9Dg0n vAq5nK+oXYnEBY4XKrIRqzWipPUJOqHvTtOAF+3qVYmL24GuXz07cekiaDtmqH5Ho3Cnkrk6v8PD XBv0eqkJbCIY9PG2u+pByBNEFRdRKYmawMQ02ziJmmy5LP1PMrfzdXYTk+AmTpuCQ9xOlwdgE+Pj CJmYoXIdDCYstwOsjvy9bMTgBjd4y+0rKRz1ZSArS4QRlifsFV9bTDSpgXRPP/rmBCaGY4c0ff3Y ATgcQVFjE+hYrTc3W2rJ7mf3cBE1JZsgjQzZbFeP56xXiydxlgRZUqIZ487xhWw2dZLiBcXI0sG0 9Nz82c0YcDi0xYDKHG920IODeLyj21sgUpr9lyT3plrNp4uhesRCa80vNzuyCdt/RNrzi5bQmkcN wTuPsOtbS+EGTujZQuEtPHjvFk3YZ/obPkGRwwFflnqJ3ABh62eNfRzV75iPqx+UROC9vkVwotxj XAsfRXa1E6WxKS2V+leSUzwoK3KzKVveBtOWeWZpb1a4bc/B67KBCPMsT9wY5Pwe1McBD9pbWZRc MIH44jWSGG/3Q9dlAlmKzlevAyic7GK6QLhbB2dXsGXL6o0zwfmG/LF6ThwN1sXN9ngbx8N5al8n yVzw6Jb45YUXwA3QZ8+QWgLI0RVwOM4D2TRFui3/rN1z06RuxuiQbqBUEvLRp9BXtz5ks7FXpS/6 FU6MN0T3+tEXOBz6Np0iyxpahcp+OTmrIl1Kigo8lEWj6y6i/rbKU3FLCCdd9yb77feQnBe4It7O IvJxbA2efd7NF/M/KEZRQvnTHp266gQ9tu4ENshPkjPmh0W3YuLOSvXnR5doWShK+erDtXh33cXx cY032MAL+HB6jE1sW7O1D5sKQy27rZgt5vXft5v1UiyHmoSgyMAmoCoX43ED2pajulMKYjFwu7La /QfEU5GZ2WeehwshOD/7cs95DjDv/cK10sNRv/q6QUWD+ILSxsN6dUPs3K3faPX6rVEvMvr0RCx+ +eq7Hz//4734+OP1UEaGiVvv6iSdCwoI60Yc+XciBhC3SwGN7yQcjt2aTRez/YKaktaAJkbAn1bT JZqVCySxv35DtaQKFWpBdH769VsaEq81iTqbXwY//84U5vKn2trrUjh35yfO7j3xkq9bwqamDBFs Kt798zPJ73q/wRBb9fv9FP9jmDrjrVs+pyQW9cgE3ii+UPhPIqPFHjPLjeK0VzruHTd3yaalAPQS ctup2vIf6Ijy9dv+E498uIQuWNHDzrg1xpiPbZkEtZsVDxgc6/8jym5NswGtvHqgX9yvH8Vjhfsf TNmBbebgLtD5ReuXekP2QVXf3gTNZFa3qBvP1vvFDd1AqeV2qPEMb0A/jlpvwKEDnPKUz3u8/6Oz OUtbdNR97U4pojnRomlyjyD5GEfDo1l48wx3t+vGt4FR41vDCpo9w+8t9KdiwiA0vvkSd1KOk4xe msbz0qqnntIdPxuE+SQN4lcW1Yfuw4tmvQjBZ/NytflYg3g962q5Xs8CUYder5fR3GQz263XMyBe Ly3V6CfewW4ONrJA9nppko+T9noGZK3HU+FmPQa11sNUaf2/IMM4pyJWqkG8njWRoNezQPZ6zbxY zWq9ngHxepOEnlepGa3Xs0C03k//AwlNe54KZW5kc3RyZWFtCmVuZG9iagoxMTYgMCBvYmoKNTA3 OAplbmRvYmoKMTE0IDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMTEwIDAgUiAvUmVzb3Vy Y2VzIDExNyAwIFIgL0NvbnRlbnRzIDExNSAwIFIgL01lZGlhQm94ClswIDAgNjEyIDc5Ml0gPj4K ZW5kb2JqCjExNyAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8 PCAvQ3MxIDcgMCBSID4+IC9FeHRHU3RhdGUgPDwgL0dzMQo5IDAgUiAvR3MyIDEwIDAgUiA+PiAv Rm9udCA8PCAvVFQxIDggMCBSID4+ID4+CmVuZG9iagoxMTkgMCBvYmoKPDwgL0xlbmd0aCAxMjAg MCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4AbVWy3KbMBTd8xWnu2bGIZIQBi3b 2sukTcJMZ9rpQsVyooaHg5RO2q+v8AOwzQKcGhaIx5xz79G59/KMWzzj6pOhSA3I+jSpe0R8xjf3 9SL2A0GmCEXgR1PBkeb4mOCS+ITwCEkKztYfuwuLhC+EiMFj4SU5rpKEgiJZ4j2ACyS/ME/WrOMo vJYiCEOfUFYzYJ9hoY2t9M8XqxZYqELLbDCht8mpZYmJY4nDPprLsai9SsWB0y8WQU8e5XIsQyfu 2MGKiPfA/p+4hROGEhr2EBhV/dapgsxXmV7qVFpdFpDWyvTJB5JHhW+fb+bXM9zdQZsLb5wb2iQZ cVmyfe28rcsGSzfMxpyd28YurX0b5+VCVdKq7A+M/qsWE+Qv6SMy/aRgnYaze6ef0/ODe108ZB1R T1eU1n5n3NVtG855FA1EeGZFHcOBomlZbBuDgVytqvJV5xuBOYEtMQ1RplZZU99IzG7uUSmzKguj JliW1Rt0Fa5bsYihE9Spunb8v+uyAY8OxRzr/z5UQs6AysLgrahtI+3Mg2bkMDej9ivpqzJGZWYC ZSEzVzLNMX9dabfFuJaVKy06ASNjN7kNpjP/KK/bYxw4vOlBtow27NvF9y/yQYGGPwbv2dGYajrh cfLDp+0x6s5fNNzN2GA7xd+dHmt8jNr8G7Sot/8AI9ziWAplbmRzdHJlYW0KZW5kb2JqCjEyMCAw IG9iago1MTIKZW5kb2JqCjExOCAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDExMCAwIFIg L1Jlc291cmNlcyAxMjEgMCBSIC9Db250ZW50cyAxMTkgMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3 OTJdID4+CmVuZG9iagoxMjEgMCBvYmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9y U3BhY2UgPDwgL0NzMSA3IDAgUiA+PiAvRm9udCA8PCAvVFQxIDggMCBSCi9UVDMgMTggMCBSID4+ ID4+CmVuZG9iagoxMjMgMCBvYmoKPDwgL0xlbmd0aCAxMjQgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVj b2RlID4+CnN0cmVhbQp4AbVcSZPjthW+61fglnFVSya48+jM2IkrXmc6lYrjHNgSJTGRRJnLTHp+ fb4HggAEciRqYXKIjbTwgLd+bwH/YL+yP9jXbyvOlhVzxH+rJZacheu3/07/EC+8xAlZkHiLKEx8 ttyzPz+zubNwHD9iz0vmu+KP8T9ulCySJImZHyez5z37+vmZM86e1+zN94c6Kw9Z/RV7/g/79lmQ HkNHb+7HIOm53sDm82t31aefaQKBE4BA6BMBdnr6d2W6rtnpf9799IH9Vhwy9i7fZJX9/zL2TbNp sOw6rvPV7NZLuw5u7Sbi0t2ZZi1H2bWX1jfVcvJdS06P2NVLgnt3HRSQOrZHineiXhDNaHbMzmiw F0AHuMv6FJZNWWaHevfKVtk6P2QrtmrlXr8es2oB+krIziLmSehECVmS4yUuD+mfxFrMRpnY7Esm xjkUgvvhwAnfZmWd5gecsKi3WSn5MSMjH2NpmuWGRfMADHGdiMhZMv3ZIAJzvs5/GGbHQ1JxNx64 0WNkyiMYtusNCfX9eybE98SqZrllaUVMm93knlzuOQvP4eY1+pb69V/gbTfwtpdUxIv5IiC/G0b+ IvQTf7ZnPrfW2O50jZN/3rGT38q1LVszN2l/Pwvhp8MYf7s3/1aunfw+gfDFnt1vcR61hj1nSuy4 mUs3u0PZtH07jqVs19h3L0IZyqbs23EsDwJ3/rdv//nElumBlVnV7GqWH9guLTdZydL9cZev82Va 58WBZet1tqyrhbb4cZfWDpiHUBY4BObpc/SV5dpdFf/cwLP5N9o7nuOeJgDFPHXA4cKDD3yfVfku zw7LjKWHFfuuTDcG4dnNbiiBBXOHB4imirDkF+jVrwaRUb7OkIQDSXAX2MUJ7+WZ3lUxigc2EBrv 00ZJgnOggUlDYZ/Cbz//9O2P74SlvGSsqRAL6wJhsYZVwGiWBawF/8KKki2LsmyONf7iM0GlVVqn 7FjmRXm77bgOhSRANONgt9rOYMxTwgt9WyOuQBnnpNd5IWDNU9mBjXldEUufGIXX7OWVGFpmaZUf NuSXpHlp9l2MJJe9CIENrbvcI4QB8NI73XjVPQexuE/GHHv9/XHZ0YZ8ngLdIAn6FA5FDeaClQad UV7JYE+HJgbYoxDgZZ5/MYfiEYUGD4Hf1j5pS8KI9PlVAL5A8xzDAFJBMx5g2BN7aWpDKoRfZqPw i5dI/OKEi8gVWMNPgtO1GfCLueYC5xB+MX8r1wi/qKuOxBpnr9ylqtxOJdJdBSs81GWxapZkdVWx zya0t5jSzjhwWe8kBt/vEG4M2ToxUsje/qvskKc7rUrjiGhTSMjMuBf1dx6fkJ+TEXfIU/C4v3+x vv3UnOIHd8P+ro86NbFlgN1VVn7Ml5k+udDn2ah8kNyFZjx36QoBQuCp8s7eGCozOtVwHZlWBLBF n0wQaYHTmu9MrcEs5RpKQf4iaVMN47dqbdhUR7nZ8/F47inQ3gX8ewKywdAuIIOCFfLXgLAWxLw3 4kqV1+IMoDCOH4fMuKAsmxnyHGedgxwMycUEbjRAADF3n/6X3NymKFDTIICWH7S7u0BVohx9F46K AeoTrkmqE5bW/HG7Dt5FFUD6skpbkHkjmdlJKZOTSvAoMO8hZdIc0o9pvktfdoYtX7hRT+YqA5xK 5jzEBVzUb/sE8vXVamUIuMMn/X1F9WRUcfes14/o4EPnLvajRXuWAEVc148HOJNdzZhhHY3pCsGQ QYvS3GOouBQe3ZgP3IPM+FpeaRG7CJEoOg+5iwedvKuV9XUorwwSMoTNuB+1wDGI/YUoaO1Z4HVR q1vbmWteW+DaMeO37RpAJ0WokRiyl8YZUUMlivPILo7u88pKM66sS/jQIMdFltTf22DQBa/TO7xR CVPtFBCwslCdt2sdUtj7Aslzhkeew4nElSyKKB390rzs8go5byVKR8viUDV7+rdiLdx6hVrCgerb FKvaCsTtUUq1VYzL96PUaAQVybwmiNxFjLoqarVIcKXKyjXkNSdrfltXNX8ql0z8NHuomgI3WvDm 0XXVOUhYsi0zJK6rilXbotmtGCpG6ae0RHVoTSWOKmP11cWgYafrQr14gMDRv2a6yor1mro0/9jm O5DcZpTioZ9D9dz86sBl+MoudR64+XhDPWc12svwyLV4e434ztFQ+LdPAiWpKkPzq2WaquI9Mbg4 WOQ63zSlKIvDUkuWU+lvD762lfKXBrUCCPsRlmocrW+qF7xSzxEOenEU5Kc2D6r5n5b8NtkhK9Md unb5YZVXNdxbAz9I6JKty2Kv9TTdsRqNiKzEnzxJJwmLup23nBJ4NwJMMY41FW/DXnn9ntzNCGRK d91Q9QYkUt9lqShNy8ybrQHbockV+7TNDuwjOKl6OsAd4Oy6KPfZPRxV4Ng4zEQc9XivyfNojoKE pa1pUxd72PaSNHah4cEF+5O+R7tNKqI6YQLo2iNxtdfUu2pX6YW9tsi1hx0MMpqC78QWbx7ujPsk xLzJUSOlffrKPqWHuu2/HHfFq4RGbFOmq4aE9ER6vU2PFXt5vcdVUIU4RM5kHGoixQb0ndoNg4Ql vKZGleczYUvqU7XYhDpVH1M0stCPYdu0woDAblOUeb3dVwxgldpad9VKVCJqnGcipgZOb9Ln0d4C JCymfkBDkABWIJrDH/I9qiYlqSQwYX5Enxi9LlOFAe5rVKQRCztkcRdyIJVFU2NuHGwq7vqTI4fA t5HDSfxSoa2gAaAUqAuOoaRkqYUKO+gx5hgoubrDC3SlGeMwD+UojwiR+MDwoGA5gawsATAxh6dG m24YIlTN4wEC4wNPD04acERHiAAVlFOs9/AI0SexkRly9j8CimoSQ9gT+j0YzPgE/yUSoHWW1kBD jxhjmRsHuVUhhsJ46NtN0EcLKUxsoBBRMaKFginx6y0qEfkKGJ1cWZcpjp6q07fi3aTJ/ITmjKZj r76V3lbrW+TFlslcva3GPIMaHcGbTqzRfRLPW2BzpKAyVUdQLj5CHgLYo3WRtUV/AxSZ5YU7fF1M rgi5kXGiW1Vbs3Uw74y9yZE8SFiSk9mOUPEy+6PJS5G3t9U3SuPltJsowGEGZdesCB3J2Z/376u7 oI/2w8bJpmJvbDf1rvHD53y9Sj2hKxZ7217UHRlSQMVSjMqweX/z8XbdS7y0u0jQD7SM+cEpUhLZ 803RgsO7PoSMT/xx4QfnfTIfvv/xlx++ZR/++o0X+5LaDR6b0I4TRWiwnJB4nMfmjssndtmcsmxL zA+SgNL+ARrfANi31VU46mOZfcyLpiLkT5VXKZ5quYXLEQmAdtP3Ntdhrl+enSebwqwTKsR9rtBo mFbMrt0xu1DY6HkHw8HrFi+Rs+SMMrhB7dI0+IVTnCvtqun3oUunR0RTZLmU5Go76foeXtecoIGs WA6GJHKuS61hMMRc8+QMuvztjP5OrlFjw+eylad+j7n2rlei1jAXZq61v5+d/NbY86YeyWm7X7tF TJXaZUREwzIF/kDRS8tsnEg0TqOHFI6PhxvzAQod8694R3FO5nqgZIAWapy334KGCpwQpa8Lt+hU SJkzjf8MPYVRKuaiX9aOCaqOLR57tWtGF5fWHHoOsWPmT2kJHTazdTa2w3uOkaZahDaCugZFnCOi /Sg8huWrqfKEZwjUdqngO9OauiksQwqHbF48TqCuyzbfbJH1r14P6T5fIsJSnVD71AuqKn2YVlX0 KSEtTCRCyOJEM+Mhn6Gq4/a9AH45pg0s33gNY3sO2EhcNGNBw2KskS/IxuQSnF03svgkMj4RrEgC KAdK3AtZiJdCQiBPt7NYN6Dp/jjbtCwO7PmECVgc2HASAxBIn/MancLNtsZzAWIlChGir6+jzR1a xOl1JBoI1Hu1b6gGB9qZtt/fZIvNAu+80I0+rNLylcFW7pnfUr0zom0p13gbOecXDOfjIQ+YGsT1 aVDbDBMYv39F7QUqKOFJD7pnRVMu4Y1Q15UvIBEXlw0KjKiPELpXU/DK+dPsy5Dzvyz6L2O57tXg HLNENnO+a0pykPuixDsKGe+uedU37LK6p7iCouWyvjODagcex72FMxyWS8OTdJ2hSxlK1YuumsEU Z/VD08CRaMuNYjU45cppFbWGwSm9FnWDU91vZ26k1loEJwevMJ3Uvg7EMJai061hT73mti8AdkBw 6rfd2k0x+xzKN80GMWxys+nREAFC+Lq0yqon8oCoYNEYzB45kahcUSCXEUXU67tnVNSX1vZz2Tys sfCE4jY16TC9SjefNKgA9VtG8PigAhqWAPsuh9U5skiqEeabg2joi1fau6wSiOlABcNjumkHUuhv q9s5rMtWvD3apBxGtjA5hykjOTURerh5bYIw6DD1CCPvU2mOmFFth7DKj3hyc0cXggq1DlVo5pLO XULRMNhwJH7Sq9COZtE5hGqQCHy7EXGNOZ3DERoG92k8oxyDmY5tUVZ/soe3fn/T9W85UBZQQFsF RujHE+niKOrxdXG7MeGFHsaMMdM2x9QeXf4uuQ2qoMnfuNcduaIOdk6IBn9jeyakHX4Uw1pldizK mr395e+YJ0g3Iqugx54FKvEddiJxVMW6FgOSn9CtRRi5YxzJcFeBONqkHA69yec2kI7aWA/QtB2h gzdpg0NFkI8R+KOM+cBiemP/wzuZRKu3G2K67h7tpSF5PAKdy0NNy9t48vENfIfDRkv/evvbuw// BqYnvazFSOJLtis+IQfunmKMLqsP2qd6iwcm9m64T8v8syh7qOIk1cemrJWSKYtHPwPMQEZhxEVg fHz7YvTbveHbU4TkaEAP3R6JFr5B0eoykW6L5qOjjgwIRjRTr0UG7mZcrJdbfKly53lywp0nEsvj 2WAg8w21huqwuUaveVG6O/nt1C9855gctmHk42Nrn4bsbxCeajtR1gwZZvSK5oj+CN7gUT0JAPZz Jo3tPcDRPb5JRdb2WJP6pqj3+uUa7o6LrKBhwdRlsWv2NLsvqnT7DI4+3RcNZiFpeI9SAsRVRh/4 KVB6agsU7Qx7GyXuKN7puWnenmtS9sZubwbm4cAFNCz2ls1BvLRBlYfy1mKFr6xAf8uVgCa6enev Oz4V/2lThtM7NO5RiO0fEBk0uUUhaTGuCU34hNlMDCnQ6e4u9+hRNCJu5WEoA+/zVfttN/VBu7Fl nwHXTOaKL5oM3fOOEQKjyNzn3y0u3/dk6YgHeEtHD5io9CNLOmqNSj/GGkdXhz70YP6W1mS7xo26 MBLE4kNX2NP4W7mmfz/j+Dv5UauT3xofulKSGNkZ7Euk+zoEJIL+/2mCbHDuQoXm3L4Jvmswyb6h jZAfcl489Ld7Uw/aN6T2h/mpyMfsy/HRukn2xQuzL+7bgSfqeQf08ba4/aICfbyN3j4aS1B/tYRP vEntVT/US1RzVcvUPSd7MvaTS8Z+9AzR2s9YMvfz/EDYsbFft2Ts1/VcsdQdxFgy93PjWHwZwtiv WzL2MwrK3X7GkrkfIu0CX+M079stGfvBRttCtD6fsXSyX+gv6JWlcT4ul8z94N2kh+rOR87NcFq/ /h8EY+PiCmVuZHN0cmVhbQplbmRvYmoKMTI0IDAgb2JqCjQxNTMKZW5kb2JqCjEyMiAwIG9iago8 PCAvVHlwZSAvUGFnZSAvUGFyZW50IDExMCAwIFIgL1Jlc291cmNlcyAxMjUgMCBSIC9Db250ZW50 cyAxMjMgMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9iagoxMjUgMCBvYmoKPDwg L1Byb2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0NzMSA3IDAgUiA+PiAvRXh0 R1N0YXRlIDw8IC9HczEKOSAwIFIgL0dzMiAxMCAwIFIgPj4gL0ZvbnQgPDwgL1RUMSA4IDAgUiA+ PiA+PgplbmRvYmoKMTI3IDAgb2JqCjw8IC9MZW5ndGggMTI4IDAgUiAvRmlsdGVyIC9GbGF0ZURl Y29kZSA+PgpzdHJlYW0KeAGdkUtvwjAQhO/5FcOtSOCsnU3ivbbiWAkkSxwQh8gyfQikgjnw8xsS wFTqgWAfvH5oZj/PHgvskb9FDR9B3Yy+PSJluN+fC6sKoQqlFKquhOF3eHWYkiLiGs6DTfe4XUwt SkQs2Ermdsid09BwG7wsQ4xhGycIxzHcN2auc3/EKumXZamIufpHH0NVE0B2Z2BbLLadAf4CNFuF NGann69DiHhvDv4TegJDRqfrvlrNm48AXa3H2bPEhtqOjBRn4mtDWf+jg4kTZsqJzSWn4pLTaOg/ JlV7S/+mek3/rtfFL/JRhbQKZW5kc3RyZWFtCmVuZG9iagoxMjggMCBvYmoKMjMwCmVuZG9iagox MjYgMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCAxMTAgMCBSIC9SZXNvdXJjZXMgMTI5IDAg UiAvQ29udGVudHMgMTI3IDAgUiAvTWVkaWFCb3gKWzAgMCA2MTIgNzkyXSA+PgplbmRvYmoKMTI5 IDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAw IFIgPj4gL0ZvbnQgPDwgL1RUMSA4IDAgUgovVFQzIDE4IDAgUiA+PiA+PgplbmRvYmoKMTMxIDAg b2JqCjw8IC9MZW5ndGggMTMyIDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAG9 XFtz2zYWftevwPTJmVoKwTv7lmuTXrap7ZnM7GYfaIm2WEukQlJO3emP3+/wBhBgZVKiNnmwDcs4 wDnf+c4FIL+y39lX9vJNztkyZ0b5P19iyFiYdvUzfeMvrMBwmRNYC88NbLbcstc3bG4sDMP22M2S 2Wb5YXwxvWARBIHPbD+Y3WzZy5sbzji7uWMXH5MiypKoeMFu/mDvbkrRQ+SIyW0fIi3T6pl8PnZW sfqZEOAYDgS4Nglg3dW/zcK7gnX/vf3XNft3mkTsbXwf5epvGXu1v99j2DRM48Xs2E2bBnZtBuWm mzXNKo2ysZsWOxV2sk3FTlPMagXOqbP2GqhdtkXA68Craxr8NFg5swrPQjkewcANmC7k+7GTil1I TuJZwLFn9cw/7/t3PHa46TgL7nR2UmNn+E4OuTs3AU7ulltRDK7uZLDmIG8GehHm4C55gOn36Gv4 LjQjc7KyaZk9s46GTq+VBVYNYwhWZyM4sVdgC1vDUGzxd+kcJVVdx39F7MvF1VX+5QX7m12FBf24 zaPly6srGhpspwMa1Td8/KytGk3HUtU4dtZetVnk7Yblsx4BCqmQvDFmEhhubNORMaOwOBzChxyx oRTMr9he9cPy57GKExtpKaWzkzLAD99JDZ1ec7SUogtQt3K8OVpKkYQcS4ySbhpK0a0wnFI0K0v5 ifAFpGMTh79eY7Sw1eRVlNL4BzfKDR7nG5wjHnJyQCGlNsbotE4yBqfYh58xq+IS0xiDc4p9tisv u051gwDUWv+jLNn1rUmIVVJQLWn4Vg75XIsryhUG4GqMnQ/iCvIU27R6g/o44shgptLTBg5i55bN 9E0Nh5Ue5Bqw6rMOX+shW/AGt7oAFFZdXDkOB66OLi3aFEgSdWxp0WtmgSvOFTs37tF+HWvoXoEN X3GOCqlTHghcAVUSrGbDil2JV6ge4xbTRcxPsESLVbHwSS3RciyWrVgCqFJhZTiT0JWuomlcpIUV KvWulVs0Nd+MTREOosq1FdU1oBqDXal1Muu0TgKiK4M7TNsVIVaC7HP9GZ2zDAqFpqvPfAoR1n6g rXYaG/PGI7T5Ca8KYF3DnIQHhaxJna/FK/cUADUwbb+OQRJVyQfxytUeSYXXEk4dPM3G9eG4QQmb aTJNwCkU2IBUTDqpEXjD26oNSjwpgPLtiRhQtcA0ztECam79f1sLkKcgmCBVAaqDqCEdZKmwwQxg KO4zfUMnUVSNU33WaewAjqqIVRdQoUqCFTRiAIOT8JQkblIfEbjyVC9pGar5ZlKmmnuqo/zdoGoE rLTAF1Cqxi2P6fOfBKsGrNqqp4JVg1tNQA0rFVf2RLgS8s6EK7SPFAJp8NR+HQsskZo32f8cUpTE cJreVNNl6xGg9qaqNtvxpVnTuZdF1TYZvhetlyR31ZvWPUlQbNJuZowt/jGx5XSsxpGzyXup+xe1 pMFyNBdvO3k9kw9XlD5t08rrmXa0kwuECoLlnqlAdPS0vbmfkGDynl7OWEX3yrAQ9Qxusrku4n2a sejPcLvbRJfsNsyjFUsTVqwjFt6mjxErwlv6TVzgu4coZ+Ful6V/xlscQ2yeECK5dXwRbVISYfq8 s64z8Zjpak3FESeOml9KqZBQrqv2eHFIkyarnBUpW4ab5X5Dhzchu/7466df3rHrD68s32ar6iz6 DoYI2V90Ov0tLtbMNC9RRE6iXLGuMynX4uohBoLDYOQOUi5EKO6HE7FLFiYrAuoeh/YLhzX6VnVp GQYpk+FPFsdrlFM0MS0XOa9YzLEa7aMYy1VbPdMoUVCMjXxWa8AMNlRNuocpRhdxs47yiN1GyXK9 DbMHcEhRRNsdGCVl0bZxim9plhcnGMemFMxH5igtoDbO8NRRg6Icf22qHQKwFSQo8XcJ4mT5MkrC LE5LUBJbjlWshImWGaXdnOcEYY5tnR0Tmog4gfHD5TLdJ8ABok0RbyOWRV/3cYYQVBJmkiYxaJPO v+kTJTXCs0/AiE8O7CAOSns+1oF7vUB4mmNo13SmpkSIUAyH0LyM8jxO7heMvQuXa5belbrzDeP7 UoE5+xZlEdtGYb4vFb3Ookr5FZker1wRzKV1nUu5tnoKNXm8cWw1GQMGExY+Rll4H60uqyAdInrf 3UGjQHGGWJRuWZ5mBQzQaD5OdghOq7AIj1ctD8A8JvLPubSqc6k26GkkDCYyjT/78iQnUHsHO7Bm VoYDwmwNzi2UupAkj+55NkW/Lo8dbwvh4a7dHmacyRZuoOYDPvz6UxY/hssn9iZN8ngFOBYxvpMU dbiVp1VOAQVOw0FaA3kKoQzPP7RphaI83BRQko6xq32GbD3/7CFMF3GzjnOW76JlfIcwRUZg6zBn Scri7S5cFlRH7fMoY0A3GeyUzNOhC3U4aZxLyzgWdFKW0dz9nfuWlsAPNtEhnxcg8H218R0Ay6+W D0n6bROt7snbTwCxRxWu50FDuqBJQByYKmmNnvYZEAdeyydNpjciYxiUm+sikJuzcF+skXwjouVr IuFiHSYP7G34GK/Y6024fAgv2fUyLQr2Id1souQ2Wj5UlddVvHw4gUrbJFda17Gofka53DBVLp08 ZSAZCtF9jjfraLNlVJAiOYNGKTW4i6LVLfRKDBGFGfooK7qsnlc5A1hllS73Vfg7vh/Z5gz1smbS zf7h0NWcWyqIhHNzXL5WKqIzaBcXvLth5NVqFRPvhpvN02C6OuQoLrGIixp5TjtSpF1SJv1Ue8dP acReoTP2dMl+RU3LXiWrLPqGHPoq3OzW7G262YZJfnm8c4icr17KWe3H+dm7Y7hborbHQB/rMFux H+PbPE0u2W+b8G6fsR/3q+0ebbNy7HV6yz6EWbpByv0p3G/AQXd30O0le/cYJsfrV5Qr9cLOq19X i68juF1zwr6sGupVO2QfUFyDutf7LYjmw/7rHo3cm7DYP4XspzjZRjHAGz9E7LpYsJ/SNfDKXu+z gv2Mojt/iKdBb7Wss2rX5Ooh9/TsAxkKH1wjTEbs5yjLiAMQHX8JsxKypEr2S/QYJ9D3uxW+RWSt P/MJDY88KoqTdEtdc9x8wUlHuajpdcupJjBd4kFdt7/uH+Cdg/m2Bq+UdTbPR/VNfkJkkpxCikym o+VtIzzvULBo+/44jlNlXCPjz8KSpj5FRcauURBESJp+ozDxB7veZwgcSA420ZbdpGmW7i7Z+02a xWHCPkdohWUnAMSk2z4mSiI6CqOVTQ8QScF4GuPsoR8yFOe7ibfQ3zJOHnKw2GccAKDQ+hz/kdyH WbaCt5WxohrHT3RMkCJ8Z2gubG8jJLvp3Smxo1VwtbLzKtg5eyeRW2iKdnMrKIutkjzdMTTmHyhr vc/S/a7MZPG7OGNlZ+uUopYciHsE00r8SVqU+KWtarkVaGnpWN4SdUU/v9h4nqCrOW6gsP1IB6qU wleNgWt83YvyFq0snweu4QXUqzGswERuRBU+jfk4SHjuxqhGqqKJw7Ei1SHHbrpXmXag5TBj531O mY6tFlBjArnWghIMrU/85WLw4g8GATRmDO6i78B1GVfv3yD+x0Wa/cA+bdBypxOObXmqXvaOomXZ NbqNUB5Go3uSQplSTcYdoibDqtaj4GC3v93UrSq5sXq4X1hBTQI/b09Rerb85cVYtQqscZ/a3NSI 7JlYSgxe/ojH3+9z5jkLhx5zN02+cMzAnm2Z7VjdMbbpjhk2HoffdP60HlqzO4aZTZr568hesxQO Hb/b7JxdSCsf9uhCr2ElEa51/ogLGQqtVe3OGrKrOF/u8xz3QShO5CW7UfcCnU+J9ui3YYGu6GN0 fLDldM2+SnerRf1DmFBRwQN/EdDLD4AKt0ZKOwZU1GMzGsPbA2RUSEMdVBx2lEM0IVvPV0PtERzX CxFBd64mo2o+4WQ1TkA2uL1D7WrKish+Bd6F0B5Zof2EDxfpMt3goL76PZ3NnpYwkWfjFQ1z3P6i 7Q+1oe8tXLLNljkGnJy8HWf81dimHZvRmGl0bSiGprehZ6rNoeltqMvYpV0zte/nOLpJSD1CbuA4 bo7bbbQl2S7T3JoQN3pJhBKQ3maDo8WhHkj7eEOzDfktJmisVvk/gN253waUQ6PhBi5xCju1lbKu QYn5NXby3IVNiAU7eQ2ymzGwUz02Q368CBDbpJglDZ0B2eJC8bkOIbinyfgPMiUvsM3/4s0G3yF1 pk45Ko5X30KcrONCA4WWq32S0OCbdBX9wG5AW90c+3gbSvVytTTZCw7Z0LUXfsVOdtBEmGYMNqzH Zhxjpa1F3iENTW9DH28A6pYk07OTLqMqcdh1lSF89+XFojTSKsqXWbyjeHO8hdont+e8EixbSJRV o6smbtIdAapAMa3CTZLhx6ZtcrJsgh+QzlYiFLP0JEwx3b2lc+VKjcerrH0LUZ/KpL1pxIQM2q2I yTG8OuQ2YxRyq7EZCg08UdYlJjF0BlDjbPfsoNZkgH8GRyit/KQbiYaJ+gYm0GaWTPAMvA7llXQl 0TDxsoI+EbhjFyWr6jZdiFtheLMV4AVyre+ITVRxiscSsEvFiUosD9ZgN8Z3H7blNrnqP+y0Pj7F 2TUCyWBxmsHEBd8egw2vmHvmpfS35IBDONBc0TYXVl3XmkHtivUY1bVijC/8bl3L7Xao44rH17UB nvWT/e8MdW3gnr+uhYzONthF3ZhJUlzNL8tVqohw/tVURGHyBLdZxTi731Oy2KlwGV1bQ/U0CU9X a5NDm0QSGjh4UL3bj0qjhqebMZmnMYbKq5NAiqEOOKYob01DXI0/VwLZIyOL8v0GFyjQ4UfbOkVf AvYsbfXEwIG43VI2Y9ktnd9P3mqjBSnE9/HdzXuAYzAXaQ3d9lUf857ZJVw8Ezy6lIpXP8q5Sfs8 Q49GSzUNffHjoRAl2oU9UqhDeh1lMQxWq2pGL7hEC/PZt1mKviGOKEGvVMV2JZRv62rmxdsrNRcy fMgpazDhQs2YcCE81+qVrjaT8vd6CDQ8woW6xujGN9EhwjuD1KPmyfP3HhlVo3owYLUg176KE1bQ NzB23t4GF/W2DeQBZGhNBF6Rd/2u034eGezE5R9t9tnF8OiveTK9DNFwcZ28XLXCExI8h8FeKEby 5PY5Wm3l7OI9bnSAFrc4Yriky6nRHRqA1JRFOyTCjXbcYKVHMFKGm+3x3dPxkYzj5iUatV3j6Nf5 VC8MXGrTWgF1Qpw6y2nHkOVIY2jTWoHkhfhYOXQWL4TXK5nC9F6oyyDalVq05DZj3t0lSLF98hns 2G5Et8ZY0ElHTeLKLYlQcL1DRAauUHyUIblMrL4Bcvl+t9vEGEYkxrORRRbf7nE+hsfyRKwZ6bfo 1gN3HgFP2mqZfHSSVBV4vkN95Ap4fn1s1I4BeNIYessd4OFj5dB5gIdugZxps4szAE+TUR7voPGA vKk2xRGR2CWCdujekEk9j3YXaiQ+AXUSS0OEgrq24g3rOx9bep0zpYK3EcEtL7J9VQ/fggxDPJRb hJv0/ngvE61DecO6m6nY88qOYIW9pnXYjonWIfMs6v52sNcM1dhr3wFuBQvLodNQ6ulTYwZ8Cmt4 8hBmroZm0izNH0pDlNP8/j+a5hYBCmVuZHN0cmVhbQplbmRvYmoKMTMyIDAgb2JqCjQxODUKZW5k b2JqCjEzMCAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDExMCAwIFIgL1Jlc291cmNlcyAx MzMgMCBSIC9Db250ZW50cyAxMzEgMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9i agoxMzMgMCBvYmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0Nz MSA3IDAgUiA+PiAvRXh0R1N0YXRlIDw8IC9HczEKOSAwIFIgL0dzMiAxMCAwIFIgPj4gL0ZvbnQg PDwgL1RUMSA4IDAgUiA+PiA+PgplbmRvYmoKMTM1IDAgb2JqCjw8IC9MZW5ndGggMTM2IDAgUiAv RmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAG1mEtzmzAQx+98iu2p6UxMJAQI9dZHptND n8NMZ9rJgdiyoYPBRTh9fPqubIx4ODbYTjKTgGy00u5v/7viF3yBX3DzRlGYKiB2QIVPuMArhzDh UF9fbcYCUFP8Kt66QPSvvghsJogPnmA294VrTZfwOoQJsQlxOYRTcJ3Nl/Gfw4UthAjADQSES7gJ QwoUwjlcAcALCH/CbbhZzckmmOfZhDp7LORziB6iJI3uU1mbso7sBra7MVvw9fw+6W/Buhq+gWrW vT7yA/Sc7wq9A6vto2S5SuVSZmVUJnmmIC+gjGWCf6Uqk2yhB+YyKtdFvb9zokU5wzAwf48vpbIB vspoJgtV2bI0RAfD1vMl4oUPBF7PQMuXN+8QzIUC7tmeBo2TwOaOcGEJruiOpe0xx0Ug09ajeghS iGEOOLOjZx627ipa1iNEIyLtaF2c6J6FqJAQzR4SJWdQ5qfHgRPNNBLXsdAKwygntdNec0Q40/N3 iM7yUiLDUQk5klxAl/Bl9Bfkn0SVtiF6IzwoRKNTl3JMLcd1D+9zh9tRHdzx6Atuuxoq5JFtebTq MeSxGgNf+LZAgUT4zKP1kOZxt7OhYFZSa8Sp1lcmvC6NxoFHIjlIwJmW9paAU2JTFIVX6zLOC/Uc 3rfE6oU1UNt7IkG1SFDHgYZJq6oZg/fUm9V4ipAOk6NlfI//HY+dO6spDpYxwHSmEhYAGuj4/8L1 s28gjFFtttGFOHrAmwzylcxA5etiKju5C0kGb65hrXRdwtyGdJap0ymoS0VjXadSYDy7rzVxiN8N 3QjX9ip7M3hVa4IWOrFLk/siKv7Cj42TRrZBho66dehbmAxOlUPpvysU/fn/5Zlpqo4V1J5uBRrr wMMGseeayyw80BUoEGyPgVmywO7pDqUrjBPVo1iB7hexvMJKFvO8WF6CYbPLp2GYet3WcUwzMoRh tNBhWOf4PE/T/LfO+Pk6m26a1JdjwTM4C8wXSgSHvrHhGt1jrVZ+SrGKtErY6FkPK4nvducfISSH 0nB3xukZyLdNuVbmJFutS9BpiXczyNelvo+2I7+TMt6I8vdPH28/vIVVGk1lnKfYztvn8I0Bc/Bk Z9Z1Kt4GAhMu3pXlwWQ9Xv0n7Cmq/4Q/yVqp453rAgNsoy7VLp5Q3j3EfJNKyVRdw2h1N6YaVdbT OuwSD/aYQjpTVOH65/bPKimkgg9RMY2BXqN2O7T+tLr48TlaSKD87hxs9bEAa0NzTRcEd4LvTqq4 seplx7PT0Q12r1Aa09bvUMy0u1MMEzbz9KGZCturDs36MNYcwjPKdgiPLfV5ZPdgY0gfUb78B53z /r8KZW5kc3RyZWFtCmVuZG9iagoxMzYgMCBvYmoKOTk4CmVuZG9iagoxMzQgMCBvYmoKPDwgL1R5 cGUgL1BhZ2UgL1BhcmVudCAxMTAgMCBSIC9SZXNvdXJjZXMgMTM3IDAgUiAvQ29udGVudHMgMTM1 IDAgUiAvTWVkaWFCb3gKWzAgMCA2MTIgNzkyXSA+PgplbmRvYmoKMTM3IDAgb2JqCjw8IC9Qcm9j U2V0IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4gL0V4dEdTdGF0 ZSA8PCAvR3MxCjkgMCBSIC9HczIgMTAgMCBSID4+IC9Gb250IDw8IC9UVDEgOCAwIFIgL1RUMyAx OCAwIFIgPj4gPj4KZW5kb2JqCjEzOSAwIG9iago8PCAvTGVuZ3RoIDE0MCAwIFIgL0ZpbHRlciAv RmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBzVvbcts2EH3XV2zz0mbGVADe2bfWdltPmlujaWeSyQMj URZbiVRIKm769V1QFAEBiMwL2GnyEFvx4AB7OXt2AX+CN/AJnl2XFJYlkPpvucSPyNx2j9+zL8K5 ExEfvMiZB37kwnIHPy7AInNC3AAWS3Dt+ofxHzuI5lEUheCG0Wyxg2eLBQUKizV8d5dVSZEl1VNY /Am3ixq6Cw5f3A0R0rEdzeJW31X57mccwCMeAvguA4Dz3d8U8bqC8z83L9/CuzxL4Ca9T0r5fwF+ ONwf8GOb2OTpbOihbYKntqP60Kc9zY4Whb6H5iflfnJtyU8mVnUib+yqWge123ZY4J2FF7qmszlm FyLY8TAGqA0qQg5wne/2hyqBf5jXV0ev55+TAsr0PktWx8/jbAWH/SrGn6s2Cbx79fL2xQ0UyTIv VnMDgSDszGAgOIRM6zLbcyZ2mYqALvst6RsWPEtawlFX7k44l4KtJRwVYNmEGpLM29vrOsDi6lAk UMcbBtbwSKKOQ+Y0oCCgDo0knqZCFaAsiWjgMQApqKRs6FcLBKqmAXK17WDFUcNquMNbfrGx3kn8 0ndVrWVaAOrJFcY0gakImA2/J0W6/lLzkshh6yLfQZxBmiG91Sw2gqgoSxsaeSDsYGh48VzklqNU iqnuxK9IFyGiWgCs/5LrDZcWBWCxSUtId/ttskuyKq7SPINVnpSQ5dX3I/KcSQfqAMcz6YZgWi9Y DpnYDSoCJsjrpFjnxQ4a2v0cb1Os5Mwh+Vot57A6FGl2P8JFATIlSmxhL0N9dJlvrEDxVy1mO7Pa eerMzlS/i/WE2JiriCI5DcVRuk6XtQnnncGamsmzn5mJBFiyVITu2a+s2qa8RW1P2njvZR+xPw1s CYGirp8DvN3EKCafJ0XxbQl3ZyQwIq4oK/FOCJaAOzSyuBu4wWwq93fdDXYeSthA6ljYsn2lBBvm YQ0EdwY8FDkqeFYUz3wCfZ2ijQtqM/94mPh4TIlIa6LBglDuk2WbOw3TMAoankU2QVQ79GpUKRq7 u++SoOUB4mDhmbaMWirE3e3iJ6DEhk28/CuuNkjb71mHfmzQfzl9+AHTTldzWRXO+vpXyA7CyBxH B+LOhiadNmwE8/qKCuqRHZcy8NQAW46PY4azHvv1l9qkrMFFU8Uft9jh5rBvSiZrdtf5dps/YEmE 9SFbsrpZjhEwJ5Ev7mWoQQU/nYZUlktCKfm6p8ElG3I/uZ5SWHr46VKqtX5SIeq2N16dK3r8bgX5 oWIKPz5OKh7SamNsPkFDRi4eigBhQyad5ZHRoyqeVNqS47lTN2WWCvHVrmw4EUVM91MnABFuqCu4 zcQOn2D7TSnqCzyQlEK6ZrJrn69ItLaZFI/STJS756qyLE9QL5Ila+9ltRbiCL47dUNpqRAYVa+O ua7MILHGQVqVsErWKRta7oukbNtO1vzE1ZjuP2I04GNkCJsaGns6zvYjpfJ1VkTdODtA3Xxe+EzP ZiwVQqdHDM4AREST3gjCiSf9VuhMLiRViLqCdg4rhV7awbFm94YnxxqER0fH5mp+K9AEE5oMrzCc +FbCimyF/00LNBUCw6vfoGkMIftsUk6x6RP2YdJHUeBKCqB7Be1GyNjRya0IDk8c7OJe3l3D9SbF RuTXvtmqrdoBFi8SODg2USHjjybnM0yiuX4LNBNuynubT1cmKfFlYdZ7XW4irVymlE4+otFgCD5n LvnanEY/RolL2MdFNVxb222T32xtlOe4hQVxzaUjGli+QOsjRS5lV9s+MgxJ7qDpnqyysm9G8TD0 WBq5BDlHs7qhAsgmwm6dQeoBqjzflk+gPKQ4wnt/k5UL9sGHK3jYpMsNfEzKdIXXK8cbfJxWXMES B33xtszHBAbj2RBH1M2ZJw0MmyqFsUfZ6hYYiCEFBnvmUM8R6rH+l3qKUF4apsHPef3zfFw0xsCs s2DTS3rc2bQG9jQXJp0zoqOBPVl76GZpnUEvTYtCli6RgwNnvOqQUc+mdcdWfcZehqG5H30GxpOe UsSg+L0EMWOvv3rXHr6uQIcOmbrbwKcL8j1NH8a95ALOuCoGCsL/xdsiqzn/qNTSuy6aXI6wajBx 305VDHTdf/qqwmr2YN5FbqSIjc7cc4nwhAT2XFnIm88uFaN3u2XuXh/v+NoTD226HhOJXqjcYqBV B8uBr93tU8SR8sv47b4Go3vlUMYwQuD5jnIP0zm2L5G6CBFOXzl8BQNj28gTR4uqaxtS6qiL61fV OohLs6q+UlGbJxQbNrxpR1GC55PmFIX6omfEG5X2SaLunGaiOLCVC6q+UawtzoHybsfMfkPUj1JF NrLfEF8CTbFuhDdak6zrj2Yfnd9soj6y6GtfbdJwVsOHsHIT+EdSlsm2vIIEL5K32P21f27/3qd4 mQQv4gK7bHrFfvWBtv/bfPH+dXyfAA0/9E1vwQKn34mwmu0Z10LYYJ7aP6e5bfyms2UbLcT3G7YP DoR1T78XI2Tam38BrbhZdAplbmRzdHJlYW0KZW5kb2JqCjE0MCAwIG9iagoxODc1CmVuZG9iagox MzggMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCAxMTAgMCBSIC9SZXNvdXJjZXMgMTQxIDAg UiAvQ29udGVudHMgMTM5IDAgUiAvTWVkaWFCb3gKWzAgMCA2MTIgNzkyXSA+PgplbmRvYmoKMTQx IDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAw IFIgPj4gL0ZvbnQgPDwgL1RUMSA4IDAgUgovVFQzIDE4IDAgUiA+PiA+PgplbmRvYmoKMTQ0IDAg b2JqCjw8IC9MZW5ndGggMTQ1IDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAG1 W9ty20YSfedXdJ7WqQppzOCeN6/s7KZi52Jza6uSygMEQhLWIEDjEsX5+j0DkpjhDCIPBFB+MAVJ fXqmL6e7Z/CJfqFP9PKmYZQ25PT/mhSPnA33jt+LD9HGjZ2A/NjdhEHsUbqnf25p7Wwcxwtpm5LH +1/GfzyMN3EcR+RF8Wq7p5fbLSNG2zt68X3ZZnWZtV/T9n/0ZttD2+BI4V4ESJe7I8LXU6VK7VcS wHd8AASeAKBL7V/XyV1Ll1+vf/xAv1ZlRq/z+6zRf0r0qrvv8Jg73Pl69dxFcwer5nG/6LNOq+OO 0tRFy5VKO3lcs9MSUt3Ynyt11ECD2q5wvAv3YmxDdPOQlPcZva3urbdmdfRmuTWBDycInIhMDPut MaRKzR1H03yyVLk1Y5HHfVcHoGUgXLEzDEFuILz/7obe7PK2qr+ln4ssaTKqs331R0btQ95Qk6Vt XpUyCJxNxOLACWORaRw35iwQn/pnEVmloBVSkDQacxG6LAhHdFtm7cx1nQ0L2QjAbXZX1Rkdutsi TxNtodNyqrKgUIS95wk8LZQ21r59ytSK1AjbxL1oRKqyTS//BUK4ByF8yUouZxsf1LAKfL5xIlDD njzX75/R8KxQn7FN4OD3Cjr/LX5vePZAd6uBhaAFF1rYsZFc4xBpHIpd5ghljXZSZaQpLDEAMF9n CfCDtXFOKUJCKO58jjQTYavEExUnsJWgceEuz+LsULBeENMRbKVQdt60CN7utmmTss2TgtI+vzbU VgjsjHZV2u2zsqWkobwlRPptlpfn3GutlWK7M9npC1+9sN9Yq/qEMaY7xwTbGRCKewy2Y2DpC4p6 rOqP2Y6q0j6CDR4JhLF8HhIWoIm33yFD6uDSqH0udZ4sdNSfB/lMp+3FI0YH+K6u9pMXIT1yqDkN ze1LzqcifSg5DfmoExBmU9OJ1HyoYwzJy2geiGo88JA39C132LfPVzsURUYIojXEztiLwf/W7pWr r3Wo78bSHm4iVETv+2prh6rrU5ej9BJJGd7TVHVLt5/p/Xu6efvqw4eNLMHsCEO6E/NEARSFpOAv 2IesGb9yy7BmIdeT24SU/1QQn1P+CARs82q3Q9b/odsndU5JuaN/J/Uu+ZjVgjbTKunah6puZplG FL+RSyr+krZBYa6TpXWAP0WVMix5EFzbNibEYBvZNp5blTnWcJDBGA9orSAuaQ2X6R2BfWa0s4Yb GLXF0pFiQsAa7/KyqiktECh3p1aq6SPmvk72+6m5a7QSYQy0xTxYBxpoTo3eLUWRm6GRRThOG1Mp BSATnM7iuIfQvdpa7N/XaGsPw4mrVmlrz/d1hKUdwIRYqlIb0X6Zimeo1UYQHLZQtTYiexnth3pt BMHhS1RsI4LtM9MT/u47BnFPDaPRXCDpx0cZq0XU0v5uQiDhvdkfHpIm/wutdNagbiNMkmiXtIng oa7O28+EIRpSIvruMiuGp3PoKQI9cR8JUNFoSXry41DLq/ZOYEdPAcZiV7aWCSGs9ecB5RtquX3V 5n/0kz7KS5TZ4AuqHst+VHIcdc4xkI9CG0NRWitKLGmgINaJb2kDha5BUEuHkwkBA527oF3epF3T YOSMpHzIU3p8yDCvqgnRVVZ9Z5SXadHtMkRULQZbeTm1ulA6o1gYLIjQGcl1P9dgX0hUYWR0Sf2Z lHU+vIyw1cXhnejwHI6FrQGjRdivP/345t1r+6rISOfD4GpEuL3/GWJlDo9c49zDeldOYr+w+VFk DA+WdmsTAm59cyyIkXjah6SlqZ46uipxEOBEPmwNSC1fJ/QXTjX/0RDON+ssreodqvDiMfmMYXA/ UDgeeIgJ8IefXk3dZDVwBBWhKxc6aP422SVGVym9I8bI1OCMpUYzMnBMmOMGqoGzspnUy12SgWMK n+wLUqyyNeFAp1fKWszhBuVMiJzLnIULB0qzJUcvwNAsbIZOUhSDR+cgB3iwcHXai3P6BPXXrj/J z3bfUPZnmh3aqbGm7K8jWAF5dC1WD83UgxV77zbWrpwSSRMynN9oQdzTwnNx/o4XBI62yZhhNYcs RcOO/HTaU+xd0fX0W3dFNmu0dT52xS720LN2UbHO+Z7KGucoVz4mBERgUNME93+KnKT7mxhw/+Po sW8qZElUdTPcmgm3Zhw5+7Qq1SD2jepTbs2GAZqA0Ny6urPmmxOGNDqD5A1zvaPumuAZuivpiOEi AiBQC44YvU81YgBcpX3xKcb1PbtKdlhNHsuf7wmYgM84M5V7peQWzvQC4blp5TJ1qxD+CDtbG9ou QLiBcckPAm414V7aaMFxPksXxxl6Gyxqt+6A7j6j6o6OBTU1+X2ZtB2op+cg0Z2kSYf7M2IEIFqT 0y486zBdlFe4ydYrI9P2StzGm2HCcQbCBRwtoq7DQMCRS+kvFpbd/vY0I7nPZCh96UqE0UqISHIi 3G9ai9tEGoj9fhlyFT93UXBrVegiXq5CYPCsQSzONa6BMXDNIaubquxviCTpx7J6LLLdvTiOnFUF cHGkgts2sEwPrZKOvWUMQlC2zfOuXgV4uMR5bcuYGItN1Zkp254zn0rRcqw+AoHR7+UtiKndEzyn v825NoSvXtjr/1S9IgfrAkJLgo5rP1k3/HO4C9Err0lexu99z+jMrDOSsSlKIaSElh9dfRrITIwh I4kaa48MBOI9DgRBrO2Zfrfbt8K/MMYgfJwztRVewLko/I66LJ+iAtdg2KVNFUQGPy1OHibGZR0m yqRjG4528tChZmqyhroSVjzUWdOgzSyT/byuMhS9uYszEHbUZnljhdxoyJc2Vnj9q0bMxICx/tMX sTv6fn8o+qtGfWQN17znRBEX7ZMvOrQj8vKGibh3lUQahbMT6Wj3FbPoKvrGwexsMqYvd65+OwX3 uvVp8X9FXigaTO0wxivwIsjwhTM7nKs29C6p0wdi34i3cdjw09OH335O8NYIi3+fM+4T+R8V3vqk 3uKeizb83FG6p1eqvpqaUqTFomEApsg9v6qllBbndwHceOP6eAksCPgmOt30R7sUqo9w0f/4CO8D DHf6hz+Uj3DNn375PwPKy4YKZW5kc3RyZWFtCmVuZG9iagoxNDUgMCBvYmoKMjMwMAplbmRvYmoK MTQyIDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMTQzIDAgUiAvUmVzb3VyY2VzIDE0NiAw IFIgL0NvbnRlbnRzIDE0NCAwIFIgL01lZGlhQm94ClswIDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjE0 NiAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcg MCBSID4+IC9FeHRHU3RhdGUgPDwgL0dzMQo5IDAgUiAvR3MyIDEwIDAgUiA+PiAvRm9udCA8PCAv VFQxIDggMCBSIC9UVDMgMTggMCBSID4+ID4+CmVuZG9iagoxNDggMCBvYmoKPDwgL0xlbmd0aCAx NDkgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4Ab1bWZObRhB+16/o+MmuWm0Y LkHeNl7neLCd7CqVqhwPLJqViCWQGdjDvz7fIARohqxBQOwqe6+a7pn+ur++9jP9Sp/p27eCUSjI KP6KEF8yLk378Ln8wLu0fMMlx7cuF65vU7ij75c0Ny4Nw17QMiTbLH4Y/5kL/9L3fY9sz58td/Tt csmI0fKeXv8cZzyNefaGlv/Qu2Uhuouc+nDbg0jLtFoOn/c9tdZ+VgtwDAcCXFsKoFPtr9PgPqPT P9cfbumPJOZ0Ha25UL9LdJWvc3zZNEzjzezcS5sGbm36xaWPOs0OL0p9L13ftLaTbSp2GuNUy3eG ntpqoEptSwLvBF4wTefnmL2AYMsBBphJuoSE6O0miNd8RRGwHK/wgciCLBd0nyY7us2CeBWkK0HL NAg/UZbQu6c9T6NdX+vXd2+4FvOATtP2pGbK4/I4C7YE6Z1foPThBiAMCzDznJbTu7+rFhkavlWb zjB0041lPRu3MExcy9KkBCtpsNsw2XNK7o+mwdOR4GEWJfFlXzPVr8dMOClzrabYEZ3UdCzF4iPb xER4n9addAlwp9/2qyCDUd4nWfQQSBtcEGgiTVZ5YZELiWm65iJax/TxgacPEX88mkvAC8+3mGnA z02E+YZi51qs1V0rvDNHZcIDi/T11VLK7IRvK7xDimLBlIt9Egsu49Bjkn6K4jWt0yTf0yoSYS7E QMjLQMkWDjUkn/uAtSPVr8bYtJAHy0+LeE0AAP9j8MDpj48f3r2/hhWKpCF73nNB2YZHKSWPccko F0D5PkjhHQduub4tf34I4stEolbsXHt9BfAqPU2Cd5X/i3e8HCkJcCWNOK5HTBVzwz/nMtf7+erD lfSsMOXSSAGlfB2JLH0ewiIywWU+XKqSeq6FWjxqbhnTetR8UaldpvxjsfoxJ9MlwKeuCl6/4QL0 AC65j/gW/yYp3edZnvIi9pHI9/skzWQMXD3HwS4KKS/IRwywl3nMmRp6jWkwZk6cRc/Zwpw4CraI gM2+57RLYJs0WiegJEHBXZJntAkepIX+kVUTguQxUqY8TFKZdMswSV9QcQ0yWkn8Tc3GtJrJNL4/ k+pRWrcl0HPTnTpbaxEBq6GaQT4GH8uRVYSB4EOcx0c1wwzmUFPWmHaw2MRJ89xyUYdPWoS2iPhB lpqdAVVWujUdVD2UlqO7N1FeKqCrJkqLBMOSnHm+9q4szl3Do5azx9HeBQUbru23STDs785XfSFV XyxY28EDXqRKmOc2nkVBY19tX87r5rbjqBJGyrcqgtdFVAwfxBTs92i7RE/0GGV9E+HWu/myhjH8 Bcm7KdnRhvhTsNtvD4wDikIpesjZEfa69jA1/2MSwiaaqm2vef6xNQwcQ6P0vse2PlVDArxDAdrY MHA0EYDB222QRkjvVkgDgoySePsMRPCnY5pwcyNIbILtlu447dMk5ELw1YBUoeq4zRv6jElRjq+V Sp1t1anXNnftqcvcFhGjUZSu/ThBvqYoXYJhj0VR+tnjaF9TlC7BcEahKP3gUSjK9bWEqTPeX0o5 6ti0sDQSHDs26SIQm94HK063P11ZHuCDIqUITmXRiYClt3yGhCUJANNEEtRQZcywtPBULuxu/W5h ybOsqSlEFwEzXUciECIJo6LtrFulnORU3TY6dJX65hp1ul1TSEOfMW3leVN3dXxz8raOLgK2OgwH 0BpNiplAXxu0JjFyhGZ4jklziFTyvePQge5Q2a7gwbRFQ4/uOV/dYZw3KOeTkztZ6uoX7e5ZWipZ Rz1/obH8yHGVGaYWuscOrC0yZNZXjlxfyb4Puntb/kpCovj0FXEMhZ4fNzwd0hJiSP7Rd0VpVqow a6wtdDeQPlM9LkPgXHfqphBjbPKuUIsMWAit1wzNPKTl/CkrO3mPm+cj6W0C1E50izk4ZtRFd3YU 7it1Gd9UGOMqkaE3BOrY09q/YyZrGYGP4rFVId0iQzpTVUKhoQqLoNmKUfjNzS3PxLH7KoId8pfH mKfSz1BKxfkOPxqisHruG4RrIqx75aVmgwxXP3BjQaKOh2icq9F9ihnUXMpR8phAhLJFEa8H8EWd 4LcI6A7GFwiDWYbWyhkFfw0bWKDZidsETJdxAvKiTyAbAqu+wG0FmI+pIMNYEDwBwUqQyPdb+AhG gbIN8dfrOMkOc4zbj1d/vaGdHGnAl2RJgME8EozGc8/6rcFVG2GFGidvPHvdHR5apt7uSpavMVfh Sw39+6wL/sf6Aq7iq10lzHvKGTliT5hviwWR2q1m3dYU6xDky+kqs9Ds04Sd8W71uQ3M27arwGKA Pdq5w8Yq4NRupcvQ3UpWucrQtQI5zyR1fOFpUnRNww0PPwHxA3YgZdMUyzpzdlBtUvJwbG31ZBLE Q45iSTm1Ll4N0Edii2YnIkqxpnPoN8/kum6/YIF4hdzWlDHrRN5MruT2Bmcr6B3Pmxr0rqXR1ejV hy5DB30ShttcTkCxtxZUQT2KD18dktc6sqfDZAly0GMQwlvN5HoqZfU2f82K7bFpYaoxfPQNEGws qDJOzCT7/n0DTX2tBgUu5CDQwyKw3BNQKZCv5GaJdNemm15gMC5T6ozvsGwSpM+0TQ4OLH+0JMwz fLhB+Ce3P8+HW2/b4LDF4v/JnSFHCX/Y8+CR3OE50H5N9V+Lelqm68n9LQ9MCeNpYrrDXju38Uwe ZngKD3dOicpzv2YJD9NiRcToUU+XAXfCosc2iGJYQtbxCstHgry+HlYHJFQ04CMsq87ZQXQz0HWf j7yUvFbL2IUIhZruoqzH+FZr6TBbrq14ElhQXzm7O7C0cxvA8tlgOq2fu3muO7ir33auaUy+Z4MV bbVf8rusobbigpBqBlusfVZ/gN0IFRYmMmm4IXYhf/2GVd8tP/jzl2DN8Z2/zwdyHZRL9ZpAHgUJ 6BIdI7FVLlR+0znEaAjzqmZk49zj72Y19P31X8ie31YKZW5kc3RyZWFtCmVuZG9iagoxNDkgMCBv YmoKMjIxNwplbmRvYmoKMTQ3IDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMTQzIDAgUiAv UmVzb3VyY2VzIDE1MCAwIFIgL0NvbnRlbnRzIDE0OCAwIFIgL01lZGlhQm94ClswIDAgNjEyIDc5 Ml0gPj4KZW5kb2JqCjE1MCAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JT cGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9Gb250IDw8IC9UVDEgOCAwIFIKL1RUMyAxOCAwIFIgPj4g Pj4KZW5kb2JqCjE1MiAwIG9iago8PCAvTGVuZ3RoIDE1MyAwIFIgL0ZpbHRlciAvRmxhdGVEZWNv ZGUgPj4Kc3RyZWFtCngBtVvfc9s2DH73X4H1ab2bXJL6vbe0aW+9W7s28W537fVBtRlHmy25kpwm ++sHyrZIk1wqRVR6vbpJC0AE8OEDQH2Dj/ANXryqKSxrIO2veonfInMWHP4uPiRzPyURhKk/j6M0 gOUWXi7AI3NCghgWSwhY+4/xDxan8zRNEwiSdLbYwovFggKFxQ38/LZoeFXw5jks/obXi1Z1Hz1S eJCgSp/5FuHeUKnS+plUEJIQFUSBUADn1l9W2U0D51+X76/hU1lwuMzXvFZ/+nw27BmlNcpZ0igM 5wzP3zzLgx1PfObZmcdogg/NgtZj2jNf7Nd7fCxGGOmtanYIDnmmjKDXWNo6TZMPI6R2cYaazj3l QqqfhmOlWl3apYcvEucsPdClQ4/DqsLHoCGUgamhBHh78f4CXpVFna94lTU5foKaL8UHKMrvsC0r DvWOL/ObfDkfGsXS6TQUTqdUtWJ2gIH+T3nEGSlVnh4hGrgMlirPTsn/TgEL/YndY2pA91ysVnwF y3K72/B7+FdAS1MCv8/EN+ox/mCY5DQERatDdzASTesOGupw/IRskXF0ShFTbDk0BRWhojjRCKud aezTpXYRSTGZNMAYKlWGvFJkOgVY9TT5jgHJUPCmKrf989YoLB0bMAT3JwNHodaT6ciAIZ+EIi2H Hr8MFVHXSUQSMCS7sTwSoRgFqSmfRL8+3exYmB3H1BQ74iy6+KNGQRxqqdWLnXzPJxMHuKkBIf3q CpqHHUdQX3GIfPie1ZDVdb4uEOkxij798f71u0v4+tDW5jEQHwkehxivmOEQ4704nhbjPcoMzuUY gSwqXGGQRbSbXO5QyKIBezI3OGSR7cb6DoksGkjsAossgl2gkUfj0X3FD/CIUQekxqrjxG88UwUi 0pv8HqFnm9dN9g+vIS9OGOSEZ2LpoQhzqmqXKMSiiamm59Opqb9FRcf9d1V+lzUc9nU3VViI8nGX bfboLBaQEU1Z4KNzkhgrhHzGo3P6p/tj0x8aIEWgKW01aOWChcG8d0U3Wj8aomRGDrZrkvvnuyFW YQcRHStW5qKtpfQCJHzTMmyLCgysV5uswnZe0I3brDnNqvAbG0QBMd8pyga+cuDbXfMwhoCcen7V DJe5j8E1sYtCYoC+awpiqnBGQUzR/bO6VyPkmRowI5GCrMRw9JjcMzFSHjbXjUW/kuDM6lzBTEyN +z/CY8AkZpwkCQ8atCDKeXPzdGBKxWCFCNqNh6NJHmG7giCpQG0SRtrptDP1VVGXu97GGy00ikXr mVV0f+Mfix0qpr9Ybc49e7J9hOVYEOYUW2qLYEeW42AcNVjPRkzmRtjOTiTJzCdHtvsiKiOslqaG VburGGF9V+NN2Y6sF5MdihN4i/WEjGgaJIkwTe9PIowskiQixJmLVuKHHrQkEbYhnRemxpjEeYUy VLTstNw1SCFwTtFizgiekGDmktQP0L1Sk0ueEAWBBsT9nWsUEQWIpZ8jpLian117wVRxRuVu9lVz y6sDpSvKYkRXcEJoRaPbpgCrDJYA9Ddq0ByT7XDPcRyBXV3VcJvdceSjsOVZkRfr/g2DkZRUFGaG A1ahVXfW0KSUo1sZA7Fv0PmhYn+Q63FiDsSGqpCW+0gjCIlT8Cxyh4q1Wt6NHUwFInZvs2KNCPJs V5V32dfNA3zeF18Og9BngkQqP8jxB3y5r/izETjTLbbVB3aJM4nva+HsGmeSZPKZtalCoP1mI5bB +02T4+JRTVD0U73f7cqqgWyzLqu8ud1Cts43efPwoirx/93xasymEheVmLd4/cJTLHPptZRNPchO 46lXaZ6pAr12yetllWMnjy4Q+/t2vw/fb3mBZYLjYj/D3xanjsox4S3RmygWufQWJUyvGa6TjJLI YG2uq7lFh7O23yLbDQ9XVg/mERGi7R5mw3r+bgfqGfbPHDX9yvIB7degmtD+jYQxNuw2oa3xmuTB 8SlrtGQXuO6fetCNGiafdFt0IFBd53if5TCSrPi3fV7xLS8a3ItW5b5YjaCyXct+1DtTrh8OdouV 49DjRRpPaNAc38LuA9JWCbKHZrueY0ktHoaSLCUuiCCzCc7VLQfa/8EeG9QooceohXWcX7jplezW AxQ7CMLw0XBx1+pRfSQuPG2zZnkLOd5L299gEcsxMsa0AURMz5hUp95IHXxyikdO9w/F/tFoyYd6 2npSikdwnKO3MM4rlKkDM/XP3Qq3USsQCdsm6YFT4MZg3HW0bnpHD2rVIOjvFQOX1SML9WnsYLnS K9YhAPXT6XmDqQO98rJsMEPOXFIDtlWr/RLXOPd4fVP4rOI1Evga8GrnabML6/wO2WA+YlzQXef1 js8/ynXyiK3TLhoERhVsrz73TrDzec75zWcFilCPlmDNLULQqlzuRWkaAUBytyEeRlPSPySN+YYS 6gFertamUb3Pp2dJCANjhuIcgEwd7iiyKds5RTZVEOqMIuvCJ6DIqELjM4S5ocim5P5x/xjEh0mi WTxYrsQfO8RH/vSF19SBEH+almHjDkW25VDeiCYernjNqzs+lCPL51RwVnJZNEE7yRUcLgjgvOdD VqEB+O7OCBSkMdIw5uOcAGmzcaRD0cpKw6LE2N0PlWs9JQVoYzZ9wTd1/E80HN85am8HUbgRd6mv f7vwk0CAzuHT0CiR5ypnp3gPTjy0WuX7Q+d59T1/U4wmIiTESl6o0MLvenHx8vfX/QPOhAnZMZnS B8OEPBg1Gqa/EZvgy19aZXdedk0dGHALhJrjDuaEPB0MHJFBvC604jterFqKqYTjmHliiqtfFguc ONilxp0btyWxXufcyE3p6GpkDbM00rHZib2MUH1+MViuxEtr9cTXgvRBwl+8rvmm/gW42B/gWKT7 en2/wzlQDe+yCtt/+ot465B2Pz1++PwhW3Ng9MvTkU32L0fznEcYjjVOGwb/+OrrT70rkQFkSTdo UOSeXqlVPPbxP3kE2W4KZW5kc3RyZWFtCmVuZG9iagoxNTMgMCBvYmoKMjIyNAplbmRvYmoKMTUx IDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMTQzIDAgUiAvUmVzb3VyY2VzIDE1NCAwIFIg L0NvbnRlbnRzIDE1MiAwIFIgL01lZGlhQm94ClswIDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjE1NCAw IG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBS ID4+IC9Gb250IDw8IC9UVDEgOCAwIFIKL1RUMyAxOCAwIFIgPj4gPj4KZW5kb2JqCjE1NiAwIG9i ago8PCAvTGVuZ3RoIDE1NyAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBtVtb c9u2En7Xr9jm6XRquQR4z5trO21mEje11clMz5wHmoItnlCkwosV99d3QVIkRCAqKJLOQ2zZg13u Lr799sKv8Ad8hZ+vcwJhDkb1Lw/xI+OSWvXP/Bvv0vQNB2zfvHQd34JwC7+sYGlcGoblwioEi1Z/ jP9R17/0fd8Dy/MXqy38vFoRILB6gv+8TwqWJaz4EVb/h9tVJVpHTne45aFIk5qKw5dDT+20X3QC bMNGAY7FBcCx9jdZ8KSv+uKEiRwTn8J2KhP1hMDxF3+mxQBLdc8keIQY+FCEqDxyc/cAf6UJg5vo meXFsXD86ap8LvFjalBD27zNk3c2pQZ6jfqV0/qPO+LUNs5Q0rGnYIJTTd8ee6rSGe31MPnFOboe aO+hiitFmDbGMKEgS0gB7lKI0+SZZZCxr2WUMfgUZMGW4c2Ep4jFayhSeGTwN8tSiBJ4YVn0FIVB EaXJ5Y+Lcy8u8VEp6h4ptahRQf+hG9gRIusQA6Zh9LBm8KmdKQU4aL1FbXNmb8kS0Ft/7tZBwdYQ QFbGDJ6ydAssyOIIvYWeydEpORSboIA8iNawLeMi2uEf/vX73e3HG7i/z893WXttBc3OdVlnXAGX OuMaTt97FRJp34bjfLQ4ykcWB1uKMUMxgR1fuD3D8E/SAoI4TvdsfaktUMI4j98537QUUvQjUTq1 tRCx+9lo8KmnXUAIXsZZ0UiW8I5H8/kmb7mAfLI+FziVplsuIAswKIfJ83V3eLg4hgfy0dPo7nCi 5Fi+QoBhvj1fcZcr7rrI6OSAOf/UNs6RePWicOih/xLmc+dc0heAIH49yTNY3PLUM0ESsQkwn2Pe 3iCYYSaH9OlA51avO4bcu0obD79dmZ51fjogNipADVeQ32QD/Yg9xunjuoHYnCViVBG3lwweVle/ fLjFC6dtR4koEA8pMLXwvvUP17/EkvIqnrA0jX4ED0tlpwCpTWWylMa7uoWVlGm48Q3Lc0A+Wt+9 p3R3eGFlU1ch4OH9x08fbkckX5cr7yHjlZXXd69kkhaUlm7/Ug8+9TQqLQmVio2JawGFCI5MDXSs 07DcsgRZZBEUZV4Dxu23HXJ//nEQ82z3UATJOsjWOayyIPwyRTEganUutVRUA0vi0h6G6HtM75pT IhGyqT0mi0CP3bNt+oJg/xCmCO2I9IKXeIkGOQvHlmo80xCfwFLQYErvUEei+0ORvbtPahAmc1dr S1MSMRWdVRw9DQS3fFYhwTAnIrSKs6fRvmW0CgmGNQWlVRysDxsn0ofpSLWVdryfSqldgrKwkujx 5qnRSBaBaHS1Xmcsz6PkGT7/+uEanhhbP47MDQZHH4pERJA4Jfogus2cG2ysDmf2hixi+jpjKQtp 6EJVT7xpWsZVjfFT3UXEJuIbjiNvHsINw0rkJ/gtyDcjao4DbRd1OTcYupyh6kEtbas/rqiIuz4C HBOH7zShuJhecFzFz2kWFZvtm0uA1SbKId+kJTZit8EXBlEB2xTbVOnjS5QiNduk+0N3LwwS7NSe b13K5wLUw0QvKDWXdX2p8BpWF2la1+9TdfZth7QVGRP2snmF/FQWJZpzjwaHhO0hryI1B/wj2GCw Yi+wcUd+AftNFI8yMC9pcfCxtDu9ZjKwY1l9WJvDwCimF755EFYTAp4E8rRuP1SGjtm36DGKo+K1 7lDzD5tZw9CYVV5d4mJnl5qYKeRnx/b4Psi1s2wTXF0pQTzuOeXR5wICdjuUXNVBpi1lC3SdtvKn KELXMZDFRDiNrW4GAvYuS1+iNRtR0/noDIJDTfRG90DnxnrniI7juKbXD3BtEx2Dx/c84XqzV+Gy CMzbd2nB3kKKiH9/c7W6qsdw+Vt4wPI7iC/EZt7F4Qax7PD5CJ91CUDQa0qfeaY5s8/wnsq3Rzsu Tl2dwxR1KYtofcYTiNpnNQG6qPgPtBl+Up8Jek3pM59KmVrbnnr3zHf7OWQquGt9Jouoq5Uq5b+/ urs6TL+rrtdTmuGEteGsGXuO8iJ7HXGvCG92UmLDUtBjSh8Rg5KZLxYxnD5RndxLChnopnsccGf1 SKPiE/lgBqakCzyjG9wfSy62Z72qZ1aTwJztcCGCD91raqgd/FIHoJ2YVBJ7MDVNU6QdmqhE5DsW 8t0NCPh3xYhVAOJzOuRicm9cthC2uvSZigQPykIMJ4tSf3AOKsvl9JxSFbbPLGEZtrwbq/Em67re jgqDOCzj0aswvA9HfB+NWWswypgqqoTHzp13CSWzJ16FDISHzxuWoEPysKwbT4qdl4t6oQM4rh8S cZDDnsXcq0OLD8HCvDdFcTEQ5xbV44/ynBKlOr6LMyEpEc9yDVBO7xrwpo1IWgqE4zyqxwoDFxI7 4xGsDi4JbsjwoU8rcdKsaBpzt/aIac/e21PIqMkLpqRPLMOg3gZJyOAad7+wZsNcVW2BNYOfurMx OMiVwdjxGK5TL2XyUv+RJeFmG2Rfcv3pLSaBBe4OC4HRJReFdc9Pv8JVMhFtezX20HOVBhJEWFY/ mUxPl2QZGBjvygw7KxmEcdBtaiKVeUzLApfbkvPhjlBe09v8xtaSRbjT5y+nsj5CAYICLrdVInoR FuzYt0OvEzcZx4QY37eiuMd+eBJxK12fv0gMT/Q/tvlmDjHbUnSKJonjtm5Cb/dlYIhd16FVNVHD uORbp80+KibYdbmL+X4w49umY4qmjhbVSojRpu+jJto6eBF8ZHtzt5CQeM3eQ1LIQB8dFgPQI3yX NQuDnJcwHKWjJNhhg2+H3aSCxa9Q8t/cv7sG3Lby4Qt7HQERvO1H8U2GZaPVKKf9G8Y6Xj8JVYRo cHA0cr43oiEop3eX9ynuvegDkAQU3XqV4nB9/aVzheB26ew5zpUXoSbqU3cAJMs4AqBq1x3XtYW8 cAHsBUsCTvbLJC+HBrMy6IjN4xqXInCVyO3T8N0uzXh/gI+LtOG3xiVhAkA8LgLpZCWiF2+DQ0L5 FEJ0eJj8eumpX0wsUJ3zXvnqpgykliOigDhP2/KXiZqXS6K/0YTrMuNzI1V9Xa8yLvjraTqKdYDf 7nouG22aZL/gr6DpG/ZUIvHc0e23Tl/BSz4ZnaDU5zqjCyPVudQgc/cZ8KWNfp/hM26csBins4y/ uIEz8/YLd+HwhaYcPgZZuAFywd9bI+1vm2/++yl4ZkDp/4YChWCBwwtty0Y9Md4niTBsLxxQBxe+ q5cnfxgINUKF5R1ek8KNvvbcw0uZgr5//AMkjbUNCmVuZHN0cmVhbQplbmRvYmoKMTU3IDAgb2Jq CjI0MjkKZW5kb2JqCjE1NSAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDE0MyAwIFIgL1Jl c291cmNlcyAxNTggMCBSIC9Db250ZW50cyAxNTYgMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJd ID4+CmVuZG9iagoxNTggMCBvYmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3Bh Y2UgPDwgL0NzMSA3IDAgUiA+PiAvRm9udCA8PCAvVFQxIDggMCBSCi9UVDMgMTggMCBSID4+ID4+ CmVuZG9iagoxNjAgMCBvYmoKPDwgL0xlbmd0aCAxNjEgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2Rl ID4+CnN0cmVhbQp4Ab1b23LbNhB911ds85JkJnQA8N631nbazCR2YruTmTR9oEjIYkORCknF9t93 Qcm8AIxDimCbmVaxOnsA7O7Zq7/BR/gGr08LCmEBpPpThPgjcsKs/d/FB+/E9IkDtm+euI5vQbiB 32/AICeEWC7chGCx6n/G/zDXP/F93wPL8xc3G3h9c0OBws0KXrxNS56nvHwJN//C+U0FPQSnEW55 CGkys0e4MVZqc/pFA2ATGwEcSwBA9/RnebAqofvP2cU1fM5SDmfxLS/kbwF+293u8MeMMPJyceyl GcFbM7+69OOZFvsXhbGXbm7a6Mlikp50SDV9e6rUXgXVxzaF4XXMC1Uz+DkWT1iwaaMNUAYqQoYa jSIewRUv4iTmacghSCMYq9vmZi3H8RGWEt8VuNLTvcmDW8QrH6DMoODhLhefwywt4ojnQRnjp5Ox d29MgXrCwJyeC49+0EZooyhCZEWNPWrve9UAzDZlAM2WoCKgJfy1jYISbYHfB5ttwgsoYmEP4TpI kQsgTqFcxwV853mB+oGcF7ukFD+O4tWK5zwtx5pN63EfKaF1smMp4SePSxzJGPcMOFiF3Vix6MQK y0Q6Z3gthsGl68zroFjD9yDZ8SmW7QoA1+yRr8OyqS3HiNFSn358SpHmZ+U4FeFNnm1GX6OxzDpC q5KHR+in2LmO0CoAsQQ/DrbMA0pzdkcQv0M8UEXrObsj0hfH8nsAiP3r8Qd3xcFdF/Ms1WCOl1oT LKZDkhWOFfoTM587klMZAOn7NAnyeBWH++gJwTLblZBm6fGkTAmyDWUMGrgDJw+3ni5bdjNrSkSG gHGayvlBsOX3VSKywRATYzCCz5cX5+/P4OpqCntSV+QFltW60CGTn+BktVUZ5sx5geHKatedIaoI PzKsJeaK602Qf63ygLE21us+1MRahTou4CmkEJ2UI9R+MLmGBqklBHtmj+DhelekNnqnbObSwKAu kxlLc0bYA4GqP8vS5yXm5Zvtrqx9cBqlCFVQD9p4mknlQFoCQTKjcs0HE72ib4p0dUJNqzq6JHgC H7ZqdYoegAjdxzkQ1Cp5mFIQMSHZ3p9dtqTBT6LkF40LMDpz5mgwR86otZOfCoEucL3lYbwK4yqs Yp38bRfnWCStshx2VcFUiBztEJ62eVZmYZYgKd7GRZnHItmf0CfB+Miwb9O+/LFVUUOHjdZMakqG PJoPGyZvGXILwZk74TdMBQK1domunqMW7rI8itNbWAYFKg2r1k9/vDuFFefRMgi/TtBNE1Na+Dp1 YxFvZt1Yti1Tge6gokKgbh77DFdvTiHdbZbYT6jcqcg2HFVWtRLCSY5DRR1OPcwkWgfQqRybyKFF t+PYWFRJNYpu5agQQjkFhygLdxts5+wp7+0HCKIIuz1F1QQqSj6W0RqOaHUHqSl0hCWegeeQLD1A V11BkmXbvZeOaK8vsI3fUB11MWYzk1Ug8nvqiHs2tjclNY0V2/s6DYM6WK5ICLoNQYVoeWndDaz6 f9ge3m55GsX3U7iTiboPe01GC1mnezo+lSxKt3u6mKXNrBUVQlcny1BFD09gB7WyehCIramX1SNb z+nrZlYPAnF0dLN6BA83zCeyb9dTIrlmFvLMuUcShgqBLPQBs7hPf0CxuxXjSBw7vMKWFkYGnEjk OHoIk10kJlYPSEvYMTpk4TkPMe3Dr8cGqlbg8EWnyHWgfaxjKeonDI/DKpmtqpHEYBV2e2w/mEgY CCNRVrSf8YZBEu6SKthPKDF9UR0TauOLKUBajNxnc4da35091KoQ/1eobSEfa8eNezTpCSVs7lhL iTN7LtyDgYo5tNSxcsShZ91bB6zyQx7tcg7LsQzTSwWUIdlQB/uT4hgSFzxAxIswj5eijA2qpBgy PA4ESTKYIZTYQWt+67n5aHftvVXLRijt6d102zcL0Zg/aj+nnrkaOCwSOIvWhs4xYwOl8yeKCGGD FYCknuFvpYhtP5AzdyOGMirTf1cBTy9IPZX1Pa6XGD0Y2lLWHtl6sr56/Np3fJzidwewg8y04cl6 AKsKX7wYfv5ugO8O0ZqsVTyRZJ3EHZ62KvZZD2Grw0uS9dg9s+VJz2i5Dff0NiDFUElKe/TbvYqB wWO/WHXx9hRO1zFOMN8FS1yiEZs1dW9lSg1dt08ON2yz3uhHbCy2RUqmPXeTi5r+/JFdxdBHSqrs 4U79FKW2SEmFIK42UpKFz0BKCCFRB/H0kJIqWY/dW5ayITY40VKYup+ULFx+nbl9RFWMutTAihmC XbnO8ucFBKsVrmIeyr+jZ1WUifoPq782rtZCw7ZmLzRsb/auHlUxOoXG3foBtkkQ8nWW4CqsWHiB ACsNbH4kiQgfWV4GaQlfXogJ5MX1+enrsTVIQ/bUxx48c8TAeX+sSUGkicStDnwrnjimsiYxR58D Cyk54otnMr+8nNDdcEQJYGMHwugRP5x2lDqs/TyesuMxmHaekusyJcaOldurWbGtQ8hhW0GBGP0m /RhiDxA318UuhwyBbvMeC+EIm4NLXCEXzUH0imeXuXAbHB9dXV3zsoA/g++icsZ5MFwHOGC8vEvx +wv8+OzLy+NdhxG8PvNwfHU42qyu4yobUZXnDH/kblz6UYuQIo4Ul+7ici0WwW8xgy1wJlj9isA2 wP39PNiucQUC26xYIuFP8Euxyi/0MCWvfVzRw3etDjPpXRuqazmaxywpIzn2HbES64/vHs41547v Koa+vFaVrT2vVSFwT1lXsS0LnyGvRQjJioivJ69VJY+2z1679+nkjZJ+uY4S1wcHGKXp0PgpI7Nv J+FvachNsU9izyEpXgEvscN6sqfZ6t/n91vc/CrgfZCHa6CvxC/B0db31ce/PwS3HJj5z5TIIkZP WCAYh+NpZ0DsEz22XczDeuEvx2vMe/z9SKMl9/E3JFuW+/E/plltkwplbmRzdHJlYW0KZW5kb2Jq CjE2MSAwIG9iagoyMTk1CmVuZG9iagoxNTkgMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCAx NDMgMCBSIC9SZXNvdXJjZXMgMTYyIDAgUiAvQ29udGVudHMgMTYwIDAgUiAvTWVkaWFCb3gKWzAg MCA2MTIgNzkyXSA+PgplbmRvYmoKMTYyIDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBd IC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4gL0ZvbnQgPDwgL1RUMSA4IDAgUgovVFQzIDE4 IDAgUiA+PiA+PgplbmRvYmoKMTY0IDAgb2JqCjw8IC9MZW5ndGggMTY1IDAgUiAvRmlsdGVyIC9G bGF0ZURlY29kZSA+PgpzdHJlYW0KeAG9W1tz27YSftev2JMnZ0aSCfB+5syZcWL3JNM4SW13OtOm DzQN2zyVRIWUcumv7y5FESBAWxBFxZ1pZNrGB+z1213wM/wCn+H0dckgLcGp/itTfORMubf5nj5E Uzd2AvBjdxoGsQfpHF7dwMSZOo4Xwk0KHq9+Gf/hYTyN4zgCL4pHN3M4vblhwODmHk7eLlaiWIjV S7j5P1zcVNA2OHJxL0JIl7sdi0/2XVXufiQBfMdHgMAjAGjv/rxI7legflkjjp6RV+z7U+bEYQci wCAIzMFDMVZpRD/T+2v4PV8IOM8eRNk+HZ30bP2wxsfc4c7LUV+lcQe1xuNKaVv80cYi7A9Ym5zU lLQzj2t2NsSqbuwfumqngTXbdslxWu6B8h5E3y5alMM4mAg5wGX+RdzBfV7Mk9UY8uJOFNniYQzZ Ip2tyyxfnIpv9Sd8tsohgXJ9C6VIV/jD/kbAYjKCMFB31dcIpGC74o7rOLrmKqe1lm07uo1a0c1z MQBxtEJE0dRXLkWa3WcpoNBWjwKu315+fHcBZfoo5mJK6KNeMQ8915kyDyUnIftKrsN9uO/q4uop KcwDSiRtDJ1j4jiuoZsIaOg/rQvUQgHpLClQLWj0xXomSkhu8/UK5uvZKlvOBPz+4f3F5TlcXZXw 6eTsHNJ8PheLVfnp5bS/sXMHzYRHPgbO5uwDqoz5ema1Dxxt435CZYxheD5qbDIRUGXS7pxpxOLA CeMRytFxY84CYiTVswhd6hCC0rgw7kGz/CvxNS/kLuxYkPQpnwKvh55qriz2XVXGOMWnfKI/XlQB aAq6E3fWEM/RkYDOEDgRnUGDqKTTwnFGxBit1SElFRFK7HoqSl8HkZJSskFEkorDCkBTshoGltYy 2/jNqBOMcSJYvnqYmvEWeSrKEhMs5Pdwt17OsjRZCfibKNc25BwSZiinIrFSdGVK8fR/SO4fkNxv fYo8qcunWOBPfaL5AYuQ2MfeaA6cue1nMFOfhVOfYzkwA+Vvm2ePcE87q/5+FHAXTRd/d6787vaZ +vecT30qMfBZ/bcQyGe4ZmVzldXhyTidzM5PO1XXZKnA08yk4gxKSNoL5AnSgHVFO6yq2ca2KKq9 VzpTQLYeeDEYy9tv31i0EQwzaKq1zzwXZ5r1J65OpIbmwSYC5porMa+YcInJXixSUfOCfEk0N5nB 36LIt367qY2WRZYXSO76+yujqMQDUDZkuutedvZE6T0Jwx9gzYiim3MyS9ezhERosqmNfY+o34BS 2NlckPbNqH5kLuh4oxN7+366fJwwfuRKb8JCrglqcBM3IdDGP1QEeJ4t0G7Tx2SBJb6plt5lPeOk lgD1ooD3tWepbRkYkO7pVmwdeqxo7oQHDT2vEzbjU4oN96KgoFBa4xnxs+FRHSD2ZmssK6Xjoke0 k8neyz6fESduoDNAlA5D+byvugfZF+QwUlK97ahpgKmAQ9qR50RHtiPP93VdqNXMjoD3XJrc9nIm JsQfVz+9Zo7r/YlNndpOrYNrp+alySKYJrE8/StZilWRlWP4OB3Di/N8nmQLWCRzDCr93YR5RJ0j DCLmAe07uoabMCryWBR2Lbv3bjuFxXC/UxazLoQ0x9ixXGGvYYGttiTNZtkqE+WLcX/q0PRQVTn1 dZLOA8nI4jtGQ3VDhuv/W2v7uZopoEaaH0QwQTjNea5vzoG5Y0ADB7LwMZx/eIufpiz0ovC0tvsx xqEvYn6LPR5sLoYHCLfpTap7OZZwPSOpHVW4WBa0s8R/HlerZfnv09OvX79Oi/u00eZoR5gyKBSq BlXCOapQQxmd2PuukamVKp455GTEmBFBi0jiLlvlxTQvHk6zxX1+ikchW/lv1Wm1mi6ZUYMqKc7J JrUDwR5U01hW8Swc87S1MUwwkgiBp5eYg1NNE6LORD5loh2JojdLkIlCwa99dG9jk2xTJgpcVrMw e90YNqz07GSiUDZes81sji1oajdvSiZMF4037qqSDCtjMWZSji2AiYljf5J62R0ZIsC8p9kxBbF9 N9+JQoQAx42YWJ9AaSFZBq1OJJmCNkgjZVS9HeZUinkxBi0l+Z0pyR/XErDmYdIQOQ1peaQfe0Rz c3vBGoaoBFMZJELXIMQk1ObLWo8buO6mqJQuwmnW0k7cYKSkAaKEAto3SnQajQwYphS7U5J/SErC zjKZRYzND0OK9mZhBAvFFnBKpbmytfrtgkXkGoXqQKGiKY5MCEpJnLEYU9KrIrlbiAJ9mOqWn8V3 wCHPXUkzcFiXAqfcRDRLGtu+XdxVDfr+PF1GYWVPR6KS2E3UM1bjwvTBWo92boxwmqVcic/rrKgS GLwTX8QMSxx49fojMKTsRN5JA4fwcpp34RowUbCPJMyYd7dMtxIdWJgIpwlTL3Eq2cFlUqSPWN/E B9U3Ta2qwB5LjqFBo7YirP4dWo444muHLyOZbOcqllRBpmRZ39AgUUUZvr5BBM2XO5IJmcQhyYQ1 9Y1+oH04xjPJhDncIIbWCrfLJswJ9Ip2n1D3HEiTTjowKJ94m2bbGbaG77ANdoXp5Axvx4lssfnm XVKUOX6+xB9cJmUpviNLxM/UBbo+6DbJlhrWG1OJ6r5RfselzQkOXQPNElv+uy/eLnJIeC3fgpOr vBSYqa9Ema8LnMxdibRJ2HSx6hwvLV6LdF1kq+9w8Q3Hd3Rv7cD22pZm1fs5rogD48rVRsbWvtLm +dq0GY/icGqpomg7qBdBWQM95y+S4XcAUfonhzELpc3TTWKjqucQghCSZ7jYgap3cFS1cfZD+RZD PM0znshtPcpNmdvaMFW9uXc/pbtSapp3BKHFlI7sRnYxTHZrH6m6er63xUsaIGslnBTrrG3vdTtF pUC4jlGPDeSuMr2ZGJTe8IYOzZIuknI1S/4S4BZ3lL+q9HUzhTfJAu9KYFz+tY6+Ah+Vj3A2e8gx Ej/Oy/5Vk5xusM3ejurHrv9D5xsM8TQ//nRy/eZswwvenCmxmG477nExIqb+Ow5RMPzpGEMxVDmc JQjNiW+TEq/Vvrk8e12d5c3P5z99eoklIMV+sqZtO2z3ix4Gp2QhJWRsZhon60FVd/pc3EEpFdZD Gtrn7nYnnpIt3VgfZujFXyU9JJHf8QYxY4fIsZmvMkTVzHDw4EV3X9U6CXXV+hpakIinmeQTGXK3 BSKjGuErTTLsKxnSPJZ9hnyOQMnxFjMhOjIkWQVmyP7d0ab+q/EOCrNSVEr68mKD2irxzeril/Qe ZYqiQPieUWMOniFNDMqQEc6fMUO+E9ltgo0uLO1enM1vs4c1FSJ4wffX5VIUKQZF+FLCu/xr/c2m wXiA2ravzkzYZl8HqU2KVzF2VbzRDx0OMD/SpwPU5gDq0/5GZZ/WUiQdmDVF9bS/hJv3NVDC1XaO KuHA1W/XtIKkfVS269tiEahTyjqxhGMcvSjuaUU/Ou1HYSIbNFWAT9w32DXhrGtcGWaUC4emCO0j crt2br8BQ/QT7zTivaEOqXVEZLI7pWbZv8VIguN0C8bAG+p2axDptG1fA+uOEyHXScxA65p3lxUT tcog0mSUuBZxvcM6zH6jUH+LaJh1Y2bE4UHkEAdG9BliXeSpx878+DKd3hD5Dd+uwbHTGMQKkhle TW2+Lr4tcTRVbgcoY3qHmTU/rT/88TF5EMC9Pw9JHTSjwndwJvX21Mg3iCVg82Q7msI3fapuxr/6 ayzavp4/UdbdvqCv7Hf71pAbT12f3gni0TTCd4Lw/R0Pb+6F6qPZ9tEoYM3bP80fykf0QtAv/wDH 3dRHCmVuZHN0cmVhbQplbmRvYmoKMTY1IDAgb2JqCjI4MzIKZW5kb2JqCjE2MyAwIG9iago8PCAv VHlwZSAvUGFnZSAvUGFyZW50IDE0MyAwIFIgL1Jlc291cmNlcyAxNjYgMCBSIC9Db250ZW50cyAx NjQgMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9iagoxNjYgMCBvYmoKPDwgL1By b2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0NzMSA3IDAgUiA+PiAvRXh0R1N0 YXRlIDw8IC9HczEKOSAwIFIgL0dzMiAxMCAwIFIgPj4gL0ZvbnQgPDwgL1RUMSA4IDAgUiAvVFQz IDE4IDAgUiA+PiA+PgplbmRvYmoKMTY4IDAgb2JqCjw8IC9MZW5ndGggMTY5IDAgUiAvRmlsdGVy IC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAG9XG1v2zgS/u5fwcunBLBlkXo/LA5I4+wi3WvSbby7 uCb9oNpKoqstu5LcNv31N6ReSJM8W7Jkp0BqKzGHHM4888wMma/oD/QVja8yjGYZMtm/bAaPTIPY xXv6wjeswHSRE1iG5wY2mi3RmykamYZp2h6azpBN2C/Df8QLjCAIfGT7wWC6ROPpFCOMpk/o/CbJ ozSJ8gs0/S+6njLRTeTwwW0fRFrE0gw+ajsqn/2AC3BMBwS4NhWAtmc/ScOnHG1/TW7v0cdVEqFJ /Bxl8k8Rutw8b+AxMYl5MTh00cSEVZOALbqa06DQKGq7aL5Svk82kfapj1GtwOk6qnaD6mlb1PC2 zAsTgxgI3SRPq3QZ5vG3CH2InqI0SmZRVipqQM29nc1hE2wCYx/JEgfnvSjKNGEdA8FNWo/KFaXz Q+JY8k6gDiIEZ7EccBYMLu9Y0lY8XH2c3H9ivlI5PbpapY2tdbADYALLNLDpuBqx61UK+75KEFgA usyy+DmJ5ug2XEYZChN4tVl+jtJseLgvYiqduL4o/FBf3LNtpqtum4A+jXVZgPVAK82F1YAqYTmA 7tvedHYVJXkaLuKfoMIC48I8RPdR+i2eRWdDdDfLV6BN+Cj2u2jUo+hm2+IUjqNR7MgBSVAnvOxX oyBN0ugvL3m+zv45Hs9+zjMjnoVJYqzS5/G/jA72SEB72LWQIO5Q7WliA8ZYNsKWWhJIgoAcNYpD pN02uzb7sAslKmxSBDxMkmy6Wi2yT8JKBu1CgktZgkM8pIyO2m6l1i1r9WBPVv+WyQoraBLU9mAA lgPq7c0VunqJFxH6d/g5G6IzSndyqjsGsD8p8aEYG+abNEKP50/wq12QoMJWPpFDTXm3VkeWeUK1 gjTJxtdfZhnGjTevNHPunhQxTR8Crzp0cxa8y3l8at++oxPwki0fL1gw/VYvYNCMUmk3BSI5sCvi lmsReRDEnjkL50Mmj5nbvODZj+cf726v300eL86G9TT2MTtFjzigocerZIupSvNgsEuPtR+PPNm3 tvy4ktaYnWpVWQdzkCbZ9+U6jRcsDRmiOgw9x/nL5rMxWy3HSTxbgIuP50lFlPcnZ6o6PTAbYoHV KKvtxyyxR8mXBfulCGCoBIG0aWapTj6gkwc8V8euducAlXADwMSRUKD1sNpNFyR4RJbQgtPsMuMq lo6wIuKB0XsIFDyaNkQDDmd1NFXGPyDD2qMkgk/JAUcgTtqTm6vL21sIpZXe0K/T9xBEc8qo34Wv ndm0A3BKTA+Joo8URYl7ygxlBOIkXf7ylK+BTsN3I2alpXhmQHlpPF8twzjpxqttGpYCDHrkYg/V Izd17q0WVrLyxuCllN90zHpkuVAj2iqQ9M2tNSIeFp1CSF3f0wzdTwypC3waCZRhNN4EJYJwGFM1 38/ceYBXJRTEiKMw+toypxE4n2o4/WY1I9v0JYKipUP7A26j2gYVJ3nCX1Ea08yFAvFyvYiWUOso KkerJ/QuyrLwuarpFrlOVejN2mpC8P2qjCvO51BI2RPmAL1OqmBHJjebLE6eUf4SIQoIaBF/TsP0 FWLc282ihyAHXA0HARrBOqudPZImHVOpjm/ZamO8aGaqIK5aUNk00dH1b6X5jhnaHtxYwHWQE8SW emyOWEo0EorQmAI6Dhw0UvXYCm1LIdybsENzNwwBWh25w9yFSIopoBNczF3alAJtO+UbFG+J7bP5 S6O3zgy4WjjBcGyZerYedg/IOIEmqW3sD40SDlXEw4dfr8D1HWgu3L3kIZBmg7HpWVqA+KKoVU/T MMmg94PiBAF2A/DA5xD9YIcCFaGdIOJTm+NLPxLuuLZ9SgQHcZIRTu5uEAbn9WzfG5dKH1YNTVCk 20GRHBYEucdSZKCUsI8J4C7kDNusuwbw79+/G+nTrPaQ1okyNmnri0CBRZYyOO+AeSJe19U4kCDZ XzSP81XKOhYxtFjHsBTqT51A0KUgTgAE5QWhFr1VhYlzEPQsmfn1DYKeXzOQMmD3nmWpIigIQseO guB1mOWL8EuErHQ+RBODlUqvDPR7uHlahpTgTlg2zLqg6P41y6Pl4Ry2bn+OhEkdyXF9S8mQj+m4 IE5y3Ptotknj/BVd/8ijJIO+clbGEap7ULaEkOxpF93S0g1U2EbCVI6lW/+kHRDfl1sgb8NkAwkB jcjeUPTJRlmrlpjQYj7GFpS+CnFiK+H/YvC+nkHJ2jnBwhYV40HuoS6qOQbvIj/YptmNb+kkaDCY Wl2XDjKhQYUAiokLOtTsuJ44BgdE7kaI+92kb7mnhzwKPJm89I7BqgiGwdhyAYP/in/E0RC9ByZ6 PYdv05fVMlsB9t7Dmw/Rlxc49jZE/4E39BDKWwO9WW2SeQf+xImoMK9D90zrTHz7sElkJrAFw203 c08TekTlSUB8NnlNwmU8Q3+uoSEIZ3mA1NPSghrZoAlNKzV/vp9cTq9Zc/Dg5JhQKkTgFGA1IxFP 2i5asGCBbYlKdk/al8CmK2eHND8iYM+auMaeFi1EhtcdYlzdIixncFSlYryrQVHz8IYxQOsntAph 2j60JOGojNyf6Kn9xsu+GhlKZDvY4Hl2UYoR96Z5aNtZDqrTCypif35B7bGf/EKjueY+vCPBgGXI tLH1uFrDErCBYJk99R7esCqDxTfH0uUY2qQCTgYWdLkLOtB0ECoRo3I+ogU2V+suCxTV6ii8ZCuw 9YIPgu8SRy6XqXkF6FuDv+zpuzCdvVC+HHQiDhXZg/MIdDpH1bBlnrQLgUGexBwUdCzOhzQ+Z8P5 rICOW2IG9GJD7+ioak7H/MEuekLHrSWxuxrN3W0XOlpwhmy7GtZ63H3oaEEfSBLRU9zlx15UGQwd fZuiY8H+D0c9fpoPF3L690ne26UipLhL05bfNvMlpCQZy1ru4IFcVipSlzedDlhR6IGj5qNymcc8 bodtWyVjIrpTcB+0uIKktUIB3EGepNa/o8UCeqA5zQPPIDamUY5+j14R60yEM3ZN4XIDaUySw1Hw +tYCpC+Hm1J9U2hUKqB/UxICqB2ctECHQZ7k6Y/n0/ub32iex9o7BBxSEz7Z0+JslWl2CJ4YKj5g wWDAwkyOlXU79mmzbpAnKfcosXNLzHFip6o5XewEo+gpdm4tqcfY6fjH7l1A7iITpv4zC1UGi52B hT9xLtC6FcYPWymL6OvQqIDusAYJ3dX4yC5HfIi+bug9UFrnE4H+vrolwY5Xtwk8nIEKBSlBp8fC H9c/6bkXDPIk/Hk8RxTcz83HiwxxjAfD0WA8e3ofraG7BXfSukTQqsVfzuioEdQjMhkTOUoLGlu2 KfaxFJAnKRkqyaZwJaBqUR9eRMK0PQLki57lpsJE/fWUJoEjGPRYDpUguaUO6cE0OiG9T3krvQtT rqgTbxXcubonD+Mq1xk4Mu4rTu7Kvny4uS+lRo2LGjvH9WSu0M98A7hkfYz5Bq4S5vrQA1x8lQlp az1oPZZzbGjuybW/v+F0arSA23iQT4QLuO9ef13/WMcpdEfKStGQ3vfB9U8BTVp6tXZu/A4OnZvk fkxYY9Vu1+kGW39FAvu0+wKXvEcaFTy8p8dziSOedt7dR1StuT6Mqxm/9S7qvBoqqlW9D27nMl74 j8aqUebr12ghjFv9XQ1hvn/8D988jG8KZW5kc3RyZWFtCmVuZG9iagoxNjkgMCBvYmoKMjczNQpl bmRvYmoKMTY3IDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMTQzIDAgUiAvUmVzb3VyY2Vz IDE3MCAwIFIgL0NvbnRlbnRzIDE2OCAwIFIgL01lZGlhQm94ClswIDAgNjEyIDc5Ml0gPj4KZW5k b2JqCjE3MCAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAv Q3MxIDcgMCBSID4+IC9Gb250IDw8IC9UVDEgOCAwIFIKL1RUMyAxOCAwIFIgPj4gPj4KZW5kb2Jq CjE3MiAwIG9iago8PCAvTGVuZ3RoIDE3MyAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3Ry ZWFtCngBvVxbU9tIFn73r+jKE6myjVp3TW1tFYFkkgwkBFw7WxnmQWMEaMa2GFkOy7/f7+jWrW6N kSyb5CFOB+v0uX3nqvzNvrG/2fHpmrP5mhn57/UcR8bUtIu/0wd/agWGy5zAmnpuYLP5kr2bsYkx NQzbY7M5s838h/GH6QXTIAh8ZvvBaLZkx7MZZ5zN7tjRp1UWpasoe8tmf7L3s5x0Fzri4bYPkpZp tTx80vep4vYjQcAxHBBwbSLAmrc/S8O7jDV/nX25Zt+TVcTO4vtorf4rYyeb+w2OTcM03o52Zdo0 wLUZ5ExXdxoVEmV9mRacCj3ZpqKnfTzVCpyhT21VUH1tiwyvYV5QTWdxjLZYsOXABrjJdAq/XX04 tX3f+J2x03CxCNdj9nk6ZmfJahWlD+H8r2jMznHwIcbB85h9xOfrh/AJP4JP4eqWXU2H2AEuZsIu pYvtagdCtm2uaxmGqryG3XcWcwEUo1ZqrgVfdlyfgZqiydlD+BylY/bm62O0uvz5kl1E63V4H7EP SboMszdjBkXARX1jvLs4uQdfNy3oWdA/jDhNx3pFcYKaIs6zr58YN6bcs33vuDThUoUjgv8uGNyq Qs6hQ275TOdwzL4kP6LlH1EK9DO8cR+TGSG2CKDiDoiYhkVEFMb24+81pJgIcRqkSIa/F5nVZg9q ilX86yHLHtc/HR8/PT1N07v5AJkZpBgT0VhjqXuc3IaR3AAWcdNtIRDdxlmSTpP0/jhe3SXHYIQ8 9d8DkI+7FAFN2JlgZ1dXFYZV6507aqbS3bC0VEhKJgQBjnB90FjFNQoUqxzP4YhVV+FyfRstFmP2 bppHoespm22QiRHEXkfzTRodX2wWWfy4SR+TdcTqRG1AzlLGKuliu2qsFXpq2bq24kWSw/bJCDqF KiSGTT1ehPGCvf9fFq3WcbJas5uj6+OLTxfvb96y/0QpnTFralbxa0iwIhC0XCZucBhxcu8VxcnV FO76MZrHd/E8zCC5MsyTESOBqmNYXyG2mk8dVDR+ixBZEP0crjZh+twZh0vElCDGoBzDRwGkctod YbbBcO0FE0vNoVrdYFi4r0MXqClWYhrcGLOdA5gmOM6B+Nx2mc7YngKYCc1wp+X5LfGLrGFQ/PLJ ex1Tprar+0rGVVXaE09z2s4m2yl+TbjpKMDXB1q3WXBVbLWQyCNYYLmIYOfRU4xi630Rvk6m7GMS rSI6uUVh9aYuw2dpuFrfIee8TJMsmSeLvmAhSZcyHKq25JvtqrRWDBLOyz2tBG+4b09tvlBvTUBO 0ebN0cl/P1zdvK0gF1KXIbfExPz08wbtjtzdd5ctDwgWEcrkqxxItibXkrtDyhbkFNn+IyiOulVe wiR5ldVPVCqjo+6oqHm8XGtVaT1RUCAeuNjTDqUGoZQV10WjxgU7UgsHNBxdAG/XfqEeRqrCoYVW 7wgsFCE813S1krHvbV/ABotrVe+e+1wTnQRBLxq9BL0fk816Qc2sK0LanzcxKokY2MvukpSdps+P WXKfho8P8ZydLO6TNM4elkOQgSIlmkLypQ6EDJbLFRNvAEN3++hUOkxATkGGk/t4EWfPRUkWLaJ5 Fq/u2QX6hCEc4XmAFG1KbnwLUhRESynuCShsajD4Xk5BkWKWdHaBEouEZ3Hq8POA8jJNOwNuLsMP tfh5gLguyaYaUCwfF9EyWmXClNdvureuNPhBjlnmEDqt7ua1LX0SSGQbvmJeujWPegxdWmFJVAAg p6j93ekl5QVFb5bAQ88gilOpMcidXLp97iVsBX3ForiaSLwfCCtsRxtnNMTb0+JfytBATlFmnUV0 prTNbHzYpRFYSMB0SnrzcQRIfnEYKPQi0hT94ZO+oNZqhnX3ka6vmGFL+UZmt58sQmeotxsLOQnf dQw1Ie/92FY5SRRsNS2F+e7FlOoCztFI5FmE7/iURWzG7DsSiO8P+EAjso8REolluFoVIzQEvb9i fD7BP/2KYU+0QHGHoVlfc5GkS8my6SOSSBc7EDo4gVaAHxIdQE5BBxotXlJVfHcHmVJXV26k5aka 1ciYyKQsr5EfkzTbXbYI0EBeVJET6SoHkq1rv2aDdwJyimzPaRbJ8jY5JWs3R7Pz67pS9mDeLXEu P70IB6Rw9dBfvtGhRBz8YyLcGSKaVeWosRJSL1VM3EDNgXM/6UxlW0wTuYlOBXkJ0pE6hlYhbufx hmhPSrRK7QxIU+VKvOpPgkCHCAeDkyOcMfV54BpeQLNdwwpM7tKn/MwfdV7wEWiKYgLfpw6mxDDD zbDW0z2OaOm+CFCepeaTvR8rQqCU7ksUEAuaw5u9h0CggUIiD4GBbSIE1kbese8j2JHMQhh5QWsk rVe9+bR8TJMfVEOePIUpNUjXLLljV5vVig5Pk9voJzZ7wHyvqnPyOUt1MwwHjn/GItj9mnnO1KGF L9swpwEtfC2ZHahni+YZNqZstqi+OqKvlkcP7I6ebNKTu/W8WnkXqvQtdaHiOguzzZpQWpocuYFv 6uBcnH7eLJ6pXLHGTMRBlX0r4FPbLtg3g0Ik9RnYF2dGIabFqJIc9uXKI7Yz+00Uldj31WGPhmw7 d8yoYWa4SOUmmNkrxtwd2bbhNK3dGG4rgZbcnbQlj156rihKCGZRx8LjOWMKolYegI3EygS2IigD gpaKHlnUsChcxDK90kaqswUTZ5jWuA0XYZY4go2Matb6+YpgUVhIYGoJaQ0/vV2wFU0DT82T9o6m OglCUx9bJ0DT0yTLEmS6FygYzqP4j5CWG4odu9mUfQlTjOS1fqXw9G4wJEQrMl7pVgdKx7hhqiG/ UU1I1tqJjZeaDURP8fRf0calkBGu2KeTLyeQNvYbbqM0jxc1zLJ4RYt4aJGxvPnj7qVcK68jR7a+ HEuDByl2CvfgwB8VAhoi7uksL0sYeNfMPSA3Rqasx6fitBqzYXNu9yy1nn4Qw7jAQWXKubrPlou0 pygr1TVjH/WzsUMN8MY+kTZxqVTXmdS28CQyrBZSWpzdXTf1LK8kI+ume6Btll3NTXzRJSMSir23 hFoyPLmIeAFcSiFKGCnMrUVJfZUjniv5LXe1YVjf576QWnKTq2kPzGsvROpOWQuNPLLZvp0P3Mom Dho6ZV/nYo7+2AYdsXzT4dsmSmMM4PJuzsfZ7PJ6AESISXzBuGyG3dneZoaS+kxHS0sq390FK16E XdBTYPfm6Cz5WHdvfEi8BYDz06/zLCm2l7k/BIPrVhl2aOg2BxWwZajt8IZ8+yr0RQGDniJgDSGL SqTz4plwezFGwJa5RCbvOewdIXXJtSEkLGNPCNlgKX87qrtyNOSVXMxCj6aZafR+7ksIaWF4qpDY O0LqNAqEDAIJijvNpVq5cWj+ZdN6IS8oyV7ZxGC8wbNZLOIf1Fan6QRB8i9T9mHzZ4wmC8oOwuS+ l5KsvG6slTcRL8yN+nfWWpmVrAMsK3nAYfGBRNw0lVmULuNVskjun6uygQfFzNi3A3wSi77F1ll+ OiTAoRY3PdJ0cRlZ091do2OAswO1MXVg+eKtwKZ8y5Vlam1BmBoa756v5n0ONJQhx5yoLMc9oXG9 tUIkFDttReMgGILGaIzDNGhCWLIkXK9PU3sbGju2Wll3N7ltRYrk0o7fsvch4dH2t7u2ERH5qk4j R2PfoE7ML5tlmMYY29bpqhhDVq3nkF0lSYb2bIoJ5ABnpr0F0yFnLq4kG2F3yW5zZo62JxbQCgqK DZ4n83DBhqw3iakeMaA8fgADrS06FEtS2lTkGA042ouVSPWyTg96j9bJAkovN4sh3baWR35atjzM IS91ip2gkvv9W4jke67/unvboKfAvQbw+0i3G2QOk27rkmsDeJjFEICvXxuc4JMque7etg3gPVPL hffiVZKReZ5axMKJ90JEALxO4zcC7AKv17+X1HYo4sQ4iTdo7DY4fim99c1X3RXhoKf4oxTmGF5e R8M8SalvI5/PovnDCu+4LcqfoBcHsWW6c2omBZXiQgfFPN973eEE6Ckyrka3WLwB/NWeMGSsHtDA jltYZ8ZOs8qf9E42fKKm122OJkVmXk8giYjCVPcUelvKxsmluUcprU5inWdf6/zN7AJWd9u7rf/j hAaRXYdhohSWMC/gg5Oj9ue6Wn+spz5b50m0RzA0mWu7L153V1+07I78ZZbb+lxuaI3YvciBOxoA i+dWo3UrmFoOLZdY7tQyi+0KLB148hGWK4qjkTQkr74oHdFuxbf/A4jvpdQKZW5kc3RyZWFtCmVu ZG9iagoxNzMgMCBvYmoKMzE3NQplbmRvYmoKMTcxIDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJl bnQgMTQzIDAgUiAvUmVzb3VyY2VzIDE3NCAwIFIgL0NvbnRlbnRzIDE3MiAwIFIgL01lZGlhQm94 ClswIDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjE3NCAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1Rl eHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9FeHRHU3RhdGUgPDwgL0dzMQo5IDAg UiAvR3MyIDEwIDAgUiA+PiAvRm9udCA8PCAvVFQxIDggMCBSID4+ID4+CmVuZG9iagoxNzcgMCBv YmoKPDwgL0xlbmd0aCAxNzggMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4AZ1R ywrCMBC89yvGmwWNedlmr0qPgkLAg3goIb5owTYe/HxrVaroQc0esrtZZmYnFRaoMJoGARfA2wiu aXEm9a2+JoYp4gnGpFiakIYrMbHQsp1oLpkSIyIDbSiyJUbWCgjYDfqIYQ/IbEv0DeqQM851Cuui TwRN75Vg6UPwRRjAn5AXDN3Jzsd97QNmee12EANILkX3fMtW83zrIZN1HP2m80kcN81ipKA7cdGf 2z+hPjxVNL57qu6e9n71tEM176gffmpxAaA4chMKZW5kc3RyZWFtCmVuZG9iagoxNzggMCBvYmoK MjA0CmVuZG9iagoxNzUgMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCAxNzYgMCBSIC9SZXNv dXJjZXMgMTc5IDAgUiAvQ29udGVudHMgMTc3IDAgUiAvTWVkaWFCb3gKWzAgMCA2MTIgNzkyXSA+ PgplbmRvYmoKMTc5IDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNl IDw8IC9DczEgNyAwIFIgPj4gL0ZvbnQgPDwgL1RUMSA4IDAgUgovVFQzIDE4IDAgUiA+PiA+Pgpl bmRvYmoKMTgxIDAgb2JqCjw8IC9MZW5ndGggMTgyIDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+ PgpzdHJlYW0KeAG9W21z2zYS/q5fsddP9owpA3xnpnMzusY3TXtJXVvTdhL3A0VSli6yqIpUa/fX 34IiCRCAZb7pmJlYkTPYxbO7z74A/AN+hj/g+ruMQpQBKf5kEX5FpqZ9/Df74E+tgLjgBNbUcwMb oif41xwMMiXE9mAegW0W/xl/mF4wDYLAB9sPJvMnuJ7PKVCYL+HiwzZP9tskv4T5f+FmXohuI4cv bvso0jItzeJG11W59hMuwCEOCnBtJgCa2r/fh8scms/7T/fwOd0m8H79mGTybwFmh8cDfm0Sk1xO +m7aJLhrMyg2Xek0OSIKXTfNd8rtZJuSncZY1QqcoatqDVSrbTHHa7gXmqY1HJMTHmw56APUBFXC l7vbz78fPeCX9fM6uYLbKYTbGH6Zwn202r/8meyv4BvmFXdJtku3WQK36WYdvRRekvX3ARqgUqbX UGpEH7AIOYu1LBZOxPIBBajW4rE0it1cC8nBcXXCHi7Qcg+X31xBzKKYiZv0IiBmBkoCT9xQaYcB BCTQZ4CxTqlVCJBM8idzudZIlRzNA55SNAa1bKa6tPIA1QXuRLVRd62x422W7lqrXganoLrJYHcC EfUyp7RX/VTIU5PB7loaAaj6AMUZl1DP0aw7kuIWU9zTIbPf/T1AcZspHtDzKc5SObKaRgBSxcPF X+n+K6y3sNunj/skyx4ur/qzp0nQM02/Iawve/KsJERtnZVMx5Jii5Mc+9TaIsfwnWil1USH0iRW /eGAxYhJqH8F367yfJe9u77O03STTddJvpym+8frVf60uT7SYO+SBF0a05ENggKjsiD10DtMuxAg 4TmUBQNkQRMLPNVS7SNSqX9FFgyYr2EWErApuWogC5qEgY51qbpye9UVbq2rS3XV9t56ilt5bGAH oVRsQniUsTFhHQmzfq/2g8cGcSXP6cLkSvb0WCXjIvbKsu2xP+U2HitePIutL4E0iMd9prbvYFum rNte71PW9ZnePjYnqgBC/jltzXeKX7IwworF1Szc2S95JVE7I6smJGfsqquWm7kAii3aWfsTqkj4 wnrRYyv6fRh9DfNVuv29f9r0kYSx1rVBkHSetOnaUqwKtDB61kTybxrmx2SPbdv9FFu3232ap/nL LoH1026TPCXbPMzX6RbSJXz+6dPNx/fQFU+tm9QJTtn5Mt1Dvkrgw8383609sqwWBD+vZgbKZjsH j1Z/7uaaLlwwXrmDkTidMmETYaJEiQmrytNZuXj7wnwe+7wfDpsXpA4shFqDqFAQdVgqJxYUcsVJ 1sggGtbJ7riSNhKKKE2KtrpUfFznq8NiGqVP19kq3LbvNlXsqpZN3ds4iadu2VQBXzGerzVUiOmo f8VblXWCuL5cKIRpNSw1PE+ySWX01lNSHqdCNVrHqUFNR6K92W6XbOP1M8ymADfPISO845wKfkU/ KGeaQ4ZWtQ8IwscEjXqDR5dvoGZSpUzo0MSdKpyqKaOhipiv1hmElXWiFHPQeptBUprob0zyGfzF TBRG0WEf5mi2Y27aJ1G6j7MBfm4S1h/5FES9+tqMg6vrlQ3TlUv07rleOIQQ3J6D68rl9HyV4FQ2 CrftA+yUGV1WYDumh3gpohYJHLIkhjwFHAyvly84K9bUFSzbM5tCXBwiDOEo1iDikFjU5Uy2s6hm 0NE61Z7qhGrboQiJsXAYlKdRuhnQVjisprV9Fwx1+c4eoSNyy1Xq/tawnHI0zuQ28SVcZlOKFH5f lKxw89vs4+1/bgom7+9LbExCCXXAEMT19SUdTjhgPHPGc7A4bBb6XejllC1qF1VFfJ/s8ViIhXRl hyK0axJHBrj/aQZHor4CPCli50ePm0NSfpeNMec0BMX6Gu0N8nZs+Xi3C7qtCABFSAZkWIXNZDeA C3ykSxLgiYihShqFCxw8KJI8cGQucHFGKkkYuz5RRZSFCFIOe3zXxok9wIdPSEHo2uzZ4n2CMH7C hoy1YMSiQTHU709H1cDZELQ5k2O7AZWJCXfU2m5Nz5407kawwxpCMUEYKES1WwHdq391BU8bvxSH yHiSVigg7RLtRIDZycX8iD+Odn24bL3zkjE52ddDDt12uy6r3Q5Pih6eOyqB0MRyFACrObCBAiUA xUBAXi8eDISuGxXwq04lmTB5d12XfQs/PB37/+Lny/lfj5/ZdaNa/NTddV32Dfx8Sy5Wm86H/xrX /1DgCf8r+0GRftktrIeLrtsW0GStjsm4Q7PXrsu+haZ/eiCmYHv8YhSEa4rE8beEcOT6JCBxQEIv TGKvfWhjUpjghTktmOpWRwYzwO70ldCuJU0GHLnVd+aMoyRxQPuKoYqva+FvnfedKsVra6m7dBeR 7QRLLPBIYsVexOT1u/VDa9cXpJyp/MDzFsnrTmFY/25kMPHQp+kyeCWJxHZs2gsvMZeRNQqYXMqZ wMTzAV0xV6P22odx0WRaSHCGNI4jsghC38NThkUwBpyimLPh6Wq6vtdQ5N+PjScexDfdMww8ai2s KAgTJ4pMbxw8uZhz4UmpZgTKcXvt08h4ohYSnp7nLQN/4Sd4L6EUNuz0ibIsQYMADDxMlvdMbDuC Dp1G2WOJ6ZRNPvHKiG71vr0b3msXRsq81UD9NbXeKCapB0saGayn5o/lYouGD+u6jz03YLFnTfHS BLWmrtW1FBKwFCxVbLSRz1tvs9kHv/KOAJ5KUbnIwk31FyIYjGOJMiT33mYmhxIaWM5mBZx4DkLf xQv/3buRsDwqMQhLbiPBGU3n7CeHeItbwm82NXH6813Kjgyf60knO3KtTdeyouR7qi/8GHiPuClw ctHZJfi6AlaWc+7zQmohxTVTUxd/PlXpcn9WZbw1dY4PO3wLgR0U3t1lV8XIGQfRaRRtDjEeUN3d DRo6s76QnRiWmx/k4280htS25eTRBV+FlLR8gTIkG7K5MzuhSw/tX15SxmH11USD7UKSMM6lCJdN tF08H9KJSJd1cLbsuHgQ1WOvs6leXYDUaV4codzdiaP+SZsbolx/gVxk7MciFzuQBzLjkJZjKy1M azsqhZJAho4vDzDH0de15MHeSOv6g8mb+4OAg2cqLc0o+GIJLTfyo6zrm8qAYJx1vfP4WUDP42eB exY/wwOrwXHMk5iQX7jL4VVpuSD9FV9xSTaYmju8HaskGIexP6M3QyOhfRCeKkL49QmNiHBTHgkW tfXN826Nb+7Ax3AfrYBeYXuCYxDp+XIbPuILK96AW8r1CwzVrgfVHzqKwNK9CmW8C1q8yvyP/iHn 13f+hHWrV6QFK/38P5z++fsKZW5kc3RyZWFtCmVuZG9iagoxODIgMCBvYmoKMjQ1OQplbmRvYmoK MTgwIDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMTc2IDAgUiAvUmVzb3VyY2VzIDE4MyAw IFIgL0NvbnRlbnRzIDE4MSAwIFIgL01lZGlhQm94ClswIDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjE4 MyAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcg MCBSID4+IC9Gb250IDw8IC9UVDEgOCAwIFIKL1RUMyAxOCAwIFIgPj4gPj4KZW5kb2JqCjE4NSAw IG9iago8PCAvTGVuZ3RoIDE4NiAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngB xVtbb9s2FH73r+D6sgaoXF4kSuqbtwRIgKUXxMCKrnuQJTpRYcuZLXdZf/0OdaUoRaFsaXOAxFEM nnO+850LD5m/0Cf0F3r764Gg8IBw9nUI4RGeUzv/Xb7x5szHHDk+m7vct1G4Rb8skYXnGNsuWobI ptmH4Qd1/bnv+x6yPX+23KK3yyVBBC3X6PVNkop9ItILtPyGrpaZaBM59eK2ByIZZR2LW0NXrbWf 1QIc7IAAbksBqKn95T5Yp6j5unx/h77sEoEu43tx0P+K0OJ4f4THFFN8MTvVaIrBaupnRpc6zXJE 0VCja0trP9lU89MYqzLfOXfVTgdVajNJvAa9wDXGcMx6GMwc4AChqC1BPAXbx42Y5yTwuI0xvL15 j9Ddh0X2MIFACqJtnIDPiYcZ8eEjX1+f7nzigjYQgYoyp/q+xrMrXBnGusNyM/u/j4I4oRB2xEGg g+ZTwBAjiSHHEPsYScyHgtlpN3FBJGXg5Zbd4LALY7OKVFjHFXFltNrgsdbC5vRsJVglRVURQB2m odVylbEZffEgkcLcR215agRAJsxeEAFDHaSARwE8wpkqaxq6U8xforsxeOCt2XPlsAIPymczXXWD R8cAr5Y1DXjE0Uv76cwzAQ/k9YD35cP7q9tLpGZc2XGclXW5zA6QkRTJE0FJyEs8bGELD4y52RfY ZdolBLqJRillJBTrFWYesdcO5lSKm53UsZEKyVrINEhy+38HEvrGJo5BROg68B2yCrBYO+vCbTPZ dA/rfCscNRmz1+ZcaFWVrj6AuM/AaEy5pphZY3dQNfCko3vrInr+bChu3SW/6DIy0TNlX+JFAQ8E c+zAJo7L3YGWKrW58lLbPONF+yK2qv0W0zul58FT/jK0uPTiCDpoVKE2X7tR6DMaihURg4CUFVRp BMq00WHoyEi6g5hYgjkukq4edDYNKMHe2qF+tOIBM7a5KKddSLYNNV7VjJOEOlr+K9Hq/TkulKCE xkoWEBJiYvssgiD3oiHtfWG4Cqfcj8GGzOqwdmw8XdrGcxQZ5RbXIi0RcgdbvxiHTRe85B433+HK PovNoUsnbBzH2QwW81wA1NUHEXM+iPhyJqV4Ss5yiO93LXxGzVSyfZ2NKdEbVMBsXE+1RSQHWjsK NTy1WGTOohiTd9HKe/cOgDx5/kQqIBUdpunhLMo7tmXGQDY7D5hLKs6qKA8itKjaheHmGIlofjiu EHIBtZLyy8/LDOJXNz9vUfkxtDqmaCvneiuBomzwJ6JXp+Nbzfek9aVqE+HLCNOy4xCiGuELIkoj irlvBmtFVRXfcYcGliJ6Kvx4x3ZtXH4yru/GouPjJg6DVGQYyiGZfMmUXPOzRUj0TTJ0l4TiDGoS X1Y7qBGWotVE0NrYm5qaIEKjZgtaY1/2tURyBIg9GCFbbYmZ70aR4sv6hmFI0SHlvyWHYuVU5HD0 rg5wNEbRKG/Zjt69rne7eQrHOvm834G/y1cD2t0xPT3xEyY9yKH1UWQXAJ5xnKX2QEw2Vy7JJGjR tSunESecwxEm57Qu9FagubbuGZor5ZrYEhuPNbAp6skPeeIWBWlQJT3xlFfwVxUlZkMHLHUVVpyR CRx9xGI5WO90R2cziNBSXbJLKnReGj+1tj2ySccUmmupu7awucP7ciagDhKkw9sSgkfxlMVedhRU BuGUc19ViYlSmmO/OETPbW5+H+rD/hEOKKF5kxMewtfadbnDbTi3Pn/0aylSpgLT1ycoTdQav40C oeyMCPYheTvwrTn2raVVogzz0QveyiSpo0tOXccFL3Gfu1zwoSldTbjVxK3DnsoMw8TRaUa9XeZw PPocYjV2rXdDK22nFuWhhwVKaJXLpRnlBcCZBYGx1T1Dtw5TjZftS5cKmL6+X2gB1/VgZDB9fV9U Z5Cco8ZW94HZNtV4WTMwXabvELqwaz0bF0xQQmNmHeA5R42t7gGzw1TjZQ3B9PSOugVc14ORwfT0 BpVWAZ5zdKR5sNu2diie9fCyDm+P6eMU832PmZs8Tz9LWswZ7HmuPi9uKwvOqV+ObB6hn0dWLkot YB9/u8pv0P0dpw/Qz2/SGG5YFWO1QyXesO7UAJLyJkkhU72HOBjAetnaLz5tVf2h2nbWJ0WC21El R5FRzUL9lohrsRdvUPogMvdL72S7rXCXpEGcHGoPFd33XoS7fXQAutzFMGuCgdPmn6EBrMCL5bwJ rl5aimYTtYwEU71mQTYyxtdopiBlaJ2O3LvehQ9iK+CGyt3NLUD89QIFSQTQCXQdHB7QYnO/20M4 bOUnrhfMs+ET8QFFYh0nIkLBOTMHX15PczmciuS6qcF4hvXK0KFmMIG+VKtkE0AMV9OazWT6AGCl 8TYjMrwtrm2iYxpv4h/iADc0oziNd0mwQU0aI5mFTqcv8SHTUe5JcDOtJgWXkMnPSuBmUHUiUQxf Cu5Kwl4HxtHSV4m4nJZy2IhaHeIa4fA92BzBfXC7Viaox338XQ7F90FyL4OJDr8aWmceuGgKmceW rsttVl1nPuFoZQUlLmCaBexwYIYiRWhxQR0I8rkxnoUcRf9qUt+x+BlxrewQlbiWVzSbMTckrvvI UJUmgEiXsXwQB6EGb8GA0wO23sQX4sb3usy3cFYuz7fBIs3rOXXzM0RIS3uBkl2Kvot9vI6DFdw0 NyZEgalCCIXQLSTNCdFaV2EB3FDRWXC6vuq6ztmtVY2Dsi6M2yfRl0FMa9EwCg4MLi9Msa5t60l9 HD7ADZtJ9HVsvYkaR1/Ha232R/EbZ9PwjHvT8Myl0/DMPf/GWWcce3D9aoq48OCgbIp1fTINz3w+ Cc/gP5fOjuMXtrYwz9JLx+/icBCbwxskUhRs8iPXfDp09fQY76Htuw324QMib+S/06l31LJP/fEx gCaQen+e3gzUJ4CFemozYJ5xWq1ZXYGgYJbHFKxop38yzjitdb3yPy0tZd3yfy0VfT/9CzBnD8YK ZW5kc3RyZWFtCmVuZG9iagoxODYgMCBvYmoKMjIyNAplbmRvYmoKMTg0IDAgb2JqCjw8IC9UeXBl IC9QYWdlIC9QYXJlbnQgMTc2IDAgUiAvUmVzb3VyY2VzIDE4NyAwIFIgL0NvbnRlbnRzIDE4NSAw IFIgL01lZGlhQm94ClswIDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjE4NyAwIG9iago8PCAvUHJvY1Nl dCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9Gb250IDw8IC9U VDEgOCAwIFIKL1RUMyAxOCAwIFIgPj4gPj4KZW5kb2JqCjE4OSAwIG9iago8PCAvTGVuZ3RoIDE5 MCAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBxVxZd+I6En7nV2juU/fJBSR5 774zZyCQ9YYkhBCS6XkwIBPSbLGBLL9+ygZjWTa0DfZ0+px0CDmq0ldVXy2SeUW36BWVjx2Ceg7C 3j+nB7/CJSqvXrs/6CXJwCpSDKmkqYaMemNUbaEiLmEsa6jVQzL1/hj+o5pRMgxDR7JuFFpjVG61 CCKoZaEv55M5syds/hW1XlC95YlOIidYXNZBpESlmMWLaVcNtC8EAhSsgABVdgWgsPY127TmKPxV a9yhp+mEodpwwJzVu18L6XYX6MGhSFxFiGHEbJTXIOWeC/GydJBFZc9iwp4ri8ECtkUxxYlFFVbO EWBKMViNGp7RhPXRAatu/AwkhS2VxaqSoRy6aizYm/CQ3MAJhQcYNi0csSIkBXyYUBSVwN7N8WzE SisX0lUZY/jxvIHQ3XXF++UEiMDsj4cTsDnRsUQM+JMfX9L6dGB8ooE2wCCcMoUVGyTfbCK6kTAW 6Ga1y198zwRxQt1oVRDoINgUMMTIxVDFwF0YrTD/8fUQQN1okgHRQFg+iFJFiiKaGK+I0TiW9T0U JAh4bfdQYFrfQ0v+Xx2Aos+vnAo5oYjVvFGEzBxmEh+fFWJ8nAco0kxRDFTIB0WiiMUE7C1TXwQJ sSgmFrLOe7GUvCkrYqTEsPHTdaN+VUM8B7s11EE8rLpJHjiK0yAnUxESdfiVJ+76ngnOPhETAjkm lFxVytSepZAupkyRu4YrrrBXDUo2SAZC8kFSlX87kFAJh3HsKpahan1F1npMloi0NlvBbSPS1fIb HAUZhS8HBDZXQm8qLaL9dhiJWOupmkENTCzD0nWmSloGMAoyMoexKP3+Agt0EPxRNqS+aVoyJj0v pr2+spDMF2OpetN5rWQVuP6V9qhvqD16142/xwCZmPx2VVUbhy9qorvtIt7Ne2mrqXj41qUw6CBE ndHvE2xh1u+SnqJaepo9F2DawPUUPgPHbDTxqrvSdYAkoZE2cIPXjh+yhRKUELCEjpoSYunQUzAm QfEFHUXSoUqkPyeq26JBj1aM2W3aZWOdgsNTizTrKeq4XTbze4oiiYjYXg7HFlpUPrDlDfAMVMmn QihSElMX73DM9VuZWNUvtlwlBFZmtK9QyVLdSkum1HTlHVht8VLyAlONadV2gZkNjBjCj1AVFakq NnIr4dmI8Yk5KsVQe4qpW7KsYq3bZcxlk5RDTJ6cfTbhBOVkMKg/BWIEwBKjtSuXbtgERIi+vXWI FsMmVD68cfPx5FTJC0/197duRUkVezdGdBmoBDNJMg0mkyzYhJOSE5gy1qPOuYtN8gh2UEJwX92A 1qNP9L7SJxKx1CzA5KTkBaYilkC/RjINF+yqLDZ5TlbEYhArVo/qkseYfv2VsPngGBPWhbMegoqi gOx7OAXTqFNmy5ggQnA5OFTYDBsRkjyXS3T+t8sq7rkC1jRALSoQJuPw5Z5rrE413EmaVMIlQqSS Kh2Q2/ypMS8zJ49X5JjKLmNLyWLdNnGCsTBaH1asgGx1Wl7E/dF6HjpoXVGjZ9NB48VoPoRTJdT3 zkCdP/bHd3NSWITd+06UF76G2KCm4YtEtYNiiH14GF9J5Ry1UvF8lWJMvvW7+rdvGTlqoMO+QAZM FfRxqhyZTWbim5wEIMTw6LFSkmFW3npm6L55Xqo0byre2XtiuZHGV3cpxJCg8VUjwpKXkZFlgz1o kph9Uy/7i35a08WUlMaLd/HrpgKOigiZ4NO9/mCzuT1kS9b3jiz2JwBC3FQIDlfkpK799oALHvzs CE5kQQJ0WyBBSIUk+SWHdfwHoUGoBOsq4EvRdQ/QnDs0heGMe8hshLBZ36yhBCKjMZ0zNHfp2fGO +ZFnGqDodYTsMaMHNoLRkA5JlrMHgiYBbvMkd+UIWXL2CIJFl3Jv5kCEwCk/vrD3tAQSG5IymB9T 13OjQmZDm/V/fEXOcDAx5wubOX+i7mKOJtPgV8ia2mA8htZNZLNZOiCMtPUdAV6ZLOlf1yNnAYlR jHgD5+OBNxhUzJ2ZE1tUxHf011//+hdc5jpFcImtJK9e/ntkvpfeLbvUnzilYc+cTEpTe4AW9rBk 2jMTmfDeAbbyb18VOX32tVWsa3KgapGsnfW8xNDEE8PvcG5NkcPsJbMdcPPFBGIhsbdEsqvuBpoO t8mKUVHJKWlX5gvwIjBlFwgjcy+MkfH9OxqMpl1zhKaz+XA6cb6ho964v7+PGW5uwgokvbU0/lQr OWiRyI3lcYLV3DsXV4ZgGD8c19cpwE58eQ0vN3fcHAjjUCiXDrtZYbg5Eg6xAVxPq1zBJWTLjDpx RIWtWAhd3nUnERgGGrAXECQgPJn2eNwSC9wVa0E0xwi0ByWvniQYazBUIHDqhVdWhZGM4TZPnokP mla7ClAF0vZafr7GU3MvccBsYo3z68hoNu/OTyFCGnf1Y6QjuDrqgnvQdaNNBbJWKFdcKYmUI27A 753btgYFCBKCwr0mC6SqQ9Oiwr301UuswWGLAkfHsgYNzaZSOKSiU9yKDi4cwRmtp0O+eCoxs5Fc 8FTEKo/Vj+W38rTzd5PUZ2+DpXxVHdbmd1Wn8/xqX7SXFw/3s25H78zYvLKsSUr3/a1xfN8a7p8c iTsGoF5ypJ46uUIrYbHr9Bw1e1cFQYKrlmeVi/Z9h1ls8MCG9rBG7Z+twXH1+Go80R7TAhhbam5G 5SS6z9vzsTToN4/OXh7LR1Op2mncTj4NzTpiaTMJ13UHtovuN3lhsytDcdWgBHkiPJKK2q6Q5BJc LHZc7l0J4v3wrFI36rXa57TRtv4mNx/tMrX6zJjX2P2ictpuv41rkmE0Tl+Nl4fHq+bswx7Snx+O jV7Lg38edJ4Lk3PYEoyZiiSqVnKIw1XHlkeGQISRf+0IMgQzRjMkf2faNXKQIb38uL7Gn8FzEd6W fXVyavsInOwLo66o4ya6vbl23K35EQT5e/EnU35+hJRI8SY/wmMhOvRWeeTHlQ588GTupXDp8P+E J/S5YcaptD7atEIr+tN0MDg+UvWFfLq4Ua6u7xfNI2rbEnu4/lnPhsxl96kWrxmIbvheUT4rZ6N+ WTsZVt9H8miSCYuDIGHDyY2XkMUVuJIRxjQaDJmw+EoQ74hy9+Pi8UNrLPr3b6Or63rHfHk9eapr tfZIv5n1lvaNdMbYqdn+vHw1H16OzIWDX7qXJ2to9xjgcsVNaN+5THCJom+58pDYN8JpYivPgCDB hlVn6dAuea09sXHV+vlZPrcqz/eti8vJfIqXd/fD3sWldT5f4NOXj8fGxfEnPX6tL05r6OG9l1mC XKnFWzy594Z3vjVBqlJM/bgnvCCEm71uDnyggxRLx2iCXB9deofsfIK86ngJ8vD+0R2qSG5fvtIm X1D1mFsR7q72BHar36q6WEFu+kcNOkZ1S37Mhs4l9+RLg/MjAmoI+Ws9yy6l3TBXigcdanT5fYEM eyhXimtUrOGiJL67otmVLbhSPCqIaWVbuuzUps8dMvpom0s2Pzm57s50q6qbnZamnk0axuXxbe39 bnI3eG5c6dL9bRvP0xqRgzboclbq5BoMWuTmflpow1S2NRhAkEDio9a8pl+0WYOMj5e9xsnTzBy8 nQ+qWue5NR+rVbawy2OlfnckL+4mbXan3qrqWfXpMhtoPXVyhVanMecvefAMCBKgrUjjpqGcz9hy 0T5/Wi4vjk57x5XbWXWqXjava4/Li3Kv/HSqOtbjw88n7XVQro+V8hE8tH9/nll+XKmVL8RazBXW tKwW9Oex+VGHW2fhCjKaH8XDB7+BhE+MSOutgTbceQtxPwqDwIcUFAmoI7D5Zf0xNMb1ryYmeEZP eNImGI9HN52c1NdcGzAax+QGEUu5jNZVxSImk3UhX+fdoVCsilPmB+Y4bATXBtgcmaPgiAuh+rt7 u8BBV6bde0bkT6ggoK8Wvv5zYw4YosZ/07oeZzH/QzyKa/UOimJuXf9jPOD5DuxPnaX18OAfaQM3 WFePW9f/IBrOE27/B6i48E0KZW5kc3RyZWFtCmVuZG9iagoxOTAgMCBvYmoKMzAwMQplbmRvYmoK MTg4IDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMTc2IDAgUiAvUmVzb3VyY2VzIDE5MSAw IFIgL0NvbnRlbnRzIDE4OSAwIFIgL01lZGlhQm94ClswIDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjE5 MSAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcg MCBSID4+IC9Gb250IDw8IC9UVDEgOCAwIFIKL1RUMyAxOCAwIFIgPj4gPj4KZW5kb2JqCjE5MyAw IG9iago8PCAvTGVuZ3RoIDE5NCAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngB xVzJlqrYEp3nV/BmVcvS5NAzqAHY930Dr94AUVFEFBBRvr4OagqC14sp5DMH2ZiLHe0+EUGggXQR A/nMWwCRLQQ9f1ky/BOaw4jL794PTA5nUQohWTxHUyyByBuEHyBZNIeiBI0MZITAzv8Mv2E0m2NZ lkEIhv0YbJDPwQAgABkskD+q+n5u6vP9n8hARYqDM3QcHP/iBAMhcQx/cPHsq1f1pf/wAUiUhAAU 4QEg99IXTGmxR+5fhVYfEbf6HCmslLkVfhdBOFux4Z8xFEP//Piu0hgKtcbYs9JfMn1cLIq8qrSv qe8nAgv5KYmr4iz57lUfOugmNu4F3l14XV0T2yQfT6KYIGEcYAyORGEwFDAAvgdI+D6M9/OvKA1o ksFgpJM0SyG2ucpJ5k7Kfd/rgPS8DkBQgu963bfko0TFUTTsqospY1vyng8+7vjAtySKhhymu7up vkTbhqXwfIfp7zFm1zh0il3cEa/YHx49xeGIhyoCAN0IYMxHVeSGsyJvD52VljH3qjrWBGFlqJ2j iDFUbL2vEeQnFWAgIEZSHmBI2fhJ9Swub+GPkXgY4EWnPYO5OS0KMykRPQPY1mJEHmmgii5ZNSyn LXWVlcSCk7adlXYNe1KgSoOyhemT8rJVXytg9EYmfBk1IEw6mYCh1E9kAoQJ+U5eVpS9o9LoZjKk sfJ8MVK2zOBolgT3aBdLHVIcdFhsz9Kl0Xg0Op1KM4ayptNeEkb1hUnHqIAM1wGvEnUseoEwIaNS BVHFbQ5zigeDHzWKeaXWMJtdVjjRTXte0/AhRyyJIuW2sZrACjt0zDpbA+UTMGpAmJSMCsBPRCqA 58/9ITsz1mtHGDjuVjkJi0VnU+ZqZRb0atjyizcT4myIHVJRruxLalGcY01dEjBFM/SViI4H7GEy mSXA2VFlE+ZsWFbeG/PVRIhF2REUu9TZoPUCO6RpTs6Ie3nPldi9JTr9Gbdt4BRZxBqQ0MUpl6mj vN7pGOVSrVdbJ5AHviwppQEdCpFXLRqPWsKVJtlDOeD8/Tfyz5/fjzvaazUoFgHhqyccdVk8Uoog yUDgXpEMMCSKcKt/r/5AEJyCFRF8VVuXP/V6/WoZ/gg7qHpRQBgEFmnev/zzxzthh8NSkbwTKJ24 y9I/EngQJsQYz5sPkoQNcqLNR0CClCwJsEijeImQ2JkVK4ezECdkS228744+ScvtquvJZioXCPoz YwZgP77feKAwuQFgkCvsR2AK0h4z61pnbfVKFc09HjfuHo5WMgVeOC3MCmUb5CQgwvPe59f9xwN1 k8n5WwOSBTQWMujFb0Gc71vw1oFccYIW1CsHc6h121QTYPbSKMwbmWmhNFKM/q51yhDYZ1sSD1Id rzFFtyOO+EqndlrXm6OrXWPXJw/6unutP7ypVlDf5+66D9RfjM2yGPiRetnDCfmPwgcMLnGrmsmd Km5bKs42biO/kzRDLhax6sbVGpW+tGhKem9RazCCfcjUCmJJfYexr/1yUJqUiAajfqS5y0KckF2x cWG8KMpD21lvquJ4AoB73GUKR8c9DbWeRh+JzHZNruriuKqQQ53nFhTPDGgyEbv60qRkVxzgP1GE ZSFOyK5jfeJqy7yDl7DdpIpKZENQaBBgz+/TD7gR+AU2SD8NfLD7PC7VFiWcWLWsVXsLkld5kp1g rinhEtYLiPCcEZ4QeFTd+ETzrE/wCRynws1dOgR+wQlasLOuomy/r9tFp3IqgU1BGpH8pms2yj09 rx6cCUcvt9gmczgQ/Q45G84mi0x5MOeSIPA7rVMhcAJlfiQhIE4oIUBlzi+S6kuy0esnHYHwkA9p ACPw1eR5OPm9tSZRiPi9Sb/NJdSY0N4xRyDZgDQpsTGJRu7mpFJOQ5yQ666tCQsAQcPh9PW+CINh 3q0ShKDhLD7Z1iQgQlrGJH6mFCOJcClm6MyJb20rBbU8G9DsEBvbieQFCztkgMIbFNkoJlutSstt HxU6bUXoMFo5Yzgd2RQB75RXlZNjb4cSlkRNEoBOy3Hsz/TnJBtu0JtHih+LmpKpFE7SUcVW7c32 mKlWje2wspwMp226OlzXSppitut5hethe6dQMSd2Inb1pUnJrhRB/MjRBnFC7MLyw27lxPa3I0A5 wgZf84Ni53Qck6XShjnIM73OlWjr2BcYfioJrV2vWlQLR4JDakP5PKd74/a7N1ViSCQbkCot+7Lh mfcrB2KkvwwsNtwORIoNV32/PxBb/WLeO0UW+13O/2+4++CdkG9N7FjvYISDhGxArJRsS+M/U5ZB nFDsNifIedz5KoP78wfKm7RSsN7LRq+eTMFEeZs1FDyHHiCc3X8d1F4m3h/f2t7xm6qAFml5m3kw VoztgFiZRENOuL+f4+fGpeZCEIYiznPvr7E3zJnzS8qtJF16g/RJL3FQGrrLl+Jqyjc2oQLrIbf9 Ew8hRPrW3DzMTSsHd7lyL9o0QEmA8TZcYCkSUOG6KZZMTPutLoOHZwfQC7Elf9ZO33g1ChE/GqaJ RUNAipSiASKkGw0BFdKKBniT5D5xk4+GCET8aJCTiwZfirSigQnvjiXMDZAjwr5KJG99bmCxcA2f eDREIeJHg/7qIfFwHgIIr/Fj4HkBZQnnL5bTJFlfye/yOe3xOazcPYy0nUaHG4TknRaBiO80ay7j OWl3s+m3mw/g29QXJ6WSCS61pt59eBih0Iha9boqcNsVgPXz+QVQZDeXl1sTVk+ypOu5ram8s2Hr DUMwyrtJe5EqOKKOXx1EasVAEeWzDICrHqG8eyViIyCBOupWgngYvzVueBHjWtcj561VOO58q52j PIvC+4rQomdRUrUoAD9zQw/uhYXv6HFOkeNkfkXv+5K5x2oky7pTYWztmq1yi0ar/HhKuCvj1BUq bHPAf47ybjI0TnsGxmHN7AkViidqfBrWYx+O14jye8zb7vKja7+RDoFIDaQDoB5U5F6Wx1bgWVUe 2B6IAtkTW3dWtdp02sWncsMYNMZFB+AET8mDZsUUd+qAm5JjzlGIiTwe2sxmJncGq8arHnxs2rPe qeYFBsI12Zk9XzDtPdv8Yp8frphAQr6vo3mNMkY9rVdAx6tSfuDawnCxdqwl6E1N2jyYx353WSLN JQ3c/s4Zkaqq7ihyfEzEtBdx0jUtGS6e0jItGa6g+rOaqlVQPpGdQ289KAyQTOYFUhxHw/ORpNLb P/GiGNFy4tcnHo3gyZ14F1FSDT+c/JmbewAChTL7fOJNW6MDZWtKb9bGQXPPzZcureJco6c6oqKN 55buHrRXc/lxv+I9iAdYr5KIKq11tc/Mku+JJtvdCrEPjAurBY6jwIkXVTj5dIDa3LNllDu+v7AS OPHwM1AwEOU2Vs0U1m2iC1r14/ZIFIbVo8r0j502XnYKdrvUYw3sM19aYW10I6rSYjoT9mP5atr3 FuYu4lyfA01l4QIQRLgWipr2+SJOzBMPAoV8iLv9GT9d4QYqO/nqkS7bZXZuaI3MTqE3szU7U2Yt cVFxeLShG4MCM582OpbZ/nw1Sx4WExdxgp6OH7X3Gv9qGREQbHjcl5Zp4QOu9+lRndFrXloZQnvR 1ER9iS12GfiUSbtdEyt7AS3UwVCzrBNPdupWEd2P3C1pUe6WTca0Z3FSNS1JPGi3Peu+yGhfz2H/ sk6DQCHTrib1OWlnmPGgKZULAsEeygxa63D1Ij13m6vKZ0uUh81VEe28aszfsXlU6Z7IFPDF1sBm gt0nX9T9MZtHFY5v02dtRaC4IZnwXb5oXiTC5hegYCCe4GIcx+AifWC4TM9ZEsOyrh7rPONuTAbF RyjX5zYV91NxKuRoiuqVTKM9dUpfj92/x+Z3eqfD5hQevt8UNW0ibA6BQnmh4c5uusuMdxvmvYd7 GO/hHsZ7FAX2n2GUxIORYsLl2iss8izi/Uo7ivF/q7QvogRTIr5FYx57NPZgWueF4Yv89FtuhkCh GLxU2o5eGkjr/EEa1q2JuiI2yuYoDmsrUD0pU70sLafrTakooQ1A1TIDeVlP4llg7+kGT5x0TftD z04BOvL0lCMr7mhhHYdlCWtu5vDxX2XNbbd53D5lzvT4yl7D45MOwHsgAFaJ0JQRPQebbdNSToxt fNY4FSMK6qrizgiqsSjEDqtrsj4sB6MKxw/XZyQQOPYYuMV6X6VFuTmRY+8CFAzEUv3TaK5mI6O0 E/qVuYGNDuRWXdtV60hs50TdkhblsdBqy25dVCqkti2rLUyqla+mfe/Yu9M7nWOPoX+oHIRAIR9u zOomk5nkd8u2tVbyVlfQKLJZde3JYuHWTkeNs/dWZi5z1dVobvQko7swmUZv+Gpx+DBqL+IEPR0/ aq9s7l83EKosiOx7xc6yp9elIuVJEteF+9KRTuvV6/qUFKiLfZPAz50ID2zhzMaaa9ZfyHyPSFru mszet+JxtzLnFtKUTHmJgL+8DzECgffPP/63Iylz+GEn//t+JNw+3Sh7FS/xSIBz4a+pLX7dKPnP q5b1I4z5+nwr+Mja7bpfn3AViNzuvzPUVLgKZW5kc3RyZWFtCmVuZG9iagoxOTQgMCBvYmoKMzM5 MQplbmRvYmoKMTkyIDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMTc2IDAgUiAvUmVzb3Vy Y2VzIDE5NSAwIFIgL0NvbnRlbnRzIDE5MyAwIFIgL01lZGlhQm94ClswIDAgNjEyIDc5Ml0gPj4K ZW5kb2JqCjE5NSAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8 PCAvQ3MxIDcgMCBSID4+IC9Gb250IDw8IC9UVDEgOCAwIFIKL1RUMyAxOCAwIFIgPj4gPj4KZW5k b2JqCjE5NyAwIG9iago8PCAvTGVuZ3RoIDE5OCAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4K c3RyZWFtCngBvVxpk6JKFv1ev4LXMx+6n8+SZOdFTMy44I6KS1ny6k2EoiguqKCI/vpJ3IDEqsES tDuiqror8t48efMu515YYxK2xlJZE2CKieHHP6YC/wl/JajTz8433CvJ4wxG8+Qry/AUpiywTBtL 4q84TrFYW8Eo4vjL8AvB8q88z3MYxfEv7QWWarcBBrC2iv0s6ZuRoY82v7D2FBPaR9Fh5LiLUxwU SRLkjcWT967qav/iCqBxGgpgKEcA5tc+Z/TVDXb+hBb28gVUHAl3w/HH3SDCohQDcLgpAI4ngojJ 1VqYvNRHWE4bj8zr7i67xNLb8Rb+M4ET+K+X7x4agcNTI/zbfDlZBBYax7PJuSfl2hlFIHYWxaok Tz+66k0Du6pNOhfHdz2iPHOKhnZMcCQWFMPuSmbV1vR3zVgZG8kYLI2EsLHmxRW/fheYdLMt5w4q NbXM2qpiVfPyZmEf8ir5fQMAHNSGoBmvMt81ABfUWz6HxHH01E6o3mtnZzEvPtfmgorjyNmNUp3y gR4Vp6tdrqXJVdYWuL4AlkAvqI1N2eZlPUMO+qv5pl+md70E/V7PVsa9B26VC6qrTDygEjT5DFCh GARUe1F+s2rSfDcU/oV9/Ap9hmef6/oKzvHqHA2DU0BGeF/xlSe/3moCRsnArb5X8Zs2Tjo3GsAt BCSom9Xr1tBe+8aq/3o0d5KBNgE/pdrJ+pvNVqkAv621hCzGYY9cZQZCSQDaq0akVgcYGBQJwDsC EKs77urjZ2g0AyEDsE4goqgba4c3g0Du48kermYAaDR7OB1EeDFfWdvVDwXFEDjgAHT8MORy0OGe fsRZwNIcATCKBTSNXW3lAY9OO0gCmNi5G43UDFwkAUDM4F4k/Qf2iUcHcC/+e1vMzgvpdcM+zHqz dJuVUlJtI40yTM+YNRihUR+pCV5a0inioI936dHuXUhL2j7PPwDqJUx6lIkHVIZ6BqYwi/ZDOs2B TqusGUsRAGmdaZEW2S8Nu6nqe71pUsKBnFSVSq0OlErRrG+76fVhISQyjUYEkLq6xIMoYJ+BKEBT xrShTrgaT0/Xk9SasVb9DN/ZiDOJJjciofY6oGAe6tUaPtPtQXGcK6YnRN8WC0VsvhbvRfVmVAK8 k9qxBBYA4K6IHXDVBO6EAY4OrhvehfovPqxSb3nqJImmctC/hA4xX3npS8AOSggGbAaHlS0M2YGA nW60m07Exs6/AcPft+uwa8bo0Sie25Bkn3IdoBjEw1zCH3BqeCfOO9EQZwmcpgk6hvDn0SAmJAER qENPATC0jfqvwSfxLwnlIFh2l1UtYcmHmd1fVg2iVJD13axpKTmVqdhaVxqCrtxIdRLprv6WYEVt bXYbcl+NoqTxahMXrmyANYgHV+gb/VGQ3yybgjEyCst8XaunWzVbnmYKZaM5ni76Vl3kO4mq3FKW eoM/GLX8kBqWtsxsRUdx8YGrTUy4wtT9GZEw6ZQIflx79lwq49ti3bKBXMxnp8w8vQHpbKe0wyl5 Iu6H7YVGsAonHoS6OFpZOqsVWYPFZuzsGKy+7VivwcqrVVz4MmhZdE+88vsCf0i8xiuCQWvYYMBC K8xjZQk1mWx8xWjtGL8eClqXBCPpUSsmbEnwFKIjCeUgtnsq0I8gPsJzsA5HwLIAuyEimqTmWpcl SQatmO4xxHCJU0BE0BDRzOlkcdixG/HjBwb/PmR9jFPnEhwE1NUlJuujcO4pnhPKQazvx2//hcD+ mUp9/Pzrv3+m/v2Pv3//+PX6+z9/O+cYL06PyGFO/l9DyGXcYAKGvwKCwJI+cS9OG+jj497cxbsu NHFAMMd1EbjuX9ctaTylAXDaFfCG+jU/NrDAb9oP7PUhKhJAbuYVkly3lo/6ikKeCDnpyK9oUASM AKGP9ysvQDnNMQKefDIoA+E70WCE0p3YhTn8doS/ModeZWLyAzT+nMwUykGs41w98TjAGdidulRP sZGHSY8KcYFJPScdpSk0He3gZE3fSCxZLXZXanXRqXC6aK5nuzezXugSlaG53xZ76elaaslWZbBZ DCy2mFkIUaT5Hm3iwpV/ToVP82iJXwSJkkbKid1GHYpyZk/3synGLA5ths+octkEjL1d7BVxnt4z JEHnKm1pUBJriUhwdbWJCVfIWiBRDbps5xPap/pT/M/KfYcd8ZdPmrrhC0Ylk2WVcTa0tK88uNNt wTnYskoGpQ2JhZlPbQ8to2fbY0osS4dMw5rPdu96jxywo3JrXnrXzExJZzFywEVVn3kUiesA+Rv9 itBw+g/vk/qM4dHMG6m6oLmgafE1JMZDKHpUiglXlnxOdgzlIBfDjYqQTHQan7Fziq4KcYHJPYdU ZCGB7/cybXbRNIb9caLbWhQSOkEsNpmWlMJ7pJUwhjldld54vFqj82uSqNEVQuvl+9M8m4/Ce3u0 iQlXjnwOgQDloLiuaGZZP+j7japUKbVohHY5X3lwzvHgPEthyaDEdV3Ad02Fr3Xr2WxnpPBZttsH 47KkzOeCNV6mxUSViYYN9giP6+C4p8wNJSGgyME1TWHaXTMJfmrNqxXxXbJwW9qK74AlSW67zKVs LZ2XWnpuoEkVe9cV129pbWHRGCubUUVFj1Yx4csTN9LF0CYaKipCEQi0waiIFooX1nLR1+abpWeI 5nHeknCGLgkOUnEexeJCl31O0uh4Ar87j5y3DIoIn/l+5clc3hJOx6Dp0z3p9VdCrgz6DRlBY0RT tCBz+UDQY5y2PCTskmdVXjxj2A+NUF0JUWdhtFSJ5EZ7j4pBq2qnFIKf0IK+Oq7rGBUEKSAIcqLO kd0iRb/PIsE29Im8PAv0ncpDrOiZsnTWRQ4lKlYUOEPk5NGiAmBFwYuSzvoM61hsYP1ozttjWACg La6ojMr1AUEZgTBzIiah6MDcx3lQM0rmEk6VOZv22lx4XAMh+Nb0dRJKeE4C7AhCQtG5TOMAgPMe zyAvzzrEiicBnpOXAigIwbNg2Ye3Kkcbwna2K6w326o9mvHaajfNiGq7ni8J+zLbV7Nc0X4TTWah 5vspXRBTDwSty/wjHP84qhMvtPSNlPSu2OK/E58xbXCwBk1MS8O8ZeXHibnSW5ZbUm/bSr/18nPS bgycwPZyx6NRbgfLcyEBcJpvkEVw5mjQXY4N+61VrcD/kbabbF4cZlO96VYW9DWtzO+Nq57GnOfw AhsO72e+itce/w2DBWKuzsnBj2cDL2E6ljfx8yQGJ0FeQ1QlRRObObZJJg66rC64IbdNmXr1jd9R ucS8nZGNcrmTGQFBVThru6At643l4LSKvOxFVbDB83X271XLu/NQvdqbO/dCTN9oQ3ngvVOIp8Hq hkgSPpLhLyiCIRJNk2NmMsFJp3ih5dEk7WS83z3DT10PyaP58zVKUoCDE3/xk5ngpEOseFLUjZko xBvcY66f4gkFIfYq9tO5zlghVYW2EgkR7y3W08KMnGaGailNN+8NhjcvJSAcd047qXdwp9sGQ0w6 rXnDzMt1akayI2NaKmTVfOirena5N115cMPhbTSkK6fgg6F+HxC8DJG48pMgryFOE2OO2isJaTxo DUd4QyqahzmvCqlEq0PL71qL7w2VwaEl2ytiZORXcr2tTIzV+Aztd8Zi3Cjp2/dxLiY8tP7M45Pn r5PQZAIV+gnb0LbhF/TpvYCCkDPkAdOmLJvRaN5UlsPpAJ8zg9xeTiw2pYahgB0zoCadfb3TNnPS Ml3u2UNV2Ipj7G1PRRYlT2p5Tzx6iLkbbalvwvtJuw/QHNqSCkbJz5jNraFHSmsCHvoignFSy5Na saLLkM/pU8FqEs0nI2c2b8gIb40hfSnDofkUvO+hrfErIW7OFpRxtMZIpFxf75AEQTFefj7Q3w6S p9GMfZ71iNXKWeJJ6SAUhLhpyHKefMmfHz9f4dDnf05fHpn85B0qEpAOkeeTF8Hop8MQwtdYHBeO ieW8jq36lT9OfxJRTH9eUzkfOMf1o7mpnhKODTwfFb07CMrwhxwn4UCD07WEi4PlPCkU64XliOf0 22CJhjbcrvUbQRIUea3f4hvRPOsQL57sk/JUDj4a4a81imMT0jaj5coEdW7b3QvVwoiZrJqpurDO 6u2i1Z/Md5o0K07qdLZ193Dm7Xru8oqDJIAKIY4Mvo9lssinu6PQAfWco9+s34Lrh3cygXU9noUH gbT3+/p612UCCV8U68JbE+hL3Luue5QeKstVHb6uAmXQuyPTHM3NP7DRBuvPT2/mcNwhhgn2SjNG Jib2DWWCgT/gPYZNaeTzV6M/HmEk+PteEsG1hOubl5Jn9R66xp51L+/4gg+84ReCmTy/5evy1Mg3 Xu/F3Vr38vYwj+VK/wPZWnxfCmVuZHN0cmVhbQplbmRvYmoKMTk4IDAgb2JqCjMyNjAKZW5kb2Jq CjE5NiAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDE3NiAwIFIgL1Jlc291cmNlcyAxOTkg MCBSIC9Db250ZW50cyAxOTcgMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9iagox OTkgMCBvYmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0NzMSA3 IDAgUiA+PiAvRm9udCA8PCAvVFQxIDggMCBSCi9UVDMgMTggMCBSID4+ID4+CmVuZG9iagoyMDEg MCBvYmoKPDwgL0xlbmd0aCAyMDIgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4 Ab1aW3PaOBh951douy/tdAFJtmQrO/tAAk1DEyjgJFua3RmwTUJTSGJDGvLr9xMY20gsYy5O01wI GZ1PR+e7yk+ohZ5Q+SQkyA0Rnn+ELvwKl6i5eC1/sEuGwBwxYZQsLkzkjtCxg4q4hLFpIcdFJp3/ MXyjligJIWxk2qLgjFDZcQgiyBmg92fjiR+M/ckH5PxANWcOnQUnWdy0AdKgxprFi9uumlhfSAAY ZgDATQmAVq2vBr3BBK3+qzY6qPsw9lF1eOuH6rsIVaa3U/g1xRR/KOy6aYph11TMN720qbBgFG27 6WSnyTmZVDmnQ6xqCLbvqmsPKDbbkMJbkVd0NJkpKWxQsclAB9Q2kA5z2bwfnVY8p/Yt6Lx+DO/P 263pmdO++PU6+zQwHy7vu8O709ldd/b6ue++XA+mVbf81SuL3QVAbLCGMp42ZlcBJKSu81kDY/XU FqxmJnU1NBRWQkNCKsbK2VU7Pxm/9fzjXzPiP4/Zr2NnFNop1EKWQLF2cwSDTxNiI9jcEjVib3bd urpvTB7v+vXPINjb9lN32quHxnm1/OTM6qz6iM6fK3+hmw8pSzaHxkhUKT/DBphuszR8FA+z+9km qcYeQZmx3N8SAB0GwpDeQCC2awjTYFyaBsNSL3jsleZS4RiCNEborLFQTrvdOTuFHxuVr04bwSmg 6C9u3h/AI1IW5eMRFPO38AiAUc6OYmITTAW24DuHFCJfYotixihDpkUYQzHzezDJZHIhBABiC/Jh kjC1HlgIJLtEM8UWgFGYrJyfdav4+fip0mpNTHzawrVB74fdPJnVxEunXW97s+fZuPy5/Kt79fen 9qcvQetbcF7p7EHqMmCnjMmJVELeQp4EBLKabKvlL9YTP7lwmi9O+2RK6/bMD7lxXR9GobIgC8vd gzaRQdswESArG+zVa9747qMXun+/du9HzVtzzL6Gt93+/fNl53r3QB1nWX2z2SWaKVBDeblK5raO sAklTrIayvHwdPLy/Mp+NMbuBX656t//6E+OZ8FzvVVpEveSjMY/q1988ml0dUym549XXkWc9c06 uru4nOfAPSrYKAcmNuXkDpYiFmA2syJWwwt0Nam+YJkBiVp06gnQ4DL9JQmw0amdyNdxsI5S4SIx 7pUFhYzdFkeJVfnQWjTepCwEGMUx5tztU31x2c8xaiF97ezC2ORucfVVtFRpwJln1t4miKX2dARd fGr1tai60Lw5f/cOwf+9BMel4KiNUqbkpDhCtf5ROtEWlK668/90IkXAUTT3rgy0HgFNWacUm86O Q+DDjANjOtD3f4/++XjzoZwCytTlJL2FLdVtM7pu9Zub3esXW1ptw8QhbXV00LBuVmJWT2B1TCQr JCwgwUsIJWiT8vAdKm3TdUVICTNQPkD9QPm65bN7pbaBVEZIHJ9YVJHQNjLdpJ7Y83WIJJvMvQK+ qHmn06zM3wrHYcmDz6HbG49LD8EtMLtP6yVAdBQSeTFlVE5BgJI3aRmKgKOc4PjBVUlbdmCYIgIT ObwgnFAsZMKfsw+ZaucaiUino9KXU9bkxStf09Tu7tYpr4gVS3ncTkbDiD//RK2pH8zQZDjyjxC8 Pwp9NzNq5CeJi0sdEkwYEKZhZXfxTe6XuLhB8h6tFHUIIKxTa1/V2keICFrCJYNCS0R/Z8bN+/Qv 9lKdPDBiAYkp/JxUZ3C1ldsmTm6KxbHqAEJxZCDx+nOtcYQ60zFqujCLl6OOI0McQRlz6ZzIwcoe TkslfTBxKKaQI/rS08tMjXAibUKhziIc8u8azjJ7zCbGEmmb2FYo2+ZUNrlPfCo6BJwKTFpQOHyF SABFQOC7D4EXQmIa+WHYg7sURP5A/dkEfjCESfaSOIMzohhagJQdOUkcmm+lltmGzE0HlpAJc7/V 6YFaCqiFQLfZqF1UUTxClAkMPvYqAizJKdQAsOGlNTlRyrB2PTUva7KH+FVa/68RAJzlTqKERagg fcv2vIHFueiTniE8TEzPtjjlfQuLPmOWZbrMszxmD3p7hBEu6ZR8pqzIi0/zbWoqZqo1lecyxk1D 2LboEez3BnxAiMchfGLcMwdC8L5ncohMjJi+aRmyAdi9nLJkmWpAOZUyZFdKk8icxE0mtFnTgSMz N9U5YaXE4JLFufNRu9l0MsNppVPSleoY2e/RN8V+KWjMIbUUdYRFUdMpNeARgGgP+w2LBYARLCDC A5gSf+XtfGaiokiRHHfSRuorL23f4TGGREVcaDXRttYml56pOjxBsIzc87sOsUaiW442ZNLGpgkN vL56cduwkFCUuvSWF19wV7lAUFSTluirfL4j8CeBP3z2vXkWzXxEmueRuN5et62sg5VNnkcMWTta UJLqCATvYbkJ/Smxwcn0dQ8TM4i8uiCCrEOgpLSH6Uy21hjKad307F6snWXKx+B6f7UmO8iytqF1 nbuTkFhr2+qY/SDWCpiy50CCsNQseBBr4WpdbRUPtC5X657DrEvgIYAc6IVlcxEZoSQXlcG0OBeZ EQPn4sMQ8NW+4jB6MEQ+OpM5Nw+dmXCdkMe6zMzHj5mt1U2HCL7gbvnojNv56Myi+ejM0u9LD8Kv DW10HjqzrXx0JuDJxDzsFTwXncG4dG8/XluOJ/UJPImmpo5rmAr6P8M/kD9BvZ+LBw0XU6Day+Mw gCnhRS9w7+TQEJ61Jou3kq/fv8JIERn0n20bh6QTjB/CLkbmFVIPtmeP6FqHmdo2wcuJghFNoH7L 7BHauvbyMXy4TorXXT6In7K39R/kESX3CmVuZHN0cmVhbQplbmRvYmoKMjAyIDAgb2JqCjIwNzcK ZW5kb2JqCjIwMCAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDE3NiAwIFIgL1Jlc291cmNl cyAyMDMgMCBSIC9Db250ZW50cyAyMDEgMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJdID4+CmVu ZG9iagoyMDMgMCBvYmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwg L0NzMSA3IDAgUiA+PiAvRm9udCA8PCAvVFQxIDggMCBSCi9UVDMgMTggMCBSID4+ID4+CmVuZG9i agoyMDUgMCBvYmoKPDwgL0xlbmd0aCAyMDYgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0 cmVhbQp4AbWdWY8ctxHH3+dTMG8S4Gnz6PttE+nBD5JjeIEEjvMwR896nT3inVXgj5/i9MEaVi/B 3i6uAUuWjPrz+FWxeDX/ED+JP8T3fzsrcTgLefnnfIA/kpnO+/+2v6kz08hSFI3JqrLJxeFR/PVW bGUmZV6J24PI9eV/hl901WRN09Qir5vN7aP4/vZWCSVuT+LDD0+v3ctT9/pR3P4uPt9epGN0nPG8 BkmjzYzx7VKrrvQbJ1DIAgTK3AqI69J/etmdXsX1z6evP4tfnp868en+rjv7fyvEzbe7b/DHWmr5 cfPeSmsJtdbNpdJjmTZ9i4qllXY1df2Ua6+fOKyaplhrdbaDpmIbC94VXtA10c2xCRBsCmBAaUEV Xp6f4+EdJFyL59aurs2M4Xh4QwWfvIOW/Ny9/K97OWfgfdnUTBvr+zEO6HoCOXptwBdrwBLU/K6e JKJ93Ekgb2zAG5VUxUyLmVLaH/HDVyF+/vHm4pa7zOugTUzlXAepAnpIy2pGbrvUfV19UJOpwnqy UjNNdtVBv36IBhlC8QZCMapEA/2iy3qmEjzu4TwQmp94oO2I6MIHYZ68hcg8nV8fjhnwfH++v3sa 1KJhdk1V22BfF+DpnsTmQ7xDhsZC5yJSei5yB854eH7MYGxQtWyUgiKoPId/V9r+VssGCBcj5r9+ RI26EGstLRE1eBEY9DqMBeuJCF0Yr5pLaCAtiSLBGJNBwauC5/LhePZ2TKaG4xEIYjxmLFTgyuWt 34ydbWMaJBaXnyGmvTt5mGIa0h+Sh/gKkp7B8WaMaSDgdT6uIMI33EW9Fup6VdugWQpUgSGf5Ak0 jl7IcD33YIplE71EgYteYji+c+PoJQK4cy+kztG770dkBnqdfiJ6ZZmWXleBNPSqwp+wQK9Ee10I gpFeqsBELzXMTC8VOHcsTVPYHDiXhaAKON+GnpjzjgOXdyD1NN4BAkm9A1UgkXdA0p02tiuiwOUd xDC3dxCBqNh+ZKPX6SeiV6m09LoKpKEX1qPSwksEmNgldpnRJfajyO24yHXyacAt86TcuuKnwVal XqEjAkzYErvM2BL7UdieuLB18mmwVf56IK5edN715kTQFT8NtltDlkmYM2mqAOBGNwxdxLBZqIZ1 LWqXY7maWmV2ByqAgXlzcnnH5Q9IP41DgEDSQI4qkMglqtShfEsUmGI5NcxNLyl5FL2/sdHr9BPR W6WN57SHeNYtpoW9rdJF4gR6RoKLX1p4boCpQhTB92wEowIkQhgU0kZgVIVEIVhVOjnERIINYmKZ HWKiEAXx73wQuwKkgrjyT2rgKkbnj28m1tsZxKKthlaQXSTWiq5SL5VwG7jGJr6yasR2xu5Ss7M7 9uPa94wAl2vQonO7BlXA3LyZX/+HzTVQARK5Biikje+oConiuy5Tbz9uqQQbxKTw7BAThSiIH/gg dgVIBXGZdg9ypv+5M22j/PMZ3LuQWyrBBTG1zA0xVYiC+JENYlSARBCDQtpIjKqQKBKbMvVm4ZZK kMOL4WMyZBFwOrk8Y5sH42mze0bBwxjvdt/Aj80x4Fibagtp2v3OdG2rW7P08JlL/FRtT2oWJax4 ur4agJbRid9wrAmb7Y8aWasexPGBcrDq0kl0lsklwrmsU8/mqAQfY9Q2N2NUIcTYJYkVQjV1lqtM ZvkKtkrLFlx62KIiDGytoAAdmUMUFP6yxJLhMkTaNHGBU+ceaMOhrNhLGIFIQ22zU0BKH6Dgyz97 DLQUj7v7hwyOB2fd8Vu2ggV7RFjnNbDgCpKIhUL6s3t2FkAiGQvUNjcLVCHAgjfqyBaGn7bdr0Ch smNDDmEBlSMVCrk/m+VHIfcXYvjCQkFss6NAFEIo9FEBBge4mZapHK54qDUc2JBgYLMVVTMVB42/ 88LPQePv7A2nEhmGh4LYZueAKAwcoBww6raEy9bQOF3Z+yElrC6iigw9PVykujrWSUNO2x5QQRYm 9Kqy1zYM5LhIPtGMp4S4lvaE2ZZK8IFGbXODRhWiAo7OjMnyTOkV8aa0446GFASVIVG8KRsy7Vlw 8iUqHQUJj7ThHClDvKG22TEgpQ9hcD3xhRTk2LbHFSRUdmICCQiqZyIQKlP7819uEEAiGQjUNjcI VCEEAkpAqqxRmVqz9DHFA1SGVBjUyaenFdxLvB55htO5DPGA2mbHgJQ+hMHNzVLnn01LlIYRQZVG bKGCnpvilTbZ7uq2XXzRBS2HjQGHNmT8QkjcvnBtku8bUAk+0qhtbtKoQoi0KeBomOwYyCIBmBVf oFAjCKgUiUIOXPb0kGaf8oCEF3KGk9UMIYfaZgeBlD4EAklBTm17WhqFZiICqmciEBqdfO4LEslA oLa5QaAKIRBQRCgym0auWQKZUhBUhlQYVP4dGPZ40FT+5Hc4Wc4QD6htdgxI6UMY+PFA6XdMSeaz knGMgCp7EVweo1dBZrbkxhV4ajc+CQlNTd1ujJLan5wugS2U6UzbMTMafLTNGOfGbUYixBsKO0rB aki5amfOLshdll6HUmzQx8VWwICW/DAMZfJFeGVXF69nP8O1AIbQM2OcHwZS/hAMJPi0bbFmJjxG HFzTRMMQ3O72z2YtCQ2h+ONCA2iko4EaZ6eBSoRomEJDnTVVphqZrYNhXC23XQXNmDQ2wOzbG+MS 0AAz/OvYMFy44IgNdvng2jg/DUQiQMO4da9g6/7PbPXNEjdQ9BXFMMRXlHgtGijc7gzg5sMwVvT5 5S5bmPrgw0Ljd7u2VsLrrvjhLpSWoOFOQ9NfE7EE6ZCIC3BU4z6+fUIS8AkWuAErlYB7WKQe646H unN1M6bjWQqV3h2sm5EYWeq/3Pj2hmN1gkN16yLolF31bYidJh63kNNg3Irk03u4kuXP7xkjKDXO DwMpfwiGaTy9pNkqrzNVrVnpmcbTvqZJaTDSX8heEnwIciiIuuADGl6AG+5+cYyn1Dg7DVQiRMN1 rm3ag64uZ27XrAJPh25VX5a0SBTJj8MpA9/+vB7zOJEgxvmRIBIhJFCAKCA4aPio9xoapuMpQzOm paFJPxk3jT8ZH27AsQQIYpyfBiKBaBjS0Oiv5M6u8U0fzN0qaCxvBgTflQ5lJ3D2QUXnwkO2hDYe piVnq+w5bXxyEsrCUHKS5/5EfMlwFBJxwxHVYKSNGmenjUog2ggLU+wxcDgfjmAq3azJTaZMtS9F 0tCTN/70bgkMcbkJaHhMD/cWOUIPNc4PAyl/CIbr3ES2DWxK5muOyE1Hs1Vf16Q8FHnyQ3IKNNLx QI2z80AlQjxMwaHJqqyGA5NrWHADRV+ItCzUyc/JwZsB/kG54TooR2ygxvlZIOUPsdDHhhVjg7GH o+wnIYaG4+9/ZVebFLzjcZHwsqDLLcfjwbStKaLTnX6QQLNW5RYwaQ+xpzul8WfGS0a4uHSHajBS TI2zU0wlQhQPEQ3e/YFMJ9MVHANfgbSDoS8FP9Io9y3r9PNu0PCGt3VrtNPLOltFTfOgML2tMyfh oXA9D/Jep1n/LfyxBBiD+EqShBRvaoxvOVwkvMh2VUmWF2rGiuA3wtiDW6XJdLH3ThSd339FCJHX C+FOmX2nJvpFJDf5RdNuEPG6ZUXPowFneqnGfgPKb7Dlb9W8G/LprZqxHLg949kIQY5iXUW+bLhk 4CMiqD3dPB80UsU6ajoehtCojWIdlbgKA9aT8Lcefvnx6+cvn+BbD0tHu9nlJpXbc8t1BYkW7Sn0 bBJcilsVj6ZL3lbG66x45kItipir4QbP9ZpzH46wEEs86oWw/5zUYScPh2Oj9seiqMyxOeVGHaTs OgnPrO11kReHpiql3ndy11QoQi69uzh9Q0HN1Hep3Vk4cJNW/mw5VZNehHCT1juzV+q4Px3UoarK Y7E3XV3uOmhbaN9yX5i82e+qk8xNLk8wLVnzkBeaFdRelTcfMD/h3hrilhtfUFM2ikxoo3sraLck G3wcdmHLnyzOLbXr6ELx2zWJlqV/MOIf3fncPZy/E92r2D3Ytc7x5/Of/71/6c7iy+7l8JtQ39mX P9X4l+Ov//r77q4Txvx7aZBEPTY+CbodioeZZCEBjgCMG/RmuHT8l6Ut68pbj4/CwncUJ7vjs7Co vD/9H8mNBdgKZW5kc3RyZWFtCmVuZG9iagoyMDYgMCBvYmoKMzA4MQplbmRvYmoKMjA0IDAgb2Jq Cjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMTc2IDAgUiAvUmVzb3VyY2VzIDIwNyAwIFIgL0NvbnRl bnRzIDIwNSAwIFIgL01lZGlhQm94ClswIDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjIwNyAwIG9iago8 PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9G b250IDw8IC9UVDEgOCAwIFIKL1RUMyAxOCAwIFIgPj4gPj4KZW5kb2JqCjIxMCAwIG9iago8PCAv TGVuZ3RoIDIxMSAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBtVrbUuNGEH3X V/RbdivIzEVXnrhWQqVI2MULVUnlQQsCO2CbleVlk69PjyxrpBmV0MgjeOBaczTdp08f9cw3+ATf 4PBsTeF+DaT4XN/jr8iEedufxTfRhMckAD/mkzCIPbhfwOkUXDIhxAtheg8eK/4Zv7AwnsRxHIEX xc50AYfTKQUK00f4cLnM02yZ5h9h+g9cTAvoPjhycS9CSM54y+Ku6ary6R0J4BMfAQJPAEDz6c+z 5DGH5sf57zfw52qZwvn8KV0Xf/3omG1OPkYtiFRslMZ+yz4bD2C4Z6cdLMJNM6/ImLLnk83TBrfF CCO9oZwtOWRMGcHNsLhImrI+7LFqxTNEambKxqocg7/nqq3BrsqDi8JplMfJJp+tsvVPcPLwkKXr dbo25ZKMecixUEIONRRnW4T9g1NWuVxUPjshSmkbryqDU6u+CoD5XAkO0t6UKxKiVlncxwKnKFMa wvkmwUK+E4F/WZdYjlBHM4kKhEQFXqwhOB/676CXwDISqFkwCJIGUctDFSTU/CZHb9Nsvp4/LU1z IUnkiwR4XoCioi7ePz6lxrRmuCIR9VUJt00iHYHiriicvmzSxWqZw13yr4iUM6jZCVkmkc+gBjO0 iN+JFKUjM4lSVJ+G2n3GfrlaHsDtCSAVaLxHgwlFyUVY1DqKMaUkUSseoRtoPrrxou9EX20E1mmq AlzP0LMcwc8UQsIh9qLhJJWxr4E4wu3tYchqei2LIFQoyhnpzxmtl8VYXJRQH6i6bv/sdkloxR6X E5U+BirdJXQ7ldYRLhbJ/OUIHt62zez4e6nak/vVYrinoASlm7IAaoDj6JEbakkxiFlXWqqYhTW6 Fi8nXz5fHmHhzfL89ejwsBEx+brimHkBSgTLaAS4IZUEw/MgqUVZZVKHJqJF71waMqXWbNcEo2O3 ZleHuJ6nOZwm2dc0q+yLY2zvhLH2A0ypCmDd37ksGNvgCQiFmBYdXsvq/YnUpXyyAjgd+0XB1SFU k2faPVvtQCh8cRhSVFfKlfLbushhI5Oqgbas2z8bXZpaywZ6X8UqGeh2V8Yr3eYaRKuRHOa4KzPj 1mBsKqtHIiW1tlPg+VVLKKdutt2kq0OM4SfrMGUKLDtKgaBkw5KnbFnZdp59ok29bJeaDlH6ytev RRO1ZiuxpVLGwK0BDi26VmmVAuV76kzapDq6RLASKIRQNHBcZ6njgQ1r6ceVYx2aizZrGXieUnK2 CyOIR+9BOsRVkuOwJ50v0Vs+leZyn9mh24AoXqf3iFPtdVqWQsi1VmQgIL1KASGUUjhZJP+t9hke ipGYOJ5x9bX7B6g0Gm38DCOtfVbvCu+Ngrv8i4x7xEd3rDpEKdyLJH8TJD1OijzsOw7YvdzW8IZq xTu6HUXagYNtsiKEQtambtdCJucB3WcDGs9iMUAhqKyujmaFvjGrVHvn/kzp21YVcTjyCNSlhI0u 2y0Yd0mWpUv4bbNIsrkN3W5ijCLclASjmxiBoVTDL6vV00s6nE3VyTrmWlvcmPzv6AUeBKhzDROj 16XkldFrwaABIXCyeJ3N81ma5FkK10n2/JYMN2RSMUo4p3afojhbGjYViMX9AspRicS6I1syRBi9 57VgXK02yzyZL+F2nr4dwBkeNMUe8bidbBRbqmejP4dL89SmtJRRrdP1rrkuUyYNCA6NtSZh0Ez7 1YaOUVqQt0Jxj58LxZ2Iy0CG92Vk1Gq1sYWznw1O1AmBnSxzf+wJO+WxquD2FVDHwOsT8GuSPSTP 1ZB9yHuQmIUGBIfszW2M00/xMoIqgAb10FV0sleICw/NyeiXm7PDy5vL3sWtmUlfnER4xMcg6av3 p2lXPddEw8P7W80N2KeTjnE9+WMCp6sfwCO2hz2TdGpAjEMn3xv7MoVLEUPJxnnyfb4um5wf0HA4 r+RBRAuMMa+kXNfI5EfqYMB43fcMYMC1F3mDou4qClnUOkbZ5PCg8fF4Vsrges8uJ53aFs9+lwui vbtRa5pDpr2o9KZll0cK9esBVtaN2N7DydY4RKGmCFaeN6baCM/OusEorgdveakHm/3LvqvNSmXB 23fqFKe80HkAePifvEywa+0+Ln68zvGeLVwl2f0M6IG45kx3f9x9/es6eUrxGu3fw31qdf/ZLR/P egXjS4N2YUYy4dP/Tf0Y1AplbmRzdHJlYW0KZW5kb2JqCjIxMSAwIG9iagoxNjIzCmVuZG9iagoy MDggMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCAyMDkgMCBSIC9SZXNvdXJjZXMgMjEyIDAg UiAvQ29udGVudHMgMjEwIDAgUiAvTWVkaWFCb3gKWzAgMCA2MTIgNzkyXSA+PgplbmRvYmoKMjEy IDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAw IFIgPj4gL0ZvbnQgPDwgL1RUMSA4IDAgUgo+PiA+PgplbmRvYmoKMyAwIG9iago8PCAvVHlwZSAv UGFnZXMgL1BhcmVudCAyMTMgMCBSIC9Db3VudCA4IC9LaWRzIFsgMiAwIFIgMTMgMCBSIDE5IDAg UiAyMyAwIFIKMjcgMCBSIDMxIDAgUiAzNSAwIFIgMzkgMCBSIF0gPj4KZW5kb2JqCjQ0IDAgb2Jq Cjw8IC9UeXBlIC9QYWdlcyAvUGFyZW50IDIxMyAwIFIgL0NvdW50IDggL0tpZHMgWyA0MyAwIFIg NDggMCBSIDUyIDAgUiA1NiAwIFIKNjAgMCBSIDY0IDAgUiA2OCAwIFIgNzIgMCBSIF0gPj4KZW5k b2JqCjc3IDAgb2JqCjw8IC9UeXBlIC9QYWdlcyAvUGFyZW50IDIxMyAwIFIgL0NvdW50IDggL0tp ZHMgWyA3NiAwIFIgODEgMCBSIDg1IDAgUiA4OSAwIFIKOTMgMCBSIDk3IDAgUiAxMDEgMCBSIDEw NSAwIFIgXSA+PgplbmRvYmoKMTEwIDAgb2JqCjw8IC9UeXBlIC9QYWdlcyAvUGFyZW50IDIxMyAw IFIgL0NvdW50IDggL0tpZHMgWyAxMDkgMCBSIDExNCAwIFIgMTE4IDAgUiAxMjIgMCBSCjEyNiAw IFIgMTMwIDAgUiAxMzQgMCBSIDEzOCAwIFIgXSA+PgplbmRvYmoKMTQzIDAgb2JqCjw8IC9UeXBl IC9QYWdlcyAvUGFyZW50IDIxMyAwIFIgL0NvdW50IDggL0tpZHMgWyAxNDIgMCBSIDE0NyAwIFIg MTUxIDAgUiAxNTUgMCBSCjE1OSAwIFIgMTYzIDAgUiAxNjcgMCBSIDE3MSAwIFIgXSA+PgplbmRv YmoKMTc2IDAgb2JqCjw8IC9UeXBlIC9QYWdlcyAvUGFyZW50IDIxMyAwIFIgL0NvdW50IDggL0tp ZHMgWyAxNzUgMCBSIDE4MCAwIFIgMTg0IDAgUiAxODggMCBSCjE5MiAwIFIgMTk2IDAgUiAyMDAg MCBSIDIwNCAwIFIgXSA+PgplbmRvYmoKMjA5IDAgb2JqCjw8IC9UeXBlIC9QYWdlcyAvUGFyZW50 IDIxMyAwIFIgL0NvdW50IDEgL0tpZHMgWyAyMDggMCBSIF0gPj4KZW5kb2JqCjIxMyAwIG9iago8 PCAvVHlwZSAvUGFnZXMgL01lZGlhQm94IFswIDAgNjEyIDc5Ml0gL0NvdW50IDQ5IC9LaWRzIFsg MyAwIFIgNDQgMCBSIDc3IDAgUgoxMTAgMCBSIDE0MyAwIFIgMTc2IDAgUiAyMDkgMCBSIF0gPj4K ZW5kb2JqCjIxNCAwIG9iago8PCAvVHlwZSAvQ2F0YWxvZyAvUGFnZXMgMjEzIDAgUiA+PgplbmRv YmoKMTggMCBvYmoKPDwgL1R5cGUgL0ZvbnQgL1N1YnR5cGUgL1RydWVUeXBlIC9CYXNlRm9udCAv SlpHRFZLK0NhbWJyaWFNYXRoIC9Gb250RGVzY3JpcHRvcgoyMTUgMCBSIC9Ub1VuaWNvZGUgMjE2 IDAgUiAvRmlyc3RDaGFyIDMzIC9MYXN0Q2hhciAzMyAvV2lkdGhzIFsgMjIwIF0gPj4KZW5kb2Jq CjIxNiAwIG9iago8PCAvTGVuZ3RoIDIxNyAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3Ry ZWFtCngBXZDBbsMgEETvfMUek0MEzi0SQqpSRfKhTVSnH4BhbSHFC8L44L8vEDeVetgDM/NgWH5u 31tyCfgtetNhgsGRjTj7JRqEHkdHrDmCdSZtp6qZSQfGM9ytc8KppcGDlAyAf2VkTnGF3Zv1Pe6L do0Wo6MRdt/nrirdEsIDJ6QEgikFFod83YcOn3pC4BU9tDb7Lq2HTP0l7mtAyI0y0TwrGW9xDtpg 1DQik0IoebkohmT/WRvQD1vy2ChZRghxqvlfp6Dli69KZokxt6l7qEVLAUf4WlXwoTxY5wdwRnAZ CmVuZHN0cmVhbQplbmRvYmoKMjE3IDAgb2JqCjIyNAplbmRvYmoKMjE1IDAgb2JqCjw8IC9UeXBl IC9Gb250RGVzY3JpcHRvciAvRm9udE5hbWUgL0paR0RWSytDYW1icmlhTWF0aCAvRmxhZ3MgNCAv Rm9udEJCb3gKWy0xNDc1IC0yNDY0IDI4NjcgMzExN10gL0l0YWxpY0FuZ2xlIDAgL0FzY2VudCA5 NTAgL0Rlc2NlbnQgLTIyMiAvQ2FwSGVpZ2h0CjY2NyAvU3RlbVYgMCAvWEhlaWdodCA0NjcgL0F2 Z1dpZHRoIDYxNSAvTWF4V2lkdGggMjkxOSAvRm9udEZpbGUyIDIxOCAwIFIKPj4KZW5kb2JqCjIx OCAwIG9iago8PCAvTGVuZ3RoIDIxOSAwIFIgL0xlbmd0aDEgNTg0IC9GaWx0ZXIgL0ZsYXRlRGVj b2RlID4+CnN0cmVhbQp4ATWQ3ytDYRjHn/dszraS2bIzP9dmx9nM/NrOMWpOiaZISZKkOGYz5SBN US4kKRfKHbmiXPoH3Ej5C9y7FDdKihQj33N2vKfP+32/73Oe532ft7ixmSMn7ZKNKKtr62QONg+p X1rZzlt+H3peyGmLZU8laE8BG1ZchooFvbhl+Wmoc2Ut+x/fged1bcuqTw/wwVVNz5X/50SoaEwt QAIREAWtIAbaQBy0gw7QCbpAN0iAJDAuoYAekALEAEe3SDohHqtqpB0QuS49UfTLzDj/lO99nZyd c6c/qMFpZNH102m/ofdH7PFdfhkR3mpfYV2oUB6o6zj77SPyz7zLP5fCm1nJCprCVQzRDbsz1+Vz iCpxh0rshKyTjeA4PiI73WA6qJhEy3G0hUaYIqtcSrUpshRuruIcYUVlyUSA89XAVNmamN8XVpgn 5DHgUrwQE/1Sg3tADXaJda759OFgJqs2usV0PCj5HN5jVvrhbVqplz0LQktMidR1JvvCoxM1YiKw F+hoSmZaJbU/0x6KR6KN/OrFxe+j/ew7b//8usKtjJf0Wj3yWNHIzPDQ1GjboKYvbCxrY1qx8Acy V1lLCmVuZHN0cmVhbQplbmRvYmoKMjE5IDAgb2JqCjQ0NQplbmRvYmoKOCAwIG9iago8PCAvVHlw ZSAvRm9udCAvU3VidHlwZSAvVHJ1ZVR5cGUgL0Jhc2VGb250IC9ETUpHUFQrQ291cmllck5ld1BT TVQgL0ZvbnREZXNjcmlwdG9yCjIyMCAwIFIgL0VuY29kaW5nIC9NYWNSb21hbkVuY29kaW5nIC9G aXJzdENoYXIgMzIgL0xhc3RDaGFyIDIxMyAvV2lkdGhzIFsKNjAwIDYwMCA2MDAgNjAwIDYwMCAw IDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwCjYw MCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAw IDYwMCA2MDAgNjAwIDYwMAo2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAg NjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAKNjAwIDYwMCA2MDAgNjAwIDYwMCAw IDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwCjYw MCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCAwIDYwMCAw IDAgMCAwIDAgMCAwIDAKMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAg MCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMAowIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwCjAgMCAwIDAg MCAwIDYwMCBdID4+CmVuZG9iagoyMjAgMCBvYmoKPDwgL1R5cGUgL0ZvbnREZXNjcmlwdG9yIC9G b250TmFtZSAvRE1KR1BUK0NvdXJpZXJOZXdQU01UIC9GbGFncyAzMyAvRm9udEJCb3gKWy0xMjIg LTY4MCA2MjIgMTAyMV0gL0l0YWxpY0FuZ2xlIDAgL0FzY2VudCA4MzMgL0Rlc2NlbnQgLTMwMCAv Q2FwSGVpZ2h0IDU3MQovU3RlbVYgMCAvWEhlaWdodCA0MjMgL0F2Z1dpZHRoIDYwMCAvTWF4V2lk dGggNjAwIC9Gb250RmlsZTIgMjIxIDAgUiA+PgplbmRvYmoKMjIxIDAgb2JqCjw8IC9MZW5ndGgg MjIyIDAgUiAvTGVuZ3RoMSA0MjYwOCAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAHU vHlgVNXdN37OuXf2mcydfd+3ZJbskwTIckNYBESCgBJCJKCIWBQQtGqt4IqCCmq1Kiq07lolhMUA KmhtrbVW69qqzyP64F7UWrRaycz7OXcmLLZ93vf35y+Ts59777nnfM93P3fleecvJEaymghEPv2c +cuI8uddQgi98vQLVoZLZaOREM11Zy5bdE6pbLuNENWSRUsuOrNU9j9IyDW/PWvh/DNKZXIYadNZ qCiVaSPS+FnnrLywVPaIuP9ZS5aeXm73fYn6nefMv7D8fPIOyuFz55+zsNT//hOQVi5bumJlqXwf 7/fnZectLPenswnRb+UPySM0ITQjEIowh0bJJHIFURFGJFJDZhEibFKdSkSUebuKkPRLT98wz9z6 tVan5VeRexLTlXH9xvCnu4uaf24Qv9dmUK1T+vMOuE790PDthIgvFjXFV8Tvj7TwVv43ZzeZWdwn 7Buc1SAPIRmtJNsq4vWrUdxmMCnpoK6ho7NG2EeWIWxBeAlBJPMQryrXCCSEXAcCr12PIJLNwh4y gLAP4WUEXrMbNbtRsxs1u1HTIQwRKjwu7ByMhzCC7ds88fovOr3CNlJEYMKNwjoSwb1PK6fzyul6 pGnUbyin1wvrBseEzJ06lCn5AnERgeHd7hycOK1+l5JpblUyG0dqNm5DTajTI9yJUd2JUd2JUd2J UX2BmOLuG1G/EfUbUb9Rqd9IqHKrSFX5VuXMnYNmZ7kGmU690COcQupxi9nl9FThlMH60N7OfmEW br1FiTcLM5Ffr8TzlHiaEq9SWlcp+aVKfqmS71DyHeU8v7ZGyZfikJI381g4WZhBqvD06cJkJe0W xpMEytNQ5ulJwiQlnSpMVNITUe9G/RRhPLEinSxMUMqTUB6H8gko83SiMGFwXKi2cxnK89DGiFng 9eMwknFYzHGYJF6zHmEzwrtKzTzEqxBeQhCUnlQYh18Xfp1CJ66QcQ8ZLTIRBBm/DvzahXa0tOFt 2hDLQiveN4S4BqEDYRrCPIR9CC8jaIRWxGEhT2oRZIRuhH4EFe6TxXVZjCuLJ2SFHInjXhF2HbEj DZfTEFtHgigH2brBYEju1LHtpBuhH2EZwmq2fVBlNXfa0Y/3rUGYhjAPYRXCJoQtCFrSgRgtsoF1 sA5hGpsmiIDuqm2trfVK2tBUSv2BUmr01ps7zxOqME1VZBOCgCFXYchVeNWRUgg5BtBJkb0ILyG8 i8AnPIXJSGEyUnjBFK5PKb3USr8vUCoiCGQp4lUIx/bhU5PCK6fwrKN34bWVqKnEPStxTSXuV4lp fBcxVa7g7d0I6xH2IvC2KNrWK3EH4mkIDPeI4g14zow4JEQHmc48hPmlo82dzZj3aQhoZNdjNq/H vF3PIQSzB9hGS0e5x3qkWxBUwi78qvBL4VeJXxS/CH5h/EL4BbF6G/Bbj98N+F2P33X4rcNq2Ldk 9mbYvPzS/Kr8+vym/Jb83rxmD5uPXz/rl/XE6QROtFq03k6JiWQuMdF/KvGjSnyeEstK7JK9c00H 5pp+N9d0+1zTLXNNs+eaTpprmjDXVDPXNEQXyK6M6e2MaUPGdErG1JQx5TOmhoypKmPqtNAeeiox kaeUeKwS1ytxVIkD9NRBE9E9QXtJRAuIp6ntkctCH0SGRDoYuiIypEVyeanUW0rG8MqdodrIolC2 VJMsJfHIkyLuQGbRXxENzchZzfOaeRpZM0pTrclpKjUpTUwT0ti1Vq2krdAatXqtVqvWilqmJVr7 UHG/DHJCiV0t8UTNaSERlbzEeB4RYsKolpHJZMAmTGFTZoylUwb2nU6mLAgPfDMjNkT10+cMqGJj 6YB1Cpkyc6x7oDkzZUhTPHmgJTNlQNfdO3srpTf0oDTArhmiZObsIVrkVVf5Bqxds3cRSrNXXe8r pz09/JrZW0V6/fU9xHlBh7vD2m4ZNWHcv4n6lcr+cZmjf+6j2UyGjyQwcOuUGbMHHg70DNTzTDHQ MwXzPCM8d/Yu1sKaxo/bxZp50jN7l341axl/Mq/Xrx6HgYz0I2HUj9tFIjxR+pEw70fCP+gXZM28 X4InpX5BpV/wuH5b2yLjx22NICr1aVP6tB3fZ9HxfRYpfRaV+wjK+JVbjNxHs59ElD4RzX5l7Mf2 CZae9b/2SfzbPsdM58KxxxT+JUt3kcn0ja1dF49fGBvfHxu/EKF/YN0FZ7kHVi8Ih3eRLvoGbwoP CMn+BaefxdP5C4foG7GF4wa6YuPCWycrlx7fPnAxb54cG7eVXDx+5uytF8sLxw1OliePj80f17Nt 4vz0o8c97tqRx21Nz//Xhw3M5zdL82dNVK77wbMe5c0T+bMe5c96lD9rojxReZYC9QBLLRnb0zW3 lG5jBj0AuN8X6RnrlJa1K9A8JuK+1LdbJPRBYsj0DBhjYwdMCBzQc525Tt6EXcabKlBtLje5Lx0T 8e2mD5abJFRbYmOJe/zicfhfsaKcKRX/r/GKFStWnrbiNCQrVir/K1aej5SvGVlBwLniDTqNCn0L ARtz3LwO4ToFRwsrVvSsJMr6rjif8Kev5NGRhx7NnY+b0xXHQgLhjzzuD600Q0oBt1txPsUY+DDO L11HV1A04ja4dGW5DjhH/AjhJuJDGhQWgGKT4rvl8H7h0lJ7YbhYZG+i88xyQKLkZpJbUIcfnVpK yRnkNXIOuZH8HHUN9I/kISITM9peIwIl4Nhbyc3kx+R1Mqv4N9RGyD3kC5Ilo8hZxQKxkFWkQH9K 7qGMzxRpIa+ShWQDaxUy4mdAjmlaKzxCLyc53GUmuZW4yEu4Y7qoR3kbC7BWXDWTvCDM02aLtcWv 6D7x+eIC8kvayt4QHyN/IAdpVCSFK4rrihuLd5IKckgIDP+6WFc8B1fNIv3kfHIJRrCa3E1epD2s je0tXosxzcYYVpHHyQs0A4DqB0d3MnpfSW4ju8hT5CXyZ/IBpdRMK+lq+ip9TUWGny08W5xUXFBc SsaTk0g3WY3WAE3QTjZHmCM8Krw5/D+F/cUg7j2TXEAuJD8h68kG8gh5k/yFvE0Fpmcz2SzhUeIj bWQOWYDZvBljeog8T96lWtpIR1OZXk1/xS4QheFnQeFF4sAMnoC7nYG+GzGn95Et5FnyMvkT7vk3 zKlAPVj8WXQu/Sm9it5Af0bvo7+ij9HPmIr9WRCEy8Tfip8V3ijqi3cUH8JzfcRPwuB1s1iDE7Ge L5JP8X5pmqUd9BWWYVmBisbhQqGhOLG4qvib4pskRlLo2wa+djyZSk7FqC+C/LWH/BbXvkj+SD4k /8AsCVRPrZiLMI3Rk+kMej5G8Sj9gg4zJ9avhS1hg+w1ISO8KJ4qPja8veAoDBa+KBSLjxQHir8u /kFZ3yY8pwsr0EeWYYvxFduB5/yGHCCfkK/xDDUNYawn0Cl439tw/3fpYYCTll3KfsWK4H43CM+L HvG2wkmFcwq3FbYVG4tTAVsCmC4PacRvNKBpFunBvS/HbN5DHsbKbAP0vEE+p24apLV0Ej2Fzqb9 9Cy6lC6jy+lP6CWY1YfodrqHvkHfpp8zkamZA/OUYaezy9nNbDt7lr3BDghEmAEZZrnwE+FmYbvw svCxKIlZsVacKvaLF4kXq8CSqZ3aPxx2HT5neMHwHcO/LlQXxhV+VFhXeLrwRuH9oqG4t/gBUZNa jLGHLMIYf4r3v5rcQDYBPh7GGN8jH5HPsOZfYS4EqqNejDikrFsXxj0VIz8VLNOZ+J1Fz8b8r6aP 0EH6BN1Hn6bP0xfoK/Qd+gWjGH01fmOwC2axM/EOd7BH2AD7C35fs++EJLj+eqEBUkU/3maNcA3e 5+fCO8IHIhMdYp04Q1wlPqcSVGeoblVtVD2r+p3qU7Wk7gWEln4l/KHEwh/Y02K7sIRshnQgCJ+y V1gr/Sn7nj7AAvRpPC0gdAvdrIuNAW+0B1B+DrFrNqoj6gizE0nTz2/Cbmc54VQxKRjJSuw3wuaw q1k/uZ8+Qb5nJwDSLhBeZJvZPGGjeJPYTt+EfPE0VAEm+g3pJJ20HWv3KlmOFcoJW8Q/8juqtMJh 1TnMVFwjfqRiwivAg22UCb+nc+hB2s2cmK0x7AYSQ1miB5FOwg78CyB/F9jOFnG/cB2bzN5G3RJy M30a77iHLGF76C+xLi3Yj+fRbnqnUEcupcsxI6PI2exnJMqWsSjgeRb5O72cOrBzv8faxNmZRBRM 7HTyGuvBqr9MrayaXgo4PYeso2tJlg7TfeQP7EbSRBcKTx32DFcyevgg3SqcQLbS78XnxefBfH+P mQwAcrVUBoTcAxwxCzszIiQBNS1ExSDHYT/1Y69b2Nf0EraELKa3CZ/Q+1gnmUYWCivYBHpr4Wux U2jAjO0GNulSj9ISVasqIDZixT8i7YDGRdCQnCW+q7qc54VXhUPFnmKkME9VUXiHXIzZOQHYbR32 0gnkLeqkp9HpYpFNEYvFU8gjbIv4TtFFjTRC/lTEDivsoK00XgzT5UUDnQ4IP43rXsR14lXi+eIl oE/fA2teTW4id5BnQE3uBd1KYR5PxGzOBe5ZDBpRC41BHm/XTsYCK01CWzc5Bfi0H1jyTHIuWQ7M exf5FdkKCjUF83EarjuTnI36FaBQPyGXYv+vIdcBB9xK7id/Yg+zTZBxr2G/YRewxeQt8pbwnCDT U8hr4rXiKjIDMvB0asOTm7FKIVx3XfFVPK2K+ID9G7FLAfnFz4pvFB8cfgn3ux9jv0k9lnym7iKV ZBr9RvRSldw5U+5ob2sdM3pUS3O+saG+rramOpfNpKsqU8lEPBaNhEPBgN/n9bhdTofdZrVI5gqT 0aDXaTVqlSgwSrLjYxP6wwPJ/gExGTvhhBwvx+ajYv4xFf0DYVRNOL7PQJhfNx9Nx/WU0fPMH/SU Sz3lIz2pFG4lrblseHwsPPDiuFh4iM6ZPhv568fFesIDB5X8VCW/QcmbkI9EcEF4vPusceEB2h8e PzDhgrPWju8fl8vSrQZ9V6xroT6XJVv1BmQNyA24Ysu2Ulc7VTLMNX70Vka0JrzigDc2bvyAJ4ZL cRshMX7+GQPd02ePH+eLRHpy2QHadXpswQDhXGBG6UK6lMcMqLsGNMpjwosH8DZkXXhrdt/a64Yk sqA/Yzwjdsb8ubMHhPm4x/gBSwbPHTfguviA+2gRNwe/uebYVp+wdrx7cZh3Xrt2TXhg8/TZx1zr i/A79PTgHriWJSb0r52AR1+HlZrCJaUBdlXP7AF6FR4JnjmhvFXp/UocfaL/7PCALjY2dtbas/ux NN61A+TkiyKDXq+8q7ifeMeH186cHYsMdPhiPfPH+bfaydqTL9rmkcOe41ty2a2SpTSxWyvM5YzR dGxmISa91KbklO48N+XkIzNL+RhjkwZkQNTpYYxkdgzv1MKjhS1k7ektWAD89VBcNXAGVmTxgK6r f600mtfjFemAKiHFwmu/JoCA2MG/Hl8zv1yjTkhfE97I4eQIqA3Q+SP5gUxmIJ3mIKLpwppijO1K OZ/LXjDEFseWSWEkEIhIN+Z2fs/oGkx/JMIXeN2QTBagMLB6+uxSOUwW+AaJXAO5gfXzln0jLY5Z vGX1SMuRy/tjgOTtYCIIcQxok0f+zZLTNv6s0QPU+b80Lyy1T5kRmzJ9zuzw+LX9ZaidMvO4Uqmd TyjmDW3l3ICta7bgY6jjOeYTlFYA5dw5R7qgMNs4ICbwr1aA+owhjRZQqdTQ8IQBqf+EUtyjj0TK e+b/dtFQ8Ut+lZIcvaz8GgOjM+WBloY9MOa48nHDM64VpswEymFTZs5Zu1Z/XNsEILO1ayfEwhPW 9q+dP1RcvSAWlmJrd4EBSa5dNh5oqLSiQ8Xd63wDE67rwaucRUcDbhkZuzVGr5m+VabXzJgzexc0 LeFrZs4eBGvT1T+2pycnvkgWIUCbTz9D0CO/B+EA8u+JL7I+pLzP+wgbkM8g3Y30RaQfInyAgL7k EYRfI7yB8CzarUhfRfgIeVupP21BeQHCQoSflerJm8hbEE5FWIVwN8JshE0IqxF+hMCfwe/fg8Dr 3AjVCGchbCun/JpdCOsRZiBICAmEboTTEV7Hu7Qh/R88txUpHzPeh/B34/e+FIHfm4/npwizEJ5E 2I6wF4HPiQNhCcKNCPw63p9f+xLCTQi9CGMQ+Hvyd7wF4SCei+fRBDYFBD/EBBYnNb0AaZjsRA1T JBeV0qImGuh5dURPDOhlgmxmht3GAlnLBp2ygzgh67nBn3sVySTA9cq4S4REIXfESYIkQf0rQWvT JAOZJUeqYfOpJXXgABrAKeVhHGoGJzAKvP0YUOc25ZntpAOUvxPcQZcitUwgE8GZTILybQp4hamQ 3KaBY5gOaW8GaPcs8A6n4jrYnP5/9tejjLcZM3AjJNXvhJgwVbhX+F58S9WiOkt1uepBVQF6y3u1 5+tO1H2iv82w3eg2xSvcFb0VW81281zz09IiyyXWu2132uc64o5/OHe5ful+x3OhN+Pb7Y8Grgpe Eno4fGbkvuhvYjfGTfH3Ey+nrqosph3pP2akzMzMjZmvs3/PPVN9UU2q5re1K+tOrJ9Rv6+ho/Hj fHvT1uZnWjaMOnf07DGR1ovaAm3vtj8r/3zs2K7F41TjasedjnEzzlOKiwAkAiBkwla1Zogat4PN UYk8IxC9WoXMTkFgXp2G1+2kxKOd9hN35iTpUOvU4daTpG9ap0rDMHK0DrfyUFfbYIlYEhFLZJFI DoeFfYdlFfmehMV9kC8+K77P3lepAHkhMk02v2H4wMC0Gj2RqG2lF7d/XLaZiNfgfExqp/r2wGO0 F6pgzRNsEqCxQE8i7oz0Td/BAwekAwdIR8dB6SC1WEfhv64WYqKgVseiyZSQzDc2NdSDfxOUWB1D LarY40nmslhdLMFqYrHqhalMW3uaR+JNw3PCXm+Y3e82RKurY/rD2rZMtrUtnWvFDFE9e0B4WnwF +8dC+rdWqIbY1bKe6nXccql/U7eb3UsM7CnZGLbstbxkedfyhUVl2U2dhLGntmkhCw2xe3fUapdC T/0Eux077m+0u/Qehw5Kw3ibQwcxd61SK+YTrxEpv8XRDJ41QR32eMJqukjJur1hlfhKwZsMhZL0 w1KKldxTvFS0qMZil02hU+SGblu3f5N9k2+LfYt3i0+DvZdMTOqUm7O5pt5Jsi0/aWfdmDpGp8Ti k7U6a8Bv6508VNw3GM0rSbyUBJRkpys/eafL5NqqZl0zZ/vkNtVmOm6zXLU5F94cp71TSO8Jcm9z R29Le3PjCY1TGq36Xouu19JuldO3NlrlaN4qO0cjY87Ps1LrEOuWc1Ore/O53qZE76R472SAauOk xu7JdHKjzddr3+De7Gb+3m77Bvtmu2Bvt2FcsgG3kmwbbJttgu0J9jdgkL9BbgE8HOrL/LXvYJ90 ELlDh/6KtPRDPf7+yguHDh06PFIN0OG/HlJTIw3zHsOt/E9SYqXu2AosSB89AkZ8aVLJfN4WK+ea bSXQamg4mmlqaoDsoBEabEdyHBbVsUgMAn3Y+oug1xt8IAJQtHgiT4WZW7J6aHgLr91hvTPk9YZ+ GSlXPqn08tLINt5a+PuTtqfYgcK3LpvNVcgG3aLZa6Z/PJrj9VSrxK8FPKLklgr19EhOuepbwOyB YqfwsWo69Idny/XRqFHqmBybHL8wdlF8L3nbq54VvTK6I7ojLs7WhiPRWDyR1KRC3dNOmnrilMma SSd3DLEXBlvemzBEewfr69OdRnYZqIGDPU8qqAl7hND/gb7MT3u3a/fiYU8pRTf2sZUYcInFYh2i pm2p+kXpIfbHnWMmtaW8pzR26tGhC2EM7nEy7tFLtOyywVDbyU+ypSANv6Bq4qZnXIXdP4xdc+jg QaCdqdg+yLfy9SY1h/paD2JhDx2s4TWHDmKjAzG4gBm6LpJbJ84MVCUSU5KBmSGZRLoRnRifJNOJ VYiCM/wynUnC06NoinZPm5ycKtN47MSpJ1ROkElVWmrNYHMeiaDjVf4uuwy2I8OMKQMJsJXbJwan 2Mc/BQEhUvwrCSAEi39tUf56yPI+aI3LOMnhdLoAF4AIDhLAVvjFomqH3eUUXU4OJ5pSQz6fTNkV hJZXLnU50dxQ35RvVK4BGAKjjeGLOm52K3VbbG63TXKK6paTly6/ubOOjmnpnjb4AG+/Y7HGabK6 XTarScfUm665/petcvrqZ6aceK/42Nkc3s5Whyo9bm/wp0Gvw1OTbLpyxoxsdIw3duGs8x61/IP3 +Id+TtZm9gbvDfpMulB+6dU9Y2b6LJ5ka+vKJQ9jueh7sF9+Jn6E9a+SJdVOVD3GbiKPrdcWFbQ3 FazHEfR9YBi4++CxqO49jtYibmA48aPhv6cjkTRuwPoKh6Et+ggcSbecqjKmJaZyVdj0VqdarZJc Tpuj3aaaqtPZNlfECZgZRjz+3++mKgCK5ypOnfqmDivAgaeBMIFIjOLEgpOKPtpotTaXaIQGikS7 lUv7WI5UkiVZX+vDKWOF1aM597TTztV4rBXGxIMy/WoFZfTkmMFt0Rt/Xxi6977C0PNGvcVjiNLJ BcxArnCYrSqPtkrHdF4P83hFPmKdVe1ySio1RqvXY9AYrxnkjxFv4N7ddOrIeL/h4z0A2FWGe9xo 7YxpOLDkG5ubrPlGpix+Q73LaXWyVf92tH9bUSgWHo0aPRjt8/SEe++jJ/weowV9K+zEaMn7TCP8 D0abo43yFXa/FJP9X3u/jau6PGtsq+1CyBeKnxgX0vF+0xm2c+J/cP3desj3ZVybTUcFUqm3V2jt EWs2nTLrVWKC5HLxRNyeSMTjwBaxuN9n9/t9Pq/P743brHabzarTauNWi91qteSgZPGrSKUXqhWd qkIbJ1ZdTiSJIUGQrRaNtVerJZr4VF/Y+iTwScUQvUM2a2XfVGtYg77id5WUDNE22TCtcmklq/RU P/eEe4jGy8utrPZwq9cjHfS6pYN9B3nOjenkSceBjlGcUwAMlBCDuKY6U/FT6dk1FdXujPZfMiJq iNK3oUGBmxIyoX192M/UUuIwLIkSEKk1qhEISo2sVHMiWWJEXKzFbbO6qcWml9wWb+GLhySPxel4 6CGHw+qxPFT43GNxmw02YT0N8b1WeK9H7bGYndqej10mqyfwyScBj9Xk+niO1mG2eNTYGbBldIlt 4lQAUa9c5+kNhQgs4A9IveIDWnOvTqf1v0N6ta5ei8XdK0la2qvRaN+pNVKjJ6ztvsydITVU2R7K fAHgOAbFngSSAwYdPsCRncT3p0XBUHlLRGGfGiIjLx0p0TN2I3+twnWcNtGVyiuu5HkWKsxV6u5V SNEvFdp1Gs9zTJEpvMb+RKuBEBpk9zPkFbKffAmCsVOkf2dPk1fMYJWZ5gl6G0SVc2igxChxjFHD R9RHI7S8EaBQtxTe9CU9MYFWD/+5PubRw52Okt1MI9rYKvCzXtlI9mGXqZhHPP0RzrAekD4kNVP5 jRyRvGg7/ABbdeGFGNOLxfcFCp2+ifjB2Q1qDeKfDZ6Kc3bRIJ6PqZqKPYmrEsezk7PiLd3Tm3n0 t2kto0/iAc//sHiq8KnqHCCkc+TROp2TenQCJCPdBDpJ16v7ke4CeqHuWu21ulvp7br76EO6nWQn fY4+r3uDfkg/0X1Dv9W5DDpqGKK/2yEY2kmvbogOYlC92idrBCq8aRmie7Y+obA9w6By5XlZ3tcH u0wJQ9ASebEL+4fnWoCk9eweg73C4lHF/zk74TEbHaoHXRUeswEI6AO898fgxj2AiEe3WZk+trv4 FRGKhwZz2qpOHfKVxUMkVfwHcSI4iv/Y6a/QVWgr2O7it0QqfjUYqMjxK9LFr+RYlcpfEaqIWs/R Bv1WUk1TKlM0VhFps2bbVFaVyuRtAyf8h5118bYKT+0vdisUPavsXBDybzDDHZyQA+9hk1p4VCLd c1i1lHR7XB6nx+Gxe1Rqvy/gC/pCPlGdSlYmq5LppKg2GPVGnVFr1BhVaiEZtcRlErZ5ZZpRJ2RI 1DUyjZkjMvV5ECWNWZlUM0ScjJeIeRp/mctIiWC3tNCRjJJCuSM7LEGbp8MetLg6LDxyBoPWjuhQ 8XtZRiZl91sQ+SREHjMiV0VHjEcpu9OEHCLBjn5C0GroyOkROXkuYPdE+E3+KruQMdtdIX5VqIPp JUu7i0dlVqPEcJRjPuwe6pAUPJNKghvI5yWFmIFBcDk1Jf4gFmXgMFB2gWmw5oWPL1t4x+QrqgPj zS7kplxeHRwnOWd2pT2VoyZev7kr464cdcJ1m9nbLxf+dvclY/KRm9pOWfEylXg+elPrKat+/GJb zBMr7N+368d/bIt64jSyj++2AxAcPxa/BY3eOmjV+oaK38pmi5podT7Z123t9ok68272EDHSjbJO MhrN0lM6LeM1KtRYqUrF6FPasrJdY/XZd8MKbmGLHicqndboYfY94C4txMX+KOvJIouFLoKkKD3J lsF8+gsYv91wt1EkwlaFFVRI50EuE7pGEWm4zTqqxk2lrw89e1yhrpb08YWlljIiO4LfVCNEtplt oGGOt4aXKJgsXPjcrjN79FqP+O33c8FJud1Wm0usPYVjapOWS4KPYCbexF7K0HBJTHrcZ8ioRDsB werdoTfa26IqYJGO4RIdgY+Qs/jfctYXbzzBfHHF1amrK6+uur/y/qo9xu1pncmqd+aNLWmxKpYO ZuypYGXMaDdwSDF9aj3o/Kd12ClWakdm8p3HyxOpepIeAGI1gImmYMB1Or3RO0S/2648ew+Yamx6 zpi/Z2lLdJrAWeeIC7VB9Dewc2DqunFkV0rfgM3+BgiGsyMHD3Zgfg9A2C7PKeFzqjDW/lDc6nYm wklHxC0TW8wiU1fILlNrHFF5d112WWm+MeVkOV2e6WmOjDDDkXy8uZ2BpQULrMGvJE2VaapaQzTD 7CpOWA6/RslXy2eGHvvJuQ971DqjZHEt3jX/rveTvRcU/rx7ZoQv0vmXfPj50rOmVS65/9I+t0bv kmrvPe2ttaPnr1hZeOcXHFZ/XXxfxEQRLPy2JS1gJIC1Gurr85bR8UnxyYmulvOIelXk6pZbxJvz t7bcl7+/ZZdtt+sF2wv2F11v2/7L9VfbP13FGgu/boc9ioWzDGEF/chUac2GTKVFqMFA3EQV8xNP MFyZzHqw9NvCYWt2iF6/LdnWAH7m+h3WNnWsrQlCkKx3tAl+/yjBO7pmN5bAzy573OAZ1aBSm/66 m64uATfQIifWUw8cOEn6EPA8lcs2AOcD+EcRYs4oji4VkOeMTQlp+hvz8YTNLqoSjTGZ2lQOCDT5 pEztolUmQCBYmsvwh6Slb3kLaVlOFdFDkUfK0kZJ1MDCKEyMSxE8lFUa2SMlYijYVl789dCSj6vN Lkmyb3z0pt/M39kX9Ho8Jyy/+Y5LTr0pK1kMFvepF92x6Q8L2CONOxb8/KO5tZJVcptXPL5syoYZ fC/Rtb2nbWhttOtcUmXbrL1XzrwVtOkNvp/AoQaghfyTbAI9D7NgRBUI+Z2Y1g93BgJPOc0OCJP9 srWi4ilHOBJZxARwygKLhGAe631cEERVJGgKIj8IhecQA70K+Pk2cBIz6pwOYYhdIZupqmJRIBAi 5iDFVgjuZueSCO2VDdhD1BMVRYcR1OoVLAf4zPJyLJ8Kxc1yrjYYbpU45wQGqlX6XOGlFFXOcKtl lAoMJphIN+Eb5+vXWkdSc13tchrJ0wbLCD8xkikjogaLJUYFYfhV+uqWCZwlnKDEhd/x/F3Zwql0 3nwhdfgPfO4KX49gIzqPvTscAZw/y+EcM5cl/y1HDT6dP6qr8ox2q3JVJ1bNqzq36raq5z1vuz9z az0ciJ0ciG3I+MIxrV0Kx50hLw0FIuRJTFSC4xHMxgFZF2gTRT1JJmxD9H9knatN722ToJrbza4i VWzJDvRclIgP0f96XPLkEqJ+BISPztnUQ1AOSgeH+0rgywWymoMQ4DkIKww2h2MFqbjdfpXOrwL9 dusQ+dQBmXq0rqOQiy2cyfQtp5YyqwOQ5HL0cZAbi5bQyQiSp6smX9N29+tfbv/xuSfJSbdksf18 8OZ996++4oqwCWLUZI5CxJsKC0Oh/97xu2/zieaI0+qxXv/8Azc8Ol5yO1mO4yGgTytm1wssEiO1 9GHZWB21xxujwUwwEkzuLn4Dw/n7ckVeHKPtEqdoZ4lztOoEJngb5jdcTkHwUY41xoeKr8l6jj1w dVxrGsKVq0RR1NpFuzYpJrVp22jbFFuv7WzbRbZrbFfF99h2xN8yvGX9zGQzUJVWE1YnPeZ4OBFZ GD49clHkosoVNctqt0X3pN8wvq//0GidowXTI1msYZs95Ag6Ay6P5DZFSdxkTBiSelpbw6qzoCJV mkxa5VJXmOJ12CP37ci1CYLON0T/W3aG2uyqVJvO5H5P3UbSUjqcrk2L6SfZi9D7x2mcGNn9j0fb aiGoeer20BZ6WQlnKcIFpx3DfYqoDwLC1/oAX2VFohpRy/gT2XBEtElmi9lqFtRGk8HE1FkxLdOw LTpEfyU7SFIPXi4Rr9SiMqPKyTRiDvEWA02YUtDOaBCVGTmoaDKZdJrjteUKgecMU5n0ZEa4Yo69 OKSA7HABuiz1x6KEa2DAKnH9CgcduuSk+xZe/fJTD5zzZFNXR+3m1y+Z2eJ2WkzWqrZfF/Z6kvcs XbZp88L5c1qZbcW5795763dXr3v0lbuvWbxpYdTssbr09sLWjyJ/2nnnluuu+NWMZuzKV4sF4Q3s SgdZvVUncBZIDdSVZmq1wJ7SGU2mRQ5idziIA8yE0WVwGIkgUbbIoLeYJb0oGQ27sRMpe3C7S+dx gj5whZjCPh+YCqUX55454gHecSm7iW8mSLaKhAseqMQLlek2zUdGdEwRBy3pmBqbhcuG7+e4RBAK j2mdFVa3WlySVLbFpqu//53X4pb0VmDhjyAzfKTIDAlSR9fI46wPRH9PPiefG0WvGHBkcqdmFjKV oUJ0+yrs7rXun9E7tHcYbk5tytyZe4jek9rB9up3G3dnXtT/PmO7iN4XYXX2HDibQX8sOFT8r8Ha WPXu4n9B2Ph2u0VbWYld8l+D6crobqjUEsVPB1PRCGeDrJlKWRtrq6pSB9psqpo2tQnO23+Rpaoq p5RsE97ztnU4pzmZc4gelA0N4TbpvWybzlP/A7GDqxK5/p2jog85c6bAqYKDanN1vpDFIWqD1rBM /HbgoWoNZIZaFchoyAKM5HMgymlrZFIHAeOoMMEJ679KEqSP9i0nyyFL7CKZ4sfbIA3gRT7eBiGB p3ItZASVGyWVGznKc5TnVG67scPhRncHr3PwOgevAwY8+tdzhH4DBzaPoEJAt0bdrDBXEAUA27Zj 8oJt8Y/2b968/0dnz02Pfv3Wn782usr0i/NX/mLTBT/e5PrV6tW/enTVqkfZuoYH+m95661b5j3Q mB81fcHal15au6B79CdLNt559oKbby5olt5777nnPfgg8KINeNEFuEiQBgr9vkYrpjUZUv1wfHdc neRIMpZFVOFGZKoI1jcao4jqnQ3ZVNbBOTFzb90H1u9if08fqlZBcVzHsSS/aogvuhPr/ympxzzl cJXavqPu2bpX68TTtKY4SVYYU4ZKXRrSH3KmJCpMojle1aZXcXwm62uA0PSRNqcpuRs4y8Tul/Xx NrM3731P05Z9kj1IGo+iLunQMBgtqJYPfQB4ULBWR0meAIwoyEuBjlSqOhoTHaYKYwVTW8DO2CS7 JKpVibQOMFJpAIykklEH6OGvZButFrmwqa1CZQWimBRB/Q6SUwNsRuDmKPIifRlwypnl9AgOQ17Z pCUCB4mOr6vCLR9D80i+EcKgokrmS93cJOzt3Hbaqff079183hONXaOSN8+99Jo5o7xui9GVanid 1tvzdy3+0S9/eeaYFQ0R9tsVK894+uw7hm9Y8+gHgxd031rTEYWuymWw0YaP0n9+4ebt11+7TcYB C1bSlQgLoCvxkTpZZx50GrSDRG3dA4uXh4jUucNg8Hj8R5UnsA6WpAhF5zvC8ihspe24EjuqUFG0 KkokLOhuHnMSD8Prj2hZGG0ppuHryUfhJrNly76Klyv+LO2v+ET6suI7SeMCk/LwtlozNQ9Rr6zD +Mx/l552ikPUKZsMjRWvmJ3U+ZaHqMujJB1UMR6V1GAHYUcqaYmPG54A1ROnHqAdbGaiZVp3M6Lp c6m28IEDGryw+pih/qFQG7UGHUYblzsWkE5xFLR1FnKFHNyqplqdLk6onej0hFsR48SCPIyL2l7K h01gPOvU0YeJHt6VRnYr5OFHiJY+MajeRYfYI4Bn3NNjJdMug+ozBpbUU0PdCsk9cPAg/onnkPug R0K0RlvWcGqh4eSqTq5Bs9Em5bU0lJap3wLhOqfB4oke/kbQRT0Wg5NNpP+E5thjK3QXum3IGMGP L6RrxcXw/+Tr3jyoiWMs38o+R9xs8HgD4jQrxb/ZWmPtsApWj79sIO4Dkwz7MJRuw99wtduIpK0o EIXjSmLdYUXWFn7GObFj8uxxznnxUHiVKxEVRSIlP8Os/kiZ1avl6F71n4xfGYXjZvPYWe6F2gwz ixnuNGBm+azy2S3PLMjqI9AV7qpRUzUmtvsnmNjIsRM7fOD/YWKPKuBomRMVf3R4pTKzgv7wP8oz W1ArM0sH6EB5ZjnmFD4T4T0Hf4qn5M5xWnpXxd0WZqrYpN9oElK6ROzy2JYKMQfVeEzoBmtv9Zqd iZVZg3OzOWsO1gRZUBSzQdrbDX5co60comNkW82VWm19gzEb8TbYet2e+nu4ohwGNEWbqWA4TvRA AFslMOQ8XwNmrYOTwlHWvrLZLOgLmyz+pBSwptDF560IGSupxWdOUVPYXAkKREuWMQiTCnXroyN8 BfBPWao/pqa0nehxu4r9DJoU99vduXsuH3v+TM5/3Fl90kkPvHBR4Q8zs20d6ZmwzzM2i8PE9dOn 58Yt2xSsOkUpjTfafnf7aTcWTj7GVk/eLF4KLYwFHigTad8u6Cj3bfMHG63cgKyzBhtNMqIOlLYh 5WZlnrqV1N3YxXu5rO7G3donZGaVakwxSThLGw7QtqZRQ7RC1jc11bdRcWL7uMCQoJJ1nrpsxTvt vfo2br2wiNlx4zx6dTzrMYQfG9XeBBl0gmxy6tvzTfH2iXG4D0Po3zTYmYWLRY1scDriOWc8152l 2SfoR3CMeY6brrgyC8IkdC/Dh/qGucAE+VI6xA1mHVgjLvZjzQ5glayjFLFSaiV9Ckk6uaMr0ahy pzNVmcpMKpPMwOBkt9otdskuqmuSDYkOXWclcSec84i51jGPmOoNlbRLhTpZ215JXRnPPGKvrphH jY0VlXSselxliTaNmDuPcNZlroPmy9iwqaHMMoMmOWDkaag/YllTeG3OjVhKCkqnw6LoGdTcfl5i SZqFXk/a+pO7fv3wNWdO7Mj4a8dvu+3WKRbJ4m7t39h9Vc5/kuS6ZsndJ68922432dzjrrzlnAWW hJ1WG0TxtiU/2Tr/3OvinnjH1isKO54p/GMibN7hZNuYxtCto6cvgw84+eXl43+xeHgfA+vu0NH9 9PKZJ56p4qfULfB72SveBI+marpTzjRZMKO+9mxzbqJ1kvfE7IQc1JfOed552e7ct2lzhqTT2WrK WE4vwZ9DdprWmzaZ2LsmaqqymEySJaC3WGNVvKkimWxIJ5NV6UAsndVBxYAqtbpBYfQDOpbz2JQq p/MUq9Nps8K4Y4n6edUJIRJaHdoQEl4O0VCVLxSCpjvq83qz6XTQ57XDoma1WIIsBx1HLh6LwSeZ 0GDGXB3CQYJqnSeXTXptSZgdvbtxaCdL22V7OumTzboOYqFmKMz3+770iRDssjtrWdKSS1p303Zi wR6w6DugytonS+hrtlBimQYflqJFBNLMbqsZvwSYo6RmXY4tD/ADdEL4zgASYVvjmg+OPvoArIob yxqVovZYA5qz5qfQfmiPKGL/1re8BrrYYyr+PxWVqzUQc3goGYNGPDNGFCe0rK6KjCCZkQYBXlnC T4b/vFzxvij8lmOQTrriW57SB+gdnTxTeI4rWDbf/HHoPbqm8OKIYkX4lJOc758ZKdM17PThu6Ce 4v5qYg9gyA/vuHp6pvzklvQjmd/qf2N4U69an16buSu8MbEp81hC/ZP4qsSKzPm59fr19nXx9Qnt LGmhtEq/TFpmWWZdZtNMDk+NTIpPyVxdoao3jwmPjoxOdKTHZMabJ0paXY0n7I/4Er60ryZmTme0 F0lPxJ+rESaEJyUuCF8dXlt7S/i+8I6wNquFagxnYANOplVlKA1oa8MVQqyyoj6cClQlnamkNhgI 1tXXO7XMqY0lzMaQscbYYZxmnGdcCtPJEL1CrsolCDYfM1s2WPZZXrbst3xpUVu8jalKKMe4kf1L znw0TL6oBBOc7Vhe9gLrU5RiXBIFNCiqHkW1U7a4jii/RlIFZwXjWatdb7AlM4m0PZejCX0sR7PW Kpx3NyRztKSoVFSV3Oa6fDnMXH19CcvIInMuQlNGKOWFtkWAfRTSA/+zeiWXjEUoWc7Xl0l3/ea+ Ky7uvm/+sGK0/A2tmjetbdzPflzYRh+afmF7z93rCq/MLC33jovvmFdz52kz1y3gmn7WFPOf3Tzt qsPOE84eJV/YjklYVXxXPFF8FF6P78oX5uy0Bt6O04igcjqcp7gW2s9wLq5eZl/hXObe7tI3+5tq JzsnN/W6evNnu87KX+W/vUbfUGcO+6I4GKWtcLqa68OxoBlaTqshtj1jTTQb1onBRKZZEFlGV5HU 9keSSe9oX9JcF6qrqeuoE+s8o9YcswhTFYeY4WE+/YodjfPcJV2LYkor6YchwYCxJSW3lTjcVnYR PyRv8J9cvIbXyg5YkPxuJ7eO4K+HE3Xs9BFt/TEOK1xZr1HDwkQUWaPEUXKCkKoW4K9iBY8p/LnE rVlcTHXKyp/NP0VOjk35qbR9ySPdFofVmTn5xcW9p51w2rX1V3205mUxNIYv0Schr9s3s7MnE8qd NG/C7JufKHx22jyH0+KqmdsX853wyI2nPnIJ5Z/KwHk9Il6AvRcAqjPKkRv01xqusV5ru9Z+nWN9 aH14beT61Nqq9WkjqFwqXOWHkL1f1t2e2hFhXVpXgONbg7eKeL0BEnBpGS/nVVWKHSWgtVSbQ0Gn MxB0aTNBnY4FtSyeNEOcMIfNzOytzgaDNIzVhstJbg8dRbUjuhg4IZVcIrEZsBTcsq5EXPN1nA3q uIKyFxrDab2jwmwyG80Gs6hOJlKJykRVQlTDhcLK1JFEWh+vpmFHrJomzJlqGrWGqjmF5noAWC/L RhZovo7dH9z8xx2NoAodwYTKruCyIpcWIzQwUUGBz569pXpaVeC8q06/vNDKazbSurN39XniY+PX TS+8VN4Us1vmnT118crLvpozlu+KtU+fdttJbT3d2UnYD/DbFWuwHnlqlb3zQkvVq9SCxVCRsVoD hqg/lI/FAn5Bp+a8ljnYwVM5a/Z0qE9hLKCze10Zmy3gbazmAM7qMvl8oDqV4zpHls4kk4EclH5L 5FYvo0lDLJ705qGJDhJi8DKDNpo0++kX/qKf+Ttx4EpHu3WbdS/r9uu+1Kl0+WSymuSkHMsNgSI6 4aQCoqk72VZj/cL6JRdVmiYvVWz8WLmD3PMPGI0jr77lEAOXl7GZwoYhwj9U+dBff933WuuRTFm9 r9RnMiMNryl9ofbn5kaYGsubaMSZouEIFit7WeSBsEb6lPwu8nQWu5rvocPz+YosV3CYsILXDN9P FX00551ZvhBS6FhhO1+UEvoqvMsvebEwZR5PC5/zeB5WaRNWaSVWqZH8TT6tX0XNOmNGkgK6iC+Y j0YDvoacuTZUy2ozjY2BHMhIEycjVo8jY7EEPMksqZKqWFUmkQhko7GkpxGa2SQhHqyKzsN02sZE LpEkWSnbnRVg82qXs3AJIjQpRZPEF/axbt9m38sKH6LynWwJS5RIq6UN0peSKHny3+zi+0hx3OIk BZOP+VbWA9sI7sUdKHIWmLPEw/8y+yN05fjVOWYR4DsyYgoY2QqlJQC3Gvlf1uDOkiG44BtZA7Mh KNzFJ374p8cvwgh/oKyASf/vlwBrsBqU4ypQjlaalFuuC98RZjVShzRNEiYZJ8RPMfQZT4nfb7g/ /oR6t1EnxlyxpDEVS8ab4uomMmoDGTWKBJryNRxhNZjraX1TdX19TXUgr9eGUlLORoMuN8hTrikd CkhCxNeabIJH35l5uLtEEhUC2L/Fcthut7F0QtQFz6yuzgUpJd72VNKsDcFXz9O2ZulR2q6QFcW9 G1YuiCAKPuPc3oGj5KVkvFEkEs5DH4PZ+kqG95IRnmsfjqE8nfD5Bs1Rwb8kC9VeFUJl8dMdcWfU GRuhPyBAcJ3kdh5OWapZmbC4Gktmn5JkydEYNx4DzYmcFo1sMJWiY1CLNf1756158YZp135+3QvX abhe2221uKj6Tz9ZuWd6EyXvnXj5qaWlotA8SHY6WLgt39S9YfDaO9ZS1dqldXb4PT4V8rgCs5Ys vKHvgtv/9E24kjZjF7qpy2ZyarCiP8KuWopd1UWfkY3WXzgfq9nm3FsjlkQFgylTlhC8Yb5qFVKA BjKRQCAcCXiz9UoV/G9qqhpqauobAtnWsbxKMnfAEaQj09XRMbYr0FqSIwzqTFmMKAkRBmdVWYbI JJT7QCivzMQrKxPxQGZMnld1wVbWkmlsack3BsbEokEY9KAHT2azmXDSm0hmMiWZoXXMGD0EioZg vDEY75L9ocZNXVu62Pqud7tY1xDbI/vGW4ORiCVYy2R8rgbfCHqZMTObx5bC3voEDt+O45/M4PLr Ieh8FI8yoM8MF2UhI2DHQjbgugYuPCDmIMSx7BEXjTKooJo7bBxf+oH7xr8C2L+96of3UAQGRf1e w5UBZnuHU0ZUA0L0eIUNBURctO2hkX8xx5YZzhHFBY43/LCm3DSCWYQrhl9V0HXhHQXzNnLB4jsF g7DcMpjHQ9/xmsYSdkYfT2gZayoEj0MhiqarcCLdXuKjQAecI+2AuQ8ggHwCmAuRN+VcjVitihnD prA97Kjx1wTbVQ3GWnuto8PfETxJ1WWU7bJjin9aYFrQwb9nBN7H2KS44wR0npBS9jcRvz9EAp4S L2QA5ufOOQGtG/7698opR5MF7oqWgDuU9FiTHjdjSa05CV9DLoRapsErxxO+7t0RSqocB+GLzVcd ePw/eOIcs5Q/WGRltX6Ar0Egy46IytaOsRt/4KOzn08wU/SHYvvRySpRRD6JXBv7CLDvFsxbknwl X3KpsMp2sf1adp2w3rbW/q1Tq2MGu8Eh3MHu0jys+Uj6wP6BUy1KZ0o7pZ12sV6bDMfwKbxA2BPy v+12B0Ias9VgEMMhZgU2dbs4KpVNFhx7glP9fgIfDqDWSvOZFUGtVsMbNLxhNdR0ntRdu+jrZXIH Fo7jWG544HK1UgDBw+QBsqGP+4H/gMIuRiUnUzucdsQWlRlY16zW2ARXjkpq4GAns+ZKzCHfehnO HXIBCiSwxMOXPTkFbvHk8tIPZlbYcuDueY8v4USOTv355JMnNfcWHucAy87kUyy2D3tv33/q6bSJ lwpfTZxYGbxhOvtwBE7x1jgTJd6OWR7LzpD73Dl3k7cz3pBvaG6aGOntXBRZ0vnjyCWda+W1nbfL Gzu3dO7pfKHBZiZNDeMbTm0UzdFM04TGzvwpdc92/Fre16n1RX11i6OL637WuCX3UNPH0e9y3zXp 68cSUjcCzZnjoLkC5w/8DWEAdDjgSddyAHaGcxtyrDZHc7kNdblcbV0gXYczBrypAs5oqobjwN0A hqcE7lUx3qU7aU6GkrU4FJmJcnoTqIpGOhvlJrFjbLSOWEkwErVHIlESqYuKYVqbTMeS6aoqT100 GsZ+wYZxs5bmZHtHh1YrJWGQgGHq4u2RiFtXP0RnPx4eO7aOjE3W46M5+EjBxbJL7q7rr1tWJ8DA UtddJ+yv+xI8cWfzHuh1wrBVNMmWcZEw33fwhvuSb72uybtxgqFsEC6L5K1wez7kHXajuNzLnYY4 0vV6FNwLd2gv56q4wVgRUHiW/7BbudQIzxXu9eghcrAV0OxvRuSpR+TKIbJXdihmq0zPGtVPS07S 7mOUOn1cq/Mf9jzHysd0relbflzfHyJtTQVUPSV3ul0kWtyP7y02ckluECmG0MPRhCKi/ieUXfbw i1lGNEMjOBwGUwhHIyWWTNFTNnIIL2xWsLSCvGk/r9nIxs3l6T94Q7RQv+iajnj/Yl7zyyu3r6G/ L6wdwcpHEc3w9zirAITDQ+H09KUrO7/knejil/jJBrIau2M2dkeELJFbICTluZDEWXDgFh+EpLfL MlGey0QsafBxMcesozovuOmgzeqJ3neRgmpL0uaHfeCOS2Y2xdFI4YGPsL4jnDHmCoSr7Lc+QqhG CFl5nujrrFrxt+vnL/u73/GYfsBjjlDpSZxQFU47KmYoSJXCBkfEfXifFpaSR78f+DDIJpDJLfvw fZxX6Z/9fwp8Q76h3wT0CZIKpILJlon+U/0PBncFXyOv4XjSp/TjgGl2kBoVQmPbxMXsEMTsKpvZ bLUFjCGFtZFItDvKolXJaDSRDIRqFObGUI8vE9bnmwI1BhXfpgZtg6jVqsSAwefgZdsmNzW7Q27m rrK73Q57wFddWdrxmW58O6YqlclUpgLVQ8V1sj9ASdgfCAQps1MeB1sIgbrMjirs1oBsCCZw3i4Y 9AeSMH0F5Mk449DSzARH0seqa1JNyZoag8Eo2pJGbTLV0hIIBgPNTUF4p7xEQ6l5qaWpLam9KVUK J1kaU7I1b06tT72c2p/6EnVD7D3ZEQjReZStpy/hmAkV/X6RMRFqiotkpy0siHYxOM32ku1d2xc2 0eYZ9UxZZp3KN7FyysEyqqb037ccpx1w9G25W/rQC0GpVMsFKEVyUoTYVuS5aIUCZ8cUtoyrbaGv hc3QnVHBVpiB39oRun38vvzBpj1uBx9X+NfLAITngadfjs8Txf7Tnm2gI9rbf9OF3d1feFLayEGy 8HseT8zz+I/4xsyoP/JN2VjylXsBKvPQRit3ivshJzCcZa9xwD22nu9KqFPEywDFWbpUhoqU6vwe P3uOUQNV+3zU6RMNFgXIKqrgcGjBjk1kSsAEprsqW1mZyQYSelHpomkQNBpRCOi9dqUM7YbLZcdm jgd5ORppCEQiwUAg7oNDGQ2WTsxQH7FlkolEMBmPgzBdvNNnT2LnwzZwMQ4AGPR6qg34g7ARZ2Uf IVk5kTdnp2XnZZdm12ffzaqz3moGB3Mf726zzrMtta23fWkTzTZq8+RG/+iIULecazoAGJzb4KzG hyVmjYt2HP0jxb/ikFemAmaqBcandosfkeRTPE96FNX+UQA5btn/c+F4gOA+xAr6jsTofwaGH6Co mMiWDN9SwtUv8AWfoODqd9gSAIUnVOJJJoquw23Ho+XvPxJ+M4KSCTR3Z4EPPAtSuIl46GG5+Lz5 Nx5m/dD5ofs76TvrIechj/o551+kv1jfcL7p/kT6xKrxSl4rTu+5xees/zR/YxPu0t1ivJc9pHpI d6/x9+rfa7VXsOtU12tXG6GEdPyMbVRpm9XN2gZdq3G01GBtcI52a9MsY6yREtaEs8Y9BqdczHul QeugbdAx4Nzr3u3RPmp+TLrP+kvbPY57nVvcD3u0p9qmO/vcm6RbbDc773Tf7tGOt413jHdOdp/o mWOeI51s1Va5R5ubbM2OUe6TzJOl8VatQa3X+tQ+bZU5ZUs5IBd7qKi1mU0i0bjApFoSeqEiwVX5 YRzg30xU5Mf2hMazzdt1sUJRoASDPZi7QikqY24I5or3su6dn33qA2eww6nHiQeYVb/ZhlSC2/82 q7sDrqTfyhV2X4fT7Qx0uHmkA7HeBjUfmj7lqWqo+MaRssHKy89sQ4p+Sgqb7DPbwCjDJWh/OT0k V4BpdsBLs90WRES52xQOY8BhUkkZTyVHh7Gcwpz7FXhtWzutQGSM8hwX7I7/KzEwmR7o5uwM2gVY PaDKdlo1jYwfneB6bat41jVfXPtC4QWaf+Haz6+d9fmTW7+nmvue/JxNeLDw3mZ85asCXx6avbnw /kMv0gmF59/5tPAmHc9haxswSS8wSYzkyJeyG45xPg2+qGDzWUMJX9433rcro09bU0PFz2XpfO+V XpbSprU3e28JKV+b5dLZCD/776WxuiPsaVaRxWIkmLCa4x1xFo+7IZJVJaAR9XtrcmARJU/1N0cN BSPqaa6d5tJFH/9+omyOy1iDOKRiRAYzl4N7OGd4nIj+n3c138fcW4ksx6EKaGuOP1ZxVNOpiG2K m3+ibJuBAnrgh/o1cBwfP/r2xPop3aNPKXxHjX33THn48sLrdH9h5fE7+g/XTr880eK1zZxxYfvp MAfwPW1R9nQ1GU2fl+etyVxdu7bx55nbGx+svD99b7XWenbd4gamTwkZX8qeseeSZHJtV2NX06RR U0b3xeckTkn11c5omNV4anPvqLmjz8icUbeosb/5sdp7Gjc3P1m7s2GwcaB51+jfZn5bG601NgPa d47W12rjPHtosE7bgETuyRhT2qpc1ah8ZUd6dG70qEnxiZnr4+tSV2SurL6y9tqmjfGNqZszG6pv qb296T5yf+bVzCej/ln7TeM3Tf8c7W9qHjVabGyoFbJJmIZIMBa14+sFgTOxR4H4Txk0nAnvgWtl m5BwtUDVXZ+oclUJMV3FmVkcM+kbpAfhdZCV3fmaBFfDhrO12c1ZVfbH+UTSMwY7XDHkKi4g2OXw McBBeLCONdxKAflzhNHW4DMAOqkx03PA84Eb9QprUPHTZ49iBMU1rWQkwgfWuFejPCHWiqNP1WfA UzFTiaiaY4imIKJGHjXx01GNPGoKol8TPx3VyKMmfjqqkUcZOzb+8VuVQB3Tp9LAmuRSJFWFXy8f FOFeurBrKA5ZzUmW5/uX72LbMTuYnbdsRtPsWa2R0RP9RnjlOia3NKV/Nr7uhIVtdp3F7drzwBfY 3NjghZffPrK9IzMtYVeN1WUzG9xhT5PRYoETpl1aU0Unf8w3fOHBwt8KXxceYGccu+2ZYgF5Crs+ R5rpL/CF3eKz8knhSHvGDo1sb/7MuvPrBE1mdN3kujne2XUrwyuzF+avz9+XfrjupeTroVfD7yZf z32RtECpUjc+NCFyYfaq0NrsjaFfhh7J/i78fOTDjCm4B8fudPiy6b/DEMcLsGOOYohQOJ2JqKO5 bAwGo6ayNJojwZpqvukRYdWqte4qiKxprs8J7WYXkxzbLJvwvX8alBoSfpKkSYDXjlX+9TCyDNFK tEVpd3Rz9OXol1Exyvlhs0WWaA10+UzytEwu+wyM2If7lh/oO8A/0QC+UznrpzCdit8AEPGIEKro kBUgO4b1/L+gnRbolK04hM+tmYMhY3g3FMqR4qHtGWPeGQJ9GmwMw5X00xKs4qRLSaUMKPuPHEcJ e8GufKx0iKOfZbMynfWvcuLhu9686s45q6+XOSu67M5Hlha+/uDcbdMfuqjwAtMXJh+Ptp776ZxN +fY7v+K11PVUfmb3kpaZt4H/3AWOxA6OZBx5W063NZzom9bQ1/Bj59XONd5rfdeNun2sflJ4Qifj IPFQ54NjX3d96PrapcGZu28Gbe4m+MsC98hVbWO8brPKTmhzRX1tTKhu5FZli4Gf1W+0JLpgV65e l2pMRLpgWk5pI4pxuTkxL7gUbmTeCfaEXJeMJeXOpVWrqtZXbaraUqWq8oy/azcNHVUvTIWXocQN zjixXrI4j5ichyFtlM3OJTf0UfxMEv88C/eIpsrR6R9Yk7n23mEPMuX7BopKPzXiMqbIqke88rnF suzvKtxc4uSsLqq658p191af2H/mI52n9nz467ev4NOKgJY9d9/9+ITxtbf9ae7cVx8dENv9fHXe wAkt38yr18+vP7khZPEHUmtP2/DCtbW86WNue57787uXjF0UdHjxbb+rrnyKywXrQc1bFWp+g5yG wSzPDWYwaTZxkyZsZHluI7N5nE2Q4j0xKwQPmMK0OKS0dKckWWClBOZeKoclf42/3/+SXzT7O/zT /PP8y7Cbtvjf9Wv9nyS4QMe1fziSDTGt9MWCESPXEUn+eLmey/Nl/cURaX7EkAVBv3x2m214i7/b sKK9eKvwIJ8e4VE+fcerSAv/xXlp+uPCtUoKPQOZAXi8BO9dS6N74CfwLQkVvx0MSX5++NcHTi/6 Y98B9Yf+T0Pfsa/VX/u+DX0f1hmYqKY+Q+gq30a12urmwo5EHJKDORo8DofbE7CW1HEV+PJArgpf DqglgbRFrwhJpiqdyaTXBSwlndvEZENZ1wZ9GhRqVVXupFWftFpYAHxsNAJl61KsDTPDED+PH/eu 93ihZ52mm6dbqlulWw/jr6fuGLkHYk9Z6inlFAXrEYHn/0WUOV56QYnzxpwUArjLmlW4upUoEoyK JS11zGIH6eI6VqXhSL0w/NcHlj12MczvFcZgSWrZ+NTlM65dpMi2pQooWsdu/XLBcxeyp7BiJj1f tuGx65458e7TlRpFv4SVkgChnPJkaI/sx6lJdy050T050x+4SXo58J37u4z+QfJggBkVYbRCkhoc OKvnCBgdzii+wnKvDAS/LMlIUkr2J1/G0aNkFWzu6UwgmiEGxYHNvVRD+cn8pRrItVVMoxFYwMBo xMOvnhQINLgDAY87EHG7HNBeBOGXA7ccfGiAwBppd7nwMc10MupJRuxJo5A0RPFlQKOBEdh74b6Q rHV3uwfcX7pFsCftssHFkjWOeY69DsGB8jZ8tNS1m14BlfbL27KKLxq8WKVDH/bh5AaMTQeh+wKj OqLF4DaHmpoRXca/cUH7occZtty/0Ugeq6IsLzNkVCwg9+xVlpD7TuPDUvgE97+pZfedX+jpdNlN JruLjnLbTBU21y/o1Wp62Wa3HQU3bSmlstiucxiNDl0pPuwUPj22zLEPZDXxXqxtJftbiT+T3Q43 c7pUangCayu9dnUybGS6OHNUlUgn59pbMSVcj1tX65NnLPUu9S31Lw1c47zatU+1z/6xU9cv9Vv6 rf028SVGJafkkp2yS3QznyvoCQWClVWuJtbkrHNNYBOcna4e2uuc7brG9aDrefY751t4LcWD0SJ1 Q/Wct0uSzR4w2R0R6LHulYPxcHxZnJG4FO+O74u/HFfFN1TG46nKQKSSGNVKF51ZF9Ixs26v7l3d F7oiNuoGlU6nVgWMKjHs5V3sgXkwkuY9gYDXA2sLzt05XeGhwj/lRsf/qexL4KOqzr7vuXf2fZ/c mcnM3JnMZLJOlgkEBpILYVGRRQoCSlwQVHAB3LdP4ldfxbqgIioule9V66tQxAQkgBZrUbHYoi3W pbYgxaUtKvpS6idk8v2fc2dCEmvf3xedu06GzD3nPOc5/+f5/x+dFPfpdbqo3we2lA9JqtEyGeAe chBEiUXLgjgOIibJpCiiI35/QEwHe8Vr1GhZGqFPoHWSzlSZVkL0fzzuTdsNabsNJHRWKwiY4TrB YRBYp9q0V2YxmclqdYus5kbk5K4sDpIVOVlNV+bktOrMxDLnZlZkVmWeyOzNfJUxZXaI12MJEoT7 HQzg1wJqFi/8akANtTgDX3Ey0tzNoppuAbhzfbc+7n8Z/5xPkPBP61id6o/52Cs+5ku79JBfm65f pd+r14HRjaQLYSJH96njY474An32S9l1COheTd9yWtaWfSq7+paHyr7ga9zlnYdwt8z1JUZG0b5h p8Vfx4BxSaOD653oMT4GDgD5FVM28XmDMXoO5w8aEN9L4vz+BQwymMYpm9JwzKrhmG0Vu8RQMBQI cVs5D3dCRZdtG4oeHe4WTUHIXL4QcBXvc0i/s3MeFLOQtznUbia93mZvSW2rZGOl92798q+33hSj qY610gy2a+lfbvnrZa/xCyPoQkxqPwEdbM1xAPiXkLIn3pH+XDrHSJuBkdaFkdYhNqtrPC1stNKa bOlQbdMD0+vHtZ5hOzfQWX9G6/m2ywOX15/f+tP6e1ufSfR6epXeXG/Hbs9uZXdud8f7wuHcV+1f dPwT6mRfuxJl+Ngm5ulwezqSrgSIP5AcZkou1+HxIJyeQ8wo15QEfSgKOg5jTSL8bBdCTRZv2pNW 0ojQj093pHPplnS+Md2URvrAdWoEfrrFFDLlxWrxqxzLpTs62ltb2yFoV1/ZQa65p32c3pVmTG+z 6cvLbUhjg/+RUd1OfVbfjn51rl6vD01sSoMwl9lSeWE5/iW6b5mOMbe0XCqXJ+xgaZ7S5td0deSp 4JK4jhKthHw+eeqhMiAHGq4s44jf5NdknOC6dpGCEpSLyJ3FL8hjLG2oA9KSMeqioJKLgkouCiq5 wJlpdznsAWxsvtJSkKBG6pn4jW2Cp39fD34HyNO+Hvwa3+M3sf8cqfzaOX6frncP/Qgnfvh8zT+n uf9r1euAmIcTqKZb76cNMCTCllQvLilluNlBG1cZsgT452PfhPtbsXc7sKYrLVU5lDRvALQuOWPD LowArF3syUWvLfm9C+JatipOXbbwDW1vKzxdePY2fn6UUlOa2U8KK3kf/4R69DlsAht/Dh19Su+J i3P6+si9o/AM+0VhvHbsCBhgGD8r9fNCJ3uydIzOCQ1IICb3o5M+RgG2z3ogPwKC8mdqCxC2FxPM nDQ3yUm5aXFycZPhLM85gXPLz1J0JmVh4oHE0wndP5Vvk8hNNCf9ipyE1gfZbiscZFL6KDdr+S72 gWQXJVHTiHf0uOpZfa/4qmptqq9vbCqvaSoGYq1wpbWkA9lLqooBes9Aknx1BX16c2VNsrKyIlle nUwkmCvhFiTZ3JT0NqZrKtI11fF0dUjxeHgePJzwZHoGUqR6xZ1bYNXTbqTu71SdSlrwTPesouS/ 5sH+IUh/BHjBp+AuhRYuQXwEPRdRSJpOMcGOGmQaSVjkpGEcLjMy+BZ5jj/8Tt4theVYycowiyQn 1yOUucuKCbjL0b++7+n/z31p9YDjL8c+LKxqoj7yGW1+hPoWzTMH+k2T6CpMGOg3L4n1pe5RqGQf lI7JE3kXGScF9BXMjOqo6yXmOd98vv+8wDLLcuuygKFX+lz83CmZRLycMSnozIhZqVVEOTFphXSt 8xrXHeJKyal5AFbzmcUJX8tjqsbaSeNCuJyi5Nbpow676MHSiZmcarzFqZbjJUdyzjTCKzeoSVnz +ZdCNyoUdqdt4+KMTUetiBXsCNMxOYRW1fIIsVIlkwXUk6ZGNKsGahJHuujwc0r0kBM+c/kH5idn /zcviA5qC8pFY7AeWyQS+QHofbCnuN8KHEuUnDEioBNipUDdYYBj7QbH2l8KvEqFE++Jz/W9Q0FW 8d2+M8Vb6QnfIL1s5Dp7bMq1J8abWYoaB6y0sYU+aQ04425hkppGnPgbQWiCXqr+G8wVJqvFZfII rMLssjRYZlgki+xZ9OzgBBzK1hsiPIFvNrBiLIG04n1vcQNzQINhdfd/t5P+Iv3f6C+kVv9L/xng e18EveDTt5gzVjkHG/k+WJRyzmyWzZezxSYdZE12bzZMhUYVaVXZoFn1chaaAO+5DG9sY3uQ5IL0 Ngwr0qvqE7iMF3p0iX1YJMux0eKTFtkdcfd1YhfWj/9ubsDiklP6Z/1WF6ZRNqbQJz7An0WbGh/+ LFxWj9lSwdrx95aewglqdUobHf4M9AMLsVLWi9i+h54BixcO0P55/TjKfPmOZ1vhEw+JB5Bp1c/5 m80Xm64zrTRJZqvZaD3bJcD7FcxGs9V4tiiAl4OVGI5Fg+R0YaezmX8pqIbtkgQBJFn1x4VNEmuX lkqrJEkKeaETAPk6dFTIkiEMJmdDU/vK4NV9oVH4kYUB/v4QYToyFCcfXEnwS7yQLYdUhS9Q+F3h d9AylD26/kJjEJmOIdZV6ApDwRCZT6JwL9bzZ0pdQgZUtAXqGc8Zn4o9Vy+ljalYXneV99rQNeEu 33+E7vetCa03rvM9FdqY3WJ8yfGCb3NoW3SP42ij34KyFNVMesT9QEi8sf4n9Y/WP+dYX/9a47uN nzSaMkABN6qhVFZJpRJKIuMp9warRijCiCrop9rMtSC/HVDPYiszgqVZkaxmhQDqZcgTrsrbbBnf Yy6l3Eg37EI8roA31+5UWFZpV6Yr5ypPKM8rO5X9ikkJtQZXNSgGur/U8IRhp2G/QWeQR1bvGIC2 O1nN1L5PadQjlUrrAkC3OZU724mj9jGc71+05khYdQ9OWSXHtWiHCVHcKRgBduT6jwgteMn9R3s8 pnoTvFT8IHREJpsUQH146w4ofh4RvP2v0B1kWnUqLRo4DfA6ECxS5LgDMBLkSHIBSmNRoowiBOo4 TjBSmrv17YeeO/De6JXTu7oWvBA3u4IWxwWPzXiiexlZhdfyt5669aJp115x2Y4Lrn9k7dIbXnS6 Vk68cJQFWa0WZ6j68Qv6ENwGsvifbtf0/MzTL55zLrV9Hdp+DkZPRMiwihdoAbdRtbqyfPGWsEcC dO6Vs35ZDvgTkahRYtZ42tYJGboLtqQVc1yBD3mBWi1FMAegu5crTjx50RCqTs4SbHG/j2hmTt9S 337o9cpV59wzuDmoEXhuGwWdkKhCixPMqfKhMuIxEjz4g+ALbwxb0Rars5aYWYO1oWJy5szMwsyz iacrtrJt1peiL1bu0u8x7dN9ZDqk/5vJHdA1sib9WGsHm249NXomm63vNHZaF7IL9ZdarxZvtNwY vT52R3R77OXEllQA1uxIt9WVAUb8QpQnHvNMuXnQlkE4AXFAUFr8Jb+tZDngdQ8Q7Vn1w+/1MkPh n1s+Ws2XG8U8/Z9+eP/9H9ILkqa/f73wj1d3FY68/jT5Zro2sq0ndj/xpz89gRcsDOUkTsHIrBaO bFEsAOQR/jym1uLgDf9HqQ8qD8QOKH9P/a3SWOGvDEyIT01NrZwd70ydVbnEuURenLpDtiG++o16 pdc3z3um/5LUhZXHQnoD8kL8ISTse1Khn7gedT1Ytib0tP9pvDcJEM0p+8KMuEdyJKghxMJKt1Jl tPboDJH/DCpJqyNvmrcuxu6NvRITY6Fan4JFr7l9XZpRKty9SIWTa3YNameMNp4tDuYL8QKhGYb/ 0MAc/+XIBLV1EQwm1IzSETEPlOBgzibVkrmLI4EPEigdIDjbkkNwR3qNzDKSrsEoMjz/wI5X//Dc gj0z/dACW/Tk7j2F48y655eSPUKj5BexUDA8uetvDz2575QZvqC7ZvwlTHpjD4NCpCjcjKe9HmMh iuf98YunVl9cjeJVNAB4ImCWu6AJUxTg5UbVFc4Gw+GyYCJqCSQy5k4LhkFPRsHzxnCIJxRfVLBZ fUZgB9A9M8e7qE4ZY6HalNIFcKSX3dVTU92lDQbXseXcGQFNjlJvaChQ5g1k1Q4dpXHwA4OAw4xT NgWKg6DHgfqXZGKmbCqNi23QXzzcHfdVEjCbhg+fNFXIAzZqYMpPcnukAVhNwVJXHiwJohM1E3P/ x1e8c/3171z50YP8fNn7ax58//0H17yv++z4ZWRbntl9/YFrr9t/w272odaT13300TrqySLnNmTR k2WkF7ytLrYE1vrFJnG8OBN1ul4XX/f+Wv7Q86H8UfgvZZ/EvgvY5Uh1JCe2Rk8Lnx6bHz4rtjR8 aezm8F3htZG10a1659WB7ZFd0i7Pm5E3owbTa+5QPA5PwF2uBI06xW21zQrl1wlsGUZQL/tEDSbi eZZf52NLfTt9e2GKdNBXrN5w0hSBk8Wpq1DNpM6JpSv5+3BIBj3M7oAP3KQjm8O+WBSZBZqGM5l6 JBoyhfJli9abJDhKPVMwkgk3GHV1J/4r8Mmz5/x2nNcBJnLDP255v7CfOXf/llnmyO+uXr0vxB5/ 8o22Zqfsdrua5rDwm1thOf77ljs3bribfK33sBo7Cz0zJ+xRU6pthr5L/2PbLY3rbN22zTWv1uyr sQSRBmjb7XIlzLl6yO9gOaWD2DK4ESZ9L1PVEGMJU0UmIaQ6q5RyQfDE5fq6MoPZZIGc0l0gsCO5 KR7ay7vmGtWe9av+Zf63/Tq/3HL1NvZWMR95KqdAjYFYKkGrY8hp7uPiTZgpB3tTIEGVLvCcZEd1 TRgNWhsTasJVMdA3GRcG+MGEABDHMcYR4NHCPtym+ouQjphlPK+nbym5ZHtepO2LG+659vZmqN+Y vA9dfPm17A66KNn7JpdWL+I26o8rljwWMAU8nqAUvHTiCs2PFYX/VbhZdzN6ZiX0aaJq40TfMp/4 kfL71GHlUOq4crTCcEnVZXUXZC9ovsF+U9Xy5ruqupofr7qveX3VuubtUYdoImuwgDKFs2a93mRO iEK0prEs7grG0ZaO6OpGJW6pUYTVaSOgGQhJsEx5nMUtFhfIaJvMktNMgYnnzXuBdoZa6pWu5L3J dclNSd3O5N7kgeSRpC4p56rPH9JZuRNDeZ0wGOTIth8ik0puPWdQDLIY3EgM6sU7EKA5KoSQlVBt AmbxbXcUKcc4qzU10K7KhlSFb7vrAmA/lEKjRZ+GPBfWUkIo3D6jQ0QCAhe0gAYgVB3IikCxETT/ waZDukWb+yrKls2fytlmX592bWXg9nd/fvz4z9+9fc/dd//613ffvUfc/Qi3GNtmja89J4OFRhk7 /dTqcSe2MbZlCxMKUx546zerH/jNbzAWZmMsXIax0MquUOvWho7HRR3zs4WGqw33sgfEdewpcRPr ES1PG35m3KzfYnzd+L5xf8gYMrkB98JuO30xn+ibj8B9sCzhrgJfCg5P7fyG2tpsQ6LKhYgT2XvQ 9+fzoFPCpfmv1tT8ov/aCthgo5psyTa2tDQ1JloZkUh1VZkMmrtV0BldFpM5Lu8vY5gnnlStowUl 3rizYS+4c73s7z2jJhebklafHFTAtmjyeezb/YMGH1DByamAgIOTZ0NOcKuUsMFAqoSQHHyZA90g awMwQGZ0x/WqKxTWGw2psB55cSFjRBuSGJPoKaWY+TbB0H90S9wW82neD1av5ABpynonfdQSqOUm zwd5FyXfdeB6sY+wmTNWn73gjvnnxGRkCn9Fc/E5P756/rjspYOJiHxkwy86PmfyxFXT+/45MH6l s2+oi1/bd7h0QXOVMK+8jN4QgK6HBA92hVqdkJtkVZ4pXyBfJd8qG71211yfL2E32Mxz9fqELRCR 1/jhx0qvib3sgRcjBrsNWjs7GIUJRSxDHDod4PfpANvl8jNWnFwzIz7IkyHbj2GEDVk6n7RzGB7+ ZIu3tH4uPoABRpB4700r2Gn0vfvKyDyx0/5Bmah69wcfFM44wYP+5APCUsGXIW9kc+FmqZV/s3Lh CbXGhZR+pFBIZzvnReDdRa5ydgldrEvsktY4HdNMq0xPmNZHtkf0EVOYUh0iGM16K9bdP39Rp0tY tS+sOqyG0Cw57vE6AqsBovSyc1U3hDGlaMxmj5eXT0fkSI5uZ1vYO0WLz0OjcEKyA+FnaMEc6ys+ BEyQcNegFMq/+cA3Hkwr1kM4T9x/0y0FOyVhipPnzh07q/AP/gDMl9xK377vBB/5F1xyb12MD/y7 LsIo34l2XY1RjpjINpAAX+lBHlAVcYShcEZ7dTp0ki/y/swr7sqxal91qr6qOpdpGVXRnhpb1Z5b 4luStF7oZUnvCK9Y45te9UHqg9zh1OHc8dTxnGl0anRuScWSlvW+9UlDBRjIqFLK7cCADY/QonUz qpbHkCvySg/yDGmvuuB5x+YnY7FEMhFBEl8ztxYNDZNyDQ3NuURdrsVt5R/kyFocDqsl4aZ8c6yg tGTzsrU82zwR9nlr03R9clXV/FRVVTqVqE1BKr8i3pLzgcyYRIFBb1xIQiM4KXhbKnz6JEvkIxF/ PmxI52ub83V1tbWiNe9xC6Y8Ey0+WkKblyIQ+UiqYnbLdrZOSOGKfVmuKyfGcw2583JSjqxR+UgI T3kw+ywzd5lFlzlubsABzUMGszxiB3scDISyohqQpt9ANon4zlD30PDPUryI5poShR2IhI4j99uw zt3XA2oI0jX39YAdwvfA5fkeuDztu0/SRBjxRLjOPmWWlw2CQr/+Xjx2iI3DyUnYdPh7sXrIDreP QwgjXuSQhipyVBu+x+kmvZ8D3dgTXg/7iCjUSQ86CQ/aZ0qRmHmu/xhf3nO8bzneVQHXewZW+NuE JPJcU3IuTqt/TjyhEAArudIDiY7NA2yTUnxqWCwAFQXYS4MWi6+xRTV8rNjJcJxfgE7Q+XRUOEJX 84WH2DWFnwxaOn7Hasl80IAqfFmYV7KWqDzNUKlXQBbRZ+BkdKq5Bf4r/T/2w/mwzSWfEV7iXPIQ PWX+NW43olNwDAUWd7vAPt7pklyyPNgakvf3b6zgD1rA+4bav2/I/pWWDie/BPm7fvytO+GTTRKr 1THOkc5WxyjnaOcY51in6uxwTjR70rYRts3h7lpdJRvBxNmRBcYFkauMV0X0I4xNkYnGiZHZRn2D aeRYPj73j2ajJ7WNHj22LTHSj1DERjUa97AZnrc9B0D11wkel0cF6D/J4fE4HQl/CsRHOApCwgVe yaRoIhGLJlIjQBaji82uZrF5Ura5uSGbGDFJpYuL9newjkntHR1qe6Iua4im6+sy5REDM1aPVPPC JEO1IoUUs1kyglCXSvktdkccgeBYS0OgC7HfE+nyaLwyTefpLlQZOdEmZOPtbQRkCW072/a2SW3y 5Oqfa3ORBlxhJFJqXHGH1qAkB837QzC3FI9AROKHaBpDhtLQkQKS7vC7JWfCQFaYOxPDnYqiVxHP VJWh2IJOb01V6SpjTG+QLUGUhNZXx1iZDUlEFLCAMJimMS2gYMaUTeHi8hW0b0v/l4IOL2P/h/A9 PhRY/+9LvifT9DGRf9oTCLVxrQjs4da80o09H7cQsPMTMBBEGgbpt5YckST3TE46Jtr5IE9lOIbz +SWXjlugtF45+uwRk7kGxqPTmusvHDeJRtyj0xvrasd28MsH6YL2DmnB7CsnTpo0MX/6WX1baNCJ D6mzJi7qgywdju/rmFNetVA7oW6uLUbQyy9FL5+DXt7KbldHvmt41yTuMuwyiU+aug3dJmm5scso XmBcaFoYlh4NP20Qb4z1sM2iFIktiSFFBjSgKMYr75VOfwyJVJN4IlXCM9yn1aYkB5VNmVSclTSf 1iWkXClxmGNrb5mkObZN+VYD284OCHEgGt5yRWeEj+sBmGi2xEP7kQJBE4qLu7f3NqyDeyuTb8vD KwTsoXdqPhPvnJCEav9ioDsO72GDPNmhvXH4G0td8Yf8Wl84Av1jk8EkGiATHWNhE9hTtNwkouvJ ztaNjAqkRb4Q9pHBFojDAC4DJISYX+s9g7qPtsRpHtaLvufezpl7z7zzpreezbvGx2SjJ/3vy350 w/LB3i2/Jy1YMW9CVfTOU/u+KplnUZp3Y8d/9H09cM5Xq+QD3gdEagx6iBXpI6eorZ6ALgA1YulN 9qb1XfGP+j8Z37UaLjEudouLxEW6xabFliX2S92LvBcGTX5FcipmwOlGm4IVHrRV5Ha+R+Sa9qrd 37JJYC5wPc6D89sr3q6WeYCf420GFe9ZCgh9r+GA4YhBb+hlB3vKYIJ4kjjWLZjcQAZZjsdaQ8At eQIcKiHEm8DxHahgcFTwIdnW5XP4gtv7D8ItONhjj7qjfEDzh06sYy1B3Bog8hASqcOkNnYMzlK0 3erDxmTBxkgbXD+slsPjM/qQmgwmtqc94HMH23y08foo8N6LrGoPDiwWOGsm2vDAG6sh6zD4Zx4j 7FZDDgUUxRgAbHVjCl8AjP2SeXa9yryzP1637mN6sedfKRxh7p2voKzMkV/+9M/7H3/swH60TR1w Axq9pHZcp7Y3WpyjKvFqqTsD8iyd9oUMbWK4xH4Vu7H6inrrrwyvWD4wfmD+sPKDxk8Nn6BgBAq5 32i8S1orbUDleXC5sAyVs+VQSC1PBLRZyurZPWRKGpfIFmcjiMtlnXl/JA+IxJFVrJYqha3WGYVY PmVIK04TM4WaawVHPOosn86zN3TlctNg8J1GKCd6aWpEHED4V/jBkAE47IS3eclT6s7YGmjdUcdT rO1xRq3e2P+nFyqTA23OWxydRhtlhO4QiF4y1N8bUoOahlVP2XD1Tb+7stD38sd3aXFJDv8UIfXH f//w2n371j60T1qw9uz5V+29Ykuhf2vBQOOJYpa6PHeIFt+39+1773t7L9quC233HNouiQDk6aS7 fKzbOQrLimNqq3PURuGZ8MaUNFM4N7RQuDy0RLlSuCl0Tf2PhbtDt9WvTT9W+1D9s+kNtT+rdz+V ZI9WrY+vr5K09YOGExdhIM02W/27i2ZZM8MzyQyXFgdCqLKuLO8hR95Rp0SgswGEqBJYUQIyqrJZ jndZmNNywHIEQdxQY7VCIoDrYptiur2xA7EjMSkmN5RAZJ5QX8LZifwJUAGoELG4ebLXUCD531vZ oQ0b0kTAsnCEU75aEuTO+Gogvv1C1bCW1VD7AYSoeDDQrICHMOgqhsFDG14jW7mM48kFCGAA0rvz 4EuFPib94sCd+x5+eB+9xDfXUgseB09Pa1H23VYAQy/2F6bct3fvffe9/TZm0/WYTc+SroW196u+ mxys1jzdssRzvecOz4OGx71GvqJTrbHdxdVb2L9d3IjFjqqai4sykkrZqE7PTOM6KYkaq8PHC7zr jXaUl/c5XJaKVF6oMVjaXZgMsRajJVnY4jQeQWGqUJ3gi1c4kzOSGoB3JGlIyrV995ycEFGmg1JS p2oLJ7QKl0ekdtE8Nuj3/ACgM2zc/dtJELOcu2iGt3h9joAnok1xiA/zuU2DVLnGF3DpYa76wEJF FJ96cuKUW2SvxeFN5uSRj+5kV1E79V1Gq/g9nFApLdj3wOxFIS9QlmRo7vpCjjcOJHTEl6ix0CJ7 +/dLBYyyCexrdaWvPTJO9JwOAYjFEzbEN4z8P61ved8c/2fvHwJ/aPvj+L97D+U+H3/CezT37XiP 1WsI6NvM42Nef8DfFh5/Z2JNbofTOsd7Vuvi1iX5G1pvzt/Rekf+aV+3z3JPfktMPMNUA5ZKozp2 TA4cB4fRbxsl5EBy0NWPcDqg/gueg5wfO1ZxKx2I07RsluKUaMQeVCPpEYoi5I2zRynTo0R1kEB1 aJyVzFf5FZVmyQDmQ3Xe0ioGrkOHUTKkLYr1nGLchlA7XoOlc+pRVkM8KcJlOfOB2pizWpD0RroK PNhV1N/ncS+ElzkQ1zpyvCceSXlTwTZ/TMiHR8XYyDg2nvE4DbSXxQTkk40dXT4GvkwoP6Y1NiIm +Ma5uStNjpUms0urTfxwH6fU+pvzvpwl8lL/Z0IQckoTMGzbfKCjHe5JBMZQn9B++Gp1OTE3twmt mGPNWHbkfdi00oxbhsy3vA+bCTTFTvBhUp3gAwQSoc/Bk6E3bSXHwkcb7Y+gLZEnOUeDJObgXxM/ Q4tkE5ljANcfXMUS/RLXEUQhBbqKYoE86SZtNUtxvdaZt989LT+p4bbnJ5x/7m/feGOFya/VrpSD ybVLn1p3xszCGytP37d6o1RTjp56bzQUkMdUto6qaRmTiTi9ZcmbTrnkmUUJnyMU/Tk6sb8+1tB+ w4Rp2Ww8d/GYS1fQqvN+eFt55DHVCm+qFcfDzI5SheJTli2WVy2/txyy6K9x3OZY4/iZ43XrH6yG oIlqnGxEhu4Vqt+k0xlNyDrzmf2oyuD2+PSyraqXPam6o/mKCmOeMcFgU2SrbyWkxp9VfbW1wIjT yutCxBWJg++xE7hdr/hJTx0t9NCJDsE4wIMuSWsRHZ+MhFYPZYiZ0OIrobDFag2ZY4IlbItB34Xi Kzxcjbp4GtsAvA96ulqCgRaiKlESRjRr8ZaAH+4+V3YotF69fPbrI3121AWJ/3P56o2cevAoNYa0 gAZ33zunLmiO26nGlTL1J1eLWbrIteboOZ6N5zhPWiBUwhLbLLotATETYCEEqLiTY8uabDazKeHU AqnW8LRiILVSofuQ+GQVk+IVFUo8UckCTl9cyQuVlmBZHhoLTpM5D0EbH9JBEPETgkhPeFI1V7nc cdNeiOcQwJ4ZDrDjQVLYmXNWMWKKiV5D4qr/ZjosYekg2quEpMeHwOgeL2n7e3XumOAx+LQnrw1D b9EIv4yCFYfhDx9EhupBjDmKGPIEEBI/Hlh6UtuMPHlanDql2zbsvlH9EQfFX7t42m/W82b4ii8j bnysY+7VYpQ3xt0zl7ykHWo4MrVBHrPh/WiDJCDexvVsvWeDV4pb4tY4iUE54s44Vm551uoZ7b1Q vMi92Lc4+Tze9JzXo8YYyZNtVP12we6yZ+2SfRqXKUtAyFibRPFtAYyehEFJgwxBE4NhPhchA5yE Ghh0qb3MyUU2pg3Anm6wQOJaxU9fUhBQgQZlQIF2omB2EeAMu/IWKW8xG5J5wJpLVKtXzGfd7e7n 3RKKZy8RvMysQq2bNXiWetYBwtF5XmbPo8+kmKJBl1h4Lv+Uc0DQ7KU8d0pz/7f0j+HJ7MPgx+G3 6ZySrpD5p/E/KGI5AOpx7sfgK+KmewrPnEneDcvT9k6WS7F6rjXLxlBEZLZkp6bkzTlZAwjomFqy tb9f9wBaMiPVqk9nApXB26TnAk8jmLUtsDloEkSXuCKwKvB84BeB/YFCwLRO3CTuFSWTzuQHccaf Eat0GX9lsFXX6j9Fd4p/jm6Ob65/rjw3cyG7RHex/6LgRfJFmRt11/kfDjwY/Jm4Xvdf/nXBLeIO Xa9/U3CrvDXzZuCN4B8D+4J/DRwK1lgD4QAEUgI1wdvl2zMbAjsCr+tf930U+Jx9HvxWPB74NujW cohAJiolEWkMkI1q7bIKJoAFolZIR+hoHUgg0rKKrgqRKCFgqK/lfJBEkQ+yUa06l9O1gFLGECSV vjKz5zk1BBeY2byWZ4omitSQjaq7vDzLeSEJ8ELWcF5I/2lqU4kXglykIi8kPogXEh/EC4kXeSE7 gXkE2VXoTQfw+P0A0pM61MRm0iydpTKvhPJxb95uyNuUeNxutxmWItL3KxmxlLvUtLBaVhvAB8nU gA+SAh9ELY9iI4ewAcAs59XzoAmygz2DNUiQ3QlCyGxRbRyVE+l9Ir1PVF3uHIJTz6h2ffw8JIj+ yqdb7ctDDuGV7oYW2vW0jsrx0xrtFP8Mv4xP4Hv8Pt/jw2ivegLBnF71t6wAcUQk/ogI7shBoWrQ iDnWyUui8wn8C+KIdBKFBD99nEDSWSKQ1BwFn+RQp1CmQY7k5XBvFuREZKsgHP3/SyEZNsqygGCW f4939a8uFnkkJcRhS8Ykm3TEEik6NOwKxShJlSWKSGlRMpgiUromrbx4W+/FG6toXH5Gm0vW9Czs XbWE0OlPyenNMDGCNIdBI/RC0dd3WOQR69IoXQR7uwSjtEO8X10Tc8c8oqfVPccthgljiSXOY5d5 lipLk+d1/Ir9yvVbz2+Vt5JvNb2ae7XDCW1T4WFUT/4XdBBOAYlrFBBODYlr1BAR6SzOPAylN+/J K/l4PtSYb8pX5JP56vH5jnxLPpfPqyX6RyX4H+3z9LleVr853vEI8pPRo8NEA1GUAKggAkqegAry iFO/FF0DBBDc70k+UokKenif8kjlPGd5tggj6EECsVhClmpD3vDpdmbEGIEA/CBH+NBAjRHyhYuM kE6ifuBFcUSqQHIo9EUZShUU+SDFfUhAZeYSEeTkEdXKKxI8fj2M4LGhRyN4HOvxJImIcbAHuBX2 f+4Oj2njfRk6ZAMUETXpGkGkktoBUokFv+aKEpMjCofXlRj4Lf5rRAvRVlpb3GV2Z64ZDI9u7OHm UoyILL8GSjf3H0QJCSvKvwKVwrsOqqfhwG0JBNvcmDLbOsZB9IDRpmMk9A4YbTpGQu+A0aaDUsYR bna2K5byeFvOiU2TTw63oW6Qn2glh0nCBN+K71GJYlePy0fI9y7VjoPkGGwU2hTXANr31raaR07O OGvScmlKi/FhYSeioGgUxubSqBhGQTEkkVlxSxqSp7HCNzQo7ixsK+zgE1jhq2jI6U2zWwrPVaAU fOwTms8WsjArX0hD6BO6W8FeK6zixeYJAGejCm9oWCdUUrEwPcVEZehpJBW+Ym7al3ltAehHCmuA 0zyMUdXEXoIzIZR5yhI1diWIJHr3dLsaPO79vwmrGbXwTktczC52X+e9LrHSuzKxzf2yd3vi9cR7 CQcmUE+Tx92ECtvkkETt9uyAMxNORLtQ1nFtIgpULZxIEgdl4+b6Br42DBZJKImaJq9ZSwLU69dq KYBmiDeCMYspJ9gAEmqWSzglQt4mYqJsVC+rrMxyKkoCVBRvEwTcuVaH2+OJU3Ufj1dgTbjhQUEF U1TvMZPrEw778qEQRrRIrk9FvroxD/VuhxCdERWXRQ9Ej9DKNDdDDwKgSx/XL9Mf0B/RG/Ryc/V2 Rn6PVvCtczlPGC+BDIOcn6LYPhX+oUgr0ab+h4DrcI9nmKkeuI0hzVxfd2ZRFH1oRNZoco0xUTmG 5Z1KkZSClUaR+/y97lVS9ir2UEW8tHCDHA3Z/QHOYVrO5rCZ3BEGw8nlq+87/GMy1QVO3WdG2GYP ynhQ1+mbLr6gdSF0rpOIEXlSXyBH+Uv0pqDwV9XiIIiYmRwW8WVUZ7QjQ9Ii6NB6VmOWS3QlLAHe ZSZ4s04vKhEmAg4mesS43QH2rgPUUAcL2EUbczjjQhCl+uIoNc06dXmnpd2ylPA6OdC5lEqrl11d xAsIoptazHcmIr+2EqHEV6IPYXEHU0c0EqI+7iNbhzTDV4jMxvewddi/3w17RaOb62wNoacMOcFj pwU+AxjGlGImrRHkk4H6ftIf+u4UW3m+RZ8gXtF3TFvcTekbexU92N1TxFevoIM3wDYhhsV9iBzb BWUbnlEzSB4CywkVRpPsKDJLgCfTYhX/rFTUF+DrfyixagPdW6bb+N3t9IH662E+0BosJd4t7sGn moXRarBWuAkukVH3IjP/UhS62X87xZgowg+6vMfChKe28YLvVI2rr5PqjCDrhgAU2I6TZd+3D5R9 RwJRqew7PpT/FJLCLBww7WzQ9iwcS6AL6QWDYEQXsApUycohOMHYcAseAcAfotEB9Jky5K6GhDDy jMqRIRwT4oIiJIAgVyACkEb2YAZ03GqhBuhBHRTjsgisNKIaZjNyNluEEcJIAbXeBay5hDGoQdSG mhCqME6YIEwUJgmTUeTnVOE0YYpwujBVmAbZghnCGcJM4Uf4m2cLZ6KayFzAZmcJZwvzhU5IGmzl fz/DX6d9HwPFyydMPW3yjFk1HUuvvmLxoiumLbp2xo+mzhL+H18C8zkKZW5kc3RyZWFtCmVuZG9i agoyMjIgMCBvYmoKMjkzOTkKZW5kb2JqCjEgMCBvYmoKPDwgL1RpdGxlIChNaWNyb3NvZnQgV29y ZCAtIGRyYWZ0LWlldGYtZG5zb3AtZG5zLXpvbmUtZGlnZXN0LTA5LWRlLmRvY3gpIC9Qcm9kdWNl cgoobWFjT1MgVmVyc2lvbiAxMC4xNS42IFwoQnVpbGQgMTlHMjAyMVwpIFF1YXJ0eiBQREZDb250 ZXh0KSAvQ3JlYXRvciAoV29yZCkKL0NyZWF0aW9uRGF0ZSAoRDoyMDIwMDkxMjE3MDIwMFowMCcw MCcpIC9Nb2REYXRlIChEOjIwMjAwOTEyMTcwMjAwWjAwJzAwJykKPj4KZW5kb2JqCnhyZWYKMCAy MjMKMDAwMDAwMDAwMCA2NTUzNSBmIAowMDAwMTcyNzM1IDAwMDAwIG4gCjAwMDAwMDQyNTEgMDAw MDAgbiAKMDAwMDEzOTkxNyAwMDAwMCBuIAowMDAwMDAwMDIyIDAwMDAwIG4gCjAwMDAwMDQyMzEg MDAwMDAgbiAKMDAwMDAwNDM1NSAwMDAwMCBuIAowMDAwMDA3MzM0IDAwMDAwIG4gCjAwMDAxNDIy NTcgMDAwMDAgbiAKMDAwMDAwNDQ5MiAwMDAwMCBuIAowMDAwMDA0NTQ1IDAwMDAwIG4gCjAwMDAw MDQ1OTggMDAwMDAgbiAKMDAwMDAwNzMxMyAwMDAwMCBuIAowMDAwMDA3NjY3IDAwMDAwIG4gCjAw MDAwMDczNzAgMDAwMDAgbiAKMDAwMDAwNzY0NyAwMDAwMCBuIAowMDAwMDA3Nzc0IDAwMDAwIG4g CjAwMDAwMDAwMDAgMDAwMDAgbiAKMDAwMDE0MDk2NCAwMDAwMCBuIAowMDAwMDEwOTIyIDAwMDAw IG4gCjAwMDAwMDc4ODQgMDAwMDAgbiAKMDAwMDAxMDkwMSAwMDAwMCBuIAowMDAwMDExMDI5IDAw MDAwIG4gCjAwMDAwMTY2NjAgMDAwMDAgbiAKMDAwMDAxMTEzOSAwMDAwMCBuIAowMDAwMDE2NjM5 IDAwMDAwIG4gCjAwMDAwMTY3NjcgMDAwMDAgbiAKMDAwMDAxNzIwNiAwMDAwMCBuIAowMDAwMDE2 OTA1IDAwMDAwIG4gCjAwMDAwMTcxODYgMDAwMDAgbiAKMDAwMDAxNzMxMyAwMDAwMCBuIAowMDAw MDIxNjQ0IDAwMDAwIG4gCjAwMDAwMTc0MjMgMDAwMDAgbiAKMDAwMDAyMTYyMyAwMDAwMCBuIAow MDAwMDIxNzUxIDAwMDAwIG4gCjAwMDAwMjIzNjEgMDAwMDAgbiAKMDAwMDAyMTg4OSAwMDAwMCBu IAowMDAwMDIyMzQxIDAwMDAwIG4gCjAwMDAwMjI0NjggMDAwMDAgbiAKMDAwMDAyNzAzNiAwMDAw MCBuIAowMDAwMDIyNTc4IDAwMDAwIG4gCjAwMDAwMjcwMTUgMDAwMDAgbiAKMDAwMDAyNzE0MyAw MDAwMCBuIAowMDAwMDI3NDkwIDAwMDAwIG4gCjAwMDAxNDAwNDEgMDAwMDAgbiAKMDAwMDAyNzI4 MSAwMDAwMCBuIAowMDAwMDI3NDcwIDAwMDAwIG4gCjAwMDAwMjc1OTggMDAwMDAgbiAKMDAwMDAz MzQ1NiAwMDAwMCBuIAowMDAwMDI3NzA4IDAwMDAwIG4gCjAwMDAwMzM0MzUgMDAwMDAgbiAKMDAw MDAzMzU2NCAwMDAwMCBuIAowMDAwMDMzOTExIDAwMDAwIG4gCjAwMDAwMzM3MDIgMDAwMDAgbiAK MDAwMDAzMzg5MSAwMDAwMCBuIAowMDAwMDM0MDE5IDAwMDAwIG4gCjAwMDAwMzg3ODcgMDAwMDAg biAKMDAwMDAzNDEyOSAwMDAwMCBuIAowMDAwMDM4NzY2IDAwMDAwIG4gCjAwMDAwMzg4OTUgMDAw MDAgbiAKMDAwMDAzOTMzMiAwMDAwMCBuIAowMDAwMDM5MDMzIDAwMDAwIG4gCjAwMDAwMzkzMTIg MDAwMDAgbiAKMDAwMDAzOTQ0MCAwMDAwMCBuIAowMDAwMDQ0OTU2IDAwMDAwIG4gCjAwMDAwMzk1 NTAgMDAwMDAgbiAKMDAwMDA0NDkzNSAwMDAwMCBuIAowMDAwMDQ1MDY0IDAwMDAwIG4gCjAwMDAw NDU0MTEgMDAwMDAgbiAKMDAwMDA0NTIwMiAwMDAwMCBuIAowMDAwMDQ1MzkxIDAwMDAwIG4gCjAw MDAwNDU1MTkgMDAwMDAgbiAKMDAwMDA0OTc0MSAwMDAwMCBuIAowMDAwMDQ1NjI5IDAwMDAwIG4g CjAwMDAwNDk3MjAgMDAwMDAgbiAKMDAwMDA0OTg0OSAwMDAwMCBuIAowMDAwMDUwMzYyIDAwMDAw IG4gCjAwMDAxNDAxNjcgMDAwMDAgbiAKMDAwMDA0OTk4NyAwMDAwMCBuIAowMDAwMDUwMzQyIDAw MDAwIG4gCjAwMDAwNTA0NzAgMDAwMDAgbiAKMDAwMDA1NDEyMyAwMDAwMCBuIAowMDAwMDUwNTgw IDAwMDAwIG4gCjAwMDAwNTQxMDIgMDAwMDAgbiAKMDAwMDA1NDIzMSAwMDAwMCBuIAowMDAwMDU4 MTI0IDAwMDAwIG4gCjAwMDAwNTQzODEgMDAwMDAgbiAKMDAwMDA1ODEwMyAwMDAwMCBuIAowMDAw MDU4MjMyIDAwMDAwIG4gCjAwMDAwNTg2NzUgMDAwMDAgbiAKMDAwMDA1ODM3MCAwMDAwMCBuIAow MDAwMDU4NjU1IDAwMDAwIG4gCjAwMDAwNTg3ODMgMDAwMDAgbiAKMDAwMDA2MjkyNCAwMDAwMCBu IAowMDAwMDU4ODkzIDAwMDAwIG4gCjAwMDAwNjI5MDMgMDAwMDAgbiAKMDAwMDA2MzAzMiAwMDAw MCBuIAowMDAwMDYzNDg3IDAwMDAwIG4gCjAwMDAwNjMxNzAgMDAwMDAgbiAKMDAwMDA2MzQ2NyAw MDAwMCBuIAowMDAwMDYzNTk2IDAwMDAwIG4gCjAwMDAwNjc0ODIgMDAwMDAgbiAKMDAwMDA2Mzcw NyAwMDAwMCBuIAowMDAwMDY3NDYwIDAwMDAwIG4gCjAwMDAwNjc1OTMgMDAwMDAgbiAKMDAwMDA3 MjY1OCAwMDAwMCBuIAowMDAwMDY3NzQ0IDAwMDAwIG4gCjAwMDAwNzI2MzYgMDAwMDAgbiAKMDAw MDA3Mjc2OSAwMDAwMCBuIAowMDAwMDczMjY4IDAwMDAwIG4gCjAwMDAxNDAyOTUgMDAwMDAgbiAK MDAwMDA3MjkwOCAwMDAwMCBuIAowMDAwMDczMjQ3IDAwMDAwIG4gCjAwMDAwNzMzODAgMDAwMDAg biAKMDAwMDA3ODY2OSAwMDAwMCBuIAowMDAwMDczNDkxIDAwMDAwIG4gCjAwMDAwNzg2NDcgMDAw MDAgbiAKMDAwMDA3ODc4MSAwMDAwMCBuIAowMDAwMDc5NTMxIDAwMDAwIG4gCjAwMDAwNzg5MjAg MDAwMDAgbiAKMDAwMDA3OTUxMCAwMDAwMCBuIAowMDAwMDc5NjQzIDAwMDAwIG4gCjAwMDAwODQw MDcgMDAwMDAgbiAKMDAwMDA3OTc1NCAwMDAwMCBuIAowMDAwMDgzOTg1IDAwMDAwIG4gCjAwMDAw ODQxMTkgMDAwMDAgbiAKMDAwMDA4NDU4NyAwMDAwMCBuIAowMDAwMDg0MjU4IDAwMDAwIG4gCjAw MDAwODQ1NjYgMDAwMDAgbiAKMDAwMDA4NDY5OSAwMDAwMCBuIAowMDAwMDg5MDk1IDAwMDAwIG4g CjAwMDAwODQ4MTAgMDAwMDAgbiAKMDAwMDA4OTA3MyAwMDAwMCBuIAowMDAwMDg5MjA3IDAwMDAw IG4gCjAwMDAwOTA0NDMgMDAwMDAgbiAKMDAwMDA4OTM0NiAwMDAwMCBuIAowMDAwMDkwNDIyIDAw MDAwIG4gCjAwMDAwOTA1NTUgMDAwMDAgbiAKMDAwMDA5MjY4MSAwMDAwMCBuIAowMDAwMDkwNzA2 IDAwMDAwIG4gCjAwMDAwOTI2NTkgMDAwMDAgbiAKMDAwMDA5Mjc5MyAwMDAwMCBuIAowMDAwMDk1 MzA0IDAwMDAwIG4gCjAwMDAxNDA0MzAgMDAwMDAgbiAKMDAwMDA5MjkwNCAwMDAwMCBuIAowMDAw MDk1MjgyIDAwMDAwIG4gCjAwMDAwOTU0MTYgMDAwMDAgbiAKMDAwMDA5Nzg4NCAwMDAwMCBuIAow MDAwMDk1NTY3IDAwMDAwIG4gCjAwMDAwOTc4NjIgMDAwMDAgbiAKMDAwMDA5Nzk5NiAwMDAwMCBu IAowMDAwMTAwNDMxIDAwMDAwIG4gCjAwMDAwOTgxMDcgMDAwMDAgbiAKMDAwMDEwMDQwOSAwMDAw MCBuIAowMDAwMTAwNTQzIDAwMDAwIG4gCjAwMDAxMDMxODMgMDAwMDAgbiAKMDAwMDEwMDY1NCAw MDAwMCBuIAowMDAwMTAzMTYxIDAwMDAwIG4gCjAwMDAxMDMyOTUgMDAwMDAgbiAKMDAwMDEwNTcw MSAwMDAwMCBuIAowMDAwMTAzNDA2IDAwMDAwIG4gCjAwMDAxMDU2NzkgMDAwMDAgbiAKMDAwMDEw NTgxMyAwMDAwMCBuIAowMDAwMTA4ODU2IDAwMDAwIG4gCjAwMDAxMDU5MjQgMDAwMDAgbiAKMDAw MDEwODgzNCAwMDAwMCBuIAowMDAwMTA4OTY4IDAwMDAwIG4gCjAwMDAxMTE5NTQgMDAwMDAgbiAK MDAwMDEwOTExOSAwMDAwMCBuIAowMDAwMTExOTMyIDAwMDAwIG4gCjAwMDAxMTIwNjYgMDAwMDAg biAKMDAwMDExNTQ1MiAwMDAwMCBuIAowMDAwMTEyMTc3IDAwMDAwIG4gCjAwMDAxMTU0MzAgMDAw MDAgbiAKMDAwMDExNTU2NCAwMDAwMCBuIAowMDAwMTE2MDA2IDAwMDAwIG4gCjAwMDAxNDA1NjUg MDAwMDAgbiAKMDAwMDExNTcwMyAwMDAwMCBuIAowMDAwMTE1OTg1IDAwMDAwIG4gCjAwMDAxMTYx MTggMDAwMDAgbiAKMDAwMDExODc4OCAwMDAwMCBuIAowMDAwMTE2MjI5IDAwMDAwIG4gCjAwMDAx MTg3NjYgMDAwMDAgbiAKMDAwMDExODkwMCAwMDAwMCBuIAowMDAwMTIxMzM1IDAwMDAwIG4gCjAw MDAxMTkwMTEgMDAwMDAgbiAKMDAwMDEyMTMxMyAwMDAwMCBuIAowMDAwMTIxNDQ3IDAwMDAwIG4g CjAwMDAxMjQ2NTkgMDAwMDAgbiAKMDAwMDEyMTU1OCAwMDAwMCBuIAowMDAwMTI0NjM3IDAwMDAw IG4gCjAwMDAxMjQ3NzEgMDAwMDAgbiAKMDAwMDEyODM3MyAwMDAwMCBuIAowMDAwMTI0ODgyIDAw MDAwIG4gCjAwMDAxMjgzNTEgMDAwMDAgbiAKMDAwMDEyODQ4NSAwMDAwMCBuIAowMDAwMTMxOTU2 IDAwMDAwIG4gCjAwMDAxMjg1OTYgMDAwMDAgbiAKMDAwMDEzMTkzNCAwMDAwMCBuIAowMDAwMTMy MDY4IDAwMDAwIG4gCjAwMDAxMzQzNTYgMDAwMDAgbiAKMDAwMDEzMjE3OSAwMDAwMCBuIAowMDAw MTM0MzM0IDAwMDAwIG4gCjAwMDAxMzQ0NjggMDAwMDAgbiAKMDAwMDEzNzc2MCAwMDAwMCBuIAow MDAwMTM0NTc5IDAwMDAwIG4gCjAwMDAxMzc3MzggMDAwMDAgbiAKMDAwMDEzNzg3MiAwMDAwMCBu IAowMDAwMTM5NzA2IDAwMDAwIG4gCjAwMDAxNDA3MDAgMDAwMDAgbiAKMDAwMDEzNzk4MyAwMDAw MCBuIAowMDAwMTM5Njg0IDAwMDAwIG4gCjAwMDAxMzk4MTggMDAwMDAgbiAKMDAwMDE0MDc3OSAw MDAwMCBuIAowMDAwMTQwOTExIDAwMDAwIG4gCjAwMDAxNDE0NTYgMDAwMDAgbiAKMDAwMDE0MTEz MyAwMDAwMCBuIAowMDAwMTQxNDM1IDAwMDAwIG4gCjAwMDAxNDE3MDAgMDAwMDAgbiAKMDAwMDE0 MjIzNiAwMDAwMCBuIAowMDAwMTQyOTc2IDAwMDAwIG4gCjAwMDAxNDMyMjAgMDAwMDAgbiAKMDAw MDE3MjcxMiAwMDAwMCBuIAp0cmFpbGVyCjw8IC9TaXplIDIyMyAvUm9vdCAyMTQgMCBSIC9JbmZv IDEgMCBSIC9JRCBbIDw0NzUzZjg0ZGIzZjQ1ZTZhZWQ2MWM1MTQ5YjRjMWJkOT4KPDQ3NTNmODRk YjNmNDVlNmFlZDYxYzUxNDliNGMxYmQ5PiBdID4+CnN0YXJ0eHJlZgoxNzI5ODcKJSVFT0YK --000000000000cab08505af282ed1-- From nobody Mon Sep 14 07:41:53 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 34E903A0AAA; Mon, 14 Sep 2020 07:41:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.619 X-Spam-Level: X-Spam-Status: No, score=-9.619 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=LzJdur+6; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=xYOJaNFv Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f5Ewem2l3-nT; Mon, 14 Sep 2020 07:41:45 -0700 (PDT) Received: from alln-iport-3.cisco.com (alln-iport-3.cisco.com [173.37.142.90]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8B4BF3A0AC6; Mon, 14 Sep 2020 07:41:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=30980; q=dns/txt; s=iport; t=1600094504; x=1601304104; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=h0M496FFPt9taClXMMxEPVRGvbtRBTElKCsROa8Ko5Q=; b=LzJdur+6KjzVxK5PyK2OMwUpYbbdqV0P4MTXf3+NGwAfKjn8w+qqVhM/ Vm6Ztu7e2RNS9ejd/bHBRCxi5ZZ33FOZuiQ1iAYdDFYjOdNSyM78Pk7SM +ZOMYUfiJxlcLmvrIjy+xW9jqXaEBVmAQeMmE3xwOFmfOTZlQKK1Od5Nd k=; X-IPAS-Result: =?us-ascii?q?A0CrAAACgF9f/5RdJa1gHQEBAQEJARIBBQUBgXwHAQsBg?= =?us-ascii?q?SIvIy4HcFkvLAqEL4NGA41uigyOZoEugSUDVQsBAQENAQEtAgQBAYRLAheCE?= =?us-ascii?q?AIkNQgOAgMBAQEDAgMBAQEBBQEBAQIBBgRthVwMhXIBAQEBAxIRChMBATcBC?= =?us-ascii?q?wQCAQgOAwEDAQEoAwICAh8RFAMGCAIEDgUIGoMFgX5NAy4BqmUCgTmIYXaBM?= =?us-ascii?q?oMBAQEFhS8NC4IQCYE4AYJwg2mGUhuBQT+BVIIYNT6CGoFbSgUHKIJhM4Iti?= =?us-ascii?q?0yEFiALgxqGcItyj3k3UQqCZZRPaQSFIoMJiXWTbqAbkiYCBAIEBQIOAQEFg?= =?us-ascii?q?VYDNYFXcBUaIYJpUBcCDY4fDBeDTopWdDcCBgEJAQEDCXyNH4EkATBgAQE?= IronPort-PHdr: =?us-ascii?q?9a23=3APqbO3h1rJX8nk4m1smDT+zVfbzU7u7jyIg8e44?= =?us-ascii?q?YmjLQLaKm44pD+JxWGuadiiVbIWcPQ7PcXw+bVsqW1X2sG7N7BtX0Za5VDWl?= =?us-ascii?q?cDjtlehA0vBsOJSCiZZP7nZiA3BoJOAVli+XzoPk1cGcK4bFrX8TW+6DcIEU?= =?us-ascii?q?D5Mgx4bu3+Bo/ViZGx0Oa/s53eaglFnnyze7R3eR63tg7W8MIRhNhv?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="5.76,426,1592870400"; d="scan'208,217";a="533128377" Received: from rcdn-core-12.cisco.com ([173.37.93.148]) by alln-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 14 Sep 2020 14:41:43 +0000 Received: from XCH-RCD-002.cisco.com (xch-rcd-002.cisco.com [173.37.102.12]) by rcdn-core-12.cisco.com (8.15.2/8.15.2) with ESMTPS id 08EEfhOA002753 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Mon, 14 Sep 2020 14:41:43 GMT Received: from xhs-aln-003.cisco.com (173.37.135.120) by XCH-RCD-002.cisco.com (173.37.102.12) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Mon, 14 Sep 2020 09:41:43 -0500 Received: from xhs-rcd-001.cisco.com (173.37.227.246) by xhs-aln-003.cisco.com (173.37.135.120) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Mon, 14 Sep 2020 09:41:42 -0500 Received: from NAM11-CO1-obe.outbound.protection.outlook.com (72.163.14.9) by xhs-rcd-001.cisco.com (173.37.227.246) with Microsoft SMTP Server (TLS) id 15.0.1497.2 via Frontend Transport; Mon, 14 Sep 2020 09:41:42 -0500 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=A6V/cMml9+waIgl0LGF4Ijf2CelieLYwa7Ly4Gm/pAb4scRW6Ers/ssgr012sfK8E/5h2AEyJK/5ZI8wqS23MPGdSYUWj7+tJboTGquUTYu70sEJW3IA6d982Q2nnaxYXobtvBx2M5kWF8BKZfoWtP2QsrkAh3U3WlimaLiNzztTlWh7Q9lbJ569/o8LLKugw61yqS9DRnUZ4llQxm9tVAnZB+BBD7r87H+CZ79F0CXOaHeBekC7RG0uEYgBJy0lhH74uC9ZZ1TUwbXJFOFzmilovZkQpeEJIcP3RSFHnxjJCkCAmDZVCCNTPNUeAZeyHRLY/FIxkfLiOicmJthlLw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=h0M496FFPt9taClXMMxEPVRGvbtRBTElKCsROa8Ko5Q=; b=Xed/jYCiHVp26DhQVfBh/riH9110gT6XFiYn1+Ob9iCrO2H+Bta4CHs2/AP+8TkgFCPF3wCi86HIppH3BGO99R5ekVw3HYhhkozWnaWdrlxld/iibObQzEDAZ7yViKJHTTnZs4uyNR9WRJ946npNpoRxF2nC5jl+dnBwubCzckXfsjRkrY/LP3MQnqrXzTJN4XAbkDw5nhp/HDd42rN0/jbiPNlqpW5VQx19BNcyGihPTBVVOjl06tIy7rzCvJQH0Zr3JNBge8ag+rWerDHE0kXe50vI1rAClDmKEjG0vRKofC+M2VSJn73ZQbDuQO8iMiYguxfD+fxwalPgu+R4Tg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=h0M496FFPt9taClXMMxEPVRGvbtRBTElKCsROa8Ko5Q=; b=xYOJaNFvj0TmSdGEKKa/x6cLrUcr02cDe5SN/+p9OHABm0cjA0SDzt8XsxsZtM0RK22BF8wr9G9uUDtL9uziKrsKyn6TmeAMOdqfo8vYmhoOPAvtbLvKXkiCXZ/lnmJ/gW+kIDr7gEJ9HHFsthtUzoIawFCMSlZGEc2Hd3dIIos= Received: from MWHPR11MB1374.namprd11.prod.outlook.com (2603:10b6:300:24::8) by MWHPR11MB1375.namprd11.prod.outlook.com (2603:10b6:300:23::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3370.17; Mon, 14 Sep 2020 14:41:41 +0000 Received: from MWHPR11MB1374.namprd11.prod.outlook.com ([fe80::91c6:cab8:6b42:58ca]) by MWHPR11MB1374.namprd11.prod.outlook.com ([fe80::91c6:cab8:6b42:58ca%3]) with mapi id 15.20.3370.019; Mon, 14 Sep 2020 14:41:41 +0000 From: "Pablo Camarillo (pcamaril)" To: Brian Weis CC: "secdir@ietf.org" , "draft-ietf-spring-srv6-network-programming.all@ietf.org" , "spring@ietf.org" , "last-call@ietf.org" Thread-Topic: Secdir last call review of draft-ietf-spring-srv6-network-programming-17 Thread-Index: AQHWfCAs7si/IaQjAUGLemDRAKxyiKlTzVOQgAVi8ACADx4iMA== Date: Mon, 14 Sep 2020 14:41:41 +0000 Message-ID: References: <159849805983.7699.460089427690333419@ietfa.amsl.com> <38FBDE44-D2F4-44AD-BFF4-FBE9B6FC42DE@gmail.com> In-Reply-To: <38FBDE44-D2F4-44AD-BFF4-FBE9B6FC42DE@gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=cisco.com; x-originating-ip: [173.38.220.53] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 5a405a15-3786-4b8d-c940-08d858bc4b93 x-ms-traffictypediagnostic: MWHPR11MB1375: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: zUFq3H0HaRSL1dCgtPim9vBZcpbLNPxAG/Cglaad4iyuijSGlkkTMHxlVYnicSysufx2z4SWyYrA4FVQQsDI+CKof7UNILYALF1DNC9HLLkAM1+d/cPG7znrymPziXBH2bolIx86TIPsmR3iNqSF0A/5CM08aOGUiI9V/lATtEuy70WwJ/o9PWAzxqDU2Wjt4nM5ZDrR04MWQyjmL7FKqML1UK6ub03jbfqDGJYZ75sqMWiM3CnY6FsFcFvGfj/LBAsis6tFAanNn1GvF79l0RV7uOK+4949uITW9jSOzZSL4+oAWH/IGOLjjonSDhd9unjTbmxhGTynmoSHv78kpw== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:MWHPR11MB1374.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFS:(366004)(376002)(346002)(39860400002)(396003)(136003)(54906003)(26005)(76116006)(66946007)(478600001)(66476007)(8936002)(9686003)(5660300002)(316002)(4326008)(64756008)(66556008)(66446008)(55016002)(86362001)(6916009)(186003)(7696005)(33656002)(71200400001)(2906002)(8676002)(53546011)(6506007)(52536014)(83380400001)(66574015); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: QRc/jaR91gJaujhIpHepMC0IXV9bwk7Yg7bnfqrVGOovNVxMZYd8Ciy3NkH0kp1UGzbItoDOOWqoGflDKPOq9zOkiMjfquqSvefAk3HUN64kEYa5OZ6yU6OyDILRLW6tWwJX35nplCVhQJIsIPb3XxSQcdD6ifA6uWvUaIcna6cPr0RNxFU0Q7A7QiEDw5WapP7jVrC425AnPeazP1RNY5XKbfiJ4hqM/c/60Ip8K20b/ahFxsor6IyqlyZP2Wp7glMDpsq3vjeNHJLsKBRzncrWMrHffDb+BmTWrreROTmfLmqjvw8IUooMQ37M06waL2IhvRMJgbs4dNe/yQFrg1e0RP1DitHcW2wzq7DKOPFxQWmfjvvVkuuip5s61oNK3byOUZFVpMtam/Wz96NEg8lTusy+2MQUAetEjLSDawD3TPjFrm4pS5rxfdV8n5DcFwAQXrR1ajmiaVddj4RGf2QKbejESiybCPYY74fNmMi0W6M2xlMnHJs6o1QPiIvOpcLcpG0dPH1Scjl6D5mQ/PrjIO/aeGvNvRtL08UvLWMKHHx1ntjSXJFRpkXoCr7kWrHsJfZNdYXqxru5KkKL3GfdSPikfIsL8zJB2ukHprs/dmqzaivTCixNvjKC9jkHLPAwu3GfdPGMwhhBTHfz4Q== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_MWHPR11MB137477559AF7955E2EC6FB31C9230MWHPR11MB1374namp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: MWHPR11MB1374.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 5a405a15-3786-4b8d-c940-08d858bc4b93 X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Sep 2020 14:41:41.7188 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: MK6uM5w764IfN5dIJpxJdbPAxdwA9vH0ZM2oYfcEZyxkPC4v4rkblc7A5+MgbSOi4LzzNFEaYBRHzsWwPWxFUg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR11MB1375 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.102.12, xch-rcd-002.cisco.com X-Outbound-Node: rcdn-core-12.cisco.com Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-spring-srv6-network-programming-17 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 Sep 2020 14:41:48 -0000 --_000_MWHPR11MB137477559AF7955E2EC6FB31C9230MWHPR11MB1374namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgQnJpYW4sDQoNCklubGluZS4NCg0KTWFueSB0aGFua3MhDQoNCkZyb206IEJyaWFuIFdlaXMg PGJldy5zdGRzQGdtYWlsLmNvbT4NClNlbnQ6IHPDoWJhZG8sIDUgZGUgc2VwdGllbWJyZSBkZSAy MDIwIDE6MzcNClRvOiBQYWJsbyBDYW1hcmlsbG8gKHBjYW1hcmlsKSA8cGNhbWFyaWxAY2lzY28u Y29tPg0KQ2M6IHNlY2RpckBpZXRmLm9yZzsgZHJhZnQtaWV0Zi1zcHJpbmctc3J2Ni1uZXR3b3Jr LXByb2dyYW1taW5nLmFsbEBpZXRmLm9yZzsgc3ByaW5nQGlldGYub3JnOyBsYXN0LWNhbGxAaWV0 Zi5vcmcNClN1YmplY3Q6IFJlOiBTZWNkaXIgbGFzdCBjYWxsIHJldmlldyBvZiBkcmFmdC1pZXRm LXNwcmluZy1zcnY2LW5ldHdvcmstcHJvZ3JhbW1pbmctMTcNCg0KSGkgUGFibG8sDQoNCg0KT24g U2VwIDEsIDIwMjAsIGF0IDg6MzcgQU0sIFBhYmxvIENhbWFyaWxsbyAocGNhbWFyaWwpIDxwY2Ft YXJpbEBjaXNjby5jb208bWFpbHRvOnBjYW1hcmlsQGNpc2NvLmNvbT4+IHdyb3RlOg0KDQpIaSBC cmlhbiwNCg0KTWFueSB0aGFua3MgZm9yIHRoZSB0aW1lIHlvdSB0b29rIHRvIGRvIGEgdGhvcm91 Z2ggcmV2aWV3LCBwbGVhc2Ugc2VlIGlubGluZSBiZWxvdyB3aXRoIFtQQ10uDQoNCkNoZWVycywN ClBhYmxvLg0KDQotLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KRnJvbTogQnJpYW4gV2VpcyB2 aWEgRGF0YXRyYWNrZXIgPG5vcmVwbHlAaWV0Zi5vcmc8bWFpbHRvOm5vcmVwbHlAaWV0Zi5vcmc+ Pg0KU2VudDoganVldmVzLCAyNyBkZSBhZ29zdG8gZGUgMjAyMCA1OjE0DQpUbzogc2VjZGlyQGll dGYub3JnPG1haWx0bzpzZWNkaXJAaWV0Zi5vcmc+DQpDYzogZHJhZnQtaWV0Zi1zcHJpbmctc3J2 Ni1uZXR3b3JrLXByb2dyYW1taW5nLmFsbEBpZXRmLm9yZzxtYWlsdG86ZHJhZnQtaWV0Zi1zcHJp bmctc3J2Ni1uZXR3b3JrLXByb2dyYW1taW5nLmFsbEBpZXRmLm9yZz47IHNwcmluZ0BpZXRmLm9y ZzxtYWlsdG86c3ByaW5nQGlldGYub3JnPjsgbGFzdC1jYWxsQGlldGYub3JnPG1haWx0bzpsYXN0 LWNhbGxAaWV0Zi5vcmc+DQpTdWJqZWN0OiBTZWNkaXIgbGFzdCBjYWxsIHJldmlldyBvZiBkcmFm dC1pZXRmLXNwcmluZy1zcnY2LW5ldHdvcmstcHJvZ3JhbW1pbmctMTcNCg0KUmV2aWV3ZXI6IEJy aWFuIFdlaXMNClJldmlldyByZXN1bHQ6IEhhcyBOaXRzDQoNClRoaXMgZG9jdW1lbnQgaXMgdGl0 bGVkIOKAnFNSdjYgTmV0d29yayBQcm9ncmFtbWluZ+KAnSwgd2hpY2ggaXMgYXR0ZW50aW9uIGdy YWJiaW5nLiBJdCBmbGVzaGVzIG91dCBob3cgU2VnbWVudCBSb3V0aW5nIHJvdXRlcyBJUHY2IHBh Y2tldHMgYnkgU2VnbWVudCBJRCAoU0lEKSwgYXMgd2VsbCBhcyBkZWZpbmluZyB0aGUgZm9ybWF0 IG9mIGEgU0lEIGZvciBJUHY2LiBUaGUgSW50cm9kdWN0aW9uIHN0YXRlcywg4oCcQW4gaW5ncmVz cyBub2RlIHN0ZWVycyBhIHBhY2tldCB0aHJvdWdoIGFuIG9yZGVyZWQgbGlzdCBvZiBpbnN0cnVj dGlvbnMsIGNhbGxlZCBzZWdtZW50cy7igJ0gV2hlbiBvbmUgY29uc2lkZXJzIHRoaXMgc3RhdGVt ZW50IGFsb25nIHdpdGggdGhlIGRvY3VtZW50IHRpdGxlLCBpdOKAmXMgYXBwYXJlbnQgdGhhdCBu ZXR3b3JrIGRldmljZXMgYXJlIGluZGVlZCBiZWluZyBnaXZlbiDigJxpbnN0cnVjdGlvbnPigJ0g aW4gdGhlIHByb2dyYW1taW5nIHNlbnNlLCB3aGVyZSBlYWNoIOKAnGluc3RydWN0aW9u4oCdIGlz IGVuY29kZWQgaW4gYW4gSVB2NiBhZGRyZXNzLg0KDQpBbiDigJxpbnN0cnVjdGlvbuKAnSAoaS5l LiwgU1J2NiBTSUQpIGNvbXByaXNlcyBhIGxvY2F0b3IgKHdoaWNoIGlzIHVzZWQgdG8gcm91dGUg dG8gYSBwYXJ0aWN1bGFyIG5ldHdvcmsgZGV2aWNlKSwgYW5kIGFsc28gZGlyZWN0cyB0aGUgbmV0 d29yayBkZXZpY2UgYWN0aW5nIGFzIHRoZSBsb2NhdG9yIGhvdyB0byBwcm9jZXNzIHRoZSBJUHY2 IHBhY2tldC4gV2l0aCB0aGUgaGVscCBvZiBhbiBJUHY2IFNlZ21lbnQgUm91dGluZyBIZWFkZXIg KFNSSCkgaGVhZGVyLCBhIHNlcmllcyBvZiDigJxpbnN0cnVjdGlvbnPigJ0gY2FuIHNvdXJjZSBy b3V0ZSBhIHBhY2tldCB0aHJvdWdoIHRoZSBuZXR3b3JrLCB3aGVyZSBlYWNoIG5ldHdvcmsgZGV2 aWNlIGFjdGluZyBhcyBhIGxvY2F0b3IgbGVhcm5zIGhvdyB0byBoYW5kbGUgdGhlIHBhY2tldCBi ZWZvcmUgcG9zc2libHkgc2VuZGluZyBpdCBvbiB0byB0aGUgbmV4dCBTSUQgKGlmIGFueSkuDQoN ClRoZSBlbmNvZGluZyBvZiBhbiBJUHY2IGFkZHJlc3MgYXMgYW4gU1J2NiBTSUQgaW5jbHVkZXMg YSBsb2NhdG9yLCBhIGNvZGUgaW5kaWNhdGluZyBhIGNlcnRhaW4gZnVuY3Rpb24sIGFuZCBvcHRp b25hbGx5IGFyZ3VtZW50cyB0byB0aGF0IGZ1bmN0aW9uLiBBbiBpbml0aWFsIHNldCBvZiBjb2Rl cyAoYW5kIHRoZWlyIGFzc29jaWF0ZWQgYWxnb3JpdGhtcykgaXMgZGVmaW5lZCBpbiB0aGlzIGRv Y3VtZW50LiBNb3N0IG9mIHRoZSBjb2RlcyBkZXNjcmliZSBob3cgdGhlIGVncmVzcyByb3V0ZXIg c2hvdWxkIGRlY2Fwc3VsYXRlIHRoZSBwYWNrZXQsIHdpdGggbWlnaHQgaW5jbHVkZSBkZWZpbmlu ZyAgd2hpY2ggcm91dGluZyB0YWJsZSB0aGUgcmVjZWl2aW5nIHJvdXRlciBzaG91bGQgbG9vayB1 cCBhZnRlciBkZWNhcHN1bGF0aW9uLg0KDQpUaGUgU2VjdXJpdHkgQ29uc2lkZXJhdGlvbnMgc2Vj dGlvbiBwb2ludHMgdG8gdGhlIFNlY3VyaXR5IENvbnNpZGVyYXRpb25zIG9mIHRoZSBhcmNoaXRl Y3R1cmUgZG9jdW1lbnQgYW5kIHRoZSBTUkggZG9jdW1lbnQuIEJvdGggZG9jdW1lbnRzIGZvY3Vz IG9uIHRoZSBmYWN0IHRoYXQgU1J2NiBpcyBpbnRlbmRlZCB0byBiZSB1c2VkIHdpdGhpbiBhIHNp bmdsZSBkb21haW4gKGUuZy4sIHByb3ZpZGVyDQpuZXR3b3JrKSBhbmQgZGlzY3VzcyByb3V0aW5n IG1pdGlnYXRpb25zIHN1Y2ggYXMgZmlsdGVyaW5nIGV4dGVybmFsIHRyYWZmaWMgYXBwcm9wcmlh dGVseS4gVGhleSBzZWVtIHRvIGFzc3VtZSB0aGF0IHRoZSBib3VuZGFyaWVzIG9mIHRoZSBkb21h aW4gaXRzZWxmIGFyZSBpbnZpb2xhdGUgc3VjaCB0aGF0IHRoZSBkb21haW4gYm91bmRhcnkgZGV2 aWNlcyBhcmUgbm90IHN1YnZlcnRlZCwgYW5kIHRoYXQgdGhlcmUgYXJlIG5vIGJhZCBhY3RvcnMg d2l0aGluIHRoZSBkb21haW4uIFRoZXNlIGFyZSBjb21tb24gYXNzdW1wdGlvbnMgZm9yIHNlcnZp Y2UgcHJvdmlkZXIgbmV0d29ya3Mgd2hlcmUgU2VnbWVudCBSb3V0aW5nIGlzIGludGVuZGVkIHRv IGJlIGRlcGxveWVkLg0KDQpIb3dldmVyLCBpdCBjYW5ub3QgYmUgY2VydGFpbiB0aGF0IGFsbCBu ZXR3b3JrcyBkZXBsb3lpbmcgU2VydmljZSBSb3V0aW5nIHRvIGJlIGZyZWUgb2YgYmFkIGFjdG9y cywgYW5kIHRoZXJlIHdpbGwgY2VydGFpbmx5IGJlIHNvbWUgYmVuZWZpdCB0byBhIGJhZCBhY3Rv ciBjaGFuZ2luZyDigJxpbnN0cnVjdGlvbnPigJ0gZW5jb2RlZCBpbiBJUHY2IGFkZHJlc3Nlcy4g UGVyaGFwcyB0aGVyZSBpcyBvcHBvcnR1bml0eSBmb3IgbWlzY2hpZWYgaW4gY2hhbmdpbmcgdGhl IHJvdXRpbmcgdGFibGUgYXJndW1lbnQgaW4gYW4gRW5kLkRUNDYsIGZvciBleGFtcGxlLiBBbHNv LCBhcyBvdGhlciBTUnY2IGZ1bmN0aW9ucyBhcmUgZGVmaW5lZCAoZS5nLiwgcGFja2V0IGluc3Bl Y3Rpb24gZnVuY3Rpb25zKSwgaXQgd291bGQgYmUgaW1wb3J0YW50IHRvIGVuc3VyZSB0aGF0IHRo b3NlIFNJRHMgYXJlIG5vdCBtb2RpZmllZCB0byBhdm9pZCBvciBkZWNyZWFzZSB0aGUgcXVhbGl0 eSBvZiB0aG9zZSBpbnNwZWN0aW9uIGZ1bmN0aW9ucy4NCg0KW1BDXSBJbmRlZWQsIHRoZSBhc3N1 bXB0aW9uIHRoYXQgYSBkb21haW4gaXMgZnJlZSBvZiBiYWQgYWN0b3JzIGlzIGEgY29tbW9uIGFz c3VtcHRpb24gZm9yIG5ldHdvcmtzIHdoZXJlIFNSdjYgaXMgaW50ZW5kZWQgdG8gYmUgZGVwbG95 ZWQuIFRoZSBzZWN1cml0eSBzZWN0aW9uIG9mIFJGQzg3NTQgZG9lcyB0YWxrIGFib3V0IHRoZXNl IGJhZCBhY3RvciBhdHRhY2tzICg3LjEpIG9uIHN1Y2ggbmV0d29ya3MsIGFuZCBvdGhlciB0eXBl cyBvZiBhdHRhY2tzIHRoZXkgY2FuIGxhdW5jaC4NCg0KVGhlIFNSSCBkb2N1bWVudCBkb2VzIGRl c2NyaWJlIGFuIEhNQUMgVExWIHRoYXQgaXMgaW50ZW5kZWQgdG8gbWl0aWdhdGUgdGhlc2Uga2lu ZHMgb2YgYXR0YWNrcy4gU2luY2UgbmVpdGhlciBvZiB0aGUgcmVmZXJlbmNlZCBkb2N1bWVudHMg U2VjdXJpdHkgQ29uc2lkZXJhdGlvbnMgbWVudGlvbiBpdCwgaXQgd291bGQgYmUgYSBnb29kIGlk ZWEgdG8gZGVzY3JpYmUgaGVyZSB0aGF0IHRoZXJlIGFyZSB0aHJlYXRzIHRvIGNoYW5naW5nIFNJ RHMsIGFuZCBwb2ludCBvdXQgaG93IHRvIG1pdGlnYXRlIHRoZW0gd2l0aCB0aGUgSE1BQyBUTFYu DQoNCltQQ10gVGhlIEhNQUMgVExWIGFsbG93cyBhIHNlZ21lbnQgZW5kcG9pbnQgbm9kZSB0byAi dmVyaWZ5IHRoYXQgdGhlIFNSSCBhcHBsaWVkIHRvIGEgcGFja2V0IHdhcyBzZWxlY3RlZCBieSBh biBhdXRob3JpemVkIHBhcnR5IGFuZCB0byBlbnN1cmUgdGhhdCB0aGUgc2VnbWVudCBsaXN0IGlz IG5vdCBtb2RpZmllZCBhZnRlciBnZW5lcmF0aW9uLiIgIFdlIGNvdWxkIGNhbGwgdGhpcyBvdXQg c3BlY2lmaWNhbGx5IGluIHRoZSBzZWN1cml0eSBzZWN0aW9uLg0KPE9MRD4NClRvZ2V0aGVyLCB0 aGV5IGRlc2NyaWJlIHRoZSByZXF1aXJlZCBzZWN1cml0eSBtZWNoYW5pc21zDQogIHRoYXQgYWxs b3cgZXN0YWJsaXNobWVudCBvZiBhbiBTUiBkb21haW4gb2YgdHJ1c3QgdG8gb3BlcmF0ZQ0KICBT UnY2LWJhc2VkIHNlcnZpY2VzIGZvciBpbnRlcm5hbCB0cmFmZmljIHdoaWxlIHByZXZlbnRpbmcg YW55DQogIGV4dGVybmFsIHRyYWZmaWMgZnJvbSBhY2Nlc3Npbmcgb3IgZXhwbG9pdGluZyB0aGUg U1J2Ni1iYXNlZA0KICBzZXJ2aWNlcy4NCjwvT0xEPg0KPE5FVz4NClRvZ2V0aGVyLCB0aGV5IGRl c2NyaWJlIHRoZSByZXF1aXJlZCBzZWN1cml0eSBtZWNoYW5pc21zDQogIHRoYXQgYWxsb3cgZXN0 YWJsaXNobWVudCBvZiBhbiBTUiBkb21haW4gb2YgdHJ1c3QgdG8gb3BlcmF0ZQ0KICBTUnY2LWJh c2VkIHNlcnZpY2VzIGZvciBpbnRlcm5hbCB0cmFmZmljIHdoaWxlIHByZXZlbnRpbmcgYW55DQog IGV4dGVybmFsIHRyYWZmaWMgZnJvbSBhY2Nlc3Npbmcgb3IgZXhwbG9pdGluZyB0aGUgU1J2Ni1i YXNlZA0KICBzZXJ2aWNlcy4gQWRkaXRpb25hbGx5LCBSRkM4NzU0IGRlZmluZXMgYW4gSE1BQyBU TFYgcGVybWl0dGluZyBub2RlcyBpbiB0aGUgU1IgZG9tYWluIHRvIHZlcmlmeSB0aGF0IHRoZSBT UkggYXBwbGllZCB0byBhIHBhY2tldCB3YXMgc2VsZWN0ZWQgYnkgYW4gYXV0aG9yaXplZCBwYXJ0 eSBhbmQgdG8gZW5zdXJlIHRoYXQgdGhlIHNlZ21lbnQgbGlzdCBpcyBub3QgbW9kaWZpZWQgYWZ0 ZXIgZ2VuZXJhdGlvbiwgcHJvdmlkaW5nIGZ1cnRoZXIgcHJvdGVjdGlvbiBhZ2FpbnN0IGJhZCBh Y3RvcnMgd2l0aGluIHRoZSBTUiBkb21haW4uDQo8L05FVz4NCg0KVGhlIG5ldyB3b3JkaW5nIHNv dW5kcyBnb29kIHRvIG1lLCB0aGFua3MuDQoNCg0KQWxzbywgaWYgSeKAmW0gbm90IG1pc3Rha2Vu LCB3aGVuIHRoZXJlIGlzIGp1c3Qgb25lIFNJRCB0aGVuIGl0IGlzIHBsYWNlZCBpbiB0aGUNCklQ djYgREEgYW5kIHRoZXJlIGlzIG5vIFNSSCBoZWFkZXIgb3IgSE1BQyBUTFYuDQoNCltQQ10gVGhl IFNSSCBNQVkgYmUgaW5jbHVkZWQgd2hlbiB0aGVyZSBpcyBqdXN0IG9uZSBTSUQgaWYgZmxhZ3Mg b3IgVExWcyBhcmUgcmVxdWlyZWQgKFJGQzg3NTQgc2VjdGlvbiA0LjEgcGFyYWdyYXBoIDEpIHNv IHRoZSBITUFDIFRMViBtYXkgYmUgdXNlZCBpbiB0aGlzIGNhc2UuDQoNClRoaXMgbWlnaHQgYmUg Z29vZCB0byBwb2ludCBvdXQgdG9vLiBIb3cgYWJvdXQgcHV0dGluZyBpdCBpbiBjb250ZXh0IG9m IHRoaXMgc2VjdGlvbiBzb21ldGhpbmcgbGlrZSB0aGlzOiDigJxXaGVuIG1vZGlmaWNhdGlvbiBk ZXRlY3Rpb24gaXMgZGVlbWVkIGltcG9ydGFudCwgYW4gU1JIIGhlYWRlciB3aXRoIGFuIEhNQUMg VExWIFNIT1VMRCBiZSBpbmNsdWRlZCBldmVuIHdoZW4ganVzdCBvbmUgU0lEIGlzIHJlcXVpcmVk LiBUaGlzIGVuc3VyZXMgdGhhdCB0aGUgU0lEIGlzIHByb3RlY3RlZCBqdXN0IGFzIHdoZW4gdGhl IFNSSCBpcyB1c2VkIHRvIGNhcnJ5IG11bHRpcGxlIFNJRHMu4oCdLiBJIHJlY29nbml6ZSB0aGlz IGlzIGFkZGluZyBhIG5ldyBub3JtYXRpdmUgcmVxdWlyZW1lbnQsIGJ1dCBpdCBpcyBkZXBlbmRl bnQgb24gdGhlIGZpcnN0IGNsYXVzZSBiZWluZyB0cnVlIHNvIG1pZ2h0IG5vdCBiZSBzbyBvYmpl Y3Rpb25hYmxlLg0KW1BDMl0gSSB3b3VsZCBwcm9wb3NlIHRoZSBmb2xsb3dpbmcgZGlmZiB0aGF0 IGNvbWJpbmVzIHRoZSBwcmV2aW91c2x5IGFncmVlZCB0ZXh0IGFuZCB0aGlzIG5ldyBwb2ludC4N CjxPTEQ+DQpUb2dldGhlciwgdGhleSBkZXNjcmliZSB0aGUgcmVxdWlyZWQgc2VjdXJpdHkgbWVj aGFuaXNtcw0KICB0aGF0IGFsbG93IGVzdGFibGlzaG1lbnQgb2YgYW4gU1IgZG9tYWluIG9mIHRy dXN0IHRvIG9wZXJhdGUNCiAgU1J2Ni1iYXNlZCBzZXJ2aWNlcyBmb3IgaW50ZXJuYWwgdHJhZmZp YyB3aGlsZSBwcmV2ZW50aW5nIGFueQ0KICBleHRlcm5hbCB0cmFmZmljIGZyb20gYWNjZXNzaW5n IG9yIGV4cGxvaXRpbmcgdGhlIFNSdjYtYmFzZWQNCiAgc2VydmljZXMuDQo8L09MRD4NCjxORVc+ DQpUb2dldGhlciwgdGhleSBkZXNjcmliZSB0aGUgcmVxdWlyZWQgc2VjdXJpdHkgbWVjaGFuaXNt cw0KICB0aGF0IGFsbG93IGVzdGFibGlzaG1lbnQgb2YgYW4gU1IgZG9tYWluIG9mIHRydXN0IHRv IG9wZXJhdGUNCiAgU1J2Ni1iYXNlZCBzZXJ2aWNlcyBmb3IgaW50ZXJuYWwgdHJhZmZpYyB3aGls ZSBwcmV2ZW50aW5nIGFueQ0KICBleHRlcm5hbCB0cmFmZmljIGZyb20gYWNjZXNzaW5nIG9yIGV4 cGxvaXRpbmcgdGhlIFNSdjYtYmFzZWQNCiAgc2VydmljZXMuDQoNCkFkZGl0aW9uYWxseSwgUkZD ODc1NCBkZWZpbmVzIGFuIEhNQUMgVExWIHBlcm1pdHRpbmcgbm9kZXMgaW4gdGhlDQpTUiBkb21h aW4gdG8gdmVyaWZ5IHRoYXQgdGhlIFNSSCBhcHBsaWVkIHRvIGEgcGFja2V0IHdhcyBzZWxlY3Rl ZA0KYnkgYW4gYXV0aG9yaXplZCBwYXJ0eSBhbmQgdG8gZW5zdXJlIHRoYXQgdGhlIHNlZ21lbnQg bGlzdCBpcyBub3QgbW9kaWZpZWQNCmFmdGVyIGdlbmVyYXRpb24sIHJlZ2FyZGxlc3Mgb2YgdGhl IG51bWJlciBvZiBzZWdtZW50cyBpbiB0aGUgc2VnbWVudCBsaXN0Lg0KVGhpcyBwcm92aWRlcyBm dXJ0aGVyIHByb3RlY3Rpb24gYWdhaW5zdCBiYWQgYWN0b3JzIHdpdGhpbiB0aGUNClNSIGRvbWFp bi4NCjwvTkVXPg0KDQpUaGFua3MsDQpCcmlhbg0KDQoNCg0KVGhpcyBpcyBhIGdlbmVyYWwgcHJv YmxlbSB3aXRoIGVuc3VyaW5nIHRoYXQgdGhlIERBIG9uIHBhY2tldHMgYXJlIG5vdCBjaGFuZ2Vk IGluIHRyYW5zaXQsIGFuZCBvbmUgY291bGQgdXNlIElQc2VjIHRvIG1pdGlnYXRlIHRoYXQgaXNz dWUuIEl04oCZcyBwcm9iYWJseSB3b3J0aHdoaWxlIG1lbnRpb25pbmcgc29tZXRoaW5nIGxpa2Ug dGhhdC4NCg0K --_000_MWHPR11MB137477559AF7955E2EC6FB31C9230MWHPR11MB1374namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30NCkBmb250LWZhY2UN Cgl7Zm9udC1mYW1pbHk6IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAz IDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAx NSA1IDIgMiAyIDQgMyAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFs LCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90 dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIs c2Fucy1zZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlv cml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0Kc3Bh bi5hcHBsZS1jb252ZXJ0ZWQtc3BhY2UNCgl7bXNvLXN0eWxlLW5hbWU6YXBwbGUtY29udmVydGVk LXNwYWNlO30NCnNwYW4uRW1haWxTdHlsZTIwDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLWNv bXBvc2U7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93 dGV4dDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglm b250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjYxMi4wcHQgNzky LjBwdDsNCgltYXJnaW46NzAuODVwdCAzLjBjbSA3MC44NXB0IDMuMGNtO30NCmRpdi5Xb3JkU2Vj dGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28g OV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+ DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5 b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9v OnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRVMi IGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0ibXNvLWZhcmVh c3QtbGFuZ3VhZ2U6RU4tVVMiPkhpIEJyaWFuLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFu Z3VhZ2U6RU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4t VVMiPklubGluZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5n PSJFTi1VUyIgc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj5NYW55IHRoYW5rcyE8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJF Ti1VUyIgc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpz b2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGNtIDBjbSAwY20iPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PGI+PHNwYW4gbGFuZz0iRU4tVVMiPkZyb206PC9zcGFuPjwvYj48c3BhbiBs YW5nPSJFTi1VUyI+IEJyaWFuIFdlaXMgJmx0O2Jldy5zdGRzQGdtYWlsLmNvbSZndDsNCjxicj4N CjxiPlNlbnQ6PC9iPiBzw6FiYWRvLCA1IGRlIHNlcHRpZW1icmUgZGUgMjAyMCAxOjM3PGJyPg0K PGI+VG86PC9iPiBQYWJsbyBDYW1hcmlsbG8gKHBjYW1hcmlsKSAmbHQ7cGNhbWFyaWxAY2lzY28u Y29tJmd0Ozxicj4NCjxiPkNjOjwvYj4gc2VjZGlyQGlldGYub3JnOyBkcmFmdC1pZXRmLXNwcmlu Zy1zcnY2LW5ldHdvcmstcHJvZ3JhbW1pbmcuYWxsQGlldGYub3JnOyBzcHJpbmdAaWV0Zi5vcmc7 IGxhc3QtY2FsbEBpZXRmLm9yZzxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogU2VjZGlyIGxhc3Qg Y2FsbCByZXZpZXcgb2YgZHJhZnQtaWV0Zi1zcHJpbmctc3J2Ni1uZXR3b3JrLXByb2dyYW1taW5n LTE3PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyI+SGkgUGFibG8sPG86cD48L286 cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVO LVVTIj48YnI+DQo8YnI+DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8YmxvY2txdW90ZSBzdHls ZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyI+T24gU2VwIDEsIDIwMjAsIGF0IDg6Mzcg QU0sIFBhYmxvIENhbWFyaWxsbyAocGNhbWFyaWwpICZsdDs8L3NwYW4+PGEgaHJlZj0ibWFpbHRv OnBjYW1hcmlsQGNpc2NvLmNvbSI+PHNwYW4gbGFuZz0iRU4tVVMiPnBjYW1hcmlsQGNpc2NvLmNv bTwvc3Bhbj48L2E+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDsgd3JvdGU6PG86cD48L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyI+ PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5IaSBCcmlhbiw8YnI+DQo8YnI+DQpNYW55 IHRoYW5rcyBmb3IgdGhlIHRpbWUgeW91IHRvb2sgdG8gZG8gYSB0aG9yb3VnaCByZXZpZXcsIHBs ZWFzZSBzZWUgaW5saW5lIGJlbG93IHdpdGggW1BDXS48YnI+DQo8YnI+DQpDaGVlcnMsPGJyPg0K UGFibG8uPGJyPg0KPGJyPg0KLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS08YnI+DQpGcm9tOiBC cmlhbiBXZWlzIHZpYSBEYXRhdHJhY2tlciAmbHQ7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzpub3Jl cGx5QGlldGYub3JnIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtm b250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+bm9yZXBseUBpZXRm Lm9yZzwvc3Bhbj48L2E+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPiZndDs8c3BhbiBj bGFzcz0iYXBwbGUtY29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGJyPg0KU2VudDoganVl dmVzLCAyNyBkZSBhZ29zdG8gZGUgMjAyMCA1OjE0PGJyPg0KVG86PHNwYW4gY2xhc3M9ImFwcGxl LWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48YSBocmVmPSJtYWlsdG86c2Vj ZGlyQGlldGYub3JnIj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtm b250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+c2VjZGlyQGlldGYu b3JnPC9zcGFuPjwvYT48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtm b250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PGJyPg0KQ2M6PHNw YW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48YSBo cmVmPSJtYWlsdG86ZHJhZnQtaWV0Zi1zcHJpbmctc3J2Ni1uZXR3b3JrLXByb2dyYW1taW5nLmFs bEBpZXRmLm9yZyI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPmRyYWZ0LWlldGYtc3By aW5nLXNydjYtbmV0d29yay1wcm9ncmFtbWluZy5hbGxAaWV0Zi5vcmc8L3NwYW4+PC9hPjxzcGFu IGxhbmc9IkVOLVVTIiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hl bHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj47PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1z cGFjZSI+Jm5ic3A7PC9zcGFuPjwvc3Bhbj48YSBocmVmPSJtYWlsdG86c3ByaW5nQGlldGYub3Jn Ij48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTom cXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+c3ByaW5nQGlldGYub3JnPC9zcGFuPjwv YT48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTom cXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+OzxzcGFuIGNsYXNzPSJhcHBsZS1jb252 ZXJ0ZWQtc3BhY2UiPiZuYnNwOzwvc3Bhbj48L3NwYW4+PGEgaHJlZj0ibWFpbHRvOmxhc3QtY2Fs bEBpZXRmLm9yZyI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPmxhc3QtY2FsbEBpZXRm Lm9yZzwvc3Bhbj48L2E+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7 Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPjxicj4NClN1Ympl Y3Q6IFNlY2RpciBsYXN0IGNhbGwgcmV2aWV3IG9mIGRyYWZ0LWlldGYtc3ByaW5nLXNydjYtbmV0 d29yay1wcm9ncmFtbWluZy0xNzxicj4NCjxicj4NClJldmlld2VyOiBCcmlhbiBXZWlzPGJyPg0K UmV2aWV3IHJlc3VsdDogSGFzIE5pdHM8YnI+DQo8YnI+DQpUaGlzIGRvY3VtZW50IGlzIHRpdGxl ZCDigJxTUnY2IE5ldHdvcmsgUHJvZ3JhbW1pbmfigJ0sIHdoaWNoIGlzIGF0dGVudGlvbiBncmFi YmluZy4gSXQgZmxlc2hlcyBvdXQgaG93IFNlZ21lbnQgUm91dGluZyByb3V0ZXMgSVB2NiBwYWNr ZXRzIGJ5IFNlZ21lbnQgSUQgKFNJRCksIGFzIHdlbGwgYXMgZGVmaW5pbmcgdGhlIGZvcm1hdCBv ZiBhIFNJRCBmb3IgSVB2Ni4gVGhlIEludHJvZHVjdGlvbiBzdGF0ZXMsIOKAnEFuIGluZ3Jlc3Mg bm9kZSBzdGVlcnMgYQ0KIHBhY2tldCB0aHJvdWdoIGFuIG9yZGVyZWQgbGlzdCBvZiBpbnN0cnVj dGlvbnMsIGNhbGxlZCBzZWdtZW50cy7igJ0gV2hlbiBvbmUgY29uc2lkZXJzIHRoaXMgc3RhdGVt ZW50IGFsb25nIHdpdGggdGhlIGRvY3VtZW50IHRpdGxlLCBpdOKAmXMgYXBwYXJlbnQgdGhhdCBu ZXR3b3JrIGRldmljZXMgYXJlIGluZGVlZCBiZWluZyBnaXZlbiDigJxpbnN0cnVjdGlvbnPigJ0g aW4gdGhlIHByb2dyYW1taW5nIHNlbnNlLCB3aGVyZSBlYWNoIOKAnGluc3RydWN0aW9u4oCdIGlz DQogZW5jb2RlZCBpbiBhbiBJUHY2IGFkZHJlc3MuPGJyPg0KPGJyPg0KQW4g4oCcaW5zdHJ1Y3Rp b27igJ0gKGkuZS4sIFNSdjYgU0lEKSBjb21wcmlzZXMgYSBsb2NhdG9yICh3aGljaCBpcyB1c2Vk IHRvIHJvdXRlIHRvIGEgcGFydGljdWxhciBuZXR3b3JrIGRldmljZSksIGFuZCBhbHNvIGRpcmVj dHMgdGhlIG5ldHdvcmsgZGV2aWNlIGFjdGluZyBhcyB0aGUgbG9jYXRvciBob3cgdG8gcHJvY2Vz cyB0aGUgSVB2NiBwYWNrZXQuIFdpdGggdGhlIGhlbHAgb2YgYW4gSVB2NiBTZWdtZW50IFJvdXRp bmcgSGVhZGVyIChTUkgpIGhlYWRlciwNCiBhIHNlcmllcyBvZiDigJxpbnN0cnVjdGlvbnPigJ0g Y2FuIHNvdXJjZSByb3V0ZSBhIHBhY2tldCB0aHJvdWdoIHRoZSBuZXR3b3JrLCB3aGVyZSBlYWNo IG5ldHdvcmsgZGV2aWNlIGFjdGluZyBhcyBhIGxvY2F0b3IgbGVhcm5zIGhvdyB0byBoYW5kbGUg dGhlIHBhY2tldCBiZWZvcmUgcG9zc2libHkgc2VuZGluZyBpdCBvbiB0byB0aGUgbmV4dCBTSUQg KGlmIGFueSkuPGJyPg0KPGJyPg0KVGhlIGVuY29kaW5nIG9mIGFuIElQdjYgYWRkcmVzcyBhcyBh biBTUnY2IFNJRCBpbmNsdWRlcyBhIGxvY2F0b3IsIGEgY29kZSBpbmRpY2F0aW5nIGEgY2VydGFp biBmdW5jdGlvbiwgYW5kIG9wdGlvbmFsbHkgYXJndW1lbnRzIHRvIHRoYXQgZnVuY3Rpb24uIEFu IGluaXRpYWwgc2V0IG9mIGNvZGVzIChhbmQgdGhlaXIgYXNzb2NpYXRlZCBhbGdvcml0aG1zKSBp cyBkZWZpbmVkIGluIHRoaXMgZG9jdW1lbnQuIE1vc3Qgb2YgdGhlIGNvZGVzIGRlc2NyaWJlDQog aG93IHRoZSBlZ3Jlc3Mgcm91dGVyIHNob3VsZCBkZWNhcHN1bGF0ZSB0aGUgcGFja2V0LCB3aXRo IG1pZ2h0IGluY2x1ZGUgZGVmaW5pbmcgJm5ic3A7d2hpY2ggcm91dGluZyB0YWJsZSB0aGUgcmVj ZWl2aW5nIHJvdXRlciBzaG91bGQgbG9vayB1cCBhZnRlciBkZWNhcHN1bGF0aW9uLjxicj4NCjxi cj4NClRoZSBTZWN1cml0eSBDb25zaWRlcmF0aW9ucyBzZWN0aW9uIHBvaW50cyB0byB0aGUgU2Vj dXJpdHkgQ29uc2lkZXJhdGlvbnMgb2YgdGhlIGFyY2hpdGVjdHVyZSBkb2N1bWVudCBhbmQgdGhl IFNSSCBkb2N1bWVudC4gQm90aCBkb2N1bWVudHMgZm9jdXMgb24gdGhlIGZhY3QgdGhhdCBTUnY2 IGlzIGludGVuZGVkIHRvIGJlIHVzZWQgd2l0aGluIGEgc2luZ2xlIGRvbWFpbiAoZS5nLiwgcHJv dmlkZXI8YnI+DQpuZXR3b3JrKSBhbmQgZGlzY3VzcyByb3V0aW5nIG1pdGlnYXRpb25zIHN1Y2gg YXMgZmlsdGVyaW5nIGV4dGVybmFsIHRyYWZmaWMgYXBwcm9wcmlhdGVseS4gVGhleSBzZWVtIHRv IGFzc3VtZSB0aGF0IHRoZSBib3VuZGFyaWVzIG9mIHRoZSBkb21haW4gaXRzZWxmIGFyZSBpbnZp b2xhdGUgc3VjaCB0aGF0IHRoZSBkb21haW4gYm91bmRhcnkgZGV2aWNlcyBhcmUgbm90IHN1YnZl cnRlZCwgYW5kIHRoYXQgdGhlcmUgYXJlIG5vIGJhZCBhY3RvcnMgd2l0aGluDQogdGhlIGRvbWFp bi4gVGhlc2UgYXJlIGNvbW1vbiBhc3N1bXB0aW9ucyBmb3Igc2VydmljZSBwcm92aWRlciBuZXR3 b3JrcyB3aGVyZSBTZWdtZW50IFJvdXRpbmcgaXMgaW50ZW5kZWQgdG8gYmUgZGVwbG95ZWQuPGJy Pg0KPGJyPg0KSG93ZXZlciwgaXQgY2Fubm90IGJlIGNlcnRhaW4gdGhhdCBhbGwgbmV0d29ya3Mg ZGVwbG95aW5nIFNlcnZpY2UgUm91dGluZyB0byBiZSBmcmVlIG9mIGJhZCBhY3RvcnMsIGFuZCB0 aGVyZSB3aWxsIGNlcnRhaW5seSBiZSBzb21lIGJlbmVmaXQgdG8gYSBiYWQgYWN0b3IgY2hhbmdp bmcg4oCcaW5zdHJ1Y3Rpb25z4oCdIGVuY29kZWQgaW4gSVB2NiBhZGRyZXNzZXMuIFBlcmhhcHMg dGhlcmUgaXMgb3Bwb3J0dW5pdHkgZm9yIG1pc2NoaWVmIGluIGNoYW5naW5nDQogdGhlIHJvdXRp bmcgdGFibGUgYXJndW1lbnQgaW4gYW4mbmJzcDtFbmQuRFQ0NiwgZm9yIGV4YW1wbGUuIEFsc28s IGFzIG90aGVyIFNSdjYgZnVuY3Rpb25zIGFyZSBkZWZpbmVkIChlLmcuLCBwYWNrZXQgaW5zcGVj dGlvbiBmdW5jdGlvbnMpLCBpdCB3b3VsZCBiZSBpbXBvcnRhbnQgdG8gZW5zdXJlIHRoYXQgdGhv c2UgU0lEcyBhcmUgbm90IG1vZGlmaWVkIHRvIGF2b2lkIG9yIGRlY3JlYXNlIHRoZSBxdWFsaXR5 IG9mIHRob3NlIGluc3BlY3Rpb24gZnVuY3Rpb25zLjxicj4NCjxicj4NCltQQ10gSW5kZWVkLCB0 aGUgYXNzdW1wdGlvbiB0aGF0IGEgZG9tYWluIGlzIGZyZWUgb2YgYmFkIGFjdG9ycyBpcyBhIGNv bW1vbiBhc3N1bXB0aW9uIGZvciBuZXR3b3JrcyB3aGVyZSBTUnY2IGlzIGludGVuZGVkIHRvIGJl IGRlcGxveWVkLiBUaGUgc2VjdXJpdHkgc2VjdGlvbiBvZiBSRkM4NzU0IGRvZXMgdGFsayBhYm91 dCB0aGVzZSBiYWQgYWN0b3IgYXR0YWNrcyAoNy4xKSBvbiBzdWNoIG5ldHdvcmtzLCBhbmQgb3Ro ZXIgdHlwZXMgb2YgYXR0YWNrcw0KIHRoZXkgY2FuIGxhdW5jaC48YnI+DQo8YnI+DQpUaGUgU1JI IGRvY3VtZW50IGRvZXMgZGVzY3JpYmUgYW4gSE1BQyBUTFYgdGhhdCBpcyBpbnRlbmRlZCB0byBt aXRpZ2F0ZSB0aGVzZSBraW5kcyBvZiBhdHRhY2tzLiBTaW5jZSBuZWl0aGVyIG9mIHRoZSByZWZl cmVuY2VkIGRvY3VtZW50cyBTZWN1cml0eSBDb25zaWRlcmF0aW9ucyBtZW50aW9uIGl0LCBpdCB3 b3VsZCBiZSBhIGdvb2QgaWRlYSB0byBkZXNjcmliZSBoZXJlIHRoYXQgdGhlcmUgYXJlIHRocmVh dHMgdG8gY2hhbmdpbmcgU0lEcywgYW5kDQogcG9pbnQgb3V0IGhvdyB0byBtaXRpZ2F0ZSB0aGVt IHdpdGggdGhlIEhNQUMgVExWLjxicj4NCjxicj4NCltQQ10gVGhlIEhNQUMgVExWIGFsbG93cyBh IHNlZ21lbnQgZW5kcG9pbnQgbm9kZSB0byAmcXVvdDt2ZXJpZnkgdGhhdCB0aGUgU1JIIGFwcGxp ZWQgdG8gYSBwYWNrZXQgd2FzIHNlbGVjdGVkIGJ5IGFuIGF1dGhvcml6ZWQgcGFydHkgYW5kIHRv IGVuc3VyZSB0aGF0IHRoZSBzZWdtZW50IGxpc3QgaXMgbm90IG1vZGlmaWVkIGFmdGVyIGdlbmVy YXRpb24uJnF1b3Q7ICZuYnNwO1dlIGNvdWxkIGNhbGwgdGhpcyBvdXQgc3BlY2lmaWNhbGx5IGlu IHRoZSBzZWN1cml0eSBzZWN0aW9uLjxicj4NCiZsdDtPTEQmZ3Q7PGJyPg0KVG9nZXRoZXIsIHRo ZXkgZGVzY3JpYmUgdGhlIHJlcXVpcmVkIHNlY3VyaXR5IG1lY2hhbmlzbXM8YnI+DQombmJzcDsm bmJzcDt0aGF0IGFsbG93IGVzdGFibGlzaG1lbnQgb2YgYW4gU1IgZG9tYWluIG9mIHRydXN0IHRv IG9wZXJhdGU8YnI+DQombmJzcDsmbmJzcDtTUnY2LWJhc2VkIHNlcnZpY2VzIGZvciBpbnRlcm5h bCB0cmFmZmljIHdoaWxlIHByZXZlbnRpbmcgYW55PGJyPg0KJm5ic3A7Jm5ic3A7ZXh0ZXJuYWwg dHJhZmZpYyBmcm9tIGFjY2Vzc2luZyBvciBleHBsb2l0aW5nIHRoZSBTUnY2LWJhc2VkPGJyPg0K Jm5ic3A7Jm5ic3A7c2VydmljZXMuICZuYnNwOzxicj4NCiZsdDsvT0xEJmd0Ozxicj4NCiZsdDtO RVcmZ3Q7PGJyPg0KVG9nZXRoZXIsIHRoZXkgZGVzY3JpYmUgdGhlIHJlcXVpcmVkIHNlY3VyaXR5 IG1lY2hhbmlzbXM8YnI+DQombmJzcDsmbmJzcDt0aGF0IGFsbG93IGVzdGFibGlzaG1lbnQgb2Yg YW4gU1IgZG9tYWluIG9mIHRydXN0IHRvIG9wZXJhdGU8YnI+DQombmJzcDsmbmJzcDtTUnY2LWJh c2VkIHNlcnZpY2VzIGZvciBpbnRlcm5hbCB0cmFmZmljIHdoaWxlIHByZXZlbnRpbmcgYW55PGJy Pg0KJm5ic3A7Jm5ic3A7ZXh0ZXJuYWwgdHJhZmZpYyBmcm9tIGFjY2Vzc2luZyBvciBleHBsb2l0 aW5nIHRoZSBTUnY2LWJhc2VkPGJyPg0KJm5ic3A7Jm5ic3A7c2VydmljZXMuIEFkZGl0aW9uYWxs eSwgUkZDODc1NCBkZWZpbmVzIGFuIEhNQUMgVExWIHBlcm1pdHRpbmcgbm9kZXMgaW4gdGhlIFNS IGRvbWFpbiB0byB2ZXJpZnkgdGhhdCB0aGUgU1JIIGFwcGxpZWQgdG8gYSBwYWNrZXQgd2FzIHNl bGVjdGVkIGJ5IGFuIGF1dGhvcml6ZWQgcGFydHkgYW5kIHRvIGVuc3VyZSB0aGF0IHRoZSBzZWdt ZW50IGxpc3QgaXMgbm90IG1vZGlmaWVkIGFmdGVyIGdlbmVyYXRpb24sIHByb3ZpZGluZyBmdXJ0 aGVyIHByb3RlY3Rpb24NCiBhZ2FpbnN0IGJhZCBhY3RvcnMgd2l0aGluIHRoZSBTUiBkb21haW4u PGJyPg0KJmx0Oy9ORVcmZ3Q7PC9zcGFuPjxzcGFuIGxhbmc9IkVOLVVTIj48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBsYW5nPSJFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyI+VGhlIG5ldyB3b3Jk aW5nIHNvdW5kcyBnb29kIHRvIG1lLCB0aGFua3MuPGJyPg0KPGJyPg0KPG86cD48L286cD48L3Nw YW4+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRv bTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMi IHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7 LHNhbnMtc2VyaWYiPjxicj4NCkFsc28sIGlmIEnigJltIG5vdCBtaXN0YWtlbiwgd2hlbiB0aGVy ZSBpcyBqdXN0IG9uZSBTSUQgdGhlbiBpdCBpcyBwbGFjZWQgaW4gdGhlPGJyPg0KSVB2NiBEQSBh bmQgdGhlcmUgaXMgbm8gU1JIIGhlYWRlciBvciBITUFDIFRMVi48c3BhbiBjbGFzcz0iYXBwbGUt Y29udmVydGVkLXNwYWNlIj4mbmJzcDs8L3NwYW4+PGJyPg0KPGJyPg0KW1BDXSBUaGUgU1JIIE1B WSBiZSBpbmNsdWRlZCB3aGVuIHRoZXJlIGlzIGp1c3Qgb25lIFNJRCBpZiBmbGFncyBvciBUTFZz IGFyZSByZXF1aXJlZCAoUkZDODc1NCBzZWN0aW9uIDQuMSBwYXJhZ3JhcGggMSkgc28gdGhlIEhN QUMgVExWIG1heSBiZSB1c2VkIGluIHRoaXMgY2FzZS48L3NwYW4+PHNwYW4gbGFuZz0iRU4tVVMi PjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5n PSJFTi1VUyI+VGhpcyBtaWdodCBiZSBnb29kIHRvIHBvaW50IG91dCB0b28uIEhvdyBhYm91dCBw dXR0aW5nIGl0IGluIGNvbnRleHQgb2YgdGhpcyBzZWN0aW9uIHNvbWV0aGluZyBsaWtlIHRoaXM6 IOKAnFdoZW4gbW9kaWZpY2F0aW9uIGRldGVjdGlvbiBpcyBkZWVtZWQgaW1wb3J0YW50LCBhbiBT UkggaGVhZGVyIHdpdGggYW4gSE1BQyBUTFYgU0hPVUxEIGJlIGluY2x1ZGVkIGV2ZW4gd2hlbiBq dXN0DQogb25lIFNJRCBpcyByZXF1aXJlZC4gVGhpcyBlbnN1cmVzIHRoYXQgdGhlIFNJRCBpcyBw cm90ZWN0ZWQganVzdCBhcyB3aGVuIHRoZSBTUkggaXMgdXNlZCB0byBjYXJyeSBtdWx0aXBsZSBT SURzLuKAnS4gSSByZWNvZ25pemUgdGhpcyBpcyBhZGRpbmcgYSBuZXcgbm9ybWF0aXZlIHJlcXVp cmVtZW50LCBidXQgaXQgaXMgZGVwZW5kZW50IG9uIHRoZSBmaXJzdCBjbGF1c2UgYmVpbmcgdHJ1 ZSBzbyBtaWdodCBub3QgYmUgc28gb2JqZWN0aW9uYWJsZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48aT48c3BhbiBsYW5nPSJFTi1VUyI+W1BDMl0gSSB3 b3VsZCBwcm9wb3NlIHRoZSBmb2xsb3dpbmcgZGlmZiB0aGF0IGNvbWJpbmVzIHRoZSBwcmV2aW91 c2x5IGFncmVlZCB0ZXh0IGFuZCB0aGlzIG5ldyBwb2ludC48bzpwPjwvbzpwPjwvc3Bhbj48L2k+ PC9iPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbHQ7T0xE Jmd0Ozxicj4NClRvZ2V0aGVyLCB0aGV5IGRlc2NyaWJlIHRoZSByZXF1aXJlZCBzZWN1cml0eSBt ZWNoYW5pc21zPGJyPg0KJm5ic3A7Jm5ic3A7dGhhdCBhbGxvdyBlc3RhYmxpc2htZW50IG9mIGFu IFNSIGRvbWFpbiBvZiB0cnVzdCB0byBvcGVyYXRlPGJyPg0KJm5ic3A7Jm5ic3A7U1J2Ni1iYXNl ZCBzZXJ2aWNlcyBmb3IgaW50ZXJuYWwgdHJhZmZpYyB3aGlsZSBwcmV2ZW50aW5nIGFueTxicj4N CiZuYnNwOyZuYnNwO2V4dGVybmFsIHRyYWZmaWMgZnJvbSBhY2Nlc3Npbmcgb3IgZXhwbG9pdGlu ZyB0aGUgU1J2Ni1iYXNlZDxicj4NCiZuYnNwOyZuYnNwO3NlcnZpY2VzLiAmbmJzcDs8YnI+DQom bHQ7L09MRCZndDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBsYW5nPSJFTi1VUyI+Jmx0O05FVyZndDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyI+VG9nZXRoZXIsIHRoZXkgZGVzY3Jp YmUgdGhlIHJlcXVpcmVkIHNlY3VyaXR5IG1lY2hhbmlzbXM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7IHRoYXQgYWxs b3cgZXN0YWJsaXNobWVudCBvZiBhbiBTUiBkb21haW4gb2YgdHJ1c3QgdG8gb3BlcmF0ZTxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVT Ij4mbmJzcDsgU1J2Ni1iYXNlZCBzZXJ2aWNlcyBmb3IgaW50ZXJuYWwgdHJhZmZpYyB3aGlsZSBw cmV2ZW50aW5nIGFueTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsgZXh0ZXJuYWwgdHJhZmZpYyBmcm9tIGFjY2Vzc2lu ZyBvciBleHBsb2l0aW5nIHRoZSBTUnY2LWJhc2VkPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyBzZXJ2aWNlcy4mbmJz cDsgPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFu Zz0iRU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIGxhbmc9IkVOLVVTIj5BZGRpdGlvbmFsbHksIFJGQzg3NTQgZGVmaW5lcyBhbiBI TUFDIFRMViBwZXJtaXR0aW5nIG5vZGVzIGluIHRoZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIj5TUiBkb21haW4gdG8gdmVyaWZ5 IHRoYXQgdGhlIFNSSCBhcHBsaWVkIHRvIGEgcGFja2V0IHdhcyBzZWxlY3RlZA0KPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiPmJ5 IGFuIGF1dGhvcml6ZWQgcGFydHkgYW5kIHRvIGVuc3VyZSB0aGF0IHRoZSBzZWdtZW50IGxpc3Qg aXMgbm90IG1vZGlmaWVkPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gbGFuZz0iRU4tVVMiPmFmdGVyIGdlbmVyYXRpb24sIDx1PnJlZ2FyZGxlc3Mgb2Yg dGhlIG51bWJlciBvZiBzZWdtZW50cyBpbiB0aGUgc2VnbWVudCBsaXN0PC91Pi4NCjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIj5U aGlzIHByb3ZpZGVzIGZ1cnRoZXIgcHJvdGVjdGlvbiBhZ2FpbnN0IGJhZCBhY3RvcnMgd2l0aGlu IHRoZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxh bmc9IkVOLVVTIj5TUiBkb21haW4uPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZsdDsvTkVXJmd0OzxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVO LVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBsYW5nPSJFTi1VUyI+VGhhbmtzLDxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVO LVVTIj5CcmlhbjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gbGFuZz0iRU4tVVMiPjxicj4NCjxicj4NCjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4w cHQiPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHls ZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5z LXNlcmlmIj48YnI+DQpUaGlzIGlzIGEgZ2VuZXJhbCBwcm9ibGVtIHdpdGggZW5zdXJpbmcgdGhh dCB0aGUgREEgb24gcGFja2V0cyBhcmUgbm90IGNoYW5nZWQgaW4gdHJhbnNpdCwgYW5kIG9uZSBj b3VsZCB1c2UgSVBzZWMgdG8gbWl0aWdhdGUgdGhhdCBpc3N1ZS4NCjwvc3Bhbj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0hlbHZldGljYSZxdW90OyxzYW5z LXNlcmlmIj5JdOKAmXMgcHJvYmFibHkgd29ydGh3aGlsZSBtZW50aW9uaW5nIHNvbWV0aGluZyBs aWtlIHRoYXQuPC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8 L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+ DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_MWHPR11MB137477559AF7955E2EC6FB31C9230MWHPR11MB1374namp_-- From nobody Tue Sep 15 08:38:42 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD2563A0995; Tue, 15 Sep 2020 08:38:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=verisign.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Er-U_w-4KcMi; Tue, 15 Sep 2020 08:38:34 -0700 (PDT) Received: from mail4.verisign.com (mail4.verisign.com [69.58.187.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3345E3A098E; Tue, 15 Sep 2020 08:38:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=verisign.com; l=20309; q=dns/txt; s=VRSN; t=1600184314; h=from:to:cc:date:message-id:references:in-reply-to: mime-version:subject; bh=d5KCEC7c1loZfaoTmyRqPhMKAEn4mKHM/Ke2jv8ZT+w=; b=Gc0xf0JNjU5iz3BQrp5whLt6+sDke0C9YbvnXGWTyhEq+UObXrEAsPwL 9r1K7/teufaBPfbcsKylKffleZp8ML9vefYric8+L8jSbH5SkjczzQgz8 8Y7W6DxBj0aujPYNZbtESV0ZQAn9u2Kt27Z4PCO0AjVTmySHQ/WYzqkjr E4KMLq4dBb8M0EQx8WJdewLC6x7giqSONqBA77wVj2JE9aGb+sT6LhlVw MeEgO3hyIoaYWVGtkWKjumrq43W5Hm5aZ8EQQcyyCiJVEevb3gx8PA/BT RPWTdG5i2KVKHtRVEVpRFqM0oSlPaWHfgzVOFq4gRDveJefw72eBRN60Y w==; IronPort-SDR: 9+/35tGZojSp8rwYJyJBqy4FmdUgIia0quEfYe14yoMr5tkX6Wx6Gy9U69ieinC6T0Bk4gWyfx UIjucbmltRAIVgyvLOstB4mIiLyzI2AryE3alcY8sCvv2y4u4xY7/W4Bq9lHVrdS1NkDjjPSrR uevRARxrGTya8wdpgs1mT8uIZm1xfYDXjinwg7Zk/Mqq0SAfZjHXZmHt40NgG6plcF4XjP0SLz QUHz/cBPC5pHTr8tpOzpWPhGbdc3F7jyAXK6AamwFHaDpqJKTiMmexJ63olBW92Lp7tnQ3RVhu eiE= X-IronPort-AV: E=Sophos; i="5.76,430,1592884800"; d="p7s'?scan'208"; a="2882277" IronPort-PHdr: =?us-ascii?q?9a23=3A/U/gBByzF4HnVIzXCy+O+j09IxM/srCxBDY+r6?= =?us-ascii?q?Qd0usSLvad9pjvdHbS+e9qxAeQG9mCtLQc06GL4+igATVGvc/f9ihaMdRlbF?= =?us-ascii?q?wssY0uhQsuAcqIWwXQDcXBSGgEJvlET0Jv5HqhMEJYS47UblzWpWCuv3ZJQk?= =?us-ascii?q?2sfQV6Kf7oFYHMks+5y/69+4HJYwVPmTGxfa5+IA+5oAnMtMQam5duJro+xh?= =?us-ascii?q?bJoXZDZuBayX91KV6JkBvw+8a98IR//yhMvv4q6tJNX7j9c6kkV7JTES4oM3?= =?us-ascii?q?oy5M3ltBnDSRWA634BWWgIkRRGHhbI4gjiUpj+riX1uOx92DKHPcLtVrA7RS?= =?us-ascii?q?6i76ZwRxD2jioMKiM0/3vWisx0i6JbvQ6hqhliyIPafI2ZKPxzdb7bcNgHR2?= =?us-ascii?q?ROQ9xRWjRBDI2icoUPE+QPM+VWr4b/oFUOrAexCga3CePg1jNIg2X73a0m3+?= =?us-ascii?q?g/FwzNwQwuH8gJsHTRtNj5OqcdXv6uzKnT0zrDa+hW1S/g44bGbxAuu/eMUq?= =?us-ascii?q?x+fcHMzkQgCg3EgUuLqYz+ITyV0v8NvnOF7+V+T+KvinUnqwB+ojip3Msjlo?= =?us-ascii?q?7JhocMx13C6C52z5o7K8eiR05nfd6rDoFQtyeCOoZ3Rs4uX31ktSYnxrAFpJ?= =?us-ascii?q?O2fycExZQ6yxDfd/CKboiF7xzsWuuTITl0mXxodryxiRu280WuxO/xWte63V?= =?us-ascii?q?hKsCZIlMTHuH4K1xzW8MeHS/1981+g2TmRywDT5PtIIUcularULZMq370+lo?= =?us-ascii?q?ILvEjeAiP6glj6ga2Ye0k+5+Sl6+rqbq/pq5KYL4N4lx3yPr4zlsG9Heg0KB?= =?us-ascii?q?UCUmeY9OimybHu/kv0S6hQgPIsiKnWqpXaKNwepq6+HgBazJ4u6w26Dze6yN?= =?us-ascii?q?QYmmQHLE5ddBKHkYfpP1bOLejlAPmjm1qgjTdkyejJMLLgHpnBMGLPkKn9cr?= =?us-ascii?q?Z68U5c0BA/wspC6J5OFLEBOunzWknruNPECR85NhS4w+fhCNpjyoMTQX+DDr?= =?us-ascii?q?ODPK/Ps1KF6PgjL/SMaYIbojrwJPwo6+brjXAjmF8deaep3YEQaHC9BvlpPk?= =?us-ascii?q?uYbmT3gtcaD2gKuhE+Qff0iFKcSz5TZm2yX6Mz5jE9Eo6pEYDDRoW1jLybwC?= =?us-ascii?q?i7BoFWZnxBCl2UDHjleZuLVvkSZy+cOcJhnTkEWqKgS48lzx2hqAj6y79/JO?= =?us-ascii?q?rO5iIYrY7j1MRy5+DLlBE96yd0D8uG3mGMUW50gm0ISyUx3KBlrkx30k2D3r?= =?us-ascii?q?Rgg/xECdxT4OtEXRogNZHGwex6F8n+WgPfcdeVRlaqW8ipATcqTtI2298Cel?= =?us-ascii?q?tyG9O5jhza3iuqBLkVmKKSCJMp86Lc0Gb+J91hy3rczqYhi10mT9BONWK4mq?= =?us-ascii?q?5/+RLfB4nTk0WWj6yqb7gT3DbR9GefymqDpFpYXxBsXqrYXHAffFDbrdXn6U?= =?us-ascii?q?PeQb+iE7MnMhFOyZ3KFqwfRtrvhFFKDNrqI8jaamG80zO8XhvTy+ikY4/jem?= =?us-ascii?q?Fb1yLYXhsqiQcWqDy5OBMlCyO65yryETVoGBinN0/z/PJlpXegZlE51QCRbk?= =?us-ascii?q?JnkbGy/0hG1rSnV/oP0+dc628aoDJuEQPl0g=3D=3D?= X-IPAS-Result: =?us-ascii?q?A2FCAAAE32Bf/zGZrQpdAxkBAQEBAQEBAQEBAQEBAQEBA?= =?us-ascii?q?QESAQEBAQEBAQEBAQEBQIFPgxosgQgKlUAmg3qGEpAogWkEBwEBAQEBAQEBA?= =?us-ascii?q?QQEASUKBAEBAoRJAoIhJTgTAgMBAQsBAQEFAQEBAQEGAwEBAQKGRQyCNyJ7g?= =?us-ascii?q?QMBAQEBAQEBAQEBAQEBAQEBAQEBFgJDVRIBAR0BAQEBAgEnUgULAgEIDgMDA?= =?us-ascii?q?QIBFRkCHxEdCAIEDgUOgxgBgksDDhEemU6aZnSBATOIKw2CFAoGgTiBU4R4h?= =?us-ascii?q?R4lgTmBQj6BEScMEIFPfj6CGkICgRhGGAkBHgiDA4ItBItIhDYEByQJigmLT?= =?us-ascii?q?I98N1EDB4JlhEGCX4FSi2FphQkemn2FcZ1EgmeOToNaAgQCBAUCFYFrgXtwF?= =?us-ascii?q?RohKgGCCgEBMj4SFwINjigCAReIYoVCdDQDAgYKAQEDCY4MLYEGMQFfAQE?= Received: from BRN1WNEX01.vcorp.ad.vrsn.com (10.173.153.48) by BRN1WNEX02.vcorp.ad.vrsn.com (10.173.153.49) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1979.3; Tue, 15 Sep 2020 11:38:31 -0400 Received: from BRN1WNEX01.vcorp.ad.vrsn.com ([fe80::a89b:32d6:b967:337d]) by BRN1WNEX01.vcorp.ad.vrsn.com ([fe80::a89b:32d6:b967:337d%4]) with mapi id 15.01.1979.003; Tue, 15 Sep 2020 11:38:31 -0400 From: "Wessels, Duane" To: Donald Eastlake CC: "iesg@ietf.org" , "draft-ietf-dnsop-dns-zone-digest.all@ietf.org" , secdir Thread-Topic: [EXTERNAL] SECDIR review of draft-ietf-dnsop-dns-zone-digest-09 Thread-Index: AQHWi3ZE5xMDPmexIk+d7zxnprv/mA== Date: Tue, 15 Sep 2020 15:38:31 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-mailer: Apple Mail (2.3445.104.15) x-originating-ip: [10.170.148.18] Content-Type: multipart/signed; boundary="Apple-Mail=_7D80AD86-88C6-4582-B6B1-062F891B026B"; protocol="application/pkcs7-signature"; micalg=sha-256 MIME-Version: 1.0 Archived-At: Subject: Re: [secdir] SECDIR review of draft-ietf-dnsop-dns-zone-digest-09 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 15 Sep 2020 15:38:37 -0000 --Apple-Mail=_7D80AD86-88C6-4582-B6B1-062F891B026B Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Thanks Don for the extensive review! tl;dr, we did accept most/many of = your suggestions already, except these items may warrant further = discussion: - minimum digest length - more hash algorithms than SHA-384 - local policy when verifying multiple digests - implementation status section More responses inline below. DW > On Sep 12, 2020, at 6:53 PM, Donald Eastlake wrote: >=20 > Trying again with the correct subject line. >=20 > Sorry, > Donald > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D > Donald E. Eastlake 3rd +1-508-333-2270 (cell) > 2386 Panoramic Circle, Apopka, FL 32703 USA > d3e3e3@gmail.com >=20 > ---------- Forwarded message --------- > From: Donald Eastlake > Date: Sat, Sep 12, 2020 at 1:20 PM > Subject: SECDIR review of draft-ietf-dnsop-dns-zone-review-09 > To: iesg@ietf.org , > > Cc: secdir >=20 >=20 > I have reviewed this document as part of the security directorate's > ongoing effort to review all IETF documents being processed by the > IESG. Document editors and WG chairs should treat these comments just > like any other last call comments. >=20 > The summary of the review is Ready with Issues. >=20 > Notwithstanding that I have a lot of comments below, I think the idea > in this draft is a good one and look forward to its approval by the > IESG. >=20 >=20 > SECURITY ISSUES >=20 > 1) The document claims that the presence of ZONEMD enables someone > holding the zone data to be able to determine its "authenticity" even > in the absence of DNSSEC. While it is not clear exactly what is meant > by "authenticity", I think this is misleading. I think that, at best, > without DNSSEC, you can test the data's "integrity". This is still > useful to protect again corruption and errors. But as I understand it, > "authenticity" takes a lot more machinery to test, such as the DNSSEC > mechanisms. >=20 > OLD (Section 1) > It allows a receiver of the > zone to verify the zone's authenticity, especially when used in > combination with DNSSEC. >=20 > NEW > It allows a receiver of the > zone to verify the zone's integrity and, when used in > combination with DNSSEC, its authenticity. A good change, thanks. >=20 > There is a similar problem with the first paragraph of Section 6.1. Accepted your text in that section as well. >=20 > 2) The minimum size of the Digest Field, 1 octet, seems too small. > Typical minimum size for such a field in IETF protocols seems to be 96 > bits or 12 octets, so that, at least with a strong hash function, you > have a reasonable resistance against brute force attacks. Also, while > it is fairly obvious, you might want to mention how a receiver > determines the length of the Digest Field. >=20 > OLD (Section 2.2.4) > The Digest field must not be empty. >=20 > NEW > The Digest Field MUST NOT be shorter than 12 octets. If it is, the > ZONEMD RR containing that short digest cannot be used to verify a > zone. The length of the digest field is determined by deducting the > fixed size of the Serial, Scheme, and Hash Algorithm fields from the > RDATA size in the ZONEMD RR header. I'm not necessarily opposed to a minimum digest size. Do you envision any complications with private use algorithms though? It seems a little strange to allow private use algorithms whose digest value could be = anything, but requiring a minimum size (which could then simply be padded I know). >=20 > 3) SHA384 / algorithm agility > -- here are some thoughts/comments on SHA384 and algorithm agility: >=20 > 3a) SHA384 is a strong hash algorithm and is excellent for integrity > checking and the like but initially I was wondering if an algorithm = with a > cryptographically stronger structure would be better if one is trying > to protect against active adversaries, even if the hash were shorter. > For example, HMAC-SHA2-256 which takes about as much computation as > SHA2-384. (Could be keyed by the "ZONEMD" concatenated with the zone > name.) But on further thought, DNSSEC strengthens things a lot. ZONEMD > will be covering not just the SOA serial but also the Signature > Expiration and Inception fields in the DNSSEC signatures. So, while I > haven't done a deep analysis, the more I think about it the more it > seems like a strong straightforward hash like SHA2-384 is OK. Understood. >=20 > 3b) The draft lists only SHA2-384 but never says that it MUST be > implemented. Although it's fairly obvious, it seems to me the draft > should explicitly say that somewhere. Agreed. Thanks for the text. >=20 > 3c) The draft never says how long the Digest Field should be when you > use SHA384 -- presumably 48 bytes -- and what to do if the Digest > Field is the wrong length -- presumably not use the ZONEMD for > validation. (Presumably just add some text to 5.C. in Section 4.) Added. >=20 > 3c) SHA2-384 is just SHA2-512 with some different initialization > values and with the 512 bit output truncated to 384. Thus the > incremental effort of providing SHA2-512 in tiny if you have SHA2-384 > (and vice versa). So, if SHA2-384 is mandatory, then you might as well > make SHA2-512 mandatory also since you get it for probably <1% > incremental effort. Having two mandatory algorithms with some people > using one and some the other would provide some real confidence that > implementations were actually looking at the Hash Algorithm Field, > could handle Digest Fields of different length, etc., and the > algorithm agility mechanisms might actually work. It currently looks a > bit like only lip service is being paid to algorithm agility. In an earlier version of the draft, four algorithms were defined, = although none "past" SHA-384. There was a (Oct 2018) discussion to make SHA-384 the mandatory algorithm and drop all the weaker ones. I'm not necessarily opposed to adding more mandatory-to-implement = algorithms if there is working group consensus about that, but it feels like a = pretty significant and late change? >=20 > 3d) On algorithm agility generally: There is a reasonable provision in > the ZONEMD RR for a hash algorithm identifier. But, given that this > is Standards Track I would have expected there to be hash algorithms > specified of different types with one a MUST implement and one a > SHOULD implement -- possible more but at least that. Blake or SHA3 > would be example of a different algorithm type from SHA2. But I admit > that SHA2-384/512 is very strong and a break in it significant enough > to make much difference seems very unlikely. Same as above. >=20 > 4) There is no mention of local policy. If at some point there are > multiple hash algorithms and/or schemes specified (which could include > private use algorithms and schemes), a ZONEMD zone validator would > likely need a local policy as to which algorithm/scheme digest it will > pay attention to. See, for example, the first paragraph of Section 4 > which assumes any good digest should be good enough to validate the > zone for any verifier. The draft-ietf-dnsop-dns-zone-digest-00 version did have the following = text that spoke to this:=20 > It is RECOMMENDED that implementations maintain a (possibly > configurable) list of supported Digest Type algorithms ranked from > most to least preferred. It is further RECOMMENDED that recipients > use only their most preferred algorithm that is present in the zone > for digest verification. >=20 > As a matter of local policy, the recipient MAY require that all > supported and present Digest Type algorithms verify the zone. There was a thread on DNSOP where we had agreement to take those two paragraphs out: https://mailarchive.ietf.org/arch/msg/dnsop/RFCklH7Lx00bL-tOVRCAc0j5ftw/ >=20 > 5) I'm not sure about the choice of "resilience" and "fragility" in > Section 6.3 without a bit more context as, at first, they seem > contradictory. See attached for one suggestion on this. Suggestion accepted. >=20 > It is great that examples are included but I did not check them for > correctness. >=20 >=20 > IANA CONSIDERATIONS >=20 > A number of points: >=20 > 6. For both the Scheme and Hash Algorithm registries: > 6a. Value 255 should be listed as Reserved. > 6b. Values 2-239 should be listed as Unassigned. > 6c. Having a "RESERVED" mnemonic seems odd, I don't think I've seen it > before. People usually just put a hyphen in the mnemonic column. > 6d. In the rightmost "Reference Column", for things like Reserved or > Private Use, the usual thing is to either just put a hyphen ("-") or > to just say "[this document]". I don't think I have seen RFC 8126 > given as a reference. Thanks, the tables have been changed per your suggestions. > 6e. Actually, 240-254 seems like a lot of values for Private Use. Why > would you need 15 private hash algorithms within one administrative > area? If you think there are going to be lots of private/proprietary > hashes (national vanity crypto?) that get used moderately widely, > there should be a provision for "vendor specific" hash algorithms > where the "Digest Field" actually starts with a "vendor" identifier. It seemed a reasonable amount to us, but if others think it should be smaller that shouldn't be a problem. >=20 > 7. I don't think all the references to RFC 8126 are needed. These are > all standard IANA terms. It would seem adequate to rename the > "Requirements Language" section to "Terminology" and add one sentence > saying "The terms Private Use, Reserved, Unassigned, and Specification > Required are to be interpreted as defined in [RFC8126]." Then all > other references to 8126 can be deleted. (You might need some DNS > related entries in a Terminology section anyway. I have significant > DNS background so I didn't feel any need for acronyms to be explained > or the like but that might not be true of a general reader.) >=20 Thanks, this has been fixed. >=20 > GENERAL >=20 > 8. Sub-optimal ordering/grouping >=20 > 8a. The sentence immediately before the Section 1.1 header, which give > the implementation requirement for ZONEMD, seems a little confusing > right after the preceding paragraph on DNSSEC. I think the sentence > should be moved up before the DNSSEC paragraph. >=20 > 8b. In Section 1.1 on Motivation, I think only the first paragraph is > reasonably described by the section title. All of the rest of 1.1 is > "1.2 Alternative Approaches" or something like that. Done. >=20 > 9. Chronological terminology >=20 > I don't like all of the occurrences of "currently" or "at this time" > in the document. How likely are these phrases to be true 20 years > after this is published as an RFC? In many cases, this can be replaced > by using "herein" or the like except in Section 7 (Performance > Considerations) where some specific year or part of a year could be > given. Done. >=20 > 10. There are a number of instances of "must", "must not", or > "recommended" that I think should be in all capital letters. See > attached markup. Done. >=20 > 11. Verbosity >=20 > The document has a generally conversational style with some empty > filler words that don't add anything scattered here and there. While > this is all a matter of taste, I suggest the following: >=20 > 11a. All occurrences of "certainly" and "Note that" should be > eliminated. >=20 > 11b Instead of saying "x can be used to y" or "x is designed to do y" > just say "x does y" or the like. >=20 > 11b. There are three statements in three different parts of the draft > (Sections 2., 3.1, and 4.) to the effect that > "When multiple ZONEMD RRs are present, each > must specify a unique Scheme and Hash Algorithm tuple." > I'm not sure what the best thing to do about this is but as long as > the validation section makes it clear that such redundant occurrences > mean none of them validate the zone, you are OK. >=20 > 11c. See other instances of what I think is unnecessary wordiness and > suggested changes in the attached. Done. >=20 > 12. Having an Implementation Status section (Section 10) is good while > a draft is going through the approval process, but I think it is, as > indicated in RFC 7942, inappropriate in a resulting standards track > RFC. Furthermore, all of the disclaimer text given in RFC 7942 is > missing here. So, I believe similar disclaimer text should be added > and the RFC Editor should be requested to drop this section before > publication. The authors feel it could be useful, even though it is expected to become out-of-date. Looks like some other published RFCs have kept their Implementation Status sections, sometimes as an appendix? >=20 >=20 > TYPOS >=20 > 13. The only actual typo kind of errors I found were "the the" -> > "the" in Section 7.1 and "can not" -> "cannot" in Section 4. >=20 >=20 > ATTACHMENT >=20 > Taking into account the above and to make other editorial suggestions, > I have done an editing pass over the draft the results of which are > attached. I hope you find it helpful. >=20 Thank you, we did find it very helpful. --Apple-Mail=_7D80AD86-88C6-4582-B6B1-062F891B026B Content-Disposition: attachment; filename="smime.p7s" Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCDbgw ggZgMIIFSKADAgECAhB2hcsHqODMD9LFTY85NbMSMA0GCSqGSIb3DQEBBQUAMIHKMQswCQYDVQQG EwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5l dHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQg dXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDIgUHVibGljIFByaW1hcnkgQ2VydGlm aWNhdGlvbiBBdXRob3JpdHkgLSBHMzAeFw0xMTA2MDcwMDAwMDBaFw0yMTA2MDYyMzU5NTlaMIHJ MQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5 bWFudGVjIFRydXN0IE5ldHdvcmsxNTAzBgNVBAsTLENsYXNzIDIgTWFuYWdlZCBQS0kgSW5kaXZp ZHVhbCBTdWJzY3JpYmVyIENBMUMwQQYDVQQDEzpTeW1hbnRlYyBDbGFzcyAyIFNoYXJlZCBJbnRl cm1lZGlhdGUgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB CgKCAQEAt/g/DCuDIyCFpk1JAVE62t1QM77jBKQ6PqNhZkw0wuh0cHVJpbdJ7N2zkpzdeQ3iufq4 OTy+heOM7215o6a3CL+cTL4+mI6s23yaK+wFKDBfKRszTUTVcOhWIpmmPp1CW+sjp2OdLSywLj8Y 8ynNGjaJhJLHV3BbcIXmOKF8UOM3OIhlW2vLOSoEsYKqGQT/oH8/o9uRRXZmo2vzhSNeTtmFXXWn oBX3wQB04OXKlEJlmsI3eouoUKy/l3Rnd9Eyp6+Ny5OpJUK0MBp0CuIlEBDLdGdVD8sU/EFQCqR8 TQsL+QWpNflFpzHxgLuiyT7OdjnhKv92UOfoUSLfLc+4MwIDAQABo4ICPzCCAjswEgYDVR0TAQH/ BAgwBgEB/wIBADA0BgNVHR8ELTArMCmgJ6AlhiNodHRwOi8vY3JsLnZlcmlzaWduLmNvbS9wY2Ey LWczLmNybDAOBgNVHQ8BAf8EBAMCAQYwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVZlcmlTaWdu TVBLSS0yLTU2MB0GA1UdDgQWBBTYSCmoXyoXkuL6nnvvb2CD+Li43DCB8AYDVR0jBIHoMIHloYHQ pIHNMIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl cmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJbmMuIC0g Rm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDIgUHVibGlj IFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHM4IQYXDLSYxfmEUp57Cm2VBbejA0 BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnZlcmlzaWduLmNvbTBsBgNV HSAEZTBjMGEGC2CGSAGG+EUBBxcCMFIwJgYIKwYBBQUHAgEWGmh0dHA6Ly93d3cuc3ltYXV0aC5j b20vY3BzMCgGCCsGAQUFBwICMBwaGmh0dHA6Ly93d3cuc3ltYXV0aC5jb20vcnBhMA0GCSqGSIb3 DQEBBQUAA4IBAQCmKpsHQMns/7OI6EXaNNEXDygtt6WFZzHNwebVKYY4rOLwWRsM4aFFziR472nB sExhokjZaE+6/nVUN7pYaerBdqU2QuqeZniQINmVaiR5VM3eWhqKO64YlXLQJdjSRr40MKeAnvFW ziAebGfJTU95h4niLoDWnu0mYWWiA9DF4vMouStJaYJn7NXpNKQu3GIipIVNSONqApTyzf3kZ8hJ vKrVx+c83oexEGtdB1wZ5Gug9E+Zy9y1WwzMMvlq5HTAKlg3ebP7zcM0b+F23RAHAGOLB04nF5JH mw6+3g0ThRH8oi9lfcw6rB5Ua1ZnxO6lhyIjFytwVsPxrndcJ8E5MIIHUDCCBjigAwIBAgIQUgHO uRrE8f0+lHpp6LMu3zANBgkqhkiG9w0BAQsFADCByTELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5 bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMTUwMwYD VQQLEyxDbGFzcyAyIE1hbmFnZWQgUEtJIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQTFDMEEGA1UE AxM6U3ltYW50ZWMgQ2xhc3MgMiBTaGFyZWQgSW50ZXJtZWRpYXRlIENlcnRpZmljYXRlIEF1dGhv cml0eTAeFw0yMDAzMjQwMDAwMDBaFw0yMTA0MjIyMzU5NTlaMHAxJDAiBgkqhkiG9w0BCQEWFWR3 ZXNzZWxzQHZlcmlzaWduLmNvbTEXMBUGA1UEAwwOV2Vzc2VscywgRHVhbmUxFjAUBgNVBAsMDUVO VEVSUFJJU0UgSVQxFzAVBgNVBAoMDlZlcmlTaWduLCBJbmMuMIIBIjANBgkqhkiG9w0BAQEFAAOC AQ8AMIIBCgKCAQEAwbeXxaBWlxe5DxiPcGA+avq1cFigXZu2lAVx5DMmtWuUx8s+am03tuwU7tw6 xHG4sfrR9d2BucS54VpdZGxZO0ShzZ0WDatTINezhPQTh0Xumy2dbc8d7xTlSa2ZGGw/Zq78jq4C 7f3dEMMk7pqY+gBIE9d7GdjQYkwrF558PKIQIzUAcxVLTLhOqcmnA2g0WaTxWEjev2LdC41G15z8 ZIEJDWGfd7lWLNKrD4p9vG+aKTbxEaaKcRj7ZQCFbqNNAQA0YFf2xtvgUHQIh+ciuCKBlwiTVkCl KZpGkfTx0tSE47BvtNkAFxqyKTNNYrceG7/g7KaxynTfKO7zYjO1uQIDAQABo4IDijCCA4YwDAYD VR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBaAwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwQwHQYDVR0O BBYEFFaFSmgtcRDwfRFiqt3Vq8LJCLn5MCAGA1UdEQQZMBeBFWR3ZXNzZWxzQHZlcmlzaWduLmNv bTAfBgNVHSMEGDAWgBTYSCmoXyoXkuL6nnvvb2CD+Li43DCCAXAGCCsGAQUFBwEBBIIBYjCCAV4w JwYIKwYBBQUHMAGGG2h0dHA6Ly9wa2ktb2NzcC5zeW1hdXRoLmNvbTCCATEGCCsGAQUFBzAChoIB I2xkYXA6Ly9kaXJlY3Rvcnkuc3ltYXV0aC5jb20vQ04lMjAlM0QlMjBTeW1hbnRlYyUyMENsYXNz JTIwMiUyMFNoYXJlZCUyMEludGVybWVkaWF0ZSUyMENlcnRpZmljYXRlJTIwQXV0aG9yaXR5JTJD T1UlMjAlM0QlMjBDbGFzcyUyMDIlMjBNYW5hZ2VkJTIwUEtJJTIwSW5kaXZpZHVhbCUyMFN1YnNj cmliZXIlMjBDQSUyQ09VJTIwJTNEJTIwU3ltYW50ZWMlMjBUcnVzdCUyME5ldHdvcmslMkNPJTIw JTNEJTIwU3ltYW50ZWMlMjBDb3Jwb3JhdGlvbiUyQ0MlMjAlM0QlMjBVUz9jQUNlcnRpZmljYXRl O2JpbmFyeTBdBgNVHR8EVjBUMFKgUKBOhkxodHRwOi8vcGtpLWNybC5zeW1hdXRoLmNvbS9jYV8w N2JiN2Q2NDc3Y2Y0ZjZiZTk2YWYxYjM2Y2FiZDMxNi9MYXRlc3RDUkwuY3JsMGwGA1UdIARlMGMw YQYLYIZIAYb4RQEHFwIwUjAmBggrBgEFBQcCARYaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9jcHMw KAYIKwYBBQUHAgIwHBoaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9ycGEwQgYJKoZIhvcNAQkPBDUw MzAKBggqhkiG9w0DBzALBglghkgBZQMEAQIwCwYJYIZIAWUDBAEWMAsGCWCGSAFlAwQBKjAsBgpg hkgBhvhFARADBB4wHAYSYIZIAYb4RQEQAQICAQGL8cYJFgYyNDc2NjQwOQYKYIZIAYb4RQEQBQQr MCkCAQAWJGFIUjBjSE02THk5d2Eya3RjbUV1YzNsdFlYVjBhQzVqYjIwPTANBgkqhkiG9w0BAQsF AAOCAQEAeD6Ith/v5S1X1k35R2h8AK4YbmVNDgPivPZcQcpKRJ6YntyZf9l2e19igK2d0floI6ez PCEEGUwQArGOBc9nBrEPDioIq2WJCPshT4/fk2UdOo9+Yc80JlhPE3eU3HkYhu0B33Hj3tjc5g60 Y+wdR2jInSF+LnvP66yJthoXLID1NpkhitIx52m5MkKPZTxb/SHVI2MQ5x4DWtr+Obe/+YCRQ/K2 UzMSVXmVwdHLpUrm4P4uyWQ2ZuIwFbnLl7OtwKOZIaQxqXDI/jWO65hVqHgiRc1Sao/lYtKfu/jC dmXM6v0Sd+t4dJFEjH2a1gqsf4DraqnvJ4Ak6RNTCazfUTGCBF0wggRZAgEBMIHeMIHJMQswCQYD VQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVj IFRydXN0IE5ldHdvcmsxNTAzBgNVBAsTLENsYXNzIDIgTWFuYWdlZCBQS0kgSW5kaXZpZHVhbCBT dWJzY3JpYmVyIENBMUMwQQYDVQQDEzpTeW1hbnRlYyBDbGFzcyAyIFNoYXJlZCBJbnRlcm1lZGlh dGUgQ2VydGlmaWNhdGUgQXV0aG9yaXR5AhBSAc65GsTx/T6Uemnosy7fMA0GCWCGSAFlAwQCAQUA oIICTzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0yMDA5MTUxNTM4 MzFaMC8GCSqGSIb3DQEJBDEiBCDYIGy9M5obuQ3vLWmSzK/Q6yPRa2D1S4dSWpsY2lFWDzCB7wYJ KwYBBAGCNxAEMYHhMIHeMIHJMQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9y YXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxNTAzBgNVBAsTLENsYXNzIDIg TWFuYWdlZCBQS0kgSW5kaXZpZHVhbCBTdWJzY3JpYmVyIENBMUMwQQYDVQQDEzpTeW1hbnRlYyBD bGFzcyAyIFNoYXJlZCBJbnRlcm1lZGlhdGUgQ2VydGlmaWNhdGUgQXV0aG9yaXR5AhBSAc65GsTx /T6Uemnosy7fMIHxBgsqhkiG9w0BCRACCzGB4aCB3jCByTELMAkGA1UEBhMCVVMxHTAbBgNVBAoT FFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMTUw MwYDVQQLEyxDbGFzcyAyIE1hbmFnZWQgUEtJIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQTFDMEEG A1UEAxM6U3ltYW50ZWMgQ2xhc3MgMiBTaGFyZWQgSW50ZXJtZWRpYXRlIENlcnRpZmljYXRlIEF1 dGhvcml0eQIQUgHOuRrE8f0+lHpp6LMu3zANBgkqhkiG9w0BAQEFAASCAQClFhjCF6Hp+RyQvE9A PkgYUHQZsKX8wXwG1XspfN+GRD+QGYh7ip5UTjQo9E1fh1SfsSWsTMv+k8dURISWCMfKuxtggOTn iMaIm8mIsVELh2wyNwy+CuZYBEfRBQ//Ek2/dfNpYcjXCqnOqP1jzF82xFJL5o0i3b3CW+5ZBZhA K4RYFMP/42Jh2Ql/7xUgHg0JkS9Cg72J2ANLRJ+jje1CTvJHkCpIX8O7jD9fy3K1u2EyxtkjgFB9 B0S/bAEhN6IEjqS8XfB8vKh9pzfrx45A6jplPmGAlbfN0NZ6BsMtSdmbzvlR2K65piHtwji/HzmN d/EEN3CwcVUSIR9bFMofAAAAAAAA --Apple-Mail=_7D80AD86-88C6-4582-B6B1-062F891B026B-- From nobody Tue Sep 15 19:35:16 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D14B33A0CCB; Tue, 15 Sep 2020 19:35:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.847 X-Spam-Level: X-Spam-Status: No, score=-1.847 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id A5PfMGuMJWZx; Tue, 15 Sep 2020 19:35:08 -0700 (PDT) Received: from mail-il1-x130.google.com (mail-il1-x130.google.com [IPv6:2607:f8b0:4864:20::130]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4967D3A0CCA; Tue, 15 Sep 2020 19:34:53 -0700 (PDT) Received: by mail-il1-x130.google.com with SMTP id f82so5009599ilh.8; Tue, 15 Sep 2020 19:34:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=rCXuHDiMKIqNJIUZmZAIEB4qMGKTDTsjBwY+QjpyxYw=; b=Evaxk8OGg8L6QSgWCuXJJ6zoJKm1nUqHxNioE3w79KZ42RwcFDwCUuNTDeZcm3RjCt RmvJ3CJvBrx7aAXXpX2Qp44EREirheHd4YV8DnvWYNMZGFdnxltgHn5BddEH1nzkcBxb N7Xd3IZQpbAR6RHAlkYP4IWuQe8g5w4U9JWPGi8+/jL/tgRdNI+QN5BerlB8H84/M9si GfkUo4ft8eUU4g2ae0vYhYm7Cocz+dHSUf+2mC+LVZsVQuqeB3IIavh9mMtHkWaYz84O nobIjBOGhFNzN0IQGzpXRAhtbwDnlKbKvB3zUleHY2/lpebzO083WBG7ETtGyuqGHXmK u9XA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=rCXuHDiMKIqNJIUZmZAIEB4qMGKTDTsjBwY+QjpyxYw=; b=XuqToHoN1G3AQ3wgpWXHBBdq2AQlfWjYErjYqoM09SJtFZHKCsAaaOoOx1H0yctc3T VxdWUjbkaPrkfAiXnjmyq8X7vYjd/kgZA4sZigleQzQfsgBEQ21o8PO++ojq2MH+pmB4 gbmG9zxXZC1hPXlze2OXNtuWPil42bB20zt1epkG+Sge0EWBC4SEh8TalVxVLOJLimOc 3reoDAMNHEKpgLxJ8ifJlYA9/PlDRAExQSMxLDIHYyO8lrj29NTv03bJECqIYPgXSgZT ruzjjVBT9ZFaNpG7zlmKhXBu52oZF3bjdpLgVseDmKjmqGkHCdo1q2UQI+53vtlhdQJJ B0aw== X-Gm-Message-State: AOAM532mVjQ+A+9wK/srVeVk8j5+f9Q36mlW2GTucbsdUZMlZhbElRMg lpoyDjnSwtl6WapHKiicKVzaToGWUGLn1cH64lQ= X-Google-Smtp-Source: ABdhPJwbIr/574RHmMKGbWPJ4hPpkVgO+OXmSktx76xOYivbX4R6AVlZ288sIjHvZr4Tvt52rgLxdLle0udZv5pY0yc= X-Received: by 2002:a05:6e02:df1:: with SMTP id m17mr17435255ilj.276.1600223692326; Tue, 15 Sep 2020 19:34:52 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Donald Eastlake Date: Tue, 15 Sep 2020 22:34:40 -0400 Message-ID: To: "Wessels, Duane" Cc: "iesg@ietf.org" , "draft-ietf-dnsop-dns-zone-digest.all@ietf.org" , secdir Content-Type: multipart/alternative; boundary="000000000000be4f4605af651ce5" Archived-At: Subject: Re: [secdir] SECDIR review of draft-ietf-dnsop-dns-zone-digest-09 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Sep 2020 02:35:11 -0000 --000000000000be4f4605af651ce5 Content-Type: text/plain; charset="UTF-8" Hi Duane, Thanks for accepting most of my suggestions. See my responses below at on the items we are still discussing. On Tue, Sep 15, 2020 at 11:38 AM Wessels, Duane wrote: > Thanks Don for the extensive review! tl;dr, we did accept most/many of > your suggestions already, except these items may warrant further discussion: > > - minimum digest length > - more hash algorithms than SHA-384 > - local policy when verifying multiple digests > - implementation status section > > More responses inline below. > > DW > > > On Sep 12, 2020, at 6:53 PM, Donald Eastlake wrote: > > > ... > > > > 2) The minimum size of the Digest Field, 1 octet, seems too small. > > Typical minimum size for such a field in IETF protocols seems to be 96 > > bits or 12 octets, so that, at least with a strong hash function, you > > have a reasonable resistance against brute force attacks. Also, while > > it is fairly obvious, you might want to mention how a receiver > > determines the length of the Digest Field. > > > > OLD (Section 2.2.4) > > The Digest field must not be empty. > > > > NEW > > The Digest Field MUST NOT be shorter than 12 octets. If it is, the > > ZONEMD RR containing that short digest cannot be used to verify a > > zone. The length of the digest field is determined by deducting the > > fixed size of the Serial, Scheme, and Hash Algorithm fields from the > > RDATA size in the ZONEMD RR header. > > I'm not necessarily opposed to a minimum digest size. Do you envision > any complications with private use algorithms though? It seems a little > strange to allow private use algorithms whose digest value could be > anything, > but requiring a minimum size (which could then simply be padded I know). > Well, it looked to me like the draft already had a minimum Digest field, namely one octet, since it said the Digest Field couldn't be empty. As I recall, the digest didn't say what to do if the Digest field was zero length but I presume it would mean that the ZONEMD RR was malformed and thus could not be used to validate a zone. Seems like the minimum length would apply to private use algorithms also. See Section 5.2.2.1 of https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-rfc2845bis-09 > 3) SHA384 / algorithm agility > > -- here are some thoughts/comments on SHA384 and algorithm agility: > ... > > > > 3c) SHA2-384 is just SHA2-512 with some different initialization > > values and with the 512 bit output truncated to 384. Thus the > > incremental effort of providing SHA2-512 in tiny if you have SHA2-384 > > (and vice versa). So, if SHA2-384 is mandatory, then you might as well > > make SHA2-512 mandatory also since you get it for probably <1% > > incremental effort. Having two mandatory algorithms with some people > > using one and some the other would provide some real confidence that > > implementations were actually looking at the Hash Algorithm Field, > > could handle Digest Fields of different length, etc., and the > > algorithm agility mechanisms might actually work. It currently looks a > > bit like only lip service is being paid to algorithm agility. > > In an earlier version of the draft, four algorithms were defined, although > none "past" SHA-384. There was a (Oct 2018) discussion to make SHA-384 > the mandatory algorithm and drop all the weaker ones. > > I'm not necessarily opposed to adding more mandatory-to-implement > algorithms > if there is working group consensus about that, but it feels like a pretty > significant and late change? > I agree it is a significant change in the draft. But, as I say, if you have SHA-384 you have 99+% of the crypto code you need for SHA-384 and SHA-512. Of course, SHA-512 has an even longer value, 64 bytes, but with just one or at most a few ZONEMD RRs at the zone apex, that does not seem to be a problem. Of my security comments, I rate adding a 2nd hash algorithm as the most important. It could be that the 2nd algorithm would be a SHOULD rather than a MUST. And, if a second algorithm is added, I think SHA-512 would be the easiest for implementers. > > 3d) On algorithm agility generally: There is a reasonable provision in > > the ZONEMD RR for a hash algorithm identifier. But, given that this > > is Standards Track I would have expected there to be hash algorithms > > specified of different types with one a MUST implement and one a > > SHOULD implement -- possible more but at least that. Blake or SHA3 > > would be example of a different algorithm type from SHA2. But I admit > > that SHA2-384/512 is very strong and a break in it significant enough > > to make much difference seems very unlikely. > > Same as above. > Response above. > 4) There is no mention of local policy. If at some point there are > > multiple hash algorithms and/or schemes specified (which could include > > private use algorithms and schemes), a ZONEMD zone validator would > > likely need a local policy as to which algorithm/scheme digest it will > > pay attention to. See, for example, the first paragraph of Section 4 > > which assumes any good digest should be good enough to validate the > > zone for any verifier. > > The draft-ietf-dnsop-dns-zone-digest-00 version did have the following > text that spoke to this: > > > It is RECOMMENDED that implementations maintain a (possibly > > configurable) list of supported Digest Type algorithms ranked from > > most to least preferred. It is further RECOMMENDED that recipients > > use only their most preferred algorithm that is present in the zone > > for digest verification. > > > > As a matter of local policy, the recipient MAY require that all > > supported and present Digest Type algorithms verify the zone. > > There was a thread on DNSOP where we had agreement to > take those two paragraphs out: > > https://mailarchive.ietf.org/arch/msg/dnsop/RFCklH7Lx00bL-tOVRCAc0j5ftw/ I went and read that thread. I agree that the text removed was kind of complex. I was just worried that the text in Section 4 too strongly implied that an implementation must accept a zone if a ZONEMD validates. True, it does have text about "supporting" the Scheme and Hash Algorithm but conceivable you could support a Scheme and a Hash Algorithm but have a policy against accepting a ZONEMD RR that combined them and in any case I suspect the draft is using "supported" in the sense of "implemented". I'd be happy with adding just one sentence in Section 4 something like "The verifier MAY ignore a ZONEMD if the Scheme and Hash Algorithm violates local policy." ... > > 6e. Actually, 240-254 seems like a lot of values for Private Use. Why > > would you need 15 private hash algorithms within one administrative > > area? If you think there are going to be lots of private/proprietary > > hashes (national vanity crypto?) that get used moderately widely, > > there should be a provision for "vendor specific" hash algorithms > > where the "Digest Field" actually starts with a "vendor" identifier. > > It seemed a reasonable amount to us, but if others think it should be > smaller that shouldn't be a problem. > OK. It isn't gigantic or anything, just a bit larger than the 3 or 4 or so values I typically see. ... > > 12. Having an Implementation Status section (Section 10) is good while > > a draft is going through the approval process, but I think it is, as > > indicated in RFC 7942, inappropriate in a resulting standards track > > RFC. Furthermore, all of the disclaimer text given in RFC 7942 is > > missing here. So, I believe similar disclaimer text should be added > > and the RFC Editor should be requested to drop this section before > > publication. > > The authors feel it could be useful, even though it is expected to > become out-of-date. Looks like some other published RFCs have kept > their Implementation Status sections, sometimes as an appendix? > OK... I think that if retained it would be much better as an appendix. ... > > ATTACHMENT > > > > Taking into account the above and to make other editorial suggestions, > > I have done an editing pass over the draft the results of which are > > attached. I hope you find it helpful. > > Thank you, we did find it very helpful. > You're welcome. Donald =============================== Donald E. Eastlake 3rd +1-508-333-2270 (cell) 2386 Panoramic Circle, Apopka, FL 32703 USA d3e3e3@gmail.com --000000000000be4f4605af651ce5 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Duane,

T= hanks for accepting most of my suggestions.

See my res= ponses below at <de> on the items we are still discussing.

On Tue, Sep 15, 2020 at 11:38 AM Wessels, Duane <dwessels@verisign.com> wrote:
Thanks Don for the extensive = review!=C2=A0 tl;dr, we did accept most/many of your suggestions already, e= xcept these items may warrant further discussion:

- minimum digest length
- more hash algorithms than SHA-384
- local policy when verifying multiple digests
- implementation status section

More responses inline below.

DW

> On Sep 12, 2020, at 6:53 PM, Donald Eastlake <d3e3e3@gmail.com> wrote:
>
...
>
> 2) The minimum size of the Digest Field, 1 octet, seems too small.
> Typical minimum size for such a field in IETF protocols seems to be 96=
> bits or 12 octets, so that, at least with a strong hash function, you<= br> > have a reasonable resistance against brute force attacks. Also, while<= br> > it is fairly obvious, you might want to mention how a receiver
> determines the length of the Digest Field.
>
> OLD (Section 2.2.4)
> The Digest field must not be empty.
>
> NEW
> The Digest Field MUST NOT be shorter than 12 octets. If it is, the
> ZONEMD RR containing that short digest cannot be used to verify a
> zone.=C2=A0 The length of the digest field is determined by deducting = the
> fixed size of the Serial, Scheme, and Hash Algorithm fields from the > RDATA size in the ZONEMD RR header.

I'm not necessarily opposed to a minimum digest size.=C2=A0 Do you envi= sion
any complications with private use algorithms though?=C2=A0 It seems a litt= le
strange to allow private use algorithms whose digest value could be anythin= g,
but requiring a minimum size (which could then simply be padded I know).
=C2=A0
<de> Well, it looked to me like t= he draft already had a minimum Digest field, namely one octet, since it sai= d the=C2=A0Digest Field couldn't be empty. As I recall, the digest didn= 't say what to do if the Digest field was=C2=A0zero length but I presum= e it would mean that the ZONEMD RR was malformed and thus could not be used= to validate a zone. Seems like the minimum length would apply to private u= se algorithms also. See Section 5.2.2.1 of=C2=A0https://datatracker.i= etf.org/doc/html/draft-ietf-dnsop-rfc2845bis-09

> 3) SHA384 / algorithm agility
> -- here are some thoughts/comments on SHA384 and algorithm agility:
...=C2=A0
>
> 3c) SHA2-384 is just SHA2-512 with some different initialization
> values and with the 512 bit output truncated to 384. Thus the
> incremental effort of providing SHA2-512 in tiny if you have SHA2-384<= br> > (and vice versa). So, if SHA2-384 is mandatory, then you might as well=
> make SHA2-512 mandatory also since you get it for probably <1%
> incremental effort. Having two mandatory algorithms with some people > using one and some the other would provide some real confidence that > implementations were actually looking at the Hash Algorithm Field,
> could handle Digest Fields of different length, etc., and the
> algorithm agility mechanisms might actually work. It currently looks a=
> bit like only lip service is being paid to algorithm agility.

In an earlier version of the draft, four algorithms were defined, although<= br> none "past" SHA-384.=C2=A0 There was a (Oct 2018) discussion to m= ake SHA-384
the mandatory algorithm and drop all the weaker ones.

I'm not necessarily opposed to adding more mandatory-to-implement algor= ithms
if there is working group consensus about that, but it feels like a pretty<= br> significant and late change?

<de>= I agree it is a significant change in the draft. But, as I say, if you hav= e SHA-384 you have 99+% of the crypto code you need for SHA-384 and SHA-512= . Of course, SHA-512 has=C2=A0an even longer value, 64 bytes, but with just= one or at most a few ZONEMD=C2=A0RRs at the zone apex, that does not seem = to be a problem. Of my security comments, I rate adding a 2nd hash algorith= m as the most important. It could be that the 2nd algorithm would be a SHOU= LD rather than a MUST. And, if a second algorithm is added, I think SHA-512= would be the easiest for implementers.
=C2=A0
> 3d) On algorithm agility generally: There is a reasonable provision in=
> the ZONEMD RR for a hash algorithm identifier.=C2=A0 But, given that t= his
> is Standards Track I would have expected there to be hash algorithms > specified of different types with one a MUST implement and one a
> SHOULD implement -- possible more but at least that. Blake or SHA3
> would be example of a different algorithm type from SHA2. But I admit<= br> > that SHA2-384/512 is very strong and a break in it significant enough<= br> > to make much difference seems very unlikely.

Same as above.

<de> Response abov= e.=C2=A0

> 4) There is no mention of local policy. If at some point there are
> multiple hash algorithms and/or schemes specified (which could include=
> private use algorithms and schemes), a ZONEMD zone validator would
> likely need a local policy as to which algorithm/scheme digest it will=
> pay attention to.=C2=A0 See, for example, the first paragraph of Secti= on 4
> which assumes any good digest should be good enough to validate the > zone for any verifier.

The draft-ietf-dnsop-dns-zone-digest-00 version did have the following text= that spoke to this:

>=C2=A0 =C2=A0It is RECOMMENDED that implementations maintain a (possibl= y
>=C2=A0 =C2=A0configurable) list of supported Digest Type algorithms ran= ked from
>=C2=A0 =C2=A0most to least preferred.=C2=A0 It is further RECOMMENDED t= hat recipients
>=C2=A0 =C2=A0use only their most preferred algorithm that is present in= the zone
>=C2=A0 =C2=A0for digest verification.
>
>=C2=A0 =C2=A0As a matter of local policy, the recipient MAY require tha= t all
>=C2=A0 =C2=A0supported and present Digest Type algorithms verify the zo= ne.

There was a thread on DNSOP where we had agreement to
take those two paragraphs out:

https://mailarchive.ietf.org= /arch/msg/dnsop/RFCklH7Lx00bL-tOVRCAc0j5ftw/
=C2=A0
<de> I went and read that thread. I agree that the text remov= ed=C2=A0was kind of complex. I was just worried that the text in Section 4 = too strongly=C2=A0implied that an implementation must accept a zone if a ZO= NEMD=C2=A0validates. True, it does have text about "supporting" t= he Scheme and Hash Algorithm but conceivable you could support a Scheme and= a Hash Algorithm but have a policy against accepting a ZONEMD=C2=A0RR that= combined them and in any case I suspect the draft is using "supported= " in the sense of "implemented". I'd be happy=C2=A0with = adding just one sentence in Section 4 something like "The verifier MAY= ignore a ZONEMD if the Scheme and Hash Algorithm violates local policy.&qu= ot;=C2=A0
...=C2=A0
> 6e. Actually, 240-254 seems like a lot of values for Private Use. Why<= br> > would you need 15 private hash algorithms within one administrative > area? If you think there are going to be lots of private/proprietary > hashes (national vanity crypto?) that get used moderately widely,
> there should be a provision for "vendor specific" hash algor= ithms
> where the "Digest Field" actually starts with a "vendor= " identifier.

It seemed a reasonable amount to us, but if others think it should be
smaller that shouldn't be a problem.

=C2=A0<de> OK. It isn't gigantic or anything, just a bit larger= than the 3 or 4 or so values I typically see.

...
> 12. Having an Implementation Status section (Section 10) is good while=
> a draft is going through the approval process, but I think it is, as > indicated in RFC 7942, inappropriate in a resulting standards track > RFC. Furthermore, all of the disclaimer text given in RFC 7942 is
> missing here. So, I believe similar disclaimer text should be added > and the RFC Editor should be requested to drop this section before
> publication.

The authors feel it could be useful, even though it is expected to
become out-of-date.=C2=A0 =C2=A0Looks like some other published RFCs have k= ept
their Implementation Status sections, sometimes as an appendix?
=C2=A0
<de> OK... I think that if retained it wou= ld be much better as an appendix.

<= /div>
=C2=A0...
= > ATTACHMENT
>
> Taking into account the above and to make other editorial suggestions,=
> I have done an editing pass over the draft the results of which are > attached.=C2=A0 I hope you find it helpful.

Thank you, we did find it very helpful.

<de> You're welcome.
=C2=A0
<de> Donal= d
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D
=C2=A0Donald E. Eastlake 3rd =C2=A0 +1-508-3= 33-2270 (cell)
=C2=A02386 Panoramic Circle, Apopka, FL 32703 USA
=C2= =A0d3e3e3@gmail.com
--000000000000be4f4605af651ce5-- From nobody Thu Sep 17 07:22:08 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CD3BA3A0BF5; Thu, 17 Sep 2020 07:22:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=um.es Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ycj5MuhmIXpL; Thu, 17 Sep 2020 07:22:04 -0700 (PDT) Received: from mx02.puc.rediris.es (outbound3sev.lav.puc.rediris.es [130.206.19.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D1A703A0BE6; Thu, 17 Sep 2020 07:22:03 -0700 (PDT) Received: from xenon41.um.es (xenon41.um.es [155.54.212.167]) by mx02.puc.rediris.es with ESMTP id 08HEM1Yo004553-08HEM1Yp004553; Thu, 17 Sep 2020 16:22:01 +0200 Received: from localhost (localhost [127.0.0.1]) by xenon41.um.es (Postfix) with ESMTP id 346982105A; Thu, 17 Sep 2020 16:22:01 +0200 (CEST) X-Virus-Scanned: by antispam in UMU at xenon41.um.es Received: from xenon41.um.es ([127.0.0.1]) by localhost (xenon41.um.es [127.0.0.1]) (amavisd-new, port 10024) with LMTP id tc_NSATeCOFH; Thu, 17 Sep 2020 16:22:01 +0200 (CEST) Received: from [192.168.8.101] (18.red-79-149-253.dynamicip.rima-tde.net [79.149.253.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) (Authenticated sender: gabilm@um.es) by xenon41.um.es (Postfix) with ESMTPSA id 5FCB221058; Thu, 17 Sep 2020 16:21:59 +0200 (CEST) From: Gabriel Lopez Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_5A10ACE7-3BD6-473D-B923-C25616245CC4" Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\)) Date: Thu, 17 Sep 2020 16:21:50 +0200 In-Reply-To: <159915114284.18250.13963885423309139336@ietfa.amsl.com> Cc: Gabriel Lopez , secdir@ietf.org, i2nsf@ietf.org, last-call@ietf.org, draft-ietf-i2nsf-sdn-ipsec-flow-protection.all@ietf.org To: Derek Atkins References: <159915114284.18250.13963885423309139336@ietfa.amsl.com> X-Mailer: Apple Mail (2.3608.120.23.2.1) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; d=um.es; s=DKIM; c=relaxed/relaxed; h=from:message-id:content-type:mime-version:subject:date:cc:to:references; bh=YyYfbzqXxFwlxm2VyiT+RruyirHLPTrDWUQc19TrXU8=; b=nii+VU3gIOKVwLO17u9YPyowu5ckeQN2YzspflVcmkuFwaWWFW19GYDYYJmtZl44GD+DOOQOxFyy sVh8FrDf8R6wvEF5IdbsczeQmO6emlhgaw79JPLJGxzu/2luJQa52iVrU87pR8w6Dn4NePc/Nc3o FKpPBIhxLO7RvALyjekltG6fX6VTzxro11wnBv+OwU7jNAil8FDg9yZXdPZdXJjj1tEuRWOfvzGs uT0jvfcFQHx6Nbg2oitzVH/d+jD68MtdU+th4WWsEpenRlZyGcEn9nUv3BZ2/KHQX5aGaoPPOe8U GeYLdNnpJalCqT1xvjstiOZ9GWkzwg3IGIzxQg== Archived-At: Subject: Re: [secdir] [I2nsf] Secdir last call review of draft-ietf-i2nsf-sdn-ipsec-flow-protection-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Sep 2020 14:22:06 -0000 --Apple-Mail=_5A10ACE7-3BD6-473D-B923-C25616245CC4 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Derek. Thank you for the review and sorry for the delay. We are modifying the text accordingly.=20 Best regards, Gabi.=20 > El 3 sept 2020, a las 18:39, Derek Atkins via Datatracker = escribi=C3=B3: >=20 > Reviewer: Derek Atkins > Review result: Has Nits >=20 > Hi, >=20 > I have reviewed this document as part of the security directorate's > ongoing effort to review all IETF documents being processed by the > IESG. These comments were written with the intent of improving > security requirements and considerations in IETF drafts. Comments > not addressed in last call may be included in AD reviews during the > IESG review. Document editors and WG chairs should treat these > comments just like any other last call comments. >=20 > Summary: >=20 > * With Nits >=20 > Details: >=20 > * NB: I did not review the Yang Models or Appendices >=20 > * Awkward sentence in section 8, top of page 21: >=20 > Moreover, the startup configuration > datastore MUST be also pre-configured with the required ALLOW > policies that allow to communicate the NSF with the I2NSF = Controller > once the NSF is deployed. >=20 > Specifically "that allow to communicate the NSF with ..." should be > changed, possibly to read "that allow the NSF to communicate with = ..." >=20 > * at the end of 8.3 at the bottom of page 23 there is a space for "the > subtrees and data nodes and their sensitivity/vulnerability:" but > there is no list, it just goes onto the next paragraph at the top of > the next page. >=20 > -derek >=20 >=20 >=20 > _______________________________________________ > I2nsf mailing list > I2nsf@ietf.org > https://www.ietf.org/mailman/listinfo/i2nsf ----------------------------------------------------------- Gabriel L=C3=B3pez Mill=C3=A1n Departamento de Ingenier=C3=ADa de la Informaci=C3=B3n y las = Comunicaciones University of Murcia Spain Tel: +34 868888504 Fax: +34 868884151 email: gabilm@um.es --Apple-Mail=_5A10ACE7-3BD6-473D-B923-C25616245CC4 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi = Derek.

Thank you for = the review and sorry for the delay.

We are modifying the text = accordingly. 

Best regards, Gabi. 

El 3 = sept 2020, a las 18:39, Derek Atkins via Datatracker <noreply@ietf.org> = escribi=C3=B3:

Reviewer: Derek Atkins
Review = result: Has Nits

Hi,

I have reviewed this document as part of the security = directorate's
ongoing effort to review all IETF documents = being processed by the
IESG.  These comments were = written with the intent of improving
security requirements = and considerations in IETF drafts.  Comments
not = addressed in last call may be included in AD reviews during the
IESG review.  Document editors and WG chairs should = treat these
comments just like any other last call = comments.

Summary:

* With Nits

Details:

* NB: I did not review the Yang Models or = Appendices

* Awkward sentence in section 8, = top of page 21:

=             &n= bsp;           &nbs= p;    Moreover, the startup configuration
   datastore MUST be also pre-configured with = the required ALLOW
   policies that allow = to communicate the NSF with the I2NSF Controller
=    once the NSF is deployed.

=  Specifically "that allow to communicate the NSF with ..." should = be
 changed, possibly to read "that allow the NSF to = communicate with ..."

* at the end of 8.3 = at the bottom of page 23 there is a space for "the
=  subtrees and data nodes and their sensitivity/vulnerability:" = but
 there is no list, it just goes onto the next = paragraph at the top of
 the next page.

-derek



_______________________________________________
I2nsf mailing list
I2nsf@ietf.org
https://www.ietf.org/mailman/listinfo/i2nsf

-----------------------------------------------------------
Gabriel L=C3=B3pez Mill=C3=A1n
Departamento de = Ingenier=C3=ADa de la Informaci=C3=B3n y las Comunicaciones
University of Murcia
Spain
Tel: = +34 868888504
Fax: +34 868884151
email: gabilm@um.es
=

= --Apple-Mail=_5A10ACE7-3BD6-473D-B923-C25616245CC4-- From nobody Thu Sep 17 11:09:29 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D01613A0EFF; Thu, 17 Sep 2020 11:09:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.12 X-Spam-Level: X-Spam-Status: No, score=-2.12 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=heapingbits.net header.b=40eN17rK; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=MB7N1XLd Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fRlJG59EXbLI; Thu, 17 Sep 2020 11:09:22 -0700 (PDT) Received: from out1-smtp.messagingengine.com (out1-smtp.messagingengine.com [66.111.4.25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0BA143A0EFC; Thu, 17 Sep 2020 11:09:21 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id 0070E5C0140; Thu, 17 Sep 2020 14:09:21 -0400 (EDT) Received: from imap4 ([10.202.2.54]) by compute1.internal (MEProxy); Thu, 17 Sep 2020 14:09:20 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=heapingbits.net; h=mime-version:message-id:in-reply-to:references:date:from:to :cc:subject:content-type:content-transfer-encoding; s=fm2; bh=xH FCwO+FAbRYoowop78UKNArdoyzLYPpfZUdgzglCQ4=; b=40eN17rKEDifEXy1wx 1EdH6S5gifOzLrMNHLpZPHVyxwO6szsgkAPMcxVOWfd21oizesufudZMjxUpl/rw eqINwooEDbnKmE+I2rBfEgM4LoWwc7zCitUaSW80lwjcXydYO0a6+PeaxRgmj/cG Mm07VFJSiDsREs2VTVstIBIwSg9yLDToCTlpAhA2M4wVOFMmRNVf4cFMVnmW9He7 XDEWFYkJ7LzSYiQ7OluWJwpoLhPjLa+jFI5TGMCqQs/Xln/W66iUhAV3TSmwnGrN hXQ4o6kkPP3QlRz57hbqcQ6J71xRwBjoD8Frouxd0YAHlyy8p5oKYyCdxO04jpGs 10RA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender :x-sasl-enc; s=fm3; bh=xHFCwO+FAbRYoowop78UKNArdoyzLYPpfZUdgzglC Q4=; b=MB7N1XLdFF3mEkSC3zJHphQIu0U53Tg0n2OuowTHWDgIbZTO9ov/q4r9h wIpKHs/ayxlLtHV8tK0BS/urLxRjESUnmMwKeuGHia3XZ16Rt4mrnqX1LCTeqpl6 zIeiwY0QvUEuFKebbV5rPLMMEajjUaoQGiaXGNS3EDA6ZIo8a/33kPZIWav/9zBE cU4kpEK2XFicU9Xz6XJLA7eEj0IAHx2i0Qs+mA7oUTpfEzzsdWbxaH48axXTYTLh RVfzX5GXX0KGKbCffk4bxE+kUFqsMCwKY6M94n6XFxZdMD7iP4tHcfRsL8UUEmZH cHUICuPQKLIjeHP5MGSNRBYZIGkvQ== X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedujedrtdeggdduvdefucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucenucfjughrpefofgggkfgjfhffhffvufgtgfesth hqredtreerjeenucfhrhhomhepfdevhhhrihhsthhophhhvghrucghohhougdfuceotggr fieshhgvrghpihhnghgsihhtshdrnhgvtheqnecuggftrfgrthhtvghrnhepkeffkeevge fhgfdtffeivedugfeltdehhfefvddvheeliedvgeevgeelfeetjedunecuvehluhhsthgv rhfuihiivgeptdenucfrrghrrghmpehmrghilhhfrhhomheptggrfieshhgvrghpihhngh gsihhtshdrnhgvth X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id B2F013C011E; Thu, 17 Sep 2020 14:09:20 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.3.0-324-g0f99587-fm-20200916.004-g0f995879 Mime-Version: 1.0 Message-Id: <37778f64-1ad6-4f79-914e-9947ef886e14@www.fastmail.com> In-Reply-To: <4FC30E5B-EF9F-4238-A683-CE8235BDD2EF@fugue.com> References: <159969337123.15697.6820068156665930267@ietfa.amsl.com> <4FC30E5B-EF9F-4238-A683-CE8235BDD2EF@fugue.com> Date: Thu, 17 Sep 2020 11:08:59 -0700 From: "Christopher Wood" To: "Ted Lemon" , "Christopher Wood via Datatracker" Cc: "secdir@ietf.org" , last-call@ietf.org, v6ops@ietf.org, draft-ietf-v6ops-cpe-slaac-renum.all@ietf.org Content-Type: text/plain;charset=utf-8 Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [secdir] =?utf-8?q?=5Bv6ops=5D_Secdir_last_call_review_of_draft-?= =?utf-8?q?ietf-v6ops-cpe-slaac-renum-04?= X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Sep 2020 18:09:24 -0000 On Wed, Sep 9, 2020, at 4:31 PM, Ted Lemon wrote: > On Sep 9, 2020, at 7:16 PM, Christopher Wood via Datatracker=20 > wrote: > > - Section 3: is it possible for an attacker to send DHCPv6 Prefix De= legations > > with lifetime=3D0 to CE routers that support LAN-side DHCPv6 and amp= lify > > Reconfigure messages to supporting clients? (I don't know if this is= a concern > > or part of the threat model, but this did seem to be a case of possi= ble > > request/response asymmetry.) - Section 4: rationale for these defaul= t values, > > if available, might be worth including. (Why not make them shorter? = What are > > the tradeoffs?) - Section 6: it might be worth noting what happens i= f stable > > storage is unavailable or otherwise compromised when trying to store= prefix > > information. What happens if the "A" or "L" bits are modified? (I su= spect > > nothing dangerous, but it's not clear to me whether or not integrity= is > > important.) >=20 > The attacker on the southbound link would have to know the transaction= =20 > ID of the DHCP request/confirm/renew message, which is only sent on th= e=20 > northbound interface, and would have to know the DUID and IAID used by= =20 > the client, again never seen on the southbound link, and would have to= =20 > know the server=E2=80=99s DUID, again only visible northbound. I don=E2= =80=99t think=20 > this is a feasible attack. It=E2=80=99s hard to see what the benefit o= f such an=20 > attack would be=E2=80=94in order to effect this attack without knowled= ge of the=20 > exchange on the northbound interface, the client would have to be=20 > continuously spamming the southbound link with attempts, so that would= =20 > be a negative amplication factor of perhaps 2^256, perhaps less if the= =20 > identifiers can be predicted and renewal times can be predicted. >=20 > And this assumes that the DHCPv6 PD client on the CPE device will even= =20 > accept a DHCP Reply on its southbound interface. >=20 > :) That makes sense -- thanks for clarifying! From nobody Thu Sep 17 11:11:57 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EE7B03A0EE3; Thu, 17 Sep 2020 11:11:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.12 X-Spam-Level: X-Spam-Status: No, score=-2.12 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=heapingbits.net header.b=SVM7WqPQ; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=of+6ODmL Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AemHJeiFYXvl; Thu, 17 Sep 2020 11:11:52 -0700 (PDT) Received: from out1-smtp.messagingengine.com (out1-smtp.messagingengine.com [66.111.4.25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2F9243A0F23; Thu, 17 Sep 2020 11:11:31 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id 713645C0129; Thu, 17 Sep 2020 14:11:30 -0400 (EDT) Received: from imap4 ([10.202.2.54]) by compute1.internal (MEProxy); Thu, 17 Sep 2020 14:11:30 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=heapingbits.net; h=mime-version:message-id:in-reply-to:references:date:from:to :cc:subject:content-type; s=fm2; bh=raMiAC08cztIxdQBUtGLBY0cqjEP VW5TuNohg9J2W4k=; b=SVM7WqPQb4uXnFLeQTk/l27SQWh7nivtdCUYve8l+SMk HCcdwRVaLTP7XzPykeOncKTfRy8IzSzAjX1yViN2b2g3+VX2Xn0tBqEKb6YzXqoG Q3Y1vYGCq5zUgSie+4pDh3jP/LW5WFQ9cetRHgbaHEosAzphnSogYyqay1AYzQLM SNRTNzPeNAGnaw3r6XR2Cla0AnkdZjdtG495HHQnmLfwq6rgtCIl6IGM9wW6piS9 enB+9QnaZnWBK4xFJa3XqzCaei0Rjtu2ZihYCvfzglWicIfUTQv9ruXqtHktzZXm +pQubt43fSFpiNkOIMa0agcai0cFsoTFKwzvJKFgZQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; bh=raMiAC 08cztIxdQBUtGLBY0cqjEPVW5TuNohg9J2W4k=; b=of+6ODmLMMckHs2QRTdap5 O1fsoVF/rcHt3FhxsNIoZiHCMggy5wJrCHGzTZwDD1QmruWpH2kB4jVFecB4tTLl vAliKYtG2dh1uF7Un0SLIU5/B+aKmKmiYraE4B4YLCZFSc3aKaVl+n/F9wGJg1Vp 9220rAxmmBzHL/VHQ87CufNRvaJgz7o9L4Xc4b3jMSeXAdrM6Bh1B8d3Dk+JGpq0 Kk2WCcqcv0lbnSdYR/TbVzJ3y3WvBrxcbzWOdUSb6MFqtugbey5o48tTTp4aUi1/ Azl8mSfmW53AHCnQIpBs+0tjB9JUJ20W43vkMa69K3xfCsKKfIO1Pe+HkYRt7MsQ == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedujedrtdeggdduvdegucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmne cujfgurhepofgfggfkjghffffhvffutgesthdtredtreertdenucfhrhhomhepfdevhhhr ihhsthhophhhvghrucghohhougdfuceotggrfieshhgvrghpihhnghgsihhtshdrnhgvth eqnecuggftrfgrthhtvghrnhepudffiedtuddttefggeefkeegvdekledvieeitdejteet uedvjeevleelleettdehnecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehmrg hilhhfrhhomheptggrfieshhgvrghpihhnghgsihhtshdrnhgvth X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 7476B3C011C; Thu, 17 Sep 2020 14:11:29 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.3.0-324-g0f99587-fm-20200916.004-g0f995879 Mime-Version: 1.0 Message-Id: In-Reply-To: References: <159969337123.15697.6820068156665930267@ietfa.amsl.com> Date: Thu, 17 Sep 2020 11:11:08 -0700 From: "Christopher Wood" To: "Fernando Gont" , "secdir@ietf.org" Cc: last-call@ietf.org, v6ops@ietf.org, draft-ietf-v6ops-cpe-slaac-renum.all@ietf.org Content-Type: text/plain Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-v6ops-cpe-slaac-renum-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Sep 2020 18:11:54 -0000 On Wed, Sep 9, 2020, at 10:09 PM, Fernando Gont wrote: > Hello, Chris, > > Thanks a lot for your comments! In-line.... > > On 9/9/20 20:16, Christopher Wood via Datatracker wrote: > > Reviewer: Christopher Wood > > Review result: Has Nits > > > > Summary: Has Nits > > > > Comments: > > > > - Section 3: is it possible for an attacker to send DHCPv6 Prefix Delegations > > with lifetime=0 to CE routers that support LAN-side DHCPv6 and amplify > > Reconfigure messages to supporting clients? (I don't know if this is a concern > > or part of the threat model, but this did seem to be a case of possible > > request/response asymmetry.) > > Not sure what you mean. PDs with a lifetime of 0 are orthogonal to > Reconfigure messages. > > If the client asked for reconfigure support, yes it will be accepting > server reconfigure messages. > > However, Reconfigure messages are required to be unicasted (RFC8415, > Section 16.11), so there's no possibility for amplification (i.e., > single server packet triggering actions on multiple clients). Got it. Thanks. > > - Section 4: rationale for these default values, > > if available, might be worth including. (Why not make them shorter? What are > > the tradeoffs?) > > I suggested to add this in response to Dale's comments: > > " However, while the aforementioned values represent an improvement > over the default values specified in [RFC4861], they represent a > trade-off among a number of factors, including responsiveness, possible > impact on the battery life of connected devices [RFC7772], etc. Thus, > they may or may not provide sufficient mitigation to the problem > discussed in this document. > " > > ? This seems reasonable to me. > > - Section 6: it might be worth noting what happens if stable > > storage is unavailable or otherwise compromised when trying to store prefix > > information. What happens if the "A" or "L" bits are modified? (I suspect > > nothing dangerous, but it's not clear to me whether or not integrity is > > important.) > > Compromised as in "an attacked intentionally caused different bits to be > stored"? Well, either maliciously or not, I suppose. I was just trying to learn if integrity is important. > If so, I'd say that's probably the least of your concerns. Since DHCPv6 > exchanges are not encrypted or authenticated, your first concern would > be forged packets. If the attacker has essentially hacked the CE Router, > then all bets are off. > > > > > Nits: > > > > - In some places "\"Valid Lifetime\"" is written as "valid-lifetime" -- should > > these be made consistent? > > We use "Valid Lifetime" for SLAAC PIOs, and "valid-lifetime" for DHCPv6 > options, since that's what the respective specs use. Please do let us > know if you think this should be clarified. Ah! If that's well understood by others, then it's fine with me. (I wasn't aware of the difference.) Thanks for following up. :-) Best, Chris From nobody Thu Sep 17 11:25:24 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8B1233A0F2E for ; Thu, 17 Sep 2020 11:25:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=kumari-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0pwbSW6Bbnp0 for ; Thu, 17 Sep 2020 11:25:15 -0700 (PDT) Received: from mail-lj1-x235.google.com (mail-lj1-x235.google.com [IPv6:2a00:1450:4864:20::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BA6CA3A0F27 for ; Thu, 17 Sep 2020 11:25:14 -0700 (PDT) Received: by mail-lj1-x235.google.com with SMTP id k25so2869356ljg.9 for ; Thu, 17 Sep 2020 11:25:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kumari-net.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ncUT7L7TJCmDRrVAvq0XBRT2tHIg5vkD2sWztgcIgoc=; b=SF1Yb+uBH69kjprGeDSV4BLszcTxDFyfOsJLeiUOwDaZachcQZnbxsaXsxFgMUv7Jo emE0e0QB+7Jgec10HEykn7B9l+2MrDlLNSEHTwrhiRpHst1msdx/lFOeAsKGv/R8XJh6 zB1U6nLNrsY1XxU78yejrWXWGlqbKFJzrpwmMv4aBm8IYDEFaqiulSI/I0nrHj/P9WEQ Wqufd1LDjXakHNIs9dca0zFXnpfCHS9q3zJBAAw8qO3PKl+ZUaO8OEMy6fQvIxcrf1iU LxMgcu6xI/HTS9SAmP1QkiIIcdfpWG1mEdeB9YaomJNcdSsn/1irrSGNRQDfABXd69TN lH0Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ncUT7L7TJCmDRrVAvq0XBRT2tHIg5vkD2sWztgcIgoc=; b=MUdhG1IaQJX0gikpsHXZHJOgWscRInB6WtyiQel2VwTT3W6nSRZayKRof9T7rrZKN3 jIgDdxC60Dq9R3lbPhmMcaMk9KyXNK070BJfNpL0gMYYwt0bpLdrIOQpgAUKHhWLvjPU Mi4kCFtilwQG7No9Y0I3YJEeTkKjHk5r1RJ7eEFOrul6VC0SvS+Zwt+CbZk1441wq3PJ LCrcay7YR7EFRWjHYGL50/9KOG3WXuI4UYcNioc/dH+L30RjlV4G2LCzcOZ2I96Fh1LD oztHKG97gS/ARD33dgnesaa8+m+TH+uBuUOLDpsTq0bHZFDqwMx9yDfnzjpQeaD7fYXl nHrw== X-Gm-Message-State: AOAM533JWa5D3p0FIEdOczFJ/UPEwepgVsLvhNpmYVqdaIdoU4411xNP UncMfv0mX+OD9W36z7r6aJ7/M7UWejT2lyiikLU2hg== X-Google-Smtp-Source: ABdhPJxsO9ll4vAdAG+yQ4tTgOFBgM2mnAj/XqF/hqzt+npRLn1gStiNwUxtrPY11fmtL8zS/Sl+WpZZXgEWm0KooCw= X-Received: by 2002:a2e:9b99:: with SMTP id z25mr11411892lji.403.1600367112405; Thu, 17 Sep 2020 11:25:12 -0700 (PDT) MIME-Version: 1.0 References: <159969337123.15697.6820068156665930267@ietfa.amsl.com> In-Reply-To: From: Warren Kumari Date: Thu, 17 Sep 2020 14:24:35 -0400 Message-ID: To: Christopher Wood Cc: Fernando Gont , "secdir@ietf.org" , last-call@ietf.org, IPv6 Operations , draft-ietf-v6ops-cpe-slaac-renum.all@ietf.org Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-v6ops-cpe-slaac-renum-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 17 Sep 2020 18:25:17 -0000 [ -LC for clutter ] Just a quick note to say thanks for the secdir review, and for the followup discussions, it's always nice when directorate review works nicely.... W From nobody Mon Sep 21 07:08:18 2020 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 20E913A0F94; Mon, 21 Sep 2020 07:08:09 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: =?utf-8?b?TWFsacWhYSBWdcSNaW5pxIcgdmlhIERhdGF0cmFja2Vy?= To: Cc: bess@ietf.org, last-call@ietf.org, draft-ietf-bess-evpn-na-flags.all@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.17.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <160069728907.2136.5817110472506014861@ietfa.amsl.com> Reply-To: =?utf-8?b?TWFsacWhYSBWdcSNaW5pxIc=?= Date: Mon, 21 Sep 2020 07:08:09 -0700 Archived-At: Subject: [secdir] Secdir telechat review of draft-ietf-bess-evpn-na-flags-06 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 21 Sep 2020 14:08:09 -0000 Reviewer: Mališa Vučinić Review result: Ready Thank you for addressing my review comments, the document is IMO ready to proceed. From nobody Mon Sep 21 10:31:45 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6629B3A09CE; Mon, 21 Sep 2020 10:31:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=verisign.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hTdNjrpCbIki; Mon, 21 Sep 2020 10:31:37 -0700 (PDT) Received: from mail6.verisign.com (mail6.verisign.com [69.58.187.32]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3C42F3A09C5; Mon, 21 Sep 2020 10:31:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=verisign.com; l=16375; q=dns/txt; s=VRSN; t=1600709497; h=from:to:cc:date:message-id:references:in-reply-to: mime-version:subject; bh=iABkg942Lj5fcoyJdZ9us+BWsc8h6RrU36PZW4IW5MY=; b=a2AUKULLgS024O/ma3fq38QxEG2NiHGWKieirw2Em9FfyLcyfFWrOfRU mknUhsOrmCXE9y+exD/CX3QkGhBa7kUEFGvs+KLgsRJtqNegTUbcGwkXm l3luFrCaqfHptftN+g2hmR8pUACA8ZUft59kaU3W++teug2QJ7/Jh1glV uTqjl5lEdLuJJiF011ePfKTWtOPSdL62tQbZy9NpgXVyZG5XyIvow9k/u UWHykYNYYtu/vAPo3M2j+WCoIbRtJq0sPQ0+LAytSCMfQxZjKLEpCfkob zejheK4/jH95ZkL2teDM1Ye+o8v4zB2/nXk/rWPPegtpzX7EiwKY0a0Tg g==; IronPort-SDR: Pzqk5Pe/TKXQWZRBfQSIIffzc+9AQUZQXTTQm+1S4Y/cHNpVdav3uAADQcwE4/qNRmzt7ccGkE L2vXxAfNMXv3g5PboXEOixghsW4iyNR/oWUg55wRyU6IJNL8d5soRqI/BVBoTrD7zFAl3xwm4N /vDz12IWyw0rBbJ5BI7PmDAw7t6KJhNTydUC4gkAn/InwXnDqgvVZT/t1hL01RLEwAy3BNHLy8 XU8coZx+CjkGxwJ7lAZxP/FhyQv0hNC1xeLp0sI+xVRyBsEOsi7mXTsV07Hx9BcO9B1Zs6vp4N gM0= X-IronPort-AV: E=Sophos; i="5.77,287,1596513600"; d="p7s'?scan'208"; a="2984657" IronPort-PHdr: =?us-ascii?q?9a23=3Akk5jkhQnS/sGd0TzLLfI1RYA7dpsv+yvbD5Q0Y?= =?us-ascii?q?Iujvd0So/mwa67ZRCAt8tkgFKBZ4jH8fUM07OQ7/m/HzVaqs/Z4ThCKMUKC0?= =?us-ascii?q?Zbz51O3kQJO42sMQXDNvnkbig3ToxpdWRO2DWFC3VTA9v0fFbIo3e/vnY4Ex?= =?us-ascii?q?T7MhdpdKyuQtaBx8u42Pqv9JLNfg5GmCSyYa9oLBWxsA7dqtQajZFtJ6osyB?= =?us-ascii?q?bFuGZEd/pZyW91OV6emwv36sOs8JJ+6ShdtO8t+s9aXanmY6g0SKFTASg7PW?= =?us-ascii?q?wy+MDlrwTIQxGV5nsbXGUWkx5IDBbA4RrnQJr/sTb0u/Rk1iWCMsL4Ub47WT?= =?us-ascii?q?K576d2UxDokzsINyQ48G7MlMN9ir9QrQ+7qBx+x47UZ5yVNOZ7c6jAc94WWX?= =?us-ascii?q?ZNU8BMXCFHH4iybZYAD/AZMOhYsYfzukcOoxW9CwmiBuzhzT5IiWP50qAh3O?= =?us-ascii?q?QtDQTG0RYgH94SrnjZqsj+OqcIUeCyyanF1TvPYPNI1jfm84jHbBQhoeqUUb?= =?us-ascii?q?ltf8TR1FMgFwXbgVmetIfoOC6a1+oTvGiA9OpvS+avi3U8pgFvvDev3MYsip?= =?us-ascii?q?LIhoIazFDI7zl2wIEwJdChTkNwfNGrHodKuS6AK4t2Xt0tQ3tuuCsiy7ALvY?= =?us-ascii?q?K3cDQKxZg6xBPSdv+KfYeI7x7+VOidPSp1iXJrdbywhRu88VWsx+PyWMe61F?= =?us-ascii?q?tHrCRLn9vSun0D1xLf9M6KQeZz8Eem3DaAzQHT6udcLEA1i6XbN5AhzqQ3lp?= =?us-ascii?q?oJvkTOGDL9lkbujKKOa0ko5vKk5/nlb7jovJOQKo95hw/kPqkhnsGzGfk0Ph?= =?us-ascii?q?QUU2SG++mwyKfv8VD2TbhJlPE6j6rUvZbHLsoBvKG5GRVa0oM75ha6CDepzc?= =?us-ascii?q?oXkGEcLFJAZBKHl4/pO0zSIPzgDfewnVCskDBzyv3bIrPvGojBIXjbnrnufL?= =?us-ascii?q?lx91BQxBAtzd9D4JJUEKkBLOjpVUDsrtDYEAU5Mxeyw+r9FNp90YYeVXqOAq?= =?us-ascii?q?+fLqzSrUeF6v8zL+WWeYMYujjwJ+I46/Pug3I1g1AQcK2x0ZsScn+4H/BmI0?= =?us-ascii?q?uDYXrrh9cMCXoFvwQgQ+zxk12NTzpTZ22pUqIi+D47EoOmDZzCRoCihryNxj?= =?us-ascii?q?u0HppTZmxeEFCDDW/od5mYW/cLcC+dP8FsnSIKWLe/RYIszh6utArgxLpmKu?= =?us-ascii?q?rY4DEXtZXm1NJt/e3ciQky9SBoD8Say2yNTn97nngHRzIt3aBwv1B9ylmZ3a?= =?us-ascii?q?h/mfxYGsRZ5+lVXQciKZ7c0+t6BsjvVQLbZNiJRkqmTsynAT4vUtIxzcYCbF?= =?us-ascii?q?t7G9W5iRDDxzOmDKITl7yQHZA186Xc337vKMpk1nnG1aYhgEc9QstTL2GpnK?= =?us-ascii?q?p/9wzICo7IjUqZi6iqeb4b3C7X+2eJ1XCOs11AUA5sTaXFWmgSZlDIotvl+0?= =?us-ascii?q?zCTqWuBK8mMgRf1c6CJLFGatrzjVVJF7/fP4HyZGS4n2v4KB+T2reFb4eiL2?= =?us-ascii?q?lG0X7QU2ALlgkS+TCNMg1oVQm7pGeLRgNjDkniZ1ioucVjoXW2BAdgwx6HdF?= =?us-ascii?q?Zs06Gd5BMPhOedRPVV1bUB7nRy4w5oFUqwioqFQ+GLoBBsKf1R?= X-IPAS-Result: =?us-ascii?q?A2FYAAD84mhf/zGZrQpcAxoBAQEBAQEBAQEBAwEBAQESA?= =?us-ascii?q?QEBAQICAQEBAUCBT4F1BoEfLIEICpVyg3qGFJAogWkEBwEBAQEBAQEBAQQEA?= =?us-ascii?q?SUKBAEBAoRJAoItJTgTAgMBAQsBAQEFAQEBAQEGAwEBAQKGRQyCNyJ7gQMBA?= =?us-ascii?q?QEBAQEBAQEBAQEBAQEBAQEBFgJDVRIBAR0BAQEBAgF5BQsCAQgOChUZAh8RJ?= =?us-ascii?q?QIEDgUOgxgBgksDDhEemQmaZnSBNIQ/Ag5BgxkNghQKBoE4gVOEeIUeJYE5g?= =?us-ascii?q?UI+gREnHIJNPoIaQgEBAgEBgRQtGRgKHgiDA4ItBItQhDkLLqVkN1EDB4Jnh?= =?us-ascii?q?EWCX4FSi2RqhQsegwyPMY5EnVyCao5Vg1wCBAIEBQIVgWuBe3AVOyoBggoBA?= =?us-ascii?q?TI+EhcCDY4oAgEXgQIBDIdThUJ0NAMCBgoBAQMJjBstgQYxYAEB?= Received: from BRN1WNEX01.vcorp.ad.vrsn.com (10.173.153.48) by BRN1WNEX02.vcorp.ad.vrsn.com (10.173.153.49) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1979.3; Mon, 21 Sep 2020 13:31:34 -0400 Received: from BRN1WNEX01.vcorp.ad.vrsn.com ([fe80::a89b:32d6:b967:337d]) by BRN1WNEX01.vcorp.ad.vrsn.com ([fe80::a89b:32d6:b967:337d%4]) with mapi id 15.01.1979.003; Mon, 21 Sep 2020 13:31:34 -0400 From: "Wessels, Duane" To: Donald Eastlake CC: "iesg@ietf.org" , "draft-ietf-dnsop-dns-zone-digest.all@ietf.org" , secdir Thread-Topic: [EXTERNAL] SECDIR review of draft-ietf-dnsop-dns-zone-digest-09 Thread-Index: AQHWkD0NBk7hWiirA0qu4ZMMGkGTEQ== Date: Mon, 21 Sep 2020 17:31:34 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-mailer: Apple Mail (2.3445.104.15) x-originating-ip: [10.170.148.18] Content-Type: multipart/signed; boundary="Apple-Mail=_26328243-7C53-41C7-832F-932D33B5FA77"; protocol="application/pkcs7-signature"; micalg=sha-256 MIME-Version: 1.0 Archived-At: Subject: Re: [secdir] SECDIR review of draft-ietf-dnsop-dns-zone-digest-09 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 21 Sep 2020 17:31:39 -0000 --Apple-Mail=_26328243-7C53-41C7-832F-932D33B5FA77 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Donald, Thanks again for this draft review and feedback. After discussions = among the coauthors we have made the further changes that you suggest. = Namely: - minimum digest length of 12 octets - added SHA512 as algorithm 2 - local policy allows some schemes / algorithms to be ignored - implementation status moved to an appendix I think there are no more outstanding issues. I will be posting an = updated revision of the draft shortly. DW > On Sep 15, 2020, at 7:34 PM, Donald Eastlake wrote: >=20 > Hi Duane, >=20 > Thanks for accepting most of my suggestions. >=20 > See my responses below at on the items we are still discussing. >=20 > On Tue, Sep 15, 2020 at 11:38 AM Wessels, Duane = wrote: > Thanks Don for the extensive review! tl;dr, we did accept most/many = of your suggestions already, except these items may warrant further = discussion: >=20 > - minimum digest length > - more hash algorithms than SHA-384 > - local policy when verifying multiple digests > - implementation status section >=20 > More responses inline below. >=20 > DW >=20 > > On Sep 12, 2020, at 6:53 PM, Donald Eastlake = wrote: > >=20 > ... > >=20 > > 2) The minimum size of the Digest Field, 1 octet, seems too small. > > Typical minimum size for such a field in IETF protocols seems to be = 96 > > bits or 12 octets, so that, at least with a strong hash function, = you > > have a reasonable resistance against brute force attacks. Also, = while > > it is fairly obvious, you might want to mention how a receiver > > determines the length of the Digest Field. > >=20 > > OLD (Section 2.2.4) > > The Digest field must not be empty. > >=20 > > NEW > > The Digest Field MUST NOT be shorter than 12 octets. If it is, the > > ZONEMD RR containing that short digest cannot be used to verify a > > zone. The length of the digest field is determined by deducting the > > fixed size of the Serial, Scheme, and Hash Algorithm fields from the > > RDATA size in the ZONEMD RR header. >=20 > I'm not necessarily opposed to a minimum digest size. Do you envision > any complications with private use algorithms though? It seems a = little > strange to allow private use algorithms whose digest value could be = anything, > but requiring a minimum size (which could then simply be padded I = know). > =20 > Well, it looked to me like the draft already had a minimum Digest = field, namely one octet, since it said the Digest Field couldn't be = empty. As I recall, the digest didn't say what to do if the Digest field = was zero length but I presume it would mean that the ZONEMD RR was = malformed and thus could not be used to validate a zone. Seems like the = minimum length would apply to private use algorithms also. See Section = 5.2.2.1 of = https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-rfc2845bis-09 >=20 > > 3) SHA384 / algorithm agility > > -- here are some thoughts/comments on SHA384 and algorithm agility: > ...=20 > >=20 > > 3c) SHA2-384 is just SHA2-512 with some different initialization > > values and with the 512 bit output truncated to 384. Thus the > > incremental effort of providing SHA2-512 in tiny if you have = SHA2-384 > > (and vice versa). So, if SHA2-384 is mandatory, then you might as = well > > make SHA2-512 mandatory also since you get it for probably <1% > > incremental effort. Having two mandatory algorithms with some people > > using one and some the other would provide some real confidence that > > implementations were actually looking at the Hash Algorithm Field, > > could handle Digest Fields of different length, etc., and the > > algorithm agility mechanisms might actually work. It currently looks = a > > bit like only lip service is being paid to algorithm agility. >=20 > In an earlier version of the draft, four algorithms were defined, = although > none "past" SHA-384. There was a (Oct 2018) discussion to make = SHA-384 > the mandatory algorithm and drop all the weaker ones. >=20 > I'm not necessarily opposed to adding more mandatory-to-implement = algorithms > if there is working group consensus about that, but it feels like a = pretty > significant and late change? >=20 > I agree it is a significant change in the draft. But, as I say, = if you have SHA-384 you have 99+% of the crypto code you need for = SHA-384 and SHA-512. Of course, SHA-512 has an even longer value, 64 = bytes, but with just one or at most a few ZONEMD RRs at the zone apex, = that does not seem to be a problem. Of my security comments, I rate = adding a 2nd hash algorithm as the most important. It could be that the = 2nd algorithm would be a SHOULD rather than a MUST. And, if a second = algorithm is added, I think SHA-512 would be the easiest for = implementers. > =20 > > 3d) On algorithm agility generally: There is a reasonable provision = in > > the ZONEMD RR for a hash algorithm identifier. But, given that this > > is Standards Track I would have expected there to be hash algorithms > > specified of different types with one a MUST implement and one a > > SHOULD implement -- possible more but at least that. Blake or SHA3 > > would be example of a different algorithm type from SHA2. But I = admit > > that SHA2-384/512 is very strong and a break in it significant = enough > > to make much difference seems very unlikely. >=20 > Same as above. >=20 > Response above.=20 >=20 > > 4) There is no mention of local policy. If at some point there are > > multiple hash algorithms and/or schemes specified (which could = include > > private use algorithms and schemes), a ZONEMD zone validator would > > likely need a local policy as to which algorithm/scheme digest it = will > > pay attention to. See, for example, the first paragraph of Section = 4 > > which assumes any good digest should be good enough to validate the > > zone for any verifier. >=20 > The draft-ietf-dnsop-dns-zone-digest-00 version did have the following = text that spoke to this:=20 >=20 > > It is RECOMMENDED that implementations maintain a (possibly > > configurable) list of supported Digest Type algorithms ranked from > > most to least preferred. It is further RECOMMENDED that = recipients > > use only their most preferred algorithm that is present in the = zone > > for digest verification. > >=20 > > As a matter of local policy, the recipient MAY require that all > > supported and present Digest Type algorithms verify the zone. >=20 > There was a thread on DNSOP where we had agreement to > take those two paragraphs out: >=20 > = https://mailarchive.ietf.org/arch/msg/dnsop/RFCklH7Lx00bL-tOVRCAc0j5ftw/ > =20 > I went and read that thread. I agree that the text removed was = kind of complex. I was just worried that the text in Section 4 too = strongly implied that an implementation must accept a zone if a ZONEMD = validates. True, it does have text about "supporting" the Scheme and = Hash Algorithm but conceivable you could support a Scheme and a Hash = Algorithm but have a policy against accepting a ZONEMD RR that combined = them and in any case I suspect the draft is using "supported" in the = sense of "implemented". I'd be happy with adding just one sentence in = Section 4 something like "The verifier MAY ignore a ZONEMD if the Scheme = and Hash Algorithm violates local policy."=20 > ...=20 > > 6e. Actually, 240-254 seems like a lot of values for Private Use. = Why > > would you need 15 private hash algorithms within one administrative > > area? If you think there are going to be lots of private/proprietary > > hashes (national vanity crypto?) that get used moderately widely, > > there should be a provision for "vendor specific" hash algorithms > > where the "Digest Field" actually starts with a "vendor" identifier. >=20 > It seemed a reasonable amount to us, but if others think it should be > smaller that shouldn't be a problem. >=20 > OK. It isn't gigantic or anything, just a bit larger than the 3 = or 4 or so values I typically see. >=20 > ... > > 12. Having an Implementation Status section (Section 10) is good = while > > a draft is going through the approval process, but I think it is, as > > indicated in RFC 7942, inappropriate in a resulting standards track > > RFC. Furthermore, all of the disclaimer text given in RFC 7942 is > > missing here. So, I believe similar disclaimer text should be added > > and the RFC Editor should be requested to drop this section before > > publication. >=20 > The authors feel it could be useful, even though it is expected to > become out-of-date. Looks like some other published RFCs have kept > their Implementation Status sections, sometimes as an appendix? > =20 > OK... I think that if retained it would be much better as an = appendix. >=20 > ... > > ATTACHMENT > >=20 > > Taking into account the above and to make other editorial = suggestions, > > I have done an editing pass over the draft the results of which are > > attached. I hope you find it helpful. >=20 > Thank you, we did find it very helpful. >=20 > You're welcome. > =20 > Donald > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D > Donald E. Eastlake 3rd +1-508-333-2270 (cell) > 2386 Panoramic Circle, Apopka, FL 32703 USA > d3e3e3@gmail.com --Apple-Mail=_26328243-7C53-41C7-832F-932D33B5FA77 Content-Disposition: attachment; filename="smime.p7s" Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCDbgw ggZgMIIFSKADAgECAhB2hcsHqODMD9LFTY85NbMSMA0GCSqGSIb3DQEBBQUAMIHKMQswCQYDVQQG EwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5l dHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQg dXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDIgUHVibGljIFByaW1hcnkgQ2VydGlm aWNhdGlvbiBBdXRob3JpdHkgLSBHMzAeFw0xMTA2MDcwMDAwMDBaFw0yMTA2MDYyMzU5NTlaMIHJ MQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5 bWFudGVjIFRydXN0IE5ldHdvcmsxNTAzBgNVBAsTLENsYXNzIDIgTWFuYWdlZCBQS0kgSW5kaXZp ZHVhbCBTdWJzY3JpYmVyIENBMUMwQQYDVQQDEzpTeW1hbnRlYyBDbGFzcyAyIFNoYXJlZCBJbnRl cm1lZGlhdGUgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB CgKCAQEAt/g/DCuDIyCFpk1JAVE62t1QM77jBKQ6PqNhZkw0wuh0cHVJpbdJ7N2zkpzdeQ3iufq4 OTy+heOM7215o6a3CL+cTL4+mI6s23yaK+wFKDBfKRszTUTVcOhWIpmmPp1CW+sjp2OdLSywLj8Y 8ynNGjaJhJLHV3BbcIXmOKF8UOM3OIhlW2vLOSoEsYKqGQT/oH8/o9uRRXZmo2vzhSNeTtmFXXWn oBX3wQB04OXKlEJlmsI3eouoUKy/l3Rnd9Eyp6+Ny5OpJUK0MBp0CuIlEBDLdGdVD8sU/EFQCqR8 TQsL+QWpNflFpzHxgLuiyT7OdjnhKv92UOfoUSLfLc+4MwIDAQABo4ICPzCCAjswEgYDVR0TAQH/ BAgwBgEB/wIBADA0BgNVHR8ELTArMCmgJ6AlhiNodHRwOi8vY3JsLnZlcmlzaWduLmNvbS9wY2Ey LWczLmNybDAOBgNVHQ8BAf8EBAMCAQYwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVZlcmlTaWdu TVBLSS0yLTU2MB0GA1UdDgQWBBTYSCmoXyoXkuL6nnvvb2CD+Li43DCB8AYDVR0jBIHoMIHloYHQ pIHNMIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl cmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJbmMuIC0g Rm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDIgUHVibGlj IFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHM4IQYXDLSYxfmEUp57Cm2VBbejA0 BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnZlcmlzaWduLmNvbTBsBgNV HSAEZTBjMGEGC2CGSAGG+EUBBxcCMFIwJgYIKwYBBQUHAgEWGmh0dHA6Ly93d3cuc3ltYXV0aC5j b20vY3BzMCgGCCsGAQUFBwICMBwaGmh0dHA6Ly93d3cuc3ltYXV0aC5jb20vcnBhMA0GCSqGSIb3 DQEBBQUAA4IBAQCmKpsHQMns/7OI6EXaNNEXDygtt6WFZzHNwebVKYY4rOLwWRsM4aFFziR472nB sExhokjZaE+6/nVUN7pYaerBdqU2QuqeZniQINmVaiR5VM3eWhqKO64YlXLQJdjSRr40MKeAnvFW ziAebGfJTU95h4niLoDWnu0mYWWiA9DF4vMouStJaYJn7NXpNKQu3GIipIVNSONqApTyzf3kZ8hJ vKrVx+c83oexEGtdB1wZ5Gug9E+Zy9y1WwzMMvlq5HTAKlg3ebP7zcM0b+F23RAHAGOLB04nF5JH mw6+3g0ThRH8oi9lfcw6rB5Ua1ZnxO6lhyIjFytwVsPxrndcJ8E5MIIHUDCCBjigAwIBAgIQUgHO uRrE8f0+lHpp6LMu3zANBgkqhkiG9w0BAQsFADCByTELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5 bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMTUwMwYD VQQLEyxDbGFzcyAyIE1hbmFnZWQgUEtJIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQTFDMEEGA1UE AxM6U3ltYW50ZWMgQ2xhc3MgMiBTaGFyZWQgSW50ZXJtZWRpYXRlIENlcnRpZmljYXRlIEF1dGhv cml0eTAeFw0yMDAzMjQwMDAwMDBaFw0yMTA0MjIyMzU5NTlaMHAxJDAiBgkqhkiG9w0BCQEWFWR3 ZXNzZWxzQHZlcmlzaWduLmNvbTEXMBUGA1UEAwwOV2Vzc2VscywgRHVhbmUxFjAUBgNVBAsMDUVO VEVSUFJJU0UgSVQxFzAVBgNVBAoMDlZlcmlTaWduLCBJbmMuMIIBIjANBgkqhkiG9w0BAQEFAAOC AQ8AMIIBCgKCAQEAwbeXxaBWlxe5DxiPcGA+avq1cFigXZu2lAVx5DMmtWuUx8s+am03tuwU7tw6 xHG4sfrR9d2BucS54VpdZGxZO0ShzZ0WDatTINezhPQTh0Xumy2dbc8d7xTlSa2ZGGw/Zq78jq4C 7f3dEMMk7pqY+gBIE9d7GdjQYkwrF558PKIQIzUAcxVLTLhOqcmnA2g0WaTxWEjev2LdC41G15z8 ZIEJDWGfd7lWLNKrD4p9vG+aKTbxEaaKcRj7ZQCFbqNNAQA0YFf2xtvgUHQIh+ciuCKBlwiTVkCl KZpGkfTx0tSE47BvtNkAFxqyKTNNYrceG7/g7KaxynTfKO7zYjO1uQIDAQABo4IDijCCA4YwDAYD VR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBaAwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwQwHQYDVR0O BBYEFFaFSmgtcRDwfRFiqt3Vq8LJCLn5MCAGA1UdEQQZMBeBFWR3ZXNzZWxzQHZlcmlzaWduLmNv bTAfBgNVHSMEGDAWgBTYSCmoXyoXkuL6nnvvb2CD+Li43DCCAXAGCCsGAQUFBwEBBIIBYjCCAV4w JwYIKwYBBQUHMAGGG2h0dHA6Ly9wa2ktb2NzcC5zeW1hdXRoLmNvbTCCATEGCCsGAQUFBzAChoIB I2xkYXA6Ly9kaXJlY3Rvcnkuc3ltYXV0aC5jb20vQ04lMjAlM0QlMjBTeW1hbnRlYyUyMENsYXNz JTIwMiUyMFNoYXJlZCUyMEludGVybWVkaWF0ZSUyMENlcnRpZmljYXRlJTIwQXV0aG9yaXR5JTJD T1UlMjAlM0QlMjBDbGFzcyUyMDIlMjBNYW5hZ2VkJTIwUEtJJTIwSW5kaXZpZHVhbCUyMFN1YnNj cmliZXIlMjBDQSUyQ09VJTIwJTNEJTIwU3ltYW50ZWMlMjBUcnVzdCUyME5ldHdvcmslMkNPJTIw JTNEJTIwU3ltYW50ZWMlMjBDb3Jwb3JhdGlvbiUyQ0MlMjAlM0QlMjBVUz9jQUNlcnRpZmljYXRl O2JpbmFyeTBdBgNVHR8EVjBUMFKgUKBOhkxodHRwOi8vcGtpLWNybC5zeW1hdXRoLmNvbS9jYV8w N2JiN2Q2NDc3Y2Y0ZjZiZTk2YWYxYjM2Y2FiZDMxNi9MYXRlc3RDUkwuY3JsMGwGA1UdIARlMGMw YQYLYIZIAYb4RQEHFwIwUjAmBggrBgEFBQcCARYaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9jcHMw KAYIKwYBBQUHAgIwHBoaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9ycGEwQgYJKoZIhvcNAQkPBDUw MzAKBggqhkiG9w0DBzALBglghkgBZQMEAQIwCwYJYIZIAWUDBAEWMAsGCWCGSAFlAwQBKjAsBgpg hkgBhvhFARADBB4wHAYSYIZIAYb4RQEQAQICAQGL8cYJFgYyNDc2NjQwOQYKYIZIAYb4RQEQBQQr MCkCAQAWJGFIUjBjSE02THk5d2Eya3RjbUV1YzNsdFlYVjBhQzVqYjIwPTANBgkqhkiG9w0BAQsF AAOCAQEAeD6Ith/v5S1X1k35R2h8AK4YbmVNDgPivPZcQcpKRJ6YntyZf9l2e19igK2d0floI6ez PCEEGUwQArGOBc9nBrEPDioIq2WJCPshT4/fk2UdOo9+Yc80JlhPE3eU3HkYhu0B33Hj3tjc5g60 Y+wdR2jInSF+LnvP66yJthoXLID1NpkhitIx52m5MkKPZTxb/SHVI2MQ5x4DWtr+Obe/+YCRQ/K2 UzMSVXmVwdHLpUrm4P4uyWQ2ZuIwFbnLl7OtwKOZIaQxqXDI/jWO65hVqHgiRc1Sao/lYtKfu/jC dmXM6v0Sd+t4dJFEjH2a1gqsf4DraqnvJ4Ak6RNTCazfUTGCBF0wggRZAgEBMIHeMIHJMQswCQYD VQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVj IFRydXN0IE5ldHdvcmsxNTAzBgNVBAsTLENsYXNzIDIgTWFuYWdlZCBQS0kgSW5kaXZpZHVhbCBT dWJzY3JpYmVyIENBMUMwQQYDVQQDEzpTeW1hbnRlYyBDbGFzcyAyIFNoYXJlZCBJbnRlcm1lZGlh dGUgQ2VydGlmaWNhdGUgQXV0aG9yaXR5AhBSAc65GsTx/T6Uemnosy7fMA0GCWCGSAFlAwQCAQUA oIICTzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0yMDA5MjExNzMx MzNaMC8GCSqGSIb3DQEJBDEiBCAPj7DxubikwJ4ImPuQIIGWBAGief1F/AM3ZJniVjHulDCB7wYJ KwYBBAGCNxAEMYHhMIHeMIHJMQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9y YXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxNTAzBgNVBAsTLENsYXNzIDIg TWFuYWdlZCBQS0kgSW5kaXZpZHVhbCBTdWJzY3JpYmVyIENBMUMwQQYDVQQDEzpTeW1hbnRlYyBD bGFzcyAyIFNoYXJlZCBJbnRlcm1lZGlhdGUgQ2VydGlmaWNhdGUgQXV0aG9yaXR5AhBSAc65GsTx /T6Uemnosy7fMIHxBgsqhkiG9w0BCRACCzGB4aCB3jCByTELMAkGA1UEBhMCVVMxHTAbBgNVBAoT FFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMTUw MwYDVQQLEyxDbGFzcyAyIE1hbmFnZWQgUEtJIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQTFDMEEG A1UEAxM6U3ltYW50ZWMgQ2xhc3MgMiBTaGFyZWQgSW50ZXJtZWRpYXRlIENlcnRpZmljYXRlIEF1 dGhvcml0eQIQUgHOuRrE8f0+lHpp6LMu3zANBgkqhkiG9w0BAQEFAASCAQC1a4dWB92v3P/zq6TX 5aLEyDD3IsdUTz7xv06pI8VCLwfetQ7/b5NXNWEVGaLuqWi2ymZVxDvj0RZfDikbvvK/i8OiudJD qgpQWtKDtW15R5ZLujwv3o710f2mV9HOY4YQzemC0/X25yA/Pan23e3Jm7NmWjxoRgnMfbAwZKjp 8Won5Sw3Xcju2nP7GZQ3d6tFd7x2a25x/yPND3OpY3rPQAhqKtWrBmmWjuMUFKq9x4OXdx50n+na 9lnu1H0Jum4X23zAJWWqREVthYJMQsw8S78McAFqxMwfLHWS677OUDpMHPCanxo6cTdH5IDrg89z D2UpeR/pjubQvRJHOq2VAAAAAAAA --Apple-Mail=_26328243-7C53-41C7-832F-932D33B5FA77-- From nobody Mon Sep 21 13:36:00 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F040E3A0936; Mon, 21 Sep 2020 13:35:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.847 X-Spam-Level: X-Spam-Status: No, score=-1.847 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Gv4JwIImmocv; Mon, 21 Sep 2020 13:35:56 -0700 (PDT) Received: from mail-io1-xd36.google.com (mail-io1-xd36.google.com [IPv6:2607:f8b0:4864:20::d36]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5E59F3A0930; Mon, 21 Sep 2020 13:35:56 -0700 (PDT) Received: by mail-io1-xd36.google.com with SMTP id z13so16986423iom.8; Mon, 21 Sep 2020 13:35:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=9ycaqGEnhg2Edhxtx4xozB/8lBpkU2A2cM2JvtoIQss=; b=lpK696MTeOSTgorFtFH1FEOmnRDZw/QYOr3Zp6ME9XfYspj4zJ6wHok5dqUIFhmYq2 q5kHk44e52DLTYk10xE7TXgKOBAX4ClfNKkBLe2ACWKtbIxq5GEwkioiR8kOzRPfC5Xw kFNkF3aLhyrskI+ksZjbLqd1SQSyf9DpiTBVvVbGcZ8fTvnYBVgGFkvH2FLfsF5BC+5c mRrG7nDkyAVpCBg6GsSM1a/D5RmbDeL/0UYP9WoUu7nWgTh7ODHGlvX6a0jt2JErIaBS ukHuXnheuGXhtMQ917tjhW2omOaJDAIb65J88in7rsMLwrNuPNGphsH9R3KdjMtKGbUZ egFw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=9ycaqGEnhg2Edhxtx4xozB/8lBpkU2A2cM2JvtoIQss=; b=XAK+SAma8sq0985uz4W3P0phmSgaZ8Q3fFkcHMyxUXbZTHSLXo2NH7vUzyaEUUpRyr z2HanaiiVpil73It3S3Z2j+H8ki74DBvtbJcDGn/wb9+2UZetm78G8BfTRI6iXEcnsZb ZxSscV3G/hujzz+DfWe+qrTTQAEBV2WGPl8IUwSpI+eL67Bm0tkEVAiJ4cJPqIJBGW8Y VpLIotCiQDdAIuRgMclJXh391PfqoEpkzuXVs67lzPswXYJPSp1Qsmnl3xNXJ9/a7CQH b6aADEgPHo8jC5w10uUJ3ZcxXMc1wzGmQx/VDNbilxwqjp51kD5OzmqTGxoAqGkQNd75 7EgA== X-Gm-Message-State: AOAM532JFIRlMQoq8yRK29dti7aSijKcSEAmCGQqOdhNEO+iCmkW0BUS SNGKFTLlRQnzgfj7qkCIIF8/k3xHI/MkUIJLhUaG87t4Ebw= X-Google-Smtp-Source: ABdhPJxGuU9DoZJ4NWSNcM1gA/DRBrmZA3kYU0wQdOmzBhaYPp0017YyYd5AH8qx0zSqI3mxQo+22dI8nk0X8k+XdiA= X-Received: by 2002:a6b:2c44:: with SMTP id s65mr922946ios.185.1600720555041; Mon, 21 Sep 2020 13:35:55 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Donald Eastlake Date: Mon, 21 Sep 2020 16:35:43 -0400 Message-ID: To: "Wessels, Duane" Cc: "iesg@ietf.org" , "draft-ietf-dnsop-dns-zone-digest.all@ietf.org" , secdir Content-Type: multipart/alternative; boundary="00000000000011680e05afd8cc3a" Archived-At: Subject: Re: [secdir] SECDIR review of draft-ietf-dnsop-dns-zone-digest-09 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 21 Sep 2020 20:35:59 -0000 --00000000000011680e05afd8cc3a Content-Type: text/plain; charset="UTF-8" Hi Duane, Thanks, looks good to me. I'll check the draft when it comes out. Donald =============================== Donald E. Eastlake 3rd +1-508-333-2270 (cell) 2386 Panoramic Circle, Apopka, FL 32703 USA d3e3e3@gmail.com On Mon, Sep 21, 2020 at 1:31 PM Wessels, Duane wrote: > Donald, > > Thanks again for this draft review and feedback. After discussions among > the coauthors we have made the further changes that you suggest. Namely: > > - minimum digest length of 12 octets > - added SHA512 as algorithm 2 > - local policy allows some schemes / algorithms to be ignored > - implementation status moved to an appendix > > I think there are no more outstanding issues. I will be posting an > updated revision of the draft shortly. > > DW > > > > On Sep 15, 2020, at 7:34 PM, Donald Eastlake wrote: > > > > Hi Duane, > > > > Thanks for accepting most of my suggestions. > > > > See my responses below at on the items we are still discussing. > > > > On Tue, Sep 15, 2020 at 11:38 AM Wessels, Duane > wrote: > > Thanks Don for the extensive review! tl;dr, we did accept most/many of > your suggestions already, except these items may warrant further discussion: > > > > - minimum digest length > > - more hash algorithms than SHA-384 > > - local policy when verifying multiple digests > > - implementation status section > > > > More responses inline below. > > > > DW > > > > > On Sep 12, 2020, at 6:53 PM, Donald Eastlake wrote: > > > > > ... > > > > > > 2) The minimum size of the Digest Field, 1 octet, seems too small. > > > Typical minimum size for such a field in IETF protocols seems to be 96 > > > bits or 12 octets, so that, at least with a strong hash function, you > > > have a reasonable resistance against brute force attacks. Also, while > > > it is fairly obvious, you might want to mention how a receiver > > > determines the length of the Digest Field. > > > > > > OLD (Section 2.2.4) > > > The Digest field must not be empty. > > > > > > NEW > > > The Digest Field MUST NOT be shorter than 12 octets. If it is, the > > > ZONEMD RR containing that short digest cannot be used to verify a > > > zone. The length of the digest field is determined by deducting the > > > fixed size of the Serial, Scheme, and Hash Algorithm fields from the > > > RDATA size in the ZONEMD RR header. > > > > I'm not necessarily opposed to a minimum digest size. Do you envision > > any complications with private use algorithms though? It seems a little > > strange to allow private use algorithms whose digest value could be > anything, > > but requiring a minimum size (which could then simply be padded I know). > > > > Well, it looked to me like the draft already had a minimum Digest > field, namely one octet, since it said the Digest Field couldn't be empty. > As I recall, the digest didn't say what to do if the Digest field was zero > length but I presume it would mean that the ZONEMD RR was malformed and > thus could not be used to validate a zone. Seems like the minimum length > would apply to private use algorithms also. See Section 5.2.2.1 of > https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-rfc2845bis-09 > > > > > 3) SHA384 / algorithm agility > > > -- here are some thoughts/comments on SHA384 and algorithm agility: > > ... > > > > > > 3c) SHA2-384 is just SHA2-512 with some different initialization > > > values and with the 512 bit output truncated to 384. Thus the > > > incremental effort of providing SHA2-512 in tiny if you have SHA2-384 > > > (and vice versa). So, if SHA2-384 is mandatory, then you might as well > > > make SHA2-512 mandatory also since you get it for probably <1% > > > incremental effort. Having two mandatory algorithms with some people > > > using one and some the other would provide some real confidence that > > > implementations were actually looking at the Hash Algorithm Field, > > > could handle Digest Fields of different length, etc., and the > > > algorithm agility mechanisms might actually work. It currently looks a > > > bit like only lip service is being paid to algorithm agility. > > > > In an earlier version of the draft, four algorithms were defined, > although > > none "past" SHA-384. There was a (Oct 2018) discussion to make SHA-384 > > the mandatory algorithm and drop all the weaker ones. > > > > I'm not necessarily opposed to adding more mandatory-to-implement > algorithms > > if there is working group consensus about that, but it feels like a > pretty > > significant and late change? > > > > I agree it is a significant change in the draft. But, as I say, if > you have SHA-384 you have 99+% of the crypto code you need for SHA-384 and > SHA-512. Of course, SHA-512 has an even longer value, 64 bytes, but with > just one or at most a few ZONEMD RRs at the zone apex, that does not seem > to be a problem. Of my security comments, I rate adding a 2nd hash > algorithm as the most important. It could be that the 2nd algorithm would > be a SHOULD rather than a MUST. And, if a second algorithm is added, I > think SHA-512 would be the easiest for implementers. > > > > > 3d) On algorithm agility generally: There is a reasonable provision in > > > the ZONEMD RR for a hash algorithm identifier. But, given that this > > > is Standards Track I would have expected there to be hash algorithms > > > specified of different types with one a MUST implement and one a > > > SHOULD implement -- possible more but at least that. Blake or SHA3 > > > would be example of a different algorithm type from SHA2. But I admit > > > that SHA2-384/512 is very strong and a break in it significant enough > > > to make much difference seems very unlikely. > > > > Same as above. > > > > Response above. > > > > > 4) There is no mention of local policy. If at some point there are > > > multiple hash algorithms and/or schemes specified (which could include > > > private use algorithms and schemes), a ZONEMD zone validator would > > > likely need a local policy as to which algorithm/scheme digest it will > > > pay attention to. See, for example, the first paragraph of Section 4 > > > which assumes any good digest should be good enough to validate the > > > zone for any verifier. > > > > The draft-ietf-dnsop-dns-zone-digest-00 version did have the following > text that spoke to this: > > > > > It is RECOMMENDED that implementations maintain a (possibly > > > configurable) list of supported Digest Type algorithms ranked from > > > most to least preferred. It is further RECOMMENDED that recipients > > > use only their most preferred algorithm that is present in the zone > > > for digest verification. > > > > > > As a matter of local policy, the recipient MAY require that all > > > supported and present Digest Type algorithms verify the zone. > > > > There was a thread on DNSOP where we had agreement to > > take those two paragraphs out: > > > > https://mailarchive.ietf.org/arch/msg/dnsop/RFCklH7Lx00bL-tOVRCAc0j5ftw/ > > > > I went and read that thread. I agree that the text removed was kind > of complex. I was just worried that the text in Section 4 too strongly > implied that an implementation must accept a zone if a ZONEMD validates. > True, it does have text about "supporting" the Scheme and Hash Algorithm > but conceivable you could support a Scheme and a Hash Algorithm but have a > policy against accepting a ZONEMD RR that combined them and in any case I > suspect the draft is using "supported" in the sense of "implemented". I'd > be happy with adding just one sentence in Section 4 something like "The > verifier MAY ignore a ZONEMD if the Scheme and Hash Algorithm violates > local policy." > > ... > > > 6e. Actually, 240-254 seems like a lot of values for Private Use. Why > > > would you need 15 private hash algorithms within one administrative > > > area? If you think there are going to be lots of private/proprietary > > > hashes (national vanity crypto?) that get used moderately widely, > > > there should be a provision for "vendor specific" hash algorithms > > > where the "Digest Field" actually starts with a "vendor" identifier. > > > > It seemed a reasonable amount to us, but if others think it should be > > smaller that shouldn't be a problem. > > > > OK. It isn't gigantic or anything, just a bit larger than the 3 or > 4 or so values I typically see. > > > > ... > > > 12. Having an Implementation Status section (Section 10) is good while > > > a draft is going through the approval process, but I think it is, as > > > indicated in RFC 7942, inappropriate in a resulting standards track > > > RFC. Furthermore, all of the disclaimer text given in RFC 7942 is > > > missing here. So, I believe similar disclaimer text should be added > > > and the RFC Editor should be requested to drop this section before > > > publication. > > > > The authors feel it could be useful, even though it is expected to > > become out-of-date. Looks like some other published RFCs have kept > > their Implementation Status sections, sometimes as an appendix? > > > > OK... I think that if retained it would be much better as an > appendix. > > > > ... > > > ATTACHMENT > > > > > > Taking into account the above and to make other editorial suggestions, > > > I have done an editing pass over the draft the results of which are > > > attached. I hope you find it helpful. > > > > Thank you, we did find it very helpful. > > > > You're welcome. > > > > Donald > > =============================== > > Donald E. Eastlake 3rd +1-508-333-2270 (cell) > > 2386 Panoramic Circle, Apopka, FL 32703 USA > > d3e3e3@gmail.com > > --00000000000011680e05afd8cc3a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Duane,

Thanks, looks good= to me. I'll check the draft when=C2=A0it comes out.

Donald=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D
=C2=A0Donald E. Eastlake 3rd =C2=A0 +1-508-333-= 2270 (cell)
=C2=A02386 Panoramic Circle, Apopka, FL 32703 USA
=C2=A0<= a href=3D"mailto:d3e3e3@gmail.com" target=3D"_blank">d3e3e3@gmail.com


On Mon, Sep 21, 2020 at 1:31 PM Wessels, Duane <dwessels@verisign.com> wrote:
Donald,

Thanks again for this draft review and feedback.=C2=A0 After discussions am= ong the coauthors we have made the further changes that you suggest.=C2=A0 = Namely:

=C2=A0- minimum digest length of 12 octets
=C2=A0- added SHA512 as algorithm 2
=C2=A0- local policy allows some schemes / algorithms to be ignored
=C2=A0- implementation status moved to an appendix

I think there are no more outstanding issues.=C2=A0 I will be posting an up= dated revision of the draft shortly.

DW


> On Sep 15, 2020, at 7:34 PM, Donald Eastlake <d3e3e3@gmail.com> wrote:
>
> Hi Duane,
>
> Thanks for accepting most of my suggestions.
>
> See my responses below at <de> on the items we are still discuss= ing.
>
> On Tue, Sep 15, 2020 at 11:38 AM Wessels, Duane <dwessels@verisign.com> wrot= e:
> Thanks Don for the extensive review!=C2=A0 tl;dr, we did accept most/m= any of your suggestions already, except these items may warrant further dis= cussion:
>
> - minimum digest length
> - more hash algorithms than SHA-384
> - local policy when verifying multiple digests
> - implementation status section
>
> More responses inline below.
>
> DW
>
> > On Sep 12, 2020, at 6:53 PM, Donald Eastlake <d3e3e3@gmail.com> wrote:
> >
> ...
> >
> > 2) The minimum size of the Digest Field, 1 octet, seems too small= .
> > Typical minimum size for such a field in IETF protocols seems to = be 96
> > bits or 12 octets, so that, at least with a strong hash function,= you
> > have a reasonable resistance against brute force attacks. Also, w= hile
> > it is fairly obvious, you might want to mention how a receiver > > determines the length of the Digest Field.
> >
> > OLD (Section 2.2.4)
> > The Digest field must not be empty.
> >
> > NEW
> > The Digest Field MUST NOT be shorter than 12 octets. If it is, th= e
> > ZONEMD RR containing that short digest cannot be used to verify a=
> > zone.=C2=A0 The length of the digest field is determined by deduc= ting the
> > fixed size of the Serial, Scheme, and Hash Algorithm fields from = the
> > RDATA size in the ZONEMD RR header.
>
> I'm not necessarily opposed to a minimum digest size.=C2=A0 Do you= envision
> any complications with private use algorithms though?=C2=A0 It seems a= little
> strange to allow private use algorithms whose digest value could be an= ything,
> but requiring a minimum size (which could then simply be padded I know= ).
>=C2=A0
> <de> Well, it looked to me like the draft already had a minimum = Digest field, namely one octet, since it said the Digest Field couldn't= be empty. As I recall, the digest didn't say what to do if the Digest = field was zero length but I presume it would mean that the ZONEMD RR was ma= lformed and thus could not be used to validate a zone. Seems like the minim= um length would apply to private use algorithms also. See Section 5.2.2.1 o= f https://datatracker.ietf.org/d= oc/html/draft-ietf-dnsop-rfc2845bis-09
>
> > 3) SHA384 / algorithm agility
> > -- here are some thoughts/comments on SHA384 and algorithm agilit= y:
> ...
> >
> > 3c) SHA2-384 is just SHA2-512 with some different initialization<= br> > > values and with the 512 bit output truncated to 384. Thus the
> > incremental effort of providing SHA2-512 in tiny if you have SHA2= -384
> > (and vice versa). So, if SHA2-384 is mandatory, then you might as= well
> > make SHA2-512 mandatory also since you get it for probably <1%=
> > incremental effort. Having two mandatory algorithms with some peo= ple
> > using one and some the other would provide some real confidence t= hat
> > implementations were actually looking at the Hash Algorithm Field= ,
> > could handle Digest Fields of different length, etc., and the
> > algorithm agility mechanisms might actually work. It currently lo= oks a
> > bit like only lip service is being paid to algorithm agility.
>
> In an earlier version of the draft, four algorithms were defined, alth= ough
> none "past" SHA-384.=C2=A0 There was a (Oct 2018) discussion= to make SHA-384
> the mandatory algorithm and drop all the weaker ones.
>
> I'm not necessarily opposed to adding more mandatory-to-implement = algorithms
> if there is working group consensus about that, but it feels like a pr= etty
> significant and late change?
>
> <de> I agree it is a significant change in the draft. But, as I = say, if you have SHA-384 you have 99+% of the crypto code you need for SHA-= 384 and SHA-512. Of course, SHA-512 has an even longer value, 64 bytes, but= with just one or at most a few ZONEMD RRs at the zone apex, that does not = seem to be a problem. Of my security comments, I rate adding a 2nd hash alg= orithm as the most important. It could be that the 2nd algorithm would be a= SHOULD rather than a MUST. And, if a second algorithm is added, I think SH= A-512 would be the easiest for implementers.
>=C2=A0
> > 3d) On algorithm agility generally: There is a reasonable provisi= on in
> > the ZONEMD RR for a hash algorithm identifier.=C2=A0 But, given t= hat this
> > is Standards Track I would have expected there to be hash algorit= hms
> > specified of different types with one a MUST implement and one a<= br> > > SHOULD implement -- possible more but at least that. Blake or SHA= 3
> > would be example of a different algorithm type from SHA2. But I a= dmit
> > that SHA2-384/512 is very strong and a break in it significant en= ough
> > to make much difference seems very unlikely.
>
> Same as above.
>
> <de> Response above.
>
> > 4) There is no mention of local policy. If at some point there ar= e
> > multiple hash algorithms and/or schemes specified (which could in= clude
> > private use algorithms and schemes), a ZONEMD zone validator woul= d
> > likely need a local policy as to which algorithm/scheme digest it= will
> > pay attention to.=C2=A0 See, for example, the first paragraph of = Section 4
> > which assumes any good digest should be good enough to validate t= he
> > zone for any verifier.
>
> The draft-ietf-dnsop-dns-zone-digest-00 version did have the following= text that spoke to this:
>
> >=C2=A0 =C2=A0It is RECOMMENDED that implementations maintain a (po= ssibly
> >=C2=A0 =C2=A0configurable) list of supported Digest Type algorithm= s ranked from
> >=C2=A0 =C2=A0most to least preferred.=C2=A0 It is further RECOMMEN= DED that recipients
> >=C2=A0 =C2=A0use only their most preferred algorithm that is prese= nt in the zone
> >=C2=A0 =C2=A0for digest verification.
> >
> >=C2=A0 =C2=A0As a matter of local policy, the recipient MAY requir= e that all
> >=C2=A0 =C2=A0supported and present Digest Type algorithms verify t= he zone.
>
> There was a thread on DNSOP where we had agreement to
> take those two paragraphs out:
>
> https://mailarchive.iet= f.org/arch/msg/dnsop/RFCklH7Lx00bL-tOVRCAc0j5ftw/
>=C2=A0
> <de> I went and read that thread. I agree that the text removed = was kind of complex. I was just worried that the text in Section 4 too stro= ngly implied that an implementation must accept a zone if a ZONEMD validate= s. True, it does have text about "supporting" the Scheme and Hash= Algorithm but conceivable you could support a Scheme and a Hash Algorithm = but have a policy against accepting a ZONEMD RR that combined them and in a= ny case I suspect the draft is using "supported" in the sense of = "implemented". I'd be happy with adding just one sentence in = Section 4 something like "The verifier MAY ignore a ZONEMD if the Sche= me and Hash Algorithm violates local policy."
> ...
> > 6e. Actually, 240-254 seems like a lot of values for Private Use.= Why
> > would you need 15 private hash algorithms within one administrati= ve
> > area? If you think there are going to be lots of private/propriet= ary
> > hashes (national vanity crypto?) that get used moderately widely,=
> > there should be a provision for "vendor specific" hash = algorithms
> > where the "Digest Field" actually starts with a "v= endor" identifier.
>
> It seemed a reasonable amount to us, but if others think it should be<= br> > smaller that shouldn't be a problem.
>
>=C2=A0 <de> OK. It isn't gigantic or anything, just a bit lar= ger than the 3 or 4 or so values I typically see.
>
> ...
> > 12. Having an Implementation Status section (Section 10) is good = while
> > a draft is going through the approval process, but I think it is,= as
> > indicated in RFC 7942, inappropriate in a resulting standards tra= ck
> > RFC. Furthermore, all of the disclaimer text given in RFC 7942 is=
> > missing here. So, I believe similar disclaimer text should be add= ed
> > and the RFC Editor should be requested to drop this section befor= e
> > publication.
>
> The authors feel it could be useful, even though it is expected to
> become out-of-date.=C2=A0 =C2=A0Looks like some other published RFCs h= ave kept
> their Implementation Status sections, sometimes as an appendix?
>=C2=A0
> <de> OK... I think that if retained it would be much better as a= n appendix.
>
>=C2=A0 ...
> > ATTACHMENT
> >
> > Taking into account the above and to make other editorial suggest= ions,
> > I have done an editing pass over the draft the results of which a= re
> > attached.=C2=A0 I hope you find it helpful.
>
> Thank you, we did find it very helpful.
>
> <de> You're welcome.
>=C2=A0
> <de> Donald
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D
>=C2=A0 Donald E. Eastlake 3rd=C2=A0 =C2=A0+1-508-333-2270 (cell)
>=C2=A0 2386 Panoramic Circle, Apopka, FL 32703 USA
>=C2=A0 d3e3e3@gma= il.com

--00000000000011680e05afd8cc3a-- From nobody Tue Sep 22 10:56:45 2020 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 90AE93A18B7; Tue, 22 Sep 2020 10:56:35 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Brian Weis via Datatracker To: Cc: draft-ietf-spring-srv6-network-programming.all@ietf.org, last-call@ietf.org, spring@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.17.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <160079739555.27095.23366687198553864@ietfa.amsl.com> Reply-To: Brian Weis Date: Tue, 22 Sep 2020 10:56:35 -0700 Archived-At: Subject: [secdir] Secdir telechat review of draft-ietf-spring-srv6-network-programming-19 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Sep 2020 17:56:36 -0000 Reviewer: Brian Weis Review result: Ready I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. This is a re-review; thanks to the authors for addressing suggestions made in the first review. The new security considerations text is good, and logically correct so I've marked this document as "Ready". But let me explain one way I think that it could be improved. The last email exchange was about suggesting that the HMAC TLV be used even when an SRH is not included in the packet. The newest text "regardless of the number of segments in the segment list" implies this case, but there is still a concern is that implementors won't get this hint about the possible need to protect just one segment where the SRH is omitted because it's not needed. It would be nice if this sentence could be more explicit about the need for an HMAC TLV in this case. For example, something like: "regardless of the number of segments in the segment list." "regardless of whether the segments are defined in an SRH header or a single segment is passed in the Destination Address." Thanks. From nobody Wed Sep 23 09:41:51 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D7C0F3A041C; Wed, 23 Sep 2020 09:40:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=verisign.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DmBm0qMaqOUW; Wed, 23 Sep 2020 09:40:44 -0700 (PDT) Received: from mail3.verisign.com (mail3.verisign.com [72.13.63.32]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5F5B13A11E7; Wed, 23 Sep 2020 09:40:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=verisign.com; l=17828; q=dns/txt; s=VRSN; t=1600879246; h=from:to:cc:date:message-id:references:in-reply-to: mime-version:subject; bh=rCZkgMTVCO3dmM8QFaozJhZ+CZ7nLLuff/RHRHaYOwU=; b=Og7DEljiUqi7qgTKIlDNrxom6KN7Pt22vzeo6863aeQJAHs3vHHuAi/G 5vm3dmcTJLP3zRyLQUV2O+dkR62ferDIpBMg4j2/ymcBQCaau7ZgbfA/7 f3qshj7H4xCgg5uqG2I/FEg7ss+BXhs3Li+/lQmu2GnZxe7qaogmhlI/d gkOjtrHwm0TXPM6MI3Ip0NWSkfb4qKbyR2xs2etu63XbBLMBRQfeOQeGU nFsGhTSIMqj3NLDOFvXqfeyHiYRhxp2tdjeo6OeDa8YIGvoZqsdLOpTAJ u7X4U3d2N5hpt2TYtV5+b9WPaVBFQhzgCHE/1GLUvWNjkLtSsV9zgCaXO g==; IronPort-SDR: u/6mVTcqtnCUMmgg40w0v01zHttFNBCP9QCFtIX9c059gwtiyBIsmG/q9uuf4jlLSww9IrdHxE 2Qb00kz6mJu/052DUBarrnIGn9hsDW2kbC3XDBWgsaZyB241bhoiy53w7LmP4FLW9v8hI8n1zx 9mgSUXwibKdIbekaHkx83bS3dPji6xbE5QS1gL6O86K2mFslqGNdzwo5qDWerX4ua/CYYa47Fe StpEy0vn4KNk/ltEuZ9WhShRuJiLAI156A0swwHgvNqZ3zMid7PgYPgXgSflC4me24OpdTiY1H +qI= X-IronPort-AV: E=Sophos; i="5.77,293,1596499200"; d="p7s'?scan'208"; a="3108789" IronPort-PHdr: =?us-ascii?q?9a23=3ARan4oh0EwIsDaVIOsmDT+DRfVm0co7zxezQtwd?= =?us-ascii?q?8ZsesXLP3xwZ3uMQTl6Ol3ixeRBMOHsq0C0rSd4vCoGTRZp8rY7jZaKN0Efi?= =?us-ascii?q?RGoP1epxYnDs+BBB+zB9/RRAt+Iv5/UkR49WqwK0lfFZW2TVTTpnqv8WxaQU?= =?us-ascii?q?2nZkJ6KevvB4Hdkdm82fys9J3PeQVIgye2ba9vIBmsogjdq8sbjZF/JqswxR?= =?us-ascii?q?fEpnhFcPlSyW90OF6fhRnx6tqx8ZJ57yhcp/ct/NNcXKvneKg1UaZWByk8PW?= =?us-ascii?q?Av483ruxjDTQ+R6XYZT24bjBlGDRXb4R/jRpv+vTf0ueR72CmBIM35Vqs0Vi?= =?us-ascii?q?i476dqUxDnliEKPCMk/W7Ni8xwiKVboA+9pxF63oXZbp2ZOOZ4c6jAZt4RW3?= =?us-ascii?q?ZPUdhNWCxAGoO8bpUAD+wdPeZDsoLxo0ICoQaiCQWwAe/izCJDiH3r0q0gy+?= =?us-ascii?q?kvER/I0hE8H9wAs3rUotf6OqATUe+pw6bF1jrDY+9T2Trn6IjEbg4trPeRVr?= =?us-ascii?q?xwa8rRzkwvGhvLglqQt4PlJCiV2foJs2iA9+ZrSOyhi3M9pAF3vDejyNonh4?= =?us-ascii?q?7UiYMb1F/E7j55z5gxJd2jU0N7f8CrEIFRtyGBNot2TcUiT3t0tyY9z70LoJ?= =?us-ascii?q?i2dzUFx5o73RDQceCHc5SW7RL5UuacOSl1iXJ5db+9hhu/80aux+79W8Wp31?= =?us-ascii?q?hEoCRLn9vOu30J1xHd5MyKR/h/80q/2zuB1wDd5/9YLE40kafVJZAsz702m5?= =?us-ascii?q?EOv0rDGSr2l1/3jK+Qbkgr5umo6//7bbXhvJOTK4h0igTmPqQvhMO/Heo4Ph?= =?us-ascii?q?IJX2iB9uSx0qDo807hQLhSk/E6jrPVvI3YKMkVvKK1Hg9Y34g55xuwDDqqyM?= =?us-ascii?q?kUkWUdIF5Yeh+Lk5LlN0zBLf37F/uznlehnTF2zP7cJLLhGI/CLn3bnbfker?= =?us-ascii?q?Zy9lBTxRIozdBa+5JUErYBIO/vWkPptNzXEBs5Mwuszuv6FNtzzp4SVmKXDK?= =?us-ascii?q?GWMazerUKE6vgxI+aQY48Voi79J+I/6PHzl3M5h0UdfbKv3ZcNdH+4GfFmL1?= =?us-ascii?q?2YYXrqnNgBDX8HshciQODwlVGPUzBea2yvU6886Dw3Eo2rAITbSoComrOB3S?= =?us-ascii?q?O7HpNMZmBBD1CBCWrndouaVPcXcyKdPMthkicfWLi/VYAhzxCutBT7y7poKO?= =?us-ascii?q?rY4DEXtZXm1NRt/e3ciQky9SBoD8Say2yNSnp0nmETSj8wwKB/oVR9xUmZ0a?= =?us-ascii?q?h9nvxYCcZc5+9IUgc9M57Q1fB1C9f3WgjZZNeGVE6mQsm6ATE2Vt8+3tkOY1?= =?us-ascii?q?16G9W6lR3D3jSlA6Mbl7CRA5w06K3c1WDrJ8lh03bGyLUhj14+T8tOK2Kmna?= =?us-ascii?q?F/+hPSB4HXj0WZmbymdaMG3C7C7G2D13aBvFlEUA5sVqXIRWsfaVXKotvk50?= =?us-ascii?q?PCVaSjCbU5PQtdx86OMKxKasfmjQYOePC2HdXVY2u8ny+LGTSPxrWXJN7vYG?= =?us-ascii?q?c12jndEEUelh0P9GqHMg54DSCk9THwFjtrQBjQblj3/O1l7DuXU0YywkvCO0?= =?us-ascii?q?F+2qGu9xoOreKRUfII370C/iwmrmMnTx6Gw9vKBo/Y9EJad6JGbIZ4uQ8f2A?= =?us-ascii?q?=3D=3D?= X-IPAS-Result: =?us-ascii?q?A2E0AAAHemtf/zCZrQpgGQEBAQEBAQEBAQEBAQEBAQEBA?= =?us-ascii?q?RIBAQEBAQEBAQEBAQFAgU+DGiyBCAqVTiaDepgnBAcBAQEBAQEBAQEEBAEbF?= =?us-ascii?q?AQBAQKESQKCLCU4EwIDAQELAQEBBQEBAQEBBgMBAQEChkUMgjcpAXOBAwEBA?= =?us-ascii?q?QEBAQEBAQEBAQEBAQEBAQEWAkNVEgEBHQEBAQECAScgJwsFCwIBCBguAjAlA?= =?us-ascii?q?gQOBQ6DGAGCXBG3BnSBATODOIIbhQsQgTiBUwmLa4FCPoERJwwQgk0+glwCA?= =?us-ascii?q?4EzKBgngwyCLQSQBIpSgn2IVZELAweCZ4RHgl+BU5FcH4MMgSeIVJQCryODX?= =?us-ascii?q?AIEAgQFAhWBa4F7cBUaISoBgj4JNRIXAg2OKAIYiGKFQnQ3AgYKAQEDCYwZA?= =?us-ascii?q?i2BBjJfAQE?= Received: from BRN1WNEX01.vcorp.ad.vrsn.com (10.173.153.48) by BRN1WNEX01.vcorp.ad.vrsn.com (10.173.153.48) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1979.3; Wed, 23 Sep 2020 12:40:41 -0400 Received: from BRN1WNEX01.vcorp.ad.vrsn.com ([fe80::a89b:32d6:b967:337d]) by BRN1WNEX01.vcorp.ad.vrsn.com ([fe80::a89b:32d6:b967:337d%4]) with mapi id 15.01.1979.003; Wed, 23 Sep 2020 12:40:41 -0400 From: "Wessels, Duane" To: Michael StJohns CC: dnsop , The IESG , secdir Thread-Topic: [EXTERNAL] Re: [DNSOP] I-D Action: draft-ietf-dnsop-dns-zone-digest-10.txt Thread-Index: AQHWkETTMQ8NU9ufI0qNlwpBjJp1Oql2sw8A Date: Wed, 23 Sep 2020 16:40:40 +0000 Message-ID: <9C60879E-20A2-49BE-9712-CB52C5CCFD33@verisign.com> References: <160071009516.32585.7690187581775122560@ietfa.amsl.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-mailer: Apple Mail (2.3445.104.15) x-originating-ip: [10.170.148.18] Content-Type: multipart/signed; boundary="Apple-Mail=_7C924EEC-3ACE-427A-9E35-DFA907E55987"; protocol="application/pkcs7-signature"; micalg=sha-256 MIME-Version: 1.0 Archived-At: Subject: Re: [secdir] [DNSOP] I-D Action: draft-ietf-dnsop-dns-zone-digest-10.txt X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Sep 2020 16:40:47 -0000 --Apple-Mail=_7C924EEC-3ACE-427A-9E35-DFA907E55987 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Mike & everyone, Here's a response on behalf of the coauthors. > On Sep 21, 2020, at 12:06 PM, Michael StJohns = wrote: >=20 > Adding IESG - I didn't realize it was in IESG evaluation. >=20 > I'm not sure why this version was posted as there is nothing on the = datatracker that indicates there were IESG issues to be resolved. There = are several changes that were non-editorial that really shouldn't have = been included without WG review. 2.2.4 is the one that I would have = problems with the most. >=20 > Mike >=20 >=20 > On 9/21/2020 2:26 PM, Michael StJohns wrote: >> 1.4.4 - "has not been modified." -> "has not been modified between = origination and retrieval." That proposed addition is fine with us, but note that sentence is not = new and hasn't changed since Oct 2018. >>=20 >> 2.2.2 - "MUST be implemented" -> "SHOULD be implemented. Failure to = implement this scheme without other standardized schemes being specified = may result in a receiver being unable to validate the zone. However, it = is possible to use ZONEMD with a private scheme, and for that reason the = requirement is set at "SHOULD"". "and MUST be implemented" was added based on advice from the SECDIR = review. Previously there was no discussion of implementation requirements in = this section. Our opinion is that MUST is appropriate here. The suggestion to change from MUST to SHOULD just because there are = private code points seems strange. >>=20 >> 2.2.3 - "SHA384...that MUST be implemented." -> "SHA384 is the only = mandatory hash algorithm currently defined for the SIMPLE scheme, and = MUST be implemented if the SIMPLE scheme is implemented". Language here probably depends on whether or not 2.2.2 needs changes. = Our opinion is that "SHA384 MUST be implemented" is preferred and = sufficient. >>=20 >> 2.2.4 - SHA384 has a hash length of 48 bytes. 12 bytes seems to = imply some sort of left or right truncation. Show stopper! Explain how = this value was selected and how it interacts with the native length of = the chosen hash. Note: I have no trouble with truncated hashes here, but = no modern hash has less than 20 bytes so 12 seems to be a very strange = number absent a discussion of truncated hashes. I think you're referring to this changed sentence in 2.2.4, which was = made in response to the SECDIR review: OLD: The Digest field MUST NOT be empty. NEW: The Digest field MUST NOT be shorter than 12 octets. We're not sure if you're referring to the idea that longer hashes could be truncated. We are not suggesting that. 2.2.3 also says: When SHA384 is used, the size of the Digest field is 48 octets. and similarly for SHA512 at 64 octets. Also there is a new paragraph in 4(5)(D) which says: D. The Digest field size MUST be checked. If the size of the given Digest field is smaller than 12 octets, or if the size is not equal to the size expected for the corresponding Hash Algorithm, verification MUST NOT be considered successful with this ZONEMD RR and the verifier SHOULD report that the RR's digest could not be verified to to an incorrect digest length. I see for RFC 4509 (SHA-256 for DS RRs) says "The results of the digest algorithm MUST NOT be truncated." Are you suggesting the same language for this draft? On the other hand, if you're just wondering where 12 came from (versus some other value), that was Donald's suggestion ("Typical minimum size = for such a field in IETF protocols seems to be 96 bits or 12 octets"). >>=20 >> 3.1 - "It is RECOMMENDED...SOA". Add "However, the TTL of the ZONEMD = record may be safely ignored during verification in all cases." Okay. >>=20 >> 6.2 - *sigh* No. Basically, this allows a zone that is done ZONEMD = to push back on a parent zone that's doing key updates. (e.g. its not = the keys in the zone being ZONEMD you're concerned about in this = paragraph, but the keys in all of the parent zones). Use *EXACTLY* the = same model for ZONEMD that DNSSEC would use and with exactly the same = implications for verification. I'd delete this paragraph in its = entirety. This subsection below was added in response to Stephane Bortzmeyer's = lastcall comments: 6.2. DNSSESC Timing Considerations As with all DNSSEC signatures, the ability to perform signature validation of a ZONEMD record is limited in time. If the DS record(s) or trust anchors for the zone to be verified are no longer available, the recipient cannot validate the ZONEMD RRSet. This could happen even if the ZONEMD signature is still current (not expired), since the zone's DS record(s) may have been withdrawn following a KSK rollover. For zones where it may be important to validate a ZONEMD RRSet through its entire signature validity period, the zone operator should ensure that KSK rollover timing takes this into consideration. All this says is that a zone that deploys ZONEMD may want to keep = signature validity periods of ZONEMD RRs in mind when thinking about a KSK = rollover. (Stephane's suggested text ended with "Verification must be timely" but our opinion is that its better here to put the onus on the zone operator to do the right thing if that is important to them.) A signed zone with a ZONEMD RR will always contain the KSK and ZSK = DNSKEY RRs. To build a chain of trust for validation, the application needs to join the "offline" in-zone DNSSEC data with the "online" ancestor DNSSEC data, and the link between those two is the zone's DS record. If that = DS record is no longer there (due to a rollover) then validation could = fail. But parent zone rollover won't have any impact on whether or not the = ZONEMD zone's DS record is still there or not. DW >>=20 >> Mike >>=20 >>=20 >> On 9/21/2020 1:41 PM, internet-drafts@ietf.org wrote: >>> A New Internet-Draft is available from the on-line Internet-Drafts = directories. >>> This draft is a work item of the Domain Name System Operations WG of = the IETF. >>>=20 >>> Title : Message Digest for DNS Zones >>> Authors : Duane Wessels >>> Piet Barber >>> Matt Weinberg >>> Warren Kumari >>> Wes Hardaker >>> Filename : draft-ietf-dnsop-dns-zone-digest-10.txt >>> Pages : 36 >>> Date : 2020-09-21 >>>=20 >>> Abstract: >>> This document describes a protocol and new DNS Resource Record = that >>> provides a cryptographic message digest over DNS zone data. The >>> ZONEMD Resource Record conveys the digest data in the zone = itself. >>> When a zone publisher includes a ZONEMD record, recipients can = verify >>> the zone contents for accuracy and completeness. This provides >>> assurance that received zone data matches published data, = regardless >>> of how the zone data has been transmitted and received. >>>=20 >>> ZONEMD does not replace DNSSEC. Whereas DNSSEC protects = individual >>> RRSets (DNS data with fine granularity), ZONEMD protects a zone's >>> data as a whole, whether consumed by authoritative name servers, >>> recursive name servers, or any other applications. >>>=20 >>> As specified herein, ZONEMD is impractical for large, dynamic = zones >>> due to the time and resources required for digest calculation. >>> However, The ZONEMD record is extensible so that new digest = schemes >>> may be added in the future to support large, dynamic zones. >>>=20 >>>=20 >>> The IETF datatracker status page for this draft is: >>> = https://secure-web.cisco.com/1Bciq9FKQYC7LPRB_xc5DUd2eectN1vID6gMeVeUvZjsC= 9YJ6gR0Y1X9uKqk-E2hG-aupvQW-vJixykihX8foFWsEamul7uYumJ9pTn4rB2bsVFllxWQ6oZ= Ycw-f-GGBMzQPdjAvKUr42B5YYlZeminoQpdGMpfzqiTPiIf6vU1SKSq5s3jVaTfKuVkN-_Hpv= moKQdG4kF6OOW151OV2KBsWnc2bA5IPTjW5r7J0Sa5ZoOJQAIpSdds4gNXh5I2XQKsdKzVJHoH= PYxO6RVeoHvQ/https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ietf-dnsop-d= ns-zone-digest%2F >>>=20 >>> There are also htmlized versions available at: >>> = https://secure-web.cisco.com/191c0vgh-YAcjBXWPCGyC3caoo2F3ilqCOrud8-TE4fax= QzDDn4SgJj_5KNvmW1EazmC4NuCiiUsbyAdqYuFsa98WTDQXcDMgSv8pqeEoFb7dpJhdYd2Fyr= aNlGPm4q7QPqIYYu5QalekRcQEy7n7nCVhgTXo0z-Xcu0PScviu0-Qc8HL0xPWtiXIzDZoPTyc= ATAdOw3o-9NTa1QnZ8fFSeCxnAUmrQ93OmqhhLqh0nc7lPWU72oQl5JcLO3xhxSXyVbaYnClq4= BUj1Bh_SFrffbcd3W-_0zt0bRg_SC2Kso/https%3A%2F%2Ftools.ietf.org%2Fhtml%2Fdr= aft-ietf-dnsop-dns-zone-digest-10 >>> = https://secure-web.cisco.com/1o_pTg6x9j3zM6iNdwzB7XFoHZ6jjmWxkJLq1l9p422P_= QEAlIIFZ8bj2jPIBDZTVt9cWgyCpAad0tlIvbbHUhMygGbbFwLCwnh0c1x87jQB2jgb3haHbni= k618V_d9SYC7678tVdYSxh0dvguXLVpiQKfAUuB-o5Ln8kucsB-4rCXNhcZlsLSfM3UeckZwgK= kYmpDKI5s9qb830pu_sgsTf0ktpZmExbwFHQ-WhtaU75jhTVI3ysAgHF9IoaB86ehBCXAj9GWr= AU0SbaKBV4uw/https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fhtml%2Fdraft-ietf-= dnsop-dns-zone-digest-10=20 >>>=20 >>> A diff from the previous version is available at: >>> = https://secure-web.cisco.com/1HGjXQI_4iLK5f4sDQfn5qQ6z9HYWmDKDJO1dAqOTnP2Q= wJyb371KfblT4labrcqaQFw4KICgfJ0q7J8gdnsntJq08bJFPNI9rpKF3JSaDic8n1nVza2er1= QT9kny4MsnhD8LphgKurPjREbcq95d8JMRk8hj8pJ82_rOYO9Yepfr-C2Yy4uDXpB4V5POETKn= RoV6BTsBElgyIeQbIcHrDhuSFV9LaDWP-hbsnbWYJ5wlB9ln4s3d1czbYruB1gpg3VXKWnuk_p= e9EhmCBlNa0VrMlKfrKPzkRCV9oL4IGow/https%3A%2F%2Fwww.ietf.org%2Frfcdiff%3Fu= rl2%3Ddraft-ietf-dnsop-dns-zone-digest-10 >>>=20 >>>=20 >>> Please note that it may take a couple of minutes from the time of = submission >>> until the htmlized version and diff are available at tools.ietf.org. >>>=20 >>> Internet-Drafts are also available by anonymous FTP at: >>> ftp://ftp.ietf.org/internet-drafts/ >>>=20 >>>=20 >>> _______________________________________________ >>> DNSOP mailing list >>> DNSOP@ietf.org >>> = https://secure-web.cisco.com/1hLFbYnvHqECH8cjYe-sOIimYA8qICY9J06FkQxqloKZx= 6DZXS2iEoYJbxUIedyflFr6PaoBHOv5dp0Bf9x0UVO7HHZUVo1bR5fAX3pzWitEO9Eo0rcl5hn= rq5Q6Dd-xWSdMAPsO_H5PaOUNLPZvTCPJg6CeVPWDPJkDlQwMDNrFJNlGZfTcUIbUP7ucEsYZS= 5-k-kFrqKonOLi1gnxQH65clcnQe1tPS2Li9OeqEM7nZvQusi4KZQ3ytaibZjN34m7KqzVoPdn= W35D_O4eRTudc6wDeXrzNLAn84Imv90do/https%3A%2F%2Fwww.ietf.org%2Fmailman%2Fl= istinfo%2Fdnsop >>=20 >>=20 >=20 > _______________________________________________ > DNSOP mailing list > DNSOP@ietf.org > = https://secure-web.cisco.com/1hLFbYnvHqECH8cjYe-sOIimYA8qICY9J06FkQxqloKZx= 6DZXS2iEoYJbxUIedyflFr6PaoBHOv5dp0Bf9x0UVO7HHZUVo1bR5fAX3pzWitEO9Eo0rcl5hn= rq5Q6Dd-xWSdMAPsO_H5PaOUNLPZvTCPJg6CeVPWDPJkDlQwMDNrFJNlGZfTcUIbUP7ucEsYZS= 5-k-kFrqKonOLi1gnxQH65clcnQe1tPS2Li9OeqEM7nZvQusi4KZQ3ytaibZjN34m7KqzVoPdn= W35D_O4eRTudc6wDeXrzNLAn84Imv90do/https%3A%2F%2Fwww.ietf.org%2Fmailman%2Fl= istinfo%2Fdnsop --Apple-Mail=_7C924EEC-3ACE-427A-9E35-DFA907E55987 Content-Disposition: attachment; filename="smime.p7s" Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCDbgw ggZgMIIFSKADAgECAhB2hcsHqODMD9LFTY85NbMSMA0GCSqGSIb3DQEBBQUAMIHKMQswCQYDVQQG EwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5l dHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQg dXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDIgUHVibGljIFByaW1hcnkgQ2VydGlm aWNhdGlvbiBBdXRob3JpdHkgLSBHMzAeFw0xMTA2MDcwMDAwMDBaFw0yMTA2MDYyMzU5NTlaMIHJ MQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5 bWFudGVjIFRydXN0IE5ldHdvcmsxNTAzBgNVBAsTLENsYXNzIDIgTWFuYWdlZCBQS0kgSW5kaXZp ZHVhbCBTdWJzY3JpYmVyIENBMUMwQQYDVQQDEzpTeW1hbnRlYyBDbGFzcyAyIFNoYXJlZCBJbnRl cm1lZGlhdGUgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB CgKCAQEAt/g/DCuDIyCFpk1JAVE62t1QM77jBKQ6PqNhZkw0wuh0cHVJpbdJ7N2zkpzdeQ3iufq4 OTy+heOM7215o6a3CL+cTL4+mI6s23yaK+wFKDBfKRszTUTVcOhWIpmmPp1CW+sjp2OdLSywLj8Y 8ynNGjaJhJLHV3BbcIXmOKF8UOM3OIhlW2vLOSoEsYKqGQT/oH8/o9uRRXZmo2vzhSNeTtmFXXWn oBX3wQB04OXKlEJlmsI3eouoUKy/l3Rnd9Eyp6+Ny5OpJUK0MBp0CuIlEBDLdGdVD8sU/EFQCqR8 TQsL+QWpNflFpzHxgLuiyT7OdjnhKv92UOfoUSLfLc+4MwIDAQABo4ICPzCCAjswEgYDVR0TAQH/ BAgwBgEB/wIBADA0BgNVHR8ELTArMCmgJ6AlhiNodHRwOi8vY3JsLnZlcmlzaWduLmNvbS9wY2Ey LWczLmNybDAOBgNVHQ8BAf8EBAMCAQYwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVZlcmlTaWdu TVBLSS0yLTU2MB0GA1UdDgQWBBTYSCmoXyoXkuL6nnvvb2CD+Li43DCB8AYDVR0jBIHoMIHloYHQ pIHNMIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl cmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJbmMuIC0g Rm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDIgUHVibGlj IFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHM4IQYXDLSYxfmEUp57Cm2VBbejA0 BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnZlcmlzaWduLmNvbTBsBgNV HSAEZTBjMGEGC2CGSAGG+EUBBxcCMFIwJgYIKwYBBQUHAgEWGmh0dHA6Ly93d3cuc3ltYXV0aC5j b20vY3BzMCgGCCsGAQUFBwICMBwaGmh0dHA6Ly93d3cuc3ltYXV0aC5jb20vcnBhMA0GCSqGSIb3 DQEBBQUAA4IBAQCmKpsHQMns/7OI6EXaNNEXDygtt6WFZzHNwebVKYY4rOLwWRsM4aFFziR472nB sExhokjZaE+6/nVUN7pYaerBdqU2QuqeZniQINmVaiR5VM3eWhqKO64YlXLQJdjSRr40MKeAnvFW ziAebGfJTU95h4niLoDWnu0mYWWiA9DF4vMouStJaYJn7NXpNKQu3GIipIVNSONqApTyzf3kZ8hJ vKrVx+c83oexEGtdB1wZ5Gug9E+Zy9y1WwzMMvlq5HTAKlg3ebP7zcM0b+F23RAHAGOLB04nF5JH mw6+3g0ThRH8oi9lfcw6rB5Ua1ZnxO6lhyIjFytwVsPxrndcJ8E5MIIHUDCCBjigAwIBAgIQUgHO uRrE8f0+lHpp6LMu3zANBgkqhkiG9w0BAQsFADCByTELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5 bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMTUwMwYD VQQLEyxDbGFzcyAyIE1hbmFnZWQgUEtJIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQTFDMEEGA1UE AxM6U3ltYW50ZWMgQ2xhc3MgMiBTaGFyZWQgSW50ZXJtZWRpYXRlIENlcnRpZmljYXRlIEF1dGhv cml0eTAeFw0yMDAzMjQwMDAwMDBaFw0yMTA0MjIyMzU5NTlaMHAxJDAiBgkqhkiG9w0BCQEWFWR3 ZXNzZWxzQHZlcmlzaWduLmNvbTEXMBUGA1UEAwwOV2Vzc2VscywgRHVhbmUxFjAUBgNVBAsMDUVO VEVSUFJJU0UgSVQxFzAVBgNVBAoMDlZlcmlTaWduLCBJbmMuMIIBIjANBgkqhkiG9w0BAQEFAAOC AQ8AMIIBCgKCAQEAwbeXxaBWlxe5DxiPcGA+avq1cFigXZu2lAVx5DMmtWuUx8s+am03tuwU7tw6 xHG4sfrR9d2BucS54VpdZGxZO0ShzZ0WDatTINezhPQTh0Xumy2dbc8d7xTlSa2ZGGw/Zq78jq4C 7f3dEMMk7pqY+gBIE9d7GdjQYkwrF558PKIQIzUAcxVLTLhOqcmnA2g0WaTxWEjev2LdC41G15z8 ZIEJDWGfd7lWLNKrD4p9vG+aKTbxEaaKcRj7ZQCFbqNNAQA0YFf2xtvgUHQIh+ciuCKBlwiTVkCl KZpGkfTx0tSE47BvtNkAFxqyKTNNYrceG7/g7KaxynTfKO7zYjO1uQIDAQABo4IDijCCA4YwDAYD VR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBaAwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwQwHQYDVR0O BBYEFFaFSmgtcRDwfRFiqt3Vq8LJCLn5MCAGA1UdEQQZMBeBFWR3ZXNzZWxzQHZlcmlzaWduLmNv bTAfBgNVHSMEGDAWgBTYSCmoXyoXkuL6nnvvb2CD+Li43DCCAXAGCCsGAQUFBwEBBIIBYjCCAV4w JwYIKwYBBQUHMAGGG2h0dHA6Ly9wa2ktb2NzcC5zeW1hdXRoLmNvbTCCATEGCCsGAQUFBzAChoIB I2xkYXA6Ly9kaXJlY3Rvcnkuc3ltYXV0aC5jb20vQ04lMjAlM0QlMjBTeW1hbnRlYyUyMENsYXNz JTIwMiUyMFNoYXJlZCUyMEludGVybWVkaWF0ZSUyMENlcnRpZmljYXRlJTIwQXV0aG9yaXR5JTJD T1UlMjAlM0QlMjBDbGFzcyUyMDIlMjBNYW5hZ2VkJTIwUEtJJTIwSW5kaXZpZHVhbCUyMFN1YnNj cmliZXIlMjBDQSUyQ09VJTIwJTNEJTIwU3ltYW50ZWMlMjBUcnVzdCUyME5ldHdvcmslMkNPJTIw JTNEJTIwU3ltYW50ZWMlMjBDb3Jwb3JhdGlvbiUyQ0MlMjAlM0QlMjBVUz9jQUNlcnRpZmljYXRl O2JpbmFyeTBdBgNVHR8EVjBUMFKgUKBOhkxodHRwOi8vcGtpLWNybC5zeW1hdXRoLmNvbS9jYV8w N2JiN2Q2NDc3Y2Y0ZjZiZTk2YWYxYjM2Y2FiZDMxNi9MYXRlc3RDUkwuY3JsMGwGA1UdIARlMGMw YQYLYIZIAYb4RQEHFwIwUjAmBggrBgEFBQcCARYaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9jcHMw KAYIKwYBBQUHAgIwHBoaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9ycGEwQgYJKoZIhvcNAQkPBDUw MzAKBggqhkiG9w0DBzALBglghkgBZQMEAQIwCwYJYIZIAWUDBAEWMAsGCWCGSAFlAwQBKjAsBgpg hkgBhvhFARADBB4wHAYSYIZIAYb4RQEQAQICAQGL8cYJFgYyNDc2NjQwOQYKYIZIAYb4RQEQBQQr MCkCAQAWJGFIUjBjSE02THk5d2Eya3RjbUV1YzNsdFlYVjBhQzVqYjIwPTANBgkqhkiG9w0BAQsF AAOCAQEAeD6Ith/v5S1X1k35R2h8AK4YbmVNDgPivPZcQcpKRJ6YntyZf9l2e19igK2d0floI6ez PCEEGUwQArGOBc9nBrEPDioIq2WJCPshT4/fk2UdOo9+Yc80JlhPE3eU3HkYhu0B33Hj3tjc5g60 Y+wdR2jInSF+LnvP66yJthoXLID1NpkhitIx52m5MkKPZTxb/SHVI2MQ5x4DWtr+Obe/+YCRQ/K2 UzMSVXmVwdHLpUrm4P4uyWQ2ZuIwFbnLl7OtwKOZIaQxqXDI/jWO65hVqHgiRc1Sao/lYtKfu/jC dmXM6v0Sd+t4dJFEjH2a1gqsf4DraqnvJ4Ak6RNTCazfUTGCBF0wggRZAgEBMIHeMIHJMQswCQYD VQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVj IFRydXN0IE5ldHdvcmsxNTAzBgNVBAsTLENsYXNzIDIgTWFuYWdlZCBQS0kgSW5kaXZpZHVhbCBT dWJzY3JpYmVyIENBMUMwQQYDVQQDEzpTeW1hbnRlYyBDbGFzcyAyIFNoYXJlZCBJbnRlcm1lZGlh dGUgQ2VydGlmaWNhdGUgQXV0aG9yaXR5AhBSAc65GsTx/T6Uemnosy7fMA0GCWCGSAFlAwQCAQUA oIICTzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0yMDA5MjMxNjQw NDFaMC8GCSqGSIb3DQEJBDEiBCD9ROmeu43bm/1Vdm9sZaeqPWYm7zNsKObEVkbl6EzIJzCB7wYJ KwYBBAGCNxAEMYHhMIHeMIHJMQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9y YXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxNTAzBgNVBAsTLENsYXNzIDIg TWFuYWdlZCBQS0kgSW5kaXZpZHVhbCBTdWJzY3JpYmVyIENBMUMwQQYDVQQDEzpTeW1hbnRlYyBD bGFzcyAyIFNoYXJlZCBJbnRlcm1lZGlhdGUgQ2VydGlmaWNhdGUgQXV0aG9yaXR5AhBSAc65GsTx /T6Uemnosy7fMIHxBgsqhkiG9w0BCRACCzGB4aCB3jCByTELMAkGA1UEBhMCVVMxHTAbBgNVBAoT FFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMTUw MwYDVQQLEyxDbGFzcyAyIE1hbmFnZWQgUEtJIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQTFDMEEG A1UEAxM6U3ltYW50ZWMgQ2xhc3MgMiBTaGFyZWQgSW50ZXJtZWRpYXRlIENlcnRpZmljYXRlIEF1 dGhvcml0eQIQUgHOuRrE8f0+lHpp6LMu3zANBgkqhkiG9w0BAQEFAASCAQCHY6dgHXjyVBFwho24 zpDy08NcRUIc8MUdTuBh9nJe8zJGiF947lr1TLXah0fx9UN5SRTGR6ma3u6WebCVf4PDA4yAOSZU aiPwznMLJ9K/FFwA5m1ntkx4FEX8+Xxo2DYrvk2LGMNToeAmq5SGG4gtDpahJGaRl+UNLLRL83tA KDjd58oEj09WGW7pJhyUgQeSkAHrEg4Ny7xckJ9MGL7IdztOeacAzHcgFBnZl0sFhI5jopAIWxFS TqLKH/Fc8ifCC7H2x2YbYpXPWGONzHmaVYoGA+K7RBa4xdGs/EUy6l7pHkTvFM4SS5IRQr/+Lni7 3GEpaAyUb53zkszzSkmCAAAAAAAA --Apple-Mail=_7C924EEC-3ACE-427A-9E35-DFA907E55987-- From nobody Thu Sep 24 05:16:20 2020 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id CCC283A0A16; Thu, 24 Sep 2020 05:16:18 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Klaas Wierenga via Datatracker To: Cc: v6ops@ietf.org, draft-ietf-v6ops-slaac-renum.all@ietf.org, last-call@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.17.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <160094977880.10661.1204066741049367981@ietfa.amsl.com> Reply-To: Klaas Wierenga Date: Thu, 24 Sep 2020 05:16:18 -0700 Archived-At: Subject: [secdir] Secdir last call review of draft-ietf-v6ops-slaac-renum-03 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Sep 2020 12:16:19 -0000 Reviewer: Klaas Wierenga Review result: Ready I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. The document is clear and well-written. I believe that the workarounds presented are a bit weak, but I guess the future work will address the issue in a more fundamental manner. From a security considerations point of view, I agree with the authors that the document does not introduce any new security concerns. The summary of the review is: Ready From nobody Thu Sep 24 05:16:34 2020 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id D087D3A0A20; Thu, 24 Sep 2020 05:16:18 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Klaas Wierenga via Datatracker To: Cc: v6ops@ietf.org, draft-ietf-v6ops-slaac-renum.all@ietf.org, last-call@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.17.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <160094977878.15549.13751271672700751713@ietfa.amsl.com> Reply-To: Klaas Wierenga Date: Thu, 24 Sep 2020 05:16:18 -0700 Archived-At: Subject: [secdir] Secdir last call review of draft-ietf-v6ops-slaac-renum-03 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Sep 2020 12:16:19 -0000 Reviewer: Klaas Wierenga Review result: Ready I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. The document is clear and well-written. I believe that the workarounds presented are a bit weak, but I guess the future work will address the issue in a more fundamental manner. From a security considerations point of view, I agree with the authors that the document does not introduce any new security concerns. The summary of the review is: Ready From nobody Thu Sep 24 07:34:45 2020 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 5DE5F3A09AC for ; Thu, 24 Sep 2020 07:34:43 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Tero Kivinen via Datatracker To: X-Test-IDTracker: no X-IETF-IDTracker: 7.17.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: secdir-secretary@mit.edu, Tero Kivinen Message-ID: <160095808303.32248.18058204918732690494@ietfa.amsl.com> Date: Thu, 24 Sep 2020 07:34:43 -0700 Archived-At: Subject: [secdir] Assignments X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Sep 2020 14:34:43 -0000 Review instructions and related resources are at: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview For telechat 2020-09-24 Reviewer LC end Draft Phillip Hallam-Baker R2020-03-09 draft-ietf-calext-jscalendar-30 Brian Weis R2020-08-26 draft-ietf-spring-srv6-network-programming-20 For telechat 2020-10-08 Reviewer LC end Draft Donald Eastlake R2020-09-14 draft-ietf-dnsop-dns-zone-digest-10 Daniel Franke 2020-09-18 draft-ietf-jmap-mdn-15 Paul Wouters 2020-09-08 draft-ietf-i2nsf-capability-data-model-12 Last calls: Reviewer LC end Draft Donald Eastlake R2020-09-14 draft-ietf-dnsop-dns-zone-digest-10 Stephen Farrell 2020-09-10 draft-ietf-detnet-mpls-over-udp-ip-06 Daniel Franke 2020-03-09 draft-ietf-regext-dnrd-objects-mapping-09 Daniel Franke 2020-09-18 draft-ietf-jmap-mdn-15 Daniel Gillmor 2020-09-30 draft-ietf-ccamp-layer0-types-07 Phillip Hallam-Baker 2020-09-30 draft-ietf-lwig-tcp-constrained-node-networks-10 Phillip Hallam-Baker R2020-03-09 draft-ietf-calext-jscalendar-30 Steve Hanna 2020-09-30 draft-ietf-ccamp-wson-yang-26 Dan Harkins None draft-ietf-rtgwg-policy-model-03 Christian Huitema 2020-10-08 draft-ietf-opsawg-model-automation-framework-06 Leif Johansson 2020-10-02 draft-ietf-lpwan-schc-over-lorawan-10 Charlie Kaufman 2020-10-01 draft-ietf-cose-x509-07 Scott Kelly 2020-10-01 draft-ietf-idr-tunnel-encaps-19 Watson Ladd 2020-10-02 draft-ietf-oauth-jwsreq-30 David Mandelberg 2020-07-14 draft-ietf-idr-rfc8203bis-07 Kathleen Moriarty 2020-07-20 draft-ietf-ace-oscore-profile-12 Russ Mundy 2020-07-20 draft-ietf-ace-dtls-authorize-13 Yoav Nir None draft-ietf-netconf-trust-anchors-13 Brian Weis R2020-08-26 draft-ietf-spring-srv6-network-programming-20 Klaas Wierenga 2020-05-26 draft-ietf-kitten-krb-spake-preauth-09 Christopher Wood 2020-09-23 draft-ietf-6man-rfc4941bis-10 Paul Wouters 2020-05-25 draft-ietf-capport-architecture-10 Paul Wouters 2020-09-08 draft-ietf-i2nsf-capability-data-model-12 Dacheng Zhang 2020-03-12 draft-nottingham-how-did-that-get-into-the-repo-01 Dacheng Zhang 2019-11-05 draft-ietf-mpls-ri-rsvp-frr-07 Early review requests: Reviewer Due Draft Chris Lonvick 2020-10-15 draft-ietf-lisp-pubsub-06 Next in the reviewer rotation: Aanchal Malhotra David Mandelberg Catherine Meadows Alexey Melnikov Daniel Migault Kathleen Moriarty Russ Mundy Sandra Murphy Yoav Nir Magnus Nystrom From nobody Thu Sep 24 08:09:33 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 58B473A0D5A; Thu, 24 Sep 2020 08:09:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.891 X-Spam-Level: X-Spam-Status: No, score=-1.891 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, NICE_REPLY_A=-0.001, SPF_PASS=-0.001, T_SPF_HELO_TEMPERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id W5wt8GLm3nUD; Thu, 24 Sep 2020 08:09:25 -0700 (PDT) Received: from skynet.si6networks.com (fernando.ipv6-lab.net [IPv6:2001:9e0:803:1::195]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 06DAA3A0D60; Thu, 24 Sep 2020 08:09:24 -0700 (PDT) Received: from [IPv6:2800:810:464:1088:1c:aabc:1c34:6047] (unknown [IPv6:2800:810:464:1088:1c:aabc:1c34:6047]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by skynet.si6networks.com (Postfix) with ESMTPSA id EB0791D37; Thu, 24 Sep 2020 12:09:16 -0300 (-03) To: Klaas Wierenga , secdir@ietf.org Cc: v6ops@ietf.org, draft-ietf-v6ops-slaac-renum.all@ietf.org, last-call@ietf.org References: <160094977878.15549.13751271672700751713@ietfa.amsl.com> From: Fernando Gont Message-ID: <48c03f94-bb4b-5d79-9afe-7a585b0c8151@si6networks.com> Date: Thu, 24 Sep 2020 10:41:43 -0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.9.1 MIME-Version: 1.0 In-Reply-To: <160094977878.15549.13751271672700751713@ietfa.amsl.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-v6ops-slaac-renum-03 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Sep 2020 15:09:29 -0000 Hi, Klaas, Thanks so much for your feedback! In-line.... On 24/9/20 09:16, Klaas Wierenga via Datatracker wrote: > Reviewer: Klaas Wierenga > Review result: Ready > > I have reviewed this document as part of the security directorate's > ongoing effort to review all IETF documents being processed by the > IESG. These comments were written primarily for the benefit of the > security area directors. Document editors and WG chairs should treat > these comments just like any other last call comments. > > The document is clear and well-written. I believe that the workarounds > presented are a bit weak, but I guess the future work will address the issue in > a more fundamental manner. FWIW, the "workarounds" presented in this document are somewhat limited, because they suggest the things one might do without modifying the underlying protocols (i.e., operational mitigations). Indeed, other work being pursued (draft-ietf-v6ops-cpe-slaac-renum and draft-ietf-6man-slaac-renum) discuss how to mitigate the problem in a more comprehensive and effective manner. Thanks! CHeers, -- Fernando Gont SI6 Networks e-mail: fgont@si6networks.com PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492 From nobody Thu Sep 24 08:16:29 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E973C3A09B5; Mon, 21 Sep 2020 08:25:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1600701947; bh=1LqxLKMWEgLlH48ieTf1Ws6LWJ6s1oeLZpx9CmAe0p4=; h=From:To:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe:Reply-To; b=Kh37eOiPJRAhw8teQIWr7o1ihawaMPkSgkOh+pFuyk6iMFm1rM20cPoVh7mYMAneg NXxHFHm+4bDTkb59i6A6Ee6Vehr8ujh70IS1IESt7BreZeEXYR/69Ulpt2wqAay6WY u+/5lHQ24t5nD7lP123nKOqo+jvkGsJne6i8e6xM= X-Mailbox-Line: From new-work-bounces@ietf.org Mon Sep 21 08:25:40 2020 Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id CB4413A08BD; Mon, 21 Sep 2020 08:25:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1600701934; bh=1LqxLKMWEgLlH48ieTf1Ws6LWJ6s1oeLZpx9CmAe0p4=; h=From:To:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe:Reply-To; b=MeFu50EH/KwbvrDLjI1bSbkFGRKRvFK5tCO35vyFwOaIABCDbMJNAGwu5Wdg22Ttt ujXYYk9xmsw/MSZAiJuAbkT3L6bIr121Exz/xmxMP+dYLrOENZtoFBBnGshdRbGrnj wGDHk8p5R5K3VwXovqHnO2WhS4AYafuHO3VWSDx0= X-Original-To: new-work@ietf.org Delivered-To: new-work@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 2093C3A080F for ; Mon, 21 Sep 2020 08:25:27 -0700 (PDT) MIME-Version: 1.0 From: The IESG To: X-Test-IDTracker: no X-IETF-IDTracker: 7.17.0 Auto-Submitted: auto-generated Precedence: bulk MIME-Version: 1.0 Reply_to: Message-ID: <160070192711.7373.14461341215438663473@ietfa.amsl.com> Date: Mon, 21 Sep 2020 08:25:27 -0700 Archived-At: X-BeenThere: new-work@ietf.org X-Mailman-Version: 2.1.29 Reply-To: iesg@ietf.org Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: new-work-bounces@ietf.org Sender: "new-work" Archived-At: X-Mailman-Approved-At: Thu, 24 Sep 2020 08:16:27 -0700 Subject: [secdir] [new-work] WG Review: A Semantic Definition Format for Data and Interactions of Things (asdf) X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 21 Sep 2020 15:25:53 -0000 A new IETF WG has been proposed in the Applications and Real-Time Area. The IESG has not made any determination yet. The following draft charter was submitted, and is provided for informational purposes only. Please send your comments to the IESG mailing list (iesg@ietf.org) by 2020-10-01. A Semantic Definition Format for Data and Interactions of Things (asdf) ----------------------------------------------------------------------- Current status: Proposed WG Chairs: Michael Richardson Niklas Widell Assigned Area Director: Barry Leiba Applications and Real-Time Area Directors: Barry Leiba Murray Kucherawy Mailing list: Address: asdf@ietf.org To subscribe: https://www.ietf.org/mailman/listinfo/asdf Archive: https://mailarchive.ietf.org/arch/browse/asdf/ Group page: https://datatracker.ietf.org/group/asdf/ Charter: https://datatracker.ietf.org/doc/charter-ietf-asdf/ ## Background Data and interaction models of IoT devices today exhibit unneeded diversity between different industry ecosystem standards development organizations (SDOs), hindering interoperability across these ecosystems with little discernible benefit from the diversity. Early 2019, One Data Model (OneDM) was started to bring several IoT SDOs and IoT device and platform vendors together under a broad, multi-party liaison agreement, with a goal of arriving at a common set of data and interaction models that describe IoT devices. Ideally, for every class of IoT device, there is just a single model selected/created by the participating organizations, which everyone can adopt. As a common language for writing down these models, the Semantic Definition Format (SDF) was created, which can represent IoT Things, their composition from reusable Objects, their Interaction Affordances (Properties, Actions, Events), and the data models relevant to describe these Affordances. SDF represents these models in JSON, enabling re-use of specification formats such as CDDL (RFC8610) and the formats proposed at json-schema.org and their tooling, for describing both the SDF format itself and the structure of the data to be modelled in SDF. Some 200 models in SDF format have been contributed by participating ecosystems; new models are being submitted continually. Version 1.0 of the SDF specification was published on the OneDM github repository and as an Internet-Draft. OneDM is now focusing on consolidating the body of submitted models and developing processes for arriving at harmonized models that span different industry ecosystems in a common way; they look to the IETF for developing SDF 1.0 further into a high-quality specification. The IETF also defines the YANG data modelling language (RFC 7950). YANG has a strong focus on modelling the management interface for network devices, using a fairly small set of network management protocols, whereas SDF is designed to span (and transitively unify) many existing interaction models already present. While data associated with a YANG schema can be serialized to a variety of wire formats (e.g., XML, JSON, CBOR, and others), the serialization is driven directly by the structure of the data models defined in YANG; there is no separate "protocol binding" step as in the use of SDF. Conversely, SDF does not deal directly with serialization at all, modelling only the structure and semantics of the data being interchanged, hence leaving data serialization (and RPC semantics) to other standards, most likely defined by existing IoT SDOs. ## The ASDF Working Group The objective of the ASDF working group is to develop SDF to an IETF-quality specification for Thing Interaction and Data Modelling, working with experts from OneDM and its contributing organizations. On the way to that specification, further functionality requirements will be addressed that emerge in the usage of SDF for model harmonization. The ASDF WG will work closely with the CBOR WG, home of the CDDL specification. It will also engage the still active mailing list of the concluded JSON WG. Recent proposals to form an IRTF formal description techniques (FDT) Research Group might lead to another collaboration partner. The Thing-to-Thing Research Group (T2TRG) and its WISHI program can be instrumental in engaging researchers and other SDOs in this space, such as W3C Web of Things, which is working on Thing Description Templates and related specifications. Milestones: Oct 2020 - SDF specification, WG document adopted Sep 2021 - SDF specification, publication requested _______________________________________________ new-work mailing list new-work@ietf.org https://www.ietf.org/mailman/listinfo/new-work From nobody Thu Sep 24 08:21:16 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DB3123A0ED1; Thu, 24 Sep 2020 08:21:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.917 X-Spam-Level: X-Spam-Status: No, score=-1.917 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u7iu6KH7ta4O; Thu, 24 Sep 2020 08:21:07 -0700 (PDT) Received: from out69-ams.mf.surf.net (out69-ams.mf.surf.net [145.0.1.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A8B8D3A0EB5; Thu, 24 Sep 2020 08:21:06 -0700 (PDT) Received: from mail.het.net.je (mail.het.net.je [192.87.110.20]) by outgoing3-ams.mf.surf.net (8.14.4/8.14.4/Debian-4+deb7u1) with ESMTP id 08OFL3H9024152 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 24 Sep 2020 17:21:04 +0200 Received: from [109.37.133.155] (helo=[100.102.17.216]) by mail.het.net.je with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1kLT2V-0002Y1-Na; Thu, 24 Sep 2020 17:20:07 +0200 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable From: Klaas Wierenga Mime-Version: 1.0 (1.0) Date: Thu, 24 Sep 2020 17:21:02 +0200 Message-Id: <9D55177C-68BD-4022-BAAB-46E7642C9778@wierenga.net> References: <48c03f94-bb4b-5d79-9afe-7a585b0c8151@si6networks.com> Cc: secdir@ietf.org, v6ops@ietf.org, draft-ietf-v6ops-slaac-renum.all@ietf.org, last-call@ietf.org In-Reply-To: <48c03f94-bb4b-5d79-9afe-7a585b0c8151@si6networks.com> To: Fernando Gont X-Mailer: iPhone Mail (17H35) X-Antivirus: no malware found X-Bayes-Prob: 0.0001 (Score 0, tokens from: p-out:default, p:default, base:default, @@RPTN) X-CanIt-Geo: ip=192.87.110.20; country=NL; region=North Holland; city=Zaandam; latitude=52.4414; longitude=4.8156; http://maps.google.com/maps?q=52.4414,4.8156&z=6 X-CanItPRO-Stream: p-out:default (inherits from p:default,base:default) X-Canit-Stats-ID: 0b3vPl39P - 823dc94f1efc - 20200924 (trained as not-spam) X-Scanned-By: CanIt (www . roaringpenguin . com) Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-v6ops-slaac-renum-03 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Sep 2020 15:21:15 -0000 My pleasure! Sent from my iPhone > On 24 Sep 2020, at 17:08, Fernando Gont wrote: >=20 > =EF=BB=BFHi, Klaas, >=20 > Thanks so much for your feedback! In-line.... >=20 >> On 24/9/20 09:16, Klaas Wierenga via Datatracker wrote: >> Reviewer: Klaas Wierenga >> Review result: Ready >> I have reviewed this document as part of the security directorate's >> ongoing effort to review all IETF documents being processed by the >> IESG. These comments were written primarily for the benefit of the >> security area directors. Document editors and WG chairs should treat >> these comments just like any other last call comments. >> The document is clear and well-written. I believe that the workarounds >> presented are a bit weak, but I guess the future work will address the is= sue in >> a more fundamental manner.=20 >=20 > FWIW, the "workarounds" presented in this document are somewhat limited, b= ecause they suggest the things one might do without modifying the underlying= protocols (i.e., operational mitigations). >=20 > Indeed, other work being pursued (draft-ietf-v6ops-cpe-slaac-renum and dra= ft-ietf-6man-slaac-renum) discuss how to mitigate the problem in a more comp= rehensive and effective manner. >=20 > Thanks! >=20 > CHeers, > --=20 > Fernando Gont > SI6 Networks > e-mail: fgont@si6networks.com > PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492 >=20 >=20 >=20 >=20 From nobody Thu Sep 24 09:37:44 2020 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E7C8F3A10CD; Thu, 24 Sep 2020 09:37:37 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Brian Weis via Datatracker To: Cc: spring@ietf.org, draft-ietf-spring-srv6-network-programming.all@ietf.org, last-call@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.17.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <160096545789.2761.7901137068170504935@ietfa.amsl.com> Reply-To: Brian Weis Date: Thu, 24 Sep 2020 09:37:37 -0700 Archived-At: Subject: [secdir] Secdir telechat review of draft-ietf-spring-srv6-network-programming-20 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Sep 2020 16:37:38 -0000 Reviewer: Brian Weis Review result: Ready I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. A new sentence was added to Security Considerations in version 20. I believe it, combined with the previous sentence, will help clueful developers understand that there may be a need to add HMAC processing even if there is no SRH header. Thanks. None of the other changes in the update appear to affect security considerations. From nobody Thu Sep 24 11:15:15 2020 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id B55083A124A; Thu, 24 Sep 2020 11:15:06 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Stephen Farrell via Datatracker To: Cc: last-call@ietf.org, draft-ietf-detnet-mpls-over-udp-ip.all@ietf.org, detnet@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.17.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <160097130665.26261.15986068503995393539@ietfa.amsl.com> Reply-To: Stephen Farrell Date: Thu, 24 Sep 2020 11:15:06 -0700 Archived-At: Subject: [secdir] Secdir last call review of draft-ietf-detnet-mpls-over-udp-ip-06 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Sep 2020 18:15:08 -0000 Reviewer: Stephen Farrell Review result: Ready (Sorry for the missed review deadline.) Other than general doubts about "I'll only use this in one administrative domain", the only specific thing that concerned me here was that draft-ietf-detnet-security doesn't seem to include any analysis of detnet/UDP (and indeed says that detnet runs over IP) and the security considerations section here is purely by reference. Given that draft-ietf-detnet-security seems to have done a reasonable job of analysis, it's a pity to not have that for the detnet/UDP case. All that said, I don't have any concrete problems to highlight with detnet/UDP, though of course I've not been thinking about this as $dayjob, so there may be issues there. From nobody Thu Sep 24 13:28:38 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 861AB3A129E; Thu, 24 Sep 2020 13:28:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.101 X-Spam-Level: X-Spam-Status: No, score=-2.101 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=dolby.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tSjVRS6HDmyf; Thu, 24 Sep 2020 13:28:28 -0700 (PDT) Received: from NAM02-SN1-obe.outbound.protection.outlook.com (mail-eopbgr770102.outbound.protection.outlook.com [40.107.77.102]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7660D3A129C; Thu, 24 Sep 2020 13:28:25 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=n1L6spdWWmF33rst9XT7Nqb0UJ+EK8ZMFdR/XvrBDnBaBgtY3TBk2MNFs5xAx5aIfiwqaZJ2MG+tXKxjMd6uSqPMevYz0bNHY1Mdzxf/azBWUCrTK84/b/pbAPQFnIS3hauxs2x8kJKccsvQvkmA+Uv//8ZP6kKs/tyNrNbLF1HS47A0hu8ICDbl2FhEBALPhQrt2W5U75r9arIhRPIwnDs31WPOtdS+oS2Fdxp6OAFWRo+Kd1+s8cANwqKa4qRWrqra4ioSjbz0lQ5pw0ayOctZ9oEow/Zuz8D+puR0gEOuN8j/TPCjJlesN1cyq63pTO2PodVNU7TSsdLiCcLSaw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=JQ9DDh2bdEUIXxp9x4wdpjQbrgT6HCUOOwMHiFGFFEY=; b=XtCvimn6ls2ay3BovRgJreUCSPu/1M8VXwo+KZRazprwbERBg0ij6UWyHq1iTIw3ellBuS5RwKJt56REF3HfUwjVEgLEpeolOiHVnWX6CiFaQL7kc6MzTBaCE8MLMxISPnRQQqgID7q4GeT+9lLEviqILqekolYSBFXDETmms9SmB+3JnRCwJrVdMS7maRojHz7D3hurpsa/MWvWB794KW4KwUWncosjhqPTFtWcMFRJNdfFdnsknZPlXaNdX7MQu8Laj9ZfqNdPYTSQQFd2ONzGJl+LBChm/4RnY2nzdsXEICvNyK+Q4Mj0kzsxKX/vjpLRu8RBCXR4bBPy1kyV8w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=dolby.com; dmarc=pass action=none header.from=dolby.com; dkim=pass header.d=dolby.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=dolby.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=JQ9DDh2bdEUIXxp9x4wdpjQbrgT6HCUOOwMHiFGFFEY=; b=q6q0iWac6LEeT8sjxV/lD1bReSBd9uUzkvRWR6QSZzYg6YHXL6XVnAi8bffIb46z4FmL/OhoeIAAx55VBl4egYuDeIEND8opMz8SmuhqwZKAmyy/fUt9LpoyTp0WFiqfQr9wwsLq1CA3uFXkq16HBdFfLrWWADJNcJdF7c3ji7o= Received: from BY5PR06MB6611.namprd06.prod.outlook.com (2603:10b6:a03:23d::20) by BYAPR06MB4327.namprd06.prod.outlook.com (2603:10b6:a03:59::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3391.22; Thu, 24 Sep 2020 20:28:19 +0000 Received: from BY5PR06MB6611.namprd06.prod.outlook.com ([fe80::59d0:9610:aeb8:ca84]) by BY5PR06MB6611.namprd06.prod.outlook.com ([fe80::59d0:9610:aeb8:ca84%4]) with mapi id 15.20.3391.027; Thu, 24 Sep 2020 20:28:19 +0000 From: "Grossman, Ethan A." To: Stephen Farrell , "secdir@ietf.org" CC: "last-call@ietf.org" , "detnet@ietf.org" , "draft-ietf-detnet-mpls-over-udp-ip.all@ietf.org" Thread-Topic: [Detnet] Secdir last call review of draft-ietf-detnet-mpls-over-udp-ip-06 Thread-Index: AQHWkp7QtLhjU0mW50S8oNMAEUQjo6l4Ol6g Date: Thu, 24 Sep 2020 20:28:19 +0000 Message-ID: References: <160097130665.26261.15986068503995393539@ietfa.amsl.com> In-Reply-To: <160097130665.26261.15986068503995393539@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: cs.tcd.ie; dkim=none (message not signed) header.d=none;cs.tcd.ie; dmarc=none action=none header.from=dolby.com; x-originating-ip: [73.70.15.21] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 04de134e-650b-411c-dace-08d860c8601c x-ms-traffictypediagnostic: BYAPR06MB4327: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: XwKAXlmqxjyImV6kggr57UmOwsRSN/CXdRysDtGCxgpbZ9MpKzrum8luZY4kQ1Y14Hy03vxz76KeoVwJ9D6pg9FwIKGMLqh7LKM45MnKyYUW+cuIg7f6mbFXKUscb+MXE+By+MzaludYEmGhioyk3iTAC0eB8/Q1RTMxd+ZNN5S7S/tRgSXn2MzBHdBvj1R7fT7w7gNsY1qfKCQZaDdLlYU3qePsC4w06G1wyGQSdbu0fhKm6CXzUhoig1+58gOIMjqS0/u5y3v2qb/nJpzSFNA2VKztNG2d53XIxKYyIR/rDNzqPUUuxCVcieAuu/9F7OFWCUHpi/z0x8YhsTM8lQ44uTa+2q0/7nY0iBVZeyGPWRVaEFQy3kM+gRpnWiR1vTDVJAMreV4eRQ1Ftk5tzQ== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BY5PR06MB6611.namprd06.prod.outlook.com; PTR:; CAT:NONE; SFS:(376002)(136003)(366004)(346002)(396003)(39850400004)(54906003)(7696005)(66556008)(966005)(8936002)(26005)(53546011)(8676002)(186003)(71200400001)(86362001)(5660300002)(64756008)(66476007)(76116006)(66946007)(6506007)(33656002)(66446008)(4326008)(316002)(55016002)(2906002)(52536014)(110136005)(296002)(83380400001)(9686003)(478600001); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: 7nVo6cpmNss164UgW7ZX7ygUSyAr5vWfasYQ/JNh9ihoihkWgmdRjKUmJUswtjxEgAdaMPU4XZOGQqNTL4+2JAzYlCmFKJVzHmZjz+QV2EmpizYxRxFs+wey9464hpjZ8XCR0p4BeJdTUrcSuNzn+gDq9rfkK0EQz1HMJKYG8lkDNYcV6SgBJr23yGCBALPO3/nqMZHFebv3gBfdIbv3MkTH4jqb1xvjdbswhSFpxkgVeRxC1/8QEpBFfo7smDqqTDHMmVcE/mATsWhJxzXwSH3HYD5TNjBwcxmE5lKBDC9t35uJ0Fx6+Fn2GRElIcfI4x9a6n+3KwqsJ9ldL0bqcLXZE1E/Y0SOpX73axGVz7Xv5UjIfEkArKiZpRU+n7lr64tHhUhsFAibfeyIHrc1BGU8SAXhmpMiDvVjFkF9E1vYrF+hP5CnOUkNuqgjULpx14Fe8V9G3KQDUJnR4H51LVeyh5VfmzekPg7vnq6pVqGaQf9wj1vpEdCm8yi9LYt+gwxxMzsIwI5vlJ+ow/0y5+lYvIltK7BIeoz/RRDW7KtUEFxE2/f7+5x0MDdhxyu7RG8l7NoPZeRFO9qWMotSL9FOSQW7RjFG5PcbUq1GMbaQAmDb0f1jn691c4Mps7p00wP2uAG92YkMjCWcKka+XQ== x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: dolby.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BY5PR06MB6611.namprd06.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 04de134e-650b-411c-dace-08d860c8601c X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Sep 2020 20:28:19.2864 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 05408d25-cd0d-40c8-8962-5462de64a318 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: ylkk38uS7dW8ppMs+Aql3zyQYltzOwpswUxY0vfKpuRao/MWqdN1B0woethxC+pgRLoX08XZHK3K1Qa5gEBoRQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR06MB4327 Archived-At: Subject: Re: [secdir] [Detnet] Secdir last call review of draft-ietf-detnet-mpls-over-udp-ip-06 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Sep 2020 20:28:31 -0000 Thanks Stephen. FWIW it isn't too late to add some text to the DetNet Secur= ity draft regarding DetNet over UDP, if someone can think up something usef= ul to say. I suppose one could simply mention UDP in the same breath as TCP= (implying that the same general security guidelines apply, if that's our s= tance).=20 Any thoughts (from anyone)?=20 Thanks, Ethan (as Editor, DetNet Security draft) -----Original Message----- From: detnet On Behalf Of Stephen Farrell via Dat= atracker Sent: Thursday, September 24, 2020 11:15 AM To: secdir@ietf.org Cc: last-call@ietf.org; detnet@ietf.org; draft-ietf-detnet-mpls-over-udp-ip= .all@ietf.org Subject: [Detnet] Secdir last call review of draft-ietf-detnet-mpls-over-ud= p-ip-06 Reviewer: Stephen Farrell Review result: Ready (Sorry for the missed review deadline.) Other than general doubts about "I'll only use this in one administrative d= omain", the only specific thing that concerned me here was that draft-ietf-= detnet-security doesn't seem to include any analysis of detnet/UDP (and ind= eed says that detnet runs over IP) and the security considerations section = here is purely by reference. Given that draft-ietf-detnet-security seems to= have done a reasonable job of analysis, it's a pity to not have that for t= he detnet/UDP case. All that said, I don't have any concrete problems to hi= ghlight with detnet/UDP, though of course I've not been thinking about this= as $dayjob, so there may be issues there. _______________________________________________ detnet mailing list detnet@ietf.org https://www.ietf.org/mailman/listinfo/detnet From nobody Thu Sep 24 17:19:54 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6B8953A09A4 for ; Thu, 24 Sep 2020 17:19:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.919 X-Spam-Level: X-Spam-Status: No, score=-1.919 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id awDxWrusYYlj for ; Thu, 24 Sep 2020 17:19:51 -0700 (PDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EBE4C3A0994 for ; Thu, 24 Sep 2020 17:19:50 -0700 (PDT) Received: from kduck.mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 08P0JkKp027803 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Thu, 24 Sep 2020 20:19:48 -0400 Date: Thu, 24 Sep 2020 17:19:46 -0700 From: Benjamin Kaduk To: =?utf-8?B?TWFsacWhYSBWdcSNaW5pxIc=?= Cc: secdir@ietf.org Message-ID: <20200925001946.GM89563@kduck.mit.edu> References: <160069728907.2136.5817110472506014861@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <160069728907.2136.5817110472506014861@ietfa.amsl.com> User-Agent: Mutt/1.12.1 (2019-06-15) Archived-At: Subject: Re: [secdir] Secdir telechat review of draft-ietf-bess-evpn-na-flags-06 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 25 Sep 2020 00:19:52 -0000 Hi Mališa, Thanks for doing the original review (and the re-review); the point you raised is one that I would have raised if it wasn't fixed already. I filed a No Objection ballot. -Ben On Mon, Sep 21, 2020 at 07:08:09AM -0700, Mališa Vučinić via Datatracker wrote: > Reviewer: Mališa Vučinić > Review result: Ready > > Thank you for addressing my review comments, the document is IMO ready to proceed. > > > _______________________________________________ > secdir mailing list > secdir@ietf.org > https://www.ietf.org/mailman/listinfo/secdir > wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview From nobody Fri Sep 25 02:39:50 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0544B3A12FE for ; Fri, 25 Sep 2020 02:39:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.919 X-Spam-Level: X-Spam-Status: No, score=-1.919 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bqTrqEDim7GH for ; Fri, 25 Sep 2020 02:39:46 -0700 (PDT) Received: from mail3-relais-sop.national.inria.fr (mail3-relais-sop.national.inria.fr [192.134.164.104]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 263C23A12FD for ; Fri, 25 Sep 2020 02:39:45 -0700 (PDT) X-IronPort-AV: E=Sophos;i="5.77,301,1596492000"; d="scan'208";a="360034882" Received: from adsl-bb1-l204.crnagora.net (HELO meganisi.t-com.me) ([95.155.1.204]) by mail3-relais-sop.national.inria.fr with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 25 Sep 2020 11:39:23 +0200 Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\)) From: =?utf-8?B?TWFsacWhYSBWdcSNaW5pxIc=?= In-Reply-To: <20200925001946.GM89563@kduck.mit.edu> Date: Fri, 25 Sep 2020 11:39:22 +0200 Cc: secdir@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <5E2B3ABA-56C6-45DC-97C0-A5AB382B0207@inria.fr> References: <160069728907.2136.5817110472506014861@ietfa.amsl.com> <20200925001946.GM89563@kduck.mit.edu> To: Benjamin Kaduk X-Mailer: Apple Mail (2.3445.104.11) Archived-At: Subject: Re: [secdir] Secdir telechat review of draft-ietf-bess-evpn-na-flags-06 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 25 Sep 2020 09:39:48 -0000 Thanks Ben for confirming! Mali=C5=A1a > On 25 Sep 2020, at 02:19, Benjamin Kaduk wrote: >=20 > Hi Mali=C5=A1a, >=20 > Thanks for doing the original review (and the re-review); the point = you > raised is one that I would have raised if it wasn't fixed already. > I filed a No Objection ballot. >=20 > -Ben >=20 > On Mon, Sep 21, 2020 at 07:08:09AM -0700, Mali=C5=A1a Vu=C4=8Dini=C4=87 = via Datatracker wrote: >> Reviewer: Mali=C5=A1a Vu=C4=8Dini=C4=87 >> Review result: Ready >>=20 >> Thank you for addressing my review comments, the document is IMO = ready to proceed. >>=20 >>=20 >> _______________________________________________ >> secdir mailing list >> secdir@ietf.org >> https://www.ietf.org/mailman/listinfo/secdir >> wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview From nobody Fri Sep 25 13:12:31 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E2BB93A08B9 for ; Fri, 25 Sep 2020 13:12:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.919 X-Spam-Level: X-Spam-Status: No, score=-1.919 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 71VuJAT0mYqQ for ; Fri, 25 Sep 2020 13:12:28 -0700 (PDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A6E083A08B8 for ; Fri, 25 Sep 2020 13:12:28 -0700 (PDT) Received: from kduck.mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 08PKCOKt028991 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 25 Sep 2020 16:12:26 -0400 Date: Fri, 25 Sep 2020 13:12:23 -0700 From: Benjamin Kaduk To: Tero Kivinen Cc: secdir@ietf.org Message-ID: <20200925201223.GQ89563@kduck.mit.edu> References: <159372902558.22641.8459872357136850825@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <159372902558.22641.8459872357136850825@ietfa.amsl.com> User-Agent: Mutt/1.12.1 (2019-06-15) Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-mpls-sfl-framework-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 25 Sep 2020 20:12:30 -0000 Hi Tero, Thanks for the review -- I tried to restate the potential new security issue in my No Objection ballot, so that the authors can analyze it and come up with an appropriate response/mitigation. -Ben On Thu, Jul 02, 2020 at 03:30:25PM -0700, Tero Kivinen via Datatracker wrote: > Reviewer: Tero Kivinen > Review result: Has Issues > > I have reviewed this document as part of the security directorate's ongoing > effort to review all IETF documents being processed by the IESG. These > comments were written primarily for the benefit of the security area > directors. Document editors and WG chairs should treat these comments just > like any other last call comments. > > This document describes a way to make synonyms for MPLS flows so those > flows can be processed differently. It does include privacy considerations > which says that depending on how the synonyms are used there might > be privacy issues. > > It does claim in the security considerations section that there is no new > security issues associated with the MPLS dataplane. I think that is not true. > If there is any kind of different processing depending which synonym > is used that can be used to bypass that processing by using the another > synonym instead of the intended one. For example if attacker knows > that specific synonym causes deep packet inspection (one of the examples > given), and he might want to use the synonym which bypasses this > inspection, in case he is sending things he does not want to be > inspected. This could be some kind of malicious code somehow > loaded to the sending device or something. > > On the other hand my understanding that trust model of MPLS > is mostly we blindly trust everything other end says, so someone > able to use different synonyms are most likely also able to do > other even worse things, but I think there are new things caused > by this addition than what is already present in the MPLS now. > > > > _______________________________________________ > secdir mailing list > secdir@ietf.org > https://www.ietf.org/mailman/listinfo/secdir > wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview From nobody Fri Sep 25 13:18:01 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3892F3A08BA for ; Fri, 25 Sep 2020 13:17:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.919 X-Spam-Level: X-Spam-Status: No, score=-1.919 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H4=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PHdpbmnDGfTs for ; Fri, 25 Sep 2020 13:17:57 -0700 (PDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 98D563A08B8 for ; Fri, 25 Sep 2020 13:17:57 -0700 (PDT) Received: from kduck.mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 08PKHqoO031037 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 25 Sep 2020 16:17:55 -0400 Date: Fri, 25 Sep 2020 13:17:52 -0700 From: Benjamin Kaduk To: Phillip Hallam-Baker Cc: secdir@ietf.org Message-ID: <20200925201752.GR89563@kduck.mit.edu> References: <158385051998.15836.4770030164750320016@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <158385051998.15836.4770030164750320016@ietfa.amsl.com> User-Agent: Mutt/1.12.1 (2019-06-15) Archived-At: Subject: Re: [secdir] [Last-Call] Secdir last call review of draft-ietf-calext-jscalendar-26 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 25 Sep 2020 20:17:59 -0000 Hi Phill, Thanks for the review; I'm happy that Neil was able to respond and expand the security considerations to cover these issues, so that I didn't have to raise them at the later stage. I did file a Discuss ballot, but mostly just to ensure that some errors in the examples and potential internal inconsistencies are wrapped up, not for any fundamental security issues with the protocol. I also tried to give a suggestion for where in the body text they could expand upon the "malicious timezone selection" topic that you raised. -Ben On Tue, Mar 10, 2020 at 07:28:40AM -0700, Phillip Hallam-Baker via Datatracker wrote: > Reviewer: Phillip Hallam-Baker > Review result: Has Issues > > The Security Considerations need to be substantially expanded to address: > > 1) Spam > 2) Duplication > 3) Time Zones > 4) Authentication > > The first issue is a major problem with ical attachments, applications assume > that these are authentic and create entries. It is stupid but it is ubiquitous. > There should be note of this as it is a very common channel exploited by > spamers. > > Duplication is a related problem. Calendar entries should have a unique > persistent ID and clients should check these so that updates on multiple > devices don't end up resulting in a dozen calendar entries which happens to me > repeatedly. > > Time Zones are a related problem it is important to make sure that the time > zone of recurring entries is correctly set. Why is this a security issue? > Because I have been in a situation where a meeting secretary deliberately sent > out a maliciously crafted meeting announcement to make sure the 'wrong people' > didn't attend. > > Authentication is my main concern though as my entire home automation system > runs off a a task database that is based on a JSON calendar format which is not > this format _yet_. My plan being to let you folk do the work and then wrap > authentication round it. > > So when I am done, the calendar will drive the selection of what happens in the > house. The school calendars will be loaded and these will cause the alarms for > myself and the kids to come on when it is a school day and not otherwise. Same > for heating etc. If one of us is traveling, there will be adjustments etc. > > This is obviously a stretch goal but it is clearly something that will be > commonplace at some point. Calendaring systems are going to be about more than > just work appointments. And that means we need authentication. The draft does > not need to say HOW this is done but it does need to say you need to do it. > > A related concern is that many companies set up accounts for each meeting room > and you reserve the room for your meeting by 'inviting' it to the meeting. Now > consider doing the same in a serviced office scenario, you want the convenience > but there is also going to be a payments interface because you pay for the > meeting room by the hour. > > In the general body of the text, the treatment of recurring events MUST address > time zones and daylight savings. This is the stuff iCal didn't get right at > first and that lead to pain. > > > -- > last-call mailing list > last-call@ietf.org > https://www.ietf.org/mailman/listinfo/last-call From nobody Fri Sep 25 16:02:55 2020 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 0CE613A0AE0; Fri, 25 Sep 2020 16:02:45 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Yoav Nir via Datatracker To: Cc: draft-ietf-netconf-trust-anchors.all@ietf.org, netconf@ietf.org, last-call@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.17.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <160107496501.14047.597283542214697710@ietfa.amsl.com> Reply-To: Yoav Nir Date: Fri, 25 Sep 2020 16:02:45 -0700 Archived-At: Subject: [secdir] Secdir last call review of draft-ietf-netconf-trust-anchors-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 25 Sep 2020 23:02:45 -0000 Reviewer: Yoav Nir Review result: Has Issues I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. The document defines a YANG model for managing a trust anchor store. It allows two kinds of trust anchors: certificates and raw public keys. However, certificates are not just containers for public keys. Certificates include attributes about key usage, path constraints and name constraints, all of which constrain the ability to use the public key, and are relevant for trust anchors. As far as I can tell the document does not include any attributes to equivalently constrain the use of the raw public keys. If the intention is that raw public keys will not be constrained, the document should state this explicitly. Perhaps this is clear to the people who worked on the document, but it's not clear to me. Are the trust anchors managed with this module supposed to be used to establish trust for the NETCONF or RESTCONF connections? Section 1.1 seems to suggest that it does, but then how is the bootstrap problem solved? How do we establish the NETCONF connection the first time, and if we are able to do that, why do we need more certificates? If the answer is no, and the certificates are to be used by other protocols, then perhaps some re-wording in section 1.1 would help to show this. Currently, it says: "This document presents ... YANG modules that are part of a collection of RFCs ... define configuration modules for clients and servers of both the NETCONF and RESTCONF protocols." The security considerations section is OK, especially sub-section 4.2. Sub-section 4.1 has the following: The YANG module defined in this document defines a mechanism called a "truststore" that, by its name, suggests that it will protect its contents from unauthorized modification. Perhaps this is my different perspective, but the name doesn't lead me to expect that it protects its contents. I think that the document should either just suggest that some mechanism to prevent unauthorized modification should be used, or to present such a mechanism in detail. The current text suggests is partially specific by mentioning digital signatures and non-volatile storage, but not explaining where the trust for the digital signature comes from and what policies govern its us: In order to satisfy the expectations of a "truststore", it is RECOMMENDED that implementations ensure that the truststore contents are signed when persisted to non-volatile memory, to prevent unauthorized modifications from being made undetected. It is too vague to be a specification, but still unnecessarily constrains the solution space. I think the correct thing to do is to be explicitly vague and to just suggest some mechanism for protecting the content. From nobody Fri Sep 25 16:46:23 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B89113A0BDB; Fri, 25 Sep 2020 16:46:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.1 X-Spam-Level: X-Spam-Status: No, score=-2.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=outlook.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NAjWfTZIi34M; Fri, 25 Sep 2020 16:46:20 -0700 (PDT) Received: from NAM12-DM6-obe.outbound.protection.outlook.com (mail-dm6nam12olkn2065.outbound.protection.outlook.com [40.92.22.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B54313A03EC; Fri, 25 Sep 2020 16:46:19 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ZNV+74tQa/lvz1OEVDm9WWJlKMJHOzpXjzraciG1FPtAzG8qbtYJ1gP40iSqcOkgRswxq/nRu3/vl7wicxLOEvK8jlP+b59EwVBvHUyWtn1VvEdQvhQGMCuG2eUsIlyoshaqN2Y3JvKvuYVQEz2hvIWxrgDsJd85FYtbZxCDdV6H93hNcNk52JyYTlWnriYoBU3yY3aHkFY9aPSA6EcyAVQ0KPOv5aww3BRBcGL0iByAxE2ih7KhrVuMwDz1QxDMrGWdEUeeubWXoLgIBs6YyLMAESiopj4pfeoGMnpg9TICvOMWjK7lEYeyIntbBftNF2yw+PNkkSbGKNGfnl/ZSA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=YrwJ5PpPoAIubM9pOX7c0+uaYbC8YNVz1vb2YegdNuE=; b=SITnMr0LnToFZSMF8h3n0E1RU1rzU2ipvTHIJch9wMWoJ7AkQ1GjXBXQmXVxImi9Vk+NVNl+zezAbVd5wnsUo7ovu1XScfuYrUjSScdUuijDmZOsUSxieQ9x/b6P1vC5o8TklbPCP3D/i0MgykAe1eLq2JggjirH0OYeGkRzCkXqk9ZVxgvHmCR8Na2bI+I8b0E0cBVXsBClmzL+ihh9FRNb+Bbs6GNHvpiQF7wjdqpOepPbLmTcluoQPZXX3fYU4Xtj3smv1FcEGKHXW+nkimtYA0dqvtGq37vLdpnwaIkdZHSQOKpAKtVE4DrPysmqUNX2Hp6ZFHfS5E+c4WzdYg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=YrwJ5PpPoAIubM9pOX7c0+uaYbC8YNVz1vb2YegdNuE=; b=XUaZh5IzMUkMQ18ICIlgU+fodkWmjO7MHZkYAUvNQYP9PSMJHJrAgVKWgWxIssAM91REGraC73P4N81Rw08icKQRspjGf3Ispm4/Uw7+54nu/GwuaSwEtLghPl/pcVaeT7T+mzNAT7viZXWJVE2iW+y7hTO8ZLYuQ2We8N42sSaZVjTERMx5NDOO6egZ2KZ+kivjj19XEnBdZlaUknUrxRxGbMGrb27CsuG8ndJtndgwcSxUJ3Eok9TzLoA5NDqZwPMcQfvObSy2HI9KQyB5ac3Q+MSFKegtiKBbWpzgwVI6aDLgXQhFNL1lLzdVG7NQNu8dkYq6LR1T4SYwsl8cDQ== Received: from DM6NAM12FT016.eop-nam12.prod.protection.outlook.com (2a01:111:e400:fc64::47) by DM6NAM12HT171.eop-nam12.prod.protection.outlook.com (2a01:111:e400:fc64::185) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3433.14; Fri, 25 Sep 2020 23:46:11 +0000 Received: from CY4PR0701MB3650.namprd07.prod.outlook.com (2a01:111:e400:fc64::45) by DM6NAM12FT016.mail.protection.outlook.com (2a01:111:e400:fc64::217) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3433.14 via Frontend Transport; Fri, 25 Sep 2020 23:46:10 +0000 Received: from CY4PR0701MB3650.namprd07.prod.outlook.com ([fe80::846:2245:3f7:6a56]) by CY4PR0701MB3650.namprd07.prod.outlook.com ([fe80::846:2245:3f7:6a56%7]) with mapi id 15.20.3391.025; Fri, 25 Sep 2020 23:46:10 +0000 From: Charlie Kaufman To: "secdir@ietf.org" , "iesg@ietf.org" , "draft-ietf-cose-x509.all@ietf.org" Thread-Topic: Secdir review of draft-ietf-cose-x509-07 Thread-Index: AQHWk5XXlCad6vVpLkGw/qO9HNCu3Q== Date: Fri, 25 Sep 2020 23:46:10 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-incomingtopheadermarker: OriginalChecksum:E356CABCF9938917E58ADA9BCA7BA9AE6B5A0B2E84A06C7BA7801400746004C0; UpperCasedChecksum:B2F6A429F48F49025B80AF4DCFC31720D5B9A0E4E8CCCAB4C452F0206B73E93A; SizeAsReceived:6791; Count:41 x-tmn: [py+g9kjfE2qfPLeWMmAgmj0WoxZfztix] x-ms-publictraffictype: Email x-incomingheadercount: 41 x-eopattributedmessage: 0 x-ms-office365-filtering-correlation-id: c0a48896-d855-4f27-c1cb-08d861ad2e7a x-ms-traffictypediagnostic: DM6NAM12HT171: x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: xNqvR1ncuR5+3r+Y4g6q6Q7cZH3iDdikOivbP7ADxFI3M7XdqLSuQjMvJOQhYPfQ4q2RlIXU6jq9GRPghaC0OPgN5ieFHcMM5Pw0tJvBW7TvZYW0xCCCCNl8oRA0uuUIQXW0AxcSNwH4G9WId9mwbJpithcNt0hgU3KjrydYi/uIf9VQFr6JwSeO8bJKgyPBqxDkRQAmu7L+06KxY0sdlRCiX8wllpdxGhHEq9jHGFotkipYl9AeKgej282DYnQM x-ms-exchange-antispam-messagedata: QUpWDhFSvCzPXOxIVh8dKAY3Fy1PvDPSto7csyiVWoUn94JqkNJcWUwIXoYXaIu4j8EFN/5lt9YKaImqvpmGHB8jyaCnjxxRyB9KIhOABgLUVCJ4L9hiPPNCD0KX1YX3T3JUmYF+f6Z1607qIKlZyQ== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_CY4PR0701MB365018DEC39F83CDD60A7D11DF360CY4PR0701MB3650_" MIME-Version: 1.0 X-OriginatorOrg: outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-AuthSource: DM6NAM12FT016.eop-nam12.prod.protection.outlook.com X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000 X-MS-Exchange-CrossTenant-Network-Message-Id: c0a48896-d855-4f27-c1cb-08d861ad2e7a X-MS-Exchange-CrossTenant-originalarrivaltime: 25 Sep 2020 23:46:10.9318 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Internet X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6NAM12HT171 Archived-At: Subject: [secdir] Secdir review of draft-ietf-cose-x509-07 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 25 Sep 2020 23:46:22 -0000 --_000_CY4PR0701MB365018DEC39F83CDD60A7D11DF360CY4PR0701MB3650_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable I have reviewed this document as part of the security directorate's ongoing= effort to review all IETF documents being processed by the IESG. These co= mments were written primarily for the benefit of the security area director= s. Document editors and WG chairs should treat these comments just like an= y other last call comments. This document extends COSE (RFC 8152) by specifying a syntax for the inclus= ion of X.509 certificates. The only thing the security community might find= vaguely controversial is the mandate (on page 5) for support of the SHA-25= 6 hash algorithm "for interoperability" (along optionally with other hash a= lgorithms). The document correctly notes that what is specified does not gu= arantee interoperability. Minor suggestions: Page 3: "If the application cannot establish trust in the certificate, that= certificate cannot be used." I would say ...cannot be used to establish trust in the key. An untrusted c= ertificate might still be used for other purposes, like forwarding it to so= me other entity that might be able to establish trust in it. It also might = be worth noting (here or under security considerations) that certificates o= nly establish trustworthiness of a key to the extent that the entity named = in the certificate is trusted. Page 4: (This language appears under both x5bag and x5chain): "The presence= of a self-signed certificate in the parameter MUST NOT be used as a signal= to modify the set of trust anchors." I would say "...MUST NOT cause the up= date of the set of trust anchors without some out-of-band confirmation." Th= is requirement should also apply to certificates that are not self-signed. Page 6: "As this header parameter implies a trust relationship, the attribu= te MUST be in the protected attribute bucket." This seems inconsistent with= the other categories. Why does this form of specification imply a trust re= lationship which the other three do not? Page 6: "The URI provided MUST provide integrity protection and server auth= entication." This makes sense if the certificate is to some degree trusted = by virtue of where it came from, but it's not obvious why it is necessary o= therwise. Page 6: "If the certificate does not chain to an existing trust anchor, the= certificate MUST NOT be trusted unless the server is configured as trusted= to provide new trust anchors. In particular, self-signed certificates MUST= NOT be trusted without an out-of-band confirmation." These two sentences a= ppear inconsistent. Are self-signed certificates to be trusted if they come= from a server configured as trusted to provide new trust anchors? Note tha= t most trust anchors are self-signed. Page 6: You might want x5u or perhaps some new attribute to be able to refe= rence a bag or chain of certificates by URL. Page 8: "A new self-signed certificate appearing on the client cannot be a = trigger to modify the set of trust anchors, because a well defined trust-es= tablishment process is required." I agree with the intent, but this stateme= nt may be too strong. Page 6 implies that a server may be configured as a s= ource of trust anchors, in which case I assume you intend that a certificat= e appearing on the client because it was downloaded from such a server shou= ld modify the set of trust anchors. Also, while adding a new trust anchor m= ust require a well defined trust-establishment process likely involving som= e administrative approval, there is nothing wrong with that process being "= triggered" by the appearance of a new self-signed certificate. Page 8: "The use of unvalidated keys can lead either to loss of security or= excessive consumption of resources (for example using a 200K RSA key)." Gr= eat catch!! I wish more specs included that reminder! Typos: Page 2: "ad" -> "and" page 2: "wher prestented" -> "were presented" page 3: "process of X.509" -> "process X.509" page 3: "configured use" -> "configured to use" page 5: "remove the following paragraphs" -> "remove the following two para= graphs" --Charlie Sent from Outlook --_000_CY4PR0701MB365018DEC39F83CDD60A7D11DF360CY4PR0701MB3650_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
I have reviewed this document as part of the security directorate's ongoing= effort to review all IETF documents being processed by the IESG.  The= se comments were written primarily for the benefit of the security area dir= ectors.  Document editors and WG chairs should treat these comments just like any other last call comments.

This document extends COSE (RFC 8152) by specifying a syntax for the i= nclusion of X.509 certificates. The only thing the security community might= find vaguely controversial is the mandate (on page 5) for support of the S= HA-256 hash algorithm "for interoperability" (along optionally with other hash algorithms). The document correctly note= s that what is specified does not guarantee interoperability.

Minor suggestions:

Page 3: "If the application cannot establish trust in the certifi= cate, that certificate cannot be used."
I would say ...cannot be used to establish trust in the key. An untrus= ted certificate might still be used for other purposes, like forwarding it = to some other entity that might be able to establish trust in it. It also m= ight be worth noting (here or under security considerations) that certificates only establish trustworthiness = of a key to the extent that the entity named in the certificate is trusted.=

Page 4: (This language appears under both x5bag and x5chain): "Th= e presence of a self-signed certificate in the parameter MUST NOT be used a= s a signal to modify the set of trust anchors." I would say "...M= UST NOT cause the update of the set of trust anchors without some out-of-band confirmation." This requirement should also = apply to certificates that are not self-signed.

Page 6: "As this header parameter implies a trust relationship, t= he attribute MUST be in the protected attribute bucket." This seems in= consistent with the other categories. Why does this form of specification i= mply a trust relationship which the other three do not?

Page 6: "The URI provided MUST provide integrity protection and s= erver authentication." This makes sense if the certificate is to some = degree trusted by virtue of where it came from, but it's not obvious why it= is necessary otherwise.

Page 6: "If the certificate does not chain to an existing trust a= nchor, the certificate MUST NOT be trusted unless the server is configured = as trusted to provide new trust anchors. In particular, self-signed certifi= cates MUST NOT be trusted without an out-of-band confirmation." These two sentences appear inconsistent. A= re self-signed certificates to be trusted if they come from a server config= ured as trusted to provide new trust anchors? Note that most trust anchors = are self-signed.

Page 6: You might want x5u or perhaps some new attribute to be able to= reference a bag or chain of certificates by URL.

Page 8: "A new self-signed certificate appearing on the client ca= nnot be a trigger to modify the set of trust anchors, because a well define= d trust-establishment process is required." I agree with the intent, b= ut this statement may be too strong. Page 6 implies that a server may be configured as a source of trust anchors, in= which case I assume you intend that a certificate appearing on the client = because it was downloaded from such a server should modify the set of trust= anchors. Also, while adding a new trust anchor must require a well defined trust-establishment process likel= y involving some administrative approval, there is nothing wrong with that = process being "triggered" by the appearance of a new self-signed = certificate.

Page 8: "The use of unvalidated keys can lead either to loss of s= ecurity or excessive consumption of resources (for example using a 200K RSA= key)." Great catch!! I wish more specs included that reminder!

Typos:

Page 2: "ad" -> "and"
page 2: "wher prestented" -> "were presented"
page 3: "process of X.509" -> "process X.509"
page 3: "configured use" -> "configured to use"=
page 5: "remove the following paragraphs" -> "remove= the following two paragraphs"

--Charlie

Sent from Outlook

--_000_CY4PR0701MB365018DEC39F83CDD60A7D11DF360CY4PR0701MB3650_-- From nobody Fri Sep 25 17:46:55 2020 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 085613A0948; Fri, 25 Sep 2020 17:46:44 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Watson Ladd via Datatracker To: Cc: oauth@ietf.org, last-call@ietf.org, draft-ietf-oauth-jwsreq.all@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.17.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <160108120392.5893.18114957198518376382@ietfa.amsl.com> Reply-To: Watson Ladd Date: Fri, 25 Sep 2020 17:46:43 -0700 Archived-At: Subject: [secdir] Secdir last call review of draft-ietf-oauth-jwsreq-30 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 26 Sep 2020 00:46:44 -0000 Reviewer: Watson Ladd Review result: Serious Issues I generated this review of this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written with the intent of improving security requirements and considerations in IETF drafts. Comments not addressed in last call may be included in AD reviews during the IESG review. Document editors and WG chairs should treat these comments just like any other last call comments. Two minor issues: On page 4, "This offers an additional degree of privacy protection." should be reworded. I don't think it makes sense in context, where authenticity was discussed. It took me a while to understand what the by reference method is: maybe the intro should say via URL instead of by reference. And now for the thorny isssues with this draft. Signatures and encryption are different. And encrypting a signed blob doesn't mean the signer encrypted it. Then there are a plethora of methods specified in the draft to authenticate the blob, which will give different results in maliciously constructed examples. The security considerations section should discuss what the encrypted vs signed choices give in the way of security, and it doesn't. This makes me worry. Looking at the cited reference for attacks, I see the fix is to include information about which IPD was used by the RP. But the draft before us doesn't mandate that. It's not clear than how the cited attack is prevented by the draft. Saying that the communication through the user-agent is subject to manipulation, and this prevents it, ignores that the attacker in that position sees a lot more. The user-agent as resource owner modifying the requested resources is a very funny sort of attack: can't they do what they want with the resources since they control the access? Key management is ignored. This is a very important issue, especially considering the potential problems with the reuse of JWT. I'd like to see a recommendation that keys be separated by intended uses, rather than limiting particular fields in an ad-hoc manner. Then we have section 11. What section 11 introduces is an entire new dramatis personae, the Trust Framework Provider, with no prior discussion of what it is or a reference to where it is defined and a good number of statements about how it works that aren't really clear what they mean from the document to me. My biggest concern is that these issues are signs that the problem this draft is trying to solve and the mechanisms to solve it haven't been analyzed as thoroughly as they should have been. Without that sort of thorough analysis it's not certain that the mechanisms actually solve the problem and it's not clear what the recommendations to implementors have to be to preserve those properties. Obviously this draft has had a long and tortured history with multiple reviews, and what I'm suggesting needs to happen is a lot of work. But it's essential in any security protocol to do this analysis and be clear about what is, and what is not, protected by the protocol. Sincerely, Watson Ladd From nobody Sat Sep 26 05:46:17 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 22CCE3A082F for ; Sat, 26 Sep 2020 05:46:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=authlete-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GT2JWtRaKt6Q for ; Sat, 26 Sep 2020 05:46:09 -0700 (PDT) Received: from mail-wr1-x435.google.com (mail-wr1-x435.google.com [IPv6:2a00:1450:4864:20::435]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4C7AC3A0844 for ; Sat, 26 Sep 2020 05:46:09 -0700 (PDT) Received: by mail-wr1-x435.google.com with SMTP id z1so6857151wrt.3 for ; Sat, 26 Sep 2020 05:46:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=authlete-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=WfkduaNsMGbCxYWrUS6vkQnPxC8dGW9h6dSEihomNcs=; b=NfPC86AUWNdZDItubJhoglZitu2uUdS+RGliwAJARDkSgicBCaIOp7auceFsrhbVTq hs8P4AP/CIC63ZTAIWYTu7JJZxg4+B/nFLA9vTE0zJcpLsYdWkI4JFMyDSyukknzmG8y rKIWnVDh5wwKclc8PL08qfkx3DGAVYCCCjH1d4qiAfR/0TLa7Ijhs0LBAkOh4EYZUkyv IjEdN3bQ7zgWucC4KTiFly6P+b0/BuMn8ALBMN7FyZUwmiUOMrcae7+2mVyuhI6ShPIG 2ffaIhs9oeNm3lEgA08ZDfqkgkmjgN809QumJIvOKjr62qL2IfoMWc8xf9NCUNGSinyK hhow== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=WfkduaNsMGbCxYWrUS6vkQnPxC8dGW9h6dSEihomNcs=; b=ukGrZGnlZEFduZiaLYba1UCeedy98g2MMratOZ7KuipEBHjj191RUKqULC6sQHsDsk bHfMTAOndOifRp/yi9Z4rH9vMU9qzwIorstlmfS4uaLoXQxEEARHpdCPxfBCE4i15Yua jqUhzCw3rwSjiPQY+G+/61EQzXhcpnaWa0MMviyAvPGjP2J5le0Pe4DVyzEAJ1IFd8q8 e+PvkZolqmMSWc6NMKOVqPxwHCryE57YmRE0fejJFFuxM4Uj1pdkgY9g2WkkQq5msglp LFxTS7lbaQIryL4ws7JqDvxXGA4Md4eLH3ngLk7rcbfjTR4sCIlm2M+ov++UVEI8hYsP fUeg== X-Gm-Message-State: AOAM533nUO7b5Z3bbePoilLP5ZB95gjh2x9gQLCpJy3U6lSlt/PZuTi9 icyO2+Snj6C4yk8ZgkNaH2Dse45VT4SExDdDh1t8aA== X-Google-Smtp-Source: ABdhPJxg54/w8MuF4dB9o7+ZKCsSI+VVXcRLsjMUebLZuqeghr/iT8cx1QjmMt2KHzXabZFMnbb1PEQiBRLkTRvt7CA= X-Received: by 2002:a5d:660f:: with SMTP id n15mr10073860wru.103.1601124367455; Sat, 26 Sep 2020 05:46:07 -0700 (PDT) MIME-Version: 1.0 References: <160108120392.5893.18114957198518376382@ietfa.amsl.com> In-Reply-To: <160108120392.5893.18114957198518376382@ietfa.amsl.com> From: Takahiko Kawasaki Date: Sat, 26 Sep 2020 21:45:56 +0900 Message-ID: To: Watson Ladd Cc: secdir@ietf.org, last-call@ietf.org, oauth , draft-ietf-oauth-jwsreq.all@ietf.org Content-Type: multipart/alternative; boundary="00000000000029f12905b036d10f" Archived-At: Subject: Re: [secdir] [OAUTH-WG] Secdir last call review of draft-ietf-oauth-jwsreq-30 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 26 Sep 2020 12:46:12 -0000 --00000000000029f12905b036d10f Content-Type: text/plain; charset="UTF-8" >And now for the thorny isssues with this draft. Signatures and encryption are different. And encrypting a signed blob doesn't mean the signer encrypted it. Who encrypts data doesn't matter. Especially, when the encryption algorithm is asymmetric, anyone who has a "public" key, which anyone can get, can encrypt data. What matters is who can decrypt the encrypted data. It is only the party who has the corresponding "private" key that can decrypt the encrypted data. Best Regards, Takahiko Kawasaki On Sat, Sep 26, 2020 at 9:47 AM Watson Ladd via Datatracker < noreply@ietf.org> wrote: > Reviewer: Watson Ladd > Review result: Serious Issues > > I generated this review of this document as part of the security > directorate's > ongoing effort to review all IETF documents being processed by the IESG. > These > comments were written with the intent of improving security requirements > and > considerations in IETF drafts. Comments not addressed in last call may be > included in AD reviews during the IESG review. Document editors and WG > chairs > should treat these comments just like any other last call comments. > > Two minor issues: On page 4, "This offers an additional degree of privacy > protection." should be reworded. I don't think it makes sense in context, > where > authenticity was discussed. > > It took me a while to understand what the by reference method is: maybe the > intro should say via URL instead of by reference. > > And now for the thorny isssues with this draft. Signatures and encryption > are > different. And encrypting a signed blob doesn't mean the signer encrypted > it. > Then there are a plethora of methods specified in the draft to > authenticate > the blob, which will give different results in maliciously constructed > examples. The security considerations section should discuss what the > encrypted > vs signed choices give in the way of security, and it doesn't. This makes > me > worry. > > Looking at the cited reference for attacks, I see the fix is to include > information about which IPD was used by the RP. But the draft before us > doesn't > mandate that. It's not clear than how the cited attack is prevented by the > draft. Saying that the communication through the user-agent is subject to > manipulation, and this prevents it, ignores that the attacker in that > position > sees a lot more. The user-agent as resource owner modifying the requested > resources is a very funny sort of attack: can't they do what they want > with the > resources since they control the access? > > Key management is ignored. This is a very important issue, especially > considering the potential problems with the reuse of JWT. I'd like to see a > recommendation that keys be separated by intended uses, rather than > limiting > particular fields in an ad-hoc manner. > > Then we have section 11. What section 11 introduces is an entire new > dramatis > personae, the Trust Framework Provider, with no prior discussion of what > it is > or a reference to where it is defined and a good number of statements > about how > it works that aren't really clear what they mean from the document to me. > > My biggest concern is that these issues are signs that the problem this > draft > is trying to solve and the mechanisms to solve it haven't been analyzed as > thoroughly as they should have been. Without that sort of thorough analysis > it's not certain that the mechanisms actually solve the problem and it's > not > clear what the recommendations to implementors have to be to preserve those > properties. > > Obviously this draft has had a long and tortured history with multiple > reviews, > and what I'm suggesting needs to happen is a lot of work. But it's > essential > in any security protocol to do this analysis and be clear about what is, > and > what is not, protected by the protocol. > > Sincerely, > Watson Ladd > > > _______________________________________________ > OAuth mailing list > OAuth@ietf.org > https://www.ietf.org/mailman/listinfo/oauth > --00000000000029f12905b036d10f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
>And now for the thorny isssues with this draft. Signat= ures and encryption are different. And encrypting a signed blob doesn't= mean the signer encrypted it.

Who encrypts data doe= sn't matter. Especially, when the encryption algorithm is asymmetric, a= nyone who has a "public" key, which anyone can get, can encrypt d= ata. What matters is who can decrypt the encrypted data. It is only the par= ty who has the corresponding "private" key that can decrypt the e= ncrypted data.

Best Regards,
Takahiko Ka= wasaki

On Sat, Sep 26, 2020 at 9:47 AM Watson Ladd via Datatracker <= ;noreply@ietf.org> wrote:
Reviewer: Watson Ladd<= br> Review result: Serious Issues

I generated this review of this document as part of the security directorat= e's
ongoing effort to review all IETF documents being processed by the IESG.=C2= =A0 These
comments were written with the intent of improving security requirements an= d
considerations in IETF drafts.=C2=A0 Comments not addressed in last call ma= y be
included in AD reviews during the IESG review.=C2=A0 Document editors and W= G chairs
should treat these comments just like any other last call comments.

Two minor issues: On page 4, "This offers an additional degree of priv= acy
protection." should be reworded. I don't think it makes sense in c= ontext, where
authenticity was discussed.

It took me a while to understand what the by reference method is: maybe the=
intro should say via URL instead of by reference.

And now for the thorny isssues with this draft. Signatures and encryption a= re
different. And encrypting a signed blob doesn't mean the signer encrypt= ed it.
Then there are a plethora of methods specified in the draft=C2=A0 to authen= ticate
the blob, which will give different results in maliciously constructed
examples. The security considerations section should discuss what the encry= pted
vs signed choices give in the way of security, and it doesn't. This mak= es me
worry.

Looking at the cited reference for attacks, I see the fix is to include
information about which IPD was used by the RP. But the draft before us doe= sn't
mandate that. It's not clear than how the cited attack is prevented by = the
draft. Saying that the communication through the user-agent is subject to manipulation, and this prevents it, ignores that the attacker in that posit= ion
sees a lot more. The user-agent as resource owner modifying the requested resources is a very funny sort of attack: can't they do what they want = with the
resources since they control the access?

Key management is ignored. This is a very important issue, especially
considering the potential problems with the reuse of JWT. I'd like to s= ee a
recommendation that keys be separated by intended uses, rather than limitin= g
particular fields in an ad-hoc manner.

Then we have section 11. What section 11 introduces is an entire new dramat= is
personae, the Trust Framework Provider, with no prior discussion of what it= is
or a reference to where it is defined and a good number of statements about= how
it works that aren't really=C2=A0 clear what they mean from the documen= t to me.

My biggest concern is that these issues are signs that the problem this dra= ft
is trying to solve and the mechanisms to solve it haven't been analyzed= as
thoroughly as they should have been. Without that sort of thorough analysis=
it's not certain that the mechanisms actually solve the problem and it&= #39;s not
clear what the recommendations to implementors have to be to preserve those=
properties.

Obviously this draft has had a long and tortured history with multiple revi= ews,
=C2=A0and what I'm suggesting needs to happen is a lot of work. But it&= #39;s essential
in any security protocol to do this analysis and be clear about what is, an= d
what is not, protected by the protocol.

Sincerely,
Watson Ladd


_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth
--00000000000029f12905b036d10f-- From nobody Sun Sep 27 19:51:17 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 965CF3A0CD4; Sun, 27 Sep 2020 19:51:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.849 X-Spam-Level: X-Spam-Status: No, score=-1.849 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id snL3FF50OtEu; Sun, 27 Sep 2020 19:51:09 -0700 (PDT) Received: from mail-il1-x142.google.com (mail-il1-x142.google.com [IPv6:2607:f8b0:4864:20::142]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 04DC83A0CD3; Sun, 27 Sep 2020 19:51:08 -0700 (PDT) Received: by mail-il1-x142.google.com with SMTP id e5so5008627ilr.8; Sun, 27 Sep 2020 19:51:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to:cc; bh=THCHk4hScgROLOkjQQMbZWHllRs1wmKgEMLqAUZm/l8=; b=cCoHqMgLVfW/GT2EjSFdqMdz+69w1XDB5hRlHesia/M6B4bBR3G6OrXWkRwVuk8rfD 9VxYgQtbCrHfM2gnYV7ehaJRxUETr2mJzNay2q1I97gZm2bLhobYcRYi1zEp50yw6JZQ mWhhx3tTe6saO6YcrLgh70J4ITtfI8NsnQnkaZGMuZM2Fen1WZVvJhzkaK77oa74AnyG 6SdD09jqm4oIDgAV0MAMWWrkmG7R7T4l9/xsBuxY78CrpZfdl2iXHhjEuurzxe3q/Zpj uJmGDIMhQopbjcXDVTkTGvX3hdZkoKOZYHPUKSAPwvYu2P8uWk7c6SKjKNdKAGNFEUbb qS2Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc; bh=THCHk4hScgROLOkjQQMbZWHllRs1wmKgEMLqAUZm/l8=; b=Qq0DZqZeyOftIdpuTKqG4qdVIr/Rx023BnsbslysZ4C4VjJusT7Vy5M88MsiBmR/gN l9e/QHWeTVuRWdjMSYHvwXFiPXChrGQgUgon6v46F4Lf7yRf03WA9ystV9BdjOVTm8Nk r5Igu6Hy+8Ww17CQwW0CzoF0tkKVdxzu5ewH7wTpOHNdxM4FRw+W+nfFiLBOMKPepSSL WLCbsmrMHv2x7vEoVAkdot2/P44zfCC/5xH8Cl+Mn7vdB84eSwBNTU9iJbHXtRsrtqg+ bEFBZczlEuPqTaa0/kAcRSCYIZcNet93gNUs6Hs0IkB9dbq561gtCBmaNiAuHECY2I+F wDyw== X-Gm-Message-State: AOAM533v+SUwXmrW8EBZTOf5BE2++UjgTx+BtJ0T2zRbb4O00Ik0TdxN dr/1adAZ7eAwqOEW319iDiwjc7X2d7yiTKX/BYrf6c9iZNJ0zA== X-Google-Smtp-Source: ABdhPJwP2gDKjmal5KgXKdEzb+gOKZ40Qeb/a/5yRYOm3KkDiwGHvYx8i/HUX/vQfHkLcL4clcBES+jJIxDUuuVPYaw= X-Received: by 2002:a05:6e02:49:: with SMTP id i9mr8689642ilr.40.1601261467911; Sun, 27 Sep 2020 19:51:07 -0700 (PDT) MIME-Version: 1.0 From: Donald Eastlake Date: Sun, 27 Sep 2020 22:50:56 -0400 Message-ID: To: draft-ietf-dnsop-dns-zone-digest.all@ietf.org, "iesg@ietf.org" Cc: secdir Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: [secdir] SECDIR review of draft-ietf-dnsop-dns-zone-digest-11 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 Sep 2020 02:51:11 -0000 I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. Document editors and WG chairs should treat these comments just like any other last call comments. The summary of the review is Ready with Nits. Overall, I am pretty happy with the state of the draft. Essentially all of the comments from my review of -09 have been resolved and I don't see any problem with other changes that have been made. However, on reviewing -11, I did come up with a few things as listed below. Section 2, last sentence right before the Section 2.1 header, should "recommended" be all capital? Something I didn't notice in my first review: Section 2.2.1, ZONEMD already covers the SOA that is in the zone and so includes the zone serial in its Digest. Thus it seems a little odd to say that the field is needed to make the DNS response meaningful. I'm not suggesting removing the field or anything... Perhaps some wording change like the following: OLD It is included here in order to make DNS response messages of type ZONEMD meaningful. Without the serial number, a stand-alone ZONEMD digest has no association to any particular instance of a zone. NEW It is included here to clearly bind the ZONEMD RR to a particular version of the zone's content. Without the serial number, a stand-alone ZONEMD digest has no obvious association to any particular instance of a zone. Section 3.1, last sentence just before the Section 3.2 header: This says ZONEMD RRs are excluded from digest calculation but in Section 2.1 it says that non-apex ZONEMD RRs are treated are ordinary RRs and included. I think that 2.1 is correct and suggest inserting the word "apex" so the last sentence of Section 3.1 starts with "Since apex ZONEMD RRs are excluded ..." Although less important, "apex" probably should also be inserted before "ZONEMD" in the fourth and sixth bullet points of Section 3.3.1.1. Section 5.3, the last sentence, after the table, is no longer needed, since that information is given above the table, so it should be deleted. Section 6.2: Need to expand KSK on first use or alternatively, since it is the only use, just not use the acronym at all and spell it out in full. Section 6.3: Size estimate for ZONEMD RR seems a bit low, perhaps based on algorithms in earlier versions of the draft with shorter digests. I would say 55 to 85 octets would be a better current estimate. Section 6.4: In the second paragraph, I think you mean "private use hash algorithm code points", not "private use hash algorithms". That's it. Thanks, Donald =============================== Donald E. Eastlake 3rd +1-508-333-2270 (cell) 2386 Panoramic Circle, Apopka, FL 32703 USA d3e3e3@gmail.com From nobody Mon Sep 28 15:54:23 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 731D83A147A; Mon, 28 Sep 2020 15:54:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=verisign.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id re81Ljq9h1C3; Mon, 28 Sep 2020 15:54:13 -0700 (PDT) Received: from mail6.verisign.com (mail6.verisign.com [69.58.187.32]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 242B63A149D; Mon, 28 Sep 2020 15:54:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=verisign.com; l=10221; q=dns/txt; s=VRSN; t=1601333654; h=from:to:cc:date:message-id:references:in-reply-to: mime-version:subject; bh=9WrD1Snzx4fcjhLgKByqtkpaHUvqvQz8+Jy5OxV5E7Q=; b=VZeOnUPZJkyGazsucpY3/aEh1+3CcRkLDsORxR9Po8OZ/m9ACEJ08Gn/ Ot0/8vrU6/F4AZUfUib7alqtSsWY8EyXOPlrvZ/kpmEA5freG4CGHTszg s7nQJP6/z4nhE75DnejBwcTUSGf62pKjM/ENus3vUFYsHCQzwkqddPF2K f1JnpCuNpbD7pS0RTVdU5hSo9jLJ5jiGClKwsNsGzyD2l81C2HFurzHLp j+rtX8z29OTGxp1kIbCD6AZV/iFf2s9Bde+qaFCbo799GJLnMJSobtBMm Z1taYD23TJGpXrtRP3ECRPI95MwddRLwSQBLVvRqh+qI1pKK0zke9pWH5 w==; IronPort-SDR: YzfauKbyTdMeLjVST9ln1ailw0dYaLSCbl2tJwW1tKnN4N9eTQDVu4HGpZnL2Xv+pbJYFC+p2L 0a2OUO5g4IsMpRn7BKDMi2zpIaR41FGLsCb1D3lSGhjeodtcaYI4Mp7CGceIQWYdc1v/cGegv1 wtUIu1tV1QzP0kyE3GUw2DX15UyGYUzk5G3iQUgjFUN0xaJ4audfFYBgFn6uWITWQHjl38Z7X7 iouFL5jqLrpgNn5C1SL8TDDuB+6vDkDiWqEDkPeZwOvs4GWqcTcRg/WMUj9fnCeYx4mQmcGku4 QmE= X-IronPort-AV: E=Sophos; i="5.77,315,1596513600"; d="p7s'?scan'208"; a="3069623" IronPort-PHdr: =?us-ascii?q?9a23=3AnjCZRhLuLAJxsz01ntmcpTZWNBhigK39O0sv0r?= =?us-ascii?q?FitYgXK/3/rarrMEGX3/hxlliBBdydt6sbzbCJ+Pm7EUU7or+5+EgYd5JNUx?= =?us-ascii?q?JXwe43pCcHRPC/NEvgMfTxZDY7FskRHHVs/nW8LFQHUJ2mPw6arXK99yMdFQ?= =?us-ascii?q?viPgRpOOv1BpTSj8Oq3Oyu5pHfeQpFiCe/bL9oMhm7rwrdutQYjIB/Nqs/1x?= =?us-ascii?q?zFr2dSde9L321oP1WTnxj95se04pFu9jlbtuwi+cBdT6j0Zrw0QrNEAjsoNW?= =?us-ascii?q?A1/9DrugLYTQST/HscU34ZnQRODgPY8Rz1RJbxsi/9tupgxCmXOND9QL4oVT?= =?us-ascii?q?i+6apgVRnlgzoFOTEk6mHaksx+grxGrhK9qRJxwIDUb4OSOvp/YqzScsgXRW?= =?us-ascii?q?VdUsZUTSFBAp+wY5UJAuEcPehYtY79p14WoBewBQajGvjvyiRWiX/yxq02y/?= =?us-ascii?q?kqHw/b3AM6GdIBrnrYp8jyOagPX+G60rLIzS7dYPNSwjfw85bIfQ47ofGNRr?= =?us-ascii?q?JwcMXRyU81GwzZiVWQrJXoMjWI3esCr2aV9fBvVf6zi2E5sQFxpCCiy8Yyho?= =?us-ascii?q?TUmo4YyVDK+Tt4zYsxKtO1RlJ3bN2qHpZTtyyXNIV4Tt8sTmx1pCo3zr8LtY?= =?us-ascii?q?KmcCUU1JkqxR/SZ+Gaf4WO/xntWuGRITJii3JkfrKynwi98Ee6xe35Tsm01E?= =?us-ascii?q?hFojBZndnLs3AA0QHY5MufSvZl40utxSyD2x3R5+xKO0w4iKrWJpA7zrM/kp?= =?us-ascii?q?cfqVnPEjPslEnrjqKaal8o9vWn5unkeLnqu5yROolpgQ/kKKsugNawAeEgPw?= =?us-ascii?q?gLWGiU5Pqz2aX4/U38XLVKlvo2krTFsJzCJcQUuKq5AwhN34s+9xixFyqq39?= =?us-ascii?q?QAk3cILV1JZAyLg5L3O17SJ/D4F++/j062nzh23fzGIKfhAo7LLnTZjLjher?= =?us-ascii?q?N951ZdyAo1099f+4pZBqwdLP7pR0P8ttLVAgUkPwG0zevrEtpw24cGVWKKGK?= =?us-ascii?q?CZMafSsVGS5uIoJumBfJIauTjjJPg+/P7hk3s5mUQGcKm3w5QXcnG4Hu9nI0?= =?us-ascii?q?WWZ3rgmMsOEWAPvgYmVuzllEWCUSJPZ3a1R68z+z82B5yoAIjdSI2gm7OB3C?= =?us-ascii?q?KhEZ1XYmBKEEyDEXDtd4+cQfcDdDqSItN9kjwDTbWuVpUh2gugtA/m0rZnL/?= =?us-ascii?q?Tb+jEWtZ76ydd14fbTlRYq9TBtEsud1XqNQ3h1n2MPQT85wrlzrlF8yleMz6?= =?us-ascii?q?d4mOBYGcZJ6PNNVgc3Lp/cwPJmC9D8QA7Bec2JSFm+SNW8HT4xVs4xw8MJY0?= =?us-ascii?q?tlGtWtkAvD3yWxDr8UibOLGJI0/rjb33jrKMZ302zG27U5j1k6XstPMnWrhr?= =?us-ascii?q?Vh+AfPGoHJkl+Zmr2rdasCwC7N+n2PzW2UvEFXA0ZMVvDpWnYWYkeegN3i+k?= =?us-ascii?q?fLTLLmXbh8P1BMkuaNL6JLbpviilAQF9n5P9GLKV28gHy9AQ3Mjp+RZYznMS?= =?us-ascii?q?1J0DrQE1MJlxs743ucNBM/CSHnqGXbWm89XWnzal/hpLEt4EiwSVU5mlmH?= X-IPAS-Result: =?us-ascii?q?A2HuAAAPaHJf/zGZrQpgGwEBAQEBAQEBBQEBARIBAQEDA?= =?us-ascii?q?wEBAUCBT4MaLIEICpV6g3qGFJITBAcBAQEBAQEBAQEEBAEbFAQBAQKESQKCM?= =?us-ascii?q?yY4EwIDAQELAQEBBQEBAQEBBgMBAQEChkUMgjcie4EDAQEBAQEBAQEBAQEBA?= =?us-ascii?q?QEBAQEBARYCgRQ1AQEBAQIBeQULAgEIDgouAh8RJQIEDgUOgxgBgksDDhG1Z?= =?us-ascii?q?XSBNIgMDYIUEIE4gVOLdoFCPoERJxyCTT6CGoIiP4MMgi0Em3SKP5A9UQMHg?= =?us-ascii?q?meESIJfgVSGVYUUaoUMH4NFcJxenBOESY5cg10CBAIEBQIVgWuBe3AVZQGCP?= =?us-ascii?q?gk1EhcCDY4oAgEXg06KVnQ3AgYKAQEDCY1dMl8BAQ?= Received: from BRN1WNEX01.vcorp.ad.vrsn.com (10.173.153.48) by BRN1WNEX02.vcorp.ad.vrsn.com (10.173.153.49) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1979.3; Mon, 28 Sep 2020 18:54:11 -0400 Received: from BRN1WNEX01.vcorp.ad.vrsn.com ([fe80::a89b:32d6:b967:337d]) by BRN1WNEX01.vcorp.ad.vrsn.com ([fe80::a89b:32d6:b967:337d%4]) with mapi id 15.01.1979.003; Mon, 28 Sep 2020 18:54:11 -0400 From: "Wessels, Duane" To: Donald Eastlake CC: "draft-ietf-dnsop-dns-zone-digest.all@ietf.org" , "iesg@ietf.org" , secdir Thread-Topic: [EXTERNAL] SECDIR review of draft-ietf-dnsop-dns-zone-digest-11 Thread-Index: AQHWlUI6Y640j+h6gE6AOdpuc1oe76l+7RaA Date: Mon, 28 Sep 2020 22:54:10 +0000 Message-ID: <3D8D339D-C83A-45E9-9E0B-027C8F03B136@verisign.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-mailer: Apple Mail (2.3608.120.23.2.4) x-originating-ip: [10.170.148.18] Content-Type: multipart/signed; boundary="Apple-Mail=_4E2106C2-6A90-44D0-91FD-B50A9A926E9D"; protocol="application/pkcs7-signature"; micalg=sha-256 MIME-Version: 1.0 Archived-At: Subject: Re: [secdir] SECDIR review of draft-ietf-dnsop-dns-zone-digest-11 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 Sep 2020 22:54:21 -0000 --Apple-Mail=_4E2106C2-6A90-44D0-91FD-B50A9A926E9D Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=us-ascii > On Sep 27, 2020, at 7:50 PM, Donald Eastlake wrote: > > I have reviewed this document as part of the security directorate's > ongoing effort to review all IETF documents being processed by the > IESG. Document editors and WG chairs should treat these comments just > like any other last call comments. > > The summary of the review is Ready with Nits. > > Overall, I am pretty happy with the state of the draft. Essentially > all of the comments from my review of -09 have been resolved and I > don't see any problem with other changes that have been made. However, > on reviewing -11, I did come up with a few things as listed below. > > Section 2, last sentence right before the Section 2.1 header, should > "recommended" be all capital? That change is fine with me. > > Something I didn't notice in my first review: > Section 2.2.1, ZONEMD already covers the SOA that is in the zone and > so includes the zone serial in its Digest. Thus it seems a little odd > to say that the field is needed to make the DNS response meaningful. > I'm not suggesting removing the field or anything... Perhaps some > wording change like the following: > OLD > It is included here in order to make DNS response messages of type > ZONEMD meaningful. Without the serial number, a stand-alone ZONEMD > digest has no association to any particular instance of a zone. > NEW > It is included here to clearly bind the ZONEMD RR to a particular > version of the zone's content. Without the serial number, a > stand-alone ZONEMD digest has no obvious association to any > particular instance of a zone. I think that is an improvement. > > Section 3.1, last sentence just before the Section 3.2 header: This > says ZONEMD RRs are excluded from digest calculation but in Section > 2.1 it says that non-apex ZONEMD RRs are treated are ordinary RRs and > included. I think that 2.1 is correct and suggest inserting the word > "apex" so the last sentence of Section 3.1 starts with "Since apex > ZONEMD RRs are excluded ..." Although less important, "apex" probably > should also be inserted before "ZONEMD" in the fourth and sixth bullet > points of Section 3.3.1.1. I don't mind inserting "apex" where you suggest. I felt we were covered by the earlier statement that ZONEMD means apex ZONEMD unless stated otherwise, but its good to be explicit in those places. > > Section 5.3, the last sentence, after the table, is no longer needed, > since that information is given above the table, so it should be > deleted. Yes. > Section 6.2: Need to expand KSK on first use or alternatively, since it > is the only use, just not use the acronym at all and spell it out in > full. Done. > > Section 6.3: Size estimate for ZONEMD RR seems a bit low, perhaps > based on algorithms in earlier versions of the draft with shorter > digests. I would say 55 to 85 octets would be a better current > estimate. Yes indeed. I changed it to "65 to 95" now since the smallest SHA384 SIMPLE RR is 65 bytes and a SHA512 SIMPLE RR for "example.com" is 93 bytes. > > Section 6.4: In the second paragraph, I think you mean "private use > hash algorithm code points", not "private use hash algorithms". Yes, thats better. > > That's it. > > Thanks, > Donald Thank you again. DW --Apple-Mail=_4E2106C2-6A90-44D0-91FD-B50A9A926E9D Content-Disposition: attachment; filename="smime.p7s" Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCDbgw ggZgMIIFSKADAgECAhB2hcsHqODMD9LFTY85NbMSMA0GCSqGSIb3DQEBBQUAMIHKMQswCQYDVQQG EwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5l dHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1dGhvcml6ZWQg dXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDIgUHVibGljIFByaW1hcnkgQ2VydGlm aWNhdGlvbiBBdXRob3JpdHkgLSBHMzAeFw0xMTA2MDcwMDAwMDBaFw0yMTA2MDYyMzU5NTlaMIHJ MQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5 bWFudGVjIFRydXN0IE5ldHdvcmsxNTAzBgNVBAsTLENsYXNzIDIgTWFuYWdlZCBQS0kgSW5kaXZp ZHVhbCBTdWJzY3JpYmVyIENBMUMwQQYDVQQDEzpTeW1hbnRlYyBDbGFzcyAyIFNoYXJlZCBJbnRl cm1lZGlhdGUgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB CgKCAQEAt/g/DCuDIyCFpk1JAVE62t1QM77jBKQ6PqNhZkw0wuh0cHVJpbdJ7N2zkpzdeQ3iufq4 OTy+heOM7215o6a3CL+cTL4+mI6s23yaK+wFKDBfKRszTUTVcOhWIpmmPp1CW+sjp2OdLSywLj8Y 8ynNGjaJhJLHV3BbcIXmOKF8UOM3OIhlW2vLOSoEsYKqGQT/oH8/o9uRRXZmo2vzhSNeTtmFXXWn oBX3wQB04OXKlEJlmsI3eouoUKy/l3Rnd9Eyp6+Ny5OpJUK0MBp0CuIlEBDLdGdVD8sU/EFQCqR8 TQsL+QWpNflFpzHxgLuiyT7OdjnhKv92UOfoUSLfLc+4MwIDAQABo4ICPzCCAjswEgYDVR0TAQH/ BAgwBgEB/wIBADA0BgNVHR8ELTArMCmgJ6AlhiNodHRwOi8vY3JsLnZlcmlzaWduLmNvbS9wY2Ey LWczLmNybDAOBgNVHQ8BAf8EBAMCAQYwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVZlcmlTaWdu TVBLSS0yLTU2MB0GA1UdDgQWBBTYSCmoXyoXkuL6nnvvb2CD+Li43DCB8AYDVR0jBIHoMIHloYHQ pIHNMIHKMQswCQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZl cmlTaWduIFRydXN0IE5ldHdvcmsxOjA4BgNVBAsTMShjKSAxOTk5IFZlcmlTaWduLCBJbmMuIC0g Rm9yIGF1dGhvcml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDIgUHVibGlj IFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHM4IQYXDLSYxfmEUp57Cm2VBbejA0 BggrBgEFBQcBAQQoMCYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnZlcmlzaWduLmNvbTBsBgNV HSAEZTBjMGEGC2CGSAGG+EUBBxcCMFIwJgYIKwYBBQUHAgEWGmh0dHA6Ly93d3cuc3ltYXV0aC5j b20vY3BzMCgGCCsGAQUFBwICMBwaGmh0dHA6Ly93d3cuc3ltYXV0aC5jb20vcnBhMA0GCSqGSIb3 DQEBBQUAA4IBAQCmKpsHQMns/7OI6EXaNNEXDygtt6WFZzHNwebVKYY4rOLwWRsM4aFFziR472nB sExhokjZaE+6/nVUN7pYaerBdqU2QuqeZniQINmVaiR5VM3eWhqKO64YlXLQJdjSRr40MKeAnvFW ziAebGfJTU95h4niLoDWnu0mYWWiA9DF4vMouStJaYJn7NXpNKQu3GIipIVNSONqApTyzf3kZ8hJ vKrVx+c83oexEGtdB1wZ5Gug9E+Zy9y1WwzMMvlq5HTAKlg3ebP7zcM0b+F23RAHAGOLB04nF5JH mw6+3g0ThRH8oi9lfcw6rB5Ua1ZnxO6lhyIjFytwVsPxrndcJ8E5MIIHUDCCBjigAwIBAgIQUgHO uRrE8f0+lHpp6LMu3zANBgkqhkiG9w0BAQsFADCByTELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5 bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMTUwMwYD VQQLEyxDbGFzcyAyIE1hbmFnZWQgUEtJIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQTFDMEEGA1UE AxM6U3ltYW50ZWMgQ2xhc3MgMiBTaGFyZWQgSW50ZXJtZWRpYXRlIENlcnRpZmljYXRlIEF1dGhv cml0eTAeFw0yMDAzMjQwMDAwMDBaFw0yMTA0MjIyMzU5NTlaMHAxJDAiBgkqhkiG9w0BCQEWFWR3 ZXNzZWxzQHZlcmlzaWduLmNvbTEXMBUGA1UEAwwOV2Vzc2VscywgRHVhbmUxFjAUBgNVBAsMDUVO VEVSUFJJU0UgSVQxFzAVBgNVBAoMDlZlcmlTaWduLCBJbmMuMIIBIjANBgkqhkiG9w0BAQEFAAOC AQ8AMIIBCgKCAQEAwbeXxaBWlxe5DxiPcGA+avq1cFigXZu2lAVx5DMmtWuUx8s+am03tuwU7tw6 xHG4sfrR9d2BucS54VpdZGxZO0ShzZ0WDatTINezhPQTh0Xumy2dbc8d7xTlSa2ZGGw/Zq78jq4C 7f3dEMMk7pqY+gBIE9d7GdjQYkwrF558PKIQIzUAcxVLTLhOqcmnA2g0WaTxWEjev2LdC41G15z8 ZIEJDWGfd7lWLNKrD4p9vG+aKTbxEaaKcRj7ZQCFbqNNAQA0YFf2xtvgUHQIh+ciuCKBlwiTVkCl KZpGkfTx0tSE47BvtNkAFxqyKTNNYrceG7/g7KaxynTfKO7zYjO1uQIDAQABo4IDijCCA4YwDAYD VR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCBaAwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwQwHQYDVR0O BBYEFFaFSmgtcRDwfRFiqt3Vq8LJCLn5MCAGA1UdEQQZMBeBFWR3ZXNzZWxzQHZlcmlzaWduLmNv bTAfBgNVHSMEGDAWgBTYSCmoXyoXkuL6nnvvb2CD+Li43DCCAXAGCCsGAQUFBwEBBIIBYjCCAV4w JwYIKwYBBQUHMAGGG2h0dHA6Ly9wa2ktb2NzcC5zeW1hdXRoLmNvbTCCATEGCCsGAQUFBzAChoIB I2xkYXA6Ly9kaXJlY3Rvcnkuc3ltYXV0aC5jb20vQ04lMjAlM0QlMjBTeW1hbnRlYyUyMENsYXNz JTIwMiUyMFNoYXJlZCUyMEludGVybWVkaWF0ZSUyMENlcnRpZmljYXRlJTIwQXV0aG9yaXR5JTJD T1UlMjAlM0QlMjBDbGFzcyUyMDIlMjBNYW5hZ2VkJTIwUEtJJTIwSW5kaXZpZHVhbCUyMFN1YnNj cmliZXIlMjBDQSUyQ09VJTIwJTNEJTIwU3ltYW50ZWMlMjBUcnVzdCUyME5ldHdvcmslMkNPJTIw JTNEJTIwU3ltYW50ZWMlMjBDb3Jwb3JhdGlvbiUyQ0MlMjAlM0QlMjBVUz9jQUNlcnRpZmljYXRl O2JpbmFyeTBdBgNVHR8EVjBUMFKgUKBOhkxodHRwOi8vcGtpLWNybC5zeW1hdXRoLmNvbS9jYV8w N2JiN2Q2NDc3Y2Y0ZjZiZTk2YWYxYjM2Y2FiZDMxNi9MYXRlc3RDUkwuY3JsMGwGA1UdIARlMGMw YQYLYIZIAYb4RQEHFwIwUjAmBggrBgEFBQcCARYaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9jcHMw KAYIKwYBBQUHAgIwHBoaaHR0cDovL3d3dy5zeW1hdXRoLmNvbS9ycGEwQgYJKoZIhvcNAQkPBDUw MzAKBggqhkiG9w0DBzALBglghkgBZQMEAQIwCwYJYIZIAWUDBAEWMAsGCWCGSAFlAwQBKjAsBgpg hkgBhvhFARADBB4wHAYSYIZIAYb4RQEQAQICAQGL8cYJFgYyNDc2NjQwOQYKYIZIAYb4RQEQBQQr MCkCAQAWJGFIUjBjSE02THk5d2Eya3RjbUV1YzNsdFlYVjBhQzVqYjIwPTANBgkqhkiG9w0BAQsF AAOCAQEAeD6Ith/v5S1X1k35R2h8AK4YbmVNDgPivPZcQcpKRJ6YntyZf9l2e19igK2d0floI6ez PCEEGUwQArGOBc9nBrEPDioIq2WJCPshT4/fk2UdOo9+Yc80JlhPE3eU3HkYhu0B33Hj3tjc5g60 Y+wdR2jInSF+LnvP66yJthoXLID1NpkhitIx52m5MkKPZTxb/SHVI2MQ5x4DWtr+Obe/+YCRQ/K2 UzMSVXmVwdHLpUrm4P4uyWQ2ZuIwFbnLl7OtwKOZIaQxqXDI/jWO65hVqHgiRc1Sao/lYtKfu/jC dmXM6v0Sd+t4dJFEjH2a1gqsf4DraqnvJ4Ak6RNTCazfUTGCBF0wggRZAgEBMIHeMIHJMQswCQYD VQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVj IFRydXN0IE5ldHdvcmsxNTAzBgNVBAsTLENsYXNzIDIgTWFuYWdlZCBQS0kgSW5kaXZpZHVhbCBT dWJzY3JpYmVyIENBMUMwQQYDVQQDEzpTeW1hbnRlYyBDbGFzcyAyIFNoYXJlZCBJbnRlcm1lZGlh dGUgQ2VydGlmaWNhdGUgQXV0aG9yaXR5AhBSAc65GsTx/T6Uemnosy7fMA0GCWCGSAFlAwQCAQUA oIICTzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0yMDA5MjgyMjU0 MDlaMC8GCSqGSIb3DQEJBDEiBCDG5DSXjazcwlNOd5xX9ynt8DcOIl5MlD72dVDGNeN5QTCB7wYJ KwYBBAGCNxAEMYHhMIHeMIHJMQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9y YXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxNTAzBgNVBAsTLENsYXNzIDIg TWFuYWdlZCBQS0kgSW5kaXZpZHVhbCBTdWJzY3JpYmVyIENBMUMwQQYDVQQDEzpTeW1hbnRlYyBD bGFzcyAyIFNoYXJlZCBJbnRlcm1lZGlhdGUgQ2VydGlmaWNhdGUgQXV0aG9yaXR5AhBSAc65GsTx /T6Uemnosy7fMIHxBgsqhkiG9w0BCRACCzGB4aCB3jCByTELMAkGA1UEBhMCVVMxHTAbBgNVBAoT FFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMTUw MwYDVQQLEyxDbGFzcyAyIE1hbmFnZWQgUEtJIEluZGl2aWR1YWwgU3Vic2NyaWJlciBDQTFDMEEG A1UEAxM6U3ltYW50ZWMgQ2xhc3MgMiBTaGFyZWQgSW50ZXJtZWRpYXRlIENlcnRpZmljYXRlIEF1 dGhvcml0eQIQUgHOuRrE8f0+lHpp6LMu3zANBgkqhkiG9w0BAQEFAASCAQBhXDGBkgWhfO81x6g2 L6rETEfexzi3VaxE0mC1AFDfTEnNWyoH7dVUEzGjjD97T0cziKh/CXuEq7xNdsnQQVZsSuRwcxWy Fn88wAF/F0TBQ45oMZg9D9tlhlsN/HvM91CoJABaY+IIQKi8SFNn9qeghPjnpj9fmGrgK83zQYQt 4uKSEFFiSQtwU/a35wwcf4rWNoNQaX57KfFgYqqPgiL/sQaGjzBQnU2Z06A687FQbT7o+VvA1Zzk +ThWE/cU0pWJad65QXt8I2+h2MKCGQib2YumhXsIAU8ae7A214AuDGs9apqQjIh21H8FKIwkVp4o tq/lMCGPb8anwcNTVXo4AAAAAAAA --Apple-Mail=_4E2106C2-6A90-44D0-91FD-B50A9A926E9D-- From nobody Tue Sep 29 05:07:27 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E40023A0412; Tue, 29 Sep 2020 05:07:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.3 X-Spam-Level: X-Spam-Status: No, score=-3.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-1.2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y-_PtNYFnKwR; Tue, 29 Sep 2020 05:07:17 -0700 (PDT) Received: from NAM12-DM6-obe.outbound.protection.outlook.com (mail-dm6nam12on2053.outbound.protection.outlook.com [40.107.243.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C08473A0410; Tue, 29 Sep 2020 05:07:16 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=fkjeVJBDuxOl2PlM5GAJFRVpyNl9PWT8qxMDYkGPwcGacmmK3LcYNppDDJlD0N8EyuSv7pw4Qe2XW1OcNErvzM9+Ax8mhXSFmOKAJ45DutuQjXYfiDIfcw4vAr08lKbGIA6Zv1cqNnZWkBd1HWJGE5NTg7wOSRnYZpQ9y3sihlv08Ht5IGEIvXtllb75nCvcp/9hv5NiJQSsu0U+w45GwZK5GRu8V0siy5VIXKmVp1vwqjm5E3/O7Ori/2sIgggcSIVdv8inCB90FAE+/pgxRCt+qrIwXDhMUTQFb4YH+hMad7WMSGTsMNHquTYNSk//83RP4auHeRyIsJexwkQUMw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=mNMefdXLQGPu2zFoDrMmDZJzZui8hbotWTCBsifnNl0=; b=lNFICvJC9S3VYNAPSd4++eHCJ2+kiYYgVc3cc+T0t5BTp2ypEQ7aR41U02BrBA93uO2A4siHKo7TklWpOoX3yLwvXhFcXk8XO+nfqqAWO9BHvRCF4YU33rRCCFuWdx/I0Nll1XnVxb7e7UlpD0bA2aJGm2TJkHjIxNxQwToEHLPquaNMXiiSdPA4/9Jm/NYoo/r0jw+NlphdNi5e9TCbtBkT6lflzLUt34I98rJme16U4A14vKv/Yxx04CxglY3PL2qqWH5Fv0GBV34IrieeNSfF43eWpuXGOGpbrN6BRKRkD//7xDwMCCW4UM/3SzwxGLr8YIUL/Visv7vGp1odGw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=mNMefdXLQGPu2zFoDrMmDZJzZui8hbotWTCBsifnNl0=; b=vWVHfkPbi0GOgGSZ4l02YMgDTXbDfSwo5cEjqckg2FUwBUYcIYoY55lN9qT8pfnSBD/E0c0bu3QVrs7sKScpX1DpE3ezXvDdCKVhi8uQCxEurBJVSbC9VdNOlslvq/DgKSkamo1XEAcNUNblCDmgQSeIwBBQYii0LbEWp1W6ZTQ= Received: from SA0PR15MB3791.namprd15.prod.outlook.com (2603:10b6:806:8d::10) by SA0PR15MB3853.namprd15.prod.outlook.com (2603:10b6:806:84::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3412.20; Tue, 29 Sep 2020 12:07:10 +0000 Received: from SA0PR15MB3791.namprd15.prod.outlook.com ([fe80::b13f:64b1:b76c:4650]) by SA0PR15MB3791.namprd15.prod.outlook.com ([fe80::b13f:64b1:b76c:4650%9]) with mapi id 15.20.3433.032; Tue, 29 Sep 2020 12:07:10 +0000 From: Daniel Migault To: Neil Jenkins , Phillip Hallam-Baker , "secdir@ietf.org" CC: "last-call@ietf.org" , "draft-ietf-calext-jscalendar.all@ietf.org" , "calsify@ietf.org" Thread-Topic: [calsify] Secdir last call review of draft-ietf-calext-jscalendar-26 Thread-Index: AQHV9ug4c3iZkcrB1U+c01Ajnj3Ax6hLB5kAgTW7U9k= Date: Tue, 29 Sep 2020 12:07:10 +0000 Message-ID: References: <158385051998.15836.4770030164750320016@ietfa.amsl.com>, <857a3426-bda6-47cb-9b73-b9db8e596a2d@beta.fastmail.com> In-Reply-To: <857a3426-bda6-47cb-9b73-b9db8e596a2d@beta.fastmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: fastmailteam.com; dkim=none (message not signed) header.d=none;fastmailteam.com; dmarc=none action=none header.from=ericsson.com; x-originating-ip: [96.22.11.129] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: ae7c9ead-05ff-401b-d6f1-08d8647031a9 x-ms-traffictypediagnostic: SA0PR15MB3853: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: XAIijdoP/JYOmcS8q+52DrIvX8vzbg0pwsd+mLpIhG1oyaLCITxcLSZPoQLTlaqBybz9Pf8bdswnAmVu++tnFLgv9bylH7gZPZk4g5tbPcajhY0hdPAaRQz4kZEWyEcCR6lIFBXuejhA+O2lEdm3xIKxPZrNjVwENaaZF05SbI4iOv0oQ8CZJ9r9D4YbH4CAVgHxaVMZLFPCI3My/6qyVdLAIpQ0xFMBpnLNHMDMRwaGjcK2DwUz/+ZlEKS+7KX90yNTHQs+ABFxKmrrBY60cSknEl4WCigo2L5SLUpo+wIAbfr7aeJJ3OLEEQtLzyR7NUTgvWg3tJPzW73Atw5JBOOR+Av97az/riBd86SqtI5x/18kftknzgjwJOTeO6A3 x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:SA0PR15MB3791.namprd15.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(136003)(366004)(39860400002)(396003)(346002)(376002)(478600001)(8676002)(52536014)(33656002)(8936002)(71200400001)(9686003)(86362001)(6506007)(26005)(53546011)(4326008)(186003)(2906002)(7696005)(316002)(55016002)(64756008)(66446008)(83380400001)(110136005)(19627405001)(54906003)(66556008)(66476007)(76116006)(91956017)(66946007)(5660300002)(44832011); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: Wr0c3zheYYrBuKsULTfP713QvhdSHHDx0Ossbc2epVyhrBobUbpFF53zXJSACrOE/lO+Bjam71iXZnWoooXZmDqP6ZZb+QsWTM+6nBBe7xw88MYMsR6dHdQ50iaLFCCDB/VkOEpERb4eBOYdLHRwbiCB9iDf/PIq7H+azwdIXU9fnIyxh6S68xZzz++sx+j6N95m5TbsfZKpqGEzTgdaLpabRAo8M725x3vk97yP86fw77s6oAD9YthH36ilnQebRrQcpWaBGnQlBmqhUkm5auPudoE1EhS/92Cw4mpTbQUCIWkZqzkJP0iII9HIjT3Uul5bvPLeC/VWozVoHQoZdntqphv/avSit+ezCmhSXQrkJYDK4862BE0f4G0kqOYP+G1zKY1JljClOXNxWFu703PmGiFlVETkcd5w9LntmWDCvxcA01P+JrqLIkILBOpIEcFo7xS0p+dA68p/Pez1PZHieoz7pKDl8gT7sbsb/Y1t5IXHIrfbdkH7aI4VtIIy/IpIXl/0dya1nLdvRCpbrSjY92A57trZkxMsO5QWD4bHaJ5uCyxtzIg13HyKwGIwfAtAKUSUhT7juPV5GfOGpV/8Z/R5OjyCxfjCYDhy6Y9kyLSPJVDIaWOcjJLzyKOKJguiSDxh+kepfu2JWapK/w== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_SA0PR15MB37910F779239FA49591D61D8E3320SA0PR15MB3791namp_" MIME-Version: 1.0 X-OriginatorOrg: ericsson.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: SA0PR15MB3791.namprd15.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: ae7c9ead-05ff-401b-d6f1-08d8647031a9 X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Sep 2020 12:07:10.3113 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: k5f1zIr0AcJRy5MQoFEQOVVNDqHoTrSDlFiifPpkilpodNjxyp0g3eLrJW58EOag+pH22oK8s4OJRtDhK1GVQZu3xdGuNQmBMrtKSnboQ38= X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR15MB3853 Archived-At: Subject: Re: [secdir] [calsify] Secdir last call review of draft-ietf-calext-jscalendar-26 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 Sep 2020 12:07:19 -0000 --_000_SA0PR15MB37910F779239FA49591D61D8E3320SA0PR15MB3791namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Thanks Phil for the review. This is a useful review with related experience= . Thanks Neil for addressing the these comments. Yours, Daniel ________________________________ From: Neil Jenkins Sent: Monday, March 16, 2020 6:07 AM To: Phillip Hallam-Baker ; secdir@ietf.org Cc: last-call@ietf.org ; draft-ietf-calext-jscalendar.a= ll@ietf.org ; calsify@ietf.org <= calsify@ietf.org> Subject: Re: [calsify] Secdir last call review of draft-ietf-calext-jscalen= dar-26 Hi Phillip, Thank you for the review and apologies for the late reply; I have been on l= eave. 1) Spam 2) Duplication 3) Time Zones 4) Authentication I have expanded the introduction to the security considerations to mention = (4) and added sections for (1)-(3); I include the additions and alterations= below. Please let me know if you believe this is insufficient: 7. Security Considerations Calendaring and scheduling information is very privacy-sensitive. Its transmission must be done carefully to protect it from possible threats, such as eavesdropping, replay, message insertion, deletion, modification, and man-in-the-middle attacks. The data being stored and transmitted may be used in systems with real world consequences. For example, a home automation system may turn an alarm on and off. Or a coworking space may charge money to the organiser of an event that books one of their meeting rooms. Such systems must be careful to authenticate all data they receive to prevent them from being subverted. This document just defines the data format; such considerations are primarily the concern of the API or method of storage and transmission of such files. =85 7.1-7.3 as before =85 7.4. Spam Calendar systems may receive JSCalendar files from untrusted sources, in particular as attachments to emails. This can be a vector for an attacker to inject spam into a user's calendar. This may confuse, annoy, and mislead users, or overwhelm their calendar with bogus events, preventing them from seeing legitimate ones. Heuristic, statistical or machine-learning-based filters can be effective in filtering out spam. Authentication mechanisms such as DKIM [RFC6376] can help establish the source of messages and associate the data with existing relationships (such as an address book contact). Misclassifications are always possible however, and providing a feedback mechanism for users to quickly correct this is advised. 7.5. Duplication It is important for calendar systems to maintain the UID of an event when updating it to avoid unexpected duplication of events. When the UID changes, consumers of the data may not remove the previous version of the event if it has a different UID. This can lead to a confusing situation for the user, with many variations of the event and no indication of which one is correct. Care must be taken by consumers of the data to remove old events where possible to avoid an accidental denial-of-service attack due to the volume of data. 7.6. Time Zones Events recur in a particular time zone. When this differs from the user's current time zone, it may unexpectedly cause an occurrence to shift in time for that user due to a daylight savings change in the event's time zone. A maliciously crafted event could attempt to confuse users with such an event to ensure a meeting is missed. In the general body of the text, the treatment of recurring events MUST add= ress time zones and daylight savings. This is the stuff iCal didn't get right at first and that lead to pain. Can you clarify a bit what change you are looking for here, if any? Do you = believe the current text in JSCalendar is ambiguous? A recurrence applies t= o the "start" property of the event, which is a local date-time. All other = properties (including "timeZone") are inherited unless overridden for a spe= cific instance. So an event will essentially recur in its time zone; if you= need to translate this into UTC you'll of course need time zone informatio= n and to account for daylight savings etc. Cheers, Neil. --_000_SA0PR15MB37910F779239FA49591D61D8E3320SA0PR15MB3791namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable
Thanks Phil for the review. This is a useful review with related experience= . Thanks Neil for addressing the these comments. 

Yours, 
Daniel 
From: Neil Jenkins <neil= j@fastmailteam.com>
Sent: Monday, March 16, 2020 6:07 AM
To: Phillip Hallam-Baker <hallam@gmail.com>; secdir@ietf.org &= lt;secdir@ietf.org>
Cc: last-call@ietf.org <last-call@ietf.org>; draft-ietf-calext= -jscalendar.all@ietf.org <draft-ietf-calext-jscalendar.all@ietf.org>;= calsify@ietf.org <calsify@ietf.org>
Subject: Re: [calsify] Secdir last call review of draft-ietf-calext-= jscalendar-26
 
Hi Phillip,

Thank you for the review and apologies for the late reply; I have been= on leave.

1) Spam
2) Duplication
3) Time Zones
4) Authentication

I have expanded the introduction to the security considerations to men= tion (4) and added sections for (1)-(3); I include the additions and altera= tions below. Please let me know if you believe this is insufficient:

7.  Security Considerations

   Calendaring and scheduling information is very privacy-se= nsitive.
   Its transmission must be done carefully to protect it fro= m possible
   threats, such as eavesdropping, replay, message insertion= , deletion,
   modification, and man-in-the-middle attacks.

   The data being stored and transmitted may be used in syst= ems with
   real world consequences.  For example, a home automa= tion system may
   turn an alarm on and off.  Or a coworking space may = charge money to
   the organiser of an event that books one of their meeting= rooms.
   Such systems must be careful to authenticate all data the= y receive to
   prevent them from being subverted.

   This document just defines the data format; such consider= ations are
   primarily the concern of the API or method of storage and=
   transmission of such files.

=85 7.1-7.3 as before =85

7.4.  Spam

   Calendar systems may receive JSCalendar files from untrus= ted sources,
   in particular as attachments to emails.  This can be= a vector for an
   attacker to inject spam into a user's calendar.  Thi= s may confuse,
   annoy, and mislead users, or overwhelm their calendar wit= h bogus
   events, preventing them from seeing legitimate ones.

   Heuristic, statistical or machine-learning-based filters = can be
   effective in filtering out spam.  Authentication mec= hanisms such as
   DKIM [RFC6376] can help establish the source of messages = and
   associate the data with existing relationships (such as a= n address
   book contact).  Misclassifications are always possib= le however, and
   providing a feedback mechanism for users to quickly corre= ct this is
   advised.

7.5.  Duplication

   It is important for calendar systems to maintain the UID = of an event
   when updating it to avoid unexpected duplication of event= s.  When the
   UID changes, consumers of the data may not remove the pre= vious
   version of the event if it has a different UID.  Thi= s can lead to a
   confusing situation for the user, with many variations of= the event
   and no indication of which one is correct.  Care mus= t be taken by
   consumers of the data to remove old events where possible= to avoid an
   accidental denial-of-service attack due to the volume of = data.

7.6.  Time Zones

   Events recur in a particular time zone.  When this d= iffers from the
   user's current time zone, it may unexpectedly cause an oc= currence to
   shift in time for that user due to a daylight savings cha= nge in the
   event's time zone.  A maliciously crafted event coul= d attempt to
   confuse users with such an event to ensure a meeting is m= issed.

In the general body of the text, the treatment of recurring events MUS= T address
time zones and daylight savings. This is the stuff iCal didn't get rig= ht at
first and that lead to pain.

Can you clarify a bit what change you are looking for here, if any? Do= you believe the current text in JSCalendar is ambiguous? A recurrence appl= ies to the "start" property of the event, which is a local date-t= ime. All other properties (including "timeZone") are inherited unless overridden for a specific instance. So an event will = essentially recur in its time zone; if you need to translate this into UTC = you'll of course need time zone information and to account for daylight sav= ings etc.

Cheers,
Neil.
--_000_SA0PR15MB37910F779239FA49591D61D8E3320SA0PR15MB3791namp_-- From nobody Tue Sep 29 08:08:02 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 95BC33A0EAE; Tue, 29 Sep 2020 08:07:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.848 X-Spam-Level: X-Spam-Status: No, score=-1.848 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Fia1bHewuf8c; Tue, 29 Sep 2020 08:07:57 -0700 (PDT) Received: from mail-io1-xd32.google.com (mail-io1-xd32.google.com [IPv6:2607:f8b0:4864:20::d32]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9A7B43A0EB0; Tue, 29 Sep 2020 08:07:50 -0700 (PDT) Received: by mail-io1-xd32.google.com with SMTP id u6so5130491iow.9; Tue, 29 Sep 2020 08:07:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=O3p/33o+5CA2DzGmK4Us7uHgx/5uL2uTVjEZsYuoj2c=; b=k3HDwbjgUSq2D71HP38+GvKLSM8mbTrlARj+ckh4WhecQ5P7LQsUGrVDMiwtKLl6+9 cogZ7PUHNGCVgL0uTmuyu93qYDic+aYlpdLzZp8kWkDhhiiwkhn7ZTXY8gs8wcs1VGRE bnPlACNIMCJvNGYWU1/uzxTtbO2HrhUXxh4ixUTltXk0PjTQtnCajmfIR/4GwMF5eUNs X9TaA374a25/RmPoUzurZzKppvR47wd0JXfexZopQQmJNGswmdKDv25Al67pi8THdfnb vCsz2A4yjq1A2MUw1r/oU0xje/8bIfkHF1J/Jx2xBYps1vzQxe50xyd6ICWxgn4o9BQD LrAQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=O3p/33o+5CA2DzGmK4Us7uHgx/5uL2uTVjEZsYuoj2c=; b=AtDnZ9y+uUlBbOVofiOws5EwvVBfmd6TApAVgYDJFEaAdtGLCN6nG6bvbMhKncTPNV g0lP2uvvHbIl6E7WheuT2plizabw8xTcpyGxnsKpluztoGFFrffVs3HnRz2myHj7qzjW CZagLHnvLvXv28WyXZBxnmIVhj71h4rbhc77A1J8asn+eYJSuGeo+Ub6sn4eLSpv9gFD sY4nmZ33cpaWqErDv8YI5Nu9YGL/FdP3RU7QDiweA/LFcNEm2yclB8Wxq4fn8KLK/82O dRrbyjUqxxlekbElMIoszbSXJ4Dw54oTGpBFYWJPyxlU0c18GB/M8ty8GCETc4Ms3oz9 aFGw== X-Gm-Message-State: AOAM531A5Y1jULaDPF5nlv8dskETnWsQGeHjO67dH8Hsd2wtC86iyfn1 sXJvdKCDsPOzxVWeDDMH2GzR1xIoVTrmf/rN3AQ= X-Google-Smtp-Source: ABdhPJyLE+PgZlN7kOUvLsFo+gEEfrOhvlg2Ow4nBr2rPIA0mOoX78LmlANLOos0D7ZWja5h4AxgSJlxllZDOSOUghQ= X-Received: by 2002:a05:6638:250d:: with SMTP id v13mr3275219jat.50.1601392066840; Tue, 29 Sep 2020 08:07:46 -0700 (PDT) MIME-Version: 1.0 References: <3D8D339D-C83A-45E9-9E0B-027C8F03B136@verisign.com> In-Reply-To: <3D8D339D-C83A-45E9-9E0B-027C8F03B136@verisign.com> From: Donald Eastlake Date: Tue, 29 Sep 2020 11:07:35 -0400 Message-ID: To: "Wessels, Duane" Cc: "draft-ietf-dnsop-dns-zone-digest.all@ietf.org" , secdir Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [secdir] SECDIR review of draft-ietf-dnsop-dns-zone-digest-11 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 Sep 2020 15:08:00 -0000 Hi Duane, Thanks for being so agreeable. As soon as a new version is posted with the changes I'll send out a message confirming that all my comments are resolved. Donald =============================== Donald E. Eastlake 3rd +1-508-333-2270 (cell) 2386 Panoramic Circle, Apopka, FL 32703 USA d3e3e3@gmail.com On Mon, Sep 28, 2020 at 6:54 PM Wessels, Duane wrote: > > > > > On Sep 27, 2020, at 7:50 PM, Donald Eastlake wrote: > > > > I have reviewed this document as part of the security directorate's > > ongoing effort to review all IETF documents being processed by the > > IESG. Document editors and WG chairs should treat these comments just > > like any other last call comments. > > > > The summary of the review is Ready with Nits. > > > > Overall, I am pretty happy with the state of the draft. Essentially > > all of the comments from my review of -09 have been resolved and I > > don't see any problem with other changes that have been made. However, > > on reviewing -11, I did come up with a few things as listed below. > > > > Section 2, last sentence right before the Section 2.1 header, should > > "recommended" be all capital? > > That change is fine with me. > > > > > > Something I didn't notice in my first review: > > Section 2.2.1, ZONEMD already covers the SOA that is in the zone and > > so includes the zone serial in its Digest. Thus it seems a little odd > > to say that the field is needed to make the DNS response meaningful. > > I'm not suggesting removing the field or anything... Perhaps some > > wording change like the following: > > OLD > > It is included here in order to make DNS response messages of type > > ZONEMD meaningful. Without the serial number, a stand-alone ZONEMD > > digest has no association to any particular instance of a zone. > > NEW > > It is included here to clearly bind the ZONEMD RR to a particular > > version of the zone's content. Without the serial number, a > > stand-alone ZONEMD digest has no obvious association to any > > particular instance of a zone. > > I think that is an improvement. > > > > > > Section 3.1, last sentence just before the Section 3.2 header: This > > says ZONEMD RRs are excluded from digest calculation but in Section > > 2.1 it says that non-apex ZONEMD RRs are treated are ordinary RRs and > > included. I think that 2.1 is correct and suggest inserting the word > > "apex" so the last sentence of Section 3.1 starts with "Since apex > > ZONEMD RRs are excluded ..." Although less important, "apex" probably > > should also be inserted before "ZONEMD" in the fourth and sixth bullet > > points of Section 3.3.1.1. > > I don't mind inserting "apex" where you suggest. I felt we were covered > by the earlier statement that ZONEMD means apex ZONEMD unless stated > otherwise, but its good to be explicit in those places. > > > > > > > Section 5.3, the last sentence, after the table, is no longer needed, > > since that information is given above the table, so it should be > > deleted. > > Yes. > > > Section 6.2: Need to expand KSK on first use or alternatively, since it > > is the only use, just not use the acronym at all and spell it out in > > full. > > Done. > > > > > > Section 6.3: Size estimate for ZONEMD RR seems a bit low, perhaps > > based on algorithms in earlier versions of the draft with shorter > > digests. I would say 55 to 85 octets would be a better current > > estimate. > > Yes indeed. I changed it to "65 to 95" now since the smallest SHA384 SIMPLE > RR is 65 bytes and a SHA512 SIMPLE RR for "example.com" is 93 bytes. > > > > > > Section 6.4: In the second paragraph, I think you mean "private use > > hash algorithm code points", not "private use hash algorithms". > > Yes, thats better. > > > > > That's it. > > > > Thanks, > > Donald > > Thank you again. > > DW > > From nobody Tue Sep 29 14:30:54 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CF2973A11F0; Tue, 29 Sep 2020 14:30:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.848 X-Spam-Level: X-Spam-Status: No, score=-1.848 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xmD5U1a0YjJq; Tue, 29 Sep 2020 14:30:47 -0700 (PDT) Received: from mail-io1-xd35.google.com (mail-io1-xd35.google.com [IPv6:2607:f8b0:4864:20::d35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E93373A11EE; Tue, 29 Sep 2020 14:30:46 -0700 (PDT) Received: by mail-io1-xd35.google.com with SMTP id u19so6442561ion.3; Tue, 29 Sep 2020 14:30:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=25icHoRFDQXHflTJ+V2N9toFrfror14ls0g4e4NLb8Y=; b=MFod/eeJcxEjEw0zxx3Me/GAkdBdQr7ozNkp5eLjB+rAhDP09FGIsrMox68w1chrsk cQMxwPcuW8LsUlHy+6F+TJv/agpzrG/sEOCYZl2Af4UndYe65emO5wwCqNqeWFw0npgx ygUQ+4g5UPVtvUCimAJuVEX8J62/CVptonsRiV3y7L4cspl2cwtHrFe2Pt99elXYxzZP YK5bmCtQ6cew9I0QXUessKxSLBxadyOMTJaVUmRNEFOkoh1KrtshwQO9Ej0BPfvkfEqN Nyr6Fz05CwVVZaI3bFxHMWhVz143MfCo3IqKFsz4ubaNt+vTwQzhIF4B1Syp6L5G2EDK pX/g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=25icHoRFDQXHflTJ+V2N9toFrfror14ls0g4e4NLb8Y=; b=T3i46Ij+KV4tXHSiIIUOvPTJcO3dFtqISVA1nsJ0LWmCMy6E1JYcG0h7bsub3oGNrT Vi3YX5B5Q1UncS2oT2MXyRnV9sacFQf6BnaFe0ltF6c/7Y52rm7+7e4ZoWSxuMb1Z1YD UgbuMmto96pW4/vnBOeXBfF6NUI6itSkHVsHDdXq3dhKcB8GYGWI2EsUM8csJLLy4oIs frOe49hGrymAUWtDfVwr1kykB9PSF8C7TjOKEWCNrFSwtwUPluf8TqglrGAulfeJcJyO isrrhI7TWdp626vjQQGuK+xrZX5y0cZhTifoycqBypTPvko1xi+TzoD/mwgU95wx7Jga 0KXQ== X-Gm-Message-State: AOAM531AMdmu0FklJxwiN8ji6aZhHX/FgLzIQsHLD5mntGvrrxS6FBSv HFwTvKpRSnh/eEt/VRqOXCpNiwczfO6FSr1fkcNrdFyKun8= X-Google-Smtp-Source: ABdhPJwx5zLE2PNCvnvD8tuCbcOfRHXYsTLAEAzrJ5MxK41Z2f6cqalXqtjqsucnJh/MetUjcAjgZGXwEh3YZsLEMU8= X-Received: by 2002:a02:b698:: with SMTP id i24mr4035405jam.39.1601415045558; Tue, 29 Sep 2020 14:30:45 -0700 (PDT) MIME-Version: 1.0 References: <3D8D339D-C83A-45E9-9E0B-027C8F03B136@verisign.com> In-Reply-To: <3D8D339D-C83A-45E9-9E0B-027C8F03B136@verisign.com> From: Donald Eastlake Date: Tue, 29 Sep 2020 17:30:34 -0400 Message-ID: To: "iesg@ietf.org" , "draft-ietf-dnsop-dns-zone-digest.all@ietf.org" Cc: secdir Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [secdir] SECDIR review of draft-ietf-dnsop-dns-zone-digest-11 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 Sep 2020 21:30:49 -0000 Hi, Looking at version -12, just posted, all of my comments are resolved and I believe the draft is now READY for publication as an RFC. Thanks, Donald =============================== Donald E. Eastlake 3rd +1-508-333-2270 (cell) 2386 Panoramic Circle, Apopka, FL 32703 USA d3e3e3@gmail.com On Mon, Sep 28, 2020 at 6:54 PM Wessels, Duane wrote: > > > > > On Sep 27, 2020, at 7:50 PM, Donald Eastlake wrote: > > > > I have reviewed this document as part of the security directorate's > > ongoing effort to review all IETF documents being processed by the > > IESG. Document editors and WG chairs should treat these comments just > > like any other last call comments. > > > > The summary of the review is Ready with Nits. > > > > Overall, I am pretty happy with the state of the draft. Essentially > > all of the comments from my review of -09 have been resolved and I > > don't see any problem with other changes that have been made. However, > > on reviewing -11, I did come up with a few things as listed below. > > > > Section 2, last sentence right before the Section 2.1 header, should > > "recommended" be all capital? > > That change is fine with me. > > > > > > Something I didn't notice in my first review: > > Section 2.2.1, ZONEMD already covers the SOA that is in the zone and > > so includes the zone serial in its Digest. Thus it seems a little odd > > to say that the field is needed to make the DNS response meaningful. > > I'm not suggesting removing the field or anything... Perhaps some > > wording change like the following: > > OLD > > It is included here in order to make DNS response messages of type > > ZONEMD meaningful. Without the serial number, a stand-alone ZONEMD > > digest has no association to any particular instance of a zone. > > NEW > > It is included here to clearly bind the ZONEMD RR to a particular > > version of the zone's content. Without the serial number, a > > stand-alone ZONEMD digest has no obvious association to any > > particular instance of a zone. > > I think that is an improvement. > > > > > > Section 3.1, last sentence just before the Section 3.2 header: This > > says ZONEMD RRs are excluded from digest calculation but in Section > > 2.1 it says that non-apex ZONEMD RRs are treated are ordinary RRs and > > included. I think that 2.1 is correct and suggest inserting the word > > "apex" so the last sentence of Section 3.1 starts with "Since apex > > ZONEMD RRs are excluded ..." Although less important, "apex" probably > > should also be inserted before "ZONEMD" in the fourth and sixth bullet > > points of Section 3.3.1.1. > > I don't mind inserting "apex" where you suggest. I felt we were covered > by the earlier statement that ZONEMD means apex ZONEMD unless stated > otherwise, but its good to be explicit in those places. > > > > > > > Section 5.3, the last sentence, after the table, is no longer needed, > > since that information is given above the table, so it should be > > deleted. > > Yes. > > > Section 6.2: Need to expand KSK on first use or alternatively, since it > > is the only use, just not use the acronym at all and spell it out in > > full. > > Done. > > > > > > Section 6.3: Size estimate for ZONEMD RR seems a bit low, perhaps > > based on algorithms in earlier versions of the draft with shorter > > digests. I would say 55 to 85 octets would be a better current > > estimate. > > Yes indeed. I changed it to "65 to 95" now since the smallest SHA384 SIMPLE > RR is 65 bytes and a SHA512 SIMPLE RR for "example.com" is 93 bytes. > > > > > > Section 6.4: In the second paragraph, I think you mean "private use > > hash algorithm code points", not "private use hash algorithms". > > Yes, thats better. > > > > > That's it. > > > > Thanks, > > Donald > > Thank you again. > > DW > > From nobody Wed Sep 30 19:03:03 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 7EF233A0CBA; Wed, 30 Sep 2020 09:04:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1601481873; bh=0BChfWZa4e8CxGAMB4FIQXd411YIqE21XwgD/C6owh4=; h=From:To:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe:Reply-To; b=gCRYOJwMm0xUtWiYxD7VxSWrJMh3776Ad4W4MavDSShjnKkU5/hX4JzniBeD018zn Jt5+7XocBCg1+A2Cxebkhmo5I+dPY6mqCtXkIEVocoIc8QpV/rpOi/GESQs4tGyN8A 9qPsD0vfIfApPfJtAM3Nz3QesWDaXcb+fvYlsKV4= X-Mailbox-Line: From new-work-bounces@ietf.org Wed Sep 30 09:04:27 2020 Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 4334A3A0CAC; Wed, 30 Sep 2020 09:04:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1601481862; bh=0BChfWZa4e8CxGAMB4FIQXd411YIqE21XwgD/C6owh4=; h=From:To:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe:Reply-To; b=k/jPkyxExne9QigVsTMfkDNZ9c1nOpfAttYMEtxImqvkoVKSjoJR0Ln26YmKcNQJJ Vr2L9GuOeUEXC30H2E6nfqnLV22oNC6M1b1aC54edoRZZFJGhS35p1LR+MRfH8zo7W 9c7yCdqQf31g6uL/Ra7Bde/BQ/g6Rl7xlEV1e1ng= X-Original-To: new-work@ietf.org Delivered-To: new-work@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id BFB823A0AF8 for ; Wed, 30 Sep 2020 09:04:15 -0700 (PDT) MIME-Version: 1.0 From: The IESG To: X-Test-IDTracker: no X-IETF-IDTracker: 7.17.1 Auto-Submitted: auto-generated Precedence: bulk MIME-Version: 1.0 Reply_to: Message-ID: <160148185576.24946.8722239041031299275@ietfa.amsl.com> Date: Wed, 30 Sep 2020 09:04:15 -0700 Archived-At: X-BeenThere: new-work@ietf.org X-Mailman-Version: 2.1.29 Reply-To: iesg@ietf.org Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Errors-To: new-work-bounces@ietf.org Sender: "new-work" Archived-At: X-Mailman-Approved-At: Wed, 30 Sep 2020 19:03:02 -0700 Subject: [secdir] [new-work] WG Review: Building Blocks for HTTP APIs (httpapi) X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Sep 2020 16:04:39 -0000 QSBuZXcgSUVURiBXRyBoYXMgYmVlbiBwcm9wb3NlZCBpbiB0aGUgQXBwbGljYXRpb25zIGFuZCBS ZWFsLVRpbWUgQXJlYS4gVGhlCklFU0cgaGFzIG5vdCBtYWRlIGFueSBkZXRlcm1pbmF0aW9uIHll dC4gVGhlIGZvbGxvd2luZyBkcmFmdCBjaGFydGVyIHdhcwpzdWJtaXR0ZWQsIGFuZCBpcyBwcm92 aWRlZCBmb3IgaW5mb3JtYXRpb25hbCBwdXJwb3NlcyBvbmx5LiBQbGVhc2Ugc2VuZCB5b3VyCmNv bW1lbnRzIHRvIHRoZSBJRVNHIG1haWxpbmcgbGlzdCAoaWVzZ0BpZXRmLm9yZykgYnkgMjAyMC0x MC0xMC4KCkJ1aWxkaW5nIEJsb2NrcyBmb3IgSFRUUCBBUElzIChodHRwYXBpKQotLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLQpDdXJyZW50IHN0YXR1czogUHJvcG9zZWQgV0cKCkNoYWlyczoKICBEYXJyZWwgTWlsbGVy IDxkYXJyZWwubWlsbGVyQG1pY3Jvc29mdC5jb20+CiAgUmljaCBTYWx6IDxyc2FsekBha2FtYWku Y29tPgoKQXNzaWduZWQgQXJlYSBEaXJlY3RvcjoKICBCYXJyeSBMZWliYSA8YmFycnlsZWliYUBj b21wdXRlci5vcmc+CgpBcHBsaWNhdGlvbnMgYW5kIFJlYWwtVGltZSBBcmVhIERpcmVjdG9yczoK ICBCYXJyeSBMZWliYSA8YmFycnlsZWliYUBjb21wdXRlci5vcmc+CiAgTXVycmF5IEt1Y2hlcmF3 eSA8c3VwZXJ1c2VyQGdtYWlsLmNvbT4KCk1haWxpbmcgbGlzdDoKICBBZGRyZXNzOiBodHRwYXBp QGlldGYub3JnCiAgVG8gc3Vic2NyaWJlOiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xp c3RpbmZvL2h0dHBhcGkKICBBcmNoaXZlOiBodHRwczovL21haWxhcmNoaXZlLmlldGYub3JnL2Fy Y2gvYnJvd3NlL2h0dHBhcGkvCgpHcm91cCBwYWdlOiBodHRwczovL2RhdGF0cmFja2VyLmlldGYu b3JnL2dyb3VwL2h0dHBhcGkvCgpDaGFydGVyOiBodHRwczovL2RhdGF0cmFja2VyLmlldGYub3Jn L2RvYy9jaGFydGVyLWlldGYtaHR0cGFwaS8KCkluIGFkZGl0aW9uIHRvIGl0cyB1c2UgZm9yIHdl YiBicm93c2luZywgSFRUUCBpcyBvZnRlbiB1c2VkIGZvcgptYWNoaW5lLXRvLW1hY2hpbmUgY29t bXVuaWNhdGlvbiwgZmFjaWxpdGF0ZWQgYnkgSFRUUCBBUElzLiBUaGlzIFdvcmtpbmcKR3JvdXAg d2lsbCBzdGFuZGFyZGlzZSBIVFRQIHByb3RvY29sIGV4dGVuc2lvbnMgZm9yIHVzZSBpbiBzdWNo IGNhc2VzLCB3aXRoIGEKZm9jdXMgb24gYnVpbGRpbmcgYmxvY2tzIGZvciBzZXBhcmF0ZSBvciBj b21iaW5lZCB1c2UuCgpJdHMgb3V0cHV0IGNhbiBpbmNsdWRlIHRoZSBmb2xsb3dpbmc6CgrigKIg U3BlY2lmaWNhdGlvbnMgZm9yIEhUVFAgZXh0ZW5zaW9ucyB0aGF0IHJlbGF0ZSB0byBIVFRQIEFQ SXMgKHR5cGljYWxseSwgbmV3CkhUVFAgaGVhZGVyIGFuZC9vciB0cmFpbGVyIGZpZWxkcykKCuKA oiBTcGVjaWZpY2F0aW9ucyBmb3IgbmV3IG1lc3NhZ2UgYm9keSBmb3JtYXRzLCBvciBjb252ZW50 aW9ucyBmb3IgdGhlaXIgdXNlCmluIEhUVFAgQVBJcyAoZS5nLiwgcGF0dGVybnMgb2YgSlNPTiBv YmplY3RzKQoK4oCiIEJlc3QgcHJhY3RpY2VzIGFuZCBvdGhlciBkb2N1bWVudGF0aW9uIGZvciBI VFRQIEFQSSBkZXNpZ25lcnMsIGNvbnN1bWVycywKaW1wbGVtZW50ZXJzLCBvcGVyYXRvcnMsIGV0 Yy4KCk90aGVyIGl0ZW1zIGFyZSBvdXQgb2Ygc2NvcGUuIEluIHBhcnRpY3VsYXIsIHRoaXMgV0cg d2lsbCBub3QgdGFrZSBvbiB3b3JrCml0ZW1zIGZvciBIVFRQIEFQSXMgZm9yIHNwZWNpZmljIGFw cGxpY2F0aW9ucyBvciBzZXJ2aWNlcywgYW5kIGl0IHdpbGwgbm90CmRlZmluZSBuZXcgSFRUUCBl eHRlbnNpb24gcG9pbnRzLiBBUElzIGZvciBIVFRQIGl0c2VsZiAoZS5nLiwgaW4gY2xpZW50cyBh bmQKc2VydmVycykgYXJlIGFsc28gb3V0IG9mIHNjb3BlLgoKTmV3IHdvcmsgaXRlbXMgY2FuIGJl IGFkZGVkIGFmdGVyIGEgQ2FsbCBmb3IgQWRvcHRpb24gb24gdGhlIHdvcmtpbmcgZ3JvdXAKbWFp bGluZyBsaXN0IGFuZCBjb25zdWx0YXRpb24gd2l0aCB0aGUgQXJlYSBEaXJlY3Rvci4gVG8gYXNz ZXNzIHdoZXRoZXIgdGhlCmdyb3VwIGlzIGZ1bmN0aW9uaW5nIHdlbGwgaW4gdGhpcyBtb2RlLCB0 aGlzIGNoYXJ0ZXIgd2lsbCBiZSByZXZpZXdlZCBieSB0aGUKSUVTRyBuaW5lIG1vbnRocyBhZnRl ciBjaGFydGVyaW5nLgoKVG8gYmUgc3VjY2Vzc2Z1bCwgdGhpcyBXb3JraW5nIEdyb3VwIHdpbGwg bmVlZCB0byBoYXZlIGFjdGl2ZSBhbmQgYnJvYWQKcmVwcmVzZW50YXRpb24gZnJvbSBhY3Jvc3Mg dGhlIGluZHVzdHJ5IC0tIGUuZy4sIEFQSSBnYXRld2F5IHZlbmRvcnMgKGFuZApvdGhlciBpbnRl cm1lZGlhcmllcyksIEFQSSBjb25zdWx0YW50cywgQVBJIHRvb2wgdmVuZG9ycywgaW4taG91c2Ug QVBJIHRlYW1zLgpUaGVyZWZvcmUsIGFkb3B0ZWQgcHJvcG9zYWxzIHNob3VsZCBoYXZlIHB1Ymxp YyBzdXBwb3J0IGZyb20gbXVsdGlwbGUKaW1wbGVtZW50ZXJzIGFuZC9vciBkZXBsb3ltZW50cyBi ZWZvcmUgYmVpbmcgc2VudCB0byB0aGUgSUVTRy4KClRoaXMgV29ya2luZyBHcm91cCB3aWxsIGFs c28gbmVlZCB0byBjb29yZGluYXRlIGNsb3NlbHkgd2l0aCB0aGUgSFRUUCBXb3JraW5nCkdyb3Vw LCBpbiBwYXJ0aWN1bGFyIHdoZW4gbmV3IG1ldGhvZHMgYW5kIHN0YXR1cyBjb2RlcyBhcmUgcHJv cG9zZWQuIFdvcmsKaXRlbXMgdGhhdCBhcmUgbW9yZSBicm9hZGx5IGFwcGxpY2FibGUgKGUuZy4s IGZvciBpbXBsZW1lbnRhdGlvbiBpbiBXZWIKYnJvd3NlcnMpIGFyZSBsaWtlbHkgdG8gYmUgbW9y ZSBhcHByb3ByaWF0ZSBpbiB0aGUgSFRUUCBXb3JraW5nIEdyb3VwLCBidXQgaXQKaXMgZXhwZWN0 ZWQgdGhhdCBjb29yZGluYXRpb24gYW5kIGRpc2N1c3Npb24gYmV0d2VlbiB0aGUgZ3JvdXBzJyBD aGFpcnMgYW5kCkFyZWEgRGlyZWN0b3Iocykgd2lsbCBndWlkZSB3b3JrIGl0ZW1zIHRvIHRoZSBh cHByb3ByaWF0ZSB2ZW51ZS4KCk1pbGVzdG9uZXM6CgpUQkQKCl9fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fCm5ldy13b3JrIG1haWxpbmcgbGlzdApuZXctd29y a0BpZXRmLm9yZwpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL25ldy13b3Jr Cg==