From christopher.morrow@gmail.com Fri Mar 1 08:36:39 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A931B11E809C for ; Fri, 1 Mar 2013 08:36:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.6 X-Spam-Level: X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mIniov0B4ch8 for ; Fri, 1 Mar 2013 08:36:39 -0800 (PST) Received: from mail-la0-x22c.google.com (mail-la0-x22c.google.com [IPv6:2a00:1450:4010:c03::22c]) by ietfa.amsl.com (Postfix) with ESMTP id A5C3F21F90D5 for ; Fri, 1 Mar 2013 08:36:37 -0800 (PST) Received: by mail-la0-f44.google.com with SMTP id eb20so3149133lab.3 for ; Fri, 01 Mar 2013 08:36:36 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:x-received:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type; bh=6dTI4TUVgNlKodYhamBUybzaHv6qY0DfLK5D26m7NI8=; b=sDVIA5hTlKX2A8qNengozKQi5hf/KczN/L8kue58bRzSgL6f9r63TI3TXIZImmSY88 dyE9zm13lVt2SCKuKblolkTvmOUmACnVI+XXhGrIjdG/kjmNjprfFMvq9i309KflE2k+ PT9+rZeTxTa3b6NjElN7SiWaM7usYjoeu//P589nqWDpAEgpSr/NsTACzfEBnYxwyQbK AAk7GEvwOglq5dTLbWlKvZ83aDxxgbjYCbSTcnvCfQTCvjXmRSY2+YIF4hsmS1D6LmYZ zafLVFpGYxFodEnL7jq/PiAPvQYnB964TSzm67i+FjH7FNzRf3Q/+B/rHVKbPvhm3aal /XCg== MIME-Version: 1.0 X-Received: by 10.112.50.42 with SMTP id z10mr1001336lbn.73.1362155796577; Fri, 01 Mar 2013 08:36:36 -0800 (PST) Sender: christopher.morrow@gmail.com Received: by 10.152.28.34 with HTTP; Fri, 1 Mar 2013 08:36:36 -0800 (PST) In-Reply-To: <512F69F1.4090301@ieca.com> References: <5126F465.8030005@ops-netman.net> <512F69F1.4090301@ieca.com> Date: Fri, 1 Mar 2013 11:36:36 -0500 X-Google-Sender-Auth: S_nBL7Ldaq4ReAPvata8vTSNXfw Message-ID: From: Christopher Morrow To: Sean Turner Content-Type: text/plain; charset=ISO-8859-1 Cc: sidr wg list Subject: Re: [sidr] WGLC: draft-ietf-sidr-cps (end 2013-03-07 - Mar 07, 2013) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 01 Mar 2013 16:36:39 -0000 Great... so assuming the authors deal with this set of comments we'll ask them to spin a new version and submit that for WGLC when it arrives? Does that seem like a good path for those still listening? -chris co-chair-1-of-3 On Thu, Feb 28, 2013 at 9:30 AM, Sean Turner wrote: > Below are some comments on the draft. I also submitted my nits to the > editors. > > 0) Based on the assumption that draft-newton-sidr-policy-qualifiers will be > adopted because that's what the RIRs want should s1.2 or 1.5 also include > some information about where it can be found? This information would be > identical to the URI included in the policy qualifier? > > 1) s1.6: CP - Is it worth nothing that there might be another CP for the > BPKI? > > 2) s4.6.1: Not sure if this needs to go here but don't we need to say > something about not renewing certificates forever? > > 3) draft-ietf-sidr-rtr-keying describes the procedures for operator > generated keys (i.e., those that are not router generated). A couple of > questions come to mind: > > a) Should the CPS point to that draft in s6.1.2 or will the CPS be updated > when draft-ietf-sidr-rtr-keying is published? > > b) draft-ietf-sidr-rtr-keying allows operators sign the private keys they > generate and subsequently send back to the router. Should this be > explicitly called out in s4.5.1. For s.4.5.2, is the returned signed-key an > RPKI-Signed Object? > > spt > > > On 2/21/13 11:30 PM, Chris Morrow wrote: >> >> WG folks, >> As the subject states, let's please start a WGLC poll for the document: >> draft-ietf-sidr-cps-01 >> >> >> with the abstract: >> "This document contains a template to be used for creating a >> Certification Practice Statement (CPS) for an Organization that is >> part of the Resource Public Key Infrastructure (RPKI), e.g., a >> resource allocation registry or an ISP." >> >> So far the authors have made a few revisions, with updates based on >> comments/feedback, at this time the document has been stable for more >> than 6 months time, let's move this along if there are no further >> issues/addendums/questions/appendixes. >> >> thanks! >> -chris >> co-chair-1-of-3 >> _______________________________________________ >> sidr mailing list >> sidr@ietf.org >> https://www.ietf.org/mailman/listinfo/sidr >> > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr From turners@ieca.com Mon Mar 4 08:08:33 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C1C7621F8C26 for ; Mon, 4 Mar 2013 08:08:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.265 X-Spam-Level: X-Spam-Status: No, score=-102.265 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, IP_NOT_FRIENDLY=0.334, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Jffa4Ujsm97r for ; Mon, 4 Mar 2013 08:08:33 -0800 (PST) Received: from gateway05.websitewelcome.com (gateway05.websitewelcome.com [67.18.21.3]) by ietfa.amsl.com (Postfix) with ESMTP id 3FDEA21F8A3D for ; Mon, 4 Mar 2013 08:08:33 -0800 (PST) Received: by gateway05.websitewelcome.com (Postfix, from userid 5007) id 1128A96C883FE; Mon, 4 Mar 2013 10:08:31 -0600 (CST) Received: from gator1743.hostgator.com (gator1743.hostgator.com [184.173.253.227]) by gateway05.websitewelcome.com (Postfix) with ESMTP id 75DE096C87FDA for ; Mon, 4 Mar 2013 10:08:30 -0600 (CST) Received: from [108.45.16.214] (port=57362 helo=thunderfish.local) by gator1743.hostgator.com with esmtpsa (TLSv1:DHE-RSA-AES256-SHA:256) (Exim 4.80) (envelope-from ) id 1UCXwD-0006Vz-PX; Mon, 04 Mar 2013 10:08:29 -0600 Message-ID: <5134C6FD.6080807@ieca.com> Date: Mon, 04 Mar 2013 11:08:29 -0500 From: Sean Turner User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:17.0) Gecko/20130216 Thunderbird/17.0.3 MIME-Version: 1.0 To: Christopher Morrow References: <5126F465.8030005@ops-netman.net> <512F69F1.4090301@ieca.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - gator1743.hostgator.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - ieca.com X-BWhitelist: no X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: (thunderfish.local) [108.45.16.214]:57362 X-Source-Auth: sean.turner@ieca.com X-Email-Count: 2 X-Source-Cap: ZG9tbWdyNDg7ZG9tbWdyNDg7Z2F0b3IxNzQzLmhvc3RnYXRvci5jb20= Cc: sidr wg list Subject: Re: [sidr] WGLC: draft-ietf-sidr-cps (end 2013-03-07 - Mar 07, 2013) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Mar 2013 16:08:33 -0000 Sounds like a plan to me. spt On 3/1/13 11:36 AM, Christopher Morrow wrote: > Great... so assuming the authors deal with this set of comments we'll > ask them to spin a new version and submit that for WGLC when it > arrives? > > Does that seem like a good path for those still listening? > > -chris > co-chair-1-of-3 > > On Thu, Feb 28, 2013 at 9:30 AM, Sean Turner wrote: >> Below are some comments on the draft. I also submitted my nits to the >> editors. >> >> 0) Based on the assumption that draft-newton-sidr-policy-qualifiers will be >> adopted because that's what the RIRs want should s1.2 or 1.5 also include >> some information about where it can be found? This information would be >> identical to the URI included in the policy qualifier? >> >> 1) s1.6: CP - Is it worth nothing that there might be another CP for the >> BPKI? >> >> 2) s4.6.1: Not sure if this needs to go here but don't we need to say >> something about not renewing certificates forever? >> >> 3) draft-ietf-sidr-rtr-keying describes the procedures for operator >> generated keys (i.e., those that are not router generated). A couple of >> questions come to mind: >> >> a) Should the CPS point to that draft in s6.1.2 or will the CPS be updated >> when draft-ietf-sidr-rtr-keying is published? >> >> b) draft-ietf-sidr-rtr-keying allows operators sign the private keys they >> generate and subsequently send back to the router. Should this be >> explicitly called out in s4.5.1. For s.4.5.2, is the returned signed-key an >> RPKI-Signed Object? >> >> spt >> >> >> On 2/21/13 11:30 PM, Chris Morrow wrote: >>> >>> WG folks, >>> As the subject states, let's please start a WGLC poll for the document: >>> draft-ietf-sidr-cps-01 >>> >>> >>> with the abstract: >>> "This document contains a template to be used for creating a >>> Certification Practice Statement (CPS) for an Organization that is >>> part of the Resource Public Key Infrastructure (RPKI), e.g., a >>> resource allocation registry or an ISP." >>> >>> So far the authors have made a few revisions, with updates based on >>> comments/feedback, at this time the document has been stable for more >>> than 6 months time, let's move this along if there are no further >>> issues/addendums/questions/appendixes. >>> >>> thanks! >>> -chris >>> co-chair-1-of-3 >>> _______________________________________________ >>> sidr mailing list >>> sidr@ietf.org >>> https://www.ietf.org/mailman/listinfo/sidr >>> >> _______________________________________________ >> sidr mailing list >> sidr@ietf.org >> https://www.ietf.org/mailman/listinfo/sidr > From Sandra.Murphy@sparta.com Mon Mar 4 14:14:33 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C9DE511E80E2 for ; Mon, 4 Mar 2013 14:14:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id khU9fUgEfPPr for ; Mon, 4 Mar 2013 14:14:33 -0800 (PST) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by ietfa.amsl.com (Postfix) with ESMTP id 7992811E80DC for ; Mon, 4 Mar 2013 14:14:31 -0800 (PST) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.14.4/8.14.4) with ESMTP id r24MEUtu004225; Mon, 4 Mar 2013 16:14:30 -0600 Received: from Hermes.columbia.ads.sparta.com ([10.62.56.107]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id r24METrU028887; Mon, 4 Mar 2013 16:14:29 -0600 Received: from HERMES.columbia.ads.sparta.com ([fe80::e4a8:a383:2128:c0e5]) by Hermes.columbia.ads.sparta.com ([fe80::e4a8:a383:2128:c0e5%18]) with mapi id 14.02.0247.003; Mon, 4 Mar 2013 17:14:02 -0500 From: "Murphy, Sandra" To: "George, Wes" Thread-Topic: request for agenda items Thread-Index: Ac4Tm5rJ2QzVI03iTWuu0A/oY7LgWwFiW3EX Date: Mon, 4 Mar 2013 22:14:01 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F65C232828@Hermes.columbia.ads.sparta.com> References: <24B20D14B2CD29478C8D5D6E9CBB29F65C22D716@Hermes.columbia.ads.sparta.com> In-Reply-To: <24B20D14B2CD29478C8D5D6E9CBB29F65C22D716@Hermes.columbia.ads.sparta.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.137] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: "sidr@ietf.org" Subject: [sidr] FW: request for agenda items X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Mar 2013 22:14:33 -0000 I thought I asked you this but I don't seem to see anything in my sent fold= er. Do you want to speak (or want me to speak) about the as-migration draft on= the sidr agenda? --Sandy ________________________________________ From: Murphy, Sandra Sent: Monday, February 25, 2013 4:03 PM To: sidr@ietf.org Subject: request for agenda items Any who would like to speak at sidr in the IETF86 meeting in Orlando, pleas= e do send a message to the chairs and/or list. --Sandy Murphy, speaking as one of the wg co-chairs= From dmandelb@bbn.com Mon Mar 4 15:16:37 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 788F921F8640 for ; Mon, 4 Mar 2013 15:16:37 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6L1NmwcqKRpJ for ; Mon, 4 Mar 2013 15:16:36 -0800 (PST) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) by ietfa.amsl.com (Postfix) with ESMTP id D8D7E21F862E for ; Mon, 4 Mar 2013 15:16:36 -0800 (PST) Received: from smp.bbn.com ([192.1.122.26]:32020) by smtp.bbn.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.77 (FreeBSD)) (envelope-from ) id 1UCecW-000H5B-1o for sidr@ietf.org; Mon, 04 Mar 2013 18:16:36 -0500 Received: from dhcp89-089-068.bbn.com ([128.89.89.68]:43949) by smp.bbn.com with esmtpsa (TLSv1:CAMELLIA256-SHA:256) (Exim 4.76 (FreeBSD)) (envelope-from ) id 1UCecV-0003Fl-TK for sidr@ietf.org; Mon, 04 Mar 2013 18:16:35 -0500 Message-ID: <1362438997.18228.199.camel@titan> From: David Mandelberg To: sidr@ietf.org Date: Mon, 04 Mar 2013 18:16:37 -0500 In-Reply-To: <5126F465.8030005@ops-netman.net> References: <5126F465.8030005@ops-netman.net> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.2.3-0ubuntu6 Content-Transfer-Encoding: 7bit Mime-Version: 1.0 X-Authenticated-User: dmandelb Subject: Re: [sidr] WGLC: draft-ietf-sidr-cps (end 2013-03-07 - Mar 07, 2013) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Mar 2013 23:16:37 -0000 Overall this looks good. I found one minor issue and a bunch of nits, and I have some questions: = minor = 4.6.7. Notification of Certificate Issuance by the CA to Other Entities: There is no section 4.4.3. = questions = 1.5.1. Organization administering the document: Should the address and/or website of the organization also be included? That could help disambiguate when there are multiple organizations with the same or similar names. 4.1.2. Enrollment Process and Responsibilities: I found the second sentence unclear. Are you trying to tell registries and ISPs that certificates should be issued as part of their normal business practices? Are you trying to say that *if* certificates are issued as part of normal business practices *then* "a separate application to request a certificate may not be necessary"? 4.6.1. Circumstance for Certificate Renewal: The phrase "unless the private key has been reported as compromised" doesn't specify how a compromised key can be reported. Should there be a reference to section 4.9.3? 4.7.1. Circumstance for Certificate Re-key: What Certificate Policy is "Section 5.6 of the Certificate Policy" referring to? Section 5.6 of RFC6484 doesn't mention validity intervals. 5.4.1. Types of Events Recorded: Why aren't "Key generation", "Software and/or configuration updates to the CA", and "Clock adjustments" listed? 5.6. Key Changeover: Does mention of validity intervals belong in this section? = nits = Multiple places: Should "the RPKI CP" be changed to "[RFC6484]"? Preface: item 5 lists "Acknowledgments" three times (twice as "Acknowledgments", once as "12"). 1. Introduction: "(INRs, see definition in Section 1.7)" references a non-existent section 1.7. 1.1. Overview: Change "as described in 2.4" to "as described in Section 2.4". 1.4.1. Appropriate Certificate Uses: Change "2.4" to "Section 2.4". 2.2. Publication of Certification Information: Should the hyphen in "RPKI-signed objects" be changed to a space? 2.3. Time or Frequency of Publication: Change "nextScheduledUpdate" to "nextUpdate". 3.1.2. Need for Names to be Meaningful: The first two sentences seem redundant with section 3.1.5. 3.2.6. Criteria for Interoperation: Change "e g." to "e.g.". 4.1.1. Who Can Submit a Certificate Application: Should "this Organization" be changed to ""? 4.2.2. Approval or Rejection of Certificate Applications: Change "3.2.1" to "Section 3.2.1". 4.4.2. Publication of the Certificate by the CA: Insert space in "notified>. X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D634E11E80EA for ; Mon, 4 Mar 2013 15:40:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.599 X-Spam-Level: X-Spam-Status: No, score=-106.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4OEDOUernB+x for ; Mon, 4 Mar 2013 15:40:46 -0800 (PST) Received: from EXPFE100-1.exc.icann.org (expfe100-1.exc.icann.org [64.78.22.236]) by ietfa.amsl.com (Postfix) with ESMTP id 72A4611E80E6 for ; Mon, 4 Mar 2013 15:40:38 -0800 (PST) Received: from EXVPMBX100-1.exc.icann.org ([64.78.22.232]) by EXPFE100-1.exc.icann.org ([64.78.22.236]) with mapi; Mon, 4 Mar 2013 15:40:37 -0800 From: Terry Manderson To: Christopher Morrow Date: Mon, 4 Mar 2013 15:40:29 -0800 Thread-Topic: [sidr] WGLC: draft-ietf-sidr-cps (end 2013-03-07 - Mar 07, 2013) Thread-Index: Ac4ZMawF3Bbp5CCxQQydBlsCsGMg9A== Message-ID: <4C3CA1B5-5747-4BC7-AF6C-E2AD5239ACC2@icann.org> References: <5126F465.8030005@ops-netman.net> <512F69F1.4090301@ieca.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: sidr wg list Subject: Re: [sidr] WGLC: draft-ietf-sidr-cps (end 2013-03-07 - Mar 07, 2013) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Mar 2013 23:40:46 -0000 I'll go along with that.=20 I'm not seeing any major structural alterations to the draft (at this stage= ) by doing that.=20 Cheers, Terry On 02/03/2013, at 2:37 AM, "Christopher Morrow" w= rote: > Great... so assuming the authors deal with this set of comments we'll > ask them to spin a new version and submit that for WGLC when it > arrives? >=20 > Does that seem like a good path for those still listening? >=20 > -chris > co-chair-1-of-3 >=20 > On Thu, Feb 28, 2013 at 9:30 AM, Sean Turner wrote: >> Below are some comments on the draft. I also submitted my nits to the >> editors. >>=20 >> 0) Based on the assumption that draft-newton-sidr-policy-qualifiers will= be >> adopted because that's what the RIRs want should s1.2 or 1.5 also includ= e >> some information about where it can be found? This information would be >> identical to the URI included in the policy qualifier? >>=20 >> 1) s1.6: CP - Is it worth nothing that there might be another CP for the >> BPKI? >>=20 >> 2) s4.6.1: Not sure if this needs to go here but don't we need to say >> something about not renewing certificates forever? >>=20 >> 3) draft-ietf-sidr-rtr-keying describes the procedures for operator >> generated keys (i.e., those that are not router generated). A couple of >> questions come to mind: >>=20 >> a) Should the CPS point to that draft in s6.1.2 or will the CPS be updat= ed >> when draft-ietf-sidr-rtr-keying is published? >>=20 >> b) draft-ietf-sidr-rtr-keying allows operators sign the private keys the= y >> generate and subsequently send back to the router. Should this be >> explicitly called out in s4.5.1. For s.4.5.2, is the returned signed-ke= y an >> RPKI-Signed Object? >>=20 >> spt >>=20 >>=20 >> On 2/21/13 11:30 PM, Chris Morrow wrote: >>>=20 >>> WG folks, >>> As the subject states, let's please start a WGLC poll for the document: >>> draft-ietf-sidr-cps-01 >>> >>>=20 >>> with the abstract: >>> "This document contains a template to be used for creating a >>> Certification Practice Statement (CPS) for an Organization that is >>> part of the Resource Public Key Infrastructure (RPKI), e.g., a >>> resource allocation registry or an ISP." >>>=20 >>> So far the authors have made a few revisions, with updates based on >>> comments/feedback, at this time the document has been stable for more >>> than 6 months time, let's move this along if there are no further >>> issues/addendums/questions/appendixes. >>>=20 >>> thanks! >>> -chris >>> co-chair-1-of-3 >>> _______________________________________________ >>> sidr mailing list >>> sidr@ietf.org >>> https://www.ietf.org/mailman/listinfo/sidr >> _______________________________________________ >> sidr mailing list >> sidr@ietf.org >> https://www.ietf.org/mailman/listinfo/sidr > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr From turners@ieca.com Mon Mar 4 15:56:59 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 14C2F21F86BB for ; Mon, 4 Mar 2013 15:56:59 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.19 X-Spam-Level: X-Spam-Status: No, score=-102.19 tagged_above=-999 required=5 tests=[AWL=0.075, BAYES_00=-2.599, IP_NOT_FRIENDLY=0.334, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IFBL6RbcQMeg for ; Mon, 4 Mar 2013 15:56:58 -0800 (PST) Received: from gateway03.websitewelcome.com (gateway03.websitewelcome.com [69.93.38.21]) by ietfa.amsl.com (Postfix) with ESMTP id 690F821F869C for ; Mon, 4 Mar 2013 15:56:58 -0800 (PST) Received: by gateway03.websitewelcome.com (Postfix, from userid 5007) id E248A24A13103; Mon, 4 Mar 2013 17:56:57 -0600 (CST) Received: from gator1743.hostgator.com (gator1743.hostgator.com [184.173.253.227]) by gateway03.websitewelcome.com (Postfix) with ESMTP id CBD7D24A13093 for ; Mon, 4 Mar 2013 17:56:57 -0600 (CST) Received: from [108.45.16.214] (port=57733 helo=thunderfish.local) by gator1743.hostgator.com with esmtpsa (TLSv1:DHE-RSA-AES256-SHA:256) (Exim 4.80) (envelope-from ) id 1UCfFZ-0002pp-JZ; Mon, 04 Mar 2013 17:56:57 -0600 Message-ID: <513534C8.3070506@ieca.com> Date: Mon, 04 Mar 2013 18:56:56 -0500 From: Sean Turner User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:17.0) Gecko/20130216 Thunderbird/17.0.3 MIME-Version: 1.0 To: Christopher Morrow References: <5126F465.8030005@ops-netman.net> <512F69F1.4090301@ieca.com> <4C3CA1B5-5747-4BC7-AF6C-E2AD5239ACC2@icann.org> In-Reply-To: <4C3CA1B5-5747-4BC7-AF6C-E2AD5239ACC2@icann.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - gator1743.hostgator.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - ieca.com X-BWhitelist: no X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: (thunderfish.local) [108.45.16.214]:57733 X-Source-Auth: sean.turner@ieca.com X-Email-Count: 1 X-Source-Cap: ZG9tbWdyNDg7ZG9tbWdyNDg7Z2F0b3IxNzQzLmhvc3RnYXRvci5jb20= Cc: sidr wg list Subject: Re: [sidr] WGLC: draft-ietf-sidr-cps (end 2013-03-07 - Mar 07, 2013) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Mar 2013 23:56:59 -0000 I guess I should have also said that I support moving this draft down the path towards publication. spt On 3/4/13 6:40 PM, Terry Manderson wrote: > I'll go along with that. > > I'm not seeing any major structural alterations to the draft (at this stage) by doing that. > > Cheers, > Terry > > On 02/03/2013, at 2:37 AM, "Christopher Morrow" wrote: > >> Great... so assuming the authors deal with this set of comments we'll >> ask them to spin a new version and submit that for WGLC when it >> arrives? >> >> Does that seem like a good path for those still listening? >> >> -chris >> co-chair-1-of-3 >> >> On Thu, Feb 28, 2013 at 9:30 AM, Sean Turner wrote: >>> Below are some comments on the draft. I also submitted my nits to the >>> editors. >>> >>> 0) Based on the assumption that draft-newton-sidr-policy-qualifiers will be >>> adopted because that's what the RIRs want should s1.2 or 1.5 also include >>> some information about where it can be found? This information would be >>> identical to the URI included in the policy qualifier? >>> >>> 1) s1.6: CP - Is it worth nothing that there might be another CP for the >>> BPKI? >>> >>> 2) s4.6.1: Not sure if this needs to go here but don't we need to say >>> something about not renewing certificates forever? >>> >>> 3) draft-ietf-sidr-rtr-keying describes the procedures for operator >>> generated keys (i.e., those that are not router generated). A couple of >>> questions come to mind: >>> >>> a) Should the CPS point to that draft in s6.1.2 or will the CPS be updated >>> when draft-ietf-sidr-rtr-keying is published? >>> >>> b) draft-ietf-sidr-rtr-keying allows operators sign the private keys they >>> generate and subsequently send back to the router. Should this be >>> explicitly called out in s4.5.1. For s.4.5.2, is the returned signed-key an >>> RPKI-Signed Object? >>> >>> spt >>> >>> >>> On 2/21/13 11:30 PM, Chris Morrow wrote: >>>> >>>> WG folks, >>>> As the subject states, let's please start a WGLC poll for the document: >>>> draft-ietf-sidr-cps-01 >>>> >>>> >>>> with the abstract: >>>> "This document contains a template to be used for creating a >>>> Certification Practice Statement (CPS) for an Organization that is >>>> part of the Resource Public Key Infrastructure (RPKI), e.g., a >>>> resource allocation registry or an ISP." >>>> >>>> So far the authors have made a few revisions, with updates based on >>>> comments/feedback, at this time the document has been stable for more >>>> than 6 months time, let's move this along if there are no further >>>> issues/addendums/questions/appendixes. >>>> >>>> thanks! >>>> -chris >>>> co-chair-1-of-3 >>>> _______________________________________________ >>>> sidr mailing list >>>> sidr@ietf.org >>>> https://www.ietf.org/mailman/listinfo/sidr >>> _______________________________________________ >>> sidr mailing list >>> sidr@ietf.org >>> https://www.ietf.org/mailman/listinfo/sidr >> _______________________________________________ >> sidr mailing list >> sidr@ietf.org >> https://www.ietf.org/mailman/listinfo/sidr > From christopher.morrow@gmail.com Mon Mar 4 18:46:40 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6763E11E80BA for ; Mon, 4 Mar 2013 18:46:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -103.599 X-Spam-Level: X-Spam-Status: No, score=-103.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uktFxFl5R9zO for ; Mon, 4 Mar 2013 18:46:39 -0800 (PST) Received: from mail-lb0-f178.google.com (mail-lb0-f178.google.com [209.85.217.178]) by ietfa.amsl.com (Postfix) with ESMTP id 740E621F86A8 for ; Mon, 4 Mar 2013 18:46:39 -0800 (PST) Received: by mail-lb0-f178.google.com with SMTP id n1so4479472lba.37 for ; Mon, 04 Mar 2013 18:46:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:x-received:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type; bh=cQjxjQ9uP+kqccj8ey9LDoheIdZLUfLSJm8/0rXKRyI=; b=vzcSQ3ywLn5PRen/ku+EYv5FLQF8sk0/JkLoa3M+CGpQIoMfcrChHTfDmsLxxEvobu W/sUqsMYi4ew/qr8iwXbm672Vmfgb3ugfjsGQ11GGaQ3mhq/FRuCWGvSFH7M3QylATLN ot2jnJw4CCX/Cuk0CoaVDGIrZ8rFqr6JatEIqBPONr6Uj1b4OJj7lQNt9i4xUwcKdeht OON9YeJp7UEl3zDCRAqVrcEnaH0K8Kx5mg40P8vY4/fHIc1xz8o1aaXh159OJGrAqrwp IM0Trx9zSsxcXY072pmrb4H7urJvKCrA25HFW0RIxc5kV5B2KI1r43NOMNJgISfP21+9 j/og== MIME-Version: 1.0 X-Received: by 10.152.132.170 with SMTP id ov10mr19789298lab.21.1362451595295; Mon, 04 Mar 2013 18:46:35 -0800 (PST) Sender: christopher.morrow@gmail.com Received: by 10.152.28.34 with HTTP; Mon, 4 Mar 2013 18:46:35 -0800 (PST) In-Reply-To: <513534C8.3070506@ieca.com> References: <5126F465.8030005@ops-netman.net> <512F69F1.4090301@ieca.com> <4C3CA1B5-5747-4BC7-AF6C-E2AD5239ACC2@icann.org> <513534C8.3070506@ieca.com> Date: Mon, 4 Mar 2013 21:46:35 -0500 X-Google-Sender-Auth: heJYGc8cSM2_vh6lUlg0-o1SWg0 Message-ID: From: Christopher Morrow To: Sean Turner Content-Type: text/plain; charset=ISO-8859-1 Cc: sidr wg list Subject: Re: [sidr] WGLC: draft-ietf-sidr-cps (end 2013-03-07 - Mar 07, 2013) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Mar 2013 02:46:40 -0000 On Mon, Mar 4, 2013 at 6:56 PM, Sean Turner wrote: > I guess I should have also said that I support moving this draft down the > path towards publication. > I got that :) I am/was/am waiting for the next rev to pop into the tracker. > spt > > > On 3/4/13 6:40 PM, Terry Manderson wrote: >> >> I'll go along with that. >> >> I'm not seeing any major structural alterations to the draft (at this >> stage) by doing that. >> >> Cheers, >> Terry >> >> On 02/03/2013, at 2:37 AM, "Christopher Morrow" >> wrote: >> >>> Great... so assuming the authors deal with this set of comments we'll >>> ask them to spin a new version and submit that for WGLC when it >>> arrives? >>> >>> Does that seem like a good path for those still listening? >>> >>> -chris >>> co-chair-1-of-3 >>> >>> On Thu, Feb 28, 2013 at 9:30 AM, Sean Turner wrote: >>>> >>>> Below are some comments on the draft. I also submitted my nits to the >>>> editors. >>>> >>>> 0) Based on the assumption that draft-newton-sidr-policy-qualifiers will >>>> be >>>> adopted because that's what the RIRs want should s1.2 or 1.5 also >>>> include >>>> some information about where it can be found? This information would be >>>> identical to the URI included in the policy qualifier? >>>> >>>> 1) s1.6: CP - Is it worth nothing that there might be another CP for the >>>> BPKI? >>>> >>>> 2) s4.6.1: Not sure if this needs to go here but don't we need to say >>>> something about not renewing certificates forever? >>>> >>>> 3) draft-ietf-sidr-rtr-keying describes the procedures for operator >>>> generated keys (i.e., those that are not router generated). A couple of >>>> questions come to mind: >>>> >>>> a) Should the CPS point to that draft in s6.1.2 or will the CPS be >>>> updated >>>> when draft-ietf-sidr-rtr-keying is published? >>>> >>>> b) draft-ietf-sidr-rtr-keying allows operators sign the private keys >>>> they >>>> generate and subsequently send back to the router. Should this be >>>> explicitly called out in s4.5.1. For s.4.5.2, is the returned >>>> signed-key an >>>> RPKI-Signed Object? >>>> >>>> spt >>>> >>>> >>>> On 2/21/13 11:30 PM, Chris Morrow wrote: >>>>> >>>>> >>>>> WG folks, >>>>> As the subject states, let's please start a WGLC poll for the document: >>>>> draft-ietf-sidr-cps-01 >>>>> >>>>> >>>>> with the abstract: >>>>> "This document contains a template to be used for creating a >>>>> Certification Practice Statement (CPS) for an Organization that is >>>>> part of the Resource Public Key Infrastructure (RPKI), e.g., a >>>>> resource allocation registry or an ISP." >>>>> >>>>> So far the authors have made a few revisions, with updates based on >>>>> comments/feedback, at this time the document has been stable for more >>>>> than 6 months time, let's move this along if there are no further >>>>> issues/addendums/questions/appendixes. >>>>> >>>>> thanks! >>>>> -chris >>>>> co-chair-1-of-3 >>>>> _______________________________________________ >>>>> sidr mailing list >>>>> sidr@ietf.org >>>>> https://www.ietf.org/mailman/listinfo/sidr >>>> >>>> _______________________________________________ >>>> sidr mailing list >>>> sidr@ietf.org >>>> https://www.ietf.org/mailman/listinfo/sidr >>> >>> _______________________________________________ >>> sidr mailing list >>> sidr@ietf.org >>> https://www.ietf.org/mailman/listinfo/sidr >> >> > From kent@bbn.com Tue Mar 5 12:58:50 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C822C21F8A00 for ; Tue, 5 Mar 2013 12:58:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.599 X-Spam-Level: X-Spam-Status: No, score=-106.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yNcu7dnKW7op for ; Tue, 5 Mar 2013 12:58:50 -0800 (PST) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) by ietfa.amsl.com (Postfix) with ESMTP id 1C0D021F897A for ; Tue, 5 Mar 2013 12:58:50 -0800 (PST) Received: from dhcp89-089-230.bbn.com ([128.89.89.230]:50440) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1UCywj-0008C7-Br; Tue, 05 Mar 2013 15:58:49 -0500 Message-ID: <51365C89.8050207@bbn.com> Date: Tue, 05 Mar 2013 15:58:49 -0500 From: Stephen Kent User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20130216 Thunderbird/17.0.3 MIME-Version: 1.0 To: David Mandelberg , sidr , karen Seo References: <5126F465.8030005@ops-netman.net> <1362438997.18228.199.camel@titan> In-Reply-To: <1362438997.18228.199.camel@titan> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [sidr] WGLC: draft-ietf-sidr-cps (end 2013-03-07 - Mar 07, 2013) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Mar 2013 20:58:50 -0000 On 3/4/13 6:16 PM, David Mandelberg wrote: > Overall this looks good. I found one minor issue and a bunch of nits, > and I have some questions: > > > = minor = > > 4.6.7. Notification of Certificate Issuance by the CA to Other Entities: > There is no section 4.4.3. fixed. > = questions = > > 1.5.1. Organization administering the document: Should the address > and/or website of the organization also be included? That could help > disambiguate when there are multiple organizations with the same or > similar names. reworded to include these additional pieces of info. > 4.1.2. Enrollment Process and Responsibilities: I found the second > sentence unclear. Are you trying to tell registries and ISPs that > certificates should be issued as part of their normal business > practices? Are you trying to say that *if* certificates are issued as > part of normal business practices *then* "a separate application to > request a certificate may not be necessary"? the text is saying that an org allocating INRs is already establishing a relationship with the subject, and thus need not repeat that process when it issues an RPKI cert. > 4.6.1. Circumstance for Certificate Renewal: The phrase "unless the > private key has been reported as compromised" doesn't specify how a > compromised key can be reported. Should there be a reference to section > 4.9.3? added forward pointer. > 4.7.1. Circumstance for Certificate Re-key: What Certificate Policy is > "Section 5.6 of the Certificate Policy" referring to? Section 5.6 of > RFC6484 doesn't mention validity intervals. The CP used to refer to this validity interval issue, but it later changed, as did the admonition. We'll delete the paragraph. > 5.4.1. Types of Events Recorded: Why aren't "Key generation", "Software > and/or configuration updates to the CA", and "Clock adjustments" listed? > > 5.6. Key Changeover: Does mention of validity intervals belong in this > section? > > > = nits = > > Multiple places: Should "the RPKI CP" be changed to "[RFC6484]"? sure. > Preface: item 5 lists "Acknowledgments" three times (twice as > "Acknowledgments", once as "12"). fixed. > 1. Introduction: "(INRs, see definition in Section 1.7)" references a > non-existent section 1.7. changed to 1.6 > 1.1. Overview: Change "as described in 2.4" to "as described in Section > 2.4". fixed. > 1.4.1. Appropriate Certificate Uses: Change "2.4" to "Section 2.4". fixed > 2.2. Publication of Certification Information: Should the hyphen in > "RPKI-signed objects" be changed to a space? yes, fixed. > 2.3. Time or Frequency of Publication: Change "nextScheduledUpdate" to > "nextUpdate". fixed. > 3.1.2. Need for Names to be Meaningful: The first two sentences seem > redundant with section 3.1.5. removed redundant sentences. > 3.2.6. Criteria for Interoperation: Change "e g." to "e.g.". fixed. > 4.1.1. Who Can Submit a Certificate Application: Should "this > Organization" be changed to ""? reworded. > 4.2.2. Approval or Rejection of Certificate Applications: Change "3.2.1" > to "Section 3.2.1". fixed > 4.4.2. Publication of the Certificate by the CA: Insert space in > "notified>. 4.6.4. Notification of New Certificate Issuance to Subscriber: Change > "4.3.2" to "Section 4.3.2". fixed. > 4.7.2. Who May Request Certification of a New Public Key: Change "or" in > "holder or a certificate" to "of". fixed. > 4.9.7. CRL Issuance Frequency: Change "nextScheduledUpdate" to > "nextUpdate". fixed. > 5.7. Compromise and disaster recovery [OMITTED] and 5.8. CA or RA > Termination: These section numbers don't match up with rfc 6484. Whoops. the CP lost an [OMITTED] subsection # here. "CA or RA Termination" is supposed to be 5.8, not 5.7. so the CPS is correct, re alignment with RFC 3647. Guess we'll have to issue an editorial errata for the CP. Steve From kent@bbn.com Tue Mar 5 13:11:51 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ADBCD11E8108 for ; Tue, 5 Mar 2013 13:11:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.599 X-Spam-Level: X-Spam-Status: No, score=-106.599 tagged_above=-999 required=5 tests=[AWL=-0.001, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7RWJVt2aQEC8 for ; Tue, 5 Mar 2013 13:11:51 -0800 (PST) Received: from smtp.bbn.com (smtp.bbn.com [128.33.1.81]) by ietfa.amsl.com (Postfix) with ESMTP id C7C9811E80D5 for ; Tue, 5 Mar 2013 13:11:50 -0800 (PST) Received: from dhcp89-089-230.bbn.com ([128.89.89.230]:50453) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1UCz9H-000CzE-Ty; Tue, 05 Mar 2013 16:11:48 -0500 Message-ID: <51365F93.2070801@bbn.com> Date: Tue, 05 Mar 2013 16:11:47 -0500 From: Stephen Kent User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20130216 Thunderbird/17.0.3 MIME-Version: 1.0 To: sidr@ietf.org, Sean Turner , karen Seo References: <5126F465.8030005@ops-netman.net> <512F69F1.4090301@ieca.com> In-Reply-To: <512F69F1.4090301@ieca.com> Content-Type: multipart/alternative; boundary="------------050806090709040507020008" Subject: Re: [sidr] WGLC: draft-ietf-sidr-cps (end 2013-03-07 - Mar 07, 2013) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Mar 2013 21:11:51 -0000 This is a multi-part message in MIME format. --------------050806090709040507020008 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Sean, Thanks for the review. > Below are some comments on the draft. I also submitted my nits to the > editors. > > 0) Based on the assumption that draft-newton-sidr-policy-qualifiers > will be adopted because that's what the RIRs want should s1.2 or 1.5 > also include some information about where it can be found? This > information would be identical to the URI included in the policy > qualifier? > 1) s1.6: CP - Is it worth nothing that there might be another CP for > the BPKI? I added the following ext: If a BPKI is employed by a CA, it may have its own CP, separate from the RPKI CP. > 2) s4.6.1: Not sure if this needs to go here but don't we need to say > something about not renewing certificates forever? I am reluctant to point out one example of a bad PKI practice, when there are so many more ... > 3) draft-ietf-sidr-rtr-keying describes the procedures for operator > generated keys (i.e., those that are not router generated). A couple > of questions come to mind: > > a) Should the CPS point to that draft in s6.1.2 or will the CPS be > updated when draft-ietf-sidr-rtr-keying is published? We could update the CPS with a pointer to rtr-keying when it is published. It would be a very minor update, as an informational reference. If the chairs prefer, we can add a reference to the I-D, and have this doc held in the RFC Editor's queue waiting for that doc to be approved. > b) draft-ietf-sidr-rtr-keying allows operators sign the private keys > they generate and subsequently send back to the router. Should this be > explicitly called out in s4.5.1. For s.4.5.2, is the returned > signed-key an RPKI-Signed Object? The first comment does not seem to apply to 4.5.1/2. Could you clarify? The returned signed-key is not an RPKI signed object, as defined in RFC 6488. Such objects are stored in the repository system, not just passed between a local operator's system and a router. Steve --------------050806090709040507020008 Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit Sean,

Thanks for the review.
Below are some comments on the draft.  I also submitted my nits to the editors.

0) Based on the assumption that draft-newton-sidr-policy-qualifiers will be adopted because that's what the RIRs want should s1.2 or 1.5 also include some information about where it can be found?  This information would be identical to the URI included in the policy qualifier?

1) s1.6: CP - Is it worth nothing that there might be another CP for the BPKI?
I added the following ext:

If a BPKI is employed by a CA, it may have its own CP, separate from the RPKI CP.


2) s4.6.1: Not sure if this needs to go here but don't we need to say something about not renewing certificates forever?
I am reluctant to point out one example of a bad PKI practice, when there are so many more ...
3) draft-ietf-sidr-rtr-keying describes the procedures for operator generated keys (i.e., those that are not router generated).  A couple of questions come to mind:

a) Should the CPS point to that draft in s6.1.2 or will the CPS be updated when draft-ietf-sidr-rtr-keying is published?
We could update the CPS with a pointer to rtr-keying when it is published. It would be a very minor update,
as an informational reference. If the chairs prefer, we can add a reference to the I-D, and have this doc held
in the RFC Editor's queue waiting for that doc to be approved.
b) draft-ietf-sidr-rtr-keying allows operators sign the private keys they generate and subsequently send back to the router.  Should this be explicitly called out in s4.5.1.  For s.4.5.2, is the returned signed-key an RPKI-Signed Object?
The first comment does not seem to apply to 4.5.1/2. Could you clarify?

The returned signed-key is not an RPKI signed object, as defined in RFC 6488. Such objects are stored in the
repository system, not just passed between a local operator's system and a router.

Steve
--------------050806090709040507020008-- From kent@bbn.com Tue Mar 5 13:52:58 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 964C911E8118 for ; Tue, 5 Mar 2013 13:52:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.598 X-Spam-Level: X-Spam-Status: No, score=-106.598 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5XQx054k4tLo for ; Tue, 5 Mar 2013 13:52:58 -0800 (PST) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) by ietfa.amsl.com (Postfix) with ESMTP id E0DEB11E80AD for ; Tue, 5 Mar 2013 13:52:57 -0800 (PST) Received: from dhcp89-089-230.bbn.com ([128.89.89.230]:50640) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1UCzn7-0009I3-9D; Tue, 05 Mar 2013 16:52:57 -0500 Message-ID: <51366939.6010402@bbn.com> Date: Tue, 05 Mar 2013 16:52:57 -0500 From: Stephen Kent User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20130216 Thunderbird/17.0.3 MIME-Version: 1.0 To: sidr , Sean Turner Content-Type: multipart/alternative; boundary="------------050301040508080209090107" Subject: [sidr] slight whoops ... X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Mar 2013 21:52:58 -0000 This is a multi-part message in MIME format. --------------050301040508080209090107 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Sean, I forgot to reply to your first comment. See what happens when you label it "0"? 0) Based on the assumption that draft-newton-sidr-policy-qualifiers will be adopted because that's what the RIRs want should s1.2 or 1.5 also include some information about where it can be found? This information would be identical to the URI included in the policy qualifier? I suggest the following added text for 1.2: Steve --------------050301040508080209090107 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Sean,

I forgot to reply to your first comment. See what happens when you label it "0"?

0) Based on the assumption that draft-newton-sidr-policy-qualifiers will be adopted because that's what the RIRs want should s1.2 or 1.5 also include some information about where it can be found?  This information would be identical to the URI included in the policy qualifier?

I suggest the following added text for 1.2:

<If this document is available via the Internet, the CA can insert the URI for the CPS here. It should be the same URI that appears as a policy qualifier in the CA certificate for the CA, if the CA elects to make use of that feature.>

Steve
--------------050301040508080209090107-- From randy@psg.com Tue Mar 5 13:56:34 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8100E21F88A0 for ; Tue, 5 Mar 2013 13:56:34 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AyCgkYtEBEOo for ; Tue, 5 Mar 2013 13:56:34 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id 16FDA21F8740 for ; Tue, 5 Mar 2013 13:56:34 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.80.1 (FreeBSD)) (envelope-from ) id 1UCzqa-000BQT-KR; Tue, 05 Mar 2013 21:56:33 +0000 Date: Wed, 06 Mar 2013 06:56:31 +0900 Message-ID: From: Randy Bush To: Stephen Kent In-Reply-To: <51366939.6010402@bbn.com> References: <51366939.6010402@bbn.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Cc: sidr Subject: Re: [sidr] slight whoops ... X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Mar 2013 21:56:34 -0000 > 0) Based on the assumption that draft-newton-sidr-policy-qualifiers will > be adopted i simply do not understand the utility of that draft either no one ever sees the urls, or they are a malware attack vector. randy From kent@bbn.com Tue Mar 5 14:44:47 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BB8D811E80FA for ; Tue, 5 Mar 2013 14:44:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.599 X-Spam-Level: X-Spam-Status: No, score=-106.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hJJP7sxhoicE for ; Tue, 5 Mar 2013 14:44:47 -0800 (PST) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) by ietfa.amsl.com (Postfix) with ESMTP id 4D59011E809C for ; Tue, 5 Mar 2013 14:44:47 -0800 (PST) Received: from dhcp89-089-230.bbn.com ([128.89.89.230]:50688) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1UD0bG-000AFU-8a; Tue, 05 Mar 2013 17:44:46 -0500 Message-ID: <5136755E.2070709@bbn.com> Date: Tue, 05 Mar 2013 17:44:46 -0500 From: Stephen Kent User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20130216 Thunderbird/17.0.3 MIME-Version: 1.0 To: Randy Bush References: <51366939.6010402@bbn.com> In-Reply-To: Content-Type: text/plain; charset=US-ASCII; format=flowed Content-Transfer-Encoding: 7bit Cc: sidr Subject: Re: [sidr] slight whoops ... X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Mar 2013 22:44:47 -0000 Typically the rationale for the URI is so that the a CA can satisfy it's legal counsel that potential relying parties have been informed, via the URI, of the presence of a CPS, and that RPs who care can download and read it before maknig use of the certs issued by the CA. Its a CYA mechanism. Steve >> 0) Based on the assumption that draft-newton-sidr-policy-qualifiers will >> be adopted > i simply do not understand the utility of that draft > > either no one ever sees the urls, or they are a malware attack vector. > > randy > From randy@psg.com Tue Mar 5 14:47:06 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AB9C111E8115 for ; Tue, 5 Mar 2013 14:47:06 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SkmAUhAUdCPG for ; Tue, 5 Mar 2013 14:47:06 -0800 (PST) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id 2B84D11E809C for ; Tue, 5 Mar 2013 14:47:06 -0800 (PST) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.80.1 (FreeBSD)) (envelope-from ) id 1UD0dU-000BZN-Eg; Tue, 05 Mar 2013 22:47:04 +0000 Date: Wed, 06 Mar 2013 07:47:03 +0900 Message-ID: From: Randy Bush To: Stephen Kent In-Reply-To: <5136755E.2070709@bbn.com> References: <51366939.6010402@bbn.com> <5136755E.2070709@bbn.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Cc: sidr Subject: Re: [sidr] slight whoops ... X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Mar 2013 22:47:06 -0000 > Typically the rationale for the URI is so that the a CA can satisfy > it's legal counsel that potential relying parties have been informed, > via the URI, of the presence of a CPS, and that RPs who care can > download and read it before maknig use of the certs issued by the CA. > > Its a CYA mechanism. it is an arin disease that opens the user to malware attack. just say no. randy From jcurran@arin.net Tue Mar 5 16:24:05 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ED7B421F84BB for ; Tue, 5 Mar 2013 16:24:05 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ioi0pzeHCwM4 for ; Tue, 5 Mar 2013 16:24:05 -0800 (PST) Received: from smtp1.arin.net (smtp1.arin.net [IPv6:2001:500:4:13::33]) by ietfa.amsl.com (Postfix) with ESMTP id 512FB21F84B8 for ; Tue, 5 Mar 2013 16:24:05 -0800 (PST) Received: by smtp1.arin.net (Postfix, from userid 323) id BED5C165240; Tue, 5 Mar 2013 19:24:04 -0500 (EST) Received: from CHAXCH06.corp.arin.net (chaxch06.corp.arin.net [192.149.252.95]) by smtp1.arin.net (Postfix) with ESMTP id 3777D16523A; Tue, 5 Mar 2013 19:24:04 -0500 (EST) Received: from CHAXCH03.corp.arin.net (10.1.30.17) by CHAXCH06.corp.arin.net (192.149.252.95) with Microsoft SMTP Server (TLS) id 14.2.328.9; Tue, 5 Mar 2013 19:23:17 -0500 Received: from CHAXCH01.corp.arin.net ([169.254.1.209]) by CHAXCH03.corp.arin.net ([10.1.30.17]) with mapi id 14.02.0328.009; Tue, 5 Mar 2013 19:23:56 -0500 From: John Curran To: Randy Bush Thread-Topic: [sidr] slight whoops ... Thread-Index: AQHOGgDjoVB3miLn7Uevvqw2BL5TSQ== Date: Wed, 6 Mar 2013 00:23:55 +0000 Message-ID: <8DA1853CE466B041B104C1CAEE00B3748F913D64@CHAXCH01.corp.arin.net> References: <51366939.6010402@bbn.com> <5136755E.2070709@bbn.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [192.149.252.97] Content-Type: text/plain; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: sidr Subject: Re: [sidr] slight whoops ... X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Mar 2013 00:24:06 -0000 On Mar 5, 2013, at 5:47 PM, Randy Bush wrote: >> Typically the rationale for the URI is so that the a CA can satisfy >> it's legal counsel that potential relying parties have been informed, >> via the URI, of the presence of a CPS, and that RPs who care can >> download and read it before maknig use of the certs issued by the CA. >>=20 >> Its a CYA mechanism. >=20 > it is an arin disease that opens the user to malware attack. just say > no. Randy - Feel free to omit the URI to the CPS in certs that you issue, but=20 that should not preclude others from including them so if they so desire. Thanks! /John John Curran President and CEO ARIN From ggmichaelson@gmail.com Tue Mar 5 16:05:56 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0797A11E809C for ; Tue, 5 Mar 2013 16:05:56 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HrUQc1AYzl0r for ; Tue, 5 Mar 2013 16:05:55 -0800 (PST) Received: from mail-ia0-x230.google.com (mail-ia0-x230.google.com [IPv6:2607:f8b0:4001:c02::230]) by ietfa.amsl.com (Postfix) with ESMTP id C700B21F86BA for ; Tue, 5 Mar 2013 16:05:55 -0800 (PST) Received: by mail-ia0-f176.google.com with SMTP id i18so6775830iac.35 for ; Tue, 05 Mar 2013 16:05:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=x-received:sender:content-type:mime-version:subject:from :in-reply-to:date:content-transfer-encoding:message-id:references:to :x-mailer; bh=aehnhVy92OeS4FsulbAXCQebXMCGd3db+A5i+Ojs08A=; b=u3RZaVl+t4gSjqKG0qKGI03+rXKReYtCLsTlbUv/wST7/iJlc+YWiNER5oNdFJGWlC bpSU7nDXXKnNfk4HOv2N0yiqlP3CCFwCOmjykk75cFuTdu/mx75DguRHjDkpYnfxOveR 9Obzo2o48Muf91WDrlm325Vo5IWtL3dnldqOp24ZznzmRy69kjvpEvSOJMgUeMGzVKev 0XTJrlW+S1PMMox0UfvKKP4IrFh5Eo+el0zApQDzIS4tqoMYJoa8YAfrDPf3JeQaXciO 5KPs7eixYlnLE9rB4hXYjyh7TFtqGQee6qfVUewn0+8QYVHV7f/fh+MQXKnAv/thB5Hh /97Q== X-Received: by 10.50.208.101 with SMTP id md5mr8280047igc.60.1362528355268; Tue, 05 Mar 2013 16:05:55 -0800 (PST) Received: from dynamic180.apnic.net (dynamic180.apnic.net. [203.119.42.180]) by mx.google.com with ESMTPS id l4sm7499197igw.6.2013.03.05.16.05.53 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 05 Mar 2013 16:05:54 -0800 (PST) Sender: George Michaelson Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\)) From: George Michaelson In-Reply-To: <5136755E.2070709@bbn.com> Date: Wed, 6 Mar 2013 10:05:51 +1000 Content-Transfer-Encoding: quoted-printable Message-Id: References: <51366939.6010402@bbn.com> <5136755E.2070709@bbn.com> To: sidr list X-Mailer: Apple Mail (2.1499) Subject: Re: [sidr] slight whoops ... X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Mar 2013 00:32:23 -0000 On 06/03/2013, at 8:44 AM, Stephen Kent wrote: > Typically the rationale for the URI is so that the a CA can satisfy = it's legal counsel that > potential relying parties have been informed, via the URI, of the = presence of a CPS, and > that RPs who care can download and read it before maknig use of the = certs issued by the CA. >=20 > Its a CYA mechanism. >=20 > Steve I support this draft as APNIC has a similar requirement to satisfy our = legal counsel in the manner described by Steve. thanks, -George= From Sandra.Murphy@sparta.com Wed Mar 6 11:30:29 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E38AF21F8CE8 for ; Wed, 6 Mar 2013 11:30:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pKX1FC25ZiyK for ; Wed, 6 Mar 2013 11:30:29 -0800 (PST) Received: from Uther.sparta.com (uther.sparta.com [157.185.0.2]) by ietfa.amsl.com (Postfix) with ESMTP id 1015A11E80C5 for ; Wed, 6 Mar 2013 11:30:25 -0800 (PST) Received: from durin.laguna.sparta.com ([10.62.216.7]) by Uther.sparta.com (8.13.8/8.13.8) with ESMTP id r26JUPxW009187 for ; Wed, 6 Mar 2013 11:30:25 -0800 Received: from Hermes.columbia.ads.sparta.com ([10.62.56.107]) by durin.laguna.sparta.com (8.13.8/8.13.8) with ESMTP id r26JUPqJ029290 for ; Wed, 6 Mar 2013 11:30:25 -0800 Received: from HERMES.columbia.ads.sparta.com ([fe80::e4a8:a383:2128:c0e5]) by Hermes.columbia.ads.sparta.com ([fe80::e4a8:a383:2128:c0e5%18]) with mapi id 14.02.0247.003; Wed, 6 Mar 2013 14:29:52 -0500 From: "Murphy, Sandra" To: "sidr@ietf.org" Thread-Topic: sidr agenda Thread-Index: Ac4aoNvwBkihp6C1Rzmpm1ndqExneA== Date: Wed, 6 Mar 2013 19:29:51 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F65C232D50@Hermes.columbia.ads.sparta.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.118] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: [sidr] sidr agenda X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Mar 2013 19:30:30 -0000 The sidr agenda is rather light. Many of those who are on the agenda indic= ated that they did not think that they would need much time.=0A= =0A= There's a pattern in this working group to add things to the agenda at the = last moment. But we meet Monday morning, which is leaving things a bit lat= e.=0A= =0A= If you would like to have some time during the meeting, please do contact t= he chairs asap.=0A= =0A= --Sandy, speaking as one of three co-chairs= From turners@ieca.com Thu Mar 7 05:20:39 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3CE3E21F8615 for ; Thu, 7 Mar 2013 05:20:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.77 X-Spam-Level: X-Spam-Status: No, score=-102.77 tagged_above=-999 required=5 tests=[AWL=-0.171, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FVEhpaKr6uI6 for ; Thu, 7 Mar 2013 05:20:27 -0800 (PST) Received: from gateway07.websitewelcome.com (gateway07.websitewelcome.com [70.85.67.23]) by ietfa.amsl.com (Postfix) with ESMTP id 54FEF21F8C9D for ; Thu, 7 Mar 2013 05:20:27 -0800 (PST) Received: by gateway07.websitewelcome.com (Postfix, from userid 5007) id D351B9EDCEB86; Thu, 7 Mar 2013 07:20:22 -0600 (CST) Received: from gator1743.hostgator.com (gator1743.hostgator.com [184.173.253.227]) by gateway07.websitewelcome.com (Postfix) with ESMTP id C814C9EDCEB63 for ; Thu, 7 Mar 2013 07:20:22 -0600 (CST) Received: from [108.45.16.214] (port=57962 helo=thunderfish.local) by gator1743.hostgator.com with esmtpsa (TLSv1:DHE-RSA-AES256-SHA:256) (Exim 4.80) (envelope-from ) id 1UDakD-0001Gu-Mq; Thu, 07 Mar 2013 07:20:25 -0600 Message-ID: <51389419.6090208@ieca.com> Date: Thu, 07 Mar 2013 08:20:25 -0500 From: Sean Turner User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:17.0) Gecko/20130216 Thunderbird/17.0.3 MIME-Version: 1.0 To: Stephen Kent References: <51366939.6010402@bbn.com> In-Reply-To: <51366939.6010402@bbn.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - gator1743.hostgator.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - ieca.com X-BWhitelist: no X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: (thunderfish.local) [108.45.16.214]:57962 X-Source-Auth: sean.turner@ieca.com X-Email-Count: 6 X-Source-Cap: ZG9tbWdyNDg7ZG9tbWdyNDg7Z2F0b3IxNzQzLmhvc3RnYXRvci5jb20= Cc: sidr Subject: Re: [sidr] slight whoops ... X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Mar 2013 13:20:39 -0000 That works for me. spt On 3/5/13 4:52 PM, Stephen Kent wrote: > Sean, > > I forgot to reply to your first comment. See what happens when you label > it "0"? > > 0) Based on the assumption that draft-newton-sidr-policy-qualifiers will > be adopted because that's what the RIRs want should s1.2 or 1.5 also > include some information about where it can be found? This information > would be identical to the URI included in the policy qualifier? > > I suggest the following added text for 1.2: > > URI for the CPS here. It should be the same URI that appears as a policy > qualifier in the CA certificate for the CA, if the CA elects to make use > of that feature.> > > Steve From turners@ieca.com Thu Mar 7 05:24:38 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A77B821F8CCA for ; Thu, 7 Mar 2013 05:24:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.592 X-Spam-Level: X-Spam-Status: No, score=-102.592 tagged_above=-999 required=5 tests=[AWL=-0.327, BAYES_00=-2.599, IP_NOT_FRIENDLY=0.334, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zPNyKRd82cik for ; Thu, 7 Mar 2013 05:24:37 -0800 (PST) Received: from gateway13.websitewelcome.com (gateway13.websitewelcome.com [69.93.82.3]) by ietfa.amsl.com (Postfix) with ESMTP id 65A4F21F8CC9 for ; Thu, 7 Mar 2013 05:24:37 -0800 (PST) Received: by gateway13.websitewelcome.com (Postfix, from userid 5007) id DDFE785D57DD9; Thu, 7 Mar 2013 07:24:29 -0600 (CST) Received: from gator1743.hostgator.com (gator1743.hostgator.com [184.173.253.227]) by gateway13.websitewelcome.com (Postfix) with ESMTP id CBBED85D57D8C for ; Thu, 7 Mar 2013 07:24:29 -0600 (CST) Received: from [108.45.16.214] (port=58002 helo=thunderfish.local) by gator1743.hostgator.com with esmtpsa (TLSv1:DHE-RSA-AES256-SHA:256) (Exim 4.80) (envelope-from ) id 1UDaoF-0002q3-O3; Thu, 07 Mar 2013 07:24:35 -0600 Message-ID: <51389513.6090402@ieca.com> Date: Thu, 07 Mar 2013 08:24:35 -0500 From: Sean Turner User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:17.0) Gecko/20130216 Thunderbird/17.0.3 MIME-Version: 1.0 To: Stephen Kent References: <5126F465.8030005@ops-netman.net> <512F69F1.4090301@ieca.com> <51365F93.2070801@bbn.com> In-Reply-To: <51365F93.2070801@bbn.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - gator1743.hostgator.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - ieca.com X-BWhitelist: no X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: (thunderfish.local) [108.45.16.214]:58002 X-Source-Auth: sean.turner@ieca.com X-Email-Count: 9 X-Source-Cap: ZG9tbWdyNDg7ZG9tbWdyNDg7Z2F0b3IxNzQzLmhvc3RnYXRvci5jb20= Cc: sidr@ietf.org Subject: Re: [sidr] WGLC: draft-ietf-sidr-cps (end 2013-03-07 - Mar 07, 2013) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Mar 2013 13:24:38 -0000 On 3/5/13 4:11 PM, Stephen Kent wrote: > Sean, > > Thanks for the review. >> Below are some comments on the draft. I also submitted my nits to the >> editors. >> >> 0) Based on the assumption that draft-newton-sidr-policy-qualifiers >> will be adopted because that's what the RIRs want should s1.2 or 1.5 >> also include some information about where it can be found? This >> information would be identical to the URI included in the policy >> qualifier? > >> 1) s1.6: CP - Is it worth nothing that there might be another CP for >> the BPKI? > I added the following ext: > > If a BPKI is employed by a CA, it may have its own CP, separate from the > RPKI CP. wm >> 2) s4.6.1: Not sure if this needs to go here but don't we need to say >> something about not renewing certificates forever? > I am reluctant to point out one example of a bad PKI practice, when > there are so many more ... When you put it that way :) >> 3) draft-ietf-sidr-rtr-keying describes the procedures for operator >> generated keys (i.e., those that are not router generated). A couple >> of questions come to mind: >> >> a) Should the CPS point to that draft in s6.1.2 or will the CPS be >> updated when draft-ietf-sidr-rtr-keying is published? > We could update the CPS with a pointer to rtr-keying when it is > published. It would be a very minor update, > as an informational reference. If the chairs prefer, we can add a > reference to the I-D, and have this doc held > in the RFC Editor's queue waiting for that doc to be approved. wfm >> b) draft-ietf-sidr-rtr-keying allows operators sign the private keys >> they generate and subsequently send back to the router. Should this be >> explicitly called out in s4.5.1. For s.4.5.2, is the returned >> signed-key an RPKI-Signed Object? > The first comment does not seem to apply to 4.5.1/2. Could you clarify? Yep you're right it doesn't apply. > The returned signed-key is not an RPKI signed object, as defined in RFC > 6488. Such objects are stored in the > repository system, not just passed between a local operator's system and > a router. ack Thanks for dealing with these. spt > Steve From Sandra.Murphy@sparta.com Thu Mar 7 08:05:31 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9720721F8CB8 for ; Thu, 7 Mar 2013 08:05:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3Bu1uK3qXofJ for ; Thu, 7 Mar 2013 08:05:29 -0800 (PST) Received: from Uther.sparta.com (uther.sparta.com [157.185.0.2]) by ietfa.amsl.com (Postfix) with ESMTP id 88AB921F8CBD for ; Thu, 7 Mar 2013 08:05:29 -0800 (PST) Received: from durin.laguna.sparta.com ([10.62.216.7]) by Uther.sparta.com (8.13.8/8.13.8) with ESMTP id r27G5TIq016584 for ; Thu, 7 Mar 2013 08:05:29 -0800 Received: from Hermes.columbia.ads.sparta.com ([10.62.56.107]) by durin.laguna.sparta.com (8.13.8/8.13.8) with ESMTP id r27G5Shw005730 for ; Thu, 7 Mar 2013 08:05:29 -0800 Received: from HERMES.columbia.ads.sparta.com ([fe80::e4a8:a383:2128:c0e5]) by Hermes.columbia.ads.sparta.com ([fe80::e4a8:a383:2128:c0e5%18]) with mapi id 14.02.0247.003; Thu, 7 Mar 2013 11:04:54 -0500 From: "Murphy, Sandra" To: "sidr@ietf.org" Thread-Topic: Tues sidr meeting Thread-Index: Ac4bS+3C1zA1LBgsSlKD8eWE1G2tgw== Date: Thu, 7 Mar 2013 16:04:54 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F65C232F74@Hermes.columbia.ads.sparta.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.137] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: [sidr] Tues sidr meeting X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Mar 2013 16:05:31 -0000 We have two slots for the meeting next week,=20 0900-1130 EDT Monday Morning Session I =20 1030-1130 EDT Tuesday Morning Session II =20 The agenda is pretty light, particularly considering that most presenters h= ave said they only need a little time. The chairs think we could get throu= gh the agenda on Monday. The slot on Tuesday could be used for free-ranging discussion of some thorn= y topic. If anyone has such a topic they would like to use that time for, = please do suggest it. If no topics for Tuesday are suggested by tomorrow, the chairs think we sho= uld release the slot for others to use. =20 So, if you have topics to suggest, please send them to the list BY TOMORROW= (FRIDAY) NOON EST. If none appear, the chairs will release the Tue sessio= n. --Sandy, speaking as 1 of 3 co-chairs= From Sandra.Murphy@sparta.com Thu Mar 7 08:19:20 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E098D21F8D37 for ; Thu, 7 Mar 2013 08:19:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fATTVmfhZR97 for ; Thu, 7 Mar 2013 08:19:20 -0800 (PST) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by ietfa.amsl.com (Postfix) with ESMTP id 46EE921F8D35 for ; Thu, 7 Mar 2013 08:19:20 -0800 (PST) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.14.4/8.14.4) with ESMTP id r27GJEsX019650 for ; Thu, 7 Mar 2013 10:19:14 -0600 Received: from Hermes.columbia.ads.sparta.com ([10.62.56.107]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id r27GJEAW001149 for ; Thu, 7 Mar 2013 10:19:14 -0600 Received: from HERMES.columbia.ads.sparta.com ([fe80::e4a8:a383:2128:c0e5]) by Hermes.columbia.ads.sparta.com ([fe80::e4a8:a383:2128:c0e5%18]) with mapi id 14.02.0247.003; Thu, 7 Mar 2013 11:18:34 -0500 From: "Murphy, Sandra" To: "sidr@ietf.org" Thread-Topic: get slides to wg chairs early Thread-Index: Ac4bTzgzPS5oZ+63SReoVvzc5IK++g== Date: Thu, 7 Mar 2013 16:17:49 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F65C232FA8@Hermes.columbia.ads.sparta.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.137] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: [sidr] get slides to wg chairs early X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Mar 2013 16:19:21 -0000 Our first slot in Monday morning. The slides need to be uploaded to the me= eting materials site before hand. Presenters, please get your slides to the chairs (ALL the chairs) by Sunday= 1700 EST. We can track you down during the reception if we haven't receiv= ed them by then! Please do remember to *number your slides*. Those participating remotely v= ery much appreciate having that reference for following along. --Sandy= From danny@tcb.net Thu Mar 7 11:54:53 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9FADF21F8964 for ; Thu, 7 Mar 2013 11:54:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -98.578 X-Spam-Level: X-Spam-Status: No, score=-98.578 tagged_above=-999 required=5 tests=[BAYES_20=-0.74, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AwnJeSIa6nCk for ; Thu, 7 Mar 2013 11:54:53 -0800 (PST) Received: from mail.friendswithtools.org (unknown [64.78.239.70]) by ietfa.amsl.com (Postfix) with ESMTP id 3806621F893E for ; Thu, 7 Mar 2013 11:54:53 -0800 (PST) Received: from dspam (unknown [127.0.0.1]) by mail.friendswithtools.org (Postfix) with SMTP id DB78D300039 for ; Thu, 7 Mar 2013 19:54:52 +0000 (UTC) Received: from mail2.tcb.net (localhost [127.0.0.1]) by mail.friendswithtools.org (Postfix) with ESMTP id ADAA8300015 for ; Thu, 7 Mar 2013 12:54:52 -0700 (MST) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Date: Thu, 07 Mar 2013 12:54:52 -0700 From: danny@tcb.net To: In-Reply-To: References: <51366939.6010402@bbn.com> <5136755E.2070709@bbn.com> Message-ID: <1f434fb7f3810c61d73ce7789a517272@tcb.net> X-Sender: danny@tcb.net User-Agent: Roundcube Webmail/0.8.2 X-DSPAM-Result: Innocent X-DSPAM-Processed: Thu Mar 7 12:54:52 2013 X-DSPAM-Confidence: 0.9898 X-DSPAM-Improbability: 1 in 9709 chance of being spam X-DSPAM-Probability: 0.0000 X-DSPAM-Signature: 5138f08c42079023111495 X-DSPAM-Factors: 27, the+#+to, 0.01000, the+#+to, 0.01000, it+#+to, 0.01000, to+#+#+#+the, 0.01000, the+#+of, 0.01000, of+#+#+the, 0.01000, Subject*Re+sidr, 0.01000, it+#+#+be, 0.01000, to+be, 0.01000, actions+of, 0.40000, if+#+have, 0.40000, sure+#+#+that, 0.40000, opens+#+#+to, 0.40000, opens+#+#+to, 0.40000, current+RPA, 0.40000, each+#+#+respective, 0.40000, each+#+#+respective, 0.40000, I+#+#+#+attack, 0.40000, were+#+their, 0.40000, and+#+could, 0.40000, to+#+#+#+to, 0.40000, their+respective, 0.40000, their+respective, 0.40000, parent+#+others, 0.40000, service+#+#+and, 0.40000, and+#+#+#+have, 0.40000, RPKI+but, 0.40000 Subject: Re: [sidr] slight whoops ... X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Mar 2013 19:54:53 -0000 I understand why ARIN wants this -- I'm sure our legal folks would want something similar if we were in their predicament (i.e., one more place for indemnification against failures, compromises, actions of [grand]parents, etc..), reading the current RPA makes this clear: S.7 ...."You shall indemnify, defend, and hold harmless ARIN and CAs and each of its respective parent and subsidiaries, each of their respective predecessors, successors and assigns, each of their respective employees, representatives, agents, attorneys, advisors, trustees, directors, officers, managers, and members from any and all claims, demands, disputes, actions, suits, proceedings, judgments, damages, injuries, losses, expenses, costs and fees(including reasonable attorneys’ fees and expenses), interests, fines and penalties of whatever nature (collectively, “Claimsâ€)"...... With the likes of grandparenting and the potential implications RPKI could have on operational systems and real networks, this seems quite prudent to me. Furthermore, I'm not sure how anyone that operates infrastructure could be expected to take on liability where their "parent" or others in the system could impact the service they provide, and they could be liable. The joys of production... > it is an arin disease that opens the user to malware attack. just > say > no. I'm not sure I understand how this "opens the user to malware attack", could you please explain? I understand the DoS vector, this certainly exists for all of RPKI, but I don't understand "malware attack" and think if you have any additional text related to that it ought to be reflected alongside the current DoS text in the Security Considerations. -danny From christopher.morrow@gmail.com Thu Mar 7 12:18:23 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 98CA221F8C23 for ; Thu, 7 Mar 2013 12:18:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -103.599 X-Spam-Level: X-Spam-Status: No, score=-103.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yqIKTKaUypv9 for ; Thu, 7 Mar 2013 12:18:22 -0800 (PST) Received: from mail-lb0-f179.google.com (mail-lb0-f179.google.com [209.85.217.179]) by ietfa.amsl.com (Postfix) with ESMTP id 057B721F8B25 for ; Thu, 7 Mar 2013 12:18:18 -0800 (PST) Received: by mail-lb0-f179.google.com with SMTP id j14so758818lbo.24 for ; Thu, 07 Mar 2013 12:18:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:x-received:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type; bh=RWi/iCRjwhxHlz0fy36xHYQ7czL7nZgmkOElCm5mUCI=; b=bameKPMgl1P4vrxc9PhXpFvXj1bRwin5PnhVPn+yaq7aEUqQbgHdcLP1zRa9CV0Yjf 6Yyu1OqwHPiu+BaPTMJA0+T8X7yS8P2GtDT309hZ5c/4J8nB+5O1WB2tQaqT7a2g2yFF epSuzanye099rtri9jVhKjqQEW76I6MLQNyzCs1coriY7zVuU9QjYHItiePZ+jH28jQA L/LCBT23whVGeHXOK4RckKzGl0pECSeHzayBYwEoZKxkgOAVr452nvb1XwTaUaRmTRZQ okssyaI6JL0F8/jbSiLIya/RYXGbJldOsg0X0bLekqi5OKZI3KLQk9CBRP7KIaoo/WnK Uwmw== MIME-Version: 1.0 X-Received: by 10.152.104.199 with SMTP id gg7mr29539516lab.14.1362687490674; Thu, 07 Mar 2013 12:18:10 -0800 (PST) Sender: christopher.morrow@gmail.com Received: by 10.152.28.34 with HTTP; Thu, 7 Mar 2013 12:18:10 -0800 (PST) In-Reply-To: <1f434fb7f3810c61d73ce7789a517272@tcb.net> References: <51366939.6010402@bbn.com> <5136755E.2070709@bbn.com> <1f434fb7f3810c61d73ce7789a517272@tcb.net> Date: Thu, 7 Mar 2013 15:18:10 -0500 X-Google-Sender-Auth: wzoTo6WdBn5bKmF71I9k-cxZTsY Message-ID: From: Christopher Morrow To: danny@tcb.net Content-Type: text/plain; charset=ISO-8859-1 Cc: sidr@ietf.org Subject: Re: [sidr] slight whoops ... X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Mar 2013 20:18:23 -0000 On Thu, Mar 7, 2013 at 2:54 PM, wrote: > I'm not sure I understand how this "opens the user to malware attack", could > you please explain? I understand the DoS vector, this certainly exists for > all of RPKI, but I don't understand "malware attack" please click on this link to accept my TOS: From danny@tcb.net Thu Mar 7 12:25:41 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 462CD21F8C22 for ; Thu, 7 Mar 2013 12:25:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -99.508 X-Spam-Level: X-Spam-Status: No, score=-99.508 tagged_above=-999 required=5 tests=[AWL=0.929, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OnjsEaa8rUX7 for ; Thu, 7 Mar 2013 12:25:40 -0800 (PST) Received: from mail.friendswithtools.org (unknown [64.78.239.70]) by ietfa.amsl.com (Postfix) with ESMTP id AAB2821F898B for ; Thu, 7 Mar 2013 12:25:40 -0800 (PST) Received: from dspam (unknown [127.0.0.1]) by mail.friendswithtools.org (Postfix) with SMTP id 5108E300054 for ; Thu, 7 Mar 2013 20:25:40 +0000 (UTC) Received: from mail2.tcb.net (localhost [127.0.0.1]) by mail.friendswithtools.org (Postfix) with ESMTP id B7E64300015; Thu, 7 Mar 2013 13:25:39 -0700 (MST) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Date: Thu, 07 Mar 2013 13:25:39 -0700 From: Danny McPherson To: Christopher Morrow In-Reply-To: References: <51366939.6010402@bbn.com> <5136755E.2070709@bbn.com> <1f434fb7f3810c61d73ce7789a517272@tcb.net> Message-ID: <7ec8977acdff4c8d922143aaba00a85c@tcb.net> X-Sender: danny@tcb.net User-Agent: Roundcube Webmail/0.8.2 X-DSPAM-Result: Innocent X-DSPAM-Processed: Thu Mar 7 13:25:40 2013 X-DSPAM-Confidence: 0.9898 X-DSPAM-Improbability: 1 in 9709 chance of being spam X-DSPAM-Probability: 0.0000 X-DSPAM-Signature: 5138f7c442076090812748 X-DSPAM-Factors: 27, is+a, 0.01000, Subject*Re+sidr, 0.01000, Cc*sidr+ietf.org, 0.01000, a+#+of, 0.01000, in+a, 0.01000, could+#+#+anywhere, 0.40000, Heck+#+might, 0.40000, look+#+to, 0.40000, we+#+believe, 0.40000, we+#+#+#+is, 0.40000, believe+#+#+a, 0.40000, On+#+#+#+13, 0.40000, and+#+it's, 0.40000, forward+and, 0.40000, attacks+#+#+#+documents, 0.40000, in+#+#+certificate, 0.40000, I+look, 0.40000, then+#+got, 0.40000, text+#+#+#+in, 0.40000, attacks+#+all, 0.40000, click+on, 0.40000, legitimate+issue, 0.40000, from+#+#+in, 0.40000, Subject*whoops+..., 0.40000, on+#+link, 0.40000, malware+#+methinks, 0.40000, accept+#+TOS, 0.40000 Cc: sidr@ietf.org Subject: Re: [sidr] slight whoops ... X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Mar 2013 20:25:41 -0000 On 2013-03-07 13:18, Christopher Morrow wrote: > > please click on this link to accept my TOS: > That could be included anywhere - and if it's in a resource certificate then you've got far bigger problems than a "malware attack", methinks. Heck, this might well serve as an early indicator of compromise, if we really believe this is a legitimate issue. It also applies to ANY publication mechanism in any protocol, so I think it's rather a bit of a reach. Of course, I look forward to text from "malware attacks" in all IETF documents going forward, and this one specifically.. :-) -danny From christopher.morrow@gmail.com Thu Mar 7 12:26:45 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5B1AE21F8C22 for ; Thu, 7 Mar 2013 12:26:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -103.599 X-Spam-Level: X-Spam-Status: No, score=-103.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tYQTEUF0ZLvl for ; Thu, 7 Mar 2013 12:26:44 -0800 (PST) Received: from mail-lb0-f177.google.com (mail-lb0-f177.google.com [209.85.217.177]) by ietfa.amsl.com (Postfix) with ESMTP id 89CBA21F8CC9 for ; Thu, 7 Mar 2013 12:26:44 -0800 (PST) Received: by mail-lb0-f177.google.com with SMTP id go11so783605lbb.36 for ; Thu, 07 Mar 2013 12:26:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:x-received:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type; bh=kFSJq+LqpXs4BbLu7YU+E/Fx0YiZTitFer0l5AVeIH0=; b=f1J0vIfcaJQrctQHYKNg7Lon8e6q72T+guN8/MNQ7tfQy30xtspn/eTeSP4GHFzRQe QPRo+4KqlqPv3eAXqwuj86hD1ElqYVglUh/6QVxxNses8TBKgRT6AOvPb56WLxqcM/Th dbk8yLkMsvbu2hUyHUxWwk/u5+uyX8KkF3Ph1GRs2121rLH3+3Im8l+nhyL/Y4iH1+Gj focZ7WxKA16+EOBV8a3JlGV1zVBKPem0LQlliblsuRWlZFcSz09dqNVXGoUDcUJjM8jm RuUOMb5vdmZPWwIiezYUVz3nlaoiacsOd8w7lQdNXAXlsFGYrVFAX6jTrxx6uKt0EMtw 6ZTA== MIME-Version: 1.0 X-Received: by 10.112.50.42 with SMTP id z10mr54564lbn.73.1362688003460; Thu, 07 Mar 2013 12:26:43 -0800 (PST) Sender: christopher.morrow@gmail.com Received: by 10.152.28.34 with HTTP; Thu, 7 Mar 2013 12:26:43 -0800 (PST) In-Reply-To: <7ec8977acdff4c8d922143aaba00a85c@tcb.net> References: <51366939.6010402@bbn.com> <5136755E.2070709@bbn.com> <1f434fb7f3810c61d73ce7789a517272@tcb.net> <7ec8977acdff4c8d922143aaba00a85c@tcb.net> Date: Thu, 7 Mar 2013 15:26:43 -0500 X-Google-Sender-Auth: N4pg7qEmNWSt3fJjqTgZAvKTV-E Message-ID: From: Christopher Morrow To: Danny McPherson Content-Type: text/plain; charset=ISO-8859-1 Cc: sidr@ietf.org Subject: Re: [sidr] slight whoops ... X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Mar 2013 20:26:45 -0000 On Thu, Mar 7, 2013 at 3:25 PM, Danny McPherson wrote: > On 2013-03-07 13:18, Christopher Morrow wrote: > >> >> please click on this link to accept my TOS: >> > > > That could be included anywhere - and if it's in a resource certificate then > you've got far bigger problems than a "malware attack", methinks. agreed, there's also dns pinning and a host of other ways. > Heck, this might well serve as an early indicator of compromise, if we > really believe this is a legitimate issue. > > It also applies to ANY publication mechanism in any protocol, so I think > it's rather a bit of a reach. Of course, I look forward to text from > "malware attacks" in all IETF documents going forward, and this one > specifically.. :-) yea, it'll be fun! :) -chris > -danny > From eosterweil@verisign.com Thu Mar 7 12:46:27 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0611221F8A6E for ; Thu, 7 Mar 2013 12:46:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0Ct3u0mfDmJ5 for ; Thu, 7 Mar 2013 12:46:24 -0800 (PST) Received: from exprod6og103.obsmtp.com (exprod6og103.obsmtp.com [64.18.1.185]) by ietfa.amsl.com (Postfix) with ESMTP id ADE6E21F8A5E for ; Thu, 7 Mar 2013 12:46:23 -0800 (PST) Received: from peregrine.verisign.com ([216.168.239.74]) (using TLSv1) by exprod6ob103.postini.com ([64.18.5.12]) with SMTP ID DSNKUTj8ni5ixeThTcEYZp7e8+sP4K2B/yAn@postini.com; Thu, 07 Mar 2013 12:46:23 PST Received: from dul1wnexcn01.vcorp.ad.vrsn.com (dul1wnexcn01.vcorp.ad.vrsn.com [10.170.12.138]) by peregrine.verisign.com (8.13.6/8.13.4) with ESMTP id r27KkIFY023659; Thu, 7 Mar 2013 15:46:21 -0500 Received: from dul1eosterwe-m1.vcorp.ad.vrsn.com ([10.88.29.242]) by dul1wnexcn01.vcorp.ad.vrsn.com with Microsoft SMTPSVC(6.0.3790.4675); Thu, 7 Mar 2013 15:46:18 -0500 Mime-Version: 1.0 (Apple Message framework v1085) Content-Type: text/plain; charset=us-ascii From: Eric Osterweil In-Reply-To: Date: Thu, 7 Mar 2013 15:46:18 -0500 Content-Transfer-Encoding: quoted-printable Message-Id: <7BF89E8C-A4E4-4CD1-B15B-1D122E55CCA4@verisign.com> References: <51366939.6010402@bbn.com> <5136755E.2070709@bbn.com> <1f434fb7f3810c61d73ce7789a517272@tcb.net> To: Christopher Morrow X-Mailer: Apple Mail (2.1085) X-OriginalArrivalTime: 07 Mar 2013 20:46:18.0241 (UTC) FILETIME=[D153CF10:01CE1B74] Cc: sidr@ietf.org Subject: Re: [sidr] slight whoops ... X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Mar 2013 20:46:27 -0000 On Mar 7, 2013, at 3:18 PM, Christopher Morrow wrote: > On Thu, Mar 7, 2013 at 2:54 PM, wrote: >> I'm not sure I understand how this "opens the user to malware = attack", could >> you please explain? I understand the DoS vector, this certainly = exists for >> all of RPKI, but I don't understand "malware attack" >=20 >=20 > please click on this link to accept my TOS: > Wait, does that mean that the sidr mailing list is a malware vector too? = Maybe we should shut the list down too? ;) Eric From christopher.morrow@gmail.com Thu Mar 7 13:58:02 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6213921F8C46 for ; Thu, 7 Mar 2013 13:58:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.6 X-Spam-Level: X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P2Dim1z68Fpk for ; Thu, 7 Mar 2013 13:58:01 -0800 (PST) Received: from mail-la0-x235.google.com (mail-la0-x235.google.com [IPv6:2a00:1450:4010:c03::235]) by ietfa.amsl.com (Postfix) with ESMTP id 67C0F21F8BED for ; Thu, 7 Mar 2013 13:58:01 -0800 (PST) Received: by mail-la0-f53.google.com with SMTP id fr10so1052921lab.12 for ; Thu, 07 Mar 2013 13:58:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:x-received:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type; bh=eTNGDnY52NB1ZCZmslCgEFZc08WBLtbKkad1cV2/2PI=; b=qcnCn56O8zQ1pfID+w0ufy8gsoepu3TZDlYKR7ZSV4SEbM7/9zKHNf+qMaqdvCfHn+ U3NBCzIeHfJKnHOdx6I3SMfWjV5YZb37oQXqILIm194jatqibqOUi+hESGMVg3qz50wa RciXM8pEk1KD4nv1ap5J9xkWMeomSqDg1GfYp4OEem7U2zE+Cqx/v78Zqu6fEEhvkads NnyYb075Ya59la85zY6vMohTqieN1SwmY18abxgM4ixk7CTex/tyRdgfvtineJSoOn8L vtsCW3zycJvkUar4QqqnafIpUkwRpFEmOBJRXCU4QupaDZaaQIWvV+YgJ49BEqU5qwTL jViw== MIME-Version: 1.0 X-Received: by 10.152.110.6 with SMTP id hw6mr30292299lab.43.1362693480311; Thu, 07 Mar 2013 13:58:00 -0800 (PST) Sender: christopher.morrow@gmail.com Received: by 10.152.28.34 with HTTP; Thu, 7 Mar 2013 13:58:00 -0800 (PST) In-Reply-To: <7BF89E8C-A4E4-4CD1-B15B-1D122E55CCA4@verisign.com> References: <51366939.6010402@bbn.com> <5136755E.2070709@bbn.com> <1f434fb7f3810c61d73ce7789a517272@tcb.net> <7BF89E8C-A4E4-4CD1-B15B-1D122E55CCA4@verisign.com> Date: Thu, 7 Mar 2013 16:58:00 -0500 X-Google-Sender-Auth: AJAVD9ktACi9t_yNgeXFAvNSqSw Message-ID: From: Christopher Morrow To: Eric Osterweil Content-Type: text/plain; charset=ISO-8859-1 Cc: sidr@ietf.org Subject: Re: [sidr] slight whoops ... X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Mar 2013 21:58:02 -0000 On Thu, Mar 7, 2013 at 3:46 PM, Eric Osterweil wrote: > > On Mar 7, 2013, at 3:18 PM, Christopher Morrow wrote: > >> On Thu, Mar 7, 2013 at 2:54 PM, wrote: >>> I'm not sure I understand how this "opens the user to malware attack", could >>> you please explain? I understand the DoS vector, this certainly exists for >>> all of RPKI, but I don't understand "malware attack" >> >> >> please click on this link to accept my TOS: >> > > Wait, does that mean that the sidr mailing list is a malware vector too? Maybe we should shut the list down too? ;) > yes, please download this update to your codec, it'll make viewing the mailing list easier: From warren@kumari.net Thu Mar 7 14:26:03 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6C94621F8C20 for ; Thu, 7 Mar 2013 14:26:03 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.521 X-Spam-Level: X-Spam-Status: No, score=-102.521 tagged_above=-999 required=5 tests=[AWL=0.078, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id q4BTyENFpAR5 for ; Thu, 7 Mar 2013 14:26:02 -0800 (PST) Received: from vimes.kumari.net (smtp1.kumari.net [204.194.22.1]) by ietfa.amsl.com (Postfix) with ESMTP id B474C21F856F for ; Thu, 7 Mar 2013 14:26:02 -0800 (PST) Received: from [130.129.0.147] (unknown [130.129.0.147]) by vimes.kumari.net (Postfix) with ESMTPSA id 9221E1B4030C; Thu, 7 Mar 2013 17:26:01 -0500 (EST) Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\)) From: Warren Kumari In-Reply-To: Date: Thu, 7 Mar 2013 17:26:00 -0500 Content-Transfer-Encoding: quoted-printable Message-Id: <2E957452-C2CA-4553-9040-DD83D2BF6473@kumari.net> References: <51366939.6010402@bbn.com> <5136755E.2070709@bbn.com> <1f434fb7f3810c61d73ce7789a517272@tcb.net> <7BF89E8C-A4E4-4CD1-B15B-1D122E55CCA4@verisign.com> To: Christopher Morrow X-Mailer: Apple Mail (2.1499) Cc: sidr@ietf.org Subject: Re: [sidr] slight whoops ... X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Mar 2013 22:26:03 -0000 On Mar 7, 2013, at 4:58 PM, Christopher Morrow = wrote: > On Thu, Mar 7, 2013 at 3:46 PM, Eric Osterweil = wrote: >>=20 >> On Mar 7, 2013, at 3:18 PM, Christopher Morrow wrote: >>=20 >>> On Thu, Mar 7, 2013 at 2:54 PM, wrote: >>>> I'm not sure I understand how this "opens the user to malware = attack", could >>>> you please explain? I understand the DoS vector, this certainly = exists for >>>> all of RPKI, but I don't understand "malware attack" >>>=20 >>>=20 >>> please click on this link to accept my TOS: >>> >>=20 >> Wait, does that mean that the sidr mailing list is a malware vector = too? Maybe we should shut the list down too? ;) >>=20 >=20 > yes, please download this update to your codec, it'll make viewing the > mailing list easier: > That URL didn't work for me, but I think it is my machine, not your = Internet, because a Nigerian prince sent me the same link and it didn't = work then either=85. W > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr >=20 -- I once absend-mindedly ordered Three Mile Island dressing in a = restaurant and, with great presence of mind, they brought Thousand = Island Dressing and a bottle of chili sauce. -- Terry Pratchett From Sandra.Murphy@sparta.com Fri Mar 8 08:38:11 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8F2ED21F882A for ; Fri, 8 Mar 2013 08:38:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -103.599 X-Spam-Level: X-Spam-Status: No, score=-103.599 tagged_above=-999 required=5 tests=[AWL=1.000, BAYES_00=-2.599, GB_I_INVITATION=-2, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mByBqNEhuEu2 for ; Fri, 8 Mar 2013 08:38:07 -0800 (PST) Received: from Uther.sparta.com (uther.sparta.com [157.185.0.2]) by ietfa.amsl.com (Postfix) with ESMTP id B2A4A21F85A1 for ; Fri, 8 Mar 2013 08:38:07 -0800 (PST) Received: from durin.laguna.sparta.com ([10.62.216.7]) by Uther.sparta.com (8.13.8/8.13.8) with ESMTP id r28Gc4Gx027093; Fri, 8 Mar 2013 08:38:04 -0800 Received: from Hermes.columbia.ads.sparta.com ([10.62.56.107]) by durin.laguna.sparta.com (8.13.8/8.13.8) with ESMTP id r28Gc0a8028301; Fri, 8 Mar 2013 08:38:02 -0800 Received: from HERMES.columbia.ads.sparta.com ([fe80::e4a8:a383:2128:c0e5]) by Hermes.columbia.ads.sparta.com ([fe80::e4a8:a383:2128:c0e5%18]) with mapi id 14.02.0247.003; Fri, 8 Mar 2013 11:37:21 -0500 From: "Murphy, Sandra" To: Eric Osterweil Thread-Topic: invitation to repeat IEPG presentation at sidr Thread-Index: Ac4cF+0BZyLiVTLiSI6ddGrOst02OA== Date: Fri, 8 Mar 2013 16:37:21 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F65C23429D@Hermes.columbia.ads.sparta.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.137] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: "sidr@ietf.org" Subject: [sidr] invitation to repeat IEPG presentation at sidr X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Mar 2013 16:38:11 -0000 I see that you have a presentation on the agenda for the IEPG meeting on Su= nday about RPKI Spider: * Erik Osterweil (20 min) RPKI monitoring system RPKI Spider (http://rpkispider.verisignlabs.com/), measurements we've been collecting, and events we've seen. This sounds like it would be of interest to the sidr working group and woul= d complement two presentations already on the agenda. Would you be willing and able to repeat that presentation in the sidr meeti= ng? If so, do you have any preference for the Monday 9am slot or the Tues = 10:30 slot? (There's current consideration of cancelling the Tue slot, but= that won't happen if that's when you could make it.) --Sandy, speaking as 1 of 3 co-chairs= From Sandra.Murphy@sparta.com Fri Mar 8 10:10:47 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3D28E21F8691 for ; Fri, 8 Mar 2013 10:10:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.658 X-Spam-Level: X-Spam-Status: No, score=-102.658 tagged_above=-999 required=5 tests=[AWL=-0.059, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kwYIXUQuFpGu for ; Fri, 8 Mar 2013 10:10:46 -0800 (PST) Received: from Uther.sparta.com (uther.sparta.com [157.185.0.2]) by ietfa.amsl.com (Postfix) with ESMTP id 9FE9D21F8682 for ; Fri, 8 Mar 2013 10:10:46 -0800 (PST) Received: from durin.laguna.sparta.com ([10.62.216.7]) by Uther.sparta.com (8.13.8/8.13.8) with ESMTP id r28IAkHM028169 for ; Fri, 8 Mar 2013 10:10:46 -0800 Received: from Hermes.columbia.ads.sparta.com ([10.62.56.107]) by durin.laguna.sparta.com (8.13.8/8.13.8) with ESMTP id r28IAjf8001449 for ; Fri, 8 Mar 2013 10:10:46 -0800 Received: from HERMES.columbia.ads.sparta.com ([fe80::e4a8:a383:2128:c0e5]) by Hermes.columbia.ads.sparta.com ([fe80::e4a8:a383:2128:c0e5%18]) with mapi id 14.02.0247.003; Fri, 8 Mar 2013 13:10:07 -0500 From: "Murphy, Sandra" To: "sidr@ietf.org" Thread-Topic: ORIGINs Thread-Index: AQHOHCfs3cfQG/cxxkuNsRMS+Ut9iw== Date: Fri, 8 Mar 2013 18:10:07 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F65C23437D@Hermes.columbia.ads.sparta.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.137] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: [sidr] ORIGINs X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Mar 2013 18:10:47 -0000 In reviewing the discussions about the threat document, the wg eventual con= sensus wrt one topic was not clear to the chairs. The ORIGIN attribute was mentioned by some as having the potential to be us= ed out-of-spec to influence routing through the neighbor (and their neighbo= rs, etc.). One response was that there is no way to verify the authenticity of the ORI= GIN's original value, so the origin AS could mis-use this attribute no matt= er what we do. Also, a later discussion pointed out that the original need for the ORIGN a= ttribute had long since been OBE, but that ISPs had re-purposed the attribu= te for influencing traffic. Several operators mentioned that ISPs find it = useful to modify this attribute and spoke against protecting the integrity = (ie preventing the modification). The current draft does not mention the ORIGIN attribute as a threat. Is that the right outcome? That is, was the desired outcome: (1) yes, we know it is a threat but we know we can't & don't want to prote= ct it, so might as well leave it out. (current state). why do make-work. (2) we should mention it as a threat but then mention the bits about can't= authenticate the original value and don't want to protect the integrity (i= e want to permit modification). If there's no interest in changing, the threats draft stands as it is on th= is point. --Sandy= From Sandra.Murphy@sparta.com Fri Mar 8 12:46:05 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A57FE21F8576 for ; Fri, 8 Mar 2013 12:46:05 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -103.652 X-Spam-Level: X-Spam-Status: No, score=-103.652 tagged_above=-999 required=5 tests=[AWL=0.947, BAYES_00=-2.599, GB_I_INVITATION=-2, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8h8tg-XHtrGS for ; Fri, 8 Mar 2013 12:46:05 -0800 (PST) Received: from Uther.sparta.com (uther.sparta.com [157.185.0.2]) by ietfa.amsl.com (Postfix) with ESMTP id 0BAA521F8558 for ; Fri, 8 Mar 2013 12:46:04 -0800 (PST) Received: from durin.laguna.sparta.com ([10.62.216.7]) by Uther.sparta.com (8.13.8/8.13.8) with ESMTP id r28Kk4pn029733 for ; Fri, 8 Mar 2013 12:46:04 -0800 Received: from Hermes.columbia.ads.sparta.com ([10.62.56.107]) by durin.laguna.sparta.com (8.13.8/8.13.8) with ESMTP id r28Kk330008102 for ; Fri, 8 Mar 2013 12:46:04 -0800 Received: from HERMES.columbia.ads.sparta.com ([fe80::e4a8:a383:2128:c0e5]) by Hermes.columbia.ads.sparta.com ([fe80::e4a8:a383:2128:c0e5%18]) with mapi id 14.02.0247.003; Fri, 8 Mar 2013 15:45:25 -0500 From: "Murphy, Sandra" To: "sidr@ietf.org" Thread-Topic: Tues sidr meeting Thread-Index: Ac4bS+3C1zA1LBgsSlKD8eWE1G2tgwA8ZQhG Date: Fri, 8 Mar 2013 20:45:24 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F65C23444E@Hermes.columbia.ads.sparta.com> References: <24B20D14B2CD29478C8D5D6E9CBB29F65C232F74@Hermes.columbia.ads.sparta.com> In-Reply-To: <24B20D14B2CD29478C8D5D6E9CBB29F65C232F74@Hermes.columbia.ads.sparta.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.137] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [sidr] Tues sidr meeting X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Mar 2013 20:46:05 -0000 We did get additional requests and/or suggestions for invitations for furth= er speakers. So for now, it looks like we could be tight to fit it into Mo= nday. So we will not release the Tues morning slot. --Sandy ________________________________________ From: Murphy, Sandra Sent: Thursday, March 07, 2013 11:04 AM To: sidr@ietf.org Subject: Tues sidr meeting We have two slots for the meeting next week, 0900-1130 EDT Monday Morning Session I 1030-1130 EDT Tuesday Morning Session II The agenda is pretty light, particularly considering that most presenters h= ave said they only need a little time. The chairs think we could get throu= gh the agenda on Monday. The slot on Tuesday could be used for free-ranging discussion of some thorn= y topic. If anyone has such a topic they would like to use that time for, = please do suggest it. If no topics for Tuesday are suggested by tomorrow, the chairs think we sho= uld release the slot for others to use. So, if you have topics to suggest, please send them to the list BY TOMORROW= (FRIDAY) NOON EST. If none appear, the chairs will release the Tue sessio= n. --Sandy, speaking as 1 of 3 co-chairs= From danny@tcb.net Sun Mar 10 09:00:57 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1C4C821F8618 for ; Sun, 10 Mar 2013 09:00:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -99.972 X-Spam-Level: X-Spam-Status: No, score=-99.972 tagged_above=-999 required=5 tests=[AWL=0.465, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cEM5JlPD99YK for ; Sun, 10 Mar 2013 09:00:56 -0700 (PDT) Received: from mail.friendswithtools.org (unknown [64.78.239.70]) by ietfa.amsl.com (Postfix) with ESMTP id B1A2521F85F5 for ; Sun, 10 Mar 2013 09:00:53 -0700 (PDT) Received: from dspam (unknown [127.0.0.1]) by mail.friendswithtools.org (Postfix) with SMTP id 4ECCD300054 for ; Sun, 10 Mar 2013 16:00:53 +0000 (UTC) Received: from mail2.tcb.net (localhost [127.0.0.1]) by mail.friendswithtools.org (Postfix) with ESMTP id 1B7AC300028 for ; Sun, 10 Mar 2013 10:00:53 -0600 (MDT) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Date: Sun, 10 Mar 2013 10:00:53 -0600 From: Danny McPherson To: In-Reply-To: <24B20D14B2CD29478C8D5D6E9CBB29F65C23437D@Hermes.columbia.ads.sparta.com> References: <24B20D14B2CD29478C8D5D6E9CBB29F65C23437D@Hermes.columbia.ads.sparta.com> Message-ID: <31089dec6d0c4ff57b8ba5e680c6c29b@tcb.net> X-Sender: danny@tcb.net User-Agent: Roundcube Webmail/0.8.2 X-DSPAM-Result: Innocent X-DSPAM-Processed: Sun Mar 10 10:00:53 2013 X-DSPAM-Confidence: 0.9899 X-DSPAM-Improbability: 1 in 9809 chance of being spam X-DSPAM-Probability: 0.0000 X-DSPAM-Signature: 513cae3542072069042232 X-DSPAM-Factors: 27, to+#+the, 0.01000, to+#+the, 0.01000, as+well, 0.01000, and+#+the, 0.01000, to+#+#+and, 0.01000, the+#+to, 0.01000, the+#+to, 0.01000, be+#+in, 0.01000, it+#+to, 0.01000, to+#+#+#+the, 0.01000, to+#+#+#+the, 0.01000, on+the, 0.01000, the+#+of, 0.01000, the+#+of, 0.01000, that+the, 0.01000, that+the, 0.01000, is+a, 0.01000, is+a, 0.01000, need+to, 0.01000, need+to, 0.01000, to+#+that, 0.01000, to+#+that, 0.01000, Subject*Re+sidr, 0.01000, to+be, 0.01000, to+be, 0.01000, the+#+#+#+a, 0.01000, a+#+of, 0.01000 Subject: Re: [sidr] ORIGINs X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 10 Mar 2013 16:00:58 -0000 On 2013-03-08 11:10, Murphy, Sandra wrote: > In reviewing the discussions about the threat document, the wg > eventual consensus wrt one topic was not clear to the chairs. > > The ORIGIN attribute was mentioned by some as having the potential to > be used out-of-spec to influence routing through the neighbor (and > their neighbors, etc.). > > One response was that there is no way to verify the authenticity of > the ORIGIN's original value, so the origin AS could mis-use this > attribute no matter what we do. The origin AS sets the value of the attribute to whatever THEY desire -- the concern was that upstream ASes can manipulate this to launch "traffic attraction attacks". This happens today with some of our transit providers, and we'd like the option to be able to mitigate that attack if we're going to put a bunch of stuff in place to secure inter-domain routing on the Internet. > Also, a later discussion pointed out that the original need for the > ORIGN attribute had long since been OBE, Many origin ASes set the value to various upstreams intentionally today to impact path selection in upstream ASes, so it is very much in use today, even if not for the originally envisaged application. > but that ISPs had re-purposed > the attribute for influencing traffic. Several operators mentioned > that ISPs find it useful to modify this attribute and spoke against > protecting the integrity (ie preventing the modification). Right, that want to be able to exploit traffic attraction attack vectors, whereas, as an origin AS I'd like to have the capability to prevent that. > The current draft does not mention the ORIGIN attribute as a threat. > > Is that the right outcome? No. > That is, was the desired outcome: > > (1) yes, we know it is a threat but we know we can't & don't want to > protect it, so might as well leave it out. (current state). why do > make-work. It's not make-work, it is a clear threat - you say yourself in the question. It needs to be reflected in the threats draft and accommodated in subsequent requirements and solutions work. We should not keep it out of the threat draft simply because the solution does not currently accommodate it (we've done lots of that already). > (2) we should mention it as a threat but then mention the bits about > can't authenticate the original value and don't want to protect the > integrity (ie want to permit modification). It's a threat, we don't need to have a solution here, we're talking about the threats draft. It should lead to a requirement and then the solution can be developed. > If there's no interest in changing, the threats draft stands as it is > on this point. How many times do I need to defend this operational feedback before it's considered and accommodate in the threats draft? -danny From turners@ieca.com Sun Mar 10 10:41:21 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6476F21F85E2 for ; Sun, 10 Mar 2013 10:41:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.432 X-Spam-Level: X-Spam-Status: No, score=-102.432 tagged_above=-999 required=5 tests=[AWL=-0.167, BAYES_00=-2.599, IP_NOT_FRIENDLY=0.334, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7+f68iUZplpC for ; Sun, 10 Mar 2013 10:41:18 -0700 (PDT) Received: from gateway13.websitewelcome.com (gateway13.websitewelcome.com [69.93.82.3]) by ietfa.amsl.com (Postfix) with ESMTP id 6E87D21F85DA for ; Sun, 10 Mar 2013 10:41:18 -0700 (PDT) Received: by gateway13.websitewelcome.com (Postfix, from userid 5007) id EBE9A8CE43266; Sun, 10 Mar 2013 12:41:10 -0500 (CDT) Received: from gator1743.hostgator.com (gator1743.hostgator.com [184.173.253.227]) by gateway13.websitewelcome.com (Postfix) with ESMTP id DC13F8CE4321B for ; Sun, 10 Mar 2013 12:41:10 -0500 (CDT) Received: from [198.180.150.142] (port=53530 helo=dhcp-5422.meeting.ietf.org) by gator1743.hostgator.com with esmtpsa (TLSv1:DHE-RSA-AES256-SHA:256) (Exim 4.80) (envelope-from ) id 1UEkFJ-0002fs-Ks; Sun, 10 Mar 2013 12:41:17 -0500 Message-ID: <513CC5BC.2090405@ieca.com> Date: Sun, 10 Mar 2013 13:41:16 -0400 From: Sean Turner User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:17.0) Gecko/20130216 Thunderbird/17.0.3 MIME-Version: 1.0 To: "George, Wes" References: <20130223154110.5586.21859.idtracker@ietfa.amsl.com> <2671C6CDFBB59E47B64C10B3E0BD5923041F0C2E2D@PRVPEXVS15.corp.twcable.com> In-Reply-To: <2671C6CDFBB59E47B64C10B3E0BD5923041F0C2E2D@PRVPEXVS15.corp.twcable.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - gator1743.hostgator.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - ieca.com X-BWhitelist: no X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: (dhcp-5422.meeting.ietf.org) [198.180.150.142]:53530 X-Source-Auth: sean.turner@ieca.com X-Email-Count: 5 X-Source-Cap: ZG9tbWdyNDg7ZG9tbWdyNDg7Z2F0b3IxNzQzLmhvc3RnYXRvci5jb20= Cc: "draft-ietf-sidr-rtr-keying@tools.ietf.org" , "sidr@ietf.org" Subject: Re: [sidr] I-D Action: draft-ietf-sidr-rtr-keying-01.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 10 Mar 2013 17:41:21 -0000 Wes, Comments inline. spt On 2/27/13 5:39 PM, George, Wes wrote: > I gave this a review since I am one of the folks who raised my hand as willing to be the resident PKI n00b to make sure that things like this are clear to "router guys" who are dealing with PKI for the first time outside of maybe generating the SSH keys for tty access to a router. Thanks for following through. > The second paragraph of the intro, starting with the sentence "The router-driven model is most..." is difficult to parse (grammatically). I recommend re-wording to eliminate "often times for human subscribers" from the middle of the phrase and generally streamline the point being made here. We're trying to head off the typical knee-jerk reaction about non-client generated keys where somebody says oh no can't do that because that's what their BPKI does. But, I get your point. How about: The difference between the two methods is where the keys are generated: on the router in the router-driven method and elsewhere in the operator-driven model. Different equipment necessitates the two methods. Some equipment doesn't allow the private key to be off-loaded while other equipment does. Off-loading private keys supports hot-swappable routers that need to have the same private key needs installed in the soon-to-be online router that was installed in the soon-to-be offline router. Do you think we need to say anything like: NOTE: Unlike humans, routers can be easily cloned; hence, operators generating the private keys make sense. > Editorial nit: multiple instances of %s/drive/driven I must have had Bullitt on the TV in the background when I was revising this draft. > 3. instead of serial/craft, I'd just say console. > Or more generally, you could refer to in-band management vs out of band, as that covers a wider set of scenarios than specifically referring to an Ethernet port and a serial port. Yes, that doesn't exactly cover the hair-split when people use a management Ethernet port connected to a separate management network for "in band" (non-console) management of the device, but maybe that's clear enough, I don't know. I can go with in-band vs out-of-band management. > I also don't think proprietary is the right word. Console access via a terminal server is pretty universal, and unless there's some sort of a tool pushing out the initial config snippets over console to bootstrap the box so that it can talk to it inband and finish the provisioning, "operator going typey-typey on a terminal" is definitely not proprietary either. roger that console it is. > Another thought - console access via remote terminal server isn't actually secure in every case. In a typical setup you have: > User host -> (ssh) bastion/jump box -> (telnet) local terminal server -> RS232/USB connection to console > Unless the path between the jump box and the local terminal server is such that it is nearly impossible to sniff the traffic (private network, direct connection, etc) using this to provision sensitive config might be ill-advised. Might be worth explicitly stating that for this reason, use of the console to provision the SIDR keys is NOT recommended. This sounds like a good security consideration. > It's not clear to me whether the method being described in this first part of section 3 is actually important. Do you actually have to do something different in the way that you bring a router online (get it basic connectivity to the network) in this process in order to preserve proper security and trust for the keys, or is this just illustrating a typical process to provision a router from bare metal such that you have secure access to it to further manipulate the configuration? Is certificate-based authentication (instead of password auth) a MUST, or a SHOULD, or does it matter? If this is just illustrating a standard example, you can probably just say something like "this assumes that standard (BCP?) procedures have been followed to initially configure the router for secure remote access, via either inband or out of band means" and then just specify that it's necessary to have the secure connection between the router and operator before the router keying for SIDR is done (because ....). Some of this is down in the security considerations today, and I think it's important to actually discuss it here instead since it's basically a critical part of the provisioning process. The key (pun very much intended) thing here is to highlight things that are different from normal provisioning and explain why they're important. I was shooting for something more narrative, but yeah I could see that it would make sense to say here's what's different. Now, any idea where this BCP is? :) I'm not sure there is one. > 3.1 - wouldn't it be sFTP/SCP or HTTPS or some similar? I think you're referring to this: The response can be returned using the application/pkcs7-mime media type [RFC5751] if the router supports protocols such as FTP and HTTP. And the answer might be maybe. In the router-generated case, what's being returned in the public key certificate, which is well going to be made public so it's not necessary to secure it. Then, again if there's a protected channel open continuing to use it is okay. Not sure how to explain that but I can give it a shot. > Direct/indirect makes sense, but the process for indirect transfer is a little light on details - what steps must be taken to ensure that the keys are not compromised in this transfer, either from the router or to the RPKI CA? Even a reference to section 5 might be enough to cover this. Ah for this section, the only key transferred is public and it's in the PKCS#10, which is the only thing that gets transferred. But, you asking this question makes me think I should make it clearer about what's being transfer and why anybody'd care. > Also, I don't follow your last sentence "...linkage between private key and a router..." - why is that important? The idea is that you want to be able to know the router's got the private key associated with the public key. Another way to say this is POP - and I agree this could be made clearer. Something like: Note that even if the operator can not get the private key off the router this still provides a linkage between a private key and a router. That is the server can do a proof of possession (POP), as required by [RFC6484]. > 3.2 "installed over the ssh session..." - are we talking simple copy and paste of a huge string of text representing the key, or is it actually SCP/SFTP of a file that is then read into the router's config via additional commands? > If you're talking copy/paste, it's probably worth warning that for keys over a certain size, this method is error-prone. I've seen a lot of mangled config because someone exceeded a paste buffer when trying to copy/paste a config, especially over a 9600 bps console at the other end of 90ms of latency. An excellent point, but I'm sure hope it's commands and not ctrl-c/v. > 5. when you talk about offload methods, you should probably specify the required/recommended security precautions associated with handling the key so that it isn't intercepted across the transfer method used (e.g. use SNMPv3 with encryption, use sFTP/SCP, CLI with SSH, etc, as well as any considerations around chain of possession and level of trust as the keys are stored and transferred between old and new box. There are a lot of risk factors if a tech is transferring it to his (possibly compromised) laptop when compared with transferring to parts of the infrastructure (a config repository server, for example) that are properly hardened. > Also need to discuss sneakernet transfer, where I dump the key to a local storage device so that the tech can plug it into the new RP/RE and upload it that way. This is sometimes important if the box is having issues and as a result has limited connectivity to offload the keys. Any considerations to ensure proper security in a transfer like that? All good points and that means I need to get out a new version ;) > Thanks, > > Wes George > > > >> -----Original Message----- >> From: sidr-bounces@ietf.org [mailto:sidr-bounces@ietf.org] On Behalf Of >> internet-drafts@ietf.org >> Sent: Saturday, February 23, 2013 10:41 AM >> To: i-d-announce@ietf.org >> Cc: sidr@ietf.org >> Subject: [sidr] I-D Action: draft-ietf-sidr-rtr-keying-01.txt >> >> >> A New Internet-Draft is available from the on-line Internet-Drafts >> directories. >> This draft is a work item of the Secure Inter-Domain Routing Working >> Group of the IETF. >> >> Title : Router Keying for BGPsec >> Author(s) : Sean Turner >> Keyur Patel >> Randy Bush >> Filename : draft-ietf-sidr-rtr-keying-01.txt >> Pages : 9 >> Date : 2013-02-23 >> >> Abstract: >> BGPsec-speaking routers must be provisioned with private keys and the >> corresponding public key must be published in the global RPKI >> (Resource Public Key Infrastructure). This document describes two >> ways of provisioning public/private keys, router-driven and operator- >> driven. >> >> >> The IETF datatracker status page for this draft is: >> https://datatracker.ietf.org/doc/draft-ietf-sidr-rtr-keying >> >> There's also a htmlized version available at: >> http://tools.ietf.org/html/draft-ietf-sidr-rtr-keying-01 >> >> A diff from the previous version is available at: >> http://www.ietf.org/rfcdiff?url2=draft-ietf-sidr-rtr-keying-01 >> >> >> Internet-Drafts are also available by anonymous FTP at: >> ftp://ftp.ietf.org/internet-drafts/ >> >> _______________________________________________ >> sidr mailing list >> sidr@ietf.org >> https://www.ietf.org/mailman/listinfo/sidr > > This E-mail and any of its attachments may contain Time Warner Cable proprietary information, which is privileged, confidential, or subject to copyright belonging to Time Warner Cable. This E-mail is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient of this E-mail, you are hereby notified that any dissemination, distribution, copying, or action taken in relation to the contents of and attachments to this E-mail is strictly prohibited and may be unlawful. If you have received this E-mail in error, please notify the sender immediately and permanently delete the original and any copy of this E-mail and any printout. > From christopher.morrow@gmail.com Sun Mar 10 11:05:16 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C359A21F8600 for ; Sun, 10 Mar 2013 11:05:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.6 X-Spam-Level: X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oU3x8Jde3PfC for ; Sun, 10 Mar 2013 11:05:16 -0700 (PDT) Received: from mail-la0-x22e.google.com (mail-la0-x22e.google.com [IPv6:2a00:1450:4010:c03::22e]) by ietfa.amsl.com (Postfix) with ESMTP id C802B21F85D6 for ; Sun, 10 Mar 2013 11:05:15 -0700 (PDT) Received: by mail-la0-f46.google.com with SMTP id fq12so3121207lab.5 for ; Sun, 10 Mar 2013 11:05:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:x-received:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type; bh=ZPemiW0dpAFC6iCUMBximGs+XFbkyGzOQorI5qmLkh8=; b=Zt1qVLqunZ5xNJYuoF20nLpxnBRmKeO9iQQln61+OU1B4bheXva3219LQM9cZ3A7Bf LBvVpVeu5x21bhznide/WFURJlroh2A/CH/uTpPqnK4shLAyvmQ9F5xB7J1AkujCrG5l YECydAvo2yqsus8VVmAKwjnLMpwhLzC7j21LRPv/uQJRDVdCSqPclq+fG9T74sTFMteK rnyyljigKJdQnmneyQy6jp1IiY/V4sCEk5I9LlfAJ7zylUYaKQNTj50rB6PK7dvYythJ lDqiFx1DGkptOKBFyjLnYUzqggmW5AA5kABhSnQVLVBk+Zk6SeCLHfRHse24efyRKgKO kbpg== MIME-Version: 1.0 X-Received: by 10.112.27.106 with SMTP id s10mr3581726lbg.27.1362938714644; Sun, 10 Mar 2013 11:05:14 -0700 (PDT) Sender: christopher.morrow@gmail.com Received: by 10.152.28.34 with HTTP; Sun, 10 Mar 2013 11:05:14 -0700 (PDT) In-Reply-To: <31089dec6d0c4ff57b8ba5e680c6c29b@tcb.net> References: <24B20D14B2CD29478C8D5D6E9CBB29F65C23437D@Hermes.columbia.ads.sparta.com> <31089dec6d0c4ff57b8ba5e680c6c29b@tcb.net> Date: Sun, 10 Mar 2013 14:05:14 -0400 X-Google-Sender-Auth: gR-Qclp7D0QWAJvo1TikkEidH4Y Message-ID: From: Christopher Morrow To: Danny McPherson Content-Type: text/plain; charset=ISO-8859-1 Cc: sidr@ietf.org Subject: Re: [sidr] ORIGINs X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 10 Mar 2013 18:05:16 -0000 On Sun, Mar 10, 2013 at 12:00 PM, Danny McPherson wrote: > On 2013-03-08 11:10, Murphy, Sandra wrote: >> >> In reviewing the discussions about the threat document, the wg >> eventual consensus wrt one topic was not clear to the chairs. >> >> The ORIGIN attribute was mentioned by some as having the potential to >> be used out-of-spec to influence routing through the neighbor (and >> their neighbors, etc.). >> >> One response was that there is no way to verify the authenticity of >> the ORIGIN's original value, so the origin AS could mis-use this >> attribute no matter what we do. > > > The origin AS sets the value of the attribute to whatever THEY desire -- the > concern was that upstream ASes can manipulate this to launch "traffic > attraction attacks". This happens today with some of our transit providers, > and we'd like the option to be able to mitigate that attack if we're going > to put a bunch of stuff in place to secure inter-domain routing on the > Internet. > > >> Also, a later discussion pointed out that the original need for the >> ORIGN attribute had long since been OBE, > > > Many origin ASes set the value to various upstreams intentionally today to > impact path selection in upstream ASes, so it is very much in use today, > even if not for the originally envisaged application. > > >> but that ISPs had re-purposed >> the attribute for influencing traffic. Several operators mentioned >> that ISPs find it useful to modify this attribute and spoke against >> protecting the integrity (ie preventing the modification). > > > Right, that want to be able to exploit traffic attraction attack vectors, > whereas, as an origin AS I'd like to have the capability to prevent that. > > >> The current draft does not mention the ORIGIN attribute as a threat. >> >> Is that the right outcome? > > > No. > > >> That is, was the desired outcome: >> >> (1) yes, we know it is a threat but we know we can't & don't want to >> protect it, so might as well leave it out. (current state). why do >> make-work. > > > It's not make-work, it is a clear threat - you say yourself in the question. > It needs to be reflected in the threats draft and accommodated in subsequent > requirements and solutions work. We should not keep it out of the threat > draft simply because the solution does not currently accommodate it (we've > done lots of that already). > > >> (2) we should mention it as a threat but then mention the bits about >> can't authenticate the original value and don't want to protect the >> integrity (ie want to permit modification). > > > It's a threat, we don't need to have a solution here, we're talking about > the threats draft. It should lead to a requirement and then the solution > can be developed. > > >> If there's no interest in changing, the threats draft stands as it is >> on this point. > > > How many times do I need to defend this operational feedback before it's > considered and accommodate in the threats draft? I think the question was a survey sort of question: 'Should this be in the threats doc? Is the intent to come back and say: "Yes, origin changes along the path for many reasons, we want to protect against this." (ie: origin changes are a threat) OR "Yes, origin changes along the path, we actually want to keep this feature available.' There were at least 2 people talking about origin, one from either side I think... so clarification would be good. > -danny > > > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr From christopher.morrow@gmail.com Sun Mar 10 11:06:05 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F34D521F868F for ; Sun, 10 Mar 2013 11:06:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -103.599 X-Spam-Level: X-Spam-Status: No, score=-103.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WLTULs3ybyo1 for ; Sun, 10 Mar 2013 11:06:03 -0700 (PDT) Received: from mail-lb0-f171.google.com (mail-lb0-f171.google.com [209.85.217.171]) by ietfa.amsl.com (Postfix) with ESMTP id 5137A21F85D6 for ; Sun, 10 Mar 2013 11:06:03 -0700 (PDT) Received: by mail-lb0-f171.google.com with SMTP id gg13so2533900lbb.2 for ; Sun, 10 Mar 2013 11:05:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:x-received:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type; bh=uGAafz8IyQJyK3Kok/LtDYNSCJmuH+ZSB8wfQvLmn6c=; b=UcBjIrL9U0khyBSuqseZt02waKweVMEzL8fBsP4vg4pRqojyRDtoJB4smTA4LlGtlT k5vMrWtR5RSwHfp+sPobp+iiXw4fHE8byOVo63ZLugJeA9zaG0XrVdQIana1gejirgJV LfiiaSJGX21p7xoSDpGJoNm8INPBOVt+gSs/1HdffTCf6O/xoOESEet36J4J8nyWzkg6 rCFo446gk5HNljR9zunlKcUjx1mPPeFDTiFUdBfDKBSfMu8z2E7QwcwXLLMoo6eDk8EJ 7VA0/qHiR85T4XyPSlzytmsgP/W83584G9vdn1hR/y3TlW+w/fbaVUZA2cFVHh60LDXl IQ7g== MIME-Version: 1.0 X-Received: by 10.152.109.112 with SMTP id hr16mr7918612lab.38.1362938759216; Sun, 10 Mar 2013 11:05:59 -0700 (PDT) Sender: christopher.morrow@gmail.com Received: by 10.152.28.34 with HTTP; Sun, 10 Mar 2013 11:05:59 -0700 (PDT) In-Reply-To: References: <24B20D14B2CD29478C8D5D6E9CBB29F65C23437D@Hermes.columbia.ads.sparta.com> <31089dec6d0c4ff57b8ba5e680c6c29b@tcb.net> Date: Sun, 10 Mar 2013 14:05:59 -0400 X-Google-Sender-Auth: TexdlWwGIfy1RsSvnGzwXYyyI9k Message-ID: From: Christopher Morrow To: Danny McPherson Content-Type: text/plain; charset=ISO-8859-1 Cc: sidr@ietf.org Subject: Re: [sidr] ORIGINs X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 10 Mar 2013 18:06:05 -0000 On Sun, Mar 10, 2013 at 2:05 PM, Christopher Morrow wrote: > On Sun, Mar 10, 2013 at 12:00 PM, Danny McPherson wrote: >> On 2013-03-08 11:10, Murphy, Sandra wrote: >>> >>> In reviewing the discussions about the threat document, the wg >>> eventual consensus wrt one topic was not clear to the chairs. >>> >>> The ORIGIN attribute was mentioned by some as having the potential to >>> be used out-of-spec to influence routing through the neighbor (and >>> their neighbors, etc.). >>> >>> One response was that there is no way to verify the authenticity of >>> the ORIGIN's original value, so the origin AS could mis-use this >>> attribute no matter what we do. >> >> >> The origin AS sets the value of the attribute to whatever THEY desire -- the >> concern was that upstream ASes can manipulate this to launch "traffic >> attraction attacks". This happens today with some of our transit providers, >> and we'd like the option to be able to mitigate that attack if we're going >> to put a bunch of stuff in place to secure inter-domain routing on the >> Internet. >> >> >>> Also, a later discussion pointed out that the original need for the >>> ORIGN attribute had long since been OBE, >> >> >> Many origin ASes set the value to various upstreams intentionally today to >> impact path selection in upstream ASes, so it is very much in use today, >> even if not for the originally envisaged application. >> >> >>> but that ISPs had re-purposed >>> the attribute for influencing traffic. Several operators mentioned >>> that ISPs find it useful to modify this attribute and spoke against >>> protecting the integrity (ie preventing the modification). >> >> >> Right, that want to be able to exploit traffic attraction attack vectors, >> whereas, as an origin AS I'd like to have the capability to prevent that. >> >> >>> The current draft does not mention the ORIGIN attribute as a threat. >>> >>> Is that the right outcome? >> >> >> No. >> >> >>> That is, was the desired outcome: >>> >>> (1) yes, we know it is a threat but we know we can't & don't want to >>> protect it, so might as well leave it out. (current state). why do >>> make-work. >> >> >> It's not make-work, it is a clear threat - you say yourself in the question. >> It needs to be reflected in the threats draft and accommodated in subsequent >> requirements and solutions work. We should not keep it out of the threat >> draft simply because the solution does not currently accommodate it (we've >> done lots of that already). >> >> >>> (2) we should mention it as a threat but then mention the bits about >>> can't authenticate the original value and don't want to protect the >>> integrity (ie want to permit modification). >> >> >> It's a threat, we don't need to have a solution here, we're talking about >> the threats draft. It should lead to a requirement and then the solution >> can be developed. >> >> >>> If there's no interest in changing, the threats draft stands as it is >>> on this point. >> >> >> How many times do I need to defend this operational feedback before it's >> considered and accommodate in the threats draft? > > I think the question was a survey sort of question: 'Should this be in > the threats doc? Is the intent to come back and say: "Yes, origin > changes along the path for many reasons, we want to protect against > this." (ie: origin changes are a threat) OR "Yes, origin changes along > the path, we actually want to keep this feature available.' > > There were at least 2 people talking about origin, one from either > side I think... so clarification would be good. oops, unfinished thought: "your message provides at least 1 bit of clarification" would you be interested in providing stephen with some text for the threats doc about this? -chris >> -danny >> >> >> >> _______________________________________________ >> sidr mailing list >> sidr@ietf.org >> https://www.ietf.org/mailman/listinfo/sidr From jgs@juniper.net Sun Mar 10 15:34:03 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD4CD21F8788 for ; Sun, 10 Mar 2013 15:34:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.467 X-Spam-Level: X-Spam-Status: No, score=-3.467 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, UNRESOLVED_TEMPLATE=3.132] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id k+61rmz-ZABf for ; Sun, 10 Mar 2013 15:34:02 -0700 (PDT) Received: from exprod7og102.obsmtp.com (exprod7og102.obsmtp.com [64.18.2.157]) by ietfa.amsl.com (Postfix) with ESMTP id 5A54921F8629 for ; Sun, 10 Mar 2013 15:34:02 -0700 (PDT) Received: from P-EMHUB01-HQ.jnpr.net ([66.129.224.36]) (using TLSv1) by exprod7ob102.postini.com ([64.18.6.12]) with SMTP ID DSNKUT0KWTTQ5CEKHUjwQQ5G2z98tEA7FTAZ@postini.com; Sun, 10 Mar 2013 15:34:02 PDT Received: from P-CLDFE02-HQ.jnpr.net (172.24.192.60) by P-EMHUB01-HQ.jnpr.net (172.24.192.35) with Microsoft SMTP Server (TLS) id 8.3.213.0; Sun, 10 Mar 2013 15:34:00 -0700 Received: from o365mail.juniper.net (207.17.137.149) by o365mail.juniper.net (172.24.192.60) with Microsoft SMTP Server id 14.1.355.2; Sun, 10 Mar 2013 15:33:59 -0700 Received: from va3outboundpool.messaging.microsoft.com (216.32.180.31) by o365mail.juniper.net (207.17.137.149) with Microsoft SMTP Server (TLS) id 14.1.355.2; Sun, 10 Mar 2013 15:36:42 -0700 Received: from mail190-va3-R.bigfish.com (10.7.14.247) by VA3EHSOBE014.bigfish.com (10.7.40.64) with Microsoft SMTP Server id 14.1.225.23; Sun, 10 Mar 2013 22:33:58 +0000 Received: from mail190-va3 (localhost [127.0.0.1]) by mail190-va3-R.bigfish.com (Postfix) with ESMTP id ABA611809EA for ; Sun, 10 Mar 2013 22:33:58 +0000 (UTC) X-Forefront-Antispam-Report: CIP:157.56.242.197; KIP:(null); UIP:(null); (null); H:BL2PRD0512HT001.namprd05.prod.outlook.com; R:internal; EFV:INT X-SpamScore: -28 X-BigFish: PS-28(zz98dI9371I936eI1432I1487M168aJzz1f42h1ee6h1de0h1202h1e76h1d1ah1d2ah1082kzz8275ch1033IL8275dhz2dh2a8h668h839h944hd25he5bhf0ah1220h1288h12a5h12a9h12bdh137ah139eh13b6h1441h1504h1537h162dh1631h1662h1758h1898h18e1h1902h1946h19b5h19ceh1ad9h1b0ah1155h) Received: from mail190-va3 (localhost.localdomain [127.0.0.1]) by mail190-va3 (MessageSwitch) id 1362954836627499_25678; Sun, 10 Mar 2013 22:33:56 +0000 (UTC) Received: from VA3EHSMHS002.bigfish.com (unknown [10.7.14.254]) by mail190-va3.bigfish.com (Postfix) with ESMTP id 8B47E60050; Sun, 10 Mar 2013 22:33:56 +0000 (UTC) Received: from BL2PRD0512HT001.namprd05.prod.outlook.com (157.56.242.197) by VA3EHSMHS002.bigfish.com (10.7.99.12) with Microsoft SMTP Server (TLS) id 14.1.225.23; Sun, 10 Mar 2013 22:33:52 +0000 Received: from sa-nc-ipg-172-23-0-134.static.jnpr.net (66.129.224.54) by pod51010.outlook.com (10.255.233.34) with Microsoft SMTP Server (TLS) id 14.16.275.6; Sun, 10 Mar 2013 22:33:52 +0000 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 (Mac OS X Mail 6.2 \(1499\)) From: "John G. Scudder" In-Reply-To: <31089dec6d0c4ff57b8ba5e680c6c29b@tcb.net> Date: Sun, 10 Mar 2013 18:34:08 -0400 Content-Transfer-Encoding: quoted-printable Message-ID: <095E75BC-2D81-4E16-A256-B31C4783ECE8@juniper.net> References: <24B20D14B2CD29478C8D5D6E9CBB29F65C23437D@Hermes.columbia.ads.sparta.com> <31089dec6d0c4ff57b8ba5e680c6c29b@tcb.net> To: Danny McPherson X-Mailer: Apple Mail (2.1499) X-Originating-IP: [66.129.224.54] X-FOPE-CONNECTOR: Id%0$Dn%*$RO%0$TLS%0$FQDN%$TlsDn% X-FOPE-CONNECTOR: Id%12219$Dn%IETF.ORG$RO%2$TLS%5$FQDN%onpremiseedge-1018244.customer.frontbridge.com$TlsDn%o365mail.juniper.net X-FOPE-CONNECTOR: Id%12219$Dn%TCB.NET$RO%2$TLS%5$FQDN%onpremiseedge-1018244.customer.frontbridge.com$TlsDn%o365mail.juniper.net Cc: sidr@ietf.org Subject: Re: [sidr] ORIGINs X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 10 Mar 2013 22:34:03 -0000 Danny and Sandy, It seems to me that the question of whether an intermediate AS monkeying = with ORIGIN is an "attack" or not depends on what one understands the = correct and intended operation of ORIGIN to be. The problem is, as = you've rightly said, ORIGIN's (ahem) original purpose was obsolete = almost as soon as it was introduced, and since then we have decades of = uncoordinated operational (ab)use of ORIGIN. I'm not aware of any broad = consensus on best practice for the current use of ORIGIN, and I'm sure = there's no standard for it, other than what the BGP standard says which = is as previously noted, effectively obsolete.=20 If I parse Danny's email right, he's saying that he wishes he could rely = on ORIGIN to be untouched by intermediate ASes, so that he can use it to = "impact path selection" by them. I presume that he's not actually = relying on this, though, since the facts on the ground (as he points = out) are that various intermediate ASes do adjust the value of ORIGIN. I'm not aware of any of the operators who do adjust ORIGIN in their = networks having spoken up (though I may easily have overlooked some). If = correct, I suspect this is simply because they're not following SIDR. = However, I don't interpret this silence as meaning that all operators = agree that ORIGIN should be immutable once launched. So, we have the following schools of thought on ORIGIN: - It's an interdomain policy knob to be used solely by the originator. - Or, it may be used as an intradomain policy knob by a transit AS. It's tempting, though futile, to say "a plague on both your houses!", = because the standard doesn't say it's either of those things. It does = say it "SHOULD NOT be changed by any other speaker", which offers some = support for Danny's point of view. But really, spec-lawyers can't = convincingly support either approach, since the spec doesn't frame = ORIGIN as a policy tool at all. For my own part, I think twiddling ORIGIN at any point on the path is an = abomination and I wish it had never become practice. However, as with so = many things about BGP, it's an abomination that HAS become practice, and = I think we would be well-advised to be careful in trying to stuff this = little genie back into its bottle. All that said, I guess I prefer Sandy's option (2) -- given there's an = identified issue, why not write it down, if only to avoid recapitulating = quite so much of this conversation in the future? (And for the sake of = this discussion I assume characterizing it as a "threat" uses "threat" = as a term of art and not a value judgement -- see my first paragraph = above regarding "attack".) --John On Mar 10, 2013, at 12:00 PM, Danny McPherson wrote: > On 2013-03-08 11:10, Murphy, Sandra wrote: >> In reviewing the discussions about the threat document, the wg >> eventual consensus wrt one topic was not clear to the chairs. >>=20 >> The ORIGIN attribute was mentioned by some as having the potential to >> be used out-of-spec to influence routing through the neighbor (and >> their neighbors, etc.). >>=20 >> One response was that there is no way to verify the authenticity of >> the ORIGIN's original value, so the origin AS could mis-use this >> attribute no matter what we do. >=20 > The origin AS sets the value of the attribute to whatever THEY desire = -- the concern was that upstream ASes can manipulate this to launch = "traffic attraction attacks". This happens today with some of our = transit providers, and we'd like the option to be able to mitigate that = attack if we're going to put a bunch of stuff in place to secure = inter-domain routing on the Internet. >=20 >> Also, a later discussion pointed out that the original need for the >> ORIGN attribute had long since been OBE, >=20 > Many origin ASes set the value to various upstreams intentionally = today to impact path selection in upstream ASes, so it is very much in = use today, even if not for the originally envisaged application. >=20 >> but that ISPs had re-purposed >> the attribute for influencing traffic. Several operators mentioned >> that ISPs find it useful to modify this attribute and spoke against >> protecting the integrity (ie preventing the modification). >=20 > Right, that want to be able to exploit traffic attraction attack = vectors, whereas, as an origin AS I'd like to have the capability to = prevent that. >=20 >> The current draft does not mention the ORIGIN attribute as a threat. >>=20 >> Is that the right outcome? >=20 > No. >=20 >> That is, was the desired outcome: >>=20 >> (1) yes, we know it is a threat but we know we can't & don't want to >> protect it, so might as well leave it out. (current state). why do >> make-work. >=20 > It's not make-work, it is a clear threat - you say yourself in the = question. It needs to be reflected in the threats draft and = accommodated in subsequent requirements and solutions work. We should = not keep it out of the threat draft simply because the solution does not = currently accommodate it (we've done lots of that already). >=20 >> (2) we should mention it as a threat but then mention the bits about >> can't authenticate the original value and don't want to protect the >> integrity (ie want to permit modification). >=20 > It's a threat, we don't need to have a solution here, we're talking = about the threats draft. It should lead to a requirement and then the = solution can be developed. >=20 >> If there's no interest in changing, the threats draft stands as it is >> on this point. >=20 > How many times do I need to defend this operational feedback before = it's considered and accommodate in the threats draft? >=20 > -danny >=20 >=20 > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr From Sandra.Murphy@sparta.com Sun Mar 10 19:53:53 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6A60621F87AA for ; Sun, 10 Mar 2013 19:53:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.69 X-Spam-Level: X-Spam-Status: No, score=-102.69 tagged_above=-999 required=5 tests=[AWL=-0.091, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 72qiUg+1c5tq for ; Sun, 10 Mar 2013 19:53:49 -0700 (PDT) Received: from Uther.sparta.com (uther.sparta.com [157.185.0.2]) by ietfa.amsl.com (Postfix) with ESMTP id AB3B521F8794 for ; Sun, 10 Mar 2013 19:53:49 -0700 (PDT) Received: from durin.laguna.sparta.com ([10.62.216.7]) by Uther.sparta.com (8.13.8/8.13.8) with ESMTP id r2B2rmAw011623 for ; Sun, 10 Mar 2013 19:53:48 -0700 Received: from Hermes.columbia.ads.sparta.com ([10.62.56.107]) by durin.laguna.sparta.com (8.13.8/8.13.8) with ESMTP id r2B2rlBk017183 for ; Sun, 10 Mar 2013 19:53:47 -0700 Received: from HERMES.columbia.ads.sparta.com ([fe80::e4a8:a383:2128:c0e5]) by Hermes.columbia.ads.sparta.com ([fe80::e4a8:a383:2128:c0e5%18]) with mapi id 14.02.0247.003; Sun, 10 Mar 2013 22:53:02 -0400 From: "Murphy, Sandra" To: "sidr@ietf.org" Thread-Topic: slides, slides and more slides Thread-Index: Ac4eA4vFkgN4qMmPQsWAYbqLlE4klA== Date: Mon, 11 Mar 2013 02:53:01 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F65C23481F@Hermes.columbia.ads.sparta.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.118] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: [sidr] slides, slides and more slides X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2013 02:53:53 -0000 But not enough slides.=0A= =0A= Presenters are urged to send their slides to the chairs just as soon as pos= sible. ASAP. RSN.=0A= =0A= --Sandy, speaking as a wg co-chair= From Sandra.Murphy@sparta.com Sun Mar 10 22:15:24 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1A3A321F87D1 for ; Sun, 10 Mar 2013 22:15:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.71 X-Spam-Level: X-Spam-Status: No, score=-102.71 tagged_above=-999 required=5 tests=[AWL=-0.111, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QTk7J2syPEa9 for ; Sun, 10 Mar 2013 22:15:23 -0700 (PDT) Received: from Uther.sparta.com (uther.sparta.com [157.185.0.2]) by ietfa.amsl.com (Postfix) with ESMTP id 7B74021F87B9 for ; Sun, 10 Mar 2013 22:15:23 -0700 (PDT) Received: from durin.laguna.sparta.com ([10.62.216.7]) by Uther.sparta.com (8.13.8/8.13.8) with ESMTP id r2B5FNpI012182 for ; Sun, 10 Mar 2013 22:15:23 -0700 Received: from Hermes.columbia.ads.sparta.com ([10.62.56.107]) by durin.laguna.sparta.com (8.13.8/8.13.8) with ESMTP id r2B5FMLE021475 for ; Sun, 10 Mar 2013 22:15:23 -0700 Received: from HERMES.columbia.ads.sparta.com ([fe80::e4a8:a383:2128:c0e5]) by Hermes.columbia.ads.sparta.com ([fe80::e4a8:a383:2128:c0e5%18]) with mapi id 14.02.0247.003; Mon, 11 Mar 2013 01:14:37 -0400 From: "Murphy, Sandra" To: "sidr@ietf.org" Thread-Topic: need jabber scribe and minutes taker Thread-Index: Ac4eFNLo/JdipgPPSmiHPZfbYok7SQ== Date: Mon, 11 Mar 2013 05:14:37 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F65C2348E3@Hermes.columbia.ads.sparta.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.118] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: [sidr] need jabber scribe and minutes taker X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2013 05:15:24 -0000 As always, we will need to identify a minute taker and jabber scribe. We c= an't start unless we have someone taking minutes and the chairs will be bus= y with the presentations.=0A= =0A= Note that the etherpad capability lets minutes taking be a collaborative ef= fort. But we still need to identify someone.=0A= =0A= Please do consider volunteering.=0A= =0A= --Sandy= From mlepinski.ietf@gmail.com Mon Mar 11 06:48:18 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 44EAA21F85ED for ; Mon, 11 Mar 2013 06:48:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.419 X-Spam-Level: X-Spam-Status: No, score=-3.419 tagged_above=-999 required=5 tests=[AWL=0.180, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RsI6jHusbUT0 for ; Mon, 11 Mar 2013 06:48:17 -0700 (PDT) Received: from mail-qa0-f48.google.com (mail-qa0-f48.google.com [209.85.216.48]) by ietfa.amsl.com (Postfix) with ESMTP id 2AFC721F85DF for ; Mon, 11 Mar 2013 06:48:17 -0700 (PDT) Received: by mail-qa0-f48.google.com with SMTP id j8so972545qah.0 for ; Mon, 11 Mar 2013 06:48:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:x-received:reply-to:date:message-id:subject:from:to :content-type; bh=57l4468bQwMzPk5UZazSlsvgaOXp9Jfo/CTGP3/zlTM=; b=YhaXomeCZt93Q8TJ+BkH7HCmDGTQ6VPYyAao5ti0buTqqxQMURNpoH7cqfyIJUxMQ2 M9PJVdIkcBRemWIhW71ATGI0/k6iF5pLXRo0gKnR1LQvTkv+edGQHFKpzCd0BML3Jzhc YhNuNxusR3Qsx/oPvhgd2fif6CLM1D1epkfAvVC9eKpfdIqfDPr/+gRat75RlfxUsWhz F2f6rJPLK/gVM+irOX5Jyt0zd+56A8dfXNfFRPBDf7bSNP0IF/AEGSFof7Cp7jwT2n6N Em7Ct8ztGvibqkGlQ31YHZosCLn4shafX5NosEPDmMsdkkNJzQjPHJHnCVXd9VGd2Wxr u9sQ== MIME-Version: 1.0 X-Received: by 10.49.97.134 with SMTP id ea6mr19297600qeb.33.1363009696717; Mon, 11 Mar 2013 06:48:16 -0700 (PDT) Received: by 10.49.129.196 with HTTP; Mon, 11 Mar 2013 06:48:16 -0700 (PDT) Date: Mon, 11 Mar 2013 09:48:16 -0400 Message-ID: From: Matthew Lepinski To: sidr@ietf.org Content-Type: text/plain; charset=ISO-8859-1 Subject: [sidr] draft-newton-sidr-policy-qualifiers-01 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: nomcom-chair@ietf.org List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2013 13:48:18 -0000 I have now read this document. [Also, thanks to the document authors, the -01 version is a significant improvement over the -00 version] At the meeting, both APNIC and ARIN said they would like to put these URIs into certificates they issue. This appears to place no burden whatsoever on the relying party. (And some relying parties might actually find these URIs useful for finding applicable CPS documents.) This seems like quite a reasonable document, and I do not anticipate that it would take a lot of working group cycles to process this document. I would, therefore, support adoption of this document by the working group. - Matt Lepinski From andy@arin.net Mon Mar 11 06:54:51 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A34F921F85D9 for ; Mon, 11 Mar 2013 06:54:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5uDPkls5FAuy for ; Mon, 11 Mar 2013 06:54:42 -0700 (PDT) Received: from smtp1.arin.net (smtp1.arin.net [IPv6:2001:500:4:13::33]) by ietfa.amsl.com (Postfix) with ESMTP id 78B8021F84C8 for ; Mon, 11 Mar 2013 06:54:40 -0700 (PDT) Received: by smtp1.arin.net (Postfix, from userid 323) id 26D731650E4; Mon, 11 Mar 2013 09:54:40 -0400 (EDT) Received: from CHAXCH06.corp.arin.net (chaxch06.corp.arin.net [192.149.252.95]) by smtp1.arin.net (Postfix) with ESMTP id D51C71650D2 for ; Mon, 11 Mar 2013 09:54:39 -0400 (EDT) Received: from CHAXCH04.corp.arin.net (10.1.30.19) by CHAXCH06.corp.arin.net (192.149.252.95) with Microsoft SMTP Server (TLS) id 14.2.328.9; Mon, 11 Mar 2013 09:54:34 -0400 Received: from CHAXCH01.corp.arin.net ([169.254.1.209]) by CHAXCH04.corp.arin.net ([10.1.30.19]) with mapi id 14.02.0328.009; Mon, 11 Mar 2013 09:54:38 -0400 From: Andy Newton To: "sidr@ietf.org" Thread-Topic: [sidr] draft-newton-sidr-policy-qualifiers-01 Thread-Index: AQHOHl8kTr/kgcMCNUuI4FFBE+v3WZigk/MA Date: Mon, 11 Mar 2013 13:54:37 +0000 Message-ID: <62D9228640AC7F49B2DD9ED0C9CE60E58BBF2611@CHAXCH01.corp.arin.net> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.3.1.130117 x-originating-ip: [10.1.35.138] Content-Type: text/plain; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [sidr] draft-newton-sidr-policy-qualifiers-01 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2013 13:54:51 -0000 On 3/11/13 9:48 AM, "Matthew Lepinski" wrote: >This seems like quite a reasonable document, and I do not anticipate >that it would take a lot of working group cycles to process this >document. I would, therefore, support adoption of this document by the >working group. Thank you Matt. And since you beat me to getting a message to the list regarding the adoption of this draft, I would like to ask the working group to adopt this draft as a work item. -andy From carlosm3011@gmail.com Mon Mar 11 06:56:59 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B1B8221F86EC for ; Mon, 11 Mar 2013 06:56:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SeFnPZcrodn3 for ; Mon, 11 Mar 2013 06:56:59 -0700 (PDT) Received: from mail-pb0-f50.google.com (mail-pb0-f50.google.com [209.85.160.50]) by ietfa.amsl.com (Postfix) with ESMTP id 233AF21F8610 for ; Mon, 11 Mar 2013 06:56:59 -0700 (PDT) Received: by mail-pb0-f50.google.com with SMTP id up1so3777144pbc.37 for ; Mon, 11 Mar 2013 06:56:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=x-received:message-id:date:from:reply-to:user-agent:mime-version:to :cc:subject:references:in-reply-to:content-type :content-transfer-encoding; bh=O1pCYi6jybg2Dr5YJZ3m7E2ZpwdiIqy8O5WO7oNPzg8=; b=khW0M5P7VlyRRym6voSzsZq+pAvLhcV35EkCO+a1H69Rgu2rILXMvOyQgDfQ/PpNY/ cwGy4ji3ppuEUB2iLSPZFlkRxQBjtEQ3GDXrteoTqtUew0mrV9+uqxUlVWJcOpbeMlay snXyn+okM3s0O5kXGwWtjAo66Ovob9PYFdnZQhugETUG06D1zXqqFkAkuPJ5ja6xhvIf UdEDInqsl7G+szCzJTLeOFeCI0gq9tfuYHvddG74QjHUJhpLfbpEqCwbCUAsfUUHjnz+ K3eHEe5x7rjAZQqzkyjeGuYyvSWBnTc+rSrwqkioB//V5+80spVPAuawP7myaEenVjbp tpNQ== X-Received: by 10.68.238.163 with SMTP id vl3mr28214894pbc.177.1363010218853; Mon, 11 Mar 2013 06:56:58 -0700 (PDT) Received: from europa.local (dhcp-542c.meeting.ietf.org. [130.129.84.44]) by mx.google.com with ESMTPS id eg1sm20464850pbb.33.2013.03.11.06.56.56 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Mon, 11 Mar 2013 06:56:57 -0700 (PDT) Message-ID: <513DE2A7.3040707@gmail.com> Date: Mon, 11 Mar 2013 09:56:55 -0400 From: "Carlos M. Martinez" User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130216 Thunderbird/17.0.3 MIME-Version: 1.0 To: Andy Newton References: <62D9228640AC7F49B2DD9ED0C9CE60E58BBF2611@CHAXCH01.corp.arin.net> In-Reply-To: <62D9228640AC7F49B2DD9ED0C9CE60E58BBF2611@CHAXCH01.corp.arin.net> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: "sidr@ietf.org" Subject: Re: [sidr] draft-newton-sidr-policy-qualifiers-01 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: carlos@lacnic.net List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2013 13:56:59 -0000 I support WG adoption of this draft. ~Carlos On 3/11/13 9:54 AM, Andy Newton wrote: > On 3/11/13 9:48 AM, "Matthew Lepinski" wrote: > >> This seems like quite a reasonable document, and I do not anticipate >> that it would take a lot of working group cycles to process this >> document. I would, therefore, support adoption of this document by the >> working group. > > Thank you Matt. And since you beat me to getting a message to the list > regarding the adoption of this draft, I would like to ask the working > group to adopt this draft as a work item. > > -andy > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From carlosm3011@gmail.com Mon Mar 11 06:59:18 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 588CF21F8522 for ; Mon, 11 Mar 2013 06:59:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Yf1iDDx5YjZb for ; Mon, 11 Mar 2013 06:59:17 -0700 (PDT) Received: from mail-pb0-f48.google.com (mail-pb0-f48.google.com [209.85.160.48]) by ietfa.amsl.com (Postfix) with ESMTP id C769D21F8517 for ; Mon, 11 Mar 2013 06:59:17 -0700 (PDT) Received: by mail-pb0-f48.google.com with SMTP id wy12so3746912pbc.7 for ; Mon, 11 Mar 2013 06:59:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=x-received:message-id:date:from:reply-to:user-agent:mime-version:to :subject:references:in-reply-to:content-type :content-transfer-encoding; bh=BtUyJNBAMX3Hx9QeeW77JH7qR4Ktypu+1jyRlZqK4tE=; b=iD7ywO2GivWrztIoog1Hdo6oPTOEIk4uW/Uw/XObAIsFgLMldqFWEEndRZDrS4EDix TAR3SQT2MvBg3NyXFFyH6KMbRuLhy/TjMRH2F8QFoXooMLO/sPpX2tZlpX7YUJdrrz+U Hy1mMq4RVfAxa4BS07q2SHeP1XVIVIdSwW3QYUJV/5lQ1zHa+Uthsrg8HygmGACAmb8h K1v7VL6yYP6KaC8Dwv0FyEDDWqyqc3g43m3HfcGhxwnN5xCwDXLldjKhvkQXs7ohDDZ/ XcAiCW5tjDtF1zl3MU5SvmwB85fxbDrd81mat75Vf53D8EXXCochv8ZQ+9bW6K8xbHla iA8w== X-Received: by 10.68.83.38 with SMTP id n6mr28480543pby.28.1363010357472; Mon, 11 Mar 2013 06:59:17 -0700 (PDT) Received: from europa.local (dhcp-542c.meeting.ietf.org. [130.129.84.44]) by mx.google.com with ESMTPS id zm1sm20479653pbc.26.2013.03.11.06.59.14 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Mon, 11 Mar 2013 06:59:15 -0700 (PDT) Message-ID: <513DE332.4090406@gmail.com> Date: Mon, 11 Mar 2013 09:59:14 -0400 From: "Carlos M. Martinez" User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130216 Thunderbird/17.0.3 MIME-Version: 1.0 To: "sidr@ietf.org" References: <20130225202309.13536.56264.idtracker@ietfa.amsl.com> <512BC89A.1040603@lacnic.net> In-Reply-To: <512BC89A.1040603@lacnic.net> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [sidr] Fwd: New Version Notification for draft-rogaglia-sidr-multiple-publication-points-02.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: carlos@lacnic.net List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2013 13:59:18 -0000 As requested by the chairs, I'm sending this email requesting WG adoption of this item. Warm regards and thank you to all who provided feedback. ~Carlos On 2/25/13 3:24 PM, Carlos M. Martinez wrote: > Folks, > > we've submitted a -02 > > regards > > ~Carlos > > > -------- Original Message -------- > Subject: New Version Notification for > draft-rogaglia-sidr-multiple-publication-points-02.txt > Date: Mon, 25 Feb 2013 12:23:09 -0800 > From: internet-drafts@ietf.org > To: carlos@lacnic.net > CC: rogaglia@cisco.com, terry.manderson@icann.org > > > > A new version of I-D, draft-rogaglia-sidr-multiple-publication-points-02.txt > has been successfully submitted by Carlos Martinez and posted to the > IETF repository. > > Filename: draft-rogaglia-sidr-multiple-publication-points > Revision: 02 > Title: Multiple Repository Publication Points support in the Resource Public Key Infrastructure (RPKI) > Creation date: 2013-02-25 > Group: Individual Submission > Number of pages: 13 > URL: http://www.ietf.org/internet-drafts/draft-rogaglia-sidr-multiple-publication-points-02.txt > Status: http://datatracker.ietf.org/doc/draft-rogaglia-sidr-multiple-publication-points > Htmlized: http://tools.ietf.org/html/draft-rogaglia-sidr-multiple-publication-points-02 > Diff: http://www.ietf.org/rfcdiff?url2=draft-rogaglia-sidr-multiple-publication-points-02 > > Abstract: > The Resource Public Key Infrastructure (RPKI) depends on Relying > Parties (RP) ability to access its Trust Anchors' certificate > specified in the different "Trust Anchor Locator (TAL)" files and the > Repository Objects located at the Certificate Authorities (CA) > repositories hosted in its respective publication point. This > document updates [RFC6490] by allowing multiple URI associated to a > single public key in a TAL file and introduces the concept of > multiple repository publication point operators for every CA in the > RPKI. This document provides also recommendation for the RP behavior > when analyzing signed objects that include multiple publications > points. > > > > > The IETF Secretariat > > > > > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From turners@ieca.com Mon Mar 11 07:36:05 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A7FF121F8B77 for ; Mon, 11 Mar 2013 07:36:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.209 X-Spam-Level: X-Spam-Status: No, score=-102.209 tagged_above=-999 required=5 tests=[AWL=0.056, BAYES_00=-2.599, IP_NOT_FRIENDLY=0.334, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KSf7jQgJhJLa for ; Mon, 11 Mar 2013 07:36:05 -0700 (PDT) Received: from gateway01.websitewelcome.com (gateway01.websitewelcome.com [67.18.65.19]) by ietfa.amsl.com (Postfix) with ESMTP id 3242B21F8B6C for ; Mon, 11 Mar 2013 07:36:05 -0700 (PDT) Received: by gateway01.websitewelcome.com (Postfix, from userid 5007) id DB4984505E7C9; Mon, 11 Mar 2013 09:36:04 -0500 (CDT) Received: from gator1743.hostgator.com (gator1743.hostgator.com [184.173.253.227]) by gateway01.websitewelcome.com (Postfix) with ESMTP id CD1834505E7A5 for ; Mon, 11 Mar 2013 09:36:04 -0500 (CDT) Received: from [198.180.150.142] (port=54264 helo=dhcp-5422.meeting.ietf.org) by gator1743.hostgator.com with esmtpsa (TLSv1:DHE-RSA-AES256-SHA:256) (Exim 4.80) (envelope-from ) id 1UF3pc-0000GX-Kf for sidr@ietf.org; Mon, 11 Mar 2013 09:36:04 -0500 Message-ID: <513DEBD3.2030903@ieca.com> Date: Mon, 11 Mar 2013 10:36:03 -0400 From: Sean Turner User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:17.0) Gecko/20130216 Thunderbird/17.0.3 MIME-Version: 1.0 To: "sidr@ietf.org" References: <62D9228640AC7F49B2DD9ED0C9CE60E58BBF2611@CHAXCH01.corp.arin.net> <513DE2A7.3040707@gmail.com> In-Reply-To: <513DE2A7.3040707@gmail.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - gator1743.hostgator.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - ieca.com X-BWhitelist: no X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: (dhcp-5422.meeting.ietf.org) [198.180.150.142]:54264 X-Source-Auth: sean.turner@ieca.com X-Email-Count: 8 X-Source-Cap: ZG9tbWdyNDg7ZG9tbWdyNDg7Z2F0b3IxNzQzLmhvc3RnYXRvci5jb20= Subject: Re: [sidr] draft-newton-sidr-policy-qualifiers-01 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2013 14:36:05 -0000 +1 spt On 3/11/13 9:56 AM, Carlos M. Martinez wrote: > I support WG adoption of this draft. > > ~Carlos > > On 3/11/13 9:54 AM, Andy Newton wrote: >> On 3/11/13 9:48 AM, "Matthew Lepinski" wrote: >> >>> This seems like quite a reasonable document, and I do not anticipate >>> that it would take a lot of working group cycles to process this >>> document. I would, therefore, support adoption of this document by the >>> working group. >> >> Thank you Matt. And since you beat me to getting a message to the list >> regarding the adoption of this draft, I would like to ask the working >> group to adopt this draft as a work item. >> >> -andy >> >> _______________________________________________ >> sidr mailing list >> sidr@ietf.org >> https://www.ietf.org/mailman/listinfo/sidr >> > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From aservin@lacnic.net Mon Mar 11 07:39:24 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1966811E80F3 for ; Mon, 11 Mar 2013 07:39:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OxHILoUoA4HC for ; Mon, 11 Mar 2013 07:39:23 -0700 (PDT) Received: from mail.lacnic.net.uy (mail.lacnic.net.uy [IPv6:2001:13c7:7001:4000::3]) by ietfa.amsl.com (Postfix) with ESMTP id 10F8811E80EE for ; Mon, 11 Mar 2013 07:39:05 -0700 (PDT) Received: from dhcp-11f1.meeting.ietf.org (unknown [IPv6:2001:df8:0:16:7958:a751:c815:bc0f]) by mail.lacnic.net.uy (Postfix) with ESMTP id 7A587308451 for ; Mon, 11 Mar 2013 11:38:52 -0300 (UYT) Message-ID: <513DEC83.5050908@lacnic.net> Date: Mon, 11 Mar 2013 11:38:59 -0300 From: Arturo Servin User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130216 Thunderbird/17.0.3 MIME-Version: 1.0 To: sidr@ietf.org References: <62D9228640AC7F49B2DD9ED0C9CE60E58BBF2611@CHAXCH01.corp.arin.net> In-Reply-To: <62D9228640AC7F49B2DD9ED0C9CE60E58BBF2611@CHAXCH01.corp.arin.net> X-Enigmail-Version: 1.5.1 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-LACNIC.uy-MailScanner-Information: Please contact the ISP for more information X-LACNIC.uy-MailScanner: Found to be clean X-LACNIC.uy-MailScanner-SpamCheck: X-LACNIC.uy-MailScanner-From: aservin@lacnic.net Subject: Re: [sidr] draft-newton-sidr-policy-qualifiers-01 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2013 14:39:24 -0000 I have read and support. Regards, as On 11/03/2013 10:54, Andy Newton wrote: > On 3/11/13 9:48 AM, "Matthew Lepinski" wrote: > >> This seems like quite a reasonable document, and I do not anticipate >> that it would take a lot of working group cycles to process this >> document. I would, therefore, support adoption of this document by the >> working group. > > Thank you Matt. And since you beat me to getting a message to the list > regarding the adoption of this draft, I would like to ask the working > group to adopt this draft as a work item. > > -andy > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From internet-drafts@ietf.org Mon Mar 11 09:06:38 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1CE1811E813B; Mon, 11 Mar 2013 09:06:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.499 X-Spam-Level: X-Spam-Status: No, score=-102.499 tagged_above=-999 required=5 tests=[AWL=0.101, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NFSn4lYiTRTG; Mon, 11 Mar 2013 09:06:37 -0700 (PDT) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 5E8E611E813F; Mon, 11 Mar 2013 09:06:37 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: internet-drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 4.42 Message-ID: <20130311160637.10414.37402.idtracker@ietfa.amsl.com> Date: Mon, 11 Mar 2013 09:06:37 -0700 Cc: sidr@ietf.org Subject: [sidr] I-D Action: draft-ietf-sidr-rpki-rtr-protocol-mib-07.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2013 16:06:38 -0000 A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the Secure Inter-Domain Routing Working Group= of the IETF. Title : Definitions of Managed Objects for the RPKI-Router Proto= col Author(s) : Randy Bush Bert Wijnen Keyur Patel Michael Baer Filename : draft-ietf-sidr-rpki-rtr-protocol-mib-07.txt Pages : 25 Date : 2013-03-11 Abstract: This document defines a portion of the Management Information Base (MIB) for use with network management protocols in the Internet community. In particular, it describes objects used for monitoring the RPKI Router protocol. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-sidr-rpki-rtr-protocol-mib There's also a htmlized version available at: http://tools.ietf.org/html/draft-ietf-sidr-rpki-rtr-protocol-mib-07 A diff from the previous version is available at: http://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-sidr-rpki-rtr-protocol-mib-07 Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From rogaglia@cisco.com Mon Mar 11 09:52:49 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5712A11E80A3 for ; Mon, 11 Mar 2013 09:52:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.999 X-Spam-Level: X-Spam-Status: No, score=-9.999 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, J_CHICKENPOX_25=0.6, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lsF0wEkpjbVr for ; Mon, 11 Mar 2013 09:52:48 -0700 (PDT) Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by ietfa.amsl.com (Postfix) with ESMTP id C3FAD21F8B8A for ; Mon, 11 Mar 2013 09:52:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=1350; q=dns/txt; s=iport; t=1363020768; x=1364230368; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=csV0CYYOWExibOAO+zA2QkqqtLU6qEXKxe1VAwTKDfg=; b=MpWPVa37xqL2jddLp/7L46lhGmK5+1Ui39USyXfsZq7tSYA/Jx4Ebvm/ o11ljydaf0Q+5UA2iLFaPI+YPalx7M8w/K21KmY0niLqcMGAFMQE69WkW 5J6O208ysLFfSQJrw+Ym/QZm81X0G7pA0ulkWM6avTwg3CvKTiVdYVPAi I=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AgEFAJkKPlGtJV2b/2dsb2JhbABDxGCBXRZ0gikBAQEDAQEBATc0CwULAgEIGAoUECEGCyUCBA4FCId5AwkGDLNODYlEEwSMRoIVAjEHgl9hA5R1jTyFGYMKgig X-IronPort-AV: E=Sophos;i="4.84,824,1355097600"; d="scan'208";a="186165654" Received: from rcdn-core-4.cisco.com ([173.37.93.155]) by rcdn-iport-5.cisco.com with ESMTP; 11 Mar 2013 16:52:48 +0000 Received: from xhc-aln-x06.cisco.com (xhc-aln-x06.cisco.com [173.36.12.80]) by rcdn-core-4.cisco.com (8.14.5/8.14.5) with ESMTP id r2BGqmYf004919 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Mon, 11 Mar 2013 16:52:48 GMT Received: from xmb-rcd-x02.cisco.com ([169.254.4.47]) by xhc-aln-x06.cisco.com ([173.36.12.80]) with mapi id 14.02.0318.004; Mon, 11 Mar 2013 11:52:47 -0500 From: "Roque Gagliano (rogaglia)" To: Andy Newton Thread-Topic: [sidr] draft-newton-sidr-policy-qualifiers-01 Thread-Index: AQHOHnjbTE9XgwNV9kiTRp6Wv6dcEg== Date: Mon, 11 Mar 2013 16:52:47 +0000 Message-ID: References: <62D9228640AC7F49B2DD9ED0C9CE60E58BBF2611@CHAXCH01.corp.arin.net> In-Reply-To: <62D9228640AC7F49B2DD9ED0C9CE60E58BBF2611@CHAXCH01.corp.arin.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.61.102.191] Content-Type: text/plain; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: "sidr@ietf.org" Subject: Re: [sidr] draft-newton-sidr-policy-qualifiers-01 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2013 16:52:49 -0000 I support this document and I volunteer review.=20 I suffered this problem in a previous job. Also CPS URIs in certificates are common practice. See the "Certificate Pol= icies" extension from my personal certificate issued by Verisign where a CP= S pointer qualifier (id-qt-cps) is present: X509v3 extensions: X509v3 Basic Constraints:=20 CA:FALSE X509v3 Certificate Policies:=20 Policy: 2.16.840.1.113733.1.7.23.1 CPS: https://www.verisign.com/rpa Obs: CPS OID =3D 1.3.6.1.5.5.7.2.1 (id-qt-cps) Roque On Mar 11, 2013, at 2:54 PM, Andy Newton wrote: > On 3/11/13 9:48 AM, "Matthew Lepinski" wrote: >=20 >> This seems like quite a reasonable document, and I do not anticipate >> that it would take a lot of working group cycles to process this >> document. I would, therefore, support adoption of this document by the >> working group. >=20 > Thank you Matt. And since you beat me to getting a message to the list > regarding the adoption of this draft, I would like to ask the working > group to adopt this draft as a work item. >=20 > -andy >=20 > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr From ggmichaelson@gmail.com Mon Mar 11 09:56:30 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 82A6411E8146 for ; Mon, 11 Mar 2013 09:56:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.788 X-Spam-Level: X-Spam-Status: No, score=-2.788 tagged_above=-999 required=5 tests=[AWL=0.811, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8d6XT3a9H3mc for ; Mon, 11 Mar 2013 09:56:29 -0700 (PDT) Received: from mail-pb0-f44.google.com (mail-pb0-f44.google.com [209.85.160.44]) by ietfa.amsl.com (Postfix) with ESMTP id 2497511E8142 for ; Mon, 11 Mar 2013 09:56:29 -0700 (PDT) Received: by mail-pb0-f44.google.com with SMTP id wz12so3970508pbc.3 for ; Mon, 11 Mar 2013 09:56:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=x-received:sender:content-type:mime-version:subject:from :in-reply-to:date:content-transfer-encoding:message-id:references:to :x-mailer; bh=Mw/Jp37ZK+3Z89lwNySB8GnZghhVzTKf0D7Z0SrLYTc=; b=Nw6O6iHM6YPAMZ0Z672oC8Uqd2vN9+TFx7yg0Ycy7SP9aF1fLBiPrCEF/FnzTuFq7g 3WE8SMPfANxhXNL6DP+rFS4mEsN5Nvi5OQWpVXeQM7OlOp1iyZufnBJRczdj/9I/EtOp NW0ReZA1kY/4IUr5lDA+FWLnxB4IWS+dgAk0Dp/OQKXBiQ6SlHlFXfMgiJsj/zUvIZPT QClFimIxA9e3gauD+XmUBZW4GL8SJQ41qfR1/4V+lmO8hPhJAVqjshu3L2J2hKdRH0BW vPk+3RoBe9MrmPMDlz/mP9rx4BYsK1x68Qu9pzp5cfuAbxYvk9oPWVvP6ao/16EJxvry VW/g== X-Received: by 10.68.136.97 with SMTP id pz1mr29451668pbb.205.1363020988450; Mon, 11 Mar 2013 09:56:28 -0700 (PDT) Received: from dhcp-54bf.meeting.ietf.org (dhcp-54bf.meeting.ietf.org. [130.129.84.191]) by mx.google.com with ESMTPS id kt5sm21119720pbc.30.2013.03.11.09.56.26 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Mon, 11 Mar 2013 09:56:27 -0700 (PDT) Sender: George Michaelson Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\)) From: George Michaelson In-Reply-To: Date: Mon, 11 Mar 2013 12:56:26 -0400 Content-Transfer-Encoding: 7bit Message-Id: <06F5662B-9687-4BC9-8571-030AC4D30431@algebras.org> References: To: sidr@ietf.org X-Mailer: Apple Mail (2.1499) Subject: Re: [sidr] draft-newton-sidr-policy-qualifiers-01 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2013 16:56:30 -0000 I suport this document being adopted. -George From randy@psg.com Mon Mar 11 10:15:00 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4D0AF11E815A for ; Mon, 11 Mar 2013 10:15:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FFa-cfb8WBZx for ; Mon, 11 Mar 2013 10:14:59 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id D888211E812B for ; Mon, 11 Mar 2013 10:14:59 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.80.1 (FreeBSD)) (envelope-from ) id 1UF6JO-000AxT-86; Mon, 11 Mar 2013 17:14:58 +0000 Date: Mon, 11 Mar 2013 10:14:58 -0700 Message-ID: From: Randy Bush To: George Michaelson In-Reply-To: <06F5662B-9687-4BC9-8571-030AC4D30431@algebras.org> References: <06F5662B-9687-4BC9-8571-030AC4D30431@algebras.org> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Cc: sidr@ietf.org Subject: Re: [sidr] draft-newton-sidr-policy-qualifiers-01 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2013 17:15:00 -0000 > I suport this document being adopted. as do i. we should definitely discuss it. but, as stated previously, i have serious reservations about it. at a minimum, the sec cons must say that the uri can be an attack vector. randy From randy@psg.com Mon Mar 11 10:16:10 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1834111E815A for ; Mon, 11 Mar 2013 10:16:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QAThiTjp9vPI for ; Mon, 11 Mar 2013 10:16:09 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id 8DF7B11E812B for ; Mon, 11 Mar 2013 10:16:09 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.80.1 (FreeBSD)) (envelope-from ) id 1UF6KX-000Ay2-0B; Mon, 11 Mar 2013 17:16:09 +0000 Date: Mon, 11 Mar 2013 10:16:08 -0700 Message-ID: From: Randy Bush To: "Carlos M. Martinez" In-Reply-To: <513DE332.4090406@gmail.com> References: <20130225202309.13536.56264.idtracker@ietfa.amsl.com> <512BC89A.1040603@lacnic.net> <513DE332.4090406@gmail.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Cc: "sidr@ietf.org" Subject: Re: [sidr] Fwd: New Version Notification for draft-rogaglia-sidr-multiple-publication-points-02.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2013 17:16:10 -0000 > As requested by the chairs, I'm sending this email requesting WG > adoption of this item. agree it should be adopted as a wg document so that we can discuss it. this does not imply i [completely] support it becoming an rfc. randy From jcurran@arin.net Mon Mar 11 11:28:47 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 02BB921F8D68 for ; Mon, 11 Mar 2013 11:28:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bU4CQ3ABRVc1 for ; Mon, 11 Mar 2013 11:28:46 -0700 (PDT) Received: from smtp1.arin.net (smtp1.arin.net [IPv6:2001:500:4:13::33]) by ietfa.amsl.com (Postfix) with ESMTP id 2A61A21F8D6A for ; Mon, 11 Mar 2013 11:28:43 -0700 (PDT) Received: by smtp1.arin.net (Postfix, from userid 323) id 0DAE516507D; Mon, 11 Mar 2013 14:28:41 -0400 (EDT) Received: from CHAXCH05.corp.arin.net (chaxch05.corp.arin.net [192.149.252.94]) by smtp1.arin.net (Postfix) with ESMTP id 81EDA165063; Mon, 11 Mar 2013 14:28:40 -0400 (EDT) Received: from CHAXCH03.corp.arin.net (10.1.30.17) by CHAXCH05.corp.arin.net (192.149.252.94) with Microsoft SMTP Server (TLS) id 14.2.328.9; Mon, 11 Mar 2013 14:27:52 -0400 Received: from CHAXCH01.corp.arin.net ([169.254.1.209]) by CHAXCH03.corp.arin.net ([10.1.30.17]) with mapi id 14.02.0328.009; Mon, 11 Mar 2013 14:28:21 -0400 From: John Curran To: Randy Bush Thread-Topic: [sidr] draft-newton-sidr-policy-qualifiers-01 Thread-Index: AQHOHoY1ev93wt/QvUW2z6VZ7FvbmQ== Date: Mon, 11 Mar 2013 18:28:20 +0000 Message-ID: <8DA1853CE466B041B104C1CAEE00B3748F96558B@CHAXCH01.corp.arin.net> References: <06F5662B-9687-4BC9-8571-030AC4D30431@algebras.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [192.149.252.97] Content-Type: text/plain; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: "sidr@ietf.org" Subject: Re: [sidr] draft-newton-sidr-policy-qualifiers-01 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2013 18:28:47 -0000 On Mar 11, 2013, at 1:14 PM, Randy Bush wrote: > but, as stated previously, i have serious reservations about it. at a > minimum, the sec cons must say that the uri can be an attack vector. Such as the following? "RPKI Certificates contain URIs, all of which have potential of being attac= k=20 vectors. An additional policy-qualifier URI adds one more potential vector= =20 for attack, which should be considered before dereferencing it."=20 (or should the first statement above go into the RPKI framework document?) /John From kent@bbn.com Mon Mar 11 12:25:55 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8F06521F8EDF for ; Mon, 11 Mar 2013 12:25:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.599 X-Spam-Level: X-Spam-Status: No, score=-106.599 tagged_above=-999 required=5 tests=[AWL=0.001, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 472VEohvk+9h for ; Mon, 11 Mar 2013 12:25:46 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) by ietfa.amsl.com (Postfix) with ESMTP id CDE7621F8CF0 for ; Mon, 11 Mar 2013 12:25:45 -0700 (PDT) Received: from dommiel.bbn.com ([192.1.122.15]:59667 helo=COMSEC.local) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1UF8Lx-000IMT-0W for sidr@ietf.org; Mon, 11 Mar 2013 15:25:45 -0400 Message-ID: <513E2FB9.3010505@bbn.com> Date: Mon, 11 Mar 2013 15:25:45 -0400 From: Stephen Kent User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20130216 Thunderbird/17.0.3 MIME-Version: 1.0 To: sidr@ietf.org References: <62D9228640AC7F49B2DD9ED0C9CE60E58BBF2611@CHAXCH01.corp.arin.net> <513DEC83.5050908@lacnic.net> In-Reply-To: <513DEC83.5050908@lacnic.net> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [sidr] draft-newton-sidr-policy-qualifiers-01 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2013 19:25:55 -0000 I also support adoption of this draft. Steve From kent@bbn.com Mon Mar 11 12:31:21 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 771FD11E8165 for ; Mon, 11 Mar 2013 12:31:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.598 X-Spam-Level: X-Spam-Status: No, score=-106.598 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LitgKj17MHrS for ; Mon, 11 Mar 2013 12:31:19 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.1.81]) by ietfa.amsl.com (Postfix) with ESMTP id E33F111E820B for ; Mon, 11 Mar 2013 12:31:13 -0700 (PDT) Received: from dommiel.bbn.com ([192.1.122.15]:38985 helo=COMSEC.local) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1UF8RB-0006cV-0C; Mon, 11 Mar 2013 15:31:09 -0400 Message-ID: <513E30FC.1050504@bbn.com> Date: Mon, 11 Mar 2013 15:31:08 -0400 From: Stephen Kent User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20130216 Thunderbird/17.0.3 MIME-Version: 1.0 To: Danny McPherson , sidr References: <24B20D14B2CD29478C8D5D6E9CBB29F65C23437D@Hermes.columbia.ads.sparta.com> <31089dec6d0c4ff57b8ba5e680c6c29b@tcb.net> In-Reply-To: <31089dec6d0c4ff57b8ba5e680c6c29b@tcb.net> Content-Type: multipart/alternative; boundary="------------080808040505050501010009" Subject: Re: [sidr] ORIGINs X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2013 19:31:21 -0000 This is a multi-part message in MIME format. --------------080808040505050501010009 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Danny, We have been told by several operators that the values stated in Section 4.3 of RFC 4271 are not what is used today. We also have been told that, contrary to the "SHOULD NOT" in Section 5.1.1 of this RFC, it is not uncommon for ASes to change this value, en route. Given these two observations, I don't see how one can argue that protecting this attribute via a PATHSEC mechanism makes sense. Separately, there is the issue of whether it makes sense to address the security of the ORIGIN attribute in the threats document. The SIDR charter states that the path security goal is "Is the AS-Path represented in the route the same as the path through ?which the NLRI traveled" There are a variety of other attributes that do not directly support this goal, and which are not being addressed as part of the PATHSEC model. The threats document already addresses this issue, in the Residual Vulnerabilities section. I suggest the following updated text for that section, to better explain the criteria for inclusion and exclusion in that document: PATHSEC is not planned to protect all attributes associated with an AS_PATH,even though some of these attributes may be employed as inputs to routing decisions.Thus attacks that modify (or strip) these other attributes are not prevented/detected by PATHSEC.The SIDR charter calls for protecting only the info needed to verify that a received route traversed the ASes enumerated in the AS_PATH, and that the NLRI in the route is what was advertised.(The AS_PATH data also may have traversed ASes within a confederation that are not represented. However, these ASes are not externally visible, and thus do not influence route selection, so their omission in this context is not a security concern.) Thus, protection of other attributes is outside the scope of the charter, at the time this document was prepared. --------------080808040505050501010009 Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit Danny,

We have been told by several operators that the values stated in Section 4.3 of RFC 4271 are not what is used today. We also have been told that, contrary to the “SHOULD NOT” in Section 5.1.1 of this RFC, it is not uncommon for ASes to change this value, en route. Given these two observations, I don’t see how one can argue that protecting this attribute via a PATHSEC mechanism makes sense.

Separately, there is the issue of whether it makes sense to address the security of the ORIGIN attribute in the threats document. The SIDR charter states that the path security goal is “Is the AS-Path represented in the route the same as the path through 
which the NLRI traveled” There are a variety of other attributes that do not directly support this goal, and which are not being addressed as part of the PATHSEC model. The threats document already addresses this issue, in the Residual Vulnerabilities section. I suggest the following updated text for that section, to better explain the criteria for inclusion and exclusion in that document:

PATHSEC is not planned to protect all attributes associated with an AS_PATH, even though some of these attributes may be employed as inputs to routing decisions.  Thus attacks that modify (or strip) these other attributes are not prevented/detected by PATHSEC.  The SIDR charter calls for protecting only the info needed to verify that a received route traversed the ASes enumerated in the AS_PATH, and that the NLRI in the route is what was advertised.  (The AS_PATH data also may have traversed ASes within a confederation that are not represented. However, these ASes are not externally visible, and thus do not influence route selection, so their omission in this context is not a security concern.) Thus, protection of other attributes is outside the scope of the charter, at the time this document was prepared.
--------------080808040505050501010009-- From danny@tcb.net Mon Mar 11 12:52:24 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3A98021F8EB2 for ; Mon, 11 Mar 2013 12:52:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.437 X-Spam-Level: X-Spam-Status: No, score=-100.437 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ilqW6HL2EEnV for ; Mon, 11 Mar 2013 12:52:23 -0700 (PDT) Received: from mail.friendswithtools.org (unknown [64.78.239.70]) by ietfa.amsl.com (Postfix) with ESMTP id B03DA21F8EA7 for ; Mon, 11 Mar 2013 12:52:23 -0700 (PDT) Received: from dspam (unknown [127.0.0.1]) by mail.friendswithtools.org (Postfix) with SMTP id 58583300089 for ; Mon, 11 Mar 2013 19:52:23 +0000 (UTC) Received: from [10.128.75.22] (mobile-166-147-117-003.mycingular.net [166.147.117.3]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by mail.friendswithtools.org (Postfix) with ESMTPSA id 25802300054 for ; Mon, 11 Mar 2013 13:52:23 -0600 (MDT) References: <62D9228640AC7F49B2DD9ED0C9CE60E58BBF2611@CHAXCH01.corp.arin.net> <513DEC83.5050908@lacnic.net> <513E2FB9.3010505@bbn.com> From: Danny McPherson Content-Type: text/plain; charset=us-ascii X-Mailer: iPhone Mail (10B146) In-Reply-To: <513E2FB9.3010505@bbn.com> Message-Id: Date: Mon, 11 Mar 2013 15:52:22 -0400 To: "sidr@ietf.org" Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (1.0) X-DSPAM-Result: Innocent X-DSPAM-Processed: Mon Mar 11 13:52:23 2013 X-DSPAM-Confidence: 0.9898 X-DSPAM-Improbability: 1 in 9709 chance of being spam X-DSPAM-Probability: 0.0000 X-DSPAM-Signature: 513e35f742071008527203 X-DSPAM-Factors: 27, mailing+list, 0.01000, of+this, 0.01000, sidr+#+org, 0.01000, Subject*Re+sidr, 0.01000, sidr+ietf, 0.01000, ietf+org, 0.01000, On+#+#+#+at, 0.01000, From*danny+tcb.net, 0.01000, Url*ietf, 0.01000, 2013+at, 0.40000, Mar+#+2013, 0.40000, draft+#+#+mailing, 0.40000, adoption+#+#+draft, 0.40000, also+#+#+#+this, 0.40000, 2013+#+#+25, 0.40000, Stephen+Kent, 0.40000, Mar+11, 0.40000, To*sidr+#+sidr, 0.40000, wrote+I, 0.40000, com+#+I, 0.40000, 11+#+#+3, 0.40000, of+#+#+#+sidr, 0.40000, PM+Stephen, 0.40000, also+#+adoption, 0.40000, support+#+of, 0.40000, draft+#+sidr, 0.40000, at+#+#+PM, 0.40000 Subject: Re: [sidr] draft-newton-sidr-policy-qualifiers-01 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2013 19:52:24 -0000 Me too... On Mar 11, 2013, at 3:25 PM, Stephen Kent wrote: > I also support adoption of this draft. > > Steve > > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From markk@arin.net Mon Mar 11 12:54:42 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B545E21F8EE7 for ; Mon, 11 Mar 2013 12:54:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.599 X-Spam-Level: X-Spam-Status: No, score=-10.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z1YB2YKBDbtC for ; Mon, 11 Mar 2013 12:54:42 -0700 (PDT) Received: from smtp2.arin.net (smtp2.arin.net [192.149.252.32]) by ietfa.amsl.com (Postfix) with ESMTP id 1695C21F8E99 for ; Mon, 11 Mar 2013 12:54:42 -0700 (PDT) Received: by smtp2.arin.net (Postfix, from userid 323) id BD70C21369A; Mon, 11 Mar 2013 15:54:11 -0400 (EDT) Received: from CHAXCH05.corp.arin.net (chaxch05.corp.arin.net [192.149.252.94]) by smtp2.arin.net (Postfix) with ESMTP id 5924B21364E; Mon, 11 Mar 2013 15:54:11 -0400 (EDT) Received: from CHAXCH04.corp.arin.net (10.1.30.19) by CHAXCH05.corp.arin.net (192.149.252.94) with Microsoft SMTP Server (TLS) id 14.2.328.9; Mon, 11 Mar 2013 15:53:23 -0400 Received: from CHAXCH01.corp.arin.net ([169.254.1.209]) by CHAXCH04.corp.arin.net ([10.1.30.19]) with mapi id 14.02.0328.009; Mon, 11 Mar 2013 15:53:52 -0400 From: Mark Kosters To: George Michaelson , "sidr@ietf.org" Thread-Topic: [sidr] draft-newton-sidr-policy-qualifiers-01 Thread-Index: AQHOHl8kwuRwtzTGHkOVcbq8PhG+R5ig+QwA////TwA= Date: Mon, 11 Mar 2013 19:53:51 +0000 Message-ID: <942A93A955E676498483E4F3CBD297C38CF6C268@CHAXCH01.corp.arin.net> In-Reply-To: <06F5662B-9687-4BC9-8571-030AC4D30431@algebras.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.3.1.130117 x-originating-ip: [192.149.252.96] Content-Type: text/plain; charset="us-ascii" Content-ID: <1C086CA3494A074481FF6C275AD6D0A8@corp.arin.net> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [sidr] draft-newton-sidr-policy-qualifiers-01 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2013 19:54:42 -0000 I do as well. Mark On 3/11/13 12:56 PM, "George Michaelson" wrote: >I suport this document being adopted. From alexey.melnikov@isode.com Mon Mar 11 13:40:25 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BA8D321F9050 for ; Mon, 11 Mar 2013 13:40:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.228 X-Spam-Level: X-Spam-Status: No, score=-102.228 tagged_above=-999 required=5 tests=[AWL=0.327, BAYES_00=-2.599, DATE_IN_PAST_03_06=0.044, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y8H8EB+i-shx for ; Mon, 11 Mar 2013 13:40:25 -0700 (PDT) Received: from waldorf.isode.com (cl-125.lon-03.gb.sixxs.net [IPv6:2a00:14f0:e000:7c::2]) by ietfa.amsl.com (Postfix) with ESMTP id 1DBA421F8F14 for ; Mon, 11 Mar 2013 13:40:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; t=1363034424; d=isode.com; s=selector; i=@isode.com; bh=iy3lMcDDU27/ydkz39X40sWWNlka0egi073N7jb+EEc=; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version: In-Reply-To:References:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description; b=HrY5umNnaD/fGD+6/VyeMuKg+Lj3hoVxT3GjtKJVtnhVkPfwcNbLNW9fw2PctvEvFBB0CP q/EbJjQLoJs2bLhV4hwLBxAdowLf+nZ4ygLFE0snYdiuPFaTNFD6H1hCwFXh6/U0Zx4kmu iC2xOIbN905Y4VkXk9dFFFeFeRkMezA=; Received: from [130.129.18.89] (dhcp-1259.meeting.ietf.org [130.129.18.89]) by waldorf.isode.com (submission channel) via TCP with ESMTPA id ; Mon, 11 Mar 2013 20:40:24 +0000 Message-ID: <513DFA0A.9000007@isode.com> Date: Mon, 11 Mar 2013 15:36:42 +0000 From: Alexey Melnikov User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:13.0) Gecko/20120614 Thunderbird/13.0.1 To: "sidr@ietf.org" References: <62D9228640AC7F49B2DD9ED0C9CE60E58BBF2611@CHAXCH01.corp.arin.net> In-Reply-To: <62D9228640AC7F49B2DD9ED0C9CE60E58BBF2611@CHAXCH01.corp.arin.net> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: [sidr] Acceptance call for draft-newton-sidr-policy-qualifiers-01 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2013 20:40:25 -0000 On 11/03/2013 13:54, Andy Newton wrote: > On 3/11/13 9:48 AM, "Matthew Lepinski" wrote: > >> This seems like quite a reasonable document, and I do not anticipate >> that it would take a lot of working group cycles to process this >> document. I would, therefore, support adoption of this document by the >> working group. > Thank you Matt. And since you beat me to getting a message to the list > regarding the adoption of this draft, I would like to ask the working > group to adopt this draft as a work item. On behalf of SIDR chairs I am starting 3 weeks WG acceptance call on this document. From heas@shrubbery.net Mon Mar 11 13:46:23 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 90A2D21F9044 for ; Mon, 11 Mar 2013 13:46:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OYTpZBdNz-s1 for ; Mon, 11 Mar 2013 13:46:23 -0700 (PDT) Received: from guelah.shrubbery.net (guelah.shrubbery.net [198.58.5.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2AC4221F9039 for ; Mon, 11 Mar 2013 13:46:23 -0700 (PDT) Received: by guelah.shrubbery.net (Postfix, from userid 7053) id 022F9AC93; Mon, 11 Mar 2013 20:46:23 +0000 (UTC) Date: Mon, 11 Mar 2013 20:46:23 +0000 From: heasley To: sidr@ietf.org Message-ID: <20130311204623.GT14869@shrubbery.net> References: <24B20D14B2CD29478C8D5D6E9CBB29F65C23437D@Hermes.columbia.ads.sparta.com> <31089dec6d0c4ff57b8ba5e680c6c29b@tcb.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <31089dec6d0c4ff57b8ba5e680c6c29b@tcb.net> X-PGPkey: http://www.shrubbery.net/~heas/public-key.asc X-note: live free, or die! X-homer: i just want to have a beer while i am caring. X-Claimation: an engineer needs a manager like a fish needs a bicycle X-reality: only YOU can put an end to the embarrassment that is Tom Cruise User-Agent: Mutt/1.5.21 (2010-09-15) Subject: Re: [sidr] ORIGINs X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2013 20:46:23 -0000 Sun, Mar 10, 2013 at 10:00:53AM -0600, Danny McPherson: > The origin AS sets the value of the attribute to whatever THEY desire > -- the concern was that upstream ASes can manipulate this to launch > "traffic attraction attacks". This happens today with some of our > transit providers, and we'd like the option to be able to mitigate that > attack if we're going to put a bunch of stuff in place to secure > inter-domain routing on the Internet. Whether anyone likes it, it has become a TE knob of sorts, in a protocol with few such knobs, and many smaller transit providers rely upon it to affect route selection for non-malicious reasons, such as to balance their own transit links. Without providing an alternative, it will be crippling to many to inhibit its use as such. From internet-drafts@ietf.org Mon Mar 11 14:52:33 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6241F21F9034; Mon, 11 Mar 2013 14:52:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.504 X-Spam-Level: X-Spam-Status: No, score=-102.504 tagged_above=-999 required=5 tests=[AWL=0.096, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VHpGZuINh4DS; Mon, 11 Mar 2013 14:52:32 -0700 (PDT) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 7EE0621F903C; Mon, 11 Mar 2013 14:52:32 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: internet-drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 4.42 Message-ID: <20130311215232.11462.89440.idtracker@ietfa.amsl.com> Date: Mon, 11 Mar 2013 14:52:32 -0700 Cc: sidr@ietf.org Subject: [sidr] I-D Action: draft-ietf-sidr-rpki-rtr-impl-03.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2013 21:52:33 -0000 A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the Secure Inter-Domain Routing Working Group= of the IETF. Title : RPKI Router Implementation Report Author(s) : Randy Bush Rob Austein Keyur Patel Hannes Gredler Matthias Waehlisch Filename : draft-ietf-sidr-rpki-rtr-impl-03.txt Pages : 9 Date : 2013-03-11 Abstract: This document is an implementation report for the RPKI Router protocol as defined in [RFC6810]. The editor did not verify the accuracy of the information provided by respondents. The respondents are experts with the implementations they reported on, and their responses are considered authoritative for the implementations for which their responses represent. Respondents were asked to only use the YES answer if the feature had at least been tested in the lab. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-sidr-rpki-rtr-impl There's also a htmlized version available at: http://tools.ietf.org/html/draft-ietf-sidr-rpki-rtr-impl-03 A diff from the previous version is available at: http://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-sidr-rpki-rtr-impl-03 Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From randy@psg.com Mon Mar 11 15:45:18 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EAFC221F8F28 for ; Mon, 11 Mar 2013 15:45:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tC5pHrT1Xl8h for ; Mon, 11 Mar 2013 15:45:18 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id 9054121F9033 for ; Mon, 11 Mar 2013 15:45:18 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.80.1 (FreeBSD)) (envelope-from ) id 1UFBT3-000C6P-9E; Mon, 11 Mar 2013 22:45:17 +0000 Date: Mon, 11 Mar 2013 15:45:17 -0700 Message-ID: From: Randy Bush To: heasley In-Reply-To: <20130311204623.GT14869@shrubbery.net> References: <24B20D14B2CD29478C8D5D6E9CBB29F65C23437D@Hermes.columbia.ads.sparta.com> <31089dec6d0c4ff57b8ba5e680c6c29b@tcb.net> <20130311204623.GT14869@shrubbery.net> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Cc: sidr@ietf.org Subject: Re: [sidr] ORIGINs X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2013 22:45:19 -0000 heas, > Whether anyone likes it, it has become a TE knob of sorts, in a protocol > with few such knobs, and many smaller transit providers rely upon it to > affect route selection for non-malicious reasons, such as to balance their > own transit links. Without providing an alternative, it will be crippling > to many to inhibit its use as such. that is not exactly the qestion, thought i gives a hint. by "smaller transit providers rely on it" do you mean that the value is legitimately set or altered by other than the originating AS? if so, then signing it would be bad. if not, it could be good. so could you please clarify? randy From heas@shrubbery.net Mon Mar 11 15:47:47 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7A65B21F90A4 for ; Mon, 11 Mar 2013 15:47:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S76ibcXDl0XU for ; Mon, 11 Mar 2013 15:47:46 -0700 (PDT) Received: from guelah.shrubbery.net (guelah.shrubbery.net [198.58.5.1]) by ietfa.amsl.com (Postfix) with ESMTP id 006A421F8E72 for ; Mon, 11 Mar 2013 15:47:45 -0700 (PDT) Received: by guelah.shrubbery.net (Postfix, from userid 7053) id 20326A298; Mon, 11 Mar 2013 22:47:38 +0000 (UTC) Date: Mon, 11 Mar 2013 22:47:38 +0000 From: heasley To: Randy Bush Message-ID: <20130311224738.GM14869@shrubbery.net> References: <24B20D14B2CD29478C8D5D6E9CBB29F65C23437D@Hermes.columbia.ads.sparta.com> <31089dec6d0c4ff57b8ba5e680c6c29b@tcb.net> <20130311204623.GT14869@shrubbery.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-PGPkey: http://www.shrubbery.net/~heas/public-key.asc X-note: live free, or die! X-homer: i just want to have a beer while i am caring. X-Claimation: an engineer needs a manager like a fish needs a bicycle X-reality: only YOU can put an end to the embarrassment that is Tom Cruise User-Agent: Mutt/1.5.21 (2010-09-15) Cc: sidr@ietf.org Subject: Re: [sidr] ORIGINs X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2013 22:47:47 -0000 Mon, Mar 11, 2013 at 03:45:17PM -0700, Randy Bush: > heas, > > > Whether anyone likes it, it has become a TE knob of sorts, in a protocol > > with few such knobs, and many smaller transit providers rely upon it to > > affect route selection for non-malicious reasons, such as to balance their > > own transit links. Without providing an alternative, it will be crippling > > to many to inhibit its use as such. > > that is not exactly the qestion, thought i gives a hint. by "smaller > transit providers rely on it" do you mean that the value is legitimately > set or altered by other than the originating AS? if so, then signing it > would be bad. if not, it could be good. so could you please clarify? that is exactly what I am implying/saying. From mlepinski.ietf@gmail.com Mon Mar 11 15:59:34 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 433E721F8E12 for ; Mon, 11 Mar 2013 15:59:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599, HTML_MESSAGE=0.001, NO_RELAYS=-0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jylJfarZQmiO for ; Mon, 11 Mar 2013 15:59:33 -0700 (PDT) Received: from mail-qc0-x22d.google.com (mail-qc0-x22d.google.com [IPv6:2607:f8b0:400d:c01::22d]) by ietfa.amsl.com (Postfix) with ESMTP id 7819F21F8C7A for ; Mon, 11 Mar 2013 15:59:33 -0700 (PDT) Received: by mail-qc0-f173.google.com with SMTP id b12so1760135qca.18 for ; Mon, 11 Mar 2013 15:59:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:x-received:reply-to:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=i5rtXOxU2nCw8Z/3YUijJ/duCs/axtnAT5CRFLCw/64=; b=G7spC2DYYlHUt7Y8uQ2bF1Vhdv0ONRyjGUvimLr7BJd7nBTW8UlB91hYTIsd4gmGXS fjse5gZRgHcBQgIdAkSuyiJ4A74+KzfQv7XAu4b0BIC24BbvLyYlYAY/q0g95wcjulMy AwbUA6e0H98KBKpBSAZz+UwalDbYMA0ZV4MF4U+r0nrRI1JIGn+7CwwaIG+hOERQCjgw PNxcLZSMeExprsW3ELaP+ACfCF8S19ePoHehEZMhdrYOd3w4YZ+BXN1Ilqwm2aftzfEM Bgt5K0c3npE1qeUagftfBmEFOdNh2gtqGxnk7JgXs4KfgWm7TVNVbwpwI6JsmwnSoks+ tWkw== MIME-Version: 1.0 X-Received: by 10.49.94.238 with SMTP id df14mr21790859qeb.44.1363042773023; Mon, 11 Mar 2013 15:59:33 -0700 (PDT) Received: by 10.49.129.196 with HTTP; Mon, 11 Mar 2013 15:59:32 -0700 (PDT) Received: by 10.49.129.196 with HTTP; Mon, 11 Mar 2013 15:59:32 -0700 (PDT) In-Reply-To: <20130311224738.GM14869@shrubbery.net> References: <24B20D14B2CD29478C8D5D6E9CBB29F65C23437D@Hermes.columbia.ads.sparta.com> <31089dec6d0c4ff57b8ba5e680c6c29b@tcb.net> <20130311204623.GT14869@shrubbery.net> <20130311224738.GM14869@shrubbery.net> Date: Mon, 11 Mar 2013 18:59:32 -0400 Message-ID: From: Matthew Lepinski To: heasley Content-Type: multipart/alternative; boundary=047d7b67893a4cc5d004d7ae2067 Cc: sidr@ietf.org Subject: Re: [sidr] ORIGINs X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: nomcom-chair@ietf.org List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2013 22:59:34 -0000 --047d7b67893a4cc5d004d7ae2067 Content-Type: text/plain; charset=ISO-8859-1 I do not have an opinion about what in particular the Threats document should say (or not say) about the ORIGIN attribute. However, I am quite concerned about potential hurdles to BGPSEC deployment. It appears that breaking a current (non- standard) use of ORIGIN had little if any benefit since no one seems to use ORIGIN for its originally intended purpose. Therefore, I would like not create a new reason for some operators to deploy BGPSEC. -Matt L. On Mar 11, 2013 6:47 PM, "heasley" wrote: > Mon, Mar 11, 2013 at 03:45:17PM -0700, Randy Bush: > > heas, > > > > > Whether anyone likes it, it has become a TE knob of sorts, in a > protocol > > > with few such knobs, and many smaller transit providers rely upon it to > > > affect route selection for non-malicious reasons, such as to balance > their > > > own transit links. Without providing an alternative, it will be > crippling > > > to many to inhibit its use as such. > > > > that is not exactly the qestion, thought i gives a hint. by "smaller > > transit providers rely on it" do you mean that the value is legitimately > > set or altered by other than the originating AS? if so, then signing it > > would be bad. if not, it could be good. so could you please clarify? > > that is exactly what I am implying/saying. > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > --047d7b67893a4cc5d004d7ae2067 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable

I do not have an opinion about what in particular the Threat= s document should say (or not say) about the ORIGIN attribute. However, I a= m quite concerned about potential hurdles to BGPSEC deployment. It appears = that breaking a current (non- standard) use of ORIGIN had little if any ben= efit since no one seems to use ORIGIN for its originally intended purpose. = Therefore, I would like not create a new reason for some operators to deplo= y BGPSEC.

-Matt L.

On Mar 11, 2013 6:47 PM, "heasley" <= ;heas@shrubbery.net> wrote:
Mon, Mar 11, 2013 at 03:45:17PM -0700, Randy Bush:
> heas,
>
> > Whether anyone likes it, it has become a TE knob of sorts, in a p= rotocol
> > with few such knobs, and many smaller transit providers rely upon= it to
> > affect route selection for non-malicious reasons, such as to bala= nce their
> > own transit links. =A0Without providing an alternative, it will b= e crippling
> > to many to inhibit its use as such.
>
> that is not exactly the qestion, thought i gives a hint. =A0by "s= maller
> transit providers rely on it" do you mean that the value is legit= imately
> set or altered by other than the originating AS? =A0if so, then signin= g it
> would be bad. =A0if not, it could be good. =A0so could you please clar= ify?

that is exactly what I am implying/saying.
_______________________________________________
sidr mailing list
sidr@ietf.org
ht= tps://www.ietf.org/mailman/listinfo/sidr
--047d7b67893a4cc5d004d7ae2067-- From Sandra.Murphy@sparta.com Mon Mar 11 16:05:39 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1789421F8FDF for ; Mon, 11 Mar 2013 16:05:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.773 X-Spam-Level: X-Spam-Status: No, score=-102.773 tagged_above=-999 required=5 tests=[AWL=-0.175, BAYES_00=-2.599, HTML_MESSAGE=0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nuFV2vsuAX3Z for ; Mon, 11 Mar 2013 16:05:38 -0700 (PDT) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by ietfa.amsl.com (Postfix) with ESMTP id 6FDEB21F8C69 for ; Mon, 11 Mar 2013 16:05:38 -0700 (PDT) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.14.4/8.14.4) with ESMTP id r2BN5bhT005385 for ; Mon, 11 Mar 2013 18:05:37 -0500 Received: from Hermes.columbia.ads.sparta.com ([10.62.56.107]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id r2BN5WBb018094 for ; Mon, 11 Mar 2013 18:05:32 -0500 Received: from HERMES.columbia.ads.sparta.com ([fe80::e4a8:a383:2128:c0e5]) by Hermes.columbia.ads.sparta.com ([fe80::e4a8:a383:2128:c0e5%18]) with mapi id 14.02.0247.003; Mon, 11 Mar 2013 19:04:44 -0400 From: "Murphy, Sandra" To: "sidr@ietf.org" Thread-Topic: [sidr] ORIGINs Thread-Index: AQHOHCfs3cfQG/cxxkuNsRMS+Ut9i5ifW6CAgAHiGYCAACE5gIAAAKgAgAADUwD//73bFw== Date: Mon, 11 Mar 2013 23:04:44 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F65C234F82@Hermes.columbia.ads.sparta.com> References: <24B20D14B2CD29478C8D5D6E9CBB29F65C23437D@Hermes.columbia.ads.sparta.com> <31089dec6d0c4ff57b8ba5e680c6c29b@tcb.net> <20130311204623.GT14869@shrubbery.net> <20130311224738.GM14869@shrubbery.net>, In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.118] Content-Type: multipart/alternative; boundary="_000_24B20D14B2CD29478C8D5D6E9CBB29F65C234F82Hermescolumbiaa_" MIME-Version: 1.0 Subject: Re: [sidr] ORIGINs X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2013 23:05:39 -0000 --_000_24B20D14B2CD29478C8D5D6E9CBB29F65C234F82Hermescolumbiaa_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable >Therefore, I would like not create a new reason for some operators to depl= oy BGPSEC. >From the tone of the remarks preceding this sentence, it seems that you mig= ht have misplaced a "not" in here somewhere. Could you clarify? --Sandy --_000_24B20D14B2CD29478C8D5D6E9CBB29F65C234F82Hermescolumbiaa_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
>Therefore= , I would like not create a new reason for some operators to deploy BGPSEC.=

From the tone of the remarks preceding= this sentence, it seems that you might have misplaced a "not" in= here somewhere.

Could you clarify?

--Sandy

--_000_24B20D14B2CD29478C8D5D6E9CBB29F65C234F82Hermescolumbiaa_-- From Sandra.Murphy@sparta.com Mon Mar 11 16:16:24 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5FCC011E8127 for ; Mon, 11 Mar 2013 16:16:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.77 X-Spam-Level: X-Spam-Status: No, score=-102.77 tagged_above=-999 required=5 tests=[AWL=-0.171, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NCA3EGiYQ9ql for ; Mon, 11 Mar 2013 16:16:23 -0700 (PDT) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by ietfa.amsl.com (Postfix) with ESMTP id CB1DC11E8112 for ; Mon, 11 Mar 2013 16:16:23 -0700 (PDT) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.14.4/8.14.4) with ESMTP id r2BNGNLo005425 for ; Mon, 11 Mar 2013 18:16:23 -0500 Received: from Hermes.columbia.ads.sparta.com ([10.62.56.107]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id r2BNGN5l018243 for ; Mon, 11 Mar 2013 18:16:23 -0500 Received: from HERMES.columbia.ads.sparta.com ([fe80::e4a8:a383:2128:c0e5]) by Hermes.columbia.ads.sparta.com ([fe80::e4a8:a383:2128:c0e5%18]) with mapi id 14.02.0247.003; Mon, 11 Mar 2013 19:15:35 -0400 From: "Murphy, Sandra" To: "sidr@ietf.org" Thread-Topic: old discussion on ORIGIN Thread-Index: Ac4ereLJQWnxQrKkQmGeD3vSh60GdQ== Date: Mon, 11 Mar 2013 23:15:34 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F65C234FA2@Hermes.columbia.ads.sparta.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.118] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: [sidr] old discussion on ORIGIN X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2013 23:16:24 -0000 I'd like to point the wg to a previous discussion of the use of ORIGIN over= a few days in October 2012. We're revisiting some of the same ground now.= =0A= =0A= Start with http://www.ietf.org/mail-archive/web/sidr/current/msg05179.html = and follow the thread "origin attribute". It was a short but intense discu= ssion, with Shane, Warren, Heasley, Roque and Brian describing some ways th= at the ORIGIN is currently used by operators.=0A= =0A= --Sandy, speaking as one of the wg co-chairs=0A= =0A= From mlepinski.ietf@gmail.com Mon Mar 11 17:33:05 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0609421F8D10 for ; Mon, 11 Mar 2013 17:33:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.449 X-Spam-Level: X-Spam-Status: No, score=-3.449 tagged_above=-999 required=5 tests=[AWL=0.149, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8Cty7zZhfyK2 for ; Mon, 11 Mar 2013 17:33:04 -0700 (PDT) Received: from mail-qa0-f48.google.com (mail-qa0-f48.google.com [209.85.216.48]) by ietfa.amsl.com (Postfix) with ESMTP id 6987021F8AA1 for ; Mon, 11 Mar 2013 17:33:04 -0700 (PDT) Received: by mail-qa0-f48.google.com with SMTP id j8so1309460qah.7 for ; Mon, 11 Mar 2013 17:33:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:x-received:reply-to:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=rP0vs9w7u05N46s/j7ZGSa/o2klkc+Nr87EGGNesDIQ=; b=JJYyZlDtF1a6GHHwkpZw8U5/pmQyLPpNpD/70FxmhB5MCbEG/nvDl6Rx1lAc8wY73y bRgBwweyk87JkvGqgr6rIjv25puxIkK2jmhdnHjjCscicZOx65du8ouVQch60b1eKk0i IoXs+sTGn/EEaR1XUFNNGriFFjp/n/l7p3Vn6wvueb9m/tlbTIAew8Cwl9mZbg8+LomG XxqnTcRAJ0T0bfrwoHL7G8IMA3/H/8eh3NFkZl4kPVMaXP+IbrqV6mnR50QV9t36EVom yhZbYobsVSPqw/hemASL0KLm+ClD7ClCdX5+SCBKzMkmU0q4DiVGuNvgRlmIgUkq4MFa Hhow== MIME-Version: 1.0 X-Received: by 10.224.207.72 with SMTP id fx8mr19776096qab.66.1363048383779; Mon, 11 Mar 2013 17:33:03 -0700 (PDT) Received: by 10.49.129.196 with HTTP; Mon, 11 Mar 2013 17:33:03 -0700 (PDT) Received: by 10.49.129.196 with HTTP; Mon, 11 Mar 2013 17:33:03 -0700 (PDT) In-Reply-To: <24B20D14B2CD29478C8D5D6E9CBB29F65C234F82@Hermes.columbia.ads.sparta.com> References: <24B20D14B2CD29478C8D5D6E9CBB29F65C23437D@Hermes.columbia.ads.sparta.com> <31089dec6d0c4ff57b8ba5e680c6c29b@tcb.net> <20130311204623.GT14869@shrubbery.net> <20130311224738.GM14869@shrubbery.net> <24B20D14B2CD29478C8D5D6E9CBB29F65C234F82@Hermes.columbia.ads.sparta.com> Date: Mon, 11 Mar 2013 20:33:03 -0400 Message-ID: From: Matthew Lepinski To: "Murphy, Sandra" Content-Type: multipart/alternative; boundary=20cf300fb4cdba18f004d7af6e64 Cc: "sidr@ietf.org" Subject: Re: [sidr] ORIGINs X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: nomcom-chair@ietf.org List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2013 00:33:05 -0000 --20cf300fb4cdba18f004d7af6e64 Content-Type: text/plain; charset=ISO-8859-1 I am sorry. "I do not want to sign ORIGIN if doing so will create a new obstacle to deploying BGPSEC" On Mar 11, 2013 7:05 PM, "Murphy, Sandra" wrote: > >Therefore, I would like not create a new reason for some operators to > deploy BGPSEC. > > From the tone of the remarks preceding this sentence, it seems that you > might have misplaced a "not" in here somewhere. > > Could you clarify? > > --Sandy > >> >> > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > > --20cf300fb4cdba18f004d7af6e64 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable

I am sorry.

"I do not want to sign ORIGIN if doing so will create a= new obstacle to deploying BGPSEC"

On Mar 11, 2013 7:05 PM, "Murphy, Sandra&qu= ot; <Sandra.Murphy@sparta.co= m> wrote:
>Therefore, I would like not cre= ate a new reason for some operators to deploy BGPSEC.

From the tone of the remarks preceding= this sentence, it seems that you might have misplaced a "not" in= here somewhere.

Could you clarify?

--Sandy


_______________________________________________
sidr mailing list
sidr@ietf.org
ht= tps://www.ietf.org/mailman/listinfo/sidr

--20cf300fb4cdba18f004d7af6e64-- From danny@tcb.net Mon Mar 11 20:17:32 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B751821F87D1 for ; Mon, 11 Mar 2013 20:17:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.205 X-Spam-Level: X-Spam-Status: No, score=-100.205 tagged_above=-999 required=5 tests=[AWL=0.232, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f5WO5z6Z6Anh for ; Mon, 11 Mar 2013 20:17:32 -0700 (PDT) Received: from mail.friendswithtools.org (unknown [64.78.239.70]) by ietfa.amsl.com (Postfix) with ESMTP id 2B32A21F87CB for ; Mon, 11 Mar 2013 20:17:32 -0700 (PDT) Received: from dspam (unknown [127.0.0.1]) by mail.friendswithtools.org (Postfix) with SMTP id 8E5AC300021 for ; Tue, 12 Mar 2013 03:17:31 +0000 (UTC) Received: from mail2.tcb.net (localhost [127.0.0.1]) by mail.friendswithtools.org (Postfix) with ESMTP id 65F64300015 for ; Mon, 11 Mar 2013 21:17:31 -0600 (MDT) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Date: Mon, 11 Mar 2013 21:17:31 -0600 From: Danny McPherson To: In-Reply-To: References: <24B20D14B2CD29478C8D5D6E9CBB29F65C23437D@Hermes.columbia.ads.sparta.com> <31089dec6d0c4ff57b8ba5e680c6c29b@tcb.net> <20130311204623.GT14869@shrubbery.net> <20130311224738.GM14869@shrubbery.net> <24B20D14B2CD29478C8D5D6E9CBB29F65C234F82@Hermes.columbia.ads.sparta.com> Message-ID: X-Sender: danny@tcb.net User-Agent: Roundcube Webmail/0.8.2 X-DSPAM-Result: Innocent X-DSPAM-Processed: Mon Mar 11 21:17:31 2013 X-DSPAM-Confidence: 0.9898 X-DSPAM-Improbability: 1 in 9709 chance of being spam X-DSPAM-Probability: 0.0000 X-DSPAM-Signature: 513e9e4b42073274754564 X-DSPAM-Factors: 27, to+#+the, 0.01000, a+#+#+to, 0.01000, To*sidr+ietf.org, 0.01000, that+the, 0.01000, From*Danny+#+danny, 0.01000, From*Danny+#+#+tcb.net, 0.01000, Subject*Re+sidr, 0.01000, I+#+#+#+to, 0.01000, From*Danny+McPherson, 0.01000, of+the, 0.01000, of+the, 0.01000, a+#+#+the, 0.01000, From*McPherson+danny, 0.01000, From*Danny McPherson , 0.01000, From*McPherson+#+tcb.net, 0.01000, From*danny+tcb.net, 0.01000, am+#+#+#+not, 0.40000, AS+#+#+one, 0.40000, gotta+believe, 0.40000, that's+#+positive, 0.40000, by+#+#+#+is, 0.40000, that+are, 0.40000, a+#+#+deploy, 0.40000, would+#+#+#+while, 0.40000, a+#+obstacle, 0.40000, the+#+#+#+by, 0.40000, others+#+well, 0.40000 Subject: Re: [sidr] ORIGINs X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2013 03:17:32 -0000 On 2013-03-11 18:33, Matthew Lepinski wrote: > I am sorry. > > "I do not want to sign ORIGIN if doing so will create a new obstacle > to deploying BGPSEC" And I'm saying that the ability (i.e., option) to protect the ORIGIN as set by the originating AS is IMO one reason that's a positive to deploy BGPSEC for me (i.e., to minimize traffic attraction attacks and hose me as a stub for the ASes we have that are stub ASes). If 84% of the ASes are stubs, I gotta believe some of the others would agree with this, while I certainly understand why intermediate ASes want to muck with it. If others disagree, well, I'm at peace with that... -danny From danny@tcb.net Mon Mar 11 20:34:47 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5385521F88E3 for ; Mon, 11 Mar 2013 20:34:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.251 X-Spam-Level: X-Spam-Status: No, score=-100.251 tagged_above=-999 required=5 tests=[AWL=0.186, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cVeX3CCgtB6v for ; Mon, 11 Mar 2013 20:34:46 -0700 (PDT) Received: from mail.friendswithtools.org (unknown [64.78.239.70]) by ietfa.amsl.com (Postfix) with ESMTP id B6A6521F85BF for ; Mon, 11 Mar 2013 20:34:31 -0700 (PDT) Received: from dspam (unknown [127.0.0.1]) by mail.friendswithtools.org (Postfix) with SMTP id 71849300027 for ; Tue, 12 Mar 2013 03:34:31 +0000 (UTC) Received: from mail2.tcb.net (localhost [127.0.0.1]) by mail.friendswithtools.org (Postfix) with ESMTP id D5657300021; Mon, 11 Mar 2013 21:34:30 -0600 (MDT) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Date: Mon, 11 Mar 2013 21:34:30 -0600 From: Danny McPherson To: Stephen Kent In-Reply-To: <513E30FC.1050504@bbn.com> References: <24B20D14B2CD29478C8D5D6E9CBB29F65C23437D@Hermes.columbia.ads.sparta.com> <31089dec6d0c4ff57b8ba5e680c6c29b@tcb.net> <513E30FC.1050504@bbn.com> Message-ID: <58e88a56a071774a598154fbe4e6d8d8@tcb.net> X-Sender: danny@tcb.net User-Agent: Roundcube Webmail/0.8.2 X-DSPAM-Result: Innocent X-DSPAM-Processed: Mon Mar 11 21:34:31 2013 X-DSPAM-Confidence: 0.9899 X-DSPAM-Improbability: 1 in 9809 chance of being spam X-DSPAM-Probability: 0.0000 X-DSPAM-Signature: 513ea24742079045419400 X-DSPAM-Factors: 27, to+#+the, 0.01000, to+#+the, 0.01000, not+be, 0.01000, and+#+the, 0.01000, for+#+#+the, 0.01000, are+not, 0.01000, are+not, 0.01000, the+#+#+of, 0.01000, is+#+#+of, 0.01000, of+this, 0.01000, are+#+#+#+of, 0.01000, that+#+not, 0.01000, that+#+not, 0.01000, the+#+of, 0.01000, the+#+of, 0.01000, that+the, 0.01000, that+the, 0.01000, is+#+a, 0.01000, the+#+#+#+is, 0.01000, a+#+#+#+to, 0.01000, to+#+#+#+attacks, 0.01000, to+#+#+#+attacks, 0.01000, From*Danny+#+danny, 0.01000, From*Danny+#+#+tcb.net, 0.01000, of+#+#+the, 0.01000, to+#+#+the, 0.01000, to+#+#+the, 0.01000 Cc: sidr Subject: Re: [sidr] ORIGINs X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2013 03:34:47 -0000 On 2013-03-11 13:31, Stephen Kent wrote: > Danny, > > We have been told by several operators that the values stated in > Section 4.3 of RFC 4271 are not what is used today. We also have been > told that, contrary to the "SHOULD NOT" in Section 5.1.1 of this RFC, > it is not uncommon for ASes to change this value, en route. Given > these two observations, I don't see how one can argue that protecting > this attribute via a PATHSEC mechanism makes sense. 84% of ASes are stubs, apparently. Many of our own ASes are stubs and we buy transit services in some places from some of the ISPs that like to muck with the ORIGIN code to exploit traffic attraction attacks. I'd like a secure routing protocol to be derived from requirements that accommodate issues that both ISPs and stub ASes are concerned with. That's what I'd like as an operator. If this is yet another thing that you believe is beyond the scope of SIDR because the current BGPSEC spec doesn't accommodate it then why don't we stop pretending to be writing threats and requirements documents and you just publish your BGPSEC spec? > Separately, there is the issue of whether it makes sense to address > the security of the ORIGIN attribute in the threats document. The > SIDR > charter states that the path security goal is "Is the AS-Path > represented in the route the same as the path through 
which the NLRI > traveled" Careful, I'm not sure the current BGPSEC spec does that at all for the "AS_PATH", and it actually diverges in some places. If you're going to use the charter again to nix this requirement as an acceptable residual vulnerability in the threats draft then it's crystal clear to me that you and the BGPSEC design team simply want to publish the BGPSEC draft as you've already envisioned and you don't want to accommodate my operational requirements. If that's the case then let's just kill the threats and requirements documents and save everyone's time. > There are a variety of other attributes that do not directly > support this goal, and which are not being addressed as part of the > PATHSEC model. Right, and I think they should be, as they all impact BGP path selection in various ways. > The threats document already addresses this issue, in > the Residual Vulnerabilities section. Out of curiosity, does anyone intend to ever address the growing list of "residual vulnerabilities" or is this merely a place to catalog requirements that would rather not be addressed? > I suggest the following updated > text for that section, to better explain the criteria for inclusion > and exclusion in that document: > > PATHSEC is not planned to protect all attributes associated with an > AS_PATH, even though some of these attributes may be employed as > inputs to routing decisions. Thus attacks that modify (or strip) > these > other attributes are not prevented/detected by PATHSEC. The SIDR > charter calls for protecting only the info needed to verify that a > received route traversed the ASes enumerated in the AS_PATH, and that > the NLRI in the route is what was advertised. (The AS_PATH data also > may have traversed ASes within a confederation that are not > represented. However, these ASes are not externally visible, and thus > do not influence route selection, so their omission in this context > is > not a security concern.) Thus, protection of other attributes is > outside the scope of the charter, at the time this document was > prepared. Again, I'd like some clarity on how long we're going to hide behind an explicitly worded charter, or if we're actually going to address any of these issues? -danny From kent@bbn.com Tue Mar 12 06:07:56 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DCD0021F8A2A for ; Tue, 12 Mar 2013 06:07:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.598 X-Spam-Level: X-Spam-Status: No, score=-106.598 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qsq4JFF-vqow for ; Tue, 12 Mar 2013 06:07:55 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.1.81]) by ietfa.amsl.com (Postfix) with ESMTP id 8943821F8A9B for ; Tue, 12 Mar 2013 06:07:55 -0700 (PDT) Received: from dommiel.bbn.com ([192.1.122.15]:42135 helo=dhcp-1067.meeting.ietf.org) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1UFOvm-000BDN-Mc; Tue, 12 Mar 2013 09:07:51 -0400 Message-ID: <513F28A6.1090907@bbn.com> Date: Tue, 12 Mar 2013 09:07:50 -0400 From: Stephen Kent User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: Danny McPherson References: <24B20D14B2CD29478C8D5D6E9CBB29F65C23437D@Hermes.columbia.ads.sparta.com> <31089dec6d0c4ff57b8ba5e680c6c29b@tcb.net> <513E30FC.1050504@bbn.com> <58e88a56a071774a598154fbe4e6d8d8@tcb.net> In-Reply-To: <58e88a56a071774a598154fbe4e6d8d8@tcb.net> Content-Type: multipart/alternative; boundary="------------000005060707070708080308" Cc: sidr Subject: Re: [sidr] ORIGINs X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2013 13:07:57 -0000 This is a multi-part message in MIME format. --------------000005060707070708080308 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Danny, > On 2013-03-11 13:31, Stephen Kent wrote: >> Danny, >> >> We have been told by several operators that the values stated in >> Section 4.3 of RFC 4271 are not what is used today. We also have been >> told that, contrary to the "SHOULD NOT" in Section 5.1.1 of this RFC, >> it is not uncommon for ASes to change this value, en route. Given >> these two observations, I don't see how one can argue that protecting >> this attribute via a PATHSEC mechanism makes sense. > > 84% of ASes are stubs, apparently. Many of our own ASes are stubs and > we buy transit services in some places from some of the ISPs that like > to muck with the ORIGIN code to exploit traffic attraction attacks. > I'd like a secure routing protocol to be derived from requirements > that accommodate issues that both ISPs and stub ASes are concerned > with. That's what I'd like as an operator. If this is yet another > thing that you believe is beyond the scope of SIDR because the current > BGPSEC spec doesn't accommodate it then why don't we stop pretending > to be writing threats and requirements documents and you just publish > your BGPSEC spec? I am writing a threats doc consistent with the SIDR WG charter. WGs have charters to help scope the set of problems that they address. If the WG recharters to extend the scope of what security concerns are to be addressed, then this doc will be revised accordingly. > Separately, there is the issue of whether it makes sense to address >> the security of the ORIGIN attribute in the threats document. The SIDR >> charter states that the path security goal is "Is the AS-Path >> represented in the route the same as the path through 
which the NLRI >> traveled" > > Careful, I'm not sure the current BGPSEC spec does that at all for the > "AS_PATH", and it actually diverges in some places. If you're going > to use the charter again to nix this requirement as an acceptable > residual vulnerability in the threats draft then it's crystal clear to > me that you and the BGPSEC design team simply want to publish the > BGPSEC draft as you've already envisioned and you don't want to > accommodate my operational requirements. If that's the case then > let's just kill the threats and requirements documents and save > everyone's time. I'm sorry that you seem to be uncomfortable working within the WG charter. > There are a variety of other attributes that do not directly >> support this goal, and which are not being addressed as part of the >> PATHSEC model. > > Right, and I think they should be, as they all impact BGP path > selection in various ways. > >> The threats document already addresses this issue, in >> the Residual Vulnerabilities section. > > Out of curiosity, does anyone intend to ever address the growing list > of "residual vulnerabilities" or is this merely a place to catalog > requirements that would rather not be addressed? The previous bullet in this section deals with route leaks, and says: If, at a latertime, the SIDR charter is amended to include route leaks, and an appropriate definition exists, this document should be revised. I'm happy to add an analogous sentence to this bullet as well. > I suggest the following updated >> text for that section, to better explain the criteria for inclusion >> and exclusion in that document: >> >> PATHSEC is not planned to protect all attributes associated with an >> AS_PATH, even though some of these attributes may be employed as >> inputs to routing decisions. Thus attacks that modify (or strip) these >> other attributes are not prevented/detected by PATHSEC. The SIDR >> charter calls for protecting only the info needed to verify that a >> received route traversed the ASes enumerated in the AS_PATH, and that >> the NLRI in the route is what was advertised. (The AS_PATH data also >> may have traversed ASes within a confederation that are not >> represented. However, these ASes are not externally visible, and thus >> do not influence route selection, so their omission in this context is >> not a security concern.) Thus, protection of other attributes is >> outside the scope of the charter, at the time this document was >> prepared. > > Again, I'd like some clarity on how long we're going to hide behind an > explicitly worded charter, or if we're actually going to address any > of these issues? As far as I'm concerned, we're going to follow IETF procedures. Steve --------------000005060707070708080308 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit
Danny,
On 2013-03-11 13:31, Stephen Kent wrote:
Danny,

 We have been told by several operators that the values stated in
Section 4.3 of RFC 4271 are not what is used today. We also have been
told that, contrary to the "SHOULD NOT" in Section 5.1.1 of this RFC,
it is not uncommon for ASes to change this value, en route. Given
these two observations, I don't see how one can argue that protecting
this attribute via a PATHSEC mechanism makes sense.

84% of ASes are stubs, apparently.  Many of our own ASes are stubs and we buy transit services in some places from some of the ISPs that like to muck with the ORIGIN code to exploit traffic attraction attacks. I'd like a secure routing protocol to be derived from requirements that accommodate issues that both ISPs and stub ASes are concerned with.  That's what I'd like as an operator. If this is yet another thing that you believe is beyond the scope of SIDR because the current BGPSEC spec doesn't accommodate it then why don't we stop pretending to be writing threats and requirements documents and you just publish your BGPSEC spec?
I am writing a threats doc consistent with the SIDR WG charter. WGs have charters to help scope the
set of problems that they address. If the WG recharters to extend the scope of what security concerns are to be addressed, then this doc will be revised accordingly.
  Separately, there is the issue of whether it makes sense to address
the security of the ORIGIN attribute in the threats document. The SIDR
charter states that the path security goal is "Is the AS-Path
represented in the route the same as the path through 
which the NLRI
traveled"

Careful, I'm not sure the current BGPSEC spec does that at all for the "AS_PATH", and it actually diverges in some places.  If you're going to use the charter again to nix this requirement as an acceptable residual vulnerability in the threats draft then it's crystal clear to me that you and the BGPSEC design team simply want to publish the BGPSEC draft as you've already envisioned and you don't want to accommodate my operational requirements.  If that's the case then let's just kill the threats and requirements documents and save everyone's time.
I'm sorry that you seem to be uncomfortable working within the WG charter.
There are a variety of other attributes that do not directly
support this goal, and which are not being addressed as part of the
PATHSEC model.

Right, and I think they should be, as they all impact BGP path selection in various ways.

The threats document already addresses this issue, in
the Residual Vulnerabilities section.

Out of curiosity, does anyone intend to ever address the growing list of "residual vulnerabilities" or is this merely a place to catalog requirements that would rather not be addressed?
The previous bullet in this section deals with route leaks, and says:

      If, at a later time, the SIDR charter is amended to include route leaks, and an

      appropriate definition exists, this document should be revised.


I'm happy to add an analogous sentence to this bullet as well.
I suggest the following updated
text for that section, to better explain the criteria for inclusion
and exclusion in that document:

PATHSEC is not planned to protect all attributes associated with an
AS_PATH, even though some of these attributes may be employed as
inputs to routing decisions. Thus attacks that modify (or strip) these
other attributes are not prevented/detected by PATHSEC. The SIDR
charter calls for protecting only the info needed to verify that a
received route traversed the ASes enumerated in the AS_PATH, and that
the NLRI in the route is what was advertised. (The AS_PATH data also
may have traversed ASes within a confederation that are not
represented. However, these ASes are not externally visible, and thus
do not influence route selection, so their omission in this context is
not a security concern.) Thus, protection of other attributes is
outside the scope of the charter, at the time this document was
prepared.

Again, I'd like some clarity on how long we're going to hide behind an explicitly worded charter, or if we're actually going to address any of these issues?
As far as I'm concerned, we're going to follow IETF procedures.

Steve
--------------000005060707070708080308-- From danny@tcb.net Tue Mar 12 06:26:52 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 29DF521F8AA1 for ; Tue, 12 Mar 2013 06:26:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.282 X-Spam-Level: X-Spam-Status: No, score=-100.282 tagged_above=-999 required=5 tests=[AWL=0.155, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g6DfE+Hrk1AA for ; Tue, 12 Mar 2013 06:26:51 -0700 (PDT) Received: from mail.friendswithtools.org (unknown [64.78.239.70]) by ietfa.amsl.com (Postfix) with ESMTP id A466221F8A51 for ; Tue, 12 Mar 2013 06:26:51 -0700 (PDT) Received: from dspam (unknown [127.0.0.1]) by mail.friendswithtools.org (Postfix) with SMTP id 566AB300039 for ; Tue, 12 Mar 2013 13:26:51 +0000 (UTC) Received: from mail2.tcb.net (localhost [127.0.0.1]) by mail.friendswithtools.org (Postfix) with ESMTP id D0F3F300015; Tue, 12 Mar 2013 07:26:50 -0600 (MDT) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Date: Tue, 12 Mar 2013 07:26:50 -0600 From: Danny McPherson To: Stephen Kent In-Reply-To: <513F28A6.1090907@bbn.com> References: <24B20D14B2CD29478C8D5D6E9CBB29F65C23437D@Hermes.columbia.ads.sparta.com> <31089dec6d0c4ff57b8ba5e680c6c29b@tcb.net> <513E30FC.1050504@bbn.com> <58e88a56a071774a598154fbe4e6d8d8@tcb.net> <513F28A6.1090907@bbn.com> Message-ID: X-Sender: danny@tcb.net User-Agent: Roundcube Webmail/0.8.2 X-DSPAM-Result: Innocent X-DSPAM-Processed: Tue Mar 12 07:26:51 2013 X-DSPAM-Confidence: 0.9898 X-DSPAM-Improbability: 1 in 9709 chance of being spam X-DSPAM-Probability: 0.0000 X-DSPAM-Signature: 513f2d1b42071526517885 X-DSPAM-Factors: 27, that+the, 0.01000, From*Danny+#+danny, 0.01000, From*Danny+#+#+tcb.net, 0.01000, Subject*Re+sidr, 0.01000, From*Danny+McPherson, 0.01000, On+#+03, 0.01000, Cc*sidr+ietf.org, 0.01000, Subject*Re+#+ORIGINs, 0.01000, On+2013, 0.01000, From*McPherson+danny, 0.01000, From*Danny McPherson , 0.01000, 2013+03, 0.01000, Subject*sidr+ORIGINs, 0.01000, From*McPherson+#+tcb.net, 0.01000, From*danny+tcb.net, 0.01000, into+the, 0.01000, intentionally+#+when, 0.40000, written+#+that, 0.40000, as+#+#+we're, 0.40000, 12+#+07, 0.40000, solution+envisaged, 0.40000, envisaged+would, 0.40000, requirements+#+#+being, 0.40000, are+#+#+backwards, 0.40000, That+#+was, 0.40000, engineered+#+#+the, 0.40000, threats+#+subsequent, 0.40000 Cc: sidr Subject: Re: [sidr] ORIGINs X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2013 13:26:52 -0000 On 2013-03-12 07:07, Stephen Kent wrote: > As far as I'm concerned, we're going to follow IETF procedures. That charter was intentionally worded when it was written so that the solution envisaged would be the only thing worked on here, absent being information by any actual threats or subsequent requirements, which are being carefully backwards engineered here to the solution that was brought into the WG. Alas.... -danny From mlepinski.ietf@gmail.com Tue Mar 12 06:38:57 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A1FA021F8BCC for ; Tue, 12 Mar 2013 06:38:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.766 X-Spam-Level: X-Spam-Status: No, score=-1.766 tagged_above=-999 required=5 tests=[AWL=-0.833, BAYES_00=-2.599, HTML_MESSAGE=0.001, NO_RELAYS=-0.001, SARE_HTML_USL_OBFU=1.666] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N7UC9pOZ7lHc for ; Tue, 12 Mar 2013 06:38:56 -0700 (PDT) Received: from mail-qc0-x22b.google.com (mail-qc0-x22b.google.com [IPv6:2607:f8b0:400d:c01::22b]) by ietfa.amsl.com (Postfix) with ESMTP id 6068721F8BB2 for ; Tue, 12 Mar 2013 06:38:56 -0700 (PDT) Received: by mail-qc0-f171.google.com with SMTP id d1so2011520qca.2 for ; Tue, 12 Mar 2013 06:38:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:x-received:reply-to:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=UNXyWA9coH9XmdF6jADQ4Fly/1UoBOrCD5JtGzyro20=; b=WajIdyor6m+Mmy0JaTup3vZeyydFCVA9YdVyfCuVWlRBuJV3VCJti5bRv3sJWbhTQn ug883B/gmRXTvBSxvB7HjUada9wiVVh9cIZvWt5aLPCyx8aQFrIO1QwCzdPQsDp8y429 q4mSxpNELKAUyPlSFo+wlP9zEE8rxvUbhCP60P14l2znz1N8LXUgwb2fSL3TxJkVVfYj EjY9iWhFKunzzumWagFZ7J7/+yHSHgJdLDY61ALKZqnE8YRiwecodzoI6IHjPc0USL1k UysnayzK93dWFm9lfikt0uyet0B0pofPuGPHILRWgSiKLP7Tk4dWXCu+dIB6uLMAgEgv kCvQ== MIME-Version: 1.0 X-Received: by 10.224.187.194 with SMTP id cx2mr12579426qab.1.1363095535849; Tue, 12 Mar 2013 06:38:55 -0700 (PDT) Received: by 10.49.129.196 with HTTP; Tue, 12 Mar 2013 06:38:55 -0700 (PDT) Received: by 10.49.129.196 with HTTP; Tue, 12 Mar 2013 06:38:55 -0700 (PDT) In-Reply-To: <58e88a56a071774a598154fbe4e6d8d8@tcb.net> References: <24B20D14B2CD29478C8D5D6E9CBB29F65C23437D@Hermes.columbia.ads.sparta.com> <31089dec6d0c4ff57b8ba5e680c6c29b@tcb.net> <513E30FC.1050504@bbn.com> <58e88a56a071774a598154fbe4e6d8d8@tcb.net> Date: Tue, 12 Mar 2013 09:38:55 -0400 Message-ID: From: Matthew Lepinski To: Danny McPherson Content-Type: multipart/alternative; boundary=485b397dd783359e5b04d7ba6904 Cc: sidr Subject: Re: [sidr] ORIGINs X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: nomcom-chair@ietf.org List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2013 13:38:57 -0000 --485b397dd783359e5b04d7ba6904 Content-Type: text/plain; charset=ISO-8859-1 A quick clarification: The current BGPSEC protocol specification can easily be modified to protect the ORIGIN attribute. (That is, prevent it from being modified by intermediate ASes.) I can very quickly put out an update to the BGPSEC protocol specification if the working group decides that there is a requirement to protect the ORIGIN attribute. It is valuable to have this discussion. I am personally sceptical of preventing the modification of the ORIGIN attribute. However, if others in the writhing group see value in protecting the ORIGIN attribute, then I want to know about it. (And it is certainly the case that I understand the issue better now than I did before this discussion started.) -Matt Lepinski On Mar 11, 2013 11:34 PM, "Danny McPherson" wrote: > On 2013-03-11 13:31, Stephen Kent wrote: > >> Danny, >> >> We have been told by several operators that the values stated in >> Section 4.3 of RFC 4271 are not what is used today. We also have been >> told that, contrary to the "SHOULD NOT" in Section 5.1.1 of this RFC, >> it is not uncommon for ASes to change this value, en route. Given >> these two observations, I don't see how one can argue that protecting >> this attribute via a PATHSEC mechanism makes sense. >> > > 84% of ASes are stubs, apparently. Many of our own ASes are stubs and we > buy transit services in some places from some of the ISPs that like to muck > with the ORIGIN code to exploit traffic attraction attacks. I'd like a > secure routing protocol to be derived from requirements that accommodate > issues that both ISPs and stub ASes are concerned with. That's what I'd > like as an operator. If this is yet another thing that you believe is > beyond the scope of SIDR because the current BGPSEC spec doesn't > accommodate it then why don't we stop pretending to be writing threats and > requirements documents and you just publish your BGPSEC spec? > > Separately, there is the issue of whether it makes sense to address >> the security of the ORIGIN attribute in the threats document. The SIDR >> charter states that the path security goal is "Is the AS-Path >> represented in the route the same as the path through which the NLRI >> traveled" >> > > Careful, I'm not sure the current BGPSEC spec does that at all for the > "AS_PATH", and it actually diverges in some places. If you're going to use > the charter again to nix this requirement as an acceptable residual > vulnerability in the threats draft then it's crystal clear to me that you > and the BGPSEC design team simply want to publish the BGPSEC draft as > you've already envisioned and you don't want to accommodate my operational > requirements. If that's the case then let's just kill the threats and > requirements documents and save everyone's time. > > There are a variety of other attributes that do not directly >> support this goal, and which are not being addressed as part of the >> PATHSEC model. >> > > Right, and I think they should be, as they all impact BGP path selection > in various ways. > > The threats document already addresses this issue, in >> the Residual Vulnerabilities section. >> > > Out of curiosity, does anyone intend to ever address the growing list of > "residual vulnerabilities" or is this merely a place to catalog > requirements that would rather not be addressed? > > I suggest the following updated >> text for that section, to better explain the criteria for inclusion >> and exclusion in that document: >> >> PATHSEC is not planned to protect all attributes associated with an >> AS_PATH, even though some of these attributes may be employed as >> inputs to routing decisions. Thus attacks that modify (or strip) these >> other attributes are not prevented/detected by PATHSEC. The SIDR >> charter calls for protecting only the info needed to verify that a >> received route traversed the ASes enumerated in the AS_PATH, and that >> the NLRI in the route is what was advertised. (The AS_PATH data also >> may have traversed ASes within a confederation that are not >> represented. However, these ASes are not externally visible, and thus >> do not influence route selection, so their omission in this context is >> not a security concern.) Thus, protection of other attributes is >> outside the scope of the charter, at the time this document was >> prepared. >> > > Again, I'd like some clarity on how long we're going to hide behind an > explicitly worded charter, or if we're actually going to address any of > these issues? > > -danny > > ______________________________**_________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/**listinfo/sidr > --485b397dd783359e5b04d7ba6904 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable

A quick clarification: The current BGPSEC protocol specifica= tion can easily be modified to protect the ORIGIN attribute. (That is, prev= ent it from being modified by intermediate ASes.)

I can very quickly put out an update to the BGPSEC protocol = specification if the working group decides that there is a requirement to p= rotect the ORIGIN attribute.

It is valuable to have this discussion. I am personally scep= tical of preventing the modification of the ORIGIN attribute. However, if o= thers in the writhing group see value in protecting the ORIGIN attribute, t= hen I want to know about it. (And it is certainly the case that I understan= d the issue better now than I did before this discussion started.)

-Matt Lepinski

On Mar 11, 2013 11:34 PM, "Danny McPherson&= quot; <danny@tcb.net> wrote:
On 2013-03-11 13:31, Stephen Kent wrote:
Danny,

=A0We have been told by several operators that the values stated in
Section 4.3 of RFC 4271 are not what is used today. We also have been
told that, contrary to the "SHOULD NOT" in Section 5.1.1 of this = RFC,
it is not uncommon for ASes to change this value, en route. Given
these two observations, I don't see how one can argue that protecting this attribute via a PATHSEC mechanism makes sense.

84% of ASes are stubs, apparently. =A0Many of our own ASes are stubs and we= buy transit services in some places from some of the ISPs that like to muc= k with the ORIGIN code to exploit traffic attraction attacks. I'd like = a secure routing protocol to be derived from requirements that accommodate = issues that both ISPs and stub ASes are concerned with. =A0That's what = I'd like as an operator. If this is yet another thing that you believe = is beyond the scope of SIDR because the current BGPSEC spec doesn't acc= ommodate it then why don't we stop pretending to be writing threats and= requirements documents and you just publish your BGPSEC spec?

=A0Separately, there is the issue of whether it makes sense to address
the security of the ORIGIN attribute in the threats document. The SIDR
charter states that the path security goal is "Is the AS-Path
represented in the route the same as the path through which the NLRI
traveled"

Careful, I'm not sure the current BGPSEC spec does that at all for the = "AS_PATH", and it actually diverges in some places. =A0If you'= ;re going to use the charter again to nix this requirement as an acceptable= residual vulnerability in the threats draft then it's crystal clear to= me that you and the BGPSEC design team simply want to publish the BGPSEC d= raft as you've already envisioned and you don't want to accommodate= my operational requirements. =A0If that's the case then let's just= kill the threats and requirements documents and save everyone's time.<= br>
There are a variety of other attributes that do not directly
support this goal, and which are not being addressed as part of the
PATHSEC model.

Right, and I think they should be, as they all impact BGP path selection in= various ways.

The threats document already addresses this issue, in
the Residual Vulnerabilities section.

Out of curiosity, does anyone intend to ever address the growing list of &q= uot;residual vulnerabilities" or is this merely a place to catalog req= uirements that would rather not be addressed?

I suggest the following updated
text for that section, to better explain the criteria for inclusion
and exclusion in that document:

PATHSEC is not planned to protect all attributes associated with an
AS_PATH, even though some of these attributes may be employed as
inputs to routing decisions. Thus attacks that modify (or strip) these
other attributes are not prevented/detected by PATHSEC. The SIDR
charter calls for protecting only the info needed to verify that a
received route traversed the ASes enumerated in the AS_PATH, and that
the NLRI in the route is what was advertised. (The AS_PATH data also
may have traversed ASes within a confederation that are not
represented. However, these ASes are not externally visible, and thus
do not influence route selection, so their omission in this context is
not a security concern.) Thus, protection of other attributes is
outside the scope of the charter, at the time this document was
prepared.

Again, I'd like some clarity on how long we're going to hide behind= an explicitly worded charter, or if we're actually going to address an= y of these issues?

-danny

_______________________________________________
sidr mailing list
sidr@ietf.org
ht= tps://www.ietf.org/mailman/listinfo/sidr
--485b397dd783359e5b04d7ba6904-- From christopher.morrow@gmail.com Tue Mar 12 07:21:37 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 06BC021F8B9F for ; Tue, 12 Mar 2013 07:21:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.6 X-Spam-Level: X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K5+rB2zZn2Ft; Tue, 12 Mar 2013 07:21:36 -0700 (PDT) Received: from mail-la0-x22a.google.com (mail-la0-x22a.google.com [IPv6:2a00:1450:4010:c03::22a]) by ietfa.amsl.com (Postfix) with ESMTP id 29FD921F8B9B; Tue, 12 Mar 2013 07:21:34 -0700 (PDT) Received: by mail-la0-f42.google.com with SMTP id fe20so5277213lab.29 for ; Tue, 12 Mar 2013 07:21:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:x-received:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type; bh=d+8hbpJPwp2Qfz6qUoB54HQKOndPhf8WVkXUls2QvbU=; b=IcEy78xYHnAxiMtTmiuwgCaCGokN81LixdgP8b6Gqxgz7I2CmfinVTwLe8Va42q3J5 yF/GctD+I/QTsrxEu9rcBb7au38PPXSl9CRklry7Lr7Nz0auOsOHQLZBVMehLrfoBLPV AubOt4+rbXImVEDza283lm2P36ySmLC957OoCjTUW1qG51fl20HzAxCiDCHoc8DDyFez blp+Zytkb11TKcrYCEzCyjiIyQM3A7Z/EibZK/yryxiaiuj7FnlXbnhHA/M3wxXlS7qa JW4OHyvId6UKH/ZsrmhzuycVLlCp/xydlef7QneyhrqwQ01R2M9uLYzpzpD3ByOHUzsQ Eleg== MIME-Version: 1.0 X-Received: by 10.152.144.138 with SMTP id sm10mr14043774lab.53.1363098093770; Tue, 12 Mar 2013 07:21:33 -0700 (PDT) Sender: christopher.morrow@gmail.com Received: by 10.152.28.34 with HTTP; Tue, 12 Mar 2013 07:21:33 -0700 (PDT) In-Reply-To: References: <24B20D14B2CD29478C8D5D6E9CBB29F65C23437D@Hermes.columbia.ads.sparta.com> <31089dec6d0c4ff57b8ba5e680c6c29b@tcb.net> <513E30FC.1050504@bbn.com> <58e88a56a071774a598154fbe4e6d8d8@tcb.net> Date: Tue, 12 Mar 2013 10:21:33 -0400 X-Google-Sender-Auth: 49HdUu8KO9OUlwbvrKzp8wVIG8Y Message-ID: From: Christopher Morrow To: nomcom-chair@ietf.org Content-Type: text/plain; charset=ISO-8859-1 Cc: sidr Subject: Re: [sidr] ORIGINs X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2013 14:21:37 -0000 On Tue, Mar 12, 2013 at 9:38 AM, Matthew Lepinski wrote: > A quick clarification: The current BGPSEC protocol specification can easily > be modified to protect the ORIGIN attribute. (That is, prevent it from being > modified by intermediate ASes.) > > I can very quickly put out an update to the BGPSEC protocol specification if > the working group decides that there is a requirement to protect the ORIGIN > attribute. I wonder if it's worth protecting it as an option? In other words protect origin at the origin's discretion. > It is valuable to have this discussion. I am personally sceptical of > preventing the modification of the ORIGIN attribute. However, if others in it seems like there are thorns to watch out for, for sure... and mandatory action will certainly have us falling into the thorns minus protection. > the writhing group see value in protecting the ORIGIN attribute, then I want autocorrect or freudian slip? :) > to know about it. (And it is certainly the case that I understand the issue > better now than I did before this discussion started.) > > -Matt Lepinski > > On Mar 11, 2013 11:34 PM, "Danny McPherson" wrote: >> >> On 2013-03-11 13:31, Stephen Kent wrote: >>> >>> Danny, >>> >>> We have been told by several operators that the values stated in >>> Section 4.3 of RFC 4271 are not what is used today. We also have been >>> told that, contrary to the "SHOULD NOT" in Section 5.1.1 of this RFC, >>> it is not uncommon for ASes to change this value, en route. Given >>> these two observations, I don't see how one can argue that protecting >>> this attribute via a PATHSEC mechanism makes sense. >> >> >> 84% of ASes are stubs, apparently. Many of our own ASes are stubs and we >> buy transit services in some places from some of the ISPs that like to muck >> with the ORIGIN code to exploit traffic attraction attacks. I'd like a >> secure routing protocol to be derived from requirements that accommodate >> issues that both ISPs and stub ASes are concerned with. That's what I'd >> like as an operator. If this is yet another thing that you believe is beyond >> the scope of SIDR because the current BGPSEC spec doesn't accommodate it >> then why don't we stop pretending to be writing threats and requirements >> documents and you just publish your BGPSEC spec? >> >>> Separately, there is the issue of whether it makes sense to address >>> the security of the ORIGIN attribute in the threats document. The SIDR >>> charter states that the path security goal is "Is the AS-Path >>> represented in the route the same as the path through which the NLRI >>> traveled" >> >> >> Careful, I'm not sure the current BGPSEC spec does that at all for the >> "AS_PATH", and it actually diverges in some places. If you're going to use >> the charter again to nix this requirement as an acceptable residual >> vulnerability in the threats draft then it's crystal clear to me that you >> and the BGPSEC design team simply want to publish the BGPSEC draft as you've >> already envisioned and you don't want to accommodate my operational >> requirements. If that's the case then let's just kill the threats and >> requirements documents and save everyone's time. >> >>> There are a variety of other attributes that do not directly >>> support this goal, and which are not being addressed as part of the >>> PATHSEC model. >> >> >> Right, and I think they should be, as they all impact BGP path selection >> in various ways. >> >>> The threats document already addresses this issue, in >>> the Residual Vulnerabilities section. >> >> >> Out of curiosity, does anyone intend to ever address the growing list of >> "residual vulnerabilities" or is this merely a place to catalog requirements >> that would rather not be addressed? >> >>> I suggest the following updated >>> text for that section, to better explain the criteria for inclusion >>> and exclusion in that document: >>> >>> PATHSEC is not planned to protect all attributes associated with an >>> AS_PATH, even though some of these attributes may be employed as >>> inputs to routing decisions. Thus attacks that modify (or strip) these >>> other attributes are not prevented/detected by PATHSEC. The SIDR >>> charter calls for protecting only the info needed to verify that a >>> received route traversed the ASes enumerated in the AS_PATH, and that >>> the NLRI in the route is what was advertised. (The AS_PATH data also >>> may have traversed ASes within a confederation that are not >>> represented. However, these ASes are not externally visible, and thus >>> do not influence route selection, so their omission in this context is >>> not a security concern.) Thus, protection of other attributes is >>> outside the scope of the charter, at the time this document was >>> prepared. >> >> >> Again, I'd like some clarity on how long we're going to hide behind an >> explicitly worded charter, or if we're actually going to address any of >> these issues? >> >> -danny >> >> _______________________________________________ >> sidr mailing list >> sidr@ietf.org >> https://www.ietf.org/mailman/listinfo/sidr > > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From randy@psg.com Tue Mar 12 08:00:19 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 27DFD21F8A38 for ; Tue, 12 Mar 2013 08:00:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2mTX0HCohcgT for ; Tue, 12 Mar 2013 08:00:18 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id 6545921F8A91 for ; Tue, 12 Mar 2013 08:00:18 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.80.1 (FreeBSD)) (envelope-from ) id 1UFQga-000Enh-C3; Tue, 12 Mar 2013 15:00:16 +0000 Date: Tue, 12 Mar 2013 08:00:16 -0700 Message-ID: From: Randy Bush To: Matthew Lepinski In-Reply-To: References: <24B20D14B2CD29478C8D5D6E9CBB29F65C23437D@Hermes.columbia.ads.sparta.com> <31089dec6d0c4ff57b8ba5e680c6c29b@tcb.net> <513E30FC.1050504@bbn.com> <58e88a56a071774a598154fbe4e6d8d8@tcb.net> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Cc: sidr Subject: Re: [sidr] ORIGINs X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2013 15:00:19 -0000 > A quick clarification: The current BGPSEC protocol specification can > easily be modified to protect the ORIGIN attribute. (That is, prevent > it from being modified by intermediate ASes.) ops with deep clue and who i respct have spoken. don't do it. randy From andy@arin.net Tue Mar 12 10:03:11 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5793821F8B14 for ; Tue, 12 Mar 2013 10:03:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.907 X-Spam-Level: X-Spam-Status: No, score=-2.907 tagged_above=-999 required=5 tests=[AWL=-0.308, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id z9YQDHVqfqlg for ; Tue, 12 Mar 2013 10:03:10 -0700 (PDT) Received: from smtp2.arin.net (smtp2.arin.net [IPv6:2001:500:4:13::32]) by ietfa.amsl.com (Postfix) with ESMTP id E89A311E80AE for ; Tue, 12 Mar 2013 10:03:05 -0700 (PDT) Received: by smtp2.arin.net (Postfix, from userid 323) id BA429213688; Tue, 12 Mar 2013 13:03:04 -0400 (EDT) Received: from CHAXCH05.corp.arin.net (chaxch05.corp.arin.net [192.149.252.94]) by smtp2.arin.net (Postfix) with ESMTP id 7499B2135FF; Tue, 12 Mar 2013 13:03:04 -0400 (EDT) Received: from CHAXCH03.corp.arin.net (10.1.30.17) by CHAXCH05.corp.arin.net (192.149.252.94) with Microsoft SMTP Server (TLS) id 14.2.328.9; Tue, 12 Mar 2013 13:02:31 -0400 Received: from CHAXCH01.corp.arin.net ([169.254.1.209]) by CHAXCH03.corp.arin.net ([10.1.30.17]) with mapi id 14.02.0328.009; Tue, 12 Mar 2013 13:03:03 -0400 From: Andy Newton To: "carlos@lacnic.net" , "sidr@ietf.org" Thread-Topic: [sidr] Fwd: New Version Notification for draft-rogaglia-sidr-multiple-publication-points-02.txt Thread-Index: AQHOH0N16gUku2SeLk+FB2/8g+Jrxg== Date: Tue, 12 Mar 2013 17:03:02 +0000 Message-ID: <62D9228640AC7F49B2DD9ED0C9CE60E58BBF2C6E@CHAXCH01.corp.arin.net> In-Reply-To: <513DE332.4090406@gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.3.1.130117 x-originating-ip: [10.1.35.138] Content-Type: text/plain; charset="us-ascii" Content-ID: <05D587E273C8734BA479A4E1949390FA@corp.arin.net> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [sidr] Fwd: New Version Notification for draft-rogaglia-sidr-multiple-publication-points-02.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2013 17:03:12 -0000 On 3/11/13 9:59 AM, "Carlos M. Martinez" wrote: >As requested by the chairs, I'm sending this email requesting WG >adoption of this item. I support the adoption of this draft as a working group item. -andy From Sandra.Murphy@sparta.com Tue Mar 12 10:55:17 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5CB5711E8112 for ; Tue, 12 Mar 2013 10:55:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.748 X-Spam-Level: X-Spam-Status: No, score=-102.748 tagged_above=-999 required=5 tests=[AWL=-0.149, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id D9lyKSvvD5TC for ; Tue, 12 Mar 2013 10:55:10 -0700 (PDT) Received: from Uther.sparta.com (uther.sparta.com [157.185.0.2]) by ietfa.amsl.com (Postfix) with ESMTP id 17FA611E8103 for ; Tue, 12 Mar 2013 10:55:10 -0700 (PDT) Received: from durin.laguna.sparta.com ([10.62.216.7]) by Uther.sparta.com (8.13.8/8.13.8) with ESMTP id r2CHt9iR029012 for ; Tue, 12 Mar 2013 10:55:09 -0700 Received: from Hermes.columbia.ads.sparta.com ([10.62.56.107]) by durin.laguna.sparta.com (8.13.8/8.13.8) with ESMTP id r2CHt8f0003492 for ; Tue, 12 Mar 2013 10:55:08 -0700 Received: from HERMES.columbia.ads.sparta.com ([fe80::e4a8:a383:2128:c0e5]) by Hermes.columbia.ads.sparta.com ([fe80::e4a8:a383:2128:c0e5%18]) with mapi id 14.02.0247.003; Tue, 12 Mar 2013 13:54:17 -0400 From: "Murphy, Sandra" To: "sidr@ietf.org" Thread-Topic: wg adoption call for draft-rogaglia-sidr-multiple-publication-points Thread-Index: Ac4fD8PVv36B/fnuSja5n3WU1EWw/A== Date: Tue, 12 Mar 2013 17:54:17 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F65C2350DF@Hermes.columbia.ads.sparta.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.137] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: [sidr] wg adoption call for draft-rogaglia-sidr-multiple-publication-points X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2013 17:55:17 -0000 The authors of draft-rogaglia-sidr-multiple-publication-points have request= ed wg adoption.=0A= =0A= See http://tools.ietf.org/html/draft-rogaglia-sidr-multiple-publication-poi= nts =0A= =0A= Please do respond to the list as to whether you support the wg adopting thi= s as a work item. Note that you do not need to comment on the content of t= his draft at this time. You are asked to indicate if you think that this i= s work that the wg should be doing and whether this draft is an acceptable = starting point. Adding whether you can/will review or not is useful.=0A= =0A= This adoption call will end on Tuesday, March 26, 2013 (extra time because = many of those in the wg are busy at the ietf this week).=0A= =0A= --Sandy= From kent@bbn.com Tue Mar 12 12:15:48 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C7C4A11E80E4 for ; Tue, 12 Mar 2013 12:15:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.599 X-Spam-Level: X-Spam-Status: No, score=-106.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sQWLlNtjZJF0 for ; Tue, 12 Mar 2013 12:15:47 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.1.81]) by ietfa.amsl.com (Postfix) with ESMTP id 8AE6D11E80B8 for ; Tue, 12 Mar 2013 12:15:47 -0700 (PDT) Received: from dommiel.bbn.com ([192.1.122.15]:48048 helo=dhcp-1067.meeting.ietf.org) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1UFUfq-000FEq-OB for sidr@ietf.org; Tue, 12 Mar 2013 15:15:46 -0400 Message-ID: <513F7EE2.1090403@bbn.com> Date: Tue, 12 Mar 2013 15:15:46 -0400 From: Stephen Kent User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: sidr@ietf.org References: <24B20D14B2CD29478C8D5D6E9CBB29F65C2350DF@Hermes.columbia.ads.sparta.com> In-Reply-To: <24B20D14B2CD29478C8D5D6E9CBB29F65C2350DF@Hermes.columbia.ads.sparta.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [sidr] wg adoption call for draft-rogaglia-sidr-multiple-publication-points X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2013 19:15:48 -0000 I think we should explore how to make TAs maximally accessible. I don't know if I believe that revising the TAL format is necessary, but ... So, yes, I support adoption of this doc as a starting point for the discussion. Steve On 3/12/13 1:54 PM, Murphy, Sandra wrote: > The authors of draft-rogaglia-sidr-multiple-publication-points have requested wg adoption. > > See http://tools.ietf.org/html/draft-rogaglia-sidr-multiple-publication-points > > Please do respond to the list as to whether you support the wg adopting this as a work item. Note that you do not need to comment on the content of this draft at this time. You are asked to indicate if you think that this is work that the wg should be doing and whether this draft is an acceptable starting point. Adding whether you can/will review or not is useful. > > This adoption call will end on Tuesday, March 26, 2013 (extra time because many of those in the wg are busy at the ietf this week). > > --Sandy > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From jrmitche@puck.nether.net Tue Mar 12 12:23:56 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1B7CD11E819A for ; Tue, 12 Mar 2013 12:23:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id di2h3F61ByBK for ; Tue, 12 Mar 2013 12:23:55 -0700 (PDT) Received: from puck.nether.net (puck.nether.net [IPv6:2001:418:3f4::5]) by ietfa.amsl.com (Postfix) with ESMTP id 781D811E815E for ; Tue, 12 Mar 2013 12:23:55 -0700 (PDT) Received: from puck.nether.net (localhost [127.0.0.1]) by puck.nether.net (8.14.6/8.14.5) with ESMTP id r2CJNlV7014666 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Tue, 12 Mar 2013 15:23:47 -0400 Received: (from jrmitche@localhost) by puck.nether.net (8.14.6/8.14.6/Submit) id r2CJNkBf014665; Tue, 12 Mar 2013 15:23:46 -0400 Date: Tue, 12 Mar 2013 15:23:46 -0400 From: Jon Mitchell To: Christopher Morrow Message-ID: <20130312192346.GA28236@puck.nether.net> References: <24B20D14B2CD29478C8D5D6E9CBB29F65C23437D@Hermes.columbia.ads.sparta.com> <31089dec6d0c4ff57b8ba5e680c6c29b@tcb.net> <513E30FC.1050504@bbn.com> <58e88a56a071774a598154fbe4e6d8d8@tcb.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (puck.nether.net [127.0.0.1]); Tue, 12 Mar 2013 15:23:47 -0400 (EDT) Cc: sidr Subject: Re: [sidr] ORIGINs X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2013 19:23:56 -0000 On 12/03/13 10:21 -0400, Christopher Morrow wrote: > On Tue, Mar 12, 2013 at 9:38 AM, Matthew Lepinski > wrote: > > A quick clarification: The current BGPSEC protocol specification can easily > > be modified to protect the ORIGIN attribute. (That is, prevent it from being > > modified by intermediate ASes.) > > > > I can very quickly put out an update to the BGPSEC protocol specification if > > the working group decides that there is a requirement to protect the ORIGIN > > attribute. > > I wonder if it's worth protecting it as an option? > In other words protect origin at the origin's discretion. Although I was skeptical of origin code validation, this seems like another reasonable alternative. As an operator, I wouldn't mind the option of only optionally validating origin code, or conversely on sending side allow those who choose to have it validated as you suggest take the risk that the only path in some cases may be dropped by others doing validation (if the majority of their transit providers are already doing origin code manipulation for instance). I'm seeing origin manipulation already from certain peers and I believe some in the same situation many have choosen to flatten origin themselves (set to igp on incoming) as a result to prevent it from affecting their BGP decision process. Other stub AS may use origin code as a traffic engineering knob internally. For these reasons, I think origin code validation should be optional at best (this threat is not high on my list frankly). Jon From achi@bbn.com Tue Mar 12 13:37:53 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 22B7F21F8CA1 for ; Tue, 12 Mar 2013 13:37:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WGVIZt0TltZA for ; Tue, 12 Mar 2013 13:37:52 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.1.81]) by ietfa.amsl.com (Postfix) with ESMTP id A139721F8C98 for ; Tue, 12 Mar 2013 13:37:52 -0700 (PDT) Received: from [128.89.253.220] (port=63924 helo=platypotamus.local) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1UFVxH-000GGF-Bn; Tue, 12 Mar 2013 16:37:51 -0400 Message-ID: <513F921E.7070603@bbn.com> Date: Tue, 12 Mar 2013 16:37:50 -0400 From: Andrew Chi User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: "Murphy, Sandra" References: <24B20D14B2CD29478C8D5D6E9CBB29F65C2350DF@Hermes.columbia.ads.sparta.com> In-Reply-To: <24B20D14B2CD29478C8D5D6E9CBB29F65C2350DF@Hermes.columbia.ads.sparta.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Cc: "sidr@ietf.org" Subject: Re: [sidr] wg adoption call for draft-rogaglia-sidr-multiple-publication-points X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2013 20:37:53 -0000 On 3/12/13 1:54 PM, Murphy, Sandra wrote: > The authors of draft-rogaglia-sidr-multiple-publication-points have requested wg adoption. Support for discussion -- it's important to support high availability by *some* mechanism. Andrew From madi@cnnic.cn Tue Mar 12 13:53:50 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5A85111E815E for ; Tue, 12 Mar 2013 13:53:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3.816 X-Spam-Level: *** X-Spam-Status: No, score=3.816 tagged_above=-999 required=5 tests=[BAYES_40=-0.185, FH_RELAY_NODNS=1.451, MIME_CHARSET_FARAWAY=2.45, RDNS_NONE=0.1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LbWOzB-VfdRk for ; Tue, 12 Mar 2013 13:53:49 -0700 (PDT) Received: from cnnic.cn (unknown [218.241.105.202]) by ietfa.amsl.com (Postfix) with SMTP id 4644111E8158 for ; Tue, 12 Mar 2013 13:53:48 -0700 (PDT) X-EYOUMAIL-SMTPAUTH: madi@cnnic.cn Received: from unknown127.0.0.1 (HELO [192.168.1.26]) (127.0.0.1) by 127.0.0.1 with SMTP; Wed, 13 Mar 2013 04:53:41 +0800 Content-Type: text/plain; charset=GB2312 Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\)) From: Di Ma In-Reply-To: <24B20D14B2CD29478C8D5D6E9CBB29F65C2350DF@Hermes.columbia.ads.sparta.com> Date: Tue, 12 Mar 2013 16:53:37 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: References: <24B20D14B2CD29478C8D5D6E9CBB29F65C2350DF@Hermes.columbia.ads.sparta.com> To: sidr@ietf.org X-Mailer: Apple Mail (2.1499) Subject: Re: [sidr] wg adoption call for draft-rogaglia-sidr-multiple-publication-points X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2013 20:53:50 -0000 I support adoption of this document, the discussion of which is going to = make a better RPKI deployment.=20 Di Ma China Internet Network Information Center =A3=A8CNNIC=A3=A9 =D4=DA 2013-3-12=A3=AC=CF=C2=CE=E71:54=A3=AC"Murphy, Sandra" = =D0=B4=B5=C0=A3=BA > The authors of draft-rogaglia-sidr-multiple-publication-points have = requested wg adoption. >=20 > See = http://tools.ietf.org/html/draft-rogaglia-sidr-multiple-publication-points= =20 >=20 > Please do respond to the list as to whether you support the wg = adopting this as a work item. Note that you do not need to comment on = the content of this draft at this time. You are asked to indicate if = you think that this is work that the wg should be doing and whether this = draft is an acceptable starting point. Adding whether you can/will = review or not is useful. >=20 > This adoption call will end on Tuesday, March 26, 2013 (extra time = because many of those in the wg are busy at the ietf this week). >=20 > --Sandy > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr From aservin@lacnic.net Tue Mar 12 14:07:35 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3F14C11E8170 for ; Tue, 12 Mar 2013 14:07:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.851 X-Spam-Level: X-Spam-Status: No, score=-1.851 tagged_above=-999 required=5 tests=[AWL=-0.750, BAYES_00=-2.599, HELO_DYNAMIC_DHCP=1.398, RDNS_DYNAMIC=0.1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hIfvsNwsv-NF for ; Tue, 12 Mar 2013 14:07:33 -0700 (PDT) Received: from mail.lacnic.net.uy (mail.lacnic.net.uy [IPv6:2001:13c7:7001:4000::3]) by ietfa.amsl.com (Postfix) with ESMTP id AD49B11E810E for ; Tue, 12 Mar 2013 14:07:33 -0700 (PDT) Received: from dhcp-11f1.meeting.ietf.org (dhcp-11f1.meeting.ietf.org [130.129.17.241]) by mail.lacnic.net.uy (Postfix) with ESMTP id 21D65308444 for ; Tue, 12 Mar 2013 18:07:21 -0300 (UYT) Message-ID: <513F990F.8090907@lacnic.net> Date: Tue, 12 Mar 2013 17:07:27 -0400 From: Arturo Servin User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130216 Thunderbird/17.0.3 MIME-Version: 1.0 To: sidr@ietf.org References: <24B20D14B2CD29478C8D5D6E9CBB29F65C2350DF@Hermes.columbia.ads.sparta.com> In-Reply-To: <24B20D14B2CD29478C8D5D6E9CBB29F65C2350DF@Hermes.columbia.ads.sparta.com> X-Enigmail-Version: 1.5.1 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-LACNIC.uy-MailScanner-Information: Please contact the ISP for more information X-LACNIC.uy-MailScanner: Found to be clean X-LACNIC.uy-MailScanner-SpamCheck: X-LACNIC.uy-MailScanner-From: aservin@lacnic.net Subject: Re: [sidr] wg adoption call for draft-rogaglia-sidr-multiple-publication-points X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2013 21:07:35 -0000 Support and willing to review and comment. .as On 12/03/2013 13:54, Murphy, Sandra wrote: > The authors of draft-rogaglia-sidr-multiple-publication-points have requested wg adoption. > > See http://tools.ietf.org/html/draft-rogaglia-sidr-multiple-publication-points > > Please do respond to the list as to whether you support the wg adopting this as a work item. Note that you do not need to comment on the content of this draft at this time. You are asked to indicate if you think that this is work that the wg should be doing and whether this draft is an acceptable starting point. Adding whether you can/will review or not is useful. > > This adoption call will end on Tuesday, March 26, 2013 (extra time because many of those in the wg are busy at the ietf this week). > > --Sandy > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From achi@bbn.com Wed Mar 13 07:19:51 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 23D7721F8BF2 for ; Wed, 13 Mar 2013 07:19:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PoOQjv3nbc9i for ; Wed, 13 Mar 2013 07:19:50 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) by ietfa.amsl.com (Postfix) with ESMTP id 7CC2421F8AA6 for ; Wed, 13 Mar 2013 07:19:50 -0700 (PDT) Received: from [128.89.254.53] (port=49492 helo=platypotamus.local) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1UFmWz-0000HE-GD for sidr@ietf.org; Wed, 13 Mar 2013 10:19:49 -0400 Message-ID: <51408AFC.2040303@bbn.com> Date: Wed, 13 Mar 2013 10:19:40 -0400 From: Andrew Chi User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: sidr wg Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Subject: [sidr] NotFound vs Uninitialized X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2013 14:19:51 -0000 Yesterday, Ruediger talked about a 4th validation state for BGP routes (RFC 6811 gives only 3). After thinking about it more, I believe it may be helpful to call this validation state "Uninitialized". Here's why. First, for the purposes of this discussion, we assume that the validating cache has a "complete" snapshot of the global RPKI. The definition of "complete" must be tuned via the validator settings according to local policy, but that's a separate conversation. I believe Ruediger is talking about the actual variable *in the router* that stores validation state. Currently, in the router, the three prescribed validation states for a BGP route are (RFC 6811): o NotFound: No VRP Covers the Route Prefix. o Valid: At least one VRP Matches the Route Prefix. o Invalid: At least one VRP Covers the Route Prefix, but no VRP Matches it. There's a hidden assumption in this trichotomy: that the snapshot has been completely transferred to the router (via the rpki-rtr), and all related processing is complete. "NotFound" really means "I have searched the complete set of VRPs, and no VRP Covers the route prefix." Similarly, "Invalid" really means "I have searched the complete set of VRPs, and at least one VRP Covers the route prefix, but no VRP Matches it." During startup, however, it's important to for a validation state variable to start in a 4th state ("Uninitialized"). "Uninitialized" says "I haven't finished receiving/processing all the VRPs yet". This is different from "NotFound". In fact, filters would potentially treat this "Uninitialized" state differently from "NotFound". In some sense this is just an implementation issue, but it is something that an implementer could easily get wrong. You probably DON'T want your variables to start out in the "NotFound" state. Andrew From achi@bbn.com Wed Mar 13 08:51:26 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C5F7921F8AC8 for ; Wed, 13 Mar 2013 08:51:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6ZsVznIfmQNw for ; Wed, 13 Mar 2013 08:51:26 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) by ietfa.amsl.com (Postfix) with ESMTP id 248D121F8935 for ; Wed, 13 Mar 2013 08:51:26 -0700 (PDT) Received: from [128.89.254.75] (port=49672 helo=platypotamus.local) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1UFnxb-000A6C-3M; Wed, 13 Mar 2013 11:51:23 -0400 Message-ID: <5140A07A.2030107@bbn.com> Date: Wed, 13 Mar 2013 11:51:22 -0400 From: Andrew Chi User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: Andrew Chi References: <51408AFC.2040303@bbn.com> In-Reply-To: <51408AFC.2040303@bbn.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Cc: sidr wg Subject: Re: [sidr] NotFound vs Uninitialized X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2013 15:51:27 -0000 On 3/13/13 10:19 AM, Andrew Chi wrote: > Yesterday, Ruediger talked about a 4th validation state for BGP routes > (RFC 6811 gives only 3). After thinking about it more, I believe it may > be helpful to call this validation state "Uninitialized". Here's why. After talking to Doug and Sriram, it sounds like others already had this discussion and used the term "Undefined." That's probably a better word, since one might need it for more than just startup conditions. So do we explicitly call out this state and give it a label, or just leave it up to implementers and local policy? Given that there are already several implementations, perhaps there's already a conclusion to this? From achi@bbn.com Wed Mar 13 10:28:52 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E06C821F85D4 for ; Wed, 13 Mar 2013 10:28:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Hd9w31vsYxCB for ; Wed, 13 Mar 2013 10:28:51 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) by ietfa.amsl.com (Postfix) with ESMTP id 5B85821F8510 for ; Wed, 13 Mar 2013 10:28:49 -0700 (PDT) Received: from [128.89.254.84] (port=49788 helo=platypotamus.local) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1UFpTs-000DfE-M7; Wed, 13 Mar 2013 13:28:48 -0400 Message-ID: <5140B750.2070800@bbn.com> Date: Wed, 13 Mar 2013 13:28:48 -0400 From: Andrew Chi User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: Andrew Chi References: <51408AFC.2040303@bbn.com> In-Reply-To: <51408AFC.2040303@bbn.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Cc: sidr wg Subject: Re: [sidr] NotFound vs Uninitialized X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2013 17:28:53 -0000 On 3/13/13 10:19 AM, Andrew Chi wrote: > Yesterday, Ruediger talked about a 4th validation state for BGP routes > (RFC 6811 gives only 3). After thinking about it more, I believe it may > be helpful to call this validation state "Uninitialized". Here's why. After talking to Doug and Sriram, it sounds like others already had this discussion using the term "Undefined." That's probably a better word, since one might need it for more than just startup conditions. Should we explicitly call out this state? Did we already decide not to? From jayb@braeburn.org Wed Mar 13 12:03:48 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1C73711E819F for ; Wed, 13 Mar 2013 12:03:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HptUce30V1Lq for ; Wed, 13 Mar 2013 12:03:47 -0700 (PDT) Received: from nbfkord-smmo05.seg.att.com (nbfkord-smmo05.seg.att.com [209.65.160.92]) by ietfa.amsl.com (Postfix) with ESMTP id 618D911E816E for ; Wed, 13 Mar 2013 12:03:21 -0700 (PDT) Received: from unknown [144.160.20.145] (EHLO mlpd192.enaf.sfdc.sbc.com) by nbfkord-smmo05.seg.att.com(mxl_mta-6.15.0-1) over TLS secured channel with ESMTP id 97dc0415.0.270357.00-377.754927.nbfkord-smmo05.seg.att.com (envelope-from ); Wed, 13 Mar 2013 19:03:23 +0000 (UTC) X-MXL-Hash: 5140cd7b49560a8f-c84659a21c39045ee0215ac20bc5b3c346d76257 Received: from enaf.sfdc.sbc.com (localhost.localdomain [127.0.0.1]) by mlpd192.enaf.sfdc.sbc.com (8.14.5/8.14.5) with ESMTP id r2DJ3KvM027401 for ; Wed, 13 Mar 2013 15:03:21 -0400 Received: from alpi131.aldc.att.com (alpi131.aldc.att.com [130.8.218.69]) by mlpd192.enaf.sfdc.sbc.com (8.14.5/8.14.5) with ESMTP id r2DJ3Gc4027352 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Wed, 13 Mar 2013 15:03:17 -0400 Received: from alpi153.aldc.att.com (alpi153.aldc.att.com [130.8.42.31]) by alpi131.aldc.att.com (RSA Interceptor) for ; Wed, 13 Mar 2013 19:02:56 GMT Received: from aldc.att.com (localhost [127.0.0.1]) by alpi153.aldc.att.com (8.14.5/8.14.5) with ESMTP id r2DJ2t8r001200 for ; Wed, 13 Mar 2013 15:02:55 -0400 Received: from oz.mt.att.com (oz.mt.att.com [135.16.165.23]) by alpi153.aldc.att.com (8.14.5/8.14.5) with ESMTP id r2DJ2lif000796 for ; Wed, 13 Mar 2013 15:02:49 -0400 Received: by oz.mt.att.com (Postfix, from userid 1000) id E5D8B68035B; Wed, 13 Mar 2013 15:02:46 -0400 (EDT) X-Mailer: emacs 23.3.1 (via feedmail 8 I); VM 8.2.0b under 23.3.1 (i686-pc-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Message-ID: <20800.52564.222858.149467@oz.mt.att.com> Date: Wed, 13 Mar 2013 15:02:44 -0400 From: Jay Borkenhagen To: sidr wg In-Reply-To: <5140B750.2070800@bbn.com> References: <51408AFC.2040303@bbn.com> <5140B750.2070800@bbn.com> X-GPG-Fingerprint: DDDB 542E D988 94D0 82D3 D198 7DED 6648 2308 D3C0 X-RSA-Inspected: yes X-RSA-Classifications: public Subject: Re: [sidr] NotFound vs Uninitialized X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Jay Borkenhagen List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2013 19:03:48 -0000 Andrew Chi writes: > On 3/13/13 10:19 AM, Andrew Chi wrote: > > Yesterday, Ruediger talked about a 4th validation state for BGP ro= utes > > (RFC 6811 gives only 3). After thinking about it more, I believe = it may > > be helpful to call this validation state "Uninitialized". Here's = why. >=20 > After talking to Doug and Sriram, it sounds like others already had = this=20 > discussion using the term "Undefined." That's probably a better wor= d,=20 > since one might need it for more than just startup conditions. >=20 > Should we explicitly call out this state=3F Did we already decide n= ot to=3F Hi, Not commenting for now on the need for a new term or the choices offered, but I did want to point out that junos has a "4th" state now:=20= Per http://www.ripe.net/lir-services/resource-management/certification/rout= er-configuration:=20 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Note: There is an additional state in JunOS called =E2=80=9Cunverified=E2= =80=9D, which indicates prefixes that haven=E2=80=99t been policed. This means there = may be a BGP neighbour session that doesn=E2=80=99t have an import policy route-validation applied. You can verify this with the following command: junos.rpki.example.net> show route protocol bgp validation-state unveri= fied =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D We can hash out whether another standard state is required, but I wanted to urge that in the end we arrive at a set of states with names that have clear and unambiguous meanings. Thanks. =09=09=09=09=09=09=09Jay B. From oliver.borchert@nist.gov Wed Mar 13 18:16:09 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7F02521F8B18 for ; Wed, 13 Mar 2013 18:16:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BnmeiChNJDRw for ; Wed, 13 Mar 2013 18:16:07 -0700 (PDT) Received: from wsget2.nist.gov (wsget2.nist.gov [129.6.13.151]) by ietfa.amsl.com (Postfix) with ESMTP id 28D0321F87CC for ; Wed, 13 Mar 2013 18:16:07 -0700 (PDT) Received: from WSXGHUB1.xchange.nist.gov (129.6.18.96) by wsget2.nist.gov (129.6.13.151) with Microsoft SMTP Server (TLS) id 14.3.123.3; Wed, 13 Mar 2013 21:16:27 -0400 Received: from MBCLUSTER.xchange.nist.gov ([fe80::d479:3188:aec0:cb66]) by WSXGHUB1.xchange.nist.gov ([129.6.18.96]) with mapi; Wed, 13 Mar 2013 21:16:05 -0400 From: "Borchert, Oliver" To: Andrew Chi Date: Wed, 13 Mar 2013 21:16:01 -0400 Thread-Topic: [sidr] NotFound vs Uninitialized Thread-Index: Ac4gUX/Dj9HnfXe8SaqJrZjeMmkbeA== Message-ID: In-Reply-To: <5140B750.2070800@bbn.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.3.1.130117 acceptlanguage: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: sidr wg Subject: Re: [sidr] NotFound vs Uninitialized X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2013 01:16:09 -0000 On 3/13/13 1:28 PM, "Andrew Chi" wrote: >On 3/13/13 10:19 AM, Andrew Chi wrote: >> Yesterday, Ruediger talked about a 4th validation state for BGP routes >> (RFC 6811 gives only 3). After thinking about it more, I believe it may >> be helpful to call this validation state "Uninitialized". Here's why. > >After talking to Doug and Sriram, it sounds like others already had this >discussion using the term "Undefined." That's probably a better word, >since one might need it for more than just startup conditions. > >Should we explicitly call out this state? Did we already decide not to? As you correctly state Doug and Sriram, we do allow the validation state "undefined" in our implementations BGP-Srx and QuaggaSRx. This is for the timeframe where no information regarding the particular prefix/origin is known or during its calculation. In our implementation for instance we out-sorced the internal validation process into its own API - checking the prefix-origin against the output of the validation cache outside of the router. During this timeframe (which is a very short timeframe for origin validation - but longer for path validation) we provide the state "undefined" to allow the router to continue processing the update until the final validation result is available and handed back to the router. We added policies that can specifically deal with this situation which allows us for instance to ignore the update until a calculated result (one of the three specified ones) is available. But IMHO this is an implementation specific solution and others might do it differently. The main problem, as far as I understood it after talking to Ruediger yesterday, is the timeframe in which the router fetches new information. In other words the timeframe between "Serial Query" and "End of Data" - RFC 6810. During this time new ROAS will be introduced or removed from the router. If during this time the router reacts to each change individually without waiting for the "big picture" of this particular fetch/synchronization, the following problem can arise: In case a route with a x/24 prefix has the validation result of "NotFound" and a new ROA is introduced with a lesser specific prefix and insufficient max length or even another ASN, this route will automatically change its state from "NotFound" to "Invalid". If on top of this the prefix in question belongs to the route that is selected, a withdrawal of this route occurs. Now an additional ROA is introduced that contains the exact x/24 prefix including the same ASN, the route's validation state switches from "Invalid" to "Valid" and the route will be re-selected. If the router would have waited with its processing of the new information until all new information are added to the system, the route never would have been switched to "Invalid". In contrary, it would have switched right away from "NotFound" to "Valid" without passing "Invalid" and therefore no change in path selection would have occurred. For this I see two solutions: (A) The validation cache MUST send the deltas ordered from more specific to less specific prefixes. (B) The router does not process the new information until "End of Data" Thinking further about (A) it would only solve the problem of a ROA specifying the lesser specific prefixes that would invalidate the more specific prefix but not the problem of a "same" specific prefix with a different ASN. Here the temporary switch to "Invalid" will occur. This leaves us with only solution (B) that requires the router to wait until the cache update is performed (receiving "End of Data"), before using the new information "snapshot". But to not having to wait with calculating validation results until the update is performed, the old "snapshot" should be used. But this problem will not be resolved by adding a fourth state "undefined". It is more a Best Practice kind of thing which the implementer MUST be aware of. Going back to the missing state "undefined", I think this is an implementation dependent solution that actually only exists during the time until either a validation state is calculated or during a power up or until the FIRST "End of Data" is received from the validation cache - I would not call it uninitialized because it also includes the time between validation request and validation result as described earlier. This time is short but not to neglectable, especially during table dumps. Said that I firmly believe the state "undefined" should be added for clarity and allowing a defined asynchronous processing of update validation without delays of regular update-processing due to the fact of a synchronization between router and cache. But again this could also be only seen as too much implementation dependent. Maybe one more information to our implementation, we allow to freely configure our initialization state, which is by default "undefined" but can be configured to any other state and therefore provide the operator with a maximum on flexibility on how to proceed in this case. Oliver --------------------------------------------------------------------------- - Oliver Borchert =AD Computer Scientist National Institute of Standards and Technology phone: 301-975-4856, fax: 301-975-6238 From randy@psg.com Thu Mar 14 03:55:21 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9973C21F8DD7 for ; Thu, 14 Mar 2013 03:55:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hfUOk3lXOZei for ; Thu, 14 Mar 2013 03:55:21 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id 4588F21F8D8E for ; Thu, 14 Mar 2013 03:55:21 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.80.1 (FreeBSD)) (envelope-from ) id 1UG5od-000M1b-Qo for sidr@ietf.org; Thu, 14 Mar 2013 10:55:20 +0000 Date: Thu, 14 Mar 2013 06:55:20 -0400 Message-ID: From: Randy Bush To: sidr wg In-Reply-To: References: <5140B750.2070800@bbn.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Subject: Re: [sidr] NotFound vs Uninitialized X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2013 10:55:21 -0000 what will an operator do differently for these two shades of grey? what is the trust difference? was this perhaps discussed extensively before? what did the security folk tell us in that discussion? randy From aservin@lacnic.net Thu Mar 14 06:51:45 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2825911E8100 for ; Thu, 14 Mar 2013 06:51:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oGVx9nSAct8e for ; Thu, 14 Mar 2013 06:51:44 -0700 (PDT) Received: from mail.lacnic.net.uy (mail.lacnic.net.uy [IPv6:2001:13c7:7001:4000::3]) by ietfa.amsl.com (Postfix) with ESMTP id 868D611E80FE for ; Thu, 14 Mar 2013 06:51:41 -0700 (PDT) Received: from www.lacnic.net.uy (micron [200.7.84.3]) by mail.lacnic.net.uy (Postfix) with ESMTP id 6A92C308523 for ; Thu, 14 Mar 2013 10:51:19 -0300 (UYT) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Date: Thu, 14 Mar 2013 06:51:19 -0700 From: aservin To: Mail-Reply-To: In-Reply-To: References: <5140B750.2070800@bbn.com> Message-ID: X-Sender: aservin@lacnic.net User-Agent: RoundCube Webmail/0.5 X-LACNIC.uy-MailScanner-Information: Please contact the ISP for more information X-LACNIC.uy-MailScanner: Found to be clean X-LACNIC.uy-MailScanner-SpamCheck: X-LACNIC.uy-MailScanner-From: aservin@lacnic.net Subject: Re: [sidr] NotFound vs Uninitialized X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: aservin@lacnic.net List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2013 13:51:45 -0000 After talking to Oliver and the comments of Andy I think that it might valuable that fourth state. Trying to respond to Randy I thought that it may be useful to know if a route is unknown (prefix holder does not care about the prefix, i might not trust it) or "undefined" (i lost connectivity with the cache) Perhaps adding a very low preference to unknown (not signed, perhaps unsecure?) and leave undefined untouched? Does it make sense? /as El 14-03-2013 03:55, Randy Bush escribió: > what will an operator do differently for these two shades of grey? > > what is the trust difference? > > was this perhaps discussed extensively before? what did the security > folk tell us in that discussion? > > randy > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr From dougm@nist.gov Thu Mar 14 08:07:48 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 22C1B11E825D for ; Thu, 14 Mar 2013 08:07:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GCO5IfW2u7pr for ; Thu, 14 Mar 2013 08:07:47 -0700 (PDT) Received: from wsget1.nist.gov (wsget1.nist.gov [129.6.13.150]) by ietfa.amsl.com (Postfix) with ESMTP id 1A6C711E8258 for ; Thu, 14 Mar 2013 08:07:47 -0700 (PDT) Received: from WSXGHUB1.xchange.nist.gov (129.6.18.96) by wsget1.nist.gov (129.6.13.150) with Microsoft SMTP Server (TLS) id 14.3.123.3; Thu, 14 Mar 2013 11:07:06 -0400 Received: from MBCLUSTER.xchange.nist.gov ([fe80::d479:3188:aec0:cb66]) by WSXGHUB1.xchange.nist.gov ([129.6.18.96]) with mapi; Thu, 14 Mar 2013 11:07:46 -0400 From: "Montgomery, Douglas" To: "aservin@lacnic.net" , "sidr@ietf.org" Date: Thu, 14 Mar 2013 11:03:04 -0400 Thread-Topic: [sidr] NotFound vs Uninitialized Thread-Index: Ac4guxeD7GhUc6LgTcesfKVVzracHQACe/PZ Message-ID: References: <5140B750.2070800@bbn.com> , In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [sidr] NotFound vs Uninitialized X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2013 15:07:48 -0000 I remember, and agree with the decision to not try to distinguish among var= ious flavors of INVALID. I think this discussion is different. RFC6811 provides a complete 3 state= taxonomy for the result of origin validation, but is based on some assumpt= ions (e.g., reasonable access ("loose consistency") to RPKI (or other DB) i= nformation). "UNDEFINED" is a implementation realization that there are circumstances wh= en the implicit assumptions of RFC6811 may not hold, and one may like to ha= ve routing policies that take that fact into consideration. So far we have waived our hands and said smart people won't let those assum= ptions fail. Folks who are worried about new systemic dependencies betwee= n routing and global info systems would appreciate the ability to write pur= poseful policies that could deal with the scenario "what if we can't perfor= m the validation function as defined?". I can think of scenarios in which I might treat UNDEFINED different than UN= KNOWN/NOT-FOUND. I don't think could/should standardize all circumstances under which the re= sult UNDEFINED is returned - other than the situations in which the assumpt= ions of RFC6811 aren't met, or the validation function is unable to execute= the defined validation algorithm. dougm -- Doug Montgomery - Manager Internet and Scalable Systems Research / ITL / N= IST ________________________________________ From: sidr-bounces@ietf.org [sidr-bounces@ietf.org] On Behalf Of aservin [a= servin@lacnic.net] Sent: Thursday, March 14, 2013 9:51 AM To: sidr@ietf.org Subject: Re: [sidr] NotFound vs Uninitialized After talking to Oliver and the comments of Andy I think that it might valuable that fourth state. Trying to respond to Randy I thought that it may be useful to know if a route is unknown (prefix holder does not care about the prefix, i might not trust it) or "undefined" (i lost connectivity with the cache) Perhaps adding a very low preference to unknown (not signed, perhaps unsecure?) and leave undefined untouched? Does it make sense? /as El 14-03-2013 03:55, Randy Bush escribi=F3: > what will an operator do differently for these two shades of grey? > > what is the trust difference? > > was this perhaps discussed extensively before? what did the security > folk tell us in that discussion? > > randy > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr _______________________________________________ sidr mailing list sidr@ietf.org https://www.ietf.org/mailman/listinfo/sidr= From oliver.borchert@nist.gov Thu Mar 14 08:18:34 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DF44E11E8171 for ; Thu, 14 Mar 2013 08:18:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MAJDWo6i1lKv for ; Thu, 14 Mar 2013 08:18:34 -0700 (PDT) Received: from wsget2.nist.gov (wsget2.nist.gov [129.6.13.151]) by ietfa.amsl.com (Postfix) with ESMTP id 43C8B11E8142 for ; Thu, 14 Mar 2013 08:18:34 -0700 (PDT) Received: from WSXGHUB1.xchange.nist.gov (129.6.18.96) by wsget2.nist.gov (129.6.13.151) with Microsoft SMTP Server (TLS) id 14.3.123.3; Thu, 14 Mar 2013 11:18:54 -0400 Received: from MBCLUSTER.xchange.nist.gov ([fe80::d479:3188:aec0:cb66]) by WSXGHUB1.xchange.nist.gov ([129.6.18.96]) with mapi; Thu, 14 Mar 2013 11:18:33 -0400 From: "Borchert, Oliver" To: Randy Bush , sidr wg Date: Thu, 14 Mar 2013 11:18:31 -0400 Thread-Topic: [sidr] NotFound vs Uninitialized Thread-Index: Ac4gom/Ej3s7nS4VSuOgMM2XUfdobQAIhffw Message-ID: References: <5140B750.2070800@bbn.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Subject: Re: [sidr] NotFound vs Uninitialized X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2013 15:18:35 -0000 I prefer Undefined over Uninitialized and therefore use Undefined below. > > what will an operator do differently for these two shades of grey? > The "Undefined" state is most likely to change shortly after assigned. If processed as "NotFound" and selected but validated as "Invalid" it would have to be withdrawn right away. A well-defined temporary state such as "Undefined" allows scripting policies such as "Ignore until validation state is available" > what is the trust difference? > "FotFound" is a well-defined state within the Cache. It gives a clear answer about the content of the cache. It is what it is, no information found in the cache. "Undefined" on the other hand tells me that currently no cache information is available and I simply don't know if it is "NotFound", "Valid", or "Invalid" - I personally have some trouble just assuming a state. > was this perhaps discussed extensively before? what did the security folk > tell us in that discussion? > I don't remember this topic being discussed publicly but at NIST, we spend some time around this topic. And as one of the previous emails shows, at least one other implementation next to ours independently introduced this state. > randy Oliver From achi@bbn.com Thu Mar 14 10:16:24 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2BDA311E8194 for ; Thu, 14 Mar 2013 10:16:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FTfp4ynRGVJ1 for ; Thu, 14 Mar 2013 10:16:23 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) by ietfa.amsl.com (Postfix) with ESMTP id 7F3A411E8138 for ; Thu, 14 Mar 2013 10:16:23 -0700 (PDT) Received: from [128.89.254.64] (port=52891 helo=platypotamus.local) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1UGBlO-000E3t-F4 for sidr@ietf.org; Thu, 14 Mar 2013 13:16:22 -0400 Message-ID: <514205E4.2040007@bbn.com> Date: Thu, 14 Mar 2013 13:16:20 -0400 From: Andrew Chi User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: sidr@ietf.org References: <5140B750.2070800@bbn.com> In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [sidr] NotFound vs Uninitialized X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2013 17:16:24 -0000 On 3/14/13 6:55 AM, Randy Bush wrote: > what will an operator do differently for these two shades of grey? Good question. *Operators*, would you ever treat these differently? > what is the trust difference? NotFound: The global RPKI doesn't know this route, i.e., *nobody* knows. Undefined: *I* don't know what the RPKI says about this route. From Sandra.Murphy@sparta.com Thu Mar 14 10:55:14 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D2ED21F87E7 for ; Thu, 14 Mar 2013 10:55:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 22mmoN8Jpwuu for ; Thu, 14 Mar 2013 10:55:07 -0700 (PDT) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by ietfa.amsl.com (Postfix) with ESMTP id 35EB821F8CD0 for ; Thu, 14 Mar 2013 10:54:59 -0700 (PDT) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.14.4/8.14.4) with ESMTP id r2EHskuE021478; Thu, 14 Mar 2013 12:54:46 -0500 Received: from Hermes.columbia.ads.sparta.com ([10.62.56.107]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id r2EHsfwP022589; Thu, 14 Mar 2013 12:54:41 -0500 Received: from HERMES.columbia.ads.sparta.com ([fe80::e4a8:a383:2128:c0e5]) by Hermes.columbia.ads.sparta.com ([fe80::e4a8:a383:2128:c0e5%18]) with mapi id 14.02.0247.003; Thu, 14 Mar 2013 13:53:45 -0400 From: "Murphy, Sandra" To: Andrew Chi , "sidr@ietf.org" Thread-Topic: [sidr] NotFound vs Uninitialized Thread-Index: AQHOH/W7HlMwpM+770SixP5fz+4b2pikI5MAgACCioCAAKHcAIAAanMA///F+js= Date: Thu, 14 Mar 2013 17:53:44 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F65C23686D@Hermes.columbia.ads.sparta.com> References: <5140B750.2070800@bbn.com> ,<514205E4.2040007@bbn.com> In-Reply-To: <514205E4.2040007@bbn.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.118] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [sidr] NotFound vs Uninitialized X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2013 17:55:18 -0000 >> what will an operator do differently for these two shades of grey?=0A= >=0A= >Good question. *Operators*, would you ever treat these differently?=0A= =0A= I thought Ruediger was saying that the need for this 4th state arose as his= company was studying using RPKI.=0A= =0A= Ruediger, was there a difficulty? a need not met by just 3 states? can yo= u say what it was?=0A= =0A= --Sandy, speaking as regular ol' wg member=0A= From dougm@nist.gov Thu Mar 14 11:02:14 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EFF9911E817C for ; Thu, 14 Mar 2013 11:02:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8MkYLNG1OANU for ; Thu, 14 Mar 2013 11:02:14 -0700 (PDT) Received: from wsget1.nist.gov (wsget1.nist.gov [129.6.13.150]) by ietfa.amsl.com (Postfix) with ESMTP id 56CBC11E8129 for ; Thu, 14 Mar 2013 11:02:14 -0700 (PDT) Received: from WSXGHUB1.xchange.nist.gov (129.6.18.96) by wsget1.nist.gov (129.6.13.150) with Microsoft SMTP Server (TLS) id 14.3.123.3; Thu, 14 Mar 2013 14:01:33 -0400 Received: from MBCLUSTER.xchange.nist.gov ([fe80::d479:3188:aec0:cb66]) by WSXGHUB1.xchange.nist.gov ([129.6.18.96]) with mapi; Thu, 14 Mar 2013 14:02:13 -0400 From: "Montgomery, Douglas" To: Andrew Chi , "sidr@ietf.org" Date: Thu, 14 Mar 2013 14:02:13 -0400 Thread-Topic: [sidr] NotFound vs Uninitialized Thread-Index: Ac4g17AO47+XVHpkTdatleKIYu5UCwABI25W Message-ID: References: <5140B750.2070800@bbn.com> ,<514205E4.2040007@bbn.com> In-Reply-To: <514205E4.2040007@bbn.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Subject: Re: [sidr] NotFound vs Uninitialized X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2013 18:02:15 -0000 Not an ops person - so take with a grain of salt - but imagine a world N years from now where I only accept routes that have VALID origins. All others routes are dropped. Imagine a net/power/nature event that both reboots my routers and all of the caches that I speak too. If may prefer to reboot the routing system without validation, until enough infrastructure is up to begin validation. dougm -- Doug Montgomery - Manager Internet and Scalable Systems Research Group / ITL / NIST ________________________________________ From: sidr-bounces@ietf.org [sidr-bounces@ietf.org] On Behalf Of Andrew Chi [achi@bbn.com] Sent: Thursday, March 14, 2013 1:16 PM To: sidr@ietf.org Subject: Re: [sidr] NotFound vs Uninitialized On 3/14/13 6:55 AM, Randy Bush wrote: > what will an operator do differently for these two shades of grey? Good question. *Operators*, would you ever treat these differently? > what is the trust difference? NotFound: The global RPKI doesn't know this route, i.e., *nobody* knows. Undefined: *I* don't know what the RPKI says about this route. _______________________________________________ sidr mailing list sidr@ietf.org https://www.ietf.org/mailman/listinfo/sidr From Jac.Kloots@surfnet.nl Thu Mar 14 11:21:28 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 16A8711E8162 for ; Thu, 14 Mar 2013 11:21:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.504 X-Spam-Level: X-Spam-Status: No, score=-0.504 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_EQ_NL=0.55, HOST_EQ_NL=1.545] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KlWb+CI4A3JW for ; Thu, 14 Mar 2013 11:21:26 -0700 (PDT) Received: from ms1.zimbra.surfnet.nl (ms1.zimbra.surfnet.nl [192.87.108.8]) by ietfa.amsl.com (Postfix) with ESMTP id A969C11E81A3 for ; Thu, 14 Mar 2013 11:21:25 -0700 (PDT) Received: from dhcp-9255.meeting.ietf.org (dhcp-9255.meeting.ietf.org [130.129.10.85]) by ms1.zimbra.surfnet.nl (Postfix) with ESMTPSA id C5C5719A056; Thu, 14 Mar 2013 19:21:22 +0100 (CET) Date: Thu, 14 Mar 2013 19:21:16 +0100 (CET) From: Jac Kloots X-X-Sender: kloots@jacbook-air.local To: "Murphy, Sandra" In-Reply-To: <24B20D14B2CD29478C8D5D6E9CBB29F65C23686D@Hermes.columbia.ads.sparta.com> Message-ID: References: <5140B750.2070800@bbn.com> , <514205E4.2040007@bbn.com> <24B20D14B2CD29478C8D5D6E9CBB29F65C23686D@Hermes.columbia.ads.sparta.com> User-Agent: Alpine 2.00 (OSX 1167 2008-08-23) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Cc: "sidr@ietf.org" Subject: Re: [sidr] NotFound vs Uninitialized X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2013 18:21:28 -0000 On Thu, 14 Mar 2013, Murphy, Sandra wrote: >>> what will an operator do differently for these two shades of grey? >> >> Good question. *Operators*, would you ever treat these differently? > > I thought Ruediger was saying that the need for this 4th state arose as > his company was studying using RPKI. >From what I understood he's missing a state for unverifiable resources. eg. when the validator isn't reachable. Reading the RFC6811 again, I think the state is covered by the NotFound state; No VRP Covers the Route Prefix. The problem arises when strict RPKI policing is used. Using a strict policy you'd only accept Valid prefixes and drop _all_ the others. For this case a 4th state could be introduced. This state would only be assigned if there are no entries in the entire VRP. The strict policy should then accept Valids and 4th state prefixes. Jac > > Ruediger, was there a difficulty? a need not met by just 3 states? can > you say what it was? > > --Sandy, speaking as regular ol' wg member > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > -- Jac Kloots Network Services SURFnet bv From heas@shrubbery.net Thu Mar 14 13:25:52 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A137E11E80FB for ; Thu, 14 Mar 2013 13:25:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aBiDRXIqoV5U for ; Thu, 14 Mar 2013 13:25:51 -0700 (PDT) Received: from guelah.shrubbery.net (guelah.shrubbery.net [198.58.5.1]) by ietfa.amsl.com (Postfix) with ESMTP id 82D1511E80F2 for ; Thu, 14 Mar 2013 13:25:50 -0700 (PDT) Received: by guelah.shrubbery.net (Postfix, from userid 7053) id 57547AF88; Thu, 14 Mar 2013 20:25:51 +0000 (UTC) Date: Thu, 14 Mar 2013 20:25:51 +0000 From: heasley To: "Montgomery, Douglas" Message-ID: <20130314202551.GC64360@shrubbery.net> References: <5140B750.2070800@bbn.com> <514205E4.2040007@bbn.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-PGPkey: http://www.shrubbery.net/~heas/public-key.asc X-note: live free, or die! X-homer: i just want to have a beer while i am caring. X-Claimation: an engineer needs a manager like a fish needs a bicycle X-reality: only YOU can put an end to the embarrassment that is Tom Cruise User-Agent: Mutt/1.5.21 (2010-09-15) Cc: "sidr@ietf.org" Subject: Re: [sidr] NotFound vs Uninitialized X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2013 20:25:52 -0000 Thu, Mar 14, 2013 at 02:02:13PM -0400, Montgomery, Douglas: > Not an ops person - so take with a grain of salt - but imagine a world N years from now where I only accept routes that have VALID origins. All others routes are dropped. > > Imagine a net/power/nature event that both reboots my routers and all of the caches that I speak too. If may prefer to reboot the routing system without validation, until enough infrastructure is up to begin validation. or your validation server is remote - within a prefix that will not be accepted because it is NotFound/Undefined? > dougm > -- > Doug Montgomery - Manager Internet and Scalable Systems Research Group / ITL / NIST > ________________________________________ > From: sidr-bounces@ietf.org [sidr-bounces@ietf.org] On Behalf Of Andrew Chi [achi@bbn.com] > Sent: Thursday, March 14, 2013 1:16 PM > To: sidr@ietf.org > Subject: Re: [sidr] NotFound vs Uninitialized > > On 3/14/13 6:55 AM, Randy Bush wrote: > > what will an operator do differently for these two shades of grey? > > Good question. *Operators*, would you ever treat these differently? > > > what is the trust difference? > > NotFound: The global RPKI doesn't know this route, i.e., *nobody* knows. > Undefined: *I* don't know what the RPKI says about this route. > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr From kent@bbn.com Thu Mar 14 14:04:07 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0235A11E820D for ; Thu, 14 Mar 2013 14:04:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0 X-Spam-Level: X-Spam-Status: No, score=x tagged_above=-999 required=5 tests=[] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vj+PIFtcOHIL for ; Thu, 14 Mar 2013 14:04:06 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) by ietfa.amsl.com (Postfix) with ESMTP id 0CA3B11E81F0 for ; Thu, 14 Mar 2013 14:04:06 -0700 (PDT) Received: from dommiel.bbn.com ([192.1.122.15]:58397 helo=dhcp107-16-217-98.hil-mcowdes.orl.wayport.net) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1UGFJf-000MG1-Lk for sidr@ietf.org; Thu, 14 Mar 2013 17:04:05 -0400 Message-ID: <51423B3E.6030804@bbn.com> Date: Thu, 14 Mar 2013 17:03:58 -0400 From: Stephen Kent User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: sidr Content-Type: multipart/mixed; boundary="------------030804080901060905050506" Subject: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2013 21:04:07 -0000 This is a multi-part message in MIME format. --------------030804080901060905050506 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit During the first SIDR session I commented that I agree with the need to explore new paradigms for distributing RPKI repository data, but that i was very disappointed with the analysis being used to motivate the exploration. Attached are my comments on the I-D inn question. I have used MS Word with change control to associate the comments (and some edits) with the original text. I rendered this as a PDF, so that list members do not need to use MS Word. I am happy to provide the Word doc to the authors if they wish. Steve --------------030804080901060905050506 Content-Type: application/pdf; name="draft-tbruijnzeels-sidr-repo-analysis-00.pdf" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="draft-tbruijnzeels-sidr-repo-analysis-00.pdf" JVBERi0xLjMKJcTl8uXrp/Og0MTGCjQgMCBvYmoKPDwgL0xlbmd0aCA1IDAgUiAvRmlsdGVy IC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAHNXdty2zgSfddXdM3DblKVhQmC13lLPMlWamey 2URVedjsAyVBNicSqZBUEs/X7wFFUKLkC4iYMu2UbKsU+6DR6MvpRusr/Ye+Enfxj+HRj0IW RRQG9ZdC0ifK6OKy5DQvyWGxFzs8Dm77blLOyRM+Cz0eEI88hkc/ZDG+pcDxmO/HMeEXLts/ GPrM88jDn8L/OHjJpPM3ycEnfvdX/FEeCddx1BP4bH8KOfNFjN8eBh5zPS+i+ZpeTYGmfuHu y2S6povplDOHOE2X9Iye0/RPej0FHC2BuwB1hTDpAcjHEn2I9RZANF1PHgeQWqWSvomEvIB5 IaR+O6BGQpOflFAtdkNAImRB5ESTewH13LLJsd72AeRGOABhs2UThzncCWiqdPtAm7B5XW16 J6vvefGFPuEhza7on0W+3ZDJx5TRq2Kb/pn9JeWqfD6xU8qHV+hxHGkPqwibFY5I5JByLIKd UhqL/G1WySKTleE5tlAKztX2R0pkHYT3q8I/DAHBGPa1dJx7LHJhnjt4YAqVkk4eVNLfimRZ mejk/jX/ZvTHtki+lV/Sm7Po5k7Q49FNzhnnQeNSeulmtpALKquk2pa/0ttsmRfrpErzLFnt xXvXdx/evn9N7y4vzyHyZoXjEbnjMuGKvhb49Y9NWkiI+uX2altWCD5ekOtwoUU8nChdV3l5 WIkGeCPJ3al82HVogHd9HQ64CGMmgoDbIn/F6JOcycLQ4FlY4L3T6irF/Ra4R2jX1wK3sWYQ C+a7CIV3gYupCb5rk02fP4My6JX1VOPLfCazNMnOoAwaYRMwjEAZkO74PhzzWZRhQB0QAXPC iIJmPT1V4I2cFdukuCHOd7b3QBcmuyTTLMXqEc0eQX0cXbCwVHvDgCWGfqzd1+MAsogV94CC gMWBry1VB9CTZMWBogUisAyHp+XET55C69rIA91qCIy7dKuvjeeeQE4ahHQr0IfD7A/v//WW PshNXqZVjtPwEiHfTZmWlGQLPP91izhlLbNqwGRPeI7KYnGSG1mPJroLvJjx2NfHo3+QZLjv FkeY85gFQgntZzAOiM+LmIeTbItvodK/AeGFLvM9H2xfV3wdg3NCnAyZLYchE3DLR4CM0+UK 3qzlZczIQgutc8GZOqELBnQkYnNFDNvhHu+jsdjKdDFgRuD6sB8uPzkET6ZlbiBYLJBndvfP WFwFHMVwh9KNBOOhc7yZk6cTFwoMceRYH8qkcabDiUy44Mj9aDwaJgRnbhBZi8xxBhRWG2j0 sV5nSdCBzHNQWbqlsnAaWxpKSBWwOtWpHsWgANsYOH2j3pezsiqSuanfPgQ4USW7h1OpluXu AuxYiKcRmOsiHhtR9SzggkUi1Cp1R+x6Kivqoe+H6lUr1wPFz8hHchcLWCs7cNNrSfNtUSAf oSZxKfNtMZd0KYsqXabzpJKH2czHqtjOqy0OwudnH95cBl7k0N+GoyRaBlCvbzyZjIPArS2l 9iAADW2NRSy5VwYrbLvt5J+f07aUJRXlTTanpKRZXl1TQgu5qpI6iYVFysqlLGhT5FU+z1eM 6DLP5qjHDZjUetBwR3hQ9d3qRqMJfgzaLOhdMwafcQZVsAR3nXyTNJMyoyJJS1Syklm+raiC uSjnySqZpau0uqF8iadAbSCKHc4GtBGZXktPXlITMYp/wQI6Qp+o1pe7mKNDY2ziSkUcwcUj 4zwC2vGlJynwgFrQkoCqr8cNe9fYz6SiduAKuUK9AZ4qh5IqWwUrNFXKuMjnW0WwKfP0LV3A lCUZ/jUsXK2yspQD6msUIccB46qlPh5LFYJC6oagD/OZZ1ICG2jzxunUXklV2LcrhCvKHO1Z VsLztNzWIYvq0WEDbrzOhvx6MePZ9iBmvtOW1B/HHEHIfZn1vTkKHBY6vaunH+tuCuV06nP+ h1wPSJ3wwGUx6CbyO2AfoE5MjflPSc/n6KvUaUhnN0+Tj463qxs9zbxdj8zWR8GEu2AMexd0 7MD1yosswdUK1rPFDHtKnyYH/bIGybfm9I9g3r+pPUjzbgjz8KZyXzDhBIKOAJkmu7seMzjh cjtbp1WFyDHNYH5XK4KxrpuglMv+niKl6MZij1whbptb9ELGY42Fx7inC7LGPWVncsN24OpI q0R3W6ms86vL94Q6moq3XzVHfNK3zfrhs+Oic81xRUh+g7lnWqBAxszQBFlk420hRePb2ccx OBB0rAldg+12Nj+NA+EB+mdwUWCUDsQOnI3vaO5amBK3rocLFKAj/S7Cp/MdbsxcP/SOAfXy HUjW4EZVoK766HUqV5sVRT5osdLr7CrNpCzwqgED+jahb0Q8HifihMyPdBA4NidiB26alF/o Ta7I58/P3r6evvn8HCn9uxwEdHWdVAQaEpzjlbpaUdI6uaFkVea0SFEhSWfbatCMHi479CPy m5WNRg88aGh41Es1lpTeDtvp0QcFrY/9gbd+5HhRd3E3oI022DQOtwoeHBR90VJqJ8Q6DC9r QkzSCidEhWW6znMozInFDbiHQzPPiRgSwhb9U0uzLR10pXm/p+yRyvfNsloixItiFsdHVSSj XsiDk/BA/+MhuF6psyW4ne6Ranis6LqqNr9eXCwSUDeoY3+RBUtltWR5cXVRN6SVF41aXgxJ zIHC4W4Qk16SkUKaKoDF8T5QACQxXNeUR5AbeGjjO+ZyRuNQrLAdmjuDC78Wu8l1JN4V3v3m xdR51KzS4S1sAxJHB+JdPBZxeH1ED6Lwb8kqXdSMeoII7Ee63q6VZynTH7TOs+p60PJvc4G1 WdR4jjA6AD2BHrs6ex1ZKO7ZgVPUjYqwZ5K2GxhvuXgBPdyskrn6DgWVfFbmK6novRmqwHVg vs/VYPeTbND7ok0ngF7deHTBx+AD0fu+6Hm4PTRn24Cr0rVEJPm2Ui49zZINyL5Nkaq+oCpX rSL76Hyw2+uubhvVazDacVMTa2Hy3dhlIeKJjkiNm34RIhnGbxbQBHJUl8fiCJyxYVpWiNxU DRUdPhJk/YBIcc+sTqu7YhxDFOT5LNAVtnH1dnk20HD1HFQZrp7DdOPQztOaU5Fw3rXpBr2C DomSflHJtyrY4Ihf4TZ1yX4ZkFzDuBaMfQhptyKjE32WkBy3IKMg0P68E8VZN+/gOFlXyz1M 7MAVkXH2bXTBGRsZm/qqhS3kur56BPP+TTX1Gxab2tZXu4D6eA7M8Pieop4q64kHqvvpaORB XdMahthp7yJo+OM5tbi9t+8o6ezvk9S0PAyPEU7vpojLfHNTpFfXleK9U2Pna6OJ7dHoIh2B 6BxM9HJaUrsDCAb4/GOzBII9X7dPNUd1LCSdHba9mn1+NkfDdz0pRZVcaFqo6SlNqyxtZFGq oj66KDN1G0A1Apd148Zgob7Q3ZPNykZjYQTu0oVCV6mNPd15cjtLcDpnp2RbXeeFqhi8hGup LZBKAYaL/truCI282ec7SKqTwKuUxTe5GLJ9I8SEF5gh0gBH074hQgTOY5pziCFCjO/nHN6x hadu2PgCBDTRuophCa7bSb5raPtTznEFIj/sb6p7Elq7+feSfpdXyWq4Y9O2telljcc8YtQE b2dLjs082oF7ry4Q7NraPki0lquWFOx/7Sh/a24ZDEh5t3fLRQN/PJuN4FFgbucoOW9hB+7z s6ZYiRuOZSXlvlC5QiCeDXljZO8MG+hGG22aplrkzRijy4LYdclSlilafRFWgkmSy6WymshS lalUpQQUjBSlOFCC2kaPfSR5DlpJYK4GLgRZTL4ZjoBtL4xagttsZzgb9VhLVQasDm9fIZR8 v5IJygOF/JbK72r/8YOOOAc0myo+8n30sOtVGZ2m8+iAwwI+0lKhEFbg5ujXRH//cErazmWy BLi6edEkrTe4w1zO0Swo6QaX3HWao5JdkN3oIpyrAa3l7nYCntnAcg0XyrVX2/W6xqOmLmfo LR2pd7cDh7Dt2Dxd5guMOcjXmzxT49hAqNajNsBxLIt83X05rRETDKkLTUVbNKsbjy6oW/f9 x/GeifWwA5dm89UWe/8xXW9WO1br1cff6PddmEcVFEFZDG0s6itMH2ELYBzIY3UAMxj95Tno JsF8K4yUquU+HkXAmzg43ojKYm7s47pBWxbr0MSnXIOhfzpiGvDOCuZv9+BGanKUHv3ZvVfz JLy1iwl4wX70pykvc/B+BC9I4iio+R74aEZsH5eb9oETLnk97phXFFAwxCn2Sa+kOQ13rOSE JKxhHzwcKMEjt4+3vIwl0v++T64k8f8dILxPlhYpXRtuaISj4TMx3AwDV2+v95zzIPOIMy+g ++DsNeyWN0n5P4kVodYKZW5kc3RyZWFtCmVuZG9iago1IDAgb2JqCjMyMzAKZW5kb2JqCjIg MCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCAzIDAgUiAvUmVzb3VyY2VzIDYgMCBSIC9D b250ZW50cyA0IDAgUiAvTWVkaWFCb3ggWzAgMCA2MTIgNzkyXQo+PgplbmRvYmoKNiAwIG9i ago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBS ID4+IC9Gb250IDw8IC9UVDEuMCA4IDAgUgo+PiA+PgplbmRvYmoKOSAwIG9iago8PCAvTGVu Z3RoIDEwIDAgUiAvTiAzIC9BbHRlcm5hdGUgL0RldmljZVJHQiAvRmlsdGVyIC9GbGF0ZURl Y29kZSA+PgpzdHJlYW0KeAGdlndUU9kWh8+9N73QEiIgJfQaegkg0jtIFQRRiUmAUAKGhCZ2 RAVGFBEpVmRUwAFHhyJjRRQLg4Ji1wnyEFDGwVFEReXdjGsJ7601896a/cdZ39nnt9fZZ+99 17oAUPyCBMJ0WAGANKFYFO7rwVwSE8vE9wIYEAEOWAHA4WZmBEf4RALU/L09mZmoSMaz9u4u gGS72yy/UCZz1v9/kSI3QyQGAApF1TY8fiYX5QKUU7PFGTL/BMr0lSkyhjEyFqEJoqwi48Sv bPan5iu7yZiXJuShGlnOGbw0noy7UN6aJeGjjAShXJgl4GejfAdlvVRJmgDl9yjT0/icTAAw FJlfzOcmoWyJMkUUGe6J8gIACJTEObxyDov5OWieAHimZ+SKBIlJYqYR15hp5ejIZvrxs1P5 YjErlMNN4Yh4TM/0tAyOMBeAr2+WRQElWW2ZaJHtrRzt7VnW5mj5v9nfHn5T/T3IevtV8Sbs z55BjJ5Z32zsrC+9FgD2JFqbHbO+lVUAtG0GQOXhrE/vIADyBQC03pzzHoZsXpLE4gwnC4vs 7GxzAZ9rLivoN/ufgm/Kv4Y595nL7vtWO6YXP4EjSRUzZUXlpqemS0TMzAwOl89k/fcQ/+PA OWnNycMsnJ/AF/GF6FVR6JQJhIlou4U8gViQLmQKhH/V4X8YNicHGX6daxRodV8AfYU5ULhJ B8hvPQBDIwMkbj96An3rWxAxCsi+vGitka9zjzJ6/uf6Hwtcim7hTEEiU+b2DI9kciWiLBmj 34RswQISkAd0oAo0gS4wAixgDRyAM3AD3iAAhIBIEAOWAy5IAmlABLJBPtgACkEx2AF2g2pw ANSBetAEToI2cAZcBFfADXALDIBHQAqGwUswAd6BaQiC8BAVokGqkBakD5lC1hAbWgh5Q0FQ OBQDxUOJkBCSQPnQJqgYKoOqoUNQPfQjdBq6CF2D+qAH0CA0Bv0BfYQRmALTYQ3YALaA2bA7 HAhHwsvgRHgVnAcXwNvhSrgWPg63whfhG/AALIVfwpMIQMgIA9FGWAgb8URCkFgkAREha5Ei pAKpRZqQDqQbuY1IkXHkAwaHoWGYGBbGGeOHWYzhYlZh1mJKMNWYY5hWTBfmNmYQM4H5gqVi 1bGmWCesP3YJNhGbjS3EVmCPYFuwl7ED2GHsOxwOx8AZ4hxwfrgYXDJuNa4Etw/XjLuA68MN 4SbxeLwq3hTvgg/Bc/BifCG+Cn8cfx7fjx/GvyeQCVoEa4IPIZYgJGwkVBAaCOcI/YQRwjRR gahPdCKGEHnEXGIpsY7YQbxJHCZOkxRJhiQXUiQpmbSBVElqIl0mPSa9IZPJOmRHchhZQF5P riSfIF8lD5I/UJQoJhRPShxFQtlOOUq5QHlAeUOlUg2obtRYqpi6nVpPvUR9Sn0vR5Mzl/OX 48mtk6uRa5Xrl3slT5TXl3eXXy6fJ18hf0r+pvy4AlHBQMFTgaOwVqFG4bTCPYVJRZqilWKI YppiiWKD4jXFUSW8koGStxJPqUDpsNIlpSEaQtOledK4tE20Otpl2jAdRzek+9OT6cX0H+i9 9AllJWVb5SjlHOUa5bPKUgbCMGD4M1IZpYyTjLuMj/M05rnP48/bNq9pXv+8KZX5Km4qfJUi lWaVAZWPqkxVb9UU1Z2qbapP1DBqJmphatlq+9Uuq43Pp893ns+dXzT/5PyH6rC6iXq4+mr1 w+o96pMamhq+GhkaVRqXNMY1GZpumsma5ZrnNMe0aFoLtQRa5VrntV4wlZnuzFRmJbOLOaGt ru2nLdE+pN2rPa1jqLNYZ6NOs84TXZIuWzdBt1y3U3dCT0svWC9fr1HvoT5Rn62fpL9Hv1t/ ysDQINpgi0GbwaihiqG/YZ5ho+FjI6qRq9Eqo1qjO8Y4Y7ZxivE+41smsImdSZJJjclNU9jU 3lRgus+0zwxr5mgmNKs1u8eisNxZWaxG1qA5wzzIfKN5m/krCz2LWIudFt0WXyztLFMt6ywf WSlZBVhttOqw+sPaxJprXWN9x4Zq42Ozzqbd5rWtqS3fdr/tfTuaXbDdFrtOu8/2DvYi+yb7 MQc9h3iHvQ732HR2KLuEfdUR6+jhuM7xjOMHJ3snsdNJp9+dWc4pzg3OowsMF/AX1C0YctFx 4bgccpEuZC6MX3hwodRV25XjWuv6zE3Xjed2xG3E3dg92f24+ysPSw+RR4vHlKeT5xrPC16I l69XkVevt5L3Yu9q76c+Oj6JPo0+E752vqt9L/hh/QL9dvrd89fw5/rX+08EOASsCegKpARG BFYHPgsyCRIFdQTDwQHBu4IfL9JfJFzUFgJC/EN2hTwJNQxdFfpzGC4sNKwm7Hm4VXh+eHcE LWJFREPEu0iPyNLIR4uNFksWd0bJR8VF1UdNRXtFl0VLl1gsWbPkRoxajCCmPRYfGxV7JHZy qffS3UuH4+ziCuPuLjNclrPs2nK15anLz66QX8FZcSoeGx8d3xD/iRPCqeVMrvRfuXflBNeT u4f7kufGK+eN8V34ZfyRBJeEsoTRRJfEXYljSa5JFUnjAk9BteB1sl/ygeSplJCUoykzqdGp zWmEtPi000IlYYqwK10zPSe9L8M0ozBDuspp1e5VE6JA0ZFMKHNZZruYjv5M9UiMJJslg1kL s2qy3mdHZZ/KUcwR5vTkmuRuyx3J88n7fjVmNXd1Z752/ob8wTXuaw6thdauXNu5Tnddwbrh 9b7rj20gbUjZ8MtGy41lG99uit7UUaBRsL5gaLPv5sZCuUJR4b0tzlsObMVsFWzt3WazrWrb lyJe0fViy+KK4k8l3JLr31l9V/ndzPaE7b2l9qX7d+B2CHfc3em681iZYlle2dCu4F2t5czy ovK3u1fsvlZhW3FgD2mPZI+0MqiyvUqvakfVp+qk6oEaj5rmvep7t+2d2sfb17/fbX/TAY0D xQc+HhQcvH/I91BrrUFtxWHc4azDz+ui6rq/Z39ff0TtSPGRz0eFR6XHwo911TvU1zeoN5Q2 wo2SxrHjccdv/eD1Q3sTq+lQM6O5+AQ4ITnx4sf4H++eDDzZeYp9qukn/Z/2ttBailqh1tzW ibakNml7THvf6YDTnR3OHS0/m/989Iz2mZqzymdLz5HOFZybOZ93fvJCxoXxi4kXhzpXdD66 tOTSna6wrt7LgZevXvG5cqnbvfv8VZerZ645XTt9nX297Yb9jdYeu56WX+x+aem172296XCz /ZbjrY6+BX3n+l37L972un3ljv+dGwOLBvruLr57/17cPel93v3RB6kPXj/Mejj9aP1j7OOi JwpPKp6qP6391fjXZqm99Oyg12DPs4hnj4a4Qy//lfmvT8MFz6nPK0a0RupHrUfPjPmM3Xqx 9MXwy4yX0+OFvyn+tveV0auffnf7vWdiycTwa9HrmT9K3qi+OfrW9m3nZOjk03dp76anit6r vj/2gf2h+2P0x5Hp7E/4T5WfjT93fAn88ngmbWbm3/eE8/sKZW5kc3RyZWFtCmVuZG9iagox MCAwIG9iagoyNjEyCmVuZG9iago3IDAgb2JqClsgL0lDQ0Jhc2VkIDkgMCBSIF0KZW5kb2Jq CjEyIDAgb2JqCjw8IC9MZW5ndGggMTMgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0 cmVhbQp4Ac1dW3PbNhp916/A5KXNTBYlCPD2qNjOrmd9q61Mp9P2gaYomYlMKiSV1P31e8Cb REm2SWTJoO7YFGNLB8DBd8fHL+RX8oUwE/9TfLdch7ouceziRxqS30hMfjnJGAkyYlBPeAbz 7GNXkywgglvUEcwmzBUU3y2HergktiGoZXkewRsumg90LCoEEfgo/MXOr0xan0kMfOG9v+BD mctNw5A38NW8chi1uId3d2xBTSFcEjyS9zP8hsEMezKTuIo/qX7MHskvsxmjBmFktiA/n8d5 mMZh/pbMPpGzGfDVU3IU4WR/Vor3fhEhYxKLy/cQTl7G9a+OgDCrfaeMMUFdU66z0oydpv4i J7c3/z0nt+E6yaI8SZ/INPZXT1mUET+e4/6XTZSGj2GcZ4SQD+F9uvHxS6bB+NtJp4mWbOlJ BcHAW4FprQc2Kanw8kSTjhOtsPJbblpgu4UdVgB6ZeW7AlJY+S0gYVPhYAMemaHJ/hbpAai9 ZJMeu5c71HaN9u4l+7v3EBpRBFdAe0W0uBb1bI9bxFEDlz+EZJZuspxchEt/RW7S5GuURUlc bhIfDF/LW/NwTr5F+UOyyck3P039OH8ifjbcRuGuSz3XspuB6bNRTBcayKk3SinED2hADhja mQYKu3hLAzVw8zAL0ugeixzFRHLiLnpcr6JFhDvv707JRRSEcRbS4dbbdFzKbQPrXY1Ao/XG Envc1kcwMkYZs9ty6HUrYubfr0KSLMhJAnsCWm84pcIsTrlhQ8u1oOqgVAyTcpNXm7dtdx1K 7o4zdGAH9FAqEN7UMmGx7pqEB9LkEFpnabIHrpdSUQTHKGmbV3GS+zmUCqEdvwgxhxM1jQ1W D08bUWPDK7EsmL2lDaaXalEEZ4IMcGDSZL4JCg50pMCWKoSMYZDXw9OHDHDuHMvT086w1cBx kAHqJ4A7m5HfYE+SYJOmUEaQUo2b9iJBRiJDNTx9yGDbMPRhDveWDJ0VhYLZ6VnUcl2PEVsN HqdSVdwF/sq/j1YRXAqYJ2n2FAd//jz/8y2Zh8NpAVN41EKsqMFerXVXobvKfcQNtlJq/2ok olYTrw9RZUjNRYROU6KqweNUqrGP67mfI0CYInQUxgEcYMSR4B6v/WVp3uTRY3iUFCORoRqc PmTAHmOepaDCEJHrGjVRkFvMsKhpuBax1QBKOkjJdRktU6x8vCR5AjIk8JxTMr27ekku4M+I GE6sbY3bamgakcGgwkAkXUEyjEQGJYCSDFI6nKVpksr4ye319GUC7KqKschQDk0fMnBG7SaU 2op+H/q6A7rhNuXCc1xit/A8YwMcIpNiqquc2nXEJzJZ1SEt08gpJXiSmdLifv/vm7sw6M7J kp8jMbMcmT7ENE0KMiiprI48VVBYW0NbDR7CceDBhR98bixskuUwX/x0XlgxMtxb5MIKQ+bA hhmJC9Xg9CED49TljpLKGoMMavA4FSDDeRwgyxNlMhSMaF22xqvjxuuuupLXhFhj2C/V4PQh A4Sx0aQjSxXxetS9j4b4LsGghA6xZ6znHSxYpAbWm/tVFJSezDqJQIt1WLF48krJwa5uKwox XtdtpiUoZ8xBYUUxr9U6P6N6D9JpKTmZvuh922NwtAW9ZcUcAO5qJiiQoEmZW55NDVslNdnZ ilGA1ygvRXic2pKkO1Gi/CFNNssH8hCFqZ8GD2DtiizCHFfwxQ7l1RhcqAenjbySlVKm0+Qt u26s7gatAhWaPLUiOKm4TkOE3mShQp4EyaqdaCoLe4LkEWU9iNUUdQxtOhDijCAY6uHpQwak 13vXnY2luywVcKKIwMxQiQLTJc3JdBknWR51dnNGIkIxNH1oYMugd53+nnSXCcNZsy6KGSwP mQ1LFduAmnWrutTAoXhRqq7NuqDozY6BdRfKssO2bDp8NRJJq8FpRFODOkZdFNGDpoMqrx0y KMGDvbtDhjiJh9tUzHEoRyUBNlUL6ssm6pD1vC4i5ra1h6dzBXTL0NtJFa/8p9YkTmSd+NGi aAUPBVEgapjIbtaT2Gl/dJ1EBeuJMxvhCNdrAPUMpcvizbaMkfJlt6j8/zp/TSqi1/wNKM23 fpLFUPffrrnSx5W3lNCJIqpz9vc6DHJUbS78ADXvqOJdLHBDukW72ybx5/vKZyRVU46t004a hQkCNQimWRWZ99M0Q/rMTYbSUgMo2SAzlKdRFqx8pKXT9noP5wOZFnK+JoOor5BXa93V1mwL qP1XI7G0Df1lrTkKTTmWU6iV/4xDUzWAkqaFhRz9E+I4gZRdmcxQyBL05Sq5R1inOMSzT4Py 9UhkqIamj8wyLRh3dQlzua86aq9xuKCET1KhKA982KTxnplyfPl37xJmDCfStoZMOTJ9mACD 0LJwflHXkgpLDaDkggz1XW0e76G5IBBuw9WTNGJu/DSPkKbaXfv965G4UA1NHzIYDqoxa6u2 jynTcgGKo7ZHXSgFj2Ub71UGN6B63RpZaugkSWX+7IPMPOyUBR7h6xHCEsbGEFnV0LShqfBc 6tT1oZ0DAGOFotXQlTRofK/9c8eto8b70kq+HocK1dj0YYLrUc+rM+p9BJZkw3BCqxELQg2g ZIP0va7vPxX2bJmU6qq/RuJCNTSNyIB+B0yt1GYkMigBlGTYqR1PwxVKyOdwcIoM9vogItcW D1DGI+gIgRyMnHt9yOCgpLYOyvTTEeNwQQmfpIL0cKpjBDUVUIZVHoLCgYIjZkJNiJGoUI5M HybYqFbjhr4ejlADKLkgPZw9LuToW7JADvtrsto8hs+yYSQuVEPThwwoGbN5ffC9n8EwnLnQ pAWFGjyMCUS4DXE+NiQXMjKPg9InqMpMZfQrXA+nAJojcDXyaqW7hmrLvjrPu+NklE46e+B/ fLBWCIvauiaXlMAJ6mxlFY45oTFIWSfaoYSh9G/GOMFdDk0facWRrbVtJdU1hrRSg4e2XFtp dVLEap9VU7XpsvtzJJlQDU4fMqCrjYHWNiqR2jHIoAZPUA9kuIuWMVyaoi7z5cjsLhFGlAvV 4PQhA/PQUajWEC2FdXjErOPqH9S3dOhBUx9+Ey08z2j/Q2RdQzAK0Jq4sRq04lBDCK9KthRA v4kM/cvkQV3Z1myfg8dfEzbGGd1qdBoR00Dfptrx7mNgd2Tp96QQBHpUKoCTxvU0+Bwn31bh fFn3ezy+6sfvjsWFcnj6kMFA21KjjtTrRgY1cNKMvUrSR8iCryGcq0WI5jNBt2NvJTlGIkM1 PG3IwD0TPWwVag5GEAxq2KYbdLNMs5/IdD5Pw+zY2ccK+5CH3yrsP3qdm6Ittbk8Ljfru3LL lEWmA8xkU5uhyUw2Nabc5dThTW1Gy8pTPhwIU6pvJ+UtIAfmev/m0zKT1Upg1s38htvZzGNI EQub8BZkDdpHcrRbYk2TZA3aR3K0/GHbJsndbXdF471X+0hFcDMU/30On8i3JJ1n5M3lx7vZ m3flT3J1XVzfnv368fz27FTev/vP9OKiuSh/Y7iYqTBcmZpyST24Hy26t/tboINu055aM3uN q4HD4l5/vKiWWV5tCXByfXl5dnVacuBy+jsYIBPtb65vZufXV9OLN2Ur42jAHtUCLQoMLixS j04fLnCc89O1RzVXAzdPAuTE0JXAR1Ny9Nu6D7HCeDDCOg1lRh3d+FpdrIcTAc25oHog1bI/ I3wPlP0ftx9OTMa8vwgdTodyPDgBTasdUoOsIo8a2CHcoDarU7o66FCTUdRN1v2092do0noW h6LeLLs9yUeQdHhMCJdy5Zkm1Vs2TcqHg3wXoI7PLUECHq1PbKGNfDORdDW3jZL3l6z9+JQe M6RsXJsuHlbRNOvtXLLyPt1En+J/wnCVvSMhRNsK1jb+Qykhnk2SkelmKZ/NwKx3xXNJin/b /fbHjb8MifnXcMKu8a/qEerDAZxxtbctcX8YBxiqp+CrmC04PcTa/wBnDXJ0CmVuZHN0cmVh bQplbmRvYmoKMTMgMCBvYmoKMjk1NgplbmRvYmoKMTEgMCBvYmoKPDwgL1R5cGUgL1BhZ2Ug L1BhcmVudCAzIDAgUiAvUmVzb3VyY2VzIDE0IDAgUiAvQ29udGVudHMgMTIgMCBSIC9NZWRp YUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9iagoxNCAwIG9iago8PCAvUHJvY1NldCBbIC9Q REYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9Gb250IDw8IC9UVDEu MCA4IDAgUgo+PiA+PgplbmRvYmoKMTYgMCBvYmoKPDwgL0xlbmd0aCAxNyAwIFIgL0ZpbHRl ciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBzZ1bcyO3lYDf+1dga6t2NVVjuu/szps9SXad VLZmZ5Tyg8cPFNUaMaZImZdRlP+5/2e/gwP0haSkZnsoMxNT3Wjg9MHBwcG5Af2r+V/zq4li /j/iNyvGo6Iw49z+WVXmR7Mw375bR2a6NuGoTMswKvNDV8F6atIkG43TKDdRkY74zcajkkuT h+koy8rSAPCmfuE4G6WpSXkVLVpVgs47Tcg/YP/KS6MiicNQCvhX342jUZaUQB/n6ShO08JM 78z3l9QIozAPLgUv28T9ubwz315eRqPQRObyxlz8sNhUq0W1eWMu/2H+dAl+niQHMQx2qWJh P4thFAkuRbKDYfA8Xt/0RAiqHkuyKEpHRSzjPIhif1xNbjbmw/u//mA+VPfL9WyzXD2a7xaT +eN6tjaTxTXlv25nq+quWmzWxpg/V1er7YRKcRglb4JehBZuOZIV0gi+TSGr71igrPA8oU1P Qg8Y+YY3M7g9Y4ZZhF4Y+b4IDRj5BqE0H6VjJuABCgW7U+QIhLpDFhwxe5PxKC/C7uw1u7N3 D7V4ZAwzeLW83k43s+Wi51gOIF2UFqO0zDMz7mLaYa49/F6FdHGB1B475toTd0FH3A1GSOSc SPk+kjhG4JVJ3pHEL48lgqL/8LUZzbLZC8tEkY3KvEwYvmHIXd5WZrpdrZBoXvStl9vVtDLv qtVmdjObTjZVWx5+3KxgyS1S7NPFhz+/y9MiNKcUfckoTNKme71E33/0pPcA0dfI4g69z0H0 RdEoivKupHlZT+jPnQOo1XBnB7lAlZi9qWN2JbQyWPTpjdmuq7VZrR8XUzNZm6vl5tZMzHU1 30zswrxZTRbrm2pl7lfLzXK6nEvp6dgyGZejJM8jM3b96sWWfcXAAEI3C2AYj5I48StyX0K/ EhcMQ25VTZd36FzXa7O5nWxY5Jx2NoMnriqzrjZme29mC1jidlatJqvpLXJrbh4mj2a9nd6e kBHKYpSHWWzGrmtnwwgsCqMsxqpR1ey8GGEgcm7054+zxWdzP2F9ggE+XXyZzGfXE1GTzGa5 nK8RF9PJwtxUmylSYj6HOXhMVeGQ0/FCGiajNMqM79z5sAJ2a5ZhGJ0lKwxDbg0LzKtGFDya 6gZlZYYeM380D7czHt5Xq5vl6k6Y5XSjnuBiCOMyMrnriBv2vhNus7w/nbaSxJhDWQFPdqnc Ue73Vt0TmuhJEo3ivIh3EOrt1bhePixMM99HpyNdGhajOMbtchTp+i7xAwy1eonPceCMs/Kg XfS7GGp5nmOEZOdpFw1E7vIWl8+6tnVuUTpn+HyuqkV1w4U1z3UJmm7nkxUPjdRhtVk+VNcG uXM6kVMvNI7u57PQiGu0wNN6lgvNMOSqyYoF5bq6ny8fxe9nljdqKD/MNrfL7QaVtDKLijHf LJnVpxv1ZqFxHek17H1l+QCbI4nyUZEUpcmHUXa2+CL0dGbc6SR5wtoXjTMkeRfP5xfBV5Hk aTmKSqwH9VaqynAuJnveQa63ye4N8Ldql4sYbQtGnU6T6+U94Yl1PZmYO1fb2fwaVf2EM8gb a75rvWZQX0YYMIOaJT0NR2lIwOgsBecw5Jao39YowxCv/skNujluxTtWRg1JBS+EpJCmbW+o DUi94A2NcceEcTI2ucP5SGW8MsR3pr/MH1nfxTOqDibP0qzu66Vw86uwqHLE+bAomnu+E8c4 G1E1CDevy4myBq81XoVHdSMgwUSbE/ORNf5O1nfHHdTewM5fTrjaN+aH9u18+CCORzm6yHmK qmHIPeBV/M81WtyDOhFrB+Ojmc/uZhthAfUmbWZ3lV3YrvAvP8yucUNv15PP1eh0IqHhBNe5 82GFKEEBHPtV6wz0qTAbhXXw98zUqUG4/ffkizDfejLDvkCXemsOL6vIqrV5qPB18nc+uTK4 O4Vt356OL5Nam9KenQ1bZmU+CnMfN+6tuL5OCGQHuefnzG1Po4j16NhcmTIcjcel5EZ1qNXb ETf5QtzlVrxx1inPAom2NuG/6RItb7WAG7GPQezzZCVxm6W1k12k+YRM6W09363z4Upy0OKx Tx44N64chtxscbOaNE4yywn/2CJ4blChJFInvpEf/4s/s8UvOMeuxF8yu0Of/uJyqGaL0/FC yvJkcwck/U9Ifz68MCbn5jwD9dkQ1GRlMuv7yRQ96HTphgnpQOOx6WDYkZ+/i/M7y8tRFvqA +xlkKWU5oj30gV8n0PdSLfZolWDyvvOy+0eR3T4tqNGGTze4JLiO8jJmOepgfwZpNVkWke7r YxtnwG9pQkpz7DMcnwgzHhjeiAH+SFbE5Go2n20exfVm82k+XVwTMLeejvVrDHAH/3MY4AT3 cFpHr85ghONslOw4hV+ev/3VV5Sytl/tqCzDbBBuH2zeluRQmy8V6dJ1qN6cMD09jjKsUzIj D+H8sueKRBLSCKqFZJ5dm+gPEbG/zUNFwcRM55JnYFPMWO6Cl7Prd0jex5VZm1cO/fNRXgj7 ZBn7H87RV50NQ25drWBM5/RFPb2a4++DX60Sa/PKPs+XV7gDfSQQlrAbBR4weCYn1GGToiCi inDyHRvKBvv7YPbiFbwoTGQNDkdFxpaY1gX50TKd2CYDJpj7WZ6nJknQMwj2giE7a8pSAL68 D6YtevrMgzpGkoXjUVZEXot/YuHbS2bpLxf3CGLRezY1vM5v9cgdOSkkLjLFJBIrujLL1TUZ rKzLafiLjzqdJEjiBeMwiqr0O6muICp1VMJqOuRHUvWtWS23n2+ZrNMlme3r++Xi2nrxrRNC dJxTiWxmRJmlNd4nmqzvPjJFyzArCtTAkHTfMo2ionX18d3edoZvmp1lOH3GRSi4RbJjKjNR iisvM7v3c/PR7hlrWsq2lz1ADE4AILJNLSAFo3dZYvoDEWxoFqCLxR4bB4atcEcBiktElOtW QLfa90cCYq2ru0U2reJ3XLdsM4D4btX3dCtQ+jy7NW+A8lALTRnZcVE4Rjwvmelw08kN9/bb 17jY3l2plPzu4//gD8eziMtxIWIUZ6PkYjHvKZxwW2/ic+v76XxNyVhSbPPEdAneMSb2l6bT mVsNAxTlqCx9TOQMzK20IEQf+aBR72F/nWW8i1xvJ+2PYifICq4bVCSTpWvYBMhcUpAO7ww+ ViOKCpQ5Nux5ZHutMifMA4sK0j/H+DM9Qkcu12g/O3kWaN7W6vp0wdaP7Wo9I9hg46+s4p/e nDCmVbuMfVd60dbraifYY93M43Es6chHCstXmjWDcJP5onJZLC12+NxvNy5fCAlOcuBy/gUz C+7AaSVJtjYML62UW06cYuuyv1Pt2/nwQc4mkyQ8T+s7HYZcNWGfjlvEGXG1LzDG3+v+jYlN G6smazad6s57a5FLlPu2DkOebmlvZILr3fnwQobTPPE7PnuvVq8kFIYhV4cN7yb/nN1t70yj 7zm7U5wypxttNqfIYR+RSR3+brT7qs4bu/WMTYl4kabVWnyHpD4i6ODvE25IrZOEdtA+AwU0 zUa5D5/0VfJfiUWHoPbpYnNr3QssV+giLsuZvNZ9fiWa5nbWe9aVBAnZu3w6/m0YwXbufGRV wmYB8Rqeo9c4HYbcfLaod4ewO9luDnF2QMv0nP2rco7lhnFE47GZhdUpZYI/NsZ3bygz/Gbf cRJr7nBK9KiQ01k42aOUkNsruY5T3heO4zN1gzjkjpwZV2xtt1EL8+7932Ewid1baTNFea65 yzTVTidz7PCmxdgMpPNdxaaAx9M5Q5IsxJ885lSuLqmfXxz7prLgZzo2+S7h2KQkIkOxi1A3 eWQvhH/AzNyfmR1nYdtRjHo4zFEsfBnlpfhgozLBNSse1fb9UR7VnMRDBSSOYnsXRJzyMwRI gePBuq0d0IJwjPeo7h7nc8htLQe6EWBw3RJ8OvfzoK//WxqKB13oo2DsXatbUL99zNtT2Lhm rlsOqO2Wow+O4q/qS2r8C1HJ2UY+uPb8zDjAiAd9WwMCai184NfQOzzOzbbh5LsByH0nCRDE o7Y73kF7UOHXomDk0uTSDo4viJa3PYVvR7rI2Ykvn4QWke+TFzmLwzMI4Rp/teO86gPPdhB6 wsLbE8OTvuw/hFhZIWc4YX12idUXt/W2dQgGoZDPnRMyZB8mkRHZd7tmu3rF3gLraTtdRLQ+ Lcv3Z6gK+rVmRyNfQhY0yV44S3tkGHKr7WIhce47BMzsXk5HkbwrcaGuN+JEs6M/ZQOJ5uaL K1UTEHBSuNjZ6ZTExjB1nTsbViDnhaNWz3MT9jDc5svJteSRTNgKJDJgz4fm3BYSOt3KObEa vJqtSdKn2R//uPz4Cozg+jaUD/Z13z194/mMJrTHMIrHpUkISY7lzLRXzmhKCvJFOJ3AUeAJ Ib8fNu59nuQeQY7IaPLIHSkgJ5vNZPrLCZODIhTVPBkXjJpSzyH4vMp6QmMuilPiugS0uwi9 oHEdUCL2GbqjQXw1Yy6VBD7y+SRlwdwFndsj0nVSOf7agsHksTdBTKbNMYacB4FZLnZcfYtR 5hJjeplxsr+n6ZA97bu+pUOk0PUEI2gIXcCF5Cp7079DMovrVtqh+lbw65/pE9RHk788X2uF RjJQyPPwu4o602FPhz3AfQc1rA4D9tP3G4Q4nSiqz4Z2iR4v57EnIzn7+O/2xD5zs+LAbY6N eLRudkIq95PP7qA/NmL3NFoGSMGYXVBJHjKnO514IX2mr9SDqsd6jGKEXTQm7NtF6Hgh8/WH mUN1mDI+M6HDd69p1jV8hysmaU7c3kXInZIf6Cn5gyfCMTMzIZ2Vc6yHKjoHh2wAUzcUSsJR HtU5BE9QyH1H4AgKHcvUDULEB8jsPiPZJVtH61N0u7Ps92FqFtsw9eGzPYRen6klpTbmTNGz YeoYdT6tT0Xs7TD8frWd/WPxr6qak0vKOcKTOasP//vTP+/50MPafLf9zIZmPvrx1n7kwT5r //z0ntM/TPLzCe0lH8bzPTwfko/5tkF97uMLi+MJ5UiE/ZbmJu6g050jfTSgp/Xvn5CFkfkZ mX9tPxsTtHXxVt59E2Lpk4EvhkuchjanPEMCigock8vPBRn5rBnHqNLSsJPxPnZ3DkitUj5v E2fMogRLWDb5EMoIuvdzq+ASuGUXtq2QEc2JOEaCW9LSxhhBrZJIdjEi0+uyIOU4WnpcgFNd L8V8si5PUZYt6JRzbhL5zIJ/eV3AN2+yfJTHeQooV2luM3XYLpITTXNlkmrP6RYSX3PAWyUO BYGltQIaK6oCy7WsOyQJNRa69tgj4AgwNbfseYrNg/kJ9giu+1kaScS2xCjjmz93prmec83n S7KysM+CJCJCTq2So+HwTehdzDeL3HWZRBBSy8sUHxYNGwhyrKDC5ipg/1YawxJSOueazVwC 1N4LD3LlILg7YEsbeQJv2jb2WrEJGgjSC4UtV0IPiZo9vz+FPVWe0AHfHmFlE+uvIf3Q4aCb nmd0tH4zwypyLb5w6M7dTjdhh1g5r0yZNxGqVYpLx4hLKRyzK0c329YmnQiSyH/5KSwjvh/F N55kYw3uH3/robJ5I43rvefjzNbTP06gcfY04Pje00/m4iM55yGz9gLDiAAjF5wsrRccJKMX 9aOFL+FobFv3r/uPgPezufyLfj1KTOgawefxdQtUg6+dQ2kE+vqBB2wZxfri3xob7mu+oE0W Fh7bwcT3+FtXEGlBcJE+8cRc1G08kLrqHxyQ0LeNPTRf9f3f2uQTH4TNzYvYCpDGxMQQlhEO xzJCTqEJI9Q8s/hPk/XZme1ZBeHJZ1LaeXZianMSogyV/nEsgyJZs8y75RuE18UduCf1HxiB MhgkMhewQGou6FJuLn56YzJzAdWi4OJnew0RxvZpl03ake4m7p2x0oXJmC0yHVytpsam011s HatwoFeN7d8mFg8yRcDjyv6CK5gRviwFj4BfLd/ap2Bvy+WX/tBK609tK73GaKcP+qvwOZ+y CC5mtu3c/uob8SHW0L6zNNJWUKdP/+uRQkLkXm9mToVln75/ADeGiF4wNtf2F6y4ptdQgAnO tdYBq3rM9Bpq8PRz65e+A02fQiWlTBI4yNATmDrqClOvhU9gCmUayOSa+aoQixIIx+8vbwJe qa/Rco+ugO4A0t60q+rbFJDgGAgux9CYpH0UDO+TECJne0R206HNYDf07BvQpmt0k3dyDfJc QwXpuT6AkFILjKWMAeDmB1vtI0XQ9b3+WSsE6Es1B1qL3I3I5waQAA/8m7RR/QrBBK6V9zlU 3J1I9gaEe6P2I+j0QwF2q0PhulNHUphP7MnXRZyotxQu9kh8YA5PoSf48mbBGnaWLoFbHFys 39pCpdBaSMSjmoRUF+SFAFL94JNKa/MOGZL9d/hGsmW/Bf3GkkE+lUgrvhbTekR6ZuuVEvqn itZXXnBoCkPD9fpcqh3DraLTio7mv+/Izt4jSOkwIBnQdkNQgJaulJkv+OsjezxTTblLHnHj uqvEcvyj1clNpXFw4WBI/Nh2X+mkdTwh18LKvMi9Vh+2x8nBqnT4JwgDqd4M+TH0wsE3xuPY IhjGQo/1g7xrOz2lQyr9hADmjjFmCZB5xe0v+pCDyWwlmevUJVuXUReUZUpKK/fXtUJKSemM E2HlL/2Xusa1EaoAxJd+4BZmESmBoHZNCclyT1v3YuE8ebFr5F4nZKTU9UBkgLx1B9fjuI+T kouysyAdR01PkLnrJZszBCmHqXGlDsWd7gjX0B1XxxNxU9PLTj6IarvpHo/MR+4hnKv11vzA vVDbvbL7xv/Th3IWnVLUU8sNtJRbJGYO/pGTFxWOowrasxc/Zg9mvGe4QZrhhVh6LUKEfsFD PGDyQBm6XlcCMUqYqPyCq/TYXmtjvf68XF7rlbbkqOoalrZ0L9FG7Zdos08XFqEHpYmc1Q16 +rbNm4A3azU4D7gKRJ/q+xDhdZ2rrYKnxTGzmxzxiK/ttmZ3T4IqrhzTYnG7QtKAyiPLM38W yxoX7rSmYnzfvml3ZaEt2oSaWVgc+yyd//TG0mbke9ynjxnf2CQhjr273V529PTdVVNIvvtp 2X1flQ8I7PqqzLuvdVqEeAPEN1Xy8bu2r6rkAK1jfFWB+qpKZo6AIXe2BKi90xjpcb4qXEFY T7LFXeKv6r6qi1oOgLqscT2RSpCRhe0LAklXI5RPKlBdZpNDyhDPe8tnJZ//GxcRXjDvsyIh YRSK99lhENQFjc8KM8xVavms6rLa/VED9yWB5KdYFBq3CQmCDtW2b8L1p3ZZ1V0W28O5zRyt uo4r/JpifrcNt4Mpyt6hVOAabK7bjqsS3cW5pPgEduO4gmm844oIuxygYWvFjL44roDmXF8x nih1XNkr57iy1y3Hlb237ikPQZ1VAts6u6xLi3dKG3vtsGkcV4Kpd4qJl/JJxxUWqs+cbzmu GAEmYWLZzo9Ur1Fp+NWPCtKgHpWjOBiG7XJwg0CLg2tEO6zikHeOrMBZp8KOnPKPB9I7snAL 4q3Ur5y3v1t9lCNLjpmpRXrjFxLfhHqE2g6bfn6sQB1aoldY9w5C8qv5sZ5A96u5sXrCbxPF dy/x/f32JF6sVMFbg9uS8xkvlgiqSA6Cq91YfKqgGLNatw4YDCRrxP579iAt7xwhzFmnEmBU 4to8iRMrZgX/jU6sFqbiwgqZIbu47i7k+Gi/w55QBQQDAD3Cqnvyi+5KOUdb1I4XHFmUoOnz iypSl+s1SivlCgHe4OnfGDpVJQGHfqZek+YB6h83zBfa6TXt+igtXjTI6Ud5PMDsAkvBDOVK /mzcX9R1a+E8oa6LhSiYusZzb0980XLUMgHGhz/13vy7QnPqvn/HYQNMtFto4RR/B4rYr8I0 D4DisX8zimQfMmXsHC8SkzgyaVriQQ9s7XK6+KbR7HbX32Y19vRH1+BbhC5JwvJcPz9B9Sv9 QmEVo5E/jD2Ec/a6/RNcqKlvlXsZKOdKEFLToOVYMBdCOvhLBq0BqUa9jASzCq4SGO5t7ffU zVC5aQwjUxGLgV/XyIHVO7RtnmgthpUWzgEhMp87V1kraBPnXWJXrq1PoRu5AzmABwhMWozf cSTRjvCw4SE7VeohZE5zCj4Iwau8jl/w4XepNxCbG2dKwFB9GImdlARVCfuQxSQItSwhPoTe Q8ishOiQjq/RWUKBEeQCIUZHr4XzqQB2QlWtJc/VC8KflfNxyihSUYxGNyN4KPTHx6SgRv06 laV8nTzHz+861Wt6gNLLho9fbXYNn+Dd1zB8WkH6OO4G6dE1JZH2iJRZa/hIgqndRJnx6Ty9 cTCOs3sQLfLZzVaQ3hW0bB5X4g0cmhDWly+2tEoIxkXdML3dz5vgBWqbPKJphmDcmDxYIOMC w8irrOxo1YLG5EGtd2Vtk8eX1Wpz4oE3JZA6FxQakweTyqHa0mPrDtU2j+uyCE2xeDyV2vYO cbVj7J04bgL19rqxdzBleaaWTNwO1Auv1PZORqTd2zuZnHHYDtSTRMWigYod2Ctv70hp296R e7V3PAR3B2wXqLfvVHtH8NK0gdresZhae8dePWPvIPoaewfDwGVEJFhQ2H1NnH7QeDCKlmub SL0rGMS1EvD3KSiKX5s3LMI7kfokIlAKX9X2DTvu2BqeeveJn4PHmDfJWNYSH6cPvo59Y82a wMrar23feHzdwtLg+7UMnN4vOGThoJurRfets3BcQXAx3n3iIvgH4vT1k9C38QH7RAsCCWR3 LcfnTB0EFNqAmMUuYs/Gcb6CZs3iY9NevT7Hlw6isBOyl1PJD7kCB4XsxZLQkD1dZtX+LSF7 cuEtri1VhC9xPIFtWzf6iIqBuojGAAYYJegSKCX84pal/AerHrHMc436SB2UOtUw+EXpU32K p1oHDZ226CY8RcXjqUBDf3UwBY4oY1TSF6OjUIS6QwMF0S6pm9VqWfCyGo485BtjPlf56cjn rpo4WXudWLQpzD+nGoOQosuvU2mdggvClE2uMEdA3z1zerW20hp6LTod1VwM1IFwtd0bHaSO Qu/AakxT4X0AEqR9r4R0SrcDMZGwCa9R5dy9RZRFJXBNyD1/4r66zSc/Iv1MV/D95TP6tiQ3 t3nqmqEFPcYf6jCEvFnDEdCBFAb6wFM4pS7Xp1oTZZdy/dWa0qrW19tAOT3WRk/0da6aVtCi NkTMGKC0Id7qYy268RHpGnFFQaFqHQWtiGu5vma50DKsLFprdIgWx5Ca841ignxO6bY8uzd7 e+ZDOD5whgE4QU6w5Rds+bW2R+DSJiCBYwyGau3u6Cf1xLjU8ZMaWuZYTQxJHgln6tyWGmvh NUoRCtzpG6ECJTLhmU62uockXMojrXAoHcJ1w6E0soC09iVNobMzkZoetOiN8d12lTd3XrSz oQ2va5vc6R69G++Q7kXBkpRT4ng7/XMTy5rUvhtKI5f9ALEdiZraE817cBLAtXUAqybUTjsf tu/AV5BQ1hKuyaBwo6KPu4hVTob5RA4Hz9+2YTk8bo7k3JjjYsTJ3iRH8B2vHguPj+rK+El/ BG9GVdiWPzL6hPxFHtopZetAX8usgimlznVkJCIq5XMHCmHXYgXk1mFWkLPrJVRmEteF1trZ L8DOd0cdnsx/6cTGYUDk0a4I5gPle4kE8HIv/DiXA8UXg7yL3yH9o5a+MqFqi/z/AUUMBpEK ZW5kc3RyZWFtCmVuZG9iagoxNyAwIG9iago3MjEwCmVuZG9iagoxNSAwIG9iago8PCAvVHlw ZSAvUGFnZSAvUGFyZW50IDMgMCBSIC9SZXNvdXJjZXMgMTggMCBSIC9Db250ZW50cyAxNiAw IFIgL01lZGlhQm94ClswIDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjE4IDAgb2JqCjw8IC9Qcm9j U2V0IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4gL0ZvbnQg PDwgL1RUNC4wIDIyIDAgUgovVFQ1LjAgMjMgMCBSIC9UVDEuMCA4IDAgUiAvVFQyLjAgMTkg MCBSIC9UVDMuMSAyMSAwIFIgPj4gPj4KZW5kb2JqCjI1IDAgb2JqCjw8IC9MZW5ndGggMjYg MCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4Ac2d33YbN5KH7/kU2Js99jkK w/5Lcm/2OM7MrHcyE6/t3bnI5IKiaJkJRSokZUf7nvs++xUKQKNJSupukwrjGbEbjUYXgAJQ v6pC4TfzX+Y3k6T8r8/fYjTsj0ZmWNqf9cz8wyzNt683iZluzKA/zseDZFweuuptpibPiv4w T0qTjPI+f4thf8ylKQd5vyjGY0OBH8MHh0U/z03Op3gjytKrfdMM+EfZv/HRZJSlg4Ek8C/c DZN+kY0pfVjm/TTPR2Z6Y777QI5BMih7H4Qu+4r7+XBjvv3wIekPTGI+fDQv3iy3s/Vytn1p Pvxi/vQB+nyTHKSwt9sqtuxHKUwSoWWU7VDYe5yubxoSRKu2bbIkyfujVPq5U4t9v5583Jp3 b//6xryb3a428+1qfW9eLSeL+818YybLK9J/u5uvZzez5XZjjPnz7HJ9NyFTOkiyl71GDS3c 0pIV8gS+zWlWX7GessLjDW0aNnSHnq94s4DbC0aYJeiJnm9KUIeerwjKy34+ZAAeaKHe7hBp QVC9y3otRm827JejQX30mt3Ru0+a6UicJe2JqWVU9MflOCvMsBtxHz7N6KPtej77PFmY1Uez mV8vZ1dmdfnLbMrAYLBczTbT9fySxPnSvPvz6zIfDcw/X2x4Pl8tTfnPl/1TjpesP8jyqn7n M17SEQvR0I8Xncv3uMHsMWpjbugwmCtu6EYc3MCUNuH/y5X5uFrfwBOL+c1cGOGGaRQeuLw3 209wxXxpnwsLkAm2MPDC9tPshKwwGPXTlMVz6Cp3RqxA74+z0k2d58YKnYi7u72abBGG1iyT s+X0/sJc3m3NdmVu17PPrJnS12b1ebZerCZX8+W1zB3rsNSejgsyBLdkWAgXaL3OhwuSpJ8k pVseemfGBd2I28zWdDECU7wMTC7p9wvLANv72/mU8e+4ZS6CqltIpnfrNXxyOk7IB1k/T1gZ XNW6MsI+rNibefvj0SAbpykS+6gAYUQXiNXJOOkPk3FqhoNBP0M+SLM+0n5qRv0xOGU8lvKe RhV1ueRpmb0SlAZpP0uz1DXAmTGeI67l3LhdrRZW+ricbb/MZkuTnE4EToZpv8iLnP7Thmwk Ap8S/AyH/awohKFighrjxTRvKnHucfrTbGe5fZSXO8Q1nu8+re7Wm9N1ZpoU/VEmAnGt7Z7A M/2GBHXAMynrVJlne51ZQ3z7oGGfoP15CmqqSeP1e/hjPChGozSnM7J0nCfJiDR/9f71nori m0pHAfAbIteDtcYjhoPVlOTj8ai3m2AW5r3VP1TvCoR6oCg0H1KUkVK47mWjscyN4/alyJtC UFTUiMJbUJMkqJCqmlGQpsAbQF8pul1hWagb5ciNr1yvfTlR7UJhVM+V9Ki6p8YFogR7egyH pQPo2C/Scdl17TyW/qkiCPGOme88haiyG3FvllZonq/u9gf1sRowyfL+oASNdqQR+W6+md5t NuA5AXdWuvvHX8x8a74g/G3urq9nmy34b/tpsjWf7m4mS3Sek8Vz4D1fpfNhUnptWCDgqars vASushtxt+vV7eR6YlU62/nNbIOKZ96f9Q2yvcA+ZAq7cv/zpdUPXK9WV2a2XN1dfxJFgbDL 6ST9jFlqOEZA83U7H04oS/RvxXki/7IbcXDC5WJ2oyP9i6qDtut7wfjwwWa1+CxcUamKPq2+ oBFYG8sS69lkwwxyOl7IWWmtQtDX7nx4QYxJI2xTZzkrdCPuy6d7c3M3ZYxPmP3XiBqRqng5 +7K4P6gwPl33Z8WgXwyGTAWuQq77m87Bm/l6And3XYi9gB2J1ZWA/aiFLeitOhJ+ITqYfbL3 QcEepHuKZqEsLZnfSyxA4yFqzGTcT/kJAr7qL4JciUmuGIrR1OenS/Ix1tMxGo8hxohGdtTW dDawr5b5uJ+Mi7aakMrCcTlbrL7UWrknlueDUloHuTvJMyxI5dDsEFrDgnsmg6bgdK9FnwYC ST4C+ZRFIKiR6qMRH7rm6UW2eQWnD42dCgPkGNxFwcvfwXD8NB9q/uNw4dNtFtE56OcDXAN0 wn+8Ew+02UNc1dZWXhGUJf1yxz75tHdB1qehWdH/Nr9eI//pMj9ZrhDp1ubV+7+H4dA7NgxN UzE5Z6ZUus9nJU/TPjR5+f4MOhahZ5QNHacxIJr5jeDWEDrv6C4jwdZY1ohrrAcEFVtD4mY6 W07W8xULnHn34ysz+32+wd4ooGIiuPnj/HfrrwEnOhsUhidNP52YkXtbo6/c+fDmoOgPglPE mXFCJ9qWs9nVRqDFJVhjCaRcTtEzfFyvbrgNs9AJfQzSIUqwgnmzVPrPpq+LcalKnXNZYMT5 jtY6z3moTlybeQhl1r2ZTjYoPcSq/e4tN0uZgWab2UxnKfEYmwJuMYnzaHIr6pL1XG6Zs55h HvKVOx/eHCI51l2hnhY1nmdBApy0J+3LbHG6tTIRw/B4NDSdSFuIPnZy9XnCxBiWQOenM1ls 8NSZzBd3JCgL46ezmYNxzRfrzSOL7AkZ1Pszas26smcjGPuoDR7MOkyRxQu8dXOUMEWKLzAM +kw2+KIco5c4Uxu8J66lZgovL9bfE4qQCZ1WZkM6y7VeSwLdDP01Cp2n4V7wDtgh8nFU0BSz g5Lbwr3EewfUCar7kJ+TQbnAcltgay1B6OamV7ttYSnFsu2KwXJrb3qYSltZgH0ROJeLSTrc Iv+1sdmOQO5VhUztlgpZnByUZ5bDDlrHR0McnEVrJk0DOdG9r1ZvV+n1VEGuZnFRYplWqo6N 34PioaBrh4MzMiMXRcLGjrZyqmhCUjQhf1qvQZ8suiLbnW7PBSvVMMN2VCe2Nq80GcYPqZEq 1xBxCmjh516gpUzwtNXZuD6voJzs1famNF0eDmpLZUvOLodXA6diL4zbSe6tbE79sedqvd9W jdUfO8S1crwvuhGH/cy8fmVWtzOUbnDbzeQKaGFuUH5MfrWy21KM74o5rlQ3omY3qyWZTu6A K88h17nqdZXsDnJnB011xQwoDTN84ywmPjNVWNGJNq/00K1I1sFig619gbM9Mj3W1PkVbvlX 5n9e/fDme1GUAD9nE9RjG/Pm7zbx4oSM4DVhrm7nwwdJidYGM9Q5mluLbsQxD3yeT2dGfK4n brQzSXyxzLCYMy/Q+3Z+iDUQE92Ig4ridGwQXDB8zc6HDwbDfjHya31jtc8zqSK6EccWi5V0 tiijUImLMLLZ3LE+XF3N/Y6bH19t4JD/UOeLC5RWorwS36zJ5+dwxcEIb5u9Kx98NeLPhuN+ RrdjvuwP2RLkrdbPBPjzMbbu0chVv6n7wfNwnaOt5RK5nk1n88/WxW/m5RArAiOb3FtNgGpD UYriE3bCqQbOSpNxRs92aWLZtqTmo83qZlYXT49qzLcMWJZJRzrFye504AJtI6ZgxKQ6LzwO LlooLdqCC79Z5xFyKr+Hnm57r/ddkxAAsQ88oqHzfI+84Zv6wLOJH+mC+ADsQRZNQe2+jaqA F62ugIK0GL0bJOpr3gzfh0JQIztqbDEoDxTbi3GXWsbRBw4qCtJkYFUxoVq1+4a6GJnyUgkY oO0j1fJ3vlp7oO4BaqSQXlL4arli4mq1UVk0gW0BRuR2I0IwpNYGxh8CcnP2RwySHRv/0yBX dBYZgsB3f3n7fjZtOKFYvNuL4mY0UINmbHceDs0OmbV220fgbeiJ43i00Fbk+Ak9rKxwgTQe nlEO4tMdfYBtnSc24leMVbItMRvk5ykZOOJagiZRViiD4Xmx2q6mK2xS7ArYzhcLQKr4DLnt A7OrSigV+VXNVCcUFrxreF5v9hpfViuLC6hyYGU5yAdfo6dgQyHGjTPdDtyRuPnyiu2+gkAc 2JDtIV5TgRelOtea+Udhk53tBOLQg8fw6Vgh+Oz4ynWFJsdnhbzol22V0c8EFbqQtl7diTP4 dLbezj8KQyBwi4PE63c/bFBYOc0VKqs7PHmYD3D1up2Qd3q3QG2FXp2J4YR84HcI5LZu58MF WdkfleV5KqzyOnGPT58txIy2xs0xhqThGNfLOkGN9bwrIhD8viUYxb81FD06TPGJF4VqbVa3 k/wxohCBUQaiClHd+G4nPmm42dfJ7AlCPhICaONAJATZfE38NZQyuIUMJFTSbigEKfCJUAgd eqQSvvAowA7ZUvPxTFNtJ9pWxrxdYCFAL+Om3V9n91wuTuiuBJ7rD9IMYb9Gco2f9hi8RTyE tsqDsKe/Ts8DSrc9yiRKTdOIAzsM3wRSptmYQFCYS+vU1VqrCaJ8YvTFuo1IoxG0HKapbgOn CXF/SHRDvt0EX9132AIvBaEE0G3rPRR3ZadC2IMvug23+51iIKqNpiVJMVv7aklBtftFr3HQ Al707aHF6F1VrSaallCIr5YvVKrl2keUNsfcXRTNgnDFgDAQh9eBenDJA1honxP35mS/DrAw H1gHCNiG9pHd6ES9REk/yJ9bOT8g1sTgXLXzjriWGJyF4L+Xt2EpOOX8n3jPFHY32XZ0pO5O aXVGarEAtJUKgw9enaDmUiGhy4hPBvz0i+inyfrqiwS6+zLffrIPRF7sPR1cdWeBaKIasqOB SFDGU99SNcSC33T52hunTyv2MrZzMmez2Lfp7Eazhmsr3QIYr1+Vbj66arJ+ScslI7ZnFajk 8YO0K0btvqESG47uUZCEp5GCZKL3d4TqaV6Ie62XDtjD5qjRQjNRkLcpaJyKrUGrRdQdAopV 9y0Lkobx1Rqn3Al97aplX6MQX61wLyp7rVYb3XyTcRLWL0KtETDZ7+J9fNY5wIhH199kI+JP sE265Yz9PLCiI3EsJ0RGXmDZFY2ui+W62eKMNrue240w+BKsZ2zwJ64nPgWi48UraW0VP/fT BVn+9Rl0OL52f5gok0q8cQnml2FnGBMq6ZlFmWzI9MxGhpZrBrx3UvYLO1o8fS3HxmH9cKRY VI3i6ThM+pWojtKvnRr4xIuy94Hw1DWSwA7Mhfui/IkWZesPZFL+02Wwdt98GRRrsF32KEgW ZXfHnodWS6B9rZdiTvXU2EIlkEO7Rbm0dm6tlizK8X0rikp0KizKrlr2TuhrVy1XSKhWuKda J1+UiSaUEB++60x8/FWZCDBJiA8PKJdN8XsG8z3bX2bN5T9Mpr+a1Ql1xCkxVAri1GTdqCSY 8uZ+OcXEimEFrGLtK8TgJjATQXXVBHe6yRHlAZEtxkQ0dNSfT6cTsCQLMfifiOp5YD48yIVM iW0RaSWrov1jc+55+qNnNeIaDxHM/SBjDPyrpZX/ZubX5eoL+xFq/GcjflsmFdsfJr2KWU+6 49Q7pPvKnQ9vAvlYH84UJnQjTjaARuGR7pmH7iXaP1ZduGSXI+yO0eUJ5yUsbgP2i2auMo26 vqleqovuJEf9OYoIaikF36yuxCR+gYftrwCs0y1HIWqeb7mu8uTx5090MHjve5vleQU0yWrE NZ4/8Yqxx2XoNny2bLBXy06Q05Vs8gLacKrG5VpOG5KzFGSj/hK/CXuMwsm9I1zUfF+1RkOo 6ULaYQhVC6m4bRDFvuUQOinKDTGOsm7EbSZ4oKOyv76bXM+aeld3aMSkQKodlJnZofM4qrOv Eo84WG2Qe6eXM/CRSMcFgnl3H4mHJsC6TVvUnQ03t6YjdoGHYML1FqrAyzM6sKbo1Uti2rqZ oSmu+m59N/9l+b+z2WJzYWZbM1kgI/Dfn36/5Zi1jXl1d3232YLoL9AqJ5l9Fv/56S1jxOQ/ n056CGev7dTwOKOkw7ANc19aslujCh17HII6DNsEH3Q2KtTJqbPknnfFgbXhQaWT+QkH3MT8 zPC4soc29o5iFZIlI81Fb9TLCwloSUwFUjgBAZWLOJLZlOZKKPtqdSoAah9cJiiodkpAFNfy scA0BcM7w5ZRYgnnRAbZBeKSTEha2EgUbHAnMKjPVuAJl+AJRwrHXsnpMj6FopCC0QmbaUgj FishCzExUlR4UULlFow0CXOhhQOeOVSReCueKJ/ACZRF2S9TJmqOd9NMC9JoQHHnCmk5n8E/ jzDzvnCf0vMUSFE+kydUigpprjpV4b7KnoSqraaGyMMmNV/MT8ozu8ECDu4rYRGUbseo1wuX C5ZG2cvDIQ/yJEuIJpDLAYOceunuJKCwHAIx1fsS7rH38iqz4VD4ayyyvi9oKN5uwmv2K+Fu Ci+mQ44lck8X3HOdo2v2aT3hVk4ocSXau/A9eZ+nuadH3pd7T20oTSoin4JTh1D9yYiLSzgD JLKsVj5CxFuIegJfS9k4exPSKtZq12MV28KSnrd8tzbh7iRiW880FXdDliO1RlZIU4dCYZ9U eBWXEwlPnAASc7HawaosOGzU21HzyFSU+JNbB+NEIhgTbVb+Mb7crS+VfQZJ6aVTMyxsPv1x U2Lqz2v9ybx4z1mtg35qXrDFDx7l4tZffPIX4dHSp5iXQAzy/nX/EeX9bD78p57+KqMgEPg4 vW4Rr+i1wy5PIF9PJqRaNIKcMvsvFfw85gfiZmGtsBXMfI2/dQmc7iTN1HuRP/DEvAjv+EJC Vlx9bakD/27hS/NZ3/4tbj6xW9s9ApwHY9llLLuHMw7tkmkWldmQCCj2KGB/uGuv2bEqnlcw Fw/qKkFRSzNIpa/0x/EMwrG2PjzzGnU0nX8D8Vn4gRNIg0MS8wIeyM0L6lSaFz+9NIWR1kp6 L36217TC0D6t80m8J7DaISj2kUE2JPRujVZBuAMO29yl1vEKkUcDtW+gA5pwTPmGH042+QY6 0WCEn57l/SoL1HOjb030Lb2RClOjuX0uY4GC9Ikrlb3Gknalj9y7WpwMFC21Sa19/yDDD1jq KgF3gHNfgzrPhTr6ZiufhaK1fv0z9JEqhJHIKaqa66M+Nane0leSy8j459dlkipy50oioIut vXvV5XEPzWvy0unv9OcH/ZEOkAZzX3cUSltlvRdG2hauqD+cu+JdLVwJW/d7Qdu3aUw5HZuA e1Fjcjhjg8acCKn0nZCqXUg1ZB6AoyGBm3t9QqgTzzokQju5pWX4iR9I69CSr/jRUUJmdqi8 BDnJyOEODgsF6DVbV2zabHNhf/W7f9EivtMCNU2+BEdPax92pNde3q9Wm8YssBoNg41NRuO4 SVu++xFaqadUnh96kibo24mCNYXB9d63Gg1AVUmhWvyl+nAULEk67CD8adPpB1L0Wp9ScaZn 2JV0GoO39OlnmwKD8S4u6aRrnrg02om3pAT/FRg9TGXwQXiq9GjJWgstR/8KN1M9Hrdq04TY m1kEZwcsfw0Y9Bc3NmVcKA/xV2apnjChJOmUBW0yAu2Qs63eiLgRwskYC1tJpLKIvNoisTvt Ss13Dybfx1oeiO5iLXMUrCXjXORRkBXHy4nHdUBahLETG3dznNUTiEYxGhjQxr+zIphL0YKa 4SyiClqcZeN/JhIItMJZEhLUJkWSaEgLcKkoiSuFo08vSmFztTUwV9JpgRkfEJDHQKtgU/2o oOcC0ML3uJ8QQL6iyiUgpssiZIGWz0RRAQuFtCCl+8JBtg5BBRIiWb5g96slNRKQfYWi0l1D UJanwTdNd6RFEMZSXDUsCLLXEday9xZsJQnaDsFA7m6UeaAFnMpoAwuyEg58tyAtgCzWFozo gujslQNX9joCVvbewiRfgkIsW7YDVMKufEdzeWoCmLKUWuBmr/bgFKKRP0ixuorhVCF4razB KZjx4W6hExy6Drx4qFv2+PoAE8csq0wcMawnoYJTBBx0pMbc4tJwI6nBKeFIe+h9BafEIQ7J GROxl48N8nEbNCXxIjPOxNxDJyIgKy6JYUMzNNVToCVihYUDTJb29who6kF6j4WmGn8gbhZf wczX+NuToKmhFm+lMtugj6Apma1Sgh9UcIqzWYDNjPuIXdrBKULzg+trHhZ7y/dx4FRhF/ev gVN1Wi2cYnNUA2HjA1KWShRIUEgcKolxjYxhU3ohJchs5Ef2QPSAEciDDMY17E+65uHdJrKI RINhiKModC3thuXjssg3lSwi6oIHcCbKxHFJE+wUbSXbRqLt998jN1L3976moUZ7sXMqIhzQ K3Jio4zq20GzQ70hO2NjcCuRmWhR9jnzl55BVqV1uaZ1uaZdAVX0Eik3iNOKu/kL2lAkyzVY mKz6Mt1Byr/bF+gsrt9YMRs5kiI0RYujsrwlZdrxRk5N18+DiHi6n19TlOjfbR7UTeREIKeE +csef7UySrrSo0+1zL7NqeV8sE2tlGuZWm2e/tyLdVCH+9w3vux0Y5nQPWgP8JIza/EVL9c+ zEsYyTByiiK8VrKwEu4DH6a9B77BeEC9hYLl91tqDCvRljrUuF5SKX4480vAI6fd2dtbOpKx BFmB2/ZCGlXcZuMXcSz2DmE1ctwEFZjsRbPhgx/eaFCO6yXbacVWua5T2oULVJmzAPx8QPXo fKnytVZS7nrCXjTG8v9sn8MXZNDH8KY2AY+1xTSrFnKpTUkL8RjmEWWDffmVtqQ+1jdWF1Gx +nr4UJP29QzFfpgyyzuobSDD6khg40j1sjVTVbfIcYDynFrKD+jWoswtI0Cyu2QiK9buAb7y 1OuErlUJtKOHYThLJl+U+5D/grSVgnOrsnAfckogR3T9lS1uJDUq8DSRCP1tmjEhjDpnuEQK m4baL9+MngRHGvouq/9ytZqLEjBqGOPAsmsKX3dXWdclJjRFzzaF/4TLRS39xx0od+850F1v JN8H2+1EO5ipTzr2VyXMlxSKbNl8OPmFSOcy+TRrPV+jqtFsK+EsJ421EF0Xv8Zzlav4pSZ7 DjWOdteWC9cYBOSRfD1ZnmwpjkfqzeLu+s2qW2A2Je4cUw8e8FWFa5Pa7oQjU4Cfx/3msD9S P2EPSIj0EwXCaAf9RBUtLwHk6F0b3UQwiUmoUlQneaSbCEkRrAtpQRORY4vkFOyA6nq57JCz TiMhDQMhh18SBClWTeTUGAMuS5O3AUtQnFT26Hs7XUiIVBMhLVJNhLSgiAiF+5ReICFSTQRS I7Dp6xMgcKiyh8DU0LVVd82E9NXIG4HtdayZkGeqixA4XGkmYJqgmWDtdZoJ9nkS0gTzMSZl Z0dmw6gYkkUzIVdeMyHXsWZC7lXn4ErwdwOmYHct3/SaCU9NpZkQSlUzIVd7mgmE7/1Al7Fm IpdTu8QHqzL0EhbUMdAjvVL1ge8VXgu94hUTIekxDqaoOgdXBER6iUBoTJQn3uklrO4KM6+w 4wgVwq6ZF+NDhDTbKiYkKmSZemNGZTU9U73EQ+QeSy3RtPw/QCsxYqlDL9BIKyGuE+wpPqqR Nyf8dFE7hmAPWB5HKVEiYn+djbdG6ml0Eiz8ANnfLBpAKAETIG0gciGviPhrnyL5kwdJRfCG /YuQQx5kHCoIYOCpvtVOoM1FsSwKSYs0bf2+0sBjrYxih4RkiHXio5dFbZo+cXKYF7vskx1x l7pQhBNE9UbMWIj97uW1k8v0mXvbJ9KiItA5Oc/ldDIjrUrJ+pp4l4gY6T5mxV1Hlftx7zqB mbccZDhwWFGFbB3yktiaHIQahdVSxF2Hn7sQF/h5d3tFq0Gl4j1oUIohVXHgMn4ANGhEFKLM SDzjOpP1WYlSjEpTQI6i3RUkwJGadHt36S5WgVjRwsHTu7XQfNdav6X+aFHxl/oRDH5jFQxa e95ugd9yTl3fOYIzk5MXH5XM6YsbSGGExSqkG1gQLRFUWC2R/MWXgRTNqunUhtegkafuBaoG /8YPaD4yxelwbm7txRSnOWHE8DEtLtavaR5NAaiRk0bnk/oW6JoUfYv5guu4Hu9sj7y1zUvv QAkaB95t2bDIyiMOFImAcUNPBhpKuUZnM9EezDaS2BPVSKO+xSVlmGAMFZlaiDikNtsdYFK/ p+GWF4d2zcG91++RHMePnMneJCBL5HoLWkTjF8Gt8Uj2gjc3B1u32yguWYonkkYpc4U0MwV7 ZEM8Nk6GSFAYVaZgn0SBFSJy2SIkRYA0CflQ4a8EPRwmCAT2kJbJMXziMEtR3uU2oxtxbo8s wfhY9Vl/KcvZp30CRQWp2qdRVEBEIc2DKwa4KzxKURJsWc46nDtSbVkhTesTCg/NEEjwKRTV 2eWWvsrofoVEXGNKrMCSPFO4RctWcEuYxsMtvJwFvNpcaSqR6rn3JeArkDhPW3vl4Ja9juCW vbdwK5Sgd1K2wi1i4fBND7c8NRXcEkoVbsnVI3ArAl41uCUnoxS4Z8dwq02vVOZ53ytQ4fkn JDXh4MowHNgi4uDcExrDrSqtZgaWOBQDcR0PZmBsK2Df8di7m/jB2cYOzB5ziT3lJrsa3HKT XYwsmpmBnfWXdcObgREJmZiPYAZ25O5ZrY8Gt7Q5niw/bhTWAFu9zNf325MYgcdafCO4JbzC ccCREZggUpxIWUPm7WzAEkdw5PkEpeu+TfU4YAtb91eCrZhSi0UI8dFAOnuL7IRsiUCG8CCI yAphKk9wvbDyDzIP1/Q48g8iGk/hclL0r+IuTUe0JQ9SkEpNtfw9cVUL5SCm8BSFMSlaAhIU JbeTnbIxblHEQI1kp2YGKvaXR1IxxCthNMUlmIkblbZVANdrKDsssKsMT0NCPuIkL/92p7/A DGc/503kepX8tVBETnLql5UWTSfslXaJFqg3SJrfINUhaloTUUPhTjcmsBWhT3SAaKczslcT yX0q6nxonE3FgsEFBGrfy42YW/jpW0ABlTx5TxI/AjB5Ahdwo09EKLW9XRWz0SdiaSCzIE1F 4+Sjmfg705c028bR4sq22X1GwZYUUSuPA5jEkuoeyRnrVYkzlxoIbCQpu8Ykss+gZgtsxm93 S0iACZQvlKE8WwmL3K/uoJ+LmC0cJ2AVFupXn5VBrrQMza78w/Fs9mVlN89H+ky/q7m1oEM8 F+fV8unYJu1SSIOgRs60YQ7hB8w1NUcH6alzwg/oqGP8QABDOayoLX7gNQycGkARvbm9c4V4 EQXY02DLHk0p7iMRetAECgvYwaVEAABjGV0RQQK2dhLLUIRPn6uHFwN7+2qb9TLkrkFts17G wVG8FzbrmZBQIQdKcpli5ODTKpzgC49SlILKTtPjqBIlNJIGs6GrTkAOrsIBN7j7GDUQM/tq z1sCWcx7i6CpG44GwqAWKRARS0BjdV2hBmR+njk8gNNHMNJw3g/CgHtSDAd0iebiIMgaajBp gaJIyu7ZK48aJDVGDXKvOMGX4O4o2xlp7DcVNUCXoyagBkupRQ32qhFqYOsZor7DaJn4aYof bZTSoUNwghGmjQCDS+jEtDW8qwTG3OFT6kgB9iMkSrT/DsfqcZF+DU7IKKKUjaiq4q0Bhc7+ os5+EAEFlaSPABQ8vU9K8l133zX+wLlDBTYSEMROrHhu+x3aTZxI7WbN4F7cEitIEWnttPA9 Cfw4aAEb1NeihRqt7W0ziAhIJKzj6DyxASB9IWZwjexMOqzdSHRgo2yKZxXR3motV9MoP6Z8 fNhnrwD5sdYillRF9777wEDDtaSR/+cXqqggBpUzwieiGTISKXjK4PESP0Wc5ClSFzmR6ciD EMdfhFTSNUX/6lvkD83ziDNpgRpzSMiIuA6GOtSap3KF2Y/U8XDzOPtKhtIX+3yMDKxT0ZMe jcGFaSvyOJU87KPGYUuCB7xflPk7mWmjH/XnNT+wjHF+W7SNZJZpkQLdHQKriPa0vMAfv//R OI8qlwl4Kq/QxFLAhf+cK0mEfaHQmaoEOaj7oWQWVCEPd7ykxFLWWo+/ExeuhYuWb8R63Tmy TFprp2ldi7haif8oeWz7BA9C1yzGPbR11F2xVfvu1rjVV3rSJ/4rgRccEUwKgbv3xLFKGvMs yEAdMu9GAL7ZPmBrqYQM6VaqxfTj+ISZkeHnKSTRmT2FXu6kjckPtuSmb/9CMdd/5gGsIH3B 87Uk9mzD8kxzuFddQdK6wr725bV7TbgrlO4yri9sUZpRvytdQjafwf1qDuYRvijMHD5cq6MM Kp7U6iEjgPIooE3Tc0bSKOyFEXZtBmVXqu/gYzQX9eGvIs4bKGPaozZKeXi80rwOx/K8EZVE PmByKk1Wo/OB2Y9PSiyBRt7NOaGYhgUH59RLbt4Cde/muCE+0Tuh8r9qS8ghCqTBazSIZn6v vVtzUGb4kOtaf7RBlxeR+khb+pM+0SIprFFLOtWFBAbBPhANtWYdfnmnOgT9q5VSalCyUCcl 5hPn79kqXmkdr12va4VktJBVb5y3+65OpFK7aQlBJ/KgAqRN7dlPNkAX3L72cYW12pqivvpK ajvFSrNeQ/WMuM3GxTrljw8AyHlateIh0a5p9ug7ddNSnL4Bly4mEhhVdu42V63oTl1ec9G9 S0R2d9fJE5YtYqBdduZUptmQFCNVn82rTugEKJCThXwKKhD8H+X4rUrBAuov2XaEFxBledts ynbLETutK+VNStQ8NnsGDQsqApdQaVgoyqVFGpaQFrB6KNynUJYjoVKxQLwjNQbRvkKVisVX 2itZqKJrrVjNwk7JVmoWYhd5X1hUIeKj6k2roiRxIZHSEkBWqVlgm6BmGRXCMKpm4RjLui8s 0fRZIMQX1l55NYukxmoWuVfFiivB3xUFqgZ9It90xtlATaVmEUpVzSJXj6hZwFJ+v25snJXw f6hJ46BHzbql6gTfLbwXusVbZ0PSY0xMUTtMXJEQM7EnNeKWQP6ON6xwZClniwbzbBT0KODo tt6w6RhcUoV8P47a5YTbdB+k91gG2sYfeD61C5E61M7tLhpZaGW6khgJQevy9UGP5DwNPFT8 fj+EuFPZaDFFf6XWpU7r4yhbJEW/kj8M5OW0C6JGYW9wzRCJN81w1Buk+QppIN8ghFp44r1Q ke6q5+5Gs62R5uSR3iEUyY2geaBIhUhIEyQLVHI5PHKjgi3ktxSjDAtHLL029JITqAwRgtD4 ESzFDzSjUNizBEK5SKqgGGkD8iFuk+YtoZDMnaY5+6Xzt9M0BGCe61/NO9EfZ+XUXM5yGhdG J/CxC0uUpguBgQqsmXKnuZA1yTsTF11+nSV0JniQ26k0PL+80GLPLLF/CFmHRKKbZh9QXeyq 4nDu9HoT4QQI5FR2LiqFhLALyUaqj/TvdBdzpxdynCdsQSavpzlcQqol5PrjtRVWcWK9PaPi 3UcvdjatebWQUzc5iv02ygsjDYhiyBYpNXEZpCFrAfC8OUnj3/k7p85Anen2R914deMRfMIt 4Id3pH+1sXx72zR94gi31bD9T27Xwu4ROg2BWG6rn2v2tTCMAtPqhSfcwO0L2Jp5gebhr1Wq 6diiKNeTNRrd12qTieMKS4BdPijJKQVfQRRsVGVv0weofNn6H6uUmuHcmhc2DQ054Hltdanr rzQ01fP7mC8djH2nXfKWHzJBMn9pFnIC+ZvQjfmVqY0tRWmd8uZI7/8BOn0wwwplbmRzdHJl YW0KZW5kb2JqCjI2IDAgb2JqCjEwMDAxCmVuZG9iagoyNCAwIG9iago8PCAvVHlwZSAvUGFn ZSAvUGFyZW50IDMgMCBSIC9SZXNvdXJjZXMgMjcgMCBSIC9Db250ZW50cyAyNSAwIFIgL01l ZGlhQm94ClswIDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjI3IDAgb2JqCjw8IC9Qcm9jU2V0IFsg L1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4gL0ZvbnQgPDwgL1RU NC4wIDIyIDAgUgovVFQ1LjAgMjMgMCBSIC9UVDEuMCA4IDAgUiAvVFQyLjAgMTkgMCBSIC9U VDMuMSAyMSAwIFIgPj4gPj4KZW5kb2JqCjI5IDAgb2JqCjw8IC9MZW5ndGggMzAgMCBSIC9G aWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4Ac2d23LjRpKG7/EUtVdWR7RpnAHOXbtt x3gnPNtrK2IvPL6gSKhFmyJlHlrWPuZu7Pvsl3UCQFISgBbVnB5TRLFQyMrKqvrzUIk/1X+q P1UU8/8Rn1lZjMpSFbn+s67Uf6ml+ub9JlLTjQpH43QcRuP82LdgM1Vpko2KNMpVVKYjPrNi NOarysN0lGXjsaLBa//AIhulqUp5FHc0qgStZ6qQf7T9Jw+NyiQOQyngn78qolGWjGm9yNNR nKalmt6qby+pEUZhHlwKXfoW++fyVn1zeRmNQhWpy2t18eNyW62X1faNuvxdfX8JfY4lRykM 9rmi236SwigSWspkj8Lgabq+7kgQXO3LsihKR2Us4zyIY9+tJ9db9fOHf/yofq7uVpv5drV+ UO+Wk8XDZr5Rk+WM8j9383V1Wy23G6XUD9XVejehUhxGyZugE6NFWnqKQhohtylsdR0LjCg8 zWjVkdEDRr6WzQxpz5hhmqBnRr4rQQNGviYozUdpwQQ8wqFgf4r0IKg9ZEGP2ZsUo7wM27NX 7c/eQ9LUQOI0ac8sLWU2GufjJFPFMOLeMRkYpM1usVWTxUJNd+s1M0LNb+8Wem5MtvPVcqNW 19RaPMyXH9XdZL19UNvVaiFXN5NP1WtMF9u9odPlcO84mCujcRkm4zhmWS4ztpHGF9bOJB+P ipKdpYjzUVnEKklGRchOVI7GbEbjsbT3/NbRFr7nF+Z6NsQl+14RWwaYreNA+NTBvOgsfAf8 eJ64WvgscXbt6ErczWSmliu1ujvd8hbF41GcFSnDZvjXk0SRfnW12yLvarep1HrzsJyqicya u3UldAfPb8gD9om4SAAkrDWO7k6C33VDHjDWcVGOkjwU+R/EyPlys2WBqWaq+kvQzGTRdVUc QKyerGnOqjiM2Lv1alptNqcTyzRMRmm0T18bBh5sJKOO9ByI2/N7XBqWozgGmLYZ1iaIxSVo 4dIjI3i4zraoef8Lq+s4zMoyToNwlMTjNIpKyty3X94f4OivayANOinKUKZwNM5A7Coeh6MU ZB0clKiF+kXD5Ppu2ekfa4zZpuJyPKKt0jSmS9JUlwxpjFuzZksMuKgAPciKoyRv93GvpGdj RbuPNKZLBvSxcav00V+2+vikjtKSCtHc5J9oaF20qJgNZpzkx4BhvQEGRnc6IqNHlaajBHVV 66JoFEV5eZ57syWu58Z3eYOedMNGt6k+VWtW69vJ76u1mq0n9+pqMv1jo6653N5U6s/dZDEH EQIR91Dj314DGLZ5fwZ6VBizmiXno0ehHoyyGORq9CgDzp43OqATd9xvBmzQHjm2iWNLEIvI 87B2pVDutQ6yYeJqRR5ZnGwtPkN0a7wBgJuozcNmW92+1Zo/QvugppPlK0in614n9HZCfns1 IsfulWUYVoyW35XfCMNJ5SEKgQDjslAD6VuuUF83m91tpe5v5tMbxZq1EejelITR6QY8LpNR VIQYEi1/z2fA2e2KbHxGy1GeY7LIznQ5ahHXZzn6tppOREFkccEQgNitlgv2xCXfW6YUbWXR hsm1M0zOq81rLUe2e+cjnWKAL7GinOtyNIy+q0pNrq+r6RZ19+pBth9MZYsKQ8JHBWqq/rpb rOYY2ZZmvzrhwpQk0SjOy1jltifnM/TpeIQWd0YLU4ouGeLpOUuc1CKuz8L0HquLGGony9ry Yu0bskwhi9VyM/9UqcX8dr6VmgLqr6pldT3fbk63ZbLdj/KQ8c9t185HMpkz+Z6ZvxNefiWI NIg8jY4BvYys+jiZL1mZrterW7Hmi1lugTlT27wQgFMuRzhxw3gcqdx04nzGPI5H0HRGq1GU jMqkONPVqEVcn9XodCplrUIMI+7DBI2B1W+2ul8uVpMZE2R19Tt7OLqkqJPV9fV8Ohff2AnX RGwHaTjOVG77YOdHVzXt6xM6AJgcduq2+fsyFhe0+L4hAkmEIy4px55ZPTduN7riwRT3zpV2 55wmvsLZ+924WlJbvDuw93e1BxyYLp+399f2gDAbhd7H/oicHVLWxxzQJC9wpt6nLav1XB5E XmMKM66z+eYPdT1fb7YMMUZLraNpA5DshesKJ6TEg7ARbqrZKfe+EldxieIL6hGen83el43z UZjj0jZKWEsoa3u6jUXqIZR9J7QXSonxwgF6nntfm7g+e993FYZydpj7+fZGVev1aq23lukK A8F8OhFl8XRbC0qgRL5FOoBOmHtGW4v3Le/x9otJojfntQnqHLBX/YV2P13NMOxMWG+0dXJx P3l4BY/yHsUtFh6u4x3hWHMJ13GWPXaYjMCBvYjHA/v+IWGvtcEMom66qCbrt2qznTGLcYw9 6CgogyHcPqLU9w0hYH+5JaBg8tFIxOmmeQo4C5M0U6Zj57PHED6Vhd4r9gjQONxt+sjBAD+U BxrZMPpkZn8kbHRChC7Lt0aR2n6ymeCKmEzXqw0OKh0zZD0Sm1MijCyEyQQ7ud6c0fCHRMs5 H+QZBJdmWUTkd1+EQXzDSKkfl1NCIuc4FFEGf642d1xV7aU9wJIQvVScQRzmI0IsxsoSfT6j muL1ImzofIBjko6i9Ex9S1mLuM7A8d1SfTVvSNxXRGRsJdjC6a9YJ3AwmLJ1tV3PCdiobRcS pTF5jf3G9m6ocB4Gjh0s508H6MpSnop6lcXJKEnyki8cBwF6vFKEbhZnoyQ7zwBdS1tPC8n7 d121vYOxej54uN56Dd/60latt3MscqhNHUHsEBozRCnME0RJj62l8YuB6igrJdAMJe5xemoM ZSPg7jvy5wDkdxjDnCkWZ+xMg2Rfu8qNw3w2x1/KyQPCbrHKbO+raqlxlFvk/ML2GktZqzOt wa6Z+7g55JmVrBkC2wh87RcCK6tsKqEmKsJlyZ+9y+5RpkFK6IppRjeiLxKW0e5NQIm9K9Mh r/5S6OvRTFEAX+sO6cvA9q9XM8IQuY8OFWJUUhEdCvo3kXAkSljrG7EdCp45gDdgJtW2L6za WVY662APRanjNB+wDPpovcwSZwFfV+LEvCpOZTeZ5cwdwVmCUswsn644dSQ4eib2sdvJcn5d bbYCta+xzT6cbs4nxEYWhJIr17Oh8OUo1h/A6loOQoKzS6ehdEaLJ3VB13IwjDg3/mITu51v xN32VuJh5ozybEbwwUqOhbhaolvvS8rpJMF5aNCfNd/PRhBS4iQKFyHV2QL5OnIwjDY3v7Vt 9Hq1W868FCx1GHlzrZitQARaFCZb4jq3N6cTgYQNFaW9VLZbnUTghOgzcQ6jNptbgOTQctpx GzjYo3qYdFN9UMZ7DVsEgZCePSR0dLE8IKjDiZB8lKTjggFrE/TIvnTAK4433BwsMX77eSt7 ltmfRLvWZ/7ub1aE8c1PGRYF5kginHGuT52k8IR6mt+R0pKMBJGLSDmzHWkgcdqQhxUfKNK0 sYA8fv7hfZ6WuT4Cs+XIIjvUp7kOEPn5gwT3KrIKbOZXi1MefnaH8lznzkcUiliOC/ZU2V9p TxpEmzjnxHy/JR5gq6oJWw0mNhYAQrqnE8y7iMTfV/dyFkqvCybGe6IWk/XHSs2qj+vqlJLg vDqp6dz5CEKOSTzh3EPv+O2O29QACO1RajqMOMZ9hx1ivSVKkmNtrPvIxc3qnkASY6OQxCKU rRYbfZ7ohIDERTi5nnzpcU9iImNTjuk4gnqO++qOo4SkYoFx93OyTcyIiGgJwov6TXyuFUft l2ZfvZVyeDkXE/VZTpthxOmoFrtgrshWtDbrJtY8czDmdkUA1qyasolKQhHRARcVSXqYXIvV FDk4Wc4dr+SntmfnIwdpNsr7OiFfaRsdQtodOWGmD2yV+vSwRJsTKaHd4k10ZcLtDHx6UJvd +m6tkdUJJcBrdrpXQ8f/GcuuSUD2VBIZCcLKc6IgUrxlpSRbikhPQqDbK7moUhIKlHl+nsZF R1zPRdHtyuI54ECV2A4+EWc304mLBMTpw3anky0fWOfot9L1iBJ64EGA0ElrD9S57o6qyAPA UEwoJXmNROLM0Fvu7uvs7YRzPTKN9A3yjMcxFtc9ctp5Rg709CPa7eFUbNkPmk4WNFWXXaT+ 1jnPSEpIPg6EUpwtks6jed3HuWH9GNIQHgVzFZBxr1dGEN9IUmrHRH2N0bKPgyPKiEF23RJ6 WteLoHvqlIzgFNOQacZc1d2C+82kiMfzr7hGXLf8tSQoMX4bsom8KDissRgpgkLS3gzdFF5q ptYEsSf4UKlzM/gOou0nY+tXP//HO2/dt0fRJJncfLpDjea0NEfQMKjcsnJPPWxcsaCvT7d6 +1OIqenZGUkBi1XobCznZm0jXegA4hh/NL/mSURt/dd40O7ZFb4ACaidL10Bvy7xEUxNps7T SYJPgZXazp2PKIiHX1INnqW2OIw4LQT3q91iZmKnryTg43ay/gNLLBYXPfhydN4olNZZKAvI L6eMn5Ucj5I2TsdUwPGzEQHyUpJC2J7QObM9YRht72qHb3NbELMARvnrnTa1O9uBGGZP6fgj pWealZmyXbHD3hXBV2IPnG+/Mn5KfTjAA3pCRUzy6qMwoYVZux2N80atNq1P4/lOAPpAu3gm 3rIkjwtxQgluoULyXb1yuGVC0FGBy7bnYL2O9cQR13PJvr+pBO4g7AT1yrS4Zy30siTpDF8U A0cyhAURso7cnrzEPm4iefasuC+rwSZjEt8ChByRnTTYNtceJ4gZ2FuDJWFiLnmC2wR1XpVd NNRPP1zqPEEkl8VKgRmg0mEQxDo49fsEcWb+fJAjfugWd6iAt9aPpgIOZ4Yp4EIbSww6YBwV Enu3d9k9oi8Y61A+aUY3IspvTG7gPhq8awJ9USwB/rLWUfdzVx5XdmNOTdQ9YkI3r7t3CZmW FKOaNaJ666ugb6d8I9Ir34zwprYovPQW5jXdhEGVCP2hMnh0T22JYbc9tSaI/FjROeXAT8ja hMw6T3trl+9iJjvKoQPU0SP0J0lJA13nwG8R9KqhP6hE+pUaCdsDZ14dNN4nyNo1XzEZbJKE ozwKHS55hKDHw8ePDtlnCTVOWwJJnfr4MgQN2DfrWSbRDD5Dan/b71EOfZZQ8/aXMM2PzrIv ItTxOCNrvcvS2eZQ7UB4RaGOQYopWSR7AsRv17v578v/rioJlZAYugW+Qf73/V93vHplo97t Pu7wCkfZW/3aFf1b8+PXD5yYVtlvJ7T6uPex7PXwZWbJ50zbuOBtIz5P5pc7Mhuh36W5apPT FskuO9EhXnQz9lfWwkj9RrjnTL/IKXgR7ChaQpyKcyJIWG/IvV4Ab2ISzgtmGtMnMr33gX9y a+DyzUtTUVL6/PO2ocZ7qJ5yA2fMpiSJA3mVCI6XnNZsEfn3bdGCIhInZHlRl2Vku48KsqcV cUpMeMI5MFtCU+Qv49iImvoyxVtJRrQuvXT1KEPlI4ynbj1nOY3F3+Co8gW8lgrwnccsjL5s QRkclDSJvixF8y8KUsz6xl1J4EmQtmwtT6q05ctsh3zrnhGOhppbU3XDm1Zida9+NVLTCXcj BWbgbYr/1jUsSiLeN5QhEyIcUocSMW9g38TnZy+iBAbrcl7OYV4WIHdSL+MoXCaxyL6djA2P dsaU8GR/NUUs46K+XnAd8eqlMA58HRHcukVzZZ/H8/U1jUK0+WpJdO34HgT6Sb4/wjdx7Pk3 MBxVzMjBXw8LqyPJJBDQoC5zktZv+LwUB0iokX9fJALaQ9i5zwi7NOWnhCO1SVZdZt7MI7IU G8nVOZEjsFqKDUnBXN4aV5T7C7asTJHLVRWOI14Rx4DqlxXgo7OXttUCD1IROyQaFJmuZ/+Y 9/KQQY3meKXbr+riF17nFo5idcEJAhRFvvAaHPPlxn2xPwUXS1eCXUPX/Ye/y/9Ee7+py383 CcxkSngCn6bX7uk1vXoOphHkG6o55G+ovvi32hb1kg9ossV1MHE9/sb2ODIFwUX6yC/qwt/j GvFV/9ZuRF341lzVDz812Scqr44Wi4jRkWUtZXmLeOXTOOILKkeRpfi4MVa79791zGzmZCUc s1y7dJMyVogFK0uhZcb8sbsq0NTLzPvVG9a9i1s4kPg/SAJliEGkLpCBVF3Qp1xd/PpGZbqj UXAR6l9/0yXwotB12tLS9NLXPvsMZxjZRHjviqW4RoBheUizlRjym3maL5FmKDNUQhk0XemS 3RsA7AXxn5SYT1OHPlBCPg262KxvfjU14QP3crL5a7oulYILgmj4vtYMaD7MlFOnS3f98KBe jr0Opx0BycEAHens7Vwz9y83DDAaUhmS6zcBnYIKSj7qElNuPmeN+tBLTYaTu5rlt3SKH6Qo uDCPMTdPdTkdZ8xNHfOYZrmpD2d5vPlufp2/CSiB17R8a/6MnHjwww96EMxjzAP68VFef1BE PrYCPvLqny58rODg14wwzOg0bDlJ7scJOOXggVHYbeBYfGE40kW3DRffWkYIh77V8vaj5vE/ vzP8NXw0TDMlZuhMG7eGa+Znw3iyu9HUTj+IKcDjTBN/6u+m3JSY+qYFU27acSSpIrh40HcZ Ul37Qvy9l4FOnLM7IkHzZSt5RQhu3F+Rjgj8bLX8Pz3xIMHMVz5lXibBxQqRMVOSzwdYxE+m 2mplrmQhgw07hJHBvjGFcJGLq9XONRlwn6mxsjfYP5zC0Y1e6+eY+2Ag1RkDPneGABhCg1T9 LWhuj8cXPA8RiJvL3GEnvUAfESS7RDeXOzvuZuaaoWiKCKQy1fZmFKNmJqIZRz8DOw0gnuFy XPDmDPRFS3HAu2VbW8n+wAkz9t9welRB076RfQVNvW+8xQvWDDfuC3xFHYtS9BmxPlv1jLA2 CbrrbgsP5EYbVEczBSDMhsaZNnrqZRn4cixv86j1Ml/UgKq+zIPQDFObvEXNFQQZmDDSpi5f xunSMdofotVQyzjFSIon/BEeB6eYgHgJJdDUKou+oKGW+bKGWubLPGL3jbuSwJPQwPqe1AaA dv3xWpnvskwT0QwDX/IZWhljlaBiaD1Jf29oY/paa1hRSgZir4qJzDhdLJLQCKuHRQAzUeNo zepzUZYlRgfT36z+pb/Xuhc2KGppdcq14K5Q1K3OpZ9plS5Pjde6NKVa49LfntC2GhGpTW0r w05RYjlG7NxIkZfACtATo1KPgRsVfPFWgmtlyxc9JcE0JRJMgK4T4ZqChrLlKW1S5ahfmNeg ojFqZSuV7LJMTqdqYeDAgcCC1QDPklOyj6ol2RoA4geaiyg6QzWtwOheAC/zhSXypTStx8h9 KUWra/tfQM+KDTsD2XE0O5/Qs0RSMnnFrle0ZJhjyXfUkJV+ipZEEpMxycQM6G38ANW8pJ6F WgnU+Bw9yxLcULNIP9UBiP3PBzjNs4GL8gd8KX8EB2ltwUMog5IMtDJYCTAiVUXw+cM4Udd8 ikGCIlsBiMIvtppp4H8dsuIH0xhYxzdi6ogxg6IahBkbhQ6MqvVMY6JwkMwvHYRm87ayevRC MpvuM+MICFtDDM9E0RL9UCjgD+QY0vg036FJSFsLnER5Ap9zZWu73+xfMFk3NEayjnGZ6BQS QrodxxdAY840dXo0NpYUKA00VqIcDEBj+sgEzXC2oLAHKCyk6wnH5LAUya7KBhzzRY3NzJf5 rStNMC/n4ARXghcF56x+q4YvAymzxYrpvIHHEsB0CEir8ViCmTwRa5DDY76ggcd8WQOP+TK/ p/vGXUngSWjgMU9qY4/1HfKAzHfabf100XLrcwBZSeYDB8jkexOQybUBZKVgVGcbjxAbB8hi jrk4QBZH4N0WIItxNxhApr9ZQKa/NwCZvtaAzLVgAJm07QGZPNMBMkdNDciEUgPI5Ft/QJZK IjjB8w1A1mlY6kFww4LDzA+LM3/7oqeEmKb2hJimDoXYk9qUFkf+HiITiSzlBUcek5FWkLTB aXOb7QvJ8GmQ4dcfLaytyWeKyR6l96VAWecHfAFUlrDhgcY6oTJWS6YvZ1Q9KktxTCfM6qa4 9ENlEsSc+7QRp4dloFB29s+BZY7iBi47AkX27Sy4eX4ESvFsYJdADYtI1hpVBAKKpNRUMZjE wg9bv4lZbJGpLPgOTGMb2Grk0gY11OuEWKyWhnkfO78AZbEeiaW2owGwifugACRorG5SHlxc WSueqeUMdjPopt8GLJqfPlpbHmTThDX37YwdT96LQaGBrqbIfJpmPpkWzM+GBPODacuU3JhK ZG4yDO/FG7Je4ALRx28eY80RFHpnGMGZNt0nQ5M1XYIn6ZEh8O+MJRcrbTaVMRUSP5nqpom3 jdqmH8bkae7391l861nFuTkjI6bLlH9cmdvJsqibNLyx1ljbzoHZ1rKqC2KXVAtl5OMVHzH4 H+HVxCosVtewWgzkdRonCS3DBIhjzjy+L+oWZ6bTPfY0kSLBHoL9Yq/p7hNkZ6S8OZyG92ac zQBbSTF/mjrUvy4atu3mD3YcTVMJh6IY3dhIVfyvN/qm5hDfmOfbSfaw2pkfb8ykscLmbpC2 RCY68d6sH4lk3fEZTfQk0Z4eoG3DpXlkfeRV8mYRtIqlFQCRReOPEQnGmv41XkxZPRHlCtKM PsenrJeUTRAVrswvbb2VNF36NythchGIYkx184O5FX+KXYvrVjl5KnOqYv75xnlvuK6oadJK Iz+ZJo7RYjtinmSeaj578pe3qIStALyO6zPHCRqLh7zjzC4GAT5JywOG+y/zAyutrEscvNN/ Z5DNpaloPptybGWK3YdKrTuMpJonG6E2LR3fDpw7h23BuoRpzzSBRHeRwgwdrsAMjDJn+GT3 sSelT0g+Iy9ITCKQpt7NYYUherc/KkFovz9mMMgNIuH5OCUaarcraSgsrsip2IwAVnqx4jVK 8BGRNqoZrpPIq0okZqypdBNbDvomVsoFAyWY8As5WmYDhtz1VBuXdWSaK2pq3PYup14rCVrX Ddcl7vHSko1BS0g/LWRCUqPMdsYr3K6/XrFzBdNgeFRaHIm9xUSk8Z1MDt57EctvWt2OybhX q9siLV7dTthxrf8j1kmrdfSa8X8EVJQWJPpNvjl1W7431W25Nuq2a8FeyW6uf8HLxjOtuu2p 8eq2ptREnAnNT6jbbA/WZxg0/R9QwBon8tbgf48xaQiFldza++FGqZfksnnZxzd8H47KppRY wq2eDfna85GgKMWSwtnr2cb38VlRZkleELImY3+rvr08/ygzR6+FZLVd4KX07M4P+AJ6dgpU 6KxnIy2E9DbCzD7f+yHHh/jPCougssOQrZd0fyQaXXyOnu0obujZvcLMgBnEV4AdDCLRAVOC KZrlKJdANlQMyk1N82nqAEApB+QZnEQL9b3aYEKJudfUMa2B6SgHENEymJpPYA8AFvxCOUCj C4rx68aYHbTBAZyl+06PI0j6AzTwxCYN9AtKQFV8QgO/QhWcMXU+6T7SO8pdTalvappyIJzp haX/aSUQS29UEjlKVmZ6YBXmRzAYo0IgbAuD/T/3k+xWCmVuZHN0cmVhbQplbmRvYmoKMzAg MCBvYmoKNzA3OAplbmRvYmoKMjggMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCAzIDAg UiAvUmVzb3VyY2VzIDMxIDAgUiAvQ29udGVudHMgMjkgMCBSIC9NZWRpYUJveApbMCAwIDYx MiA3OTJdID4+CmVuZG9iagozMSAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAv Q29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9Gb250IDw8IC9UVDQuMCAyMiAwIFIKL1RU NS4wIDIzIDAgUiAvVFQxLjAgOCAwIFIgL1RUMi4wIDE5IDAgUiAvVFQzLjEgMjEgMCBSID4+ ID4+CmVuZG9iagozMyAwIG9iago8PCAvTGVuZ3RoIDM0IDAgUiAvRmlsdGVyIC9GbGF0ZURl Y29kZSA+PgpzdHJlYW0KeAHVnVuT20aS79/xKXDeWhE2TVxJ7suGRp6N8NndOV5LEftgzwPF Zqs57m7KvEjWfsyZmO9zfllZN5BsEkCTMtcXNlAAEllViap/Xirrt/S/0t/SLOe/Ab/VeDQY j9NRbf6s5ul/p0/pd2/WWTpbp8PBpJwMs0l96ChZz9KyqAajMqvTbFwO+K1GgwmHaT0sB1U1 maQQvPMvHFWDskxLXsUT0S1J453pkH+h/RsvzcZFPhxKAf/6s1E2qIoJ1Ed1OcjLcpzOHtM/ veOOYTask3fCl3nE/nn3mH737l02GKZZ+u4uvfnhaTNfPc03r9J3f0v//A7+XJMc5DDZbRVD +yiHWSa8jIsdDpPjfH3bkiFatWuTZVk5GOfSz71a7PvV9G6T/vTjv/+Q/jT/uFwvNsvVl/T1 0/Thy3qxTqdPt5T/tl2s5o/zp806TdN/m79fbafclA+z4lXSqqFFWjqKQpkhtyXN6iqWqCgc b+i0ZUP36PkgmxXSXvGFGYZO9Hxbhnr0fGCorAfliA/wQAslu59IB4aaXZZ0+HqL0aAeD5tf b7r79e6zlvZkzrB2YmgZV4NJPSmqdNSPuXf383S7nqfLu3S1/vI0S6d8Hent/GEzTT+ulpvl bPmQ8sVw/P5h/jjdLGbp4ind3FM2WzIu/b755pJfSzEYFmWo3fV8LfmYaWjkvhYdyfdkId0T 09ay0ONTDrLQj7n389lUZEEFgQ5+Wj41Bp5EZuGDU06PkTAbM5/XdK1ltlXXtp1xerReNq4H kxFzs2PIDoRtu3azmj6tp7PNYsksM0jT1/Ihrebr7cOG+Ya5KH2cfkk/MItfbHIpADX0T6hC qzZtOzr1aNMwluc046SoO7Yp83JDAA0MPCiAPZiLPpdezH2crjaL6cPDl3T78Xa6md+mb17T 4R5tLN//bT4DWyzu0sUmvZ9+/Dh/WqebZXo338zu08/3i4f55WShzNzQaZv+emQhywZZVttp NGn7fX0lWejH3IZp1PX38im9Xax/Taegw/fzxdMHJx8MCu/uF5fr8nySD0YoGbYKtsPbti+C aqb0u+1aeEZOpVI//SgfYHJa6egxA5TD8SDPZcRtcnwFWHiYD4q8uNLZvR9zn++X6YyJ6Gm5 STfzhwfTvbeLu7v5av40E1HdfJ7PLbQTBQkAOF+hLW3QkNL5arVcXU50gyjYyl3NaAW4HlQ5 FgVVi9p+TV9ntOrJHCOUfNsft+8fFuv7+SpdL27n36TLlQCV6WYznf0KyP+0fPgkI4Gd52Rq ewDBXFIMivF4MBlXGFtsq/cVg31T0R5A4EXDYpLnWGHGFVaj6ABTSVaNB5kAlhqYWhWjOi2K wWiI5QkOMT5NJkLwtKmoqWyeNsR4xFSD5aoqH3ccxb+S3FnmOn4Unxeb+/vlw61IFQrn5aCd 6b2szug9bcWOjNqp/IIMTrLBaFyKeDUYPD71DVoyxKfa2d42qQfVhNc3GWoaJvdNG/sM7X95 DWTw5i3f22RYjcd5CfQr8kmZZWPK3NHbN3uG1G+DJRUFdDQeSm/yBQ5KsalWBR9osluQPqRv jZU0PCuGnmdIjQcVdLIB9CaGlBSUohBOJuPupORJeBtHpLCtCbMduGJ4MlxRu/Qxic86EcH0 7KuWPqaTMQVJn6qZJ02jSNUiUo2qHTVMNyRBzPVdxkPUvlE1yfvOCOfSGsMAXSMeNXPVVQKD fsy9BhYyMBvr3vT2do3mIoqA2DG8Wrt4ultN15vVdrbZMgUKUpwtVxfEhkU9wWeDpai2leo4 Jc7XH5dPMufsD1bnEgqvbDsWrVAcH87bToA9hvMgpeLhGgNb1Iiu8PW0x+krwYgGc60tAZ+m DwsMLhja0tX2YY5N5X66SR/m00+IY3q/+HCPAfvDam6s2lt0m9VmunjafBHD9WxqjN1fQZOp beWuZ8AqJ0Da6jqV2rofc4w8T+gv0qtrY15BArab++VqjT77sJgjEUY4MMB9Xm4fbikVRRd3 qoxrv9xkv7y6nCgUk/GgHtLgrnJXJArDQTnEqX2Vc1fZi7nFIz4q09/zdL1hWpqumMDWYsZi dEDf5cOPxcXY5xg91unD4tc5VtzN8nKi4O0bta3c9YgCsLfe8WlezfzQi7flbLZdfWOAyS83 +S+v0rvl6nH7gIU+fdxieF+7OIrkRBxFD7iaFxPcgjkBJcp6R6iyWsxkaNqb4CIp/hoy2uD9 PBhmz/zSBfrn+YD2vNKJqx9zMSwRswiy9sEMWExL98vP2N3Xxl94O58+pOaGxti1WF9ODsK0 ZavWd6zaNwXsScEJI1xeDsoxDoIaB8EYV8FXN8LhRBtj/Ov4GX8l9GyZ6ziJ321XTIartsrH Xped/nAz6bYSk2ndj8PV/HY7m99eTl0L5sEmg8eHukta3+p8MMmryU6LXa/1rc4q7EqETjo7 V7Ogi52rJtLPkMKkZI4TwmqMJa47FXnSWqccKbF/dTCYjSajqGKw1CxIOpESKyJtZKjIcVwx wMduwOgR42RUsRFahZDyFTOUzhmZE4wHw2owLMu+4/+5rCuenwoj9bDuHHSFAw/d8C0WoAfr 9Jqp9eDjErOAeDmJ3LjcfJqj2lYEJaeO/etpT2Kp85GPyjk+/LWdMF5irapGDCjXaavqxdoP 6mhFH8HHvsEqtV58eEqXT2ibxvl6QA4lCmP+9Gmxxrw1vx1cTizLYTEoM5wDps2vRyax9lZD H3pxBTJZD3H8ugCA1jH7XwcDVg3mWltQ//zJBHost5hK16ITE+shwQANeZRwxfnjx4flFxTS 1WK5xdA6n90/LX7bis31ktYSFyTvqnc90lnhJHR2s2uThV68TWf3xkwqZvMLIu6yIHS+HqVV g8nG173nXW4b7Ltnpzkd05+VglzxKTX5eSa6Z4+z6afp4mH6fvGw2Hz5BtsiY7ZxP5gAOvwN xHnuKPX/Ytv2AjangliZ0aQqXV2u52Oh0zPR2tXK3Ojs/cj4feHbtx/Ynk6i9V7HgnjyGgN8 zVwiMQJZMSzTvBDNIv9aQTxVQUB2WV2n/cAx19F+sCS03YSIrQEy6fd/eSv2VbGvN6aQy+EW 6VSW8GV0aq/GNaB/X9jOpazYIFzHnDbu9SryWUnAZZVmRYWWRLxK47yL4syDopEKIfRdPUv4 5jqFz3giQ9HCHRmIDolO6qJ7ZyYqyFZLCDXOH5LWsUE8SMP4armzUC0wV7zo86AO74m4anky VMs2MuaAsy6vCUpzXg2K6nriZqqMSlesub1G32NP5mRMNMvhViwA2mKx3yzmjSHmrF3rVk45 ZltN+G3BVB97r1s55Rjq2LWEZbjgc1bQSEBRrIys56tPc/x5ny83pRQjCcKsi9RVwLboM3Bw D7uI/+Zp2ejws65U8qp649M5+6SiC+gVUDGsHYiKLvJ6UIywNVZYBqu6LtNsMsgxILmgaAFo J4KiewhYGMtkAB07/au1uosuflF1PBsSvzoZo9304+8zmraAKOLrnzD6pI+LDyu1UP5yY5aJ SUDDF4ma1ni8C34JdHBZjdGLbE06fgmyDu5y3wErgQc10feeOzvQHNcsCPFplzehh+WyqAjS HY7QvRo9f/ZP82xh09kI2wp4phQvguC9+LwT3hvJYGQICb4yZwm6TtGLSGWinC0ZiGIl6Ib3 xqxydNUSfhrnXfDeODcwlvZRMnoWqtUK7zkirlr+XKipC+lieE96djR260aOfxoHbPr7Svfe gH3caZ8XIOIJc0SJd2GE3ZT13RN0YD9HCL0Tc8SeRee009nPEeV4go7vvVZt5/CLThB+qbFj riNCAl/+GxYnibc24dk7uvbFVmhKX+Y1aVgc3x2nA8VuLYffPTk73em4zLEw4cRw/LWaEFpJ fcPUFA+/0VqVbqtWpO2yjDW6jFMsteHP7nl753ICITMyQUjJ6FnZaYmJEkmyCmuo5caSkTmi PTeox4aCVktmlfi8IyHcP6Z9pFqFuE6Fv27VMo9BxFXLn1Mta0W42DqVkgU2w8yHDP0B468z epYjPl5Zsfi1B2CCMLD6dhwqvtL4q7zpMNHaf8Pw+8vNfxCg90A0qa6PNcbPP8DoWfZq3IuP wxI1I6vCLHu2fRvCv+dE6TIMa4a3eBgGh7klg+Go7eJBZ+WsZRCNrJ7mvNN4Za2ePCjjlTlL spqFnV1GT0cE9Sa2etYlk0Q3qyerlhk9tRrwg50tnHdBweTCsw9KtdxZqFYrFOwfs9Xy5zL3 XRoF10Q34PGxo1BDEvfsNwck8VzugABLKxIOFp2znuA2ldil2dS5G/G0rIzfHrftarrCe8s1 TSkjS9wullso95+4rcj1tKxYBexSlu6K98GO3tM/TnuUQ0cX9WAspjFj37ZzzF5msP3RsHWq ox3mOmWJK/sx9w7vHnlDZMWdWU2D1LGW6g0priSjiM0jccGvyPv8mvy3NgBiYZ4S6PL+cppI gf0nJ2EEAhh3/4k0im2N8nR51wX9rJcYDHOmpSZDrTHPLbkxZyZrpmqci9UFG88tlGvyeqLx DsjbvvGiocbFBm4a4oCBO2famKQlLrOxZJ4kgCHHd+ZNF9IPlzRdgNSHpJ+7TuhsmbMqdlu7 CtljJPQRx07s1NHI23uSTb6XnEMXnLakQ4uM77Jf2663Hz7MSYF0wdUIYehotvB5MMuLho4G Q62HDnr1cbFZfFAXBqkCcAp8+HK54cPn1HV9bEW0cwOeGD5i9YPG6Kd+yLedsaRI4PVEUpcY O0d83l5zIL4C+KKElIw5Iy9pJ/XDEEmyMW5cy40lI3/ac4PeQRZpVy3RquLzjoSMHYr2kWrJ 6i+sQF2rZR7DE+Cq5c+p1sWtQPhFiRm+zoFceWvg09MrfsU/uY7UEFCByWMpXkmTZxvX35RU wnJuEsheMHRd3NDGS1k2mrnz934Q+/cwQwfszwdQDPtHPB5kqMcIHhiSoCyxAcbKyOnO/krG uAZzrcE8yojknZH/06ft43uW7yCMq/l0vZS423tW8ktAbkM/flyS0tosqJX0h++/Rt5VY9Sh 6a9GTybZHZns7Crq1pP51xGFfrxNb1knMyUvuaQuJNcHquhyvV5Q4MKtdauEs0Zf4W5iTTAZ 1y3P19O/Y+LASQHdF/2cffCRsCocsdc5+DSZaz344AoQY0jQamSVjIwpn8mkKTll+qoyLine IWApO5fsLhYNYadsKEJUDIksm1WyX/hpy9N0Npt/dDkxTu0twjjrU1omqk9rMr9DfB/fFYWV h0TdEUnr+P6jv6SclXBFPSTVZ0NwW8sGyd7JNMb4Y9aFHDBPHPzC9vDGMUk43qI+GslVoCP+ BOP11dJewDQ7vJBodeRb/Y8WA59vzrWiHVDbWjwunjzUhYM2+etu+n5W3Y33UzqSqpNRyYw9 2LoL3JITyZLssuSG4YkB4y41klkRKOpvtIGj/j6NCvIZIREKFqZGhNEsywk+xgnGuBEbnnBg KB915O99W6dDSjx0Lsg2mIX9cNr2PnjpopDJx5r25G+xXm8JMX1PNjz2JjCG/L7f/OnGlCAV k+Z2h9nzaGovUYwKsvNl17S5kETMFNe6uVBP5gBLP81Z/L5ekJdNd5UxNgOWD+NJWm/v7haz BdZhlsM/TFcfuMelGV1wCxpeXzB1WjJ9kiNXtb6zzv4gujfoHI+XlA+6lJznBTs4kQCdIIod r4MOjUcHuhiWmY3wTrdAGOjIWcauem6F0PUNdJa/jtPw/HfZbwXJu+Dw5lY1F/1YtBkrm8rE vaQxfUKRuFxUJ4piNmI1rGO7I0yc3S8XsmHElrSKS9nrhE1wlp9tM19igbPbFWCH386zyIlv 9Wz2fXKWYQfPya5hDOqN0/b2dLJ0y9JDIYMV3J4Uo2EXS7p7SpJqYJH3pxIW1J4TNmiRB3yF zGliTzuRkagiW6ERCJATKtQlxMk9JRWiVfyprdAFpC8aJ4cDPBoupOgKx0nlr+M4iZvfztDe ns9XbR14897D0DGF8JQ9g76VfEkF0efS4Fqh9vaM9Xo5W8iGXC1H/njyfKlNw0VJOd77wop2 poLTszzeCDL9TrBWNhqztU3j+++Xb9NP2weyLGu+C5BZo1nPalsNqMxy27f5Toz0bQxXkrar zEk2VuAFryRvNqt5jDnzpM7qHvj6OiuLl1geaS2u3eNnDkrdi9QsEiwO/UZa3U0UzzHkbZAG 7HaIziMklJR2PjpvF0IkjX2X25rw4gHEo+/jg5yfVfJJNcjZ58cOcrsM2Y2gE90I+kUMHbcd BoZk85Kw0Ubbae5Pq+3ib0//M58/rL9J52x5KXtg8s+ff/9IJNk6fb39sF1viCX+xuywbK7F Pz//OEUBrP96OZXPh4nkzRo+0+R27+22Tb6n9Z0em0OTj9hYOGwlch6Geny2GWtXiPHOG+x0 /2j3B1/3gfxMo2bpX2maW2NjTM4CueXTyUuTIqSSTax1e5qcrYXAiJJqw5R0wKnyaKIZQ2TH HM0f5ABzy9xDFUJW4G2V/cNYHZuDvneLQODsg8THhvHb3UaSSKaXEXGb7DRNFl1ZVO5LxD8h C2uiopItH9lzXkj520gxX0uCjUC8YAkmxlfPgD2fJbx7UOcMh7UtekhL4ruBX2TvtUUl895o RNIkyV1vCEcl9vVCyd2lXMJRKHJVCbRtq3CPY8CVzJJ7DMZ5+jn9WQVl1/N1MMUKIX7a11iI JygGjXMUjCJjN/GKFSoiD+aeIsPmUqHBkwGHy3JCzbnEUKznbAast8rjXB+RbA8Siac1Qgsx D5i3+TMxi+cjbrdXH1Rzkvf4MpFXT1BP3NvkcS56buRxObesGrVLaPmamLe5M6Tj3mx95bfZ es4zF7oHR9wwY8UuCuJOL9JyoahTLwZhcx9AP2mnM4JkW0YbXDnmWQRhNvwSicpFeoFvYlYj eRArQfgc+FQQEvUb/Hf6pAMQSFCGpMxNjsMJixj5x4zezH3u1FEFkOD3d7P1qDL36R8b0k/Y NeTe3aU/pzdvcauyCC+9wQiF2HLw0R2QbE9L/CX22tYSfMjm3n/fvwS9v6bv/m9q9mOVD8Mz aDwn4XSHX4ujA7/mSywz2NctyrEIKdc3/yfA+3O+IG4W5lRTwcLV+DtbkGlBclM+cyW98c84 Iv5WYj4MVUskvakcNXfrj/8ZN58YVKUZiAvUsW0ood6ZjA+s0uWTJwa8Ho3c3CXjvtEOTZcf 9ci7xq8RFo/GpbOQC8aWkaGgf6zQAEq90LwhkwyS8gj3hf+DKFCGiGTpDUJQpjdUqk5vfn6V VukNVc5Mo3H1r6aExhiZe5riEqeq8moMaW8Y2AghYIct5TgYBIdltcezFRlyQ3uef7iDW14O U/xSgW+V22/zxMi+v4SZ8FsYFsmmDAt/9Bj1Cg8rpdW2QcoWEkss9FFEhYh8N5zN9Ixb2lTZ dRFuoJIPOqow2tNuJx2oMDvNGG5xmPNuXkpXvRMOkpv/UEbeen64BKtwuoVH/tzr7VNzQqW5 rr9aojf9yg4P3Ku3SqtxFzsYmbtvtZSwE3OqZwS1CfGYth4LveRm+aR0PdttWqkasZ0JGdBT 2cxK2gmolfzpnYjysF07PZE1H87hpM37XK/Isu86i8Jnh+P9T+dAr7xjVKUNqKN2CpKGLFKy eZVwHF+l4/QjopxBmXu0RO9npRAltLbKKtTkc+QPHVkkUh0u0KCULMwxPeFvxe7Ew3rP/itj 5qavEijoi+PyT4YC4sBVZULf4il3akwJAR26OETpuqqViM/kM6Yi8n3xh7SmhqunV4mcrunY Vlww/ReTDIRZKh9W0T00CvoRRRrv3d90lnN+rz9Qq2CPUtEhBFdarYIZQku6ahVuywSxXUPQ nyqdbrpFIhHtfDLQ8sjelsRYyxYFFDVkP8VC1AGvMbB4jT2gEJFQRj40UmsQ0RFpFgJJh0OS MXjNgh2KB7nsd+QYcAWQko/Z6BauzKgEVrnwZR5eeuJRibJgaDntwrLaUC9chYJ6YevsWbAt ZcBxT+Vikg9paIP0OYxVCrliFAQiYGRbNSLaRF2YoC4Z7cCqE6TCFT3NXMtyYIaoI06XwIyK 2m+omyOrQ5jjSH8w50Yd8BTsGbRVcUj8e63i4LnymoMwbJQGOTiiLwBD3SIX8I7vlxqbskhG rC606RYvr7vdIhjfqcvtBbhK9gS4oSxYLmMNxhc1VAWRRdGhvabAqnlyepW7Jp1OigJ2RsCj 22EvAG/B6Qq5Y0TcQVFIzIBskC6j5NkUBcvv5RSFti+Im8VVsGAKMjX9ronxz6Qo1ErezOvm NUcUhUoS5dYENXtFoWTwLHIU8t3Q2NaKgmQDqv12jJdXFFCMmMFfoig4jiPczGzWAjf/P9AE eBBQg/ICjldsyDEIjV/gEiVAIa/goFgArIA/XAWAcAwE4yqAixIEhF+ACk/pnVKS2KsxNX0q pqwUPuvDPNYKzahxQUarij0do+qTf71F9deiz9D27EUc/WGBqQGC1BLA14RdazhTlMmvPRF1 gCbQ26kGV6iqEJQiHSA40SfXDseJ6YFScenywJ19jYI6LTtAyr4R4CnP2mdmthaCiQX1WoSo j4MLIQ/BLu2JzVAStUft2RvwC0IXERJkrQgdruEdJvn1CBq+9VivKvrWZ/XOfzoxqxzed5Sl fnq/VQqoLOSoPr9KTktUi9BbtYRtsuk4LYm1ixjw6+uV2nOU6QB0upgh7uzU4GxqItYxsy5M vMEt9bklX5l2L42M7HAMFzTsF6NfJjffuG+a60gjvwiE6RC5S4/je5YfaQ2uKK2gE6OxahEV 849rif42Lqtuq0+znFyeULZoRvQ1ZYQGp1x/9Z74sa0+oNx0bE3Zvi0eDbJh0WY0eIQvrDS8 GMF5hHuVIopmTl9VaaFcb4IvriJXvpwKUvIZtrlJfxEgLuutQtTILzfZN+hlfbWOmfqYvkHp hYfNhwM5PhZDNGkjZaI8YDZALdCWsTqfiNmBacLawLz2h+H0sw7dcM9LYckP9bDNMaxqDdsw I2gTg7C4hoYhI5DRg9t00h2tI2MfXPCLxMiJDLfBtCWjIx8CYq2fBr980FIEu9xNNeQhGpUi e0IvyA3WlIXJl5N1TN30pjzmRlklwhfUptKV7HQxGrFLQrPaDbV714IiHJ5Wux0s3nXmpW/e Al0mR5YDtUnPJVOAqDS47uwyea90Y70Xj157lTsRbR0yAtnQVkjD78966dsVNuERzrKgb7uS SN92RV45qXBADEscaqEkH8kuQk19ezjGPYElOta3aQYGZhxbzk1YgaJz49pT76I7jzx5rijy 5Lkir8FVjnBUYl8fefIqy2asa/vKeF3b1dcrda7gBY48ukw6TNVhjmNt21xTJbpglYj33om0 oP/pFUIuvarNspEdVZvs5Za2HDlVW45jVVvOVbl2FOwZtK2qbd5p1ezMcePVbMOp0bPN0RFF m+/GKtoSNRI6RTbgJf4tUrQ79Ulw7/o+8Yq2K+kkuYl9/SRWtCvLZaRoh6Kmoo30snQ28slJ PnkWPbghxdm/umjaFbvNTgKUuXpN2/FrsW7g91wuudYvOKRp58wyDU3bFiQ3o90r3s9WuCtM H+ZZf2XorjjfXKkFkd7unjmmcrPZQKEGGuubI/U4aX/rrEeMi0MD7Do7ae7qJ2kRDk2PvXxz oswG31x6g4mBqfxFKrflONKRWvrmQEuCIyzi+KcCGdodDeIZMCK82qdE5QOagJopE72PE6Wg 2MZeF68AV4Sqarec2Et6n327KL7+PqVjb+NRC2zMhrbBO6mebee5dP2HwdHvEikWk2f0Fwno i4Flw0tGXKtRCZ6AeLCtegVNwvF7vaIXYA3FAR2dX1mYwZ/vqQd//qJ/3vKHh/SSEqBu5hn5 1RJVNvDrCf1/fdUOSBPFMGaWMfsLhPruimmjlu1QnLNW7aK45M05UJwAfkVxZG+2WY6s64St ByR2vz2KMz6XaMcCNoK3Z5aImzUAn8d2g3MmZnYXZcumchxFZLkiCEZQS2+LYBv5SspanB3O cSJVYdkWjsqoDJ8pFmUh5W8joI6IIPaXcTiuJI6EFTiEI1m7tyuI/SauDFIebfkyDxJKRzwq MRzEbhPHqCFlXSkEeWl1PHHfDAHLubYS8NLTccIiWkmOq2CO4waYk2sK2Sp2cAhgziQqsVeI O4NvvauWnSEafpOaaUBpy5EDc3Icgzk5V/jmKNgzaDswJ+90YM5xE8CccKpgTo66g7kSIy+p gWRbidBTVn7adUsE52y3CAyzAuT7rpUIB9eJl4xYhB2rEaTz7O/EWZWkLssrciV678kZMB1b cyILLko7CRjpSr0njt+LYbrWLziE6Qpmpwams/gsQmHf7SI3/wxzmnm2dEQclPMgr4v3RKRl jEbjnScRkvMx/d2irErzATRWCe2Zdc4ZZQUOZv5+CZJzHEdIrpO1G0ClBkGgBd3D8cKYC0EW vsRapsFWMKsXQCTcCq7hF7OT4hWOQScgMvCZLTHmUsr1Kf0Ve7OzW+srsRzyMqUPcOpsjisx +ed1M0VeO6Mp/MId/PJOPQZUcozJn3JnpxSr6BvD9WsY5oSKcFlNnTAMPsdGx2O0JlcBZ/6q 3GkM2ZTrs3q/3qkvwwDIszQp9/yreVbv/NE0C41Mub6LGB8ox2/XO/WNeqdWI36LGmbpJt4y aIeMKzMSE2PomvZQpE0w+T2/pKR9pE3D5BdFC3hzRtrG5BfAIrkeQUiyUtWBxYqZoAdYZL2W mvxIPAICNWd9TH60pbhm4xibxBdFM60vizAfQQWitEYl+FzMxpe+LAEVkmSEULoYLZJ9GKiP 6dajRYy5hSirbrIvXUGIsoGUvSlGi64sIA5HPCqxLATDE1W0rMYAgBQvpkIeLvpKe7joSzxc TDoH8Wc1yyEcXJTjELzPzgqSJ0iCa7IaaQ9wEbEBC+mVCcZ+Bxcn5FSI4SI5V0uhUJBPVI4c XJTjGC7KuQJER8GeQVvhohFV88ywhi/LTYCLwqnCRTlqBReJQQ/LKEpCcUsatgEXO3VLgItR t3gJcnLdSogjuOhYiOGiYzWWllDWMAGKlI5ZXRbgIjvoZZN6nL3EBljWo8FY1mqqO/P68aLl 93J4se0L/gC8aA2JraJtSoy7Ki0uKp/YRVbCmORP8SIOYyRyizicreig5agklHnk8zqJ6Wg/ tPiceHFsQMiL8KLlOMKLB7yoYWYHqunyk9eAJEBaHGZDEAglW2PKwo2seBEs9AhYAWoASviN na9KAujj3a6P4BdOPmvZg4nbAcZQxIU2vklrwiuJ8q4nMXDHhvecEba7DS85bMMzqBVGqTmY TEEtv2AvQPCBoH6JdzB2Um6ixjxGXaUJ9Qk1EColcJq2J7+v1TDIXsamUK2B90BUyGjRbrwB D4Xgik7NKGu+400Dhuxk/IwtO27Gvx+ov9oxlU2t4D9MIynLv9yYVtLntDEQD7F82ngmsQ9z pi0EqOWYiJc2lcHZJoHE7ORHrLVUx4JXseweMHMfCBlgay7zQuOaN+BbWGmuMIFnyuDfWms5 ea+Ga/rR1QM5sFZqvV2qGMr0JfQnzzZfhQ+/TU2d9Ms6I1lwZKas5yzYB+r52zaWORUs7Ytl WGyBMKH8CNvaC0//NAEGerd2phdJ7SURfyWslxuGctEmGResuVwN4frOj9rX8ZMHxEovq0Dp ZX3JneEqRPJ0aT/MTENUnqj9Jm0Gj5/Q0Og63s+ARePQUgx6/hdOOWbtDdWFU36/cUObjHkq JVQdlY4G5BcZoOVicnosTcZ70P4MPaGkD+gbaAse1luVHGLmCcWk9X65kxHN3BNz/aspQV55 VmmiknPMl8iv0kQl5hgt1TdvsrumNnhbyLrI6gBWiJTNBt51OUhiAkaT69QiCT1qaJGsbeuj RYZ91GoqGm8O19HlUOIizyWTjY8cQV2zRTEAd2VBZxSjOLpNKCATU0GkJBqFK0t8HtBIiZQ8 m+yBHCmR7NvO8lDZPNtajH1BpET6skiJ9GVeZfTEoxLcqSbVszduJ6VjNVYLbH2CDumqHHRI V/ISHXLChs1Oh5TjWIeUc6spEp0WdEiJV7M6ZJ5j4rc6JKs2EJ7I5YBtgvY3OqQ5sjqkOY50 SHNutEZPwZ4Z94HVJ3mnuhzQRy03QYcUTlWHlKMeOqRkXyH4p6FDdumVSIUMveLkp5MERxqk YyBIcFo6RmNRCWUNDVLEsWafyYYGOST65mUaJLnaSvmsHlPWNzYUSDsHx5pSh+Ua6nc3JvQz ruuW1HKwezn9sSX9uFGYokw1C2a+C7ob0KeEfCv1UQYqMS4EfwP+9JfqjxKN4iKnL68+Tgxc eZH6qAxH2uMZvQ1gJPDNvnsA5AH6AbuAPPQXFEKJ3o+oWABFmLfDY5TsBMx7vHIk+72F0wWJ 17B7R8n5ngkIsbgFXlRHvlUcC19wBxLk12pmugAb5imyapzeawPMHSjWh+6pEy1hCy2k1Yfl SnJzqycKuxWVKzlF0Pq4XrUxJg0Irm8RCG1W1AtP+ngjUgWwChPQ6tJ0Y1Ythh2rReNqt0B4 KpqRMKJ/eCudjbFBFsHTq3LJKoR6icpxgyhNXHGLRvSSpTSXnH1yNTzgSWnR/He9ATuG3Efb QXJKS/DHEtEbBaqDue3bLFd6aW2Zk75C6OyCGFvYZJL2Vm46tSchCi8URJUD6W3j3KNPybZq +lY7nfTJsbipaFlBtBqf3qhybaWSCQhK8QWloiX2JvuHnmtTZzz/LHIFUJE6qkelbeSVsqEV tML/d2Mq0broBf3VEq2qjaX6R59OIm1MTSxPNCq2S2jwSRtL2Yj5bhh39JvWbvmg98afufbK F/2j9dJ7beOzd1arxmePTxxckiVfa2PhS0NX2zUhyLd1Osj/q4WH5bnZajp4/CZFtyB/Gx42 kQXVOA6JCgUamjOQ9VtSAnXU1WT7B5JAlVF4mCuCoPfJ+TKnhqVs7jzIRb9yYV8u6X0cHVaQ hqqQVG+xrsY3hDoQLasvyFVUEaMWdDVbEIeH+ZtiXc09GDQzRzwqURbi+DDHKmyF+2x9vK7m q+x1NVcCqd7hYehJEhNlQrjkOA4PM9eMrpbnLLP1upoIjdfVZO8Qp6sVWC9iXS2BoCyyJzmY OXK6mpTGupqcq3bmKNgz47uTY9aS8E7V1RA5y43X1QynRlczR610tUasPxvPEBtPl0fhYZ16 JehqrlfERuB0fSvUVOC0BAddzTMQ6Wqe0YaoWOZ3gsMKcpYJDjtnbBjWj4EkO/jfoagptxfT 01qS/wPUNPSW9mqa5NEHgQY1DfVzQsj/C9x8mNYHE5KaBPvwpdx8OfAjuRkaEPISPc1xHEGS Vkvq34BIrDZldC1VALBWY6enXA3UwAtfHluLwSaUg5wBmmonBlkLpDblAFAByBybReWUA1Yo AUJA/4eWEJGQAdJGYjKzXWIr2EApu97Lm28DSjlmrJaUzGyd0aQsKkwLD+nN9xEUev4lTsMs MXcT0BN1TzvECDAUJULBvB5jizdqhcDx13wo/FF4qIhw+Y3rLS4oPLxX2KnXFXZa7KwUb+N0 YRZF7imhpit58e/6MsWlT/pHX6NvEUdSOwAqC/By1uoVtnH+NwJQlmaaWDEbcoa1VpaLdl2f oEZeAaA5q271zBKJAOiRxbFmNy22lqwIEZcdmXMMVxIIR8s2ygwGKbFiASKNIR74JLCEIZS8 JP5RU7bzKNBKYFqXkCxqI62T5+RYMmto43PocZ3cgaG+Gclkw/3mevS8vF8guV/f5/EJXt+8 kPrulFCNAFj0pghgy7YrWH7jEruHziwCMYS85eL4iCE3fZyN8hhykzq9FF3KM+AKorW1ROXp TTHkdmUBODviUYmy0IDcbrufGEe5CgXMbescILdtqYC4d0cupl0XAIMqNBqzwMHB64KNAOLj yC2SyzWF2iXLNAPUlpXLzi1SMoo7qF1O+EwabhGWIFi3iBw5qC3HMdSWcwXXjoI9g7YNrQNV S28p7HbcBKgtnCrUlqNWULsRWkdaZvI7NSLr/N5LbTojQtq2dyKgbUs6iW3iXx/jbMtlgyNl fBdly4Iol+UW70o9rl+Uu6pAAydKyrrWr3/1heP3cijbNsjJFxzC2cDDpjvEFpx7Ra1dhmHA mXG/HFlRW+DNG7GvRQDcmC6IqkMLXs0TF1fntzJoFVdHZnJW6cpgYTQziasbjp6LyIjX1H4v +NIAIDClHivK1GNFpf/yKtFo/DZ2MbKmk3gXdX2fpyGjzLsZLvMoB6/FnrjHmZjwCtwsHj+y JV0AoEdTUJrm2l1F2QiMx0nk0uiFozaB8SJvMgjKhCqJF2Tw7otSNBeGxSWglDFpHPuhlIIl eGTHK2lERSkypdiyGH7Inp81U2CEUgpJ7Cp43T3JZLJHrQdIASAF0PGYZI1zQAirPc118eQz sXAuBxbUyHn8fARSiG4BlgVEQPdJ5GiEUohnMEXxeO/KgiFQBuWc/JpRCZ0K2IjHe5l1JfAt himSsHCMuy5gIHYLrAB6iWfKFkAqYARXFsMUVxZAiSXOdGZXhMrmKIaFsBSACV05jachWx1e SLNL3jrS35lmiGZG1wi9cEo1nAAF1WzHMU3i8mTyIXCuOAULaYRT+EBoA3vF5C3V45qV4uCU kLU/x9RgacuRwylyHOMUOVdkYinYM1akAOP0irxTcQp8WW4CThFOFafI0RGcEq2cidN/FOTC ZAfVRl7+Nt2RuO6IJCJ0hxccV3RMdGk1Fd0IYluBiEXXMdoQEsu8BStGNFg9UbDqOMtMonWb l1/eAGJxHgenLXkdQfDtiTT3SArbBfsY2Eb4hh3d46m5XfhGotO2eBXNfMqEYP6eIS3/s/ya L+oMaflbvyBuFlfBq0QsiE3dSLvJt4+mPa5egFhYRc3C2thE+Mcjlj2eWiEW0tGvrgyw1Die YsAi2y91MatYwOKsMyOTs9iYavq49ZKcpfYlEhRN3r4oGgF9mZ+qMR0I3PEDIJQqrNWSC9+X sWUSphbJbBRN3iR8IMfDOLIxIK+kqDD5vEz6rsQXRJO3L4smb1/mp2pP3JVAy7IQTd6e1Whg dvXxk7evssMPoa3C5N3FZqTzdp0Tgsn8Ia43OY7ncDm3szNabrA1IDN+Dh+ZHBp61wifT3MO H5FNQ2nLkZvD5Tiew+VcZ2pLwZ1VmHHtsbzTzeEE1hpuwhwunOocLkfd5/AcZ3AhmQwit16b Xgl94Hol9f0UEKkvOibBkGpKMJQOSLBjtCEqlvmdOZyVdoPqQBqvl0zhOSHarOLcU7FfkvHh gjP4c+yeawJvS//Q/F04xPJdM6vDy/I9eFSAp0sAUasATBmmhroL037qrp4JH1gmxPjrPMBi Z9hb7WRjXmIrQ49ddagxjj3yXOAyeYljzzJsRbulc4okqP9FDBaGEfwzBLLhssE8gn+GX5bN 4IQjpo2rzPqU/N3cg8GEO4mQoxw3nn8WCMsxviOuKgVSH1Ai9yc3/zDlSkffpfdjeOEeyluZ XDTJai4LL1CRo7q2iyV8Pq5vJ501piHckC6IEO44E4hOH031mo05XJl+i4P7EkkRbvxu8tAh Qt9DiDayf2xE4FsKuV9fpcm0PU9hUxTDwaBdY7HhHxoNe/ztNNchq5RfsScMnI7bcquoL2+Q GotBgWnNGaRkwXoffGf8ReI2Y5uhnJ1ZPRGnCB7PKStuMzE0ZWj4mMjGY2ADTGmR2fXYFMkM L84iiQaS7XmHBquRjgmDB8YC/yj37VLrYY+SXZfFRyHJqgBBGOejc3GKmawWvracGyea3s/1 nfu906xpjxLX23jMSohgj/JFMSBwtwVISzRQhjIV7FG5SGTDHEVOJ1zrJkwqPIehiM1eInMU Vo9BhgXIm6NcAVApABd7EzArgE5X5vAr7a7EgznKsxAjWmU0Bim2MhFtW+FgjfLNEgBtB68Z m196axTHDSQr5xajSrYOt5Vkztfhkey4Fr1A7xqTra2JZOlBi2TlyCFZOY6RrJwrkrUU3Fkd rFHyTodkR5abgGSFU0WyctQDydaYfSXHQoxkT/cGeomV0iAPriQCsq7omNwm5AsychvpXfty 69hsiIhlfcdxJsJKOrjzes/EAZ6xmZL6Qa7fe+b43UPeZ4OytkFOvuDasSwDVM5GagedZn2x LKnJ8cQ0nWZt4GxLp5mkoYoR3JGFv95phqtphyc1QeG1iZxmFmJHTrON7BXiEcr/BzwEtdwK ZW5kc3RyZWFtCmVuZG9iagozNCAwIG9iagoxMjEzNAplbmRvYmoKMzIgMCBvYmoKPDwgL1R5 cGUgL1BhZ2UgL1BhcmVudCAzIDAgUiAvUmVzb3VyY2VzIDM1IDAgUiAvQ29udGVudHMgMzMg MCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9iagozNSAwIG9iago8PCAvUHJv Y1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9Gb250 IDw8IC9UVDQuMCAyMiAwIFIKL1RUNS4wIDIzIDAgUiAvVFQxLjAgOCAwIFIgL1RUMi4wIDE5 IDAgUiAvVFQzLjEgMjEgMCBSID4+ID4+CmVuZG9iagozNyAwIG9iago8PCAvTGVuZ3RoIDM4 IDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAHVnUuTGzeSgO/1K7A3KUKm 613kXDY08kyEd3ZivHZH+ODwgd1NqTnDJmU+LMs/czfm/+yXSACFItndVVSzh2M5mlUoAJVI JJBPZP1i/sf8YrKc/0f8rcbNaDw2TW1/1jPzo1mar99tMnOzMeloUk7SbFIfu0o2N6YsqlFT ZrXJxuWIv1UzmnBp6rQcVdVkYujwfXhhU43K0pS8ihZRlaTzTpPyj75/4aXZuMjTVAr4F+6a bFQVE3pv6nKUl+XY3NybP15RI83SOrkSuGwT93N1b76+uspGqcnM1Xvz6tvldrZezravzdXf zZ+ugM+j5CiEyT5WbN+PQphlAsu42IMweRyur3oCBFaHoizLytE4l3k+CWPfrKfvt+b77/7y rfl+9nG1mW9X68/m7XK6+LyZb8x0eUv5L7v5enY/W243xpg/z67XuymV8jQrXie9EC3UMpAU ygy6LUGrH1iipPA4ok1PRJ8w8y1tVlB7xQqzAD0x830BOmHmW4DKelQ2LMAjGEr2l8gAgLpT lgxYvUUzqsdpd/Wa/dV7CJo5ETgL2hNby7gaTepJUZnmNOBW5wQuS9NRMRk3pwL37u3G3E8/ m0/zzZ3ZrszH3fXCXt7N5muz+rQ0Nyu2xuX2jVmtzfZu9jmufr5FzJhGdVrlYVyXs4jzMdyx 8YtYGcwBiZqD1cMG2JsQTthkWkI4Db7uxLtJN/OlmbLBhO19ezfdGnb3j+vVr/Pb2a25/sxO f0YyGI9Hk3FVm8aN6lQyOBRsDnDMi9JikufIDOMKGSe6gLHnzXhUAIVphL1MoMzJqEknItAA IrLSZCI9Pi3ZdPfGp+WGdrPOobVJUTsUvAzhjSZpNR7nJUgp8kmZZePo6nF5J+xMp8G9Wn+Y Lue/T7fz1fJ8vDmrxqMsqzMITLH7r+bNWZ2PJnmFINsBqLcgu2KPlo16upTdmj3843TN9t2X Px6siqcJ1K6MOpU12kFhXwJ99/Z805ujyrCsYSNd2B6XBUc9ATpB9Mon+ag5mNwOOIfSzSE4 h9vZgaDsV27ywMoVhlHarTUbj9IGDQ1NrUH0apUqu59Zxe/dDxS7reBohz+8O1DOvmo7QuRt xqksraxEBq5MUYxH5WQyTg5KzML8YHWvtrWIjw91hk5JZ0xy6ExK8klxQj8yNwA1MfcJYGo/ mQVzUGdVuj/CbsnAzuq9EVaplAwdoW/VjtCXdEZolWrRtNEJK6GJwO3SETwRbteyO6E42F2i loOjavIBUT69m7TsLstkZx6fyvGPAnTC9tYClObwwGKo4FeOjPlmtthOzXfr1XZ1s1p09WJV lG9W96jJt5bbbc4oT2X1aFyM2YDcYC4Gu2hYoyrHrHQpunGN+aqqEPhUN1Zu9rQhqRxlTPjh jv1c5Bjk/C58bMpi6HpaD7laT5ebj6v11rz9sFxttvObM8I6rhGNscXtwdphd4eaUk+ATuC+ YS3XTEdTTdxa7toG+/Dfo7N5sNsNMHzUNaiqUXRiajuYzUPQepPaHnCDDB8nAvfWvN9td3CJ W7v9oTPq9re5W+0WqI4zsw3EOHXE+MZMF4vVp/nywxk3QVZ21lSQpUP65WyCYiwfY3vXTbDv mj6rYSGYv+rTgJt+mC/m289iSnDk0M66J4kNxLD9NJstsSer6TjYHOazzZvzkUKZjkd5LjuU G9yppHAokB+IGk/YFwoE3gmCcl3iCxkjKGOZhfu8kHGhLie8vsrd+C+M8hxwA5eFSFabu+ma zcSs3usu1FKacJnkaU/P3r5pBdgnDMY5U5nXzN2JSGUN9GSBBzT2tHyNb2xUi5XLA+eQ+jhP PqdGzORWOBT3ABrOkw+XYGfunk+FzdAT8QbkOHMmk0ZU2G7JIAWPNa+didapN9gSRZ+dnNCP NPV6te9sTP9DlOq8ZkI6w+uWDOusQXGUzmR4ub05aXhtUz88X9IO71GPbYcWxI/tlgrqa9fS 0N610mKJqSTFQa3C2QNLJVFPcl/Z/yGADuwoxwAqMrwjXjXuu1nj5kU1+WH30Yr/34mn58Yq nOaH2faMSmeeVSidONDqDtgPoNE55Pui8YQtsJ3XPB8Bk9fonwcg5nWoJ74FKCvAVOMJTSf2 aZ3zheS/DnC9Fc7jWkDE4J7ZgCTbHpYrokkcvANFmgUyg9VPZsvp9WJmxEMaOUaXs09mdf33 2Q0hDVP+P6Ns6uMY9gbyPGT6ResGC2caogYujEpPgm0z25rNStwmWzNbr1frjegrs1+nix07 JPLjerXbznCBzz9QTvH8VnQaIQDW+2a32CJhvgQp6OhO1VKOmi2+hBKqST1K61Oc4dEG4GLP ngu4oLCeCNx8iTH242LGfM+X71fre+WREiWByWL668o6vpn6+93NnZAA3vHNnK1idD4CKLDH 4/ptjB/T5VAAHra8KS7HbovbAr+WE9X67k3lqIhEo+V5Pc7FqEjrAndbBGhnUz8w8w2IAuyG FzxtgQwO8A44D4iUB4DdzWfr6frmDkFywUYY4kQW08/nW+DBqdsB+V+GQefS7QDTF39wlZ54 2lMX+thvi5SlmeEK7YDWwRPG96QTB9tX7N4DR9UpCf/toU5VomCm3pHWVfRbb8ALqlNVnUos zwmRNT0n7wQW23IxB9xA49fV3Qw/7nQxvVbzK+LJ+UKbGwwieMyNR2Qvm9IAUhuqUGVNMypw 3u0B1DuIZupN1cc9F8vVFmviR/y1ZkWA3BnZvo+C9Ii9HLZfZYT1X6aiWp0EW19WhhnL4D06 fmyhy317WGO9acTB3Gt++0oDJ+w6OWFSdcnWfBoOYWeIUVd3RIhKkOh0jXt5t5iuF7h/7sXq NCUSbX5ORcn7c4bgs+9GdAI+g2WnKguO1hBHeYmevROBWy1nEh2+QR9CXyba0GlCnuFQNF/f WjL4rIHlzty4ma1/lSY4aL4+3+YZzoH44fVaXC9CDAUO6NI7+3tb0l7GzFedBpyeDgi6sNlt MJe8N/dzsaa0qgHuXHaIb5fmmkBVczPdzIRyzkcEBQ6Roia+1w/LEcEDAnorfjoztLX/nU9y KtNiVGZVgM6prR0Z/UDp6kuiBzL609pgu1/h3SoQoC4xHKU6CTYsOeYTiupda74lNMUde+Ak ww0R0/cERJnF/B8zGJYIedh7/AY3uz0jkQYxT0d26kZ16AE9YFlPBCFMOH6VEn9SEX6ATScv xBGZv1QQQkV0YlWNy4Fr9IX2RQfcQA6ObWRxSwS+bIaWRUZuN+WD9mTVbAphno/CciaW4F2Z 2JNQbE8VnG8bLHL8mSWn2Dx4DsmdffBgbz5jUEKRczCyGrMxd2a9a6voszEfLsnOrvx8QQmi IVZEDUk0hYQkxPeDPPac0XYdGelG7giHT8uTOoG94fl33QAdUcdVMiQYoR57aLSjzv0i6X9U oJ54/Ag8/q4dFlJYfLL8+HmD0MwNK9xLQIgOiyCEZ9UQW46MNa8aZ95I9fjS6CsiHPCHp1XW AFAJ12p8rGJv0wphbQiAf/rtIx5UuO776Q3nxlEF3r+nwHraIivyanpOrgsxlpzgM24gp3Ld o7aAL0IsND+ZeP/qBRwTL8ckSsgGhyXIVEsw/Dfzzc1iOr+frc/HQYIbowvrJSAP42hQ/Icz kKPU1eEhEsw0QLIva1SOgo3vEkX7E4ETY/dyd38tRoWbuewr1zOiyEHT+wXbilnt1pQg29/s 1vY05MxRYvJEno8DRD+9PwbRwY9loDTLkQw8zqjF1yjHYmCOFs0zh8qE6Oc9UC+At3D8ri7q ywyEl7OBJwC3ni0IKMEAutkSUSAnbyBWpUfUTQJPhEpv5xzO2UwX1oxKsgUO7xKFQAIGOWy/ XZ1PQyiJlkqLEm7oRnc57LCsRvVlehrKU0BzuRM0scZvWyOGiQWSjmHRWwmICtAA871ZLXZy /H1zzsiSggieZmx0KJcz6YA1rmtvL3+eHYndfKgnsZV2SUCRyoGMmG1eSmhm2QGut0H5R8KZ 2F+wTNyw94jBFp8mVvnPZrP78EGoEdqzmZzWM+I7Pq3WHNuKdi8Jl3uJHcmN7nKIM5uQieNC t6STYBPjJx46srpwKO9uBinI7Fs5pGtleVbdNngbSwX6giaYpAlp8NZdwO6TckpEDLPDdh/R wGzM//x3lvpGdO6NN0R+WKyuWdSSwO18a5hEJrg9cXBwfMIO4GKmmEw/ZAz0Do7ODPex6z27 WlaMi1FTkHEhnuGnDwDrDIuW/VfraZODs+eL8/G5abrAXoCSXTTEx7ZZHy9gOjlanIVUf846 9vR09ndl7GmmfeIBQ0gZDtFTgPuz9/Hu1iKfykYSR5jNt0gI7mD3x/XuVrIOcXBiutns7oWr nFNWCOni/NAuZ5/hYHEWUiz2Fs36E8IJlsaWEE4DTp36Yqxtj/Jv9FgZWgsHJMTRZTODMv/W 6bVCh8X7OhNpczk7H78pyCLSTIhELNzILocOSvLHhcyWl0YHpwFnneedmB7xor8RCvjIqeub Oaco3vgQEKEDe7DijLMv6ji5+EzhxuNmv3ewB0c+VCw6Hw9tKbSL8w7LOnB1HvHnPOhZTKJU zY9lNCQ5S8qR3InNn1VI1gmk8Byvv085IOryGfMZFgWuPRJpDpykF9oZHXAqjvVerlaaPp/8 xemvPMUr7VE3EDqkRCKvRJeXw2tE52nuV4l0uZt+FN3f7tcUz37TnK/Xu621B9zONvMPZ8zz GayPfmSn7tuHq6LDH2N/O0LZYUrLPnnsBLaSqSALG7Fb1i/due3v307wq7tu8Eq7m6JJh/ja fSs5VIHjP9y25+L3j2Qc9W2jXcYDsreJG1//AZkqFX+9tGNA7oYBDfH5+1Y2DUHbSe0GdAaX TTDyFWTuqLP0MgOQPHADF7090yr2HSeh6bpvBbfpLVnacTjJ2vdVNvdkYSKNqPOpndH8HC38 DuoHs8OjCnln7UdJH/qcUpKYJMItvAvqeQD6Egt0IR6akH/wAjzJOJE5Bu5t9F2AkGBe/mBZ PoE/tin7HpiyFzxYliNjlaSZGyji/HG9m/99+ftstti8MZxMt+5A5B6iZvicwsa83X3Y4czO qjf2Uwo86f7303fTDzPT/Hw+STvE1u+N8AGUv2BOj5yjX3VIpPevM01lxMyQhKILTneN9LEz Hsoz3vDzE0jNzM8EJNzaj7MkzyLbCHPJS0kxmzQFgSKShogSUn/D1gvJgyNRpAMEAmmaWKlO JBzsm3qtPUSayuNpxjPMxzXf80gkj3M2JjCdID5XZnM727IFZUT5NeQjsHlrU5SZhZmQEgkH Z2gptfZ7W5g7ctn+pNjsJS+VNjBRgj1E0rF3id4tuJP4QD/QEorkztaUZyIg+bs7IxGMMpGZ ZN2t2C8KjNKSm6uqifVD/NkrYkAkZGdXIRmAr0ZWALDSTDJKSE6PaTsuIdMlYaEJvYdazGwt nIS+2jJJBCwRr6H3nAz3KNMBAnd/k/By2rPx166IYUm+ZEmR5IvKikTXDZBI0h/bcVTiXi89 +Vqo7gImIEVlbjBt5w4v1PEQeEzd2BnMzacD3n5U3IWZkpaKo3z3JlwuuOSDKBVpqeVJQQwt VAP0kp1M7wqSs8sCuHH3hEDae2lK7THf+KkmEJvviBLN5ZXYt/g72udl3oSnjNqK2sTHtmWy DNse7V3j3sdk6r2HR9rbDOwO2tCbDMS+Si4ER0JvIZV3qwKh4XplCDqMpsBlvoLEB01VEmjz YKoAI5CUn8/HiJquLB1whicQq6eWmKh9kq4OBTnwF/phBku5OUSKnF/kTFjGRSleF3Kg12Mo GgNl/LmhsDJlT0gnmSTAntgYsOhWRiidltAyH6dyzL6pbD33o58Dyf33pn4yr37g5D95As0r YtEgUS4++os7f4GlVB8RBKYXGIJs3b+EVuER/f1srv5Lv171JfDa5VZmgK9Qc3KR7Um+kvUf rV3sOV8Qo8UPMPcj/tqN2BUkr5r9J5kvKPyF7yQ8Sf2TP7jeSi2IevNtvvtrjEfJKWcjojLW j5DNuIH5ZGygE5L+YSojn6JsD8MjSzzVsIQr72kWIsvSRsJKisaSj/vRiUDc1omAfL6BAArz avHa1JaEuIYAKn99+9pAUX94nTTmFSPrEkYc6N6GvXP+YsQuRiLGfZDScY7rKjkGUvsFNf1e x8Ymy2nJxOfkO5RjvG62L8eYZ5FjZBHKlii8thYG9CVyjO0MOcaxdDnPkDaBv8uOGgkyj5lc 3b4He+FTCxBUy959SbQR+qKw6zUYmyZj4k6iEvLFcXCmw9wtJxYZLVSr2bpx2cqX/bzkUKFt c9Kr3YldAT21G7avFLN3X9ayA995VCKygAAVihrJxQagMXsPwwns3Y84QOAK6EnEM2HuQ0Q0 y3JFZuVzgZlj9Em4b7m9lWttHcvEC5hSy/ILztXYTd+xfEllbu8XsHQ4SE0GLCSGluM3WAap ICUiYvg7x/HDfcTxfRnmNni471Bv/Nscww/QOIYfYA0M34+PzhAw/N1jrJ9N5xjr51Mgkv+e vJ3PNIvmJvF83090D2pHIPVcPxBRy/UTD2XE9NsidV74jZasEDm2vZbn10xUlU0ay/ST9hOX Q5h+g8Q3KXz6K9Nh+k6/i7lbP6bveH3g7BwMfC6m7+E9EFKei+n3fkGMFs97AwP3TN8x8OSV 49fm1d4T8yq08Z2Eqp7XB1EiiBC+6mO8HnJB+QmcXj5bw2Gh8Z6E2CfuwhFgg25ah0gAy+ol IKTDVR3JxIz+3cqy8nsEFni8+4H5w94hkMyy/dIyeQSBn6wIwDiz5JX8Na9+tiWgor8gUIkW Q45oNi+F2BGLbKQEiO/D7KREUkIG4eTbfwqcwAOigYFPTHzFDwP5Kk8E6q8AnnxEUrjTOzJe y51ItfwgvUgVbX2tNyQUa8sQdRihyMlUm9uXuB5o00vYcTK7/RxT+MiMjJAp7jHCGxkMkMo4 EbrczwwXmZQCHnCN7F8A4vpKQRWIZZha6DsRjIRW9OHuEkUBfzcMkR9Cu6Seq8CJdHurfQmW eCZY4kfLpvrzDqAgHT6z9ZUSCl1phxsqDMGWcCPE3ogesI/3wJYEClhxldcCCVMFjHdMNpN4 CwyUfQI6fmyhebW245UK5tWv+qNFWhn8tnW1SAbJuGSQPOo5rgo5ns0bu4kbWetbSREYe4zs 0/S1AalMCW8FLGie0YX1SHg0JdCKwsQ1Sh7XUD1/mTP+qggPZkJbqCTU13LpORGCok7PsXm2 h/Uplc8xh7hCRvaQghGv4b/pmBQ6yCpApKNUGFFQw1hZ5VwzWfxlslgVWlNHwHKnRK+1pmJO 60irREYWsKX1taT7xha77yx9vNVKMQJhmINQrUCznsIgtTdBgQdLwR2IfHyYWXCQyO7C5xt7 UNVCdhdgkY0ToubV8kM4vhYDliXyG6X5bukW3MsW4Erx42lr2S1keLJR8CsbhdySfMVeiKmB dxgxQlDuXun6cl2495Lj6YpaTKdr6+H7J6W8mVTitqthewtaWtYmBQy85qjWGdPpWoDjrQKE fXkYPcMRiB0C2WocJ4GkqeiavbE3TCtF7rl7Ishv+435VOIbazPIk3qCC/8qS/qU6XPXket2 rdUhMCqQCkveoTfdF2o110g70moto6Nl9O4YqiGbelVwPhVNpt0gqnEfIn2CewnDAmwY/g1U BKgzAkCl8Gm+pfUEoTRzrbSrd5RBnW/5YZcZ9aOwStLO820FPvIShprwbfiO5LUvxQjs+18o PzRieLvP2Y0YY6LFukaMRlJUiFmjpzMmGDH8hyvQiAn/ki+f6ocsXEc9TBmS59OrcnznBDBQ gFpbRiiK1LtQFrQ5HAg4CLI8iUo4V2n9ya3OV+EuyVKoMzJnyKv5qKcYL5w5g0wdOH5JHOOh 8gXovcGYEMoic0YoCzqu77zVegMIkT2jzh2okd7pB2Tthc4XorixZmfnMHHYOt2ikYzR653X Qi4jO4bcqh+C03OYMMQGAerG2M+tRcKZMFCCxfUjzxJwi68qtl/wFblCbRf2ytkt7HVks7D3 1kThe1Drhe3bGSvCe52xYuyhCsYKAVgdIVwceCcin8RxE0WNc6UQ5Tv2TjwyM8xD8FK5eQjU EQj0CGkfoeOYai0dx94JD0Jrp+BjBA7UmGBcGcFRHUuFEKWQd3BO4FjAlsRS/xLvBI4sLG5e du8YKtzeF2vk/QwV5/ROPATvcxkq6r4viNECU7CWmAIGZC++dgXPa6hw3VvR077mEUOF3fKq 2FQBuxvzQXK1axm1ayX9op+80sC3V2txIweZAP/PGU0VjBdO/yWmCvi7hbhVTTNccvsw7zN5 /Cg/ImagKyA9YiBB8JhYqYW/ZJ5RZYS/TDsliMyhBHEwlKP8i1hje9B+EDvDU4RKVDdtSz9D JDOyJzVEAbSzwNbcRzL7X8aBlITYpQIpuBVBmB9kR/6KjM8P2QTkR6tpk/+zzwGT5k7+Ylyh kl7/Z1TpR7piqGgPVNJ27lVaV/+2lgr61TeJehKauOdaGZmYB8i61O30pd2D4dAOiZlr15XY YBAK3Y8rdAaZYYiviCMbx0fxJJDkAQdYrIp41QsQRRUQ4BkDOJc7kB7m/pGPTpUNUX4lS+8Q iOO2Fgmzi4FYxfOpKHMoUfQqzu4UjUtFs5LFPfQAArWNmyW90ZZLrbbTF2iZPneTpW30wfq1 mK9WH7XCtRZqBWfq0SL9u6RawM5BBEfko1SznQh+aUo4UNif0l7Wmu+/swTDOHScUC54sHQm 0EKG/AUUyrUO0PGUAaPs/uqXeSjROmiQutj5KzUToV3qY62jN1YRfxk4JSwcfW+foVbwpyJP yd7fHewzaC0v5nrN+IQlHtgQQEbSW/naXU+NhX0vkfAx+Wi8JG+zedtwzujdQQRZH8er5LUk kdWYvoKq4IsiKS9UC7oJRzmJuSI+yZckYiXHb8buHMpIosHi5SuasbZCfAAfQU6jwKqSsyXy zVEHATGKeh/pKr4oUlV8UdBUQsdRib4+9rwGMCPBMwwmyMNhwEEe9iVf4nuV6QbT1hEq1wi6 ITDKPrPqCTFXEqXjAq6EZECpPiGUzSkqBOgIDUSKSpKN69T1LVdeUZHrWFGRe1VUfA/ujr5V USG9Ie90SkqAJigpFlKrpdirAzUl8p8GNUU05DAtFT5gQuOE6NoyTz29pqVVIP20CNW5yMBQ 1IuAW8UlUEZEwAHUGCwP/p6aIgTZyGm7oKfAusasiNzvL96UMMShSmTFiNO8PvHL8+gpVlhX z5MVp9ni7e8zRFF5eB0rauF9Lj2l9wsuXE+R7aqQhRZcqiSiKzj/l8Vq7TA9pSStbfaCekpp xYcv0VM8xJHkMj7UrY7oKVcIEsi6CCSIE4gZCBJ6ja8D0UJFDgQShBOomxIEGxVmuFbxQ1tp OaJO6A1RmWscLvg65K/v4aE3jmz/+pa3Ktxy00emceqlxEDnEt7cim/HZVuzJ9veqaCpMiPD YYAMB+BV2nSirVbSGwBTcY2q2ozUBbaJ1lKJ1MnMn7U2/gu61Cf6kp12pkVH5F/teamwOFen lmlf2q+WaCWF4TOyo6J7EPYQDOMk2cgWPRTd97zYqoCMguEBkhIS1+L70RHzlxHzF+zYB7YJ km/k2lD3ibZ3HhNxJimxYe7/nhuoE1Hbaj8M0T1SJ68Sa3idaJk8F3WNH+dl8SCKUK7Xrhoo dFojT0S/4seVuR9RJSlU8LSt7dvaUoZgGWZWoWJEyveRyAAXrxHrX7PfFEbeDRyKTZLcRljQ axmRoFgh/ahT4LRWsO/Gp3iSUWpP4rHnjmXKEy1ybUTJA7fyHE8Q6cS1f61/45rrq7V77UOv OcRv+3XQRO+3eOONUZF9yRBUEmiFeTX6XHHPMJI9154SHoDiygMcECBjRutyU8++RBkDDn// m+e6Ubb0/U+WnqMh6ol9gNE58pO+fQ8seakmMPQZayUR5EVRmvJwtEcI58gO350CF7shU8x0 /qLAyPIAJp0Lnf2Zm/c2bKRdbjqnjj6UMFwPZG/pNyy/Y5NOo+mks+npyW7dy3ZZCu6FmPXH O5vFEMU2OHcGk617zABltK4NWSW4l91SNjI6MWJHYPbdbeTQtr254q0RBGHb26vmbmW7oE/Z 4fg58mL1qvK6hX/BMMQRTEqWcNlGxOWoIQB9tuu5A1tsdUDmwBWiBBYS6/DNlAhij8nuAFjh gkAhALpw6Oyiw+IUF6326+flaEPzPZXYYWRjZ1G5aZFsH9q/sa2tCCFvPdqHZARytQeiUQ7j 5tEWQqxAHzTegzhg/ocXmHSHhBwWNjSelcQ1oFIO+OGpXmtbBkq51tRyMKkWH9c2ERSDkrj8 nd1K3mrj0aDwOxyjuHtrrAmdQf87GX5yDtXEhh+UaTkEN9TwQzM9X4euihJvb06y+xQFn8IU N3Jr9wlFkdocyryVhyB/nOM2dN5FIXOWEbUFX7No4D4yWT6vURf29FpUZiNG+aaF91LnkpwI hcdr7kkoiCw/oSwy/YSyYD6Qk86EozbBoEBfDoTI8BBAjbT5MKBg+wmD9rYfhuiwdbqXWmYL N7Uee7PXke3H3lsLD2YV8VQ7249QDWjVJzBTb/vhqCF+W47lBetRXkuOJwmwt1fO9mOvI9uP vbfWHt+DWoJy+saupU/knc72E6ABQKYdsCyk1vZjrx6x/UTO6tj2U0juUhAb2356TUs7CX5a oMUwLd72E4oeI2K62iNiujok4gBqTC0e/L0DdHIeGMd710ddZBNCDr7ARy0ZLji18G/jo34Q 3uey/fR+wTHbTw6j7fioXUF05u3rrvf6SDD9wyfoKu3expl3zyY+4qyWfSvlhEtrBJLYLAkf OvkAHT4SYizjzKgPuepOiqoXJ3AbVW9eMWyEmy8xATmAI+NHz6B6J1GpguNUbpGm0PdErEcu XOszVY5ELBNZ0QIsshlwd8riyiLN8RxjEn+1ie3aa0MiNYIJV+aUbNdpMAjQVORU24/5OYnP oj5w5FDdeQXOlVyFZOOE5CP2oCO69jUjRbL9wEj4+daqsD8oBCKlKiA8Ia+1xQICGhjhg706 SJ5oB2QytD0AfWgDRriO2x0JROfzv68TunH+zTvtAIRQxnTxMu1Yvr4cbvSdIJlK+hYqiY6Z /OmKs4RysvZxdJF3pUQYjkwT/dC1OxyTlryxsMRYjPHxQa1rigr9i0AL8Frpb2CaGx3PXYww 5+jV8fp3C+4fet8vO22udbVHbS2Ille6Lu1rEnlnL928AaMV8ohkrDmGuSeDjDvDApI+b3Wq Mw4REg2HwKv+GqBXnedgw+q74QICtgWQs9A4OJNbWXr8uNqyUsGXLHh+3DMx13HnQ8JVk058 E9dS9hIqdfXP/djzUU8k4DLFSQTq99DQX5n5f2m6GqQKZW5kc3RyZWFtCmVuZG9iagozOCAw IG9iago4NTI4CmVuZG9iagozNiAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDMgMCBS IC9SZXNvdXJjZXMgMzkgMCBSIC9Db250ZW50cyAzNyAwIFIgL01lZGlhQm94ClswIDAgNjEy IDc5Ml0gPj4KZW5kb2JqCjM5IDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBdIC9D b2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4gL0ZvbnQgPDwgL1RUNC4wIDIyIDAgUgovVFQ1 LjAgMjMgMCBSIC9UVDEuMCA4IDAgUiAvVFQyLjAgMTkgMCBSIC9UVDMuMSAyMSAwIFIgPj4g Pj4KZW5kb2JqCjQxIDAgb2JqCjw8IC9MZW5ndGggNDIgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVj b2RlID4+CnN0cmVhbQp4AdWdW3PcyJXn3+tTYJ5GHdGurgJQqCpHbEzIGs+u1jOe3m5FzIPt BzZFtejhRSYpt9vfcF53Y77P/v6ZeTITQF0AkEWx3Q4RyEokTl6Q53+u+Zfi/xR/KZYl/5/z 72qznm82xbpxf+4uiv8obopv3twvi/P7YjHf1tvFctvsuprdnxd1tZqv62VTLDf1nH9X6/mW y6JZ1PPVarstaPBDfOF6Na/rouZVPJFVmbXeWSz4j7b/wkuXm6pcLFTAf/FuvZyvqi2tr5t6 Xtb1pji/Ln7zjhqL5aKZvRNd7pHw59118c27d8v5olgW7z4Ur97ePFzc3Vw8fFW8+3Px23fQ Z0Oyk8JZd1Rc2wcpXC5Fy6bqUDg7TNevBhLEqI4dsuWynm9KzfOkEfvnu7MPD8V33/7u7UAS p4xZU8635ao7q0fGrBhI0JQxY6Guq1UzddC+u/h0e3/5cHv3c/H65uzq5/vL++Ls5n3x3cVf Pl/eXVxf3DzcF0XxLxc/3H0+o1K5WFZfzQYtSX1XIz+aeskXXrMAbQnM/EdzeEkOHd4J852+ 4hX7woq9yBH05eY7EVQ383rNVrVjhGbdzWToCPWmbDZin6vW82azaO9zRXef65FWz/nY+a8o fv/5+oeLu+L2Q/Hm9X1xeVM8fLwofry6/eHs6sRfdbmu4ASQvm714SXMcrmB863DsmuzjN5Q PssslzCNbdW0uNnxWWYLGb4H5ruGW4BHWO1mNd8222pVrKcR9/r+/vP15c2PLLizh+L25urn 4vzz3R1bX/Hd2++K6wu3LgfS39tk5tvFarMpazh/VW7r5XKTXR1k0GWzEXBZxn6F3dBDiN6g F92v/vbux7Oby7+fPVze3txPJf84jqiq5RxSy0jml94jq6qZL9Z8zbuWw3Hk5VbBGczr4+3V e5bF6UauXlbzRVV3F+74fWcvSp5lKPnwMtRia5qKWVxuNHrg4xIGA8eLmFZL+4NbD+6DBKWt VG8tpr1dqeKq3gKot8VmvgWsD4LWve/l+IJLPHC5nC+XTWA5s6HfxfDNaAJxaTOaRtzbb/9a f13wbyMc9s3tXfH6+9/Dl+9vP9+dX9wXP91+vnpfnJ0/FGf3xZuLu4fLD5fnZw9TMdmh3UnC 034Bp1ox34u15j+fBVaBBJze7tTjVmxKA7+sDioZwhIqFidcat0lrgskZy2ZayKP8p/EkdFq tuzlDZ/6tNF6/fnh4+3d5cPlxdCdPIxa2gGOf1h1Wc6bVQ3DaRPZGrXeRO4Ytb37US61+/2I r3YnW3TLawXQWC+28+VC4jtQcY14GPcj9XDXfmQP5PvRGnyw3fod7KAg3Vlsabvb/yWk/WhR 0pmqHMmnn2k/CsQF7rznM+2BiD++evP6j1997cD4xd8+XZw/XLwvbo5A9QIpMlZ+uC1+uJi6 Pw1YtFFmbI9+a9H2ujVo0fa2//l2s6i2pVjdBl63yC7YK5dVzd4Hx2y2yzmoCPVVWLLGD0+8 /gDB81W5bV7k+jPiRq6/s7vbz+gjYDYDuUVv0o4vITdxDVLWRBrR/p2QuHozr7dwjonEIVn/ r9ufLv56cfd1cfkB8eaiOLu6vy3OEQou31/c3Tucq79I3t/e3f5VhSf8XBfVvF6m3kzV8PRZ TGvi33zPN3pI8vr+TQ/b/CpxFr7d9WYh2hoUbKui3vBlFe27q+J7p5NNT0lZ0mtE671pGrDS YjmrN+gPhZBTGUI9CuntdlNMapCH1XK7QVRDesmIBtEkzVeQ57vp7kKnRzWycmPl+zi7Lta1 K5jQwfSkG7fUVKtr4zn5YZQWOXmDqWC1Amx47doeZtmHQs+i5phI3Nub9xefLvgHvcYfX337 9o9fgXVMrHj4CMsObP367Gc4dnF1dvfjxR3bx78ghNxdfLhAI3J+8esTbg3Gya2DU/eGp7KQ pOVAi+vV1rS/e5ZDH2QMXg6tvUtGreNMKwqazTTipF397u23vy1+/+ZN8RFhEkbb1nXMhGB2 juUEkLzcNCgFMIMZuSNByke0cuVqKps9yAoOirnlcjXfVCgXO3QfhpdfTyX0+LyXaLWaGkWN ETQSUMlU+e3b4hNf9OXfUCjcXfx4eY+t8eL918VfnXA5O25u7C2AQwN8eM+Nonq7P21dd/q0 Zt48OhQN9gg9PsCViepG0Jfehqq1mFFTTZ3xP3++P6EZuULoWG9X6Avb+9DhD2SQ/BUmL6kw Dq0ymeP1seILgOEei46MY/V8LZ1mhGheAKua1XxRNiJ5dzW9eIdmwao/u2JB+BER4IUKdoG4 kfuQ2I029e3UrfLYYtivsFmW23m5QnXZGdfDS/aEe3oSQKeNpfZ09vHPQLZgrroHt739IK3N /UXAdRj2Wdb3l9eXqvYBUHd2dXVKNBeMG6MGedC+0ENLx5aCm3BhD6mFV4t9+0JEXWbaUH0M GV/AtNHIS2mD05MTQF6YaWMicUIaKB2+dg4mP6GGkN31wmkW//Gn27v7h+L87P7iH4ufPoJG tDiFU2SEc0qKs7+eUIlYbbF+LbBhWdem8vwjagnvrzZMiVjjgrZ5dhVijbYdY95IdP48Kuwm EDfyo2ATvMSv5KebHZvLTvGmt78cB41pB59GIy4vU/ngAOKiCnEacU77f1Pok+XDvLq9/U95 S+ArERQGzmKO/sBY+ofbz6fjKwlvtpfqYeZ9d7rRTXtHe3QPE7RjLfb3jhYAfmKV5rrEo227 XUetZiwYqPHTFmGKTXwtvHrU6zkB1luv55zSlh6Gsk2u02zWG1SLI1rzKszYJykQkaJEp+/1 qKakxfQ99HrJsd3ThuWenGV9s6ZSxzJnjUMswmkAGsGZajOvNsgxz21nqhfzGjHrhTIJT9xY JnF5jTLE6zx/XVzOL4ZqGHrM4hgYPSCXrEtcaCRKtwf48E5ySrlkvZ5X6MEjQWFQDxO0Y2vb yWbZ3Ua7iGM/WcoWFgbI04N8P8ypHj/9qXzgEbO6ZVPcMmRG9CBsecJZxYebzxc3DyNo5Kci aXPqMB4HK0m/2ZrjwSLQSZFUSSzJYl2iYGoTd/iDGLqVTPggymqLgzDepW2C2trTvp2qP317 wcdwl50l2xcWRHYL40td9ZvwzIeCWB1cDYlZ2FvPq+kcO3wy1EN0CXq7Yo3KzxlHr4tuyQhI sFwy7mosmnOtpBxnzNVekD0qEBVvW6bOLtfo2ZldSyUmtHYfOyVj+ljiCdruYyiZ0sf0qOuj 3bb62Ne/2EJ6fo0rTs3NYjNoqz7hZpgskHLNk0vRi9QHTSPu97cP0v4gR16cnX+cPIqP4Myr jfyHYYShA2G6h9p3cwf7/o66E/P00OIAhhgtkO1hPsxzhg7nFJ4TLZAtggajsJ8uUe1d36Lv u7r8zwtMAB8u8fCSvs9raqJXwumUCDHQrDPzo8e0zzZ7M3xsfS61ChVS02hcMV6h+l0TjNQx WvU3x1C9vzd6NnvQOaZH5fF1mPYiwhY21TrEAA0GZs+kI5xG3O2N84w7jw71F1+jenZucwpF k2IatXUxdUUeWgOHzeMxNq1pdSx8bMfd7CfsUVo+BG4ms+vxtRFjgDpUtr6nITB056YZCEpI 9HhYosUAdejZs7P3KJPVQa4RwT1q4ObOA2MF2nqxmZeldDnt6R09cP2NqDdqtgj3udxrqTUL Aukb3P83UNXbidTkLru41e9vRR7JH9yKenQeX25pK1ogj9X1SL79TDuRp22kiuLD3e11cf35 6uHy09VF8QmFO+565qV3fcsEgJjYkNJGVQR/vZuLi/cX7+dTt6jjo54U3a1Rby3V5KgT8hgM xSGPYUgrBMqFzLQvERxPJE5Ol3LRu75VDL5sLw42RZspqFk/55EY+aK4Lz6d1Iub3cpFLlrv pgpK/W2rtxAOB12UFThpi2C0wiGyXBGPGJQOzxRzodwkbJzPqAu3bRwIsDNyqqspiDiyiC6j E4megCV6s3l8m1nWsKENsXtGZfisn2afmcCjl2Y+bRM0Tt7Bofr86hYUSTjUQDgxYez0NZQN futtUo9EFC8HEjRh7KLCtE3QEf3kCIVpniygWBwHhlFheogguNjRyND+ztUDMval7gNcuEQv luV6m/auruinJj943JsrQnc2OCSiRZ/ScrnFzFQQpEuwB0EarfuhJtbQEEmOXENObUnU22pG qOaoSBbe7htxmktHTbjHajIbqK501HhNp++W6GndX80GB+vwoPSeasg34+9Stxj9POdTTxMb qAmPSSHrqAn3dCsMMhI96xW3VXM3iyysj6P9QjiIoydsFxFHE8iP6l6Ek6KqtdH2RKOhu1fv azj+bSZycMFeLbAkeIKGSm3DcX2HOEfa0Cwjq2nECdCN0XPmJM6839jhDA77+X70dzXSR8pL nz7/UHy6vbyZ7EVuG+F4yCKbkjOJd0hvrdHnFDqWZhI3gvwaZU/YmfagR1pd3P7wZ6KoyeQg NSiwgNG9urz/eBGY8OxIprd8Xbj8d8cRVUVkdL3YrgqjeeT8v29nY2qhhScNEoqRDh1CR892 nzn3dsdja9J8hlcEgNY44gICl5slqd/i7q8md2hD7IHn38SbBYpj9DcvUgyeRpzS+f3aSbpv XufybXH5cH9x9YFAxh9+dj8HTYlPVqAg52tyH324uH/4Word0ylFoiVhFTo4VRLeqfnsrdrj H3tioqsliS7bmbqOZz8azkMn0JYE0Em0vfnuX53vuKb3x48YkH4gsomUcXcX57d377NtaeaT h+4c0t7+eWQjoK34xbvRT3dJ2mp1Z+9uNVNiz8n4qU9nJgYcjmE0r5VVi849LKuH+P746vaT coidXX1d/PD5wQ33NVoptI1//Cob9ZCydeeoT1gsMTCwTXVrdHu0nlByjHGBB+hJ7D7EKe6Y 7T5vGrAk21OdlF64HG8XGAvlf964HFwmmuxhTvZAnzt5dnZQxOgROmY7Qq2zxKgwdX/sD1tv TR3RFK4IbajIFraqaKsiCmhJGBh21+fSFDJFy3p0EJ9PkFm1EmR+9++9DJmn43Cku2XiSNmx mtaB02bkLZFcq4aEY0ZdQD+tbSJ9lvutEv31FVa7t4Pm6pedYswQ9YvW/tJlttIfn2ujfT9c 4THjk5cPmhqSgsHu2AyGNxIeo61F0FPEZpKeossAdys8atcf3y1plfL7URThAJ11y92JvnHd skasW/E+aZVOt9MRY1DFEKrRC/Gp+GcCgks6LcvIi5QLphH3rmX72rEfatcp3t/i039z+1C4 zCen2yLN22AVOjNavsb9JFnzWpDqSeXr6G3QIfQFrFF9qBuTVgZrU55JWplGnM9kDeN+Xdxf y72tNbHueINh33of+Wcc6CDyX1p6eDJ1uvEduTKfx+JXKigLLmZE+o3qy+mhk1zXmngGfaeO ryeEyCHjI/HKPpf0smB7+pqo5kscOs58iNHUlXAcb8fwyPZgHrEA7liaR/DQEI20W31Y5nEX WRFK33Mn8hJHz7Ex1u/LKIJkR87q6EkFx8cscsqaMPC1Bd2H6T6pymT6lx1VKYHmF/lhR1N+ e2Bb7Kb39exYizu3yZ4waoOZycrJReLwNmkW/jad/ns/vgD43qd+0EZztqEPpdmOImkvgNbY DpF7do7thI8ospppYyjvtS8wiJaV7FkG8RGTjZGcXOtN0aZzD0PqTfu90n+eXU0d3+M7qHHw aXOvXDU3aHLPMDQ9tHMHKzokQ8anO3lGoQxKfd0e4NFfU59r9j6lY6sgeoWQ9XVOhBkKq50B Ac4tSf5uVi2os5J+2jFLl3iPYLtYjZgq8miz4QRN4R4uHOs/PxfeKHmAHW3zwmSBehpxyAJe SJVX+dWZkmjjCJZWtpLvYmB3SnVsHDckPT4Ppy/ZeRSnE1+jWGidC2Bi9Op/Kl6SANmGE9GW LzTUpJ5G3P3FxU3boF785n9+yx4onYYdPEMqlQd3JM3ZD0gNlp6TfGmnWwUVOW9J9ylLtx/0 l7MKcAJROELuDXQclT2PboCtdAJtJDWeyoyPsY+utjbu83i0AS23m3URaB40vyfMQ7BELiwX G7JrTxpDpSG4/0zgaGu79CZKbaz3l39HAnc58IqH+Bn9wNf3HN+Q79KgId4h8DwBjNBs1xsx /jU+wQt5sOxMhtkTv2P952f8eKTWMsy9REV1PY24H+9uf9JG7uDt5dXPQw3UPdh4HIQnCaxN 6tOwcXDL2OC2xMYx6TQyvfodvEXQ08n/IxxMaxLTN23XmOOhlMMZSkc1Mcq9dBJpb4kR++hO hsKhEIOH4KVEJzDnVD5zfL3F1Ng7SD7Onu8Jqr2R/+Pnew+GpxI6nSGWW5TiSjTmOxA266FC 9Zk/kunv5rh5giN6K1KWcPyjEXjaz8fGcbz6jCPs5g0nvoVxHInTcvYtft1fB0/ADTXV5PPQ SBJdpOOY+UtwSk8Odn0hxU+qCCdfbhZEaSQktdu3JjbdZ5xexh5ncbb52KUaPBwznvZdTkLc SPOeI+fjG10KM5Wnnc8U35+VpxL2EttqUTtY7o+Ij1lRfkqith/uLs/dqZe/FtlT8tkf3/3k MVGSt4GF5Af5C2K9bMI5QlvHFKMTWnIAY7Zo96l5cOpxT/QXrbjYKY0tnG3Lh2YpjlugoKfB 3LEr7Fx/j0IpKNCi+zRf3bCccsNRwQRIl6w8k2i7nX4AyaHdRzFLQ8RMT/NItvrvOn9XLtsT D75/BOFoRjdrxOMW3U+zLifMfTKeTZp7HRv6BcYwWqVagzgUU5FEGHZzr4h3sq6ctfArgTFj 3LqP7+AlUkm1XI6b8BPKb9HRMizAqXCvD5c68gh7WzgabR/WS8oDwjIXOtW9B5c8d1hqvldI doqDcBWxVNWw9AGcx554fs6zRBG2MIXieNeIp+c8ZOTk/HmTj18Y62kRNxiWwXuk0I7nDF0T q+GSfCHyfbzgDOMQuDNVGWdLeDw8ji7D5DDuD/txeHx/xqkFA7fWzpc3RBMQo/Umkvfm9dA9 agpxeDhuqs226BDX5ZLPET7v5lEAstoqYTie/GWlrOOZTOc3qZ6KUw9USxSN+dbjjyyfIqkd ZzURoHN67Jz4g6myws6dZwK2SPRw4uMay4/nNYM/7ucBvdU04th5/uXz3eRg5eOzSc4C1Jmo ZSYSyPkmQcTu7o+35xgAQb/OMuz2GR/XOHWTPN4XYieI7mi2sS8vZ2ly7BleACYfDoWQLM2T rs5oRVOw8gT6ssxdzu+luMVYdVdwAM77exLPf/jCaQbbvQpS8HGeOMFROHCfSWkGO1S2uM9z GhTM8b9Dz5612qNMdv2pQOIQ/jksoJPRH+6HitOoHimhn53/5fMl50UOpHwCe4pOzEZhYE+t eR6iI9orCqVVd2wcY1bECkXwltPV97hj+VFFEor1uo5W+8CItZuDkfW2wjJxajDCaXNLtIUj 5//5dthA30hwEtN2Fj6ZYkyaKG22T6Uo/vqzM0ApOgiJ5OzHHzmezPllTeW1hxbSYX19Hc5E r1r9bcc/pNUeIosvB35+HZDvEMGRVDfRH8wIGoQJbgYSNGE/qC3doBH0BfcDN1lbELPi04kn HupWUWGU52A15XVe1Vs+7m0MPPYbw0H11oRBSxgf/9GlTkMd7VbxTEBqGn3Ox0eiOEbuoRLv hGF0Gi5Uc0XVJnM0L9opuzH1k70qKqIWKunmXopXRaVDMTYAi3HmxuGrrLOXDdGmRAvKROK+ fzh74HzsS+KddGSqFp07Nd0fZomW+v3lOWzDu1vg0GCMhHwZxYez8weeuf0wlaUcF99i+hnr 3qCteijonPC5pF2HVJSNdCyjd53T8ZFsMUwirmr7GirHrnYfhSzcXZzdkyIFb13nyUvJT84f 5xMJU7RoLv72iaxfgObThTBYKvEqjPzUpdAHzb11cCzTBoYVcuIWFYqSjc7jfuYD6qqSBObL xo5v2SOOJUhlWSGmm0uPf6lp7QXiRn4YKdOzDyTwOiK0BqxBvGZ0tNnEpTUduJbKQLFYwhtb fTqCXIe6FHd2+yHINZr0jKCRog0+xafbfcqG6NJ6ueyM1hH701BoMwFJxLMlbLSmIon+jtGb O1tk+yyOWkp1KaWE7Rldd2U1+eS5cKtSyUZKhGCfCze/H5W1pML24BtyyVh0NytrsliPSsbi G6mRA13S2NBo3RBAPSoXbo3zt3VL9LTux+TCdWYeNz6+GeXmzbvFdFrCKVlZ9qSGkZ1Nj4Vu hUZdt8L48DBoDr8Sy4Ubl0EuLnmtiF8IpxOXJGyWlnz2yNc5FElN+DoTklrUHHIRvfhagkdP pTiCoLGpsyNB5Vap9s1zq7fbH7X97ZOE2gRpvz+sN0kEETNZrzD8jRM8fnP3+fLPN3+/uLji UPoLWafBbvzvt3/7hH7zvnj9+UcZrZerr2Gvy8r9lv6Zym6PQ4WYaa4M/RrJxU4JYyoOZ0YL syyMtpEw5g/fnv14UWz+dDo2G0WiDoWt76aP/QYS9JgPuSR3sDv48gsL7OSxnRNLfoicND5T Ehn+AUC9LP7ESn//xMnry3ohJkKaMXeKJ4nGynIrFl5J2y5f/hH8Vo/yoLKoXc/gkYAPd+Ob yE7jPpx4G+spLrQ1J4SLGZL4C6I6RVDl0N8Kc+YavyeO925cGQtiRYyWPerKOq1dFR/BPX/w o9l1u9zHcJXNrSojv423oAg6KnZsXeUkUx1v7iu7X2NlqPlYKG++ZnMp7rxiQ6pgjWvlBFy6 rnaLeGi1YS5IgxyrFastQ7PeLinhROktrCMrgZlIVMuKlCpyjSmFpuKDNUGpq3KZNc5ccQAK 9hgjKhTQFG+fNyUsc22VrihjnUgYjWX1qiTAHrYBKveNZyWeBNeW1cJuBqVQlapZd1LjYWQy Emyszt1ElsVPPefZnbNYscg5nKEGeMXLKy5rZnW7memXasnaWQIamVKEMHeHPze65W1x7u+R C3Uvqt3vpZDuVr4LoSE+oHLmXsAFT5WgcJXxQFlz9KQ+C93qyyvi0/7O2tZT/KokpHo3i8zf G2WxIRHtXqALjYdWV/RG5Kp3oo0QQBpuZS/VeeTXWdmYWZmlhWHz1F/UWnZHV/B6lpamowCP x9YSDpTmi8Wovwpu9SKGs6S1HjdahmQ5JP4R0wIHUHACTt1Vu8TPULvAYksycv7n4ER2a42y trFOm/fEeuXqhT/vrotv3r0r5wu+anIS/6F49T3uMoSJFq/wu2Y1cvHJLj7aRfhp9gpLj68D 2HR1fxefij/R3p+Kd/+7+O07ZngEvQHqJHrdl0VijkVgSXyXnupX/5BY9lO+IB8W62BpPf4m 9DgUzF6tu79wmI4fnMourJH4CzoGX4XwFDd+K18wexXfY898+2/5OGokNR4c0KdNi9VS4jS6 rLAscagL9iS+XTjQBIxiq6Ymmp04qRxIrxXLV63d+gl//PpBKonr559ZAVXxihQzjVtDXLMC VnaNrwBL6tdfzdYuAXZ7ZeQCZBInaw7WYsfa0s8uTYtNiUfKbBdN7ONhdXiPlHu097c392ml mNjYV1nY13YQvDBfvS2qGJr6VZsirNapOrQlJ/ACB7NTYbSU8xFhpditJn2z0BfikQsj5CAP Ar5YamX3I/CLtlcZVTksh8Y5x7FSyng4Tq8M/oEaYskxOJwxQGyMGArCOsf9CNL4B9n4dz04 Gr9sWdEr5pfcx9rh1D+VOIcVVwJO2XIKOSWpz5Q4XGNPqU7rKajbB2cAjyT9E6tNYCIU5czA qtnWP0PJDabQCU4Rp8ADcQsUJ01lJBcq+T5zOCOsqCMLjdPM+HDntdzdIgVWkMMZK8vhjJUZ m5w5NKnGrQR86SnIeakRmnMo647BGToYhiExTisZB2cMYqw9OgmYpvRHyW+1mBIeCXU8XqlY 5ELmAjd8OQXfvS6p7lvSk7oX2OWbis1UiAgsHpWAo+JdADh276BKQDlW5sGLNeiQTHxbQDoi JICcMhBoGGcW+xSQVOjNILQjjJ1NGt/ZelEjT6SyIbMGotg3a4LZES4PWOE0tW+FtxB76Ull UBKpqcxHERqPYb269E5PCncqRFqAoZesE3qQDulRaKfI0Q7aTtjYU6AdT+7pwM7A9ndhnYhb DOsE3DJ7VRtu6fxSvIrPGG6JVQ3iRGQTfpnpIAw3nIcgDraAFY4ruxBOVBa6w7EcOuHj6XLP xDxt9cEk4tnlEECQ51rurS0wEZbMBIBTdADOgdNDEsBpkdQiJKlhiqU7PQSY9e7PHlTvRzJS kHOAN7heUPmEahj5NIkfJzVMjcv+YCSjr9UhmZrUUx7JzNZKcmi3PSCD3mSLLEpWBHyo4Arx gqmP+xr6FaL4G4jqFokDR8kuVMvYNHygkeI/MW5MASQE5MyKVNZsiZhYArcybt7oDMPNJlNO NKSJ2zTwJSPBCpxCISgnrMztmkE5EcviPhobz0o8Ca4tU04EUls7sHXI2LnTPWls2KVNQWKj ldj5GFWTZ661JHK7FAg0Xl7xi2fPnDyDkkLcWMxaUYPizUFJoZRD7j4w83rjlRSweq/tIHsh hxnxP/+WeBe4ebzPdBaxzDHw2KK/s/cFdh7pCTy9MmqNqRfqiOPnunCsnHDUg4qLNivHNwPB TMg6zuI6zhhaiTiLYQkOmDEhTGPltpavZsfXN6s0glUjIVvf60Aq05jIMvI7mouGhtARZZoL UJhzSQs7UNChokPWf2F/Pqa5IDoT5eFOXs5+KOtSzrZGaC5avJzZK2dPwssDvadj5kNfkA+L cdfImTs8+wtwc62WbYOEE9k5+9MWfVdpDEvLZSQ7RwWps0E87hM7H8LM39w6fcQ1eAZFRfgD awXcocBaOt1F7TQVaDP+4PQY4Jfl7FXjfsV4hWYDZNNh9gfQx8rNoVTNnuCwWCB4QcaBLv4I bH9lygwUdN+iWoEkT+SZIxWtBgRzth3/Mt38is4O4u+cKoYucv1X9y++4vyKEoYS34Kvj4qG chR8odyBMkp+cCX5W3wL/o3+2Q/ZW/wbKY+KnUO4x2s9GyIhU7I3vsaFbCI7RkIffD4SD1JI Mm2XUPMrdZ0e6W+4fbjUfDIzkK/ih/DzvPhqFsk7MFM15iRAyaroENjCZQEgRrJ2nerW1zDZ Mu/istmTHC7k0JTTMM1WaBeC5kT4CkS2wmzrENZI8xj8JDaFzn4Bywn3PWx2xEgmDzFMXbNm zanXlVQtZSgqrAjuC+HrFXabZk2aphUh+pQp2nIFP8irdRqbYCPjgCKNi073BFcAFuleXsKb l9jGVCd1mRLhW3vK1ek8NdujY2oAnisphhIsjUUZLI1lxqRnWAKAkuxxVlI04GO5V2ZcG37p 01rlqBSUw0pIqHTWyANNiboMOMSCTMcUyzIdUywzSMA0hsathOkJJGQqDKM0wxKxOwZx6GAY mQhKY0kCpV3BrqcWZfl7HRPTaWhUlxka1a3Dn+RayNDoigXm0GdAozqGW/cOyArCuzRxbNMR jXLeWIZG411Ao/E+odFZLHP4M7bo78L7mE9/b/QENBqpNTQ6U0ccGtXFeMUS2TmwFGgpJuQ5 ZKZYePtnip3C24ZjpUOrmqbcql7vWNXJshYJzdePEd/FopjcKyU2f0q1UoOnxGYRY5BbeqXA pHPQNQKLnsaKZvSeDIsOfkE+LAADp+mJOiDDoqHgqa1oFZzfvdBefEDFpH2MvTVCUnSitbOm S4KZ3Xj3FR12M1jD1OCWRlaKHJMuvrQNrUPTLiyTLGc7PI6/IJZp0HjLGTYAmTUOu+x62tfl OzCELXgd01qHTG23azi9dEx2G9rJnH2G6JgaYEMjxVDGzEMRDUYZ3Kplmxw2NMeATQRvUKEp /15LxYTOXWa1nJczCoum4ows0181nGJKftBkL7KClobJKuW83MoS57bGsxJHQa5gMkKhKlUL vTFWXsQOJ1ZuI5VY+Wj9UoPPimPQXsk0i/cZb49ljsE32LuSTwzj5tl1YPBrTORe0zRbkygR bpzx9g1Zyd3LnD4r3gXeHu8Tby+sDH9vnGBii/6OVwW2HqkIbD3SaGy9iH0Qb0+9nMDgV/Bp OZIkdRPYzy+0ifMnsOkZPC35xa/1GVejlSWQumelV2oprP5ZY4TmiyqVtexGWt+bLUbayOBZ tiXnWkp90AqiHKNtash/glj+C7EbeWpPx93dYBxt/kvy9mhYGsLb+e5z6xHuaHzZ+BBO5+0r LA4WSS2dhdRNOx1RctvRYHXTrKVuKuRchGbmMeqmxhOcqZuaapeSRf5gUZuBuun/oj76Fe/+ iT8ohOTWxR1jXs1eveEG/ctr/xNqF375f+5f/e50TqrsfwBMUOR/kGKGxlDM8DOnMKiWv/nR t4+qhiL0VOFlg/Q1QZ2El9CWVMdZT7dDOvpG3fDUQto/OYUY1DIRb7+aoeVDRca//+3+pUfU 8b8yIiiXvB7R1/Hl566/KOui7xM9ZNBQkVHi62hQeSV6LJrQz/Ya/zOHycWmP7vr/OH7r2YQ 4V+ZP8vY0Y6GmKb9jacxUjdmNHGeIB9hFkC5RznXXTemfJP3IORcXQbtG1RLGcdqGEQFh3qX C1RwgYywPe+CrXHRamynm0Znb77ncw5ZMbma5uSVqeCWShKW41bvliRQNxK3ogkT4AVqivmt w21oJ8Oth/VvS4a0KWmgwW0QTZqga6+MRpfEKOBmjbZNPiRbRF+VEV6D2dUedUXd5sar4Lb4 ka2KNTxH45TdoXjZkhKF31JnNyhhHO739VUjPW2OXbli9ahkoJ1CGI33PHayXFMKJogEM7gL 3I7ivZ/1coGKbInLehxJSOiW0XuUdtLcMVlpEuTIXbuJCRPILPSepSx3thsUnbegvTQNROyn W6YeVW02EdC2XJC32+rrtlV/j/Jzxerj+MLMwW4WizIUGcsMIKK3JncJauCswPl9yQhrZbOV zMlIQpm8tGJVrTe5vLTC4Xvh1KhBTxULku5zFssyeSmWRbEnNp6VeAqS6pP+BUIzaGu9ifJS 7HCUl2JJlJd6ppRdqk9vF18unFepk1zcdSYg6d67zi1xeUk+dVr7DKYTm/DuNMmIb8KJRplH 3bJEvPFtc4Vs6FSQrjSThty9k31iC+EuiULunUEMMmqQnoIfnqPct63+jBZ/WA9YDPCfz8Qf FtKU6UirNIo/tBTW8qiFa+shF3+wIwRC8zWSylrij5ahy6cRxR/86NRL81s2VjBG+sGswkdh qqqWevMlus0FcgPGS+S67+kJYgSGtr9LAKpAPE7paMrNp3Wbw/Ks5ge5zWl/qmr0+7u1mniG jTe0rxo54JigLMnni/vNtUlqgcOe31wGDrvAIHMRVO7yim3qQMvhs0ja0v9KsPNQy5gWUe+0 W4Y9L3wsQ9v9MKde8TmvlNwjgtv9b9GR72QojG8J38nekXFtZ9k4DrSMBm6BnczoH9QyYD8H 5GhqiLaTgzuxBWij5AylshURB2zZoUybqsIRAD+xjJxSwCEFDaJTwjdLWtBYovzFSuUey2gL 7FgzDGor1mP5ysM/a10pgKQ+9STQuC+gJZRZ23JR0ZIvoiHoqxZLLY3wGLEP2w0RjW6tuJZT SXi/WvK1HE2OTjUVn7TepMbDKBgFVA4l4oLy6WQNMRdaSXRNoRfQipxm/lbfXtydX3x6+Hx2 VdxdDtOOf/P9R1yzPqJM3+9RGtvHQad4ElFJK6gi8bBD34yIRADuZYFfLt29sAvgs2L5hhLs r4rw4MiGpRYQv+ueSEgM9FKzxt+x2nkcE+qjbiQWLm9PJl3uw/vcHc87sEt77p73L/hdLwol LABBX+5Ce3bv3qfnw++OHj2ve9ozelN7rof+fdY7wznGxwdYnDh4AWdm9LxahGSCy+V11jrO NKWPDwx/vCc86S1Qs2hfmc/nxR+WWSx+JkANg51BgAJpe+ks2Wkyeded3JG2WXVsJ4Z1vsBR ZEKEwvWjI0KxZW4HGWhwgAdQ+j0m2KWtSNuCD1CeNVZmskTRELXARpc5ATfEqFTuOOoocdAA qkT8KGjKVNkrmYr93uQbpxJ9liHQLOOxIEkcqVKSOJzPjXswyRfWeFbiKUgSB6QHQhOanMXu RJEjdjmKHLEkihyDo839V4yguyECLDPRpPtMAol1nKyxwfsnmWhwjNHzW6QKL4kQ+MLohmt9 Xy6SJ3gDIyGQRcnFR+vKJBFdJ0lk5mp52WMRWgh3tB2MMvZe9xziTaQqSiNGNfIJgdF2x/MD gpdbPsCy90AHSzLzuuhPWVqBA6aM4bLFFWcxLW/UB+ErsFWaGs9K/KpRU2EtUyuQmlZSXtaW S1jljfagKJegciZbSrNsMQ1M6GMEk0ZmXiw+XvM3S1Bfm8ejAnpO5HgR6A3AKNH7VKKJDcjR F3wB2STEQA+TTfgSBeWiaIKL3XpVV1tzjhwvmjSEAhIHmssmPc3/joiewVYZGQNyJ+CNs1I8 yioTKA6Tqe+FPAA7fF+76vX/wGYANVgI+BeZZutMM1zffiXbEap+Snw5tgGcYDFZ8O9/ZvV9 Hd8OynnvwsxTmDJCCzNZJrj2v2J72Lg2BynugzEGrSrxk6ONMd+9dVaS73JDSzSWyM3Z2zW8 RcObT3xJbiDp/+oNKgwLndJTs2B0wTk6tul/9S/G2RlbTTCl+Btv0PH2lvxlWLFowltpwgM4 T8dWfVXfKoIW7/fv8W/25YhJvvxPszxfggV9OxgYQ8DFtFkqcEMsm7mP0QL1R3cBdb2Usev9 GVJlmOHVshMxVvwLTd5mJBPN33wF/8sdPVbhJ8w3PCWjoKw6rn74yVdklGgCg5N+lzWPP75Z /MT1prvw7DUt+e5S+B2/MdJvv+UvRq3f+j//HYjj+SFrboXlD/d6eRL6QUlflVRb3UEJ3CPa jRiU93QFaugJVPtrDIGU4DJOCYuSIYAarv/ymQXHL5AYn6Dv/EK+32H0xilEaCGQLKMWr6YB 1P7EEuZ90OHtgH5RuxJZBvPVSY+yX1XfLzn/LPTyK/PDFNAHrpk42mGJRIOlr+mf8vUZn/iW vB3/Xl+C9Y92rERU5e9llfCrp8235q89DXwari/J1MrKoUR0Og4zZE3YGBNHRrxedtA3AKw3 xjs+k399zVJk0mXqZp5/7+9YCHQllDEajBv0U40eUYvcvvzry8PzPkiCgeA5uscDu5piZ+AX /6B/gu2cpvxzvpyB5UV8nJT7l2q7oYixpsjvT77SfNg6xBnfG6NWYZTCStylLopfi6jMlTqH 1RGZONnPAzbZyio6g9xJ7iPZCaPUuVFKQLD8UBMrwfpY7Tb4gDrbIq6BfIPx1rcT5fGD5uH7 8xnJSsAheIcIPm8RJpBgu0UYzHBvKskSRi02AJxNIXep1PIbzIL+QVnZ+g/mhj3GLucPO6Vp /Ja94XhD66F7VlbEsiu6LKVG1mlSEanAnrrCwa3bkhlcI6Q3KWTFU9umJXfHokwwsbLk6q3V WBLcm4SQFYluiMlwqj0TTLTXu9ycSfAuVkqfJF9Mk+opIdoyi3Kw+1zsDlWS1B2fMhF7Zg0n f8f4+kzqjmRmslLsjIlwGBbDuESpO5Ykqburf901rT7GAc1IDLl115mY7e694KwIm5g8Q9+K U5IR0rAsEbVNvOYkvI54XZWLIF7rysRrXSfxGgTPvReoQwveAVJtm3jt3mmGPqMmitaO0mBE pD89kRplT98PI8+QQTo9n188+TkWh+YDwRtNo3LAxdHfNR+9xfwkKzeQmi+TQD4z0RapWZz4 JyuhGhtTlhAsl5GKkRL1iphm7Rlhl08S6mMk6plsUh73tRzunyBFxl56n0qiHvyCXRJ1CfNt WftCwVOHMtT2Hviue9+BUAbtV+XaRWOjG5QOEzz8yIRgKzToYOtctv7iwQx9mkYnBHtZIIaw pRzEMHWeXw/EMQ4PCcdsMTfA6JVYbFmj8o/3I4CMEoKV6O43C7kfoacg1ZwL1uyVsa3jnrVG dUE9Ql4Uhq0yIDeZOexR9rZ+c20vpSFghsPQ2blnOOilHjrPpFgCZiIbHuOY9ZoSQZlWndZT ULfPY4m0TgvlIE0RHisrytmBlZnuFNQgqx6wxUoAFpUiilvxmrjYcXgUWtMcyDDvKE4RZM08 sSKvQ7llgCNHsoIcylhZjmWsLIEZa9xKikhCDmaM1JxLWYeMedLFMDaJeVrJJDCDqohh9vp8 XedgRvcezCg9VwIzfDMRzHA8WAQztRL6t2wFrJzQtq4MzOhawMR8jnTvwUxoIYAZ2o5gRu/U M0B71JchNWpsQZR6MKOrCWBGudA4tIShSHN0YD4yMGOjv2s+4tKxSjtWbwbDbbKPrN5Aar5M Avk9MMNS3ChO6UnBDMCodIl5rovfvCOrsIvOC3+mmgdOCWb20ftkYGboC34xYAZeVvlon6cD M0jcpDJmE3CrxjsxfeHspkrV0KbpFw5m8KnJwcxyEZw5xqlkeMwrdmrCAMLNCBQjwyv+Mfjw 4FokHyBSirGvhiLYaShCt0Gg40LmJ0X9L8lzwA7P1YJc461q3cbGQ5haYjZ9wTyKxmrWumUf RceS9bRySplQmV/zZ7uYJUbeK6McuC93eohF2a4fy+IeX9PjNSg/8QGXx23j/apM+VKjXCOr ViuPaa2oe840YKzAnrgtFZx5o0wUiSh/D0OM3ClUYaQNUthTifPFho0XzuLrM7wSycwYkXUm a9zGxSiYxSEYh1cCjiBgNOIVrh32MM8E/ebxilI+JLwiVzPzbSDXAn0PtZR9P8Mrs+WaFe+x kK4Mr+g6xyu690ikCS2EO9rWMzhoL/VOwytGTUI8otTjFV318Mou9WwrGXutIJ3GrTabIzL3 8dVq2QyaDxAMKmil6c/mw/BKLHqSlRtIzcky8jvKlxqfKhIH95Uvj3FnqOUkQZT3L8Wdwejt KYueCq8MfsEvBa9o2Wy1lKNjA0sOvoKNthOd7Ay6lgsv1+Innb6+C2QIpUVcSaHzgvBKn6Zf OF6pcZ3MLEiPxSvotLd7AcsAz8XZagkiQXeX6R1CSbYRWqXIwVdoamCZ8gxgGemkFR1pV+Ej kPt14RQ9J46kzcF5AOFXntHGwbnAME2Bd5zEz8Ddn+f7tS/KOXiolXiBNZyVhNerpZDx0sjM OUbsTIQH1t/IMKzgnHRbHH7JmSqjs0pgWlpENs51i43rN8+gax1MaAnISUcqd0P/C9E7UB2u 5fLbYuNMRGDjujI2ruucjeveM245h6qFcEfbxsb1TmPjRk1i46LUs3FdjWfjChpYuLRk0+Yk LYo4J3HlWMmolcsX4FcunWF4wmoOVGYM3Ajv8m8y75ayQEZ9Q8hJWj2Gga+INkUVFDwJXr4/ otF7MgY++AW7GHhlVo1vglXjaWOlxvgj1krUrONUIt/2SUkf45CIDn6+lAo48e19TieT0kTI VSd3SNw6F5DHOCQaxWG5KC6pXvVo3uE69Ra7FO4nOPDwL45J8kjB0YUb5XfgBtdD/fHVvudG jkG+hnMuo6YcWeiRr4Jvizxu8KjRY0oF4Z6WO0x4V3hLqIi7kGrg+aLHWm1wM8JXSPmiSxT+ 2RAM8x77gXfzaobAezV57yVK7iwzKyXqIz5At+99Zdx1KIRA/sXjhw7c4uzjeppa+cgw8Tuu UzQ2H5a9lAAEwoFIS2LdCWuw5dTTdXgSIcedesz43HXqmb156tQJBEq1IBmCLPcDrWHqsPPq IWgIjkqagwbXSH8T2hjq0WMsRIFneCmvN8qZ4E3ysYgmcXggvEjYC1UHfyX9Er4B/HdBbO5J FXWeBG+MdelppGWgL8FemN/SmpIKOD+f2FnlTgsl7hHVyVroKpKMb8/cSb06iyaB0FiU8fJY Ftk0If7zjTSsVkJTcsHDGSdj5jUqMPQRGierV/C2eb1ZJuMXJQ2e4fII8jh0FgtyVZJVypGo lUVAExu3EkBLICFXJhmpGciIHYpQNHbasGgarUnKJM5OiiiU6xYK1W8eX+pIn4RC+UAYz/AL mNFQ6EY5MVoodIM04pVJujIUquschere405rwd/hGuaekTJJ7zQUatQkFCpKPQrV1XgUWuMf hTm0ZfyKS2fQfCQcGmcoBcfEokGrN1OD2pJord5Aak6Wkd8Fo3x22MX7xq/HYFFOOp6vSXXk t/aXj0WN3pNh0cEv+AJYlGAROQoNio2pWS0b4pETFmVPNAeeiefdSGAk8X6ORb944H6fpl1R 8AGlpEj7N6+L84u7h8sPl+dnDxdjMMusi1mKJ8EsWtDaKMWTyW7Twiy4gIzCLN4TmZBGb/Yi FzmN+rue3WuIGqkmLXnTsgT5gnwD9CUZC8bSqrORshJiWoEyLR0S/cXJp8W7sV2BSbLkpLAq Vq5i/U2HFApoyfgmJq9QKefdVmac2hnGXONZiaPANRW0SDVuaiIUqlI1ThF23Ums23c4EeDv H6ND2pQ+cF1H9XLd4t76zfPojXBY1CGxVIx7k+MphrmS8Kwd5jojy04Ic3VXgXu764x7u3vH r2ML4c7pg3Q90/KM3NuoSdxblHrurasJ3FuHxIFisrEfPh8Z4w7zkVaNLxizZkGJ4dU5y3b0 5WsjFLTcbrUet2vE9qg5wtucbxBXaUuvoPQHI/1u8d9FIkMf5ZQBvwBuHeg9Hbce+oJd3Pq5 /G6DCsnJ6LBvzl/5t1yboEwZ2lbcQby1ctUh80QNElHXG7kOTk4zKkdGsgqHNYMl9mR5RtHE oVxYuH8fpUAKFGfak4EKpP9uqX+C3kfBgmAmr1aC00MjiTWl4XG/RJ0RupOs8M7XD5oh4jCl GVKw4qytH1JIqY95o8GW6opXjVEZIZSxX+QqIzTEA0L47Agbaa2k9BHF/A1RlkR0OS0Zf0KH 0QKFKhoFakoHJgVSKJWajFuNDX/c8wxeaD38WIRnQinqJrUe7ubFa+59BKCaCO1eajqIBfy6 eOurF0a5/8Wr90TI5cPIoUPHv+HEkLReyDQ4ZOiuIY25Q62IOg3quUZB5sLndLj0NWPAD/SO zvifIcwHQlPJl9Ar6vjH8josBWqqBQfXU3MMYXwb64kffKMsMco9RXlzvr6vQygfdfwrfQnz QwlRlvzrW6B8zLIDbpF6iAx85sY2MM71063XKN7QUSYNisNbdyRoyYzReHkvsBo6JKb37lIp JtUwmlqllqFL01WKLXi+MwpoyJHbThPo4Xm5QM0vXaA0g4LrUnhPUClyGKQDOhvURy5dCQ2p pAfRjyRjlbPAUrn7MWtxLCC+aXjrdMtQGSq5E9o86uFtrNxZKkMt5lJi2rMq6zwLDh2rW4SM oCuUA5XQnJXMlr5EjnGmYbRuE+5I3axCu5GuhjF5hZHhFO98OeUlESEU5XDPqkWRpGLiyPhu 97OKXE2c1iV9mJVxKPgK17+WepEjuXHn32YiSkUiiooESvb+WSzIRJRYlokosSyi3di4ldCW pyDTLkZCMxgaOpMEFOtuElFCCcKOGbqHRAl6nR+SgRRqTv/nrpNjvWSLcBhnyQl0STrRlxKl kyVCaNAtllp3uW6Rc7kQFdX2zF2ZdKLSXDrRvZdHrIVwR9vewk0aW97pdYvQFaiJ0omj1Ekn 7mqQdIJ7DWJFEA450p790q21rCwsmwGzkQkoNj+ZZtGKHr9qjcwWSYH0jl5Ra5AI40xUwev2 sclASXKFL6dpilo+9UEXkyPyEWcdtQIE2c4BME8QIBjIPZmcMrT9fFDgeq57zyWmNMAy90J7 8QExpVKYvyKso5zyeA81VPYEs1v+2BfhUN8j6Zftn8aJiF4jaMhlFSx5I/3pV0E/6fzp/c1I 0BKc53X4HDmD0bUlf/pYlPnT16SP5rQwKQphhs6fPq8W/OmzorGAJfjEK7oOtGL+9P6WLdT7 01tPgz99/NX709utjwEMSuLZong/LHOmGBnv3j9FO3A1n6v5fDI26w0uW2avtinS8VS4j6hp P0WATFKsIWfG0VKApy/D0B+mAxiIDRV/URxH09jLVlyT7r9dr9veeLi4lrISMsPot27JKYHi Tr+GTqzdOZqhMr/mzxpEfCmjv1XcvRGuj4yTuICqOIbEkWb0Q1lrVPlAFgx1a/RZ+pyh0B79 XnvjR58UG/not245GmHVGv0tS2W1QIUUJ6BTPwuBlYe/AXIO8uZ8JTqUMHosytBOLEv4G9d6 wmCzcBKsCrjPyQqVoXR8BSp5utKWufnpIPblFs1RdEatcOLgVMcoOIR7GooY2YqEm5BGlN7B ihLes4atZAbS8a/PMbqRmUOw0JmscRsXowC4H0ZqEkrHcBBROte5DaHUb86GgFtxlstDW05E 6QRhMIa+Vhm8SO2oUpmVgh+quzKUrtIcpeve43JrIdwlP1T3To/SdSavpyahdFHqUbquBqH0 VjhJRXTRQo4imRkhLptB85FwejYfvcX8FCvXSG2RFcjvInW+1AXCUzIqPAVS17kopOn5pdgU qkDv6bD60Bf8YsC6Nng54WdgPboCtA67Gx5OUhFSia0irBpnVfjiuTz6ND0Crnc1IwlqrbD3 rTdrfKHCGISV2HKLDDrM5HDwX0mHeaBpvO7Q5Ynn+OHN1LJshHusAekldz+e3Vz+/ezh8hYd salMD7wOg3qJSbL7usM96WhjYyr+CsXhQnpFsXh4p1LxxzLtlLxMbDuWxYT6BH3ihIS1OCsh gLaWi3wsc0x223hVHPDIJfHXOFVKzZ21zmfpzi2wXPzCAa6EttCBumT8sQy6eLnLxh/LYlL9 1Dr83SXoF6N3NKgtXwZdgVa1FetZj1LrYXSMhjQO4m8nS8dfftF0/LhveiV3SI8f7oUwcGNQ Ov5QEtLtlyVwM0vHXxIFBziVf6JLv8+94KjTPQq1lsoH00rHTz5g/RDf5+543qfjD7/yvKXP t/o+3X5qz+7d+/S8C0UP9Oh53YOIjN7UnutxSMcfemcIJjoLHz8AOqbj1yIsM9uWcumwEQxI xl8+QTL+siLlhhT4pjJoXEI/L0v+Bf2bCaBiHQfk0QaMp2ZIroqFwd34NuJBeTtNM0gQbIfE lGEpArljVEBBhMjUK0NgxazBGcaIR0Q6ckyCsC/bjTL3l+lZlXXbGycyaUteEdeBSEqq8tCp 7JZdwJ0mF3u5ckqXUJlfs2edacXJhVilOThDu52Pk8NThNMYnGKkV0QbiH0IDESHWzWTemYV 3qMc1Jm8pqkDdcoAR+tRNsKfyQXq0VYqw4gBao6tz3BEJwIb/6xIghXkEpOV5SKTlSUJic/X NW4lBYcKeRJymclIzcGwdcgEMroYxsZkpjQM42Qmn/+QlS1BwVs2dO12F2+gcL95aaiS2cz8 rvRZuF2JYS0x2Tg5y13LJJh5TUsQCimD3JXJTCrNZSbdeylJqmJa8CmD1DbvCb/wTpOZjJok M4lyLzPpynaco59Xmg/scWSC1OeVlYWls2M+kJAg1AnIh+YjLh2rtGP1Jh/pgavXSG2R5cln JlqOWGwJ+F1hn4qOWEFmshAU25P1AbpPUHiJ0x/ARSAjh4jTrVackkhhDlpxjEdPBlH1F5gy aC+9bg6f4LCzwS/4xchMLBt37N9TykwuubhyapivBdkQv3DKoKpNUwv595ym50mo2H+8k31X XTfpJw/tIiOCxxQGTTZkJTM1d1foOQBNNvLfVDQWx3GhjA3enOLKtjXETZSdYWcSWdKHzcn2 DEZBV72t0K4DmLpl2rtxMFgLwNUwv9XKR8FIv67Eh/asq9dtbxxG0QqjOw6VbDipXMirdS9s pEMgATHWYe5VEYWb/uj3/PmOZp1tboBdQ9ujWBft9ScLbfaYyQo+7RtJdfTGnGakPVdJMG6Y 70rNUkBikC40+rNYmfpuvjBgIMWFiedHXxir58qCL0xWlpuWhuBf83yBUpdQPPnCWEnyhcG3 OvQm+MJYDvJuIzYdkWlFNotDrM5yuE5K7lCS891QlKCfVBoN+CUrwSFVmfYSaJxVSoCJOYiB SfUUS1bWSnllkBT+ul4obM+grBUk0AjwCpVy0GhlCX5Y41lJICGBRlBqIDVHA9ahBFJCnxNm DAUZZBwynR4mYn9gaaXrHDLqN0FGEJySr0bIyHYVIWMNzNYzgoyrBVJECzKuyLXk29aVh4yz Utc5ZNS9B4bWgr9T2wYZ9U6DjEaNQUbRF9I9uKseZNy322WzARAXYsz8Yx45GSdZtp7KfHko yhbCu1iR+SpdzmMWtRKqsiIdCPAu+zPjB/GrGwIVYVLrhRB5P7vki/SECfT2oO2TQcWhL/jF QEVWDVHyssrE7JKPzdZUKdm+pPiXBBV7NA1Sr599fvh4e3d5j3P0AI20jj5bSiMdXhaWYQuX TtStK6FzrTCqdtPKTzFEt+678fdh3ZDFhRMouu863I29inWSzixLn8VJugHp1UORmLqp1UNR 0qEzloRgS59j2nKgHeeNOqYeymgJZ1aSU7MXZvVQ1mxAEVnjDJM8P0yzT89CiTThplW3MtqK em8rS7pxxt+3HrXlRoPaMq260aq2TKsee5Ra90NjJECWLxAzO5lOvfqyOvUar1ZhYNNx+3vB CdOp+xLTmeMz0tKp11sh/KRTr50bu4MwEqgAJBhVsL2k9tDa8oO9z98lnbq/5/moAw/1g848 thfu/fuSTt3To+fht+jUI72xvdAfp8MH87j+G1wxpjzAdpl06izBshUxMlyrXj2FVt3cs0x0 xaWYAR6tVd866wYKO2EVfzNYq86xx86VC+5VrdkTkJRwP26XIRUtmPk1KmCMbDKBSasur/n1 hpLwpGr1n8zlJJDkQTuBdnklT0L83CLCaXG3boFuSgaa+uiXQKisX9OzENhywRsmqorRmqja npwZA5tNzrGuuIZ0gEKYD8Q9di2nS/Ql0Oc0/mxq+NOhMrBhlKjaLZNYyv7svL7CBLBKlMMG R6wSP8U0BTueHTsFG2WVkdYzzkK3BFGV3mQTsdEna/X5NbTAoLl5tLmIiDkJhUovzDx3CsSF oiCpKpluGMOJy/6ShE8SFK1kJElCqjYR5X5pCakcIqTwjC3CRWhbihgS2iQhNRYkIdVpa1wl SQ70WhjP6iWJxxrPtOZGQhJStZd6UnMpJHQo06RjbGNUkozq7zMR9djy05cUREegTn7t9vdg 1cAcRC0nfMIykojKynd8Qb80HCeoZ9w1zLgtojac/+Tfoyuzaug6F1F174XSxrcQrBq07Z7B 06HUO01EXQVqTETlVyj1Vg1d2Z4fFXL7jIZJREW4RmGf2zQeNxPH1mtUjaDjGLZeHYH5svAk d2RTqROJvO+ZMR4TTq6jtkhoFWTTlx9ObvSeTjYNA3L0Bbtk08riJ745SSJCEvMpPGNQ8hct Fnf8xy6RdGLyl0pIQDrCXCTtuSQFlUaeivCfEZmIECXW1YfRck3MqA+g5Zr4VmJ4fm2RsDF2 ddZV4ScMoXTefF2IVz2adolyPTvGu495xpf97xFw3SxISG/vCevisBg3zNOLgMut3JQ6TQ+V Rm+ufi5ub4YJo9KFOn+1MFqDepEJowcGKPqrtZse2ovX3/9+2HvwAahlI5k4Wtef7x+KH/JJ l/3KPNdmMqaXeFs4OOIlbN4UyoRITMS2siQps0K2Xv3tZWzaIuEsfA1IEsVuipDfpW7Myvia 0O/EtgUjcISWJ1uQ8WNJkrCBH6GWpOLgtxbLkpys2VDjQXB2RDkKkoBNBz2hasnk69gbazuO ggnYaawOS9hmBfzm24u784tPD5/Proq7y+OhMFqb33z/sT4mYcf2lUVldwKmDBsMjfBGwnXG KnQsTgiJEq/uHRoyCdvXMAkbbJRJ2GAnvu5cwm6k4mf6rX4DrkPClv9J8IJrHKy29/k7k7Bp z/0qCbn07nGhxLzSYntBwvbvSxK2p0fPO7iOz2egN7YX+hMkbHfnwoRbZlDnDYGT0oENAdRf rYEp+lAJEgwKTKZiMVzCrndL2L3X9my6WjwmxDVK2MkHHSRsjsWRABkk7GMoGh7n7Y08JtkP 0Uxn4IW7johNY7uNwuGUu1m1ZitBIBI1dvJdLAP64m/uTr5jB5pvKmfkCQfftWr5c/RSa5Kt PoxKVe4PvqMbzkGNNAEyf8qJ0t0jV/pD72I3w5F32e/t+lHOJk/Dn8bL2TunKIjH3SXWm+so Z8cpIvJbfXET5qaIeH42tjUDH8cRgahXxmeBQoxEt6zaOAPEtsI0xXHC5Onr3/Ho2ClgqFmX LC4/BYSr6z5NAZ3wUxK6QQi7to44Bd36H2c73QdxAXNRU46jeY/CWCQuFMXgUM1E6plSWrjk Z1YCyyHUV2G5UbIpfFgPPlU0Zd6DJXTioclZAaHxGQmQyWjD6JvIFAtyGdsq5TK2lZkUR1Oh cStJJGQytlGayVKxOybA08HQ5Shkx5IRYrY2CBN/twxyumaZEODnpOWSCGnunACtjLTREszC Zzj9L+uyiWL2Wg4sLUvwmlMCfdu6MjFb17mYrXsvZocWgphN2+4Zidl6p4nZTaAmidmi1IvZ uhovZpdC5DpdJBO0D0xH0njEwd81HXHh2JztWLpJPxTnOq3JXUs3EJovkkA889ByHSzRMwOu FDez0x4c/YOidku71hHXwRJVJWG1lueplRnhJboO7qX3qezBg1+wS+Z+ibkRtFkpMmqX7D0x 2qpcE2S9keHu5XgO9mkaZA6+dTFK98NjlEx6tfcNkl6HyeAmvXaaHiq9To226rzusDYhk49z mRUGiOSgTIFZtFUs0z4ZZNZYFkXPUumLkKap42VW2kJnju83G7+VzVSG97lYfKymVagg69Q4 Sx1hV4biIDZr8buSJLQ67u3KaMsEy1gvCp9uVFzrJo4aCUlodVQ5StVUkFpTf2LjNjYmtabR Oiy1RmXqSKlV3yVS6+qY1Brb3y+1ZtLEEKlVX4NJrRzj52QVkyL9vQCJSZm+xKRQQkIzqZVp wiqaS63rgEFjfTx32nbhNT50yS7s70xqpT33K++PUmaoH6TQtbVn9+59SWr19Oh5bxeO9Kb2 XI8t1sr3zsDLFLuw1iDuc+uwx4ySWle7pdaeGnO3JBO8ZNfIhy2pFYEkSq1D3BMl7iItBE9T YsXjXUdqzbQjSX5Ftq8RTEDZCtNkB0EgFKTrlYGeUGmQUhoBCQPlxhuLatQe2HPSo6rWbW6c 2OpEekKpGAVi7bTaEKJb94Ba2Uj1u+u17lEXxvrud55XrJ7XwmQpKvKQqxJJz0VOJaNkLNIu aDJTqJYBTwT4LQOVcCeEkFfb7adRPsLbWjHYtJSKIHOzrjKzJPFPG9C522ErGlB4oSvIRSYr E4RluTizZCjLzJIaAxpPZkm0Pv7otazICM3RsO9NBtFtXBJEt5IREpPfqEhtzZhWTGKQarjO JSb9FuQionaTxMR3AXPyv3AAeJSYNp0012z0Mc21rkxi0rWkH0xyatTV8hJTaCFITLTtnpHE pHfqGXcdqEktiFIvMenKNp3hhkkEMrYadA65xPTo6YgSk83QEyxcIzRfI6GsJzEp7yNn4T2t xIROkSDEsCe/fIFpD7lPJi8NbH+XuHQaE2VsdTHGRMlS4XgjROfkNRuTUkw0UWqDR93HZ5+J SV/YRNmhaQ/YD4luSRdsPrLjA6yK3Ayyk70PAZQau6BDR4cvs0fSoetAsIhGBujQYclCIzqD 0enQq7JWGEOCNBGjkYASBgvqSFgkXYFKxAcB/EALMCIaFnTptNQtY7eGIdYNeiiSQcHstH8T 1QSUSQ+qqPMg29hYPe4Slb8whvJ4hb6le9rjd4dJrLdLH0cf6rvfU33I3IdJQO6k5mQO4s7u S3gkIZJQlIAFZ575rBgRaqDBAiahQMhgC6h6qbjwHJLgZIalJgvnKTkMFmEt85SyguwI11gp hyRWL+lsrfGsxJOQH79RGqk5v7EOJcAT+pwwSRipEZBES93DkC2p8/LrBEnQF/ObBx64PyZI oo/DIAnCbQznqZzCPlfiujOb9B5sp06P7mCDuxa8CJDE3TuwEVsId7QtGAMMce/UM5zCAV2e mtiCo9RDEtHcgyR7vq0MMspRsYNIxkwGLYUj2MswO9InBOtDKBm1bGdxLdBQXMqBynx5xKK2 /pYVuAGXd9W3LSl85AkcCBkkKTUvmJfvMmX09tDTk8GRMCBHX/AF8Eg8CRYlGvvfwYM3EBqx YOCPm+GRklOQyY2XHdgyY7kMcDTXh4DthVzWZB6KWZBRJxDw/aXxSJumw3jkUQHfT45HSA6M AP+EeARRcC8eGXAulkMbLmw2smeaI6BYXnL5RmdlaQ8DlCxq5PusBNFR/p1pp2P3IxurMmbl DBp1+GazSklaSD9C+qlGbcWtNhQknQFNhbKcQVtZYsfWeFYSSEhmVroYSM13YOtQYtDW6cQU rCSy6Nnoc9YR3NeRU+s659S6DyoC5d6M5lZFMpnyYBsUDjLKIn50zK2c2OQQAdzVKRwCNw2K AFMe6DfHj2ML4c4pAvy13mmcmvN7vNbBeL3rhW9bNE/g1DrLSmf65MqDUdOS8eo0LXEFWdGg RZwhSiMhLWIGKpCar5ZU1mbYrEh0ZG2OjRNm+SiOTdLirZIYOaHwF8CxA71HGSqxfCSs0fko /5DExiEW6KEveOkcm91KfnBPyrHxwNjqBPekQRjCr98guAMvdPoUHs3hD865lJGI0R8MxQE9 wBBcoP1p6yhNOEoKhMKvWA5wh+67QPc83pILtIuwIxcb27+nOCwXmSwQ8/ZkiiR3ul8yfyhe kcX5d55e/NWhuoI6/vwPjlqHJH9Txjr/FM/3IS9K1zkrIwvgsyGetkvWLpgRiWmd7/P/AWOG lzsKZW5kc3RyZWFtCmVuZG9iago0MiAwIG9iagoyMDAyMgplbmRvYmoKNDAgMCBvYmoKPDwg L1R5cGUgL1BhZ2UgL1BhcmVudCAzIDAgUiAvUmVzb3VyY2VzIDQzIDAgUiAvQ29udGVudHMg NDEgMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9iago0MyAwIG9iago8PCAv UHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9G b250IDw8IC9UVDQuMCAyMiAwIFIKL1RUNS4wIDIzIDAgUiAvVFQxLjAgOCAwIFIgL1RUMi4w IDE5IDAgUiAvVFQzLjAgMjAgMCBSIC9UVDMuMSAyMSAwIFIgPj4gL1NoYWRpbmcKPDwgL1No MSA0NCAwIFIgL1NoMiA0NSAwIFIgL1NoNSA0OCAwIFIgL1NoMyA0NiAwIFIgL1NoNCA0NyAw IFIgPj4gPj4KZW5kb2JqCjQ0IDAgb2JqCjw8IC9Db2xvclNwYWNlIDcgMCBSIC9TaGFkaW5n VHlwZSAyIC9Db29yZHMgWyAzMDE4IDExNjQgMzAxOCAxMTk4IF0gL0RvbWFpbgpbIDAgMSBd IC9FeHRlbmQgWyBmYWxzZSBmYWxzZSBdIC9GdW5jdGlvbiA0OSAwIFIgPj4KZW5kb2JqCjQ1 IDAgb2JqCjw8IC9Db2xvclNwYWNlIDcgMCBSIC9TaGFkaW5nVHlwZSAyIC9Db29yZHMgWyAz MDE4IDIyNDggMzAxOCAyMjgyIF0gL0RvbWFpbgpbIDAgMSBdIC9FeHRlbmQgWyBmYWxzZSBm YWxzZSBdIC9GdW5jdGlvbiA1MCAwIFIgPj4KZW5kb2JqCjQ4IDAgb2JqCjw8IC9Db2xvclNw YWNlIDcgMCBSIC9TaGFkaW5nVHlwZSAyIC9Db29yZHMgWyAzMDE4IDI3MDUgMzAxOCAyNzM5 IF0gL0RvbWFpbgpbIDAgMSBdIC9FeHRlbmQgWyBmYWxzZSBmYWxzZSBdIC9GdW5jdGlvbiA1 MSAwIFIgPj4KZW5kb2JqCjQ2IDAgb2JqCjw8IC9Db2xvclNwYWNlIDcgMCBSIC9TaGFkaW5n VHlwZSAyIC9Db29yZHMgWyAzMDE4IDI0NzcgMzAxOCAyNTExIF0gL0RvbWFpbgpbIDAgMSBd IC9FeHRlbmQgWyBmYWxzZSBmYWxzZSBdIC9GdW5jdGlvbiA1MiAwIFIgPj4KZW5kb2JqCjQ3 IDAgb2JqCjw8IC9Db2xvclNwYWNlIDcgMCBSIC9TaGFkaW5nVHlwZSAyIC9Db29yZHMgWyAz MDE4IDI1OTEgMzAxOCAyNjI1IF0gL0RvbWFpbgpbIDAgMSBdIC9FeHRlbmQgWyBmYWxzZSBm YWxzZSBdIC9GdW5jdGlvbiA1MyAwIFIgPj4KZW5kb2JqCjUyIDAgb2JqCjw8IC9MZW5ndGgg NTQgMCBSIC9GdW5jdGlvblR5cGUgMCAvQml0c1BlclNhbXBsZSA4IC9TaXplIFsgMTM2NSBd IC9Eb21haW4KWyAwIDEgXSAvUmFuZ2UgWyAwLjk1Mjk0MTIgMC45OTIxNTY5IDAuNjE5NjA3 OSAwLjc1Njg2MjggMC42MTk2MDc5IDAuNzU2ODYyOApdIC9GaWx0ZXIgL0ZsYXRlRGVjb2Rl ID4+CnN0cmVhbQp4AWXBU9gQBgBA0WzbtbRsG1vGlm3brj972daybdu2bdsv9XC/e06gQL8E liAUlIJJcApBISUUhaYwEpbCUXiJQBEpkkSmKBRVolF0iUExKZbEpjgUV+JRfEogCSkR/SGJ KQkllWSUnP6UFJSSUklqSiNpKR2llwyUkTJJZspCWSUbZacckpNyUW7JQ3kpn+SnAlKQClFh +Yv+piJSlIpRcSlBJamUlKYyVFb+oX+pnJSnClRRKlFlqUJVqZpUpxpUU2pRbaojdake1ZcG 1JAaSWNqQk2lGTWXFtSSWklrakNtpR21pw7SkTpRZ+lCXambdKce1FN6UQD1DgjoTX2or/Sj /jRABtIgGixDaCgNk+H0H42QkTSKRssYGkvjZDxNkIk0iSbLFJpK02Q6zaCZMotm0xyZS/Po f5lPC2ihLKLFsoSW0jJZTitopayi1bRG1tI6Wi8baCNtks20hbbKNtpOO2Qn7ZLdtIf2yj7a TwfkIB2iw3KEjtIxOU4n6KScotN0Rs7SOTlPF+iiXKLLdEWu0jW6LjfoJt2S23SH7so9uk8P 5CE9osfyhJ7KM3pOL+QlvaLX8obe0jt5Tx/oo3yiz/RFvtI3+i4/fvsJC/L36gplbmRzdHJl YW0KZW5kb2JqCjU0IDAgb2JqCjQ2NwplbmRvYmoKNTAgMCBvYmoKPDwgL0xlbmd0aCA1NSAw IFIgL0Z1bmN0aW9uVHlwZSAwIC9CaXRzUGVyU2FtcGxlIDggL1NpemUgWyAxMzY1IF0gL0Rv bWFpbgpbIDAgMSBdIC9SYW5nZSBbIDAuOTUyOTQxMiAwLjk5MjE1NjkgMC42MTk2MDc5IDAu NzU2ODYyOCAwLjYxOTYwNzkgMC43NTY4NjI4Cl0gL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4K c3RyZWFtCngBZcFT2BAGAEDRbNu1tGwbW8aWbduuP3vZ1rJt27Zt2y/1cL97TqBAvwSWIBSU gklwCkEhJRSFpjASlsJReIlAESmSRKYoFFWiUXSJQTEplsSmOBRX4lF8SiAJKRH9IYkpCSWV ZJSc/pQUlJJSSWpKI2kpHaWXDJSRMklmykJZJRtlpxySk3JRbslDeSmf5KcCUpAKUWH5i/6m IlKUilFxKUElqZSUpjJUVv6hf6mclKcKVFEqUWWpQlWpmlSnGlRTalFtqiN1qR7VlwbUkBpJ Y2pCTaUZNZcW1JJaSWtqQ22lHbWnDtKROlFn6UJdqZt0px7UU3pRAPUOCOhNfaiv9KP+NEAG 0iAaLENoKA2T4fQfjZCRNIpGyxgaS+NkPE2QiTSJJssUmkrTZDrNoJkyi2bTHJlL8+h/mU8L aKEsosWyhJbSMllOK2ilrKLVtEbW0jpaLxtoI22SzbSFtso22k47ZCftkt20h/bKPtpPB+Qg HaLDcoSO0jE5TifopJyi03RGztI5OU8X6KJcost0Ra7SNbouN+gm3ZLbdIfuyj26Tw/kIT2i x/KEnsozek4v5CW9otfyht7SO3lPH+ijfKLP9EW+0jf6Lj9++wkL8vfqCmVuZHN0cmVhbQpl bmRvYmoKNTUgMCBvYmoKNDY3CmVuZG9iago1MSAwIG9iago8PCAvTGVuZ3RoIDU2IDAgUiAv RnVuY3Rpb25UeXBlIDAgL0JpdHNQZXJTYW1wbGUgOCAvU2l6ZSBbIDEzNjUgXSAvRG9tYWlu ClsgMCAxIF0gL1JhbmdlIFsgMC45NTI5NDEyIDAuOTkyMTU2OSAwLjYxOTYwNzkgMC43NTY4 NjI4IDAuNjE5NjA3OSAwLjc1Njg2MjgKXSAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJl YW0KeAFlwVPYEAYAQNFs27W0bBtbxpZt264/e9nWsm3btm3bL/Vwv3tOoEC/BJYgFJSCSXAK QSElFIWmMBKWwlF4iUARKZJEpigUVaJRdIlBMSmWxKY4FFfiUXxKIAkpEf0hiSkJJZVklJz+ lBSUklJJakojaSkdpZcMlJEySWbKQlklG2WnHJKTclFuyUN5KZ/kpwJSkApRYfmL/qYiUpSK UXEpQSWplJSmMlRW/qF/qZyUpwpUUSpRZalCVamaVKcaVFNqUW2qI3WpHtWXBtSQGkljakJN pRk1lxbUklpJa2pDbaUdtacO0pE6UWfpQl2pm3SnHtRTelEA9Q4I6E19qK/0o/40QAbSIBos Q2goDZPh9B+NkJE0ikbLGBpL42Q8TZCJNIkmyxSaStNkOs2gmTKLZtMcmUvz6H+ZTwtooSyi xbKEltIyWU4raKWsotW0RtbSOlovG2gjbZLNtIW2yjbaTjtkJ+2S3bSH9so+2k8H5CAdosNy hI7SMTlOJ+iknKLTdEbO0jk5Txfoolyiy3RFrtI1ui436Cbdktt0h+7KPbpPD+QhPaLH8oSe yjN6Ti/kJb2i1/KG3tI7eU8f6KN8os/0Rb7SN/ouP377CQvy9+oKZW5kc3RyZWFtCmVuZG9i ago1NiAwIG9iago0NjcKZW5kb2JqCjUzIDAgb2JqCjw8IC9MZW5ndGggNTcgMCBSIC9GdW5j dGlvblR5cGUgMCAvQml0c1BlclNhbXBsZSA4IC9TaXplIFsgMTM2NSBdIC9Eb21haW4KWyAw IDEgXSAvUmFuZ2UgWyAwLjk1Mjk0MTIgMC45OTIxNTY5IDAuNjE5NjA3OSAwLjc1Njg2Mjgg MC42MTk2MDc5IDAuNzU2ODYyOApdIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4 AWXBU9gQBgBA0WzbtbRsG1vGlm3brj972daybdu2bdsv9XC/e06gQL8EliAUlIJJcApBISUU haYwEpbCUXiJQBEpkkSmKBRVolF0iUExKZbEpjgUV+JRfEogCSkR/SGJKQkllWSUnP6UFJSS UklqSiNpKR2llwyUkTJJZspCWSUbZacckpNyUW7JQ3kpn+SnAlKQClFh+Yv+piJSlIpRcSlB JamUlKYyVFb+oX+pnJSnClRRKlFlqUJVqZpUpxpUU2pRbaojdake1ZcG1JAaSWNqQk2lGTWX FtSSWklrakNtpR21pw7SkTpRZ+lCXambdKce1FN6UQD1DgjoTX2or/Sj/jRABtIgGixDaCgN k+H0H42QkTSKRssYGkvjZDxNkIk0iSbLFJpK02Q6zaCZMotm0xyZS/Pof5lPC2ihLKLFsoSW 0jJZTitopayi1bRG1tI6Wi8baCNtks20hbbKNtpOO2Qn7ZLdtIf2yj7aTwfkIB2iw3KEjtIx OU4n6KScotN0Rs7SOTlPF+iiXKLLdEWu0jW6LjfoJt2S23SH7so9uk8P5CE9osfyhJ7KM3pO L+QlvaLX8obe0jt5Tx/oo3yiz/RFvtI3+i4/fvsJC/L36gplbmRzdHJlYW0KZW5kb2JqCjU3 IDAgb2JqCjQ2NwplbmRvYmoKNDkgMCBvYmoKPDwgL0xlbmd0aCA1OCAwIFIgL0Z1bmN0aW9u VHlwZSAwIC9CaXRzUGVyU2FtcGxlIDggL1NpemUgWyAxMzY1IF0gL0RvbWFpbgpbIDAgMSBd IC9SYW5nZSBbIDAuOTUyOTQxMiAwLjk5MjE1NjkgMC42MTk2MDc5IDAuNzU2ODYyOCAwLjYx OTYwNzkgMC43NTY4NjI4Cl0gL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBZcFT 2BAGAEDRbNu1tGwbW8aWbduuP3vZ1rJt27Zt2y/1cL97TqBAvwSWIBSUgklwCkEhJRSFpjAS lsJReIlAESmSRKYoFFWiUXSJQTEplsSmOBRX4lF8SiAJKRH9IYkpCSWVZJSc/pQUlJJSSWpK I2kpHaWXDJSRMklmykJZJRtlpxySk3JRbslDeSmf5KcCUpAKUWH5i/6mIlKUilFxKUElqZSU pjJUVv6hf6mclKcKVFEqUWWpQlWpmlSnGlRTalFtqiN1qR7VlwbUkBpJY2pCTaUZNZcW1JJa SWtqQ22lHbWnDtKROlFn6UJdqZt0px7UU3pRAPUOCOhNfaiv9KP+NEAG0iAaLENoKA2T4fQf jZCRNIpGyxgaS+NkPE2QiTSJJssUmkrTZDrNoJkyi2bTHJlL8+h/mU8LaKEsosWyhJbSMllO K2ilrKLVtEbW0jpaLxtoI22SzbSFtso22k47ZCftkt20h/bKPtpPB+QgHaLDcoSO0jE5Tifo pJyi03RGztI5OU8X6KJcost0Ra7SNbouN+gm3ZLbdIfuyj26Tw/kIT2ix/KEnsozek4v5CW9 otfyht7SO3lPH+ijfKLP9EW+0jf6Lj9++wkL8vfqCmVuZHN0cmVhbQplbmRvYmoKNTggMCBv YmoKNDY3CmVuZG9iago2MSAwIG9iago8PCAvTGVuZ3RoIDYyIDAgUiAvRmlsdGVyIC9GbGF0 ZURlY29kZSA+PgpzdHJlYW0KeAHVnetuI8l1x7/3U1TgL9p4lmbfyG4DQTA7doxNsvZmZwIj cAyDkqgRdylxVpR2PAsjD5kg75PfqVO3JimpmxI1zKwtdldXV586darqfy5V9aP5N/OjyQv+ N+Jv3UxHTWOmE/tzMzd/NNfmV2/WuTlbm/Gordpx3k52XWXrM1OV9Wha5ROTN9WIv/V01HJp JuNqVNdtayjwInxwWo+qylR8ijeSLFnnm2bMf5T9Ix/Nm7IYjyWB/8LdNB/VZUvp00k1Kqqq MWdX5qt35Bjn40n2Tuiyr7ifd1fmV+/e5aOxyc27C3Py9fXt/OZ6fvuFefe9+e076PMs2Ulh tskVW/aDFOa50NKUGxRmD9P1ZU+C4OpQluV5NWoKaee9OPabm9nFrfnu23/52nw3/7BaL25X N5/M6+vZ8tN6sTaz63PSf7xb3Myv5te3a2PMP81Pb+5mZCrGeflF1ovRIi0DRaHKkdsKtvqK ZSoKDzPa9GT0Hi0fZbNG2mt6mCXokZbvS9AeLR8JqiajakoH3MGhbLOLDCCo22TZgN5bTkeT ZtztvWaz926RVo0QYf5vzO/vrk7nN2Z1YW5Wd3Rpcza/uV1cLM5mt/O1WVyb28u5eb9cnc6W VnYPJ4ZlPR7V42llpq5OxyOGRcP4Pj0iMSwYGttyMnDMZkg5XKdt6lE7acvaTDvEZTqhbImk 2ewt75Cz6weF8Xz+YX59vjYrFcqY+Yf5pzVyOrs9nHBWeTkal1Ws3fEIZ56P8nziRoDe7H4h WdiPuI+L5dKczs3den5uTj+Zr3737dv5mVl/mM9+WFy/d0PVenS49i6mzaicjCdm6mpwPO09 LkZlUR7PYESnH9UF+HYYgHwZAewS17t3vL41MxG3M5kJzeu3v39lzhcXF/MbkJn5cAlgO2M+ vEcszTev/0NE93DSGRCbr97RSOcEHaauAcmK2PoO/i8kDPsRJwhoPbuaG+aZVxank3Izv1gB ta9mn8CTFrUzLy0/8WeeQihDroNPTQ6+e94fjzCgCk7r1g9VRyYM+xGHDICa/6AQZCWCYC5F dbtdmfXdhw+rm1s/LNyslsvDDQHleDoq8rY0E1ePXq3eVzveQ2krsYWMizYPBA0cAlY/zW9Q OG5tlzqdHw6olowC+bRuNgl9HnX3KdrlZDIBQ9dHOpN2iOs9k87Of1qsZ6fLufSQD3eny8X6 0lyvbmWgfGVO727N7ceVjKxYQLj2Q+3t4mpOP/t2ebc+XB+qxuWoymvj+d6rC+1QobaNgFv9 Z9Q247ItCuxrTY09MLnACFZOavrOBJsfBo92imKHxtlWSAI/mBXbVgp83AjYNSM8bmILdo2J GB2bpnEcOLKR2hE3cEBZr5iyVx/mNzMMbWs7rJxdrlZrK4nAM3N3vfjxzs7qa0O2iOsOJ3El pkP09ikNvRfD1UZzwLERLD9taxFEpc/x/OGxcdSToD3GxrJtRpNxXWwQ1DVOb5m3evVRqIn9 5c1bemY7rpumqBjbyqKt8rwhzV+9fbNlTP8yWtMxUU6bsTArb+m6DCnT6ahq2ybbSjFL89ba yuPbYu67r7CpLYx5IRRmU9D/9iinzIWo1lxlkKnljC2ZQworxg0KX1rDjZSBhaEwUFioIYXZ lGE1DG+FGoaUTg0fdFJ0JEJcN24EzXq4USZVO8pbBHWHZTjaujJ1nuyQz51ek/sI2hLFKEtx SK+o+DifHOeQ7ogbOKS/xiyESXomP7cGp4kACVRyfCaoXmfL+Qxla2VRxOzu9lKG/cvVR4b+ a56qXXt+frjRParlXd4/PHr2FYYtTDFkfqfnTza8BI/7+F5IK9+LNosYRfs+dTASqzDY8tbZ kEGTa8vY7HHf5B69rKjp7YVARyV+YCe7XLy/FAKLnhPnVtP7qSqZoOJU9aBXtcR8WI3bTcof FtFX+9L5uIhGPXYvMcCxvS9tT+BhQW+qGlBcp/U/Hw8LvJJ1E9rUzUGK4h/v5hIccDn7aU5X ml/vy80eLd2gzDToNI5ru2bKZ0ByGnLxAJITfUts6PjzJkU7wj7VmGo0nQA44jRq1a1S2plR 895sqpV5mGAA9/VUIjcolj4mER/oeoRwtEGPk7HmgvRNdRDM6fRCyGsmBD4U05aCxqMJcR5V OSpKsIXXBrWUB7HM1pDxeANF6FAUIxrpSO12+xEnMRULbA7nhxPwnGYvahzYky6JD48LB1Se 8rIajSdWztMGPV7lqRrXKAPN1EL2Ft2pmzBEsagkeoqe1HrNySUU9R6lFMRLWL0Jgig2awoM RyhkQ4qalIw1oW7mimGQhMxXdlBRAi/tqOKqJ6W5NGgbVEP/nkHx9ZX0aZv1fHDA2QNFxQEH 73pTTr2u8nCHeRG8jCCOQ5hP34lUo2pq7JbvVrf4B2OEwur0+/kZMV0vGk8TUIpWZl/r5k7N 9CnTS90yv8mwpD7C52ltxG9oPF8QP4nfLMTqqrp73+Z+GfWoS1xvu/u/ryVQQuzp21J4trgl rsLJ4oeb+U+L1d3arJFQZsj1K/MRF+bs+oB6srO7+6odj2QS9TE4EvaFxGAf0s7n67ObBYE0 Ige3D49JNjD14+L20mbGbX11t5z9+gWEwFbseESAKbUeH1F4TT0Zj6aiTBzl4NQhrvfg9AeV xX8wvzggGvfgt8vA3jS+eb26eT+7xnlpR0Xz9+YXr396/5c3r8WQ+Bf8RX9Jn/O4Mr80v/ju D68P6bD0UYi+TsfTbeqcVQtHKqR70SaNqRHRb2jw9QEFtW4kgDM3dYfODizqYxfZidO2UPmA 2PIas0NeFDuD3XFpZJ31IDtQ+bZbfIsabweJ5o/UDlJMylFr6pKCynFlWhkHZUHMC5lBakaQ XJzwilOPyym+J3Fh5GVJ0A8MWv+Vu5HL3v/SFN+YfzCHm/Rti5Z5SaMqb90A1pe35TeH64do AIQuYu7ztO2rn9wr95ldE5a6mnfa7/u4moVvORozJoW8rMUfu3nf3z2cUZDYXaQgLUbvYEX/ QoQaXqMsAtMcNa4YIXJIQZV1TWu1xH+e3g8sSFzxvlqVOOaFvmHVsq9RiK9WuKdamVbrYHaR uqhH2H2PZ5bPqXSNhXvYiKh2kUmwi6wXPxOZc2E+i1XEhynWri7Hw1yRsMZjqCNY7FYRezNl XesxKh770fbVTBaUuPVDZ3c3Npz/xi/GXLDgjTVGy9UnXXUiSvN3X3+3FnvIxUJifC/nh43q d2uMXOWORjKrRqzo3hzaW4N6GcPInsTh77yZvSewn7FobaP04wIPHZfM7acP8/UBLSAFcVT5 FGDrq3BEDc5C73zqkW9HFYnBTG4l+A7kf58qsreFtpoWo6iJHJeBtktbh1dbatsve8LXLUXp cbWtxUw0bXHadum5B1lvUfblrn89qd3DGZC3OXNLhWu707KfjXvsz0AkAJ/v0vMk7kWOHo6P LEkdTQgR36D7s/ExLOJ+Bj725JrtK1my4cbjkQ5hNW+Xys/GtRA4+AA9cdx9wSDSCgtMhe3F zUz3dIdImp8SXmShuSduoDbyN3CJ/pMJ3l/HVAsJzH+enH5iB4T//MJnMJLDai44zoz52+GM JFEautzviOc2z3t2lz0G6+AorWp2qCmPdK35nsQlDR+amuZNrndd2udXq8MJQTltWYCOVdhX a2AXPJ8vhe6/HU4qoph2peJ5xJRRfX+0KJPicfoiqpS0Dqe2ENmLYMWUnHtG9y3CIq5Jrg4n ZxEqpsR+Nt5FpJiS8yTeRTYejosRKKZkfzYuRpyYkrMXF3vy7EkwMSXys/EsDrj3khNRwf0g 8V73RLpl3cZq1eifIzxZ3XIVHpxG9ubKiXolduqFnHJVORk1E5bKDjNBMxX2lJM98FHY+mhP 4iyYePPaL1GSrbdk6pb5O/47HNQITjlP/kCokbN54eGYG61ke7d8wsSD7VYYx9f9yLStzZ6M 5oevIPdFYFuX0M6wFscRr9FtN/C948iB3JyNXRca3Zx639+xGNycvJi4OZuyHeRUdG7OphTf oqXGujkJXx7q5gTh45201bBuzuR+EEVVwzoTW5DQY+8y9s0cVi1fiK9WuKdazs2Z7Gi6MT3g xo6rV9z0gOuykZ0SN6YHGV4PuJGBeGfH0+I4NzLwxA2cu/xE8A3RaBdzljjafz7VDW4vMT3s x1tWRefbo8dOF8Eec2+cHhx1A5nr2Kc/hyMzTg/7kamtXejs8DLTQ5fQo58eWsLE0igYvd9j euDFdFxnmWf/QkIUTMMavs70AEYcGAWj04GtRjI9DK2WmxAYhrVafnoYWC0/HfhqhXuJ+Tlw FEzFFEIA9EBUSo8+XHeOiF9p00GHabDf5tlx7H7z3b8eeujJ2YqkZE8+4/g4kNaD8jHadp7I R8vECVvNdf5ZPuMX9aD68Ftod2V18KD5XLNitNiziTqrnY9UXd6PuNh7iLYP7R1TbRI76E/C M7nQ53EGfQlZUN67gesIhGGMgjn2EV3HFsezH3E06+8uV+vb07u17F5+Mz9b3Zzbxr67/uF6 9fH6lZn/lY1cb/HdXS2WukGMCkOibb+AMLjqHY0wsBsdJ0D4/Yr6zlx0pBeYVfejbWMEcL1/ IzUdMmyOvx0w3J1pd1TmrHR1FRoOYVwlDsn1EAzR5XpnuNryAfU1UFmre3oayuOBTMHM/QA9 0T51v51751y6Rc/jwSJhLi2J15uye+jwVnyJLuOIG6j+0jvcKqfk3AeGxwcGTwzV2qdeci7d 4H1HOKMwDDFWbtka/FqkaMzqWLUqQh9wO7BtzKiV3c5rfuXYHO/3OLBhq5yycyTfO07hc8QN F74wvsWLZMA+oFFLmlP2Y92Tr0lvOVznLlqMr7LNiCdyIH8jTw9HYzBs7Ulj0tqQ23da2eq8 jw/jcVrpCuszDCVuUnluv0chM48p+KempM59f5tUxlZS4iCQgsSw5e4wCwwybNnXsoKocE+N LZSdtLnvTw3nm7He1VdLDFvp/cCCxIHiq8VRaZiioG9YtexrJlYr3L+AYYv4rlGOC/04x3RH nBtzHu4mA2KVhkZ1hbh2zy0lqLetLQbXJFeHGw+DRatL7iPLuQ7IvxCv1CXoafyLrAyczJ57 FWScWbrd5HkkcY8ZJMQsdTnZ244SmcZV4Nuzn5sY9bkj6cFx5u0QNHwbun4a3eMaZtTo2OU8 v+c4P7SKR3c46EeQYBM56LPHLtJlxbFT8Ti/e0T9JXVe2aSOo++Oc4pyxA2ExX+0B4vJIWLX 56z0PFxPzP3OHuV+hK4uLliQera4CnvJ6UrF1d0NG3Qtz9igSfemYbemw6lKJTsiTatJbXwt nCzcI5z36+A7e8se43DsvqVsj8oCymOMBSz3Iw4r9Yflgh3a3FFTp/OzmRxWIW3OVm3nC92k zcyIo1lwBq8VYfY8f79gA9/ZtVmcz2eHk4U4t7jaHY8ssNshi+eP8+Ax2Uh4D+LYIkHWoKv/ Qhau35zj4iD1avb+enF7d253UZAsYQ37J12iJEeRHfB0xNJv5ewrdjxiIDtkHdPpiCyeYydR H698BJinaGt2KfYn9HUJ+iyYpyCmpAqnxDm9ZOu82C0PxFc3d4vvr3+ez5fsWDnnvMYl+4vw 77d//cBxEGvz+u49LkHMC6/s8dn2WfrnT9+y/P+AI6Xb49LX7nP3kGrcyAr6hpOlUnb3Vl7a Px8OJwUFYYO250EYDI5DbQ4BYRTEzkziiWwdgrYksi+S3PJBPa6x5A3n2nAq2APkRC/I/erB vSHb5k/Attz8GVXlXJeBpLtUIST+GKR41WeXKgFmRTUWi+F0HDb1LjhciZQJG38OshzKe+HY Ic4w4oQfKUUPWnKWw54xyjWdoMT5LeetTYgXxg65mUSBnAbFyGRP69JspsYalbPLAi+yY3VD d0pS2NGARYdZTGFHbeLWZLupJI19EnEIx6LZ4r+oxJ/kSfIJZxnfHk3ssXA+bWmXg9Yc62PP BrAvVnii2PlBTjPQspMER4AU5TOxySBkSkEhxVVFVppq0Y4r5PEE+JSz7JLw7cJ8NH9SYdlU aneeY8WOb9rebFo+xQbduSd8sMwr2X5BjmTEnSZ5ylwOihD+j/PW3bV2L/fWcH6DPG04L568 Euau9xPs5Jy4FQpr6MY8x30inw93LGBiR7F4v+Q+r/kQ5yv4N0Ro2TxeC9Qb/zV5nYcTT428 Lvee1lBYqIv9nL/LzsylPQAsHDfGjLfduzAXxAaCORU7A8C4mGabEdYlKUOaMYqb7wF7insi 2o7MDlGe9KUL+heJKlR4OdWQxWPoERU+dcNqsoKdxYp0cMw4y0OGpdw468m4zeU0jdZ6ewhZ 8be+VKwnTeHjm8y0tvn0x43WnFFKce8uGPBO3t5+Ae8Lc8Jho4gtFx/8xaW/CI84GEXzEC5i 8/7L9iPK+7N598/GHjkkHSMQaI8Iibcb9DpsEOm1PbHKIf/dlWGbTfYJUqpP/i7Ows/5gZQt TGO2gqWv8a9cAlH8woLspLrniTkJ7/hCQtZfb5bK2Udams/6LXs7RvaJNdkufc9ZYigjm8Qq 5SUbgnJ0neH8hQZRaDalJRzFsjksxZNdPO9Z6DKNMFjinwRzllMrM/rjZIZBNMjMm9UXjH4n VxBfhh8kgTQkJDcnyEBlTqjTxJz86QtTW57k2QnV5SkgihR4MbV5YnXvp7cmSLKWyNaJo9hJ CxSPWXa5SbOTGI4vCDTfijRDrQgsdBohnu+zeYGkciBK8hBHHvfU4IYfCF643xm3rt5CuruV TmGLsCWZr/UdKt+nYqEhCLOgJaJbZzxp5NCiTlPsqNYlREDhT1SLHz4KJWf2GpqhVdMxhvCU VlEGcC0WP27c62zsG97WAvWxMAk2YFiLZdH1efH6TvNd68f0M67QU32khS7sd9IPXNjCbJmZ UDyETXiBmRiTXQ044mir9Z3Epq3PRv62JWdL+/FPevczxKnMSiu/Dw1HGrzi7yXSwRPNth71 pJVdlEo7vHeI7bTkJonCh3ff65jpXUj9cWqW4tSdM+kwnJo1zOvurBeHU/c57EVe5fQU57if MITpjfrJE5Cq51TtJJw5j71KhZ+ZPTGrBSQCnTRJD9GSJNCPHAVegDPl3KmSU0slCc9ygbSE NyVto7AlSISJcACOY5dqWeXYjMXxziGi6e3ScCsBC76mOee2hsz2aXxXPi2noPrZPQvol3UA eY1JNwHkPilFKD4tAmsoY31dgCPZBExX2o38Q5qZoJQXNEYKyInLHTdTdiT2YB+Ewc4rAu0V kQPoXYJgMgeIQ1qCyENaxGS+cJ+SeQpSeOcJTcGcq02E5L7CngLq5zglgFIh+eYkwvzKOlB2 dmYuCAfUOjDceBjeTJsUgXPr4DSHogC+/R17gVos7cB3KwcZ6wlIFnwzMgG+KSqgb456kxwC 3kHf4c6h73CfoO+QZgF1KFHv/Pcc/G48PQ5+N57aAL+lIg7oYxQWecNDPQB0I+NtawXRN54J IrVM9KlHW4rXQkttifkSyfdKps+2IdOcA5ek7BJqpbSDuz31G7hbRLTNZVWux9055ys3mCdx J/wxxukyZ8p/PWE3W+rKaXq6T2xEsQLG1Imawst9UbeA0uzkOVC3kns40N2z/JQpzIFHh7nF YINgBMyNmBKBhsklERXR0AZgbo5dlNBZFRSB3OPpfRAmBd2/AWMBvAAwgGq9BqQApPUaBAtg 2QbVDxzbzOGdzJQ1Jyx2SOoAFQc5mR5MnqExngCC9gcqJgUqz2FQy8e4OmoMV0+EKW6+Zjaf 5lhFLGYZClNkw/aJaCiclwkmgahyI0kwiZxSOmGKTmCK7G/OhnLhTZtto7A9YMrU1sLBFMMC DAFi9pZBknqKQdLXlFsJZNTM8jRmhpouTPGQgAEZazp24cRu6JMEXPghPaSFAVzOPuNcDQyA 3pLIrqOjitVqGIZiWsOIWjCkJkClZpeHYszhfrF0PRLKzykcPWoPrwogJXMpKUTRPGFGC4Um Ke7TCUIJJCYIJVQkQJRQWQ9RApfs9NsTosiwrIiBHWItwti8R5K8ubD1eSwGycfALTHjubu8 hKfumklU3sNsmI/hPLTGUnJe5A6UYq8cQrHXEZ1k9t5ikVCCu6Nsh0qkT/Idl+6oCYjEU5tZ WOLvFJuAhftjk5r9uPMxdbmKOMS3EZ+PbemFrUcbifg5C3RoyGeRZEdqSpYnfxOcsOJ9LPPD JjjZjBEZAk5qRITR3qGTbBOdiHUtnYgHoJNMLD7eJqjT9zOgE0/vweBJ7w+kbDlCfFLL/gji 9nhGgMLxC4zF6EpHhFA2aLoHojif35FBFEwQHYgiflUGKNH8e+mq1uMXTsi9yibYxMPtFkh5 aFOiMLbJZggEWKYTt0uCsGRq1WzJlEz02kSOPomTtJwXVJbsS5GkYYGRjTbSeRseNOOOgQEg NLa+Qz/gugRKinOnz5TO3j4tjvC+8CTFUmCLcg6+2hHamRp8deLU4NkQSfC8ihaGIcYiP6Na q5WbXSepqYEZdeLm5Nw54HSGRmyYFfW6JPDQz9z2vKNk5mZHr0ZKkJlbrvzMLddx5tZnOif7 EtwdZevMzezON/3M7akJM7el1M7a9qqXC08ifmOrTCT6gpOHEhfesGaJzuDaN1QyY/ukPiJc Rg91ICEVYU9qOmPHNN27S2QEO2+NQE7K1JyAl5QFB9iBEiXRDHTj1SxXQi/zYZ3HP2U7eg83 Zff9wGeYskvFQNadYU0YD7jxakarUg5+DlO2xEVP86Lc36YgJ2GWolDFKbuPSWFvPx71xS3y FD+ep9iJi/jxqnqL5h0Or69BYXwbt5N4ZvA0yY9gUOxi+ui/5UbdkmopCTmsW4fs+HP4ixNT 8tl3zcn/aElaBP6y5CXxFpGRRwNcVew1hKKPenJ2lX31DmQ8xqPXp4KcVM338LqdqlNNfW+v rPFHfW+nd+rJgyAMQnrtHHnpg/OVFqC+t+v/tQaimCGz/lu+o966HzSzlqlOu5jXZ9Kn71cr 5+lT59/lamF9gqkrcCCzWIgM7FDxlWi8cS9ZuHBNCItoTz5JK7nGsk+ykzttujSDcBermXtV HL+8ReWlwTGu8Rf8qM3N3295YK1u4kB1uZzQcQqWfUm/+7191X1vDevIr3J2EeWHAp1o6Utr ibWIn3dC7V7TH5c2kJ/saopFJ9mkYZefdEfvOhMvOZQLd7QCUHc2f/VFxq/SPFf2OG+p3iCd 4fmpvupcrPrOGXUhA1zh7+zWlqZJ7kPSCfleWo57kjbdTylVMy1ajmiXV/VuraW6Noa7fXos Vju4Jb6ubbb1Cy5YiigoB/p8MAAHInXK7jadZZ8hgiMXJL4C2eUvn0ackVxCEoh27/V9cG9e EcBH6IelwM0bHbXqyF3U7LesB346yy/4V+Iph+pVvKYGZA7YbJmS7Smi+ylVBDrivOtYQ10S VEWlyqdFFYo4HraLTa2hRPqA5TvW0KrlEBqJEEm0KpqQTe0YK0PpcoiaWJe9pufvkzBKn5So VD4pIPVQcJLiPp9EUdaOTEgK+WpfmahS+QpHlcpz6ikqFfvieOdtznVHpZJnqjjhu02MoYhM UKlqvDpeparpD6kxNGPNGiu9rEolV16lkutUpZJ7VaJ8Ce5OVjrYJ5mIqX0HLS/31ESVSihV lUqu9lCpUBmbQoygaROo9PRrlkSl8g2VqFQ+qZcAJyqVl4xUpfKkptIS0zoqVWX9AkRuBCOo j4x8kkqFm7cgztnBjONXqRy9h1Op+n7gM6hUFTOqdXYzsT+mUom4TMVTFFQqRiHcJkX+BJWK QKG87FhBt6bm5wyNpL6gmCepVI7ifVUq9AQBUg7CCr5DpbI/Afm6LIpuaRiyp3g7vKyPHD7+ q5bkULNAM9QyBbcC+4BNEUhToBYuOLTzJOCahxzaziCD034sR4pGbXi8E1fJ0vY0SvBeXEV9 QFdvrb4FIFX6SdFralajTWkm4C+gLM2kAI2oR/XV81eBm+aXl60SGgAdSl4oWt9FByCPgj5Y Rk4aghSYSM4UBup3tWQYOc0IYZT8mlPf4mlg5pYFOgZLOZBasUMiwcbJllt9VQkH4CMW99JF IDC0qSYgP4rZXXanCYx6Egl1xHY1ZoPMDpLd1HNEV3g8hsHPNA8uCmJo2l620CfYUjqpgAUg a966U9U9km0GbpOdWQ+BnqEAEECTwTeYHgyRhFr2cA+wSwvOeDHNx/DDkJQAgZAWkCwWKJbV YLP0KRSFFRN7M9DGp7ENJH1uY0UQ6EdWBKGR+KiBEmybLgnKQkLiHwhpCZgNaQGThsJ9CmU5 EhLrdCA1wSehQgHNhkp7NBu59RQ0y07p+LEVccp14t6nJb2DoIHs6NpHbGCrxbkFPnf7Dkiw wIrfXQJEsKfgYRwE9sqhWXudoFl7b/GrL0GxrZSNI0WRrXzTOwg8NRHNCqWKZuXqATSbhP6k DoJKImFkeWaCZns1S2wE3yws6XVCHNFsSHpIiClqQ4gpaluIA6mptHjynUvfQmscBCKR3XU+ FWNqSRhiCk+GOgiIQxtNxxNv43keNJupK18GYQu6GCnt7zP49O+l1/atZ1jn0/sDR45mZbhi C5wmolkiypop1uPEnTQs5lDWFk9YhJ8gooOC2frJYNZTHMGsDGI9FsR8A44AGgF1gEbAjNaa Bvl79kWm7gD+ApMa/xT0wVPgGfn1GrhFHoAZf7UEYBjXWiZdos1OPloAo/mxvVGC/pWnmO4t DfoWKUPglqwqmKTnPIzrqk+91w5nuRUuUAOyesVf6xbh2tllZScVejdAm/1UbCb3osNfYrom tz56Q07Q42v9WYNMeeRMxDNnjXWlRPu3FJ0W0gV2kl34kYX1gT46X5cH+jsPPzHgyLqvAOV3 oc9NUyXLGjtscBRwpJyt2y68KZySWksFkQ7qoLmcmdvVWd//R2XO1zYbTJE39YnLpq86djmT 9M+OTxxdlBDhG03TXBbXUrP1XLwTkCKfyLxN3gFkx8a4zNIzbicbS6yHjYS8Wz5aD0s/y/Y9 y+boHKKeie0d74i7E15xh9jLM6GdOyMyRIcUGaIPGTqXV+yU1VLB28WFW2nlHrsSb11Z9Dx5 yUhDUqawgJ+l6J78/mO/HlazWrhgn03mY2WGG1v+P+kKBcuCUBlCvDMH2gyzejtdoWUNqT2Z x+oKereP1TsrMTgT6iC2WG9zDkkJzAppUQsA6BeydbRPoShZrtXRFMBJU1nmT0k+UrisYMB0 wnKQoCmwJJSD19A6XCRR6RLSSCKfRlEBy4c0rxew/toVnqQoCWkokSM0QX6yFZCtTCzb8yUA Us8CSvJLlQYHEoHRWzjtsXybWr3tM6cNwICgJ4jIBD2htCceaa6S8O2O1RuILwHBoifIldcT 5DrVE+Re9QRfgrujbGf1tt90ekKBJ8NSE/QES6nVE+zVA3pCVK87gUTErkk0WWcvgCGNEm3e vlFE6rz0+JbrJb7R5r1DfD2ZHUlxpG+E/cq2chUALRi86efEUddPiiGS/eJRH71f/XlUBGeW PYSK4Ol1A3Ok97lUhN4f+AwqAqfH9jZ4i7S0eKsTFYHtCVlS0dEoh+kIJQGSmA6csNDzDrwX APVl5n+KwdtTnOoIvfYC+CM4TRF+0BH+12oEa2t6BVqB4YFk/NWcwBByajroLLyrGgFwrw/C r/EtcwpVzpp+5XSkuy/GFyCIruLwrOJUSfMG1U382Ysuh7SJMeUI6zrZ5LQvVQp3twGuYOkN gNuBzlqbHcjZQdwf6BEB/fqC3DP9phwEalniUHjA2u4eLU30F82sKtEyCWXxKhGE9GlAzyj2 yy2BIGDpYZFdp9ABXJWaQNTqHJBL9SCLxF/bCCoI4drle693q2ukj3zImjKDHMkWClYsSdLC ruWd7OQ7PgHzv7a8cTeuNIRGkLT9kD5/q2yWSKfwAWEchWpcFyzm+lLf0e/otZK+0uckDWFi xXyXOhX6qSPoCUqlMJEu6fSEPnqI0yFE+aU20vT8OIUCpkjdrcqSnSycfuEK31BCXm3t+2FL MqIOU6LTWGyJmfWOkWjcx7tUL5cbCs2GtpMw9HGnV1nJqo2uprzLbrDp89oVQyedCnYIq5AV YZWKDH9fc4M2JzKDnAnBZHS9TfjFnXCPnMLM8JrLKDwizd25jAgOA5jv350yOpFzLrs0GWVw 10fcanZDYpEZ0RyOP72Uvi+jg2hziUZ0kFl9ctqWm0Xb8MV+NhsdvJw9xo1Gyg7hM4OE8FkY 1nfvEVnKOCGWbZOm/1c6blXKlhlBx+VsC1FW+0d2qY4rR2KojkussT9AZD8dl1PNp3J2aKLj +qRUSfBpUVclnpDNN1IdV/ZusrpVyFSg2RKA1VFy2b5Ldt9IlFzZFHJSiWtN1ZQsJCTusJCW KLkhLai0oXCfkgUSEndY6ShNdRdfnajl+ip7LTcrfcpTtNwKAXbeMJRGjdNye+PZe9VfK8Qi arkITdByxR7hYrvYEQbhSTfEKybSZa2WK1dey5XrVMuVe9VrXQn+TraBd9fyTa/lemqiliuU q5YrVw9oufd4wxAcKLdi51uK3cdVfh5qldgGvlV4zUlwoub6pIckmKI2JDhQkDp0PaEpVTHN RnZ5X1jBngMyS23pualzY6grTHYZZ6cUDyei3qibb+y3vPWArrB76X02Pfc+hmx+4DPouQ1T Wt/ALpGWaYUBMAR2ofg+Vc9lG9F2LGPwldGFGYfd825qsdST9FxHcaIvcr5TD1/Yt6BQBbnA MuAFf8Fo4IlTux8c8B2IAcYiHdTBNTCVpwLFeE2zaib9C27jsRb6yr4gr2WuaH2KAZ88+i7A hqK1UH1K/j6ozWtaRDKkJ03u8v1sBveI70cglHfjOF3ZYiyvJs+pgtaZbBxiZ+8Ui6mqiJbB c732XiPnnHEq9sx5d1zxgk15AzZRoqDWULwW695yZURw55hhjw2KyLLrwpGVRLIQkGBEuBHF dkz8wA4h2AT4v4cbGCzgPw1MLB4tC00hBcpJoY14SoVJp0qkSLp1HQ5pL7Z5byX+J3StXZsz 7vDWeY3LLG5fGeElBAhnhVavbjl/kvuhzb4kjoxaCT6G/OTHyKoaXrV5gkbmNMeFhCPy0LhX 3S1KXubUCnnqClw4IhxJLnVkpAHh1NIluFyvOKhAC3eFDZN2OejQroiO3LNL4rIHwTvyfiPf hwtOX6N1kT6pHj830MCPuNVsol0rc6NZaG7SPF/SfHRfyd4pSepKmpZnM2QnN+4rmugWM3ly vncP3bc7hUXl0H5GFle5SmhRrirum52v/BY6kNU3/KCI/kZ/3vJDs72mEUlkbFJKB8hugdk/ BoeL+ZP+1WcHzo+0OZ/WvkNdoU1TqAkyotes+iKd6vBX0/X6CkaSxLgh4pR0S2SXimhW7GB8 ACaQk7FFuyX5tQj98M/2qebR9FG/obaWyHrxEXgG9FKQISxEUP4f6vo51AplbmRzdHJlYW0K ZW5kb2JqCjYyIDAgb2JqCjEwMDY5CmVuZG9iago1OSAwIG9iago8PCAvVHlwZSAvUGFnZSAv UGFyZW50IDYwIDAgUiAvUmVzb3VyY2VzIDYzIDAgUiAvQ29udGVudHMgNjEgMCBSIC9NZWRp YUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9iago2MyAwIG9iago8PCAvUHJvY1NldCBbIC9Q REYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9Gb250IDw8IC9UVDQu MCAyMiAwIFIKL1RUNS4wIDIzIDAgUiAvVFQxLjAgOCAwIFIgL1RUMi4wIDE5IDAgUiAvVFQz LjAgMjAgMCBSIC9UVDMuMSAyMSAwIFIgPj4gPj4KZW5kb2JqCjY1IDAgb2JqCjw8IC9MZW5n dGggNjYgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4AdWdbXMbuZXv3/en wFZeXHvjcNjP3Vu1tTX2Jilvdja+tm7lxUwqRVO0xYwkekRpHO/33O9zfwcHQKNJiuqmRJs7 nqIaaDT6ADgA/ucBp38x/9f8YtKM/yf8lk09aRpTV/bPzcL8xVyb716tUzNfm+mkLdpp2la7 rpL13BR5OamLtDJpU0z4LetJy6WppsWkLNvWUOGH8MK6nBSFKXgVT0RFkt47zZR/1P0LL02b PJtOJYN/IVWnkzJvqb2uiklWFI2ZX5mXZ5SYptMqORO67CPuz9mV+e7sLJ1MTWrOPphnr69v FzfXi9vn5uzv5vdn0Oe7ZCeFyWav2Lr3UpimQkuTb1CY7KfrdwMJolfHdlmaFpMmk3E+qMf+ /Wb24da8ffOn1+bt4tNqvbxd3Xwx31/PLr+sl2szuz4n/5e75c3ianF9uzbG/GHx/uZuRqFs mubPk0EdLdwykhWKFL4t6FbfsERZYX9Hm4EdfcDId7xZwu0lM8wS9MDIDyXogJHvCCqqSVEz AXf0ULI5RUYQ1B+yZMTszetJ1Uz7s9dszt5t0syBxFnSHlhamnLSVm1emvow4v7fenn90dxe LNYLc3139X5xszafF2Y+uzafbhbny/mtmZmPl6v3s0vGMsyk9fK/F+bz8vZCHj3mbMkn07zo Wnc6syVr2IZqP1t0Jd/iBbPFpoN54YCp3PHCYcR9WN1c3V3O/uV4i02aFeyodWXqPoVPs/o9 arHJGMI2r05nsUnTSZpWJ7rYHEbcu9vVLevIv5rfvPp+dfNxdr1cz26Xq+u1+Wfz0zPz6vu/ zRc3t8sPy/nsdvE3u8b81vzwhzN3ebx1JgcNpnUJ3HANO511ZppN8iw/0XXmMOJevf1PP7h/ fGmvfnpufhutOoni/Z3g9gDMlTbVpK1B3bWj91uPbtqmk7opWAYP68DfvP3z9zJn+OM78jdv V3cICeYVE4hbR5wqwMQ8ZePztH/rzgx4ERg0KTNkPwWwp7UlH0icjurfZFTtSEeTxAnFOyfJ AeAhrbJJm5Wt2aD022/NFYtzWSILnoocUNHnddm6NdlJ8VvY7xvJAQcSF7Zm1Bc/63aM0uJn 81uTyc90Uuu1rNSIyLaMvZP9QOns5yMuOH5v9i07nQWnYl+pSr/gjJ4p9+qzkkif1UzzNssY gKZEtRVdoM9J82bSlsDpikW5rUGv7aSetqLH4gYqsraVleBhhVZfJH5YXdStuaJAa5rGjcmJ rbmOuJEbQpgKxeSIyy1D19Q1I6cd6BY37cCHNYLVH49IWtFMCvh6g7bxGqEH+PvVO7i6nZZN kxVc5VlbpGkTXb17taVT/V2nVEVTVTdTYbyqZYMwVV1DdtuYrYxL884qTLtnRedzT1VgCKpi YvuqbAYAfGAtMpB2C02qPBWCWkuQ1jJVCkdUhf5rUiZR22xG19hRVZW2qtC2uiDDVOPa5h/S tiVXxmf02rZXP70Twot2foAGvSraSdqWfu+9Z81NVG9+oN7Nrn8P6N26FbCg4dO0GrkCogeZ 5BNjXl3c3VwfcS7nxWRagdYrR6ZbC+/pN2dvGNFvY/X6Xb8xO6qgS+3Rs42cBnbQFmONUO5W WTZhxnrGumcn2yZtsEJvg7hRyt0DiTu7WJjz2fLyi5kLm5nltahrrVnkhVlOFvCfpGdXq7vr W7P6YK4Xn83q/d8Xc2TIz4v/c3NM1e40nxQpy4/r99NBdWk+aXJA1UmKkYcRt/jHJ8Z0cW5u V2a9WLwwn1AVsOterO7Q91uD2ApOuDHLq0+rm9sZ3PBhNsdmJg/MUdAtzxc3x4P4wShWuead DjNMy8k0mKCGojPMiQNXrAME9aDlrw6iza0BDOrt4h920q/ns8vZ++Xl8vZLRPUT6+CyTKyL OVZ026EnM8BlW+kGqbO9tw9tW2+i/tmnfmGpP3hfFP+GTEQ5SxBoeJiLwNdhuT5xyT2b5Fa/ yT40v7u5wdRu3r5+a65m17OPrEbWPr9e3Py6nC/W5vbLJxT/l+xWd5/OMQCI5t9a6tEXr4+4 +EybSZahHfaNO5Q3t8WdrdmNrLxPnG+ookXRhUg/yRp8TrJc5JDsa0nzZY3kd5qyvJI2clJg 0DSL2fwCy5JZ/LrAuaM54sKcyvAhNh9Eqt2JBy4vW2z1sMImm8JRad4eRtwLM5vPBSOKr4B0 6swBSiCj1wVanWFWfI15GnPp6AX7gVn6ZEqJNp8iXKf8x58r00sOF9qTNmtdNVKJJqZVNUYb EZ4S8T+qRJQmwykx6bT0pEiLkn56VEWV7xrahAMcKWob1yh9TJ4WHYavRtKiL1FqxishBrrx lRU9Mc0zt1MM3Qa/0h7tiBspv6go8B0rpL1Cz/+vJp1k5ocgEEYyA9b6Js+tFHG1vMbw+NNz ZEm2+a8x/fudP3oBeCqDWdBklDAwWvfTFBgPJO7X1eXd1UJUArcXiIdOfbA2sSDp1AZIiMFm lP380hmLXsJAR7RCFwiK1jHMt++bgba8ZPkqweuYZ9Bmo9HCtaktsAp9JRNMWab4MI/VP36l tUhpGwnbfnoWVBOb61Fl/vgyVl7YRSo1P2jm8VYfO8rTujCH9bYukseDd3ndTvKqSj15rsN7 a+OW6nKodWtDcWmmD2tVgz+V665d9HRS4v3a+m2w1iNmN1hDLPW2pCEWJKGNIwAW22RlpWgi Tjs0sWmc2LIfuYoaakipSEBJgylNUmmqSAulygNGqF4lOOVbbOOrmQqRDmnRyviwwU5qWJcF 5Ak1tqJ+eiBkk5WVBwVmuWaFlG/WluHmPmoEgdIb2qxQTdSsMZBtiAa926SLnNMjrCuqVunN DDgx6Z23GCok9phRjp/Iv4GGrBLLTCrbRKznORUnkgOJEz1PQAjB5GCd1eTExY26qM0Xx1sI M2TDvJqyG/e6d7CmKnifckYEz4nQmNuVozl54OzNTpbYL1YUzhLiST4Uyjw9sEVnmwdT64lp Ig+i7XzxaQEjrq6P6ePuTa5lj8TeirO1Fx+84jy8F3dLYMouUHLY7WSWwGk9KUXNeZJL4GHE rawYvGFS/XQ5u75G380vWrS5O3OGJeblH9+EtZCV5WndnvMMC3vR1KZ0TTmZhaVoG/yfT8eh s2gQ3doNM9+p7MUHEucZEbU3thZ3tksEet2F12xUcv5RNLpi9f958WVt3i8kebO6vFycH1GW wk+7bksO1rpuH8SXQ8+aHqAcz2FH7JJZIEgXpMGgAVgTZvGTn8wNmg7fW4643n7SyVL3e/Dc K0sN9jad4unUgFgLpM3pFCz9lc1TRcOR6LQ+QNVxVG1HSr/AQjXso/SNZB/roXM8Bgpn7jbI 289AI5QDY03dKVaMrESX0ieofwZ+CEK6l6M1HkCsHYh0AuO1A4UcQDBphQgpho9ecqAQLSxR NPK8VINqwCaStMRfdXwVZQtw8pUQxAAfBm/zGKRgEDebrkGml4Qai0QGqBcqzuiHBrnEiAbJ sh+e0gaFpOgrtF+GoKJuBXvYEhrgcFFnYvfXyfrkzKfBKNTaD/Ptct4Xf2U5rlRU+NKmbD+b y6nIkg/47h+w23UdUOGBl09dDwze7Y66lgbnpuIw4kA9MaZ+8t3Yh6XokzfYS+fdYi5Iy0Ks I674cHZZCMDqd+L+FX8owIIrR6/4sHrOEa4NggZ32woQuz5efxHxAxfuIt0g73QPPLSq1q1z 0Qdj0Y+Tw3eTpEXxxPpNNbYS3RPaYsyG5KrQAw9CiasEBhxTTTrNPSnSIrwB4vTwJmH/R/sS 2qSpJOWAyEhqdGOTA6V0ja+0ammWswaEE1p+xxG/A870dqs5Su5CjmLJWayaCB1cHHk9Lwlp lPuIAeO5d6f+8IDZ3m0wnC/BqyPW7jx8sukrbS+HkPaXhbmY/YosjU/05WKGt/T5YmZm75H/ xI9eIqi4ReoIWuKM0c3TFCnDku5k5qGuJy6yy0wIxZ5/u7zCCfw9dBPrRZXcx5P3g3d3j/L9 m9FQfeij8E9eTZqqOlH8cxhxdnQ1jo+47r9fMH8vibHx6wK32vUV3rW48199wrZhzwLAtc63 40Ycbuezu/UxNT+dLsO1bpDmZwcvbEt+W4yw39VW/CFxtTUFOvpGYkylyKQ4cXwln40CH5Ep MXBGzuKvtDY64kaqMd4Daxef7t5fLtcXokbEe1sDrQXg9uQa7uDVemB/Wsfyo8XU80cePHGD JM0Repf+oe2HDUEZHqlZhXv5PoKG2MK3Z58gmxAI78n0LjhzivNs2uaCu6yPZ5ceB+jU45SK LJxTj1PCdx1SSUM0GUWFWmmDzOpR4SDtC1GdLLy0zRJ6eunLZNBhZWEmHrReGa5ZLhU1C5n+ QR8RX0loVqhG6g46GNw2kBTuiYfZjb13gthv8e4QIssunpOHbgM76dnaCTxC3xycrnMietAO imbbYtbBKhE5zFvgAPtfFmaJkeUt+60sgm9meBQsjnh6pZvUeNUI6afTl0jV5dRb+U5AHCGO BmFY+wd8T0UeOYy217dymvNqbTAw362X7y8XwHswPpblmflwB9jD4eFy9UVinDIjF9ezm+VK T8R8/+6/iN94eXlE2O/PVbm2nQxj5ujhazwUR07yrwO+DiTu5i6grCfXebZsBE3TpuZA2mDG W4O8vEb4/Lzi0B+SyeoSJl1z0Hi+4CzB6nph3s/mRwwilDH36za0YBAvDlWIHrDhZGLAkQAj B3bp3ScOXBxvxHM8hZq86frLTZWnkdkfo1LK6wLn+hBAu0fQEJPhTsTQQ6+CYB7G0gEx4HU9 SUPUZKfRPhXXkQOJw40TPC/+j+7QLrqDGW4jeM4RRUTCm7N7EDZAo0m44MCYXV6Y9crql463 qQRXDd+0QTN5hwZhJyMcMJM7RiCQUxqiVQ+Gjl9pVzmMuM+ru8tzs777+HHB4j2LnIga5YPz 5ZozocSInl8u7eHuN4j8cw5zS1TpI3KBDwmXu3YdygXbkuwWC+zXIyELTtNMdhaClecSCw6K ag4BfSVFUs4Bg5yQ5K4DhqqDvxLXOeJGAq0QZlwEp6NpZ1K8Oaqmqhk57cJBe9zQTfeAPS6F Dht2rU/Qk3smPJl6prBnQtCaWt+NpJccYbLD8oqiQapBF2ITCfGOR8Vb81Xg8CqamZDEBDfm 8E6dymkd3yBiQUdJGjTULaZGqREa5BPDGyRTOTylDQpJOTgTVDIcx9mvkjnILSYXo3IIbD+e +3ZurI9CWKgtq9S7qZwawjqMuD9jeCHwkrUmuu1VDDIiu79lC5WvL2CJQTL6sLzkbLVZXyC5 o066Xcwvrpe/3Em0lNXx9tciiO6ueYfurzuZYWuLHaGgE592Tgw41/FTQ1mHEYct7g4xGJZY 3ojChhMqi+v5F06pGFQ2tzcbX94gXA68g7bxtR7OPh4b5A0oRhx+fa+fDhvI8e8uKn5PDBzi C72TLw/Yszv0zyY2Lbwt+QRWzQytTXZP0OwhNp77emhb1T/wvGMGVC7GB81+eXO3/Pv1fy8W l+sXZoEQcgnn89/v//GJjzetzfd3H++QTdLyBYdU09zei35+fCOHH9LpX483S4J7g2/hycyS DLe76hHxqe/jgdHuf/jF87GDPjnj58i2sOZhxY+cekjNX9lHzq3rdxJjXBCDPw7eXQ09GJ4V OAqUSS1HHzSUb0aYYlBYxUFTj8U2DUu7Tz/zXAjba8PmErbbhyxWTBd8yvbLnCUzKceOIUG/ K7wIqGwzC5CIypb5Bqj2xUzZYvGq0eNWJREuOVMe5/BBCjy1kq4M4Vn5Zob4zXV5OO5zMJ4D ZaFuXAUQf+WrfI4mnzFPePmkylgSMTlroUuDUyo2IfmYns8rShSzNZ4Yla+8y3EkJHweL5Qi oASESk3+Od+Yrm7XL5TxFPiempsLPKoz89n8qNwyaOjylO9ryYDDASKkSJqQzC59SRrhXxzf Q16esmtW0kt8jJD7kmrljBlOgHNNNxzKI4n7f2LvNyI1tDUqYV8bn7/TJ+z7Q2pO4M6sNiF9 STrFMEtseJ+XCNuaUKOm/Pvkee4GeuR5SXtqQ22+NdTG+3wK+i9sPO39sbuJ5twNkXzIDXd7 OTvRDdtjBlI41XOcH+0DWT6wd1J5MmPu6vLUE194KqO3GBuihDeE4GdlEGNSxgSQb8OJJ0TS fZFSFqbUW8OnLWc1hAdsoAAs3y7pK0UDwBD6c5F1acvpH6fczvw3IX80z95x6gyPDvOM8/Qs OVx88hcX/iLcwjNRy5jnoGbK/mn7FvX91Zz9h35hUmZGIHA/vW7D6+i1UxF/6qnDYoReoBPk S5b/1Cl0nvIFcbeg7LUNzH2Lv3MZqWYkz4p77phn4RlfSSjKgfF+rY2vzRd980PcfXJsRbqh SpHSZW0rJEJUiltzK35nTNgWrsn8DiZLfzLMecIzCx8QqDuAJ5o/MTvktWUa/eOYBmiq3Q/T vCKQAaN/BfV5+AMrkAeLpOYZTFCYZzSqMs9+fG5K2ylp8oz2cvevNofOqG2ZPrvEviadc0Up 4T5wnSbQvFLs2EU0yHwAYZNmxzJEiQ00v7m0NCmVM0srikEoJtwYv9AKxTfPDQ3SMr9aWpc2 35eU8uc2X8trO5kotEqeSqSeIe0J/c+pHgZA1YYyWfiSwVZr3AjErZkzAr/jpTIE9K7MWVLY b+UPVEHnTP/QABKu+PXzRApAJHnvtfRMvDXtc5odikZ57jWE9u0ehwRbmbvn/ixkjQg0rLXK mXuVq5qelSIL9KChr7aC2kRjTyDTBsUgY9/rrR6XdiN+SCCgTexnYuzHUvdY7IeXlRwpAGQ5 5EdERzkWMELDKQ9KJEg5FKFebIlLHYT7JDrstGXLCbgvCVnRJhjyAn7jzOVEAptHGRyBs8bL kJeUfAixZq+OcF+JIrQq6rzDfSUG4lZj5iruCxmy7SvqSkJehPtCXgACofIux1HQIQja5wiN tmbfmoD7QoM9BTaOru2pgPuS0bhPhtthPhnDnI7xCE1GMVc0x+BmFoJZLEc23iXujgS5l2fA gGkBShCg6GsgB6djiyftlcN29jrCdTZtUVqowaWo2+E5+07FctDlqAlYzlJqcZy9GorhOrxW yreOBOegXvcYbtSodPJAGKd5EBtC1hD+7YSUQAA1eeEmEBqziif+0p2ndGt4yceY7ReGA4or xS+7KDZVlGNQnAQHDV5mHSaSyFD6NdgYrHxzDKfUHg3BDaw+7hL2nT7S+u4o+K1lJ+M9dtu3 79uD32SNypC0O/xWwDiEVrFHurzj8zj8xtfmCTwfPoBydPxGe9m4H4PfPMURfmu2MWe3mwf8 dqYoCzgD3gGPgdMYZK4JMgJNQAuBFBbYxHcVj+pdABHl9SmBKwKS7AN6Y8518kxfo4U+ayHN iovq7dce5QYUsxXDrkMxfrVA9yAQN2o/otwA/PqZNtBmIB6/YFmQNbDN9kLCNS0Hv/7D5oAG ydccGkU+DaQMeItfaOcX2rUvuKZ9lKd9RfIMbBae1ZJgt5CjddKn5OhdrVlp26BqSK+UBXsy Mo2EeJRuiYAwe9pmt+wAwrcQL0II1Mt43hrBsl2az9ZoGmqH0ONHCbt+Pi29T7ngcsT0TXJ2 cOmv0AEf0hPQAK/ye65/bp8nJL5AR7hzTeeRoFN5BNED+nvPw8fc0Cc+2NsrLYX4zXOvtMlv 9c9/8ofS8TNKCw5X9jU/UIAh/4OWO/PFZfJoAS2ub1CayB/TaTkKpPg40i5ZZkefbcgyTpCA pX6HxAivSbNgXXoHeviFdcmhQ5Rycta2sHn2IiolcxfOF/ag3JdY8HG33ENOaGLIqKknCTlx p1+OvqfcT8/s690t+izQMnMUu4eVZBkjRkwpd4mfntuFa2QfZ/hJlLEdWxkzuUcYgi40Jojs cqYqYj1lkwteDlnnOvLKjTNPFTdkKOhDx3WBJ7ij7BjzCvZk2wuOqfVlX15YTtXX6DzQJ+Mc fa/mXCgpMRdfr3yBZAwzognlk2VeDTZCsnYc48fxozKQl5H/beCUsF/hQONbOjrcer93mIS/ z/6umjMfsWTbXuFh5V6ZFfRzmMwqdIpYgJSJClmPrnuZlXg7o2TWRGXWKHAs0oumDpFZkQU5 Z6lBcb3iNmTFmN8X6+A8MWY4f09kYwfwqUosE+K+H/JMgXu3/XJKJLXytVQAFgglWCsKVNw5 24QXO4jk4zI6qZXAPC4vklpDXhB9QuU+JwkkdGIrHORIjWUR36BObvWNlh1MLCZdbwW5dby9 Ii3QLl5hW4CT7XUnt2raSaTs3mI6cKkqD3JrWUvQYs0vmRPIrdTmLB0oruUZqdvadGE8bAT2 OpZb5Z5Kqq4Gn6rRdrprWJX3OHnWUdPJrdIKrVuu9sitkaontj2UzAdrA43l1iHD0g2CHxaG 0zFxJLj6rH1MTFUbTNxxRsTEgdSYWzz5TnK1UjT2B+HIRj6DGSRXtT+gUI2PYqJRHiW6Eol5 iqHGrXg94dXt/rGkNkx4TdTuIHurlbNYKe3fJzBAlPfR+1QGiMEviLvFNzD3Lf7uKQXYwtc6 1YtBAqzEDizk2ERngODYQpYSMT5il3ECrATxbOveBzO3YPbTGCBoMnCS9oLUHiPAeoojAe4r GyBgDRXpFN7SHpAV14Am1USEu8BT7gKfyAFYgVuBZVxrDZoDHgPPaRkQHGVAdeSAc0fALdnK 2p5/5XSg/AYVIrj9zB/eupQZzl9BXUKET0vobJuBPCvFxfbAfVealkvm0sl+NEOStEOgv3vB 7dJV4Z7BVY771IH9R0qbULPNFeiLecr9cTW6R2/d+4yrWqwbVGTrtxK0VmuJmAzDi0RUxrul YU3uOjJ5eda3xG3KTsPwIpPT+tocHy9WaEjFOOHxYiWfnWZbHnoW3eFFFyKRsH4AA00cBBcL nCsIZdRZOIg5qjnRPuuzPDKkDDrqlMeinEICDXM8IsrDwVlMFzFUzDm7k/FBow4qikAsH3Px aLVwGdYZxbmV+DyqCmAu5HlgiJ+TqzzKsRTEfi1ooS2htirn2RKa01XuOiEgEtcF1HSwXwvD JAOvWI5rHOY7lCf3FAFW2LI7nAi7BJzYVFOo1lKNOERG9o0kbQDgWrdcefuGXMc4UdKKAH0N LkXdihMJ4mU/EKb5npoOJwqlihPlag9O7MQrcVzsxgStPR0emzdGjUln3vBs2YFEnzOKd5Pw +ph3HZURQixCVs9BRfiwFW1DAIio68DrbeuFUO9tNgYgFoxvg7HGnZV5GoDo9PCyQj81QPT0 bgHapwKIg1/wDQBi8HfxgHSPhQMzpKgNvHsKnneNeDdF4NDM10M+uCJLk8gnRG6p+6H9jwoO aetjwaGjOAKHw7T7f4ZxgRDAM/TxqA65psO5Xj4X7T4gLWjrr0AdYDh9IC4K/uCxWPkPAuIx LQ/CqxLBKJTRfFCMYsExOA9HSSJFMnUFndyjVdvEKagfF7QMkMX3w+1f2kaKa3l18vszG26g s5Wop5j3BJIYu02JkZxPP7uXG/fyHUr5HTaCFa+j1Xc0mPFVNaVmQQE3nNJRE3rDaj4TV9aV WjlFuiZdparUdIrST6vtV6gilGHkRar7VAK0lt7jekOrUDI4vTEMP/oZg2ZlKsofG3rGjg8b 2QC7xY2AV4ZElOE6MtpTooKHIKeCJw96+P0LWY3tSrmjeQKneVQwMXni40NKgHNUwiJtl+cK 3ghop6RW4h5z99yb6SrqoCP5FbW6LS12C/conUiCzpVXuT/uJTfur+wLPKY19V7FyPCUKyaW AWaMey/lxkwNPNM4fhmdoh1oM7KDDHcoR1woSwgXWKmcG3LtbzN1aQf9E3IgneuPXyYDqRUX 4hL9JQ6nMb3/mzTTfPzLHhcNkkZNSIEDJA0f+7as5BCkDYS7JWlgxGqI5bRLnw70S1HdtVWV iKq8lq8/SEAtm2XjANusS7IKCRJJ0DT2h1xCBEoeT+D92y+3UdulheRj3I1w1pc9uBYfITS3 vSTQUWOh+aaWuD2HwnI3elZeLYKbR3bBVzon7EgjaqDgOWZCVgROQ16Qo3IizMvX0zrXm5zY uHjDixjQleKcR8sHeOmiLo9vRQAEojMDOUIMnxLOOqpcBlUFwcYXoqog/YS8ANrls4dSeeem lHsSImgfSI1Qs29QVLvrmw7Ih27opKvhxwWyaVPhM2hFH7mmIUGssmkrMGVTjmkFsUrmBp2g d2Bq+wzTPeM7gn31e5biUah1y5UTq2xuJFbZtBWYfA0qZGXUjcjo7vBOp34P1ASxylJqxSp7 tUesukf9LkcIKzlqEqnfB41HEnq/4wnPvZ1kFQrt416qUu6NuHIn9zpSYzbx5G+o34UV8d2J 3P/FRbKB9fuIOUxB613ygDt93vL5EOLRbgkrgqkOdR07ovb9XnqfSrga/IJdwlUGHrDi5HdO ++4ykmf15h0nKO1w/w93woU/BxC077mvDchh37dHypL1KpUvsAVBC7+ygpg2ImmNPVXncCOH TiacJYrcb1hFJKzdLlQQnwT4d9AHCEXlFr0GxgCh9BqABlr5l+fJcE9/HOIIUV1K2KgeTT1K HMiH1ZkcciSEfnvYcu7n1aYmNHn1jl5v9+z0I0/6pS1n32NN6Fh8YoGNgyRsANiuZZveDVD0 8yA0YMfnQTrFI07bHJmLTvkVOKRLFut2pLB0eWHnLSRqqpysi3I4q1Ti3Rrt2Ww+BEbDihPt 2Sg+sZlWeECw/MFmxEgRWw+HAT1RPh2d8vNZ8Ybtngr7dag4ynGvl5q83lOOVEEmJEV5rjEB DYROCPuDz3mUNlSip3ptKNc9bajcc3pOdpSwbQvLhG0bZAPdbnOvgbaxNpRNdOq2bbny27Zc x9u2pHVznroaXIq6vTZU3um27bRx1IRtG61r7bShcrVn2+7AcV8bSljstIDDom2bT8WMGJYO RvlhgQzPPiFrEAN3oDOQEDOwJzXmli6vpxTNEaCKFgwflKLMpKxs8scpRcWxqwtGcPpKUUfv Fs54qn0bVxDbIQ++YNe+HfZTv2+7rfdxx/YKv0uH2gZs17JcTVlGu+3afaHpMVZzOXIgZ2GD mmfbhfopreagHlQMj7KaO4ojxRTWmnsARnzQ7QzFFO+mowEVop4BT6BpIgtHRdXocENvgzbI 1wfAH9xFcwI60buKS/RZdCyq5nF3E1GJogzVp1Ahka/Xmv/Cltd69FktQ84YDRGeJjn4PuqE HQrMHdrTzgVSCIMkmma/F5l7FaXmQQ73f4Zy+uGLqo0gXRvJr/Qff5yKCYM3xS70IXX71Gr0 eZ8vhc7P4ztasf5qWacZVdUVOkvr6ry6C1SN6qQ44jNbC0cii/ugaMwp64V3JBZlnxCtf2gH 3eVOIN6pHzB4lTz9XcAYJP6NcoPIRIBE28NXH1xoajeaPXy6OYbCgg/jU29U28SnvdOI3WYb XQ3Bp0KnQACAacZ/PXza2g8ejbbUt/YDSzaGPNuhprYUaAPwKd7LFecFmQyRTslnRdt7KBbQ aE54EfgDUOk9O3OsBa0cKYi29xzDAe6LYB1fzOQ4CRJWIbLW5wUG9RYaHMBIQkasUvKFYoTq 8wLQDJX7nMRTEGuUPKER5gjNCQg1NNkj1K6vOo3SGAWhKnwIc+P9OjO5jhVLklbsiS6pQ6jC NHSq3snzYK/P8sLa6zu/zoz2O4QqVx6hynWMUCWtmNTV4FP5NCiW5J1eseSpCQjVUq6KJaF5 D0K9T7GEwrOSQGARQg38s29YukHww4Kk7Fi4Q6ghax8LU9UGC1PVDhb2pMZkdXkWoVq4jN1U GLeROFIBocZxJcxhcSVyXASINOI3r6cBqMdULN1H71MB1Hs7ZPMF3wCgZmx96JEGuXXmJQKm iPhBnyQGDGKKP+JcIi4iLML+ExiyiW+DvacEqLmFMo8BqJ7iCJsNOpb3Eosp6EHBJbs8xvrX DiyK4T6ATsoocASccI27I79aPi6DYQ+AFteGPZ9x1LcAYsJTYCsgbFweKKZIz7oNOIC7YeHf E2ZBVjJZPNCgTLvg6IK/doPU5Luzsxh/uaNrCgtpAbQAsPh1Z974/qYdJQWFcTHFnvqIw5P/ 5Fs6BJJZn3dUoIH2/42QLAfARCpDjITjYoOp82QXdzZD/aNRdQ9DZHwgkCBDYtD0ChdOvWhW vJ35vA5Y4fSZCZTzOeAonMYkxknIIoobEfj5CHuMyIgAhhIxa3mfUxhmOIqhvAoawyRkRIgs 5EWILOR5/MULXeU+h7ocCTEkc5TGe6xvTofIfJP91k8DXcc8BpGxnQREJtcxIpO0w13YjILO MINnAiKrSzHBaSm6f8PUV9uYYGiRiZ8nekZFTXIdIzJJKyJzNfhUWQdEJu/0iEwsWEJNh8iE Uq1brg5AZPJNP7710kNkA0alGwM/KqCgMCqjOJiqNjiYqrY4OPeExrzS5fXwmLCjeBj4KF81 kfMIrdnbX/GMQ9CWf3gVDIhqJRGWwb/e2+T04dh99G6ipUPDfN3bIZsv+AZwDHgyGI7JSsW3 hkW97MJ8ySlMWQUjq/C4QzacBBXxNzoLe1w0VjwejTmKIzQ2zI/tNZDKqX5ASqgCRV9onb+S Z/8DwuCelhB9ELecvxteZYOABpKuDQXke3Qs0Nh0/ehcHiUQQmPNnttNx9YwQFPqz7MsgVbS NPMb/gK/XpgPqvSS3iAN/rIuebeiDQQqumy6ZUgXeJRIlOppEAYFJA4bH++PB24VIoRU/thx 0rP+EO4y8WcLo/UHykE6CJos+Yq7PKXDiX4zFHvLDQuKbWAyO+zBSdA5Dv6Pe1i5AHAtXeW9 H13SsY0tmXiHRrBseI+rQ8mRo0rU4d6mec4JURNysIhHQbnyx5VT4rXS4NM4agTwH+PTpV4e Hz8EznnSzQBLpNUmC5G9TlJSnXsn+FwKaPe5trgqxAkWfrIzK9R0oyVdl7p+0Tw3Wm94jLG9 75VhAOLZ69jH9az740hzFXX1BbYeIPzwNYq8C54pnbojHh/a3U3hZyZ9QL9AJLwgfUVCGs0f Jhy/8AJ39H4vNN+vyhcLOkVY0RZeCCd2Nazjh3fUulhPnLwkJpF3PMufe9ThzBdu6ssWPhKf DCSv01x9GYtGyHnteT905cOBbuTrZEX4phUKuPvkSLMhR14wuLzZSYuQBHPQbfxa8wU+7Jon 7ENLhH2UUF0g+L1m7MnSh7S2a3iELJUu9XYcmuLc1UlDtXOkFi2sv7tcv2NCvauuvvNCH3Je 4ZA7pt84ZVvWeRx6ZjcLbvabfjJJh1DZzLEhnCVsMZKzZFHSfuXZtUutiWJDciEtU7MbKeUX x0LO6OIZ2IeD9NmulNLHdyN53FU92P6iaooMH01BSZ0FNKuGWIn+wvRhkWK68svy29oNgms6 jmsaBkmcLiUHNsFtCVLJ17uao2XgK+5qDfqrZWChIaMtAU0522hcOyKgM+w08bs3EAOpvBQV D3sQY0XT7Igl5EA2vz5HrjUn2D/JiWugCeTAt9TJIFGP1Jn0niL2ib5xSAMdUMhE2Embsmsg LsBD4MwPsBUdDxUwGlTz64ciIZ9u5gCCdjn0cpe2RmXkWQaZHB00WhYGmaFz1zbc185n9Sl9 o5bXt8DIlGeP4xfO5VdpYHenTpZtcvSX+QaFSpXWwBpEGW3LwDgyEoiwxsKC3N7rx+HWxv8P Kp62IgplbmRzdHJlYW0KZW5kb2JqCjY2IDAgb2JqCjEwMjIzCmVuZG9iago2NCAwIG9iago8 PCAvVHlwZSAvUGFnZSAvUGFyZW50IDYwIDAgUiAvUmVzb3VyY2VzIDY3IDAgUiAvQ29udGVu dHMgNjUgMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9iago2NyAwIG9iago8 PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+ IC9Gb250IDw8IC9UVDQuMCAyMiAwIFIKL1RUNS4wIDIzIDAgUiAvVFQxLjAgOCAwIFIgL1RU Mi4wIDE5IDAgUiAvVFQzLjAgMjAgMCBSIC9UVDMuMSAyMSAwIFIgPj4gPj4KZW5kb2JqCjY5 IDAgb2JqCjw8IC9MZW5ndGggNzAgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVh bQp4AdWdW3fbRpLH3/EpsE8rn5NBcL/MW5KZ2fXO2VlvrHPmITMPtATZTChSISl7vZ9+f9U3 NEiKAmDRxsY5ItAAGtXdha5/Xbr69/C/w9/DJOX/iL9FXUV1HVal+tm24d/Ddfj9T7skvNmF cdTkTZw05amjYHcT5lkRVXlShkmdR/wtqqjhMCzjPCqKpgmp8M69sCqiPA9zXsUT3i1B751h zD/q/p2XJnWWxrEU8M+dVUlUZA21V2UepXlehzf34Y/X3BEncRlcC13qEfNzfR9+f32dRHGY hNd34dXr9b7drtv9q/D61/DP19Bnu+QkhcFhr6i6z1KYJEJLnR1QGJyn6w8DCaJXx3ZZkuRR nco4T+qxP20Xd/vw5zd/fR3+3D5sdsv9Zvs5/GG9WH3eLXehozs425HCDSOHOi2zqMmSriMD f6jDZ4d6sb6F4t8fl9v2vl3vd2EY/qV9t31cQH4aJ9mrYBALTKA8T/iicgbcdrmh/DwLdF35 4jzZfTUF32HBt6+68hmeHErQBJ7sCMrLKK+YGvTY9nooOPx4RxDUZ7ZgxLySVVFZx/155YjZ jkkLJxKnSHtm0quLqCmbrAiracQtHh62m8XNh/DT5nF1G75rw9v2YbX53N6G+w98wzeqeNve Pt60lLTh+vH+XbsNN3d89ztKFvsLfixxHaUpE7lt3Hw+lrRGPlb2Y9Ei5ogVwiMuHcwKE6RL xwrTiLthJtwuVnyybirftduP7XYXflh8ZPQ3oTqPwvDvbdj+z0N7s4cBNo/vPyg+4M9yd0Fm cDOnad6MmIHxb7LSzJxzY4ZJxO0+LLbL9fvw03K1klnhfrPbrz6HjzuZGDZhu949IrZlXljf LtY3n7lx/yFcrMMf3l6OBbKyAVeWTHapbtRIsf8dBN46VPLiojRrsqhqityRN1WUPgnBAwfB LdgEuBUV0LqSr6MpUtBukTdg7Casowb8btE2oL2OsyaVO2puidPAHgisTqo0yoHVYRU3URIL dm+iFJ7u13IWyE2YszphnyRRkpRGtkKaYPbZTKjTiLt/RK5ejt06bWIaeat2t+PT3n9q2/Ul yYSzily+imlkMqFMVMiiJi7qOs3h+Cxt8iSpvaPzilrNJyjzjCF5kKhpp9Jpv+WnVdukLvmY BQj1+7CHiY/Qxm4gQRNAetIkEdNOeUBQX8M+QsLRcILGgnSsEVHRiF7V66E+QfRQ0FP5T7D9 k3Ovb/7QfMUsdZKvEuGeRtRqO5fmUVUyt3a2CmUAUZP5T28pNox6ssK3Px3ZPP7QVYS+VtWx CJq6qqIijpMww3aTN00dnCgLV+FbJfe6GkT/eaJC9C8RJJlwn63QluXptLryRFWqiHN1xYrg MRUizKLCb2q/YFxVGI78Rja1KhjXQvuQbl54H6qCIMt7bVMWK5G3Tm5bFvHldoVCZ+X25SRu nMK+cOVc9H3U2KhIsSpqfV9DgOfNdnkEBEIn+Uu7R9zebTHrtAJIRUNtV58FxL5ZbPfL9oK6 SVpBeoFlwLZhkMA4Mfu8lKXR4aoSC2xRMBfNZpRpYlU0hu2Y+4YZZ7HQDRQeE1Co05zLHnGD Ueg1dpGntObVcr9ftdhRUK43K+FKsaLc9Zj1oryZWyOKbdx8eLNErpTFPPXmchpxSkF+9/lw 6mF++mEXiq15uVmjQi/X2FJu5CTMovTw7stp0M78bJs3H2YQJ1GNz0lPVPNSAMtpxCmzGTaR pXiW2t1ehl19+SKU1u0nzu822/tLmlDTOouSKsb3ZppgBnxo/wqHKj32fiOYVUtXLEEyGQfP O8mYFvtI/nldJ2vqqIyxZBxQfF7XuaB06GRpjmlEbCyzZNFpxGHAX4tE+hzebsKbx+2WKWr1 menq9f5fd+F6sw9vVu1iG26X7z/sOf8UfsLkbxlB2f1Wq68xX5nmzWe+EmAvdrJ5MsMk4oyd F7Byf893z2y1CO8eMQBrn5CIL3SXdo1pePOUF+CSvJBFcZYX6E66dfPhhSxhyur7BZ9XXL4S pJ1Em2DU23aHf/w2fHy4Xezd3G8+efEJwB9y32Z7qx2CLb6iz+G+XV+OBzLUmaQqULR0s6ay wLGV50htOLKXo6tow7no75hE4iStmrDEFVEyDWTY/mPgi7WXS33Px7iMFY6dLErTiD5IR4rz r8RzhriRc+P9cv24R02faO59Hlok+DTKrIJ7phHInHctPs7LEVhkURaX2SGBL4N9pth5i1rc MskBQYPV9l3b3hMlsNHTxeU6Lk0leOWw3/rW3yNz9IjAqv53+nzMSJrFUVpidulzmum3I7/W EWmr5brVLtXNQ7tdEFcV7pf3LTPPQowJgLb3l/xQOptB/0MZzYfH86zRCLQn0zd+0zfH1vQh xm+ZAvO4wIZbV8rY2mB9PSgYaPbWVWExY35vlM1bVaUK0mKMUTmXUMcA55M2oQtBupZstKlb YjGpqmubKugaO7BtMhnjDpOqurapgrAe1zb7kG4blnxb0GvbWcP1Sb1QQkef9oF1oi/Jojqr +nbi5z+p4aLvgLhRYVjlNOIkjsqEYNlYGwHji1uFsn78tzcSuaDQlkRb+n60QEftnjQcHzRE Cchn4smAFFGcNkz4piFTEdZJgo5A1vMyuxt2PvF4RtGABR7HuLQhYINndmYBYMSfVfQU4Pow eNaPSr2guKzqKCsJsOg3YgZBnzK34U2xH3dP4BxJyaFGn6Pv4HkB7tiO6BoCYzSSHTXICcP8 X+9+xcq7Ux/voTPqYiAyzRpiEwl76JE+g55E7BSxdTj2sdkQz/zJGeVoaGVGGShIijJGZztw OM5FkEwk7jUWGkIydSgv5jsJ1xPZ8pR7ao3Vz7qmUN8vqbmjGdc4e2zDZiNYiiJhecq3n3HK KMsblNM+PU8Y6o/nwgtOhs4/Oo20rXHDP2g3PPOihI4vMJDgFHnYrHfLdyg1eEIE4CyJLf8k tse77WK33z7e7Ak0vRxb5jGgNSlsp8+HKXP8NsS+jzShDAe5E6BYxwbTiBMI+1vbPoj36/FB rAJiWIQd/t5iY757XCuHqFwV/lCRx3sxKBJ3vl8QeyyPXJATALzKvFyY1s2HFzKMnvlM/eTF NOKUSRm5tGDkxbKx+w7H0pJpYPFxs7yFB6YOtI2lO2VOOI8LWDIYlRIg3W/SEVAxqwYDvWpw 8rT7vOqT4vMqWGfpCDIc+YRIOIr/3CDQV5vF5Ij3c10pNvCndfUUFE9AXteVIymX8b8YPs4I fMvjhjm/z7o9hHzUmSPGub8Kc3ovZjG6UNJkjtCRvSi65dRu/AKqU8I6i7rr3m89j2a4itKy 7phxpEzVi6D+cbX7xytk1Y+LWx39cJklwrmTQl/InM9YXvUy7vPx8WpCLNEjMyrLiCE5DGPW Pi752OuGiD53H6uK8wrjdxdkrJxhws9JRvyEuzFlGa886W7UNR5FyboHvnqUbIFjQUhWXn6j /8/FtTuNNtS9u+V7QLUYn4hJA1l92HwS3214t1gijTfA8v12SYlx/SKbNTb/LHdPFczPyzu3 fso07FtPHJ0NKGFxQcEqqznGehTTiFuidhGRRpjHzYf25jdB3aKBaWc/2hnQLPwELr/ccKfO CGlaMGi8hzrtJug3LlZuYpcu3oG4ALA47N6j20rQhKg8NwuCQo0cJhPCeL/IeazlQjot1YO6 8QScOZYYR314PibCrSEsxBtXIjkO1hDq2f2lO6D7TJEvRZ2UpgOGwuSvpDMb4kbOIYvb26WE CbMuW+OQEwN30jB6NHbPz78yfmqlXjGN1i/RNQZQZ5ecHVB3Hrb7rjIUFklwc7K7kHl92D6E ILPkrE9QX188ttMdI/LjDw9quogD30n+MivEkpwY28JfH6ZLxji468qs3pJH/dVcWCqyiRUV 8N9BVbISa4SDW68Cc+3zT8dVI++VatxCrrHN0uvBeIo22UqoEVtzEegGXWwelNGt6nqqHDj5 fUyYTty8nNcSS2Fdt4NX1XydeXkicf+++CiQabdYGgfLp5YYp5VCzdqZT5gOodW7/fLhcSVQ YLchfued2Luwg/92OVjlULRt2Yz4gGRbiQ3cmB0fTCKOsVzctyzvkFw4x1P7S31LSY4XmrVS Yc7a1Al9CJxfLbaCSm1yF9aceZ7CB8pxyKjcHrctYEPSeVyOR63XxbZmPiwKBHJel5mp+5hU JtD2biEpW1DzJFSbNUhLlhsx9L2laHIJDvi43DzCFHpdWnS50SfyBN9W2YSmRfMZfdLK5WLo 0nr+eWQ5FIhPQJad5CxwSWQ2K8rc+LFH3ODp/Bpm00nEJPvIihVFIhMXu90j8tEozztZJyvW B+6QeDhlqsL4+vprLC0gV4nq9PmwZV5EpY1P0FrtXEyQ+RTStgiY5f5zXxYpd6+NfXQiKHxo F7+FoljqXHMXNkASHqtiVHSz5sMAWRnVYk+Zo/0xn0YcoR+PF8RLWKDSGCfUROpWssRxc48N tMt3eLu8u2MZL2vg7hY3RORjFl8tf2v/eEFBiWG0zmoEpenj+XAkOfhicfHMRlJiajwM5ZvN JDmJtg0pAwxo73jQmufJzLn4iLdmQeTU5fjPGcRz3YL5sB+JlHHj2wlxBkAtxq4jy//U9zA3 oNYjbjBQgwE7rKYTvkqs6FrrB7sQHpT14fgJ12SGvMWbtF2+YwHf7eUYstMcTJNmw5FkViT7 uPUT9xhyiAn4pJ2gZwUWh/2IsPWMvA8Vq2V7DDmX2OaJxGmGxDQusx9r0/f7xc1vVrXV3pHL IYoUrSBLkopEYX7PzmDJRFblJOR3axRmwHukzklcJvG+P+SbBPpn5D5Jnsgk3gV6XT6gz+n1 Gea8jEzi85m+WDPC0hub2qTHQ10PmY0SvoblI2MBbZlYU0yfh77NhJomEb5lK+EPe+jZvJLD ZnjxOp6PUu14SCLFXP6+fg91Q/Y1mZoVrnFe5rNh6rRBCZxT7ruUrBH5+Nx3P24fl7+u/7dt V6icrcRMYwrjPxYRkqBjF/7w+P6RUJ6k+E5tXqGuhRcEYTbA0zbHDPiIeAtN4tB5ZILvUWRi UZBIwdI40nTyyxsJ4UmSf14OULi4nQMSD2eW/iY1Q/vsS6zOKZlkS5eXrz+zfM25N8HXRYrh c+QMmeieDq/4BYGWhP9k0r3V2X1fLNQizWOCQ8KsdNluUzJQS0k/H+xhCP3JRLzyKPllkNDh fUACMnuiwwhcSvjnQrYzMggQEKHT0yd1kRJqcVRGlIRk2a9rSSwsOeVj1uJKmYQUUES2G3lU io6qW4XkXw1/0f05qGU0RlqVMaNIkIR/SpAEp6RVNS2X05z4LnOzuto9K6+WxMYynonEyxVM tRn6mLShIk2OJCnoldACSVvAsprK3sRqaFpXsfi9SthWpWZlqFdC0oFSQHbQlaGEVrJWmars k2VDihk8713lZcNaiFTCqA0BruAm4O1RKddc2SoU9wOrPtgKyz4oMSRVRZi0q9yVVIaEgM2t 7F2VrNwXUqUu86RrkKvddAy3GBJsT92oUUzDT0frO04yJ7swaa5mQ66EMeydM4hZwjY+BYE0 wvnqnixhKRNLHSV9Gsml1RkeQQLBm/BGn+cwhGScFjaT63lGvBJrIwNXm+g76lVK8QnTPK1C OVxxyODlrD2RU/kO3dPmzNRNl6mrYlNQ75ZHudtR5ipylKu3uDPpKOG58+m74cVuFEjFSjJe eqkrOjNYsIdhhacGi/6yXGVvOcPWgeEClmZYdnW8QkWuzFDps48r0imthGlS4VA+IOI5WByA 3xRjQ0LqRljvUGC7r1ImhbhJZHuKRgXYeaemzgrTXpPZBABBVaj7zI/eT4cMFXzkbNn2S3j1 lu3aSLUTXhFhC39y8GAPCMfQJeZScLW2JUhRde9f3VPuEvX9M7z+D726YwS9BgR19KrByxPI 11SznlNTffUvHah4yRf43WIbmNkWf29anOiC4Cp/4kp45Z6xlbhb/2gqcQXm1uDK3vrmP/3u kwg36YYyQZrI5BWnfMwJqdIa8uOTKo0VJjIHeNGOgdi51L+zC8wss8RoiZ1irxBoJVaurFJ1 6B+DWdBOHNv8iYHPwqvVq7BUrMMxA1/YY5bMwUk0twqlaY4hSLbilqpoMt3ugzmrYJir2H2w T1OPkiO48reOFWw44DeEKxXfr2AMi1UkWxAz6uAdAzRQoSNk+wEJeizKwO5GYOoZjFYSXo7o 0FteZKzPR4QflVFpwutimYRkswUkkJQgvHO1J04SyZOq7LC28WClAcwh6tAs1K4INK9XgKxr 2EKPO2wHUKBWcMqeDPYpynpPQdtp5BKUyO5MXFoddHFF3iTvytz8XRaskhJbji0JAAMAaXGX uDISKAKHQEYQYO+jTLaBJMrMISN2rSAnv8MugT0XoWahi7nFRy6myEk5V7FXol/vAxdHpid5 XGOcLHQN7igwPUVdAkDHQZeSND4KahjoYs996GLLNBipgPYddBG5q8SZgS4V5mF1bqALG0Id QJc6hkcENcmBgBCgixx60EVOFRixT5szU7eFLu7dBro4yhx0cZSrt7iz8dCllEXxRCD62OXc eHXY5enx8tCLu+kEZ3eA2zFDx7GnONuS6rORKWNU+wgGWRQLhD+EML5Mkj1vx0CYkqCYosvN 2UECEWxTIUygsYzDKVbivgCEeZLel4Iwg18wdwgDt5RicvUgDF8vAsdnl3EQpmSv5FyUAs9z /K0hzAFN/58gDEhAiWfQwguhmKDB7uHJdEFDHoo52FQPfNglCba6mcy7ZZ57RghTIsLXGiFs UTe3YTBqUuCLV4I634gPwp8TSRIAqvbFODAkQcJ4dWNIIacnuYWsDcIW+DYIW+ZLclvWCW5b uVeiKZCqnKHCEOpPwbY5nSTX3eJBCVNwE1g5PsaYpM0BhRiS3OHKsxhwRRsT2HsJ+S32AzEt 4JhR8t/I7xKzljJTGPldymZQTYXf1xgyghJFWUl49RZ3ZiS5O/fEuStTMt3VKGeBe58xRzh6 jEzHoaKpdTKd2UKDBjmYIMkFnoKOPSMEWU80X50YLk+QPzlcHVuZW86wNd2n2NozQrjX+/DU UOlT5Ir6IhwWbWRxthPhOSqUbKD1JWaIkjVLtbOBz98MYem9mBli8Au+gQw39ohhZghlU6s7 EU52ENYy8oFPtkKwySrG8V4ewSE2iJ82yspwjyEG84P5wS6B5QGUlyiLRK7sD9goflHWCRqa BFeFuoprCnvFsY3iyGzbWSwKbGsFX1toKe48dzH7KhzaTQxWJe2qs5u8BnZCGRnZwj/we6N/ FvITiDWFMv1X34dNhRIxxBkLHWf6CknUpQJCgOUS2X68HyIa5Zq5RdexVDXRY3KfgGB+dE3q 5e5uypy15kxPGPtRiTe98ZPoxwjXAd3wjvZDIUQxciwDVL8QmgVXH6CHS3KiKOSvLtE3vdPP mEd+oCHc8JYfntF3fNJl5HB8FXDtVpfqOuhv7vv9UVeyVbyiSdF3/aw75q+6itfqur5yu3hF KIAhyyfoTt200XVx75jeQzSRMc06/EVuokkN6L7lXsZWRlAYiF9hA9rKDn1yRpY390lggBNe oxQKLVdwRrowzvkwhLl4dGlqMqeEiOm6QtoqTwvLcBt5BfXBvqt1SIsLtq3MxFVEFL7f5lPQ 2H0vV16uiqcNh5JuDnDItiZjqmakrn/tjNQJWzeDWg5skizmJ80vn3u/ZhmoYZ/7P64+6u4z 32Kk+I9387XDgzCU+RT1R7qlswf1Jh5GvIkX6U0WycVqv6vJbX4l7QuvfqDlTLDybQrj0LLA dwuc7nE7rwCSmy6LsXQ4e5YcfhnGLu34BXfGQrwXvNz8wPOcyOfAz+JGmJsDRmFIL7OdN2F4 KVuUGGrMbH+eZz3GetoibZHVWQc6qtD0hP6CjbGl1rInKFDV6HK1RD+h6gy1SCtLdpcpXyyp 7ItuM+kf+c/P6HKB05zwgJOYr2eWtUU+7LVlnfImxvW0Sj3VjeUdOCp7ZllRByuCiX19Tl5d Jqyfd7oicJeUW1Rl1DlzjjbgjKK2yFPmbJFT01zFtoQKzes9ryW722gyfSxuGqPcO9pbbRts KQhkZxzVU51ZdrQ6JwMu2hmqs9K27DndY/UxxlPfo/U5IhdEXzKOZTpJ62pGuyOiMFeWXfFD xXwXyjNtXdRsOW9Ms+rIaHTq2NPm1LnS5GwNgTmTFAfaUuvea7Q4R5XT4hzV2v5r23mkz538 inynMs61KBb06St0Zshoqh1aEvpr/jszZOxW4obMspYtoirHfrbMs0zYyj12P2ZuS2qfLEP+ gWWWDIJRnmP9cGqdOCdg4fQQqI8yzeJuz8Xroa1tPdOsmY59/WWEd1mLQuVVJvZO/b6EadbQ ezm1bugL/G5BRqgGZsgjdfD9RbzL6DlS/SC1TtilAcp3ep3JLZgcsstw73JJbujM7fdIk3Hk PSHDfd/yZL2uVNL+i/Q6Q7Gn16HYHtJ8Qq97g9aGrgkoBiuD4vgL5OMvuhh/GXCu/qr+gtXB IPoqsI9ykCB/USTASWwMylV9v74KaKFE7gnMU/oqyJFyXZtRft+pIk0E0IfqgDpUzQODAI+O SinE40aaEa8TiDYZ0Al/A2jxTsjWegXHkM0xq845RknlL7RQQoAAx1AKdXQFf9E/+AvVYEb9 FK1x9+j75dnAPEUnu/t1GIJ+Step69Hvott5Ix1FbbzL9cSZYIQCp0LNEgwmaN0XnXfhlIp2 Aojul4yngM0lBIkCxZvl51Cf+pliWvyGH5oT3mnV3TyzP1DKPOKf181lJxAXTD5cZREdROjW GokQwgkd6ewTdDMlv3FBsbe7bh8RkM0VfZu0mrv7iJvZ/Qn0T4qyBseuJt30+Tm4raY2q8c9 DbftFHYWbkPVNLgtdBq4nbCtkkrBZfA2ZlQJWh0OuBVQZw7GJqsCOtOmCszZEdp+JvksUQxA FpX7OE+JWoVIXRRI3mZVJOCKGFDCQlRK2TjjQMqIdkgARP59h7Wp8I9gDB4Fh0gqr0Ti/1Tb /HMQTZJi/Jbrqu3qXG4093Pu3w+Zp8M+IJqgUvi+i/owJTziAJgtcmirIAIvFrTUlaTEJaj1 Kp3CURAZyV5fPWdRAQAgZMkLWC0AlMRauqCP0BV4ziJX5usX9kGHOV3lXokmwY/7QCvSpHpo 1TXIeYtsm61+4XqqUy8OjSygB/uhggyqOhZWV3oEo+T8ROq40yeEX42nKMkwIkgoqfIUyccB vtfHOTjUeIgkM9yBHpGz8kDeE6BZZEonwNihjn09Qq5pzcHWYM6o2+gR6p1ah4AuQ43TIRSl Sn9QR0N1h85PV8j2furb6gZozGBQk4kCsqPTBaTaklFsGxhekEhgj5U1lT57GMIPlQZ2L5MF P05nQC350oBUwp90UhClMszfE2TpvZjKMPgFc1cZmPlS2bbZi+b40oDUgtTnzUEeimMA/nUD Ug9oOoVHUMGPFwoezqbdZJqDc4j3BugcNTeuU0m78cRLQF6EbWPgB5ANgj0qJ+tZ2HPSPjJ0 21ALe3Jc+p6Zkdl0HOzRdkYeM7CnVIqoAQIHASPnYU9GpD3LYTqMg8DSRT6cUTtDsKcBZXxk GvawbzBZ1RBRHuw5qm181Cub/8qqGwt7gv45sEaMOj7sKdVWrB3s6T3vwR4YzlunI67JWta4 eLjHFvkSxJZ1woGwX+I4ag/lkL1YbTPXSZBcYg4IgBEMZZc55JgGWdCLjmQjcISt4yaj841Z 1RYgjJygc2Ue8HFlTorayjtR60jwLKuSOFgo9QWbaU5npbM948la2wmTkE9eNtaaCiJpFIox S3TUucE3su2hQz58H/SBvsKySod88IgJ8umCbJJCRcqgA6kja0GVUh/5yLnGOqYGe0bAuEU+ 8k6NfEBOhpoO+QjlGvnI0Rnk46lFvtUUmzXrwhS/uUEbMhyBHY6OI1yJh33sCJ1j3aCwY+14 0lLggx9LaI9JDPEG/ijWYD2O8CGBumIE6y/IsQqkjVsbYzItWNadxC5XQc9kOsdo1ifpfalo 1sEvmDn+kTmKL6CHf740mlVmOTxaNkuCmEzjb41/jmkCpBzZAw0mQwJYkEKeyoEoReVqdygl OLGY+EVQCppaD6WwDIXz4cYZg1JU8nfkrMS16kzppg47OxDeeMYTirxUC2kDm1/aE9muyJv3 XJmb5XIELo5QJ4qpCehCMlhf6WMLKRWm6EtslE3i+ry4VvmkVX5UR5Mt8CW2LfMlti1zk78I eFW5LWFS1RR4AtsR6k3GtjXOUOEabDFD11OdwB5jedIWi6LOWJrVHXcWC2Qt14x05qPu5Lbo 9lZuV1g1rMWiIkNPX25XAEddtxxZuS3HvtyWcy23TQ32rCic3JZ3WrlNrgtFTSe3hVItt+Vo vNzOa3AiMUcwnR0ocmIb9jkzKt0Y2FHhMZuW3rJ0V3SOf6mqz78dAZ7cdoT2iDLEH8ptialm 3Wwnt7WvM+stjRy7DEXiPwgfP7IDzHQVylPkvpTYHlr/N5DaOP4GOzoJ+iZAxFtF++V+zryS tV2di+iyXs5K+V++xMup6fXce/UxxSd8nNc41fBRaY8jjiGcPN8pdx3+elxY2vmor+I8ogTx z1/xcOECeiNBlTzyWlWiL+Ed0h4+ynXlH1WUpa5cl+h79P24w7hTu1e1+5Ny58973iXG0kyC 24j70dEL4hQbFq9K9Kc4vcTNSg88QB9na15OwCpkQpQu+v1R/0I0N9AL2uXIsdyrfLy6qfzd mNr0lXscf1SN18w9YoJkTUDsR33JBsvqN+i3aQo+difKUexeah4c2VWkfEvJouF11bDYVNnF QQL+oEb5OyFUfgmflR9pcxeSGpqL5l6GVJ7sF6ptIaRY/JLUsA//RFU4dP/GOT9v+RHPaf8p ukSYTqIvO1pMobkzVLQEtl4c73Jr31MJ7LQOEBX24M4KFiETL4rKaPqJrz/48fqk3c7FJwoT OKvd/wEVBkxdCmVuZHN0cmVhbQplbmRvYmoKNzAgMCBvYmoKODIxNQplbmRvYmoKNjggMCBv YmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCA2MCAwIFIgL1Jlc291cmNlcyA3MSAwIFIgL0Nv bnRlbnRzIDY5IDAgUiAvTWVkaWFCb3gKWzAgMCA2MTIgNzkyXSA+PgplbmRvYmoKNzEgMCBv YmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0NzMSA3IDAg UiA+PiAvRm9udCA8PCAvVFQ0LjAgMjIgMCBSCi9UVDUuMCAyMyAwIFIgL1RUMS4wIDggMCBS IC9UVDIuMCAxOSAwIFIgL1RUMy4wIDIwIDAgUiAvVFQzLjEgMjEgMCBSID4+ID4+CmVuZG9i ago3MyAwIG9iago8PCAvTGVuZ3RoIDc0IDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+Pgpz dHJlYW0KeAHdnduS48aRhu/xFLX2zYxD4uB82AjFhg72htZhhyzNri8khYPTje6hxSZb3eSM Z59+v6wTCmQfAHRjhlrLMY0qgsWsqkTlX39mJX5Vf1O/qiTl/wv+LepqUdeqKvWfm1b9XW3U q69vE3V2q+JFkzdx0pR3XUW3ZyrPikWVJ6VK6nzBv0W1aLhUZZwviqJpFA1e+B+sikWeq5yf 4hvBLVHvN1XMf7T9Kz+a1Fkax1LBf75UJYsia2i9KvNFmue1OrtSX73mjjiJy+i1yKW/Yv+8 vlKvXr9OFrFK1OsL9eLbza692bS7l+r1P9UfXyOfG5I7JYwOR0W3/aCESSKy1NmBhNHDcn0+ UCBGdeyQJUm+qFOZ50kj9s3N8mKnvv/uz9+q79vr7e1qt735oL7cLNcfble3ark5p/7X/eqm vWo3u1ul1J/aNzf7JTelcZK9jAYNtGjLSFXIE/Q2Z1hdxyKjCg8PtBo40BNmvtPNAm0veMK0 QI/M/FCBJsx8J1BeLvKKB/COEYoOH5ERAvWnLBrx9GbVoqzj/tOrDp/eY9HUROG0aI8sLXWx aMomK1Q1Tbhv2ovVZrW5VLu37S1r3/KMJ+VWrTbqYntztV8vub5Vb7fv23ftDR+vbtYf1Nn2 6nq9Olvu2vPFfI9K1tSLMi5S37XTeVTSGhtUuUfFLONHiqCOdHSwIkx4jjtFmCbc67etWu53 b2X237TrFfONTix3asX/WTHV1ZbV7vpmeXm13K3O9BK6v20v9mt1u7tBFS4/zKcKeVwv0hS7 WdnOnZAqMPtNVtpV89RUYZJwu63aLX+R6W/VZrl6N5/xScp00aQFwCidJGmr2tvdCoVsb9W5 rGTtuSjv9r1i3VqimMubnSxu19vVZicqO5+KdquV7crpqGiSLJKktGYrOjEVnSbcjQFvZoXa tO9ZmLa77dl2zbSzTK23y3OFUmCgFNq8RDkub9pWvX/b8un7Vp0tN/OpQrda2c6djirE6SJL sxM1XNOEe8NsbjcXq3OAfKcPKxCKxvYYq+3mVr1frdcsDWr5Zs3CtlVXbSt3s8ABc5brGZXB A37bvZNRBmDjokjZKxvAf1rrwkTh9INvFwezs2uXt6v1h8/EILxv0QH+XrfLX8wSgeKcr4yC 7OZTgaxsIB3KQrlOWRUYOuKCwq6WH+Yzw3mcLfKkk+9kdlwlLE1RQAOYLeA9A/aJdlwThWv/ ddZilsy6Y9TwzQe/8dpeqGK+iU7zZlHAj6m+7I9s9mekedIiX2RJUh0INJgZg7aacbTKWsjC 5EC4R0ZrxGZ/LCnmqZES3q8qGmvH++zh8dMwcISO2KwR1EhZlvAQhbUldvqOdsRHovF0L9KF Uv99fQ6GR4C1cArY5Zvt/vLt9X5GxjPN4kVasrT0RT+FyRVSuobjPhXeq2TVSBqImJNchacJ 9/fWbhjV7zpt+52gAwGFu+1uuVab/dUbSC+W5O+/E4y5ac8sVhCLzH3zQQZPE7uxPx3UmMeL PMYfcpKocZpwN52LgI2hum1v3rW9RTMS99OdvpajRXOAr6XGkSVo0Ar7qac2qVm7K8g1J9DI qb3mGblabfa7lpX8r1vWcc0b7t5CG55vYWY2WyhE9mMzEoRZXbNmYn9cH6YO6rGP8V4uFs9U UYnvMKsXWV3mWL0ib3AiNgrcACfv3Il4Jes4a9IU7qXmljjlVnuBVy6pqkUu+7AybXi0uEia RQqlSJdwc7pWntvl14GJLIFnd+bGYOzHfZK4zHqPiPbQ3vmI3DuA9ztMPZldTpJtufmA9sH7 Ld9s92abP5+sMn0ZmxT0YMo4Ql/215pnHUhc4YuiwbnYF67nbTxCZUMn9mjtexww4lxFxXMg 9R2D9ThebJdnbwNLrGnq2xl3AFlcLdKkefLwHa8qvbH7+gcWhCYu6jrNWSOytGHXUVPnrn74 +ii64PMuvADjVNWxrNqNhDGoOmWQm6aODivUWv2gQwe674r3856mYIdoCsFcU1JRVeX4VipZ F2RdFIFoJaqqXEs4pqkkZjK6ztGWqYlcd0c2VgfdM41Rg2Sj+ocI0k7QQV9jehiZIX9w8e7p gkSxPI4husU7TRc8S+lUe/dcK3YnUJIt6oxRPEl8OE24rz6YzYKmCvUGQUPEG/VW9gvbkFfG D3HW3orzye8e5tslZNBjwFKQm+3X6WhBXCxiH7pxYphikmzh/k8Qr9httd/gHTdecqZ8p9aw zTuFb2q5hnEmyOj6pr1ob3A6zIl94fGrppAgNj3oJ6MEBeAjLk80TGKicIS+EBizkxlVb1aX l+3NZ6IAG70q+EdeiUsy1BitI3gm51wL7A7Idex01ICIzbQ60RAJCSedIFz7r2vIIKjKrYRF mf2uXRDsTiN6JEhzgtFPkwLTSqyXE9pO8T1ukaP4ox378z8tV+s9PvDOBcou3eqt+Eg/hoLa IT8dBa3qxeiY3I+z/4VgGC8aYTDvVmaJwiDZCIg3+9X6fL5dcEqoQ5xmlepJ/PA+c4RfaWzM ZveoHA/g49vM/bWQvmcEwRFS0FvGiYyCHtbhRPONZeYM+oixnHHP7qF9gR+7iF30CNtTiV5/ fDSHPykHa+Ko+NeJwpmIIJlUC+l1oMhmi2N2g3EPof3y7Ky93h2a9hkXTBf/6rp2OgtmGS8q ISrNHq/3lB9ZnTs08146JAoOchjKtGNKe5RpLstiriBT4U3gLgmwiIV69ZypkI4XKktKibav uxszsHKMb+0jcatFkXDApO8WPRVudZpsXy1vBfZsVB3/csfUPhefkMgM41FW06T8/rv5luek qCWeMjkQrfcUfExO1QfR3jVUjy/Pu61ETV60uzNNme+1K/5WSbz/Byi2GedYP51Z3RwM5FC2 wPicbueb6KzAoxNXLDO9p/iTTTReBoJl2E/35Rlqhwl7JYoMF/ftfrDLQVvkKDhg9zg16V3X fSlHj9q9RsKc9ns2zpzIPBjcJC3kz1XUK47gy6u8sM1AJusCTmNihyY0QVATkphGECwGdVka +dBjdidzXzXCk7sOqV4RadiYDmxGmG1pRmQBi0hheIcErPhv2Q7ZRqRDI8YlSsrSjS1fhPfv lUcMMF/EP8K86D6Z0qhOCeDpvkavcLH48shuyRHUcKKifnlMt2qMpZ8qmqE0WvnM12Q0zGT5 cqB+A9FZJpHOskwR4NCkueIoZ87BHY+5DDabzSVS5BkHhfGkaXR63zblGKfOaOlqTmAUDVrn ZJuKnO+EVyzSYyMJvYO9L5AdrMcRquEz2Qy7QD3HIbFvrn/p7ZlfqRm3SGgaEROgxGlzDoSY ET7I5kPDGyvcSJcYbB3cnGxN3whzPNvZb+9FcoM4VTnvtdhmWxdabBTN+ba7qyFebnmoAeDa ZGfa231YHr5wRjSkDQsNiVmxJTmPNrwR+zUxKrIIh83I6j6mobIUD3uiu2UMS1ce2ZCEAUhD xlpaozeuW9pWiv233fJlujW3V7vIcGzmRTl6CZ9zDXcnrZ1wIx9n1prV1f7KOAs2HAFwruPb /fU1LqVZz1L7OHsnvB3ZHio/NonzLTodqZiyqfGxxT15PuYmupOHVbso4JYeRA9HovGILbLj SHbI47P9zU27OZvx+E5KUpO4SkEXPdlPIJSd3fOiqD3/9elnN2cLUvnQ+qE754/DYE+T7Uui aznVSsYGcsTIaWjCHvUpOJPKQSDE5epdu1EcMhIs0fmonQ9zPnjmzpXZnp3MmpPX0MaNC085 sRPRE4XzK03PY8WK9KU+ww8bbvJ5zDfbKa62rMQj5Hrwqec7rdkIVoAgJ9BIi82I8ch0/vHg Ufp3axln8PJ7/sxJ/amH0ZvGnG1snPjQvt5qPhk7TNi8dgJVqaQF6Znqx/euw1fzp0Suw3hM kO33XzvA0HuM1Rfq938lpIhP/SGkn17wyMPM2rMXP71Uf1C/V1++u5zvCffruenb6SgmG6dc djsas53aej5NOBtIqlMzSWTRTy/YQDDbMuk/vZTlJ3o8E9yBQ31IZHFKxHeZ4+TPrdynM8uc FS4zn8fkBJYfKP/yNH27+RTR/ri4FM7pQlI+vd/u10QOSRqgjBRkLWpnNqwuwFmw5BIf4fJS 59+wy9JnMy4+xDjHWV4o07fTUcsMmg9y5DQXn2nC4So0CiA8hcQKWo7CwR71N+1Fes5TkWlc ctQmazjMbsbzdCaYnGNsr13+pNHrziO0qElb+lC0S9qkRLHgPRBoGEsCwo/sUck5kEi4j52R e3bNxwjwo5wQtLKNxIDWR/FKbOofIKMhblebVxpQfaFy7cAwvM1uRu+FzGuFwk8a3e+/mzPy wZ17649uT/WPKLA7uNd7Vf+ZffiJ0Jow3g07FO2TDcujqPOCADHTkKbypRRxAHDcoTDXCLyc 8QjYRkXIMZ58goxENU23NJUfltfR4MN8NMTA6IZMM6bUdQvMHKYuvjOuwDfiuuUa1WNvHB04 dfGEPN9Z+W6rR8/xKzunbk8Tj1eej8BbkwOB4CBHJQ7ecwhPnB/zxGTQvLggq+a77VqCc2ZL P+wTADnxT8bKcj6eJNkux0hvfoesNPc5xscGjnuFyyCPKlyjPcPyeDTdcHLhYG82Kth5onAm dnO/IZ8JrHC702TxebvecYxxScCzTo1oaGHjphKQb1RSAuLJ0bOcTzV91kTXudNRTU4rwxY7 AHha+CebJpw5ssT0BrlP+odadYlceS65h+TMlHD48xZHA2ipnTGZau72eq53p6MLJLpKuizp J6YL04SzniHrIOj2eM//lgEXOZ31Be2t9pOt+VOY5IycW8kp5ZrPCOLLTjXX/ETh/me7/ods uL5QX7/d32z+gWXRZXjrWXczPtVbX+4T8I9nGaGwPpH8+Dx+j+yvQmoBhHpH7iHBg3lKrGYG yUGEItD9IFhTYMojb0SZ4CbpYBZp+NjlnCZ7lk0TrtNzwj7VXyzJIOdlvlBsGP7zq1fzoSgP 8J3sI0kbns/5Nk8pLoUmSzLlhLOc6ej1/169f+5Iw1TH0qe5xI3LzrlXHh7bx55YEjEpacg0 Y0pkYh3eiPw6X4vSPLEhea5RaMFxkYYCq4w0hi4Jy6Mkyth3dd3SJZFvXLdcI65bvvwRIg0z ciURoFSfDsAU6NulaB/9aNy3ER4bId6t0ETZxqK3JiCuJ9An2ZmnDUlju6TQPYEAj1Hv1Vl3 kJL3jVCfKhBfqbwx7PCsTEeU+RFKCUfOu2y89+wJjsbqq5v96p+b/23b9e1nimz0yzW8EP/7 47+ueS/Vrfpyf7knm0xSfKbfSaU/C/758TtxvSXpz/MZEx+K4np4Mk9JStI9TgFNPoF8nw6M fUoSCOe8VH1xnhPH/cgr4BL1M9p4rjnz6Fmi6OVZTnM8biQ8w6ZIsjjMUkreOVbzKcnZ5Kvk TiMMw6Z5w2nsi8bEBYeHTKa7O88ASD5MmDc4oDKSXJ4l70kTi2nrdH5PXbemjggbTnfrBJz8 fo3lkvlIaknG6L4rdYftrdVbMO2PZlQPH/A7uW+yecrIcO5dYIAuRaa0Vg1pO2XUbOelwl76 O4Jvy28Lby/TmshrA+UwQ5alkaQRJTPolavQ3aJiTQVnoYuSJOnmlqJhEaoaSaKIz7SpOP7S 1UhGsBRzFtSRIi6WIFxa8vfhc+I8EgfjfdtY3zRjNK085BQzFTTFjy/KlIlwdTSVE41BKnmy lrov5gXurIqk5KVrvKuxIui23F0S4y9uVWnL19kOda2bLncSmPJZJDOYqvdH6/Od0wfmNHot uQwZ4l4Zj0yWyCFQPhLd1/dkCYsL2V05XsTmSBck34G5rEtO9Yuiyze5r2bu5duumYhEjq4Z ftiXznjo0qorrymT00d+wt8jj6VvUAqR/zX5Oh/yxPLD5tIK6Jvx8usf8qUzo3TsAW2Wyfue vW4m5EVbcvKzqzmeL3R26Hx1amUm8Eiro043XaNBjVaVhvHv6oyAofLYmshsV0VliIkX9ZQs vZyGIUZMLnirnGTrZV8bvrvRP4+yHsQNx/VkgnUqxq7o2iR5KUPuHOI8gHKf/WPe+sYjx+PN yzt/VC9+II09yebVCw5xoZ5cXLuLt+4Cn4/5iO2XuQC56Hv/7L/lP6K9n9Xr/zKvAn2KvPox IxtrbEk34mWN1C/+rdsFPucPhMPiOpi5Hr+yPU5MRfQiv+cT9cJ/xzXib4W+1MPmKyrXmrv1 u7+EwyfHUGUYcGaalSvLcIsmeGybhLWMlTetsCihukTDcnQ6ZWGHQbrvXpxYJY4kkiWJ2pg/ Fh0Ctb3afMPEZ+rF+qUqtepwzcQX7ppkTmgS3a3UC7rmFSKS+QqduV0pJ/MWCxav/+jL1JOk 418j8/bZm04V3Jnde/ffqLtoUIdXVIhXWH+mnfrr8IpqcAQLyOCAnMUrtTG3YkgGO8TlqyS3 xeXIkX9StpI4RheOoMpDcTmdpYQ8ljNMV9FRVbjOsU3Xt3VrmCz+CSYwqMnANHiaguUQR3Mm nfM3sTSxAeL3vPEuhKaAwvOrrK/ojDct2psC4+3r/DLvG/c1pRFAWjJmOpJ0oyJluPi6rnSW 23W3s92uRsyRtt7RGAymjXZNuhBrv+WyM93Y3MZaY8744N4Wc8xT13B+HXVhSG3ZWHhvuxs5 SxrYbtWwvZQvRPr3XImva5Pqy4Ht9nXaJrsGTcH+GsDHlJ001oDXTlZvwaUbFiWIvTNg8Q67 HTxLgEg3NeQA5eUhlehiUDdguphTq513TdcotaYprdbkguvgplXroMoJGipRV6dteGSXUOYH BCuZBAIjTiYy3hv0FCsuISVgYLupPX0rfp+8z2bFh/7AiVtxUZeSUJLAiMc8F2yYAm0ZacRj AYXu6AsGNsY2Pm7Cv95qI30FBMF62z+YdQw3YC7RBj3X5hsT/6M27uCWJHpR609/1jXHJv5o 09OZ+II5JF8cUMZK3PH/MXj2UGZr7Dk/2sGOvYYdWH2gxvKlQj5gB/KtXkb8S4/oCtLz738E sOMhmQTyZ5KmuhvF6KvXfQB0KIlgmsOXsN8JOzRl8yDsYLqmwQ4ZO1m2QQlJWsku34MOzsWP I90jDTkk9YxuRl7rYQtTMEckme8IchRuxC3OvirAHL7OL8UFSWdqoK6roCVOMWgfpK9TBYey G9nch6gDmEV2fLJ1OcqgkF190VEGka/oUAdN2ZtC1OHqvNkqXOOuhrasCIFx86IGNsP1x+MO 32VnyLqx8rhjFPejcYDkQQDfddcd8pB5tGAjSUve5eIYA9EZBzuSrK40WgGSEOUuzlZBGJZ2 SAh+Ap7AFegrizX0dYAzdFnDCNeCARXStgMY+jctuPDSeHChJdXoQl+NhxeS0gdnkaidmyly r1gFemBWujlws8LXrAZ7CqyrekiDaaqvwZ0AAT3gBe0JZYVfG4+2hxeoY4kL2qOLFEZOYi8C c6HY842hCIocrOwTWJw8trhP3OeCFkPbP3VkwTJFrHnAD5BxgZRZPP+BroyDFuzbWH+td212 YNE8GVgYeUfDii85ruChjoEPBkrw4l3Db/ApnAawAstPDRwZ1waGAJn4lBfRU7PSn5rvGqhi WhaeJHpBmg3u+UzfY9r5VgOZkCF5AKq4DUcqhFDj3qrCrMRM+gDwtBNCT4QUro6/v5g/RNPC 70k9sn4O+lP2czrgkCE0zhtTEsKPe+j650BEMjiYsnrPXwaGGFz5mJ7KVzmdZS7sH+UkuDTV trgYCNVIeQn/xdatPwJ3MUQeNA6Dai5KaH6oltsDCpYfwtQ9CaqRCe+JWE1eoiR8TYDVXFVo 6Vydg2bkc5EXwQX8UFTILh3LFFi6HFonk1PwAVbjNXS8sbNiGh1Wy8kpngsvYNFi5CsCrObr Aqzm67y99427GtqyIoRYzUoa2l/XnQ6ruS47VADss2P1FKyWJwAUi9XkOsRqUtbEUJILb+ix GkrjsRqJ0DxWK8TP1cNqBc4Dg9XkymE1uQ6xmpQNVrMtuFKeeawmv+mwmpOmw2oiqcFqcjUB q3Hmh/fC9Kggpz8PzUo3B25WWA38rPjdhqt6SIPRV63BARXkJAg0uHCC9qSywh9gtRwXNceA OALpqCAL1rLQAo9Ga0Q9ktjiN0MFFffJ+2x4begPfALABjciHrJIzI529Tzg0BF1KWS/4rkg uMmG6IImVJeRgI1X2DU+DcqcXBBvgocLip8O2azE/79BG+niCVQL+vjMkO0CvQOPWVhmQdqv BmVZHGcrAXfeHfcA2CyIrKsAJ+pIcvYTA8Cm5JTTCFETioL/EA8p0RkeDSCivLGCd9Hpa2Az NbYgSBJAvew1AMvHHbYZ+4fTz9QJhqRp04TgSgq2biiuJAYHJuigq78pVEmAX48AzDQvONzn aAnAjJe06VBiwtfEiElpEgOYIw9bFAlncTbZVwU22dd5VMkLiIGC8B2uJspBiWTWkPgWV0f6 FziqHgGYc2gHxJIFoJKw6Er7L00ME18yFTrOx8YMuTp66XGfr3MQkm/axoMaEUC3ZKODvJgB TvCd6dp24+LRixsC2nJRQ6P9jklRJYy0xX1VEgYN6c8MpixqeTu6jRjC0855Vos2qzhmBMxd lZzGDnyOEXFQiW1brhymlOsQU0rZYErXgi3RtnEwktKW33SY0knTYUrphcGUcvUApuw4cwmC 7SaF55g3AInSBXVWewZNiybddDCZmxbEmKbAnY/ca0aowE7UUKyurhcklJNgPi1DB6NFlW7T 6oIXx1CAOcmFQe7uaMvzcIAW+gh9oLGPw0DPECXk5LUWtJP3uUDl4B84dVCJtuDzDxyMTweV 7M0hXnrHzY8gwB0xQhMcjAZUEmOFEX+Kg9FJHACu+tgpeujWIxzuNdCB3wYy8S/clpBYmqP7 9mVkGEIcjybSydwJ7qAGled+CDX+Nfcf39O1FglOozUQmcAe/SvmF+EJffumHdO+/+4Q6Ca2 heDCXNw9Zez2jcITQuUOgG77DeIhGOLRHbys/ItgwhC+jPgXYaihg7pG/j3TNQPhVq6DWjho dSDgbwlwpbFN7+5ovIagWoeVDmPcWAxdyBu+TfM2dAu4dE4Y7BXpS3hiTWka4ILrr2Q9DwCX qwoBl6vroBSb6Qaz7CoiYr4IrpUX4/o6leMb5w1mOt7bhc2In7CWlGeexstg2iRQ0bF4rhyQ eK4qgFuuypts37CvcT/fw1tOzNCC2r50cMt1t4NbtuZJcKupMw+3uO7BLfnMAClGtYNbojCM qP6EbGI+wislZVYfbvFKHeIuxd2qryzc0tcB3NJlDbB8C7ZE2xZu6d90cMtJ08EtkdTALbma ALcIiII+7LlbvfIMmZUAbbl5CtCWqxqivQHYcmrR014raCiUE95SeCBGvWiKNpYlwQWewiMk W94r+SSwJYF1bPjNIbUOu8gprqkR2RZiBViLoDsW7efAWkbc+aDWwPY/AdJqDHQdRN/JOpVJ om5P3xFJ9MRQrozoWU42GEWZ0d9qcFaqzfZTcJaRN0BZ2IMBCONbcSairIAbkASOVSkIfIjC gwPOaJpzDq4k0Ths9NmShmN1D3iwUeJAqUHhWvrQxYM+wCCytQvcGvJumCBKHA8BC1IXI87B 645oGQIedHA5a7c7+J1VJQebdWkKeND5FVKJmfbgIZKUC7oqWH59ncMKfJGAsRhnUlCTE57C +tmtv/i6MITyjnXa8uhBwjlJIh6gh5jASDnH5fbbmavo8EPk60IA4e7zeCFzjQc1VoSOLqCL VtTALPgOeQjhO+0hhK/xjM34SHFmS84vGTMv150XUGaytEBBtjGesRG18RBCPLaWsSFqr3/C S0HbCgjJOI4vVw5CyHUIIaRsQINrwZZo20AIPtaRYVKPXFYaDyG0pBpC6KtBEIJThdh9S5pl eODYlPQYm3HT0mGIYFq8Bo1S4g5EeBE6JWY4raihtnR1PcYmw8CJD+Y5MYTkAsgh5Y1tiHog wu5jQ3s57FjXjISNk3c2FDH4B8JhwRBolJQ5iurVLMe6RsEIQUOSq/E5YQQcro6E/EhAguHE jj8JSFiJPxGU6I/XIZiQrA13BxT9H+Q83gkKZW5kc3RyZWFtCmVuZG9iago3NCAwIG9iago3 NTI2CmVuZG9iago3MiAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDYwIDAgUiAvUmVz b3VyY2VzIDc1IDAgUiAvQ29udGVudHMgNzMgMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJd ID4+CmVuZG9iago3NSAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JT cGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9Gb250IDw8IC9UVDQuMCAyMiAwIFIKL1RUNS4wIDIz IDAgUiAvVFQxLjAgOCAwIFIgL1RUMi4wIDE5IDAgUiAvVFQzLjAgMjAgMCBSIC9UVDMuMSAy MSAwIFIgPj4gPj4KZW5kb2JqCjc3IDAgb2JqCjw8IC9MZW5ndGggNzggMCBSIC9GaWx0ZXIg L0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4AdWdW3PjxpXH3/kpkKcdV40Z4kogL1v2JKl4c1nH nlQeUnngUNSIMSXKJDUT7cdMKt9nf6dPd6NBUCIAkTLtcYlAA2ic7j7o/p9r/xj9OfoxihP+ H/M3L6fjsoymhfnZLKK/RnfRL99t42i+jSbjKqsmcVUcOhpt51GW5uNpFhdRXGZj/ubTccVh VEyycZ5XVUSF1/6F03ycZVHGq3giuGXUeGc04R91/8hL4zJNJhMp4J8/m8bjPK2ofVpk4yTL ymh+G339njsm8aQYvRe6zCP25/1t9Mv37+PxJIqj99fRm2/udovN3WL3RfT+H9Fv3kOf65KD FI72e8XU/SyFcSy0lOkehaPn6fqyI0H0at8ui+NsXCYyzoN67Neb2fUu+u7b338Tfbe4X2+X u/XmMfrqbrZ63C630ezuivIfH5abxe3ibreNoui3iw+bhxk3JZM4/WLUqaOFW3qyQhbDtxnd 6ho2UlZ4vqOjjh09YORr3szh9pwvzBB0ZOS7EjRg5GuCsmKcTfkAD/TQaP8T6UFQc8hGPb7e dDouyknz6432v94WaUw04wh2u3qYL6I/rGdX0fouerc435DGJTNlkUfTQ/Qen23udpvZqv5s lovt+UhNilLm43iP1kvgvqRknZnaz6E5QbeG+FW4L2GKrtKisXYc5z6mto7DtzebmQ/jyMJW 5uOqqFJYbRhx39xFs+j6YbWKrhb3q/WjTMYspYu72Wa55tJqtvm4iO4ebj8sNtH6mgmduZtJ d/HP+8V8t7iKduszTtWTcpwkLNaucUOn6jZuac3T46qcpFWSAAnKHAgTHLBuJwlTsyyGk2oc T8Ai8GaV5UXED0CoqqS+47ClOfEdBwX1TBzH4zguStsBCltarBe15uTOrNfqj+PE1axnibPr VlfiZvf3m/VsfgOXbZd3H1cL2N8DBfliRseB1t4XY4g+8sWYocxZ/od16Xax+bTYdPygB/Rq kmfjNI6nnr6fGg0kOSyfxMwwjWHuDJ03i48PzCKrR5bg32x3y9vZbrGVqeRm/bnRjSORMA7C 6QGjnFbpeFrlmaf6TFPHu+/piGqSl2WScZQmFWtpGRx9/64llnxZyyU0eVpOhDa+7mKcRynC VVZVZdQuWUXfG6mjflqA01OV5aayYozQYyszJVkSdawHvhtBlD4VC1GVEqUlEyWzY2WmhWmS 7LVwr6RfZeleC9PElPRsoXuqbqErabTwWXHP8OcoEIKPT571zD5J4JrUoRydPI9DxO6gYsAc VM/sDeJGXWd2BQ27G+S8JnJYbt8ayY9Pnz6z80K0u1k8Rp+XYJDrxW5+cz48kaJyYIaRZVw7 feikcHCWGtDRnguAcOM8QWuiol/Xjn4dLhhI3MP9lUz1b6NPCPVM/r9bf16wdEYzEGS03c02 O1b96H69BHGu7xbR7fLjzc4CS1Pw3bfnY4XMQUvXuMthBZg0z8GaF8kKw4jbrdd83OtNtBC8 99X3f3obzR82G2SN1WOUTX54ixihH39kuSYSVnmMrpefFudjgnRajdOiiKPCNmsoE7xYvigL lH/JtIqKKbgFjUvKzwQt6yvJFwUz2jSvEtsBFzb/WOJ6fhG3y7sH5p8GxjRa7FPN3nFcjYt0 WjJo2ns9CWRO/OsNU6RMiqyBrIhofXTB3Ea3s8fowyJaIo3frB9WV3JytzYSN8+c75vIJuk4 A+27Np3pkzgZbs4mgkfz0qA1Qah7BT0wZSYmiChnUrCg2RakmRRMuwJn6bH6ydyQZCrmmzbQ viNJcNNIbC2N1u0V9KqqbLYOmUUKerZOqXJPSutcPY3WHcfL1mg0EqNRD7xcICZVBZoXszxa KbSlCWnrBztrQvaEzV5KuIHE6cfvdR+qYohuAEpmEVwtdzu0I/M1emHW0bWdL7ZOL7cdn286 SKtyXEzyJHJNGzofnGrSrSGzWA5LlkjFSacx3zD4fe1kNUEZipKKrgo581IkuaJBXGdJ7uvF fPYAo6GuMeIcy9Ht7Af0N9vFHcWgttV6/UMEhBdl8dVitZtFaPV26zmM+vlmsTkjevMrlW3a 5XBmxmIkSmLlzAsDU8OIkymqluXnq6Ux2ooV93qDGXdxN38UJjECPGLdWzN7yUOrxWx7Rrji RfrCtutyuCCNmTmbpsqzzgbPqiGf9T3w+p5CabZ92JVxZ1esSNvB5tThdNcAvEH3aZaCAeqc OMlwV5niqTJo7BfX19jUxDYtHw42OGMGdkaRQI4ZqTfOwSV1D750wVbeBDxs+BHTX2YUGc4A KR5Jk6RCgG8wQFfGfRstxh/Hb4OetX5OB3t2AEOkWT4uMBA6+iw0aDBoG6p2pKc10scdKdJ8 Ms4nU7ytDjDocRD94THCMPxhxQTfj8aRdw87jvT9st4gsXeXtVUyrf5yfAcaatttmDBrpUxS jVGOlFhn8IcRy7DzMjNWX8OFpTio+fus9sbfKLxzXX+LuFTlU3F644FsYpzlsDnj/VZ5hY9Q yxMtszTEWvs0FMY4xkFPge2/4P37SiOtI2VlxOHJ34XWIsGJ4bU0Sxh94LYL1SxZ4noitXtg 7fkcASewY1VOGS/tOUtc4wtoWfrP6QiIhiWZlKiEGgRZ0fs4pJmvb+8fjK4fgHjGfpNvIUUx 0CSzs6hjFc/nIxC3Rj72jMWq0Y8/nadVMinGSZyidG4Q1HlgBf2vr69XONSJJQcRcI56X4z7 m+Y4n9ayL9NZKVpXS3VPtPru1386o044LZjzk2K/T48M8rgj1zGh91VPpKw1+KztTyf93emO LKihQvfggtrFEUKmujK3pvhyqjrd0YGyrrpYrdDqhstCNbumQleW5MPqEqjPet2sq6EC3fdG b3lqCHHxhEU7j4K27pX0oY5HRdEctNOV9Gulf0rbGOEIYmvGxaKnChuXnkocW8IWNkt6tRCf nr0W2pKeLXRP1S10JQNaWFbgw0YLmyW9Wlix/jfH0Jb0bKF7qm6hK2m0sLOi3kR3WPiOAOqh raJaj4hrdWicjssU2UfVoU/Al5HGVzTXi6etdC0Mf1yeqAkCx0yyrOdy8UouFkqb7SuVX48j q69WO2yDH29UNysWw81i+7DaoY9FG+v1sDsMhizN6HG3RrPw3WL1KAv2t7hgPJ7PdJDBAEwb 4MZGxz/BCDbQpisjDBDGPSPkTEiTwjmWdwaIr8MJA4kDfF2to9s1UuPn9UYcKlAhoT+6cpLK 6EjI0oAvK8EhdJKk08jR3En32lVSGTDCeKky5eAM7wjS76nzCANmRYkdYNp33/4lmj/OV/Ll eHf4M34y1vju6O/Uoa/yyWCHTqYu9KFzh77SJzOMOGvO6Ai9B7CjV0+L0X5A74k9RY0r4iZ1 v16J4k0jMJCx7rEXm/iLaHu/uDMSmHCrao9fgUVtmy6HRaco517R3HIceXizCrq+/qRZLwB8 aINYG0JzZrgC3D7gRvdhsSMo9Yy2/wSykWcLXGKE/ssZaeS4fOJcpo+I1l1nxwGidQ0oEPqJ DHJQtyt8y8ZTXMD+Ytxkxbdreb2cz3bL9d0Z9RNEZqPKBoPlDZovoROR+ytnND+5ekJD0zXE i+XrQIhXOkV2Fr/bHAVTRTTHYW36s/LSgEWiZqIsRXPEey/RayAfRtzvcOnGuVFVq24xmxPP aqIAcGzcMIOJoHI/+2g4PyI+SK4CY8+3hOlIF3wDtlV2ZutqNrxabAlbvzofcPDO6Y5AyxPP i05nVCJ6Ua5J0Mm/0pMpEWOiOdGixKm4dKKja5z3U8fgDqoVSfRTJWeos/NqSCVJLn6Trhq0 HLiw5aPuPpxREhcSQqXNoqLm+WrUKUBMmIkHRe0oFWk15ixoFnOks3EejDILK3HNcpWaZtn+ Ybo8qfa/ni5RdcZE4Pb8dl9JIrHE9ZzL/1c9P9bI7hscqDCv4G/32Xh/z1bbtbiAf1yvKb2O Hu7OOD8SHYVVWn2DB/Tx3WK+2G4J+jnfDOkdK8R9WUjsNEO+ChYkUjy9UCfQfBBt28e7+c1m fbfc6hI9Q+y4vSdly2fcO1m8iV8gO45kAgBDmxQbYhEE2f4WO6B4jZ6RU513sm3Z5YgoMTA7 x8PjIsHcMOIIT9miXWi7+ZoJCu3j5wUhnHDB9gHdxGbnYF9Tsjl/Xp/cNu9ymGHCMi/+QRfJ DMOIY5hJBcJH/jWrVXT/sCWNA+uVKKmiDzNRTG3RPu8WHwXs21gmDBC4C7/ipGCbdjGMkDFd TV3EQmc3i9eBLMNou3/YiBqyq+gxQD72PrVNAhui0Gu6UHoAmpXiTXA4ORbuWaNG/rgeyKOd I0bS5nUwuGYl5pjYG1yfkGZbfUWWNz5jmxzr3c3D5u58sC1GACKnRBw1ab0A7RNunZJqSKfo /nLtQYfhlkntuINuzV3IZ5lIZ2bNsHPFcQ/d7nPFHnG9wtyyYcR9ZbNJ3WN3Fjub8XIXhhN7 tZyYbIEovI2tmojXR1NqE0WcEUW6tBCuXZezYJAMqEgLF+P2xCfdcgbtzgUDJmRv1ciGEUc8 wwMu5NsbMWbBBX+c3S2vF1vkCQEQ7777g6CKb2y8WR1cNLdB0OdkA1yiS0RJ17DLYQMJI+hr XXglJhhCmoqJV+R8Ef+VHZGtt+iAb5eSBoxYElJDLHePb5EjJDmY8AUzw39pzOFyt/zERcSM 8zGCzxCamcYNZYO2w2Tra2t59zPRB979eOpPUaqxHLFIS2LQfZOEVHjGrHNZWozLorhMlylH XE+piulnhaPUGTGOywoxkEDUK7P5D+c0AebpOJ1g/hhIoPEt0gV7t96RskLUPeJ3YCLVpGPP lLivQoyWbGaObvthdl0VNQOxmtXBGG490UCOM7hHuUCmPXIbkkt76W4z5pF5JLSZMH20I5m6 OF5LV+YINJgESsmFg1GgcdrdRkHKCjFySDWmEj0hyKB7FTajBPYHHsZ442okmW4vZ+0pDuRB g8zpyLavBzVTAeWuQe4krfrYbfxTav/xp7ZBZ2C+WpAgU+lkmjjvja4fyyuhB0tc7zlc1Myo mJYfwY44TUgeqVAHceIA2biK0dtkLMTNzuz9KR8UE1uo4LhnUT26LDa140mDnpag33XN25MM o0kfsZUs9unEy9FPcFuLNEJUAP3fM5yM6q8li8Q51z9sqJWYOrMGsZeghCBCLJesXyr0//TD SUJk9k1oZjS5FCXEMNq+OZxPK5o5V3pJcL1Z7DZLzFrR+sM/iMjf4rmyvsXkuts8bLF0nVPy sC7ztnFDRY+TzzNpSUQzuTZ6TtSvs4oMJG67fthgqDZwVlLc2LEW36P55vF+t/64md3fsLqs 8L79NFstJZ2l2DXJmW5M9OfjA591yTXtchgBLzmU3pepkRLHrgHEETBxhZYBK5bRSy02byWC 9XZ998PCuTCcAaElErSfMbk6qjuN8TmjJyTHPYnRHT12FdI1/Hgw0vKMdoOETYMAsWQ4aI5w Y4VsyVJd+4r5vm9UbZJWBCGLk2iDoM42PbTdbUHvVLO2TyHfJO4IwDlnb7kU8k2COvfW7fLq anXG/mJxi6fYWprkdY5yWZDNFh0lfg7kMN6S8ApfGGPN8CQzfZw2ZY/TLTiKO80dXQWAlwgk pNMdx/UeRk8IAK1P9ZWAwjDixC7xcXG3EH8GBQIeLDgN9s3sk+iuZ3PxfBMfGGGA2Xa7ni8F NJwPKXhGsE27HEbAtzX2e0d1/pZeiRGGEXe/WX4SHgAXiJHqdzro29lSPvjZTpAk1kv2uMAJ hmngE64vIk58elgJ83wgcOe8ZgsnPNjWDeWFIwrHMJSitleEhotEJlSCBVP2D0slV6vNm/RK KYfSjLgldgmz7b+wOcgS11OSslYBzamJvRw3KjZSIVYoguNkFrpZkCNaEq+czcHOjKpZJof1 r1pezhk3kSakXMxIneQ4oGcn803L92oX8+X8jBjNz9sNdujveNL+Vhvqu9A4wBw8zDggvRiL x04ekTgMnbUEVITnfXT7PChaeakI+4Cejdj/pM++NPYxKmHATUCFqxSZqldABVtqidFDmyX0 NM57BFTERRU2y53VzeoSUOErcc3y1UjdarI4W0BFikhDoPJlJmpzxPX8oNWD4OwGVcLIihJ+ 3qPyeem0KxofIJ3yVZGmh/0nmwR1lreILwG/SjYRNF8sMbfeRQdkq2uP3HAbzT7gvvGr8y05 It7kOaZq15ChkOZUorU3vKSppFx0/nlHROsDQ/3kvF2nynzeOURyXbDRMtgKE1BpDhh0kpo4 kCV8c0bfEJl68Wm/UJBlies5Xawj8NUSpyOnC6633rCi/Dn0gC5pycAeddkBvLLh5FtT1/qk Zrf2nt+OMH0IVpirhoEVmSFi2buaVR09hMKDxnl30z/735HDSCsScGDP2I68F+Ixj42SDBHd gBVfjaQy604N0ZpkPHTNEgwWnvesKGyW2fBO6OvXLN0nr26WP6dZ1jni1GqvevqV3FLAv8tZ Dwg0nmSFM5D1/jQOLlADln7fQwmJ8hK/jVh/weIpgprhCT1cAxLSKWdkUdY52WKR48bkrzcP y3/c/d9iscJSt9hhqEVK47/f/POeIPxt9NXDR4yyUZy/NfvGm2vBn799O2P/4jj9+/lAincX dS28GKZMpmyX7vfK6Q9SnuKBvtaSGNkR75kmOf1Z8snlI/ob2ePi6O84zlxFkmp8dJKlRDg1 yUiSm4/EVUTm7oT9XTlIjY9bj6lbnvN7u+rUXZ/bqdvnSH8e+OV8RylmQ7aHk3zHiXGQaxZR ofjMERbNNsL2NnKiEdI/JVf+lLA4Npsj0Uldgn9xCZSriwpYx2y9TVXuNtkSLK5rlq3q0inx Ro4iXzAf8epxkTAd+rKVcavPBaj6sixPxtMpU4LWHJzal895SG8ZoXgSGmmaK6obIg77pmbf WP9+XzKPbnCVTqLPo78pn+xHVB1Mz5rGZJOT0bY7gjXOWeTSGBVnjk+qvyeNRd9JoB87wFRc l3gCNg3n+Sqa67mk3jHn8jzXc2KPqGPkKyNYVF9oXufP2IY8S8i2566uOAc8ZuxV7suEX32F euLeJo9z0VMjj3PuafWV+baY17kzuOPG7ED8/H7HxKr5ASokL+qUYHg2RHNDbceRvguKLEN2 G0fHbm5oqWoItzMaNWdbQkOqPPHsXGkgtfAUJmjh3ipB0CJ5BiFa+MTgnU8KDPYdxnPkr8G2 ZjInxWTsMsF7kyqW/P6Vce5DJe1Oba1TXL+q3EX6RNPc3Kc/1l2OrS6o7v01s92b73dfsIIm 0RtUlDAuB/fu4MYd+EsY5vUelMPm3t+3L1Hf36P3/xOZLdfl0/AEms3Z6tM9eu1aV9NrxpAk 5xNr48MSoFS/+UUtoZzyBWG3IGibBqauxb+0BbEWjN5kT1yJ3vhnXCX+1l/ZSnL3rK/N3frt H8PuE9RrYohiQjYKVBhsCVPCLvBNzGRHDmX4IIn32aXDLniOBfFHLTFwBFBKgBSZOKUO/bFM Ayr1TPNu/QUT4JtbmpH6H1iBMlgkjt7ABFn0hkYV0Zu/fRHl0RuaHJtO4+rfTQmdMTX3NNkl TBZTp47JZdksZIK3FFt2gb0kAGGfZssy+Hp4mv81M5RBEyTjFAodS3NM/pMvOWEjEvnBO4Dr tIXjfwdPkKRJLtNw+dFa8OkJyh7kbGQvSdfQA1qPvlk+Hn20S4PdAOFDPyFDXdBcdp3u0FzZ H9e/kHEhWsG05pO21p6xYw3XaA1/bdP0Ni3a2jJpDWNIKi250fbU8osRJzPbLEacs7C+efNh mVZovla/sLQt7NNbreyT3iPv6dNHUzwFEpY/dXYVlsgzcTNqsPEBlqj7xJD2VJ+MLNHa+s/Q yMjaBrCBqrT7v7sRnMuOHEAnvmUl2Q7rs4TK8Lz/h86nTgxuA1jnarEPYKOTAFihU9Z4EGsB BpF89TWGFchAy+KuigNTmcDYYK9VYkTqU4XDHVCsxLO7RZw0zKRGtbEiimJ9UbCu+7J6yZbg DtI/1QUFmIuNZhrrOqn8ZO4NQSy2aON25zEDAbYs6JiLPU22gJrke1Yc68pCHOvKPJIpbOXg X4dsLQUhKnKEBhCo0NaYZcNiZO2XEEnbnvJINuqLZCU2BwawqFK6JYCcYFgDRomyqqErG9g1 oCt7RJtzA335dk0kC0nR6oqmmPfgM6kN6OzPLHb15zV2HfkyA0d9jXpm38dQmHNPjwWvuaPW gVfTRAuTWR/7Q1ZC2+NY+DEYwz4DFrCMY+15zVmuqANrE6BwgLdDfreUhmzkqN/HrIROZWK6 b2FWNwG5z7YPZkW1wMyi03cNAIEglwhYDbF24q6JPRVa7Vb7pUNVZi9kyWeBKrtAdEkV4XBQ jnjaiAZqgaBT4lRBqy/EqUqw5RPBJCyZHTDJ74CRAFDgBX+BFR5Gf0X2M38CbOIyAIu/IBBQ NkiTq6BUSgAMlAC4OAZvCXIzV4FXlIB6i5F9Vl8GGuZZkC9PgWm5BxzHcU8Ylk3x0WpAVTy3 OjR5J1hKCIOOLwFTkf1lx185hXb5EQyKvODuWS1/0Kfs5QiQbR4WDElltpjmC+pkcwopjK71 1Jbae37UJwS/1w8KMOVsF9l7bfU7S1Qk4JbrtkJXsa1xN+cqNLuG2coEOAsVHiwab95ayFEB 2QlAjvPxpsgkmUSNbsEh+91qmT8UeEh6YsbyO6XlW37oCfqPv2NzpSbEqCWeJIRUpSmLSGEp sTz9cwKt7Fq4B1rLnhsQedBaGtMZeqgJe+uY4xZcnYCOmKsOGR4BrJLufpIWI7NzZkWub3al 0iLdTFOKVrJlJE4BZks1ej8WiEW+FCQbRGDZz9LetV/Xyign+8A5VUiXoHpRS5uzkZ4BByTp rW+l6Pc4M3dyzSiy3Zkq9Pya7wEw21ImaG8D1bLsVClFAqWdatmX1TglwTsMmBEUkA0TDW9D tYztLjGa3Po2dhIhIy0ZmX3dIq+QB7kWFGwBNdWg3N0kEMiqgI2gIw/WENxVHpQYCkxVDqdL akxRRYdoyramrtt1Qk2B66kalHfXKwsfApXFD86AZXduwLXVK7syBedlKplZnV65xO+I571e uaI7DPS2emV0TOiVp4FiuUpjfZUcWEguhzUaj+TUQG33tD2zddNn5qp/twXinjIHxA3/mdYZ NO7b0YLkB90SG1pknPomZCERPvdi1dPDBW53rPDkcNH2fV4/xNgB2H6KsaUmbx9xhDZ4SIln TJtaZNOfISKPkUtLWhkokWXLLf9xdtCZyo6IxOa1UK6sUO9vIzLShQi0mw55pKpjWQuNapXV 51Q65KfIPRkof6I79usPO8U1L3Xt/eVZNMiJVm/0jqY7n9Mgy5QtopvVH5fjhJmRSaDJKX1g OX4x5MEI9ceT6VPgJNQg/xqkBBRSzKnH4FhFqpSDY4FPbQ3xM9vF4a3NOikwpUXTpEyeoolE h3wYmELekH1yu5TIii7aNtdjRts2qs3FJ9e2sZXzqYFLzAzq13TJ8+4k9mPmuJFEYUxRyHgA wnKzX8SKYbYqhydkVVfkkgK/sFlh8rLQRRam9pNiV+0DXWiJ+JA77KKnHqBwKj7dsl6IcxSu A2bDR6ZLPZVn/c0Gv7CFoPwLlYporUg1qQlorFLRFYX4xZW5GXzEZjfoEDGg+ikdKJWKGSeY 5vFhAQrJeuHukgPypQfwRXBMKllX3DLjCqjIgwdfFsAXX+aXOld5rY+yBIQqRUdmuPLYttTL oWuuI4Dm2n4agl6q1OsSOQwxi1wxusQK2bKGKxXJP0O4Ek/MjpbmTvYXtXZ0a1Bnx1E8Rgws MkcWrJjjAK2YcwNIfA32jLoVqoz8ey1U8VR5qCIEG5QiBy2AUksEAVQJAQq2expm2M2PWtFh ROr+dyOCmt6PiOMcX9SBcxs6Q0dBg3UtpQGfeOotQjEaZ+zcwomVpET1OsNTIBTM3DDLAZ3h RQKUw9Tu44ehJu6iW/UXDk8kT1jBxknPA5SRRA2af3w5+yJSrcKQD0F4D3PxXvLbnxqftEg6 BE9g4mbeZ3wVfzNGgXTcEtjAJurKpqEA775nAqqeUU50ze8mEyNrZzzBgSXwZSvFZZTVrOve MSPjy+a2c0YoY+ZlRcaAZeyLLbWK7rlFG9p7bgWrIxoR2V5Skr3pgu33TAymPV9Wr7xoV/I8 jmtJLSf2NBNFRTjtYRYpRCcQrtkFzZZU1DLPwXb4VQHapmyVXlNlCxprtisL12xX5mf/3FYe rNmOhGDV9qSGs7FtUK3QcI0287KxRboSs1QZn7Ze+EsWVZZX45ZlF1iOA1uguWaXZRoi/mX2 bJryTj0GmJlnMMGyz6VxYOOK1VrEiXkGvjBHbvGW0nDxlnNdrm0NOKHjkYb9TbUTcgy3mmfM saXGL9yGUrNym6PW0h0s2LVar7F0s7Mh7vjCePXgOQ46MCwMglUu+EHwa7cvgfM6MHHIssrE AaB0JIRM7EgNybJl+9oF8TBMJbeMX7sTvirxGGrKjL20C2r3x+H0Z7J6P0nvqdbvzi/4CVZw q7/opGAQbikrHIK9ioEdVGICzBrs0nMFl/VAvN28/QN5fc+355Smv+LFpr/cUmzZ+3k7yTf1 kv40mJHwI0xA2PH7VB1oMp6rmmloyt7qe1WLxfKAnemAF9XV+u4/Rl2DAketW/z94W792drc TKl4TVF8o65w4Z3/Nv19j5lNbX1dHL8geIyjC97Kffrjyy5d7XAjqR1TBH87htIb3fzuDnu9 iW0R30DaTSMxwPJX9KBY4qwzHWNFmfWYw6jIFS0yT6pTLmXWCxGvM/G9W2z/rTc5/zznjLfF vsd1vSiGP05Qtckj7KijxYt/KgH36hCol2cN2qil02iUmD4kU0/e7LTnGR8qjmNZ51Rydq82 9ktVA5iNy3g5liWk9qVYFjVHIfvCBFjWFYVY1pXVWBbZp8Kv3BWMcrBGKSG9IQqQTGgFQRQh lMUqBG4VVzwHZVHYJTE0WCAyyl1BqH5yZSGUdWU1GnKVuxLqsiSEUNaRGoIT254aMrkmO8hE C21f1QqoPppERa+47uGtVR+HSFauKV5NYtFFOSQLv3gkm8Lx8gzG+lgShzRCMcDK1pXNHDkk K6UhkpVzxa62BneWTp3FTHjVI1lHTY1khVJFsnLUQrLHlVAZXwIa2waS7TAq9Ri4UUEQ8qPi gawreo6DqUo4GMuEY2GqOsDCjtKQV+oyYybzSij4cYowd1IcqxtN/2xg7BPkngzFdqz/0kEs 8xRzgHzD1k52AhCbEWdhQ3r5AFkazglhpy+HsIbeGvzEqNL2KT4ABf+KwxN+Y4A8PLUAO5XB IPydfzGiRMsBPtwDZCz375Gn9B78pzjW2rAOcozfEn8BDdXozQdTg5ZLSfQGlESdeo+Wg5R6 e7DlsiuK8TG5jb5+L+OEMaFLu0nGpp5d1uHLnq5I12ccvsQFC9umIDEc7X7PD7SB/AUARoLp gMY0XGDazv5KgjdT7i8bZzgJOeHmrvEGCOsTNH6Ra5kKUaMTIDMr/4/Oj8xSUWSxGFlkxgQu yse+akYes9XEugrIWR8VY4CA0DLHRunlFzUC+ExRuKi5snoJI+c/6bjrcNlRzvgkSFkBLJPN CTPZqieAZWTgGSdVCMsyCR6WnIgOlvmCAJb5sgCW+TIHwiJfuSsZeRJCWGYpDVda15walrkm OwAAwrMd8xJYljJgDpbJcQjL5NwCLpTRNSyDaTwsywNYlrdgGRiFGkTBKEcOlslxCMvkXGGZ rcGdBbBM3mktg3FqqalhmVCqsEyOBsAyfIIqsY6ECsYOo1KPgRsVZgM/Kr04GH7d4+DIcrBo WQM+t5Q2mMWXNWBZRnIJNuasYRkhsBmxyPs+Kf30i/h2pmx297MBZk/RezJk1vUFPwE0y1jR cFzqpF8UbkEPFugXaRh+HfikBOronvpFSQAjyQdeSb9YvhycWYpreDbBzNEBnv0BSAHiAJgB RgBgYBEgE3CCcG5K9CrKJ1Mi9+idgBqeQjNECeCNY5RW/HXPSjmoBfCCEi8bies9xwCzLsoj mZTETsvqHKh4Nab3eZxC8Pq/rD6MNyo9Sif0e3UiJeamkfV5/7e5FeK46b1CLgFt3KaV6BUa y3Ua6Ku1eji5ycX4hjfpY3uxoeZx+lD7k7/7T4ze/CskVAIReKF9ld4cXretDZtAv/OEDWG2 1/v1fEbgG+mfAuGESJUu0bOf6TfapAEjHVWFWSEp5sir6t5qefgEgPT1VIWV7AYeANLSANTe gNRtjzaVDBB6MgiPyp6OWclGGrWa0BcFeNSX+XUasx4qEUbelZDXh1yEqcyFvowg6kpd4AJA SrKW8US0XV5PmJLRxbi3OUDqCwJA6ssCQOrLHPzkhbZyV8I0YEkIAKknNQAZvkEekfpGO+xD E21vvQSRliV2XqsolOMQkcq5ItKS1apGpHAN3WquJAy3eQZFYRJLxpAwZwvbeUgULIjUHFlE ao4DRGrODSJ1NSgilbq9olDe6RCpo6ZGpEKpIlI56o9IM3GdTwzjuaEiFZPloOeGpR4ENyw8 54fFQVJf9BwTU9UeE9ckBEzsSQ3JcuTvuasJR5b4ytWYFJXlRIStAGP0dagn3c54OvEboNZx oxfqUf8kvaeCpJ1f8BNAUkzAnSEpsyWfb6gtxFUVN2eCaQJ26QdJJQ9c0fRaa8G7U5q8KwMi XpKVxVEcQFJMyh0g6TeAFQCMIBcwo6i8+AFkfolA8B+gE9f0Dj0WqMYNQCODesyJxIEq3qRM 9GN1RYKkzCU8u00wJieiX+NMwkQ5A88ZJVwvsCqJr7DGF0FrCavo0NotrRAS9EcS2NuX01ot s1iUBnLflqbzY1HlQk20+he8xRW9/p5qAGIOxgLmuSR9SDOdlVdr/wuFgH4ig+Wafb2jRiuT fuHaTF/zoMZhsiN266CcQH68pDU3mHRRLVVJyGOHLpLNn4zOtNsLrfiAbzimUudQJIrbTsHW 7BFvOAmgT7fQRtSy8AedCaKmE+kh7WXKxcYuHWMvdxNuJKnElA3X2/R1UywvbXyxsCmUQKf8 7AgFN3wtAwmxyAhCmlUYywhSuJTh5dc+Gn3HKYKa1UHbmiJx0qBxbPugd7sw6kGjkFYijWeh 00THZtrXWZKXNnx6ps1kcwolzhG1H3wtHwiNsE2wDXY3Oz16hA1COq15l32TjSV3Ydz2fbZf I1uVrdi8DRnQEivziYyJ/R2Tz1yptbdbjX3HD8jys+i8WVScBksYuqszDi8S/l3zxfOrZ3jX CDvbMgiDW2g5f8O7aAElH/VHpc87+KR1l0ymWm8onN4zY/BCfdqGnuuJvkP/aom++wdmKp6Q /uRHX6h33di361tsmZJNUQ+1Qopb44Qol2Cm7paG4TMUwFKMPKQx0vyFKYRaiOaCnvB18klB EiVQqTzITZAaziccaxV8mv4qfZebWZ+n9GU6C+mzer/WzCrGU3zr/NVyepE69Y3uXUKV1kDv chUu9O/Sp7Qehok79alxt87MUWYT/I2evNmdPyepnX32GolX2ahDotn7Su3B/h4kQLVng8R2 CZMjiEn0+U7i8UWBxOPLnJBO4BxZIiUXlSshLo8oTCwDgcAjCb3ZQc1E2bvgshQLAtJfKLUT iJOLb6WX2l1BKLW7slBqd2Ve8POVu5KRJyGQ2h2lgRjmm+OFdt9kJx3SQNtXLxDaGStylqnQ bo4Dod2cq2guLO6FdmEaL7RjFvNCey4IsCG0041WaJcjJ7TLcSi0y7kK7bYGe0bdTmg377RC e+Ko8UK7odQI7eaov9COXWRcYoUMzUhdRqUeAzcqJtDTcDB8Z93U/UA9x8FUtcfBVNXmYEdo yCt1WcOKJDtXsEAGIjuGsZd6qctOIWhZ3Bp88SL7k/SeSmTv/IJLF9nhlkIys+05+BDCM1hk Z4uJMcgXA7JzHWlbZE4jshcgstGbicFlLxHZHcUBNJq2Q+MOOPl8D3YATOpfEApYQ2QjwAZZ lhQaUgQIEcRpyLSX7Y8+CLJSYMm9Wgmghifw7aF8bWoCLnGs9wNV9M4+6I8A8EnDh7ubnew9 2Mm/GOLAeCArGojbtbd1gb44VuKkZb5LfMsUGvI3rA7YRzvkMWNG4irgj7/6An2Z1qB9p6/R cuxDkAWM468+5YgQdK/3aC9q7+tfvV/fq1fdU9Lf9GuXHiWsja7M2Zmq0ac/KwSYS0xZbbdh UxcJX+yNAP1eMOi+3c4wwxCgOBI38J8WhGunljikJ+YD9BySKd+DOmmE5AcIwF+CHD5lAzba 5u9LCIQtCmLZvckmIdzWJGHVMEl7WgO/kS0JYJ8tcRAv8pUGJfbVIehzJIYruWtIjfq0qTW6 0PP+iE8mNDWf5DQ3PA4Rn1xTxIevc4D4YBKP+ArSCMszYqYxeRlNMlIbmZiw1YB9jxw5xCfH IeKTc0V8tgaNTEyo2zxDNCK7IokJyeJCS02N+IRSRXxy1EJ8RyMTUzIBYGEP3IboHcMzvNQP nOOsOi6RRMXCnu0B8WBPb3iaXQHbT7Er7fCsaQkMiVGS9zIdJfB8VqJT3PfhdqZfl8jEp/Ho kOkoJSdOkeFvZxbuEaMlFhn7MzTVkTUfMI+fPNWRo9cu2zW9J0N5tkOOvuAnQHlT7dBOvkIy N01E0KlRnujUkH1egPIkf7ek9nsllMf2ACz1L0J5luIa5RFk38VUcQvAULdrBScKVChBMw6A wQOoOxwT72N0EQjIrf7r6mui+jbRmTkdmOq6AD2B1k0o03sAWBy/NVf1HtWZ8Ul6LRrlXaCP TIDMn4mEpk98TrTuKtmmKhYyGFJeDRkf1+sr1YHSGErBZZTqHTQDdKYlercer8OTG5rpa/vw sDL6VNXD6pXwea337tHqW/VUFLVdOgH/V+SbdjccAoCE/EKV5NT6RR3j90wEKgkNKhP21Ozh Q1X7/KaCW1344HNVs/7AffuD93zVdImr+s//D/oxxrsKZW5kc3RyZWFtCmVuZG9iago3OCAw IG9iagoxMTE4NwplbmRvYmoKNzYgMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCA2MCAw IFIgL1Jlc291cmNlcyA3OSAwIFIgL0NvbnRlbnRzIDc3IDAgUiAvTWVkaWFCb3gKWzAgMCA2 MTIgNzkyXSA+PgplbmRvYmoKNzkgMCBvYmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IF0g L0NvbG9yU3BhY2UgPDwgL0NzMSA3IDAgUiA+PiAvRm9udCA8PCAvVFQ0LjAgMjIgMCBSCi9U VDUuMCAyMyAwIFIgL1RUNi4xIDgxIDAgUiAvVFQxLjAgOCAwIFIgL1RUMi4wIDE5IDAgUiAv VFQzLjAgMjAgMCBSIC9UVDMuMQoyMSAwIFIgPj4gPj4KZW5kb2JqCjgzIDAgb2JqCjw8IC9M ZW5ndGggODQgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4Ac1c23LcNhJ9 51dg87JSlcwQBAGSednYilOrzSbr2KrKg+OH0QxlTTwXeThjWfuf+z97GjeSc5FI2iMzTo1I EGw2Gt2Ng0YDH9nv7CPjMf4P8SuzNMwylir9Z1WwP9iCfX9ecjYuWRTmSR7xXO27CsoxS4QM 04QrxrMkxK9MwxyXTEVJKGWeMxC89h9MZZgkLMGn8EatStD4JovwD7Q/4qM8E3EUUQH++buU h1LkoJ6qJIyTJGPjOXtxiRoRj1RwSXzpV+yfyzn7/vKShxHj7PKanVws1sVqUaxP2eVf7OUl +HMi2cthsC0VTftBDjknXjKxxWHwMF/PWjIEqXYVGedJmMXUz70k9tNqdL1mr1/9csFeF7fL crperu7Z88Vodl9OSzZaTFD+cTNdFfNisS4ZYz8XV6vNCJXiiIvToJWgSVs6qkLCobcJxOoa FhhVeFjQrKWge/R8pZsS2i5hYZqhR3q+LUM9er5iKFFhksIA90go2DaRDgw1uyzoYL0iDVUW Na2XbVvvLmusJ3OatUdcSybDXOVCsrQfc0vG7m6KBVvfFGxRfF6zze1ktC4YjKT4fFuM18Wk Lfc7yhfmkcyyOIGfE3GecJ7Vrh50R7HM4et51apWVvLnyfHMJFYizAWH3TbkHBgXvqMEbFs/ R2st4hlkW/b24/0FKmLYksy6CvT0eAIVgoexyuJtgXZ2hAdRQVBDBQ8rolY3oTDaAB4oJRVL wlSJuBrCSbevGUlRpHCRB+sZ/GDGf2g4Bi+ZAl74+lEokxw4I2dZmMJs89xQfnA87zHMVE40 zgCX0riVAfW29McBRo0hmEwulB1m2toPRujj6WLlRONezF1cs0kxW49KdldAUcrp+wXc5nTN 7pab2YRdFQwQpJxezaBEyxVgScnWS7yyhn9lo/V6NP5QHhNyiDASCWzftq6vLuxa2h6Xn0Ui j8lyMmh6VLuAOfAMJHJCdRH8ewRQDe3ME9gb/gDRH98aOA85V5mVwMCUzzLX0TKgUOvVaFHe LldrVqxWy1XZNJWA5k57Jwo9HIvuQgVd6ifJcrlcFKvjWXIMtqJYpJ6/jsIMGfvn8q74VKzO tBlPF++daY+X8wIzBxgsGy8xhh9xiuDstSnjrzAyNuz1/A2s9CGI9uZ8Z077rJrU0jCYRWRJ ucCwxgQm5kmeZ2ynYMbe6Alr9S4NkPtJxbkmpUKMkZqUKUhi1pIKdXhOLwUi4cRQTgxZKpHh sAMpHmFwAK2qcaakam43YkoT880DMZQw0a19/i3TwGDOfEmjhd1RBcVI2sQxohiQHgDJTM0O +NFvNRPqx9zyGnY9v50Vn6fre/iBiwW7Ha3W0/FmNlrpwXw6m9FYPpleX1Opg/HBI+GYHl62 guu2LX2H7L1uv+EFKGr2OHyr0HpDuK2nP4A7EO58s5iOMQM6nv8XeRaqSMI1Nfns7Dv3Cg49 2TWO5XEvJumhjBGZrJvM46G/p8G9TeZa9+qH4r5kmxJYl2AtwV4aL6cLDJFlMd4AClOgbXK/ GM2nY/bnyWg2W96x1XI2K/88ZXcjMrPLm+KYQ6mNtrkG9rWjL4a+On7AMN9FJDhF4DkPY8yB ngj2KgS7pYyHCXsdcx2R2lWxKK4xxSqLYk7TqSWbTedTClfB19yNVoDEa3Y8zfLxIMd+xynF +mZaHs8NxpkIeRphXcP2vBXuw24wbMlQDzcYAz/lGaaDTYaa6x67eGGXoV1DbAyvdUwLN7Yb dmyDaUlYHFYKYCYFDJbNg8ZtF8QnMJAQGU6AFlCUKFFJAtynIW53YvQqAW2CfY4YQvdEvgux JCWorRtIlGq33chkBP5dAzUlXdKrgYl/1TXQlTQaeDRcq9A3qcwdrj1gLoFZlWvOsvUK5SHU 0FxyeBxuVahBQU0QkOzoXSQG1jc0AgPKsvPlopxOitVoPcXVEV1ihOlIlHCmmkwfkKJd22wr xR6gtZIiLfNmWDXW2GsAS1sqQfwrB0wdJBhsMNcaDF6++GnXXe81iB5dySM48zxLEVGvS24Q XYkpN4UyTVc2lL3NgLZXQo0xjWZoHVYpFcYa1XmRUsFjPB9/WCzvZsXkvVkVP2J3IqUCayJI qmgwOwDhxXEInpxhNhjCml7QSMto67p2epMGgJaRFsVFmNGMoe4pdpYbdxWt9XLJFnOd1px7 MtfeU/RgrvIUTckNoCsjGUb70xmq5eInxBYyV2Gk/NLggSBexZodsFN4it+WqzngxKcCWTTX WPJajAs9mwkeT07a6tI2wSdOWDlF1tQWx9td2kyaamudPUYjDywoGS1O/WLm12EIEuodZcJq c9g5vexpYky9WHv7+udzrOnk7xh7sRpNsHZ0xt6EZ+y7X4p7rK6uJqUOPSEGRWEnVNYrqxeL iYkzHm2NRmBejTU1qKQWeN+w0t7B/4sUUmFSF7nAfGvsBg2o/XfEcV8gGyFNmWywiWWodnmQ tZQ99m8s0s3K787Yi/NXmL2eUeczUpUz9utoNb5BiC1Pw+PNdgSmz0Ip7tsyIB2IQiywuwyL ATglieiHR8htO/v5Zn2Dtey/s+eTyaooSzPCHCn9VWaUF4DObLDaEN0uxmppJzsjXgcwLxME 8mKk0O2ZXXwTPCoFHB9lbAwRj/Zk7nKKbOzVZvrX4r8FfEr7bu06THOvZk0pDkDPYhmKrXjE UGYZshdvry9evWS/nZ+3700fpAvarYnyOMH2AEzNmgwOoDM5QtcSaYeDcRpRGspsawQYjHr1 Y+7lfDSd/cDW0/mPq+ltER53e0aawjxhn7LB7ADCXwkW3FMXWe2+nLMXAH/JgJlkOdZVDs6y nz6Ak2TISOMDDeD0ZO4/s+I9+3WzGn0qP0zvu3jYoLZX6/FlEC5FKCIlsFrWEOK3d7FJGocV LDsQOtlFjE8SlevH2xOOl00GB9CZ2NuRCKyWD2W8TCQ2J9J+hCGC7J7M2fFyCdfxFAMmZZoj TXmL2QHoWkI7TA5omg1gPmEMOBEqzJRKBhO8SLAjIEqxRUCrfpcAVsthqEd0zW8P6cnci9X9 aMH+KK6OmfnObWityeMQEBly3Xw0yob6hoL9k168nS+RfDYdLVpqXB3Odp1aNhkcgPvCPnER DSgehaV3BLz9BGRgSKwfc3aovCK38ePYKluI/OmWCtfDxcWRCmMuctaU5wAmmNhNhpTZvQvy u/i6pYDqFqmPjegQkRVIrUyx/HNgCH/6CaZIE+yh84t+DR9RLd4+IabAqkjIcZDAYDCFQPoX 9wcJDEGnkywU1UECjS77NkotsGyIXcLDUWpsKVP84JTs6YGyiHmICKZLoW90WWVlT5jTiLMI aKej7bIhKDWO0IkStdcxfhOljnMZxtj1YJW6LTSorQSdsQLbPWdIeMF/Lz/f4riYkj3fvN+U axwddKaPiqmtm+vLt69G7wssSL873tKzP0PGtXAwnjam1HSfP91dKQ9m9wdvYVqcvUPMcGJO e6pn+mNW0S/TnwQXJ8A+iBQA2SLTn8U4qQQXIsvw2z6fPqD3qk2hekdmWt0bQrUDKR7YJh9I SFHAstMIsXValZvj1KutohmKkOojFbY6u2oyxw7bNOcoSRFzxn6fWgmOUyKUjBwqW0lhWssJ yoNUVRYj04oSNBxxhchrjJUHz5QrACl8PVQxLN6XzXTARVI6rC9LZBymKXLqafMTEQ9qJZYF omVrYdeK5pRI+SLTnIq4azJIWRZcCdi6wUkdMbtjb422bG9n3dl3TP4B3pQ2+WI/ltl2TPda B+weDcFxGJHEjmRfR3AsgtN2QyDmHO/jLsGpBqifs3Gg7yXOevLv4zm2/4FGCiKOGk4F05/G /gm8BVWMIXpcznDJseUhgtxxSypavW3uHG16C0/9t+lV3HvOHCHPeaC/4ttB8qLt2Q9vBce2 YN8dKkczUlLLqic79RpI7fSa1y/fka00vFJdx8G4UnrPaE2XamXmnDfiJTbqmkVA0RzIIyF8 T2e9AKNtT6bIDXF33FuUczrMJTdZjAhz2FtLNMX8L5cujhukUtezf8wJQbE75O0tO3mDHcVR GLMTbJCFluLi1l3cuAv7KDhB9MHUQZ6jrvuLf8s/Ar137PJfJmeG7MAzqLf8Vrdb/NrxpOKX wqgSOzsiC3WQlAIh0NF0f6umXF/zA3WxuAYK1+LvbYu5KQhOkgNP2Il/xxHxVX+wRKR7N3XU XNVXv9bFR3uOdDSZIzu82scpcCwUjjQBHMDxUBm28deOhGsZ7HEamANhVpMCgisUJsNZFtRZ 5o/FUQBaRvxQmvPlKbzdCWIDz4T/A1VAGfSAsxMoQcJO0CjFTt6eMslOFMqDk1g/fadLIIxU 12mqy/7TDCWNlIocuuXYqgs4jrJdnq3KIPfZ83wJdQZnU/1t5NuAcfAHzhanmKeS+hsjwO9E 16zXudb1N7ocJ4mgbWgh3jU0zbtUHhDNNu1x8kdKZ+RTJ8lYcGjUoR6ot6b4DNmDbTJW/Jlp 7ik6SHcjMIdmoKn4RVdRmX2E3akoM8/tE3CMoitTrTB31LNoXuEoGlKWxntT9VrLDTKpGAjb NV4ibBwjuRoq7Zsf4GjKhtptdyFJdvuAxL3QTSdIHR26SQQcaL9ghd4kzFKXtARwGgcSgLP7 PYHfocnmpgt0czgtwDGBiIGoGnJzJbVhzRVV8IuSiQWQR60EoxDCm0EduGFPapZjblwHbhi1 UiXrwA1gI0qAIh10VLYApEjjDXBzlerAzZVVA74jXisxLGhaDt5hwyyxCraqeq5BegAxsNAI pmLBSAqU+uI2JhNEwGgUtjjO389qSMvVMcgM4xnAlYFtUsF3I1kYAEw/BDSH7cP7zgyMy3AU KWAb0LyDbVkMr08f1DDR31kA5+8rFMdcGcAXwJmnaO7c9yyU8/xYKCctsx7JufYZJOfuNPLt iORSoD4kCteAnPqiXgTy9epmLaCfvqMxzgYCZbls6JVhfGYP63UuHKqL2WcNxEkaRgUSe2lY riWfdEFxKkUWSuozeCpURLu4vgjFmaFAozcMBl8LxTl+j4biWn/gG6C4HGMgBKkHfy3Qh1Ac /BpPMAPmDsUhDJoi5VofA+0O9u2I4pBLIqrtoEdHcQC4QBRfhOIsxzUUB8+2jTy3IQCQ53Og LAImNXyJXDBgueVpgF+gEYPrgDuB34DTRvrX1AGKQTlQDOoAxPiagEMoB5ZDCdUPCCChBIgD v44+PfX0u2A8nHEMn+uiuITxMDtr0dbJcvE/jc3AjeEVv2gVcDTajx4wv+DS8I0Sc72oP6aj dPEcCJbAIMSHP9UrmNNVNxpHoq75niFiXlhALCBvHkCMqPSp/vXJVIufmHO1zIum7tWm/uaS PtlFgAkSUXEyaqUsPBJtBDgHi1CWsYPqRh1QAsiPa/CGCQh4RskcLOEGbOIXwBiPTYkhAZ3x LwMp4xqIGzXpqTZ7XL/WjX+lhWOIHqKJ+QUoGMrmi47RAKyYEvOuYRF9h/I6Neiqp4DyLsKE u0my+uEOLbXxdnOFNqPjTZearr4B41BHq2MTumsqkdEbsOhfXFhNrJcZYhiOUMu8YRVG00d/ 1dUH3YmP/KNdqyV0R6f2qGa7W081KMBwYEqKBbU0hyZukSYDx8GnLQz8AjJAUyAQmkJBrvil ORZGEqjIM2OoKEPr8Ys+pyLIh2qbMkPAFuGmkyLoLfuVUbXUA2v3xrzvTS9+3Bg9MP1Y76yl 9RxWd4yCmJdMZVNi+nTjfAbpgaFiP2CUwrxhfjc0RYUN3Da/1nYGivEHTiR3ZwFYKbTWit// DygcvfEKZW5kc3RyZWFtCmVuZG9iago4NCAwIG9iago0MzM1CmVuZG9iago4MiAwIG9iago8 PCAvVHlwZSAvUGFnZSAvUGFyZW50IDYwIDAgUiAvUmVzb3VyY2VzIDg1IDAgUiAvQ29udGVu dHMgODMgMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9iago4NSAwIG9iago8 PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+ IC9Gb250IDw8IC9UVDQuMCAyMiAwIFIKL1RUNS4wIDIzIDAgUiAvVFQxLjAgOCAwIFIgL1RU Mi4wIDE5IDAgUiAvVFQzLjAgMjAgMCBSIC9UVDMuMSAyMSAwIFIgPj4gPj4KZW5kb2JqCjMg MCBvYmoKPDwgL1R5cGUgL1BhZ2VzIC9QYXJlbnQgODYgMCBSIC9Db3VudCA4IC9LaWRzIFsg MiAwIFIgMTEgMCBSIDE1IDAgUiAyNCAwIFIKMjggMCBSIDMyIDAgUiAzNiAwIFIgNDAgMCBS IF0gPj4KZW5kb2JqCjYwIDAgb2JqCjw8IC9UeXBlIC9QYWdlcyAvUGFyZW50IDg2IDAgUiAv Q291bnQgNiAvS2lkcyBbIDU5IDAgUiA2NCAwIFIgNjggMCBSIDcyIDAgUgo3NiAwIFIgODIg MCBSIF0gPj4KZW5kb2JqCjg2IDAgb2JqCjw8IC9UeXBlIC9QYWdlcyAvTWVkaWFCb3ggWzAg MCA2MTIgNzkyXSAvQ291bnQgMTQgL0tpZHMgWyAzIDAgUiA2MCAwIFIgXSA+PgplbmRvYmoK ODcgMCBvYmoKPDwgL1R5cGUgL0NhdGFsb2cgL1BhZ2VzIDg2IDAgUiA+PgplbmRvYmoKMTkg MCBvYmoKPDwgL1R5cGUgL0ZvbnQgL1N1YnR5cGUgL1RydWVUeXBlIC9CYXNlRm9udCAvVVZJ QkxLK0FyaWFsTVQgL0ZvbnREZXNjcmlwdG9yCjg4IDAgUiAvRW5jb2RpbmcgL01hY1JvbWFu RW5jb2RpbmcgL0ZpcnN0Q2hhciAzMiAvTGFzdENoYXIgMTE2IC9XaWR0aHMgWyAyNzgKMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDI3OCA1NTYgNTU2IDU1NiA1NTYgNTU2IDU1NiA1 NTYgNTU2IDU1NiA1NTYgMjc4CjAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgNjY3 IDAgODMzIDAgMCA2NjcgMCAwIDY2NyAwIDAgMCAwIDAgMCAwIDAKMCAwIDAgMCAwIDAgMCAw IDAgNTU2IDAgMCA1NTYgMCAwIDAgMCAwIDU1NiAwIDU1NiAwIDAgMCAyNzggXSA+PgplbmRv YmoKODggMCBvYmoKPDwgL1R5cGUgL0ZvbnREZXNjcmlwdG9yIC9Gb250TmFtZSAvVVZJQkxL K0FyaWFsTVQgL0ZsYWdzIDMyIC9Gb250QkJveCBbLTY2NSAtMzI1IDIwMDAgMTAwNl0KL0l0 YWxpY0FuZ2xlIDAgL0FzY2VudCA5MDUgL0Rlc2NlbnQgLTIxMiAvQ2FwSGVpZ2h0IDcxNiAv U3RlbVYgOTUgL0xlYWRpbmcKMzMgL1hIZWlnaHQgNTE5IC9TdGVtSCA4NCAvQXZnV2lkdGgg NDQxIC9NYXhXaWR0aCAyMDAwIC9Gb250RmlsZTIgODkgMCBSID4+CmVuZG9iago4OSAwIG9i ago8PCAvTGVuZ3RoIDkwIDAgUiAvTGVuZ3RoMSAxNjA1MiAvRmlsdGVyIC9GbGF0ZURlY29k ZSA+PgpzdHJlYW0KeAGFewtgVMXV/8zcu+/X3c2+kt3s3s0mC2HDKwRCIJIbSPARkGcwUVIS HvJUwAAqgsQXSERBW6n4xEcrWJElCbgEW1KlWrFUvmJttVVpS9X6NUr9KFUhu//fzG4Q+vnv tzdn5szMufM6Z86cM3Oz6qbVC4iVtBGJaPNuaFlBxC9vNKJX561ZpWbSNj8h+pnXr1h4Qyad swzpGxcuu/X6TDpQQkjUu2hBy/xMmpxHPGoRMjJpWoa4cNENq27JpHP/iHj2suXzsuV5nH7Y DS23ZNsnvFy9seWGBRn6cT/g6RXLW1dl0zWIp664aUGWnjYQYvkZLzsz6LIXjxRf9iIhdkIo MnzkS1JJniAGwohChpJZhMgvyvlEhzQv1zlmf7/7+dFzHJX/NAaMvAryzF8GDOLxLx6be803 e/sWKsRoRdIk6HkB3jOMS11NJijkm73frFUyLfGS/p/vIJkpDeyM+cPHX5GKyUkAk4o74vnh g9IAKb9jbFhLStFOl6fUUT1YUlHjUBGqCJcD9gIOA2QyRwqhVEG4AdAG2As4DDgO0BOCkJeq gOWApwAnAXopXwp2qGGleoCUi3dzMV6H5CNfANIAiYQRDgVMAcwBbAU8BdALOp6zHLABcBhw GqAnmuTreGgE+u7ruE9EnUuWlYpkSyY5u0kkO69pzMSTp2XimiszZGMyZMPLMtlDxmfiASWZ 2FVU2obKO8220p5qr+TFIL3o+AqElB0hDkpJmOyUPCQBYBK6KnI0ydVZGCt96rAkEyoxiZL5 JJzukWiHzVlabWZp9gVxkTD7nPVmSlhvp91Z+lT1VezPZC/gMEBif8bzJ/YnsoGd5HOOsArw FOAw4G3AFwA9O4nnIzwfsg+Jg31AhgKqAHMATwEOA74AGNgHCBX2Ry4xIuR4FYCxPyJU2B8w rD8gdLD3gb3P3k/3sBMd5RWlBwUSH5pFwkVZxBfIIi5vaZL9puPrYkhUDJyGRB2SCsg4MkIq 6CgaHk5K/o7KxeEk+0unGg/vrB7G3iEJAENP3kHL7xAVMBXQDFgB0AN7F9i7pA2wDbATkABA yhAqAJUdBfwK8C4ZBtAAUwFGdrwDzSTZ2x2x8eFqL/s1ewNLL8yOsV+K+FfsdRG/xX4h4jcR h1B+lL3eEQqTagvKCd5RECuIh6Jcx37eWegKp6ud7DBmMIxwKKAKMAUwB7AVoGeHWUHH/LAL lRwiR7GGw6yD/E3EPybPGIm2JKzFJkAAVR7ExlwGDMFT6lMxpsW270CSB7EHHgLGg9jdW4Dx ILb2DmA8iC1bA4wHsflLgPEgdu0cYDyITZkJDEGSPfly4YBw+ZSlVK12sJsxSzdjlm7GLN1M ZHYzf8jXMu/jYx2DBmHGHtXixYPCbd207RXaNp22PUPbFtC222nbHbStkrZ9j7bFaVuQtoVo m0bbDtHRmIo2qnVdkqzQ/LTtKG3bQ9taaVuMthXRtkLaptJyLckiHVdi1SGqFVFnNV90LNJ5 2ThoHweLYEYjkPkIdMJhhG8D0iKlgUgtyBDnhnhc0DmoKpMeMqZ0efUV7DW8+BrY8Br5CCCD Qa9BjF5DJa+hOgfCKsAcQA/gC0AaoAd1AcaxVYQOhEMBVYA5gA2ALwB60Z0v0BVGliPkXdwr OjYUYRVgCk+x1/AU4ImwiJavBJW4coW0NUgdITollA6xcuL1Qi+7nEZnktoO/Mv21b9sxFRt Yg+wrSQfjNiWjbd2fJ0fTtJHOmKHwtUe+kMSkiF1tILEaBHi0aRVpEeSoJHnl5Eg+wni0o7g LLzm6IiVhLupnb91IPx18FT4b8EkA/pp8FD4d2pSph3h3yLnJwfC7wQ3h98cmjQi55VYkiLq VgXpweDo8J6jgvQOFDzaEb6dRwfC64OXh5cGRcGCTMH3WpHSHOHpsWvDV6C+muDcsNaKOg+E q4LfC1dmqEbydw6Eh6EL8Qw6CJ0tDopGoyFRYX15ki7SSgzbDQ2GKYZRhlJDiSFiCBvyDQGD 2+gyKka70Wo0G41GvVE2MiMxupPpk1qc73puvdj89BBoSmSBK9AwlKsZhIRRIyNXkUSOVMfq ZoyndYmeeaRurpo4OyOapOZp1yZ00fE04aojdTPHJ0bH65KG9PREebwuYZh6XcM+Sh9oRG6C 3ZukZGZDkqZ51j2BhGtCw0FCqfOe+wM8HnjP/Y2NxO9dU+Wvco1zVkys+Y6gWWQ218S//fm/ ReP+eH5ie92MhsQL+Y2JUo6k8xvrEt+foc5uOEi/pKdraw7Sf/CoseGgNI5+WTud50vjahob 65J0lqAjKv0H6CAxiEBnxMbM6YhqDGXoHs3QFeF90BXyCHQmEykSdEUmk6CTKafb11pYW7Ov EAFofCppFTStPvVimqNFoClCABpvGzkqaI562zhNYpyoJhgESQgBSGgeCQqSIM0TJKLn+wTJ 0CzJ5gskm0VLUqY3goYHqMZ2sp/GdhI0F03kf0YXjI/HaefYxnmzaxdEa5ujtQsAzYn71izy J9rmquq+eY28QE1Isea58xbxuGVBojG6oCYxL1qj7hsr3vu34tm8eGy0Zh+ZXTuzYd9sbUFN x1htbG20paax8/KpZeWXtLX5QltlU7+jram8sjLe1uXivX9rq5wXX87bKudtlfO2LtcuF20R IeNTG/YZyfjGCeAfjzuZxQx5bQ5EGsd7lRXjhPCOjfhvD3TDWtlFLPHGhDU6PmEDcLkeXD24 mhdhTfEiO7Id2SL/7WMjgW66K1ukINsZHU/iq1a3rib+2sU1mb9W/JC1ajVnRSaM87zv/IGk NqG11HDbui4xaEZdomratQ37DAbkNtc0Im9Mf57FUptM92QyhyBzDCeUpAuEPK+S55lMWcL/ LQuiT8jG7ByEoXGok2ohuoq0NkqJUN1MBlUw81pMw+xrG7phS/FNorURA2ylcdraXxsfh8BJ Jodg2K39sGp1FsvOxapsLEhb4yTe2j8l/dXF+WSJQMzVqjhUm66b5ALydM+TXDlG4P+kPwF8 yuPU4vSnvJzH7DMoumQWCNlF9tDFZA85TF6lp/HWXnKQdBFuAtWQx8k68gOyCdvatcjZTKbj 0SH/BzQ33QXP5GlsmE+TY6C9htxOuomX+tN/IxvIPdIJvHUPsZECUk2mkuXkfjopvZrMJh/J d5FyMoncSFbQtnRD+oH0Q+nnyI/IQemX6T5iIXlkHp5j6c91v0//kQzGGw+THeQj+pBpP9HQ ShsonyA3kUelJpmmF6a/QQ8i5Gb0QSaTyTHaw+KofQH5hPrpOmkCank2nUgfAVWQNJFF5FHS TUfSy1lENzs9OX2MeNHGLah1B+kgB/AkyU/J+9SqO51+Ln2a5JISciXG00V+TXukVN8dqSrM mw6zVEwqULKc/Iy8QY7TKP05W66z6kp1mm5t+h3iJsNJPXr7PN78mP6L3Y5ng/S6PDE9Hk7e PeRBPtvkF+RPNI8OpVPoLFbMlrMnpZuIES0OxzOfLMZ8P4LaP4QYHWBW9rb0rPwT+Zw+P3Uy bQdHYuQx8gT5ObVhpCptpXfSd+lf2AQ2hz3G/iz9QN4t/8bQglF/j9xA7ic/If+iLjqaTqPX 0UV0Hd1EH6Q76DF6nH7KqtlMtpR9IS2SVko/lcfjmSG3ynfpNuru03+aakgdSf1X6l/p0vRG Mg3ycAd6/zB5EiM7SN4m7+H5iPyZ6qiF2vGoNELr6W14bqf302foLrqbdqGV4/TP9G/Ykv5J zzHstEzPAjB+uAkUZTfBwvwBe5y9jec4+zv7WvJJBVJcGilVSo3ScvRqk7QNz37pT3Ke/Lac xjyX6rbrntLt0v1E96rutN5quBN7/K/OP9s3qO/DFEndm9qe6kh1pf9EPOAhdg+4YJXofQue JeD3dkjcXnKCWjF3eXQQHUcnYWbm0CV0Jb0FM3k3fZT+SPT9JfoKZul39Av02caCos9D2Eg2 nk3B8z22gK2EMfYQ62Lvsm8kg2SRHJJHGiRdLjVJC6RV0q3Sdikh/Ur6QPqzdFY6jyctm+Ww XCDH5Lh8uTxHXi0/KX8if6KbrXtL91e9WX+DfqM+qf8HrJpxhqmGaYYmw1bDAcM7xmZI52tk P3kZEnjhR09Kd0i10n7yABsh58KF+TXkeQ6ZL01mkFS2i97L1tMuVqi7RT+WjaVXk9NyDHP9 OnuKnWVjpcm0js4gS9jwTIV6t/wCsEr5NdIrv4Kx/Ro136K30tvZF3or6YCNVAEb6RfSMDku vUXelz6iBvlp8gfZTH20lz0vTYUU/FQep2sgEelx8pK0kq4n+1ktIeZzxi2Q46vpC9ALM2kp /UpKwwy+GlJULv2F3EWWst+TXqzje8kP6Xx5IXmAjKDryCfkx1gVxbob9YP0HvomWyy3sxza RZi8G6OroIVU0rnJ3bRJelT/BXuPrCZvy2byofQiev82e0maLJ/WTaeLsALWk41kZfoOcquu Qf4NXUgkOosUySeh3dZJpXIE8QZoldnQaQewuruhB6qlycjxQ3ImQS7qoSEexfMI9IQMCVqM NX4NtNivSZd+JkuShTo7hdbBSc1bqenk2vSPyY70QnJj+iEyGPpgU3odatxF/kq2kl30ntRt ZAVcyfewtifpJrK3dRPTg1k7e4/NYNsv5S9mu4j6yWd4XgJnxukOkXb5d2QGqUpvSf8W0j0Q GnYHmQuD9RRG+TlauELqISNSV7N96YnSCoz3IzIt/Xw6TM1kUXoZmUJeIT8y6EiLIQ4eJ+hv MN7byAI2Pb1KWpBajHnYilnQMFuroX82axPqZ1ZrVeMuqxw7pmJ0+ciyEaXDhw0dMrgkPqh4 4IBYUWG0IKKGQ/nBQF6u3+f1uHNcTsVht1ktZpPRoNfJEqOkpDY6sVlNxJoTcix6xRWDeTra goyWizKaEyqyJl5Kk1D5ey0ouoRSA+X1/0apZSi1C5RUUStJ5eAStTaqJo7VRNUkvXZaA/D7 a6KNaqJX4JMFvk3gNuCRCF5Qa/2LatQEbVZrExPXLGqvba4ZXEL3WcwTohMWmAeXkH1mC1AL sIQvumIf9Y2jAmG+2jH7GDHaMMREXrSmNpEbxauoRiqqbZmfmDqtobYmEIk0Di5J0AnzonMT hFtKcUFCJohmEvoJCYNoRl0MGydB7lP3lfS0b0kqZG5z3Do/Or9ldkNCakEdtQlnHO3WJHxr T/m/TaJy2GSbLi4NSO21/sUqJ25v36Qmdk5ruOjdQITX0NiIOvAuK5rY3D4RTW8Bp+q4LZ5g 9zQ2JOg9aBKGZZEYVWZ8Gau3qHmJmjBFx0cXtS9pBmvy2hNk+q2Rjrw87WD6JMmrVdtnNkQj iapAtLGlJrjPTdqn39qZq6m5l5YMLtmnODMTu8/uyCJW28XIAkx6pkxggpxjddMvzCzlfYxe CUswoc5T0ZOGKMY0mgcLRpP2eaPBAPwaKd5KzAdHFidME5rblTE8H0OkCV2RElXb/0kgAdHe v1+a05LN0Rcp/yS8kMvJBVFL0JZ+PBGPJwYN4iJimACeoo/jRHrk4JI1SRaNrlDgP3OngUzF 3LY0jhmK6Y9EOIPvS2pkLhKJtmkNmbRK5gY6iDYUtjVr5iU9/SWeel7S1l9y4fXmKCS5i/uz xJMwxi78ORRvTu2iMQnq/Q/FCzLldTOidTCN1dr25qzU1s28JJUp5xOKeUNZFkvkTGiQAgx5 HGMBSZRmLOR+EpjLDdaEXIQ/vRDq+UmDEVIpcqg6MaE0X5EJG82RSHbN/F8vJdOn+Vsi+va1 7DASY+LZjma6nRh7SfqS7lnbpbqZUDkMln17u/mSMohappdXZiNIPBz9iDohQeqxMovwB5dj NIfGQELDlKFkJlaRyG4MZJOXEAayLzXix6VzcMlE6Mz29olRdWJ7c3tLMt02N6oq0faD7FX2 avuKWmi7jOAk0933BRITtzRixhbRMVgejIzfF6X3Ttun0XtnXNtwEEcc6r0zGzoYZROaxzfu K0RZw0GVEE3kMp7LMzmJyhOkjmKQHcwo6AMHNULaRKksMkR6Hk43RF6GCHmUzEuyTJ7ST8eQ J2fyNJHHx8d1zISZDVm2CIHgSw8yhBsaVMNtDA5yK6kHfASoBMwC5AF43mRACwB2KqkH7UHd LLJd/wJ5BPGTgNnIrwNs6gfQFBKCyvmCILg90sPyIESFlZ7JEdnfETB4DjIsfj1uY4y4TzHD R7HCr/m/frjKIQ5BhOnHzynC/xy4RHHORURu4J5smh8I8p8Hz2TYUjtg3zwm1+kG6nP0iw2d xmPGc2av5SfWIba77HMdZYpP+dp5H06z8IoOD8ZhICTijDiLEODki5xXpZ7zmo6cI6rcw+cG fiKr0J0A5YyDREp/2OGuYMn0h5rqrvihRJn0lLQXFxVrCEW3KCqWiFn6lLBPaZLu3g9+da71 x5VK5Uyv0kuqKqsqN+mGxJvWK0eGD6NN8biHjqB097ZUQ67u79+gBkbq05/ITl0P7rjyaf0+ yOHMBs2cF5J17pDN5jMl0592ORysniNars0GzEmsPId4rVaEVp5HhsInPobgGKnqreodPiyw T/+/azqDmvS8po+7bDaBfK7lWizAnEThOUSxWnnI8y5U+W2dXXo1VwlCsWCJWH6GTc0LcAEc OFacK+s3sXst9zretOtMBouf1eZM8lyVOyEwM2e2Z3bu9MBSw1LLvJxlnqW5zYFb2c36NZa1 jk36RwzblTf977N39e9a/uDIuzDwVpMWiZYNM1FiUkzMtC3sbCVQJpoduSpMM0a2hd64D1N9 tinei2BlHNMthk6bVsLJHc1/FNDYmKO4Ro0o9XpdHoXpowUDYjmKd0TpKKcSixYY9PVLT+xc 07Fq/JITT79z64MHd69bt3v37euuamInqEwve3FOZyr9fiqVem3PIy/TJ1I//OI0PMclny/e yGXlIzDwHHhnJns1VdJszrKl8ga2le0w4qqSmohexySTjloZPWoWvTfzMRGq4l0cxXYpCliX TH+mOQVDg4KhdsFQzLKWy9nVzxPBnzyrTrM5ynT9MzFMR1V420yXa+mmlfQe4o9frZzCZGBe sqckSFRO7qskVVW+Cuqs4GJImuKRqFOvN4wcNap8BDvXVX1i5g//PHSVfNu4deGXLj86h4+t ErJswNhC9I2sLJmcis2fk6OvtyXTZ7qcToF8rpkUBVjIrQtxEfVxglCIl4aCdpSEIKAIk+yQ ZmVmnw83m07G1LDTVTH0nWM8PEaG9vLOVvHwCEzrQHYZ8AatLhcTDWomhxNYpp2TmsWVw+pD bp7H6+5A1XypWCysHsjfNTGL39UaXyO8Pd6aaEwbNVY3Vn9Id1h/yPCG8c2g4Upro3Wmfal1 vn2ta23OZtcrrr/m/TVwOs962PJyDgvgoiJfCSn6n+FoxADhNyI2gVt5IbNi1OuPBvPcwWCe MZgHbWHMC0q2kJJkz3VOcVJcY/j38xEQMR0OyqzmVt8JzDaXdXqI3QFdrNDRmtW5vwpHGMvZ BiazblaIy4qt+zLCDr1yNs7VC5RLX2VVb1/TKaeLcxbBJvuQuB2qBgnwWSwBvgJGkybadFNj Y5EnEisHx0eNGlkG0dcbBozi68LjhiTgTzacL2e+omcf/WLXjtvufJwezPnqv06cveL5V5+Z Hdqzp7pyXs/tR/56/dLvP96e8/Z7n+1peOGV5+5tGQ5JmZX+WPZCUuK0Mcs4S65f41LsDxLK RTVuRYIWR802h9URMpuLPaGgHCoO6optUZvVn0uJS4XqYfWqIca5yMljQ7lCOzaUP8RVUVWl QKNCWnpfV153VShH4qUcICzaQJ3Na6u1bbTJtc5rnGsC0nTvMmWJe753te1W90Zbu3tz4Ec2 s06V+O2HxWK12WUDRbuUs0XDAA7BuSwmNjqyy2r1yP5u9hzJZYu0AeilDt20uVrnqMtVpvq5 JKtthtaY0E0xSmJKjKHHZ17mJbFtg/1JOroj9wTtpqOxkfRolm+1VUmSPpTlYbxXcJHrrDPx poze6gMbMThF8DPDTixVqDCsVrqyMafcy3WWYJyh/ALaz0PORIMXIYkWxGZ1hR9eumHvM+tH THK7LK3JjUsWb3F3RT576ZajS6+ff+e21Kfv/jxN7/Lv2JS4c93T7ifZLevn3Xn33er+NxZ2 zJ/z+JDQTx/oSf3zY6jYPOgARdcN/WajMW2Uq8G6yPqodbf1TatukjTJ9gNZckHGiVUvGXRm i2QgViz2o5LsliRZshFmtckG6RAud43YgndqZiLLICFHzXKSXf+yTmfW8sNl5n5NCIRvTKwe yOdihzInablmM2gF0TJDW2SkYZsDWzFm1eYuI0yBnSYhfVK8A+TUAc4Ftt+epFvETP89Hm8S ivAMVy+VyseK0IPKmcqzlc4KPskVFZuGxGUsGYfDgekWZ9s27PmuCui4dzTLiAqpYHCFJOfn V/IqGsEM0Ghuq2apsLZNrbBqsQprQRDx4ApOEG+EWTGSjnCO8ESdkpOy7X13sye+//rrXamR dM6PpAPnr/pR6mks6of7lkLw+N4f0f0YOnZWZuXgTgzjs/FJoEG7OeTxBF1cc1ocshwK2uyU GPzYL4RFIBCxyvi+z1cJ3/8gRH1HsDL4wih2Cd3rEGFd3q357fnbc57Pec36rvUPAaMpx28f lCeZhumGWbqhxySsDiXH7HHl5By1O9z2HLfdYcMS0XJ4RzT7Tjuz2x2ah2Y79bJDpif48oFW 01TePeccZbmyQdmqyAoWiV8sEj8lfsXP0NnMIvFvU12v0JH4/uNhCNXoDvv+71osuJa9eLF8 u1yasJFxnScG2uSsGNoEtXBqk3FIXAcuEqH4hM6jK2FtXbJssFZyIp6IBJ1HPG4DLIFY/U89 O5bd2bVnyzVbBu5+gL3X9/KUux/socZV95/5ZR9tU9rvO/LMox1TqrzsHy+m1sxOnf2vNx7s OMmttsngnAc6L58MolOyWi/soGEcn0o0MDCk2ajNhi0xoCsIuW3mECVFCqYgY8EpIZ/CN3yf 0Hk+sAd41oI79s4x5Rf9nGzqVY40cU4OXppLawyapya3Rr3WNVNdKs03zDcucc1XVxlXB+8x bgy+a3zH6zSofAUMyKwJfX1UKDyeFREFBl4wQI2qEV7g5L2camPoZ4CemMMZCaVn6u8z7NnR movsL2pVBCMVfFgDewWjOP0ytxKVbSVmruZCtELzVvnm+Jb7NvhkH4xSfb3Pyxv1JVlhZzxj pGEl9vKdS+i8rMbjOxcYCGtVcIwvH67tGqkhNkCYZnoD36BcfIOKFhCnUo6Ul7q/1YR66Vyn v+TKpbOq6+ey6lcWdvXdfPzuP6VOPbH50z0f9JVPeeDqm5575ra1L8gz7EuGTR427vM/zmtO /es37b2348h3Hd39812vnv+g6YXG5JOP7N2LCWiBvvPi5shGVmj2IzYq448ZZRN0GV+FwxiV TVZbqyQxPiVTxBYtsTyHsdX032QKeD+HSVWIltMNMB5zoYiEFF+tnGlaWTn5TO/VyllujXHP gO/eFU6hgzD+lU05IyMePZH0hugol6u8Rdq/JdVbN8pxULrzfzbL3+zZ8nDKlTqX/MMe+hl9 43Hux8yABOZCAn0kim9VSEYGu6wkEBrCdSTsMFY/ZIgrEtLrBoZctpDJyjdYGP9noCaBxB3g pFAkQDKGE0dEocOPvfK0ME8FwoUVSFZ8pUKPldtZHlGjR4ivJyu+GS/kIlcEHI73VsAcyXok L4uOCOeDdwQI78gp4ZlwRORl2+fmL5o9rxVwQt4sFy7eIA/5SL8dX/+SQVtU6MNMT4RPxFdQ +UgvLfZe6b0y9rH1b8N0pmE4lF9P18mrjCstN1lX29b67iPtdIu80XiH5W7rRtv9vl85X89x FWCldATVPB6p6lAeDVax45/UQsWqlYT8xIpu7BxCv+1JqPWwiZqSbKGmxFsdmgqL30GJQ3Ew R5I+eKDU35qQqITyjsJWT78hr3o0D/NsG37BpTmDtQ+pgYWQNRBcFU1D+eD4ppVdMdy2g2W3 kqxsbKSx2Mgyvj4usgQIcnLc3n67QS9dvHTokhXLPj7c89nSGzbdnzr73nupsw/O3bh00T2b r19475grt824Y9eeOzc8LwWKH1my8/2Pdl7/w+KSI/e+ksZHGz1bf05nLrr7rjnzNt19Pj15 25Qft935wq5+X5bLZAha8aWM1/CyJYwtoMiJDeCsYDLfCcTmDuS0NpBz1O8ULHUK79Ppd5bE LQNDDnvYPsUu2e1uMpVSYUbaFHgVlO80UKo6wfEj8aZSoURKxcSA81wQFa5FP/gFFzrhUF/U iW/3Tm2Q2DydQor/P61e2ta/NYWWvm1IKxuTN8mrRa/zXhO9XlrmvSFvYXRt3vrQlrz7Qo96 d+e9kveZ92P1rJpzmfdJ7x6vNKZ4vp4N4PtuFMLkj6h6dWBoin0O32SDfHj0xNSMSu7incAH ShXEAo3svHRb3VbC9XQXV9POC7Lk1JzMuS2reeEe8+2TixLXuxf2zn61S5pW0iY4ycLAHMdG lg3g2hYxgTDhHoO7zDEqHAaPkKUVe7zrWmasnzqKjjp0w4Hz1PD61t7b1v7jmRffZ2/9aNUt HbvXrX+azlDW3jhpw+9XWP2zllLj7z+iyqOpv6S+TH2S6nzpsFT22IEjj2+BysVOehDuz0bc 1POTmdGwI3DKZDAxfaUsVVK9bGaVsGsIUzEXTxuffgQOP1YF15/wBgTLxXLIGTnCIwEOHjt2 TGo8duz888eO4Y3tOPWZDvvVQlNaSCoorzCaxgwwj9SPMl9uvkbaKP1OMqwxvye9Z5b0XLvB vmf1A3Vb5HbdC/JnRp1ZpiPld2UGpXlSM7kiZZLKA5wGdVorXDy3E2ljNpZ5nB8pQ9zT6fLy /A+1y3LRZlHRZUZTbu5lcLJMuBEy6yRZVnVmNwxgk9GoGvRug0FvNuO7SZkygwWXuGaJWXA6 lWRjNAd8/J26hK5Hd1In664y8jzLMANVDW2GhEEyJNlGzWpR+QSp2fMEvtDEwcJZYRrjhOEb eDYihyM4U0imv9TMXI2SJuvYXXxS+e7LN+k+zC6fYRxhVVbC2ELAAWuMH2Rx7xKxX9jMBqNS aazEp2F+fD4SwBn5QSKnfz+6MbPweeJ0p9XJ5+u05gOiV+zOMqNiV8pMHDMrNqUs+yFIIzRa pgf8+xLNaSrAvJXkVsgcCgIVOPD48IAXqLcCnPoQ3n+FscBdIWvuCj7N+4uAejIWeKYafHoC a2LlTU1xwg1BGORO3Mnjz+Dc/ir7PTX07WB3pknf2dO67r5i9ru+l84/wj7+LIUPe3C7SfQO SI3CTvVb5cb0Wc3Cp9Bot+HEAc4GHBQg6Nfn2kCOWV28WOewSvjcnBlNFjsxmpjZouc8seB0 DSH4cIBTWRQw4OP+05+v+rl1PsMtrsD4tsXP3ap6epTjx3u4cx+HSc/niPQf7YUNKj+n04tQ EqEsQp0IMS9falFOwbBbY/vUc84zOw+5LaCvN4sQRuFXQh/jha+0MBeKGI6sVLOrzCECnVUi 1G4hRiNlwjPjtQlEVHKIzSIuzNUszUZEQ0Q0hBFmqiV8O46fGQoJE+ehlZnBwKzt5zg+7eG/ gLaBMIfRzQJGeY11o/WXmErrldYrHVKxXGQrsTdI18lrbLfYN9mMFqYzVthG2aewOglmsXGy bbzd/AjbIW03bDfukp436F3MYbcP0zGsMWbE7jJMZwRqtE53TKcaZcxoNJktFpvNbsc/CZhY s6vNxVzdbBd8kuEdOtWYpMM1s9VkVjXrBgu1dGOQdmpBCUtSC46isNgcKxSKk51ZL6u6Zl2b TtIl2a5O59hGfzwXOupMU6W/r1LpzctVsJ4q8y4kTjURP6w/LK9vnzylt5cvr03rj2zC4kKE 45u6hAXrKoR19VNiTZ/DOdO7hKXfxZ7fiDVnRdlAseZs6a/22c08N+u+vnMgUmEviQgX9kB5 hb20XKD7ByM366bGG29a2YSVwTX/CByEe32jymnEGXXiIx7nI/ii4Lph3lx4rFR3KDVrb6pB 133uywevmPqYdP6bifJb50bKJ8+p0N1Pwl7uw0qx4QuBDq1kgXOpm9Upde7rlOvcssWKPdxO fP4Q7lyI0RUzQuNgBYnTZQjbGS3ABciYp+ZR/OX5bao4GP0PWiyzBrNiltFqQpmd7ldmuWNn 8yNhIU/QZrCxr1ZWNvH05KzNDUWGXAgfPA2MvNQXYh43i0ScwPnxCjyPyJOs+KHJyx5q/Dz1 ZupeetsrTzZNGn53arOu2+5acOCGQ6m+vhclumXD7Ls8uAKhZDYs8f/GjcEw5tEGzJPmya3S KlkuGjBSqghOkK40TMqvDdcUThwwQ2o0zM6/ZuDmHHsUi1Os/8J+BNdimRwYlxkEblwGATEU OdQIiDMIiDMIiDMIiM9qEznRQFuskBVKA4pGOfAtZFHt0GvVWdH6omWWJbal9uvdC/y3Wtba 1jrWK6sLW4s2Su2WzbZ2x/3KPYV3FT1k2+7Y7gllj3sHR2KuQCzPFCumMUKK81xy6fAYPipj xDb41sDmAAsUeW2DQwOKaJHOC0V4RhP6RBcabAqFvJIwz+KwVpsA2agJO7YPp1yZB25tUaHd ZtFFgvmhAD6UwHcSelpUWIA8PdzQwXmokdVvhWz04gs1YQIKLatQlU7FhfMKuo3qYf8ktJzB vEneNHp8lSlGimkxPyex21k9kDOajddUnFeKMdGYCwfEoggIpg9CCeQrzcFp4FyDpbnD513H j9LPNE0+BeGBrQHXDQI1GbaUGBjO6eKneHCGj8iJP9ghFCh2MlhUWQFEhNuInPIQgw2eka7C AcJQ55a612eIwc/Ve9w+LxxncRAbLSiMzX7ZNueX65e/MGPq7LGpZdMWL7z9yx88+/VGXbdj z+7E0xWj6XsNbWs3nnvijdT/7KC/U268/5rxrTW1C6O+lnj5swuW/3z+4l/dYb/vgTuumzJi xNKBY/evWf1266q/cVurLv2pHJLHEQ/ummZovjAJeuDYNemaTPWWBdJS3XLTAosRPskpsSHA oDylTecbQn6QhwNc7+m+cZ/Nk4e7xuQOD1a7JudVB6e5cLcTbHHdkNcSvEV/i+csO+tX8Amk w+bzTfU2e1fgn4GCjm3KThwdKHIgaDaQbvYCP+YS8i+YinMFnCfAyH84JyhbfBrO3v4o2AIk cxAI5DNhuQDp0UwDBpUlcMCSF+amVlGsjMdadQieVpiGvSOUQoNWOKgsbKjCd/ES3yZZvcHP uWvAQBDa+RZmwHULQi8fmiE3VFYuGJ7hXFN8ct8pqI54HA47flx7wDSKx7MHT5V9Kyuz1mdG lXBOr7yJ+rInFbCdidNtiIijChoR5xl66XvdJZ8f/FvqC+r+42/xleD5T80d98zb0vc+m2Yd PWvzut10lu/ZLpwhSfgkb2Dqw9TXirq3exF9eOOERT+GUG6C28+/X3XTloO4euvp9Pi4cXWS 33Xo64vkkfgGrtsmi6wxvtwyn9FpdbolHZzPoM7gtpitRSZtxKiytIn2mKhX49Pi1bh9Yhoo QjdfLjBr/645+TSZZD5lpjxOh1xYQHzaTG7OLaS/wjks2jWZs5eKZ2HbIHm1lzPDVzaqLOE9 7WUrvDu9CW/aK3uZu4jfevVoCvpwGuPBZcdxchJ3sFyTZ03XbzQf7wQRTRMjb5rIvFlOpHnF hRjj7eBDRDROrvZcPvUijc/Pl6DeFURZizbLT3E9iOuSKic/dOHXIxNu1ex6u6HIrrcGqM3o CFBcYMTjdxCcGVNhMIo16sGmKJwfvce5qev2njUv1XWtXjr1/krYjV8+1PTc431z2NObbpvx wPq+Q1kefYwV5qXrtRydpM9hu5Sk8hfpk5zT0tkcPXyD01qlxVZ2q0IfUY77T/rTflk1uu1u rws8onqvzWyzW+2FfsEXv+CRRXDHIrgDGzLLHYuYIksBnyLknslwxyK4g/TXGe5YBHeQPqtB derrLUIALDQNo+ZqeOA9Wh7nlP+0n63w7/Qn/D1+2S+xER6vYNZZXPNl/YbvZBBsqEsYhHtM zhrBIFkwiDfh+neGX+0TDmmGNwjBsjOCadxNvfjXCyOJW41Vvd9yzat3msxGswFOmxJz6u0B 6jC7stwbdAe//YUU8BP4jI71ZjgoFK1z0zOrP2h+eqpi7hq09IrW5+XYD/fWrphcur6vlW28 8Ybqh37V9wrXk5tSi+UIuOjC6eZc7QGrMli5TKlT5Co1obKwWmyN5pd6SvPH569Qt6nGMb4x gat8VwUajddZZ/tmB5YYl1oXKzf4lgZ61BPuD/wf5J0InXKfCp1U06o3KseVuGekPEaZKF+l XKv81fLf+SnF4rRDTQb1XAKCsLXtuYXHzVQxa+Zmc5tZVoUcqOJOjd+S4D4ADp5Z+KtIZ7y7 i23zzE0/cj7VopwZ5lU0ZwQb4SoipIdi19xJE/Q0lcO0Ct9dS1DC57V8vu6ocFSoOJemMNSQ I2x6UJzFEsXpCycVy5CK3Z66OJdpbvjycj/lG+YF7jWtvAknnX1nsEv252Udd8FNcUMJ+3Pl TWRlDmdWZrW5xXHDACeOqi4cW216bsxDi+49vmT1R7ddu3WI88drbvnJ86ta96UW637aPm3a lvQjz6bO3TdpTN856bljR9767VtHf8etssL0l2yQbgfOR39/kJihLaOxMmgt7BNA2nDlSK02 M5WIV8EJpBnTLlkcSgEpoDZXkZWmDcZaU22zYQW87G0GmRhUw0642z2G4wY9PKbPhb4Cwica Gwo31fj8AeFeTxYRO05GuWGL4UsffAMmHCSkPxXbrKGbLSF+Omrf9RcrMsgwpq6XK7NTZ/il Bz8wdlbAlBoxQnmTbzrxeJGPn83ERjqjI0c4y8WdkzjhY0repMq5y0ruvrtz//6c+MDQ008p 4xY8w+ZtoYZlqfu39H1/cgmu9riki196AD8p+Y6fD3kSVkEOvvP1EC/m0i++JA/gW/J8MoQM IyPIKHIFqcNX5TPwJTCfdxeA//T8H7nrZ105flJdvPqmxS3LJs/8f3ammY0KZW5kc3RyZWFt CmVuZG9iago5MCAwIG9iagoxMTI2NAplbmRvYmoKODEgMCBvYmoKPDwgL1R5cGUgL0ZvbnQg L1N1YnR5cGUgL1RydWVUeXBlIC9CYXNlRm9udCAvRVhXVVZJK1dpbmdkaW5ncy1SZWd1bGFy IC9Gb250RGVzY3JpcHRvcgo5MSAwIFIgL1RvVW5pY29kZSA5MiAwIFIgL0ZpcnN0Q2hhciAz MyAvTGFzdENoYXIgMzMgL1dpZHRocyBbIDg0MyBdID4+CmVuZG9iago5MiAwIG9iago8PCAv TGVuZ3RoIDkzIDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAFdkMFqxCAQ hu8+xRx3D4vJ0qMIZctCDt2Wpn0Ao5Os0KhMzCFv39GGLfSg4P/PN/M78tK9dMFnkO8UbY8Z Rh8c4RJXsggDTj6I9gzO27y/qmZnk4RkuN+WjHMXxghKCQD5wciSaYPDs4sDHov2Rg7JhwkO X5e+Kv2a0jfOGDI0QmtwOHK7V5NuZkaQFT11jn2ftxNTfxWfW0LgREy0v5FsdLgkY5FMmFCo ptHqetUCg/tn7cAw2rshoc6t5uInAyNftX53Cll++EhkVyIOU9dQc5b5PuBjUymmMq+eHwS2 b9UKZW5kc3RyZWFtCmVuZG9iago5MyAwIG9iagoyMjcKZW5kb2JqCjkxIDAgb2JqCjw8IC9U eXBlIC9Gb250RGVzY3JpcHRvciAvRm9udE5hbWUgL0VYV1VWSStXaW5nZGluZ3MtUmVndWxh ciAvRmxhZ3MgNCAvRm9udEJCb3gKWzAgLTIxMSAxMzU5IDg5OV0gL0l0YWxpY0FuZ2xlIDAg L0FzY2VudCA4OTkgL0Rlc2NlbnQgLTIxMSAvQ2FwSGVpZ2h0IDgyMwovU3RlbVYgMCAvWEhl aWdodCA3MjMgL0F2Z1dpZHRoIDg5MCAvTWF4V2lkdGggMTQ0MyAvRm9udEZpbGUyIDk0IDAg UiA+PgplbmRvYmoKOTQgMCBvYmoKPDwgL0xlbmd0aCA5NSAwIFIgL0xlbmd0aDEgNDE4NCAv RmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAHNV3twVNUZ/75z7muTkGxCCAsrcJdL IpJdQgiPhEdYkmxMsmOb8JBd1LKbBySSSEyQgg8milTcJLot1BmtSlDRgKB3CUpARigKZsZ2 1BntaKHazsTBscQZq0inU5N+956QAfr4u/fLb3/ne5zvnO+cc3Pv3dx2XwOkQAdw8Ne1RFvB vlKriSbXbdmsC106BCAvWt+6oUXojq8ApHUbmretF3rqZgDc1dgQrRc6/JN4QSMZhI7ziGc0 tmzeKvTUCmKteVPdqD+1mXSlJbp1dHy4QLp+T7SlQcQ7vcTe1k3tNI51pVn557S2NYzGYwiA r7I8389aeujdW5bSfFNpSmRgmAJ50E0qAye1ish8SVpHPkuoLPW1Kqn58rq0JZc1t2algP2H dw9bPLCrmOobrk76Qs0nNcWOtxzUT80fpjVK7gIY+SDpizGP5bUu5k+B8nJqZKRr/gq9ny04 UjGXaIdNeEjQq4IOCOoV9IqgFwXtE7RXUKWgCkG3CioR5BdULGiJoCJBiiBJEBeE/p/SnC4Q zhP+SPgD4R3Cm4Q3CK8TDhMOEXoJrxD2Ep4nPEfoIuwg1BHWEfrxdZH6sKCDgl4WtF/QS4Ke F1QmaLmgpYIKBamCZEFMEPj9NNJnhE8IA4T3COcIZwnHCEcJfYTXCD2EXxG2Eeor5mY6Mh0L 4/24xV+pxvep8d1qvFuNb1LjzWp8vRpvUON3qvG1ajysxkPqDG26pmtTtZu0yZpLy9IytQzN qaVqKVqSpmmKJmlMAw3M8TzIgitLMGieroNgrW7+sNLox6SataZslKCZEYTgqhKXWZhrsl39 CKtC/TiSQHxip9vMKA0dB8SRnd3uUQ6HISv33y/XdaZg9baTMA0Xgkq/BX3qtHdV8gdXkjVu W+OWNW5bXXikGuYGo52RKXBdkhsVvNHwX3UMNFnlVocSGpSES+8U3MeSk6ieiNsTLslythbb xS32uLa7T0iAvZCcGzZTjBJzHMGq27fct9xySXQbkSuVzGmjLtf2xR73CewddTnJnE5Lad1Y /1fXR/91NvmQD3UYYg+ztdT6DdTS7zOEesLTsAf2sD5qUQwUEExqVcFFeQDmQpttL4AHicvg 77Rwv7AtS6CW/LUUfZa4mHx1xEi+OtiDXTY/BI9S7m9ZHzvDztjeZZS3yooQwvrkAbJbI++A 1+BzPE0ZHoDd5D0OH1m9KPMeOAxXcCZJJ36JQ6yarAg0PuXZSNF7aL5vw2fwHWZiMcbwJMVk sIftuYjROijmLMlHdhYr023YjJuwDR+nnIOMs/mUdRPbxXqYyc7wsFQsDygZykK1mbIg/afm kE4VWtl+Aitp5Fq4l55RIquV+Sx8iAxrcBU24lPYQ3M4i0Mk3zMfW0arbsmveURKkb6SN8ov kAwoq9XnNIVyy6DAZNAhG+ZRVQEao4Yqq4e74X5bHqAaH4SH4BHYCz2wDw5AAk7Ab60x4Tx8 DldoddJIrLoWYhGuIQmTtOF2fJTWo/Ma6cZnsQ9P0Pzex0/YNKpaSDNVL2a5gz3DjrL32e/Y F2yQfc2+5cAdfB2v5e18Pz/IP+AfSBVSj7RPuiBdkFE27ZXKUDKVu5ROki7VoW5UH1V/qT6n vpk0GyZSXV6qqwrWUFXbqJIHYRfE7F1LUCVH4Q2SAfjaqoNkZLQSq5oiLMNyXE0SxrUYwRZs x61jFb2EL2MvHqVaPiH5FM/jX/Cv+I0tV5jCsljuWH3VbCVbwzayp9jT7Fn2Kp3IPnaSfco+ pxoH2WWqMZln8Al8Kg/wcpJV/A6+le/gh/kZfp4P0b6lSEulYmm1dBfVfk4alL6inWQyl7Pl +fIikkb5Hnm73Ck/Tyd6SB5SUuj8WDJeWaw8puxV+pTPlB/VCWqWOp1ktpqvrlSb1S3qQXVQ vagdcix3NDnakrxwEObAsRvu4zfodL/D7lLyYDKep9NwL0+jKJ3W8yxLUZsdTazPmp26EmfS Tv0JrnAHBKVzsIbfAc1yLU9WL0EvtksP46u8HA7BfnULnuQRPsT3y9nKYnE+2DP8oLpNjagX aabf891yozobl8ud2MuW0R3dhjXwA16Gn9HIm9ksOAePwy7cQg+cPdohHEd38Fk2DTvlF/gR qYcH5O14C+2gWx7gO2E+TKC3lZkwnc66DJkE8C8sXDivYG7+nLzZPm/urFtm3pyTPcOY7tGn TZ1yk3vyJNfErAmZ4zPSnWmp41KSkxyaqsgSZwjegFEe0c2ciCnlGBUVPks3omSIXmOImDqZ yq+PMXWrX5Rc10X6KXL9DZF+Eekfi0SnvgSW+Lx6wNDN35cZ9GqxtiZE7e4yI6ybQ3b7Nrst 5djKOFI8HuqhB1yNZbqJET1glm9pjAUiZT4vJpKTSo3ShiSfFxJJydRMppZZbrQmsLwY7QYr DyxKMNDGUY1mlVEWMCsN6kppeHYgWm9W14QCZW6PJ+zzmlhaZ9SaYD2zcu0QKLWHMZVSU7WH 0ZtMKgc69YT3dKyr3wm1kdyUeqM+emfI5FHKETDTc81bjTLz1vsHXT5vP768KmQ6Su03hONQ NdKRqOwoKwtbo9Hj8jE7fCKFT7x/0M1jAVeTbpIaiz2mmz01ISvZVa/HigmHKanPG1wR8tCs jUCXbpWxImRXQEnRlUcTt2xWmaLgBiNgWSJ366bDKDEaY3dHaLMmx0xYsc1zZHKV//jIn6Eq oMdWhQyPucxthKNlNyUyIbZiW1+lX6+83uPzJpzpYqUTqWmjjZRx1zYaaBeEz27Z4VaLZn11 qdGakVFp+umM1ek0k5BhsuxC66ehEGJ1hbQjdIWRVrSJ1i8Scy6i6kw522nosctAB8EYunS9 JTpqUbKdl8FyWsdl7MiZGL3aNnNzzVmzrJOiltLW0syKbX2+z7vFDBqtTt0M0pJBdYg6hRfl 0ZJ7PNYud/b7oZYUs6MmJHQdat1HwJ9HrzosYnlOX/VMWG15Oq56xrpHDDrOR+lxCDDB1HLG /tKcWeMDjYtMzPof7gbhp9snoCckOTtWHcqJxjrdOZFYV5hOdTnd1bFYuaGXxyKxaP9IR62h O41YIhiMtQbobhQl9Y+c7nSb/q5wI9KimgViNczxpSHuZtbJpBZz87DPeovrUE7B7TRZ8V1l fS8pBADPmAUgB94lC6NnOfAOehPh9Apr+NPUj1H6GF+kj8oRkEf4cfwSIG94yDkEy76h3/w5 Beme9GxPuqeDw48dDIZBHvhHYYc0QN9vcPvIeaVRHoJkevYZ9IW3GFqOuaZMcbkXzJnxFh6E WeBmi/1JnpRHIOMRZZZH6cedx2DSVteUrVN9b+EBuBkK8IB/XNGEJ3nakw7XzUVTJcdxlgE8 b2hikZPGzxsVyBsqGjMUFaUXFeXl5c+RdUh3gsf+zb6mzQsyPPr4AkUxpueMn54zf96Cgrn0 T1bxXNPm64bfHi7C97CE5L3houG3cRJ2D7cPXyRpx+7Xl1Zarsriid+dOvW3EwUVFQXzKirx rYLKygJSsq/taWWqw25KMAmfGG4TKdgDw6dw+YeXLuHPK6we18DaB/saKaS3n/90kR+Zo72l qblhfbTO+hZHyLAPJH2tgwsgEFqz+vbK3DVN92yoJ7T7VjRsuK852gbwL76K8n0KZW5kc3Ry ZWFtCmVuZG9iago5NSAwIG9iagoyNzE3CmVuZG9iagoyMCAwIG9iago8PCAvVHlwZSAvRm9u dCAvU3VidHlwZSAvVHJ1ZVR5cGUgL0Jhc2VGb250IC9BTUxOU0ErTHVjaWRhR3JhbmRlIC9G b250RGVzY3JpcHRvcgo5NiAwIFIgL0VuY29kaW5nIC9NYWNSb21hbkVuY29kaW5nIC9GaXJz dENoYXIgMzIgL0xhc3RDaGFyIDkzIC9XaWR0aHMgWyAzMTYKMCAwIDAgMCAwIDAgMCAwIDAg MCAwIDAgMCAzMTYgMCAwIDYzMiA2MzIgNjMyIDYzMiA2MzIgMCAwIDAgMCAwIDAgMCAwIDAg MAowIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAg MCAzMjUgMCAzMjUgXSA+PgplbmRvYmoKOTYgMCBvYmoKPDwgL1R5cGUgL0ZvbnREZXNjcmlw dG9yIC9Gb250TmFtZSAvQU1MTlNBK0x1Y2lkYUdyYW5kZSAvRmxhZ3MgMzIgL0ZvbnRCQm94 ClstMTA2NyAtNzM3IDE2NDEgMTE2Ml0gL0l0YWxpY0FuZ2xlIDAgL0FzY2VudCA5NjcgL0Rl c2NlbnQgLTIxMSAvQ2FwSGVpZ2h0CjcyMyAvU3RlbVYgMTAzIC9YSGVpZ2h0IDUzMCAvU3Rl bUggNzcgL0F2Z1dpZHRoIC00OTAgL01heFdpZHRoIDE2NDAgL0ZvbnRGaWxlMgo5NyAwIFIg Pj4KZW5kb2JqCjk3IDAgb2JqCjw8IC9MZW5ndGggOTggMCBSIC9MZW5ndGgxIDEwNzg4IC9G aWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4Ab1aC3xUxbmfxz6S7G72kd1kk4XkLGt4 nUBCwiMLETYki4EAhoe4qwYSSCCgQHgqDyGi4bGAImJpibV6+7K9Kicb1I1Vk6vGH7S1oleU VgVaa/X2mmq9VnyRvf85ZxNJGv15b3vv2f3mP/N9M9988803c86c3Y3rN9UTC2kinFRdV9u4 nKjXqBDg18tW1zZq5WFDgEeWbd4oaeXUJEIMjy9vXLFaKzs7CbEUrbhpS6L9sJOQFzTU19Zp cvIlcGIDGFqZjgde0bB64y1a2fsxcORNa5cl5MMUlNNX196S6J+8ibK0pnZ1vVZ/VIGo37h2 w0atPPJTYHHj+vpEfQr7zccJBTeF3Eys5GpiRMlGCsg2QvQXLEUYL1XlBmq4N2b5aIm15G/U g2HhOrHzuacEnjrn+vDi5s89Fm/yHBST1fpCAL3Gp3qqMObsi5svllm8fRIhFVdKjKyTY2QF qBq0QC5NJYTNIDYQIztZOaFsGitBO5lNZSVRKn/wC3YlmFei4MwhT0NmAzG6h+6NZuUEYnRf my3dT0pT6V5iAzF6O22GLpnekcDdtDnK5KZf0J1Qe55uDyyn5y+kZwx59QySbdvTPdZtOdvy t/Ft2zNffgWszTcjWd2I5Ka1SG5ck+5ZsmbnjezGNTvXZ23c5HQNWbEKyfKVSOobnJ676h+o P13P6xua12VlbkjfWpbp3QJi7Xw+n4WebU/zGaQKxEiA+6OmVH97vJMXR1MTmbZks7+q1MTH EMoL+DjMgMw+Zv9FkoBvR59hcoy92fZMHcbK3mgbN9kvMOobIbQg43Sqmd9Gi/yJzOixiYzX l8hkZCYyqXY1czpqR4Y1sVuEeaUy20iqQAyurUauGjkTm008oBtBHKVKlCoJY5OZjqSTHFYM dAAL2TjhbFaQwHxgNvhj2bhodo4UAzjS/e30In07yuWUUol+TCj9gP5FtKLdCXw/gf+ZwPfo u8IN9E9AHfAdIOrHf0nfbjPB9NKhYFCyGeluIaJH6GFV4T0JPEwPEQMa3g00Au8Cig7vpIcw 5I4OFClpRNokBPTa6GGdHKMLoncLuDp6VMDEtp1cRoD5ow63vzSZXkFzVaNs1K6iLjDlS7jv 06pPWeBPWVn+Yy1cvq9FJ7ccTZHvgb67Dxvkw9B0L+i7R5n8naNcfuAo/cHR40c7jvKneAWf KQbHZ0abmSxCoqzNZvfnPMOxCMgFkfIJfDy8JpU6eBEpAAVAVSAdL+JOYQQvTGA+d6JmfgeK WIWIHgnE2IfRpw2Inz9EO5JEF+z30YyRagj8PopYiLEL0T0pkJ9v69BhqOz1Nl+uiK/Xoy5M Guq/EoVJpRb2AusS/mTPsk4V/y2BB4TtT7HN7GYxFHZzYihsnTYUtl4MRU0DrKZXaU00xaRq XxLNcKuZxdErRqmZ69R2pU52vdpQpFY2C2k6m0mGgxhJZmNIJojBPDlqd6ntRrVZ7H5Em09E 29NsGJPEdDMvk6I6+RT0SdhDspGKxZWjSekn9CV1Ii/Qx4hEvPQ8fSw63CvF6PlottdfmkXf om+qUfNGAn+XwN8m8Cx9XVXwOn1NrfcafRXRpXSgSOkZ+qrK/HeVubLURF/BONpFSl9JyF5W ZejxdBSbQDvi+yUR33IH/SH5EegEiMcv0J9E01yYBnqQHlA73J/ACFCE9aLobmwT9JpoEwcs jO7WA+ZH9wiYF90roCq6V8jmRpsFzBYTFaPF0T0CxkU7BHOYxkwNmCD8/Aud/IWoFO8MpPxN BOYn9MInVBSTW11D/IF3EPKiNPa4xeqHpYETVSdqTjSeaDrReeL0iQsnPjyRfOJ4Xc577+rk fRGjHNlvkA+A0OSJOwsK/XceRJdo7jyY7fMf3M/k/c1J8q7bdPJtYgzxzramWXOE/ramaWUa jvdrOHKs2q+5aajP37SDyTt3qFoD5luDM/23orADmoRqaS9U78UI94Cxu9kg335HinwHsLG5 qZl1NNPSFL6ALySpvIrPQzqXXy3SKK/LKb2Gz+ZziJV7+BA+lJi5ldu4HWjmFp4KHAEcRSzc C7kPmA25BBxBSrgXlA3ygKwgMylhj7BH2XFiZg+yf2E/BN7PfsAeALYDf0EsrA3yx4AK5FFg O9q0gRTRFvQg6H7QbWwXSWU72E6k29mtIlXt3cS2sm1YKzZmZw7otbBUZgVSxhgnZtpD4wz3 fuzkdtICYqIu9nob+QGoA3QepMfObSHTQDtBnOTQHqybTLT1wKY06HQBM2FHGsgGsoAMIEpK ULeEPk2foR3or5VGaRvwUXqcKsBTwF8RC30O8i5gJ+TPAk+hzXOgTtEW1Ap6FLSarqFr0a6W LqXLgIvpElqjlpdHM3JySqfT5WQaaCeI0y2QboO2DWi1CdiIVuuBW6BpA6hRaAQtB9WCFoPy 6BhipcPpCKQj6SiSSkdTGambZoLjoGlIndQFTjrNQKqnBqSMcqRYwiINPIRQ6YlbPZNc7oku 1wSXY7zLWuQyF7qSx7kMBS6e7yJjXcNHpI4cYR0tp+bJ1mG+1Ct81uycVCnHarXZzckpJrPB mGTmOr0ZnjYTHkjL8hGelmPgQ3JyrNOsO61c4jSHX807eJzrPHSoxW3MsrhsGRaHzmk55KF5 JaNLRpYML7miZFiJVJJd4ilxl7hKHCXWkuQSQwkvISVVRVRxVJLKhdOVNApcMF0pkitjXJqv FMqVSnLV9aFWSu8Mg6uwvTFKFiq6vTEGcJRdd30oRjOFuNnTLsatVNY0Hwy3MjJdoXsV34KQ gMC8kCLtjdnIwlAro9PD4bAyqbIKeTI9LA9V6ipRrWloWCkUmUNDw6RSmTxP8fimywOvDYKx YaMKX8laRw4PKqODtUpesKb8K7YsExRgcFDpCdbGKPP1E/ZWHKCslw3cgCtRjLHtwRjbCjVs x+Bq+trF+NxgjM9GVV4lqm7cQPtkg2Q2bASTqulAqdr5xk0wpJ8EDFwb4AbRVPhDhcsS1ewN moBcLiZ9mnq5vXhZJ5cNO6FTtNog07KQJyzLilvxIUh6GyQ0CqAxul0KriqP0Vs12KHBTg2a NLhNg10a3K7BHRo0a7Bbgz0a7NVgn4DEyPBUMkXlshINrtRgqgbTNAhoUKrBdA3KNCjXIKjB DA2uEgC/YWwbWpNF9FfNn16pJM0HVV2vZPlQOInCRBTMvunEIJNMnIxOktzeVDvIaKluKnGL XPwNNX2vN9+zKa7mCek5K3j/yCXOXoJ0/4gS0baLYEONT4nfHf+YdJAG4oyXxr8bf39Qtbvi O8h58go5RU6QR0gLOYd8F3mGtJN/JW8j/wJyj5B7yVK0/hH5PmkG/pw8SI6Q9eALFJyuv9dN R/bjXSQXyVFaSmYBB15HoOXIQObXlv8UzxpEdi4+jGwn29km9keyCZ9j0PgweeCymiuR/zHZ gPNvF+0mS+lTZDnGs5fUkbtYVfzP+lMknd+CI89a3QMiEvpd3yEhsoXU8fvif0WcWI1VuKke j/9VnKX7Xd9Uby367r3ayQGaQnbAb+NwMj9GpvcK+iN8eBFjWIax7MLnKGajDZ/t6Pfuy2sa ykWp1+4kokVrbxzpxbsGXPF3Qbeo2S7h70TE/p5sRg8lZAyOc9Z4DuKmIl4f3xL/fvxpRIOY /Z8koqIDpZ+Ru+lRWLCU3EAWsV/jYCdKa1FeRGbRodRC7ofuCWovfUliVXGNIWJcXL326RJe TKwtWKld8Sm9OXoYN+aL5CR5jsRUe+4jh0mENMEPGxHf15Eq2D4ZryW0eu+oMSws/6rOYrIQ sYcLMTgV4znXq1ug/oy69hPvbv7OPrH2u/izWhvhRe3q6c0Q8iJmUlsNe+GNTfDHMszsRXX1 iPnrwqw9iFjrlS3qk76gzq2oP5UUCivik+M74PvfkGvJWtaGB5bb0W7vV1315R4GtzeS3eQc ndon6Z/5R+J+O9ZQF/lOP4XNpJrU9+MMKAz03wDxIEV9Nx4dj2DWHkd/2/DZPkildsR3F/y0 lcwjpWQP5vEc1kcD1nAdPP4KlTA/L2MXG+yqhd7TmJW1fDlPzPJg1RAh4jPIpe/WmEmE6hD5 fbHbW1WL3d5SP5yq5+QsdSA+7iFnEROPkCewl6wQXESxdv3P5mgXWUNGJz4kEJg/s6JkymR/ 8aSJE8YXFY4ryB87Jk8ePWrkiOG5V/iGeaWc7KFDPFmZ7ox0lzPNYbdZUy1mU0pyktGg13E8 z+dRt+IuCwVXKZllNbgXlvtskmKe++GcfIU4PF6fXSrKD49J1FL0skLSKhUnnvlIoDisGOSB VeYqPNf2kReN53ikoKLLxdc3q7ZOGTk/5PXZXvP0ycNQq2SVhbxej8Jy8Z0JEb6zaqU6xVYF PgQqZ6ZCqkKCYvE/FINJir1hpPNDSnZvEY+igxjZjhXVOcDMuTRiazVnlpUrxNlKzH9QiEtU +7CY4BCmjMSjca4NOVUbyVeo8yOFpinUNQdD6t+FaHaheBAfBOtW+YJ1K+HRupqvfPqh5lGv FJEi80P2Io/XqxqNJ5F5oVZTSpmvrD4Fo8BDMxikNcUEjkkwMC2NrdQ8laoZZg5OxhN3kgXu cwhzg4JWKYH9Ncj4yuE3SNK+kuCQfOByEUEzrRJBNTVH1T4VQ5li1IyQViqBWoXsl1rzOiMH 8MS/tEY21/nqam8IKbwWRrUSnhtsWKgMqay6DiwYAappkMR0l6uJmDwp2CBFUBZ1a5D6ytG0 P7+uob5GhAmt8ZVDllwW2uPt9OBIEtoTVOyyYkFzy9Y/engk6F4piWIkskdSHsBR5DKpV9RB ELjH5EmRoA+9QVlw1XQxY/l906ZG48w6dXIC+2slpWnpKvgM39oDvfHvjdgU8ydezA7mBy3F 6hAOFlRXs0oMZRVa6gBSZH+9OtQD6tAQr+KxU5BoiOgn16D1daFggy8IfyY6hEPQnucObOv1 KpmyaBiJBIWJtXWwXngG30w8rMMMrYA14ZEp7ClTAgtVIAvVOUCPgdrycIKVqACJDvOgBGrK w2ExKG0CFGPuHv1YnxQRSo25ilO2eZ+HrHNMXuX8ULBcRCdqsrLQld1uTzfyOOj1sqkbdSL5 3cJJQrLAVzlPi4IG4R+R1CzUFjC8lph5VE3UV7W+6Pa8iLYzfDNqIpEZPmlGpCZSG4s3LfVJ Nl+k1WyONAZrJHXlU/Cf3O9RZhwIK7aaBjoZkyzibQae4NPmXS+mZ4bUUAsOvtN83mKP1w7V Wh3sHIOLE+sMEY+4F+ssYnsfIzZjR/JIM8T2EsOu4FFsxWKZwpJrQlgHy9BFsE5NsD5wzGUe sVJ4ODe4ckHCQR4vulQDRux78xJcKPF6xRraHwuQpSgoTfNCWlkiSz1REsiXMXc1QtLZK3Fd IyRNvZK+5jU+zJVbHLPVmPi6mMZ+3hfPEbvPIfnFZg7r8J1Zp3QuxBg/LVaS4DF1utPKQtzD RBXkmIeLXIqMW0KJkiGrDYVPsEtGbD7ptE+xyYq+LNTpKQlLNjs2SNoXDAmNIkxtp32nqNhE idOm0BKFpotlRbCpwo3Y9DOKIexrKAUjNYnou3x8qCpq1zX0rSNtFFi4YpBwg82HdevR/GF3 +MRQfy2iXbvBKfrcGWJRYW5Uj80KK6niZqekvq8mGJynLCRhG8KynadmpKDUIGZdkWrK1f0g 7BHyXnYsfqGmXOx/IQQaqngS8Y0oh9sSayLhhsqFod7c/NCtnq3hMfhVLK8yRpJxJxXvZGI0 3hwj5UPb8TsbX7IY4oV5khRcWY4OUbgmD4zRXuQW5SE2ReiHfGFxJ5lZF5FE8NdhWCpCUB8J 5yNeF4SwX+JVjVcJhD192fpweDL0XCv0oAmqR8LQsCqhAaiy8i+hUiivEjvV8KoQNtumcgR6 uVjCGG4nVlWnGLEYSLjPUlh860p3wubrYHN4NOTXa1oQq01QEY5EhM4FIR/CPBLxRDCORBlv eAYyAglGjIgmGHgwRpuq0BbgU58Pgj6vT3g+XI6uboDfe3cp/Pb4zR5e3Gc3Wi6BtYtVD9f8 kzxc+208vPRbeXhZn6X9PFwHm5cJD9cP7mGFDf8GH1/u0oDm0sAgLl3ez6UrvtmlDX2GwqqV MK9Bdemqf5JLb/w2Lr3pW7l0dZ+l/Vy6BjavFi5dO7hL/y+CtrGfh9d9s4fX99kNIzfA2vWq hzf+kzy86dt4ePO38vDNfZb28/AtsPlm4eEt/38e3nqZh/HDJiUMZ2rQSb2Vjtdbyc9Bp0Er QZ+xY6QLJE6C2n8kxA8qBrIbZQnndAr8ugu/veDiOCDq0cL4ddX+F3xxrE5W20mwYjLZjh8t TrM8/GL7Zy7eTeIkhzcZ+KB3I3E+YWA6Iij/xVdfVJNxBV67156LhMK8LwO86csmPfmCBHRN aIlRnUTSgRMqJ56ABbdnfhwyPTleUCDTLLdtTjfJ7x5XUDShyHXy4kX1NR4V/2PRzcLpOJmE AgX7dN/TtetO6XQ6m8lewXV0vq5Fb3DqDXqD0UhbSNJDxv06+pAEU/H7FWM4ljye5q5gzJRi d/jz5ep13YWXRC+F094aV7BHlm3PE3mdd4LXrp+Qa/e66Hg6sucs/QsdeUR3aNZ3t33+U7zG ongfSXTDYEMmeStw/yQrTXFkOdjnDvqphV600ZM2Gkl7Mu13aX9O041IoZ+m0JSktPSKW4x0 SlJlEkuSMrIqktJGprG8JGp2DXGxiWwGYymMJqW709nZ9PfSWYqe/lL/uZ7t1tOrbPRaGzW3 WE05JmYyJbfYDalGmvE94jZE7Bn7AiZitefYmdX+kv28/QO7zsI99jP4gY5m8iyyjcl0yeJq NVnntj2fNafb1v28Ol6//9Jri6vhXlq9rhrfdbiq8deZanzBwLVuXdGEibnikD/cN8w4YWJR Ic7zBis1GL2uny+ihnW/u3fXsZe7nj395c5HZnfnstsfOdVd3/Xs9jtvfrT6Qnvzb+4pPfXE I+o8n46/ocuHv7KpK5Cda6abHdSfPTM7nM2NHvpuBk22+W3sP2yfYYrwbBjIyvBUPOSOudmq 1K2pkVQe1F+jr9fz9kyaGYufDqSY7RU6l9PFkl14Hgrc5nBVrDLSIal5qTek3pSqM+uG6PJ0 3Gy8wXiTkRdbKiwM8zIkyeWu+JmT8hzD1YYlBm41vGRgJoM76T5TwDnUdF9BgaPFbm1xGklL AaWUtwzNzHfvdN/l5pb96QG0TbcnGyLJ9nS37uosihfCNsJqSCM5hODNr173anWGvzs/P1/u ribTLr1W3Y2kWyZqEPvhY0zCuiUJz8LJmBLhYeFp4fZJE9KLCidOsHl9EyZJ9vFe1duS3abX 2Z0637DTr2492NpTOTdIj/V8dCR6/Mf0hZ5f0eU97/91nym28Me30+JmSr1vL3h4Ss/Per5Y u6DnVy//BX5nBG95dLvwLjQF/zfbGVg42vK5hVncjvQKI1/B2R7+LmdJnM4yUaNphGmSiRuR sJ/oqMVE55vu5Don57pkg/nYIXgES9hAzAd09ECSAY+QySzZauOU51fbXqsufLG7EKtoGpZU dbcf492jt8k6LCYqooggkauxC0ygRfYil89OvXbOLy1nx9pfeOHSGvwV54f38kNfbn+wp5qV s8NYX58hXobA7nTyTsDP9XSFnk5iV7FrGR+VtDKJZdjoEzZanEaPptFU451GZkp2ZjpZksFt YI85u5xsi3Ofk6XF4u8FFpmtFcPtE+3MYE+3D7dzc0pSi9XKU79nMpAWGrDYKzDVrszUgyaz 2UQNEUegykGtjhzHWge3Ou5yvOQ47/jAobdwt+MMI/j1t4lyBxf/VWgbOqxC4ONmW0UGfRUL TZb7lto6deIdfn9+freIB7l7Wjecc+kFhAIiAZMPryxGqi27jN75H2bEpuO1S8Tl1HmHfXZP 8+Gf9kwY72fdlzrxqjvQ81ZPT6NBmfLwUTrHyE4/3LO15/P3zv5NXWNdPWdZFX4rMJIrAg5d CyX6FiJxo/4gCSSRepinmvRiIZkGW8YVpKEjH2aji+4/d67nrHHBkc/OqHvbLOx3Z1Q9k8S/ 6J7EdDCyCP+oo7YY0b0Zw0YaI4bT5Emx8asCve1JVOFqntkKxlGoLrL7XPRMz6bLdWt3KhIv xvvTwa4UMDmxEydxYeYz8A58KgmoFSn+EKbdAw0kjZDSObPnLiiVZ29atrKu9qr1tWvq1NfD Wg3RQPxXsQQ0G4R3p+QmkHjDewB0H+hh0FPxxIU86ctTIg0ojx1QHjegXDigXDSgjPtVP/3q LxWX9Xf9AHm1KP83Zrtl2QplbmRzdHJlYW0KZW5kb2JqCjk4IDAgb2JqCjYxOTcKZW5kb2Jq CjIxIDAgb2JqCjw8IC9UeXBlIC9Gb250IC9TdWJ0eXBlIC9UcnVlVHlwZSAvQmFzZUZvbnQg L1VMR05ERStMdWNpZGFHcmFuZGUgL0ZvbnREZXNjcmlwdG9yCjk5IDAgUiAvVG9Vbmljb2Rl IDEwMCAwIFIgL0ZpcnN0Q2hhciAzMyAvTGFzdENoYXIgMzMgL1dpZHRocyBbIDAgXSA+Pgpl bmRvYmoKMTAwIDAgb2JqCjw8IC9MZW5ndGggMTAxIDAgUiAvRmlsdGVyIC9GbGF0ZURlY29k ZSA+PgpzdHJlYW0KeAFdkMFuwyAMhu88hY/doSLpGSFNnSrlsHZa1gcg4ERICyCHHPL2Myzt pCH5wP/7Mz+W5+6tCz6D/KBoe8ww+uAIl7iSRRhw8kG0J3De5v1WNTubJCTD/bZknLswRlBK AMhPRpZMGxxeXRzwpWg3ckg+THC4n/uq9GtK3zhjyNAIrcHhyOPeTbqaGUFW9Ng59n3ejkz9 dXxtCYETMdH+RrLR4ZKMRTJhQqGaRqvLRQsM7p+1A8O4d55arUo1fGr/wylo+eIzkl2JOE3d Qw1aAviAz1WlmMqDtX4AbZpwEAplbmRzdHJlYW0KZW5kb2JqCjEwMSAwIG9iagoyMjMKZW5k b2JqCjk5IDAgb2JqCjw8IC9UeXBlIC9Gb250RGVzY3JpcHRvciAvRm9udE5hbWUgL1VMR05E RStMdWNpZGFHcmFuZGUgL0ZsYWdzIDQgL0ZvbnRCQm94ClstMTA2NyAtNzM3IDE2NDEgMTE2 Ml0gL0l0YWxpY0FuZ2xlIDAgL0FzY2VudCA5NjcgL0Rlc2NlbnQgLTIxMSAvQ2FwSGVpZ2h0 CjcyMyAvU3RlbVYgMTAzIC9YSGVpZ2h0IDUzMCAvU3RlbUggNzcgL0F2Z1dpZHRoIC00OTAg L01heFdpZHRoIDE2NDAgL0ZvbnRGaWxlMgoxMDIgMCBSID4+CmVuZG9iagoxMDIgMCBvYmoK PDwgL0xlbmd0aCAxMDMgMCBSIC9MZW5ndGgxIDg5MjQgL0ZpbHRlciAvRmxhdGVEZWNvZGUg Pj4Kc3RyZWFtCngBvVoLeFRFlj5Vt/PuTnceHZI0JLdpAsgNhIePBFvoPDoKAWwgaDcodEMH AgpEwvuVFg3EBh/gg/nUUdyZnW8fo9x04thZxWR18ZPdcQdZX7O6gDo+vl3ZYVxH/GZcev+6 93ZDMhk/9tPd2zn1V51T59SpU6fq3tudjRs2tZCFIiSRb3GobSVp12gVULlibahNbzu/BZau 2LxR1tu5mUTpv1jZtmqt3i4cILJMW3XntqS+6OdpbQmFdTkJ/WtbwdDb7GrgmNa1G7fqbedX wMw7168w5KOL0U5fG9pqjE8foC2vC61t0fuP7gKOb1vfvtFoB7X2hhajP/MTmY8SA5fTFrLS zZSBlo0m0w6itLOWaZgv0+TpLP3RuOXLZVb375kD08LV2/HqSwJPnLafv7D5Dw6LM2sumlla fyGA3YyXLvow57ILmy/UW5wpiZCKi8fpLiVOq0C3gxYqtblgNpINxKmDNxDjM7kbegqfwd0x pvz2RX4DmDegUVhOxyCzgTjbx7pipeWeOLuvx1ZUQ7W5rItsIM7uYZ2wpbB7DdzLOmNcibzI OmD2DNvpWcnOnC0aMfKtt1Hs2FnksO4o31G1Q9qxs+TNU2Bt3oJibRuKO9ejuGNdkWPZuo47 +B3rOjaUbtxUaB+5ag2KlatRtLQWOh5sOdJyskVqae28q7SkvWh7fYlzG4j3SQuk2RjZdkxq JB+Ik0eqieXk1vQlBqTqWK5R6cky1/hqc6SJxKTJ0hSsgMK/4v9FmcCPYy9zJc4/6Hk5jLny 93umTK8RGHONE1ZQKSzUKr+OTasxKhMmGRWny6iMKDEquXla5WQsDxUe4VuFe7UK30g+EEdo b0ftdtRy+BxygO4ASWg1odVEnE/nJiqicl4NzAdO5VNEsPlkA6uAZeBP4lNiZeVyHJBfVNPH LrCPY5KSXSuzr4ix37L/FFrsnIFfGPgfBn7OPhNhYJ8CTcBPgOif+Ef2cU8OXK8dBQajzSj3 ChF7hB3SDD5s4CH2EKVD8SAwA/ggUAz4AHsIU+7vR5NRG8qIELBbY4dMSpwtjB0UcHPssIBr ezokBQlWE8svrqnNYmNYheaUjeVpaPJc/y3C943vG+75tLS05vEnJOXJJ0zKE4ezlYdh7+Ch dOUQLD0K+tFhrjx2WFKOHGZPHz56uP+w9JJ0kzRLTE6aFevkikiJ+h5bXk35yxI2AZ0VpXSN dDWiJtfmS9NoMsgD8oFM0jSpUDghTTWwSipEz6p+NLELkT0yiPPzsWPpyJ+PYv2ZYgj+YWzE eC0FPowhF+L8bGxfNuRnevpNmCp/t8dVIfLr3Zgdi4b+p2JwqdbCX+PHRTz5K3xAw7838IDw /SW+mW8RU+FbjKnwu/Sp8A1iKlrp4cGk0WAsO0ezviw2olirLI2NuUqrLNb0agv5Ek1RlFY+ G2URn0VjQZyy+EQqAXG4p8Ty7JreVT2WvBpkm0tk2zE+mstiubmTyzGTcgL2ZJwhZSjF5irX pexr9ittIc+y50kmJzvDno+NdcpxdiZW5qypLWX/xj7QsuZ9A//VwF8b+B57VzPwLntH6/cO ewvZpfajydjb7C2N+S8ac3VtDjuFefSJkp0yZG9qMox4MoZDoA/5/SuR30o/+wn9FNQLkhJn 2c9iBXYsA7ufHdAG3G9gFCjS+pbYXhwTbFEsIgGaY3vTAAti+wTMj3UJ8MW6hGxerFPAHLFQ cVYd2ydgSqxfMEfrzFxPDoR/+KNJ+aPolBjwZP9eJObX7OzXTDSzuu0jazyfIOVFa9JRi7UG nnp6fb3B3rbeSO9A78nes73ne7N6j4bLP//MpNwXzVCi+9OVAyCovPDA5Kk1D9yPIaFeeH+Z q+b+/VzZ35mp7LnbpNwt5pAY6InMnivs90Rm1ut4dY2O4ydp45ojo1w1kd1c6ditWfWYd3ln 1exCYzcsCdNyF0x3YYb7wNjbma7cc2+2ci+wrTPSyfs7WW22tFBqplzJJ81HOU+6WZQxKVxe u0iaI80lq+SQRkqjyCxZJZuUBzRLFikXOA54FVkkJ+QuYBnkMnAcuSUnqAzkAFlBZnLzZ/lz /CiZ+TP8L/hPgE/xp/kRYB/wRbLwHsifB6qQx4B90OkBqUIX9AzoKdDdfA/l8t28A+VOvkuU mr+b+Ha+A3vFxvN4PuxaeC63AhnnXCIzu8gSHPd+nOR59ASIi7446230NKgfdAaUhpPbQjNB HSCJytlF7JsS6DrgUwFs2oEl8KMAZANZQOkgRm70dbNj7GXWj/G6WYz1AJ9jR5kKPAH8J7Kw VyE/DhyA/BXgCei8ChoQuqBu0HOgtWwdWw+9EFvOVgCXsmUsqLVXxkaUl9fWsZU0E9QBktg2 SHfAWju0NgHboLUBuA2W2kFtwiJoJSgEWgqqZBPJysaycSjHs6sol01gCspiVgJOPitAWcjs 4BSxESjTWDpKziSU2MKi9PwVUuViwuq4zl58rd1+jT3/art1mt081Z41xZ4+2S5V2WmSfey4 3PHjrBOU3ErFOtqVO8ZlLSvPlcutVlueOSs7x5yekWmWTGlmRNpMkqeg1EVSQXm6NLK83DrT 2mGVZImVSzdL/VJCMjnYKEtxRqnFbhthyTcVWh5ysEr3BPd491j3GPdot+wuczvcxW67O99t dWe5092Sm9y+aUzNb6Km5jq1gAEX1qnTlKa4JC9QpypNapZvib+bsQcC4Kq8K86oWTV1xTkg v37xEn+clQhxp6NPzFttCnbeH+jmVKeyLtW10C/AM9+vyl1xGzX7uzmrCwQC6nVNPtSpLqCM UsNN6BYZFVCnispDowLUpE6frzpcdcrQq10w2jdqcEnWPX6sV53gDamV3mDDJbaiEBpw2Kte 9IbijLsGCZMdhxhLsoHtuIxmnO/0xvl2mOG7hzeT0otL87xxaQ66Sj7RdWM7S8mGqbRvBJNp 5VCpNvjGTXBkkAQMXO0Ig1AV8dDgskJzu10X0OViSllKcpN42SCXTduwKbTaFVbvdwQURS1W XUiSpIJhUQCLs52yd01DnO3SYbcOHTpEdLhbhz063KPDvTp06rBXh306dOlwnwBjZngquV7j crcON+gwQ4eZOnh0qNWhTod6HRp08OrQqMONAhA3zK29O0tkv29BXZOauQDkW6KWutB4HY1r 0TC76ihdoRK8Gb1OFclSf5HRS9MMEm9klHhfKz9P1i9uSmh1oovvCd73ucS7lyDT9zEidI8T DtTE9YmDia+on1qpMFGb+FHii2HN7knspjN0ik5QLz1LT9Bp1I/Ty9RHf0sfo/4aas/So7Qc 2j+lH1Mn8G/oGXqENoAvUHCO/6ltNn4Q7wJdoMOslmYDh16PwMojQ5l/tv1ponQY2enEaNpJ O/km/hvahM/jsPhzOnJZz9Wo/yW14/33ODtHy9lLtBLz6aIwPch9iX9PO0FF0la88qw3HRGZ MOh6jPy0jcLSk4nfIU+sGT7cVI8mfifepQdd39VvPcZOXn10gGXTbsRtCt7MH6e6pGAwIoYX MIcVmMsefA5jNXrw2YlxD17eM71BtJJ+Z5Kerck8ShPfNeBKfAbaqlWPi3gbGfshbcYIbpqI 1zlrohx5c1OiJbEt8ePEMWSDWP2fGVnRj9Zf00F2GB4sp9voFv5LvNiJ1nq0b6HZbBSz0FOw fY02SqowdpWkM0SOiyvpn8mIorG34KV+Ja5P1tgh3Jgv0Ov0KsU1f56kQxSlCOKwEfm9mHzw fTq+ltD7faLlsPD8Up+l1Izcw4UcnIH5nE7aFpj2trb3je9u/sQ/sfePS6/oOiKK+nUxWSF6 Ayup74YuRGMT4rECK3tB2z1i/Y5j1Z5BriVlt6Skr2lrK/rPoKnCi8T0xG7E/p/pVlrPe/DA cg/0ui4Nlar9HNxkJhfTaTYjJRlc+T55vxN76Dg9NshgJ91OLYM4QxpD4zdEPEwz7RweHR/B qv0C4+3AZ+cwnfqQ38cRp+00n2ppH9bxNPZHK/ZwGBE/xWSsz5s4xYa7QrB7EquyXlopGas8 XDdkiPgMc6Wd05mZxEzI/FTuJrvquZtsDcIZaRK9x/KRHw/Te8iJZ+kFnCWrBBdZrF//uzXa Q+togvEhj2fBrJvc10+vqb7u2muunjZ1yuSqSRMrlQlXjR83tmKMa7RTLi8bNdJRWlI8oshe WJCfZ7PmWsw52VmZGelpJgnP85WsWC2u93vXqCX1QdwLG1w2WTXPOz+3SqV8h9OVJ0+rCkw0 eqlpikoFTWohnvnIUx1Q05WhXeapUoXtSyeU5zpkr2qqwJ9rdiisjl/gd7ps7zhS8gDMqqX1 fqfTofIK/M2CCH+zQ3JYtfnAh0DjzFLJ5xcUT3xUDSZVOwMoF/jVsmQTj6LDONmHHTUwxM15 LGrrNpfUN6hU2E3mj1Syi27nqwkvYep4PBpX2FDTrFGVygq/VFmByuxzMaXBQwi1s9XDxMAb XuPyhlcjouHgpZie1yPqlKNydIE/b5rD6dScxpPIfH93Tna9q74lG7PAQzMY1J2dA06OYGBZ 2rqZeQbTKtzsnY4n7kwLwpcv3PUKWqN69gdRcTUgbpAUXJLgJfnA5SKCmt6J0E2rMW1MNb1e zdCdkFernpBK++XuyoHoATzxLw8q5rArHLrNr0ohONVNUoW3tVkd2eRbDBacAAVbZbHcDVoh Fk/2tspRtEXfIEpXA1QH88OtLUGRJizoaoAsq96/zzngwCuJf59XzVNUC9Qt23/jkKLe4tWy aEaj+2T1CF5FLpM6RR8kQfHESjnqdWE0GPOuqRMrVpVaNi0bZ4W1xfHsD8lqZPkaxAx/oQPJ /HdGbar5aydWB+sDTbE7RIAFhYNrxFTWQNMEkKP7W7SpHtCmhnwVj52ChCKynxZBe7Hf2+ry Ip7GgAgI9KWKobpOp1qiCMVo1CtcDIXhvYgM/krwsA439Ab2hENh8Kde9TRrQM3aGmBET6gh YLCMDpCYsA6qJ9gQCIhJ6QugZlTsS5vkkqPCaEaFWqjYnP8A2cDEyqYFfm+DyE705PX+G84V O86hjhe9JJsVo0+06pwIkpAsdDXN17OgVcRHFMFmfQMjasbKo6vRX7P6RrHjDeg2uhqD0Wij S26MBqOheCKy3CXbXNFuszna5g3K2s5n4P/dfofaeCCg2oKtbDoWWeRbI57gC+YvEcvTKLeG wMHfTJez2uHMg2m9D06O4cXGPkPGI+/FPovavsCMzTiRHHKjOF7iOBUcqq1abFN4ssiPfbAC Q3jDWoH9gddc7hA7RQpUeFcvNALkcGJILWHEuTff4MKI0yn20P64h5ajoUbm+/W2TMsdMfJU KVi7oJAMJCX2RUISSUpS6kEX1qpYvGZrOfHnchrneSqfo3mufLlGHObwDn+zwupAM+b4TbWa iYhpy11Q75ccXHRBjTskUctWcEtwqyMUTVHEBKdk1OaST7pUm6Km1fsHHO6AbMvDAclSyWBY FGlqO+k6wcQhSoU2lblVViS2FeFQRRhx6I+ohjClKHujQSP7Lp8fuore4dbUPtJngY0rJokw 2FzYtw49Hnn5LjHVX4ps129walpFo9hUWBstYrMDaq642am5X2gFJueo98s4hrBt52sV2Su3 ilVX5WCDdh4EHEKeZMcTZ4MN4vzzI9HQxWHkN7IcYTP2hBGGpmZ/srbAv8uxPTARv4pVNsUp C3dS8Z1MnCU649Qwqg+/s0nLlkLcXCnL3tUNGBCNRZVgTHCidkslclOkvt8VEHeSWeGoLJI/ jGlpCEFLNFCFfF3ox3mJr2qcqifgSFVbAoHpsHOrsAMVdI8GYGGNYQGosar+G538lU04qcb6 /DhsIw1I9AaxhTHdAeyqATFjMZFAylN4vGt1seHzYvgcmAD5Et0KcjUCE4FoVNhc6HchzaNR RxTzMNr4hmcow2Mw4iRUMHFvnEV80AW4tOcDr8vpEpEPNGCo2xD35CmF3x6/O8JLU35Dcxm8 XapFOPgDRTh0JRFefkURXpHydFCEw/B5hYhwy/ARVvnY74jx5SH16CH1DBPSlYNCuuq7Q9qa chRerYZ7rVpI1/xAIb3jSkJ65xWFdG3K00EhXQef14qQrh8+pP8XSds2KMJ3fXeEN6T8hpPt 8HaDFuGNP1CEN11JhDdfUYS3pDwdFOGt8HmLiPC2/78Ib78swvhhkxkvXqjoVTOYZjDFfzIk hTLJ4OANCd8Q4IOfSTKo8IV0biJBVW+89YZWTJnszHPmVaBgeC/81iNFvo2k0R/JY4pAEz/A aFeiGu+pw11Cro/I8EO7XkunAqJFc26c1+BV5mxasTocunFDaF1Ye+3WewhLNtDIhHEJRqpu 9PkfXUKBsQplbmRzdHJlYW0KZW5kb2JqCjEwMyAwIG9iago0NzQ5CmVuZG9iago4IDAgb2Jq Cjw8IC9UeXBlIC9Gb250IC9TdWJ0eXBlIC9UcnVlVHlwZSAvQmFzZUZvbnQgL0VKV1FRWStD b3VyaWVyIC9Gb250RGVzY3JpcHRvcgoxMDQgMCBSIC9FbmNvZGluZyAvTWFjUm9tYW5FbmNv ZGluZyAvRmlyc3RDaGFyIDMyIC9MYXN0Q2hhciAyMDEgL1dpZHRocyBbCjYwMCAwIDYwMCA2 MDAgMCAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAw IDYwMCA2MDAKNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDAgMCA2MDAgMCAwIDYwMCA2 MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwCjYwMCAwIDYwMCA2MDAgNjAwIDYwMCA2 MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCAwIDYwMCAwIDYwMCAwIDYwMAow IDYwMCAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAw IDYwMCA2MDAgNjAwIDYwMCA2MDAKNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2 MDAgMCA2MDAgMCA2MDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMAowIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAwCjAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAw IDYwMCBdID4+CmVuZG9iagoxMDQgMCBvYmoKPDwgL1R5cGUgL0ZvbnREZXNjcmlwdG9yIC9G b250TmFtZSAvRUpXUVFZK0NvdXJpZXIgL0ZsYWdzIDMyIC9Gb250QkJveCBbLTY1NSAtNDA5 IDc2NCAxMDg5XQovSXRhbGljQW5nbGUgMCAvQXNjZW50IDc1NCAvRGVzY2VudCAtMjQ2IC9D YXBIZWlnaHQgNTk1IC9TdGVtViA3NiAvWEhlaWdodAo0NjIgL1N0ZW1IIDY3IC9NYXhXaWR0 aCA4MjMgL0ZvbnRGaWxlMiAxMDUgMCBSID4+CmVuZG9iagoxMDUgMCBvYmoKPDwgL0xlbmd0 aCAxMDYgMCBSIC9MZW5ndGgxIDI3NTQ0IC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVh bQp4AdW8d4BVxdk/PnPOuW337u11b+9195btBbgLSy8KEvoqSLEAKgoookGjRBGxIiJgiSIR YhRpZpFY4qIxgaivqC8JxpKNJVn39TVEDS6H32fm3sVl37zv378vyzNn2jn3zDNPn5mz/OoV C0kFuYmI5PxZ865aRPi/hWlClEvmL513VbFsmEsIXTJ/5XJ/sVz+HSHCPYuuumRpsay7HdcN lyxZVbrftJyQyW9dunDegmI76cO1/lJUFMu0FtfwpUuXX1cs6x14/pglV84vtRuPoH7H0nnX lX6fnEDZf8W8pQuL/RdqWfmqK6/B77B/C9qR/PaqqxeW+tMZhJQ9TChqp9B7iYZcTxREIAZS IEZCVJ+X/Qzjpbwdfb7wfClfpG/9JzWq2cPIEzf96yt2feM524lTr/a9oPSqn0dRyfuzBtyj VMvorNx06tVTv1F6z7awVvZvStsZ4SbaRsxEpAWiRTqUyEiH8LSZDEW+ibyAtJHXNPB8PelA TR3ZhLSW19fw+jxZgJosr6niaZqGcVXQJC8lyGK0x0kd0hjPR/lvRngr6ynSEH+qn/pIEPf5 eR3Li9TL+3qom1yAFg/vx/IidZEJSCt53snvcFA7rgqeitRGXuElC28z8983kdG4x0gN5BT6 GXkLy4tUz/NanpbztIxqiAe9WCpSNfkHKUNJjXkSqYr8B56kwLUdJSXvr+CpVOon8ZLIU4Fj lJJq9CVsBOQM6nWYdXZlfU6DCtj9OpRYXgRNojf5nrefIv8iN6L9FC+xvEi+Iyak35JvyEa0 fMtbviUvEwk1/yTzUMdaRKQ3oe6f5CSep+AtIvln2xnQmoQ6PibeJvK8SL4iVtz1X/x5veRL Uo67enmJ5UXSQz4ldtT18Lq/k7/xHn/nJZYXyRfEi/RzsgPpZ6QJ6afkr0SNe9idIs+LpJs8 y/CJK8PAX3j6CaMw8jHPf4R2kXzI83/m6Z94+kdiQf1x8p8cI8d5HcuL5H3e8h6veZfsI214 +ru8dIyn7xTnjLzDZ4DNn0je5i1v8fRNUomaP/CnHOX5I7z+9+R3bK7J73mJ5UXyBvkt+ilw ZW/P8iJ5nbzG61gqksOM0kkX4xDyKvkNb3mVRFjpDJul35TGz1pETqkieZH8mtyJp77In/oi n81fk0NkJupYi4iUzeYhPDWKOtYiImVzyWpEcrA07oMkj1Inx8uv+NOe5+kBPq79mP8ifvbz 2v1n3sITWI1I9pI9/B328pa9/B32kOf4O7AWEe3sHZ4ju/k7sBYRJfYOu0tjYi0iz4t0JImD 6ttZSp7hc/pL/uSnefoLnu4CdYjkKZ7/OU938HQ7eYLxKU9F8jjjU/IzMh7pY+RRJg9wZfhl eZE8wu95mGzjlMFSkWwhD6FWwVORbOY9HuAtGyExm9GykT/vfiZlyH28/V5yD6dplorkbsa7 5C6ygSTQ+y7OlSwvAhds7tfz9A6eriO3o7eCrOO/wPIiuY23/JRT9lpOE7eSW1Cn4KlIfsLb b8a7iMArJB5ZQ35MRqF9DdmFEsuLZBW//zr+3Gv5HSvJCv7+K3mJ5UWyjOev4OlSsoTo8ZSl pAYtLC/i19kbX05kzL9ILiOXQpYpcGWcxvIiuYQ0IF1EZnHeXMSkG1nIf3UBmcp7L+CzMJ9c DIwpyHz+RJYXIXPmQlcrcK1CieVFciHem/EJS0Uyu/Tc2fwu9hsiqIe904zS02dwzE4nPi4P p/O2afz3f1Tq8SNex95FxKyze6eQej5fU3hpMn/C+Tw/iVP7RH7/BJ6OJ424YxxvHcv0FhnD 86O5TBjFZdZIXjOCS7HhpWcPJ9ehbxt/dgHzyiRXgd8/rFQaxp/AWkQyhKet/DktPG3maRNP G4FjB+5v5JhsKP0CqxN5XiS1/Fk1vHeepzmeZvkdGZJGz2pew/UtygwPKZ4meZ8EUaEmXqLx OB97jPNKlPVq2wRJxPRQGL/K5ifMaTXEnxDkaYCnXBPz2RCBD4n39XKq8ACLInGX6ty8twv4 juNpLl5ieZE4S7/g5HXs10RoAfa+Np5y7QxLxMQ1BEtFWEEGYFrBUxGUq4OmV+DK+J/lRdBW kXsr+DO0mH/GUSwVgXsNnq3gqYjnsTpVqb+K44DdK6JHcTwKLgFYXsQf60053RCuYSl1rN1A U/8P/yP/b727h5uokNUHIS1+S44it4OUCS5hDFkNOt6H8jbyNDkslNFN5F06jP6K3E/X0Vfo ArqO9z6KB1jEDKhHS1+R1EIP7ngGdesgi4/Sv0jHyZ9AuxvIn8QtZJU4DC2ryDN0ljgcdt4y ycLL29HnXUKkJrGFbKJl9BA9Tv9E15Md9HWKXxdnkK/xvHXiNvEA3nKd5CRfizWigF/ahN94 ij8Dz0X9ZlGgj9MPaC85QOx0EX2GaslTwmb85rX0FGT4JrKOVpF7yb10GGTmxdJjqLsZ8pD9 fYVf2Uw20N9j3BsAr4gT0P8ZjPYodeE9jpJ9dBlZIKrpzbAXZXpK1Il29izowtvwdz/ZLNxC R9F7BQ8sKYaBDUiJ9I30ePEPBR/w1ovf3EACUi/7U+jICsGFN0Ef1G5QWpTT6OtCFf0VfR2Y XiDYhQ10KWwaQpx0AbtLLEO/e4VJ4hqyQXxbcMIi2YAx3ExXS48L24VFKGkxkrvpZmEW7tok tEBmr1ZapDLgj/+hdgMbqTBGcVQxROHBmDeJ2+jd4jbyIlUSJ66rySPiJuVa4OxaugvYu5Hh nywD1hZIj+FNr8TfMsBqPGsGdNxX0GhXimpooKPsbfHWdmCqjGEKz1gGTAXIasUy2FrXCG+T a3h6P7C1Cnr3Q7wN/q05g3faDA2dLaiUCgkTSdJ+w24hMnbB7sLkGf7fzgxUpQcV/QaVfzc5 f3fFKv+vzpw5f4bkUszcrXDvFiPq3VIk9PH/1vhxVXr8+TP8v6IjRraXHjtybjsqL5iBX8B/ Vo2fG9lehTeTjpJFAFzpDFyVgH3SUUGN8jbAFpTfBlyM/FJcUaaP4/oZ4CjyEq6sfACwB/A0 APXkzRK8UerPfuMD6egZGdepgEkAPJMMB8wBtJfKL+I6BtAE0AICgHEA9m7s2gK4G8DuGQLQ AQTABPwOe1/AmV6UbwOwZ84FsHvZ7x8CrAUsAOwAfAG4FHCw9F4sPwvA3om9HxsvGxO7n71T Av16cJ0CYO/3OvCEOnILYAhQWfSzCShUSS9E2Q+rC04a/HERKVAMPaGE/lBDn5RBw2ihe3TQ RQZoKRP0lgX+kg0aDTEC/HPytBIa0A1p4oXm9JMArLoQ6sPQuVESg1ZMkCS0dRp2UjXJkCza coA8oAbAog91sAQaYCE0QVO1kFa86VAyDBZHGxlORkD/joRVOBq2y1hIsvHQiBPJJNx1HuB8 wP///k3mrxQEJq6njbRbsAkzhO3iOHGL+EdJKUWlGdIhhUHxmDKvPKaaoPqV2qt+RuPXTNNs Lqsue7m8vfx32nrtkYpZFad09+j+rH/EQAy7jPXGW429pjvMzeY+yw0W2Xq9zWZ7zPaJPWpv tf/Wcb3jlPPpylGV/+Ha5B7jftnT7NV6F/hm+XX+OQFb4K3gpNDU0OfhmyLayB+in8bujI+J Xxi/L/453lMgi+RN0iLFdlCAitgLGgmkoVYIEskcOXEkRwzHjhw7kjUbA8ZIwBhYJJG+a0RX 31/lTSrdd19frUywoQp0hrhUXKGYBSoJkaGFmN9rt+q0ClFtIs9XqveGQ35XpdWk9NqMOo1a JEqtINkEb9hwrOdEj73JaLI34Yf6Wrvz9qYsDUZjYl1tfQvN2zxU1NFQ4H/UiFqnTfLZbfNs dp9kc8q3Oe2iz2afa7d5URSXOqN0mdbpcDi18t1R57klPmblmd3SG4prMeYLyPrCTH9dOiGF vGOkqZMrdKr6pPdXGRKioSF2Ycoo3a+GWcl41dTyekknDGlovmDK5EljRo8qDBtaX5dPp5KJ qN/nddhtlOgqyiA2/SOsepdphNjsEk1TDce6j3UbTU1NRnsT0lwHMXTlj7W29uRZ2tWRR4Y1 sx7AQpbWNIQohhyMAgMN5uK1JtAAFKCiJmAeSmvyNqtFqRJrBuZ5XYqqio2hAENb/zPo++/P el8+rnaaAglJ2PixLxD00rJZ8je+QMhDax5Hgz8uCPe9v13lMvpSorjxbW8w6D016ztvMOCT P3xcVWnyJ0Tx3vcFS1/f723WoFvSKuk2j9vt6/O63QF6mNWpyyR5AT1stYWcSq1SXuB3uf19 PrfbI7ecvYXjft+ZLyQizQV/jyM/LUwukDEtNW0RsXZ4VhNOuExea7YzYe1yecccTojeLv2r 4v7azpZIuC7cVHGR5kqNQjMy0FJXk8wmWlWNYVOkQIa3qRwBvbbRUTWyQqscbzjR1XOsq8vQ y3DOqIuhPdPbLfcaXus1HOtFg4nVNhlLzU3ZyFl0VVOG57zN3o9ooDEUVFotNru5voETJcO+ jqrsRVynaDAWzTA6RZ+afL1oaL/3vNuem7s0n966LHpBi6KszB/Ku0yrq/PDg43fmi3u2qG2 QGVEG60c4jQ73PapDr9CXPFxS/MlY9OTL2xpfn793EemjL6y5vL7Kn2U+tyh5nFDq/3jxstP ZyYsS/ujXnX+0oZpYV8kVaWC1ZBJzG2etCRKqKAWlwqHOQ+GC5z7JPK8eq/pB5Yzgd+KnNb9 b/lMmMW4ymG/yO5gXFViI4fT6eBsBO1Bt8lXijnpMKR9oGAUNfrXXXu9WmK+R0mVRqsXz+/o zjNW7m4CLQNPSoFhzgvcKIHIWFSoqzU1cNSKuRHG9qZszjndbPBNyC++fPrM5oujBrO02bo+ 8aj83V23/PP64XutNmfbmIfo+Z07ac09F82FwqF0y9l3qCkENaLrdf1er1PjFJ1mpz2hSYgJ c8KufpS/kVlL8FKtJ3s6GOcV3wp8VW+qq43Gzk61zWS1CJhSvCHd0m4a0ZzLV06zGALj8VYz Zw7tiBos8iOWdYnHqGbDTd/eMHyvzeJsG71ZfqZzp3zknovnVDIZSMnbdJt4CrbZKLKyMGnk 0LbWlrra6qp0NOLzeuw2g16nVlFilYKVjVLb3tHD21qJVzGSNVcphrCuUi7B+ylGsp6Sudxq tozMWROWIaMhRrpPdHf3E3SRrotTeSTflS8KlyyNcMz6KMe3SlHEu74oTzK0OMIM5eMeRiOl K7/HrvhB5AqPUbVKJ6nLVU5RNOjlzw+pVBXlw7U6hVKn3Hi/Sq+SDGWFCrzkIflvBqOKgt/V ai2CxS6Ta5LbKM5aJkh6ywStXlRrxWF/VOpVCr0mo1Fpy777rrxcrc5oWI3yj8PECo1gVUyw 6AXhGurTGrX4X8TlxbCGLpdug0VRKAT0Gq3K53T/3k6OaH9vUL3htxstemDIpiZ2i82h92OK u6E9mAyFjCWGkwOKWRrgwjEUMHIarDP2y1IjZ3SrsJsuDlalQ/ID8aC3Sn4wVJX108uSgWBc eCXt98fldeE0aq6N+73VdGU4nQ6DBpfKL4pVdALsoKpCpcNkLJd0ZcSpE486WQFqgKhVTqvz LMMdYeKGMd1QyvQaEyH904JpaKUN9Ct1pe9PepMkyV+qHDpRpR5lMAjUHjRrNQqD6nSX3iSI lSqTtlyjAK1tgaVbI2RgmQUKqJNESfU2ecugV6uIVC4aDMe6OHWcZIxuDkaHUKY8mD4FDg5b 7HaLOMRe6TXTpU7b5WabzXy5iTmilD5+5msxRafB8rMUNOIxzTtapYtoMQyG1Z5spIgyjkj6 +NLpM5csnTFjyfZJCy4+//yLL8Z7fXbmbklSbIal6C0YxArLIrLILJjLNEQyKC3FtwIjHuvK Ks5KXKCkpNLoWlvM5U4qFcJVzqjLm1QoXPlwwqO2ahVttZG4W23RMHvl6JkPYabq8I52sqQw W9mpJZ2mF7XvOlrKW1S1tFYxvny8qp22K2YbZ1dMNS82Lq5YYN5avlW1kW5U7CzfqdpBdyg6 yztVB+gBxWv0NcX7xvcr/tP8n/bPjJ9VfG7+3B7WqKyiSu92YMgYOV64u6/H0AvLBNLMVJOH 9BDEoGA0sLzRIAiLrrnppmuW33TT8kMffHDo0J//LK2Rv/ruX/J/UeO/vqOG7+fS+bSO1tL5 8jb5KP62chqnEiHiKYUaFnNbIRwwAEkKseJFn7HLUeZ3mKwG4tT4JL/SavD4lXo3dQcNxzq6 jvV1MUOBETr0Gsn05Psw1dkfbIaiDLAa+y0BbgW0YBHo2ooKhS8W9NNEubXcbHtsZjYeP70r Hs/O3CHlBCHkcYQ154tiyPv9a554GP/iHvFtJtcex3v+BfiuIWsL88NK+KsVnWss1OJJRLo8 LxKvc7X2esVq9U+D66RH1VsVW6Qtrk2+h53b9dtNu5S7VLvUuxS7pF86n4x0qvdHXlC9oHzB dQgGsDuTrslGYQyGFepgROUXy1Rpf8Qu1oI8Xj7W1cOGiYFy5d3T12V4rYPpbegVzr/DaH0D gRSHblbhD6KbGUwlUqJKPQ30k5WVyT1aVlfzssfTQGddP2/YNSFlRaQ67NWZC7+ev+ND+enp 1avpG1IsEIhCiXodqaq2vW53LR31wOK1tWm1eUR6aBiW19j3tnXJL0yuXpmCUBf14kQf83Mo OXDmQ/E74CdHHiwsJx5rqDMbpdG0p9Oq79Qq302/aM1LVZaqKeEputmG+eH5ussMV4Wv0q22 rPauNmxEKGRjbmP4vuqNint1T1Zvz22nj+merHgsvFu3l+zL7aH7qneHX1IHrMTpV2VMqqtE Ks5NXJUQEgan3yk4Nd684WRXR1fHsQ4Qq7FkY/ac7ALFlnCWLSqEIo5AF7BSmP7DX11tA0Na EY9n2yGdRGHFzd8d3vxlymd8d861D1wyy5WeOsVvnTR35eypz9nckY9u3/bmfGG3f+f1z364 YpQ3tuj2JTNXGxWioq2lTJS0l4676LpLw64hq359x2W3M57dAxrqVWiRayQPFebfQQ9Sgfo9 7kqrRRVxpPWGlFQeCZCuTHlO0+V4UYxbG63ThEXCSuGnwkZhh7Bf0KTijflMUEr7BYtW1Cs9 br9GtIpKeI+0Lh1X+sqIRx+ncV/Wv0ZP9U1gFmiFDqgFw2v5DkZMTARz1umnqt5eGOFy62ul ymwHNWpoiV/qQGWQmkAPl092G9eq4CpmHAJBTKumqLXEZcJBeS3VZ4Oh2HK5yun2KES6Q2fS K/WStEhnrIGOsrgFUa1yeaaGCuA7elTYcXqWXONLhANP+b0j42l4XEecOoFSg+CynVaHvDaN Xp0IVz7li4bDRZ34NOSeIPXCm762cJ4vESRecZjrPNdFLtHl6NSDLN43dZ6PoWsSXcH3NO+m FtuXmBerV9tvMG903mPc7nzMqAl6EyFiVUX1sI6I50rtGq2gneul3hQTLaCfDrAdFywlmQee +6ZD7urgqOPaiw9YOksqRVICE7IaplD7lS1dO/yqmme/kOU3nvpL0l3+7uyf/vyR62b90uR1 JmroqWw2Xy23iDqH/R/7XvpudltlYuLP1tzw5Kx0M/064InFIominBf7uJwPk3mFkX5XUGvV HNdjhO+LndZgp+tF67sRKWQJTbVNFRarF0sLhAW21erV0nJhue3Wylsttxp2hAxKlTdoIn6t yhRwuCOGk9193Ybu3rNC/ZuOXu4MwFot8QUGE+uXHSEm5QkfE5MyAr37J4vmrl6zYN4aW/2t kx754L2fH/6SXkh984aunJR55DBdu3rrfSuv33zf5lGjep858DfaRBV0Kn3YHSsIVOOVz3B5 8eaZXrEH8xjEqApeu88mVQa1WHwzaLsq3xMPhi4rX0vWa7dot5Q/QXZq95IXtJ3lZXZbpWiu CLq05Qr46V51hVc910zNITZxXSWVAJVfnLcuTCJ3bphjkxKKspEG+lXuMEbSJWtAJaxQ68zG 0Ra7KNJ1siSGQ8EApWXQA8IDHldZucWhM+jU+jIplakKhsvKpFlurxNTEQuApcmbkH1ySRdn yL2Fa8IO/bMaqvmj2Jm0dnpfTL6bLfMofJUeq+969fXSirIVwq22W3U/KfuJsN6y3rBevV7a 6tma2ujbmNjq2Bjemtnq3BjaGNke2h75ReYXzp3uHf4D/gOhA5FOd6ezszoadmhNqkBIqYpp Va5QjKiq3Flo6a6TkHYne0vSj2vrkx1/4D7ID7NqHjDD5n7jn1li/e4JNAi9Zu0VV669fcni 28tuWXTJLbdccslPAvMu/vMvd30yd+HCJX/Zv/+TJXTG5bfedPmlN6+hvfN/vGbB3BtvlFdl 77946+u/vWfxxmzi0cVPvvUfP1/0KONZgbxR0g0OxMOWFiYTjWjR24LHsUYsvu/u1Ng69e9q XoyUq8ulcrvLPjUw2zW7bIFnQWCxa3HZcs/ywGrX6jKGpDt0W9VbdTvtu8psTj9RaQM+lSmo 5PTcc7Kvm817D8MByBlKEv9/sAi4jUK40oQ0qzeZudIsOavj6n8CMn53R9dX8s/kP3YMufa8 6kcOK25ZNO+6H8+fd5MwZ2T7l7888Hf5sNwn75QvcUcLoqDxIIh44gZG6A/dz2I/3GZENJzZ Y/6CQXNM1B+zviP+w2FSurTEAeO8h/mE/P2yzBAt2uPBaMkAH2RN9luVwtGSWSnH+u1LgSyi a6VF4qWISrpIouDQHbF+qDpC/uy2WYvuldokRZzlbv6bRf+op68na+6XSpwTzi3tEG/2BgLe vjW+QMA3IC84Y6FwFMI3Ss+LIheJhCPFOf3gzCbxqGIG9P1QsqIwpibvEVuJuz4TbU1Q4vxY qv8kU1EWav04kyj72JwYJmmkSovGokg5WhzNyfGOccnZjlnJ8qiB+PMkZXA3JdOqpC0xzHCy 7wTiFj15cHMxUHSiBwGLLgMiGe8WhRSzf7gXwRV20QA9i85i0WY19pNzrJ/fgXCzsRruLQtj sBBFYM7UH2944mdV1xnNlbcvPP63/+x6+D6bPu83hhyJcdH5t+zborQr1Qb9nMVjhxvz4nbH +o3yH+S/ya/Kr0Q9ttwIehO9hHbQH/+1T77U7a0I1FgrzYatqx74pSC30QmULukYP4U5csIZ GSHl9+ETC4j7bizkxwuzBSEudpaRTt9fyrozAY+o74rbsmK5To8IhtfnD2jTlVUGSLbqSJUq nc4xz/dkRzdUNIzd1h57vkhGWChoc4L22vFcrGDi6gN4AXr86XgLItoo+wEBAOuXVSkMPT09 hh4Vu6h7ZpIOGoC/w8mCSUR7yRVhIUdIgxYaC5wNqZVq6Gb60Pt33zckl5pLPQ0xA73NWB+P 1spfTUhl2jrmydK0ecOzqbHyvwrJZKtZIIIpEEv4PLG+jBdXXyLq6+31RVku5mX0JGKln0jX AEdqRE/ziB2cl9B8pvrUZegMdjtJl0lKSBFLwgLym5m4THFZ4jJxlbhKsSrx09Qdos4ddJol X2U+bUpEDWVUFTIpSUVF1GeLShVpm4boKzM1hj7Q1LEeTkg8UsAlBFcWmd68zP4jAlbU5Cla 158x9+PAWNL2RSYqSktuU9/750Nb7u/8/O271t2w/Ls35EIolL4gEJiYDgfpO8f+3D5iyWWz puSuu2LDRVdceeHqWRfOvOj7Xu5VrPUlQpEnHz5vZTR255LZm7Juto5AyaQzf5GmSK9gpq4r zFCn1VXCbONi42rjeuMm11bjE9kdrr3ZF6wHw99VfZeuWO7e5xaIWaMVnYd9ce0X5i7x8+q9 8f05m91mjdqj1uWO5Zb1ie1V+6o0BpuS5IIaW0Uqm2MuXVdP0a2AW8esgdeYyDQ1dWQ7ljHF yKSTrY4JJVjIjGuKTt9Z54IF/0JBArsAXcXHy8LBiFfyJ4ZbVJL5nnnPvXd8T/N1za4LLb5U pjB114Xfyi/SUd8OXyfd7LKFGy/eWZ4JXOjWj79IPv3HP8qnAwHdiITX2xBvqAVDGWgFXeBn euPiM33SCtCEFusmMwvNGru20yt2Ja2ky9td4VK7pJQ6JbWoW6RfBHfGXlC/IJXpvQ6rZDMF iLIiXOMy1foriN6Wr2KTn+/On+xhWqE45z09+WM9Brn1cDbixXCZL8C8KGOJD+ArFie8RcwT xEz4cKP0Wv8w7zd//fR0Jmd9pCoSSbWaDK1VkVjqkQ/+ReM/mjz+/Z2WizaI4okve48LIpvo mFdc649HQvJL8n+t7Z42abSEOR4OWm/CuIaQOwvnx6szqUDYZzVoaprqm1Uk3Ov7LNVLMvSr DM30eDSdzr8bunOqrvq/kSEmt9VQhpiPWqr252J5d85KYvSrGI1lvfoma12FpM4MNfR1Yah9 CKsvM/Tm8b9o7rOQUAa2vsygY1m3zALyzELCrBtZ2pStKY347NBZ0IgHS5gXgHWPYlD4f6k5 mAlHUhMLhfFVkWiV2BwMMU4/3UOVnnDI5Q6HXfIpwcI4Pxzop/9IKBHrqY2nJ94tP1tXn6wa d3B8MjsyJI98fGI60dQXRjyXzAGu5gBXjfC7x9dl6vPxaMrtMKZ6o5/le0k9/aqe1veEjZ3+ vzu6daRLpSKxiDPkdph0aslQjvBCXSxXHcq5JVJNv6qm1Q0RvdtabmhCfDzfxbEEzcKxxEmD IQW4YLg6F1X9SIKIYJ5Pv2wUBsqFYmzt36NKuDCWjIaDsjkYjmUCw4ZNSIWD4opgKBRMek9/ TNXusN/jCobd8ncbAuFQJBKK+EUuIhIxWYZMYTiqHJuPJuV8ND/WI48EbtrPfCzdL72K9cJN hUvHZWdnZ9sW2xZnb8yutt2dfTT7aOYJ/wu2g7X76vf69YF8PJYKmxxGYmzU085haqr+r8Yu R+qLfFf4c+9ex/4WW62tPlobrV9es7xhu0el1xi0aqEqkFEoYjlFgui1hroKV7aFy46+7h7u LxYd7aIE6ZU7QGycohgKYX11ROrOkZopamSWJiSHvyQ5igsMRYo6V9CI27/zeiojdHelM5Cs 0Jqa/niVfFI+QEecal83rizkzviCyVq7WhG5Y+be93q6mlY93esPRN2BQMQt/93hspYFs3Qa hQqli3y+SnvjwttzsYK57Lxp8ukTf5FPQutQ7GcjiK8+jlj1qsKYYOfIT2vCftHYmXJ0j6jT YyNnq6qmqrVeqs2OGJKKSPGQXuMwSQatvxIsKJFCvLE9pG/K1tZ6pMYA0ddatbWG/GgE2PNH 2CqeoTsv43LW2y452EyD99rRxJJepnIYPZX8kx/EjlCsplhyLLHl2ZrSHUWFjTsC9NoRLdnk 6D8NlEhvn5+qH19FP2xvylXNeL0qHEnWOwyt6eSENyena8fm5MAGfyTh+0FA+RJxv7ydzglC K6M20Le6Xz/TxxiuXgSudMBVkDQUfH5Dp51xm1Knthslfbm/Ukkkj9gU0FvKm/QhwwkIILaM yYUtD8/15LOREuP8TynTPyCjuGliKjXx9M8y4Wh64iefjK+ORquEiyBYqsZ/ssETZ2+GeBzY IhIKhxO+PrbxA+82Bu92P95tDHm+MKp8dGp0oiZSl8q3B9qDUwNTg5p4TWD0GIkY80Efpjfp 6K7Huw9RBfM19UPbRquqiVtqHDMMYrS6OTBGD+mQGcukKDTEsa4OwzetbBhs1vLFWWPFounV BpOqnoxGyhbma9gVwBb/ASwHyKNlDK9Fncog9al6FD0Gla6nT6nrMSh6ZmZzpOP/kiogDgQu B9hnjFwoolnmfryxNSW2ohFT0S2MElrkXQjCZPyFwoRkKEintSQZKfxMa8ulsbgTC4YzrTr5 xumP/8I0FO1z/R69ZlFs2I9HXwGaiPt/ED3+OGjiMvognh+IhGIB+Q7TIfklbywU0Tl1vx67 YkXZpRz/TcD/lcB/nJxfSKrLlcQsRqyd7m4xZu4qj/iiQbfNXCFZDGgJRklO2ew0RPWWhOFE Txd0soGZ+kUuKQne12COMRFihAPHPSUPZaI18H9QTkD80JuEmxLsW5cJh1MTbrxxHNPL9FWQ UtWEpwQLvX98GhXy86HYvyEiChuDSK9gDG1kS+FKRZseiy7WtgyJtNV56iKIp7fVFto9iKe3 tRcWkmc9z0YeJy95XorswUaQSNjraaOqwJBAfXnnEKm7NuoSK7qqLGEvaaMKT8RRcHt06lZt i1tvHFaRLEQjuubW+paKIUOj+tywOt9wxGN68t0nu7sNnxo+7WVXKOeirV+UFPnXTMzj6aBY 7S6tnKT6p79fE9HyYvg7Vj7YfC8toLMb7cKl7+ty1dv9gUSDwW1vg5Uqf9aczI9OWV/Tp9PJ tO4NU5GCPofOabN5DA3JoH97da6C9ghXh/2hQNTTd7UnDu0Uh2kz5/QrSTxKGNa3nVEOR+xd nmgg5Ee0jpLAma+kdcBpC2zZxmigLrAocFmLFG+uDbT4FW51PmjqTLq7DaSrQd3sbwnYRlTE hgdimdoaxfCWWE1FrduoaWvFjojW7i4Wr5I5XprAil1QzowdGZayYMWXOKdh2wz4zM+238C1 MfTMZIzVj65i/OesfK3J8lVsOz1r8J0Vr9wTj1E6rWZcfXVq7CnQU6LF7JzaUtMUt1xYHXHS 72Kj63PJEf+VDYdSTVpXLmd3ne4pyVMmn2DwBQRrqm+LaAtxIRv39xk9tvJq8QHwi0DGQW/f Ar3NYgVDCmltl2jq0uwV9zvC5rA9ZUxVtFTUmmvtLUYW9Li17FZBq68g7dYKZZYtxpwcuBhj IP1WOKF8SYb7tybpFvmtL/8uv0mre7+k2dN/eeqVV57a+dIrwhS5V/4ZnQt5YqEd8mOntZR+ 8gmlZ7o/4WE5vBvOKXF7Sw1uvrAwhHYShPEd8FS7bZoufTQYDc9WzRYXqxaLq1WrRbXPaTNI drNeoxaifiW2h1eEtDGiD410m+1gcJiisLHYXoOSMmB7EKD28u91YCWJBZKZ3W0+x6TqNz+Z K8pFnZG++MLD2x7eBvEF0WYPwjy6edQM2E/0zX/0nfrns5JJzi5fcc3yvtWBMBNfoWDRcjr0 /PMH5TcZvuVTHN8p7K+6p3CFvpGktRFfl+2r4GdOc75Lme4ya/cr9zaGa8INqapUrramtqGl qiXXpB5lGWEd5RnlnWa5wDrNM8270LrIs8i7wrrSs9J7a/mddK13C90Y2uTdrviFaic5UNtJ g3rsUq/LVLg17XUVcTHbiHUJtg4B/i3Gp46wJYmu3m9kJvZgJEWwHYB5UcwiCiUhw7n3BcwU pTtkHqaUSz4ErkpTzJwx+sYzb9PG7k9pg/wf/3S6Kha3Xj88vTXim653hq8f3vh23fidZbaq udWd2w93Pbm9q0vI05F/omp6ibxZ/lbukZ8RLnPYM5GUxzdi+JhspWt2ej0V//whleS+Dz+U EbIQwLdE2gP+VZMC+XlhOpv4Oa1s6hdVr6xWVbXSeGv1ME0KNDLMMEwYVkk6A90Zu6ar3lCf rYm77MaA5LRUt6bUwrCmjDpODWXBYVIFqVFUxCsa4ZbHvRZnpo2pWlji3YZeYAQLFMBUkVwY p3Oly8mF2+VFZm8Cm2dIK9JqtptOpTP0IKTB2B3uYz9RiSX8lRz4gYZ6cUsAfHj7DyoU1qdY DS1Lb3vzzg13rHu3vTmbbJZ3B8Px6kBz8/h0KER3PPRg7YiJG35cmTC/EWiE5lyWyyjFl1sm DlsrueQlCxcsXNR39VkNepc7Fgx6QlUbf3TNk3593C0f8UVDkTFKiYZmsu1+kI93n3lHqsE+ khHk1cI9iebRLeucP225v+Uh50bDttwjsN+fDP5ixI6mzhH7Ww469wWNyXiwKkKUZWKLw9ks tfmqvqgt/8IEn7+ttivyuW9v2/5227AJ+Tn5hYYF3gV1C5oWmxfbl3uX1y1vWm1fbV5hWGtY b7619VbvrXWWxbnVufU5UU/czQ5nSzCnbIgnrEq3KmEdNbRhlMrdDubFUlpRN/MtQk1NfP8I jP2eflnMZoob/PAeO4rbhzLFrUN2tt+lyN6lvRaYjqK17yvugymZ+ywaV9qrASKnwxXhWDIh VsC1rtSWhx687Oafzb9o45svnv51w/UTBXcwHZR08XCdR6cL3HDeqgeXLX/smd2n3h5zV6gq lGv43JSNT0vZRk24/qLz5uosnsfufegtj89jq8y9XRaKjUta8/XXzZsww2Cx//yup34f5HPA /MtloPEcubIwzO0iuTJjhctq0iiJ0u0Qs+7Oiu4qb1c0VpVJ+qOekM5kFF3WijIN1txcOeuY 0GgPDJoxHn1ydCaPMB0LzHUjBl+Sd/3oKfmT+df6d6modCozi6BE67L1dWwPG4SdHbH5uqL2 EQPGkuLqV++CMfCV4KsKhYQyIRwVF0bDtFyIRuNeoUz+eAv3LU+/yX3LLfLHom58IhL2Gei4 CBwi+YDJT8OhxHgqMRHZ71wWaXAI1tM2YPx5cmNhYru13TnVOtW5wLrAudyy3Hq1U1NpTOcl Yu/KJF1wiTqDqu7M/ppkKhwLhVJBt6+SuYlwh4ivsTIWq01pGw36lFSrJm2IuJ3V2/1oYFfu YGNBm+0nYKFMvkMt29FvpPyghvsp6H/4PxxFdQcQeYF7cJS5MymrI3TjhLtvqZtUlxz+QTYc STfrjv/x8N8l7OmLhJhrc/rElQuTQ9qffllo8CW4H+E/vfcf//jHHxgf6s6clF4EDnBmppCZ aqDxmCGOkIxRhwE7VN3h/Ql/ecYqQK8Z/QFDXO2WrGMN2ItQPlZKsL2NHdxc6zg7JDjBYAjm ImDTKqQUwZON/aYJr9HzWtTzWCysFR6GPbvTsaT4NJxAzq4nQjix5dZgBrsY8kmov0xLIp29 Amtr49dmqpLNFEGXZK1W3uwLu5uGJwQJQVdmqEVCfZvFS0PctIdjN2V85HIsGGPcAmj/MMbd TNYX8i8F6ejK6ZVCMEjjTSmHWNaZN3ZLUY+/PqMTnJXJFFU3k6CmDJjQjbPWj8u0sKH3jzzT +hr3aPmoLUSD8WmgNypJGXJO/GF7GB8zxcptM3Ip/CXZ6A1qBKLhERUD0R2Q4SUj1+4aPHxs L2RuECzcUkbkerF/vRX4WfC0xu6t8jg1r178cHUq0UhH2ILRqPYu0WgebXdojr+ssjnHW7C9 ThuL+e20vSGRqtoAREzzG02u0ztElz8U9cY8wUCfw2cxOYXdpyc5Deag+Gkw4I16oyE/x9sE 4A3nHLBr++ZCShG4OiDEA4it+kRDZ8LeXQG/OGDIV1uik6oniqNr3JMsE2v0ZaP1dVw+wIg9 +SljBGg3bsbaETThaDNxK7YGoXsD9x7zYMoaXqfnAXwDa+EoY6F7dcnAHWQ7lXDW0s9H/Ug8 W0GN4nB42W1ypC2ZGXevvNfYCseo6q8tiVxb4OvvE/XJ8NjKRyakUq0G+WnudIN/PHSC0MQo ibuEk+gefzzp5XzVKf+G4QR7IjdgT+TjsGibC36tTV9O/lv1te2/9d0OvbrcZmAiwozQMKju vHKshrEtkjwMzwRBH6Qm0yRZxQCd/cM6eooKY57yhIMe+R++ZNJHKzzBsOep7/wuTyjqVtzr jgYQOTv3HYYWguwdVARv8DXe5Ie3kB7lr2A2S2xNDnsimbnB/E7+FngJ9h4DCY97nqVlD2Ht U95QwEu1/mTSL5/0IMj5FHbMuD2IPJ260h0Nedw+Qs/0yh7pQ/l+rGoYC0qK4wSChO08+Als +aLWQJ304fd6+f6VK5mNdduZz6TbxH3wP+vILYXp1yvWK7B7yPqA6heK7Sqs/8Z3WfeXveA7 aKyo9DjrKnIaok06E+JHH9morU9zyuD/zvNR9FvDO8nvcyljs+mgScylquvyFTgt6HOSWOJ8 ZTxkrmfK/CR8TGZf8Zhdpqe7Dz4Vi9kxP7tfj8PFZMH+0hJZnb2oorgPbh+8P6a0uYpzpNje cEnNlj1XTltzXD3llUUPPP+PE80rh16xfNLLPk/0g6d378uNxoaPh91hJT1oMl46o33G2jFv jpu0Y+0jz+gNqmuumJqJtEzZ+6zc4oV3HvQDL+04HXILdlmVYyXkeNuPYCNVYJd6BU6B2XA2 uALnjWw4t8zOBGaxOhAB/vTIs5OHbtDjRzihEaEELUrk9Tgrb8UZ8DTO3odwvt6N8xPsBCDF 6VQFgJInser0JPbr7cd1P65qnNpIoK8H94hwKN04txGGRGPPZ+de4zgHgpnAyQ4T+RF6XoA+ U9BjMskh/tfdjZ1abB2esTmnL5j+CL6zzdds4zVvYHTWEelfeIAVJDLDn1gt8OiiMe74lKiu XwHCf7cK2zbs3nvH+uee+2XjU5e/QbXyl69dti1vtj0fi1a3W83tiPJu9rrW77lr/b69d965 T7h51Dj5v397WO4dN/58l4M56BLxY2ObxYpRzwXtVYH20mR1Yc5a9936h0KP6rfqHjJtT7+g Pxjaly7D9ldKRKN0XvlF5VeWL3Avd68pf7T82fLt7t3eMq/9VLjc+JGU/Db8TlW7qd021TTV tjO6M34wejCu1llILqCaaonHprH1F+YClXZmdGEVDttpuI3EghrnLCvwxaYS/bGVei4RsNUG 29z4UtP9UYQBo1FXzJ1dN3Pbqy/cP2JVvdnfFvHF5HefOi5/SP3/OeEhca4U8GXHH4xEfLnJ F/zqvgd+HYlonXUx33lPUttbb1E7O7ABXxfj3wIaC4OG3m+bBhrTYyb1oDEFTgSpQWd60JkC pxLVoDU9Ujfm3wjxXA3KE8HYTLN/hBMjRtCaA7Ufof5blN9B6Qyo53v0YL5KOyhlKq5Tcd0F mt4F6jmI60GuJdnKXwpv4UXYkP2CCU9mT7eiXwq/FkP9dLT8CHQex4mkaYzKerCJpws7WxmN 9fM0mJp5lwMpDO7PEB4YwqZzhkD7QGoqsXBo4LYf8X6rsXXfZb8+Qw2/v2R7S930mkTsqNdV lUtH/X2796y7Y89z6zc8Y/VOGX8Brfjtm9Q8djRdgy1cIKnvHwqEYcO/csfu5zes33eA43gR cDwLJybd4KZft00ii4DPlYAdHGxkJ8a3E3NxAGV2fplxawCpFdjrJDeBfyngbjzrI/48qBq0 fYte7wBj7bhzKmAH9M5O8O1OzM5O3LEf5YMoH0T5IMpl/HQWO6/lAXbdwLoXmNQA1zNQw7h5 Ggn3Uykwiv98F1FPH9sRxlAKOmUOTbiooYqrnxyj4FiEYyMBLjepRb136wrsCvXGk9UL3r0M HE+DX7xDbZlL9acXCuv1O1evPUAfv+fhG6NuT9aeq6Wq4x9Q0xlyoDF6y7X33okXxNsegn3R ovDBJ7m7rQazz05suyDvAsh9hBzb8dyJt9ajjhIbFVB3BpRHQG9K1BmQxxZo4KAMZQL5lEGJ rf3b8bQYrl7wfAw1MeCoDDsF8lAQ2ENbPDDSH6th9gkUBFxwsCswwoIVg6yNov3VUmJhYAIV UB+eH7abi1sSqUTs9NUs3bU9UZWMP/KHT69aXB02rcstu5henEilo/KOu8MI6IeRCPOxzSTc vv+JfJ0v7rjoiiaog9jphxleBLJWXiatFR8B3zSQL9vmgV+TOAfnB88msU7oxxcP/DjVmSQ3 4Po04AnkD+F6ELS3F3m2jpxCwD6D4C7/xgwJAj/1lKCGYfgj0AGjM3aG/iO0mSiT9N9iLVbC +mM7cN0OKp2K61Rc7wDl7IKe2IVZOYjrQVw1eHoWRlsGv6XBb3mB4Rr82t0oPwsQAFOB/xho OEIaYRD0nOxgITJsVCuupfX0dGNduhcYBxvzmWC+NT2rkmuj7ETJAL0MJ7vI4PxsFBicb9ko eRDCuFt27LjlJz//Oc26g42/W3f1ZTUh11WejTcM2Tj3hX/2HZx4/3iX58F4PD/SJKofv3nN E0+sWbP9dNWdK9LjJqazvoz+9idXjR7+r5dePt3UPMZqCYXifox+AbN/ITebyBttY0BrMVCc FtKR2fZhUBQbH7PHCOpiOMFvAA7VoNAUcMpO3DM6zQPfbpRDLNCOvAP3pVHLMNcEnLFvAtQD hwxnCtzhg34NYZYdkIRm9JrO5zOGtgtQno2+U9BrJmmG/oUYRDipuMQNsv0hSsFkZWn9rZfp 4hKCUZ1tOEcuMlWMTURFZu93wamxuGns3OqaXnM7RORml3fs3RMf/GUmn47H5W8ygURT6PKF l2wNtSYDGfmbWCzTvqGoem1muaW97dAOuQUL4WFuXD+2YvUdi+S5bMWcqWhG6zuA4/MVc0Hr MXJ9WxJpCPhi3x3SUAVxA7chUGUl8PM9xm9Bzg/uDgOTOImEOTGAhpn94gdWLkS+gBrK5ymG fn70i4Pnu/qwZZrtdmWYAZQQhP30MBcZWgbuVDt3y1hN/8Ikj9MKZbHC0HikrRDrpG2xSCjT 9108nkzS3KuJFHb6Rlw+6dCSxsyMaYloX0UAa3dg9qBwM4K1IZuZjfcLeYW4hY83SVa2sdOy Uc6jPsw4H/VZDvVh7AwHUYyfcWgKnOjG2GIYuRIji4KeimPWIhdCbQxPwuZe7HnBwbfiYLl0 Z5GsIp9h8OeO9X8y2Q9HZpgZtj7eNiQWLrTFqd4bbPrd7csuB2Nd7bnvBnnVvFw8LsTYgBc3 Vc+cEYt9f3DNreCnasZPt+0Q3sTGHzZoitPqRNoMPmol37SNAiWnccY3jdXoKuwQSUFOpEHT KXzPphXQAo6IY5bjGCH7okYFatOwR1MYqwK1FJQikQrgxkLiSP3AjgU814KnlYNGatHK7qjE HVWoxWYg3Mlsn0bk1OAfZoXEoC+1ZAhzF/Ldx6APGIewLWf5PLYQMobh9iwnFBbfsJE0Ze+M Z+Lagr9WkmI1gFbegqPruPIIAA9z9PQwDxbOfjbHgrVMd/4bM9dYPJdVXALApmMd1VPOktAw xYBuA6W7A5WdsXhmYjYxLZ+IveTyUmxeTCepPhqfZy5PXJy/l66elopgA8V/p+OxmPw+XSMf j2eLRjCzWGzm0zVf64J2L056tpYJgqIuvQZHNrEA6g24YlpEKSikOpHY1wlcZGabD5hEFXTr mbOcV+Q1NVpUaGJ8iGOdwKQBNTGczLaj1s5rsB+zq6ujeHIFCOSSiDHaIHezuOpRGmVNQAjt mpdLxOg4DK8ZujVzGlICjGWVNhSHwIyuIjvhVynfa/gZ7K3zaGXb5fjSUSN5AO90P//WC4HG tGAkSk5r50Hb6fDWQ6BNazjPsK/RnEI0KI0x1oB+Csh/C52XZJIHPb+HzxTCPSNBn5hf2KPD Aa1kIWAFQInz6jGMdyT6jcFvVUEX1oI2PLiLSZwhsFjY1150wI0Smpug13ykc9DXj28IuVDP tPpFaG1AaQ7un44nMi5gdczbOh98jBXSHmyvgIg39HYXhVZRfEGJFvcysUh1ppVtsWCrTWx7 T7+TC3qGOj1HkDMKHEKN/TvABgv9fhunP35djGL3KwdOvuLxmqHjppuGJIKhNSlfe0vVeFek NRnMQu5HMu0W06iaePyhgFVIXNgyarYtecXom681DE2GQ6viUaFqw/ybrpLnstNG8eEeumPS +Ol1taePM12AkJ1HuNkfD4XskXRyyNBhrU8dKrrIWawgFOXHGvhvLeTNtnGQCDrIATVmOAXb gn3Rhnknp8DRXBNjPo2YzTTmgn3tjengGswr0xFhYN8Nu9GJe2v4rFXgOezrdC2ISrAv0zXC SqwoaeKipzsHvaejP5uhFNqKmtgCTdyI+WILHDMJW7v9t8qYqZl++Df6eIA2RhjLU9qPOCDe wE2cc7VxaQNNzdfQxslMZu4P6jjT+kEhnGyGNl60Ddo4POpAfSIBbcwwGwnYzO39yjgW8CZj XnpWGSe9bAIw6lnwYa4R94A67WRkoZZ8pFd+ZP1W/46jXdVePl4xnk7FwfjZitl0l3GX+Un7 kxUHjQfN++37KwxiXLtAEzdNc/DoUlHpQIzCji5tOITfT5nHX3RvibBoy+HXHnrocJfwc/nE F5/LJ2j4889p5JpXH3zw8OEHN/+GznpP/ooa3nuP6mX2RUiBDIdNfAts4jhw/ue26bB7w4AY bF8PbN8wIAbb1wPuYd+giICr3BiFAbTCKECFuo9QmwGd+BCZJvhejURUVET0RIWabzH/4+HX jocMmI3rbFyfhB+yA3SzH9cDuKqhj/J4phHPVEPS6YEnJguZFEzjV4PIMWuPaZcg5IUF7czL nkzq2F4pZv1yW5eRBIvFMSz1IITC3a7izjxGLODa/50zizQCVwyRgmjsHOwu+CoajWTk0fFE zUizeWRNIo4ASfuTF71BdWfI65fvaaX16/fsveOO3c+eIdj45A/DxpV0jOks1nmjRslfHT0s jx8lPLv+9ud2r7tjN8P5JOD8bu6H1JITiE3twth/gdE/AUwwj/MF5Pcir4TkdWIOcFYQGBdh mTBrjX0p7SOUw8C2B9z1ETjvW+hPEfhXEQ/wXweZWwZgvm0ZQMAvmPBkE5eBSVgzLBqFOcIM 1GJWcniuByWm01kMjFk8LGKQBJ4jwDiTA2Z4uMA3k50M4UyRcyb8XzDOGrEoM+CwCDUypyNc iiIMdDIG2cN9u9cjPrX+zmeFa4buWXxYPkP1v7tw+yiX98F4NDfCzGJUcXlUJhKP0tdvf+a5 dbc/t6fvGXr3qPHy4T9Q/ahR86wWrLr6v/8acxD2Ix6I96f4ph32GEHWpcgtbRlQUxwU5+aS DrqW0S1GymIxjGYZDffT90ZgYjtgH4B9SYzRKaNSC+ZHX6LTIm1aQJ3lqEszu7gLSOJrVaXd wjB/eEyvKLiykXO09NldJWzNrl9c9fvCKkGiE5hFfPrqWDyReqZ9XjYW73a5L/rDtTOvaAjY l6Ym/fIy7PnsN4mZdWi17Lp2+ZimSNOQK6/D2PfgWxF2jL1AZ7c9gK1mediIRsxvHnNqxHeL WvC9okqAC+DG1wnNZB1o5VbI8p+iz8Nov5/bAC5c3WQr2h9C+0a0b0L7JlDnQ6CVX6LfE+j3 BJ7zBPrt5LxeAexlQX/VoOoWUHUlwAVwgx6TiEJUAbM54D4ICKAlDerEvgFogXI824T3Y9rD weVBOeanEd9aiuCLTXFQdYQW0P8j3OHArA1F2zvkKswNZAda2mCT1uIXKiBlWOyiHM9V45n4 Jgt/rhWzuRDfgQzAsw4QbAFCnwB4J4NaAh3XxqxYbODj7k1p9wVWHfq6eno6WIis37vmfABi b+BxyAEL1yXLFFKnuBvjnG2qLET5wycduD++JxBJOAwVye3zL7/pkhsbjrz39q8nPiaVD8UH RPwhb9pnqbtu8oXXrHz1rZeP7Wu68/JQ3oj9AHvS0cagsb5t2qjRrXfddut9qVg+v6IuUxMy 5VIXFIbVS4rbNtz2uNVptzN7nSJm2StdLB0ERh5ra4YnXkGWA24FbARsByggC+zAlBeggzzI QMancS+zuk6hxYe6TtREeVQNrEPxBQFgPocaP+Q50xXMxhWRN+Ju7KjGnx71FICzKB1wB9hx u6IOx7JGd19HKxyGYpSoJFeYvC4Fi4xcihSFdzFygSAvDK5+w4qfy2eMI16bq0om5cU/umS2 7HXHci0XPzxyxaMxi3FXMlr7o2WRWDooLgjCZ5T3bL/08rgnkLPHwuPHheYu8NFJQL73aF0q kZ/5e4anMfgC1DX4hliOPNXG6JFJRxGUnwPtMKuXfaepEjUszhOFxiOgZB3kRhCYMENKV2LM VaDwCHIW4EcP2v7Bdq1GPQE+WRyJ2aV2cKMJsU0mcZmei0C75SFt2c7oVqyRcqQw2dGPM7b+ AjQyOiy2wSwtRWHP4uWHCETRQi0GfQY206WXX7N067pYKJp8N+qrziHGhjjE3HUTnnzS2p6P JR4MueiyHy+/41L6cCAUDQcKp6f4I8zvaR/X8Oxz9DdMy7mzeGNKEmc+kB4DvqLkZ20xyAQ9 fM4IeJRFGZUlyvByuwG2I5e3SmArBGzFcH8UmPADr2zpUgVMicAZk9Hsy5gx+D34zz3J0po/ Bg2FzhxIE9HDPWROOxPjI/ljfLwuiukYiVo8fPCaJ77lwHi1KINT9N8tkzMzYNtweOLU0RTN j4hQiQZaJ9ZHm2hdPJ4bbpIPOHOZVMYpck3vi2GHwCrhNhxH8rEY1+lYQ8DfiJ+mZ3qAl7eB l2ZyrG0YNLUKc8xsW4JvqEIlYYwh0Iwbo2V+eAskFkVfFn31AWqgp53AgRoYS2NYEvwaCThr QQ+2Ou5Cb7Ze1Yz7WCwsjDsqoL+b8fQEuQRcTpEzI6clbL0dC+5sDQ8shxMebPPEa9DfxT2Q QGUICGNvE8a1Bn+1xIUcs/gqcVWz31RwJ7yYzmQeePEbSbFzV9LBpSl8bZBHwbAM3y8IiwhX lW4R5t5cFo+H44a/apKRWJSW10dtRmOVv/npm8vjsXDCcOOTjtTIbLiWan2+cP7jilgsnNTR PjmClfS8cDyAjci+mCMkKaTTT9F9WHfPyXOFGQiIebGK4BdOm1kVIzZE9iR8d5GMoCvh09YD X/UgmRW4Xgt9cBtgHTzR20B9t6KO7bF8AKPfibp9uGqBkQAsBfa1tQAwOwJaM4C9/wF8MXAE eDaILwuOwBNGQAuOAE/HkbKeBswUwQwEMZNYycUMJogDM9iGZ+pQw+xnNtN6SMkc6vzoORy1 asxxOQh6KeTHYmi1pSi7kVpRknAtoHw+YC5ABJSTdrBHB/b/Gj5lOwOKe81LJwT6J7cagx9J sIUPP6IHBJBj/DIcPx7ENYc//EOOHf0L8jZ2x3AAezXsJUCO3eUHGPl9/W01jL9AFwjNlJJi pIaVZvJNdYO2p5/luP7NtdTeUBTmA3iyKO9LpIMzhHS9J9+Yq5N7vPH6Fgttl3+ja66qGXO0 PtdQq37/qLWxPltPJV8s3+CWP6YXlkWT2fFH6vLZZGPfhkgwHIx7I0Ecq6zzccc4GH7nnUAo For5cLbqXXlXBO3BcCD6DaOXJtjnG0AvGfJiWx7I8MOW9pOFgEV8VlkMLQskMBuxEzOYwWx7 S3MMuxJzzDygLBDJvviXQa/iN/3U4GELpOIluEqYNxfPwQfG/CFaZihO3tl9TWwPe2k/DJsq hnj2PCbw2ESwVQfCa30o4VxOcXMHnwR1CfODPB5zMVY2AMv9OpSrWpXgSo2tRbyrJhOJxY4/ Lt/LJaC9kUtAPbXERtZGm75NxNKNZwjsTG5d02HCm0wPcBl4XIhhYzdkIPgPLwdcvg7e0wKX MSq0zUdkh8D2jEHbxcA9FrIQ5VW4roKMWgUNuA75dcgz+/Mh5B9CntmaO5Evrs+ZgHELwAww IYfDAvCBYpCsZkjKGPjGDD6LAbNmzAzzW2LoxaKancCeAjPhxOwpgDsn5gB5zBabRQX4vAK9 LZhLppGUkKVsVSKAMeSQV4P/YKqAE+OYrR52HJtbgNhMju+qwEiEduY7yRkP4TFImdlDmKhk O22ybHNpZOARuP44ZKC47NX/dSGUVHQD/Rr4DdYOP/1EY7OzWmiVsQstHB4xRrCPGl1VtaF2 GiJCO6pi1WlXtlpoqZkOn2hXIoZT1GOZoMIp4ISsFh5XZkCVpoIKG0joMnw9iH+BiG0iqTGG hMSqVcrMt8cxvlsEIo0TemCFuApa0xHsTTxi1Tv4qXP+7cKuPljCWTPbxiEVTVn+yuHixuJb 9iwcQR3DR9xldDj3LhghfzGi/W69wymMa7x82lifF+k4P3snfOMa+9Y3wIZkcZAQKbTZwAH4 xjiNAstWzCJbkdXCxzDhq+rMLsLBeJ67H/Z9GNoLEu7kp5iEk604F5XPNvB9JUXsDfym0sD8 kAuami+4oLllstg4BbkpLc2T5QVTm5qnTG5pvmBpsYllWZfJLU1T+ZX56Pwf9uCsLOYGpWyt iH0NGqspsFH+ry98sp1rTIOylRSmnwd/zxP7jyEpchCwTN8O/IZnK2R/AYL233+58zzogMnQ bBfAv/8RNNJ0rETPxHeFZyPq2YFo5zxEFNg/CmxSnlMyeTVy3PTJk2emRly54urLFl5damHd zgdgLytdArgBgKVkug3wNOAQ4AjgBKAH0AcEaQFuQBrQCpgAmANYArgBcCdgG+BpwCHAEcAJ QA+gD8jTAtyANKAVMAEwB7AEcAPgTsA2wNOAQ4AjgBOAHkAfkykANyANaAVMAMwBLAHcALgT sA3wNOAQ4AjgBKAH0Ae21ALcgDSgFTABMAewBHAD4E7ANsDTgEOAI4ATgB5AH8SDFuAGpAGt gAmAOWdK/xi+z+YpZv7ccnBQOTSozIzZgfczeTSwHB9UZrtRBrYzC3NgmYuEAe+Ddz6nHWss 55SrB5WZnhn4PGbxDyxz02HA8/OD2msGlfn29QH96wa1Mwtt4PMbBpWZZT2wvWlQuXlQmX2z d2D/wqBy26Dy8EHlEYPK7YPK3M0YMJ5Rg9pHDyrjvOE57zN2UHn8oDJo65z+EweVJw0qnzeo DN4+5/7Jg8pMmg3ED/NBB5anDiqziODA9mmDytMHlZm3M7D/7EHljkHliwaV5w0qXzyoPH9Q ecGgMrMyBv7+okHlSwaV2anEgf2ZpzawfPmg8uJB5SWDyog9nnP/FYPKVw4qXzWovGxQ+epB 5WsGlZcPKjNPZ+D7c502gF6vHdR+3aDyqkHl6weVbxhU/vG5ZT+XZ/8fDSKGbwplbmRzdHJl YW0KZW5kb2JqCjEwNiAwIG9iagoxODQwNAplbmRvYmoKMjMgMCBvYmoKPDwgL1R5cGUgL0Zv bnQgL1N1YnR5cGUgL1RydWVUeXBlIC9CYXNlRm9udCAvTUNESERUK1RpbWVzTmV3Um9tYW5Q U01UIC9Gb250RGVzY3JpcHRvcgoxMDcgMCBSIC9FbmNvZGluZyAvTWFjUm9tYW5FbmNvZGlu ZyAvRmlyc3RDaGFyIDMyIC9MYXN0Q2hhciAyMTMgL1dpZHRocyBbCjI1MCAzMzMgMCA1MDAg MCAwIDAgMCAzMzMgMzMzIDAgMCAyNTAgMzMzIDI1MCAyNzggNTAwIDUwMCA1MDAgNTAwIDUw MCA1MDAKMCAwIDAgMCAyNzggMCAwIDU2NCAwIDQ0NCAwIDcyMiA2NjcgNjY3IDcyMiA2MTEg NTU2IDcyMiA3MjIgMzMzIDAgNzIyIDYxMQo4ODkgNzIyIDcyMiA1NTYgNzIyIDY2NyA1NTYg NjExIDcyMiAwIDk0NCAwIDAgMCAwIDAgMCAwIDAgMCA0NDQgNTAwIDQ0NCA1MDAKNDQ0IDMz MyA1MDAgNTAwIDI3OCAyNzggNTAwIDI3OCA3NzggNTAwIDUwMCA1MDAgNTAwIDMzMyAzODkg Mjc4IDUwMCA1MDAgNzIyCjUwMCA1MDAgNDQ0IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAg MCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAKMCAwIDAgMCAwIDAgMCAwIDAg MCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAg MAowIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDQ0NCA0NDQgMCAzMzMg XSA+PgplbmRvYmoKMTA3IDAgb2JqCjw8IC9UeXBlIC9Gb250RGVzY3JpcHRvciAvRm9udE5h bWUgL01DREhEVCtUaW1lc05ld1JvbWFuUFNNVCAvRmxhZ3MgMzIgL0ZvbnRCQm94ClstNTY4 IC0zMDcgMjAwMCAxMDA2XSAvSXRhbGljQW5nbGUgMCAvQXNjZW50IDg5MSAvRGVzY2VudCAt MjE2IC9DYXBIZWlnaHQKNjYyIC9TdGVtViA5NCAvTGVhZGluZyA0MiAvWEhlaWdodCA0NDcg L1N0ZW1IIDM2IC9BdmdXaWR0aCA0MDEgL01heFdpZHRoIDIwMDAKL0ZvbnRGaWxlMiAxMDgg MCBSID4+CmVuZG9iagoxMDggMCBvYmoKPDwgL0xlbmd0aCAxMDkgMCBSIC9MZW5ndGgxIDQ2 MDYwIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4AdS8eXxU1d0/fs65d/btzkyS 2fclk0ySmSSTQEIgN0DYAhJlSygpYUdFScKiqJS4IlEL7msBa1FUrEMiGMAq+qh91PqIT61V u0BbtFqlpZZarWTm+z53gkv7/J7v6/f6/fWbO2c/995zz/mcz37v+r4NK4iR9BOByMsuWdJD lF/gPwmhu5dtXB8slKXdhGjeW9mz6pJC2XkVIerqVWs2rSyUQ58Tcqtz9YolywtlchZp/WpU FMo0gzS6+pL1lxfK/iyu71yzdtloe2g16r9/yZLLR+9Pfo1y8NIll6wo9B86irSiZ+269aNl CWm2p2/FaH/aQYil9dtlM26BXlPIp6SJ/IBoCCMSSZH5GHlM/JioUObtKuPrC5x3pBdbmv6u dWmVy//wD74XeOal/Z/t+HL9yM0S0eJiRKf05w04TxPKtZIFEvly/T+PYzD8St/8TTlE5gqf DAnlgeaWYuEk6RY+IruE98lxBJFIqJGQa0boQT6PoMofFX431NpaIw8jTVYp6WCirOYQbxh0 e2t+IvyO7SOlJICK44MlHqXlt4MTJ45m6scWMkPllTXHW/TCb8lfEJjwW+E4SRTOGkpU1Zxu MaGCCt8jFkpJgOwWfkOyCIzIwntD0XjNrueEn6H9VeEVslw57ZVBk7UGF/yp8DSxkYBwUDgw 2nJgyGytIS3rhFswA0cRH0M4gXAaQSRrhUfIFoTtCE8iiMSCOICQQpjNa4THhccxzj0434I4 hbAWYTuCiCl8DPUX81jYK1xEwjj3ZuEOUoz0JuF2Jf0RUjfKP0S9H+mDKPN012j5fqS8/b7R +ntRLkH5ntH0btR7UL4LZZ7eOVreKGxQzls/mu4W1g36A1KLH+1BhDSCgNwdyN2BqbsDJYKY CtcKa5QR7EdagyteUkixapsHQxFljTYPOVw1uzGlmzH1mzFzmzFzm4mIPled63NVoU+lcBX6 XIU+V6HPVZiVtLAO91uHBSOIJYQggoB5X4d55/VZxEcRjiEI5DrEOxB285JwGeaxDKPaJlw0 mAgA2FYNNcg1zUeElZhqWVg55PLVbP+6pNNzQFw5pDOPphbed4XSd8WQzshrVwy5fYUUvS5u MQvLyJUIjBQhjiJkECYjiMKywWgqcFg4j1yiJbI5sIVtEbaIW1RiejK1PSfUkHbswACxCZWk CR3KAoub6JhuXY+uXydIuqAurZN17TrVWmGLsF0QAkJKaBZmC4sF1XD+6KCmsRaJPFXdWLvD sNuQNRw1HDOosuqj6mPqE+rTalVQnVbL6nZ1t7pH3a/eod6t1u1Q79CwbkOPod8gSIagIW2Q De0GVUBDd7dcLyzFYxLEEkIPwg4EEXO8GPVB4bsIi7EaizFt30U9QUxQkhCOIX8CqQolC/pZ 0M+CWgtqLagliHlLO0I3Qg8Cb1V/1XLuHN7/NG9BKEWrGVcyE4brmFGPHMIMlEwomVAyodcx dhYjlBAHEdoRBKXuBHKAGsTn2tKj7d1I1YS3n0Zgynm8TUYQ2Fl5SenRMpoto7vL6I4yKjc1 t9TIYUQ2m21xZHFscWLxHnFtZG1sbWLtHnF2ZHZsdmL2HrE50hxrTjTvEVORVCyVSO0RA5FA LJAI7BG3z3xy5nMz35gpLp65duaWmcIYLN3QYDJdo6ThGE8PDLrcNWMsLePYk3icxYh3IRxH EEgAcQqhGWEtgsieRBxgT6D2CdQ+QWYjLEZQ4YwncL4FMW/nbbx+F4JKyR1Hjn2rHcSQ7Rts rJ3dMgModzHCLgQB196H8/cpvQu5J5X6LOITSv1sxLz/bgQ+yn1fnSMAwS3k40AcQGhGWIzQ g6AibwgLQBwW8CsjDiD0IDyJIAoLcSwQFrAncOxj+4QK2VRdHCAlJaA4NqtWapGYETBgonuV +B4l3qbEzUoclc0zTJ/NMD07w3TDDFMpMixBWnDCHUockg0tpqdaTLNbTGUtJlzNQULExIqV WM1j+rESn6fEFXJRyPRFyPS3kOmvIdMPQqbekGl8iJ/nxd41sSIlNvCY3qXEM5Q4LhsCppcD pgUB05iAqcVEd1KMgUxUYr8Se3hMP33KMtlCdEfop2QyrkcHm8oCw4woCc0PNrUEhmlusGkq kpHBpp1I/jnYdHvgGfoFVUga/WwwejLQUkzP0OkiSBz922j6VzqdPI7yaaSrkD5MmmgM6Y8G m67m/R/C+feh/EMS1vLzHiTtyvm76HSl/gej5z0wWLEUd71/sGIT7nofqaC8992DFSdRe/tg xTYktw1WrEGyfTDGB3jRYFN5oMVKV5Eo432XkRjjI5k5esdpuPIalKcWTm4drOBnTeY3GKaT BiPVSEr5KJ+hEdKu3C4wGFEe0kciyuC8JKIM2kNiSmqmFmXwJhJWUu1g5GpcRf1U7GTgH01H +IOTv1PL4M7AH57B881H8fd0+uDjgTcP8ekaDLxRMUxjBwP/FTkSeCk6TOcPBo5WDGvR8FzF MKMHAvsxyVn0ZfRg4MmKVYEnIkrrnghasdS7mioD90cWBu6NoTwYuLriGT4McgmeeD6aOysm BGY2PR6YEhumaJabcDNZH2iM9AUaUD12mE4fejxQHR3mQ0njGo8fDJTjjvGIMpR5Yw6zOqKh G+QKzXrNUs18zfmacZpaTaUmqPFpvJoirU0rac1ao1av1WrVWlHLtERbNJw/ISc5u1akVrg2 NdA2JaKSl4AaKTagws0xqmXYO1m70Mba5kykWVsbaZs7MTsm2TasyV+QHZtsy2rbv9Oxn9Lv d6KUZTcOUzK3Y5jmedX1nqxtUschQmnq+ls8PL3q+ls6O2lb9ugy0rY0mP1sDp5Df/7CrCoy 0UlKNjY7m20TrA1TJv8PUbdS2T05+fXP+XUWOacve1fbnI7sY77ObA3P5H2dbdmpc4KLOg6x Xra2dfIh1sOTzo5D9ArW23oBr6dXTO78qhsJsx50I0084d2GSJh3I2E6pHSbqVwNYBpunbw/ jIh3eoFO550APi8onVYpnQDjvfxa7TxBN+YnUeVaUebn3QAPhYtZvnkxI6EW5WIWI1Eu5uWd 9sdiuF8Fos6O/WNi6LA/NkZpfvzr5ojSfIh2Et7hEInRTuU+VLlP4RKJQh9AwWgfpkWfb03j /9fCion/L65Ah5b8evmy1hWR1u5I6wqE7uxNG1c7s/1Lg8H9y3/NG4JZId69dNlqni5Zkf11 ZMXk7PLI5OD+Jcp5/9K8jDcviUzeT5a1zu3Yv0xeMXlwibykNbJkcufQw1smtX3rXtu+utek Lf/Dvbbwi03i93pYOe9f7tXGmx/m92rj92rj93pYfli5V9sFE2lbe8d+LZnYOQkLyNMhZtBj P3R7Qp0TS6SeCcrmGBdyfs9zWCQgW4ZkZ9YYmZg1IfB9U9lS2cKbsDt5kxnVltEm5/fGhTyH 6d7RJgnV1shEkiTO1gsnf/Vft27deh42bEgiXr+BNyKDTRua05adcv7CjmxTtqk1K3dP7qR8 1TaM/iZ1yNJzTW80sbVNW5q2N+1qerJJtWFDJ6ptz4XfCLPF4bXhLeHt4V3hJ8Nq3rCo46Dc tCv8l7CwAdBE1+PXym+FWyPFnxfXb8Bg1q0juMk6hMLtkhuSkzpawmQZuF0KzryS2BEiCLUI cxBU5D8Q/xzhDwh/QxDJtYhvR3gIYYjXCJVCZavzwsn8jp244iHiFGqG0nU1Y4eRLllZSOcs LKSt5xXSppYaJ9oHm2v1LRYw3pQcRvwqwnsIf0L4J4JKqBFqlItjzPzXuY6sS1LMFkFhPY/W JdfTJDKUT/f6dckkOvAyKlDC3CrTi/Loj9B1GwimAguCBJ2U+nX8NNwD547+eANQser7CDNJ AMEL6cpDSP53CCcRPszNyJ9VXUwiuYvyJwQ7Oj8xGgiJkbvILhIlp2k1eYEcBSZ/GKxOO7mD TCVvkCeJmWyir2E2I+Aw9gJfBID3pxAHVZF7ybtkEekj75MTkJrbyG+pDddpJT2QGhvyHyFu IzfmD6GXnkwiPyaH6Ro6B3qFSWQaq8BMxMj2/FHiIIn86/l3UPoBeZ9G8/vJNOQ+IFZw51vI rRCjLyKv5rmWJEqWkkfoVfQj8Fbd5CYxIw7kLybjyAHyC9qG3CyySfWO7gC4g1vJQ9RBj+aP 5/9IngUtXYErXUNuxIgHyVFWJUxS7SZBEifjyXlkCVqvJO9SO60W5HxpfmL+XtQ+Qj5lSfay oME4kmQ6WUxuIQ9iNt4mJ8EKGGgd/QF9HMeb9M+qdzC2NrKBXEH6MfKHce4+cohW02rmAH/I 8IRlZB7atpM9uP8QOUbbaCc9Sp8X9qjSueZ8Ub44/8d8npSTDoxwF3ke9zhD0+iDOwhhYb3o F9erakauxhMuJw+QY+RNjOO3mPe/k89pOY7fse+xLfkF+b359zEWLXiHseR8spCsJRvJZeSH WNUXyIvkr/RLpkPPN8SXVFeoTudvw9zGyUSMfTZ6z8G1b8IqDZJhHG/jKa00iKcYS8+jF9BV dDu9iw7Td+m7TM1CIJV/ErLCa8KvxXqVKt+IK5VwSR5QsoCsxgp8D7N9G553L3mJvEKLaZxW 4onexvmfsXFsMo6H2Bvst8L1wnbxrOqG3Incx7kv8wPQPU0G3HVgNh/DLPyFlmAMZfQiuo7+ ASPfwZ4SzIIkRIQ6oUWYK3QKNwp3CP8p/JfYJz4uvqearlqielyzJHdp7s18W/46zAWFrOYH JFWQDBkD+FkJaLoY4+vB0UeuIleTAfJ9wMttZDf43WHyHHmF/IL8hnyCFSA0hDFfiLtfAqi7 nn4fx710H32evkRfob+jn/GDhXEkWD1rZpPYFLaKXY/jDnaMvc0+FLzCMsjf/Th2QhX0LrC0 KOZVNTimqW5SPaJ+TZPQTNMs1f7s7KmR8pHOkd/mSM6d+07urtzzuT/m5+c3YfwxUkmqMNKt GOW9gME9OB4DJB4kL5OfkV8qY/2UMqoCxDtpBNBQgVVrplPBakyns+j5OObhWEAX4lhCl9LV OLbQfnoNvZZeR2+hdyrHPXi2PfRRehDH0/Qwjl/Q4/QD+if6KQMQMwHQHGOlLMUa8KST2FQ2 m12AYxVbi6OH9bGNWKFH2BA7xN4W7EIM2HaJ0CvcK/xYeEF4S/hCZGKFmBKbxPniKvFa8Q3x TfEd8UtVQNWqWq3aqXpB7VFn1PPUF6nvUT+p/lB9VqPWtINdvUrzliavjQFj/RTPfQBr+vUv pX6DrlMViZez49gXTqFHtZXOw4yp2VxhjfB94b9VK+lpIUjfowPChcLF+YeEKexzYS2dz56j YSGgaoQq52aSp4+z37Ez7I9iMZ3LPqIJ8Vb6NFsrTGLQMQCn/lwsFq9VfQhtwC9JI9tMj7KX oLm6Nv8T0qjaSY+rdrI3SVA8wezkOHb1VnY3TvovdiG7iXSIGdWX5ELM+6OqyzHfE9iNtFx4 S9xJ3hci7G+Qru4C1nidzhCj7LusgT4OjDtC/eQU7SU99E4i0yP0N3QYPPFe4RE6kxmxWllm omOgbHldCNG3BD3p5GOkcVZM29lpNk94Rn1MqIPYc4z8N7mCCjQN2Dn3y5FLsQPuYKXAaa3A Jj+nNcRJ7ga+P5N7hmNs1TuqmwBnDwoV5AKSJl3sNdKIvfE+jg5yA3R0hwGDN5I0u4dcle+n y4H3ZwF/MgK5jaSoAdjSgbFtAb0oYWHgwsW49efA/68C67fRP5PLaBA76yhJiLzlZrEVmKkb +PcmHMtJF0oPkNvUB1Q/J7OpgxAxmNsJKP81+S5ozh9wfzc01LcCsz0oVmDUQWDmXpzxQG4a kXHcQF6jjGzGmCdgn7eL04B578pfhCe8EDRqJmjiK+TC/N1kEtbugvy1+ZvI4vyD+UWQcOfk 9wL/bswPknqyVdXJ5quSYgY49hX6IujRr+hNwNvTyHvARzHqJH/C8WOMf4LqCBkQfwnc2Zy/ Of8LaFkT0LzeCzwzA9jrEvJnzNs04SipzZ3H9uenCD2gUMfJ+flH8gGqJ6vza4B5nyF7NCrg nn7iV+0B7N4krmRpjLeMlNAUahepdhEiT5w3V26eML5pXGPD2DH1dZnamup0qqqyIlleliiN x6KRcCgY8Pu8HrfL6SgpstusksVsMhr0Oq1GrRIFiNIVrZEp3cFsvDsrxiPTplXycmQJKpZ8 o6I7G0TVlG/3yQb5eUvQ9K2eMnqu/JeecqGn/FVPKgWbSFNlRbA1Esy+PjkSHKYLz+9A/pbJ kc5g9pSSn6Xkdyh5E/KhEE4ItjpXTw5maXewNTtl4+qB1u7JlRV0v0E/KTJphb6yguzXG5A1 IJd1RHr2U8cEqmSYo7VxPyNaEx4x645Mbs26IjgVlxFirUuWZ9vP72id7AmFOisrsnTSssjS LOFcc1LpQiYpt8mqJ2U1ym2CF2bxNOSm4P6KowM3D0tkaXfSuDyyfMmijqywBNdozVqTuO/k rOOKk86vi7g4+POt32z1CAPgEIO888DA1mB29/kd3zjXE+JX6OzENbIsNqV7YApufDPWqY2L b1l2fWdHll6PG0LCiCnPVHi6gvgT674omNVFJkZWD1zUjYVxD2TJBZtCg263fCh/grhbgwNz OyKhbLMn0rlksnd/ERm4YNOQSw66vt1SWbFfshamdb/ZMpoxmr6ZWYEpL7QpOaU7z7Vd8NW8 Uj7GyHQIDdngsiBG0hHBM43l0YqxZGDZWEw/fp0UZ2WXYz0uzOomdQ9IjaiX8Ig0q4pJkeDA 3wnWP3Lqk2/XLBmtUcekvxPeyKHkK0DLgsiNAl02mcyWl3MA0UzCimKME5RyXWXFxmGWjfRI QSSQHkk75nZJZ2MKkx8K8eW9aVgmS1HI9p/fUSgHyVLPIJFTkLJYN285eq6leB5v6T/X8tXp 3RHA8VOg4YQUZ7Xxr/4WqcTeuroxS0v+l+YVhfa2OZE2yGDB1oHuUZhtm/utUqGdTyjmDW2j OVo4EROeFWNZdWx6BKB3AYQ5VOCvik2JtF7YPQ1bDWPM2id1CB6GC/Ac8wjKpQC/ixaeux4v dBj5tcSYWoH/5cMaLQBYqaHBKVmpe1oh7tSHQqPb6/920nD+ND9LSb4+bfSZs43J0acqPGN2 3LfK3xqecUBomwvsxNrmLhwY0H+rbQrw3sDAlEhwykD3wJLhfP/SSFCKDBwSOoSOgZ5WYKzC 8g/nD9/kyU65uROPspo2AsgZmbg/Qm88f79Mb5yzsOMQlF/BG+d2DDLKJnVP7NwfRVvHoSDw s1LLeC2v5F2CvACah10xyLRKf88hmZB+pVVUKpTyMmjDlLpCJ9RRsgxKXKVOOtePoU4s1MlK XSd+HFNMmtsxOl/KymPGOCQQ2G4bqJer6Bg4aRFyHtK5CFWouxTpHKS3sgYioG0GwmmECoQ5 CEGEpWjLiteSmHALaNBPiaSaT8IIM5CPiH8g5eI6EkJ+Gi/jerVIw6gv0/jQ76f593kb+iCP PvNxzjrSj/YJKBs0txAPrjtdJPkvkU7B/SYjnYnrzEZ+PIIJ929iDfllyFuRH69uIFbkjQit OO8LpJPR3yT4yHK0F6HMEKy4vgmpB8GIa5YhTOIBfZ/nKaYErD1itBM1vQ1pENJRQZ8pKPU8 EqFT4D81ZBItLNp6YkB/E+Rhi1LPI8ADflYEG4KdFIEDKIG85yQucCqQwImX+BS5KAiZNQzp KAoKH0c97FP/9kuA5peDM6tQOP4U+K9qcDy1kFzqwJWMgUzXAM5mHDig8eBvmokMDuj/X7+J yuxP/l8G3aq0jcNT3gMZ5XnG2PmQKh5jfxCuEv4svq16SX2epkizSPOEdoXuUcM4w+fG/ab7 zH2WtdLNVp/tHfuyoluLf1zS5GhwjLhmuV/1bPBu8i8PLgldGx6MeuKG0lll9yarK26ufCL1 +/Sx2rrMR/WBMdePHWx4tali/IIJj8ryxN7Jz07xTfVM3Tl1/zQ27WaMh1EvpAAvwEEALMza z+gR9iyHC/bcIFGJw+zZpwSi1/DMAUpcWrXqObQzItAyoqMX0+8SZ1L6rGmk6TzpTNOskSbS jLx0FlF1OmQNWWOIqFckZ4PC0bOyinyJ/XcU55/Mn6QvQ2tjBDytPgLwdREdrLa6+rEZIsst GS234Rb5Qxm9+3Pzqnoil9dlHiFPY7zDwvSnTRrBJNsNyNfJJkL0oiSXZPSy+LlL+uzUmVNW W0PqFGk+1Sx9UJ2mvVyVRJJ0ymQaEeJ1mframpLiIo3AY3UkzGvo6niHelIq1SJeWtXSUoVA Vwnlde7mmTPbnMmz6ZZKXl0JkGQklj8p/Aojh5cA/a68SKvS2Jwqh020mR1qq0UjmR1+k1Nt NWokpymg96itBo3k0at0RG3V6ohGcpmcrNguFDnMJQ4zK/YJRU6TmxV79F6PXiiiRMeKRaGI 6PQez7BQKuuIrghOJ2aHg5dwzSKn01RcUuJyud2UMl7pEIrsdp/P6xVF4WmN1Wbz+wMBlUrN 2yo1ksViNBoMWvDKZpNJr9cRh9Pp8RC9ZLUWFRU3m7c6njBt7Xb2OJlzmJlkh36rR7fVwy2k GjXMzaAHi4IdP+LL3NvUJDVJZ06dlE5+1nVy5MwZXuRLzpNvxrwsAQ7OHYWO/1K7VVWV3Cy9 uLXKyRPLv/ywcF0Oe6Su1h6qC9lrBR5qiyMIISFiDwn2kD20ruvxI615Qu3fmfMdev6SOYsf OzQlnzvddf53ck8svpTOmZZ73Et/egFd0E5/mmvgoT336AWFHHPRBcCLc3Mz2FXQLtpJoxy5 y/qIld1g3GZl+nt0VuxSO1CpXrfXHG5XU3V/0dzv8lnoOjXC54HD16lqyJG0ixbHS+OsTiJj itVqVlzk8DN21d0rdjxAaz67cud5IfeMzbm1sZkrb6UDb9F6mr+0fPInubteevvJgUfuwxiq MIb5yhga5GiZWK6dphJwcysGYYd4rNNjAAWnBUHdX1xYim8PgnbZ60ocJbZiiWjq6uttdZnS KlZ1z4rtD+Te+MeVu2aFXG1XqZaXt628LXfZL3Kv5uilsdaP6cUv/SI78DAfwaW5x+k95D+B 3efIpZ2s0/FiiaBzdLuOuQQdJRpRtGht5KBNNhrERktxoLi/WCgepuWw31kWW5jF5XwA8AEM 0DVrpItvvJO2Bmq1ORr4ItJeO4aEEcUjYc3oflN2oPrSVb06jcYQsxVVN7bVT1y1Pfd4RXh7 u92kK9I11lZPWbd41X5Oz+bQftYBbaNAmuUgU/X7ltdvUUELwD1cBMIk2g4OeQfdTY9RNdR4 mQOgxXMX8qUa6eILlTqFmA8laQ8Vh+Yw1ciXzAFFBiW3AguthVxuIEnZS2S1QZB1cmOdTm6u W6yju3RP6pjueuNFVyjA35dM8merTse+iTlISlYQxgtKXJWS+XWF/Ek2ASsqkAuwgVWvBYDB KLBVqWxiQhFjGDYwmQGahYBcFBTSQrfQI+wWTghq4Qh9gr0mDtO1+4/zu546wycUm2t0t1Sn kxSKMDYhV9xOP1Z9/5/zVY9xrDQj/6HwtGo1qHaUHB5cooUoqh5UqbBK6kGTyT1MLbJN5yZx Oc7keHd8d/xEXIxbebV5MVSpW6DA3Q2mwBU7TP2Y2tHVPHWe1NX72Sz+2PzBJ22SZ9JoJBqO Qk8K9QtTa2Jej8/j9whqe9wSM8SdLoeLqUOidSkJqN1LaZEZuRIjclEaXEo9WkQ2qXgpcekR ccSs2AXKkSlPlpdfbc/YxgA/O0qsRQywUhofIzlKamvqx9RbAUAFEGIzbl6/sPuBq+6/8edL X7j6khdbG3rr1/ur0tGGssbJddMybOeHdPYFLbteyj35Se7gne8//4/ch/vvXNK3jzZ8eP+6 dGj8nNwDWKPTIHlqzFgJuVsukp3dzt3OE06ROGUn2whlCzO32KEfbQGV2w3uRlDyWuQjWODP 4TR3IXQYIAj0UxkmdguUz1Sl0xqZAFPAP9B9umwzmy2ytS5t2WLZYdltES0ux2EWpSdHJzfZ NEsCJuXos7kJFItaG8jfT52lf08mFazS22WP1VqLSkocxaG6CayOTwDfQqfpjJC9aVGOdY8t 0Wti7thE8acPfrm1b6yfxWLMV30F+/Ud5UF/gMNhBZ7xcTyjn66Wr9E4DQ0Op3d8xikjcvHI 4i8pKdM0aaZrHtWo5eB3xIXa7zgWOi/Wrreutz1g+IH5Xus+wz7zK6pXHP/pfNfxrvNE8Avx C0dxMfWJLpWn2FXicvicGp3D4DT4Mq6prm2O7UGN08WYw+0yutQmwcVUaihtQG/tomkYw9Dp 5CJjc7+O6oaFWtkoqdzbXXSX60kXcx0WajFxtwxRZvQP01tA2dW/n21fbF9r32IX7cNUI9tl PJSbBOVgf1DoDu4OsqDrCP0C+8xEZbloMZS1W9h29hzU78fZXyCZuAKHodj+Cp5PNhUgumsW tpXEN9apka7epuaR3v1qLmw8vV1Hn9O9oWOkq7czeZKjMGVlbA0NTCp0eWqz6xYX2jvNTVsl 1eYXzS9yFqOvC3SgwGYIoTpC6jJYKrUmUj/KbKg1TBOqqa8fIzy++OwJCPHBnZcu3xWPud64 f89v0jMe/mICXbpmwRQ3VeW+jNGJ9J5Hr354Q++hl9/asWrVDw/kTo+Vqrl1cA52+XysZw2d eYjo8ycGjQ06zig1GRtadK36KYa2sPiGjpaVjS2TM92ZNzInMv/Qa0iGtui2RK6oeix6KHq4 6pWq45HjsV9V/Sn8Ucw4XVs2TG8eSiQkMsxODh1L0/SwkDkgqKQSWjJMdx3wyclUxgfvkyHJ VJY4QldDENCxP8A/DmvAdihrgJUcyhqpcZjuQH1lfyXbUbm7klWi/sBizRY8+zB7X9bLGbo7 czTDMsB7E56W7c/Zmd1VyxHOh+cQzkmOb7pOdfVifbp6T4KnBOpJnuprPtV1ijN1Cg6qr0r5 43qLqA6HIqFoKBYS1aqYOR7XA7mkxMql1G9BLmQoXUr1uip1eikNmHwc20hNo2bI8qvxw4r1 dvURsId2vkwKkJZwSFWHFKaQV4GoAvtw4sU3X4TvQ76ymtWN+697aMHEw5v7e27LfbxtWSrk clsvd8TKV94dcQeSd50XnL1r2tXd968WZ2y786LZC+/YWX3wyuzVeyeX+iq0qma1Yeea2W1j fYkWv/67181eteVhjsOD2K2HsLp6SGK/lBMlJmohrSbZIsgWWm6kxRogXCroVGoqGg0mIhpN otpowq7yyjaNtkij0WoFUaM2wkZmoqYj9AHw8Qa6SzapqFqnVau1KtFoFI/AeUMgWrpSNuh0 FoHuEp4UmDBM/yE7abOyvSy0G/jqhEWwqGUN1bjM39hDvU3KCjVhAyH7AZg80tzckFJYu1PS SF+TtcHKaX/D1qqkCLaOZ8HZAaP1gVHq7aPFEWvEGqqjtUiocOjgnpEX2IZL9+Si9Mz3c/fR lf3CNWdvZg+OQIVOyVLA+ybYfEPUL0/6kUhtnf4L/VtUW9RbfDeLt/g0dawuNE+YF1wQuti7 UbXJu5UNuAe8Dwl7dbsjJyIWuERZJKvNXlzi0BaB8uIpvbI1GALJFYMht8craJyiCrW7hoLB kP0wMIlTsMuYU/p7wn4fCkFQPkwnEA+deqBfs5vDMf074DhC5Uh3hEWwQb44KLHdIRriF5F1 QVnaLTHJFT4Ms9NHClCf7AKal8CHIOKgfZKzy8A9zacUgAbW51hmq7YqqcJ0EV4oIBrZ1Ef7 WF/wGnoNuyaoBsbhiAZ4Broq2XCxuNa23N+j6vGpujrBZGlCGpFDsFr9DR5rFHgBu6VU2HRe bnUn1d1//YLrzl+36Yq1VRF3aapt1ob9O2+65BkqqmY+drB0543DFx/sLx0zp8ablEKZ/Vuu /EVjpYZBKQBeC7zSDiELXskBzZHg4o5aPtOq+h2u3SD5MtEYZZvBIheDhcrsKN5dzIqfoTFI d/9NCSYCbPMZBeMqjARYMfoNJsr+jTwNjUpgFamWiVwSE7IFzqqqZcSuVFRVTeTjidFfiYu4 LzPk1qv2qzXgrg6qZouLYYp7VpiJDoJQChAi+X55XCNQcj9h7Yh2w3h0ApyOWq1SMfCOYBph CJXBPQqESjQItmaRDhwvWLRF2g6F4S9IMZ91AXyVLGnu6k1Cwv2sSxFzOVPJj5g45stXeBDW XXDmAgxgUf59YRwkxTBsnB8e0Gktaca459nYdF0mlW5Oz04vTl+lu0m3x7jH/ZBHF9caTTAA lwiqUECkFrNdz40bkoYJISFescVOQQIPHtBPcWGgw8IFsicilxmAj0m8QrP/uI9afNS3NS5d UvJBRXqYXvJ0XA5WpCtYxRFmgmNCmo4ZCj0Arjj5WdfIBxDipDO9veck5ZHPmgCPXQrPziEQ YNjQYHWcY+LB97kdXq3REzM4TT6ic2t81OjQ+6jWi4h7fYD0XX01X9VeCpo3hvP7nAAWF30t YxcwLMBTrfnmcr9cpqme1RTdunTB8qaqUHnrCw//15JpLd+5taV4dP2p/L09t/dumrDlrgvS sTXeaPWcGb0/vrzj4un3rf7RtjMtKQ4uqRYOEdBYqbKYb/ifMud+xgm6bKMBP/P7iNcPbVWA +r2s6Fnh98SBoEHQC7+XHVrm9QsWrbfERwI9sB0zSrUWpiWpZpCcrtePvZ5K8UmRTp368yc0 VfhJm7e++KKEUJ32yB6t2WIxSXq/LtAeUhdb7JLb6vZ4vE6fOgTyPBir48lQuiOjpMkqJR0s K1QH44Vqt79Q7VCqB4uVRL5bsmdMFgMu3mCZYZkiTffPDnVaFkjzijr8F1lWSav9G6V+cat5 wLJV2mrb5r8xcL/lfule6/3+Q5ZD0k/ch/yvWV6V/tP3qv9Xlnekjy0fSh/6v7B8Ln3h+8Jf obO0eVgADD8mifj8fq/OrPfoSrwOT4mWaTzaYmuRp/hyv0UKSn6vN2yViqw9VsrNb+Zh9ops ZX4IM/6Abw+BSZdP3DA9IBu1kkWAhkKr1Wm9cMqVdRacw/aYZeswSw/N9lP/MPtENgdlc7v5 tFkwPxK8eEDBEC43xEenm6NKzptxooL4DJDnSNNWcwFDbu0yQ2GwFZxX0kmkU1Q6+u/xVmnz i02aJvwVlAngLPxoH3BlSMPBkjPVgNMxtJYWOGxFRDUw4dGRvy0Kj1uamzfPVTuB/iZC32no mjPy0fkNiUs/+IS+/Pbs0kBKE4tZnOnbxUVf3nPj+apYTKwKVSymJhYdwQtLAvY7ET8A1fJD 3zmWbZbTC8lC/zZyo39b7b3uH5Tuc+8r/cj9p9I/poxjyRWlm2rvq7m3dk/0sdp33O+UvpPQ i43D7I9DllX1jRxovOEMT+U/FDsytXKoApHLn6mRIwlEHl9mcnRybJv7Xfp29L3a92MaMUpj phpJKFZ73EX+kmhJojhdVdManZFZQDtcC0vvYlaJSI3z6MJod2NPY3/j7katO+2uaSfANO6o P+FKiWom+B3+2bU3Ru+LvlurCTbKje2Ny9gyoVvVre7WdKc3qte513l6/Ouj60qvSFynvsFz g397bX/jq6n3Uh9H/xl1dWotAY8uFJYCnpJQpDYKRXwFqUsGokK4bGxFrVAVTtTV6UrKEg5H CatKcEjZEadxvlca65RkIk/6h5pbMrw4NGmKkspFqJ+52Ev1/rSXeeeJycDYimo+PVJrnU0W d4uMIDohCiKv1JusGSLSoEghUL8pxyrUdjubV2GEuIbYZEIcBixbJDbPEuRFy86GxmfomyRE llAnqFbyvDNJyGmnAD6QE5Jdvdyvrlqo/Ai+vEhOdYKlhC7oTFcf75JM9inEnRN4INDUKSAN jjgUhsjRwOU6YNKWVCaScPqpxu1xeZhaHY/GWKw2nnDGa2lKU11LI/54rZCh1bVCqaeslqZV VbUk5gvXEn+NUFcLYQZsbBNu9pVHncLNgrmifX19pK/3K7EaLgddFBws5woiobraGhjXuRQJ PjbEeVvUx0o4f1vA1hprgdflUqZaIwzeMmVJ//H3R/pr58UcvtJZtWzGj5bdtfOqkStjixtu u/28Fw4vb1/fe+DZ+S9sn9DhYU/5Jy66fsWhebH6SJ+w5nuhipgz+vRlKx+0aDTN18y6bG/J l2s9D10++7a5InTNFPqK36kswNVRyuSJOn+KplhKSAXustzrf8jykO2g5WmbQevH6Olm4cri y0tuEQZKfiDc5d4nHBF0RsEsMt80uEipUlrJGvVAoFAdYB5KD5Nhoe1g8D5VwivQYXb8AMzX EpWGhZYD2027TMw0LKTkVJGO7YM+htZI+5600oC12cqsbhkAqGsKOqnFGYAqVAEP5/TY8mWK LiTZ1TeLy46f9fXOOnWmF+hpBDLKmQ+aT31yBkgISmfpFWV5g8UetRFiedwQL4mpPbpKYixG pHWpKqneYYLx6quVA8UEP9fX20XtEWXSoTq08TUY41CLkWApNNO2KCebfOXGiG8GAhM+eHDr e5s3nrrnulc3BVbmTh/JPXlo4CBt/snt28ttniK3QXVxrvaNg9tybx0fzn26o3dv0YG9/zx8 9jU698i0Ersnzakk9BcqzlOXgKsW5E6Dx+C7QbpT+oWk2ihtLNoq3WO/t/gVzyu+tySt02or 8vkFTTHd6r7RzxJadcBDQmFNwGMKRRwhVyBhNpuYK4FXULTeptk2SmySLWhL22Sbyjac/+1B vqds0yN8L05orgPfHIzQngjnzYVIyKHsRoeyGx3KdDugIDRK2I1qpVLt5uerd4aXjK4B34sj gHxoTsCLJT9TFuXrLddwbot53X5LsRQrivst3vnUXYzIZw3Mpx67a/656efyH3ZMV2/ttzdG UIQWFSJgKWadAFdC2IvUzo+WePkOSIBVHP/8vudzG361Zf6HtCb3X6cXrouNCa0T1mwJVsQG cs/+PPf+s28t9dIp8Fhz0ck+DuvloAdPYcZrab3cLNet8l7mvT/9qHNf+kj6RJ12vqtH3aPZ ot2i61f3a7Zrt+t00YDHFwrHAp5kKKKV+YRoQ2ZzQOfRavhUhniNJsRYQO3ReCUPoxHwH75a sidZRSolLnizn4NUVCQBUHt8ng+9Xp9Wtw/vP+xr5tI4jBCa2RoB1/pAbleutbFqX0UyUJnC qWvc+4LgaI57BM+c9rqeut11Qh2RlKWSlFWRlKWSwrGoslRRpTKqLFV0Z+bEIbpVYff5Milr hT3TBS3myREsVxc0sQpl/wQUHWgyp5B2oEow0lxSlE59QqS/J7GflHRUEwa+NMR3AERGRQwP ca1YraIVHAPDgLJ+X2M2vpeA4+DLWL6+NKOOxcxm2wXzcm9LibEfrFudntCS2PDlx+l0Muhw R+emxWJLaXFtTWKFio18GKlan0ss80YSuZaFpY5gasLm3L6YQ5KXCb1X+xOx3C8vbi+GLERB H4jIfZErafn+RGoY0umY2PJ6najTZ1PCPcnDyZeT7wo/T34kfqT/UvxSr4Ocpt6CNe5X9au3 Y421Gr2uHBohI1Qmcdmk9Wh8AY8jFFZjUXlNmcqjNiu00x/wxEORZEVCrzWKEFhoBNPvgH94 nCSkBEvwlY6VwvoAEbc0mdhHyigpS5fJZT1lYtkOtRqvMM7W0OcgxnPWrIqYlZU0K4tmVlbS HPb7lJX0KZU+ZSV9O6v+bdNB4of881lX7wiXYbF6f+7CKhYWD2uHP19CYDdl9UbOpRD9geFA PamVLxkWsYpFItYiB9etwJrz9fYrUCY7b6cP/WPebFMsRktbJ//DpIcgUz1yOD037jTpAyCj wl9NEXfriouwaB+3rc3VzZ4Ry81fFXLZnLFYdfAKYU0hn3t7cWeCr9c0UJvHQG0ytEueqxen VDFXqTvBJKfkYsF6ub67/nJtj7PHdXn5DucOV9aZdRkqUxsNWw2Cs77K3V7fU3+z+IR4ol40 CjcYjtYL07RYF+ffwja+apGMQn+GFPqDF2aI0CZPqr6vAma2sDpRIZgTYR1NBvxGznz4lUn2 qzlm84et1nbbDhuz2GbbGMedW2x5GBJFvidtQKAnn1IQ6DD7XDbom9rj1BIPxBkYotMyrHps Xlzi7fHpdcvBP8P8kuQIEfssBU4FS6VsP6wVRG6+StI5SjXKiGSCSY2kjSVKy0rLSwW1EYyI JWQdR4MByapJ6iuJKYJICprHEV2pupIaYuZKzluA7+CcOXLlXOjr7UoqNjDOenBChlUMcha7 QMmsGVC2ulAx0Ki62KpWF8gaNnM9bECKfmKM+BEYkrmbns2NbO2962/9bTe3BFouYCbXeb6i dSe25S772b3zVw7e+dqMTWvH2u0eASRu7u7zN7z+xF9eyB29Mx6jN65sDsXjmdgluSUTGs/+ 5B9DP/qPCxc4y4ojtVh5Tu1+gJ3aSi8rSIRPT5X5pJHYcP6zA3xFYpnh/FnZxrMZBfYzyhJl 7Ogg23m1nYaVtQsr+yU8nP8QemssUVjpGHa3SJAkfQgVCCmEKjhn/J7oEJoRmiBjGsaTaLRq PKvy6hlpTimS5esQKD/5RIloCrOZPPo6Vi6Z/E3yKKw8Hrm3Z+ruqcemnpgq2qfu9Mr17cgy QJwhFA4HPN5QOBPwVIXCrQHPhFCYBTz6UMQe8HhCERCOylCkLuAZH4pgBiLRqGfC+PEGg55V VVZ6vR6tzR5mcpgeD9NgOB3uCe8OHwufCKvDwywou6Wp3VOPThWCU+nU1li4rh16ZJbZOWXJ r53JWdKZPm7kl3r7FGSgmPtHpTRARAEV8CfhP4he0AdwgWvUdHMODAAH/7r5gdH/n9CBAjnq YrqHbQQeSKbTbLKCvIEIKtLpkWfSc+KukQGlqXrkyCiKQAtrxSSCkfslvW51ATE4pJblZ+/8 GkvQH+SWfV0SLv5GN44zasEsXQ7ICZDn5bUhhQqHFNAJyYk6V2iJdXm9NuBhobAz4LGFwq6A h4YiuoDHGorYrEDUWphBOPS4tHyrukQOda6wrkfbrz2hFfJamta2a7u1wmLtUe0xraAVeTet AoFwfvj8KX4uMjnZx2FNuyTYE+oPnQgJ6VB7qDskHA0dCzG+KOdhr/Otj83fi11fYJAUBF1Y BR7H/h3Nju7Iwryzy/9l6jCpypTGvoVPOW49e4cyZ3yGIOfCp3omvI+y8vCV5mfNbA2hW8gG dqV5Y3pT3RX1z+kPm7SXEGoTW6swXfVsHlvB+tk2eQe7Vx4yPWU+XHt40i9Mv6wx2QxUMMOo qKq5iWyt2Un20d3mN2u0BnDphKmMAZ3fVA6NX0rXrJutu5m8nHmXfJqx6AwuQ5rWsVp5otze +jB9iO2RD7KD+uzE1+FWfYy+BWf9j8nHcEX/u/608VOTs6S2JJOpSWfm0nvJHaa7au7M6EaV raGUJexv8rdOLibFaWZOE6HUWeLyONVObVncUzquFNsWGPUlJeJCXS8ndg2pkSaP3KA2aTxq ThFC4VTAkwiFm1rGe5pUouhRQQ4GhQgEPKWhyLhMo2ccNJJhs6kIjDN0VlyJMjedKUqnM4Sa Mi2q1jRpyYiNJpjA4N6s0Zh7zM+ZmTmuETUa+HzsczaNG5dIlI5vbCwri+8rdToc0GOWMpW2 6XbRnE6nxH4V7VFR1TAbKxtlU7uJ9ZtoFtaAYfaFXJGyKNTfouAti4LNLGEQJg5go4RJgT// zsmtz9AmsDlLqOucGHyO9wYD0MeNZorKH9SlWcl8y93jXAEz1JXCXOFPEbgKhzt8cAUO0lH1 DajJ11qc0QJXdYM1J719eONOl6qtbElNrJwkdnV2Jbn2W1/vLDE164NFDfg+wImDUoMsmRso 8PKguYGgBglKRwclXjq6HwnfBArl6uQiF/iRUa0Pt+1AOf5/RT/W+jGEu6YrsnOxmeH9Dbac nrnyxwtGrmystdflKpTtUjXy7Dcw0MSqVEXAWbSBlk3wlNcE6KcV01bPLDnATucsV3aCMS11 OuMZ+kau7RtYaM2qsJNzMeA6l+eW2NdQ6TsJvyMCTqikeUoR3iCGHx0Rn8auC5Ks7IEuhwZJ kMrhBXhZ5TI2ELw3+GjwUNBIw8P0+3KteXn9PLbIz4CXhFC4ZIzHOj6sD3ikUCQYCMIJT4a6 6o9eK97ZjzBBi223hg2zF+VUyf8knOl0egVU9Ar86BVQ0e8MLekaZT64XKbwHGfOKKZV7JWT XVwo47SgD7SAOka59a/UEMVxdYEcKPx8vXhXaP2XH9TOjxUr4tbKNQuCkrHm2mUPfG81vUyT 2xEbG1wvXMxFrRgtlzed3TcnUFxUtaGAi9SfYlbS9BX5Q4uTmonWYXaZEpYyS7mY1tjG0/Gp Tudautp5SWqT8256X+o153vOD+nHTpPJCcFcnZ6SFuqd9empTqEkXeqMpwW1U5V2OIQkKUNp HGl0NDjrXHXp5prZNavxZstG5ybX+vQA2ea8Pn0vuTv9KHk4vbsmW/MzxyvOozW/hrH8WM0p x5+cf3KdqPmM/NPxj3QMr/c7pqQW0k7H/NRFjstdLztfSr/tfDv9vvP9tLmgMQsGPO5QuErB IqDp2lCkoEMLKRiEs5SEFhGni1CXE+5ar8gT0qmitNORTjmhQ8HYYXh3OZhOiy+opNOlCW36 O6BjrlRVOBgM7Q5lQ5xunAipQzvlGloD/zFcwiRZghYr135VKwQF1IRTeQjZsHAgA5teKgf0 V9jynPPHwY0DX5mtYL5yKvar0RfSOe0HNerFDlbMVZ6UBKM/LURSg9NpbXBKtgaidTY4hvPH DsClMV3UUDCgK6+NwqRFukLKvvy2jMCZSUrP8ZOgXt9opsKUkTOeWHs6l0hDYi8yt8FziH5C T9L+1AJI8LH21MjR9IJIycjfxQ1nN24OlMdimWCfsHFhwlca+/JXolI8O/BVw8CXN4HO5d/P /wnSw0xSSp+X2wZs1LYdjnfy7LrtjNp8jJaySvtY++X2e+BzkGcaezhsw5rpQ2GsmSeEV7Gg CY0U8XWN2GxWyljYFi6y2cLYoT+ULaX7YKTWUeZxa206QVkPo22O1RqU0pIsCRLQ2VNWLA4y Z57iLALPKIoVaWcZ1wZIUKyU0SD/KMuJMlZmL+JLWhwKpcP0aBicq8KpKuICONfT0ImCDwm7 Ekt+eG7XApdj3/LlVnQq4COQ/0Ax7BbW+tQpGHMV6yREvAZliTXcoYp0cfSc0NlctjKYjhts s8kM22Ky0LaWXGS7wnY/Xrg7Qg/YXqP/pLa/MMqlhE6Y22kvcPghwvJ7h/y2ZljEjg4Bm0Pc +fAggEr2NvDs4GjiUUoHXQ3gp3j2Hdlia7CV2OCPUYzgagCb/s6goQGXOVZIPj9Q1MBkONMo KP8rZRt/GbmTdAkAqlEV6CgHFPlXKFPUBx7aI4znEEPf4bAUPXuNJz4bgMUBadz4cb5xqpln NYL5HKh8uU2cfPYn50rCk60Vdh10bVzuvBxyp5F4yH65+m7bXs2j+kcl8TK6SbOV3qgRJ2lN CSIUJ9Q6ZxP/jhGslpLAHcJkQSVM9/H1dTfXBX2yj/msTfzbR8yiC8Arbbp3VDHJ9ZKzpF5Y 9ZD52k+rhnq4P5Y7bo+bjdZKmLCdlbRIg1yJCjlJb6qkLobIpi2uJA4R0SiFLEwbjHldoCxQ gIV4PKae6+asijMWXr+CvuEU1dJrc1fg1dYPc9f++rl/HLx02/cvGXrui22XQkBbm3sr91pu NVxvmuikn+2fvnVv7pncU0N4QZC20EWP38j1kOAexSR2VQDfTbn8EKnCo97eWJeq2uBc71nv vSrRU3WnV7PJ+XT0cOJXnl9534uqXaVSVSLeEGsoHZdIVy0svbC0p6q/yvAyoW5vmbfN+0vX rzyqvQn6avRdx3vRd2FL+Tiq9soRX0ILZYo2FKYBjyYUAaItDkWIL1hR7ks0R2bDkB/RFJdD i1nMtBo4OrolWERkd49b5Z5exZcAuktSReWqbBXbVXW06liVUFVBFVaKKqSQKqwUDVvMym4b 1a4o9NG8s7JqmF42FOLqFMWccI6PGt1vXbO4TSFesCkgOdVZUK4oFgTu9NLAdSoF04E3Wubw OmOJeJkDxoKoF1Gpq7yWxjyQdUchHXrN6XM3yZIf6CcyTgz7g+OwhAHYtoG0sQkUnTP8MPr4 doRO5tso9Jx1QDEOwDe6VLEPgO/hTi/0R974rMzIEdDnIg/UofSvB/97x6/+s7qvpe4C3+q7 p103t7adXZnb0B8AfR4bWC+s4bm2wSsePmaeqtc/2N9xd5ud74rcWmigLybFeFtgRC5rpR2a O6mgNuM13g7NSrqR3kB3kLu0P7W8T3SiRSYTqTBfK9wNH/RjckpbkpAE4oc2k/MvPaSfiOQC rdYkJMNNAXvKzohdsgftabtsV9mnJ87toIQMZZm7STIFTcxiCsASML30f9pB8FxNnerCPoJB HEZyRaUv6+LBmDduMOqNTO3E+4ixCFMHisOV1KdzY/NYEMWtKIaK/JV4Ko8RiU7rMpdU0ogN keJ5dM75CH6OMJYX2FAVtz3Go1HuXsT9h/leKyL0q61WcHuMCzesPHX3QO7l3B9X7ph7xVY6 gJeh9fR67L0rDq69+fuXHnhm3dYZDT+xZB82BlUrhlY0tiyhnuehq74td0nu9S9yN4p/uuah XDb39OC2bT+kTX97uH8T34FcN7IaOzBBMozJg1EnJy8xBaK3hqnt+vhLkZcqhenRRyqZM+Co WhmFM7AuFo/hHXaK96KjV9Ir2brAuuDG8OWxAbo1eE8l3umPPR1/pjIfLVYHr6M3R68rvS+6 h/6IPRx9svK5ynfSf6nMV5rwPj11M1sCu6y6saoxvTJ6YUpfDiu8lxYHPJZQmMQSHgLh2hyK lHBNR0RmFbFoNMxoEQTr6D68f6QpL9ujKMMdfNBQaLdrujXCDg130iGefd7MML1VttQk4BbP YK2GGKm1ceP7YEfBrN46u46Engyx2WCKWOiAVE9laPmO1Qv1Ga2ys7XKPMAlA+RSGy4pVnZ2 sVJZrOzs4p11Sw4p4pGieTu3raUurhtJKl/gSBV2NRJlV/MdCObpFPxgIBj1pZLQpDS5YO4+ JxFRW4MbWEKRh5KKd2F12gmTobey2o8vplVGUrW02o+oKlxRSyLRdLCmFu4Xo5AFXRxsSdye pNDXmOIeCDno9GBRA/bBiYOgiyCYyJ4+IDWkJQtIpGJDJEmwW8lkKETVfMv/byhBw+UmuO5A k6t4eGhUq/FCf11t0OSXvPGZdQpyUJh3+ud3Xt/+0OPU2T2w9ux4u1f3wku7roUV+QpGaW7j t1FE86MbNg/Hc1fe0GFkd9C912zZhc94UNKf/52oAp4YyxbILtudFfhklIUZ8AE1EW8TqZKz 6WymszYO0ynysfqx9W7BIy52LnYtdi/2qFUmlZmUH20U1xvWm9abN1p6/D2BnlRPepv2BsNW 01bzdZatyb3i3lrJZqo1ZUx1vlpfxlfHzZCVYtAfDJSVVcL8P4E1i2lX2p8OwG04M75ummla +VzDfNMCaX7Z/CT8SQLMUxuo89TPdc51zXV31iyqXZRZVLeofuEYs2AwlNkNnrKIIdg4rizd 2Gfrs2+L3qO5J3Vvem/qaOL58peTRxtPNxadpx3rwcfrPE/SN+BBsYWOWjFlU9191fCuXhvw +P2HfbBryhnXfUVAHk1Gc5HRaE4ay81iXKck6ggdwetciWohkuDWTSr7wxm4dXCjOo3IUsr6 nJUdx0cvrE9aj1sFOGJsfTqwz5+UuB8uOgR2VdHnqv5SlQdpk6fWyVVvoCCQqmBVGgRPrHqG TiENMGpxozj38+9K9oLd6DvD3Wf7RvoaUoprPLAmt3yP+g1xcd9ckPPPaZ4J10F3UakX9tKC K2c0rbEn4oYKXS0ps3CiZkekSaOorzTWEoOxIlkqgcRZzGXlMRvInDal5jBfUEErNE2BYcX9 CD6GXF+wzLDStEpaluT6ArjmJvEavSKFGA1OS4OYtjTUInB2p5MqxgjupwT1ox/WMmyA0oL9 O2Kt9bMCmJfGo/HCe0MFhbXweMzWtW/R6huTEz569qa2vzwzLhP4D7fLB7cQd8eBNZtvHdNY mvvR7TNPPLFm01iHO6QHR5Tcuvu7W86fUNu2eeUld5x/33GdqhlG7zdvu7X7uoU1Kyv8/7H+ 5rm3/bzOFUhxyJ8A3iir8EZ/lRvxaQu20LfQfzG9mF3su9ivTYWaQ7ND96ju9uxVPezRMOrz A01KoTCkfEsoonFG4AAlWbShYXZUtsP2QGSHudlmAavVjo9riFA7JWS3VqfgOZ2C0nQKntOF HSWBpJ/TTDM/g/gl/2L/br/oP4wvBZbkP5ENXJooUfBfCa4+FFwO4V/6LJk8g5k/RPxAsIY6 foFBgyWDCU7Cwb2gElBWhsiGOoRzTR8orM4ITAlUeoXbz7nUV7AhQNHyL3iIWxDgUW0XH7TE DfbAqrnPgSNPjTzP2fOHFicyMzRxSTUz98LcaOOYL8+cY8VFo9m+ZhF8ODGrhvwJ1X7MahW9 9hBJQ+woT2XSGOtQMKqk8twSbyahblTPVG+yiLFIrLQmUlPaGmkt3VOqKSttKGXt6fWGKy33 lT5X+nlc3WQu6H+h3HOFwuWK/hcKeGcoAtEcdIrFEiZdOWS0vz7FZw2ZDxQBTslwslLGJTVJ p9PKxgYtXjkJatP4PB3EOxkvZoHqKEYHrZqfzGsPFhTEfMTy5OY6KU170rvT2fSJtJgOBJXF DCqLGVQWMxi22eA0uBZ+gwrtssNGDFuGn9/Z7kqd+Vr+4/Keskj8bQ9Y1fEDOThXyWUK0CnF 4AM2tO38TfvHaEGU4qGE3so9sJnaEiuNRc1BGIuscWMZLEX6kBSrJAkDIr62TZxEwVwECgWl HvRvfMvSr6xC3D0FdCcOrVBBv8aXGkYCZf+NGnaFN+mJ2vZk8fmnfvbbD9LBVu6Okpkbdflm bl99/X/PgrpIVRqLTQr0jrz3s989eN81nX9nts3nxWJ10b6R/bN/1jdj/YF3WAyaI8CBJ/87 zWbAQYPgL9iEDuro2LJ4kXUYlhqIl/gQjFeX9ogGGzPACxDGGkcD1Jwjx/A7SlPc48+lg84X HxXUafT6tLpBYzM77Q1GBA+HJ60ug7Sfp16k8ofI1OvqUjN0nWKH7hGdOq5OaisMCWPCnnCX ecoTpdX16gZ3Jj1VPVnTZpjmmavu0HRoO/Udxg53R3pu9YXq5Zo1htXu1Z6LazeKG9UbNRv1 lxuuNF7pvtyz2Xt5cEPqevFm7YD3xtSN6W3Vt2nuNdxuv915r/sezx2JO1N3pPdqH9M9ZnjM vdfzqPcx3yOpIc2Q9mn9sPup9E/TX2i/MJz1fRGcsTq1Ir26eptOHOtZ418buLRSXKFZoV2t E9p0MwPTEm0psdOzIHV+WmjXtGsXGuBqDvdJg8Fbkir3lgWqNQ2Gc8p0H7GNa/SkdV7RYC3M rMem1RioQdtQCkMnNEnN3PD/Ev+NkouGBo9cofN6tVAywkQFX0Qt3l/2ELu7yGNPpMo8CZvR 6rGV+qGMb6ge62kYzvcMeQz64HB+rVyU1mqCeMcxDJ83j8ft9fp1er2iBvF4UeFN+bTaMNeT pVPVag1eRnhF9qarUay220oTCYhYBF+mwxciNbpxO9V74FDWPyjXcb8yuKMp7mXxynQmXd1f vaNamF29uLq7ukcpnKg+Xa2t/lD7R90FBs8Bt+EwCxI3PB4NsrHdeMwoGB9pHDfMLhoKcQdH iOinTrqkk04Jb05yFjE5whFggStUEkl5y2urefOLeNsLTo5fZbSjNZyc4juP/+7x+O81eBG1 SYsDmhquTe8a/WH3cUERG5Ar0osSeMug2c+jYBpRwGkzNCsdOEvYSYvhCKbW0Ah/5QwbdNSS y8kltcPpoHAU7HpKJVXU6eim2Vw30V+UzN2QgB7g9WjukkpjUes4+pmzbmwFNfwuEQQPbXe5 7GVMio7NVFKRsgpfSXy8amYsnolc9+URYdnZH4grv+eIwwKVDke+N6JhW/u+UxO3m2xaqM7T ZbVbRgLs46vSDgj3MS7NTM+fwtesn8Rb5eOF6YV9LQebFYtdM+y4bF6xR1MV0xoMXMbhSDBG jPhS9GnZYLOxebUlvAvKv1WQNTJn5GKOMGuVvrUNGiXVQJoH+g3qcArc8vxiWUU6Y5R1uKhR 9vl4bEWTcTj/luznnfDCxRYndSq1TqWHU4r5NU34GkEKdnmsZhckTsBC8vXUCLcovZV8Hdbg 15Wq5NGjv0kmX5Teeh22TFiE1xq8A7XMNqee2oKBhv7mvbqDesGWtG0mm2tvIDcZbqpT+2wl jVJzf7Oo885UzVS3BlvDMxvl5m0+rd6sCZLwdNqmn26YXtc2ZlLj9PELDKsM1+uu019nsMwt ubaEBZoXN7NuLV7Lb6oqq8wcwQY0EmP+6EFdgzFhaMBjQR/VWCcBuhkH8W6jEFSSjUbR2OTk 6rkyQ8Ns52LnWqeQcm6BH933AvC/wxOnm+Qmhsfu4a8HVdZh3oaFKbJVNFQdraSV3TFSazIa MxlM/FmsgHpe7RGKr+TibWvcEVadWCDWH9sRE+XY6Rjrj9GYxDvFjrBJcP8vxkYNNOBdx1Wy 35NqqNbI5oYgJMJ+DZxa6WkNbYf/y6QJky4tMK+9fX3J/9PYm4DHUV354nWreq3eqve9u1q9 q1vdWroltSxbZSxvsoUFtmwLIyzAhBDIWDZhDY41ISwOGazJRlgmcjLZ8yUYYxs7DEEkDiGL gydDGJI3DLz8PQQCJh6ew58JSH6/c6tlzHx533uyu+6t6qrqWs496++cCxDfqRKkHvk8oaE0 hx/QLchnOTN3clw5tWPgFMW5Su4G7VMqVfVI4QHJDk/mGLln6HVxLXZlfVEsbfT29Hb3isi0 kS1IgWxRW0RT3daARR/3xgSP15V0xFhLepGxERN6LTWV1Ws2T0yJMWcLFn2m/hippCRnGYlL kpityIgkq47Bjw5FFlrs5gMDHhqYwFzsxAA+2IE7BUW+jFAXNYedjR4V904OVDs1L2s2WyOk IvEPH8ii01rE1pDxKnvwkQsyWhmtFa31nMeUqJH+4C4dy4IB8Bx5YPp7dJPP5A8u5M0TOBH4 Uo7HIoSWXzcgcQzYAYxEceXfZboXb/14oviLNzatH8jmxGouW90/c+uFi2IeOehS7P7+yQ91 9LH7yusGN/au/dRH3eFPfmRZx+DNGzN7PtTSUu6rdNbaNk4XkxeU7pj/2e2LfGZHf+8XBz/H xvvD5YnGKmQJiWffRUb+UeO9QDRm2K/1kf9IArXgzyBoD93J6EORAe72DoGAX+GBdXTe4+Aa 3qFxjs4ZREKwv90eCgoG0eoldcDt06zgFT54dbJWW2oM3gXC0wy8WNINHT5OgdhQnsaghWbQ DCfncAoJp8BxdAwdmzAac8iHARsxjYZEol66nHdwFSb68Tcfo012ey4LssJZMfBnqXe8+XvH SVCS6nGLkmNfMx02HTL/MWkw5pY5xrvV3A3SjYY7pbsM35C+azGvNLM+iy/vWOpN+AZDQbtg iAYEBUlKC1fSkTROG8UJ45TxYaNkfN2OCuKhjN2uIF486Zh2GKaw2O9AUiW5y9rRnXWccJgd GP2P9dcdE9kfoSgCOT0wMEhLpMEzBwg0v9KdA8gb4XmsfGgUwqpkM+dUKaGyiByKCeGQzR6z YC1pSKksbIsiL8MUVQkWywmfa4pwYu4gGh9nO1EtmaBClJbHnRO6KzKP1Fj3gm+S1EW26I4H /u7XX73nuyNf3+hSQ7FWJ/O2dX20seUf/mFbvV4Q3z76n/985gtTfX3SoYdWRZT05Fxh7t86 u555cv8TUXjchBWgoSFIjxT78wGLgS3IDzHyAUAqlwGmQNZlNU+kJuE4wiPhIKIUXPXPHfRC a0fn54dJosQ7UCgesPBjpfGBY6c4wuc4ZYs84uF42Otb22pCmt5e0LHJKMa8GwzrjetNG8yb o5tj5quNNxqnhKnUwehP1BPqy8J/GK09qHq4MTQa25qeCE3EbgztjH3ac6932j0d+gYcbA+n H0Xtxp+afxp+zXIy9kf1DAuZxCHPJs89yXvUqfTptNmtsn9CsSwVnyQYBmq3EANuB11MpKZS opBSUiqHlkymps+LFJ5OOVIfir8E18tPA1mrGbf3AvxJ1Gi9ngZu0pb6ZdLO1tn32kV7VeEx 5Qn4ZaeF/cIsMq2sFGQWhe9cH7k9Io5E2EyEIRsduWKnTahfqZj0wgZG07KWZUfFv9fdC4Sx Ht+5Y27H+MkdnKxKJaQn7YDfYcfOk57mEJPXx6+MXx+XPocMJGTrYmz09vaioielyMG7DZZN DFJQQqSTnz7sbRgVZQEWAM54DhbASiCxHYxsECR3CnppAu4GAJKNDBFiZOBt0lD2hdsfepWx g3d9v6O8KOG2pdNLti2+6Ct7rriwp8YuPfRjZnrpBebcO5yr5vw3JhNDV3zla+8uq9yCux88 exKerHthgLeJa5q0latyTFHRhAg0UM4cJdQkNkGNBzjDCthwpTAHiZ5Ubg6qfG9sfUfTbb0Q sSw19gMAzeIkqLEWT3qIdSlezeqErecTsnhx5TKRo865quBeOuSsBAXjmDJLXIx0jAX2dbEH RwmqTZLo0NhknGnxCYSgkjacxhbgPCwAmKJpFFfoo1YFfAlLkbiZqlYrRb4PvznUvTRVK5yr HS/pzI2gbiViFy+Ojx8HOhH21YvEPY8KVZhPK1fWqqRpXIBEqYnqbYbbjJ82TFUfrs5WzVp1 qioK1UCrvzRqHLVsKH3RjCKjTK32yCvljfKXDN9s3Vc1z1ZPl0RVFdTUD0DtMPu15f3qOvUy 9UPydeqt6owwo37HfNT8dKstZ/Hm7Us9Ce+gP54PLI0l4oNJHGYzlP38qSXLrFxOSrakYEvZ UVPhas3jnwhMBR4OSMnAdEAMvF4cMeFaMaNOjdrHVtZNyyrLdjdjq8On5nZSkiD9QdWnPGZi jwrnj0A6U7o/Z5ORXMlgyWdzlqIqlAxYFMxZlbUay5wxkrlMeHUQOKdv4NaBugTdZrnljDQB COJmkIY4I8GjO3uCxnTdDSztAg2LP102NfTFl9/58S3rwCEjJQdzt7lSgWibbf50xdR/ZXXz 8i37r9ty9YrF7/7kJ2zl8Lf/gTPKd1/8ysqYO73jZ+yFwcnGug8/8/N/BUWvBb9cj2xQH4CP u5oUXbAEIO/slE4jIAaGpokw9rdrAqNwjSggSQ8FNc/Ocl5JHc1N0W0U+I5m3WZCpiPJFl/T 0dQ5RDwV5YfOPs+PQOfnj9FoMHTYbCAgYq/gr4RvRQt8OZE1xHH1ODCUC9Qc91Pa535Boksg xAu/CP0XdUR9hkhYwZwB+81IJ52A4rgPiKvPGr5qOIBUIvyUGbdGIzFH9O3zJRO4T+ribkH2 dLdonAHaBKB+4oMivIQUQlzr+DG4TTv5teJKidzh1d4aGg9PCBO+5yVjWI1BTYs1AgiBJ+nJ yMuGapYkiQhaRY5+jW9e31qpRU1h62bvZYGtqNawJWJGVrjJjOoTRv9q0x7xM6a77J9W7oj/ o/jd0CHvc+JvXb9Tzoj/S/J6JswTlknc3R7rU+ZnXKfNkHRmx6dEyUrjxIRxMtRtXSGutK5L bhA3WK9A3ds93j3h+71fs35NPmI5ZN0v/1T8g/iy/Yzss5wwozLMCbO4g1p6dhR82Q9zcZfB J7QH/HQHXsTqt/p3+2f8L/kNfn/0XygTC4F6XwPNqwe81LygrfI06BlfGmVEA+ZfIsQXbbgC bHtgd2BvQAqc8fmmCC45bRHbLXstL1kkxaIBOjlp2Q8opcnyHaffIOwhusKcKJ52J+UVSoJT capO6bSTOelKrHiWzmWJZU3NBSbA8BwwbFDwCcqGWgOIuuAdYYBirO0E4IV07e1+6NqU6Use 7x07IWLgoOztJfzYss0HTQKwHDvGuHGAg3SN/Khgxq/Z0g271tZw4APP3eyBQoNoGQ3xiANR fS2qf9dck/U1Wf/Oytc0p7XhR8gmrLobDny4ZU6K0rk/1MnzmnSvNJCAXIKBFwT82RQ311tM v2Pbtt11yR1tSf/Pv/T11//z8ANPz93FvmVUwld2r79dXPTLj33sypt9e/4nY799nZl/8Z2+ zZle7W+hD60DjP1W42eEkmhpju5sG5dXbRppy23cro7Ct+c0MYuzyCwkxJgHz/qPGmYDwtD3 0JZmKNxE4gl4aE22ZLIJ1L4FLOsIix7wmCjL9tSsMjtwHFExXShBJM0qx5Sn6R8UJtxrcyAf RdUVOgbZXlEtXjRlcCZLkYLvplFmohHIuF7NL+MFzcZHI9+Oy/od16+dzrbyggiChl2axc8f hwSi6jZRbck96v3++3PSoDRoXxW+Q7rDbnzAwKptu1PTmCBqxjJj/bLyZff+NqtiAp/a2rq1 JMYszoMJy2db2MEEMtAtWjKdmEk8iZRjdyYbZKURGL/trUWP24SUDwUEfoRd/OheGLxHxLcP sNbSEaZojkKReVxu5bMuF8sQsT46MVHjbV+f3g4M6G2mg7daIJaqTTsZkfhWIERnnSecJme4 /AOUDzI3AzRksZZg5YJ0uW3bj+aV8ZOUoAj3Wz8KNQzMwbIFt+Tyx5PN+wK5rD+XDRRiQt6X iXEfEUVVmjFFKEnnOeSRMuhGbS6UToNyzjMMoZyD5JA5aPL7u/zsG7HskvVzLxYLF4QPHNh8 aMc1m/tqiWDXUDKZq2ixN6S1c9+YailnMoXBK8RLVvXv+eENg229iXrqo15vx9XPX7AK5Ccs nl8h/Q/o5IuE1cKYdJ/2SU9g5L7c/d0Skpy2iDe23ogyj62miunie1TDQM+6Ldt7bshNbtlr 2Gu8Pfip0N76p5fcvnzvmjvXfSH4hdD9644YjhoPBg+Gflb72ZrZLSe2vLzl9JZoRPV3KXVf d3KL8ZuWoe6BqBCQulNDUSG87P0qw1av12e1wOngQdLAvx/0QCKhM/soIG3UwoFkG5jJPpx9 Mitlj7AvH9pcmoKxhV01B+3rmUGg+cmURMYCHcNbHJLCvlpoeogNUUWcIVRPGBgq09AZGvEx 3xFm0bzbLWy3BR1UQxq11E33L2PLjkgdmj08JFfDbCQ8hao5T4i/Rp0PqzSMRIMOTTaZwxex i8pl1/APpXbIuwSWDWFYateSiBhsb9/bPtMutYdIvrbbSey11xsVaWoD20D35sDYRufnBxX8 It9Cu6BDwDEMsA2YtoshgjyrAWhY21tg6wqThdnCiYKh4KQ98ZWOUkPnTc1DumnhBnVL+xZt yz48c+MWOjRms9e2OPd+cQVbwb04KzrUAHMFJgPPgtkfOfuW5qbjAnZSDAL8GhFrekLz3j/A BpD7MyKJIxIjoBTKluCRhuM13uKsaM9w+546j9E9StdcsuUH7GYhxeRH9pAPloYFeDl8O7xz qrTzpFLaQZshA/Q03h3KSZ5KA47UFAoomAARMaCcIqQ9tIydCu0PUQEpcfDZ1EspEXIC0VAo ZQj8H3w2+1IWW3aSa5fMdnCchfQooHkgRhA+uXXNpr7lmXosHgwxOAY6O7o6ah2SaWluXa6S bc1tzG6IsdgiVC1YUx9WAYEZUIXFxoGYMNI2HBMuLm1Q2WBoRYyN5jfF2MZN8b4odo8uEtZ2 DKlszVC9WxOXqeDjSwz9MXZh9aKYsL54kSosDy5DvUdcpe5i4n4m3dmkR1HpG/xRYg/9AYRN wm4HdzZpckUBjdYB3KyAIB4BfhO7jrGF2ChP6CE73ZRO62Uf8twNRC4inm1MFjwltVL2Tw8/ iumhVx5mzedgg1EgtrmG9fqGS47vu33iRyUnKnVJrtJNvce+PriynEy1xyZ/tXh8+0ceevep O9bY3HXz1lqpwfxD2wZrI2uvWN41/061vW/bEwe/21V74H+yC4ufG7v7mGY0WYMR2WhaNTl1 2Jdr+Nyq2SAZrY7Ji3dc+dlNnd2hUPYC65XJjmT6MvGuG2/98qYLdt46c8kF7/1t1+Zse2bJ 7lW1QMAAoY/qPIL0v2DNdYt7m7Ix3guhB2im7Ja5IJRDGVoP8UAp3KLv8MAfOi/rmUMhJ3mb QzmSlkki9lyqVs8DQIQCPeJoip8j1Raic7QdOfuXg7QVnbe5ywodfYyh84bmosPb+PnaGKww zCb5e8yc+HvUtv29UMAnL9QgeF117seqdwt5d7yM0M3AKQS2YAfy/CMQZdMe5H4n5djTnQg0 kFUIuxAGIonhBW16cw3D2jRa50v8Yr6Gk9Ip3XmZi1+Zi1yZi2W56enim5q+r1BvD0vxPVN8 c4rvmcLdnOaeX3Qw9RuYDTrvPUZCvK2tt6cptbnQbvZhQ5YoPAczEt4xGlcg4qhW7UWxULl3 AnqzK+vKTfVO9xr29872nuiVSiY20jvRO0mbtF6mWkLFBKJ+KNPW0lZM5Ida5GJCGUqnionc EcmpVdL1fGVpLVEfZGq+W+B3iSiI263I4VDGOi2z/TJzyZPyjPysbEDE6QkNEc9UppJsG2mb aJtsM0y1TbeJ+9sYpeXOtp1oM7RN9HwD1iEczWBCpFlCA6V2IRCEWKu7ofvP6OFzVuGLxIwI ekRzMWM4xswWlF8h8dz0lHHHMOVXkh/DTfJYd8liyOnZlRhtFFkl2WzmpqE/VYdDY2GjOZ9l w9s/ufTCyajXKbdr80v8WqcsJQfbOz4y5G+smO9bnPaFXMmIv+pkHuO9c1fcunzjpdp35v9p E/xshF1TLmSDX7ysWls3H7usksxkvHLvRmmxbj1SZKYfCzPGi01oEZuRmaNCBoIgTiqix8HJ 3ZHinowUB6GlvCHJCgnCeTk6L3PCR+d5PpDQ+dVhonurA2NK5/jo/J7vRaNsYbg9f4j2Cqnk DgmuS21P7YYYbtmOMTyBgp5ck+VWO41GU4vJC23weTD14+PKi7opCfLno+A4hgR4ZgkDgZ0b CQ6Vj4EUX9J5Dq5ZA2cHdZYu1TtauKfHNKqRq2ufSaQfFeBeaDF76fbe1mI0kpDvnXbw8QBo IsjewccD3Zk+HtB5m48H2sLHQyiUSZ83Bnj3OK79xeMDx0FOnG74UAhPZ9hEZjIzndmXOZ0x qpmRjKjRIkOCs7OzxtvePr1FjJOvp7O81SrhSA0DxDvU4igmPBgW+fBSNZEatIft3mncSgOp THaz1yNPA0XUIBl8YFmdGs01UJeutdsdYUcmpJUauHBEcbr7atMhNhJiVGt2GuUWT4eMoQPp A//IhwNdNtXppFS2U7qaCnMMt6Z7SWgo6CIKpK67hc+rIuQ9R9ecrClS2UJ0XWxdtKi1tX/R J8IdS+eXLatEreZEJFZwMp/xXvqiv7V10XxqTt3YACFH+kfZ5V8oq2FXZhJRhSvnV7C9xr2g 2iI71uTztoKXG0HeJL2/MweJQfMOETI6OuGh84Lm1elTp22ZbCYHrPd5fgg6b3BaReffOK2i 84JmpUOSgqmYJ3q1F7AB6lMxEP0VZqw+dZy8dsrzx3VGDd63QJilp2G7HH4owkxhVqInPdBT d5QOgP1ppZHSdOlbzm/F95VMKlamSpKCLSdKUsRSyKtL84nCYJhuyTTqjVhbw1G1aDejqpkT kRBUEDfjl10zvPDU1Vp/q/6aAQ+TKqVgMIL3q1Mtd/3RKAbtZpLJaZW5VEbVGU+rkqrSyeGv /DMsRuygHmgt/XOK3jkHQxPzOwc+WX7V4CvDZ/D2oWxBPg0M6J7e/abj0YOc3k7tHEPhtP5m hTlPqVkwkzNJJZZwuuLZmCsZYwknogoc3KjbLxATOxA0+yDBQBlZAHWRyqHjTJp0Uyj195dA HlPP7NuyuQOV4tyXp0KVwPvUs5d/3Vrqn1ff+9DrJy9Ipzsd5k3ZTX8vfua+UopTEKPa6QY7 +F6P9GSTfkoRqLNIA+VLHabjxmiH5cyX2EIUEKAldINXOY1QRyvRYblUd76SZE31gOeLpkxc Yahw+V8JED1CN9P1BHR0PQGdNyFZ+VfzeuZ4RWHupCEnByNZaOr4IdBn4XFoCzmhDtrzdHNt AUlvuTBeMy7QDpI8DJQY9kPhzt8/IpvwhkqnSk0lYg6haoSrgPzTlQZSI0qzT4NrEmABqSIk zAh1ENWOuhrJhugxKQz/P2f9gjxtm7Y/6HrA/aDngeRM41FZboQbka3KVvfW5HXKdvf25IOi 9fXEqaQ4Zf1b59PS067XxNdcp9x/8lgG3JgvM9mrDjRWuHbKN7gsVbFVUbNqrtpAJEAx+5VR drGyQTWklU1sk+sV5c+KcbV7VfJH1h/J/59sDFoDSjKeTC4XL3CZbG6X1xGxx10JZ9K0XhpF NGZM2eDe4DWFXfF4IrleNDQDD9VuSCpQMlMkOY8iUsJtKH35cbBAGRkKdjt+uqndcKdgCk// Fa7XoHOa83F0/sL5eKXS6G3ycTwvHu4jfeY4BBBXaXgBZTyyUcXFRNQx9CrhZCQRrkBVybfI ojUhk6aST3fnq0vrie5BlHmzge9k1KRPZaKahG7YzkQfspXgfVWTXmbIiy5ZUUJyjyAEj7A3 tLUh+y+RGG4CxwyHQ7Kt3T5lF0/b2Qn7y3Zx0j5LMZ1gcAYIhkgSuT9QbYRMtSpUFORCUCKE caTCpirTKDY90ds4wm5+NPUNBNkxtFERFQMb2uWFyk7KIiMPGjxtC2oOXG40ksN099DciHBQ SYnjoAnjwvPJqCNgh1BTAuiwaL4EMkY5dsxsHoNQ2LlzB4V8djYhLgB76vlFCoaND/ZKsoCs JXziGgiv4KJMIaATGzZq3A2X3oBl0xrisLOPoFwTEesCyXIgjJtsFnjY8wCtAYVo9nKbhvQr MI4aJZDqVcQoUHS+YrXutSG7JZVj91780aWvv35FS3smvGR+WS5amP9DuDI8X1mR9ttcTjXi b3UzxXjvezueG/TY7b44ohdiZdFv5//146mqU85kmN8b7GJXz58Y6w2xTMZtC6Yuki6YWRl1 pyehzSyGhuUCp/Gzv9c5zVEhCPWC61c+u4mZm/45zjMY5xmo1go1mxQfdP7ILQx0dBUKnec5 w0Dn3w/x6LjxCTAHCz5mTE+Jegbec3FxMykepU4yJJqDn/Ry2AwK5NI5XSnv5VqSz8dlDcIE Ambt5YpO02fHhQhdlK70oEPMi4fGdaXHbkdVaO7nh0lCiv8AjxkRT3lsOjgbPB2UkEs4++jA ihq1Wl9jUY0FDzi2dY8EmRYcCU4EJ4PTwX3Y0WwvJsxDLayYMOXTC4FyXJLZJAss48Bv89NQ q0Xqi2rTdjZiZxP2Sfu0fZ/9tN1oPxA4T23R1feB/nPVm6noOfef8fD1B3WTBdXk4+HayvmB gUrEmQxFCiiQZ7z33aUbe+NcD5G0B1dSkJpQq5AipnZ4wTZJ/9KUIsExbm2OcR9s0M1VDPfo WgBDdX6Pzh/566MtmovecXuJ71Xq6FmxsBc6+l60RUvRXiuWrlzK91vKCWUpJ5Sla5GsKI6u XTgOHV2+oKOfAJ2/aJAT2Emm06wt8cNL/PASpnQHxoqIqIeXK8H6cxrHEffE6MRYhxFMR/cg ekhLOkePm5/Dzc/hhv7wqn4OtZ32wfqP9HOorXQOrP9Os9E5KALJ198DjeI8aiBc7Vy+ihQq deWGUY32qY6ydaPbR3ejcuxG08qOULZsAyDLqCM7UN6RopKl48ocRNos8J7EDPC3oHF9oNsk dWwDvVMsqgSvNVkJ55zWWj9Oj7PbzEbzhtGN5lDHSjdXm9wqD6CqJW4El/i2Us9SvraUry1d i/v6I5cUqroZz+kdLkd4h4YGOm/xb3t6NuMdvMnHCzr6CELnHf7t2rVjm5sDB3ENXCItFVw5 /+C+IHO47QD/lnIKHHW/A1MtPQlIxKvCcnyq+LSfffVQJARcc4hikPgbi2qxmvnE2J8C0hTM zjGythFRnB6DUa0WE0hNfu9gS08x0YGOZmtZW0ysHGpxFxOYxcJ5MF0qJgD/chxMLy0mVqCj LUmP5oeXbkiMDlqKPcNao1iwCObsyo2b6MVky3bZZjYZjOaVK5AQE5THoH2i7FuqXWWT6n5V RGC2rrl6ipVSpre9h0327O8Re2hbYHjT0szatcnhkWFxanh6WBSGlWFxGOP6sC9QG57YPHZE vAQya3foCNt2B1dJmxop7BCyy1GBmpvnF5JuCuFFfwRf7UdRQBJgC+jVhcrteLpNm70FhbEc 2XQuY08B4uVqcWbPt9mB5UIe7DiBW2CJk8n+Vwz3pizhXnWzOfg+H+EihjYj2vb+1vM12C42 ss3T9uGujbf5r753zeodqYBD7l483+9dlArKhmh+Y/3ataLo71sx37G2YTOmyuu66+vbwh1r 5hcNdEa4npt3MV9JfGObK9e6bevNa9aM9t02f+NGNQADP6ik3SPs05MVrb7KVppfw61+SKWL sa1Di5d75v2XdEdRdmbRKLvsvvKCPmyH3+z/ByfrEs9xsjrnZOSIFkc7+NJpcQXSxBIqtC0d zxSR3Ich3ayPwvmBJcDda808BI6LgN9YZ37o6BBOdN7UcjTeA0KcM5M4P1GcnyJe5N61Ilec iwsKMjqkonGwvs7ksOUvmkxnKQoxMQOq/b1m7eCWWUeng0rJUvGfFnzgb9OsGVem0xwp6yix apU71xSOFfuAhw0BaqIUzlSIcxzji/NjXdpl1QCJSt1H38H7/AI69PO7MpSaZhq1cE5h4VzD EuDwiwDfFACgBPCMACAtcb5nnG+I8y/j/EbpeN6hH0LnrcfokGKxXmuyi/+rsw26aV8d3jZL ncZ/e32kPoGScdN1Y5uBabw/hbX9ddP++om6uL/OJupT9dm6FLcEigmX7ngrFhOZoRZLMeEc SseLibTueOvIty5tT3QMxoR0Zxd/opl02uVyysFAxjxtYfstzIUA8IzlWYvBQo43lMqMZ1qT xZHiBNU+mypOF/cXJaGoICee5LgVA744UdOdbxy59v/mfPOEwpLJkA1LwRjDVAbGyMIwhmmJ AoKUz4DaFuR748OYwJDB/+Z5wzg9f2PTGQf/RBdb85XPrrlODThtHRfML/JqXbJh6fBNN9qc NBB9KzrgdYvp4/DUj9Zs7L9t/pZNyTD3ubnWsZt27fjkfHw8EMdIW7mNbfj6qgj3XIBpAw+J ceYS4qK9qTPEoAbSgLJz1FDTplMIDG2PIAh/husL1MG0Stho4LsZgsBLK1nofBQh5ZKw6Q57 H1xhpe9pvwgdHCWaihh8nOJ8dpQdgAYHsY8lTg49gLoGQ8JuT3KQBBdFNAwgi/iPUBh2uWfK z74ZOBzAVMTWY/HfWk2eP8hslXV5YJP/DvYZ6x7Xb6PmpNZZN3BwxEySPe3/WUTUkmy1ZeFq PPi5Wa0E/X8dSNHATtByxDBhmDRMG/YbTIY3qFz5gGafgYlzDhdAuGByzJbW7C9ggviRiy55 xJ5Y/UjSsBqzCz5BSGjBgE/y7CyJwGWb/0mISJ1IqPJJna8pr0XPW4V0QCI3jysj2NPN4h7M UCAii1jOmnJul08V4iyisoAVvZAZPa9DUVlUwsJvC6pC2IgFcQjd6UU9JA0DCQxaA9UBf6C5 bxBvMN0q3+q81XNz4IbQDTEL8t30TDdrTHE3ovgAhXH6EZseqAGJ6qFaeD4oDNONnH6KuAAw QDZMThROfOLaG5/d/eytV+/65fr6tRfMfPLyT1yzUnr4y3c9/PH3pr5+z/c+8V83LR348m3P zP/7vh+f+cwEjI6z/zU/JP0AtJYXGmJLk9aKizjevlNuJQ2MwgFYhrxhQZWKXs6DvSqH20O9 +Qv3caDzHue76DRRuKpUKHkMTlOEoAMo163ZoH5Uss7uMZOZ+8esAufCAgN1gsMinoGIBhju +14I4AiAywV3BbM9/r4tclToPPveISLETploEog606gsL+rD1XG69XIe6cW1kAzg3qs3UWqH bH4VexVMThSWDztxMTa6GroAetMDih6GoMJQ+EUwzxPcpAd1E1V/Ql5EUJ6GslrZouxxG+4s s0XlgUVrylvKH3F/pHy95Rb3LeVPWb5ufs3yX1ZH+6LNXWO162oGbRGrWqRC0eOFWhW+s8UL 5SqfFvKpdfkE5gj0lAqSoYL0ZboSEQkOTls45OzsSMrTsjghT8kPy5L8uiqidvzVWlRVRwi2 ivA0wT31YjDG1EQfAXqpsiMVDVzA8iIBHre18xxcrVSSnFTtGIU/QNFqtW52WLK1nD3Xnq2b O1VWdWDRZe1WWYetolKQsUm6YJQ0PwoQa2NjUrbLT5oOQQb0cCDSjZvsMgBNaIE3GnWGCXN6 YeIokUVyK/eu+/SlO+6e/M5Qd6Ez2Fgzr4Z78l6/kk6EsqxmdX50/bYlF12qbW6vZqTGzudv ufy6Tz136sHdflfb/GuXdSWoiJKtY5t0xVh7yLl7/jvb032bL/zQ0V/vuDCEKQ6B0pzHXJGg 5Thch881aTmSA0nA9eYHtgspJDClE01b2kk2CUdmOvVKD1wPwdaXOS9F5x1uOjuNRMEwnTXF HDe5Ep50NmQqjnlsZqdON/B/QPN+33ie5RSrE81stJVYaLSV6DDaSjQYcUUSGxUJOROkcquh /EibqCGp4muFfW2G9kh7aqC1t7RO0SJaal3rqtJm10hkLDGSugRole3KFZErUttbb1N2RHYn dqR2l+6I/F3pIdcXIw8lvpj6UuuXS98KfCPy3dj3SkcDPwTZ/q70RundUqvadn32+sJe733e +3yzbeb1qIcIyE/CnG9a0NGQK5GU0pEio9tKZzEjEOaawxRzyaSTyK6KmfKmmTiBYjwPM4lZ 6C7Y67kOxT/iF5/0P+v/E6YT40gA/7LyAnaS8ouRnkGxMRpPHLdyamCO6JEKYnAiDGUK3mAm mANc0otFNpBWWd5HEEqiPT18TRnAvcBmgX8SgmVBNHNaQ6SafMCE+Q0C4NsMknHAb7d0bahr aL7T2xv3hbbcvfqOf2a+Hzcmcn312/PbBib3/eP1iy6VHn73Q5s7Y9msYmtA9b1u3Vu/eI1l VTWWmauy70Ne//Cpo7MoI8gjxuJjoKwCO9Skq0Ir55GmZNCd58ppPpRkTVP+fMsXgQFdr0VH 10jReVNHSCS5YZ7kKiy2ws4iTpuEXxKl68iZG0Jdkd9rznX57fndeSlfMIfsAAgNHCcL9xTs WzzYDzpsKcpF6uj7zFJL0+lyOHa7dTfqzuAEIROulDNKN7dg3fhtYuOmUXT+yI1Q6nC8VTLZ WnxfmQSsC26b403vJgVskdME883VKXa6NFFzfdJg1lrZ1laWJC7H7cU703kEKnKJ/KAg21rd PlVhhhBNH9VQ4HYdwzQdZliEW00MQTZTJdnKWgU3ghBJlU2p06ooqAosxFmA6I3qRJGck5S+ rkcd+pWdwJdzygKy49Q4SIsX9WsCc4nIgH5CEgwS4Ui54+nhC1ZXU8n77w6/tdff0rOqlklv 8nv8be1exwVL5ksrWsKyEQVrk3mZ+aWHf/WrZeV893Jf8bL51WvzUN4yAW5PXblvcYwUONDL trMnxd+AXjoMtSa95Ls4vXQhnwdVFBmPlTIeK2UulI7KI/tRHM2n4M7U2Q86Z7ROogdXh9mS d6UMnpKR3WJk16E6YLbKGGs1h29KsCsxG0NWjbAJlLsRIx5gaoFShQ5URYtmHJ7ZAVL8oPcd f+648pwuSc+59TpTrrzF0BpIeCpGsbXDrJ8m7FljZNcaP24UjdlW82CCbUt8DJC4LKo80hW+ pYFhmkZdrq7OiAVzUsKKyQMtaBrN57s6ObUAc6C3x6BDjQPfOz4Of+/4gHKMZ13hooh0itZy uCx6PBXN1igjnynkG7NfkntQ+XzGKJuR3FSc6JrsmuoyubqOMFW7C+zyF45fOI9ljmX/Nf18 5rflVwyvpF/JvFa2eQbK4+W/adtV3sv2inulKf9UZCo6FdvTtrfioJoTMkrOm2Jy+ZmWn6Ut MSng82CukHAxWr7fer/8oPq59OcyNk/JUSgPldd1be26uXhz+U7nt9IPd70qvRKzFy0dCeEJ McGSrApP/BFWOiA8gaJAEc3dGkqEn4gmIskIUyIqXgB9GX4CEbiI1uLxIC5sM7jyvDEm2E+F SrW1A0Vb8FAjnwiHQ5TA4QtU6cGKv/Qw5iEo0p8IaSb5NNskzeM0ibnnJGAtuzVUPA5XkkCT lWfybCI/mZ/KS2q+PS/mf8BUzCimPqJjYzE4qLIDRybMEQr2bAoo2EYV2RQHzjJ0CSd7Et9D 5aF47cnzSj5AK5Vhp2UcNp/DYVsoADGGhFWq+7CT18nX+7yrB1QOVlSro4YiJJynxwrFpKq4 TeakG44TU9ESwxAGDMpcMMao7gNn7GR7UaWHd81vK2+73y2g0gNSPqjMw2YtPMNmxBlpxvaA Y9o/HZmOTsfub7kvPdNmp/KRhGUijJZmq6armXvKD2YeLGMGJdyc5i6o4Ya1gFJjmtwQ8aFc 7gNyA4bNrBaWGxVsKvMPsiEVlC5zqrSACglEL2/CjQyUAsCa4cCgxo4GiSflZl74AZR3oXMh xZxpSDPHp6x66JjTgCJgN1dDUhz4HQed4LTmceB3HNgHH1TMow83Cbgx8NcWeDaUswc5l+Zw D17WoonO5O4iFLWAAOS1W4Db4FPhBmm9R5xO5W66dMVGNbn1s7944oYN16X8QUcqFfvyFcs3 XT7/721tD368e7jLrXjs0sPzz3zuI0NtvYViZeWVX911f0KOsJWfufeixvLLpvsam3Z8Kehy hsDDfGf/U+w3PIXKY3NNHpaNo8wy0lMQbxZHbXbugLH7vczo5V0vF2TeBbQUOme4cYDOaR02 5bVZyq6AD5N5YEp6QCkGjs9hcp5Tx5o+2hcXsvDed76Gg3AqwQ3Cl1TDZ6GPd/sq96bijeid MDqaj/aYRKa6K8r81/jYaiAx6ec0kCJ+2xZlRm4cGLkzxciloBEXSPFVxNBxpVz+oaNH+DAv b+x9+VfieQADcyfGx2cVQErGFzANeK3IfXHgApbaG1vZVlEciN/vvj/8pP/JwJHwq2HzTJzt iSDJap1jq32r488heCL8oTzKPfpD4YjEaOGLYgorf3vzaiXMNYVAT50uOvAs4PekY13li/5S sFHcr4wKofZKNb4fST2osWswGDO+ES+bwoS3KJ+13zvrPeF92WvyTsS+C9SkbhrAMqB/45ia D45izMqDOTBOUj0j5RS+OskgPgWunekV30nn38kxSZi2F4oXkVkX17hQ6CGNuBncm2zo+ee7 Cqkl7nx6arCyufXve65vCxYNT83/y4q5748tKRauuLJr65Xih1OBa1blriLJKMK3MSd9HjO+ tzepKpDnPkQwNtLQmU0tNCMCTX1I5RUvYMyd1DEZaoTvGPHw6ANKCurgPHR0WxSdMxw25Mks mJ7OUNZkU50hU7zsRCoIxvAhgmZYZAGYjOOwk3QVHpND0ajUq3jzzKrz9KhNZj1lQbLINtUW cgIejrPqp7Q1dWLARKAZc6JiagRqIPlSiLAiMonHiMdiyamc8lQUkCdzNIerfYvTHjo6Sog6 3O/v8eRzTdrjfn8syOPP3f6lWXJODIAIOXIO+iAM5KhWZ3myKtQ8yYf9eUPN1pPsU1clV6nG iMW7jizP1LpENp+25NlSc8IyqNqyccsRtlzzysiXgkiiR+SUbbLNluLpUk5hP0Pdpkk2g+pG BkzJAoicJxyB/3bEO+0Vp7DY75WI6NQm2YHocj/SE6jO6WkAycEOAPVR/Bhud06IsPTPIeV0 CEg05nLHXJEY6pBElTjyqQkjR4lTyCUlrkjav54XtUCHgMWZ66kmdUL/z9elK5ETlcw7599s u/G25cM7yrGeVWzp2EDpo2sal0ifn/vNDM+G+tHUBWOfmWL3L+2Msuzcg1Mj3WtF84U9YhY0 6gaNngKNquJTOo0etlqFiMfEZx5zQy9X8REBogBuG3mNb7wxgBg4ryvSRBh0hGTM9WG1tqRw nM3Hnb8+r8nN7T+3xyTyLRjfKu+odJ7jpff/42z04l88Do8EvVarZ728ObQljEn7qFhmHYVA Z7XL/XVf2BdJW1vklFv1ZEJqWI30WRtyH0Lu9XBfZMiy2jooLw8tD6+OXGN5yHK/9R8iD0Rn Wr4tfMvydetXw19FOZEfIinosHw49Fj4B5HHo7Mtvwm9Lb8dejfSNmNFBWLCmE3UeFvq0NtE UW+R48e35/N6m07rrdvNW00Lx2qultsEmgNx0nib+rfGO9x7W6x9lppcQ0bn06bZ1AsR893y ntBdYanHsyokekO+hFeIqgnBI7sTGAV3oqBIJKyGwuF2q+xDXZFoJJKxWtDDVOgozm2BSub1 QG0STJGwDREgiKetMkpjZoDnPCw/JxvlXVYkbFytKZqpus9y1PIrlGnfZQ3fEKHCCCpNWP+o y1Oz0n0ChE7tgc46NY/Z64J1FubSEfbkYaWFTaEQa3Mvag+7vLUUMdYwcORUS5/YRmQu9EoY bDV0JnKK2p0hKFpUL47+nSLuiiqsHBxBtUGo89cKgUCiENCCTkh/nPRLjGoFHJJVVPgA83r1 MbTWDPRlGAvQUuAEe1mTvQ2LivI1+ECLIPQDKRPILqJSuwTL9nq5K4aXAEF+PxUFoYSPvJs9 HMsX/b95PmixoeRYqeZLx+YfL84fDRSS7k7p89mcmm6fN4mO3rjT6rJhsjR3YsV7b0rG7qpi tWC0OM6eNB7EaClLx5ujJZdKuJ1imUItTsGaC1kMhWzS5DIRmQ9g8gQkUJ5Xi0cfMyihCek5 SFwxFKOlhS9hJ4F9wuNAy1DOahAK/OS3IK9TuAFlJGw3IJ/Bpp+9XG5LpSptNHTAK+m3BsYH CArKC/+QX5FHaEi78FTwGrXYQD2Qh4HpzubVytbKNdbJymvZ1wrvZN8p2GmHA9463++ZaLKW qlSK27rjYcwTkFYqBjkXz5Vzjdxo8JvBb4a+mbPYsj2Znvw6YS0bNq+2rMysyA8Xhot3m6eU KfffZe8u3F2cqjygfJ52zj6uHM0eLTxZeSb7TOG32d8WTlSSghEzv/oNQWvWnLcWTMV6cJmy zD1ivNi8MXRxcY9tr3J3aE94T/ru7N25qUrwLuudwbtyksM6xm5SbnIbMCbwNrNZmZkxKpSg O6Go6VRCFYrlhOCSnQlXMpxIwKy/81ECDh45u0vTUAlTRb1UqzlTLPiKxQKoIZtvt1h9mM4N 2knYn5GzPlnOYv6J9lDYFwqFizmUxgrKGH8y3sPj7A0MogR749Ekc7lpTRGc0E0gBRUFBrwq iLQRs1hjFwzS0OPsI0IWM9d+Q3MVNFwssods6nuuq2TYVI8cnBWuKqYpa8avRasjYbYvzJ4I Pxt+CVzvs5kqhnf0MdWVRS0SxpN3kC2SfZwpALz5McLtmlzdmmNabormV2FvHLTuylctP8Aw t0D5k+FgYlOF0yghird6CIcW9mE+HThUR4psimbcUYoq5tzZX5wtniiaixNt57SmU1QlIRw5 NXcSBtCO5tjGpgg2QLyFTkagStGHBjsNdZr9EBKOVCx96HMFi1iAbmfRPPCcC1AVfQu4AC8V xDsLW/6fKwRRfSDOMBBR0MNYKNJOafOHclSqmwwTSliCNvvygThV6j7X+Gjt9IFgA8/y9AE/ X3vEr7MOYh865+D5HF4vuIQOnAKFNhlJc52lJZ2PONgUxPCxn9RC+UA/O7gqgfzSp3z5Bktt Ks7/qvgf83/Ozv8u3tsPfmJIxJLluf9k37urP+hEfrqEaLTPP/cWe7db9dIc6I5r3ntdXD33 mCSu7nKQzhhF3PkP4DC90ltNndGek0O1nKFNwKmq4DMH27yK2IvOYaEt4dYZDYIJ4DKzfKHH FEiU3uVZLrO9jr3Ove67cnfVnrc9H/xd/nddVlcFkR1bxg4You2VTnOsr+K6pNtQGTAOKAPu 3txAoVFr71ttW6esc69IrM6tLaypaX0bwxuzI303mHfbdiu73bsDu4NfMM8oM+5vhh7PJZxG l+Jyu8pJJelOlotyMVjtkzFzo/WS7pG+BSxiBtd9C7COdCM3onplJVcLyQahQveQqMTjjUql j1KPOEMDymOA7oRztFl9Sff01RzGJvxZ+VqtLgNF0wX1w2wO52r1Wlc969kbqAKeVIdaGrDH d4VH4DGqZrend6Nu8t40S4ezgDF2tb1VLOa7RvC0d9VZ3Wg0Z8Nmc6ae9dXrWXsgn2/vsvu6 uuyA0IWs9mBXPhu29VZzIVmy18x1F3KXkngT1Qq9Bghwt5ukcsWARMm2RCIuY5qs5Ye2Y0by ChLsnI+qYQZNZhZGYV0L7w+/HD4dNtAGksbhx8VuzN1iZlcfqFfy4AePYt61rsfFp5AF1ycO P5o6ztPAMCUZPKCoc4dSlAuTjY4vSFtK2EcgBOOPpsSliXCBQ9Tnr+A1uWigUYeFPI1d1dAb mOaAnjHmi8eD9iCrchxbFL6q3PYGemaL0o/54hE/2XUM818o/ccsx8xoLNgKtwfSrHixkwXo og1jSiaE4juPWZESDi8D+q9StXTE817VrDH3gAMBqQEI8FcfxQq1mhcVG40U0zRTEa9u6vXh mWAexYEiYI84w+nDrkZWdZHAf+GAixKNX0bTieawA184+BbyTuTglcgh3ziLD46j+uqkJMB/ wRu3rjJEHQ0FD8CNTxCuDAUFZTEzLFwkfirKTlwBEAxqoIvNooGlfVrz+hvdFn+jgHL/RXzc lgDNYP+yFg00ipobH3+jkz745SD9Oj50+AIok3jLB//+u0eEay+0C/+CKzDN+p5BCiad018A 4QzQJLB6iClPrImvk1naQwkEUfZwMZW2BZauWdWSY90dmY7RXSc3rGrMj7QBMn/n5wbb2uZ/ k4nmLpn9/tBFi8GYYsFQp9Ly4Q9fGfHHwZZCLTu/OX/klg4pk/E5g8HxY8e2uEN5MZMx+uI3 nX3vuh6MFTsyXM+AM3Wei51COy21SsLNeZaPw2KA/oLiQ8SY3LxLJQoPi7wrUreTdzvR1Y0J ILLfwL+B6nHy3J5vUySsJSHuc4u3YtoHATnUpvSt9Bsunw8RiloXJ11Sel4cPwa7kHQeHh7o aN+vAA32BIomviOEz54WIggoywrC3wQB+66VMgKdpS8URW+tEtjWfbvxDpNotRo9lrAlYi35 IjlrxpNBdYte1u2pR1d6Pmz9sHxN+EORK6MfLt9suUW+JXxT5GPRm8t75D3hLwlfst4X+WLp ceFE7T9MaegkpVK5tVVmXFMPk3pf7myq9zmLGo5E2ltlH3Yol0pcsS+14pDWiNUgW8pow9A0 LOmmip8HFWlOXG2+mm7EXTVAyDCFuUWL7pXZS/JpCpZOyn9CsHQXTTG01SpZd8GwdWrx0vPI ZnCpM4hT7N1aZtXyAObUDnfVvk2wMYKMofD+yfEdJ+cwHSg077kmVGx47mRJl+j0Ijj7wBzv 5yQ3BDexlv9jKT/MzNYUzmwHafGQqH9dFee6eDOQ1U2BVfKz9FC1Pvyzs+/629pSLx13my0t JdaaLYSs4fl7uh++aNHanvZUoyAnVmaWzj/mSoWVYBdoOB/PL5/vZH8pFjxWG+bfM4RSzoH3 /uaOuwfLrV0B15KxGfHRZCVtV+ygXsxEI10H6vWzb2tVj8UQMswYZhwzzm8bjhjMM0HmCN7g 6OgeERCC9KM4c9DpdV1muNj1kuGEy9y0dAtMCgYkl+g02hEy+LiRjRgnEDVot5sGXexjLrbV td0lYt50Gb4mMEm+wGPDf3p6qBlpFd5WlKX+BLm1Mlqn0XhQTtgMKHWakQw+STJINtHgYnZn 0EG/YhhB9KPdASjMVvj1gY2XXY+LSwQnyn0t0coSq8zgtiojDtbu0FAKS3JEqsGB4Dogi+0V VK5FTddwIPgVXYQA4z585iRNCQsCwPyWcIRjNiSeWU+LhWuky8QHtttdu46FmjNbNpsxYv1w ksE/AaXrqOA8e0KzgstL7VhwAIsDHZdGa5kAYdX/7XCgYSj4qPsC6nkbJj3UnT6MChohP3Vf PexH18W7j7jeV8iaHHGMYQYehokmYcGle1J+lgK1IPR5qe29F8SJ+ecu7/dGDQWTJMw9wC68 Zk1QsbHw/B8yUms43Tk0n33vuXRZvZpi5cukq6X1qM0dENqET2oF1CIwhILZaLLQYnHbClrL 4aBbsx0GcEOQkEAQcfH6fZQe36q5on37YF3+2OVMOqcw/Tdtsxr6HoarNVzBZJofezS1geap x8hCCJhmD50bbw6qAeQRkK6MB4r/nATo+eIxApXfzB0+F6iDezv71zezFZvXylaHo+wpLh7q WXbdHeKWqxBYs9vKgeLi4d4LPnKn8dpiZduitMPpWlxuX/6x0W3fy+X6Ll0SczqVRaWOVTtH r/mecPbswlNgkrAcuT7/KOCeqTCoKDCxVSrChh4n/fMp6Sr2Fp5VRFinxa1hqDZGxeoTDjs0 nxTDwzH2uYLJ4BTh11nro0o4GvsnRDFTwq/ZYlRzwHMYnhs/9T5bad44Ke5emsN8ASHBY9k9 4AEcW/Hm1dmIze60eSLuwpJka9+ya8cWSVdVF9dz9aTLZbb2t3XGcjs23Hi5Rm9z/pi0XnhG CCKD5B5t8UPRhyrfrh6pPlN9rWq61XlD8NPOO4KGUDgG3IvBlbK02kOHW7WMTTjs0ey2joFY 30gbc7UlgUKQ2vgr3gfZ8mNDn8uf9E/B8Uz35Qq3d5z/cumm3h6nunEYNqdO4j+9yvPf6Q66 vw/enn53JuP/Yfv1Vw3INoccCARa+4d7Lrj2LnblpmEZqciBoBuvunvwujvmj7U2xhfjRVos /aX2VTs3XfP9TGvbVYvSTofFsqTUvuIGvGyicP53NiVs03v/bbkC6xKQXybkB9qBtFMEt+AR vIIP8z8E8BxDQJGomOMEFSxhYuYxx0JRaMV88GWhgmfcLnSgTinKbAp1oVvoEXqFPmEQNLRC WCmsQrWLIWGNsFYYFi5EHZYR4SLhYmG9sEEYFTYKm4TNwphwibBFuBSlXA8Kh4THhJ/wa8Pk y6A1+jPh14XhZYOrBjeUNlzz0auuv/Cqmy7e/tHL/2Zk/fAGQfjf/n3migplbmRzdHJlYW0K ZW5kb2JqCjEwOSAwIG9iagozMzcwNAplbmRvYmoKMjIgMCBvYmoKPDwgL1R5cGUgL0ZvbnQg L1N1YnR5cGUgL1RydWVUeXBlIC9CYXNlRm9udCAvV1JDWUVKK0x1Y2lkYUdyYW5kZS1Cb2xk IC9Gb250RGVzY3JpcHRvcgoxMTAgMCBSIC9FbmNvZGluZyAvTWFjUm9tYW5FbmNvZGluZyAv Rmlyc3RDaGFyIDMyIC9MYXN0Q2hhciAxMTYgL1dpZHRocyBbCjMzMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCA2NjAgNjYwIDY2MCA2NjAgNjYwIDY2MCA2NjAgNjYwIDY2MCA2 NjAKMjQ3IDAgMCAwIDAgMCAwIDAgMCA3MTIgNzkzIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMzcxCjAgMzcxIDAgMCAwIDAgMCAwIDY2MyA1ODYgMCAw IDAgMCAwIDAgMzI1IDk3MCA2NTcgNjM5IDAgMCAwIDAgNDA1IF0gPj4KZW5kb2JqCjExMCAw IG9iago8PCAvVHlwZSAvRm9udERlc2NyaXB0b3IgL0ZvbnROYW1lIC9XUkNZRUorTHVjaWRh R3JhbmRlLUJvbGQgL0ZsYWdzIDMyIC9Gb250QkJveApbLTEwODYgLTQ0MCAxNzM0IDExNjld IC9JdGFsaWNBbmdsZSAwIC9Bc2NlbnQgOTY3IC9EZXNjZW50IC0yMTEgL0NhcEhlaWdodAo3 MjMgL1N0ZW1WIDE1MCAvWEhlaWdodCA1MzYgL1N0ZW1IIDEwMCAvQXZnV2lkdGggLTUyMyAv TWF4V2lkdGggMTc1MCAvRm9udEZpbGUyCjExMSAwIFIgPj4KZW5kb2JqCjExMSAwIG9iago8 PCAvTGVuZ3RoIDExMiAwIFIgL0xlbmd0aDEgMTI2NjQgL0ZpbHRlciAvRmxhdGVEZWNvZGUg Pj4Kc3RyZWFtCngBvXoLfFTVue/61t573o89k5nJJJOQmQwBZMCEhACBVEaSQCRaw9MEjCSS YEDeIlVQicQIBqRQGKye0yO2tfblZScoTVBrqojWaosWgVZLKbVHW80VX5Uq2bn/tWcSIdd6 vb/Tc/bMt771Xt/6Xmvttfa6tTc3MSdrYRKrXtCwegkznvw9jNGbi1c0rE6ms84DP7N4/bpw Mm0rYEyZtGT1DSuSaXczY86iG5bfmmqf/RFjnnBzU0NjspyJ9hOakZFM03jg4c0r1t2STGf9 O3D98lWLU+XZPUgXrmi4JTU+ewPp8MqGFU3AePIxHhuzetVN64wky/cBz129tilVn2oYs5xk hNwgW8Hc7GpmRkplBWwjY3K7swjzJaOcWGvkF6uWLHKXfkwhi9HdY9ueEfSyX57yn/2k+vxG 52nrAtS1GvVFAfo1P6lXM+Zin1R/MsV5erBElIon2MXWxLrYDYA6wJzY5bnsap6GeosQrgJs AnwT8CBAYYx7mQoIAwoAGkDhXpQFWMjAGf099Eb8Zqu95I+nA+lZx15DsPG2QGjjbRmvvIr4 +m8gWLEawfJVCG5cGQgtWrlq5aaVEruRbly5aW3mupt9/qwbliFYshRBU7MvtKp5U/M3myXW pDaFm7Sm001KTxM1Nbetycy4KbChLCNyK4Dzbr6XJx6fkqP381gX8QNA8S5iB222krMJc+xy F5/CJ7MpLIeHeQ4zsRgfQX3gcKy/h2d3ejwlT/FsnpXKyOrMLyjpRklWZ0ZmKuJWUSVrsE1m Z1qaUZLZ6XShJAMlotcA9XWaYrbLC+g4I3qNXmWcxehYCv82hV9J4aMp/DI9b9R7KYV/lcIv AoNG+mUKv5DCR+j5Tjlmv9xKz0FeduSGALz/KB3unFACuo4jkhNJRXzpycgBq6vE/STdyXIA nGKdeyXw6pLOXQKNPLDLIliWd8BqKwGOHrA7DNyJdBeFOhORnC6KdO7KAQomkXwQrP0nHO/q 74lP+U9vWsnm3ZbY1oQc27WbYmwH7UjYYrsSUmx3gse+nSjMefA+Orr39N6ze6W9CYrFExmh kngCzO7iKzvvVGJdfHnn00pMCOP6AxBmyxO8khFSoQMjRoI+4EDAwJ0OpyEQf2c4NxVJD5Z0 8xD3d0qYGU/vDCCNpr5OqwMFPjrfaWjJ+QMgE1M+3wnV7aZTdF/nsAjSpzp9GSWX2+gZetqQ zi9SuIeeRkN2+Wj6A1MBnIURFhixFvo55P4EdRktDqVwdwr/LIUPpvDjKdyZxP2nqavT4QIN B6gDQ9ifoA5M9ihpA1LVBqSqdaakqnVCqk9RK21mHpYDC9wseniSmmkpK4Sk0zs3mSDe0Z1t Ao3q3CoDjei8S6DhB+7EPA5RLkjOPYAKmHRGZ8YwwSVEgga7EHF5oAE5cbU1ktN3Hrz8DIz9 rAVa099z4JzfX2Jgj1fguOOc01ny94+l2MctFqPCh4VFRoUPhw83Ktg/DGSWFHTEO6o7JKNB hydYEn9zbH6J+iaJnjozhxkVJ3SqnhJtvxLb36bE1D9X/3nnn6XtbVDSMxkZJeEzU888eGb/ mafPnD5jun0Tcu9wu0vuSI3ZMnmKMWZLauyW0WOS6ZDR9YGWaJIWX4svWNLSxmM72+TYnehl E/oXRIW2TKsu2dJmi7WKAdvy8kribTk5CGAMl9/KJS5zhTnoEzpH/wD+iD6mvzMHvIvw2Tn0 CZsKqAZI3E0fcw9zciva2IFNdI5bgN2slFsBJoDESlG3lD4CPEj76CH0uZv2UAJ4J+2ibwH/ BPhR5qSHUf4I8HdR/n3gn6DNw4DviraA3YCdgEk0Bc4/h6ZQKX0N7fOpgMYBj6GxdCnwDOAr 0P5ylJcBX4byOPAMtL0ccBlgCiAfMCa+uzQ00R+c4PcX+73j/e4iv6PQbx3nNxX4pXw/u9Q/ YqRr1Ej36JhrTMydG3UNj7qH5bjCOW636nFYbXaHyWxxSLLiYMQdTPLm5EhXS09L/ZKc457q rnZLIcp2Bs2ZTr+a7vTKPueY0tGlo0pHlA4vzS0Nlw4rDZUGS/2l3lJ3qbXUVCqVstLqItK8 Vaxq7jQtjYDnTNOKYlVdUni2Vhir0qzVC2s6iHbUIlfjW7EWzNXkrV0cyFu2YGENNF0Ut4W6 ofxMq6pvu7e2g7NpGm3VonNqBIrPqtHCW7tUNremg9O02tpabWJVNeJsWm0sW2usQrWW7Fqt UER2ZteyKm3yLC0UnRb7ouemmy7M7Rg1okIbXdGgjamoL7+w4P8dNzqiL6iHAYwxEKwbWnzR 4J8nbrrpC2syNE/S+38VD4zxeR+i7tDhYjEqqwnVCojFtKAWh3hAVYoHF7Cii06EK5aVd9HJ JPpdEv0+iV5PojcEMkha12EVwr1s9rQqzTIbUL1Qy4wi8QISE5BwRKeZYiwDe78XWDS50bk4 lGeKUsb6/2CEbxnh64zpN/e/zZhpImIvibz/yiP2aALk/0onou1jbD4ovbL/x4h3szrEZ/R/ 7593Ctv9gMaTg4rZq7Ddj2kUNoIj2AvYRoo59wGeRI6d/SrVRzf7K3uEvfDPexQl9IMLy+Ev RoGWI2wV++TCfCP+KEIBnz93fh79ktg+NrCLfihZSxrLvVI7e5odYAl2akjLboy8h+3CwmVl 71MelrBt9CSlsTfZK9g7b+M/k+5mP0Kb7iHtRPIUflvRevChS9gn1MIuZyewAx/HDlCImthL hG0zewczfYO9wzazpylrkGeplkK+4pGZ/GhSo5Lp/4ZwI3j9HFv81XumUSRR8J/Vh2XkwT6k ZPnn80im5RS3+2ET0DfDPozYlGQ59GEldGAixsiiAHTNQhI7x94F909AK7rZTnYXu0XI06h3 KeqFwVOVZOLsH+DqWfZz9sBALaw0jMUMLX+t/8eUx0Yi/dzASF+OlSWC7wP2bGGg45XPbU55 LWXnSQv/aKAv/X0jdpAdZJ+y0+w99mtS2UHaDsqeY89A37ZD6ttB4UZ2PfuQSGfSM5hXNX5f 8ihZipjJxc9GtgezF9ayCrScopcx0hc9e6CPQ3TcVE2vDbEkxn4BO96H/i58fnphIhXfI93C PmIzLyp5E/N5hf+MbYPdbGYrjbJV8j65G6OMTv7i8dlXVJZOmVwyaeKE4vFFheMK8i8dOyY2 +pJRI0fkDY/mRsI5w7KzQpkZwfSA35fm9ahul9Nht1ktZpMiS5zYGApqwbKaimVaRlk9XHF5 VA1rjq+fvSpfY95QJOoJF+XXjk3V0pSYxtKqNB9WVBafVKuZYkOrfF2T8tQPImh8VShcocl5 +EdnNjRqo2bXRKLq8dBgeS261TLLaiKRkMbz8L8CRfjPbAg3amo18lFg5FyhseoaAV39ZyYh k02K1CKcXaMNG0hiof8CIuFN+nuGkPl1alc7HBll5RrzdTDHGY35RbWzk5jGSrVR2HjkqYgZ vbF8jXwfaJSmkf8qTOniIUSz05O+gAcVjcuiFY1LwdHG+s95ejbJ0Ui4Pdw+u8ZTFIpEDKKx EM6q6bDbyqJlTTbMAlsSZLAOmx05dpEBsazuIMdlZES4o2Iy9jMWJ9jnFeRWCFimxbfVIxIt B99QkvZ5CTbH2y8sYmiWrMRQzYiRMaZmKtPMSSLCS7V4g8a2hTvG9LRvx37q+vqYozHa2HBt jSY1gKgOJuVVNM/VsqqqFyALRADqm8NC3OVGIIQXrmgOtyMt6tYjjJaj6cX5jc1N9UJNqD5a jjJrWc2WSE8IG76aLRWaJ6Y50dy54c2Q1F4RXBoWyfb2LWFtHzZ6F5RGRB0oQXDsmHB7RRSj obOKZdOExPIHxWZo4xWNhnDi2xrCWsv1y8Az/Bu2D+h/pF3VHH+PQDqQD1oK6xAMFtBYv0xM ZRlaykDh9m1NxlS3G1ODvopNjwDRENrP5qH1gpqK5mgF+JkaEAxBeylvaNtIRMuIiYbt7RWC xIZGUC84g38GNmQgI5mATYRiBHrKtPhcA7G5hgwwYryhvDaVlaqAEhly0OL15bW1YlJJAWjm vC3KpdFwu+jUnKf5YmrkMMp6xo6pml1TUS60EzV5Wc3XeoOhXsSxjR7IpiDqtOf3CiaJkjnR qllJLWgW/BFB/dykAYNrKcmjaqq+0evLwdDLaDs9Or2+vX16NDy9vb69oau/5fpoWI22dzgc 7asr6sOG5RPyD20LadO312pqfTNNhpCFvk3HBjJt1kIhnunh5gbk4D81GpkUinjQdbIOPMcX F6fsDBoPvRd21q6+ixk74JFC4enCvXTBK4Q0dZIwU1AyrwZ2sBhDVDQaAewDLxE8JCxFqs2r WDonxaBQBEMaCiP83qxULjqJRIQNbeuKs+uR0Fpm1STTYXZ9qJPF82OQXb0o6Rko8c8TJS0D JYPN66OQVVC8xBg68c90Gv58UJ/bPVFvuEQ4c1CH/xWNWs9czPHcJM0CjhniTiurkUJcVEGM hyQRs8WwJJRq6TGjoeAJvGS7Gg0fjWpqTFPKanpCpbVh1QMHSYPKkOpRqKl6NPpLEk6U+VSN SjUKCLNicKpgI5x++iQUDjYMV7TXp7Tvwvmhqqjd2DxoR8lZwHDFJMEGNQq7DSX54fFGxVRf EtqeXOA0JW+6MCrIxuDYzFrNJRY7zfWuEWByobKaMNwQzHaWEQlXhJuF1LVwfbnhD2pDonwg u6v/dH258H81UDRUCaX0G1oOtqVsIsWGqrk1A7HZNbeHNtSOxentmKouZsVKKt54u6i/rYuV Z3fjPFhadB2K544JhyuWlmNAJOaNQcboCGLzx0A3herXRGvFSnJFY3tYKH8jpmVgFDS11+ZD X+fUwF/iRTiixWtDg9Gm2trJ6Oca0Q+aoHp7LXpYluoB2MjK70OlmjFV8FQjqmvgbFvKoejl woQx3R5YVY+YsZhI7SCloPj2pcEUzQtAc+1olC9M9gJdbUEXte3tos85NVGoeXt7qB3zSKXx wj80I57K6GKiCSZe0UUt1WgLFDX2BxXRSFRwvrYcQ10Lvg94KZyRfzmHrxukGy0XgdrrDA7X /4s43PBVOHz9V+Lw4kFKL+JwI2heLDjc9MUc1viIL+HxhSyNJ1ka/wKWLrmIpTd8OUubBwkF VUtBXrPB0mX/Ipbe+FVYuvwrsXTFIKUXsXQlaF4hWLrqi1n636G0qy/i8Jov5/DaQbpB5E2g dq3B4XX/Ig7f/FU4vP4rcfgbg5RexOFbQPM3BIdv/Z/j8IYLOIwrH2IcJzLKDLZEmUFh4N2A FwH1AB1wA+AjwA7AZvqULVUOsDpTDevmeOMELFauYnWyxubzB1i3+RnWjTfJbiWLzZcuY1fi PS15B8hwumzCeRBjYTYPeV/+cNwaybizM+FO0YJVwMbsaD/0ceJ8+P/ncaPyxW+wHua9qIM0 5mN+3AcOPOmpyGQ2md3BemgmneSl/IfSaGmHPF8+o7iUDcpx5ZwpbGo3M3OW+T/M71oqLTvR Cm+T4Kq4dpQwByxuc3BHacnHIgewqF2MHQWINOLSG4gDy8ASsPIGO2Qcvs1HI1k9hLsYExNx rhaMi3ginjwEhBrn41LL+RaFfcbicgtqLel/Xf6T0gtupbGieE6RjYo4lVqoVCZHgmWoCZPs aj1rJavf2yr51OO96qm6Xja1d2rvuII6PEou86gsEhZhXtijRgD8O+f153DGjhnR1/Rn9fNk 1vv0vjzsYmqpjn6qz9N/oH9Hn9/Nq3l1X0fffpxHh3GOcT/osLJrHjepGbmVuCl5O273BivN uBPwyglFXFLk5eRWKnF/sFIxyRYzybK5rZ7v5D24TuAq1/hpfpYrPL9uTe+RIy+rL7Opf4jF eqf29YwriMUixRGPUpznifgpTKP0k3wWjXpULp/ZuefTHnGCR2w3aFgPGjLYU/G77/ZRVRq9 nkZWhX6n0BKFpslUKG+WP5ClYmme9BfpY0n28zxezKXpynyFfy1wVYAHCgIZlRUmetz0mokv NVGJaanpfpOkBPyBHbLik2VlpkwBWfHL6XszvI5Ejp3s1oRLTma1krnVEw9WB3kwZAdTKFM9 XncEcKxX7U0vZFP7jteB8+mFVLdFVmNbbj88roDq1tStia2pYxDGGvFfU1dUPHHCVGLF4yO5 5uIJRYWy32dyk8kc8e9Wv3H7rRTTz33vxJnfvktZ7f+r8ZWRfMffAg+uuJEsz7+98ndz//jE nce2V/9w59/AEvDkRejHTuV/sxzWFb9zaQYtCVJtkKqyFmbxTPNo82SzVOAkk3+Cn1sdrizX GJfkCARGBCYEJCmLHNnLs2/L3p4tuyVXmourkjVhi/uG2RKFBSxBUmJYhjdR4CGPO+GTna3p ptbVobMhHopYM1bZNtm4zRPGDU09TrloNbXggC8MVqw5fqSusBCR3mPQQ4Mhfcd7YywzqF4F naRF19VdB1ZcV8cEEs/E4kBR4YRiNRItnhj2jI8OMEVVZI9PjuS++MY32x7S5yy8ir517nvd z578C0l6N63Xj+n66/ZT87auoTxsMs2/nPNi2ZM/0D9dPl8/8vzbsFdWD315FmeLNnyrsT1+ 7Y3OjU6+xL7ezhWZmmTKkO+XuWx32ndIsk+SZAuZJTvtdThk5nXKkkWxyc5ptu05bBPj1Yyq 2VGcFEqM2RdJ9EdcFPHVmLFUIGmSJEGl69YUFQnU+2ah2nOETS2a6i3J7+0p7FF7tiiDyoAK rA62XkwRT5E/6gGS0vqu4o+Q+9FH+ybSS7TtlLTo/EOn9Jv5Ul5uyFiHjLdiHgF2T7wWhl9q vtbMJ3vphO8tH69RT6pvq9IUT5WHT1RmKNxcYHNW2iwJt9vOElPpapi5lPBnuPbaJSck6D3r 5d6gy73DVoBbJopTNSTYQoq46HwMlkvp6vEYpNgn9Lr3sHAlQoiekvy+IzBTQ2J0gdByzbDY iBRmfiEr/ak7NiX0iRMmSLP77naj9xv0I/p760wnrrjvTrrMyt/6m/4L/dN3fvepkM8NmNcv obt+FmHfjDdmOmimf4GfT6f5xKdnzs/k4220wdpu5TODC4J8ZnhBmF/ihJDofh8pPr8vzyex jISbE+eunIQFznAqlDUN5nq1Z5FnlUfyBNrOKqTEM7IqlWgWa7Xnqsf7nhPz6z1cN2CtkNKa XhwtYlLGIwy1ro5gl5gSixqeM1KY7h8RzeU0HqHJ7xMKS/+27XdHSNaPvau/q79IDTR176kX 93Ue5qa2tSsS31q/slXy/FD/7Pm/6ifoHrqO7qSfTDg5Tz/d98h92r71//bzhwzZ4hRYfhuy tbNd8VVLrOS35lkrrPOsTVbFLeVI+ZIUlMgkT5Cny9IVtlobN1vTrSOt0gYrHbL+3sqLpZsl /ldOxZystltt99gk5rUoe02SjDXJctYiWZxMKVDiSrWyWlEU++2bGM58w4Ym59fV9R6pU2Gv 4EXP1AEWwEsZ3qouchmlEdyy30J+KvJvPEHXntelj/Q/6AcfOU+T6bOzZ/VdfSuOixVxB2R5 FLJMY8PYaLLEl69ndzOOCS1x0lIPLZVoZt6CvAfypIrovChPmGmvlWKX0E8uoUQ27R5G84dR Dg59fcNGD7MN28lG+xgbPYzl+GyjTcrwhDsjI6HISA0brTi8LKAGwgFJBDsD+wJyQCw9s3Ki lYF7LA53Vk5WfpYkggez9mfJWXEUZN0Tx1pWj1tyLxtZP3L1SImNVEfuHCmNbD/rIMcYd2RV ZFNEyok8GOGRdmbYSEzof92aVHisrhdWoR4TocebXmIsscBbDMtWXYfVLS54e0N51tQN6FId jSgeP7yoEKfTZnh5OZo7vFglnGWn1EhK6RIyRtLB4+R6/deffEql+kufvqe/zpfv2dBYd9Na 20MP3bZi9+JvShn3Pv/T1w5++/D+hz999uwbj8FmPTe1zr9hwRWVK/Tf351Yt3d9zZXLZ0Gt YFubIY8zWCuFbf3owCNmwvp8On6j01NZiyWP12aS5E3zlnnneG/ytnpNFcF5waagNDOTysJz wovD0s3uNjef7KYT2WSXQ3JMlkwZCYvF52KJq7HwSQlfRg4MLcvUGvcQ85z1cE806UskCrTh AyC78CfB7Ephc4a9gZFr+p4b9CfCOQ6xulhyKfAWm6K5WB1ZUdL2ctMMe0sy7ehT39//q3t/ 86z+dxr7N/LSRP1b+s/voba1y/fsWr9ys/34VRT97EfkOvIWXaJv0H+kt+hVcsEDnd9d/52e feDLUiyau3BDI/ZwY+NBeb/ipv3Ma9qvmLAz2U9xi5X2FxbEyFiv4LvVgd1UEXZpBFgqNifi FkU/KeWK0LDjuv7XlXqD35vj1yyUhJeaZyarmcjj8XCnO9vNHUFvemUA646JmlzU5KVbzFvN nO1S/eRP28XTbLvszl0W2c7UViUOM2XY2hZg0ZGtEksPKMt5jILqEayfdZlYSlW4ZiyshnNO Wi50L+me6/JMkUG3hWsSjr1fUeFEpf6Eflzfoy+j+2njB+/p7//sbzp5Pvz9qSn19ACtovW0 u+T9RfoJ/T39I/2YcSHDxY2lch7+yQLLXhavvN5Oq1SqllfLLfJOWV5oprkSLTQRviHxmjpN z5ikFW5y2rPt3Klmq9wqW3extLRdJDlbFesmFvcrq7iP3chxG28weJC7Yl8g3I5wPnjA7OQM 8ooKvZ7xIy+lGHXz26mGVuq36d/TX/3PD9+rn3ao85Dygr5b/yGU4MZXyUneY/c2iFsmYs9h A7kH9+5mlhP3KPcx+T5ikkl5bDW+2uQsv67vDz1QxXzsSNKwfkWxFj9Hvzl5Uj9pnvPop+bk fnMx+ig0+sBGfU7sELqVjU07POghvAiYjYRi7Oalwd08dMRf5In6eaE+7sIOOavrf0tOoD8X vq+8PT5rvkptbtqRRrV+2uKnGpns+DQsxqu4bEsfhUVctvvsw+0SPLrq5U6F+YMU2CsF3HZP wqo6mD3I2ly+VlM809XMM0xLPmdq31FMbmpvYaEByU0XW1QXS+24qC4iTIwXq96iwnSh1oY7 UqEj0vK1Hx8503/ip/fCfE7cuGHF5pN33fKbtylXJx9VbuXV/3hNit3yaoe+X1xng5PzMaeJ 8mKoqp/dFx/uwdc7zlnOV5x/cr7vVNpkSsgPyzzTRKagN1A5Q75G5nhxOBvPhCnMlGiDjRz3 uT30tOc3cCAel499WxXOPOxOq1Rd3+YBX8Kiqm4vWSVvq93hgWHYYQqYqjAFmAFW815ojpAl LCHWi0++xNuFMIg1MXxFKrbba/JMYhWHP4EqRbyRwokUUaO58sTfPqX36s9Q9L33T/VdM4ym JJ7om0Ptj3flXYZPlVz98C1H9Z/pRyro38XHCiRsgf4E+UksK+5ifihUG97SFNY26C/A9XEF wlF00yhT7B+vCR4Z7cwB8CjEfhq3BawkmdJM3AoHeTTeaHVUvm0/Z+dT5Cr5dfkdWV5nvcu6 xyqJgLv8zG/x7LVJwb2KSm4L87nanFIIo+KrKDcjm+RnPmfTFF+bP77JT27/VP/TfmmfnzQQ 50dxVrbfIA4sWrO2bo1hcjHD1ES0D84NDBOqUnS0t2jqUbyHgW9rwLfrsIRhHn7sggLpE4rC Gdinip05pmagbsrafPa2fd4Hfk9j9Tc3t92hv9naeoc88zdvb1j5tv7Y+b/yg8/29M3gBw// om9GigfyHkNPGrqZuf9k3IaZc7fXzSW3YITdl17JJa/EVdl4s8xG2i05jXnbmK3NylVM22tt xpdrTQOaLibA8nsMVY9hjrFFdZhBbIBw/+fUjtr1l90/1k/edu9mQeOhh86f408/8XzfVYM6 /Bxos2OHfW18sstCLpnucd7v5Nj3uNzkSiObkyS7g+x2bJnJpXgSJhWv3wFXq9XXKsWD1qU8 XbrAAAfWjKRXW5TcTuFlPOnTjDCv0DOwC+B36/36KzSOTGSmcfqv9XP9W9bfvOXuDHzTYCYb jddf0s/pH+i/7qYtB44effzAq0m9urL/Lf6ekgfPfHW80GZhiTRPggdcil1JWNxOt0m2uy1y mrutXu6ROU4d5DD89k5csWvyadkiw1CwyRdL3BEV7yu9iIkVRX15XIGwmAyKFhcV5/nFW4oP roG/t+xr+qaNG2nUO+88PKLYlEPNfFp3d+7r3X1/eRHHNlwQhTvjSawxGRsSBpGWQGvyPCYd PjCDZcImslg2G4GvLC6DVs9glfjmpZrNYrPZNUZ7wnkOVkI8JrRg18wuq62YGbvy5sVLGxtm rG1Y2dg0dtqq5WLEZC1RsxmwDnAXYA/g+4DHAIcBxwBvAj5CAxngAwwHjAeUA+YCGgHrAHcB 9gC+D3gMcBhwrD/1oA82GCfsqC9OFwxJjxuSLhySLhqSHj8kXTwkPWFIGl+JXUTPpCHpkiHp yUPSZUPS5UPSC4ek8eXXReM1Dkk3DUkvH5JeMSRtbDcu4OeqIeWQB2P/B4FS0lcKZW5kc3Ry ZWFtCmVuZG9iagoxMTIgMCBvYmoKNzgxMwplbmRvYmoKMTEzIDAgb2JqCihkcmFmdC10YnJ1 aWpuemVlbHMtc2lkci1yZXBvLWFuYWx5c2lzLTAwKQplbmRvYmoKMTE0IDAgb2JqCihNYWMg T1MgWCAxMC43LjUgUXVhcnR6IFBERkNvbnRleHQpCmVuZG9iagoxMTUgMCBvYmoKKFN0ZXBo ZW5fS2VudCkKZW5kb2JqCjExNiAwIG9iagooKQplbmRvYmoKMTE3IDAgb2JqCihXb3JkKQpl bmRvYmoKMTE4IDAgb2JqCihEOjIwMTMwMzE0MjEwMzAyWjAwJzAwJykKZW5kb2JqCjExOSAw IG9iagooKQplbmRvYmoKMTIwIDAgb2JqClsgKCkgXQplbmRvYmoKMSAwIG9iago8PCAvVGl0 bGUgMTEzIDAgUiAvQXV0aG9yIDExNSAwIFIgL1N1YmplY3QgMTE2IDAgUiAvUHJvZHVjZXIg MTE0IDAgUiAvQ3JlYXRvcgoxMTcgMCBSIC9DcmVhdGlvbkRhdGUgMTE4IDAgUiAvTW9kRGF0 ZSAxMTggMCBSIC9LZXl3b3JkcyAxMTkgMCBSIC9BQVBMOktleXdvcmRzCjEyMCAwIFIgPj4K ZW5kb2JqCnhyZWYKMCAxMjEKMDAwMDAwMDAwMCA2NTUzNSBmIAowMDAwMjI2MzUzIDAwMDAw IG4gCjAwMDAwMDMzNDYgMDAwMDAgbiAKMDAwMDEzNDgzNiAwMDAwMCBuIAowMDAwMDAwMDIy IDAwMDAwIG4gCjAwMDAwMDMzMjYgMDAwMDAgbiAKMDAwMDAwMzQ1MCAwMDAwMCBuIAowMDAw MDA2Mjg0IDAwMDAwIG4gCjAwMDAxNjMyODkgMDAwMDAgbiAKMDAwMDAwMzU0OSAwMDAwMCBu IAowMDAwMDA2MjYzIDAwMDAwIG4gCjAwMDAwMDkzNzIgMDAwMDAgbiAKMDAwMDAwNjMxOSAw MDAwMCBuIAowMDAwMDA5MzUxIDAwMDAwIG4gCjAwMDAwMDk0NzkgMDAwMDAgbiAKMDAwMDAx Njg4NiAwMDAwMCBuIAowMDAwMDA5NTc5IDAwMDAwIG4gCjAwMDAwMTY4NjUgMDAwMDAgbiAK MDAwMDAxNjk5MyAwMDAwMCBuIAowMDAwMTM1MjEzIDAwMDAwIG4gCjAwMDAxNTA4MDAgMDAw MDAgbiAKMDAwMDE1NzY4MSAwMDAwMCBuIAowMDAwMjE3NDg4IDAwMDAwIG4gCjAwMDAxODI3 MTUgMDAwMDAgbiAKMDAwMDAyNzI0OCAwMDAwMCBuIAowMDAwMDE3MTQ5IDAwMDAwIG4gCjAw MDAwMjcyMjYgMDAwMDAgbiAKMDAwMDAyNzM1NSAwMDAwMCBuIAowMDAwMDM0Njg2IDAwMDAw IG4gCjAwMDAwMjc1MTEgMDAwMDAgbiAKMDAwMDAzNDY2NSAwMDAwMCBuIAowMDAwMDM0Nzkz IDAwMDAwIG4gCjAwMDAwNDcxODEgMDAwMDAgbiAKMDAwMDAzNDk0OSAwMDAwMCBuIAowMDAw MDQ3MTU5IDAwMDAwIG4gCjAwMDAwNDcyODggMDAwMDAgbiAKMDAwMDA1NjA2OSAwMDAwMCBu IAowMDAwMDQ3NDQ0IDAwMDAwIG4gCjAwMDAwNTYwNDggMDAwMDAgbiAKMDAwMDA1NjE3NiAw MDAwMCBuIAowMDAwMDc2NDUyIDAwMDAwIG4gCjAwMDAwNTYzMzIgMDAwMDAgbiAKMDAwMDA3 NjQzMCAwMDAwMCBuIAowMDAwMDc2NTU5IDAwMDAwIG4gCjAwMDAwNzY4MDQgMDAwMDAgbiAK MDAwMDA3Njk0OCAwMDAwMCBuIAowMDAwMDc3MjM2IDAwMDAwIG4gCjAwMDAwNzczODAgMDAw MDAgbiAKMDAwMDA3NzA5MiAwMDAwMCBuIAowMDAwMDgwMzE2IDAwMDAwIG4gCjAwMDAwNzgy MjIgMDAwMDAgbiAKMDAwMDA3ODkyMCAwMDAwMCBuIAowMDAwMDc3NTI0IDAwMDAwIG4gCjAw MDAwNzk2MTggMDAwMDAgbiAKMDAwMDA3ODIwMiAwMDAwMCBuIAowMDAwMDc4OTAwIDAwMDAw IG4gCjAwMDAwNzk1OTggMDAwMDAgbiAKMDAwMDA4MDI5NiAwMDAwMCBuIAowMDAwMDgwOTk0 IDAwMDAwIG4gCjAwMDAwOTExODEgMDAwMDAgbiAKMDAwMDEzNDk1OSAwMDAwMCBuIAowMDAw MDgxMDE0IDAwMDAwIG4gCjAwMDAwOTExNTkgMDAwMDAgbiAKMDAwMDA5MTI4OSAwMDAwMCBu IAowMDAwMTAxNzgwIDAwMDAwIG4gCjAwMDAwOTE0NTkgMDAwMDAgbiAKMDAwMDEwMTc1OCAw MDAwMCBuIAowMDAwMTAxODg4IDAwMDAwIG4gCjAwMDAxMTAzNzAgMDAwMDAgbiAKMDAwMDEw MjA1OCAwMDAwMCBuIAowMDAwMTEwMzQ5IDAwMDAwIG4gCjAwMDAxMTA0NzggMDAwMDAgbiAK MDAwMDExODI3MSAwMDAwMCBuIAowMDAwMTEwNjQ4IDAwMDAwIG4gCjAwMDAxMTgyNTAgMDAw MDAgbiAKMDAwMDExODM3OSAwMDAwMCBuIAowMDAwMTI5ODM0IDAwMDAwIG4gCjAwMDAxMTg1 NDkgMDAwMDAgbiAKMDAwMDEyOTgxMiAwMDAwMCBuIAowMDAwMTI5OTQyIDAwMDAwIG4gCjAw MDAwMDAwMDAgMDAwMDAgbiAKMDAwMDE0NzIzNCAwMDAwMCBuIAowMDAwMTM0NTU4IDAwMDAw IG4gCjAwMDAxMzAxMjYgMDAwMDAgbiAKMDAwMDEzNDUzNyAwMDAwMCBuIAowMDAwMTM0NjY2 IDAwMDAwIG4gCjAwMDAxMzUwNzAgMDAwMDAgbiAKMDAwMDEzNTE2MiAwMDAwMCBuIAowMDAw MTM1NTk3IDAwMDAwIG4gCjAwMDAxMzU4NTcgMDAwMDAgbiAKMDAwMDE0NzIxMiAwMDAwMCBu IAowMDAwMTQ3NzMwIDAwMDAwIG4gCjAwMDAxNDc0MDcgMDAwMDAgbiAKMDAwMDE0NzcxMCAw MDAwMCBuIAowMDAwMTQ3OTcyIDAwMDAwIG4gCjAwMDAxNTA3NzkgMDAwMDAgbiAKMDAwMDE1 MTExNiAwMDAwMCBuIAowMDAwMTUxMzcyIDAwMDAwIG4gCjAwMDAxNTc2NjAgMDAwMDAgbiAK MDAwMDE1ODE3MCAwMDAwMCBuIAowMDAwMTU3ODQ4IDAwMDAwIG4gCjAwMDAxNTgxNDkgMDAw MDAgbiAKMDAwMDE1ODQyNiAwMDAwMCBuIAowMDAwMTYzMjY3IDAwMDAwIG4gCjAwMDAxNjM5 NjEgMDAwMDAgbiAKMDAwMDE2NDE5NSAwMDAwMCBuIAowMDAwMTgyNjkyIDAwMDAwIG4gCjAw MDAxODMzOTYgMDAwMDAgbiAKMDAwMDE4MzY2OCAwMDAwMCBuIAowMDAwMjE3NDY1IDAwMDAw IG4gCjAwMDAyMTc4ODUgMDAwMDAgbiAKMDAwMDIxODE0OSAwMDAwMCBuIAowMDAwMjI2MDU1 IDAwMDAwIG4gCjAwMDAyMjYwNzcgMDAwMDAgbiAKMDAwMDIyNjEzNyAwMDAwMCBuIAowMDAw MjI2MTkwIDAwMDAwIG4gCjAwMDAyMjYyMjIgMDAwMDAgbiAKMDAwMDIyNjI0MiAwMDAwMCBu IAowMDAwMjI2MjY2IDAwMDAwIG4gCjAwMDAyMjYzMDkgMDAwMDAgbiAKMDAwMDIyNjMyOSAw MDAwMCBuIAp0cmFpbGVyCjw8IC9TaXplIDEyMSAvUm9vdCA4NyAwIFIgL0luZm8gMSAwIFIg L0lEIFsgPDU1YmM2MDY3MzY1NmYyNjg4ZjgxYjlhMDgwNzZjZTRjPgo8NTViYzYwNjczNjU2 ZjI2ODhmODFiOWEwODA3NmNlNGM+IF0gPj4Kc3RhcnR4cmVmCjIyNjUzNwolJUVPRgo= --------------030804080901060905050506-- From randy@psg.com Thu Mar 14 14:10:40 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D87311E8228 for ; Thu, 14 Mar 2013 14:10:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NlGWlsCyBPAH for ; Thu, 14 Mar 2013 14:10:40 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id 0CD1C11E821A for ; Thu, 14 Mar 2013 14:10:40 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.80.1 (FreeBSD)) (envelope-from ) id 1UGFQ6-000Nv6-8A; Thu, 14 Mar 2013 21:10:39 +0000 Date: Thu, 14 Mar 2013 17:10:38 -0400 Message-ID: From: Randy Bush To: Andrew Chi In-Reply-To: <514205E4.2040007@bbn.com> References: <5140B750.2070800@bbn.com> <514205E4.2040007@bbn.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Cc: sidr@ietf.org Subject: Re: [sidr] NotFound vs Uninitialized X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2013 21:10:40 -0000 > NotFound: The global RPKI doesn't know this route, i.e., *nobody* > knows. nope. a cache can not make such an absolute statement randy From achi@bbn.com Thu Mar 14 20:00:17 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 96F5411E8151 for ; Thu, 14 Mar 2013 20:00:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.953 X-Spam-Level: X-Spam-Status: No, score=-5.953 tagged_above=-999 required=5 tests=[AWL=-0.646, BAYES_00=-2.599, MISSING_HEADERS=1.292, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EChc0RHI3OIo for ; Thu, 14 Mar 2013 20:00:17 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) by ietfa.amsl.com (Postfix) with ESMTP id ED9D211E8148 for ; Thu, 14 Mar 2013 20:00:16 -0700 (PDT) Received: from [128.89.254.117] (port=53781 helo=platypotamus.local) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1UGKsS-00011D-5u for sidr@ietf.org; Thu, 14 Mar 2013 23:00:16 -0400 Message-ID: <51428EC0.8090307@bbn.com> Date: Thu, 14 Mar 2013 23:00:16 -0400 From: Andrew Chi User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 CC: sidr@ietf.org References: <5140B750.2070800@bbn.com> <514205E4.2040007@bbn.com> In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [sidr] NotFound vs Uninitialized X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2013 03:00:17 -0000 On 3/14/13 5:10 PM, Randy Bush wrote: >> NotFound: The global RPKI doesn't know this route, i.e., *nobody* >> knows. > > nope. a cache can not make such an absolute statement I thought someone might pick on that! I was trying to capture the intuition rather than the definition; apologies for being imprecise. Randy, are you implying that in the operator's shoes, the shades of gray are not really that distinct? Meaning that it will never be completely safe to drop NotFound? Just trying to understand. From randy@psg.com Fri Mar 15 00:54:54 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2D9C221F91D9 for ; Fri, 15 Mar 2013 00:54:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3SB8FXgcbPN6 for ; Fri, 15 Mar 2013 00:54:53 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id C49C321F91AD for ; Fri, 15 Mar 2013 00:54:53 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.80.1 (FreeBSD)) (envelope-from ) id 1UGPTQ-000079-AM; Fri, 15 Mar 2013 07:54:44 +0000 Date: Fri, 15 Mar 2013 03:54:45 -0400 Message-ID: From: Randy Bush To: Andrew Chi In-Reply-To: <51428EC0.8090307@bbn.com> References: <5140B750.2070800@bbn.com> <514205E4.2040007@bbn.com> <51428EC0.8090307@bbn.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Cc: sidr wg list Subject: Re: [sidr] NotFound vs Uninitialized X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2013 07:54:54 -0000 > Randy, are you implying that in the operator's shoes, the shades of > gray are not really that distinct? Meaning that it will never be > completely safe to drop NotFound? my *personal* take is drop invalid and keep the rest. not sure if i wanna up-pref valid, though i might. i would be pretty comfortable to up-metric valid. randy From oleg@ripe.net Fri Mar 15 11:44:24 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 23A8421F869B for ; Fri, 15 Mar 2013 11:44:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jEtzRn-kxV8G for ; Fri, 15 Mar 2013 11:44:23 -0700 (PDT) Received: from postgirl.ripe.net (postgirl.ipv6.ripe.net [IPv6:2001:67c:2e8:11::c100:1342]) by ietfa.amsl.com (Postfix) with ESMTP id 095E321F869A for ; Fri, 15 Mar 2013 11:44:23 -0700 (PDT) Received: from ayeaye.ripe.net ([193.0.23.5]) by postgirl.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1UGZc4-0002BD-OG; Fri, 15 Mar 2013 19:44:21 +0100 Received: from dog.ripe.net ([193.0.1.217] helo=ommbp.local) by ayeaye.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1UGZc3-0007el-0x; Fri, 15 Mar 2013 19:44:19 +0100 Message-ID: <51436C02.1040107@ripe.net> Date: Fri, 15 Mar 2013 14:44:18 -0400 From: Oleg Muravskiy Organization: RIPE NCC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:19.0) Gecko/20100101 Firefox/19.0 SeaMonkey/2.16.1 MIME-Version: 1.0 To: Stephen Kent , sidr References: <51423B3E.6030804@bbn.com> In-Reply-To: <51423B3E.6030804@bbn.com> X-Enigmail-Version: 1.5.1 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Anti-Virus: Kaspersky Anti-Virus for Linux Mail Server 5.6.48/RELEASE, bases: 20120425 #7816575, check: 20130315 clean X-RIPE-Spam-Level: ----- X-RIPE-Spam-Report: Spam Total Points: -5.3 points pts rule name description ---- ---------------------- ------------------------------------ -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP -2.4 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] X-RIPE-Signature: c408758d4ce2e8eb06762a65a3365b74c5c3b70f069fc80bed922191aa9123ea Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2013 18:44:24 -0000 Stephen Kent wrote: > During the first SIDR session I commented that I agree with the need to explore new > paradigms for distributing RPKI repository data, but that i was very disappointed with > the analysis being used to motivate the exploration. > > Attached are my comments on the I-D inn question. I have used MS Word with change control > to associate the comments (and some edits) with the original text. I rendered this as a PDF, > so that list members do not need to use MS Word. I am happy to provide the Word doc to the > authors if they wish. > > Steve Thanks a lot, Steve! Looks quite constructive. We'll work on a new version of the document; I already have some questions, not only to you, but also to WG in general. I'll aggregate them and post to this list. -- Oleg Muravskiy RIPE NCC From iesg-secretary@ietf.org Fri Mar 15 14:03:50 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 635C121F85D9; Fri, 15 Mar 2013 14:03:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.515 X-Spam-Level: X-Spam-Status: No, score=-102.515 tagged_above=-999 required=5 tests=[AWL=0.085, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0cIu4DmHUvyY; Fri, 15 Mar 2013 14:03:49 -0700 (PDT) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 73E3A21F8605; Fri, 15 Mar 2013 14:03:49 -0700 (PDT) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: The IESG To: IETF-Announce X-Test-IDTracker: no X-IETF-IDTracker: 4.43 Message-ID: <20130315210349.6067.71879.idtracker@ietfa.amsl.com> Date: Fri, 15 Mar 2013 14:03:49 -0700 Cc: sidr mailing list , sidr chair , RFC Editor Subject: [sidr] Protocol Action: 'Definitions of Managed Objects for the RPKI-Router Protocol' to Proposed Standard (draft-ietf-sidr-rpki-rtr-protocol-mib-07.txt) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2013 21:03:50 -0000 The IESG has approved the following document: - 'Definitions of Managed Objects for the RPKI-Router Protocol' (draft-ietf-sidr-rpki-rtr-protocol-mib-07.txt) as Proposed Standard This document is the product of the Secure Inter-Domain Routing Working Group. The IESG contact persons are Stewart Bryant and Adrian Farrel. A URL of this Internet Draft is: http://datatracker.ietf.org/doc/draft-ietf-sidr-rpki-rtr-protocol-mib/ Technical Summary This document defines a portion of the Management Information Base (MIB) for use with network management protocols in the Internet community. In particular, it describes objects used for monitoring the RPKI Router protocol. Working Group Summary This document is non controversial and didn't have many WG reviews, but is believed to be a good quality document. Document Quality I am not aware of any existing implementations. Bert Wijnen, one of the authors is a MIB Doctors. Advice was requested from the Ops Ads on the 14th December on whether further review was required. Personnel Alexey Melnikov is the Document Shepherd. Stewart Bryant is the Responsible Area Director. RFC Editor Note In section 5, pls change: rpkiRouter { mib-2 XXX } into rpkiRtrMIB { mib-2 XXX } From iesg-secretary@ietf.org Fri Mar 15 14:03:51 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A146021F861B for ; Fri, 15 Mar 2013 14:03:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.515 X-Spam-Level: X-Spam-Status: No, score=-102.515 tagged_above=-999 required=5 tests=[AWL=0.085, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id x6XDPjg35Tf4; Fri, 15 Mar 2013 14:03:50 -0700 (PDT) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id AA10F21F8650; Fri, 15 Mar 2013 14:03:49 -0700 (PDT) Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: The IESG To: IANA X-Test-IDTracker: no X-IETF-IDTracker: 4.43 X-IETF-Draft-string: draft-ietf-sidr-rpki-rtr-protocol-mib X-IETF-Draft-revision: 07 Message-ID: <20130315210349.6067.12407.idtracker@ietfa.amsl.com> Date: Fri, 15 Mar 2013 14:03:49 -0700 Cc: sidr mailing list , sidr chair , RFC Editor Subject: [sidr] Protocol Action: 'Definitions of Managed Objects for the RPKI-Router Protocol' to Proposed Standard (draft-ietf-sidr-rpki-rtr-protocol-mib-07.txt) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: noreply@ietf.org List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2013 21:03:51 -0000 The IESG has approved the following document: - 'Definitions of Managed Objects for the RPKI-Router Protocol' (draft-ietf-sidr-rpki-rtr-protocol-mib-07.txt) as Proposed Standard This document is the product of the Secure Inter-Domain Routing Working Group. The IESG contact persons are Stewart Bryant and Adrian Farrel. A URL of this Internet Draft is: http://datatracker.ietf.org/doc/draft-ietf-sidr-rpki-rtr-protocol-mib/ Technical Summary This document defines a portion of the Management Information Base (MIB) for use with network management protocols in the Internet community. In particular, it describes objects used for monitoring the RPKI Router protocol. Working Group Summary This document is non controversial and didn't have many WG reviews, but is believed to be a good quality document. Document Quality I am not aware of any existing implementations. Bert Wijnen, one of the authors is a MIB Doctors. Advice was requested from the Ops Ads on the 14th December on whether further review was required. Personnel Alexey Melnikov is the Document Shepherd. Stewart Bryant is the Responsible Area Director. RFC Editor Note In section 5, pls change: rpkiRouter { mib-2 XXX } into rpkiRtrMIB { mib-2 XXX } From arturo.servin@gmail.com Mon Mar 18 07:33:32 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3AA2D21F8F11 for ; Mon, 18 Mar 2013 07:33:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tPKVncSt2vY6 for ; Mon, 18 Mar 2013 07:33:31 -0700 (PDT) Received: from mail-oa0-f47.google.com (mail-oa0-f47.google.com [209.85.219.47]) by ietfa.amsl.com (Postfix) with ESMTP id 955DB21F8F0B for ; Mon, 18 Mar 2013 07:33:31 -0700 (PDT) Received: by mail-oa0-f47.google.com with SMTP id o17so5579036oag.20 for ; Mon, 18 Mar 2013 07:33:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=x-received:message-id:date:from:user-agent:mime-version:to:subject :references:in-reply-to:content-type:content-transfer-encoding; bh=kPGqT6cSNC67DT9WTd+xLEUVKyLaHcwevkJ1OU/LrO0=; b=0evm28PlmZNozdUMDhzoG+9gl5Jn3EgjWqDZ/Pwp61fYutqaV3vE1tcoblcYPx0FFP gp+MShqDfOMDF15kA37LMEb1kak4qJdV7IbngKaZQfTP9Bg+znPF4pksN+DGuhdg/MDd 87hMf/lWAcKYOhfXImK1os8PQ6Ar+6yNHk6p1UBL++rO/gwGDJXOLl5fkoiCMcmjppDH Ny6y7bl2CfCzTlp1tjja4ocFqYnsQn0ZKOtOSXRPKXTbq+fExqX4Zjdl2986zPGWQJSd 7oZdS9M3dMtqUwMIv4+e9zDzodqOznXmEenn8fIeRkF6TVY5TDEMUpyl3OfrBm8kRgXZ Ejpg== X-Received: by 10.60.24.72 with SMTP id s8mr6925946oef.68.1363617211041; Mon, 18 Mar 2013 07:33:31 -0700 (PDT) Received: from 85-7-200.lacnic.net.uy ([200.7.85.141]) by mx.google.com with ESMTPS id a10sm7260214oez.1.2013.03.18.07.33.28 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Mon, 18 Mar 2013 07:33:29 -0700 (PDT) Message-ID: <514725B4.6050707@gmail.com> Date: Mon, 18 Mar 2013 11:33:24 -0300 From: Arturo Servin User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: sidr@ietf.org References: <51423B3E.6030804@bbn.com> In-Reply-To: <51423B3E.6030804@bbn.com> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Mar 2013 14:33:32 -0000 Hi, Some comments about Steve comments: Comment 1 (also related with 44): I agree that ISPs may operate caches in behalf end-users ASNs, but also I think that more than 1 cache may be operated by a single ISP. Imagine a global ASN operator with routers in several places. Are they going to have just one master cache? Or are they have one or two (backup), and just in one location? Considering this, even the 40k clients may be low as worse case IMHO. Comment 10: Not sure if I understand the point, but because we do not trust fully on BIND we also operate DNS with NSD. In fact, I agree with the authors that we have a problem depending on just one implementation of rsync. Comment 28: For LACNIC ~ 2,500 members and ~ 2,200 PI. But as opposite to RIPE NCC, PI holders are members as well (not sure if this is relevant to the numbers) Comment 31: I do not have numbers of prefixes per ROA, but it is a number that we could get soon. Comment 44: Does any body has a pointer of that proposal? Comment 46: This is hard to answer. I have heard some operators asking for minutes to have fresh new ROAs. Some others do not mind and request objects every few hours. What is the middle or agreed value? (also related with 55) Comment 57: I think the reason is that CDNs today work on http and we know them more or less well. Although possible it would be more expensive and complex to have rsync-CDNs. Also this is related to comment 54, the "single point" is "magically" distributed by the CDN responding with the "closest" point as it is done today for http content. Hope it helps for the discussion and to improve the document. Regards, as On 3/14/13 6:03 PM, Stephen Kent wrote: > During the first SIDR session I commented that I agree with the need to > explore new > paradigms for distributing RPKI repository data, but that i was very > disappointed with > the analysis being used to motivate the exploration. > > Attached are my comments on the I-D inn question. I have used MS Word > with change control > to associate the comments (and some edits) with the original text. I > rendered this as a PDF, > so that list members do not need to use MS Word. I am happy to provide > the Word doc to the > authors if they wish. > > Steve > > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From christopher.morrow@gmail.com Mon Mar 18 08:35:08 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2BE3D21F84E9 for ; Mon, 18 Mar 2013 08:35:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -103.599 X-Spam-Level: X-Spam-Status: No, score=-103.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SNNwwmPUG+JF for ; Mon, 18 Mar 2013 08:35:07 -0700 (PDT) Received: from mail-lb0-f173.google.com (mail-lb0-f173.google.com [209.85.217.173]) by ietfa.amsl.com (Postfix) with ESMTP id B951321F84E8 for ; Mon, 18 Mar 2013 08:35:06 -0700 (PDT) Received: by mail-lb0-f173.google.com with SMTP id gf7so4787253lbb.32 for ; Mon, 18 Mar 2013 08:35:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:x-received:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=ih/W2Gtn556oRGo1v/upqiAy47FCxSJ9XdLQu4jcYAc=; b=Wr+AuReIAxLCfiLDfHH4kCfY9x6F2zK8mB/eSz+sez4U2dGvlbbOrRRTOO6yku9OeM eRFEoT+P+kgBz3s6qYb3bgLIs8NTYG5VcfqHKuehxI16NVOjN4jkfz9Wz4T1G7IEZZpE vMy26vgzj1GAgoziNNQ2rOZWRn1qOUVCHGq9hyarMkRdffpEZgjMY8l9CPDxCmjs+y7y x4L/RcNiU6j9IsrXz43aSHzPx2A890UF0TjV/Tnc6d77BazVuGW6HNgSBLtN/Lj9E2dM VSXRKKsNeS9v4ITSwGLRcq2zBc5koy+VtAlBcOWTZnR6TBtYUGITBmZ9htFU7S/Q/amI dUbQ== MIME-Version: 1.0 X-Received: by 10.112.5.138 with SMTP id s10mr6662865lbs.73.1363620905624; Mon, 18 Mar 2013 08:35:05 -0700 (PDT) Sender: christopher.morrow@gmail.com Received: by 10.152.28.34 with HTTP; Mon, 18 Mar 2013 08:35:05 -0700 (PDT) In-Reply-To: <514725B4.6050707@gmail.com> References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> Date: Mon, 18 Mar 2013 11:35:05 -0400 X-Google-Sender-Auth: 1i0MNyxenTsIKQIKYC9ATdFZK5k Message-ID: From: Christopher Morrow To: Arturo Servin Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable Cc: sidr@ietf.org Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Mar 2013 15:35:08 -0000 I'm not a fan of word in general.. but this comment numbering rules ;) On Mon, Mar 18, 2013 at 10:33 AM, Arturo Servin w= rote: > Hi, > > Some comments about Steve comments: > > Comment 1 (also related with 44): I agree that ISPs may operate caches > in behalf end-users ASNs, but also I think that more than 1 cache may be > operated by a single ISP. Imagine a global ASN operator with routers in > several places. Are they going to have just one master cache? Or are > they have one or two (backup), and just in one location? Considering > this, even the 40k clients may be low as worse case IMHO. oops, so... we need to be clear in terminology here there are at least: o publication points - places/machines AS Operators would make their authoritative information available to the world. o 'gatherer' machines - machines an AS Operator would use to gather repository data from all of the publication points. o caches - systems inside of and AS which provide the digested data to the routers of that operator's network. Note that: 1) a publication point may share common hardware/network/etc with another publication point (shared/hosted model) 2) a AS Operator may operate more than one 'gatherer' perhaps they partition the publication space ? or some other strategy is in use (local decisions not really relevant, I think, for overall discussion) 3) a cache may be only internal facing "all for me, only!" or it may provide the cache services for external parties (customers, random-joe-internet-operator, researchers). 4) it's entirely up to the AS operator to decide how many and in what configuration the caches are in his/her network. I think that most of Tim/Oleg's doc is about publication points and the load placed on the entire system by gatherers... I don't think they tackle the cache part at all in their doc. As to the end of the comment in question: "So, I don=92t think this parameter is a good estimate (worst case, but probably not representative). " I think it's fair to state: "The worst case today is AS's =3D=3D Gatherers" which is the intent of tim/oleg's work here... I think :) I think another part of Stephen's comment is really that there's the potential for an AS operator to run a gatherer for his/her customer's to benefit from... That doesn't seem unreasonable, but it's not knowable how many WILL do that, so I'd err on the side of worst-case and jump to #AS =3D=3D #gatherers. (as long as that's stated clearly) As to the memory limits imposed by platforms chosen for the study, it's probably fair to not that any system which drives toward max-memory+ is going to hit a cliff in performance when the system is forced to swap :( try to avoid swap... it's slow (so I hear). > Comment 10: Not sure if I understand the point, but because we do not > trust fully on BIND we also operate DNS with NSD. In fact, I agree with > the authors that we have a problem depending on just one implementation > of rsync. > > Comment 28: For LACNIC ~ 2,500 members and ~ 2,200 PI. But as opposite > to RIPE NCC, PI holders are members as well (not sure if this is > relevant to the numbers) > > Comment 31: I do not have numbers of prefixes per ROA, but it is a > number that we could get soon. > > Comment 44: Does any body has a pointer of that proposal? I suspect this is actually a comment about cache's not gatherers? Either way I'm not sure a 2x factor matters in end here... > Comment 46: This is hard to answer. I have heard some operators asking > for minutes to have fresh new ROAs. Some others do not mind and request > objects every few hours. What is the middle or agreed value? (also > related with 55) this, I think, is from some of the discussions Danny/Eric have been driving about time to get CRL updates out everywhere, or times to get a new ROA published and seen 'everywhere'. I believe we ended up talking about a time of on the order of 2-5 minutes for: "Have new prefix, make roa, get published and distributed" I don't know that that number matters a LOT today, it will certainly be much more interesting as a target in a few more years (when deployment is further along). > Comment 57: I think the reason is that CDNs today work on http and we > know them more or less well. Although possible it would be more > expensive and complex to have rsync-CDNs. Also this is related to 'rsync cdn' =3D=3D 'lots of rsync servers' really, right? since really you are essentially making new 'cache' (at the cdn) for each client... the only think you're winning with this approach (and rsync) is moving the tcp endpoint closer (maybe) to your client/requestor. Has anyone (not to derail too far) thought about git or another network-based RCS system for this? It seems that (as much as I was poking the tiger on the IETF thread about this) the checkpointing and such is attractive... done right, it'd even give the history data that some folks want for the changes to objects. > comment 54, the "single point" is "magically" distributed by the CDN for comment 54, I think the text is talking about: "with all RP's talking to all PubPoints, as the time horizon on changes gets smaller (from 1-3 hrs to 10 mins) each RP will have to talk to the PubPoints more often, leading to more concurrency at each PubPoint over time" Making the overall connection time shorter for these conversations could alleviate the concurrency problem. > responding with the "closest" point as it is done today for http content. > > Hope it helps for the discussion and to improve the document. > > Regards, > as > > > > > On 3/14/13 6:03 PM, Stephen Kent wrote: >> During the first SIDR session I commented that I agree with the need to >> explore new >> paradigms for distributing RPKI repository data, but that i was very >> disappointed with >> the analysis being used to motivate the exploration. >> >> Attached are my comments on the I-D inn question. I have used MS Word >> with change control >> to associate the comments (and some edits) with the original text. I >> rendered this as a PDF, >> so that list members do not need to use MS Word. I am happy to provide >> the Word doc to the >> authors if they wish. >> >> Steve >> >> >> _______________________________________________ >> sidr mailing list >> sidr@ietf.org >> https://www.ietf.org/mailman/listinfo/sidr >> > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr From brweber2@yahoo.com Mon Mar 18 09:23:13 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 22A5721F8C7D for ; Mon, 18 Mar 2013 09:23:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hV8DC0hNoGCk for ; Mon, 18 Mar 2013 09:23:03 -0700 (PDT) Received: from nm36-vm4.bullet.mail.bf1.yahoo.com (nm36-vm4.bullet.mail.bf1.yahoo.com [72.30.238.140]) by ietfa.amsl.com (Postfix) with ESMTP id 8C4E121F8CFA for ; Mon, 18 Mar 2013 09:22:28 -0700 (PDT) Received: from [98.139.212.144] by nm36.bullet.mail.bf1.yahoo.com with NNFMP; 18 Mar 2013 16:22:28 -0000 Received: from [98.139.213.12] by tm1.bullet.mail.bf1.yahoo.com with NNFMP; 18 Mar 2013 16:22:28 -0000 Received: from [127.0.0.1] by smtp112.mail.bf1.yahoo.com with NNFMP; 18 Mar 2013 16:22:28 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1363623747; bh=HoOF04axXOvgUji9Ke56Fi3QIhjyuDelgVjKZdJZAv8=; h=X-Yahoo-Newman-Id:X-Yahoo-Newman-Property:X-YMail-OSG:X-Yahoo-SMTP:X-Rocket-Received:Content-Type:Mime-Version:Subject:From:In-Reply-To:Date:Cc:Message-Id:References:To:X-Mailer; b=CRQ56KZ4BbqvhGQFy2TZL6/YqqnckhkVlUhDjJbUWF74PimhL00LCPjPtVWp7m9dqqEQ/9xzn3QRfpC7vSuIEj8a+SJqNfd0TLqUAXjsgN0B5y/vlGN6rVI7uogO3khqSmxUbw7MW+BFnmNbPE3anI6vAXIVw5vUY/fRXR11p+Q= X-Yahoo-Newman-Id: 995823.68245.bm@smtp112.mail.bf1.yahoo.com X-Yahoo-Newman-Property: ymail-3 X-YMail-OSG: iJOgnCUVM1mrxjpHMW6nmO5yxw2cXDv3InUHoUL3KQpUaX7 FSGwf3wtNH_Ftc6giMGaqPid6nSrdtrrmzRBTOQsA2tAM9S3TMUCKZXT47Fs uEGvKUwTQI3Hq5VPjDDjGbUnSpv8OEYPcP6lR7wNc70XT63bwrpOAqllTR_Y nlu0nbpZAJKhN1Fh0hcQl03RNVvhuS_xLlONzmleQe0K4vy5cdQ_wwYtafUS SfxuKID_j3aEEF3zK3j1Y.o4WOzWgZYE5_2XWy65ojn7qXkbSpK1ix8jSzzQ hVmRi_gavJOTiDs0MOEjBqpjMnHlHnBw0PJxCHwfn3xCf0nUKndVFvxwOn_b 8WAGuEG2Fhah.yvthfzEX4iYukTN.8Fw0kQjSaxgWVgR9LZjDtEc1PIkmJn4 jCmfoT.58WYWtv8iQYMgsJ6jW1ZglDbgIaqaFAZ4AITszBXZ_XlfrHbiQCG3 xEnSuP1Qk X-Yahoo-SMTP: f4ZrQXCswBB5jGYwSTd4wDs0ZJPe X-Rocket-Received: from bryans-mac-mini.home (brweber2@96.255.147.6 with plain) by smtp112.mail.bf1.yahoo.com with SMTP; 18 Mar 2013 09:22:27 -0700 PDT Content-Type: multipart/alternative; boundary="Apple-Mail=_2670E664-7C49-4F80-99B0-91B0B562220D" Mime-Version: 1.0 (Mac OS X Mail 6.3 \(1503\)) From: Bryan Weber In-Reply-To: Date: Mon, 18 Mar 2013 12:22:31 -0400 Message-Id: <85E71D8D-B84E-429E-8145-C0A267CBA48F@yahoo.com> References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> To: Christopher Morrow X-Mailer: Apple Mail (2.1503) Cc: Arturo Servin , sidr@ietf.org Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Mar 2013 16:23:13 -0000 --Apple-Mail=_2670E664-7C49-4F80-99B0-91B0B562220D Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 I'll just address one of your comments here and I'll save the rest until = I have time to talk to Tim and Oleg as we update this document based on = all the feedback. I had proposed to the mailing list a DVCS like approach to replace = rsync, but after more consideration I joined with Tim and Oleg to work = on these documents instead. Some of the reasons are: * What do you do in the case of a merge conflict? They require human = intervention which means that any solution should prevent merge = conflicts. It might be possible to get existing DVCS to always prefer = one changeset over another changeset but I imagine that the logic for = which should 'win' could get tricky given the number of publishers here. = Do you use time to determine which one is newer? Who knows if the other = servers have their clocks set correctly. Do you use the manifests? I = don't believe that there is a practical, simple solution to this for = existing DVCS's, but admittedly I haven't looked into this a great deal = so I could be wrong... * Is there a standard for the DVCS? Would we be moving from one = non-standard program, rsync, to another, say Git? * This one is my opinion. It is only worthwhile to force consistency for = a single publication point (not up/down in a delegated world). = Otherwise, the system becomes incredibly complex and rife with a new = attack vector where a child could "freeze" a parent and prevent it from = publishing if the parent and child have to coordinate to guarantee = consistency across the two. Of course this only gets worse the deeper = the hierarchy is. I had started writing a Git-like DVCS that would detect file based = changes, would not ever have merge conflicts (solving issue #1) and = could be proposed as a standard (solving issue #2). After considering = #3, I decided that consistency was only practical at a single = publication point instead of trying to force it up/down the hierarchy I = decided that the extra complexity of a DVCS solution was not better than = a simple HTTP/XML with a session id and version id as we proposed in = draft-tbruijnzeels-sidr-delta-protocol. It might also be less CDN = friendly depending on the implementation, but that wasn't a real concern = to me. There is another possible technical hurdle to overcome which has to do = how Git/Mercurial/etc. implement a custom file system of sorts, which = enables super fast checkout, but getting this to be cross platform might = be a lot of work. Hint: they aren't doing file copying. :) Nothing that = couldn't be overcome, but this is a lot more work that the immutable = data structures side of the DVCS IMHO. I agree that it does have some nice properties. * It could be used without the publication protocol which means it could = be used by the existing code bases that write to file systems that are = in use at the RIR's today. It would simply require the process that = writes to the file system to indicate that it would like to 'commit' = when it completed writing changes to the repository. This is 100% = possible with the delta protocol that we described, however it does not = provide any mechanism to do so. * You could view point in time history of what a particular instance = saw. This very well may help with debugging real world issues. Just one final thought: there is nothing that says you couldn't take a = DVCS approach that used the delta protocol we described. The proposed = protocol simply describes the format of the messages that are sent over = the wire and some very basic information about the state of the = publication server (session id and version id).=20 Anyway, as someone who has considered this in the past I just wanted to = document some of my thoughts regarding the idea. Just my 2 cents. -Bryan On Mar 18, 2013, at 11:35 AM, Christopher Morrow = wrote: > I'm not a fan of word in general.. but this comment numbering rules ;) >=20 > On Mon, Mar 18, 2013 at 10:33 AM, Arturo Servin = wrote: >> Hi, >>=20 >> Some comments about Steve comments: >>=20 >> Comment 1 (also related with 44): I agree that ISPs may operate = caches >> in behalf end-users ASNs, but also I think that more than 1 cache may = be >> operated by a single ISP. Imagine a global ASN operator with routers = in >> several places. Are they going to have just one master cache? Or are >> they have one or two (backup), and just in one location? Considering >> this, even the 40k clients may be low as worse case IMHO. >=20 > oops, so... we need to be clear in terminology here there are at = least: > o publication points - places/machines AS Operators would make their > authoritative information available to the world. > o 'gatherer' machines - machines an AS Operator would use to gather > repository data from all of the publication points. > o caches - systems inside of and AS which provide the digested data > to the routers of that operator's network. >=20 > Note that: > 1) a publication point may share common hardware/network/etc with > another publication point (shared/hosted model) > 2) a AS Operator may operate more than one 'gatherer' perhaps they > partition the publication space ? or some other strategy is in use > (local decisions not really relevant, I think, for overall discussion) > 3) a cache may be only internal facing "all for me, only!" or it may > provide the cache services for external parties (customers, > random-joe-internet-operator, researchers). > 4) it's entirely up to the AS operator to decide how many and in > what configuration the caches are in his/her network. >=20 > I think that most of Tim/Oleg's doc is about publication points and > the load placed on the entire system by gatherers... I don't think > they tackle the cache part at all in their doc. >=20 > As to the end of the comment in question: > "So, I don=92t think this > parameter is a good estimate (worst case, but > probably not representative). " >=20 > I think it's fair to state: "The worst case today is AS's =3D=3D = Gatherers" > which is the intent of tim/oleg's work here... I think :) >=20 > I think another part of Stephen's comment is really that there's the > potential for an AS operator to run a gatherer for his/her customer's > to benefit from... That doesn't seem unreasonable, but it's not > knowable how many WILL do that, so I'd err on the side of worst-case > and jump to #AS =3D=3D #gatherers. (as long as that's stated clearly) >=20 > As to the memory limits imposed by platforms chosen for the study, > it's probably fair to not that any system which drives toward > max-memory+ is going to hit a cliff in performance when the system is > forced to swap :( try to avoid swap... it's slow (so I hear). >=20 >> Comment 10: Not sure if I understand the point, but because we do not >> trust fully on BIND we also operate DNS with NSD. In fact, I agree = with >> the authors that we have a problem depending on just one = implementation >> of rsync. >>=20 >> Comment 28: For LACNIC ~ 2,500 members and ~ 2,200 PI. But as = opposite >> to RIPE NCC, PI holders are members as well (not sure if this is >> relevant to the numbers) >>=20 >> Comment 31: I do not have numbers of prefixes per ROA, but it is a >> number that we could get soon. >>=20 >> Comment 44: Does any body has a pointer of that proposal? >=20 > I suspect this is actually a comment about cache's not gatherers? > Either way I'm not sure a 2x factor matters in end here... >=20 >> Comment 46: This is hard to answer. I have heard some operators = asking >> for minutes to have fresh new ROAs. Some others do not mind and = request >> objects every few hours. What is the middle or agreed value? (also >> related with 55) >=20 > this, I think, is from some of the discussions Danny/Eric have been > driving about time to get CRL updates out everywhere, or times to get > a new ROA published and seen 'everywhere'. I believe we ended up > talking about a time of on the order of 2-5 minutes for: "Have new > prefix, make roa, get published and distributed" >=20 > I don't know that that number matters a LOT today, it will certainly > be much more interesting as a target in a few more years (when > deployment is further along). >=20 >> Comment 57: I think the reason is that CDNs today work on http and we >> know them more or less well. Although possible it would be more >> expensive and complex to have rsync-CDNs. Also this is related to >=20 > 'rsync cdn' =3D=3D 'lots of rsync servers' really, right? since really = you > are essentially making new 'cache' (at the cdn) for each client... the > only think you're winning with this approach (and rsync) is moving the > tcp endpoint closer (maybe) to your client/requestor. >=20 > Has anyone (not to derail too far) thought about git or another > network-based RCS system for this? It seems that (as much as I was > poking the tiger on the IETF thread about this) the checkpointing and > such is attractive... done right, it'd even give the history data that > some folks want for the changes to objects. >=20 >> comment 54, the "single point" is "magically" distributed by the CDN >=20 > for comment 54, I think the text is talking about: "with all RP's > talking to all PubPoints, as the time horizon on changes gets smaller > (from 1-3 hrs to 10 mins) each RP will have to talk to the PubPoints > more often, leading to more concurrency at each PubPoint over time" >=20 > Making the overall connection time shorter for these conversations > could alleviate the concurrency problem. >=20 >> responding with the "closest" point as it is done today for http = content. >>=20 >> Hope it helps for the discussion and to improve the document. >>=20 >> Regards, >> as >>=20 >>=20 >>=20 >>=20 >> On 3/14/13 6:03 PM, Stephen Kent wrote: >>> During the first SIDR session I commented that I agree with the need = to >>> explore new >>> paradigms for distributing RPKI repository data, but that i was very >>> disappointed with >>> the analysis being used to motivate the exploration. >>>=20 >>> Attached are my comments on the I-D inn question. I have used MS = Word >>> with change control >>> to associate the comments (and some edits) with the original text. I >>> rendered this as a PDF, >>> so that list members do not need to use MS Word. I am happy to = provide >>> the Word doc to the >>> authors if they wish. >>>=20 >>> Steve >>>=20 >>>=20 >>> _______________________________________________ >>> sidr mailing list >>> sidr@ietf.org >>> https://www.ietf.org/mailman/listinfo/sidr >>>=20 >> _______________________________________________ >> sidr mailing list >> sidr@ietf.org >> https://www.ietf.org/mailman/listinfo/sidr > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr --Apple-Mail=_2670E664-7C49-4F80-99B0-91B0B562220D Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=windows-1252 I'll = just address one of your comments here and I'll save the rest until I = have time to talk to Tim and Oleg as we update this document based on = all the feedback.

I had proposed to the mailing list = a DVCS like approach to replace rsync, but after more consideration I = joined with Tim and Oleg to work on these documents = instead.

Some of the reasons = are:

* What do you do in the case of a merge = conflict? They require human intervention which means that any solution = should prevent merge conflicts. It might be possible to get existing = DVCS to always prefer one changeset over another changeset but I imagine = that the logic for which should 'win' could get tricky given the number = of publishers here. Do you use time to determine which one is newer? Who = knows if the other servers have their clocks set correctly. Do you use = the manifests? I don't believe that there is a practical, simple = solution to this for existing DVCS's, but admittedly I haven't looked = into this a great deal so I could be wrong...
* Is there a = standard for the DVCS? Would we be moving from one non-standard program, = rsync, to another, say Git?
* This one is my opinion. It is = only worthwhile to force consistency for a single publication point (not = up/down in a delegated world). Otherwise, the system becomes incredibly = complex and rife with a new attack vector where a child could "freeze" a = parent and prevent it from publishing if the parent and child have to = coordinate to guarantee consistency across the two. Of course this only = gets worse the deeper the hierarchy is.

I had = started writing a Git-like DVCS that would detect file based changes, = would not ever have merge conflicts (solving issue #1) and could be = proposed as a standard (solving issue #2). After considering #3, I = decided that consistency was only practical at a single publication = point instead of trying to force it up/down the hierarchy I decided that = the extra complexity of a DVCS solution was not better than a simple = HTTP/XML with a session id and version id as we proposed in draft-tbruijnzeels-sidr-delta-protocol.  It might also be = less CDN friendly depending on the implementation, but that wasn't a = real concern to me.

There is another possible = technical hurdle to overcome which has to do how Git/Mercurial/etc. = implement a custom file system of sorts, which enables super fast = checkout, but getting this to be cross platform might be a lot of work. = Hint: they aren't doing file copying. :)  Nothing that couldn't be = overcome, but this is a lot more work that the immutable data structures = side of the DVCS IMHO.

I agree that it does = have some nice properties.

* It could be used = without the publication protocol which means it could be used by the = existing code bases that write to file systems that are in use at the = RIR's today. It would simply require the process that writes to the file = system to indicate that it would like to 'commit' when it completed = writing changes to the repository. This is 100% possible with the delta = protocol that we described, however it does not provide any mechanism to = do so.
* You could view point in time history of what a = particular instance saw. This very well may help with debugging real = world issues.

Just one final thought: there is = nothing that says you couldn't take a DVCS approach that used the delta = protocol we described. The proposed protocol simply describes the format = of the messages that are sent over the wire and some very basic = information about the state of the publication server (session id and = version id). 

Anyway, as someone who has = considered this in the past I just wanted to document some of my = thoughts regarding the idea.

Just my 2 = cents.
-Bryan

On Mar 18, = 2013, at 11:35 AM, Christopher Morrow <morrowc.lists@gmail.com> = wrote:

I'm not a fan of word in general.. but this comment = numbering rules ;)

On Mon, Mar 18, 2013 at 10:33 AM, Arturo = Servin <arturo.servin@gmail.com> = wrote:
Hi,

=        Some comments about Steve = comments:

Comment 1 (also related with 44): I agree that ISPs may = operate caches
in behalf end-users ASNs, but also I think that more = than 1 cache may be
operated by a single ISP. Imagine a global ASN = operator with routers in
several places. Are they going to have just = one master cache? Or are
they have one or two (backup), and just in = one location? Considering
this, even the 40k clients may be low as = worse case IMHO.

oops, so... we need to be clear in = terminology here there are at least:
 o publication points - = places/machines AS Operators would make their
authoritative = information available to the world.
 o 'gatherer' machines - = machines an AS Operator would use to gather
repository data from all = of the publication points.
 o caches - systems inside of and AS = which provide the digested data
to the routers of that operator's = network.

Note that:
 1) a publication point may share = common hardware/network/etc with
another publication point = (shared/hosted model)
 2) a AS Operator may operate more than = one 'gatherer' perhaps they
partition the publication space ? or some = other strategy is in use
(local decisions not really relevant, I = think, for overall discussion)
 3) a cache may be only internal = facing "all for me, only!" or it may
provide the cache services for = external parties (customers,
random-joe-internet-operator, = researchers).
 4) it's entirely up to the AS operator to decide = how many and in
what configuration the caches are in his/her = network.

I think that most of Tim/Oleg's doc is about publication = points and
the load placed on the entire system by gatherers... I = don't think
they tackle the cache part at all in their doc.

As = to the end of the comment in question:
"So, I don=92t think = this
parameter is a good estimate (worst case, but
probably not = representative). "

I think it's fair to state: "The worst case = today is AS's =3D=3D Gatherers"
which is the intent of tim/oleg's = work here... I think :)

I think another part of Stephen's comment = is really that there's the
potential for an AS operator to run a = gatherer for his/her customer's
to benefit from... That doesn't seem = unreasonable, but it's not
knowable how many WILL do that, so I'd err = on the side of worst-case
and jump to #AS =3D=3D #gatherers. (as long = as that's stated clearly)

As to the memory limits imposed by = platforms chosen for the study,
it's probably fair to not that any = system which drives toward
max-memory+ is going to hit a cliff in = performance when the system is
forced to swap :( try to avoid swap... = it's slow (so I hear).

Comment 10: Not = sure if I understand the point, but because we do not
trust fully on = BIND we also operate DNS with NSD. In fact, I agree with
the authors = that we have a problem depending on just one implementation
of = rsync.

Comment 28: For LACNIC ~ 2,500 members and ~ 2,200 PI. But = as opposite
to RIPE NCC, PI holders are members as well (not sure if = this is
relevant to the numbers)

Comment 31: I do not have = numbers of prefixes per ROA, but it is a
number that we could get = soon.

Comment 44: Does any body has a pointer of that = proposal?

I suspect this is actually a comment about = cache's not gatherers?
Either way I'm not sure a 2x factor matters in = end here...

Comment 46: This is hard to = answer. I have heard some operators asking
for minutes to have fresh = new ROAs. Some others do not mind and request
objects every few = hours. What is the middle or agreed value? (also
related with = 55)

this, I think, is from some of the discussions = Danny/Eric have been
driving about time to get CRL updates out = everywhere, or times to get
a new ROA published and seen = 'everywhere'. I believe we ended up
talking about a time of on the = order of 2-5 minutes for: "Have new
prefix, make roa, get published = and distributed"

I don't know that that number matters a LOT = today, it will certainly
be much more interesting as a target in a = few more years (when
deployment is further along).

Comment 57: I think the reason is that CDNs today work on = http and we
know them more or less well. Although possible it would = be more
expensive and complex to have rsync-CDNs. Also this is = related to

'rsync cdn' =3D=3D 'lots of rsync = servers' really, right? since really you
are essentially making new = 'cache' (at the cdn) for each client... the
only think you're winning = with this approach (and rsync) is moving the
tcp endpoint closer = (maybe) to your client/requestor.

Has anyone (not to derail too = far) thought about git or another
network-based RCS system for this? = It seems that (as much as I was
poking the tiger on the IETF thread = about this) the checkpointing and
such is attractive... done right, = it'd even give the history data that
some folks want for the changes = to objects.

comment 54, the "single = point" is "magically" distributed by the CDN

for = comment 54, I think the text is talking about: "with all RP's
talking = to all PubPoints, as the time horizon on changes gets smaller
(from = 1-3 hrs to 10 mins) each RP will have to talk to the PubPoints
more = often, leading to more concurrency at each PubPoint over = time"

Making the overall connection time shorter for these = conversations
could alleviate the concurrency = problem.

responding with the "closest" = point as it is done today for http content.

=        Hope it helps for the = discussion and to improve the = document.

Regards,
as




On 3/14/13 6:03 PM, = Stephen Kent wrote:
During the first SIDR = session I commented that I agree with the need to
explore = new
paradigms for distributing RPKI repository data, but that i was = very
disappointed with
the analysis being used to motivate the = exploration.

Attached are my comments on the I-D inn question. =  I have used MS Word
with change control
to associate the = comments (and some edits) with the original text. I
rendered this as = a PDF,
so that list members do not need to use MS Word.  I am = happy to provide
the Word doc to the
authors if they = wish.

Steve


____________________________________________= ___
sidr mailing list
sidr@ietf.org
https://www.ietf.org/ma= ilman/listinfo/sidr

__________________________________= _____________
sidr mailing list
sidr@ietf.org
https://www.ietf.org/ma= ilman/listinfo/sidr
______________________________________= _________
sidr mailing list
sidr@ietf.org
https://www.ietf.org/ma= ilman/listinfo/sidr

= --Apple-Mail=_2670E664-7C49-4F80-99B0-91B0B562220D-- From kent@bbn.com Mon Mar 18 09:47:23 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CFD0E21F8DD1 for ; Mon, 18 Mar 2013 09:47:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.599 X-Spam-Level: X-Spam-Status: No, score=-106.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B8sMFO0Ws1pv for ; Mon, 18 Mar 2013 09:47:12 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) by ietfa.amsl.com (Postfix) with ESMTP id 775DC21F8DC1 for ; Mon, 18 Mar 2013 09:47:12 -0700 (PDT) Received: from dhcp89-089-230.bbn.com ([128.89.89.230]:50003) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1UHdDL-000Jmj-76; Mon, 18 Mar 2013 12:47:11 -0400 Message-ID: <5147450F.7090107@bbn.com> Date: Mon, 18 Mar 2013 12:47:11 -0400 From: Stephen Kent User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: Arturo Servin References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> In-Reply-To: <514725B4.6050707@gmail.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Cc: sidr@ietf.org Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Mar 2013 16:47:24 -0000 Arturo, > Hi, > > Some comments about Steve comments: > > Comment 1 (also related with 44): I agree that ISPs may operate caches > in behalf end-users ASNs, but also I think that more than 1 cache may be > operated by a single ISP. Imagine a global ASN operator with routers in > several places. Are they going to have just one master cache? Or are > they have one or two (backup), and just in one location? Considering > this, even the 40k clients may be low as worse case IMHO. See Chris's comment re the issue of "gather's" vs. caches, for a more precise description of this issue. > Comment 10: Not sure if I understand the point, but because we do not > trust fully on BIND we also operate DNS with NSD. In fact, I agree with > the authors that we have a problem depending on just one implementation > of rsync. My point was that there are circumstances in which there is a de facto single implementation and that folks have survived. But, I agree with the principle stated here, so, never mind ,... > Comment 28: For LACNIC ~ 2,500 members and ~ 2,200 PI. But as opposite > to RIPE NCC, PI holders are members as well (not sure if this is > relevant to the numbers) Thanks. I suspected that the dichotomty cited in the RIPE context might not be representative of all RIRs, as your reply conformed. > Comment 31: I do not have numbers of prefixes per ROA, but it is a > number that we could get soon. I think it will be useful to have such #'s from several sources. > Comment 44: Does any body has a pointer of that proposal? http://www.iepg.org/2012-07-ietf84/120729-randy.pdf > Comment 46: This is hard to answer. I have heard some operators asking > for minutes to have fresh new ROAs. Some others do not mind and request > objects every few hours. What is the middle or agreed value? (also > related with 55) There are at least two issue here: how quickly a new/changed ROA is published after it is created/modified, and how quickly one should expect all RPs to have acquired this info. The RPKI propagation model for ROAs was based on the observation that, typically, the binding between an address space holder and the AS originating routes to that space changed very infrequently, and not very fast. Conversations with RIR staff supported this notion, based on IRR DB experience. So, suggesting that this data needs to be propagated in minutes, vs. 1/2 a day, is quite a change. > Comment 57: I think the reason is that CDNs today work on http and we > know them more or less well. Although possible it would be more > expensive and complex to have rsync-CDNs. Also this is related to > comment 54, the "single point" is "magically" distributed by the CDN > responding with the "closest" point as it is done today for http content. My comment was independent of the use of CDNs; an RIR could maintain a master DB for RPKI data and push copies to multiple caches for access by RPs, using rsync. But, I agree that it is attractive to explore using CDNs, IF we can make use of appropriate security mechanisms to ensure that RPs know that the current version data and deltas are authentic. Steve From christopher.morrow@gmail.com Mon Mar 18 10:31:23 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9339321F9015 for ; Mon, 18 Mar 2013 10:31:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -103.599 X-Spam-Level: X-Spam-Status: No, score=-103.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gyeEwRplLWKl for ; Mon, 18 Mar 2013 10:31:06 -0700 (PDT) Received: from mail-lb0-f172.google.com (mail-lb0-f172.google.com [209.85.217.172]) by ietfa.amsl.com (Postfix) with ESMTP id 74D9121F8FEA for ; Mon, 18 Mar 2013 10:31:05 -0700 (PDT) Received: by mail-lb0-f172.google.com with SMTP id n8so4867670lbj.3 for ; Mon, 18 Mar 2013 10:31:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:x-received:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type; bh=s3E9Gzhr6OyNxB3R1/cL+xndrOXQa8gjkon7YGXJn6M=; b=X/9aHaS6cJ9kLTCS8Ap+q9CPVCiQ3GulbslYsG13RCFLqr0GRoEAKbR3AqasPxM29v cBVsfZP6LRxxS4InDJVwMCjfBaVJAzfxOEJKpLapWKg32HzSBmm7ev7+WiAIbKr/caIu wc1DM5WOOJS845k3sRU43k4RtjIGfYnj1TBCP7FVpnNCEfTB9UYYf7kxPZHADeJqzSry XzxSrMEqjzm2UUEdhKwSrnz7Ps7+VSc+aZ4J86c/CMVhjy/4Dh/42eE5k5DdWhRQiLkA l2R4zc6r6BE40QUN17DVSXq83YYOB/7ZekmLE1xa44mljaNNAu8vF4ImJr6KXbWkkNsd LXqg== MIME-Version: 1.0 X-Received: by 10.112.23.193 with SMTP id o1mr6714293lbf.66.1363627864221; Mon, 18 Mar 2013 10:31:04 -0700 (PDT) Sender: christopher.morrow@gmail.com Received: by 10.152.28.34 with HTTP; Mon, 18 Mar 2013 10:31:04 -0700 (PDT) In-Reply-To: <85E71D8D-B84E-429E-8145-C0A267CBA48F@yahoo.com> References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <85E71D8D-B84E-429E-8145-C0A267CBA48F@yahoo.com> Date: Mon, 18 Mar 2013 13:31:04 -0400 X-Google-Sender-Auth: DwmVP7TSWChHNZfv3hllgZ1quOs Message-ID: From: Christopher Morrow To: Bryan Weber Content-Type: text/plain; charset=ISO-8859-1 Cc: Arturo Servin , sidr@ietf.org Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Mar 2013 17:31:23 -0000 On Mon, Mar 18, 2013 at 12:22 PM, Bryan Weber wrote: > Anyway, as someone who has considered this in the past I just wanted to > document some of my thoughts regarding the idea. awesome, thanks! I didn't imagine one monolithic repository, but one per pub-point.. I don't think conflicts exist if you simple sync always from each repository... well, the conflicts seem simpler to get out of: "master always wins". In the end though, I was just imagining :) I'm not wedded to the idea/concept. From wesley.george@twcable.com Mon Mar 18 11:35:12 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EF82D21F8DC1 for ; Mon, 18 Mar 2013 11:35:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.463 X-Spam-Level: X-Spam-Status: No, score=-0.463 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_EQ_MODEMCABLE=0.768, HOST_EQ_MODEMCABLE=1.368] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4ol3gfRSRln4 for ; Mon, 18 Mar 2013 11:35:03 -0700 (PDT) Received: from cdpipgw02.twcable.com (cdpipgw02.twcable.com [165.237.59.23]) by ietfa.amsl.com (Postfix) with ESMTP id 92D0C21F8EF7 for ; Mon, 18 Mar 2013 11:34:45 -0700 (PDT) X-SENDER-IP: 10.136.163.12 X-SENDER-REPUTATION: None X-IronPort-AV: E=Sophos;i="4.84,865,1355115600"; d="scan'208";a="43235475" Received: from unknown (HELO PRVPEXHUB03.corp.twcable.com) ([10.136.163.12]) by cdpipgw02.twcable.com with ESMTP/TLS/RC4-MD5; 18 Mar 2013 14:34:29 -0400 Received: from PRVPEXVS15.corp.twcable.com ([10.136.163.79]) by PRVPEXHUB03.corp.twcable.com ([10.136.163.12]) with mapi; Mon, 18 Mar 2013 14:34:44 -0400 From: "George, Wes" To: Sean Turner Date: Mon, 18 Mar 2013 14:34:44 -0400 Thread-Topic: [sidr] I-D Action: draft-ietf-sidr-rtr-keying-01.txt Thread-Index: Ac4dtnkeD72pKqt9QFGHPFQJbGaFzgGTG0rQ Message-ID: <2671C6CDFBB59E47B64C10B3E0BD5923041FA90775@PRVPEXVS15.corp.twcable.com> References: <20130223154110.5586.21859.idtracker@ietfa.amsl.com> <2671C6CDFBB59E47B64C10B3E0BD5923041F0C2E2D@PRVPEXVS15.corp.twcable.com> <513CC5BC.2090405@ieca.com> In-Reply-To: <513CC5BC.2090405@ieca.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: "draft-ietf-sidr-rtr-keying@tools.ietf.org" , "sidr@ietf.org" Subject: Re: [sidr] I-D Action: draft-ietf-sidr-rtr-keying-01.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Mar 2013 18:35:13 -0000 > -----Original Message----- > From: Sean Turner [mailto:turners@ieca.com] > > > Comments inline. [WEG] me too > > > We're trying to head off the typical knee-jerk reaction about non-client > generated keys where somebody says oh no can't do that because that's > what their BPKI does. But, I get your point. How about: > > The difference between the two methods is where the keys are generated: > on the router in the router-driven method and elsewhere in the operator- > driven model. Different equipment necessitates the two methods. Some > equipment doesn't allow the private key to be off-loaded while other > equipment does. Off-loading private keys supports hot-swappable routers > that need to have the same private key needs installed in the soon-to-be > online router that was installed in the soon-to-be offline router. [WEG] yes this is much clearer > > Do you think we need to say anything like: > > NOTE: Unlike humans, routers can be easily cloned; hence, operators > generating the private keys make sense. > [WEG] I'm not sure I follow the logic on this one, so I don't have a good a= nswer for you - is it meant to be a justification of using the operator-gen= erated model, or a recommendation to do so, or something else? > > > > The key (pun very > much intended) thing here is to highlight things that are different from > normal provisioning and explain why they're important. > > I was shooting for something more narrative, but yeah I could see that > it would make sense to say here's what's different. Now, any idea where > this BCP is? :) I'm not sure there is one. [WEG] There isn't a BCP in the IETF sense of the word. I was thinking more = generally in terms of the fact that most folks who can provision a router f= rom bare metal know how to do this, IOW, it's common practice. If we really= need a reference, modulus the specific commands being typed, any "how to e= nable SSH access to your RouterBrand (tm) router using the fantastic and i= ntuitive IJunSRScreenOS CLI" documentation would probably be sufficient to = serve as a baseline for something like: "this document assumes that the rea= der is capable of provisioning a router for SSH access per the manufacturer= 's instructions. The following additional steps are necessary/recommended t= o prepare for keying the router for SIDR because of foo" where foo would be= any security recommendations like requiring certificate-based authenticati= on, etc. Basically, limit your discussion to things that are either critica= l enough that you don't want to simply assume they'll be present in the ven= dor documentation, or different from the norm because that's what's necessa= ry for your process to be secure. > > > Ah for this section, the only key transferred is public and it's in the > PKCS#10, which is the only thing that gets transferred. But, you asking > this question makes me think I should make it clearer about what's being > transfer and why anybody'd care. [WEG] Yes, your brief explanation above makes this much clearer, so adding = it will be helpful > > > Also, I don't follow your last sentence "...linkage between private > key and a router..." - why is that important? > > The idea is that you want to be able to know the router's got the > private key associated with the public key. Another way to say this is > POP - and I agree this could be made clearer. Something like: > > Note that even if the operator can not get the private key off the > router this still provides a linkage between a private key and a > router. That is the server can do a proof of possession (POP), > as required by [RFC6484]. [WEG] Makes more sense, but "this" is ambiguous in the above sentence, even= when read with the preceding text. Replacing "this" with its antecedent wi= ll help. > > > 3.2 "installed over the ssh session..." - are we talking simple copy > and paste of a huge string of text representing the key, or is it > actually SCP/SFTP of a file that is then read into the router's config > via additional commands? > > If you're talking copy/paste, it's probably worth warning that for > keys over a certain size, this method is error-prone. I've seen a lot of > mangled config because someone exceeded a paste buffer when trying to > copy/paste a config, especially over a 9600 bps console at the other end > of 90ms of latency. > > An excellent point, but I'm sure hope it's commands and not ctrl-c/v. [WEG] well... I (and probably lots of other people) learned from the school= of hard knocks on this one, so I'd say it's a point worth making explicitl= y. Wes George This E-mail and any of its attachments may contain Time Warner Cable propri= etary information, which is privileged, confidential, or subject to copyrig= ht belonging to Time Warner Cable. This E-mail is intended solely for the u= se of the individual or entity to which it is addressed. If you are not the= intended recipient of this E-mail, you are hereby notified that any dissem= ination, distribution, copying, or action taken in relation to the contents= of and attachments to this E-mail is strictly prohibited and may be unlawf= ul. If you have received this E-mail in error, please notify the sender imm= ediately and permanently delete the original and any copy of this E-mail an= d any printout. From sra@hactrn.net Mon Mar 18 21:06:24 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2B04621F86C3 for ; Mon, 18 Mar 2013 21:06:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id O-gho9tkroBJ for ; Mon, 18 Mar 2013 21:06:23 -0700 (PDT) Received: from cyteen.hactrn.net (cyteen.hactrn.net [66.92.66.68]) by ietfa.amsl.com (Postfix) with ESMTP id 53F0621F868B for ; Mon, 18 Mar 2013 21:06:23 -0700 (PDT) Received: from thrintun.hactrn.net (thrintun.hactrn.net [10.0.1.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "thrintun.hactrn.net", Issuer "Grunchweather Associates" (verified OK)) by cyteen.hactrn.net (Postfix) with ESMTPS id D74879B436 for ; Tue, 19 Mar 2013 04:06:19 +0000 (UTC) Received: from thrintun.hactrn.net (localhost [IPv6:::1]) by thrintun.hactrn.net (Postfix) with ESMTP id A22F217098 for ; Tue, 19 Mar 2013 00:06:19 -0400 (EDT) Date: Tue, 19 Mar 2013 00:06:19 -0400 From: Rob Austein To: sidr@ietf.org In-Reply-To: <89FE469F-C657-4E38-91F8-F1B3E791BFE5@verisign.com> References: <89FE469F-C657-4E38-91F8-F1B3E791BFE5@verisign.com> User-Agent: Wanderlust/2.14.0 (Africa) Emacs/23.4 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Message-Id: <20130319040619.A22F217098@thrintun.hactrn.net> Subject: Re: [sidr] RPKI operations list? X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Mar 2013 04:06:24 -0000 At Sun, 3 Feb 2013 13:01:25 -0500, Osterweil, Eric wrote: > > Is there an operations list somewhere for RPKI repository > operations? We're hoping there's some forum where all of the RIRs > and (any other repo ops) are listening/talking? We've been seeing > some anomalies in the deployed RPKI repositories and we'd like to > plug in (especially if there are already some conversations going > about what we've been seeing). Sorry, I was on holiday back when Eric first posted this, thanks to Andrew Chi for pointing it out to me. rpki@rpki.net is available for this purpose. Traffic is sporadic but generally low. List was very recently converted to Mailman. List info: https://lists.rpki.net/mailman/listinfo/rpki Mailman web interface uses a server certificate issued by private CA. CA certificate, and PGP signed version for anyone who might care: http://www.hactrn.net/cacert.cer http://www.hactrn.net/cacert.asc From randy@psg.com Tue Mar 19 02:51:51 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8EB6621F8976 for ; Tue, 19 Mar 2013 02:51:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0 X-Spam-Level: X-Spam-Status: No, score=x tagged_above=-999 required=5 tests=[] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id x+TFwKjvlYKQ for ; Tue, 19 Mar 2013 02:51:51 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id 0F13521F8951 for ; Tue, 19 Mar 2013 02:51:51 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.80.1 (FreeBSD)) (envelope-from ) id 1UHtCj-000FLt-1u; Tue, 19 Mar 2013 09:51:50 +0000 Date: Tue, 19 Mar 2013 11:51:34 +0200 Message-ID: From: Randy Bush To: Christopher Morrow In-Reply-To: References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.7 - "Harue") Content-Type: multipart/mixed; boundary="Multipart_Tue_Mar_19_11:51:33_2013-1" Cc: Arturo Servin , sidr@ietf.org Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Mar 2013 09:51:51 -0000 --Multipart_Tue_Mar_19_11:51:33_2013-1 Content-Type: text/plain; charset=US-ASCII > oops, so... we need to be clear in terminology here there are at least: > o publication points - places/machines AS Operators would make their > authoritative information available to the world. > o 'gatherer' machines - machines an AS Operator would use to gather > repository data from all of the publication points. > o caches - systems inside of and AS which provide the digested data > to the routers of that operator's network. from the emulation preso series --Multipart_Tue_Mar_19_11:51:33_2013-1 Content-Type: application/pdf Content-Disposition: attachment; filename="pub-gather-cache-rtr.pdf" Content-Transfer-Encoding: base64 JVBERi0xLjMKJcTl8uXrp/Og0MTGCjQgMCBvYmoKPDwgL0xlbmd0aCA1IDAgUiAvRmlsdGVyIC9G bGF0ZURlY29kZSA+PgpzdHJlYW0KeAGVVMlu2zAQvfMr5igXMMN9uTYNCreXpBDQQ9FDajiIC9tp vPx/31Ck4iax4UoANRoOZ3nzhs90R8+kDekkFR5DMUSZ8ZCPgbYL+k4burreaZrvSMlks9E+suSi 8imRpt0cDoTPdji3phhzddF0qxddDWRpdRSW/x7p4QNnI3ROMgTnyKcorXWe4NI56bWyLzq4bDqn ZDAqs8d2tKoEu+UKXm2kQN551OBRpwsyahvHYm8X2/niz/5wv6LtEuiMlorUi/Ubj2K+pqvZWtOn J5RxIaymwAq/imFEJ6QKeAAw3vFHZ+l9Vp4sME5OOY71sSfNVrDjZZqlQdvQkR559D0Oozf9A/2g zkxoqqShTjVBN8FMxLAlJ2jqsUlsJm1n9DLuEJ9x1H0bTEV3+3VW3bStm/Wh+VndN2lfjZZPTbNp As79pP6LuOkHCN/FI3ovYzSWrJPRqggUCx6KOWyoByFHZLSSPlhnaaqVeAVN5xCu/01ng2mnpbcu kPVG2mxrMIYN0SxHM670oXymWIcw5qgDn+9R81RT97jYDkL70kRwwedzsKgCU4UUrDSplXs6g1ro pRkUyM9n4DCLmmGsKVQGnk7hP0AQXe36kAJaJ31SuGkMJEDMV07I5wbEOGl0wgx7HTHMIdT03m+M PWrMLVPRUnf4VRgIacUadGo5KEQ3ryagbzHlTpZRqRbUgcblyMBiDMTbepTOQSVxdszHKhjs5Cup T9YgynhzrEZhzZfBRTg5H2TWuGfK4IhCZfD2FJWPEZtt9ovt9HqCSB0gwQqAmNllXfzD57u/zJRP +wplbmRzdHJlYW0KZW5kb2JqCjUgMCBvYmoKNjA3CmVuZG9iagoyIDAgb2JqCjw8IC9UeXBlIC9Q YWdlIC9QYXJlbnQgMyAwIFIgL1Jlc291cmNlcyA2IDAgUiAvQ29udGVudHMgNCAwIFIgL01lZGlh Qm94IFswIDAgNzkyIDYxMl0KPj4KZW5kb2JqCjYgMCBvYmoKPDwgL1Byb2NTZXQgWyAvUERGIC9U ZXh0IC9JbWFnZUIgL0ltYWdlQyAvSW1hZ2VJIF0gL0NvbG9yU3BhY2UgPDwgL0NzMiAxMCAwIFIK L0NzMSA3IDAgUiA+PiAvRm9udCA8PCAvVFQzLjAgMTMgMCBSIC9UVDEuMCAxMSAwIFIgL1RUMi4w IDEyIDAgUiA+PiAvWE9iamVjdAo8PCAvSW0xIDggMCBSID4+ID4+CmVuZG9iago4IDAgb2JqCjw8 IC9MZW5ndGggOSAwIFIgL1R5cGUgL1hPYmplY3QgL1N1YnR5cGUgL0ltYWdlIC9XaWR0aCA2Mjkg L0hlaWdodCA2MzAgL0ludGVycG9sYXRlCnRydWUgL0NvbG9yU3BhY2UgMTQgMCBSIC9CaXRzUGVy Q29tcG9uZW50IDggL0ZpbHRlciAvRENURGVjb2RlID4+CnN0cmVhbQr/2P/gABBKRklGAAECAAAB AAEAAP/bAEMAAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAf/bAEMBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAf/AABEIAnYCdQMBIgACEQEDEQH/xAAfAAABBQEB AQEBAQAAAAAAAAAAAQIDBAUGBwgJCgv/xAC1EAACAQMDAgQDBQUEBAAAAX0BAgMABBEFEiExQQYT UWEHInEUMoGRoQgjQrHBFVLR8CQzYnKCCQoWFxgZGiUmJygpKjQ1Njc4OTpDREVGR0hJSlNUVVZX WFlaY2RlZmdoaWpzdHV2d3h5eoOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPE xcbHyMnK0tPU1dbX2Nna4eLj5OXm5+jp6vHy8/T19vf4+fr/xAAfAQADAQEBAQEBAQEBAAAAAAAA AQIDBAUGBwgJCgv/xAC1EQACAQIEBAMEBwUEBAABAncAAQIDEQQFITEGEkFRB2FxEyIygQgUQpGh scEJIzNS8BVictEKFiQ04SXxFxgZGiYnKCkqNTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlq c3R1dnd4eXqCg4SFhoeIiYqSk5SVlpeYmZqio6Slpqeoqaqys7S1tre4ubrCw8TFxsfIycrS09TV 1tfY2dri4+Tl5ufo6ery8/T19vf4+fr/2gAMAwEAAhEDEQA/AP7+KKKKACiiigAooooAKKKKACii igAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKK ACiisXxD4l8OeEtJute8V6/ovhjQ7JQ97rPiHVbHRdJtEOcNdajqU9tZ26nBw0syDg88U0nJqMU2 27JJNtt7JJatvsiZSjCMpzlGEIpylKTUYxitW5SbSSS1bbsjaor4x8Sf8FHf+CeXg24ks/F/7eX7 GPhW7iDtLa+JP2ovghodxGsYJkaSDU/HNrKgjAJcsoCAEtjBrk4f+Crf/BLi5lWG3/4KTfsCzzPn ZFD+2L+zxLK+1SzbY0+IrM2FUscA4UEngE1UqdSEuWdOcJPaMoyjJ/JpP8CKdehWg6lKtSq01dup TqQnBJbtyi3FWs76n31RXzv8Pv2vf2Tfi1dwWHwq/ag/Z3+Jl/dOI7ay+H3xr+GvjO7uHMixBILb w54m1KaVzKyxBY0Y+YypjcQK+iKJ0502lOE4Nq6U4uLa7pNK68wpVqNZN0atKqovlk6VSNRRl/K3 BtJ+T1CiiioNQooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiig AooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKAC iiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACvxh/a7/4LEeB/hL4x8U/BD9lX4ct +1T8dPCGp3fhzx5qaeKo/Av7O/wa8SWu6C90L4kfF1NI8TXmv+NtDu3RdY+GPwp8KeNvEukXFtd6 P45vvh5fNbTSfRP/AAVj+LPxE+Cn/BP/AOPvjb4V65qnhPxrfj4WfDSz8c6HI1vrXw30X42/Gn4c /Bfxh8UdHvArjTdV+F/g3x/r/wAQNO1aRTDpF54bh1OcrBaSMP4rvFXxc+I/wg/aF8PfssfBDwV8 KtM+FPgP9mfSfjp4k1LxLH4rk1/TfDOkfErVvC3irTfDtpol8sPiDxFq+j6cJNKbVhZvJ4l1G88Q 69rWprG2kal+9+CnhfkPG0sdnnFmOx1Hh/K8yy3KFgMope1zPM80zOFerh6HPaaweChTw054jEzp tNPljKko1a9H+JfpefSN418IKeTcHeGOT5Li+OOI+HuIOKJ55xTiHhuH+HeHOHq2BwuOxapc1J5r m9fEZhSpYDLqVaLU4886WJnUw2DxX6jfED9pr/goJ8eHuJfi/wDtjeK/h9ol66zH4Y/sg6DZ/s+e E9OB3D7KvxKe48Y/tG6hJFEVhbULH4weF7W7kEt4NBsXe3gsvly//Zp+Bmvayvibxt8PNK+Knitc EeMPjVeaz8b/ABkZAAPPfxf8XdS8a+JXuSBhrp9Ua4dSyvKwZgfg/wCEX7efxe1jWP2b/EfxX8Gf De3+GH7WfhD41+Lvh3p/w7k8SXXj34eR/CLw7d+NV03xnd6tql1pPjOTXfDFnJC934e0bwwuk69I tre2qwIJJbXwU/bZ+O/jzxL+zGfGvhP4R6b4R/bS8NfGPVPg7D4WPiq+8R/DPVfhtodx4n0m1+JV xe621j42sNX0WKNdSufC2neEZdL1NpLO4jgjVJ5P7g4UfgfkVLL8Nw9wrg6FTFVsDhqdXE5BPF5h TWYvhn+ysRi8bmMcRiqVDNJ8X8MPDt12/aZrTliaWHeEzB4P/HTxMX0xeM8TnmP468S80x1DLcJn GY1qGX8b0ssyPEyyJeIT4kwOVZRkNTA5dicZw3R8LPEOOYRWDUfYcNVoZficcs0yKObfphovgbwV 4biWHw74P8LaBChUpFovh/SdLiQoQyFY7G0gVSjAFSANpAIwRXSTQQ3MbQ3EMU8L43xTRpLG+1g6 7o3DK21lVhkHDAEcgGvzk/Y0/aN+MfiL9kDwR8bPjjb638Y/EXi7xV4w0zT4/g78NHn8VRaXpXjP xhoMc3iTQtHvLbR5YrGfw5NaQ6po2maPbw6bLodrqNtf6y9/q98z9qf4y+KdS8P/ALGniLwgnxY+ Ey+LP29/gT4F8S6Jr9vrPw88Ra94T1BfGA1nQPEOk2t+kmqeEtdNvbNcaXqD3Gl6qtrE1zaSeRHt /RqPHORR4Ywef4TB4ijRx2UZXnOHympQo4bGRwGbTwkMNKsqE6+ChNQxlKpOnTxNVKN0pM/A8T4N caT8Rs04IzTNcFisZlHFXEXCOO4ow+MxeY5VPPOGaeYzzCOFnjKeCzetS9tlVejSrV8BhpOajKUI qyf2r4n+CfwZ8bRSQeM/hH8MfF0MoZZYfE/gLwrr0Uqv95ZI9V0m7Rw38QYEHvmn+CfhofhDKlz+ z78TPjh+zZcw3EF1Db/Af4y/EDwF4QM1scwf2l8KIdbvfg34jgjHyJZ+Kvh5rlkseYlthGzq35Bf GX9sW+8L/tq6P4/tPi14msvhN8MfjR4Y/Zi8ZfCaD/hK4PAWseHtf0PVLH4gfGrXZYrJvB82qeA/ ix4m0LwjA1zqC6xbw+CNRit7bybxludb4nftE/GD4D/te/tW+N/EPi3xHq/7LVtqXwp+EPirSptU 1a7tPgT4p8bfAvwprngH4n+HbV7qW18PeG9V8Z6hf6D46k0uLS41v9e0nXrw6nqENqkXwed8Y+Gm bQzGGd8KZVnGFwfFUuGswr18Bk+YfVsKsszfH0uJa0+WrVw+UxrZJmFGddzhicHRw1bM5xhhaTmf tXB/hP8ASE4Yq5HW4Q8TOJOFsyzXw1h4hZHgsFnPFWRPMMxfEXC2R4jw/wANTc8Ph8dxNPCcX5Fi 6WCVKtgM1xOYYXh2jOtmWKjRX9MHwc/4Kmft5/AW9trf4y2fhD9uH4VwtCdS1HTtF8NfA39qfSLN WhS8vNLfQItK/Z9+LV5DaxST2fhm58M/AGS6u55Vl8ayKLa1H9DH7MP7VXwR/bA+GVv8VPgZ4tPi DRI9Qn8P+KNB1XTr3w547+HXjKwht5tX8B/EnwTrMNr4g8F+MtHW6t5LrR9Ys4ftdhdWGuaPcap4 e1XSdXvv8zr40ftD/EPUP2Tv2QfAXhz45+P/AAL8Wb39ljR/2kfEnjnSb7xtrHi/xr4j8P8AgfT9 N+HHgPxJrOh2+r6teWnxb8d32u3uu3Wvv9g1KDwPfx6pduLlo5v6Bf8Agkr+0TN4k/bE/YS+MPwo vRpui/txeDPHvw3+OfhKxkkk0/WdC8Ffs9fFb44+HNf120jfyJ/E3wX+KXwzb4baR4knie40zTvi h4p8Oi7MGu28J/lPxT8M/DvHZdxFnvAVKrw7j+HMjyfiLH5LWx1PGZdmGCzOGDnjqeXRdWtjMFi8 nq5ngKWKhXmsLXq4pUMJCm6EoP8A0v8Ao2/SI8eMmz7gLgvxrr4fjzJePeMeKuAsl4uwuTV8pz3J M34erZpRyWvntSOGwmVZvlvFeH4fzvE5bUwdL+0sJhsunjc0q4iOMp1I/wBpVFFFfyMf6kBRRRQA UUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABR RRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFF FABRRRQAUUUUAFFFFABRSMyqpZiFVQWZmICqoGSSTwABySeAOTX54/tD/wDBT/8AZQ/Z9+36VJ4z /wCFoeN7QyQ/8Ib8MDa+IZLe6VSPK1jxL9pg8K6QIZtsV9bvq9zrVqC5TRbh42irOpVpUY81Wcac e8mlfyS3b8kmzyM6z/JOHcJLHZ5mmByrCq9quNxFOj7SSV3Towk/aV6rW1KhCpVltGDZ9s/En4ce BvjD8PvG3wp+J3hjS/Gnw7+I3hbXPBXjfwlrULT6V4i8L+JNOuNJ1vSL5I3imEF9YXU8DS28sNzA XE1tPDcRxyp/Gv8AtefsIz/8E/P2gtP+I02paB+0L4W8S+DYPg54K8byfE7QNJ/ab+HHwlHiC58W WPhP4v8Awn8VeLPDfhv4qeG9J1ueNbX42fDrT7jx/q6MLTxl4Jt/Jk8Q679ZfEL/AIKa/tx/tdeI Z/h3+zT4M1nwHYXxdE0b4UaZqHij4gvYTOVWfW/Hb2SvoVvDtEj6toWn+EEtAsv2rUZIAxHoHwb/ AOCMXxQ8YSXPxG/a8+KsHgDT5Y59d8SaXpes2nivx1JBChn1G58T+N9VmuvCehSRW8ctzcanHceM okhjLXPk4cx/RcE+JfFPBOcQzHg3lqV5VaDq4fH4SnjMrxdWhKbwzrYKsmpYig6tT6riaM8Pj8N7 assLXp+2qc/8j+MWB4b+kzkVbgfJfD3O+LINYrBYPjKGLx3C0coePVGnjKWX5nh6uGxWJwuPVDC/ X8lzCrTwWZywmF+uZTj5YXDez/DL4HfCf9h3wt8SZdQ+ESeF7T4l+GIvEWkad4K1L4geKdS1H4b2 Xi+5TUfEll4I+FPjLxPfWPw60jxRNOt1NN4M8MaLpWuWV1/oFxdaTcor+pfDT9j/APZ3+EPjG18d /D/4fHRvEGk23iGy8MC68V+Ndf0LwNY+LLz7f4nsfh34T8ReI9W8LfD20167Ly6nb+DNG0OO5SSS 1ZRZubevsX4u6J4f/b7+KPwq/YK/Y4+Huha9+zr8FNT1W/sfGvxP0Gz8eDUjPq1xeeMfiN4p1Dxb puqSad8OBfaldDRPA9va2el+KL/UEkutClvdX0jRtF8eX9hnSvFf7a37Tn7MfwPj8RaM/wAOPB/j +9+Hvhrwb8SPiT8KPDl/4u8C6d4fdEXR/A/jLQrCM61qM2qwadpF1JJoFtf6paxziPSbXfD/AKv8 K4OvgchyifHPCPhpwvxZlPBeK8S834fw9VYDG8H5f/aOTZdg8fmGGq5FiMPkOMza+HxjjVzSnicH Syl08SlUwEVS+p4v/wBH1+kni+H8TmdD6aGW8OcXZx4Q1/ELxD8LPFPNONJ5zw1whh8yw+WZNlnG nFGVYnEZfVw2aVeJ87xFDBZ1kmXyyvCSzv65hniMTmNKPP8Awq+C3w4+Cen6/o/wy0S88N6J4j8R 6n4qvNB/4SPxPrGhWGs6zcS3urSeG9G13WNT03wnY6jqFxdaldaR4YttJ0mXUbu5vDZefMz1ofEL 4UeAfiqfAx8e6D/bx+G3xE8NfFfwX/xNNa0v+xfH3hAXy+Hde/4k2o6d/aP9nDUr0f2Xq32/Rbvz v9O065McXl/N+lz6fY/DS8ki+L/7Q2hfHrSvHk3h7W/B3iDXvBeu/D+DwUNLnli13RtP8UfDnUfH Vl410jxDpraNrtl4h8aa3ogtrwTroxuL5Y9G/c39lL/gj/Z/Hf8AZ6+Fvxe+I37cH7aug+JviF4f m8Q6l4f8F2v7FeleGLSzu9V1JNDGlLq37GWveJrdZtDj0u8uGuPE93JLfTXDxvDZyR2UXxnH3j3w D4XcT5v4W8VcD8S4XE5F7H/ZMvyXh7EcN43A1vZ4zL8wyl1s5wUMRluLjUpYvC1PqFKcJ80atGji 6NWjT/zR8Wv2Tn0vfCf6RHG/hZxX4kcBPxL4Rp082xXF1TinxCh/rBk+Z4fD0cs4gyXP/wDU2vj8 dhM6yvG0pYepXq0K31eVfA4xUMThsXhaP5OX37O/wb1P4Oa18AdR8FwX3wl8RRa5FrnhW61jxFO+ pP4k8Q3ni3W7258Qyau3ihtVv/E1/d67JrC62uqx6pL9rgvYpo4mSnqnwC+B0Og/F618Q+FrGbw/ 8ZND0fS/i9J4l8R+IL608S6P4Y8HWXgXSZNTvta1y4OlTad4W02ytDq+mXGmag93bJrl1ey65v1N v6FtH/4IU/s1QXUU/jD9of8Abb+IsCZ82w1n45eH/Adrc5JLebL8DPhr8JNRiznAFnf2oQACMJiv ozwF/wAEhf8Agm/8P9Rg1iP9lbwV8R9ZtJY7iz1n9oXXPHn7UGrWF3E4livdM1H9o7xZ8U7vS76K QB4bzTZbW4gIUQyRqqqPzDOPpY+HVOEf7H8Nq2ZVaODp4DC/2nTybLKdHBUqGMwdHBqVDD5rOnhK OEzLMcPTwtKPsY0MdjMPBQpYuvzezwt+zG8ea1ap/rV9ILB8PYbF5rXznMXw7X4s4hxGKzbFY7Kc 1xeayhi8bw1SxGZ4vNMgyHH18wxNVYupjsmynHVXVxGWYJ0/5A/hpcfs+fDS1Cfsv+GNO8f3+qad 8PvhFaT+Gvil4ffwvFo3wytrzwv4T0XUfiV8VviHZ+D9D8OeAoNR1T+37221u4uo7261m6vrXW/F Et9DJ/Sz/wAEhP8AglH8OP2LNDf45avrXgnxj8XfG+keKLbwxpnws8U+IPGHwJ+BPhD4ieJLTxp4 88IfBbWPEtzJqPiKfx14s07Tdb8c+PrnT/D1vqsulaZong7wb4G8MWV3pmse0ftY/wDBJb4LftF6 1qHjrwl4k1z4SfEG5sdLsEbTreLXvAMlnoWkWui6RYL4Nnm099DtbTT9PsbK1h8M6vpOmWcMckv9 jXU8jE/kRrP7J3/BSr9gLVb3xR8I9T8Vav4Sgl+3Xut/BvUbrxh4Wv0iPE3iv4Z6jZNdzNb26o11 dav4PvtLs0aRbfWJEjklH8neI/jfxhxzTp5XisoybI+FsHVxUsvyjhvAUcLCjQxWKpYurSxWI5Xi K8amIoYfE16MHhMFiMXQoYurhp4nD0qtP+rfCTwIX0XuJs94ozPhvi/xSxma1cJ7fxHxvEWNz7OK eGyvA4nKsDi6mQ1arwWGxeGyrGYzA0MZiqMMZluX5hjsoweeTy3E4qjiP61aK/nJ+Af/AAXI1awk tvD37TfwvF55MiWlz43+GSCx1KF438mSXWfA2u3q2s84bMt9PpOvaYsRjkS00B2ZIU/bH4IftW/s 9/tGWSXPwg+KPhnxTffZ/tFz4aN02k+MNPjA/eNf+EtYSx8QW8MThozef2e9hKyMbe7njw5/K6GN w2IsqVWLl/JL3Z/+Aytf1jdeZ/aXCviXwXxioQyXO8NLGzWuV4x/UczjL7UFhMRySxHJop1MI8RR TaXtWfQtFFFdR94FFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUU UUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRR QAUUUUAFFFFABRRRQAUUUUAFFfPHx0/av/Z9/Zv097z4v/E7w74YvjB59n4YjnfV/GWpowHlHTvC WkJe67PBK7JH9veyi0yBpFe7vbaHdKv4ffH3/gt/4u1+5n8L/su/DUaGl3KLGx8a/EC2j1zxPdzT yeTA2h+CNKuLjR7G7eTy/sp1XUvEy3Im8uXR4JgBXLXxuGw91UqLn/59x96o/LlW3rJxXmfBcV+J vBfBqnTznOaDx0V7uU4H/bs0nJ/DB4Wg39Xc9eSeMnhqUmmlUvof0Q+MPG3g74faDeeKPHfirw74 M8N2Aze694o1nT9C0m2yrMqy3+p3FtbLI4RvKi8zzJSCsaM3Ffj1+0L/AMFrvgZ4BF9ofwJ8O6r8 Z/EcRkgj8QXouvCPw+tZgGQzR3V9anxLr32eYfNb2mjaXYX0Q32fiHy3SU/nJ4O/YJ/4KDftx6/Z ePfj54i8R+E9CuSJYPEnxpvdQj1K1sbk+ZLF4P8AhhbCG70uFgyTw2L6d4O0O5Ehlt7xmL5/Yj9n j/gkv+yt8DjY6z4l0Of42+NbUxzHW/iNBbXHh22ukKkvpXgODf4fjh3oskI1/wD4SW+tpMtBqCA4 HH7fMMVph6KwtJ/8vq6vNrvGDT36e7KP99H56uKfFvj33eEeHqPAuR1XZcQcTxVTNatF6qrg8slS mqbnBtwvhMXQm+VwzCne6/GC48Xf8FNf+Cld1NZaND4og+GF9PJFPaaCknwy+C1pbPIwlttQ1i5n hl8ZrZldz2F/qnjHWYDtaGzBZAf0H/Z4/wCCIXwx8K/Ydd/aM8a3vxN1hPLmm8FeDpL7wx4HhlDK XtrzXN1v4u8QQ/LlZ7Q+Djh2jltJVUO/7oW1tbWVtb2dnbwWlpaQxW1ra20UcFtbW8CLHDBbwRKk UMMMarHFFGqpGiqiKFAAnrSnltFS9piJzxVXrKq24ryULtW7KTkktkj2Ml8E+H6WLjm/GGPzHjzP XZzxef1p1MDCSd+WhljqVaborVRoYytjKMVZU6dNJJcL8Pfhh8OvhN4et/Cnwy8E+GPAnh22CbNK 8L6NY6RbSyIgT7VefZIY5L++kGWuNQvpLi9uZGeW4uJZXd2/nh/4KIftn/EL9sD4rWf7AX7GRuvE VhrGttoPxH8YaDeFLLxnfWZZtW0C21e23x2fw08KpFPeeMvELSG112Wymt7fzPD9iZPEnqn/AAVE /b/8Uaz4jl/YU/ZKGp+Jviv401CLwb8RvEHhJxc31hLqoNtcfDLwtc2smV8Q3iSND401cSw2/hjT xd6PJPHqT6xL4f8AuL/gnP8A8E/fCn7FXw5+26yum+I/jr41sbaT4g+MYokli0i3cQXC+A/CdzJG s8XhvTLmNJb67AiuPE2rRDVL1IrS20XTdJ/tfw84ZyH6P/CGV+NviPluGzLjnO6EsR4K+HOPh7vO oxdHxD4mwqcalHKcBKcK2SYWoqdXF1vZYnDuFWeFxmA/1d8JeCeFPoq+H+R/SF8VMjy/MPELPsI8 R9HTwgx1CNOjBwjB4bxT4ty+n7OeFyHK5Tp1+HMDONGpjsR7HF4V061TBZhlnqf7D/7Fvw+/Yr+E tr4J8NJb61431xLPU/iZ4/ktY49Q8V+IY4ApgtnaNbiz8LaM8lxb+G9GZytpBLcXtyZtW1LU7u5/ Hf8AY9/03/gt/wDtSz2/zR2g+NvnFvlI+z674Y06XaDy2Lpgox1X5x8tf0r1/NP+wv8A6d/wWr/b EuIOY7P/AIaD84v8pH2f4n+EdMk2jndi6cAeqZfpxR4OcTZ7xdk30sOLuJcyxGbZ5nHg/mdfMsxx clKdevjc4y+CioxUYUadOnCNDB4ajGnh8NQpU8PQpQo0qdOOvgDxhxJx5w99ODjnjDN8VnnEmf8A gLnOJzbNcdNSqYjE4/PsrpqCjFRp0KNKnSp4bA4ShGnhsHhqNHC4ajTw9KnTj8i/8Fsfg74I+En7 W2m+MPAUI02/+K3gqz+IfjfRoURbKHxPc6/rug3Ot2qJt8lPFC6I93qcJUl9aj1LUPNZ9SMcH9L3 7CfjvwJ8Qv2Qf2etZ+HeoQ32g6Z8KvBfhK5iQot3pXiHwhoFh4d8R6PqsKEmDVLDWdPu0uS4xdho 9Rt3ntL22uJv55v+ClVunx3/AOCm2lfCKQtd2jan8Dfg2qwSAEReKzour3kUMyh/LkgvPHd4jvgt b3Mcu4BoiB3P7IvxD8Z/8Er/ANtzxX+yN8aNYuG+A/xW1uyk8M+KtRU22kwz6vM9h8P/AIoWu6Rr PTrTWI4U8IfENYnFvpt/ZLPe3klt4RRp+TI6q+kv4R4rIqkY4jxr8CcqrPh6u055hx94VYafPici TV6uMznhCq/aZdTSlUrYOrTw+HpV8Vj8diaX5p4Y8Q0PpveE3HPDuIwFGv8AST+iVQx2RcI5zFc2 a+LHgHgMTUxGJ4TqSTlXzLiLw6zGnia+U0+WU6+WY3DYbCUMTmGa5vjKf9SlFFFfyKfyeFFFFAHy d8ev2H/2Yf2kFu7r4mfCzQ5vEt0j/wDFdeHEbwt42SZl2x3Fxr+jfZptZa3GTBa+I49Z06NixNk2 5s/ij8cP+CJXxS8EXb+Lf2X/AInL4vbTZhfaZ4Z8V3UPg3x3ZTROTAuj+L7B7bw5qV+hCSLdXieD I4yG2Mzqu/8Apforjr4DC4i7nSUZv/l5T9yd+7a0k/8AGpI/PeKfCzgji9zrZpk1GhmE25LN8say 7M41OlWdehFQxVSP2fr1LFQi9VG9j+UHwh/wUJ/4KDfsWa9aeBf2gvDev+MdHtGMCaD8aNL1CDXb q0gZVln8L/E61Q3utKdqxxape3njXSlQuIICSHX9c/2fv+Cuv7Kfxm+w6T4w1i8+Bvi+6EccmmfE OSBfCsl023emn+PrRV0RbVC2FufE0PhWSQq2y14G79JPGHgnwd8QdBvPC/jvwr4d8Z+G78YvdB8U aNp+u6Tc4VlVpbDU7e5tmkQO3lS+X5kRJaN1bmvyL/aB/wCCK/7PvxE+3618F9c1r4JeJZzJPHpK Gbxb8P5523SOn9j6ndx69o/nynar6Z4hbTdPiYra6A8aRwjl9hmGF1oV1iqa/wCXVf8AiW7Rm322 96KXSDsfB/6reLvA3v8ACXEtDjnJqWsch4qfs8zp0loqWEzOVWKqOMFaDnjcHh4PlUcFNKz/AGO0 7UtO1iwtNV0i/stV0zULeO6sNS066gvrC9tZlDw3NpeW0ktvc28qENHNDI8bqQysQc1dr+SbUvgD /wAFNP8Agndf3evfDu+8W3/gKynkurvVfhldzfEH4bXsIYyTXniPwBqFlcTaUBEAtxq+ueErAWpm dLHWt5MtfX/7P/8AwXLsZjY6F+0t8MpLCUCOCfx98Ly9xal/ljE+qeB9Zu/tVsgwZr260jxDfOzM 62WgRqEhq4ZnSUlTxVOphavapFuD9JpbPu4qNvtM9HK/G/JKeLhlPHGUZtwHnL0dLOMPWqZbVd1H noZhCjB+yk7tV6+Go4VRs1iZ3Tf9DVFeHfBn9pT4E/tCaYNU+D3xO8LeNQkC3F1pVjem08S6bEQn z6t4W1OOx8R6UoaRUEl/plvE75WN3INe416MZRnFShKMovVSi1KLXdNNp/I/Y8HjcFmOGp4zL8Xh sdhKy5qOKwdelicPVj3p1qM505rzjJoKKKKo6gooooAKKKKACiiigAooooAKKKKACiiigAooooAK KKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAoo ooAKKKKACiiigAoorl/GPjjwZ8PNBu/FPj3xX4c8F+G7ED7Zr3inWdP0HSbdmVmSOS/1O4trYTSB G8qESGWZlKxI7cUm0k22klq23ZJd23sZ1atKhTnWrVKdGlSi51KtWcadOnCKvKc5zajCMVq5SaSW rZ1FIzKqlmIVVBZmYgKqgZJJPAAHJJ4A5Nfit+0P/wAFrPgZ4AF/oXwK8Pap8ZvEsIeGLxDdi48L fDy2n+55iXd5D/wkmveQ4YvBZ6PplhdoFNpr5V/MX8zZ/F3/AAU3/wCClVzLa6NB4ot/hhfzy289 toEcnwx+CtpbMxFxbX+sXNxFL4yFpuzLYX2q+MdZhDL5NoAyKfPq5lQjL2dFTxVXZQoq6v5zs1bz ipW6n5BnvjXwvgsW8o4aoY/jjPpc0aWXcN0Z4qhzp2/fZhCFSj7JP46mDp472entIxWq/c79oj/g p7+yl+z4t/pcnjNPih43tFkRfBvwyktPEMkN2vyCDWfEi3EfhfRjFL8t7by6pcazaqHZdHndRE34 s/En/gpt+29+114juPhz+zb4R13wDp2po0UPh74TWGoeJ/iI9hI4je81jx4lhDd6JBCzo0ur6DY+ EYLCPJu79o1eY/bX7PX/AARA+GXhgWWuftG+N774l6uhSWXwX4LlvvC/gmJxt8y1vtdPkeLteiJD FLixbwc4DbJLeQLub9nvh38Lfhx8I/D8PhX4Y+B/C/gPw9DtI0vwvo1lpFvPKi7ftV6bSGOXUL5w SZr+/kub2d2Z5p5HZmOXssxxX8aqsJSf/LulrVa7Smnpdf3ra6w6HhPIPGDj73uIs6w/h3kNWzeT cPy+sZ5XovXkxWYQq/uZTg+SfJi1T1ca+WXjyv8AnN+BX/BFX4w/ES/Txn+1F8RP+EGj1W4Oo6r4 d0K+h8a/EjU5rgiW5Os+JbqS88N6TfTO5ke9jn8ZSu6utxbxu25f3H+AP7Fn7Nn7NMFu/wALPhno 1l4hih8qfxxrqnxH44uywxM58R6qJ7rTo7ngz2OhLpOlsQpWwTaMfU9FdeHwOGw2tOmnP/n5P353 7pvSP/bqife8J+FnBXBzhXyvKaeIzKPvSzjNGsfmcqm7qwr1Y+zws5PWX1KjhYy3lFttsooorrP0 MK/FT/gqX/wUcn+Benv+zb+z3qM2r/tHeN47XStUvvDyTahqPwy03XlhisIbCO0SV5fiN4lS7ij8 NadbiW+0a2uItdmhhubnw+t77D/wUw/4KIaJ+xt4FTwh4JlsNc/aE8eaXO3hHR5fKvLXwVpEzPaN 478S2e8s0ccyzw+F9KnTy9c1a1meZJdL0zUo5Pmz/gln/wAE7NZ8IXifth/tRWuoa58dvG1xd+KP BuheLGnu9X8Grr5lurvxr4qW+LTyfEPxCLuaeG3vA0/hexuC9yE8RXk8Gh/1b4SeH3DHA/CtPx+8 ZMD9a4bw+IqUvDPgKs4U8V4l8S4Vtwr4ilVjNw4QyivGNXMcTUpToYuUHTnDE0Ywy/N/7c8C/C3g zw44Kp/Sg8f8tWN4RwuKq0fB/wAMcQ6dLG+L/F+CbdPE4uhWhOVPgTIsRGFbNcZVoVMNjp03RqQx eHjTyvPPX/8Agl9/wTktf2XfDqfGj4v2yaz+0h46015rz7bIuoL8MtG1hVubrw9ZXLmUXPi3Ud// ABWOvpLL+8L6DpUzafHqOoa/+v1FFfhHiH4g8T+J/FmacZcW4543NszqK0IJ08Hl2CpOSweV5Zhn KUcJl2BpP2WGoRcpP361epWxNavXqfzP4q+KfGXjLxxnPH/HWZSzHPM4rLlpwUqeX5Vl9Fyjgcly fCOc44HKctov2OEw0JSk/fxGIqV8ZXxGIrFfzT/8E8v9O/4LLftyXEH+rs/+GmfO3/K3+j/tA+Cd Mk2Dnd/pLjbyMx5fj7tf0sV/Mh/wTp1qz0r/AIKp/wDBRHxxqDeRpuiaR+1PrV9GTlo7OP8AaN8K 6vcN5mAP3Fvp8gJ2fMWDAAKQf3LwA/d+GX0oa70UfCrBUG3svrPEGHhZre75dHtF/Fuj+j/owTjh /Bv6Z+Mm1CFLwRwFCdSXwxjiuKMJF3S1u1TdpbRs3LQ8q+EQ/wCF3/8ABZq71Qf6VYWP7QnxK16G 4KiSMaZ8KbHxNPoFycFlVZf+EU0mOBwTsmngxg4x+xv/AAVH/Ykt/wBrz4E3Oo+E9Nif42/Cq31L xH8ObiKMC78R2ZhWbxB8PppAP3ieI4LWKbRBLhbbxNZaYPPtLG+1V5vyL/4Is6JeeOP2xPH/AMQ9 WU3E+g/DHxfrtxd7Wx/wkXi7xT4dsAcjCq1xY3niBwGJJCMFU4LL/VXX83eGHGmfeHvE2Tcc8NYp 4TOslzf+0cJN83sq0ElTxOBxcIyi62Cx+GniMFjaPNH22FxFanzLmUl/nb9DXxA4p8McdhfGDhTF ywHE1HxCzTiXBVpc3ssTQtQwuKy3HU4Sg8Rl2ZUnmOX5jh+eKr4TF4ijzRclJfjd/wAEgv23J/2g vhVP8CviXfOnxt+B+mWums2pSSLqvjP4fWLxaTpmu3EdyFuZNc8MXH2bw14qMoed5G0TV7ueW91q 8S2/ZGv5mv8Agph8EvGn7Dv7TfgT/goT+ztavp+i+IfFyv8AEnRbRJo9FtPG18rnV4dYitNhXwr8 XNKOo2+rg8W3iVdRukuoL7WdGig/oC+AHxx8EftH/CHwT8Zfh9d/aPDvjPSYr4WkssMl/oeqRFrb WfDmrrAzpDq2g6nFc6bfIpMbywfaLdpLWeCaT+hfpBcF5DjKGQeOnh1hFh/DzxQnWq4zK6Vpf6k8 e0lKpxFwrilCMY0KNXEQxGYZQ+WlSrYZ4hYOjTwNDCSq/wCg30pfDzhnH4bhj6SfhPgVhvCnxmqY ivmGTUeWS8OvE2ip1eK+CcYqcYww9Cti4YvNchfJQo4jBPFLAYenluGwM63sdFFFfzGfxwFFFFAB RRRQAV8Z/H/9gH9lj9pAX1947+GmnaV4tvi8j+P/AAN5XhLxkbqTdm8vb7T4Dp/iC4AYhT4p0vXY l4IiBRCv2ZRUTp06sXCpCM4veMoqS/HZ+a1XQ87NMnyrO8JPA5xl2CzPBz+LDY7DUsTSvZpTjCtC ahUjf3KkOWpB6xkmkz+Yj4zf8EW/jx8MdUbxr+zF8Srfx0NInfUdH0q91Bvh58TtLmjJNsuja5Bc x+G9SvYU3F9RbV/CErOVW209ixC8F4G/4KX/ALeP7IuvQeAv2jPCGr+ObKzAi/sP4waPqXhrxq1l bMI2n0Lx7BZrca1FMcEa1rNn4zguUdZLa4KOkh/q0rjvHXw88B/E7QLnwt8RfBvhnxx4cuwfP0bx Toun63p5cqVE8dvqEE6W91GDugu7fyrq3kCyQTRyKrDzpZaqcnPB16mGm9XFNzpPycZO9vVyS6R0 PxvGeClPKcTVzPw34nzjgjHzbqSwUK9XMMjxMlrGFfB4io6jg3v7epjaNNcvs8LaKi/z9/Z//wCC sP7Jnxu+xaVrfiib4MeMLorGdC+JzW2l6NNOcBhp3jiGSTwvJCzssduNZvNB1C6dtsOmkg1+ldpe WmoWtvfWF1b3tldwx3FpeWk8Vza3VvMoeKe3uIWeKaGVGDxyxuyOpDKxBBr8WPj/AP8ABE34F+Of t+tfAzxRrfwc1+bzZ4vD2oG48Y+AZpiN6wRQX9zH4n0RJ5dwe4i1zV7W0jdRaaJ5cSwt+ad38JP+ Cnv/AATouZ9S8HXXi+7+Henyy3V1feAbmb4m/CS5gVmlu73V/CN/Yzy+HIpVUrPrOs+FvDl4olxa 6kkpDBfW8bhtMXhvawW9fDe9ousoaW9X7Ndl0Ob/AF+8SuCf3fiBwa88yulpPijg/wD2iKpx3r4v Lpcvs77yqVVlNJaRp05tn9bdFfz7/AD/AILl+H9QNlof7Snw0n8PXLbIZvHnwyM2p6MZDtXz9S8F 6vdNrGnW6ANJcT6TrviCeR322+jxIuK/ab4QftBfBX4+aONc+D/xK8K+O7RYUuLq10jUVXW9Ljk2 hBrfhu9W08Q6HIS6AQ6xpllLllwnzDPZQxmGxC/dVYuX8j92a/7dlZu3dXXmfpPC/iHwdxjCP9g5 5hMTiXHmll1aTwmZ07K8r4HEqnXnGG0qtGFWhf4ask037FRRRXSfahRRRQAUUUUAFFFFABRRRQAU UUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRR RQAUUUUAFFISFBZiAoBJJIAAAySSeAAOSTwBX54/tE/8FPf2Uv2env8ARp/GJ+J3jmzEkbeDfhkb TxDJa3a7kEGteJPtMPhfR2imHl31pJqtzrdmAzHRZmURtnUq0qMearONOPeTSv5Jbt+STZ5GdZ/k vDuElj89zTBZVhFdKtjcRToqpJK7p0YSftK9W21KjCpVl9mDP0Pr57+OX7VX7P8A+zhpzX3xg+Jv h3wtdtAZ7Pw2LhtV8YaopVjGdN8J6Sl7r1zDK4WL7ebGPTYJJI/td7bRtvr+df4hf8FNf24/2uvE M/w7/Zp8Gaz4DsL4uiaN8KNM1DxR8QXsJnKrPrfjt7JX0K3h2iR9W0LT/CCWgWX7VqMkAYj0r4G/ 8EVfi58Q9RTxr+1X8Sn8If2rMNQ1bw54e1KHxr8R9SmkZfPXW/Ft8994a0u+kGW+2WsnjbfhVlSN ywTznmFSu3DA4eVbo61ROFKL+dm+9nKEuyZ+O1/F7OOJq1TA+FnCOO4ilGbpT4hzanUy3h7DyW80 6sqFTEWWvsa2IwGIdn7OhV0T3Pj7/wAFvfF3iC5m8K/stfDT+xftk5sLHxt4/to9d8TXss0ghtm0 HwNpc0+k2N48m37K2ral4mW6WZYpdFt5lwfCPBv/AAT/AP8AgoH+29r9n4+/aE8T+IfBmh3Z8+LX /jJeXz61a2c7L50PhP4V2rW1zosZG2aLTrqy8E6ROu6WC5Zmy39DvwC/Y0/Zw/Zptof+FUfDPRdM 15IBDceNtXRvEPji9JjMc7yeJdWNzfWMd3uZrjT9GOl6SScR6fEioi/UFCwFWu1LHYiVRb+wpPkp LbR2ScvVKMuvMyaXhLxBxXUhjPFPjDGZxDmjVjwzkU55bkNGSacYVJQhRnieVe77SGGw2KTjf65V u2/zK/Z5/wCCT37KXwMNhrGveHZvjT41tBFKdf8AiVFa3+h292oBeTSfAsKf8I3BD5gWa2/tuHxH qVlIitb6qrZY/pfbW1vZ28FpaQQ2trawx29tbW0SQW9vbwoscMEEMSrHDDFGqpHFGqpGiqqqFAFT UV6FKjSox5aVONNf3VZv1e8n5ttn7BkXDeQ8M4RYLIMpwOVYbTmhhKEac6zirKeIru9fE1EtPa4i pVqNaOTCiiitT2wooooAK+FP29f25PA37EvwqfxFqKWviL4n+Kor6w+F/gFpnVtZ1WCNBPretmB0 uLPwloDz28+r3MbxXF9LJb6Pp8sV5ei5tPS/2uP2r/ht+x78IdW+KXxBuRd3Z8zTfBXg20uYodb8 c+KZImez0TTBIJDBbRgfa9b1d4ZbfRtLjmu3iubk2djefhD+xV+yp8UP+CkXxw1D9uL9sNJb/wCF kWsMPA3gq6imt9H8YnQ72QaV4Z0XTJlZbf4TeEJjNb3x3tJ4s1uO+t7641K5n8U3k39I+C/hTkGN yrMfGDxaqV8r8IOEsSqTw9NulmfiFxHBOphODuHYudKpVVepC2bY2lOEcNhlVpRxGGccZmGV/wBc /R68EuGMxyTNfHrxzq4jJvAbgbFqjLC03KhnPipxZTjKrgeAOE4OpRq11ialO2eZhQq044PCRrUY YrCOOPzPJvRv+Can7Dnjv4+fEQ/8FA/2xpL/AMTa54m1c+Lfhj4W8UWpMuu348ltG+IerafcAQ2X hjR4I4ofht4cS1is/s1nputWkVvoljoK6l/RxUcUUVvFFBBFHDBDGkUMMSLHFFFGoSOKKNAqRxxo oREQBVUBVAAAqSvz7xa8Vc+8XOKp5/m9OhluW4LD08p4W4Zy9Knk/CvDuE9zL8myyhCFKlGFGkov EYiNGlLFV+ap7OjSVHD0fyzxz8beJ/HXjWpxRntLDZTlGXYSlkfBfB+VqNHIOCuFMD+7yvh/J8NT p0aMaeHoqDxWJjQoyxuJ5qvsqFCOHwuHKKKK/Lz8ZCv4tPh7+0D4c+Cv7UH/AAUquvELX9rrXxc8 HftV/DHwff6fbme0svF/ir4i3F5Yi+QFpra3mFhPHZ3qCdLfUBZxXUS2txNeWn9pdf583xWtLi9+ OX7QuvhjPbwfGfxvaT3OTIslxrPi/wAXXtuxmGVJmj0i6kBJJkCsy5Csa/p7wYnLD+CP0rsXDSVP gDhLDp9V9b4rjTavtZqLur3elrn9N+HOaYzIfohfT9zvAcqxeE8IOCMLTlKPMoxzPjujg632o6ex nUbakpJpSjdxsfrb/wAEhvj58KPgHf8AxYbxWdf8Q/E74q6z8NfAfwt+Hfg3Q7jWfFPiWaGbxNPq ghklay0HSrGS+1XQVmv9e1rS7aJLW5nV5Ira5aH+qpCxVS6hXKqXVWLqrEDcquVQsAcgMUUsOSq5 wP58v+CL37HQ03Trn9rfx9piG+1eHUfD/wAGrG8hPm2WmCWfTfE/jhUkX5J9TeO48N6FMux002PX 7jbLb6rYTr/QfX8n5VGrHCU1USjF3dONmpckpOXNJt6ubk2lZJQUerZ/n74DYHO8D4eZTHNqdDDY aqq2IyfCU6MoYhYDFYrEYxY7HVZzk6lfH1cTOpQhCNOlSwEMG1F1alVnn3xX+F3gv41fDjxj8Kvi HpSa14N8c6Hd6FrlixVJvIuArwXtjOySfY9V0u8jttU0jUERpdP1SztL6HE1uhH82n7E/wAT/F// AATG/bT8a/sVfG/WHf4PfErxHYv4V8U3e6z0a01nW0jtvAXxGtvNZray0rxjp8Vp4U8aokskGka3 YWn2y/WDwpftP/UZX5V/8FW/2H0/ax+CMnizwRpST/HH4RWeoa14N+zxKL3xh4e2/avEPgCSRQGn nvY4TqfhdJfMEPiG3Wwha0g17U7iv6n+j1x7kGFrZ94P+I2IcfC7xVp0ctzDEzlG3CPFcZU48O8a YOVX93hp4HFwoUMyqc1OjUwioV8c62Gy5Yep/pJ9FfxN4YwWI4m8BvFnFOPgx410qGUZpi6soNcC 8bQlSjwn4hYCVZqlhKmW46GGw+b1XKjQq4BYfE5jKvhMqWFq/qpRX5Bf8Eiv24P+Gl/g4fhP8QtW M3xw+DGnWmm6nJfSk6h418BwtHYaD4vJmImutU01vK8O+LXzPL9vj0vWr2dZvEqW8H6+1+P+InAW f+GXGefcEcS0PY5pkWNnh5VIxksPj8JNKrgczwUpJOpgsywc6OMwsmlNUqyhVjCtCpTj+DeK/hjx P4OeIPE3hxxfhvYZ1w1mE8JOtCM1hcywU1GvlucZfOaUquXZtgKmHx+DnJKao14060KdenVpQKKK K+KPzsKKKKACiiigAooooAKKKKAPiH4//wDBO79lL9osX1/4t+G9l4Z8XXu928efDsweEPFBuXDb ru/Nnay6Hr9y2RmbxLousyYVVRk2gj8Wfi//AMEcP2k/gxrB8efsvfEc+Pf7Ime90mCw1WX4a/Fb ScbnX+zb5NRh0PUpreIFHvLTxDod9dyFVtNE3SeUn9QlFcVfL8LXfNKnyTvf2lJ8k799FyyfnKLs fmvFHhLwPxXOWJxeUxy7M3L2kM4yWSyzMI1U7qtOVGDw+JqqSTVTF4fETi0uWUbH8rHw5/4Ko/tq fsu+IIvh7+0t4Hv/AB9b6XshutH+JWkX3gX4lwWcbeWk1l4qj00Jq0EgWSRNT13QfEUupZSSLVxE RI37H/s//wDBUn9kr48/YNLfxqfhV4zvBHGfCnxRFt4dSW6bahi0vxULi48JaiJZ2EVjA+sWWsXg ZGGjwyM0SfbPxG+FXw1+L3h+Xwt8UPAvhfx5oEu9hpvijRrLVoraZ12G6sJLqJ59NvlX/VX+ny21 7CQGhnRgCPxv/aA/4Ig/CfxZ9u1v9nvxvqnwt1iQyTQ+EPFbXfi3wNI53FLSz1N3Pi7QYizAvd3d 14uKqgjisFDbl5vZZjhf4NWOMpL/AJd1vdqpdozb102vO3aGtj4v+wfGTgX3uHs9wniJklLbKOIX 9WzulSX2MPmE6y9tKEFyxlVx7hdJUsubfKfuXFLFPFHPBJHNDNGksM0TrJFLFIoeOSORCUkjkQhk dSVZSGUkEGpK/kdk0H/gp5/wTenluNPfxi3wz0mQyzT6U7/FH4KXFkjMrz3NjNFdL4OguipRrm8s PButuBHsljzCx+9fgD/wXI8B679h0X9o74dX/gbUHMcM/jf4ei58ReFGkZh5l3f+Fr2VvFGiWcS5 ymmX3jO7kYDbAgYhNKWZ0XL2eIjPC1esaqaj8p2WnnJRVup6uT+N/DlTFLKeL8BmfAmdqynhM/w9 WGDlJuylRzBUoRVFtNqvi6GDoySvCpNNN/vbRXlvwr+N3wj+N+iDxF8JPiJ4U8faUqxm5fw9q1td 3mmtKAyQazpJaPVtEuypVvser2NldhWVmhAZSfUq9GMoySlGSlFq6lFpprumrpr0P2LDYrDYyhTx WDxFDF4atFTo4jDVadehVg9p06tKU6c4vpKMmn3CiiimbhRRRQAUUUUAFFFFABRRRQAUUUUAFFFF ABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRXHeO/iJ8P/hb4bvvGPxN8deDvhz4Q0xS+peKvHfif RPCHhvT0Cs5e+1zxBfafplooRGYtPdRgKrNnAJH52eMf+Czn/BNzwpcGy0j9oqP4wXjK5tk/Zv8A hj8YP2ltOu2SSSIpH4n+BHgH4geELdQ8TbrnUPEFlZRIY5ZrmOKWJ36sJgcbmFVUMBg8Vja7Tao4 TD1sTVaVk2qdGE5tJyV7LS67o83NM5yjJMNLG51muW5Rg4tKWLzTHYXL8NFtNpSr4urRpJtRk0nN NqLtsz9RKK/EvVv+C637O8MpXwn+zN+3B8QIM/Jd6T8H/h/4HikXPDC3+Nfxj+FWoRhkzJtuLKGR QvluiTtHC+B/w/Z8BnJT/gn/APt/yISdkm/9gmLeuflcRXH7eMNxGGGGCTwxSqDiSNHBUfW0fDPx HxEFUw/AHGuIpyV1OhwtnlaLXe9PAyR+YYr6Q/gDgasqGO8cPCHBV4NxlRxniTwbhakWt04YjOac r6dj906K/EXTf+C63wIlmVPEv7J/7c/gq3J+a91L4bfBXxdDGoHLtbfCb9oP4jamwByuyOwklYjK RuhVm9p8J/8ABaT/AIJ2+IrqHT/EXxk8VfBy/eN5J/8Ahf3wN+OvwR8PWaxqGkaf4hfEb4c6D8MZ Y4gcyT2PjW8t0wwaYEHHnZjwVxjlEJVM14T4ly2nCLlOePyPM8JCEUruUpV8LTjFJattpJanvZD4 u+FHFNWFDhnxN8P+Ia9Sap06OScZcO5pWqVJO0YU6WBzGvOcm9FGMW29FrofqjXH+P8Ax/4O+Fvg 7xB8QPiB4g0/wv4P8L6fLqet63qcpjtrS2jKoqqqK891d3U7xWlhYWkU99qN9Pb2Njb3F3cQwvwO i/tLfs8+J/hfrXxs8IfG/wCFPjf4R+HtNm1bVviP4E8e+GfG/g62soYvN3pr3hTUtY0+6nnBSOys 7See8v7mWC1soLi5nhif+Tn/AIKB/t/eK/2w/GA0LQRf+GfgZ4T1GaXwf4Ulfyb3X72NXtx4x8Xp DI8U2r3ELSrpWmB5rTw5Y3ElrbvPfXOpahffGY7GwwdPW0q0rqnTe7e3NLqoxe+zb91dWuTxN8TM q8O8o9tUdPG55jac1k+VKetaS914vFOD5qWAoSd5zvGeImvq9B8znUo/06/s/ftc+DfjB8DNU/aM 8WXWh/Cr4Y3XjPxdpnhbUfGWtWOjqPCnhzUm0Gw1LX9Qv7qHToNZ1nUdP1S6Om2crx2Ylg0iCXUp 7STUL34R/aG/4LXfA7wA1/oPwK8N6p8ZvEUBkgXxFem48J/D22mUlDLDdXds/iPxAIZFYtDa6Rpe n3kex7PXnjkEg/n6/Z1+F2r/ALUPj7wT8Etd+OXhz4caPYRXVn4OX4kaxr0uh2Z1PVZtQvdB8C6T HFJosevaxq2o3WpR6PNqXhqPXdTurl4r251S48qb+nX9nn/gkx+yp8EBY6v4l0Cf42eNbUxTHXfi NFBc+H7e6QAs2leA4Gbw7HAXVZYV19PEt/ayKGg1JMnPBQxWPxtNKgqdKKSjUxE2pSc7Lm5IJPl3 fKnBq1veR+W8McceLHiVlOGo8K0cmyPDYajRwmdcWZlXw+LxdXMlShPGSwOV0ac44RTnOcsNQq4G tBUvZWxlC75fxXl8X/8ABTH/AIKVX9xY6MnipPhpf3Lxz2uhJL8NPgpptsZW32t/rE0sJ8W/Yd29 rG/1Txh4gRdrRWr/ALtR+hX7PH/BED4beF30/X/2jfHF38StVjWKefwN4NN94Z8ExTg/vLW+8QM8 HizxBa8ApNYp4MkySksMyfe/dS2traytrezs7eC0tLSGK2tbW2ijgtra3gRY4YLeCJUihhhjVY4o o1VI0VURQoAE9dVLLKKl7TESniqvWVVtx+ULtW8pOS7JH3GS+CXD1LFxzfjDH5jx5nralPF5/WqV MDCSd1Gjlrq1YOindKhjK2MoKNlClTSSXC/D34YfDr4TeHrfwp8MvBPhjwJ4dtgmzSvC+jWOkW0s iIE+1Xn2SGOS/vpBlrjUL6S4vbmRnluLiWV3du6oor0UlFJRSSWiSSSS7JLRH7HQoUMNRp4fDUaW HoUYKnSoUKcKVGlCOkYU6dNRhCCWijGKS6IKKKKZqFFFFABRRRQAV438ffjx8OP2a/hZ4m+LvxT1 lNI8L+G7YbYY/Lk1XXtXuFddL8N+HrJ5Im1HXdYnQw2dqrpHGiz399NaaZZXt7bdh8RfiJ4K+E3g nxJ8RviL4i07wp4M8JabNquva7qk3lWtnaxbVREVQ011e3c7xWenafaRz32pX9xbWFhb3F5cQwv/ AC7Ofjb/AMFsv2pI9qa58Pv2RvhJqbYdkjQ6Fol20ZkUuv2jT9W+Lfjq3tE2x7r3T/CWlfN/pVnY sfEP7x4J+EFDxAxGbcV8Y5k+FvCTgeEMfxxxXVThKcFyzocOZFzQn9d4hzeUqeHw9ClCtLCxr060 qNfE1svwOP8A6Y+jt4DYbxRxWecb8f5tLgvwL8OKdPNPEjjesnCU6cXCeG4S4aUoT/tDirPpSpYT CYfD08RPBRxNLESw+JxeIyvLcz0Pgf8ACT4y/wDBY/8AaS1P4/fHdtW8L/sv/D7VpdM0TwzZ3V1F p72UU0V3B8M/B10Ftlm1K8h+yX3xJ8bQwx3riSC3thYy3OhW2i/1L6DoWi+F9E0jw34c0qw0Pw/o Gm2Wj6Jo2lWsNjpulaVp1vHaWGn2FnbokFtaWltFHBbwRIsccSKigAVz3w2+HHgn4ReBfDPw2+HP h+x8LeC/CGlw6RoGiaerCC0tYSzvJLLK0lxeX15cSTXupajeSz32pahcXN/fXE93cTTP29cXjT4v 1/E/Nsuy/J8uhwv4b8H4eWUeH/BeFtDC5NlUOWLxmMjTlKGJzzNPZxxOaYyc61R1GqCr1o03Xref 9IXx5xPjJneVZXkGUw4M8JOA8LPIvC7w9wTjTwWQZJBxhLMMfGlOcMZxLnPs4YvOcwqVMRVlVksN HE4iFF4nEFFFfhX+3L/wVU8W+G/iB4y/Zp/YssvCmsfEPwLdN4d+M/7Q/jaxuPEXwz+DnieWKF7z 4e+BPC2n3unf8LZ+NWh2NzHeeILS91jSvh58MNRm02w8Xz+MfEsGvfDey/M+GeGM94wzjC5Dw5l1 fNM0xjl7LDUFFKMIK9SvXq1JQo4fD0o+9Vr1pwpU1rKSur/yD4h+IvBfhVwpmXG3H2fYPhzhvKow +s4/GOcnOtVfLh8Hg8NRhVxWOx2Kn7mGwWDo1sTXldU6clGTX7e6/wCINB8KaNqXiPxRrekeG/D2 jWkt/rGva/qVlo+jaVYwDdNe6lqmozW1jY2kK8y3N1PFDGOXcCvzb8e/8FlP+CbXgS9m0uz/AGmd F+LmrwmaL+zf2avBPxN/akb7ZDkSafPqH7PHgv4l6Lpt7G4MdxHrGqaclkyyG/ltY4pnj/mh8Y/D cfF/xNF47/aT8b+P/wBqfx3BeNqNlr/7QHiBfGui+Hr5i7ed4B+FlvZaR8GfhcqNJMYo/hp8OvCY UTSeY0ruztpeHfHfgXW/FHjP4eeGtc0y78T/AAwHhm28Z+GrFHiuPCq+K9IOt+GIbyLyYreJNU0Z De2SWzyKLdcOI2ASv694d+hxi5U8JPjPjTBZVicZUdKhlmT4ZYyrVrewrYp4aGNxtXBwniaeGw+I r1aWGwmKj7KjXqRqOlQlVf8Aljx7+1fyyFfM6PhJ4R5vxLl+VUFicZxFxVmEsqw+GwjxmEy6OPrZ RlGFzWrRwFfMMfgsFh8Rj81y6X1nF4OhUoRxOMp4eP7i3/8AwXg+AHmFfC37KP7d3jeAMQt1YfCX 4U+CI3UZ/eC3+Mfx2+GWoKpAyFkskl6KYw5C1/O78OPih8PtQ8Q/HY+Ofgh+0F8RdB+JfxB8I+MY NK+ECfAp/GXgmx0z4kX+ueIYfEKfFD47fC7QU1DUfBGteJfDFlP4P13xqbXX7lZzbXOmRx3k/tek eN/CGveJfF3g3RfEmj6n4r8BNoSeNPD9lewz6r4YfxPprax4eXWrNGMtg2s6Urahp4nVTc2oM0eU 5r54/Z3/AHniXx9OOAfs3ynk/vdQ1Bxz/s7MHjnNf1HwB9GzgPKfDTxh4dwudcQY3AcZ5bw5lOc4 mGMytzoPJuIa1bkwLjl1anQxEMbTq4fFxxCxTpypzo8tGtByX9l/RM+nb4tcefs8v2unG3FPA/Ae Dr+GXhl9E+rkWU4vKuJFgsyoeKHjFjMqf9tU1xBg8Zi8NicoeHx+SYnLp5bC9ajjalbFYWpThL+j LwX/AMFvf2WPDGj6F4Wvv2Wf22fhJ4Y8P6XYaHpFrN8DvBvjjTdF0jSrKO0sLGCw+BHxX+Lmom2s 7W3itYY7OwuWxGioHBVm+pPh9/wWD/4JsfETU7XQov2rfAvw48QXwiWy8P8A7Q2keN/2X9cv7mYh U0/TdL/aM8LfC671XVCxI/s3S47y9YKzpC8Sl6/mf0j4ofDPxB4T1jx7oPxE8C634G8PLrba/wCN NI8W6BqXhPQ18NRyzeI21jxHZahNo+mr4figml1s3t5ANKjhle/MCxuRyWk/Gj9nn4o+F/Ft9oXx Y+DHxF8F+HdJvL/x3eaT478D+LvC+haFbW013f3vi24s9V1DSdM0m3s7a4ury51h4LOK2gmmmdYo nZfwPNfoi8A1YUaeS8fY3Lq2Iw08Rgo5g8qzGOKo0o8868I0KmWyq4eNOMnOth48lKN6klKMeV/5 18LftRPGrAvEPinwPybOcvyzGYfLs0/1fp8R8OrKa9aSw+HwMvrWHz6lhMVOpKnChgsZJVK8lHD0 3TlNTj/dZYahYarY2mp6Xe2mpabf28V3Y6hYXMN5Y3tpOgkgubS7t3kgubeaNlkimhkeORGDIzKQ at1/Bz8HtY0H4J+NdLu/2KP2lL39m/x74g8LW/xR03wN8F/HvhzVvhh4+8EarcyQWHjnX/2Z9bn8 QfCbxj4L1W+vZreHx3pPgnS9Wklvpl0Hx1peoywXcP8AQ7/wTg/4K1aN+1R4qtf2ePjpB8P/AAv+ 0TLZeKbnwN4w+FutPq/wL/aLtPAN3c2Hj5Phrd3uo6rqng74ofD24srz/hZHwP8AEes69rvh60sr /XPD3ifxhomleJbjwx/NPiN4EcX+HlCeZ1K2W8QZDGUlLNclxCrrDqLpKTxuEmo4jDKEsRQhUqqN ShGpXoxdW9WCl/oZ4B/TT8LPHXHUeHKOEz/gbjWpThKnwzxbgXhJY+U1iZQjk+ZUpVMDj51YYLG1 qOGdShjZ0MHi6n1blw1Zw+Kf+Chvwb8b/wDBPb9rXwR+3p+z7Ym28DeNPFs03jbw9bJNBodj4w1R JpfFvhfWI7dTHH4X+Kel/wBpajZnax0zxFFq09kLKe08Pbf6Kfgf8ZfBH7QXwq8FfGD4d6gNQ8K+ N9Gg1WyDtF9t0y6y0GqaFq0UMksdtrOg6nFd6Rq1sssiQ31nOsUs0PlzPL8avg/4J+Pnws8a/CH4 h6cNS8JeOdEuNH1FE2Ld2UxKXGm6zpksiSLbavoepw2er6TclJFt9RsraV45EVo3/nJ/YA+Mnjb/ AIJz/tc+Nv2Ff2hNTW2+HPjXxRFH4S8S3byW+g6b4r1SOKLwf400uacslv4X+JmmJp+k6sjsV0jX o9KOoTaedK8RFv1+Kf0k/Bnkt9a8bPA3Jfct+8zHj7wqw8vgSS9tjc54QqVPdVpVq+GqpL65mGbP 2P8AuLBP6Xf0ffZr/bfpE/Rt4e/drSrmvif4J4Sa9xWviMw4g4ErVfdXv18ThK6S+v5pnj+r/wBQ 9FFFfxmf59hRRRQAUUUUAFFFFABRRRQAUUUUAFFFFACEBgVYAqQQQQCCCMEEHggjgg8EV8C/H7/g mj+yV+0Al9f6p8Pbf4feMLxppz41+F4tfCWqyXcw3Pc6npUFpP4X1uSeUJJdXGq6Hc6jLiTytQt5 JpJW++6KzqUqdaPLVpwqR7SinbzV9n5qzPKzjIsm4gwssDneV4HNcK72o47DUsRGEpKznSdSLlRq aK1WlKFSLScZJpM/lp+K/wDwSG/au+AOtHx/+zJ8QZviCuk+Zc6fdeE9Wuvhn8V9LQN5jrbW41ZN P1ARRBV8zSPFC6jqMiMsOgxs0cLVfhb/AMFbv2u/2d9ePw//AGlvAs/xCXR5I7bUtO8b6RdfDn4q aXCpKKG1KPSorS+ATMgfXfDN5fagUQtrUau8x/qgry34q/BL4R/HHQj4b+Lfw88K+PtJCSrbR+Id Kgur3TGnCiWfRdXQR6voV24VVN7o19Y3m0bROASD57y10m54LEVMO9/ZybnSk9N1K79XLn8kj8cx XgxiMir1cx8MeLM14QxUpe0llOIrVMyyDEzXwwq0K/takV3qYmGZ8qSjTpQ3Pk/4A/8ABTX9kr4/ JYafZfEG3+HPjK8WJH8GfE8weFb03cgVRbabrtxPJ4V1qSWYtHaW+n63Jqdwqq8mmW7SLHX1V8Xf jT4C+B2gaD4t+I2qf2H4T1rxdofg648SyBDpHh+88RreR6Tqev3BkU2Ohy6hb22m3OpqksGnyajb Xt/9n0uG+vrX8Z/j/wD8EN/A2uNea1+zj8RbzwPfSM8sXgj4hm68Q+FgzA7LbTvFFlDJ4n0i1jwu Dqtl4vupCzFrpAFUfjz+0BoX7Y37Lfh69/Zl+NHiXXLHwB4rtbPUtO8F3Hi7SPG3hK/0zQdctr/T da8Kw/bNVufCkI1bT4XU2cPhvUbmNbmy1C1aCW9tWyqY7G4WElicMm0rQr03em5fZ51fRSejd4Pf lg+niZx4oeJfAuWYyPG3BtCvUp0ZU8u4oyObr5LXxiVsLHMsO6nNhqWLrctKrN1sBXUZTlhsDKfJ E/tzilinijmhkjmhmjSWKWJ1kilikUPHJHIhKPG6EMjqSrKQykgg0+v5gv8AgmV/wU2l+F8uhfs9 ftC67JN8NJpINL+HnxD1SdpJfh5LIyxWnhvxJdysXfwK7lYtN1KVi3g9itvcMfC5R/Dn9PUUsU8U c0Mkc0M0aSxSxOskUsUih45I5EJR43QhkdSVZSGUkEGvQwuKpYumqlN2aspwb96Euz7p/ZltJdmm l+ucB8eZLx/ktPNcqqeyxFLkpZnllWcXistxTjd06qVnUoVLSlhcVGKp4imnpTrQrUaT6K+a/jV+ 2Z+yJ+zdcCx/aB/ah/Z++Cupvbm6t9F+KPxg8AeB9fvotoZf7M0DxFr+n6zqksoZBb2+nWN1cXLv HHBFI7orfHN//wAFuP8AgmdZzPDY/tAeJvF21mUXHw2/Zt/ao+KlhIQzLm31L4bfBLxXp9yj7d0c lvdSxypJDJEzpcQNJ6+EyvM8e3HAZdjsbKKjKUcJhMRiXGMvhbVGnNpSs+VvR20ue7mnEfD2SRjP Os+yXKITlOEJZpmmBwEZzp254xli69JSlDmjzxTbjdXSuj9WqK/Jb/h+B/wTmXmbx/8AtE2id5r/ AP4J/f8ABQnT7cHspub79lq3gVj/AAqZAzHhQTXXeHP+Czf/AATB8Q3VvaXX7YPw5+H0l05jhm+O GmeOP2e7HzA5jEc2pfHXwp8O9OtpGcbY47i6ieQtGI1bzI93VX4d4gwtKVbE5HnGHowTlOrXyzG0 aUIrdyqVKEYRS6ttJHn4LjvgjMsRTwmXcZcK4/FVpqnRw2C4hyjFYirOW0KdGhjKlSc30jGLb6I/ TuivPPhr8XfhR8Z/Dy+Lfg98T/h58WPCjyeSnib4a+NfDfjvw88uC3lLrXhfUtV01pMAnYLktgE4 xXodeTKMoScZxlGS3jJOMl11Ts1p3Pp4VIVYRqUpwqQlrGcJKcJJNpuMotp2aa0e6aCiiipLCiii gAooooAKKKKACiiigAooooAKKKKAPPviv8V/hz8DPhv4z+L3xc8X6P4C+G3w90G98S+MPFuvTPDp ujaRYIDJK6wxz3d7eXMrRWWl6Tp1teatrOqXNnpOkWN9qd7aWk38znx9/wCCoH7Yf7Tdzc2HwCvL /wDYm+BU8jx6d4hu/DnhnxZ+1p8QdHkRkXVLuHxZY+I/hr+z3p+qW8zmDw4nhr4k/Eu0jSy1K58V /D3XvtvhnT/vz/gutpviOT9lL4ReKFMrfCP4d/tZ/CXxt+0TDlm09fhnb+GviNoPgrWdegCsknh7 wX+0l4g+Anj7Wb24UWPh2y8KSeK9SmtdO0C6u4P4xfiXqvxM1r4wf8FRfEVv8cPjD4e0f9nD4N+G PEfwv8EeFvGt5o3hDT/EfiX9lLxNqtxrFzZQRvdv9h1iAa/p1jp99p2njxI8fiG+t7/VbDSrnT/6 b8CuA+C83y6rxZxXgavE9SlxHVyDB8MUMbTwdLDLCcM5pxXXzrNv3tOtiMLPCZRjMPgcLGcKeIxO HxEKtPEQ92H+d/0zvGrxc4Yz7C+GPhnnWG8OqOJ4Cw3G2a+IuMyivm2Kx8s08ReG/DPBcI8M/wCz 18Lgcxo5pxVlWPznMalKrWwWX4/BVsNXwNVc9b9GfEnwv+D/AIffXfjT8YG1D4l+JfCuiax4k8R/ Gb9oHxP4l+NnjzStH0m2m1rXdSTxh8StQ8V63olhBb2kt9Pp3hyTTNMhitYorPTYoba2gi9Kj8d+ DP8AhAo/iYviHSoPh5/wiC+Ox4rmmFpokPgz+xh4gHiGW4nWJbbSo9D/AOJlJNMsQhtAZJFQKwH4 A+Dvij4n8X+C/jFp/hn9oH4k/Hnwtr3/AASn+InjX4/WfjjxVP4l0P4b/GufwcLPRtN0eH+z7WHw p4jvbF/ENte+GnWK+1PSbR/EusXOr6iV1Cb1v4BfGvxpF+zL+094X8ceJvE3gz4w+AP2HfDnij4M +EbDXby28LWvwM0n9nNZvBHxV+Hoha0XUfF2peMpNUk+IfiEwPqXhvXIdA8KW91FY6Rbed/YvDvi Vw9gZYXLsh4Zy/IMpxOWZlWwcMBQwNPB/XcswuMxsYRxOW1KWXYmFbDYb6tDD0pxxMsyWKwqqv6p iKkP8ouO/o98dZxDH59xp4h57xvxNgOI+H8JmtXO8ZnVbNv7H4hzLKMoqVZ4DiChic+y+rhcwzJ4 +rjsVRll9Ph+eWZlLCqWaYLD1P2/0TWtJ8SaLpHiLQNRtNX0LX9LsNa0XVrCZLix1TSdVtIr7TdR sriMmOe0vbOeG5tpkJSWGVHUlWBrJ8W+OPBXgHT7PVvHfjDwt4K0vUNWsNBsNS8W+INJ8Oaffa7q rvHpei2d5rF3Z29zq2pSRyJYadDI95eOjrbwyMrAfKvw11j9pzXPgZ+zrrfw5n+EOtwa18AvhRq3 ifVvizqfj1vE2o+K9R8H6Xd6nfef4ds723uoLxJre5mubyb7dNqEt68oKGNm+Vf24PBXxG/ar8bS /ALw18NrL4k2Hwo+DeqeIfGb2XjrTfBei+E/j78X9F1Lw/8ACzxBaXHiG0uJdZuPh34f0jxh4kt9 Kjhhuxb+NfD15dXtlI8STffZzxrisDw3/aWXZLjsfm+JoZbHKsBPBY1Uc0xuPoLFTp4X6jTx+Kq0 8Jg6eLxuJ9hSrSpYfC1G5SUXM/EOEvCLLM54/wD9X8+4syjJeFcBi8/nxLnVLN8oeL4byjJcY8tp YjMnnFfJctwtfM82xGV5Rl7xmIwlPE47MsPCMISkqR+mvxC+Mnwh+EY0g/Fb4q/Df4YjxC18mgH4 heOfDHgsa4+mfYzqSaQfEmqaaNSbTxqFgb5bLzzafbrPzxH9ph36GjfE34beI9X0zw/4e+IPgfXt f1rwpF480bQ9G8WaDqmr6t4HnvjpcHjPTNNsb+e9v/Ck2pq2nReIrWCXSJL5TaJeG4Bjr8RdY+I/ xJ/ac8T/APBLnWfDV94K0L4z3fhr9sP4f+Pv+FoeFbvxl4f0L4h+Cfh34X8H/Etde8IWOsaJNd30 9zpWq6ro+n3WorZpJqOkz6hFf6eZYLjE1P8AZB8a/A342eAvD37P/inVvFHxm/ZD/Y08F/EHwFPq IbTbT4qzaj8fvjdqHxJ+G+q6Pb3FzBZaF8QNI8Q63onh7To7iaXQLmLw5b2+qxpaz3z/AB0/FXPs RjcTjMm4Yjm3C9LG5Nh6WMp1vZZlWjmXDXDXFM6GGwntqtTGZo8szjM5UsGsLhqVPEZZg8JPFVa2 aP6j+sUvo0cF4LKcvyrivxEnwx4j4nKOK8ficpxGF+tcP4WpkHiF4geG1HG5hmiwmHw+V8OriHhb h6GIzWWY5hia+A4gzXNKOW4fCcOx/tf9aNc8G/snfEHxDpF1bap8N9P+Ifj2fxpoHhnxZ8MfH1p8 P/ip4qvfBE7R+P8AR/D3jL4ca/4f8ba/ceCr6x3+LtIs9Tv4/D19YBtdsraa1wnuPwI/4KXfDj9k n4jad8I/jLq37K/7Z/g6LV7DQLr4fa7of7PGg/ty+BLi4uLW0tbHwdd6NY+GdA+PmrQNIsdj8NPH Phzwt8XfEUs4nsvil4r1sWXhvV/wN/Z48Q6h8QfE3/BNjxX4dgufD2qeN/HH/BV7xDoVrqYUXmh6 h4luPFWpaXBqATCi5025vYI7sIQolgk24GK+p/8Agnh8b/2efh7+z38LvgH8S9Z8LfD79orQ/HWp eFPHnwq8ZRKnxP1H4wX/AI81M2HiS40m6tJNa166157zSdXsfFsKX1jp9tdWsEmswR6cTD+Y51l3 AXi/LC4XiDhzhTh7EZphoYnDcZSpvBYyVSrwr4f8RUsvwuLhUy9YrMsRPjTFzwtHM62LpQwmVVK0 crxk6mJnhf3rhnE+LH0Zfr+ccJ8WceeImH4cxlTLcw8LK1HCZ/ltHC4TxN8cOBcRnOYYDE4PP6mW cOZfT8I8sp4/FcPYXLMRUzXielhZ8R5TRpYCnmf+hf8ABzSf2RP2gPhf4H+NHwc8E/BXx58MviNo Fp4l8HeK9H+HvhhbTVNLu96ES2t5oNrqOlapp93Fc6ZrehavZ2Gt+H9asr/RNb0/T9W0+9soPp5E SJEjjRY441VI40UIiIgCoiKoCqqqAqqoAUAAAAV+J/8AwQh0/Wh+y18b/FcKyp8JviN+2D8WvGnw CIDJpt54Abwf8LfDHjzXtATAjk0Dxd+0j4Z+PHjHTdStS9j4hj8QN4l0+a5stZguZf2yr/PfiDKq GR59neTYbF0cwoZVmuYZdSzDDqPsMdSwWKq4ani6LhKcXSxEaaq0mpP3Jx22X+7Hh9nH+s3BPCXF lTIJcM4zinhnIc/xmR1qCo4zKa+bZZhswqZXjV7GhP6zl88TPC1ozguWrTmlpqyiiivIPsgooooA KKKKACiiigArJ17XtF8LaHrHiXxJqthoXh7w/pl9rWua1qt1DZaZpOk6ZbS3moajqF5OyQWtnZWk MtxczyuscUUbu7AAmtOSRIkeWV0jijRpJJJGCJGiAs7u7EKqKoLMzEBQCSQBX8w37bX7VvxO/wCC jvxt079hv9jiVtR+GSaru8c+NLaae10bxnNoV0DqfiDWdXthN9m+EnhKQwXFq4hdvFmurZXNnban NJ4VtZ/13wc8JM08WeIq+DjjKOQcJ8P4V51xzxlmFqeVcLcPYdTqYnF4itUcKM8bXpUa0MtwUqkJ YqtTqVJyp4TDYvEUP3bwC8C868ceK8VgYY/D8McD8LYJ8QeJPH+actLJOC+FcMqlXF4/F16sqdCp mGIo0MRTyjLnVhPGV6dSpOVHA4THYvDcl8efjB8Yf+CxH7Smm/s6/AJ9Q8Ofsy/D/Vhq2t+KbmC+ g0270+3ufsVz8TvF9nJ9kaa6mjNzZfDXwXceTfyPcTXF2bGW61m40L+kX4B/Ab4b/s1/C7w38I/h ZoqaP4X8O253SyFJdV17V51Q6n4j8QXyxxtqOuavOgmvLpkSKNFhsbGC002zsrO387/Y/wD2Svhx +xz8INJ+GPgO3jvdUmWDUvHnjW4tY4NZ8c+KjAEutXvsNK1tp9vl7TQNFSeW30bTFSAS3V9NqGo3 31RX1HjZ4t5TxPh8p8NfDXCVsg8HOB6lSlw9ls3KnjeJsz96GM4z4kdoSxWa5nOVWrhYV4J4DDV5 QjSw9WviKUfs/pE+OeR8Y4bI/CLwhwOI4Y8APDirVo8KZRNzpZjxhnFp08f4g8Xy5ac8bnecVJ16 uDp4mnF5Zg8ROnToYWvicVRiUUUV/PR/KwV/mg/HK7+K3g34H/si/CpviN45+GPxtk/bc+H3wE/a i1vwvq5sPG6/F2+k+JcH7Qia697BcwaheeJ/iUmr+Nopdc07UdI8QpqOi+KFtNV0q+sZrn/S+r+U j/gr/wCMv2aNc/aO8PD9m3SvEOoftlTahpnhD4seJ/hNdadL4V8d2lnA2i+Gvhx8TvCj+H/ENn8U fiBos1zDZ6BrOgDQfHXgpLS08JT+ML3SBfeB4v6S+jDguJs745x/C/D2T4vHUeJMojgc8zjBtYeX CuUYbMcFmFfPMVmE8TgqeEy+H1T6ti4SxuGq4j29JYL6zj6eFwWJ/OOP/oYeJ301cVwfwb4RYLLc w404Iz7E8Z4TC8V15YHw6jhHkmZ5HjMbx5mssqz3D5LleW080WYYTM6uS5vVni8OsnwuW4qtm65P 5Nv2jviP4u+GnxG/bL+H2kftZftA6J48+Dlv+yhYfst/D9fiPqeq6p8SPGuseAPC66zY6nY3lnc3 fj671y9uku/FGhxXEFlqcmr6j4i13StSlt7a4svQvF3xU8XfDD9ur9o3VvFV9qfgj4I6t8ZP2K7H 9ofx94M1i7stS8JTSfAR38A6Lf6lCttd6T8LfE/xDay0n4geKYLq0u4NEhtdDk2Wfia9ZP3Vl/YJ /bG/Z38XfET43+MP2IfiL4l1D41ad8P9c8f+Nv2fvFmg/GyWGfwT4Tj8O+HNN1b4Kxa3YfFnw94j 03Rrq6sNR0v4b+DfiZpD3VvP53iq9nltWuPObn48fC3SNWn8P+MfEF98LvEdqu678M/Gnwp4w+CP iazO7Y0V34d+LegeC9ZtrhJAYpLeaySaORWjdAykD+pOH8FwxxTmOLhlHi1kH9pYXjPNczy/KMHi qmOaw2BzDxBo4XCToY/OsPVzHC4rKuK8FgcxrZNRwmCrZNlUctwWLrQrYfOaP+JnidkPjJ4SZrX4 H4i+ixxbxE8JwHhPDziLibIo5XneV5rntDLvBb/WHO+FuJvD3hniTIMTRwPE3hLnvEfCWYY7NuIp YjOeJXxlXoU8NSxXDWN+U/ht4w+LetftSf8ABQzwz4P1/TdYvPB1x+ywPhtoPj/Vdek8BeH/APhI fhQNV8TCC30cXV5psOrn7VqE50m3BvNWFrNdbkMjjz7xN8QfFXgL4MfGWXwLGLj4ufEBvCfwm+FF lbXC2zz/ABN+KGq6j4W0C7tp7ho44YfDkt9c+Lb24upYYLXR/D9/dXMqRQuw/RvRviJ8P/ESNJ4f 8deDtdjXO59G8T6JqaLjJO5rK+nUYAJOTxg+hr5//ZjIH/CdTykAKPDpaVyAAP8AifvIWdsADhWc k4GATX9V8M5HVXhz4mYDDcQ16tXNak5Uszo8tT+zocQcWZ9mtL6pSeJqpYjLKGbRwFCtKv7KpHL8 JVWGpU4/VV/VH0LOL6GE/Zd/tn+K8z4CwuCo8K5F+yoyLE8OYtVMJWz6tw9410OE8fSzPEPAYWX9 n8Q4rhKpnWaYGGDWLovPMxw31/FV5/2jL8rPCuneIf2avCn7d37MPib4cH4ReDPil+x98RvjZ8F/ CbeMdJ8a2cWqeC/g7cfDP4s20PiHSrSxtrzWtel07w14yu9OFrFc2kLX95L58dwJV8/8Aw3ng3wv 8eIvjbPodl8R/iN/wScis/2d9T8IaIvhbwV41+EGifB7WPEPi7RdTtLi51K+1n4weEtaawfXLy71 m6lvvDEJ1fTNL0XR2FlF/QdrnxL+HPhiKSfxL4/8E+HoYVDTTa54q0LSYolOMNJJf39uiKcjBYgH Iwea5Lw78e/hl49v30j4Sapr3x81xBJ/xIP2cPA3jn9orWt8TbJI5dO+Cnhzx3cWhif5LmS9W2gs uZL2a2hR5F/nfM/Dzh3I44Kpj/EHLMqwOTwzOOV0s6hlmFw+Hy7NK+Z1MTh8VTp5nlWCrxwVXNcd /ZFTDYXAUsrnRwFOnQqUMJWw+L/z1yDxv8ROKvrtPKfAXifiDNONf9X8ZnGM4WfE2OxmcZtw1SyL LcDmmTYnE8PcSZtRjmr4Py/DcVwxeZ55V4inPiGWJxuHzDHUcZln4lwfDf4i+JvG/wCzX8UPglcz r8b/AIAf8Exf2VfiZ8PtEFxNHpvxAtodb8a6b40+FutwI2yey8f+Fbm/0izkxHPaa4ukTwXdkizz j7+/4JWavqHxg0f/AIJ8r4B0vU7b4oePP+Ckn/C4PBugpMkXiTw54A8FfteeKvid+0Lquo+VIj2m kaP+zlB8T/Cnii8IFjcyeJ7Twy7Nd+JdPtbr9e/hh+xD/wAFEfj/AHFrH4Y+AOl/sx+DL7yWk+Kn 7V3iDSk1uDT5mjEuo+Gf2efhdrviPx5rupW8byOnhz4oeK/gLJI8LCfUoFMYl/en9iX/AIJz/Bz9 i99d8a2era98X/2hPHOkWuifED4//ECHTU8U3+hQXMepL4D8CaFpUEOg/C/4V2msJ/aVj4H8NRPP qF3FZap448Q+N/E1lH4ib+b/ABE8ReAuF8JnWXcGcRVOL80z7h7PeHczp0Mvnh+HsNVzqWT0nn1L GVsRKVTNsJl2VU8DBZfHE4fF8mW16mLwlTKFRxv98eA/gL41eI+Z8IZ/4s8BUPCvhzgrjrgvjzh2 vjc9oY7jrMMLwjS4nxEeC8TlOFwMIUeGM0z3iWvnFWWeTy/HZZ7XiHBYfLMyo8UPF5T+gtfkZ/wV x/Ygf9p/4Lr8S/h/pJufjd8GLC+1TRYbKAvqPjXwQnmX3iHwWghH2i61K0KyeIPCUIFxK2qxaho1 lbrN4mluIv1zor+avDzjzP8Awy4zyHjfhqv7HNchxsMTTpzcvq+Nw0k6OOy3GRi06mCzHB1K2DxU U1P2VaU6UoVY06kf9pvCnxM4n8HfEDhjxG4QxX1fO+Gcxp4ylTm5/Vcxwc4yoZllGYQg4yq5dm2A q4jL8bCLjU9hiJzozpV4UqsPyX/4JK/tvn9qb4KD4f8Aj3V1ufjh8HLGx0nxHJdzE6h4z8Hrts/D vjn98zTXd+FRNE8WzB53GtwW+rXbW48S2Vsn60V/Ln+3f8J/G/8AwTW/bE8Gftv/AAD04xfC/wCI fia7PivwzalrXQ7TxHrAlu/G/wAPtRjijeC18O+P9NhvfEHhlvJlTRdctNQk0+0tT4c0Pf8A0g/B 34teCfjr8MvBnxa+HeqJq/hDxxottrOlXIKC4tzJuivtK1GFHf7Jq+jahFdaTq9kzF7PUrO6tnJM WT+y/SG4EyCnUyHxm8OcOoeGPirGtj8Ng6Si/wDU/i+HNPiPg7GxpRVLCyw+LWIxOV00qVKrhY4m jgYTwmAhXq/0B9Krwz4Yo1OGfpBeEuF5PBzxrjiM0weAoxi/9QuPIOdTizgHMY0Yqjg5YTHRxWLy aklSoVsFHF4fLadTA5ZTxNb0uiiiv5mP49CiiigAooooAKKKKACiiigAooooAKKKKACiiigBrqXR 1V2jZlZRIgQvGSCA6CRJIyyE7lEkboSBuRlyD+cvjj/gld+yb8S/FeteOPH2nfErxZ4t8Q3bX2s6 9rXxP8U3l/e3DAIu6R7rbFbwRJHb2dnbpFaWVrFDaWcEFtDFEn6OUVnUo0qySq04VEndKcVJJ90n dX6X7XWzZ42ccPZFxDSo0c9ynAZvRw85VaFHMMNSxVKlUlHllUhTrRlCNRx93nS5lFtJ2bT/AJmP 28vhB/wTm/Y5bRfhZ4J+A3ir47/tSeNNAPiPwl8JLb4zeMfDGi+GfCL6hcaSnxR+NnjVL3Uk+Hvw 8k1Oy1HTNBFh4f17xj8QNc0rVNH8D+FtVg0LxfrXhX8531H9pLxv4P0jwJ8Xf2nPiq3w20SxbTdC +BPwR8a/EL4MfBvQdFlZ3bw5e3mmeNtW+NPxM0WJJDp/9l/FT4t+KfCTabBb2mleCvD9iDp4+Xf+ Cjnxj+L/AMLdM/4KcfHWw1l9I/aO0j9tXx54Uu9W8Q6RYapcaP4G0D9oXwz8KvgDo7aXq9peWv8A wjk/7KM/wy1jQIDbNA9t4sn8TWarqesT3svyB8afil+1Z8PvjH4o+DEn7W/hbww/hb9i7xV+0Zfe NtT+D3w6gXVvGOlfE/xfbwaLoWialJdR6do9r4fstN0KX7Xd+KL7+wNJuL2SC48S30uvwf3Z4T+H XhbwXkWS8QcQ8K4rjLiHNuH+H+I3XhSyStkmW0OKKubwyjKqOEzTN8vw9fMOTJMfLHVcdRrUMPVw /Iq2HqTjTq/4qeP3H/i9xpx3xlwn4Q8QcHeBHB3D3GPHXhzUp5dg+I8l434lq+HNHhLEcU8QZhnH CfCGc5hQ4eeI4uyH+xsFlWNw2Lx9HFrESwWPpUamIw/6d+C/h58FPhzq8mgeAPBvw18G+I5bB9du dM8M6J4b0bxJd6dcXTWc2vX8VhbwaxewXd8JLe51m884XV6ZI57qW5Lg+mfbLP7Z/Z/2q2+3/Zvt n2Hz4vtn2MymAXX2bf532YzAw+fs8rzQY9+/iv57PHH7U3xF0H42/Bz4731kPBXij4r/APBOL9n2 08ffEBtEt9W8PfBGw+J/7QqR+Jvi/qnhqaSc3mh6H9ua40TSbiO8t4NT1jQI/EUTaVb6sK/R6fxl rNr/AMFAdT8PaJpOgeL/ALJ+wDbeMtHu10jwdYeL/FOsp8atUsbDSf8AhYqaVb6ha6BrXlQSppH2 +HwdaapdvrqaVDNumr+nuH/EjI8WquBy3K3g6WGzvLMtp4fD4eFCMcFnMMZUy/FRwVOEMQqs4YCt 7WlSw06Mai+rUsRWxNLEUaH8I8c+AHGOVuhnGf8AEcc1xGP4P4g4hr47HY6pjKk824VrZPQzzLZ5 tWqVsE8PSr55hPq2JxWYUsXPDt4/E4LCZficBisZ9/U10SVHjkRZI5FZJI3UOjo4KujqwKsrKSrK wIYEggg18LfHPxt8V/FX7LX7Wlv8Q/gldfCuytP2a/jNNp2oT/EPwj4zGq3T/DvxMktmtr4bZp7I wxfvzcXOIpB+7T56/Mn4a+J/it8NPib+w3+yz4vGpeKNW8Hap4h+Lf7OHjzUIjJbeL/hR4n/AGWf iumm+DtZuwpgXxF8LPF15D4PuEbyftfhu48P3NvYW1nHE9z2Z/4l4bI8zyrBSyXMsRg82eV4eljq 9DG5bOhj81z+jk2GweKy7HZfTxtFVqX13FYTE1YQoYrEYWhlqlTq5jhK0vM4J+jzmPGPDnEucQ4t yDB5rwwuI8biMlweMynP6WMyThrgnE8W5hm2XZ9k2eYjKcXLCYl5RluZ5fh61XG5bgcxxmfShXw2 RZnhaf7b3vwH+DD+KrXxbo3hPTfh/wDE21U3GmfEj4T6nqfwe+LmnBN6i40v4kfDDUfCXj6zjhkl dlFvrq26zNuZCx5+2Pgn/wAFAv26/wBlnUbC1vviQP20vhGJ0jl+Fnx2u9B8PfHzT9NRZGuIvhj+ 0PpVnpNt4n1G181ryLRPjt4Y8YX2vtDBpVx8WvBlozarB+B3/BPPwF+zB8RP2evhX8aPiV4f+Hfi v9o6b4gXup/ED4jfEyHQrv4yWHx10v4galFp+nXWu6058TaJqdre2mkx+FfDNtPYwy6YNJe20p3u 283I/ZY8Dfs7fG28/a58S/tY+GPhz43+NPhf9pb4n+GvGFz8aINC1HVfAPw/0a+sh8OdP8ISeJ28 /wAIeAYdGlP9h6noq6Tb6ndrqLm7uzbxun5nxFkvBPiTlnDUs24F4UhjeNMBXzTK8yoZ9LLMbl+E p5ZDMmsdm+C4edRZvGOI/d5dOhmOC/cZnWnWqQwU4Yn+hOBOL/F36P8AxH4gx4X8ZvEyrlPhHneD 4c4j4fx3BMOIspzzM8RxFU4fvk/C2b8dLDvharUwLdbP6WNyLN39b4dwdLDYetm9Otl/+jB+y7+1 P8Hv2wPhTY/Fz4M61fXmkf2jd+G/FfhfxFpz6B49+GvjrSYbWbX/AIefEfwrcSS3Xhnxhoa31lPc Wby3Wm6tpOoaR4o8Marr3hHX9A1/VPoqv5fP+CSOo+IdM/4KK/EbQvCTznwR4y/Y31fxT8b7a0VX 02Lx14N+Mnw20H9m3V9T2DZbazrfhXxX+0xpljdPi41rSfCTWryTW3hizS1/qDr/ADy8SuEKfAfH PEXCVHHQzKjk+Mp06GMjyqVWhicLh8dQjWUG4RxVCjiYUMXCL5YYmlWirWsv93fo++Kdfxr8G+Av E/FZNU4fxfFeU1sRjcqqe0cMPjcvzLHZPjamElVjGrPLsZisuq43K6tRc9XLsRhaknJy5mUUUV8M fsgUUUUAFFFFABRRRQAUUUUAFFFFAGXrmh6L4n0XWPDfiTR9L8Q+HfEOl6hoev6Brmn2mraLrmi6 taTWGq6PrGlX8NxY6npep2NxPZahp97BPaXlpPNbXMMkMjo383X7W3/BDXxlb+FfHWhfsXeM/Duv fB/xz4d8R+GfEX7Jfx78S+JtI03RPDPiXR7rRtY0D4D/ALQehad4n8W+B9JGl3FxbaB4H+I/hfx9 pen3l3HaaD4++H3hewsNJsf6WaK+h4b4r4i4Qx08w4czXE5XiatGeGxKpOFTDYzC1FaphcfgsRCr g8fhZ/aw+MoVqLaUuTmSa+F4/wDDPgTxSyilkfHvDWX8RYDC4ulmGXyxSrUMflOY0GpUMyyXNsFV w2a5LmVFq1PH5XjcJi4xbgqvJKUX/DLeeF/Hv7J/hLQfAvxz/Zj/AGhP2cPDvgDw5ofhW18QeLvA Wp/EP4VWekeGrC08PaWbj9oD4STfEf4UCP7BY2f2S48VeM9B1u+tds9zpdvcRX1vaaXhD4nfDb4g wpceAviD4J8bQSRmZJvCXirQvEUbRAkNIG0i/vBtUghjnCsCGwQRX9xFfMHxf/Yl/Y3/AGgb19U+ OX7KX7Ofxd1ljvTXviN8F/h34v8AEVvKHeRbiy8Q654dvdasbpJJZJI7uyv4LmKSR3jlV3Yn+pOG vpjcVZXhcPg894TyLOKWGpQo06mW4jEZBWdKnCMIKcPZZpg4uKVksPhMPSUVGMaUbXf+bviD+yh8 NeI8xxuacGeJ/GfCmJx+IrYuvQ4hwOB43wscRXqSqVXSq/WeHM0lGUpc0pY3M8diJTcpzxEuZRj/ ACnUV6v/AMFR/wBjD9mf4A/tMfsveBfgh8MLf4S+EviYllH400T4eeJ/G3hK11VLjx7p+iSrbNon iWzuND/4lV5c2cR0CbSzBHKzQGOQK6/rP44/4IX/ALDGreEfEem/D21/aL+HfjW80u7i8J+MT+3H +3p4tsfCuulC2marJ4L1/wDaim8M69Y2NyI3l0HU7R9LvLYPaTQ+Q22v6Pzr6QuX8N8L+F3Fee8P TwuXeKOFzXGYJ4bNZ4z+w8Nk2cUsnxlbNbZTRrVIxnUeKjHLqGMrTw8JKNKVdxpPyuNv2E/iZwXw t4Oca4v6QnhzPh3xmwueY/KMRiOFOK8Pi+H8Bw/n1HIcfic/weDlmjajUqvGRpZRVzStPDU5xhCe IcKMvxBrjNa+I/w98N2t1feI/Hfg7w/ZWMtxDe3eueJtF0i2tJbRnW6juZ9QvbeOB7cxv5wlZTGF LNhRmsdfgn4J/ZX/AGrbH4Xfts/DO2+J/gLwlrCWfjTRk1XxDe6dqvhnW9LkGi+OvCUljqem3N/Y 28V7aeJYdAuRHHetb32g6zpdprizrY/o14p/4I2WmtaR4b+P/wDwTt/aMstd0S4jt/EXgbTvEWoR adc26xfMsPh34g+F7O2toLu1lEmnHQNe8K6NNpjwS6ZrmqC4iukWuC/pMeHnF+P4swGPxdbgfB5X mayXhniniLDYjMOHM3zScsa6NHPMRkVPF0OG6WMw+E+s4OvXzDE4fEUY4ypSxFRYGqp/SfRm/Yy+ DXjDmvi/lHib9MTMvC2lwXxpDgvgfiet4MVMw4bzvHUsbmzT41xeA43zbCcHf6wZVlyxGS1VmmZY DD1KGc1ljc5w+UyjiPz88BeI/GHxuEKfszfBH44ftNPeGaOw1r4SfDzU3+GM9xF5apFP8d/Gz+Df gPY+bJNEALr4lJcCBnvFt5LSGWVP08+AH/BG34u/Fu/tfFH7dfifwz4B+Hkkcfm/syfArxFqWs+I /F+nM6StoPxt/aB+w+HbqLw7drvh1/4c/BrRdKju5M20/wAZfEnh641DR9Q5bw1/wU8/b4/Yw1aw 8DftyfAbVfGegpMlha+MLvTrbwl4iu4og0TPo/jXw9aX/wANfHX2aGIyCK3t4dQu3R2v/ECvKZk/ YX9nL/gpF+yN+04bLTfBHxNsvDfjS8WIL8PPiOsPg3xc1zLjbZ6bHfXMmh+JbsfMWg8Ka3rskaI0 kqxoCa/IvHWf0n6eUV8b9VyvGeHGMpVZQ4p8Ia74i4ex+As1Ktjc8w1TFZ1gsM4P2daeKpZRgsRz ypuFWL5V/oJk37EDI/oqwwXiLPgmv4+5ThOTMMp8XsrznB+I3AlJUJKf9qYPLOHcHg8BlOHpVo06 mGxnFGSVK2ErwpvB5jKrF1ZfaXhvw34d8G+HdC8I+EdC0fwt4U8LaPpvh7wz4Z8PaZZ6LoHh7QNG s4dO0fRNE0fTobbT9K0nStPtrex07TrG3gtLK0ghtraGOGNEG1RRX8DH6TtsFFFFABRRRQAUUUUA FFFfhN/wVN/4KHax4QuD+x5+y9d3niD47ePZrbwv4x1rwl5l/q3guPX3jsbXwV4a+wmSZviN4j+0 pbTPb/6V4W0+5Rrfy/EF9aXGi/ofhf4Z8S+LPF2A4R4ZoQ9viFLFZlmeJvTyvIMnw7i8fneb4m3L hsBgqclKTk1PEVpUcJh41MTiKNOf6p4NeD3F/jjx1lnAvB2Gp/WcSp4zN84xjlSybhjIMK4yzPiL PcZbkwmWZdRkpTlJqpicROhgcLGrjMVQoz8o/wCCln7c/j344fEFP2AP2NVvPFXiPxXqMvhD4oeJ PC06tc6xfuZU1X4c6JqiyxWmn6DpdrDdS/ErxJLcxWMVpDe6Pc3lnpNh4ia9/T79gP8AYZ8E/sT/ AAoh0K2Fhr/xX8VwWl/8UfHsdviTVNSRC8Hh3RJZkF1beEvDzSywaZbuIZNRuWutbvYILq++yWnk n/BM/wD4J3aF+xx4FHjLxza6drX7Q/jfTUHizWo2jvbfwTpFyYblfAfhu7G6Nkhljil8TaxakjW9 ViEUM8+k6fpzP+ptfrnjF4l8M5Vw7Q8C/BytOPhxkeLjiOKOJ4xVHMfFLiqg4RxGd5hUhJuWQ4Wv Sisjy/mlQcKNDFP2kKGX/V/3fx98YOD8k4Twv0a/AHETh4ScN42GK4z4yhFUM18aeNsM4RxXEeaV aU25cMYPEUYrhvKueeGcKGGxsva08NlSwpRRRX8wH8aBTXZUVndlREUs7uQqqqglmZiQFVQCSSQA ASTiqOratpeg6XqOt65qVho+jaRY3Wp6tq2qXcFhpumadYwvc3t/f311JFbWdnaW8ck9zc3EscME MbySuqKSP5nP2wf29fjF+3t8R5P2Mv2ENO1q78Ga5NeaV4y8eWBl0q68d6PBIttq9zNqcixt4O+E tskn/E11G9a21LxVBLBp80MNnfjQta/WvCTwd4k8W84xOGy6rhck4ZySj/aHGHGucyWG4e4Uyemp VK+Mx+Kqzo0qmJlRp1Xg8vhWhWxUoTnOeGwdHF4zDfufgX4B8XeOmf4zCZTWwXDvB/DmH/tXj3xE z+ccJwrwTkNKM6uJzDNMbWqUKNXFyoUq0sBlcK9OvjJ051KlTCYDD43H4T1H9vX/AIKd+MfiV4xP 7H37BH9peMPHHinUG8J+IPih4Ldrm9ub6UvHf+G/hffQOkEaQQxzjXviM1xFp2mWUV7c6HeQ29uP E1v9df8ABOj/AIJieDv2StKsfid8TI9N8b/tH6vZvLd623+n6N8OItRg23mheD2mBW41Z45JrXXP GDIt5fJJcafpRs9JmvDqvsP7Bv8AwT2+F/7E/g0SWq2XjP4y+ILOJPG/xOurFUuCGCySeG/CEU4e fQ/CttMBujR0v9euI49Q1p28nTtP0r9B6/SvEnxi4ayHhjE+DXgPSxWT+H7lycW8ZYiLw/FXiljq cXSq4rM66hSr4Hhx3qLA5LFUY1cPN/WaFCnXrYJ/r3i74+cI8M8G4v6P/wBGajjch8LpTVPjnxAx UZYXjbxozKjCVGtjc4xEYUMRlvCUm6kcu4dhGhGthJv65h8NSxFfLgr+cn/g4W1byfCX7Lehbsf2 j4i+LGrbM/e/sXTfAVnuxnnZ/b+M4ON/UZw39G1fzQf8F72bxB8U/wBjvwWP3nnQfEBliY5Ut4n8 R/DzSTlfNX/Wf2OqscRbgoHmttxE/oX0IVfpI+H1ar/AwFPi7MKz/lhheCeIpQl/27WdJ+l9bh+z 2w1Ot9LjwsxFZf7PllLjrNcQ/wCWGC8O+LJ0566e7iJUX6H626x/wT7/AGENb8BWd/4+/Yt/ZM8Y 6tpXgy2lu9a8V/s5fB/xNq0l3p+hxvNfy6hq3gu6vZ7wzQG4a5LC4kn/AHvEh4/DD/gir+yL+y1+ 0xo/7QmqftJfszfs+/tBTeDdW+GNt4Hu/jf8G/hx8WLnwidVtfHNx4gj8Ly+PPDmvzeH01dtP0KT VP7Ka0XUn0zTmuvObT7cw/1K+Pp0tfAvjS5l3GO38J+I55AoBYpDo95I+0EgFtqnAJAJwMjrX4Af 8G9lvIvgX9py6O3ypvFvw0t0wTu8y20fxfJJkYwF23UW05JJ3ggYBPZ4c4qtiPoyfSoxdapOVTG5 z4LqTnNy9/8A1yzDEyUG9eZOV5Pa1rJM6PCFwl9Dj6bGM9lTpzzXiD6PntuWEYqpU/1/zbGT+GMe afNUlKTle8Xsm2yr/wAFDf8Agk9oXgRNL/aU/YL+Ffw++GerfDqDTdS8UfBD4T/DHwN4Q8Panb+G 5nvrbxl4T8HeGfDun6HrXiCyQbPEfhzUtM1JvE+lQxrZJNdWr6RrH3t/wTf/AOCh/gX9sPwRb+Dt Zg0bwP8AHbwXpMCeJvAtkI7DStf020Vbb/hLfAdo7730UsIxq2iJ5t14Wu5o7adrjTrjTdRvP0/r +ff/AIKM/wDBOfxh4R8Xt+21+xIupeEvil4U1CXxl458E+DMWd5fXVqjT3/jfwLp1rEI5tXnh+1H xj4QWKa08W2k95cWthc6jc6np+u6+HnFnB3jFwjlPgl4p4rAcOZ9ktOphPCHxQnRp0KeT18RVlVh wfxhOmoLE8OZhiptYTMKt6+XYqrzTqOMuZ9HhLxh4deO3AmRfR18ZK+UcHcS8PUKuX+BHjKsJh8H SyGvisTVxVPgDj2eHhRWM4SzXH4irLAZnW5sRlGPxU6k6jjVc3/QRRX5hf8ABOb/AIKN+D/20PCI 8LeJxp/hL9oDwnpkMni3wmkqw2Hiuzt1jgn8aeCo5XMsmmzTsp1jRGaW98N3c6QySXenTWOo3P6e 1/O3HHA/E/hzxPmnCHF+V1spzzKa3s8Rh6vvUq1KXvUMbgsRH91i8Bi6dq2FxdGUqVanJNNSUox/ lbxH8OOMfCbjHOeBOPMmxGR8SZJX9lisLWtOjiKM1z4XMMvxUL0cdluOo8uIwWNw8p0cRRkmmpqc IlFFFfJHw55F8efgn4H/AGifhL42+DnxDsftnhnxro82nTTRKn27R9QjZbnR/EOkySKyw6voGqQ2 mq6dI6vCbm1SK6intJZ4Jf53/wDgnR8bfG37AX7Vvjn9gb9ofURZeCvFPiw2/gnXrx3h0PS/G2ox wDwx4g0m4unTyPCPxY0f+zrcq3mGw8Sf2IlxDp0z+JpV/p9r8fP+Cu/7Dn/DSnwgPxe+Hej+f8cf g1plxf2cdjETqXjb4f2rXGo634SQRYmutV0h5LjxH4UjUTzyXi6tollbvdeIklg/p36PXHPD9Wnn 3gf4kYn2Xht4pSoYalmNTkk+CuOI8lLh/i7ByqyjTw8FXjh8Fm0nKlSq4aOGnjaqwOFxNKt/Y/0V vEjhevT4n+jj4t4z2PhF40Sw+Do5rWdOX/EO/EeDpUeFuO8BOvKNLCQWJhhcvzybnQo18HHB1Mwr rLcFi6Nf9g6K/K7/AIJS/tup+1j8DYvC3jXVhc/HD4RWmn6H42N1IovfF2glWt/Dnj6MFi9zNqEM H9m+JpFy0fiO0nvpo7W21vTIn/VGvxHj7gfPvDfjDPuCeJsN9Wzjh/H1MHiOVS9hiaVlVwmYYSc4 xlVwOY4SpQxuDquMZVMNXpylGE+aEf508TvDjifwk494n8O+MMJ9Tz/hfM6uX4pRU/q+Mo2jWwOa YGc4wlWy7NcDVw+Y5fWlCEquExNGU4Qm5QiUUUV8gfBhRRRQAUUUUAFFFFABRRRQAUUUUAFFFcn4 z8e+B/hxodx4m+IPjHwv4H8O2gJudd8Xa9pfh3SYSFLbX1DV7q0tQ5AO2Pzd7nhVJIFbYfDYjGV6 WFwlCtisTXqRpUMPh6U69etVm7Qp0qNKMqlSpJ6RhCMpSeiTZ0YTCYrH4mhg8DhsRjMZiakaOGwm Eo1MRicRWm7QpUKFGM6tWpN6Rp04SlJ6JNnWUV+N3x3/AOC3X7I/wu+2aZ8NV8T/AB58SW4eOMeF LN/Dng1LlFY+Vd+L/ElvDPLEzbFW88PeHfEdowZmWU7NrflD8e/+CrP/AAUB+JnhT/hKPDmjaf8A sy/CbWZHttG8Q6VpD2mq+JI8o722heNvGkU2o+J7+0Se2kvJfhlotheWNtJFdX0VtZySSt/TnAv0 P/G3jR4LEYzIcNwJlWPq06OGzLjzF/2DUxFScXONHB5JKnX4hxWIqU4udCnHKo062ijWUeaUf7G8 NfoFfSK8Qnl2KzDhnB+GmS5pXp4fB5t4m45cMVsXWqRdSOHwHDsqWJ4qxmKq0YyqYalDJIUsRZKO IjFucf0W/wCCuX/BPz4C/GLTtW+P4+JPwL+CvxgvdD0jR/GekftCw6bqHwA/aZ0PwZcQ6h4O8N/F fwvcR3mpweM/CGoQ2UfgP4teDND8ReMPDVqLXSdY8KfEHRNK8MaDof8AKbruhfs5/FD40z/HH9o/ wRpF3qGj/Cc/B/UvDHi7Q/DnxX+C9ta+GvH1944g+IOg6neeGm1sW7NeagYfE3ibwz4NTTvDi3Mm t6To/mzFvqf4Ffs2ftTft+/Eu6/4Rs+KfH2oNcwp40+LfxE1rWb/AMPeG4pAHEniPxfqrajd3F2Y mMljoVh/aOu3kQaSz0traK4mg/pW+Gf7C37PH/BM34B/E79oS8itfiV8Zvh78OfEfiWH4l+MNMtH TTPEdrolzDpOkfD/AECV7i18Lx6xrc9rpEV59qu/EV6upPZXWujT7g2Uf9R4vhHw7+jXkkOAeIOP cb4ueJeeVcDQ4V8N8FlmXwyPJ+IMbWnDJ8Tmsak8ZmmCy+GPzGpUhhK+b4T+0IYzFYvDcPVK+Ini aHzX0qP2Vv0KOHKGZ5Zxz4n+IfEX0veNuHcZwfwXDwRx2F4PqZNn/FuFy/KsmzPjLATlnVHF0cPj MLw+oYrNcRl/EWc5Tl2EwODwLwFOi8D/ADraLpf7PHxchv8AxH4e074MfE6DVvBT/DXVNd0Wz8D+ NIdT+HM1w95J4Av9UsY9SS88FS3c0t0/hW4nk0J7iV52sDK7Me10b4c/D3w5qmm654e8CeDdB1rR vB9j8PdI1fRvC+iaXqmleAdMuhfab4H03ULGxgu7Hwfp96BeWPhm1mi0W0ugLiCyjmAev0E/4JFf sEfs+/tPfCP4v/Gv9q34F/DT47XPirxxH4O8EX/xZ8D6B4v1Tw/aeHrB9W8U674M1vWLC41fw5ce IdZ8VJp+o6l4fv8AT7qWfw20HmqI5RJ+k+o/8ETf+CauoTPNb/Anxl4Z3vJIIPAP7Tv7WPw2sYWl Yu4tdO+H/wAcvDNhZxlyHEVrbQxK6oyoGjjK+b4ifSJ4e8MfELiTgfMuEqGfY3hfG0MFX4hyOvhs NRxeO+q4fF4yNPBY3CyxGDngcXXq4OrF4/FN4jD1ZxqWaZ/gL9JH9ivxX4N+K3GvhTwl9KfD8cZV wnmEcnrY/NuDs4yKjVnLLsHWxeClhcHxZndGrUy+rXqZTjE6WHpSr4KqqcHS5D+fXWNH0nxDpOqa Br+l6drmha5p19o+taLrFjbanpOsaTqdtLZalpeqabexT2eoadqFnPNaX1jdwzW13bTSwTxSRSOh wrj4f+A7u/8ABuq3fgnwjdap8Oo7uL4falceG9Gmv/AsV/pqaNfR+DbySya48MR3ujxx6Vdpokli tzpsaWMwe1VYh/Quv/BEL/gnSu4P4C/aLuEdSjw3n/BQP/goVfW7qcHD215+1LPA+CAQWjJUgFSD zXU6F/wRk/4JlaJfwajd/sp+GPHc9u+8RfGPxr8Vfjrp85GcLf6T8Z/HnjzS9Sj5b91qFndRZZjs yzZ+PxX0yuFakJTh4f5nisQvZOEcVmGXU4Slh6yxGH5q6wuKnD2OIjCvSaozdKtFVYJTimfg2W/s m/EmhVp0qvjjw7l2CbxKqzy3Is+r1YQxuFlgca6eElmOXUqjxWBqVcJiYyxVJYjCylh6spUZyiv5 M/Feh/sP+G/ira+LfEvhT9ndvjve6rb3+lz2/hDwT4g+Ner+IbeZZ7S+0PR9H0rU/iHrfiWKe3ja 1u9J0+81pHhRYZBsVR9L+Ev+CYvxo/bm8Z6V4t0z9hHwF8O9NmEdpdftQ/tx/B7R/DGr6XpcCLFb 3Xg74E+INMj/AGg/H2q6dHKt1omieP8ASvgx4RnVWFt49tJCy1/Yx8J/gD8CPgNpk2i/A34KfCT4 MaPcKi3Gk/Cf4b+Dvh1pk6xnMazWHhDRtHtZVQ8oHiYKeVANet1+NcY/Sf4iz7B4vLeHeFuGOFMF jcQ8ViK0MBhs3zKpiXf/AGn2+Lw1PALFLmnbGf2Y8XCT9pRr0Zq5/WfhR+zl4D4KzTK8/wCO/Ejx F8S82yjAxy3A4SpnWP4X4eo5dFxf9n/U8rzCvnU8tbp0m8q/1hhldWEXQxeCxdFuL+Pv2NP2LPhd +xb8PtR8L+CrvWPGPjrxpeWGu/Fv4w+MBYyeOfih4msLNrKyudTOnW1rpug+F/D9tLc2HgjwF4ft bLwx4O025u00+0m1bVdf1rWfsGiiv5nxOJxGMxFfF4uvWxWKxVapiMTicRVnXxGIr1pupVrV61SU qlWrVqSlOpUqSlOc5OUm22z/AEMy/L8BlOBwWV5XgsJluWZdhcPgcvy/AYejhMFgcFhaUKGFwmDw uHhToYbDYajCFGhQo04UqVKEadOMYxSRRRRWJ1hRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQB /NP/AMFo/wDk8T9iP/uF/wDq0dGr+liv5p/+C0f/ACeJ+xH/ANwv/wBWjo1f0sV/VHjZ/wAmK+in /wBkr4if+thSP7X+kV/yjV9CP/sivFf/ANb3Dn4K/wDBcH9nUeIfAfgb9pXQNPaTVfAVzD4D8ezQ Rbmfwdr17LP4Y1O8cD5IND8VXU+lIeWkl8Ywhvkt1K/j9+yD+0z+0t+w/ZR/GrwRY3fjv9mjXvGY 8NfEzwXJc3E/hyw8SCG1ufs9y4jlk8BeMdR0aeC68LeJ47d9H8SRRHTLsa7LoGp6RpX9lvxT+HHh z4v/AA38b/C/xbb/AGjw5478Nat4a1RVVGmgh1O0kt47+0LgrHf6bcNDqGnT/et761t50IeNSP5a v+CfHiBP2dv2uviP+x98e9H0nVvA3xivdS+CPjzw5rttFfeGr7xlpN9eReCdQks72Nor7T9fnnvN C0t/JH2iPxdpupB0S2jdfxvwo8TsP4X8TZgs94bwHGfAPHGX08g444SzFuFLMcHSxFPEYTH5fiY6 5fn2VV08RlGYxXtMNOrilCdGdZYij/DfhN4x4X6M/j3LOeI+Ess488F/H3JKHAHi3wPmrdHCY/EY PFUK+S55l2LhZZPxPlOIVHEZFnCtVwksTnlSFShUr/W8P/Rt8Dvj1+z5+278In8S+C5dB8feDtWh TTfGHgXxdpWl6hqGgahNEJJ/DfjjwnqA1C1iuFG4xGRb3SdUgX7ZpN7qFi6XLfA37Rv/AARK/ZZ+ Lpv9c+FUusfs/wDi+582VE8LxjXvh9cXMnJe78EapcwyafHlVSKDwtr3h3T7ZWkf+zbhioHxJ+0v +w38fv8AgnJ8Q779rf8AYS1zXL74ZWEkl943+HTtda5d+FvDzXC3F/o/iDSnlM3j74YrlibyUt4n 8I26x6ncXhm0x/F9v+tP7C3/AAUS+EX7a3hoWenSQeCPjJotglx4u+Fup30cl4Y41RLjX/B93IsD eJfDBmO2WaGFNS0SSSK31uytkuNOvNS/ojMsi4y8KctfjN9GPxC4izTwrxmIjLMo4StzZxwXj37O X9h+I3DM418uxMcO506eGzbE4Cvl+Ij7KcvZQxGAxOYf6IZtw1x/4I5Q/pBfQ58VOK858FMwxUZZ xHA4hSz7w9zNqlL/AFb8WeD5wxOU4yOFdSlSwmeYzLMTlWLg6FSTo08VlmLzP8h/+Eb/AOCwP/BO PafD17c/tKfBDRXLrYWseqfFbQbXSLcCTy5NGnWy+Kvga1tbQO9wNEmh8LWEvmySXd/HEJX+zf2d P+C4f7OHxKez8PfHLRNb+AHi9mW1nv78XHiv4fTXgbySo1/TLGHW9EaWUF5I9d8OQabpqHy7nX5v LaZv2zr41/aL/YC/ZU/aiS8u/if8LNIj8WXStt+IfhAL4S8eRzlSiXFzrmlRomvNCpIhtvFVnr2n xk7hZ7grL4//ABGrwj8Tv3Hjl4VYfLs6r+7U8S/CNYfhzP5VZaPF5zwziefIM7r1JNVMVi6jhWjC DhhMInJRXgf8TDeBXjF/s30kPBPC5VxDifdreL/gUsJwlxROtPSWO4g4OxbnwxxHiqs3GrjMfVlT xEKdN08Fgk5KC+pfCPjPwh8QNAsfFXgTxT4e8Z+GdTTzNO8QeFtZ07XtGvUwrE22paXcXVnMVDLv VJiyEgOFPFdLX81Hi7/gkx+2H+ylr998RP2Bv2hda1SJZPtUngvUtYt/Bfiy/htyz2mnahHcM/wx +IMcYGZE8T2nhuzZ2VYtKlOSNX4d/wDBZf48/AXxHb/DL9vf9nfxHpWr2u2KbxZ4b0KXwd4rmt43 VG1SfwZr8lr4Z8Twzl/MXVfC2ueH9KeFY2srG780OeXF/RlXFmGr5v4CeIPDfi7gKdOWJq8Nxqw4 X8RMuoRXNP63wrnNWjLFU8Or0vreDxP+21ISeDwclKMTkx30O1xxg8Tn30Y/FLhLx1yujRni63CU a1PgzxXyrDxXPU+vcFZ/XoPG0sMuaj9dwGMvmFWnJ4HASUoQP6QqK+X/ANn79s39mn9p6zil+Dnx W8OeIdYa3FxdeDb2Z9A8c6eFQtOLrwjraWOtSQ2rK8cuo2Fre6Q7IWttQuIikjfUFfzXnmQZ5wzm WIyfiPJ80yHNsK+XE5bnGAxWW46g3e3tMLi6VGtFSs3GThyzWsW1qfyHxHwxxJwfm+KyDizIM54Z zzBS5cXlGfZZjMpzLDttpOtgsfRoYiEZWbhJ01GaXNByWoUUV+cv/BRb9vvwt+xR8NBFpZ0/xB8c fG9jdRfDfwdcN50FjGrNbT+N/FUEUsc8PhnSJw6WtuHiuPEmrRDSbGSK3g1nU9I9Lgzg3iPxA4ny jhDhTLquaZ7neKjhcFhaekY6OdbE4mq/cw2CwlCNTE4zFVXGlhsNSqVqklGLPV8PuAOLPFHjHIuA +CMpr51xLxFjYYLL8FR92EdHUxGMxldr2eDy/A4eFXF4/G1nGhhMJRq16slCDPIP+CoH/BRyx/ZW 8MP8IPhJeQax+0h4305EsVto49Qj+GOi6n+5g8S6pa7ZkuPE2pIzL4O0CWOTdIV1/VYW02HT7DX+ P/4JZ/8ABOi6+Blj/wANLftA20ut/tFeP7W41TTbDX9+oah8M9N8Qebc6hPfXV4880/xF8TRXLP4 k1OU/bNHtbi40CKUTXWvyX3j3/BMD9gPxb4m8Un9u39ryPU/EnxR8Zam3jL4a+HvFi+dfWk+ogXM HxN8UWM8SiLWJ0aJvAuitFDbeG9NjttYW0jvG0OPQ/6Cq/pLxP4y4c8IeEcd4B+E+ZUsxxmNdOPj L4j4JpVOLM3oJxqcJZHiY/vKPCeT1JVsNXVOaWY1XXoSvSrZnUzT+uvGXj/hLwI4FzL6MPgfm1DN cfmMqUPpA+LWXNKrxznuGjKFbgbhzFx/fYfgfIa06+ExCpTis1rPE4efNRr5vVzkooor+RT+Ewrk /HXjvwd8MvCOv+PfH/iPSvCXg7wvp82qa94h1q6S00/TrKHALySNl5ZppWjtrOzt0mvL+8mt7Kxt 7i7uIIJOY+M3xp+Gn7P3w9134ofFjxRYeE/B+gQ7ri9u33XV/eyK5s9G0WwTN1q+uak8bRafpdjH Lc3DK77Ughnmi/mY17XP2pv+C2Pxl/sHwtbX/wAJP2S/h7rQaW7vluJ9D0o8bdU137PJBa+Ofitq GnTb9M8PWk66Z4VsbsR/atPtLzUNe1v908H/AAVxXiJHMeKuJc2pcEeFHCzjV4v48zGFsPRS5JLJ sioyTlm/EON56dLD4PDQr/V5V6E61OpWr4LBY7+k/AX6PGN8V45txpxfnlDw58EeC5RrceeJebQ5 cLh4x5Jx4f4aoTi5Z7xVmCnSoYXAYSniHhZ4nDVMRSrYjE5dl2Zanxx/aQ/aO/4K7/F+X9m39mDT NV8G/s5aPfW134q17VEuNOttT0y2uysXjH4oX1qZTbaUZoXn8IfDu0knu9SvIEvLyC+1G0R/Dv70 fsc/sW/CT9i/4dJ4O+H1l/afifV4rOfx98RdTt4k8R+NdWto2CyTlXmGlaFYySzrofhy0mez0yGW SWaW/wBVutR1W+9H/Zz/AGb/AIUfss/DPSfhZ8I/D6aRoliFudU1O5Mdz4h8Wa48McV74k8T6osU Lalq995SBmWOCysbdIdO0qzsNLtbSyg93r1/FvxtwnEGT4fww8Lsrq8E+DWSV1PB5LCSjm/F2PpO N+JeNMZBupmGYYqpSp4ilgZ1KmFwThh0/bVcLhp0Pd8dPpFYLirIcJ4NeDGS1vDv6P8Aw5iFPAcP U5qOe8d5lQlDm4v8QsfSk6ma5pjKtGliqGXVK1bB5e6eGX7+tg8JUwpRRRX86H8nhX8zf/BX9jr/ APwUI/Yl8GlTIs1l8NmER3bXPib43X+lMo2hzlxpCq22NmwF4fhR/TJX8y3/AAUCZvFH/BZz9jbR Ww8eh3f7NFs8bqCjW9p8ZvEniy5iIYRhhLDeyKTukPzYBYqIV/q36HS9j4r5tmnTI/DPxEzZy19x Usgq4bmutVb63a/mf259ARew8bs9zrZcN+D3itnjnt7NUOF6+D501rG31211qlLzP6K/ivcR2vwt +JV1Lu8q28AeMbiTaAW8uHw7qMj7QSAW2qcAkAnAyOtfhJ/wb4wOvws/aNuTt8ubx/4KgQAndvt/ DuqSSZGMBSt1FtIJJIYEDAJ/cj44zpa/BX4wXMu4x2/wu+IE8gUAsUh8J6vI+0EgFtqnAJAJwCR1 r8Sv+Dfa3kX4KfH+6O3ypvil4ft0wTu8y28JxSSZGMBdt1FtOSSdwIGATn4d/u/oqfSLlt7fijwi oXe0vZZ3ja3LH+8t3/dZl4Ufu/oS/Sxnt9Z4z8CcPd7S9jxHmGI5Y/3o35pf3T+gaiiiv5WP4oP5 8P8Ago5/wTl8XeDfFp/bZ/YlGpeEfiZ4S1CTxj448FeDF+yXs93arLc33jvwNY26tFJqUkXnL4v8 HLbTWPieynvLm3sp7mbU9O1r7P8A+Ccn/BRzwh+2Z4RTwn4sk0zwn+0L4V05G8VeEkkFtaeLrG1S OKbxp4MhmIaWxllOdb0ON7i88N3UirKZdMubC9n/AFAr+er/AIKP/wDBOPxd4P8AF8v7bf7FQ1Hw r8R/Cmonxp448EeDYzaahLqFoxuL7x74DsrSPZJqMsRuJvGPhNYZLbxFayX15a2tzdXWpabqv9hc C8ccMeOfDOV+DnjHmlHKeKcporA+Evi1jffrZZVk1HDcGcY4lv2mM4dxdRxo4HG16jqZbUcIucUo Tl/e3ht4jcG/SS4PybwB8fs5oZHxpkmHWW+BvjlmPv18nrzcY4Pw/wCP8XJ+1x/CmOq8lDLcxxFR 1coqypxdSKVOb/oVor8u/wDgnH/wUf8ACP7ZvhRfCPi9tL8JftC+FtOEvifwpC/2XTvF+n2wWOXx j4KiuJZJZLNmKHXND82e98PXUg3NcaXPZ3sn6iV/NfHPA3FHhxxPmfCHGGV1spzzKq3s69Cp71Kv Rld4fG4LER/dYzAYunarhcXRcqdWm94zjOEf5D8SPDbjLwl4yzjgPjzJsRkfEeSV/ZYnDVffoYmh O8sLmOXYqK9jj8sx9K1fBY7DylRr0paONSNSnAooor5E+FP5cf21fhh4z/4Jhfto+Df2z/gZpkg+ DfxN8Q3ieK/ClgGs9GtNT1dheePfhrepErWlpo/i+zhuPFfgh3iMGja3ZXAstPji8Jacbj+k/wCF fxO8G/Gf4deDvip8PtVj1rwb450Oz1/Qr9AqyG2ulKzWd7CryGz1TTLuO40zV9PkczadqlneWM4W e3kUcv8AtCfAvwT+0l8H/G/wZ+IFr53h/wAZ6TJZrexRRSX+g6vAy3WieJNJMvyx6poWqQ22o2m4 iKdoGtLoSWdzcQyfgF/wTO+Ofjb9iP8AaZ8c/wDBPH9om9Njoms+LpYPhtrF08y6Rp/jjUFil0k6 NPeeU8fhL4t6U9he6MuMQeJ306EWkF7r+tzR/wBk43/jpDwaWaR/2rxq8DsmhRzaKXPmHHnhXhpW oZk9PaYzOOEalRxxcryrV8JUqVqs8Vjcyw1Kj/f+Yf8AHW/0f1nUP9s+kP8ARv4fhQzyCXtM08Tf BTCT5cNm70dbH5/wJVqunjp3nXxGAq1MRXqYzMM2wlCh/TJRRRX8bH8ABRRRQAUUUUAFFFRXFxBa QTXV1PDbW1tFJPcXFxIkMEEESGSWaaaRljiiiRWeSR2VERSzEAE00m2kk220kkrtt6JJLVtvRJbj ScmoxTlKTSjFJttt2SSWrbeiS1bJaK/Ob47/APBVf9ir4DfbLC/+Kdt8SvFFnvQ+FPhDDD45vDMm 5ZIJ9ftru18E6fPDKohubTUPFFtfQOWU2jNHIq/lpr//AAVv/ba/ah1W88I/sQ/s032k2/nG1fxS dDvPif4j0/cSbe9vr6ax034ceDlmQqZYfElprtrGxVY9TbcGb994M+jL4xcZ4P8AtiPDP+qfDMIR q4jivj3F0uEMhw+HnblxbrZt7LG4rCu/8fLsDjafnsf094ffQ78fPEHAf2+uD/8AUbg6nThXxXG/ ibjaHAfDGFwk2lHGvE557HMMbg3f/ecqy3MKej97Y/pP1zXtD8M6Vea74k1nSfD2iadEZ9Q1jXNR s9J0qxgUgNNeahfzW9paxAkAyTzIgJGWr8uPjx/wWT/Yx+Df2zTfDXinVfjf4otjJEul/C6yS+0F LhWKobrxvq0um+GZrNirE3Ph678Ryqu1hasHUn889C/4JM/ty/tUarZeLv23P2krzQ7MzrdDws+t 3PxK8RaeMkzWmn6PYXumfDTwgsySyrDN4fv9Xgt3eR5NJfLJJ+pHwI/4JQ/sU/Ag2d/a/DCL4n+J 7TYw8UfGCeDxtcGVFG2WHw7LZ2XgizljlBmt7i18Lx30DlSt4WjjZftf9SPoxeG3vcceI+eeMWf0 dZcNeFeEhlvC8K8dPYY3jPNpL+0sFUfNfE5EqGJh7v7p7S/RP+Ic/Q48I/f8R/FviPx84nw+s+EP BTAQyjgyniY2X1fMfEHPJL+18uq+83jOGo4bFw939w9p/lTdf8FGv+Cmv7aFzcaN+x98Ap/h74Sv ZpLKPxfpGiL4lubTc5hmh1H4q+PbbSfhxpkyxnIW10XTdVtnWWS2u2kjRo+k8Hf8EW/2gvjfrMPx A/bf/af1a81KUfaLrRdD1bVPiJ4phtJT5k9g/jHxdJB4f8Mtbbdq22i6J4n0eKNUS3dYo1UfuL+0 L+058Cf2RfAEXiz4teKNO8K6THA9l4X8K6XBDceJPEk9lCoj0fwh4YtWimu/JUwQyThbTRdJSa3f VdQ061dZq/nh8bftF/t3f8FbvFWqfC79nbwvqHwk/Zzgvv7O8TaiNRutL0eXT5cYf4p+PbeETazc TWsn2hfh14St7iKSKaM3ml68tlHrcX7Z4a8W8ecSZZjs28H+B/Dj6MXhRlsalLPPFrN8FSzjOaeE jL2VfB0uLOJabxXEuYySdGjg8Bg6c6WMnGjWzPB1sRQlL+i/CHjnxM4tyfMs88BfDjwk+hv4H5RG pQ4k8cs8y6hn3EFLBQl7HEYChxxxfSljeL83kk6GHwOWZfRqUMfUhh6+cYDEYnDTlL8YPjJ/wT3/ AGI7ofDT9ir4KeFP2j/2jReJoq/FLx1BP8VNE8L6+84tbd9FlufM07xF4wS6MUFlY/DrS9F0ZLmQ Ld6vdXUV1otz6R+zt/wSu+Pv7V3jeP8AaK/4KKeMvFsceqtDe2nw0u9R8jx1rFiJTc22ma19jCad 8L/CcauUg8IeHra01uCGe4thb+DrmBHn/Uf9iz/gmj8A/wBjqw0/XrLToviJ8ZjZqmq/FXxNYxNd 2dxLFsurfwPoskl1Z+DtObfNEJrSS58QXdtLJb6prt7bGO2h/Revzzjr6T+G4ahj8k8GMfxFmud4 2jVwXEHjpx5iq+aeIOe05ySr4fhaGOlUjwdkFRwTwuHw1KhivYxwtT6rgMwwqxdT8o8SvplYPhCn mnDv0fMz4szviLMMPWy7ij6SniZjcRnXinxLRqSisThOC6eYyqw4A4YqypxeDwuDo4bHKhHCVfqe WZpg1jq3GfD/AOHfgX4VeE9K8C/DfwloPgnwhokJh0vw94b0220zTbYMd003kWyJ593dSlp72+uG mvb65eS5vLie4kklb8cf+C8HxiPgr9lzwh8JrC++z6p8Z/iDaDUbQNg3ngv4fQx+ItXBCsG/deLL nwG/zK0bJ5qsN22v3Br+Yv8AbL3/ALYX/BYT4Jfs9W8kWoeDfhJc+ENL8Q2q5uLCW20a2l+MHxMM x/1cV1e6JHbeEbjcTGl9plrAytOGif4H6K+WU878ZqXG/E1atjMp8Nsm4j8WOJ8bi6k8RiKseGcJ PFYXE1sTXdSVTFPPcTl2JlUqudWp7KrNNzXPH8x+hTk9LiP6QVHxG4wxGIzDI/CLIOLPHDjLMcdV qYrFVo8HYGpjsHjK+LxLqzq42XEuLynFyq1pVK1Z0q003U9+P7jfsN/BwfAT9kr4EfDGW3+zaro/ gLTNW8SxGMRyR+LfFzTeLvFUMnAeQ2uv65qFnFJIBIbe2hUqgURp9XUdOlFfzzxFnmO4m4gzziTM 5+0zHiDN8yzrH1Lt8+MzTGVsdiZJvo61ebWi0toj+VeK+I8x4x4o4j4tzip7XNuKM+zfiHM6l2+f MM6zDEZjjJJvVp4jE1Gr9LaIKKKK8c8AKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAo oooAKKKKAP5p/wDgtH/yeJ+xH/3C/wD1aOjV/SxX80//AAWj/wCTxP2I/wDuF/8Aq0dGr+liv6o8 bP8AkxX0U/8AslfET/1sKR/a/wBIr/lGr6Ef/ZFeK/8A63uHCv5nv+C1/wABb3wL8UPhz+1R4Nim 0yPxg9j4W8V6np5aCbT/AIheEoPt3hHXGuEIdL/V/Ddi9pbPER5J8FCViss6s/8ATDXzZ+158BbL 9pX9nf4mfCOeOD+1dd0KW+8I3c+1Rp3jXQ2XVvCt35zMhggfVrW3sdQdXQvpV5f27ExzyK38mY7D /WcNUppe+lz0+6qQ1il25leF+ik2f50eKHCf+uXBeb5TRhzZjSprMsnmvjhmmAUq2GjTl9iWKj7X AymtYU8VOS1SGfsh/Hqw/aZ/Z2+G/wAWomt/7U13Q107xjYxBQmn+NNEZtJ8U2ZgCr5NvNqdtNf6 fG6KX0m+sJgCkyk/k3+3Z/wSk1i18SyftRfsJTXXw8+LXh2+PifUfhr4Su/+Eci1PUYC8txr3wxu raa1g8O+ImVpDeeE1MGh69DJPHpf9n3zNpmu+Kf8EUvj5e+A/ip8Qv2WPGMk+mw+NXv/ABN4V03U GaCTTviH4RtjaeK9EW2kZTHfax4asDdXSlN8beDFh+/Liv6Za/R/CPxd4w8Lc3p8R8J46EJV6X1H Pslx9P63kXEeX6xxGV57lkpRpYzCYinOooyvTxOG9tKphK+HqvnP1r6Jn0mOPvD/AAmUce8GZpTj mFTCvh/jnhzM6X17hziqlhEqOY5NxRk05Ro43BZjQqfWYK9PGYKGPdTBYrC4i9Rfih/wT7/4KuaT 8aNQsvgD+1BFbfDP9ofTLv8A4Rmz1XVLRvD2hfETWrKR7KbTbywuoraPwb8QjcwtbXnhy5W203V9 U3RaAtleXMHhm2/a+vyq/wCCg3/BMH4dftf6fe/EHwS1h8PP2htPsR9g8WRRPDoXjkWMJFjovjy1 tUZ2lUIlpp/i2yhfWdLh8mG8j1rTbOz062+DP2OP+Cl/xV/Zh8cr+yP/AMFDtP8AEWg3Hh+eDRvD 3xS8TRyXeteG4WCxaZa+Nb+BrlfF3gu9jVW0T4h6bPqc0ETpJqV1q+iynVdD/oLiLws4N8bMjzHx F+j9g3lvEOX0JZhx14HTqqvm2UPT61nPATUYzzzh+dWTl/ZtCmsVgpThQw1CjKtg8opf2xxZ4L+H /wBInhzNfFf6LeAllHFWV4V5p4l/RwqV1iM7yJ6PG5/4YtRhU4k4WnWbl/ZGHpLG5fKcMPhMNh5Y nAZFR/pIrhPiJ8L/AIc/Fzw5ceEfih4G8K+P/DV0S0mi+LNE0/XLFJijRrdW0d/BMbO+iVibe/s2 gvLZsSW88bgMOt0vVNM1zTdP1nRdRsdX0fVrK11LS9V0y7gv9N1LTr2FLmzv7C+tZJba8s7u3kjn trq3lkgnhkSWJ2RlY3q/kvD4nHZZjKWJwmIxWX5hgqynRxGHq1sJjMJiKUtJ0qtKVOvQrUpp2lCU KkJLdNH8NYTF5jk2Po4zA4nG5VmmXYhVMPisJWr4HH4HF0Ju1SjXoypYjDYijNO0oShVpzTs00fh F+0D/wAEL/g/4lvJfF37Mnj7xB8DPF1tcHUdO8P6pc6j4o8Ex38Lie1/svUmuo/GvhWRbj95/aCa t4ljtQkS2OkQ+X83y2f2gv8Agrh/wTrkS1+OPhK6/aE+DWj4hbxTq7XXjrSE02A/PeQfFfQ4F8Z+ HZpgPKtm+KllchI42+z6JtIkP9QNfPv7Tn7SPwy/ZW+EXiL4s/FHUFi0jTomsdH0GAxvrHjLxHdw zHTPCuhWsmRcX+pNE/nSuv2TTdPivNV1GSDTrK6mT+peCvpGeIXE9TJ/D/j3hHJ/pA5ZmGKoZXlO RcW4D6zxdCvi5wowp8P8X4Wn/beCx9eTUPr2LlmNWnBytKnBOUf7S8PPpZeKnGNXIfC7xO4FyD6U mTZpjMNk2ScN8dZY8bx1TxOOqQoU6XC3HeBpf6yYDNMTNxh/aOOnm1alTc+WdGmnKH5Y23/BeP8A Zr1D4ReKvFH/AAhnjrQPi9pOkA+H/hdq9mmo6V4l8QXIjht4rDxxpG7T49B0+4mFzq99rll4c1R9 Otrk6Vo99fNbWk3zh/wT4/Y2+IX7avxWu/2/P2zmk8TaFq2sf2v8NvB+rw7LHxjfaRdG303Up9Gf dBYfDDwk9qLDwz4dI8nxJd2Znv0m0K3l/wCEn+bv2Vv2GfFf/BT74qfFD9pT4maRYfAb4Ja1qesx 6Jb/AAv8NaB4dj1nxKkRtLLSfCVi2lrYX2meG3ENx418YahYT3niTWkudOjnbWbzWL7w97zqX7Af /BS39gu+uPE/7HXxl1D4seALOaS/uvBGkSrZXd1GW8y7fVvg54su9W8Ja1PKmLdL3wtqeo+Kpi8s ljaafJtev6pzTh7wW8OsNxx4YeEPiDw34UeNHFeDy3CcQ4njPNcwzbB8O4HF4RVM18O+H/EOjg6W CyTExxnsYY/G13jsxrTqez5njMPg5ZP/AGtnPCv0evCjB+I3g14D+KfCPgh9ITjfA5RgeK8Z4g53 mueYDhTLcdglVzrwp4V8VsPgKOXcO4uGPWGhmmY4l5lmuIqVnR53j8JgJZB/Tv06UV/PV8F/+C40 vhrWx8Of21/gf4l+F/jDTbmOw1nxJ4T0XV7WPT5jlWl8SfDTxTJF4q0NYQokuZNL1PxDc3BkY2ui QIixv+2fwd/aC+Cn7QOgjxJ8GfiZ4S+IWmLHHJdroGqRSarpXm/6uLXvD9yLfXvD9y+QVtNb02wu SrKwi2upP8AeIfgf4oeFzVbi7hTHYbKavI8JxJl/s834ZxtOrZ4erhs9y2WJy9fWYSjUo0MRWw+L cJJyw8GnFf5deK30cPGbwYccRx3wRmWEyOtySwPF2Veyz7g7MaNazwtbCcTZRPF5WvrdOUauHw2L r4XHSpyTnhKcrxXsVfN/7UP7VPwi/ZH+G158R/ixri2kTi4tfC/hewaGfxR421uKESpovhvTXkjN xKN8TX+oTtDpekW8qXWp3dtE8Xmebftrft0/CP8AYp8Cf254yuV8Q/EDXLS4PgH4X6ZeQxa94nuY y0S397IVn/sHwraXI26n4hureVF2S2umWuqap5enyfiP+zP+x78ff+CoXxTh/a1/bO1fVtM+Css7 SeDvCdq9zox8W6NbXUrWnhbwFpnmtL4U+G9pKhXVPEu4614mlE72F7fatf6h4q037bwn8FctzTIq 3iv4uZniODvB7KK/s1ioxUeIOPMypubjw3wXhKlp4qtXnRqUcVmai8NhFCuoSbwuYYjLf0bwQ+jx lGdcN4jxu8dM4xXAHgHkWJ9ksbCChxR4mZvSdVw4R8PcDVSnjcRiKlCrQxucKEsHgY08SoTbweZ4 rKee+HHwq/ae/wCCzvxij+LXxmv9V+Gf7Kvg7Vbu10LT9JZ00uC2iuES78LfDuG+h8nX/F15Giw+ LPiHqNjcWljLEbfyNtppfhWD+nD4WfCr4ffBTwJ4f+Gnwv8AC+meD/BfhizSz0rRtLiKIMAGe9vr mRpLvU9Wv5t11qmr6jPc6lqd7JLeX1zPcSvI3TeGfDPh3wZ4f0fwp4S0PSvDXhnw/YW+l6HoOiWN vpuk6Vp1ogjt7OwsbSOK3treJBhY4kUZJY5ZmJ3K+e8X/GrMvEyeW5BlOWYfgzwy4WUsPwZwBlMn DLssoR54rMMynFRebZ/iozqVMXmWJU5KpXxCoKMsRiquK+V8efpDZv4wVMp4YyLJ8L4feDvBilhf D/wvyOThlOT4aPtILNc3qQ5XnnE+NjUq1cdm+LU5xq4nFLDcksVja+MKKKK/ET+cwooooAK/mY+P Kf8ACTf8F6fhHpWfM/sG/wDhg+3Kfu/7H+G9z4yx8rqRt83zsSEPlshHQor/ANM9fzOWKjxT/wAH C93MwZ7bRLu4YoQ7CM6D+ySthGV3RkIv9rKk5JCpvdvKkLtGzf1Z9FJ/Vsf47Zrt/ZH0bfFPGwlb avyZNSpRWq96SqVOXVXs1dXP7b+hHL6pmf0ls7b5VkX0RfGnMKc7XtiXS4fw9CC7TmqtTl78rV1c /oA/aKuI7X9n3463Uu7yrb4N/E64k2gFvLh8E65I+0EgFtqnAJAJwMjrX43f8G/cDr+z58cLk7fL m+MlrAgBO7fb+CdAkkyMYClbqLaQSSQ4IGAT+vf7VFwLP9mH9o67KGQWvwG+L9wUB2lxB8PvEUpQ MQQpYLgHBxnOD0r8mf8AggDbFf2YfjBd7wRP8eb+2EeOVNr8PfAcpfdnkP8AbAoGBt8snJ3YEcD/ ALv6JfjnPb6xx94ZULvW/sq+KrWVtmr3bejWi1MvDf8AdfQb+knPZYrxP8HcMm9VJ0MTjsS4pLWL SfM29GtFqfu/RRRX8rH8UhRRRQB/PP8A8FHv+CcPi3wX4tb9tf8AYnj1Lwp8RfCmpN4z8b+CPBaN bag2oWzSXN7498BWNsjJJfyI07+LvCEcEtpr9pLeXdpZTzz6npuqfaX/AATh/wCCj3hL9szwknhD xe+meFP2hvCumpJ4o8LRuLaw8ZWFqqRTeNPBcMzl3tHcq2u6ErzXfh26lGWn0uezvJP1Gr+ef/go 9/wTg8W+DPFr/tr/ALE6an4U+IvhXUm8ZeN/A/gtGtdQa/tmkub7x94CsrZCj6g6NO/i7whHby2m v2kt5d2lnPPPqWm6r/YvA3HXC/jrwxlfg34yZpRyrirKqP1Hwl8Wsa+atllaVo4bg7jLEyftMZw/ i6ihQwWNrTdTAVHCMpxcadSX99eG3iTwb9JTg3JvADx/zmhknGuSUFl3gZ455i+evk9edoYPgDj/ ABk2quO4Vx1VU8Pl2Y4ipKrllWVOMqkXGlVl/QxRX5c/8E4f+Cj3hL9szwknhDxe+m+FP2hvCmmr J4o8LxsLbT/GOn2ojhm8aeDIpnLvaPIyHXdBDy3fh67lHM+lz2d5J+o1fzRxzwNxP4ccT5nwhxhl dbKc8yqt7OvQqe9Rr0ZXeHx2BxCXs8ZgMXTtWwuKouVOrTf2ZxnCP8f+JPhtxl4ScZZzwHx5k1fJ OI8krulicNV9+hiqE7ywuZZbior2WPyvH0rV8FjaDlSr0pfZqRqU4FfjP/wWB/Ynufjz8LLb4/fD KxmT41/A7Tp9RcaSsser+L/h9YzPqmo6XbPbAXMmu+Ebj7R4m8MmFxOyNr2m20c99qWniD9mKOvW uvw28Qc+8LuNch434cqqOYZLi41Z4apKSwuZ4CqnRzHKcdGKfPg8ywc6uFrqznTVSNei4V6VKpDv 8IvFLibwY8ROGfEfhOsoZpw7jo1qmEqyksHnGWV4vD5rkeYwin7TAZtgKlfBYhcrnSVWOJoOniaF CrD80P8Agl7+2xbftf8AwGtbfxTqMT/Gv4Wxaf4a+Jdq7Rpc67E0Ukfh/wAfQQqcNb+J7W1mTVTG ka23iax1iJLe3sJdMa4/S+v5Zv2r/AHi7/glH+294S/ap+DOm3T/AAF+Lmr6kniPwpZqU0qBdUu4 tQ+IHwvlEfk2dlbXUYTxd8NjO0UNheWKWsFvc2nhO7+1f0y/Dr4heEPiv4F8KfEnwFrNt4g8HeNN Esdf8P6tat+7urC+iEiLLGf3lre2snmWmoWNwsd1p9/Bc2N3FFdW80Sfq30g/D7IsrxeReKvh1Sc vCvxUo183yKlTgv+MWz6Mn/rBwXjlTTpYavlWOVf6hSTVOWDjPD4aWIhl1bET/bfpTeFnDWS43hr xs8KKLl4J+NdDEZ9w1RpQX/GF8TwnL/Wnw9zJUk6OExOSZksU8soXjTnl8KmFwcsVDKsRip9pRXy /wDHP9tD9l79m+O4j+L3xl8H+G9Zt4y58JWl6/iLxtIfLLxAeDvDsWqeIYY7g4SK7vNPtrDew8y7 jQM6/kD8T/8AgujfeLdZ/wCEF/Y6/Z08WfEbxTftJDpOq+NbLULy4upoyUL6b8NPAcupa7q9vICs sUs/inRrmNQouNNDOyx/J8B+APi74j0o43hngvNJZK4e1qcSZvGnkPDdLDpc1TE/21nE8HgsRSow vUqxwVTFVows40pOUVL4bwz+i/47eLdGGYcHeHmdS4fdN16vFuexo8McJUcJGPPWxf8ArDn9TL8t xVHD006taOX1sZiIws40JuUYy/oer4q+PH/BQ79kH9nQ3lj8QfjJ4eu/E1n8r+CfBTv438Wi4O4r a3mm+HheQ6HOyozg+I7zRoNuwmYGaESfjWf2YP8AgsH+3IBN8efii/wD+GmrP5k/hW+1NPCkb6ZM oja2T4a/D0NqeqvGruFsPiTq+m3RCytLdgtEZfs/4Ef8EPv2TPhktlqXxQuPFPx58RweVLKPEd5L 4U8FrcxDIktfCfhm7ivpImfLSWeveJ/EFnMoSOS3KeYsn6WvCfwG8Pf3niv4zR4uzajrV4L8FMJT z2ftI6uliONc2jQyCjKE/wBzisNGhDEQam6VZuKa/YI+B/0ZfCv9743/AEgY8d55h7Ot4e/R2wNP iWo6sbOVDFeImeQw3DFCUJ/7PjMJDDQxVN+0dCvKUEz5Z8cf8Fr/AI0/GTX7jwF+xF+zFr3iLWJ9 0dprfijStV8b+JBBNIYY9QHgTwQx07RRDxILzVvE+s6bGSTeW4iiffxcP/BPX/gqB+2vdx6v+158 dpvhl4MvZkuZPB+q61HrsltFIVkil0v4TfD67034f2kiRqqOdX13SdahZYluoJpVl2f0ieB/h54C +GWhQeGPhz4K8KeA/DlscwaF4P8AD+leHNKjfAUy/YNItbS2aZwMyTtG00rEtI7MST2FV/xMlkHA 6lQ8CfCHhDgCtCLhS4x4jpvjzjzmW2Kw2ZZ1GWAyqdV/vKuCo4PG4SMlGNN8sEiv+JuuF/DhSw30 afAfgPwuxFKLp0OP+LacvEzxMcopJY3CZvxDCWWZJUryXta2X4fL8wwUJqEaTUIRPyf+BH/BGj9j H4Omy1PxP4Z1j43+J7UxTHUviffrdaAlyhRn+y+CNGi0zw5PZOyZWz8SW/iV1VmRrqQHNfqToPh/ QPCukWOgeGND0jw5oOmQi303RNB02y0fSNPt1JKwWOm6fBb2dpCCSRFBDGgJJC81r184/tJ/tX/A 39k/wa/jL4zeMrTRFninOgeF7Hy9R8aeL7uBcmx8MeHEmjur5vMaKG41G4az0PTHnhfWNV06CQTV +MZzxX4qeM3EGCwWcZ1xZx/n+PxKpZXlU6+NzSf1ion+6yrKKF8Lg48vNKUMDhaFGEOepNRgpyP5 9z/jjxr+kFxTl2XZ9xDxz4ocT5pjFRyXJJ4jMc5qPFVVK9HJchw3Ng8BDl55zpZbgsNQp01UqzjC CnJfRckkcMbyyukUUSNJJJIypHHGilnd3YhURFBZmYhVUEkgCvw8/bV/4LHeCfhpfXPwj/ZNs7H4 1/GK8vToLeJbO2utb8A+HdUnka0jtNEXTJFuPiJ4kNy0cdnZ6I7eHUnkiMuq6rPDc6K/xJ4p+On7 eH/BXrxRqvw3+Bnh66+C/wCzFBf/ANn+JtVlvbyw0OfT1Kuy/ETxpbwJdeLdVmiZLiP4d+ErZrGM T2Z1axvYLQ+Jk/Zn9jL/AIJt/AD9jewtNX0PTR4++Lj2nlat8WfFdjavrEUk0JivLbwdpmbm08F6 TMHmjMNhNc6zdWsptdX17VYkiWP96w/hn4YeAVKjm/jpiKHHHiKqVPFZX4JcN5jSqYPLKsoKrh6n iNxDhvb0MJBOUJvJcA69SrH2VRrNMDXr06P9OYXwf8GvowUMPn30lMVh/EfxYVGljcm+jrwjm1Cp gMmryhGthqvi1xXg3icLgaacoVJcPZY8TVrR9hUks5y7E4mlQ/L39m7/AIJS/Gj9pvxkP2jf+CjX jHxZf3uttFqFr8LrnV3i8X6paM7zWtn4rvtPaK0+H3hyFHAs/BHhNLPUrSCY20kvhKe1exn/AKH/ AAP4E8GfDTwto/gj4f8AhjRPB3hHQLVbPR/D3h7TrbTNLsIASzeVa2qRoZppGee6uZN9zd3Mktzd SzXEskjdXRX4r4peNHHHi1jMM+IcZQwOQZWo0uHeDMioLK+E+HMLTh7Kjh8qyijL2MZ06P7p4zEO vjZ07UfbrDwpUaf87eNH0hPEfxyzDCS4qzDDZbwxkyjQ4U8PuGsOsm4G4SwVKn7HD4XJMhw8nh4V KWH/AHLx+LeJzCpStQeJWFp0cPSKKKK/Jj8POf8AFnifR/BPhXxN4z8RXS2Ph/wj4f1nxPrl6/3L PR9A0651XU7p/wDZt7K0nmb2Q1/OR/wRV8Naz8bv2lP2qv2yfF9ur3+o3epaRpzzlrhIvEnxS8Sz +MvEI06WRG8ttA0jR9O0lGV42i03X1to08mR1T9Bv+CyHxm/4VN+xD440ezuvs+u/GLWtD+FOl7G zL9h1Z7jXPFbGNXVzbT+E9A1nSZpcNHHNqtskgJmRW6j/gkp8F3+DH7D3wsS+s/sev8AxP8A7R+L 2vK0ZjklPjQ258MvIGJcN/wg2n+FVdWC7ZBINinOf6y4OS4A+ir4lcWSfsc58XuLsm8Nckk9K8OH uH4Sz/iTF0P5sHj5ylk2LeqVWlSjaLcXL+4uAEvC/wChR4v8czfsOIPHjjrh/wAIOHZO0cTDhXhe nPiji7HYXZzwGaVJy4fx7fMlWo0Y8sZOMpfpTRRRX8mn8OhRRRQAUUUUAFFFFABRRRQAUUUUAFFF FABRRRQAUUUUAFFFFABRRRQAUUUUAfzT/wDBaP8A5PE/Yj/7hf8A6tHRq/pYr+af/gtH/wAnifsR /wDcL/8AVo6NX9LFf1R42f8AJivop/8AZK+In/rYUj+1/pFf8o1fQj/7IrxX/wDW9w4UUUV/K5/F B/KV/wAFMPhx4j/ZA/bh8J/tIfDi3/s3TfHmt2PxZ0CWJJIdOj8f+H9QtB490K5MKx+bBrdxJaa5 q0JkP2u28X3lsQYldR/Tt8KviR4d+MHw28DfFHwnN5/h7x54Y0jxNpm50ea2i1SziuJNPu9nyx6h plw02najBw1vfWtxA6q8bKPjX/gpx+zr/wAND/sp+NLbSbD7Z45+Gav8TfBIhi8y8ubnw7aXLeId EtwiNcTtrvhiXVba0sYiBda3ForurtbxgfDf/BD79otvEHgfxz+zRr98ZNS8CTTePvAMc0hLt4R1 2+it/FOl2ylsLb6J4ou7XVQoXfJL4uujkx24CeTS/wBkzCpRelHGL2tPsqq+KK6a+9p5wR/P2Rf8 a/8AGDOOHJfuuH/ESjLPsmT0o0M9oe0nj8LBu0IOs/rLcIpPlnldGKd0fvbXx/8Ath/sT/Bv9tDw IPC/xG099L8UaPDcv4H+JGjW9v8A8JT4Pvp1yVieUKmraBdTLGdX8N30i2V+iCW3m07VIrLVbP7A or7HhziTPuEM7y7iPhnNcbkmeZVXjicvzLAVnRxOHqpOMrNXjUpVacp0cRh60amHxNCdShiKVWjU nTl/UfCfF3E3AnEWVcW8HZ3mHDvEmSYqOMyvN8sryw+LwteKcZWkrwq0K1OU6GKwteFXC4vDVKuG xVGth6tSlL+Vb4VftA/tUf8ABHn4nW/wH/aH0HU/iT+zNrWp3Nx4U1jSzNPaW+ny3Kvf+IvhVrF8 UgguIftAvPE/wx1me1EV/KLm3l0Z9VOuaz/TL8Kfix8PPjd4D0D4mfC3xRpvjDwV4ltftWl6zprv tLIxjubK9tZ0ivNM1SwnD2upaVqFvbahp91HJb3dvFKhUZnxq+CPwx/aF+HmufC/4t+FrHxX4R12 Ieba3QMV7pt9Eriz1rQ9Si23mja3p7u0llqdjLFcRbpIXMtrPcW838z3j34WftZ/8EYvipL8T/hB q2o/FP8AZX8Vavax65Z6ms7aHdW806wW2gfEbT7GPyPCvjSCJltfDXxC0m3jsdRlMEXlmO61Lwcf 689jwN9LGi54ZZN4efSOVNyq4a8Mu4N8YKsKd51KDbVDIuM8RKLnOn/BzGtKU5fWIV6lXJP7vdDw 4+nDh3UwceHvCr6WkacqlfB3p5T4f+PNanSTnVwzlJYbhrxBxUouc6T/ANmzfESlUm8TDE1a/D/9 N3xf+LvgD4E/DrxR8VPidr9t4c8G+EtPkv8AU7+4ZTNO+RHZ6XplsWWTUNZ1W7eGw0nTYM3F9fTw 28Yy5YfzJeBvCfxn/wCC1X7UU/xE8epq3gb9k34Tao+n2mlwTbI9L0eeS3vD4K8P3ccKwar8RvGE EFlf+M/EW2WPw/pr2jbltbbwlot7meJ/H3xu/wCC2X7SmhfDzwna6r8MP2Z/hoLLXdcgnmhuz4as LtEt9S8S+IZLdvsGv+P/ABBLDfaN4I0tVaz0uyFxJGkVqnirVbr+n74O/CD4f/Ab4ceF/hT8MNBt /Dvg3wlp6WGm2UWHuLiQkyXuq6rdlVl1LWdWu2lv9V1K4zPe3s8sz4DKi6Tp4T6IvC8oz+qYz6Sv GOUyiuWWHxuH8GuGczouLlCpCVbD1eNM3ws3yzhKUcFhql4yeBV+IdalLA/QT4MlCosBmH0vePsj lH3ZYXMcN9H/AIPzig4uVOrTnXwtXxCz7BVHyVaUqkcuwdRuE3luvFPUeD/B/hf4f+FtA8E+CtD0 7wz4T8LaVZ6J4f0HSbdbXT9L0uxiWG2tLaFcnaiLl5JGeaeVnnnklnkkkbpKKK/imvXr4qvWxOJr VcRicRVqV8RiK9SdavXr1pupVrVqtRyqVatWpKU6lScpTnOTlJuTbP8AO/E4nEYzEYjGYzEVsVi8 VWq4nFYrE1alfEYnEV6kqtfEYivVlOrWrVqspVKtWpKVSpUlKc5OTbfivxo/Zy+Bv7RGh/8ACPfG n4YeFPiBYpE8Nnc6zp4TXNJWTcXbQvEtg9n4i0GVizFptG1SxlbJDOQSD/Kz/wAFGv2WfgN+wN46 8M67+zX+0N8RfC3xc1G5XUrL4X6dftdeI/BmiTAyDX2+I2hapoGseGdMkdEt9H0nWLDWta1ve866 g1laXN0P2D/4KM/8FRNF/Zt+1/A/4Di08d/tKax5GlyR2tqdb0j4ZzaoEis31KzgEi6544uvtEJ0 HwhGk6W80kF/4hiNubLRtc8Z/wCCfv8AwS11pPElv+1h+249/wCOPjN4h1OPxjoHgHxZdS6xJ4f1 Wd0vLfxT8SJLtpf7Y8ZLIIptO8NytJpnhYRwvqCXetLDZeHP728A8fxV4F8Gw8UfE7jPP8g8Oc1w 2Khwh4ROpRxuM8UcRXoO9WjkGcUsXgsl4baq06uMz+OFw+JxNCVOVCvCliMDLH/6c/RizPjb6Nnh /Dxo8YvEHifhfwlzvC42lwH4Euth8wx3jRi8Rh3zVqHDGf0Mdl3D3CLjXpVcfxRDBYTF4zDTpSw2 JhQxOXTzP8P3g+M3w/8Ai98Pf2nv27vgJ8YvjX4K8Spo3iBZ/iNf6/oWm+M7P7LAvhuK+8TXujax aT2en2wtby28D3p0yLU7NbOyvYodFvZY7n+qD9mf/gp1+xt+0LbaR4f8MePbH4ZeLGt7aytPhx8S 4rDwTqMbRolvb6boF8bqXwjrYAXyrDT9B1y51E20as+l2gHlL+gup6ZputafeaTrOnWOraVqNvLZ 6hpmp2lvf6ff2k6lJrW8srqOW2ureZCUlgnieKRSVdSCRX5O/tHf8EZf2Sfjcb/WvAumX3wB8aXR kmXUvh5DDL4OnunyFfUfh5fSx6PFbJnP2bwnd+EC7gPLM5Lh/F4p8c/Bn6QNLKct8XuH+J/DDMMh wtTLOGOIuAcwq57wllGAlU5qFDH8C42FOGFw9ClGlSxOI4epvMcf7DDU5So4bD4ehh/n+NPpJfR+ +lLSyPKPHjhfjHwazThrBVMm4O4r8MM0r8S8C5Flk63Nh8NmnhtmFOlTweGw9CNGji8XwtSea5ms NhKcpYfB4XC4bDfreCCAQQQQCCDkEHkEEcEEdDS1/ME/wU/4K5f8E5g1z8IPFM/7RfwU0YF08N6f HffEDSLXSbX5o7af4a6vNF478KKYkea6T4a6hPYW6IxutYIKhvqX9nz/AILn/BfxXcx+Ff2lfA/i D4FeLre4Nhfa7p9tqPivwOLyKXyJhqNrBZp4z8MzrMSj2M2i67b2gjle81mLbtr86z36LfGNXLa/ EvhVnfD3jZwnSXPLH8CYpVuIcDTkm6cM54NxE1neAxs0nJ4HCwzKrCDUqjim7fk3En0L+Pq+UYni 7wS4j4V+kTwRQXtJ5l4Z41YjirLqUk3SpZ/4f4qa4jyzMZpOTy7B083rU4OMqsoJ2X7sUVxPgD4l fD34q+H7bxX8NPG/hXx74bu1Qw614R13Tdf0/c6B/ImuNNubhLa6jBKz2dz5V1byK8U8McqOi9tX 814rCYrA4mtg8dhsRg8XhqkqOIwuKo1MPicPVg7TpVqFaMKtKpF6ShUjGUXo0j+Q8bgsbluLxGAz HCYrAY7CVZ0MXgsbh6uFxeFr03y1KOIw1eFOtRqwek6dSEZxekkmFFFFc5yhX80P7NaL4k/4Ls/H nVCRIfD83xZdWOwlG0zw7pHg7C7A4BRbpoj8yPt3CQh98bf0vV/NN/wToA8Sf8Fh/wBuLX2y0Oln 9o82rszFiR8fPCGiWXysUdQ2nidtpRlhCrERnYw/qn6Or+q8DfSczTb2Xgpj8p5uqeeZvgsMo37T 9jZrrY/tf6J8vqPhv9MbOdlR+jvmeR8+1nxJnuXYNQv2qews19qx+5X7Y9xJa/sh/tU3UW3zbb9m /wCONxHuBK+ZD8MfFEibgCCV3KMgEEjIyOtfmN/wQHt41/ZD+J10N3mzftIeKbd8kbfLtvhj8JJI 8DGQ266l3HJBG0ADBJ/SD9uWc2/7GP7Vkgl8kt+z38XYN+4JkXPgXXLZoskjPnrKYdvV/M2AEtg/ nv8A8EF4BF+xj4xkEXlm5/aE8bTs+0r55XwL8MLbzc4G/C24h3DIHk7M5QgHCn7v6IXixPb6z4r8 C4fTRv2OX4ivZ90r3SWqer0FwR+6+gf44VNvrfjf4aYW60b9hlWLxNnfdK90lqm7vQ/bCiiiv5WP 4pCiiigAooooA/nn/wCCj3/BOHxb4M8Wyftr/sUJqXhT4i+FNSbxn438EeC1Npfm/tfMub7x94Cs rZCj6g6Gd/F3hCOCW18QWs17d2lnPPPqWm6r9pf8E4f+Cj3hL9szwknhDxe+m+Ff2hvCumrJ4o8L xsLXT/GOn2oSGXxn4Mimdne0d2Q67oQeW78PXco5n0qezvJPv34mfGP4UfBnRG8R/Fj4jeDPh3ow DmK98XeIdM0QXjoMm306C+uIrnVLtsYjstOhuruZsJFC7EA/xzft6/Gj9lYftJ6H8eP2CvFfjfwt 4/t9cl8QeKNW0LwxJ4U8CnxVDMWj8U+Cm1S4sNft77WHa5j8T6LdeE4vDetx3D3ayMb7VLS+/v3w iyzPPpScD0/DLjzh3iDEZpwrgMRHw08baWT47F4XJPq1OU48G8Z5rGj7PH5LifZ+zwNSVepjcJOK jGLlCE3/AKg+BOT8R/TR8OKXg54mcKcU4rOuCsrxUfCD6RVHIMxx2C4dWEpSqR4A8Qc7jR9jmXDu L9l7LLaksTWzHA1IqNOEpU4VH/bFXhXxm/ac/Z+/Z6sDf/Gf4t+CvAJMP2i30rV9Xim8S38HI83S vCenC98T6ugIIZtM0i7C8biMjP8AMH4F/bN/4Ka/8FGvGC/Br4UfE7wV8MbiHQYr3W4fB2r6V8KJ J9PtBDY3+vya1cX+tfEzUH8yb7Tq9h4DluLa0W481tFtbX7Mq/cvwX/4IN+DI9RHiz9qL40+Jfih r97L9v1Xw94JFzoOk3OoSFjcjVvGmuvqXirxJDOxEhuraw8IX5cfPI4zu+GzL6N3AXhRXVP6QPi9 luR5oqNPFx4D8O8vxfFHFmKw1a7pKtj8VhcLlWRzrwhKdCrj8PiMJVjZxxF2k/zfN/oj+GXgjio0 /pSePGUcN5zHD0cdDwy8Kcrx3GfHONwlfmlQjXzLGYPB5Jw5UxFOE6mGr5nhcVga8OVwxN2ovx79 u/8A4Kz/ALPf7SHwu8Y/s4/DD4I+NPi5H42ii07SPFuvsnhNNI8S284uNA8T+DNAtLPxB4n1jUtN v44JbS0v4PDEt6r3On3sFxp9xc2t5+YnwH1P9su98W+Ev2CrT43eMv2Z9P8AFniOSS38I+P9S8Xf DS0sdW8YaTaa1b6XqDaZop8XwR+MrYWUuheGbswaBrOs6zE6Q2934gubu6/st+C/7Lf7PP7PFkln 8GfhF4K8CSrCbeXWdN0pLrxTewFVVotS8X6q1/4p1RGCjKahq9yuSxABZs/mH/wWO/Yru/i38O7L 9p34UWE1t8ZPgjZHUNffRBLbaz4o+HelO+py3NtLaKLmXxD8P7pJNf0aaKSG4/seXXrdHubuHRbe L9l8FvpAeC2X5pg/BnhLgXE8LcH8RY/FV8n428Q8zwvGGNy/xDxOChl/DfE2O4cxlGrw/lEFUhSw eJ/suvCDnWw9SrVw2Gp4mq/6B+j19KP6PWV5zgPo+8DeGuL4L4B4szLGYnIPETxVzjB8e5hlfiti 8vp5XwlxhmfCeYYevwtkVNVadHL8Z/YuJpU5VK+FrV6+EwlLGVnifAz/AIIR/s9+DpLbWvjv448X /G/Xt4uLzR7N5fAHgmWaRhLLHcwaVfX3jDUnSXcn20eLdLju0LyT6ZE0nlx/sL8MPgv8JPgroo8P fCT4b+C/h3pBWNZ7Xwl4e03Rnv2iUKk+q3dpbx3ur3mB897qlxd3kp+aWd2JNfF3/BMv9tWz/bF+ AtpceIbyBfjL8NE07wv8U7AeXHLqc7W8i6F47toEwq2PjC1s7ma6SOOGO08RWOvWUFvFYQ6fLcfo 9X8leOXGnjdjuL8/4Q8XuK8+zDNMgzKrg8Xk1TFPCZBTqU3Gph8Zl2TYCngsoWFxmGlh8ZgcXRwM JYnB1cNWUnGUbfwz9JHxC+kXmXHnE/AfjvxtxNmmc8L5vWwGOyCtjHguGKVWk41cLj8p4ey2ll+Q xwWPwk8Nj8tx2HyylLF4CvhMQpOMoWKKKK/Cz+awqKeeC1gmurqaK2traKSe4uJ5EhggghRpJZpp ZGWOKKKNWeSR2VERWZmCgmvmv9pv9rz4E/skeEG8V/GPxhb6Zc3ME8nhzwZpfk6l458Xzwgj7N4c 8OrPDPPF5oWC41e+lsNA06WSIapq1kJYy38+HiD4sft3/wDBYnxVqXgX4T6RP8FP2WbHUhZ+Ibx7 y+tfDMtpGyOU8deKbeC3vfiH4iaJ0uYfAfh6CPRbN5NOm1SxhEA8UH928L/ATiXxAy/EcXZxj8B4 f+GGVycs68ROKebDZTThCfJPC5JhpSpYjiHNJzUqNDB4BqjLFcuFrYuhiKtGnV/pbwa+jHxf4pZX i+Os/wAzyzwu8G8lk5cQ+K3GnNg8jpQp1PZ1MFw5hJzo4rirOqk1KhhsvyySoSxihgsRjsLiq2Ho 1vtX9sv/AILI+GPBWrT/AAa/Y60mD42/F3ULxtATxfYWV3r/AIJ0fV7iX7JFZeE9P0rfefEnxCZi y2i6YV8MpcNayR3viMfatKXxf9m3/gkx8Wv2gvGaftGf8FGfGniTXdb1uaHUk+FUusvJ4j1G1BE1 nZeNdc06WO28IaHArvHbeBfBn2WextZIrc6l4clguNIb9R/2Nf8Agnd8Av2MtJhu/CWlf8Jj8U7m y+za/wDFvxRZ20niS582LZeWXhu0Uz2vg3QZ2aRTpmkySX13bmGHXtZ1yS1gnT70r77OvHThTwyy vG8GfRryrFZFDFUZYLiDxfzylTl4hcUQ0jVhk7dNR4RyarKPPQo4SFHHyjHDYiVPLcwpVqtb9O4g +knwR4PZLmHh99ETJMbw1DG4eeXcUePPElGlPxV4ypu0a9PIZOlGHAuQVpx9phsPgKdDNJQjhMW4 ZTmlGvWxHN+EPB3hTwB4a0fwd4H8OaL4S8KeH7OOw0Xw74e0610nR9Ms4ySsFnYWUUNvCrOzyyMq b5pnkmlZ5ZHdukoor+UK9eviq9bE4mtVxGIxFWpXr4ivUnVr161WbnVrVqtRyqVatScpTqVJylOc 5OUm22z+IcTicRjMRXxeLr1sVi8VWq4jE4rE1Z18RiMRWnKpWr161WUqlatWqSlUq1akpTqTlKc5 OTbZRRRWRiFFFNd0iR5JHWOONWeSR2CIiICzu7MQqqqgszMQFAJJAFCTbsldvRJbt9gSbdkrt6JL dvsfzNf8FhNY1P8AaN/bR/Zb/Y28L3MsgtZdFOti0aMiw174s+ILGyubi9UCRlPhvwVoNnr5kmjK 29hq9xKiOskm7+lXRtI07w/o+laDpFtHZaTomm2OkaXZxZ8q007TbWKzsraPJJ8uC2hiiTJJ2oMm v5lv+CdkTftg/wDBUz9oD9q2+H9oeF/h/N4q1/wtcTrLchD4gM3w2+F1oxlVERrb4d2Gr3MDuoaG 60mFre3RlEtt/T3X9ZfSdtwhlngz4KUf3c/Dbw9wuZ8R4de66XG3HlSPEGf0asU/fdCH1KdCc1zx p4qUUoptP+4vpkW4Dyf6P30dqFqU/CPwswWc8W4WK5HQ8RfEyrDijiihXin+8eHp/wBnVMNUqJVI 0sbOCUE2mUUUV/Jp/DoUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFF AH80/wDwWj/5PE/Yj/7hf/q0dGr+liv5p/8AgtH/AMnifsR/9wv/ANWjo1f0sV/VHjZ/yYr6Kf8A 2SviJ/62FI/tf6RX/KNX0I/+yK8V/wD1vcOFFFFfyufxQHXrX8jfxZ0/Uf8Agmt/wUptfF2hWtxa fDibxNB440mws0YQ6j8H/iFPd2firw3aW4bZMfDjv4h0PR47hpGW+8PaRqcg8zymr+uSvx1/4LNf s6D4o/s8WPxj0Kx87xd8C9Qk1K/aCMtc3vw88Qy2tj4mgKxRGSb+xNQj0XxEkk0gg07SrPxFMqhr pyfOzKjKdBVqelbDSVam1vaNnNelkpW6uCWzZ+P+NPD+KzLhanxBlN4Z/wAE4ylxJldaCbqKng5Q qY+irauLoUo4xwir1amBo09pM/XvStU07XNM03WtIvLfUdJ1ews9U0vULSRZrW/07ULeO7sry2lX Ky291bTRTwyKSrxurDg1fr8kv+CO37RP/C3v2Zx8M9bvvtHjH4DXtt4UdZZN1zc+A9US5vPA14Rh QI7CK21bwrFGgbybTw5ZSSuXulz+ttddCtGvRp1o7VIp27PaUfWMk4vzR+gcK8Q4Xirh3J+IcHZU c0wVLESpqXN7DEWdPF4WUus8LioVsPN9ZUm1pYq39/Y6XY3mp6neWmnabp1pcX+oahf3ENnY2FjZ wvcXd5eXdw8cFraWsEck9xcTyJDBCjyyuqKzD+XD9q39of4r/wDBVr9ojS/2QP2Wri4tPgN4d1c3 /iXxgy3sGkeJoNGuYI9S+JHi8x+W6eCdAuGCeB/D0gS517VZrDUJ4zrGo6NY6D33/BQj9sv4hftn /Fez/YD/AGMGl8R6RrGstonxH8ZaNdtFp/jG906VpNX0iHWIlaKz+GHhQQSXvirxCrPB4juLR7ex FxodtCfEv7I/sR/sY/Dz9iz4S2vgXwqI9Z8Y62LPVPiX49mg8vUPF/iOKBkxCrbnsPDej+dPaeHN GVilnayTXd01zq+oapf3f9rcJZPlX0Y+E8v8UONMBhsf41cU5fLFeFPA2YUo1Y8GZdiIyp0/EHir Bz96ljfjWQ5ZXjGpGrFuUVi44urkP+lHAuQZJ9DngbKvGbxCyzB5p9IbjTLJ4zwS8N81owrQ8P8A KcVGdGn4p8aZfUXNRzH+J/qxlGJhGrGtFylFY6OOrcNfh5+0N/wTV+Pn7AOs6D+0/wDsOeO/GXiq x8DaPaP460iWK3uvGNjDZWdv/wAJFq13oun28WmeNvh9rkltLfa94cawkvPDsbJcCHU9Ps31fRv1 W/YA/wCCl3wz/bO0SDwtrY074ffHzSrJpdd+H8t2w0/xLDax7rjxF8P7u8fztT00orXF/oU0k2ue Hv3qXJ1HTYodcvP03r8Iv+CgP/BKK38U6leftLfseTR/DL426Df/APCXax4S0nVoPCOgeJNQ09jf v4l8I6mslha+CPHEU8YvJpDe2Hh3WZVa7nk0bVTeajquOTeKXB30gcswfA3j9jKOSccYeP1Pgjxw oYTD069CVScnh8j8QMNQWGo4/JJVqnJSzReyngXP2taphHPH5jiMMg8aOAfpSZPgPDf6UOYUOHfE fCw/s/w6+kfh8FhqWIw06tSUsJw34pYTDLCYfM+HZ4iq4UM6XsKmWyqe3xFXBOpmea4r93a/B3/g oR/wVF1XSPEM37KX7Fn2zxz8c/EWoL4S1vxv4St110eFdUvH+yy+FvAcVrHdJrfjssz29/qsSvp/ hBxJHA9x4ghuG8O/mP4j/wCCsX7X/wC0F8JPBn7KujDQ9B+KHjLW7bwD4m+Lul61Z+Gdf8cWWrXV po+j6QJ5n0vw94HvNRuJpbfxb4lsdSht9Ut3iWwi8O2z6il/+8P/AAT1/wCCbXw//Yw8OReKvEP9 m+OP2gNe05YvEvjgwGbT/DEFymbnwv4BW7hjubHTBu8nVNblit9X8SOhkuUsdO+zaPaerDwY4a+j JSlxr49UMr4r4qWNxtLw38LcsxkcblnEVbLq0YU+LOKcdGny0uF6dSVKvQyqrRWKx3PSo47CuSxe XU/bp/R84Q+h3Ql4ifSbw2Tcb8bf2hmNHwj8F8nx0MxybiuvlNeNKlxvxrmMaXJR4NpVZUMThclr YeOMzL2lHD5lg+f69lVHyb/gnR/wS70n9neS1+O/7QTW/j79pTXC+sxrqNwuvaZ8MbzUy9zeNZ6h O9yPEHj65knlOueMGmnjtZ3msvDsrxfbNc1v9kqKK/lnxE8RuLfFLifGcWcY5nPMMzxVqVClCLo5 flWApyk8NlWUYJSlSwOXYSMnGjQp3lOcqmIxNSvi61fEVf4r8VfFjjnxo4xzDjjj/OKma5xjLUcN QpxeHyrJcspSk8HkuRZdGUqOWZTgYzlHD4WleU5yq4rF1cTjsRicVWKKKK+GPzcK+Vv2g/2J/wBm P9p+2m/4W/8ACjw9rWuvB5Nv420qJvDvjqzCgCExeK9Faz1W7htiA8On6rNqOlbtwlsJUd1b6por 2Mi4hz7hfMqGc8N51mmQZthXfD5lk+PxWW46jqm1DE4SrRrKMrJThz8k1pOMloe9w1xVxNwZm+G4 g4R4gzrhjPMFLmwub5BmeMynMaF2nKNPGYGtQrxhPlSqU+fkqRXLOMo3R/Nf8Qf+CNv7Rn7PfiK6 +JX7BX7Q/iGDUYQTH4W1zX38CeNJ7NZFZNJHizRja+D/ABdDK5Z5rHxLpfhbSmjUrN9qY4eh4M/4 K5ftefsteINO+HH7en7Pmt6n5TtA/jCz0WPwL4zv7OFhHLqmnwrEvw38fRRskkcU3hu58NafcMSX 1V5InMn9L9ct4y8D+DPiJ4fvfCnj7wn4c8a+GdRXZfeH/FWi6dr+j3Q2sqtNp2qW91avIgdvLlMX mRMd0bK3Nf0thPpOQ4uw1DKPH3w74a8W8DTpxw9LiaNKnwr4iZfRjH2cHhuJsmo0Vi6eHjy1FhMV hqf1yrCP1zGTu5L+v8F9Manx3g8PkX0nvCnhDxzy6lShhaPGEKFPgrxWyvDxj7Km8Hxjw/Qw6x1L Cx5ascDjcHT+v1qcf7Qx9Tmc18w/s4/t8fssftSxWtr8LfihpQ8WXEYaT4d+LdvhXx7BJt3yQwaD qcqjXfs6lTcXfha717TYiwVr7flR9j1+IP7RH/BDf9nv4gzXXiX4B+JNe+AXi4Mbu00qF7rxZ8Pp L6NvPjePTdQvofEugSSzgAXOk+I5tP01Ssll4ecQrA/x43jj/gr/AP8ABORivjPTrr9pP4JaOcSa rePqvxU8P2mlwLsedfFVqtl8UvBNvbWypFanxVDD4ZspRFHBp92mUl3fgn4TeJz9v4FeKmGwec1/ ep+Gfi06HDfEbqys44PJuI6CnkGe4ipJuGHwlLkqQp0+fFYxuTkul/R18DfGNvE/Rr8bMHl+f4lc 9Lwf8c3heEeLXWnrHAZBxbhVPhjiXFVZN08LgqHs6tOnT9pjce3JzX9QNfzT/wDBG/8A4qL9uL9u Hxt9/wC0f8JV+99f+Ep+L15q3+x/rP7I3f6ofd/5Z/db7J/Zy/4LY/srfGA2Oi/FIar+z74wudkT L4tlGt+Abi5cgCOz8d6ZaQLYxgbpJbnxXofhmxgUCMX07ld3xx/wQAVtd8Y/ti+MplbzrlvhQu9w dzN4h1T4qardKHIfLK+nQGYCYkF4ywfcrr9Xwp4a8eeFHgn9Kynx5wtmvDOO/sLwxyrCSzCgvqmP hmnG1XC4mWV5jh5VsuzSjTcaUa1bL8XiaVJzhGpJOcUfb8EeEPiZ4IfR1+m3S8TOC884OzJ8M+Dm SYGWZ4ZfUczp5z4i18Fip5Nm2GnXyrOcPScaMMRiMqxuLoUnUpxqzi5xT/ZX/goHNHB+xJ+1K8pK q3wU8dQggE/vLnRri3iGACcNLKik9FB3MQASPin/AIIVwSRfsSXsjgBbn41+PZ4SCDujXRvB1sSQ DlT5tvKuDg4UNjDAn7D/AOCjVxHbfsM/tPySbtrfCfX7cbQCfMujb2sWQSPl82ZN5zkLkgEjB+UP +CHUDw/sM2Ej7dt18V/iFPFgkkIp0W2O8EDDeZbyEAEjaVOckgfEZF+7+hxx5Pb2/jjwxQ12fsuF 6ta0f7yveW/u9FufnPDX7v6APiXU2+s/SR4Nw6b2l7HguviOWH99J3ldv3baLc/YOisrXNe0Pwzp V5rviTWdJ8PaJp0Rn1DWNc1Gz0nSrGBSA015qF/Nb2lrECQDJPMiAkZavy4+PH/BZP8AYx+Df2zT fDXinVfjf4otjJEul/C6yS+0FLhWKobrxvq0um+GZrNirE3Ph678Ryqu1hasHUn8K4N8OeO/EPG/ UOCOEs+4mxEZxhWllWXYjEYXCOduWWOxyhHA5fTd1+9xuIw9JXV5q6v/ADV4f+E3iX4q5h/Znh1w NxNxhio1I068skyrE4rB4JztyyzLMuSOW5XSd1+/zHF4Wirq9RXV/wBXK5Pxl488D/DrRZ/EnxA8 Y+F/A/h61DG41zxdr+l+HdJi2ruKvqGr3Vpah8dE83e3AVSSBX83N3/wUb/4KZftoXN1ov7Hn7P8 /wAPfCN9M9jD4w0vRv8AhJbyyy6xTx6h8VfHVvo/w10ybaHIS30Ow1S0DStbXck0Mc6dH4M/4It/ tD/HTWrTx1+27+0/rWo6nIA8mhaHq+r/ABI8Vw2k7B5tNHjDxfLFoPhp4CAqWuiaH4o0hFVEt3Ec aqP32P0ack4JjHE+O3i9wb4dVIJTrcI5FVfHfHl1G/1evlGRTqYXLnVk/ZU8ZUxeMw1OanOqlCm2 /wCn4/RB4d8O4xxf0lvHfgDwnq0kp1+BOG678S/E26ipfVcRkPDVSrgsplWk/Y0sfVx2PwdKanOt FU6bb+vPjv8A8FvP2SPhet3p3wzTxN8evEkBeNE8L2k3hfwck8atmO68X+JbOKeWJnCKl34e8OeI 7SRWZ0mYIA3wyf2xv+Ctv7cxez/Zt+Elx8Gfh1qhMcPizRNIj0i3bT5f3heX4ufEYW9leXMEbRu0 3gGw0jVSnliC0YzbJf2N+BH/AATY/Y2/Z6+x3vg/4O6H4i8T2ex08afEhV8eeJRcxsGjvbN9cjl0 bQbxNoAn8M6Nohxu4y7lvusAAAAAAAAADAAHAAA4AA6Cqfit9H7w7/d+Ffg1PjbOaGlHjPxrxkM3 h7WFrVqHBGUzpZJyqonVw1edfDYuklT9rBzuo0/G36LXhR+68Ffo/T8Rc/wztQ8QfpEZhTz2n7an blr4bw6yKdDhzkVVOvg8TVxGEx1FRpKvTlO6h/OX8Mf+CGfi/wAfaynjz9s39o7xL4v8R6gI59X0 bwVf6h4g1y5kP74Ral8T/H0V/dTlHZobq3tvCUgyZWs9XGUmP7B/Ar9hn9lP9nEWlz8Kvgx4S0rX 7NIwnjLWbWTxX41MqKQ9xD4p8Syapq2nNcMTJPBo9xp1iW2rHaRxxQxx/WVFfmvHv0hfF/xHpSwP EXGeY0sjcPY0+Gsi9nw9w5SwqXLTwryjJ4YTD4ujRj7lJ5gsZWjHR1XqfkPib9Knx58WqE8t4r8Q c2ocOOn9Xo8H8Ney4V4SoYOMeSlgnkWQwwOExuHoQ/d0Xmix9eELp15Xbf8APP8A8FHv+CcPi3wX 4tb9tf8AYnj1Lwp8RfCmpN4z8b+CPBaNbag2oWzSXN7498BWNsjJJfyI07+LvCEcEtpr9pLeXdpZ Tzz6npuqfaX/AATh/wCCj3hL9szwknhDxe+meFP2hvCumpJ4o8LRuLaw8ZWFqqRTeNPBcMzl3tHc q2u6ErzXfh26lGWn0uezvJP1Gr+ef/go9/wTg8W+DPFr/tr/ALE6an4U+IvhXUm8ZeN/A/gtGtdQ a/tmkub7x94CsrZCj6g6NO/i7whHby2mv2kt5d2lnPPPqWm6r+ucDcdcL+OvDGV+DfjJmlHKuKsq o/UfCXxaxr5q2WVpWjhuDuMsTJ+0xnD+LqKFDBY2tN1MBUcIynFxp1Jfuvht4k8G/SU4NybwA8f8 5oZJxrklBZd4GeOeYvnr5PXnaGD4A4/xk2quO4Vx1VU8Pl2Y4ipKrllWVOMqkXGlVl/QxSMqurI6 q6MpVlYBlZWGGVlOQVIJBBBBBweK/Lr/AIJw/wDBR7wl+2Z4STwh4vfTfCn7Q3hTTVk8UeF42Ftp /jHT7URwzeNPBkUzl3tHkZDrugh5bvw9dyjmfS57O8k/Uav5o454G4o8N+KMz4Q4vyytlOeZTW9n WoVPepV6UrvD47A4iK9ni8Bi6dq2ExdFunVpveM4zhH+P/Ejw34y8JOMs44D48yfEZHxHkmI9liM PV96hiaErywuZZbiopUsflmPpWr4HHUHKlXpSWsakalOH8rP7SPgrxZ/wSR/bo8MftGfCfSbqX9n T4u39+mpeFNPZk09NLv57W68e/DCVmC21ncafMYvFnw5knKRQxwWVmjXkOga2Jf6ffA/jbwv8SPB 3hjx94J1i11/wl4x0PTvEXh3WbNibfUNJ1W1ju7OdVcLLDIYpQs9tOkdzaXCy21zFFcRSRr5N+1H +zr4L/ap+CXjT4MeN4kjs/EdiZ9C1tYEnvfCfiywV5vDvijTQxRhc6XfEfaYI5Yf7S0qfUdHuJRZ 6jcq38737Dn7d2p/8E4r/wCN37JH7XOm+Jf7K+GV/rGqeArXQLCTWdRtfEz3cU9/4W0X7RLZ2snh Xx7bX0HjPwtrF1Pp2lWzzahfXM7J4ih+y/1RjMvxv0p/C7Ls3yfDVM18ePCjCYDIuIMuw6VTNPET gGriKeEybPqcZP2mMzrh3EVVhc0qScqlbD1auLxWIlUxOXYWn/a2OyrMfpq+DGVZ9kGDq539JnwQ wOV8NcVZVhUqudeK3hhXxVPA5BxPRjJqrmHEPCmKrxwOdVZSnVr4WvVx2NxUquMynA0/6nLq6trG 2uL29uILSztIJrq7u7qaO3trW2t42lnuLieVkigggiR5ZppXWOONWd2VVJH4R/tk/wDBZXw/4Z1W b4M/sX6Unxl+K+qXw8PQ+OrLTbrX/B+m6vdSmzhsvBGkWUcl18SPEDXLBLCa0Q+FjObaW2m8UQvN Yr8Ya38Rf2+P+Cxfii68J/D3SZ/gt+yvaau1prFytzf2ng5LWCVJXXxl4kSOz1D4o+KIIXglj8Ia Jbw6JZ3Lafc3elaQu/xAf3B/Y3/4J4/AL9jTRYJ/CWkJ4x+J9xbeVr3xb8U2NpL4numlj23Nn4dg HnW/g/QZCzqNL0iVrq6h8pNb1XWpoIrheCl4c+FX0fKVLNPGuthfETxOjCniMu8GOHsxp1MmyOs1 7SjU8ROIMMq1BTg+SU8iwXtvae57SnmmX4qdWh5tDwm8E/osUaGc/SIxGC8VvGOFOnisq+j5wrmt Grw/w5iXH2uHq+K3FWE+sYbnpv2c6nDeXe39r+79rSzrKsZUq4f8t/2YP+CSHxP+N/jIftFf8FFf FniLxH4h1q4g1VPhbc6895r+qxD97aW/j7xBp85i8PaPBGwjtfA/hGa2ksbUxWk2oaGLefRG/oY8 KeEvC/gTw7pHhDwV4e0bwp4W0G0Sw0Xw94e0200nR9Ls4yStvZafYxQ21vHuZpHEcYMkrvLIWkd2 boaK/DfFHxl458W8ww+I4nx9GhlGWxVHIOE8mo/2Zwrw5hIQ9lSw2T5PSk6NL2dFRovFV3Xx1SlG FKpiZUadKnT/AJs8ZvpAeJHjpmmFxXGWaUMNkWUQjh+F+B+H8Osn4K4SwNOn7Ghg8hyGhN4eh7LD qOHeNxMsTmNWjCnRq4ydClRpUyiiivyo/FAooooAKKKKACviL/go18Zj8Cf2Mfjr40tbs2eu6l4R uPAnhaSNnS5XxD8QJI/CVpd2TIVK3ej2+q3evRMWCoulPIwcL5b/AG7X86H/AAXn+Jep6/L+zh+y 14V33ut+L/Edx8QtT0mFsTXN5LO/gL4d26hXJkXUNR1XxmjRyIEE9naSIXdT5f7b9HLgqnx/41cA ZBioRlldPO6WeZ26tlh45Lw3TqZ7mUMTOXuU6OKw+XywTnJpc+KhFPmkj+i/omeHdLxQ+kP4X8L4 ynCeTUuIqPEnEcq3KsLHh3hGlV4lzeni6k/cpYfGYXK5Zc6k2l7TGU4p80on0f8A8ENPg5/wgH7I l/8AEm+tWh1f42+O9Y16GaSJIpX8KeEGfwhoMJ4854hq9j4q1C3eUqjw6oskEYjfzp/2grzH4K/D TTPg18Ifhl8J9H2Np/w68C+GPB8M0Yx9sk0HR7TT7rUZDsQvPqV3BPf3MjIjS3FzLIyhnIr06vl/ FzjWfiN4m8ccbSlKVLiHiPMcZgVO/PTymFZ4XJqEr2d8NlNDBYd3S/h/DHZfGeO3iJU8WPGPxI8R JTnOhxTxbm2PyxVL89HI6eIeD4fw0+ZJuWEyTDZfhW2o39jflj8KKKKK/Oj8nCiiigAooooAKKKK ACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooA/mn/AOC0f/J4n7Ef/cL/APVo6NX9LFfz T/8ABaP/AJPE/Yj/AO4X/wCrR0av6WK/qjxs/wCTFfRT/wCyV8RP/WwpH9r/AEiv+UavoR/9kV4r /wDre4cKKKK/lc/igKyPEGg6R4q0DXPC/iCxh1TQfEmkaloOt6Zcgtb6jpGsWU+n6lY3CggtDd2V xNbygEExyMAR1rXoo33JnCFSMoTjGcJxlCcJxUozhJNSjKLTUoyTalFppptNWP5H/wBmvXtX/wCC dH/BR/Uvhn4u1Ca38DX/AImuPhZ4k1C9Y29tf+A/GdxZX/gDxrcl/KtYVsZpvC+v6ndKkv2KwGv6 fA4aWU19tf8ABUP9vvxVr/iY/sJ/sjtqniX4reM9Sj8G/EjX/CRM9/YTalm2n+GXhi7t3Hl65dRu 6eONZWWG28M6YtzpEl1Hftrb6D8sf8F4fE/wgn+NPw2sPBurwX3xs0zwle6N8UbDTEjng0nQHuLX U/AcWr3MLhYfFDpqevSpYus18NCudIuLv7LanSFvPrT/AIIcfs6/CK3+GPiD9pSe7Hi745ap4k1/ wbq0+qQq83w1sYRbXb6bpPmXFxJcan4u06/stY1fxNKkFxNa3X/CPWSQwWms3Gs/1V4R8D8PeDHC eH8dfFvAUMwr46tVreCXhtjvdxHF+a0I06kOLM6w0l7Sjwjk1SdDE0XOKWY1fZV43pVsspZr/SH0 T/CDh36JvCGP8dPH/DZZmeHzzPswzX6JXgxmeIj/AGx4gYvD0MLisTxxxDl8/wB9h/D7hatisurU ZVIxlm2PjUxygsLjMjhn325/wTp/YB8KfsU/Db7Rqqad4h+OfjWwtJPiL4yhQzQ6dENlzF4H8KzS qskHhvSbj5ru7SO3ufE2pxLqmoIltbaNp2k/o7RXBfE34n+Afg14H8QfEj4m+KNL8H+C/DFk99rG t6tMY4YkXiG2toUWS61DUr6Ypa6ZpWnwXOo6neyw2Vha3F1NFE34NxRxPxd4o8Y43iDPMRjuIuK+ Jsxprlo0amIxGJxNecMPgsty3BUIzlCjSj7HBZdl+FpuNKlCjh6ENEn+X8ZcY8deM3H2Y8U8SYvM eK+NuMc1pRcaFCricVi8XiZ08Ll2U5Tl+HjUlDD0Iewy/KcrwdNxo0IUMLh6btFPpPEXiLQfCOha t4n8U6zpnh3w5oNhc6rreu61e2+m6VpWm2cTTXV9qF/dyRW1ra28Ss8s00iIqjk9K/mV/ag/bR+O 3/BS74nzfsg/sS6Vq1j8JLyaS28aeNplu9GfxhokFxHFf+IPF2pCFp/B/wALrdgPs+kyR/254qMk FtfWU97qNp4Vi5D4pfGL9pj/AILK/GiT4L/Auy1X4dfsteEdUtLnxBqeqLPFpiWMd1I1p4w+JU9i /l6r4iv1tpZvBnw5s7uWC3uIfMM8j2WqeJ7P+hn9lb9k34Qfsg/De1+Hnwp0URSTi2uvFvjDUUhm 8VeOdbgiaM6t4g1CONNyRmSddM0m1WHStGgmlh0+1iae6muP6jy/h/hL6K2XYLiTjnB5Zxf4/wCO wtHH8LcAV5U8bkXhnGvCNbBcQcZOlUdPGcQwjKGIy3J6c7YWahiIVI1Hh8yw39n5XwvwN9CjKsv4 u8SMBk/Hn0osxwVDM+C/DDEzpZhw14PRxNONfL+KfEB0KrpY/iqnCdPFZRkNKpbB1FTxUKsKrwub 4T8tfFP/AAQl+CN1+ztpfgnwp4t1Ww/aB0aK61eT4u6i92+h+KtfurWITeHtb8Kxy3FvpXgkTQJB pEmko/iLRAx1K6u/EMsl9p+o+C/so/8ABQ742fsR/EKD9kP/AIKDaT4gtPDui/Z9O8I/E7UkuNX1 fwro5eS10ue71K1jum+IPw1ufJZNK8R6fLe614fSGbT5RqdnbLpvh/8Apdr5f/aq/ZE+DX7YHw+m 8C/FfQlku7NLmfwh410tIbfxd4I1W4jVTf6FqTRuTbTtHD/ami3i3Gj6vHDCL20ee2srm1+b4Y+k dPi6jmPBX0jKWO8ROBuIMxxGYQztexXGXAGb42cpTzvhHGKnGNLBUpTXtuHuRZesNBUMHh1hfrGW Y/5Dg36WdTjrD5r4efSxo5l4r+G3FObYrNYcRL2C4/8AC/PsxqSlPiLgTMFSjGll9Cc19Y4V5FlX 1OmsNgcLHBrFZRmf0Zomt6N4l0fTPEPh3VtN17QdbsbXVNH1rR7621LStV029hS4s9Q07ULOWa0v bK6gkSa3ubaWSGaJ1kjdlYE6lfyp+C/ih+1p/wAEYfiha/DP4uaff/Fv9lDxZq95J4dvdNdzpc1s 1x5l3rXgG7vZZV8IeMraKQXniH4d6vdR6XqkzzzQXDJdWfjA/wBK3wW+Nvww/aE+H2i/E/4SeK9P 8XeENbjIiu7NjHeadfRqjXeja5pswS90XW7BpEW90vUIYLmIPFMqPbT288v594teCWbeG8Mv4kyj M8Lxv4YcSN1OE/ELJIueWY+EudrLs1pRlUnkufYdQqU8TlmLkpOrQxEcPOpUwuLpYb8u8c/o6554 R08q4uyLOMF4jeDfFzdXgfxT4dhKpk+Z05Oo1lWd0IyqVOHuJsKqdWljMnx0oydbDYuGGqVauDx1 DB+rUUUV+IH85BRRRQAUUUUAFFFfE3x4/wCCiX7H37O32yz8e/GXw7qHiazLxv4K8CyHxz4sF1Gx VrK90/w8by20G5yrHHia+0SLC4MoLxh/f4c4V4m4vzCGU8K8P5zxHmdSzjgcky3F5niVFu3tJ0sH RrSp0lq51aijShFOU5xim19PwnwVxhx5mtPI+CeFuIOLc4q8rjlvDuUY/OMYoSly+1qUMBQrzpUI vWdeqoUacVKVSpGMW155+2P/AME9v2Sfjf4K8f8AjzxZ8MdP8NeOtH8LeJvEi+P/AIeeV4Q8S3F9 pmk3upG51lLGE6H4nmlkt0Es3ibSNVuvLBSC6tslx/Mt+wz8LP27ZvB3xF+PP7F3jO60Y+BNc0zS PHPhbTvFWn6Tc+IY7fS7nWbK9vvDHiuJfAfjDTtJtp78C01uebUbSW7kGlafcNeTMv6B/tE/8Fsv HXxm8LfET4c/szfs+6nH4f1PwV4rtfEvjLxnFf8AibxHpXgy50W/tvEXiE+E/BznSfC66RpElzfS a1q/iXxDpGnrE9zf2pt4H3fFX7BX/BPT49/tq/DnxFd6D8ZLP4ZfALT/AIg3Og+J9PudQ8Q6xJqv jPTtB8N6rc3tp8O9PuNM0PVri00bWtEjTVta1rTHQsLe0aYQTCP/AFa8Hch8RvCXwR41h49cT5Fw 5kVbN+EqeV5T4lxl4lZVlWQKpiJ5nlVbhPLs0qV4yzun7GGX5Ph8dh60MRQeKeHpTo1IVP8AbjwD 4a8WvAz6OXiHT+k1xlw1wnw1Xzzgalk2R+L9Ofi9kuScL+1xVTOMkxHA2VZzWxMZ8RUnh6eVZBhc xwmIp4vDPGPC0KmHqQq+0/EX/gsZ8Qfi1+zj8Zv2cfj98KtKHjXxX4U1LwjaePvA122kw2+s213b gL4k8H6jJe25Mk9pIt7qWha7bQRMc2nh94yFXzL9jL9t/wDbV8M/CHSv2UP2OvhZY6/4ki1nxJ4n vfF9n4ZuvGfiWzXXbyOZriO31GSLwV4a0yyCRW8uoeKLHVbWWZlPn2jSLCf0D/ad/wCCUH7Lf7Kf 7FXxz+JFovjD4jfFHw34S06XR/Gfi3WpLW30fVNQ8T+H9Ja50Xwt4e/srR4YmivZYlXXP+EjubZJ pZI7syCNk+Pv2Tf+CUfiH9pT9lrwL+0f8H/jTdfDr4wTa54xhtNL1qO8t/Ds03hrxNf6Npl3pnir w0sfiXwheCGzYz3Cad4mM022SFbFHZF9/JOKPolYvwq4kzbJshy3IeAsT4q4XL6NTjDh7PMx4Mre I8eFlicBmsuGMLm9fHUeHJZbJ0KmDxEsvwdCpz1KuCw8IrES+o4d4z+gzjfBLi3POH+Gcp4Z8MsX 42YLK8PV494U4kzXw+xHi3HgtYvLM7lwbgs9xOZYfhOeUSeGq5fipZXl2Fq89Wvl2GpwWLn9JaH/ AMEmP25f2qNVs/F37bn7Sd5odq0oux4WbW7n4l+IdNJGZLPT9HsL7S/hp4SWQSypHN4ev9Xt4HaV 20yQMVk/Uf4D/wDBKH9ir4EfY7+2+GEXxP8AFFpsb/hKfi/NB42nMyKMTQeHJrSz8EWckcoM1vcW 3hhL6BypW8Zo42X8lLT9sP8A4Ko/8E9bmHRv2nfhvqXxs+FenSwWo8WeJRPrVu9nujSIab8b/DEG oCC/vi6iOP4jWmuawSWT+zoHR1T9Rv2cP+Cu/wCx/wDH77Bo+reLZfgp44uxHEfDPxVe10bS7i6Y hGj0jxzFNJ4Tu4mlZI7SPVL/AELV7xnAi0cEOF/m/wAZIfSwxmQPGcP53lWe+Eap1FgKv0d54ahw fQwNlOeHxWX8OqnxHSw9KlKDxdLNnjcvw0rw+tT5ZTf8kfSAh9ODHcMSx/C/EeS8S+BXsqscsrfR SqYTDcA4bLeVVKmFxmV8KRpcWUcJRoyhLHUc8lmGV4SXNB42ajKb/T61tbaxtrezsreCzs7WGO3t bW1hjt7a2t4UEcMFvBEqRQwxRqqRxRoqIihVUKAKnqC2uba9tre8s7iC7tLuGK5tbq2ljntrm3nR ZIZ7eeJnimhmjZZIpY2ZJEZXRipBM9f58z5+eXPzc/NLn578/Pd83NfXmvfmvre99T/LKpz88/a8 /tOeXtPaX5+e75+fm97n5r83Nre99QoooqSAooooAKKKKAP55/8Ago9/wTh8W+DPFsn7a/7FCal4 U+IvhTUm8Z+N/BHgtTaX5v7XzLm+8feArK2Qo+oOhnfxd4QjgltfEFrNe3dpZzzz6lpuq/ZH/BO/ /gpb4E/a48C3GhfELUNC8CfHXwLocuo+N9GurqDStC8SaHpkQN94+8Ly3syxw6XEg8/xJpMs7TeG Z2aSR5dIltL5/qD9qn9tP4CfsfeFjrvxZ8VxLr17aSXHhj4eaE1vqXjvxW6mSNDpmimeH7Jppmie GfX9Ym07Q7aRGgkvzeNDazfyE/EH4U/HD9uTxj8cf2p/gN+y5N4K+GVg99r+uab4KMzaW0kSBdab S21CexHi/wAX3kD3GseKdM8CaNDBGWuLh9Dtrm9VtS/0X8KuGcf9Inwkjk3jbSnwzk3B/wBTy/w0 8es5rYDA16csTjaOCjwRi3m+My+fFmXVpTlDAVaOIl9TxNJYSeLp4r2MZ/6xeCfB+Z/Sv8DI5B9I qhU4O4f4D+oZX4QfSc4hxGWZbiaM8XmGHy+n4c4959mGVVOOMprznKlllXDYqf8AZ+LorAzxtLGf V41f2w/bA/4LJ21trkvwP/Ya0KX4t/E/WLttAt/iNZ6Pc+IdAtdWnLW4tPh14Zgt5rnx/rSSbmtN UngPhZJYop7W08WWE7iL84/jT/wS0/bH1H4B+Pv2wPjd4su/E/xljng8X+KfhpqM03inxt/wg1vb yjWdb1fxDDfXGnQ6v4eso7O9i8G6Xb3djpfhSxu4kv7S+sIfD0f3/wD8EPPE37H194Sv/D3hbwlY +G/2stLsrxvGereK72LV/Eni/wAONcMTqvw7v7mG3j0vw3BG9va6/wCGdFtbW/sZ4rW412fXIHsd Xk/oQkjjmjeKVElilRo5I5FV45I3Uq6OjAq6OpKsrAqykggg15HFPi9S+ilxn/xDnwm8OHw7V4fz PAS4y4s44w+Fx3GXiRgMPXhWqUMNjKUa2DybhTN6UHPAyylOc4ujjKUMuxkMXRq+Fxn470foR+IC 8JvA/wAJZcK1uF84yyfiBxz4j4TBZlx/4t5ZhcTSxFXDYTH0YV8v4f4Iz6hTc8unkSlOpCWHx9Cn lWYQx1Cv+cH/AAS4/ao8F/tL/syeGrPRtJ8OeEvGvwlstL8DeP8AwR4Z06w0PSNNuoLVxo3iTRNE 06K3tNP0DxhaW1xqFvDbW0Ntaazb69pUAlTTBPN+kVfyv/G3wx4p/wCCQX7d+hfG/wCHmm391+zB 8bLu/i1TwzYc2VvoN9fW914x+HyxkpDDq/gy7lt/FXw6lmNuZtLFlozX91FbeKWf+n/wl4s8OePP C3h7xr4Q1ez1/wALeK9G07xB4e1qwk8yz1TR9WtYr3T723YhWCT200b7JFSWMkxyokisi/hf0huA MpybOMp8TOBZ1cb4X+LFHEcScM4mcnVq5NmtSq5cRcI5nNyqOnmOSZlOvThCpOblhmqUa+KrYPGV l/Nn0q/C/I+H8+yPxh8NalfMfBnxww+K4u4PxlScq9bh/OqlZz4r4Fziq51JUs14czepiKVOnVqV JTwbjQjiMZiMBjq66Giiiv5zP5NCiiigAooooAKKKKACv5gvCP8Axmh/wW/1nXx/xNPAX7PGtXt5 bMv762trH4GQQ+H9HubW4i3wyW1/8Zby3122lZ/LntL6TyiwCA/0GftMfFy1+A37P/xh+MFy8Sye AfAHiLXdLjmIEd54ijsJbbwvprEq4U6r4juNL01WZWVXu1LAqCK/GT/ggd8I7q2+Hnxw/aI19Jrn WPiL4xs/A+jalffvbybTPCsD674k1GK5dmlmi13xB4ltre9eQkyXvhjPLIxb+s/Av/jB/B/x+8Xa j9jjZ8O4Pwl4SqvSc8343xFJ57Wwk3pTxmU5NRw2OhOL9oqNSqotJuM/7j+jX/xrjwG+lB47Vf3G Y1OE8B4G8DV37tSpnviNiqL4lr4Go9KWYZHkGHwmZQqQftVQq11BxUnGp/QZRRRX8mH8OBRRRQAU UUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAH80/wDwWj/5PE/Yj/7h f/q0dGr+liv5p/8AgtH/AMnifsR/9wv/ANWjo1f0sV/VHjZ/yYr6Kf8A2SviJ/62FI/tf6RX/KNX 0I/+yK8V/wD1vcOFFFFfyufxQFflt/wUw/4KHaL+xt4DXwj4JmsNa/aE8eaZP/wh+jyCK8tvBekz GS0fx74ksyWV44J1lh8M6Tcps13V7eVpo5tK0zU0f1r9vf8Abn8C/sTfCyXXb77H4g+Kniq3vbL4 X+AWmYPq2pxIscuva4IWWey8JaDJNDPqdwGhm1GYw6Np0qXd21zZ/lt/wTV/YW8dfHj4hP8At/ft kfb/ABJr3ifWIfGnwu8NeJIl8zX79/Ln0r4ia1prKsVj4b0qJLWP4ceG0ggszbWtlq8NpBodloK6 l/UHg54ZcM5Xw9iPHTxko1KfhtkWKdDhjhmTVHMPFPimi5vD5HlsKnvSyPC16Ted5goTw7hRxGFv Onh8xlhv7L8AfB7g/JeFMV9JTx/w9Sn4RcNY2WG4O4Pm1QzXxp40w7qPC8N5RSqWlPhvB4mjKXEe aKFTCunh8Xgk6lLC5tLB6P7DH/BKWbx58OfiF8c/2w01PV/i/wDHnwv4k/4RTTvErXF5r/w//wCE 2sbp2+JHiNbuQTTfEi+uL6PVLCwvfn8M2qlNQj/tu/ubPQ/AP+CVPxT8Q/swfti+Nf2ZfiOx0m1+ IWp6j8O9Vsp3YWun/FLwRe6ivhu5heRAWh1lf7a8P2jwpGNTn1rQ52cwwRY/qmr+Wn/gtZ8Mofgp +0L8N/2kPB+owaNqvxJtYLu5isLm3i1iz+Inwyk0hLLxNa2pkEqQ3mkTeHEF1DavBBqmh3dxezm6 1OCOX8o4/wCJ/ET6QXiVg82p4DE53xNmuLw+T8O8L5JQnLC5blMZShgMhyXBx/d4TLcvouc6tWfs 6aUsZmePrKcsTXP4++kpnfjT9KPxq4K8SuHMhzLi/wAR4cQ5fwxwzwDwrhKlShhOEMbXeFwXCXD+ Ag1SwOT5TSq1Y18RUdDD0aGOzfP84xUGsZi1/RT+0F+0L8K/2Y/hprPxU+LniKLQvDmlqYLO0iEd xrnibWZIpZbHw34Y0tpYZNW1zUTDIILdXit7aCO41HUrqw0qzvb62/mys9O/ak/4LZfGkalqjX/w k/ZG+HmvusSw+ZcaRoylXP2WwEvkW/jv4tanpsojvdSaMaP4Rsb3zGgsLS9tdN8Qy/Ab4BftI/8A BYP4sQftA/tMeIL7wx+zp4U1CfSdH0zQt2m2GorZTwyah4L+GulyyzG0SZ/LXxf8QL+O8uZbhBp9 tNf3tklpoH9Qnw/+Hvgr4VeDdA+H3w78NaT4Q8G+F7FNO0Pw/otqlrY2NsrNJIwVcyXF1dTyS3d/ fXMk17qN9PcX19cXF3cTTP8A0fiMdwp9E3A1suyStlPGX0j8ZhZ4fNM/pqjmXDXhBTxVJ08Rl2Tq op4fNOMlTnOji8XOEqOAk5UJwVCOJwWa/wCg+JzPgj6DuWYjKuHMRkfiB9LbMMHUwuc8TU44fN+E fAWli6DpYvKchVSNTCZ14gRp1J4fHY6cJ4bLJueGqQjhoYvL875T4HfAv4Yfs5/DnQ/hZ8JPDNp4 Y8J6HGWEcQEupaxqUqRre694g1JlFzrGu6k0SPe6jdMzlUhtbdLextbS1g9coor+NMyzLMM4x+Mz XNsbisyzPMcTWxmPzDHV6uKxmMxWIm6lfEYnEVpTq1q1WpJzqVKkpSlJttn+f+b5vmmf5pmGd53m ONzfOM1xdfH5nmmY4mtjMfj8biqkq2JxeLxVedStiMRXqylOpVqTlOcm22woooriPOPPvij8Kvh5 8avBGt/Dj4p+E9I8aeC/EMHkanoesQGSFmQlre8s7iJorzTdUspcT6dq2m3FrqWnXKpc2V1BOiyD +Zb4tfs+ftTf8Ee/ifP8dv2btc1j4j/s163e20Pi3StXgmvrK104XKra+HvixpemxwW9vIj3L23h f4l6NDp5hvJns5l0mTUm0fWv6qqpajpunaxp99pOr2FlqmlanaXOn6lpmo2sF9p+oWF5C9vd2V9Z XMcttd2l1BJJBc21xHJDPC7xSoyMyn9r8I/GzPPC+pmGTYvAYTjDw54kSocYeHueP22S5zh5KMJY rCe0hW/snOqMYwnhc0wtPnVWhhniaeIjhqEaX9D+BX0ieI/BqrmnD+PyzA8feE3FyWG498K+JH7f h7iDCzUITxmB9pTrvI+IcPCFOeCzrBUvaRrYfCPF0sXDC4aNH5E/Y4/bg+DP7aPgf/hIfh7qI0fx jpFtA3jn4Y6xdQHxV4RupCsZmKIIl1vw5cznbpfibT4RZXaslveQ6ZqyXelWn2RX82/7ZH/BM34o /sy+OW/a7/4J6ah4h0O+8O3lzruvfCzwyGudZ8MwyAy6lc+BbCRLhPFXg27jEketfDrULXUJILV3 h0221fRpP7J0b6j/AGSv+CznwC+J3w7vm/aS1zSvgh8T/B2nxSeIo57XVrvwv4yjR0tpNU8EQ2Nt qusf2g0xV77wdNBd6pZCXzdNudZsob2ew++458Bcv4jyZeJn0eKmacc8CYzE0aOacI06FXHcfeH2 aYuSUMmzjKcMq+NzLAOrJ08vzbCQxPtaUb1qmJpU1mmL/UPEj6MmV8W8Px8Yfop1c58SfDTMMZQw 2c8C0sNWzLxP8LM5x01GnkGf5HhFicwzfLHWk6WVZ5gYYx1qEb4iri6FJZ1jv2lor8APjR/wXk+H FlfN4X/Zn+D3iz4seILuYWGma94tM3hbQrm+lJW2fSfDOmw6t4u8QpK5jRbG6XwleyM7BCCi+b4B /wAIp/wWn/bwUSeINTv/ANnD4Y6v5ZNldT3fwU0f7FMC0kR0TTE1X4xa5azwMHji18XulXW6FRdR oS6c+U/RR49w+BoZ74n51wl4McO1YqpDGeIGdYbB5xi6Stzwy3hrC1K+a4nGxvpgcXHLq82mo62v y5H9CHxOwuW4fiTxk4g4G+j5wnXiqtPMPFLiLB5fnuOoq3tKeUcIYKris7xeYQvpluOp5ViKjTUd eXm/d345/tpfsvfs4R3KfF34y+D/AA5rFsuT4Ss71/EfjZyVJjA8HeHItV8RQxysNiXd3p9tYq5/ e3UShmH49/FT/gu1N4i1o+Cv2Rv2efEnj/xFfvLa6LrHjmG+nuL66UYR9N+G3geTUNc1aCQ7pYhJ 4o0m88pU86wid3ji9J+Bn/BB74CeE5LbWvj54/8AF3xo1wyLc3eh6S0vgHwZLM8glmiu2sLy/wDG OqHdlPtsPibQ/PVpZJbBHdBF+wfwp+BHwZ+BmknRPhB8MPBPw7sHjSO6/wCEW8P6fpt7qIjChZNX 1WKH+1dZuAFXN1qt7eXLbV3SnaMel9f+id4a3WAyvjH6QHENC6WMzirV8P8AgD20bKFfD5fQVbiT FRhNSlPC5gq2ExFNRgqiUpTXr/2l9B7whussybj/AOlHxVhlaOYZ9WreF3hf9YhZQxGGyrDKvxdj I06ilOpgs0+sYHF0lCmqsYzlNfztR/s3f8Fhf28P9I+N/wARL/4DfDDVVR5fDmuaifAdjPpsrDfZ L8LvAkZ8QatPAkrNHb/EqTT5JApD6pvSMV9vfAX/AIIefspfDL7FqnxVvvFHx68R2/lySRa9cSeE PA63EeGWW28KeHL3+0pk358y113xVrljOgVJbPbvD/tBRXgcSfSq8Usyy+pw/wAH1Mj8JuFHeMOH vC/KMPwtT5UuSM6+bYbnzupiJQusRVpZhh6WInKc50FdRj8vxb9NnxpzfKqnC/AVbhzwO4Jd40uF PBrIsLwXR5FH2cZ4jO8J7TiKtip0vdxValmmFo4qcpznho8yjH4L/bM8IeAfgz+wP+05onw58GeF PAXh6P4KeNtIg0XwjoGl+HdMT+2tHm0IH7HpNnbwPLINRIeZ42lkd2eSXezSD5e/4IWaV/Z37Ed3 d7cf278afHuq5/veTpHhDQ933m6f2Nt6J937p++30d/wVV1U6P8A8E/v2kbsNsM3hrwxpWdwXI1z 4h+D9EZcl0zvXUCm3JL7toSQnY3m3/BGLSxp/wDwT++Fd2F2nXPEvxQ1QnbjeYfiH4i0XdnYu/A0 cJuBkxt27wVKJ7mDxOJf0OuMc0xmIr4rFcQfSEyTLsRisTWqV8RiqmB4KnmspVq1WUqlWblPnlOp KUm9W76n0eAxmLf0BOPs5x+KxOMxvFP0qOHcpxWNxdericVjKuW+HdXPJSxGIrSnWrVOabqSnUnK Um7t31PRP+CrdxHbf8E+/wBpCSTdtbw/4QtxtAJ8y6+JXgu1iyCR8vmzJvOchckAkYPAf8EZrd4f +Cffwjkcrtu9f+KVxFtJJCL8SvFFqQ4IGG8y2kIAJG0qc5JA6n/grrcC1/4J3/tFSlC4a1+GdvgH bg3nxm+HVoHzg8RmcORj5gpUEE5GX/wR2tzB/wAE7/gNKXDC8uvixcAAY8sL8ZviDabCcncSbUvk AcOFxlcnCj+7+hPjZ7fWPpOYegr68zpeF/t7JLZpO7b0a0WpzYf91+ztzGeyxX0x8Jhk3qpOh4Mv EuKS1i0nzNvRrRan6X3VrbX1tcWd7bwXlndQyW91a3UMdxbXNvMhjmguIJVeKaGWNmSSKRGR0Yqy lSRX5eftG/8ABIP9j/49/wBoaxonhSf4JeOLzzJh4k+Fq22l6PPduQyvqvgSeOTwrcQF98lx/Y1n 4e1K6eRml1XdtI/UqivwXg3j/jbw9zJZvwTxRnPDOPvD2tTKsbVw9LFRg7xpY/CXlg8ww6erw2Oo Yig3rKm2kfzLwB4o+InhXm8c98OuM+IOD8zvB1q2SZjXwtDGwpvmhQzPAqUsBmuFUtXhMyw2Kwsn rKi7H8uVx+yD/wAFVf8AgnndXGr/ALM3xDv/AI1/CqwuJLpvCnhcTeILeayVi8o1T4J+J2vZbS/v vmSeX4b3mtav5exhq9vIF8r6L+An/BdTwdNqC+CP2uvhXrvwh8W2E/8AZ+seKfCOnavqvhy2v43V bg674H1MN448KrACwe0s5fGl4XUFo4VfbH/QFXzn8ef2Sf2dP2mNOax+NHwp8L+L7tYPs9n4la1f SfGelxhSI00zxjo0lh4jtII2KyGxTUjp07xx/arO4RQlf0R/xMD4f+JKWF+kD4VZbneYVUoVPErw 5jhuEuO4TtZ4zMcHDkyLiLEWcuWnjY4TB0k04YSUkmf1avpS+F3i6o4P6UvgnlHEWa1lGFXxe8JY 4TgXxLpzsoyx+a5fTVPhrizFWc1ClmEcDgaMWnTwUppSO9+FXxq+Evxx8OxeLPhF8Q/CfxC0GRYz JeeGdXtdQlsHlDFLbV7BXXUtFvsK27T9XtLK+j2nzLdSK9Pr+cT4rf8ABE34m/CjxDJ8Tf2Ff2gf EfhfxFp/nz6f4Z8U69f+FPEtvGSJX0/RfiT4SitIbyO5I+zRaXr+h6baSRIiarr1wskso4jw5/wV D/b1/Yz1qx8Cfty/AjU/GOjJMtjbeL7vTrfwh4lvo4htebRvGegWt/8ADTx4lrDGX8uytoL26lVz qHiFZWd1zq/RtyLjylVzD6PnidkPiE+Sdd8C8RVKPB3iNhIRTlKjTy/M50MuzpUIpqvmGEr4HCTm 4xw8KvMm8q/0ReGfE2jVzT6LHjHwx4qv2c8Q/DXiyrh+AfFnAwjFznh6WVZxUw2VcRLCwTWJzTA4 nLcFUqOMMLSrc0W/6cqK+Dv2cf8AgpP+yN+04bDS/BfxLtPC/ja+WNV+HfxIWHwd4se5kIC2Wmfb LmXQPEt2TuYW/hXXNbnWNWkmihUHHa/tZ/tu/Af9jjwr/bXxS8Ri58T6hbPN4W+G3h57W/8AHHih /wB6kUttpbzxLpei+dDJFc+ItYlstIgeOS3iuLrUTb2Fx+EVfC7xHocWYbgWvwRxPQ4vxtX2WE4f r5PjaOY4nVp16FGpSiquCjFOrLHwk8DChGWIliFQi6i/miv4MeLWG44wfhrifDnjHDceZhX9hgeF sTkGYYfNsZq08ThqFahBVsvjFSrTzSnOWXQw0ZYueKjhoyqr6w1HUdP0iwvdV1a+s9L0vTbS4v8A UdS1G6gsrCwsbSJ57q8vby5eK3tbS2gR5ri4nkjhhiR5JHVFJH4Gftef8Fk1l1x/gd+wjoN18Vvi XrN42g23xHtNBuvEOkR6lKrxm2+G3hWO2mu/HGrxyBzb6vfWZ8NK1v59nYeJ9PnW4j+U5dW/b+/4 LJeI5bHS4m+BX7Jltq7R3MgfUIfBRgtLpHaK/vFXT9X+M3i+z8lHWwt47DwppepQwPPF4SkuRdz/ ALufsi/sH/AH9jbw8lp8OPDo1bxxe2a2/ib4p+Jora+8a68zbWuLa3u1iWHw7oTyqvleH9CjtLJk htpdTfVdSifUpv6Kp8B+E/0eYQx/i/PA+J/irTjGrgvCLIswp1eGeGsRZVKU/ELPqEatLFYmjLlc +H8Eq9KTj7PE0sfgMXDGUf6vpeGfgf8ARUhTzPx5q5b4y+NlGMK2X+BHDWaUq/B3B+L5VUo1PFXi bDRr0MbjKEuSVThbLliKU3FUsXRzPLMdTx+H/Kr9lT/gj74w+IfiuP8AaF/4KD+K9Y8b+NNbvLfX pPhZca/NrN5eXACtbr8T/FcVxN9oigVY44/B3he6GnW1tDa2l1rb2n2rQI/6DPD/AIe0Hwnoml+G vC+i6T4c8O6JZQ6do2haFp9ppOj6Vp9soS3stO02xigs7K1hQBYoLeGOJBwqitiivwnxP8YeOvFv M6OO4szOH1DL4+xyLhrK6Ky7hnh3BxiqdLCZNk9GToYeFOjGFF4mq6+OrUqdOGIxVWNOmo/zT4ye PfiT46Zxh8y45ziH9mZXD6vw3whktBZTwdwpgIQVKjgeH8hoTeGwsKVCNPDvF1nicyxFGlSp4rG1 40qSh/PP/wAFHv8AgnD4t8F+LW/bX/Ynj1Lwp8RfCmpN4z8b+CPBaNbag2oWzSXN7498BWNsjJJf yI07+LvCEcEtpr9pLeXdpZTzz6npuqfaX/BOH/go94S/bM8JJ4Q8XvpnhT9obwrpqSeKPC0bi2sP GVhaqkU3jTwXDM5d7R3KtruhK8134dupRlp9Lns7yT9Rq/nn/wCCj3/BODxb4M8Wv+2v+xOmp+FP iL4V1JvGXjfwP4LRrXUGv7ZpLm+8feArK2Qo+oOjTv4u8IR28tpr9pLeXdpZzzz6lpuq/uvA3HXC /jrwxlfg34yZpRyrirKqP1Hwl8Wsa+atllaVo4bg7jLEyftMZw/i6ihQwWNrTdTAVHCMpxcadSX9 KeG3iTwb9JTg3JvADx/zmhknGuSUFl3gZ455i+evk9edoYPgDj/GTaq47hXHVVTw+XZjiKkquWVZ U4yqRcaVWX7EftY/s1eDf2svgb4w+DXjFIrf+2bb7f4V8QmBZ7vwh4006KZ/D3iayXKyE2VxK9tq NtFLC2p6JeappLzRxX8jj8WP+CTH7S/jL4BfFbxl/wAE5v2jJJNE13w54l1y3+FU2pSv5Fj4hhll vtb8D2d5MI0udD8VQM/jLwHeBY7e/e71CO1muf7e0S1j+8f+CcP/AAUe8JftmeEk8IeL303wp+0N 4U01ZPFHheNhbaf4x0+1EcM3jTwZFM5d7R5GQ67oIeW78PXco5n0uezvJPmr/gst+x3qvivwxo/7 ZXwbtrvTPiz8FFsL7xvc6AWtNX1TwTodwNQ03xlbTWii4fxB8Nr6OO++2qyTr4We9nmuTF4a0y2r v8OMvxnD2a8XfRK8cMPUyHLOL8fTqcL5njEqtDg7xFjB0uHOJcqxLcadfI+JIqll2Kq4aapYylWo U3VwtKtmU16nhJlWP4Vzvjv6DP0j8LU4ZybjvM6VbgzOcwtWw3AXivCm6PCfF+SYuXLSxPDfF0VQ ynG4jCVI0cfh6+GpSrYKjiM2qL926K+D/wDgnh+2PpP7ZfwA0fxhdT2dv8UPCAtPC3xc0K3EUH2X xPFbbrfxDZWaENDoPjG1hfV9L2oLe1u11fQ4pbiXQ7iZvvCv5N4t4VzvgjiXO+EuJMHPAZ5w/mFf Lcxw0ruMa1CXu1aM2oqthcTSdPE4PEwXs8Tha1HEUm6dWLf8Occ8FcR+HHF/EXAvF2XzyziPhfNM TlOa4Od3GOIw8vdrYeo4xWIwWMoypYzAYuC9ljMFXw+KouVKtCTKKKK+dPlAooooAKKKKAPwv/4L y/Gc+Df2bPAvwcsLvydT+M3jtbzU7dXcG48HfDiO01rUI5FQgYbxXqfguaPzso4tZ9kbvGXh/SP9 h34Mj4Afsm/Av4XTWgs9Y0bwJpmq+KYCiLInjHxYZfFfiyGV1UGY2mv61qFjDLJlza2tuh2qiov4 ZfteAftkf8FjPg58BYP+Jj4L+ENz4S0PxFbpvaxms/DNvd/F74kmZnWSOKe8snTwbNIUWJrzTbO2 VXlKtL/T1X9Z+MP/ABgvgH4DeF0L0cw4kwuZ+NPFVH4JVK3Esp5bwhOpT0lGpRyGli8NVVW8ualF pQXux/uPx7f/ABDX6MX0ZfBin+4zXi7BZz9IXjXD25J1K/F06mUcBVKtL4oVaHDFHHYStGtefPRh JRpq8IlFFFfyYfw4FFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFZet63o/hrRdX8R+IdTsdF0Dw/pe oa3rms6ncxWWm6To+lWk1/qep6heTskFpY2FlBPdXdzM6RQQRSSyMqIxGpXxp/wUa1vxx4a/4J6/ t3+I/hjJq0XxJ8P/ALGn7UGt/D2XQdP/ALW1yPxxpXwR8cX/AITk0bS/st9/aWrJr0Fg2naf9ivP tl4Ibb7LceZ5TgHJfDz9vWz+Lfgnxp8SPhj+yv8AtU+K/AmlaBpfiP4UeIbzSPgR8P2/aU03VrxY bab4O+HPit8ffAfjDRLZ9NeLxJaat8fPDvwQ0HW/Ds9tf+G9W1qW6traXR8JftlfEPxH4a8f67rH 7BH7X/gHVPBuj6fqfh3wZ4t8U/sKXniX4sXt5fizuPD3gC68C/tr+NfB+naxpNv/AMTXUJ/in4r+ GugSWAMel65qWqY00+iRRRwxxwwxpFDEiRRRRIsccUcahUjjRQFREUBURQFVQAAAAKfQB5x4S/bK +IfiPw14/wBd1j9gj9r/AMA6p4N0fT9T8O+DPFvin9hS88S/Fi9vL8Wdx4e8AXXgX9tfxr4P07WN Jt/+JrqE/wAU/Ffw10CSwBj0vXNS1TGmk8JftlfEPxH4a8f67rH7BH7X/gHVPBuj6fqfh3wZ4t8U /sKXniX4sXt5fizuPD3gC68C/tr+NfB+naxpNv8A8TXUJ/in4r+GugSWAMel65qWqY00+j0UAece Ev2yviH4j8NeP9d1j9gj9r/wDqng3R9P1Pw74M8W+Kf2FLzxL8WL28vxZ3Hh7wBdeBf21/Gvg/Tt Y0m3/wCJrqE/xT8V/DXQJLAGPS9c1LVMaaTwl+2V8Q/Efhrx/rusfsEftf8AgHVPBuj6fqfh3wZ4 t8U/sKXniX4sXt5fizuPD3gC68C/tr+NfB+naxpNv/xNdQn+Kfiv4a6BJYAx6XrmpapjTT6PRQB5 x4S/bK+IfiPw14/13WP2CP2v/AOqeDdH0/U/Dvgzxb4p/YUvPEvxYvby/FnceHvAF14F/bX8a+D9 O1jSbf8A4muoT/FPxX8NdAksAY9L1zUtUxppPCX7ZXxD8R+GvH+u6x+wR+1/4B1Twbo+n6n4d8Ge LfFP7Cl54l+LF7eX4s7jw94AuvAv7a/jXwfp2saTb/8AE11Cf4p+K/hroElgDHpeualqmNNPo9FA HnHhL9sr4h+I/DXj/XdY/YI/a/8AAOqeDdH0/U/Dvgzxb4p/YUvPEvxYvby/FnceHvAF14F/bX8a +D9O1jSbf/ia6hP8U/Ffw10CSwBj0vXNS1TGmk8JftlfEPxH4a8f67rH7BH7X/gHVPBuj6fqfh3w Z4t8U/sKXniX4sXt5fizuPD3gC68C/tr+NfB+naxpNv/AMTXUJ/in4r+GugSWAMel65qWqY00+j0 UAfzaf8ABTz4/eM/ix+0p+yz4p8R/sr/AB/+BWo+EfsH9m+CPizrv7MGqeKvHvl+PdM1Ff8AhELr 4IftI/GXwXaedPEukR/8J14v8FY1GeKSXytJE2qQ/wBAnhL9sr4h+I/DXj/XdY/YI/a/8A6p4N0f T9T8O+DPFvin9hS88S/Fi9vL8Wdx4e8AXXgX9tfxr4P07WNJt/8Aia6hP8U/Ffw10CSwBj0vXNS1 TGmn8Pv+Ctf/ACdV+yB/3Dv/AFY2k1/QRX9UeNn/ACYr6Kf/AGSviJ/62FI/tf6RX/KNX0I/+yK8 V/8A1vcOeceEv2yviH4j8NeP9d1j9gj9r/wDqng3R9P1Pw74M8W+Kf2FLzxL8WL28vxZ3Hh7wBde Bf21/Gvg/TtY0m3/AOJrqE/xT8V/DXQJLAGPS9c1LVMaafG/iB/wVBsPhJ8MvG/xC+NP7I37SfwB udFttOtPh54d+L3ij9kjUrv4v+K9VuZLZfDnhI/s/ftQ/H2901PD9uo17xfrHivTNCsdO8OpNNoh 8Sa79m8P3Xq/xq+M3gP4BfDjxF8UfiNqq6X4b8PWxcxx+XJqOsalMGXTtB0S0eSI32s6rcAW9lbB 0jX95dXc1tY211dQfz/fBv4XfFX/AIKr/tB6h8cfjML/AMPfs9eB9UXT9N0C3nu0sJ7G3nS6t/hz 4VuQbfzLy7h8m88feK7cR3YNwi262c93pEGl/OeCfhHlXFNDN/EjxIxtbh7wc4HqU6vEmaRUoYzi PMv3dTCcGcNpSpzxObZnKdKliJ4eXNgMPXpzlUo1sRhpr5H6O3gVkvGuGz3xb8XMxr8K+APhxVpV uLc6ip08w4tza9OpgvD/AIRSlTqYzPc4lOjRxVTDT5sswuJp1J1KFfFYSotD9nP4X/Fn9tL4v+Nf 26/2rPhF8T/jX4H0K0HiD4cfCXwPcfC7TY/i7q2ma6mnaX8LfBVp8Wvir8NvD+leCvBcE0ur3B8V a94e8JeLHsdSsb7xhqevz67p+q/v14N/bE8fa54V8d6tqP7Af7Xfw7vfA+h6ZfeF/A3ifxN+wlce IPilcXF6thL4Z+Hc3gL9tbxn4M0rVNGtANTvZPih4q+Gfh1tOUQ6Treo6mBpldxoujaT4c0jS/D+ gabZaPoeiafZ6VpGk6bbRWen6ZpthBHa2VjZWsCpDb2trbRRwwQxIqRxoqqAAK/Oz9u3/goV4O/Z X0u48EeDhYeM/jvq9kDpnhsMbnSvBsV5GDZ654yNvIkoklV1uNJ8NwyR6jqieVcXLafps9vd3PRx TxBx/wDSj8SMo4e4Q4edDLcDh45LwJwPlaVHIuDOF8J7KkqmIqRjDCYWEKNOhXzvOK8acatWNGhT 5KFLLsFS6uM+KPFD6Z/i3kPCnAfCssNlGW4WPD3hn4cZKo4fhvw+4MwPsaMauKqxjTwOCp06FPD4 jiLP8TGjGvXjQw1JQw1DKsuo9f8AGn/gsLo/wT8M+IY/iL+yL+0R8GvidLpNtd/DfwT8Y/Ff7J+q Q+N57ue7tZb6Wf8AZx/ae/aD1bw3oGhSWyy6lf8AinSPD66u00WneF5NWu4dXfRvxq0n9mj9rT9v GT4v/tTftAeGPirrV3dfDRde+BGk+Hpfhfplr8RfEF7q13YaB4E8L6R45+Jfha48C+BPCsDr4ovr vWdO0rT/ABJoF3PfeGfEHiTxXdT2eqfVn7GX/BPfxj8V/Fj/ALVX7b39p+KfFHiS7h8QeH/h34uU yXl/IVjaw1r4gadIkcNnp9tBHbx6D8P1t7ezs7GK2t9XsrayhXQa/d5ESNEjjRY441VI40UIiIgC qiKoCqqqAFUAAAAAACvu+IeOOEfo65Jmfh74OZnh+IfE/NMLUyzxC8ZMIk6OUwmuXGcLeHFV80sN Qo1E6eN4gp8tetVpKtQnLExwf9ifo3GXiDwJ9FfhbPvCTwCzyhxN4yZ/luJyLxU+kJlUuRZBTxFN 0sfwd4P4tN1cBSw1VunjeLKDhiq2JowxOFqPGU8A+HfwY/4JJftcax8FtO+M3wKv/AHjr4mX/wBj l+I/w1+F/ga58A6V4213xbpEmn6H428G+Hpfiv45+GfgSz1a+0JLHxGkPinxz4U0i0tfB3iItfNq l9a2d3+0XhL9sr4h+I/DXj/XdY/YI/a/8A6p4N0fT9T8O+DPFvin9hS88S/Fi9vL8Wdx4e8AXXgX 9tfxr4P07WNJt/8Aia6hP8U/Ffw10CSwBj0vXNS1TGmn+ev9tzwhrn7IH7bPh/43+CLQ22jeKtdt fitoEcQNvZTaxHerD8Q/C8kqRhVi1O5nubi9iiQiHSfFlvCpLA4/o08FeL9E8f8Ag/wv448N3IvN A8XaDpXiPR7ngNJp+sWUN9beagJMU6RTrHcQth4J0khkAdGA/ibA1605Ymhiak6uIpVpynVqSlOp VVWTn7Wc5NynKcnKUpSbk+aLbuz/ACZ8G84zGjT4l4C4gxVXFZ9wbnGJp/WcTUnUxGYZVmFerisL jpVKspVqzqVZ1ajqTlKUcPicGpO8kc/4S/bK+IfiPw14/wBd1j9gj9r/AMA6p4N0fT9T8O+DPFvi n9hS88S/Fi9vL8Wdx4e8AXXgX9tfxr4P07WNJt/+JrqE/wAU/Ffw10CSwBj0vXNS1TGmk8JftlfE PxH4a8f67rH7BH7X/gHVPBuj6fqfh3wZ4t8U/sKXniX4sXt5fizuPD3gC68C/tr+NfB+naxpNv8A 8TXUJ/in4r+GugSWAMel65qWqY00+j1zvinxf4T8DaNc+IvGnibQPCOgWYzda14l1jT9D0q34JAm v9TuLa1RmwditKGcjCgnivXw+Hr4uvSw2FoVsTia9SNKhh8PTnWr1qs2owp0qVOMqlSpOTSjCEXK TaSTZ+6YXC4nG4ihg8Fh6+LxeJqwo4bC4WjUxGIxFapJRp0aFClGdWrVnJqMKdOMpyk0optnNeEv 2yviH4j8NeP9d1j9gj9r/wAA6p4N0fT9T8O+DPFvin9hS88S/Fi9vL8Wdx4e8AXXgX9tfxr4P07W NJt/+JrqE/xT8V/DXQJLAGPS9c1LVMaaTwl+2V8Q/Efhrx/rusfsEftf+AdU8G6Pp+p+HfBni3xT +wpeeJfixe3l+LO48PeALrwL+2v418H6drGk2/8AxNdQn+Kfiv4a6BJYAx6XrmpapjTT+ePxo/4K 9/su/DYXen+A5PEHxp8QweZHHF4WtX0TwsLiMHEd14s16CHzIHbCreaDo3iGBhuZSwChvixv2sf+ CnX7Y+bP9n/4Xz/CrwLqL+XH4n0PS102FrKQ5dp/ih49MNhPLbqyyNL4LstK1TYqrDbyNIY5f6L4 Z+it4s5xl8c/4mwWUeFvCq5ZVuJfE/NsPwjg6cGuf3cBjFLOqk507yoXy2nQrtxjHERUuZf1jwf9 Cjxxz/K4cT8YZdkXgvwSuSVfi/xlzvDcC4ClTkvaXhlmYKfENWc6Sc8NfKKWHxDcIxxMVJzj+0Wq /wDBR+28E+A/iD47+Mn7In7SfwGXwbo1lqnhnwv8VfiN+wJaeJPjFqFzffZLnwv8MZfCH7b3jDwu PEWl2/8AxNLyL4ieJvh7pNzZfuNG1fVdWK6Yfg7X/wDg4X+Dd54We8+H37M3x5t/GbzSW0fhv4v6 j8IvC1lbsMIl0+s/Cj4lfHC0v0EhYrbWjxi5CBY72JZVmXw34e/8Eb/FHjTV18Z/tYfH7XvFevXh SXU9L8IXuoa5q10c+YqX3xF8cxXV3Ngs0Vxbw+FmwS5tdT5WWv1P+DP7HP7NXwCFtP8ADT4TeGNM 1u2VdvizVrZ/EvjAyBQsksXiXxBJqOq2AnYeZNbaVcWFgXx5dpGiRon0X9lfRR8NNc3zzi7x+4ho ayy7h2jU4E4CVaOs8Pis4xMqvEGMgpWjTxuUuphq0FKTox5lGP1f9ifQi8INc94k47+lDxXh/iyn hOhW8M/DGOIhrUwuNz/FyrcU5hSjO0KOY5G6uExFNTm6EeaMY/j348/aN/4LMfteeGtd1n4afDzx b8NvBI0+4vNN8M/DdfDnwZ1TxNGi7bWz0Lxz8WPFnhvxDqN7exyeX9stPGOheGbiQSyTtYxoixfL 2h/8Ew/2i/HXws8feLdZ+EX7Rfgv476LJoWtWHhD4s3P7Icnhv4nya5rAsfEmleFvHPwt/bL+Mt+ PEGgQzyeKtR1r4j6X4C03U9Ogl0/SV1XXrpLeP8Aq/oq6X0wuO+Gq+FoeFXCnh/4VcPYXFYevUyP hvhrBYqrndHDz5o4fiXOsxhWzHNHUjelWxWElleKnTk3CrTqWqGlD6e3iVwhicFhvBPgjwt8E+Fc FjcLiavDnCXCGX42vxFQwlTnhhOL+Ic2p182zl1YuVHEYzBTybGzpSfJXpVbVT+er/gn7+318Lv2 RdK8S/Bb4z/sppo/xu8IPJo+h678PPDnwx8H/FD4hau97DaN4K8b+IfjB40+GfhPQteRLjz9O8Re J/iN4W8F32mwtFeyabqBt7vxB+5vhH9sv4g+JvDPj7X9W/YJ/a+8B6l4P0bTtV8N+DvFfir9hS+8 R/Fm7vr8Wk/h/wCH134E/bX8a+DtP1fS7Y/2tf3HxS8WfDXw/Lp/7vStd1PVMaafl39s79hD4Y/t c+HnvbhLbwd8WtJs2i8MfEaxskeeVIkYwaF4ttojE+u+HnkI8re41LRZGa40i4SKW/0/Uvy7/Z+/ bK+OX7Avjqz/AGZP2yNC1m++HWnmO18MeLwLjWdS8L6CzGDT9V8NanEHHjf4eLtVF06ItrvhyITa faRpc6X/AMImv0fF3CPD30ocNmfiR4Tzr4HxWw+HnmHHnhBmeZ1sdisyjTjzYriDw7xmNqOtmGDc 5OdbIE1UwspqhhaOGnLAYfNPreOuBeFfpm4TOPFvwPqYrLPG7C4SeaeJngNnGcV8xxubxox58ZxR 4UY/Ma0q+aZe6jc8RwunGrgpVFhsHQwlSWWYTOf3n8JftlfEPxH4a8f67rH7BH7X/gHVPBuj6fqf h3wZ4t8U/sKXniX4sXt5fizuPD3gC68C/tr+NfB+naxpNv8A8TXUJ/in4r+GugSWAMel65qWqY00 nhL9sr4h+I/DXj/XdY/YI/a/8A6p4N0fT9T8O+DPFvin9hS88S/Fi9vL8Wdx4e8AXXgX9tfxr4P0 7WNJt/8Aia6hP8U/Ffw10CSwBj0vXNS1TGmnqvDHifw7408P6R4r8Ja3pniPw1r9jDqWi65o95Df 6ZqVjcLuiubS6t3eKVDyrANujkV4pFSRHRd2v4rr0K2GrVsNiaNXD4jD1alCvQr050q1CtSm6dWj WpVFGdOrTnGUKlOcYzhOLjJJpo/zxxGHxGDxFfCYuhWwuKwtarh8ThsRSnQxGHxFCcqVahXo1Yxq Ua1GpGVOrSqRjOnOMoTipJpeceEv2yviH4j8NeP9d1j9gj9r/wAA6p4N0fT9T8O+DPFvin9hS88S /Fi9vL8Wdx4e8AXXgX9tfxr4P07WNJt/+JrqE/xT8V/DXQJLAGPS9c1LVMaaTwl+2V8Q/Efhrx/r usfsEftf+AdU8G6Pp+p+HfBni3xT+wpeeJfixe3l+LO48PeALrwL+2v418H6drGk2/8AxNdQn+Kf iv4a6BJYAx6XrmpapjTT6PRWRiflT/wUd/am8Z/Fv9hT46+HfF37Jf7Rv7NKzap8JLfT9R+N+v8A 7Kmtaf4udviZoOr3OnaCv7OP7T/x/wBRt7vS00KK7vW8Vad4dsJIp7cabeX90txFa+hf8Eyf2gvF ngf9hXwl4di/ZM/aJ1tfhp4S1fXPCOpaLrn7K0enftBXfiz4leKdYvdN+EC63+0zoepaNfaMusS3 Oqy/HrTfgjp00drcjR9S1m4a1ju/NP8AgspqRsf2QLa1zj+2Pi34K00jGciLTPFGr4PytjnSgc5T kY3HOxvrb9h3Thpf7IH7ONsAB5vwk8H6jgHPOsaZFq5P3m5Y324jIwSRtT7i/wBUZr/sf0MuFcNt /bP0gc8ze23P/Z3BFPKubz5eblv0vY/tbOv9g/Z98E4T4f7f+lJxJnttuf8Asrw5o5LztdXHnUL9 FofM/wDwUN/ab8afGT9gn9pHQ/F37JX7RX7NS2v/AAp57DUvjlrv7KmuWHixpfjN4JuLnT/Do/Zx /ad/aA1G0vtMXT4bq+k8V6d4b0+W2uI49NvdQuvPgt9//gl1+0P4n8G/sG+FtAtP2V/2hfFEXwy8 P+KtW8JaxoOufsvR6Z8f7/xJ8XPGeo6nofwiXxL+0l4b1fRtS8LyancRa3L8eNJ+CeizNpt4PDWs +I4206XUG/8ABWaYx/sQfElBJsFx4g+HULLu2+cF8daFP5eMjfgwCXaM48rfj5Mj0D/gmvCIP2IP gCgj8oN4f8RTbduzJuPHXimdpMYGfOMhl3fx794J3ZJX/d/QpwMP+gj6TeKxGmifsfDCNC77tXsm tEtHqLE/uv2d+WU9vrf0xcbitNE/YeDcMNeS+1JXaTWiV1ufTvhL9sr4h+I/DXj/AF3WP2CP2v8A wDqng3R9P1Pw74M8W+Kf2FLzxL8WL28vxZ3Hh7wBdeBf21/Gvg/TtY0m3/4muoT/ABT8V/DXQJLA GPS9c1LVMaaTwl+2V8Q/Efhrx/rusfsEftf+AdU8G6Pp+p+HfBni3xT+wpeeJfixe3l+LO48PeAL rwL+2v418H6drGk2/wDxNdQn+Kfiv4a6BJYAx6XrmpapjTT6PRX8rn8VHnHhL9sr4h+I/DXj/XdY /YI/a/8AAOqeDdH0/U/Dvgzxb4p/YUvPEvxYvby/FnceHvAF14F/bX8a+D9O1jSbf/ia6hP8U/Ff w10CSwBj0vXNS1TGmk8JftlfEPxH4a8f67rH7BH7X/gHVPBuj6fqfh3wZ4t8U/sKXniX4sXt5fiz uPD3gC68C/tr+NfB+naxpNv/AMTXUJ/in4r+GugSWAMel65qWqY00+j0UAeceEv2yviH4j8NeP8A XdY/YI/a/wDAOqeDdH0/U/Dvgzxb4p/YUvPEvxYvby/FnceHvAF14F/bX8a+D9O1jSbf/ia6hP8A FPxX8NdAksAY9L1zUtUxpp5W6/a2vPHfww+LeofGD/gnv+0t4V8N+D/DFvrLeAfjHr3/AAT+1mL4 sQSXhh1LQ/Db6F+2n45+HGnXOhWSNrWr3fxh8U/DXwwNNRhp2vajqS/2dXA/tPftmfBL9lLQTe/E HXhf+LLy1afw98OvD8lve+L9cJ3LDO1m0qR6No5kVhLresSWljiKaKyN/fJHYy/iko/bY/4KxeIm JYfCL9mmw1YcAX0fgu3a0mZRtH+hap8VfGFqgbcS1p4f0y9Qj/ilDdqs/wDQnhZ4CcRcW5d/xEDi bOsN4XeGGVVqdbF+IXEPtcMq86c7wocJ4CEqWO4gzWdSEoYWOBcKDxFOdGGKnjYQwlT+qPBb6MfF nHOUvxS4w4hwfgx4NZJXp4jHeKvFPtsJHE1KNS9PC8D5XCdDMuKM7qVacqeCjlsoYZ4ulPD08bPM IU8DW+S/2nfGX7Jn7RfirwzY/sZ/smfHX4O/EvXtbv7DxB4K17XvhxrWn32oR3U9vHZ+F/Bfwg8e fHXwrex3ixJf2WreD/ibpmg2tiJF/wCEcuFkF5a0pv2RP20/hJrWm/F74v8A7KfiDx7oHhbVbWW5 0XxlrujfE3R/EWlaTDGbWXX9M+EHxM1jxhYeGI7eONRFrc2hJBFALTVLAWYmspf6cP2Yv2NPgj+y noIsvh74fW+8V3lssPiD4ieIEt77xhrhYIZoRfCJI9H0hpI0aPQ9Gjs9PHlRTXaXt+Jb6b6tr+j8 x+nLW4PWT8H+HOS5jxbwVkWExGV5hxH4m53nOO454to14qnXxNDNMFjqFXhqnJR/2KFOOLnSpww0 /qmClS+qQ/rbNv2kdfgJZDwD4TcPZrx14d8N4HF5LmnFnjHxFxBmXiRxzh8TFUcTjMNnOX5lha3C FGcY/wDCfTpQxtShShhKn1LLpUXgofkt8IP+C7v7PumfDptJ8a/s/fEDwP4p8JaLbWWgfDr4Sj4d XnhrX5LOaz0238PeEtR8ceLPhN4Y8GzbJZLu3s/GepeHvCukadZXMF14wNxHax3v3/8ACj9vnV/i 78P/ABp8QtC/Yt/ah06x8O6LYat4Q0i58f8A7A3ie/8AjFeXd+LO68O/DnWfhn+29498DWOtaNbn +1NUk+KPjD4a6H9iBg07W9Q1Yf2ZXmvx5/Ye/Zo/aMW7uviD8ONNtvFF0sh/4TvwkE8L+M0ncYFz c6tp8Qh1ySLJ8mLxNZa3aRlmK22STX5O+K/+CY/7WH7NGt3njv8AYu+Nuq6xErec/hiTVovBfiy7 giy8Njf291O3w/8AG9vFt3umuf2NDJIY1h0eV1DD8mnw59GbxdnOvwrxZm3gRxjjJyqS4e8Qa9Xi LgLF4uq3KVPBcaQf9pZXRlObnWx3EF02nGjg9U3+H1eEvoe+O9SpieCuOM8+jRx9j5zqz4U8UsTX 4r8Mcdjq0nOVLLvEGm/7WyWhKpOU6+Y8U8ybThQwGqlL9z/CX7ZXxD8R+GvH+u6x+wR+1/4B1Twb o+n6n4d8GeLfFP7Cl54l+LF7eX4s7jw94AuvAv7a/jXwfp2saTb/APE11Cf4p+K/hroElgDHpeua lqmNNJ4S/bK+IfiPw14/13WP2CP2v/AOqeDdH0/U/Dvgzxb4p/YUvPEvxYvby/FnceHvAF14F/bX 8a+D9O1jSbf/AImuoT/FPxX8NdAksAY9L1zUtUxpp/EPwH/wVj+OXwS12H4e/to/AzXIdStdsc/i PRdFfwZ4ukgjbY+oy+FdYFr4Y8Sx3DHfFfeH9T8N6U8ex7WO5SRXr9c/gb+1z+zz+0Xbxn4VfEvQ tZ1gxGW48I6hJJoPjO0CKGnMnhjWUs9Vube3J2S6jpsF9pRf/U38qlWP5h4hfR78VvDXD/2pnnDd TMuGZw9vhuMuF60OI+FMVhZW9ni1m2Xe1jgqFXX2P9q0svq1UnKFJx1f4z4qfRX8bfCHCf21xHwj Uzfg6pTWIwfH/BmIp8WcEY3By/hY2OeZSq0Mvw9fX2H9tUMrr1knKFFxs36T4S/bK+IfiPw14/13 WP2CP2v/AADqng3R9P1Pw74M8W+Kf2FLzxL8WL28vxZ3Hh7wBdeBf21/Gvg/TtY0m3/4muoT/FPx X8NdAksAY9L1zUtUxppPCX7ZXxD8R+GvH+u6x+wR+1/4B1Twbo+n6n4d8GeLfFP7Cl54l+LF7eX4 s7jw94AuvAv7a/jXwfp2saTb/wDE11Cf4p+K/hroElgDHpeualqmNNPo9Ffih/O5/Ov+1T+z58V/ FnxB1/8AbF/Zg/ZM/ac/Y5+IHgG5svHPiPw78QNc/ZVv08W6u9xdPqni34SWX7NH7TX7QN7ba3YQ xveePPCvijSPD2ieI9OvprnQ31fUJta0W9/Rj9j3/grTpH7SXw48U+EvFHwL8eeNvj14G+HkGs69 4A8BXnwWsdO+N5uNUbQNS0z4Y2/xZ+L3w702PWY9OZfEHizSPHF94Y8G6Rpt2LSy8Zavdzw6ZX6I V+F/7fH7A/ifwn4nf9rv9kRNQ8NePPDWoN4s8YeD/Cam2vWvbYvcXnjXwVZ26FHvXQzP4o8LpDLb a5bS3dzbWk80+oafqP8AY3AnHfDPjnwzlfg74xZrSyjivKKSwfhH4uYx3r5XXdlheD+MMU2quLyD F1VCjgcdWqOrgKrgnUi406j/AL78NPEvg/6SPB+S+AXj7nVHIuN8ioxwHgV464+TeJyXEtxjguAu PcbKSrY3hbG1lToZbmVeo62V1nTTqRcaVWXyP4Y+JvxK/wCCav7Yknxys/2bfjv8Ef2dPilq+saa fg58Uta+Amt+L9a8DOmmajrmk6RdfBD46fGn4dLqPgnXNRFx8Phr/wAQNG167s7CGy1xdN0rVtT1 K7/oo+GP7dXij4n/AA88S/EWz/Yb/a08N2Wn+E9B8XeAdD17xd+wnqesfGu28QTRGDTPhtf+BP21 vGng+x1Gz02aPW7u4+Kfir4aaDLprCLTNb1HVf8AiWV+Wvw1+NXwz/4Kq/s3+JPgL8R20bwf+0Po WlrrWnK6GK1fxLo8MkWl/ETwhEWe4k0uZ55NO8Y6BCZr3TNP1S/t4zJaXWnX44X/AIJaftH+Jfhp 4y8TfsKfHIT6J4l8L63r0Xw3XVpTvs9VsZ7m78TeAVnZjFLa3JS58UeEp4j9mvIpdXit7qeO80O3 b7Lxl4E4m8RuB8yzbibK6uB8ffAnBYXJvE3ANc9bjnw8pRlHIvETA1Yq2ayy+jGUMzzCj7T2+DVf F4mpQhTy7Br9A+kB4acYeLPhvm2ecYZLXy36T30acuwXD/jHljXtMR4k+FVGM4cNeK2W1oJxzuWV YeEqecZrQdX6zgI4nHYuthqVHKcvX7O+Ev2yviH4j8NeP9d1j9gj9r/wDqng3R9P1Pw74M8W+Kf2 FLzxL8WL28vxZ3Hh7wBdeBf21/Gvg/TtY0m3/wCJrqE/xT8V/DXQJLAGPS9c1LVMaaTwl+2V8Q/E fhrx/rusfsEftf8AgHVPBuj6fqfh3wZ4t8U/sKXniX4sXt5fizuPD3gC68C/tr+NfB+naxpNv/xN dQn+Kfiv4a6BJYAx6XrmpapjTT6PRX8Dn+Yh5x4S/bK+IfiPw14/13WP2CP2v/AOqeDdH0/U/Dvg zxb4p/YUvPEvxYvby/FnceHvAF14F/bX8a+D9O1jSbf/AImuoT/FPxX8NdAksAY9L1zUtUxppPCX 7ZXxD8R+GvH+u6x+wR+1/wCAdU8G6Pp+p+HfBni3xT+wpeeJfixe3l+LO48PeALrwL+2v418H6dr Gk2//E11Cf4p+K/hroElgDHpeualqmNNPo9FAHnHhL9sr4h+I/DXj/XdY/YI/a/8A6p4N0fT9T8O +DPFvin9hS88S/Fi9vL8Wdx4e8AXXgX9tfxr4P07WNJt/wDia6hP8U/Ffw10CSwBj0vXNS1TGmnK sP25vFMXw++LHxD8d/sNftb/AAnsvhX4SPjCPRPHPib9h/Uda+IVnaSSya5YeCpvht+2b8QfDtjq HhvSbefX9Wk+I2v+ANKn0uF4dC1PWtaMekP65X5u/wDBVj4rj4ZfsfeM9MtrgQaz8VNV0f4aaYFZ vMNrqrzav4kJRCG8iXwxomr6fLIxESyahAjlmljjk+08OeEcRx9x7wfwXhudVOJuIsqyipUpq8sP hcXjKVPG4vZ2hg8G6+LqOztToydnax+heE3AmK8T/E3gLw9wftFV4w4ryTIalWkuaeFwWPx9GlmO PtZ+5l+XvE46q7PlpYecrO1j4S/4JR+KPE+sfGj9r/8Abc1r4RfEP4t+J57HWf8AhHfDHw8vfhpb a14l8Y/EnxtbeKvFnhjwxe/Fj4k/DLwna6/p+kx6fc2tx4l8T+H/AA9D4fl1G1l1611K40rStV/c jwl+2V8Q/Efhrx/rusfsEftf+AdU8G6Pp+p+HfBni3xT+wpeeJfixe3l+LO48PeALrwL+2v418H6 drGk2/8AxNdQn+Kfiv4a6BJYAx6XrmpapjTT8mf8EzPhMPhN+x58MIbm1FtrXxBgu/ilreY1jeaT xkYbjQZJACWMieDbXw1A3mHerQlWWPHlr99V+kfSc4ww/Gfjbxtisu5I5HkOOpcHcP0aLvhqGT8J UIZHR+qau2GxOIweKx9LWzWMbSSaS/XPpj8e4TxA+kV4i47KfZw4c4azKjwBwth6EubB4bIeBcNS 4bw6wOrtg8ZisBjMzopOzWPbVk0l5x4S/bK+IfiPw14/13WP2CP2v/AOqeDdH0/U/Dvgzxb4p/YU vPEvxYvby/FnceHvAF14F/bX8a+D9O1jSbf/AImuoT/FPxX8NdAksAY9L1zUtUxppPCX7ZXxD8R+ GvH+u6x+wR+1/wCAdU8G6Pp+p+HfBni3xT+wpeeJfixe3l+LO48PeALrwL+2v418H6drGk2//E11 Cf4p+K/hroElgDHpeualqmNNPo9FfgZ/MJ5x4S/bK+IfiPw14/13WP2CP2v/AADqng3R9P1Pw74M 8W+Kf2FLzxL8WL28vxZ3Hh7wBdeBf21/Gvg/TtY0m3/4muoT/FPxX8NdAksAY9L1zUtUxppPCX7Z XxD8R+GvH+u6x+wR+1/4B1Twbo+n6n4d8GeLfFP7Cl54l+LF7eX4s7jw94AuvAv7a/jXwfp2saTb /wDE11Cf4p+K/hroElgDHpeualqmNNPo9FAHnHhL9sr4h+I/DXj/AF3WP2CP2v8AwDqng3R9P1Pw 74M8W+Kf2FLzxL8WL28vxZ3Hh7wBdeBf21/Gvg/TtY0m3/4muoT/ABT8V/DXQJLAGPS9c1LVMaaT wl+2V8Q/Efhrx/rusfsEftf+AdU8G6Pp+p+HfBni3xT+wpeeJfixe3l+LO48PeALrwL+2v418H6d rGk2/wDxNdQn+Kfiv4a6BJYAx6XrmpapjTTz/wAddN/aH1TwbaW37M3jP4MeBfiCuv2U1/rPx1+G Xjj4r+DZvCy2WprqOn2nhrwB8W/gxrdvr82pPo89lq83iu6061srbU7WfQ7ue+tbzT/yf/ZM/ae/ 4KR/Gjwl+0R8Wfih8Vf2B/Cnw1/Zp+Pf7W/wK8ZWmifsw/tG2usawf2Ytc8V+EG8f22vy/tdeK49 E0XVdW0S18S6loMfgzxPqsGgx3+i2F1c6pPa6nCAfsB4S/bK+IfiPw14/wBd1j9gj9r/AMA6p4N0 fT9T8O+DPFvin9hS88S/Fi9vL8Wdx4e8AXXgX9tfxr4P07WNJt/+JrqE/wAU/Ffw10CSwBj0vXNS 1TGmk8JftlfEPxH4a8f67rH7BH7X/gHVPBuj6fqfh3wZ4t8U/sKXniX4sXt5fizuPD3gC68C/tr+ NfB+naxpNv8A8TXUJ/in4r+GugSWAMel65qWqY00/JN7/wAFDP2cfhN8F/2e/HPx6+M3hq78R/Gf 4G+F/jFb3fwe+F3xq8X6V4i8Ky+EvDet+Lfi7ofw78O+F/HvxO8AfBG1uNftb6PxR8TbWxsfCml6 jp+n+LvEUWrw3bHtfib/AMFA/wBj74Q614E8OeNvjTpS+IPil8OLD4t/C/Q/CXhrxz8SNX+Jnw91 PVdM0jT/ABD8O9O+HHhfxZd+OFvJ9Xs7630zwvDqusyeH1vvFI07/hGtK1TVrMA+gfCX7ZXxD8R+ GvH+u6x+wR+1/wCAdU8G6Pp+p+HfBni3xT+wpeeJfixe3l+LO48PeALrwL+2v418H6drGk2//E11 Cf4p+K/hroElgDHpeualqmNNJ4S/bK+IfiPw14/13WP2CP2v/AOqeDdH0/U/Dvgzxb4p/YUvPEvx Yvby/FnceHvAF14F/bX8a+D9O1jSbf8A4muoT/FPxX8NdAksAY9L1zUtUxpp9Hr82P27P2i/2n/2 c/iB+yVffDKx+Bdz8EPjD+1T+zZ+zt8TG8a6d481j4sed8aPid/wjOs3HgeLRta8O+DtBtdM8MpF NZ61rsniq5m1a7uIW8NQ29pDd3IB+kX7P/7TepfG3U/EPh/xX+zb+0P+zb4k0G3029t9H+Odj8Hd QtfEun6l/aAW68M+M/gB8Zfjt8OL64sW02caroV14zsPE2mRzWN1d6JHZ39pcTfUtfmt8Vvh3458 Z/tD/wDBPrxR4R0efUdD+En7Vfj/AMefFHUIL/T7JfD/AMP9W/YO/bT+F1nqV3DeXtpdatZ3XxQ+ I3wz0U6ZpMOpXq32qWGrzWCabpF/qWnfpTQAUUUUAFfHn/BQ/wAT/EPwV+wB+3L4y+EV9r2mfFjw l+x5+0z4n+GGpeFbaW98T6f8Q9B+CvjbVfBV94cs4Le7mu9etPElpps+j20Nrcyz6hHbxR28zuI2 +w6+Pf8Agod4m+Ingv8AYB/bl8Y/CG91/Tfix4T/AGPP2mfE3ww1HwrbS3viiw+Img/Bbxtqvgq9 8N2cFvdz3ev2viW10yfR7aG1uZZ9Rjt4o7eZ3EbAHRUV1n/CORf8/Un/AH7X/wCKo/4RyL/n6k/7 9r/8VQBydFdZ/wAI5F/z9Sf9+1/+Ko/4RyL/AJ+pP+/a/wDxVAHJ0V1n/CORf8/Un/ftf/iqP+Ec i/5+pP8Av2v/AMVQBydFdZ/wjkX/AD9Sf9+1/wDiqP8AhHIv+fqT/v2v/wAVQBydc94t8RQ+EfC/ iHxVcadqmrW3hvRtS1y603RLeK81i9tNKtJb26g0uzmntkvL97eCT7JZ+fE11OEt428yRQfTf+Ec i/5+pP8Av2v/AMVQfDcJBBuZCCMEGNSCD1BG7kGtsPOlTr0KmIovEUIVqc61BVHRdelGcZVKKqxU pUnUgpQVSMW4c3Mk2rG+FnQpYnD1MTQeKw1OvSniMMqsqDxFCFSMqtBV4RlKi61NSpqrGMpU3LnU W0kfy/8A/BRj4x/DL41/Hb9jX4hfDDxjo/izwndLYh9SsZmifTriH4haNNc2Gt2N2lvf6HqdpFJH Ldadq1tZ3kEUkUzwiGWKR/2z8Lftg/A3xboPxo8aab4mEfw6+Beqvovi34jzi2PgzUtSgtjcXlr4 T1O2uriXxHLbM1pBEbC1eHVptX0SPQZtVk1JI4v5ZP8AgoL+zy37NX7U/wARvAtla/ZvCOtXi+PP ABSMxW//AAiPi2W4vbawtlLOwh8PaomreFwzsXlOiGf7sqk/MOj+MvEKeHf+Fb3PiTX7H4daz4r0 nxJ4g0DSES7jutVsYJNMg1hNJlu9Pt9U1Sw027u49Otbq/tbd5ZArT27MJ4/9nMf9FHgXxb8IfB6 lkXF+b/2Bw5kbxHDuYV6GHnjp8OcV8Q4TibNPrdLC03Sr8QYXKY1clw8PY0cJTzCVbFYjBqUIYWl /wBB2Z/Qi8NfHXwH8BKPDXHWevhjhLhuWL4UzTE4fC1MylwnxtxTgOMM6+vUcFSdHFcU4LI4VuHc JTWHw+Bp5rOvjcXgFKFPBUP18aX4u/8ABXn9o3yEbV/An7MHwvvxIy/LnStJuJGVXkQPNYal8T/G VvA6RnN1YeFtLD4+1W9m/wDb/wDQD4UHwq+DP/CtPgB4Ui07wwLjwzrh8B+ErQEvLofgtdLOu3jy OzT3Fys2t2l1f3928t7ql9eXd7cTXFybuavNv2DvD3w7s/gF4a0L4ZfCH4v/AAe8I6TbQvGfjH4V 0bwv4p8Z6reRiTU/Fl1BZa5qV9qc2qskV0dWuLSw02S0lsrLREXTrKGzsv5uP21v2z/HHjT9sDxp 8Q/hJ441HRNE8B2PiH4R/DnXdCuRGz+FHtNS0HxJrem3AUiObxVfX+r6tYatbpDqNpZy6HJa3MV3 pNlcxfzTDgzP/pOcf5t4QcI4OPhz4T+DXD+a0uG8ilUp1sNh87qUquByfMuJcRgJY+GM4g4gzWdT H5jUc8VXwuWYXN8PRrTzGpjcZjf4/p+H3FH0xvFDPPAbgXLo+E/gh9H7hbO6PCPDdSrTr4TC8RVa NfLsgzfi/FZZPMoY/ininO6tXNM3qupjcTgsnweeYShXqZrVzDMMx/XH9u//AIKRw/CjULr4D/s5 rH42+OupzjQNR1fS7T+3bDwHqd9ILOLSdOsII7lPEfj8zyLFb6OkVzY6NeGOPVYb2/SbRVx/2E/+ CcVx4Q1WD9or9qdJPGXxs1q/HifR/DWv3R1uPwdqd1L9uHiHxPczSXEeu+PHuH+0RiWS5sfDk4E0 TXWtJDdaXyn/AASS+C37IESWXjq1+L/hT4pftPanp1zqUuhXdtqel6h8ObWVGTVLLwvo/iqy0vUd c1jy5nj17xlZ2lyhheW00aWDS5L691j9UP2qP2jvhH+yP8O5/HfxK1yWa+vPPtfB/grTDat4n8aa xFGrfYdJtZZVENlbGSKTWNauQun6RbSRtM0t5cWFje/LcdZrjPDerP6NHgFwxxRh8/z2pRyzjjjT HZLjso458RsfL2kJ5fk+GxVKhjMl4JptYjk9m6VHF4SNepUxDwLzDMM6+L8Ss7x/hJWq/Q++jDwd xlheJ+JKuHybxH8Qsy4ezLIvEnxZzKftadTKshweMo4bH8PeHdJrFKn7N0aGNwMMTVq4p5dLNM14 g9vor8ffg9/wVT+Cui/BNviN+0D47ku/ih428U+Kte0v4OfDfQptf1Twb4Utb8aB4a8OveSvY6JY vLZ6KNekm8S6/p+pX765JqKWqW1zbwRfP2uf8FQ/2rf2iNZu/CX7GX7OmqpHvNufEV3ol/8AETxD ZISDHqF4LO3sfA/hEESQiRfED6/YRllBvSZo9v5lgPok+NmNzTOMHiOHsLkOUZDjMRgc14x4ozGh w5wlRqYOr9XxeIw2aZosPWzXAUcTGpRjjsoweOw1f2cqtCdSi4zf47ln0GfpEZhnOfYDFcLYHhnI eGMwxWW53x9xnm2G4T4Fw9XAVfq2NxWDznOlha+d5ZQxcauHjmeRYDM8HiPYyrYapVoOFSX37/wU v+C9l8WP2ZPE2txi2i8S/Cd2+IGhXVxJFAZLKxhaDxPpAnldBjUdDknuba1TfJfaxpekW0SNI6Cv zP8A2Mv+Cnfw2/Z4+AN/8N/ifaeLfFOs+Etfu2+H2n+FrK0ujeeHtd83U7jTr3U9SvrCxsINH15t Qmad7i5uDZ6za29jp88enyKvfaL/AMEuf25P2n76z8R/th/tAzeGdLaZbxfC02sTeP8AWtOkYAyR 2HhjRbzS/ht4aMqOyCfRtUu/KcuZdNcDa/xv4x+BPgn9hD9uLw94X+ImgWXxL+FWja7oGtpJ450P Tddt/EXw28U2z2NzrM+iTWjaXe6t4XuJNVEKpZRQ3HiHwyTGiWsoU9mI4D+jB4XYinmHH/ifnvi1 n1PloVuF/CLA0sJw1Gtf3YZhxrnMoU8wwEnFudfJI4fFwUIctJ6RqfA8Y+GH0Gfo3cWZb4o+L3jT xv418T1YYbhPMuCfo95RgsJwJOviZ1HQxHFHiNxLUorMsmowoxnUxnCywuYU/qODjChVdqOI+nr3 /goV+3z+1Ze3OhfsnfA+bwfoM85tV8Tabo3/AAlmoWRZzCU1Tx94tttN+HOitIrbvLm0e2u7ZhI0 GoSCEyru+Ef+CTf7QHxr1a38Z/th/tCatPeS4mfQ9K1fUPH/AIogilKmWwPiHxBInhzw60QG2ODR NP8AEemIojSHaihR/Q9ovhfQotI01PD0tlDoRsraTSI9It7SHSxp0sSy2jafHZ7bVbOSF0kg+zqI WjZWT5SDWn/wjkX/AD9Sf9+1/wDiq7MR9KbGcM0KuXeB3hzwV4O4GcJUf7YwOBp8Ucc4ig48jhjO LM/oVqlWM4XaSwKrUZznKliVJqZ+t4r6aeO4PwtbKvo3+E3h14CZZVpSoR4gyzLaXGniRisLKPJy Y7jnifD4mrXhUp3lFRy1V8PUqVJ0MZzNVD4B+C3/AAT5/ZP+Bn2K88M/C3S/EfiSy2uni/4hFfGf iA3CcLeWy6pEdD0a7UfKJvD2i6OQCxxuZy32iqqqqqqFVQFVVACqoGAqgYAAAAAAwBwK63/hHIv+ fqT/AL9r/wDFUf8ACORf8/Un/ftf/iq/nPibi/irjPMJZtxbxHnXEuZS5l9czvMsXmVeEZO/sqMs VVq+wop2UKFFU6NOKUYQjGKS/k/jDjvjXxBzWeecc8WcRcXZtPnX1/iLN8dm+IpwnLmdHDzxtet9 Ww8XZU8Nh1Sw9KKjClShCMYrk6K6z/hHIv8An6k/79r/APFUf8I5F/z9Sf8Aftf/AIqvnT5M5Oiu s/4RyL/n6k/79r/8VR/wjkX/AD9Sf9+1/wDiqAOTrwn9oT9nH4VftN+BLnwF8U9BXUbRTNcaFrtm yWviTwnq0kJiTWPDuqGORrS5T5DPazx3OmalHGlvqlje2w8qvqL/AIRyL/n6k/79r/8AFUf8I5F/ z9Sf9+1/+Kr08mzrNuHc1wGeZDmWMyjOMrxNPF5fmWX4iphcZg8TSd4VaFelKM4Ss3GST5ZwlKnN ShKUX7PD3EOe8J53lnEnDOb5hkOf5Ni6WOyrN8qxVXBZhgMXRd4V8NiaEoVKckm4ySly1Kcp06kZ U5yi/wCXqw1z9qP/AIJGfEj+xdbt7n4rfsweLdak+wyI1xDoV/5jmVrrR5nNyPAPxFiskZ7/AEa5 87R/EKQTsh1aGztdZ0r9+/gj8dPhn+0N4C034i/CzxFb69oN8BDd252waz4f1RY0e60PxHpZd59K 1e03qZLeXdFcQPDf6fcXmm3VpeT+weNvhJ4M+JHhXW/BHjvSLDxT4T8RWUmn6zoerWiXFne20mCM jessFxBIqXFne2skN7Y3cUN5ZXEF1BFMn8tP7QXh6f8A4JlfH2LxV+yf+0R4U8W+HtfuZrTxF8Lf +Eo0vxD4i8PRWzNM3hf4k+HbC6mh1HS9ksx8O+IJV0/xHprvKjRWV0IdW1j+0spocOfTDo1MBicD huDvpE4HAyrR4iwOXV6fB3ibh8JR1fE1PL8PVp8OcSezpvlzX2UcHi5p0l7SNTB5fl3+hWR4bhP6 fFCrlmLy3B8A/Sty3Lp4iPFeW5ViKXAPjHhMDh/efGFLLMLWpcJ8XKlRtHO1RjgMfOLoJVY1cBle U/05+FPFfh/xv4d0rxX4W1O21nQNatzc6dqNqxaKZElkt5kIYB4p7a5hntbq3lVJra6gmt5kSWJ1 HQnODjBOOATgE9snBwPfBx6GvwG/4Ip/tJvqeo+K/wBlzxprczG4j1Hx78K3vJfMP2hZHuvHPhi2 MrbibgSjxdZWsQCh4vFl5IS8wz/RL/wjkX/P1J/37X/4qv508b/CrMvBnxJz/gXHzqYrDYKpTxuR 5lUh7NZtkGPTq5bjrJKPtVBVMHjVT/d08xwmMo02401J/wAnfSN8Es3+j74ucT+G2aVKuMwmX1aW YcOZvUp+zWecMZlGVfKcxSSjD2ygqmAzGNJeypZrgcfQpOUKUZP+cb/gqf8AtMfDH44/s1eF/D/g 7WXtvGHhD9oaDS/iB8PdajjsPGHgzXPDnhL4jaLfWesaaZHMtrHqE09va6tpkl9o166SJHe/aoJb eH9Rv2TPi/8ADG/+G/wR+B/hrxTp/iPx74N/Z7+GN54s0bw+76tb+D7bS/CPhvRnt/FGrWytpmka xNqLi2t/D93dr4hm2XF22lrZWt3dQ/gn/wAFh/gUvwk/auuPGGmWxj8OfGrw5ZeNoJUiEVsnimwc 6B4vs0wSXuZJ7LTfEd6/IabxMCDksqftb/wSq/ZUT4JfsyaJ4r8QWsth8QfjWLTx74jWe3VLyw8P yxSr4E0OQswkVLfQrk69NBNHHcWmqeJNStJ1zboF/r7xj4U8Mcm+iD4XZrlWdZxPD5pnGPz7hHIZ VcHPES4h4noUZZ5gszxqoudbLODfqObYR1aWGhXxeKWW4TEYulKrOtiP7y8feB/Bzh/6BvgxnmSc Q59Uwuc59mfE3AvDMq+Aq4qfFfGWFw8uJMuzjMVQdTEZNwB/Zud4F1qGDp4rHY1ZRgsXjaEq1Svi vl7/AIKb/tF/Cz4gfsz/ABn+FGma7/ZnxR+H/wAS/B+j+JfAGuRrp/iOO3svEttLbeI9MtjJJFrP hbV9OksdV0/WdMmuEhs9V02HV4tK1O5/s9PeP+Cffxz+Gdl8B/2ZvgRb+Ioda+Kmp/DrUtevfCug L/a1z4V8PW+oazqh1vxlcWzGz8NWk6XOm2tlbalPHqt/d6xpYs9Ontrh7mL4H/4Lg/s7Dwr42+G/ 7Q+iWztp3jmyf4f+NbiOAJDF4p8O2zXvhe8upVB8y71vw1/aGnx7m+W18HRqAOp+mf8Agij+zMvh z4QeKv2hfENo9rrvxU1Kbw34PlmgUyxfD/wtdmG9vLaRnEkcXiLxdDexXMDxhZYfCmk3kTvFcKaO JOFPDDDfQdyDiDD51nDw2N4wqcR5Xkcq2D+tf8RFx+Sz4TzDIZ4uVFTlkmUYjAZtxHShPDxzHF5R hsPh5YvnqfXK5xdwR4N4P9nBwxxThOIc+eDzDj6rxbk3DcsRgHjf+IsZnw9PgfNeGamOlh1Ulw7k WJyzPeLKEJ4WGa47IcHhcHPG+0q/2hif2OqjqOp6dpEEd1ql9aadbTX2maZFcXtxFbQyajrWpWmj 6PYpJMyI13qmrX9lpthbqTLd313b2sCvNNGjd1/wjkX/AD9Sf9+1/wDiq/ms/wCCi/7e9iP2m/hh 8OPAWoXOt/DP9nP4s+C/HPxBk0e4jibxv4+8EeJrDVr3QraeTNtNY+EksrjS7dps2c/iefULiaOe HS9Luq/kTwW8HeJfGvi6XDPD1KcaWCy7GZxnGYuHNRwOBwlKTpUuaUoU/rmZ4x0Mty+lOaUsRiPb 1EsLhsVUp/wl9HrwC4v+kRx3Lg7hWjUhQy7Kcwz7P81dJSw+W5dgaMnRouc5U6Tx+cY94bKcrozq JSxWK+s1UsFhMZVo/wBC+ratpWg6Zf61rmp6fo2j6XazX2p6tqt5b6fpunWVshkuLy+vruSG1tLW CNWkmnnljijQFndVBNfiB+0x/wAFUtd8VeI/+FIfsPeHdQ8eeNNauJtFj+IkGhXOrtJeFXEq/Drw w8DvqsluqvK/ibX7T+x7eGC4uLfSL+xMOsR+GaR4b/bg/wCCtviD7ffXH/Cmv2XrPViYy32+Pwd/ oNzs2afZg2ep/FfxfaDeHv7k2XhrTL2G4jS48MzTpY3H7m/szfsPfBH9lTw0NH+G+ktN4hvbaOHx J4/1yG1vfGPiWRW8xlu9RWOJLDTEkwbbRNJistLhCJNJBcXxnvp/2uPBfhL9HSMcZ4pyy7xX8XaK jPC+FeUYyNbg7hLF8qnTnx9nNFVKeaY3DSadTh/BxqUHODo4mlisHiqOY0v6Ih4e+Bn0T4RzDxpn lPjf47UIwqYHwUyHMIYjgDgbHcqqUqnifxBQjUpZzmOEny+24WwEa2HlUhLD4yjjMBjMPm1D8sP2 Y/8AglNfat4i/wCF1/treILr4h+O9YvTrtz8PJtXm1mzfUZdsq3HxB8Ti4kl8SXcbYEmgaVMuhx+ RHBc6nrenyS6en7a6VpWl6Hptjo2iabYaPpGmWsNlpul6XZ29hp2n2dugjgtLKytI4ra1toI1VIo IIo4o0AVFAAFd3/wjkX/AD9Sf9+1/wDiqP8AhHIv+fqT/v2v/wAVX4H4m+LvHXi1m1LM+Mc3dfD4 KHsMmyHAU1gOHOH8HGKhTweS5PRl9WwlKnSjTouvJVcbXp0qSxeKxDpxkv5g8YfHbxK8c87o5xx9 nrxWGy+H1fh/hnLKSyzhPhfARjGnSy/h7IcPL6pgaNKhClh3iJqvmGJpUaKxuNxUqUJLk6K6z/hH Iv8An6k/79r/APFUf8I5F/z9Sf8Aftf/AIqvzM/Hzk6K6z/hHIv+fqT/AL9r/wDFUf8ACORf8/Un /ftf/iqAPHfHvw2+H/xS0Kbwz8R/BfhnxxoE24tpfifRrDWbWKVl2i5tVvYZWsryMYMN7aNBdwOq yQzRuqsPyN+OP/BGf4Ya/PP4l/Z58b618JfEsMxv9P8AD2t3F74j8HpeRyCa1j07VRKPF/hzypRv F8174naApGLewj25r91P+Eci/wCfqT/v2v8A8VR/wjkX/P1J/wB+1/8Aiq/TvD3xk8TfCzEe24G4 vzXJsPOp7TEZT7WONyLGt/H9cyPHwxOV15Ti5QdaWFWJhGUvZVqcnzL9i8K/H/xh8FcX9Y8N+PM7 4fws6vtcXkftoZjw1mDk7VP7Q4bzOGLyXFTqQ5qbxE8F9bpwnP2GIpSfMv5nf+F2/wDBT79gtktv i74cufjZ8J9MkEJ8Qa091440dLCNgGntviTpATxb4ekmUeTZL8QoJYokjIt9EKDJ++fgJ/wVj/Zg +L/2LSvGWp3nwR8W3Aijew8eSwt4UmuX++un+O7NV0mO2jyAbnxPbeFWdsiOB8An9aG8NQMrK1w7 KwKsrRIVZSMFWBJBBBIIIwRwa+BPj3/wSx/ZR+PH2/VJ/Cj/AA48ZXgkk/4S/wCGqWvh2aW7cFvP 1Tw8sM3hbVjNNtkvbibR4tWuh5gXVreSQzD9qXir4DeKf7nxg8MJcCcR19J+Ifg6qeX0atedl9Zz rgnGyq5bXU5r22YYzBzxWY4lyqLDUaDaP6IXjb9GXxp/cePXg1Lwz4sxOk/FXwCjRyqhWxM2v9r4 i8OsxlXyjExnUX1jNMwwFTGZri5SqxwlDDOSt9h6bqWnaxYWmq6Rf2Wq6ZfwR3VhqWm3UF9YXttK u6K4tLy1klt7mCVSGjmhkeN1OVYirtfz4a1+wT/wUW/Ymu59f/ZR+Kt98VPAtvcS3k/hXQporO8k iD75ZdX+Eviy71Pw1qtxMrmBbjwvf6xr8hM0sFvY/K49E+Dv/BYoaDrh8AfthfCDxF8OPE+nXC2O r+IvCej6nb/2bPgYPiL4c+JpY/EmkeWu2S6l07VNYuJTJm10OGMKh8/NPotZ1nWAxPEHglxjwz41 8PUKcsRVwvD2IWV8b5dh7+6824LzSpTzGhUfNCFOjhquKxdeTcoYOEXG/l519C7iDiHLMXxT9HTj /g/6RHC2GpyxVbB8KYqOTeI2U4S/uvPPD3OatLNcNWalCFKhg62Mx2Jm3KngIQcbxft8fsD+J/Cf idv2u/2RE1Dw1488Nag3izxf4P8ACam3vWvbcvcXnjXwVZ26FHvXQzP4o8LpDLa63ay3dzbWk002 oafqPwN8ZfifY/tc+C9F/ai8CiLwP+1x8CbbRrz4xaD4eBspvF/hXw7PajQvjZ4MRMzy3Xg69S1t vFNgDd3uhaPJbXF1LHoGg2N1efpR4X/4KffDTwn+1z4x8D678Q7Pxn+zD8TJPCXiD4a/Ey2Fz9o+ GWra14Y0WDXNG8TWd/DbarY+GJPFVvq8l3aalaW2peEJLlLt7c6HcOLD8/f+Ckcv7PfgT476d8S/ 2atY8deCvipd6jPqfjTQL74b+IvBnhHU21C1m3+M/DMnivTtIN9Z+JYp7iy17T4NE1Dwj4y0/UZt RhuZLa81BNa/s3wPXijSzvgPgnxP4WzupxLl/CdHOfDXxLllOYYnD1+EcywGHq574WeJrqYV11ls FUeUYmnmlGeP4czzD4PFxoYilTy7F4n/AEE+jjHxnw/EXhl4deMvBfEVbi/K+BsPn/hD4wTyPNcZ hsRwLm+WYStxL4K+Mbq4OWKjk1NVpZFi6OdUKmZcJcSYXL8dDD4qjSyrHYz9hPgx/wAFDPh/4w/Y 41v9o/xhJBbeIvhnp9tofxK8LWUkVvcy+PJWtNP0eLSoG3vDpfje9vLK70mcRzw2EdzqNo73Mug6 gV/RqGaG5hiuLeWOeCeKOaCaJ1kimhlQPFLG6kq8ciMro6kqykEEgiv4CI9a1WHT9T0e21C7tNH1 m7sL/VNItrmeLTL670r7cNKnurNZPJuJNMXU9QSwknWSS1W9uhEy+fLu/uQ/Y016H4p/sqfADxw1 +Z7rVvhd4VtNUljRCj67oGnx+HNfxggKRrek36smP3bAx5O3J/nb6Xv0Zsh8FsBlvFnDFevPLOJ+ OM/oRwU4tUMjy7G5VlmYZJkdJuc/a/UcXguJ3RxUmqlfAVcDRrKVbB1K1b+Ufp4/Q94Y+jzlmUcc cHYnE1Mn4y8SOKMNDLqkZRw3DmU5hkmTZpw7w3QbnU9sstx2X8ZOhjJONbE5XXy3D14zr5fVxGI9 sorrP+Eci/5+pP8Av2v/AMVR/wAI5F/z9Sf9+1/+Kr+Ez/NM8D+NXxJX4O/Cnx18U5dGuPEFp4C0 G48UalpFpOlveXmj6U8VzrQs5ZQYReQ6St5cWizlIJLmGKKeWGF3lT8C/wDgoF8WvDP7bPx5/ZE+ C3wg8Rx+IPB3ie10rV5NW07dG1rqHxL8Q22k6gmp2s43Wup+DvD3hqW8vrO5gFxpkt9qFrOhmWWJ P6CP2kPAMfiX9nn47+Hllkmk1v4OfE3S4YhGuXnvvBetW8AU5JDiaRCjAZVwrDkCv4v/ANk/4CfF b9o340eGvh78JbnUtF1iZprnW/GllJf21r4G8KsjWeu+INSvtPkgnhthZXc1hBZLc2763e3sGixS B9QyP9DfoTcFcHV8n428XMzzilw7xL4WrO3g87zCXtclwGE4j4TxeCwuZ5lg3JTqPJ69DMa+GWFl SrYr63Xw8lXqrBPDf6r/ALOvw84BxOQ+IvjrnOfUOE+LvBaPEUsv4izWXt+HctwPFvA+Oy7BZvm+ AlKM6kuH8Rhs1xOEWClSr4z6/iMLJYissA8L/bJokWiafYw6BoTWEVn4btrLRY9NsZoXXSILOygS x0+WCJ2a0MViLcwwyhH+zmJwpRlJ2K5P4Jfs6+BPgF8N/D3wx8BJPbaLocDPc310Em1bxBrV1tk1 fxHrt3kNeaxrF0GubuYhYol8qzs4rextbW2h9Y/4RyL/AJ+pP+/a/wDxVfwJnMcvhm2YxyrH4zNM ujjMRHB5nmGEjgMbmNBVJKGOxOBjiscsHWxa/fzwv13FyoOp7KWJryg6sv8AL/P4ZXDO81hkuZY/ Ocphj8VHL84zTAxyzMc1w0aslTzHGZdDG5lHAV8al9Zng/7Rx0sM6vsZ4zEzhKtPk6K6z/hHIv8A n6k/79r/APFUf8I5F/z9Sf8Aftf/AIqvNPIOTorrP+Eci/5+pP8Av2v/AMVR/wAI5F/z9Sf9+1/+ KoA5OvyO/Zr/AGYfjl4A/ZL/AOCj3wy8XeCP7J8b/Hr9qX/gpN8R/hPon/CS+EL/AP4SvwZ8ffHP jrWPhLrP9paZr97pGhf8JZp2s6bc/wBneJL/AEfVdC+0+T4msdGnhnii/Z3/AIRyL/n6k/79r/8A FUf8I5F/z9Sf9+1/+KoA/lh1L/gnv+0j8PvEP7F3xb1/4S/tHfFPw5pX/BLT9nP9hz4//B/9lL9p 7wh8EvjP8MfiL8JIn1i9vG1TWPjP8KPhf8Wfhdr1z4t8SeF/FOi2fxIuHsdc8P6T4o0j+2tDvLmW 3+8P2bv2P/E/wt/bE/ZY+Ifhv4Ha78Mf2fvgz/wS41r9mbw/pnjnx54E8deMfhd45k+Nfwp1/wAO /DDVNS0bxl4r1PXNWsfh/wCGtXivvF3h2617wfJHYSaaviu5murOG7/a7/hHIv8An6k/79r/APFU f8I5F/z9Sf8Aftf/AIqgD4I139iPwPr/AI71X4gXHxv/AGy9P1DV/FV34tm8P6F+2P8AtEaH4Es7 y81V9WfSNK8C6Z4+tvC+l+FYZnNpaeFrHTYdDtNLVNLgsksUWEfMX/BUPQP2jfiFP+yn4Y+BX7Jv xZ+PVl8KP2uv2Zf2ofGXizwV49/Zk8IaBZeGfgv8RrjXvE3gi1tvjT8ffhZ4nv8Ax5qGlW0V3oa2 vh6TwdP9utoL/wAX6dcpeQ2v7Kf8I5F/z9Sf9+1/+Ko/4RyL/n6k/wC/a/8AxVAHxX4q8K/E34rf Fr/gmp8Q9M+HniTwpD8P/wBpHxL8WfjN4T8Q634JfxB8LfDHiT/gn1+2j8NF03xVN4W8XeI/C3iL U9G+KvxU8AeDNSi+H3iPxvpcmr6iutaRqOp+GNPufENv+pFfnr8Z/hH458UfHz/gn14s8G6Zdav4 f+EH7Wfjr4g/FS8jvtNsYvDngLVf2Cv22vhNp+tXVveX9rc6vBN8T/if8OPDy6dpFvqeoR3WvW2q y2Mek6Zqepaf+hVABRRRQAV8ff8ABQzxR8RfBH7Af7cfjT4P32v6X8W/CH7H37THij4W6n4Utpb3 xTp3xF0D4L+NdW8E33hqzgt7ue71+08TWmmXGj20Nrcyz6jHbRR28zuI2+wa+Pv+Chnij4i+CP2A /wBuPxp8H77X9L+LfhD9j79pjxR8LdT8KW0t74p074i6B8F/GureCb7w1ZwW93Pd6/aeJrTTLjR7 aG1uZZ9Rjtoo7eZ3EbAHuNFFFABRRRQB5H8f/jP4X/Zx+A/xs/aG8cWGv6r4L+A3wj+JHxn8X6X4 UtdOvvFGpeF/hd4N1nxx4gsPDdlq+qaHpN5r95pOh3dvo9rqmt6Pp1xqMlvFe6pp9s8t3D89f8NT /tL/APSKL9vX/wAOV/wS3/8ApktZf/BVT/lF/wD8FIP+zCv2wf8A1nr4iV+otAH5nf8ADU/7S/8A 0ii/b1/8OV/wS3/+mS0f8NT/ALS//SKL9vX/AMOV/wAEt/8A6ZLX6Y0UAfmd/wANT/tL/wDSKL9v X/w5X/BLf/6ZLR/w1P8AtL/9Iov29f8Aw5X/AAS3/wDpktffEHxK8CXXxK1X4PW/ibTpfibofgbQ PiVq3g5TN/a1j4E8U6/4l8L+HvE0ymEW/wDZ2q+IPB3ibS7YrO0xudGuxJCiCN5O5oA/mj/4KA/C X9pX9tnVfg3eWP8AwTN/bd8AXHga/wDEVn4r8T3Hjr/gmHq+t3XhDV7W1urbS9G0aD/gpJaWWp3k OuWEbRPqmu6Rb6VbajqV5CmpzSGwk9J/Zv8AgtafsyLpmp+D/wDgjP8At3eJ/HenKH/4WR49+JX/ AASw8R+KxdkJuu9KEv8AwUeh0bw1IpUpC/hzStMuUgd4p7q5aSaWX9xdJ+Nnwb174oeIfgjoXxY+ G2tfGbwhoUPijxb8JtI8ceGtT+JPhXw3cS6bBa694l8EWWpz+JdA0e7m1jS47PUdW020tLt9QtRb Sy+cmfTq/T6njP4nS4Eyrwzo8YZvgeCcop46nQyPLsQ8BSxUMxx2Kx+Kp5niMN7PGZlhpVsZUVPA 4vEVcvowjD2WFhU56k/2Wr9ILxjl4aZJ4P4fj3Pct8OsipZlSw/DmU4qWWUMbTzbMcbmeNo5xisH 7LH5thJYjHVY0stx2KrZXh6cafsMFTq+0q1Pxn/aG+PH7cHxA+DHxA8C/Cb/AIJhftseE/G/jHQp vDFh4o8QfFH/AIJmQWvh7Ttcli07xBq9l/Y//BRXUL2bXLPQbjUpNBiH2GIasLSWXUrNYt5/Mf4I /wDBPCXwILPUvi7/AMEw/wDgpD8a9chaOSawk+KH/BLvwN4JaRDvCro2g/8ABTGbxFOFfAf7X4uk tblECy2Co8sbf1O6P8R/h54i8Z+NPhx4f8eeDNd+IXw3tvC978Q/Aej+KND1Pxn4Cs/G9pf3/gu7 8aeF7K+n1zwtbeL7HStUvfC8+uWNjFr9ppt/c6U93DZ3Dx3vFvjPwf4A0STxN478V+GvBXhuHUdB 0eXxB4t13S/DeiRav4p17TPCvhjS5NW1m6srBNR8R+J9a0fw5oNi1wLnV9e1bTNH0+K41C/tbeU4 S8ZPEfgLhvM+FeCeJsXwrl2dY/8AtDN8TkcKGBzrMK0MPDC4enUz2nT/ALWw+GwlKNT6thsDi8LS hUxOKqzjUqVnJLgbx/8AFrwx4Rzngrw74wx3BOU8RZl/aufYzhynh8t4hzTEU8JTwWFpVeJaNL+3 MLg8DRjWeEwmXY7BUIVcZjK1SNSrXc1+UPhr4pfHD4U+C9R8N/AP/gjJ+1D4EvU02YaDplx4+/4J g+C/B11q8UDixl8Vap4L/b68UeIXgeY7rzUIPD+uapOzuzgyTSXKfz//ALWX7Nf/AAU58f8Aif8A 4Xz+1V8BfE/hmHxZ8Q/hH8JdL1LUfif+z3q3h7wxr3xu+LPg/wCDHwl8FaH4f8DfGnxnqmk6BqHx L+JHhfw8LmCwurXTpNWu/E/irUktU1rXx/cHX57f8FOv+TaPAn/Z+v8AwSl/9ekfsc19P4T/AEhO M/B7Ns44hyDKuFc84jzxqOO4i4vwGZ53nf1Z8rqYOhmEc5wdXD4evUiq2KdO1fF1I01ia9Wnh8NC j9l4HfSn8QfATPM+4q4XyXgriPi3iN8mZcWcd5XnHEXEX1V8kquBw2aQz/L6+Fw2KqwjXxrpWxOO qxpLGYivSw2Ep0PxT/Ye/wCCdXxD+GfxREP7XP7FUfxA8J6pLbR6H44i+JHgfxLp3gm+DBZJ/EXw +0n4hzWvinw/c74xcPNol9qOlmKaeHTNWhlK2X9Jnh/w54e8J6TZ6B4W0LRvDWhadGIbDRdA0yy0 fSbGEdIrTTtOgt7O2jHZIYUX2rZoryfGHxs4w8bM8o59xUsNgqtLD0qP9l5PjuI3w/GpRi6ccXhM nzzPc7w+V4mpStDErK5YPC4icXiJ4ZYqriK1fw/Hv6RPHv0ieJKHE/GqwmX16OFoYdZLkOY8WPhe FXDwdKOOwGQ8R8S8R4XJsXWo2hi45NLAYLEzi8VPBrGV8XiMQV+Ov/BYz4Ar47+CmhfG3RLAS+JP hBqS2uvSwRKbi68AeJrmCzujMUUzXC6D4hOlXtuhzFY2OpeILw7FaZj+xVYPinwzovjTwz4i8H+I 7OPUfD/irQ9V8O65YS/6u90nWrGfTtRtWODgT2lzLHuAyu7cOQK/GMTRWIoVKMtOeLSfaS1jL5SS fnsfy9xnw1h+L+GM54dxHLFZlg506FWausPjabVbA4myTdqGLp0aslGzlCMoXtJn52/8ErP2gV+M /wCzNpPhPV78XXjP4KS2vgPV45GzczeGFgkk8Bamwy37htFt5vDySO3mz3Xhi9nkUeYrP+mFfy0f seeJtb/YY/4KAa38FvGd/JF4Z8ReI7j4R+ILqYeVa31vq91DefDLxgYiVjgW7ubnQ7k3MpUafovi LVvM2/vAP6l658urSq4ZQndVaDdGonveGkW+t+Wybe8lI+N8GuJMRnvB9HLsz5qefcKYmrw1nFGq /wB/Grl37rDVaibcnKeGjClVqSb9pi8Pimm7OxRRRXefrIUUUUAFFFFABXwvq37Z/ja7+K/xy+Fn wg/YW/a4/aGT9nv4geHPhb8QfiD8MPEn7EXhjwMPHfiP4LfCb49xaFocHx8/bM+Cnj/Uv7N8AfGv wHJqWpv4EtNH/ti81DTdN1DUjptxPX3RXx5+w7/yXj/gqz/2f/8AD/8A9dc/8E2KAMH/AIan/aX/ AOkUX7ev/hyv+CW//wBMlr5O+MPgHR/jsby5+In/AAQ1/bCu9avfMafxT4f8ef8ABLrwd4rlnchl ubnxD4U/4KVaPqepTRuoZF1We/gPzxyQyRSSxv8AvFRXt5DxLxFwrj4Zpwzn2c8O5lTtyY/JMzxu VYyKT5lH6zga1Cry31cXNxfVM+i4Z4v4r4KzKnnPB3E2f8K5vS5fZ5nw5nGYZLj4qMuZRWLy7EYa u4cyu4Obg+qabP4/dU/YM/aV+GPxC8NfFz9lL9hv/goh4L8X+Ctfs/Evh3RPiV42/wCCWevaY17Z 3AlOnT+J/DP/AAUk0bUINEu4DNpuoWd14c12S/0u5uLK8mnSaVpP3JtP2qP2o2tLU6h/wSe/bqhv zbwG+isPil/wS+vLGK8Mam5jsru5/wCCjOnXN1aJNvW3ubjT7GeeEJLLZ20jNAn6AfEb4leBPhH4 Vm8b/EjxNp3hDwnb634R8OTa5qpmWyj1zx54u0LwF4P01jbwzy/aNf8AGHibQdAsQIyhvtTthK8U ReVO5r63j7xa488UaWRx49zmPEWL4doYnB5Zm2KwOAoZwsDip0qs8FjcwweGw1fM6FOvSdfDyzF4 rEUKtfEulXjHEVYy+58T/HLxM8Z6HDcfE3iCPFmO4Uw2MwGT55jctyzD59HLcbOjWqZdmGa5fhMJ ic4w1LEUZYnCyzV4zFYaticZKjiIxxVeM/wH/a60P4y/tbN8E4/Fv/BKX9uyG0+FnxSsfF+qpN8R P+CXUsmv+C5LGdfE/gmMp/wUjJii8UX1j4aW9maSHybPT55I3a4EMb/Ysf7Uf7SkSJFF/wAEn/28 4440WOOOP4kf8EtkSNEAVERF/wCCkoVUVQFVVACgAAACvuX4rfGz4N/Anw/aeLPjd8WPht8H/C9/ q1roGn+Ifif448NeA9G1HXr9ZXsNC07UvFGp6XaX+t36wTGx0izlm1G98qQW1tKUYD06vlcw4nz3 Ncj4e4bx+Y18RknCqzX+wMunJfV8ued4xY/NZUIpXUsbiowqVm27unBK1tfi814y4lzrhvhXhHM8 2xOL4c4KWd/6sZVUkvquUy4ix8czzqeHgldTzDGQpVa8m3f2VNKyjr+Gn7YGuftDftU/ADxv8HLv /glb+3TpWp61FYal4V16++In/BLyaDQPFWiXsOoaTqMgt/8AgpG9wlvN5c+lai8Ecs39lalfpFDK 7iNva/h98bvjv8MvAvhD4d+FP+CS/wC3pY+GvBHhvR/C+iW3/CyP+CWYdNO0SwgsLZ52i/4KRRJL dTRwCe7nCK1xdSTTuN8jE/pevxE+H7/ECb4Tp458HP8AFO38HW3xEuPhovibRW+IEHw/vdau/DVn 45m8Gi9PiKLwdd+IrC+0C28TPpq6LPrVnd6VFevfW80CaHhbxf4T8daLF4k8E+J/DvjHw7Pfazpk OveFta03xDos2peHNa1Dw34h06LVNJubuxkvtB8RaTqug6zaJObjS9a0zUNLvo4L6yuYIytxPntf hnA8H1cxrz4cy3Osx4gwmVuX7ilm+aYPL8BjMXb4pSlhcsw1OnGTcKLliZ0oxnisRKoV+MuJcTwf lvANbNcTPhLKeIc14pwGTOS+rUc9zrAZVlmPx23NKc8Fk+DpUoSk6eHcsXUoxhPG4mVX8iP2gv2i /wBvvxR8JPF/hr4Df8Ev/wBsnwr8SvEFj/Y2k+K/GHxX/wCCaNlYeGLPUHFtq2u6aNC/4KFa5d3X iKx09520GGaKys4dRaHULm9YWS2F/wDiN4H/AOCXv7RTSJefFP8AYt/4KC30ssiy3mneB9V/4JZW kjO+XuCniLxH/wAFQNRaaSSRjtml8NoeDI8bM+xP7HvGnxH+Hnw3h8N3HxE8eeDPAUHjLxl4c+HX hCfxp4o0PwtD4r+IPjC7aw8JeBfDcuuX1imu+MvFN8rWXhzwxpbXWt63dq1tpljdTApXZ1+ieH3j z4meFWR5nkXh7nOD4ZpZ1jIYzN8xwuSZPjM5zCVGkqOFoVcyzTBY6vRwuDg6rwlHCfVo0amJxVWL dTE1pT/VfCz6TPjB4J8OZxw14V8QYDg6jxDj6eYZ7m2C4eyHHcQZpPD0Pq+Dw9bN85y/MsTQweAp yrywOGwP1SOHq4vG14v22Lrzn/Pl+zB8LvGX7Jd1Pe/DP/gmP/wVUvZrtX+3Wvib9pH/AIJlTeH9 QleIxC51Dwf4e/4KPeHPCGoXUKkm1u7/AEK6urQk/Z549zbvvH4ZftdeJPF/x48N/s8/FD9kL9pn 9mXxp42+EfxU+M/gfVPjPrf7JXiTwv4s8L/Bjxl8FPA/j+wsL39m/wDan+P+raXr+l6t8f8A4dXF ra+J9E0DTtU0671SWw1Se50qe0b9HK/OL40f8pQP2Mv+zCv+ClP/AK0L/wAEpK/PuKOLOJeNc4r5 /wAWZ1j8/wA5xMYQr5jmNZ18ROFNNU6fM0lGnBNqEIRjCKbtFH5bxnxxxd4h59ieJ+N+Icz4n4gx kacMTmubYiWJxdSnSTVKnztKMKdNNqFOnGMIJtRij7Nooor54+VCiiigAooooAKKKKACiiigAr5A /bH+A1j8cPhnqGkaZ8C/hD8X/H01tNp3hy++K1/d+HLHwolxFLv1SHxP4c0+fxtH5Erq66R4e1LQ 2v3LGfWLERq0n1/RXu8NcQ5lwpnuWcRZTVnSzDKcVSxeGlHFZhg1KpSlzKE6+V4zL8dGlJq1SOHx lCVSN4Sk4SlF/S8H8V5twRxLk3FeR1p0c0yPG0cfhJQxmaYBSq0Zcyp1MTkuYZXmcKM2rVY4XH4a VWF6c5unKcZfxnfHj/glR+07+z38FPjN+0B48vPhW3gT4H/C34ifGLxna+HPFmtalrbeEvhp4T1j xr4ig0GwvfDNnFf6qdG0W8j0uzu9StI7q78iGe+gWR7hPvj9k/4f/wDBQjwF8N774B/tgf8ABLX4 tftF/Aqxs5ZPAlhD8V/+Cf3iPxv4DvHZYzpOgP4x/bG8NWaaC0ckk9jNB4l0jV/C8sbLotxPazQ6 fafqJ/wVU/5Rf/8ABSD/ALMK/bB/9Z6+IlfqLX9Gcd/TC8W/EbIpZBxLR4SnRhiKWNy7McvybFZd neSZnh7/AFbNckzbDZrHF5bmNBSnCOIoTSqUatbDYiFbC161Gf8AWXiX9Pfxz8WeGpcMcX4fgaph 6eKoZjlWa5Xw/jsp4i4dzjCc31PO+Hc8wedQx2UZthlOpTjisNUXtsPWxGDxUMRg8TiMPV/j1+PX /BOH4geJLqXXv2fv+Ca//BQr4d3fnrcP4D8XfFP/AIJh+IfCF3EJSz6fpviY/wDBSC+8WeGUkjOw X+oQeOniZQwsXB2j9MP2NvEv7W/7LnwR0/4J6z/wTP8A26PGum+E/E/i2fwdrlr8QP8AgmBY3TeE /EGsz+IrS01ixuP+CkRjtNVtNV1TWI5o7K6vrKW3+y3UU8D3EunWP7tUV+b8YePfirx/wfgeBuNe KsRxNkWW4+jmeDebYbB4jNaeNw1Gth8PXq5z7COZYqpRoYrG0VUxeJr1atPG14151VDDfV/yPj36 Tnjb4o8BZb4b+InG2L4w4ayjNMPnGAlnmEwGLzqlmOEw9fCYTE1s/wDq0c3xtXD4bG5jQVXHYvE1 q1LMcTDFVK6p4P6r+Z3/AA1P+0v/ANIov29f/Dlf8Et//pktH/DU/wC0v/0ii/b1/wDDlf8ABLf/ AOmS198QfErwJdfErVfg9b+JtOl+Juh+BtA+JWreDlM39rWPgTxTr/iXwv4e8TTKYRb/ANnar4g8 HeJtLtis7TG50a7EkKII3k7mvx4/BD8wdS/aY/aQ1TTr/TLr/glD+3s1rqNldWFyo+JX/BLfLQXk ElvMBn/gpKRkxyMORivj79h/w/8AGj9jb4SW/g7Tf+CUv7dOt+PvEJttW+JnjaH4if8ABLpW8Q69 HEyRWOnPcf8ABSCK6g8MaCks1noNlLHCxWW81W5t4tR1W+B/bHSfjZ8G9e+KHiH4I6F8WPhtrXxm 8IaFD4o8W/CbSPHHhrU/iT4V8N3EumwWuveJfBFlqc/iXQNHu5tY0uOz1HVtNtLS7fULUW0svnJn 06vocFxXn+XcN55wlgsyxGG4f4lx2TZjnmX0pclPMcRw+sx/spYmUUp1KGGnmeJrvDOXsKmJhhMR UpyrYPDTpfVZfxtxRlXCPEnAuXZvisHwtxdmXD+bcR5VQkqdLNsXwvHNv7EWLnFKpUw2EqZzi8T9 UlJ4ari6eCxVWlPEYDB1KP5nf8NT/tL/APSKL9vX/wAOV/wS3/8ApktH/DU/7S//AEii/b1/8OV/ wS3/APpktfUvwf8A2wv2SP2hfEV/4Q+AX7Uv7Ofxw8W6Xot14k1Pwv8AB/43fDP4l+ItO8O2Woaf pF7r1/ongvxPrWpWmi2mq6tpWmXWqXFtHY2+oanp9lLOlze20Uv0ZXzx8qfmd/w1P+0v/wBIov29 f/Dlf8Et/wD6ZLR/w1P+0v8A9Iov29f/AA5X/BLf/wCmS1+mNFAHyn8APjP4X/aO+A/wT/aG8D2G v6V4L+PPwj+G/wAZ/CGl+K7XTrHxRpvhf4o+DdG8ceH7DxJZaRqmuaTZ6/Z6Trlpb6xa6Xresadb 6jHcxWWqahbJFdzeuV8Ff8Eq/wDlF/8A8E3/APswr9j7/wBZ6+HdfetABRRRQAUUUUAFFFFAHy58 dvhz488b/Hb/AIJ8eJvCGj3Gp+Hvg/8Atb+OfiN8VL2HUNOso/DvgPU/2CP23PhJp2sXdte31pc6 vbz/ABP+KXw48Prp+kW+p6jFda7barLYx6Tpmqalp/3nXwZ8dvhz488b/Hb/AIJ8eJvCGj3Gp+Hv g/8Atb+OfiN8VL2HUNOso/DvgPU/2CP23PhJp2sXdte31pc6vbz/ABP+KXw48Prp+kW+p6jFda7b arLYx6Tpmqalp/3nQAUUUUAFfH3/AAUM8UfEXwR+wH+3H40+D99r+l/Fvwh+x9+0x4o+Fup+FLaW 98U6d8RdA+C/jXVvBN94as4Le7nu9ftPE1pplxo9tDa3Ms+ox20UdvM7iNvsGvj7/goZ4o+Ivgj9 gP8Abj8afB++1/S/i34Q/Y+/aY8UfC3U/CltLe+KdO+IugfBfxrq3gm+8NWcFvdz3ev2nia00y40 e2htbmWfUY7aKO3mdxGwB7jRRRQAUUUUAfBX/BVT/lF//wAFIP8Aswr9sH/1nr4iV+lviGfWbbQN cufDlnbah4ht9H1OfQtPvZTBZ32sxWU8ml2d3OGQw21zerBDPKHQxxO77l25H5pf8FVP+UX/APwU g/7MK/bB/wDWeviJX6i0Afy2/s8ftb/Ajw7/AME7ZfjB8Xv2tfj18Xf2xvG+j/Arwt+3F8Ptb/be +Ifwf8Q/swfF/wCJvxy8E+AfHSeOPBaeNJdD/YD+DXwq+JHiG+8KeKfiD4D+G/gfUrf4S6Xe3Wnj xDqV1YM/E+Hf2uvGfiT9k74JaL4+/am8YeBP2YtB/wCCrfxr+A/7VH7Rfw9/aP8AH3i7xr8Mf2Vm 0T4v/Ef9mjQ/EX7Xmvw+DPjDpfwp+IHijVPgX4Ptf2mvEM/gvxjrXwr1/wAHanJ4rW38Vvq+pf1h G3tyJwYISLr/AI+QYkIuP3Sw/vxt/ffuUSH95u/dKsf3FACtBA6To8MTpchhco0aMlwGiWBhOpUi UNCiQt5gbMSrGcooAAP5b/2nPC/hfxR8Vf2svil+zT+1l8ck8EfA3/gh34d+L3wa+J/wf/aW8W+K 9R+IPi/wD8Xf25de+HPi3xZ8e5PEXifx/wDGHw94R1/Qbxzoev8Aj3XvBnxBS5Nv8RLDxpp+n6db wbfgv9ov9pH4if8ABR3T4PiH+0b8KfgJquh/Fr9lN/hn8I/ir+158S/hSnx4/Zk+Jn7OXwxn8c2P wZ/ZCt/ANz8Gv2iNb8f/ABj8a/FBdL+JV14suviN8P8A4jeEtE+Hkdx4Z0Pwwj+LP6eQAAAAAAAA AMAAcAADgADoKY0UTSRytHG0sQdYpWRTJGsu3zFjcjcgk2JvCkB9i7s7RgA/HLUf2gv2dNP/AOC3 Phn4cH43fBWx+JEv7CPjfwBfeAz8SvAtt43k+JetfHb4V+MNJ8FXfhf+2k15/HOreCLT/hKdO8Nz WJ1+/wDCtr/bdtZS6RD9qX7UufiN+1R4I8WeK/Ffxi8GfsseDf2XvBcPj7xR4l+JGk/HL4qat8Sd G+HHhbR9e1nTPEmo+BdU/Z70DwhBqItNP0258W6evxJksNDs5NYm0vV9fk0+0h1L69ooA/lT/Zb1 v9oX4G/tZ/s1/wDBQT43/s/z/CLwb/wUe8b/ABD+F/7QvxC1L4neHvEep6hH+0zqemeP/wDgnRpn i74fWGm2ur+CdT+BfhvwN4N/ZVik1PWNXVdW+KV5HPDbXV5HFE74d/tLeNLD9kr9qPwx4e/aI1r4 7fFT4afHT/gm1d63+2n8Hf2ufiP8fvgt8cfD/wAb/wBtTwV4Rul8HaTrnijVtB/ZW+J9x4P0zXtH +P8A+y98N4rHwR4d0Pxf4MvtMn1Xw54t0+K0/qqpiRxxgrGiRhneRgiqoMkjtJI5CgAvI7M7sfmd 2ZmJJJoA/nC/Z8/bY0nxr/wVR8B+HfBXxN8V+H/CPxP8S/t8/Br4q/B74o/tdeOvin4msvib8Gfi Bo8PwytNb/Zg8Q6e3w3/AGStZ1O1+HHxU8R/A3w14I8R/wDCa/E34J3uq694t8OyLpUVzpn6b/8A BTr/AJNo8Cf9n6/8Epf/AF6R+xzX6CeTDv8AM8mLf5vnb/LTf53k/Z/O3Yz5v2f9x5md/k/us7Pl r8+/+CnX/JtHgT/s/X/glL/69I/Y5oA+uaKKKACiiigD8AP+C0XwDNvL8Pv2l/DdpJDOJYfh748u bNSjJLELjUvBGuzPCQ8cqeXq2iXN/JyNnhyzWVWWBG/Uv9iD49p+0b+zZ8PfH93dC48U2lgPCPjw F1eZfGfhmKCx1W7uAnETa9AbHxNDDyYbTW7eMkspNes/Hj4SaJ8dvg/8QfhLr4jWx8a+HL3S4LuS Pzf7K1hAt5oGtxpglptE1y20/VYl53yWaowKswP4C/8ABJ74u638Dv2jfH37L3xCL6NH41vdV0mL TL1iBpHxX8By3lvPYqzARQnWtItdY0+aQsDe6hpXh+1hDvLGG8mf+yZjGe1HHR5JdFGtGyT9Zaav dzk+h+AY7/jX/jJg8xX7nh7xPw8cvxlvdo4fifBuEcLVkl7qni5VKUYuTTqVcxxtSz9k2v6VaKKK 9Y/fwooooAKKKKACvjz9h3/kvH/BVn/s/wD+H/8A665/4JsV9h18efsO/wDJeP8Agqz/ANn/APw/ /wDXXP8AwTYoA+Sf2j/it4MtP+CoX/Ctf2xP2pfH/wCzD8AdI/Zo+DXjL9kTw9on7RHjL9l74d/H v456x8Vvihpfxvi8ReNPBfjLwBP8XPHvgfT9I+Cej6J8CNe1vxFodz4c8ZXGtv4G1JtbuJ5fnH4O /tvP4s/4KZeHtF+FHxB8RWFl8R73/goZ8IPHHwO+Lv7X/jr4ma2fjN8FPGemp8H9J8S/sz+ILEfD f9kTUNcf4bfE3XfgpoHgjxMvjb4kfA7UdY8Q+LPD7LpEV1pf9KjxRSGNpI45Ghk82IuisYpdjx+Z GWBKSeXJJHvXDbHdc7WYFvkw7/M8mLf5vnb/AC03+d5P2fzt2M+b9n/ceZnf5P7rOz5aAP5FLHx9 4D+Nn/BJ3VdV1L9s74r/ABC/4KAeN/E37CFx+2B4E8cfHrXvFvjb9mz43X/7fP7ONj430yw/ZE8Y eItc+Gv7O8Xwy+ItzqPhfwbp2m/CTwrpPiHRdF03+1rbxLZTyF/QP2k/ir8e/wBnnxF8dP2d9G+O XxO1D9mjwR/wUT+AXhD4mfGX4+ftefGv4Y6r8K/hF8VP+Cf9h8WJPD3jr9sXwho3jj4z/Br4WeMf 2oT4Rf8A4S7Q207TvCl74rHwxs9X8FeAvGNu/hv+q1YokaV0jjR5mV5nVFVpXVEiV5WABkZYo0jV mJIREQHaoAWSNJUeKVEkjkRo5I5FDpIjgq6OjAqyMpKsrAhgSCCDQB/Oz+2F8XPDPhD/AIIQapdf tEftTfs7fE3xl4h8AnwB4R+NWg/HDQPHHg74xeItB+JU9npVp4C+Kfia18IXfxW8cw+BfDVxF4z1 TTdGg1nWta0Dxlq1xYtbwXtwP2D8a/E741+OvDHw+8e/sWWv7LXxz+H3jDS9Q1ebxv41+PPi3w74 Y1PT5HsR4d1H4fa/8J/hF8adE8Y6XqC/2x/aGoPqOlQWj2titidTF1dNY/UiqqqFUBVUBVVQAqqB gAAcAAcADgDgUtAH86/7TXwn+PXiT/goZ4v/AGnfhT4f0Vv21/2Sf+CeP7F3xO8P/D7wd4j1TU/B /wAXdG1v46/t1Wf7Rv7K9p4g1nRPDt5rPhj4y+G9NbT/AIfeINf8MaJPpPxW8J/CHx/qOlaYfDdz p5+T/gN+0L4H8W/BD/gnze/HP9on4nfse/sEfGnwn/wVA+Ml58TdJ+Mnib9k+/1v4/w/tjT6z8E/ hn8SfjH4X8T+Edf8FX2nfCvxf8Y/HWifDVvFVnp3xD8UeEr7Tta03xVbeEv7Gl/rYpkkUUy7Jo45 U3xybJEV13xSLLE+1gRvilRJI2xlJEV1IZQQAfx9+JbL9s3/AIKh/AT4BfCDUPhdrfxd8f8A7PH7 G8vxN134ieLfG3hz4G+JPBv7anx0k1qy/Yp+P+vaLrugXUUvxU+F3wH8Dy/GjxX4P0/S9G+xXn7S OgSvLpayQWK+hfGX9qL4t/tdfDD9o79o/wAM/Hv9of4DXXwf/wCCGlr+1ZafCX4RfFTxD8ONA8Df tt/DDxz+2h4f8dHxZa+H7iK+1y4+GXxQ+DV/8PvEng++1BvBnj2w8Ow6X8RfD/iuw0fQbbS/6xaK APyS/Ypm+IHgf9tb9o34M6/8aPjD8X/C2pfsXfsK/tLzS/GHxzqXjW50v4wfGb4iftoeD/ijq3gu yuBbaD8OfCfivTvhD4EnT4Z+ANH8N/Dnw3eaTJJ4T8MaHHfX0Vz6h8aP+UoH7GX/AGYV/wAFKf8A 1oX/AIJSV+jtfnF8aP8AlKB+xl/2YV/wUp/9aF/4JSUAfZtFFFABRRRQAUUUUAFFFFABRRRQAUUU UAfBX/BVT/lF/wD8FIP+zCv2wf8A1nr4iV+lviGfWbbQNcufDlnbah4ht9H1OfQtPvZTBZ32sxWU 8ml2d3OGQw21zerBDPKHQxxO77l25H5pf8FVP+UX/wDwUg/7MK/bB/8AWeviJX6i0Afy2/s8ftb/ AAI8O/8ABO2X4wfF79rX49fF39sbxvo/wK8LftxfD7W/23viH8H/ABD+zB8X/ib8cvBPgHx0njjw WnjSXQ/2A/g18KviR4hvvCnin4g+A/hv4H1K3+Eul3t1p48Q6ldWDPxPh39rrxn4k/ZO+CWi+Pv2 pvGHgT9mLQf+Crfxr+A/7VH7Rfw9/aP8feLvGvwx/ZWbRPi/8R/2aND8Rftea/D4M+MOl/Cn4geK NU+Bfg+1/aa8Qz+C/GOtfCvX/B2pyeK1t/Fb6vqX9YRt7cicGCEi6/4+QYkIuP3Sw/vxt/ffuUSH 95u/dKsf3FACtBA6To8MTpchhco0aMlwGiWBhOpUiUNCiQt5gbMSrGcooAAP5b/2nPC/hfxR8Vf2 svil+zT+1l8ck8EfA3/gh34d+L3wa+J/wf8A2lvFvivUfiD4v8A/F39uXXvhz4t8WfHuTxF4n8f/ ABh8PeEdf0G8c6Hr/j3XvBnxBS5Nv8RLDxpp+n6dbwbfgv8AaL/aR+In/BR3T4PiH+0b8KfgJquh /Fr9lN/hn8I/ir+158S/hSnx4/Zk+Jn7OXwxn8c2PwZ/ZCt/ANz8Gv2iNb8f/GPxr8UF0v4lXXiy 6+I3w/8AiN4S0T4eR3HhnQ/DCP4s/p5AAAAAAAAAAwABwAAOAAOgpjRRNJHK0cbSxB1ilZFMkay7 fMWNyNyCTYm8KQH2LuztGAD8ctR/aC/Z00//AILc+Gfhwfjd8FbH4kS/sI+N/AF94DPxK8C23jeT 4l618dvhX4w0nwVd+F/7aTXn8c6t4ItP+Ep07w3NYnX7/wAK2v8AbdtZS6RD9qX728M61+2XN8WH sPGXw1/Zk034GDXPEkUfirwz8b/iprfxYbw1DDqp8IXr+ANV/Z88P+D11zUbiPRE8SaWvxKew0aG 61WTTNY157C0i1L6booA/k+/4J6/tFXV5/wRX+JPw0+En7e/wR+Kv7RXhP8A4Jk/GnWvhD+zV8D9 U8CaN+0/8AvGnhP4W+M10q6vovB/xU8R/Ei/8S+H/FGoeFrG11O78F+EL3RfEUulSfuL69tYa3P2 hP27tZ+Ot78d5f2U/wBrjxvP4Q0n9k3/AIJG6fp3xK+D/jK8vPD3h34pfF3/AIKO6z8P/i14l8Ea 1cQ6j4I8Q+Mb7wLqGmeCPiLeWkHiHT5ptLu/hv46iuLzQdf8M2P9UtNREjUIiqiKMKqKFVR6BQAA PoKAP5l/26fGVt+z78Tv2gfhP8Tf2zv2lf2fPDnwU/YA8JfET/gnhdD9pb4k2PjL9of9qfW/Gf7Q UvxIudR1TV/Fjav+198VfDfifRv2ffB2hfs3+Of+E/8ADMfhjx5p9rpfw6W08UWU9j/RB8GNW8e6 98HvhPrvxV0iHw/8UNa+GngTVviRoNvEYINE8e6j4X0q88YaRBCXkMMOm+IZtRso4i7mNIVQu2Mn 0d4opDG0kccjQyebCzorGKXY8XmRlgSknlySR71w2yR0ztdgX0Afl1/wSr/5Rf8A/BN//swr9j7/ ANZ6+HdfetfBX/BKv/lF/wD8E3/+zCv2Pv8A1nr4d1960AFFFFABRRRQAUUUUAfLnx2+HPjzxv8A Hb/gnx4m8IaPcan4e+D/AO1v45+I3xUvYdQ06yj8O+A9T/YI/bc+Emnaxd217fWlzq9vP8T/AIpf Djw+un6Rb6nqMV1rttqstjHpOmapqWn/AHnXwZ8dvhz488b/AB2/4J8eJvCGj3Gp+Hvg/wDtb+Of iN8VL2HUNOso/DvgPU/2CP23PhJp2sXdte31pc6vbz/E/wCKXw48Prp+kW+p6jFda7barLYx6Tpm qalp/wB50AFFFFABXx9/wUM8UfEXwR+wH+3H40+D99r+l/Fvwh+x9+0x4o+Fup+FLaW98U6d8RdA +C/jXVvBN94as4Le7nu9ftPE1pplxo9tDa3Ms+ox20UdvM7iNvsGvj7/AIKGeKPiL4I/YD/bj8af B++1/S/i34Q/Y+/aY8UfC3U/CltLe+KdO+IugfBfxrq3gm+8NWcFvdz3ev2nia00y40e2htbmWfU Y7aKO3mdxGwB7jRRRQAUUUUAcF8Vfhh4G+Nvwv8AiR8GPifof/CTfDX4ueAvGHww+Ifhv+0tY0X/ AISDwN4+8Paj4U8W6H/bHh7UNJ1/Sf7W0DVtQsP7S0PVNN1iw+0fatN1CzvYoLmP5R/4d2/Af/op /wC3/wD+LXP+Co3/ANGHX3XRQB8Kf8O7fgP/ANFP/b//APFrn/BUb/6MOj/h3b8B/wDop/7f/wD4 tc/4Kjf/AEYdfddFAHwp/wAO7fgP/wBFP/b/AP8Axa5/wVG/+jDr8qf+CpngnQv2P/BvwrsvgJ8c f25fDnxQ+JPiTXI3vtY/4KPf8FBPiWieC9A0qK31i2g8N/En9pnxj4ftr7Uda8Q+Hhp+sR6Qmr25 sbyPSryBmuiP6Qa/k4/4KeeOPGXxs/4KD23gH4baRr3jLWvhFovhjwb4P0DwzYPq93eeM0tn8a3l zBpsaTG4Wz8Qa7Zadr7vGqx2Hh+czNHbWhuB/U30O+B8Bxn405dic6wuAxnD3BmR55xjndDNo0Hl dajl2FWBwFPHyxUKmFjh1m+ZZfiKyrwnCWHw9dyi4xlKP9qfQG8OMs8QfpC5VjOIcFlmP4V8PeHO I+P+IsNnkcM8lr0MqwSy7K6OZ1MbCpgoYVZ9m2V4rELE06lOWFwuJcoOEZyjxnhu+1Txta/tVfDH wr+0n+3RB8Zfgt8KPD3jX4aeNF/4KNft5ana+J/FPwZttKP7SsT+G739o++8G69a+MZ4fEus+DdL /sCSz03RLJV0iGFE2yfot/wTf+DPw8/a8/Z0h+IXxQ+M37c2tfFLQ/GPiPwj451DRP8Agpr/AMFG /BVlfXVq9rrGiX0XhHwR+1V4d8LaJHL4b1nSbRo9E0PTrG6u7G8uRD9qkujX45/Cj4IftJ/AX9qu 90Sy+G2o+L/iR8BND0b4k/Fb4e+F76y1/Urz4Z+JtK8IxeMNAjGm3Fwdem1Twp8TbXw9rdn4f/ta 4hXVNRnt1urTT57tf0u/4I5eLF+FP7TP7R/7NE98bzRte04eK/CGoTNJEmpjwNq8lrp99Y28scUg PizwZ4vtPEB82KKX7Fo8HmRRsrIP61+kH4NeH1Hwh48reH1DhTGPLMB4feKeWZjw/h8p+vYjC08s w/DXEl6+Xc1XD5Bj+H8Tk/GeAw9SosDjcbmGZ43AwqNVKq/uX6U30fvCuh4D+Jlfwsw3BOYSybK/ C3xpyfNeFsNkf9pYnBU8nwnCPF18RlXPXwvC+Z8L4vIfEHLcNVqrLswzHNM3zDLadVqrWXmH7fv7 Mf7R37I/ja2+L/gb4zftZ/EH9mi81bTItRsZP21f22B478Hact5Fcn4e+MfjPafH9vjvH4E1nVHl vdH1G1+JsOix63dtYXmm6fO+mW+s/f8A+yb8J/2Mv2vfh3D41+Hvxe/b+s9b05LW28b+A9R/4Kyf 8FPz4k8F6xPGzfZr6FP2xFN5pN48U7aJr9tEtjq0EMqgWuo2mpabY/sBrGj6T4h0nUtB1/TNP1rR NYsrnTdW0jVbO31DTNT068ieC7sb+xu45ba7tLqB3huLeeKSKWN2SRGUkV/Nx+1V+xx8Y/8Agnr8 Tj+11+xffaqvw0sp5Lnxd4Pja61dvBmm3U4m1PRPEWmFvM8UfCm+KRhbi5ll1TwxIttPdXcNzp+n +JE/mfg/FcA/SG4VyLw04khkfAPjDw1llDJfDrjWjhsPlXDvGuCwsVDAcIcX0sJShTw+bSv7LLM4 hSlVxNaeqq4ycsFm/wDH3AWN8MPpVcFcN+D/ABdT4b8MPHvhDJ8Nw94T+ImHwmFyXhTxEy7BR5Ms 4E48oYKhTo4XPJ3dHJs/p0ZVsZiKlmq2YVJ5dnv63f8ADu34D/8ART/2/wD/AMWuf8FRv/ow6an/ AATj/Ztl1XwpquueIP2v/HSeCvHvw8+J+heHvil/wUX/AOChnxa8CHxz8J/HXh74mfDnXNd+HPxN /ai8WeAPFn/CJ+P/AAn4a8WaZpvivw1rWjjWNE0+5uNPnNuq1r/sVftv/DP9svwI2reHmi8NfEXw /b26+Pfhve3kc2p6JcSYjGraTKVifWvCt9NlbHV4oI3glIsdUgs70JHL9rV/LnFXCvEPBOf5nwvx VlWKyXPsoxEsNj8vxkFGrSmkpQnCcXKliMNXpyhXwuLw9SrhsVh6lPEYerVo1ITl/GHGvBPFXh1x RnHBnGuSY3h7ibIcXLB5nlWPpqFajUSU6dSnUhKdDFYTE0ZU8TgsdhatbB43C1aOKwleth6tOpIo oor58+WCiiigAr+af/grB8Jdb+Bn7SPgH9p74fGXR18cXmmaydTsoyqaN8VPAEmnyx3b7FEMJ1rS 4NH1KGNzv1C/07xFcSB/3xP9LFfgB/wVe0z9qnw94Q1HTvEN9ovxW/Zu1vxHpWtaT4juPBulWfjH 4UeJbaeWOwsdU1Hw3FpNslvdw3l7oum+I7rTJbS/sdSl0e/W21me0uNQ87NEnhJPlm3CUZwnBJ+z lF3UpapqLV4uST5b3eiPxnx3wtHE8AY6pUweY1cRl+IoZnl+YZdRhXeU47BycqeKxSVeliaOFrUp 1sJUxOHpV1hXXWIrKnTp86/Ur4Z/tifC74mQfs42OkXsU3iz9ofwzrfiTTfDttcxS3Hhu18JaBrF 74tfVhkusemeJdEvvCdqMK2o39tqFxatLBpV8U+ta/kQ/wCCWd/K37cnwSt7ieeZE074mWFhG8jy R2sR+GfjzU3ghV2IggaZr25McQCNdXEspXfNI5/rvqsvxU8XRlUmknGp7PTry06bb+cpSduiaXQ9 Dwf44zDj7hnF5xmVKjRr4XNv7KUKPwy+q5Nk1WvWk7L3sTjcTisTGNv3NKrToJzVLnkUUUV3n6sF FFFABXxf4y/YF/Z88a/Ej4j/ABXm1b9p/wAEeMvi54g0XxZ8R2+Cn7dn7cf7PnhXxX4q8PfD/wAF fCvSvE2ofDz4E/tFfDn4ex+II/h78OfA3ha61my8L2uo6np3hjSjqlzeXMBnb7QooA+FP+HdvwH/ AOin/t//APi1z/gqN/8ARh0f8O7fgP8A9FP/AG//APxa5/wVG/8Aow6+668X+P3x9+G37NXwz1z4 qfFHWRpfh/SFW3tLO3Ec2s+I9buI5W07w54dsHlhOoazqTQyeTD5kVvbW0N1qOoXFnplle3lv6GV ZVmWe5lgMmybA4rM81zTFUMDl2X4KjPEYvGYvE1I0qGHw9GmpTqVatSSjGMVu7uyTZ6mSZJm/Emb 5Zw/kGW43OM7znG4fLcqyrLsPUxWOzDHYurGjhsLhcPSjKpVrVqkowhGKeru7JNr4J/aI/Z0/Y8/ Zi+GWs/FH4ofGf8Ab9sNJ05WttJ0q3/4Kvf8FQZNc8V69LFLJp/hvw7Yv+2MjXuqXzROSSUtbC0j udT1Ke006zurqL8yv2FP2f8A4+/tl/E7Wfihqvxf/bB+F/7J+keIb4Wmkf8ADdH7b2reNPEtsjQA fDbwt8b9W/aAHxtl0KC7srLVvGd/Z+PbTwz/AG5A9rp2gwTXEmn6PtfC/wCGfxr/AOCwHx8n+Mvx iOq+Cf2XPAGqXWmaFoVhculstok1vcP4G8JXDpCL7xFqsS2dx498cfZd0CiG2tUtvK0LStO/pY8J eEvDPgPw1ofg3wboem+GvC3hvTrbSdC0LSLaOz07TNOtECQW1tBGAqqBl5HbdLPK0k88kk0kkjf1 lxRhuEvo38HZtwJHDZJxf468Z5NUy3jbMcRRwmcZH4X5DmdGMq/DOVQrRrYPF8W4ujKP9pZlGM1l qajhZpKlUxP9xcaYPgb6JHAOd+GkcJw7x59JXxAyCrlHiLmuKw+Bz/hzwY4ZzihCWJ4PySFeGIwG O46x2HlD+1s2jCosoTUcFOKjQrYz8Xf+ChH7Pfw9/ZY/Ze8ZfFb4ZfGb9uzQ/iVDq/hLw94H1PWP +Cm3/BRvxlp1rqmt+IbGPU5J/DHjf9qvxB4X1hk8LQeIHgg1bRdRghuVhvFgEtsk0X5i/sGXuqft PeMPHvwK+JP7TP7ccXxP8XfCPxLf/Brx5Z/8FGv29/DttpnxV0ka5qytL4e8MftGaN4dv7U6BfaV PPo+o6NeaVBD4B1BrS3jute1Ca9/Rf8A4LyeO/7P+EXwM+GkcuJfFvxE17xlNCh+d7fwN4dGjRiQ AbvKe48fKyISFklgDBWaEFPxh+DfwJ/an+FX7Ss9v4A+H+paz8Zv2brDwx8Z/E/gvQtQsNR1WHQo m8G6ldaIsenXNwNZ1G60/wAZ6dpGueG9HOo6q8VxrVlFZXUljdRD+ifo+eEHAfEX0U8zq8TUeEMF xVxVmHF3FXCWfcSUsohicDPhvHZJw7gKzxmYxVRcO0eI8Jl+DznDyqLL60c6+rYuLePpqf8AV/0W fAbwy4s+hJnNbjChwHl3G3Gmacd8bcDcS8XUcip4vLanCWY8O8KZXiJY7NoxqrhPD8WYLLMBxBhJ 1llWIhxF9Ux0ebMqKn+jn/BMnw7bftN+KPjJ8JP2nvjV+3Dqnxe+G7WV9o8ukf8ABRj9vr4ZTt4c 0u7bwt4n0fUtC+Fn7S/gzw/qF/4Y8QppjXGvX2l3niDUH8RG31DV7q107T4rb0v9vv8AYE/aG+G2 n/8AC2v2Tfjt+2Br/hHQtGmg8UfD3Vf2z/2yviN8UfDUE4VfEHiP4c/ETx78efFvxN03TtfsYLK1 8VaF4C8UeGNRgg0y21Czi1IG5m0vxX43+KdM/ZN/4KOfBX9rvwtFeaT8G/2kNP0b4i60s0ElqbfT vHVrFoHxf0vVLF1SUa5ol1qMPjjUdLuAJLPX7+zglMNxbMkH9QkciSoksTpJFIiyRyRsHSRHAZHR 1JVkZSGVlJDAggkGvxXxfzWl4W+KfA/jnwhwnw3V4X8UuD44/GcH5tkuCxPD+GzOlg4cM+IvBjwk qM44Gtha0fZ4qvgnTq4evmOJw69pg5V8LX/nfx4zuh4LeNPhx9JLgTgfhKtwZ40cBRzPH8A57w9l +L4XwmcUcBDg/wAWPD6WBnh508ur4PEQ9ljMTl/sa2FxObYvCxVXASxODxP8+v7CU/7IH7YGkw+F dY+Jv7efgP466XYtNrngSb/grH/wVJXT/EMVog+1694Eu7r9sZpdQ08DM97odxLJrmhr5onGoafC ms3P6Rf8O7fgP/0U/wDb/wD/ABa5/wAFRv8A6MOvj/8Abw/4JhTeOteuP2jv2S7hvh98dtJvl8S6 l4Z0O+Hhuw8Y6zaOboeIPDGpW8tnH4V8fPOomlnE1rpHiC7Jur2XTdWlvdT1J/7B/wDwU/Hj3V4f 2ef2tEHw8+POj6ifDNh4i1zT/wDhGNO8ZatayCzOh+JNPuY7SLwn4/Nyht2s3t7LSNduyINPi03U 5bbSbr4rjfwg4W494bx3ix9H1YnGZHgqccVxz4W4irLF8W+HVeopTrYjBw97EZ9wlzRqSw2Y0lUx GGoQcq/tI0Mwjlf554i+A/BfibwjmXjh9FpYzH8N5fSjjPEnwXxVeWP458J8TVUqlfFYCmlLFcTc C80assHm9CNXFYPC03PE+1jhs0hk317/AMO7fgP/ANFP/b//APFrn/BUb/6MOu4+Ev7E/wAC/gx8 ULT4z+GLz9oDxZ8StN8BeL/hhoviT46ftgftdftM/wDCO+BvH/iH4f8AivxtofhbR/2jfjj8VNA8 Lf8ACU6/8K/h3f63qXh7S9M1i/8A+ES0i1n1BrKF7aT6zor+Uz+JQooooAKKKKACiiigAooooAKK KKACiiigDgvir8MPA3xt+F/xI+DHxP0P/hJvhr8XPAXjD4YfEPw3/aWsaL/wkHgbx94e1Hwp4t0P +2PD2oaTr+k/2toGrahYf2loeqabrFh9o+1abqFnexQXMfyj/wAO7fgP/wBFP/b/AP8Axa5/wVG/ +jDr7rooA+FP+HdvwH/6Kf8At/8A/i1z/gqN/wDRh1XvP+CfP7Pmn2l1f3/xZ/b3sbCxtp7y9vbz /grF/wAFQba0s7S2iaa5urq5m/bGSG3treFHlnnldIookaSRlRSR951/Ox/wUF/bD8eftS/E23/Y P/ZCFx4jh1rWF8P/ABI8WaFO5t/E1/bSn+1PDVrqtvvhsfh94aEb3XjfxEzC31OSyuLJJBoFlcv4 h/VPCLwozvxc4o/sXL69DKclyzDTzfi/ivMHGnk/CnDuFvPHZrmFepOlS540o1I4PCyrUpYuurOp Rw1LFYrD/tfgR4IcReOvGa4dyvE4bI+HsnwlTPuO+Ns0caWQ8E8J4K9TMs7zTE1alGhzxowqQy/B Sr0Z47ErllVw+Eo4zGYX5A8VL4u/ac/ays/gb+wD8XP2x9M8C6Obmx1b4ieO/wBvH9ur4w6XPFYX kX9q/FYL8Yf2gPiBaeBdL0B0W08D6x4Xs9E8YahcXamDVRea/p+k6d+9Oj/8E4/gvZaRpVlq3xj/ AOCgOt6paabY2upay3/BVD/gp7p7avqFvaxRXmptYWn7YQtLFr+5SS6NnagW9sZTDABEiiu3/Yp/ Y48C/scfCq28H6CLbWvHOupaaj8SfHZt/LvPE+uxRMFtrQyL59n4Z0UzT2vh/SyVEUUlxqF0r6pq OoXE3q/7SnxNh+DfwE+LXxKeGS6uvC3gfXrvR7GGGaeXUfEd1Zyaf4a0xIrf9+39o6/d6dZu8fMM czzkhY2Yfa+LXE/CnHfEHBvhh4QcO4XBcF8KYiPDHC2ZVcDQjxNxnnGdY3C4fHcRZ3j3RpYyazfH xpVMDgKjpU8NRkqksPhJVlgcF+ieOXGXBPiVxT4f+DXgPwrg8v8AD3gfFR4N4Lzetl2Ghxh4g59x DmGDwuZcWcRZnLD0cdUWe5lCjVy3LKzo0sHh5Kq8LgZV45dl38uf7AXjo/HX9qk/CH4/ftGftv8A iDwN41sPFVh8MbfTP+Chf7dPgKTSPFNhcR6vocF7rngD9onwtrOsw3/hnTdW0mCPXtT1MXGrTadI oe/uGmk9j8b+Edc/Zv8A+ChGjfs//Hv9oP8Abf1v9l/4g6yb/wCHl5J/wUH/AG6vDuteHtJ8fyPZ eGrq5+J2gftFaR8RtZ0rwb4rgn8Kaxp3ibxnqWjrpsVx4kutPe9i026j/MD9mP4W/HL4lfEWXVP2 edIn1z4kfB/RovjPY2FhdW8GsNbeDPFHhm2WfRLW4lgGr6pbaprWlzx6LBL9t1K3S5gsorq68m0n /ol/4KS/CmD9sH9iLwX+0n4V8OX2meP/AIZaEvj660G8s57fX9M8OXkENp8V/BOp289rBeJqXgrU 9ObULyK5SJraXwnq8EMPnXxDf3f4w8CeFXB/jnkeW4nLOFMPwb4ucIVPCXivC4LA5PTzDgLirH0Y VeD+LMNh6VKlUyavnCjhaVLFxjQw+IjluaYzFVK0qHLH/S/x68M/BLgL6SnDmT4rJ+CMJ4f+OvAV bwN43weXZdkFLM/DHjTM8PCtwFxvhMLSo0a3D+Jz6NPB0aOPjHDYXFxyjOswxlWvPC8sfsf/AId2 /Af/AKKf+3//AOLXP+Co3/0YdH/Du34D/wDRT/2//wDxa5/wVG/+jDqj/wAE2/2mn/ae/Zh8J+IN cvku/iH4Fb/hX3xD3SKbq71nQ7a3/s3xDOmQ5PibQZtO1S5nEcdu+sPrFrbArZsF++a/yt4y4Tzf gXiviDg7PqKo5vw5muMynGxjf2dSphKsoRxFCUknUwuLpezxWFq2Sq4atSqrSaP8UfEDgjPfDXjf ingHiagsPnvCWd4/I8xhHm9jVrYGvKlDF4WU4xdXBY6iqWNwNflSr4PEUK0fdqI+FP8Ah3b8B/8A op/7f/8A4tc/4Kjf/Rh0f8O7fgP/ANFP/b//APFrn/BUb/6MOvuuivmT484L4VfDDwN8Evhf8N/g x8MND/4Rn4a/CPwF4P8Ahh8PPDf9paxrX/CP+BvAPh7TvCnhLQ/7Y8Q6hq2v6t/ZOgaTp9h/aWua pqWsX/2f7VqWoXl7LPcyd7RRQAUUUUAFFFFABRRRQB8ufHb4c+PPG/x2/wCCfHibwho9xqfh74P/ ALW/jn4jfFS9h1DTrKPw74D1P9gj9tz4SadrF3bXt9aXOr28/wAT/il8OPD66fpFvqeoxXWu22qy 2Mek6Zqmpaf9518GfHb4c+PPG/x2/wCCfHibwho9xqfh74P/ALW/jn4jfFS9h1DTrKPw74D1P9gj 9tz4SadrF3bXt9aXOr28/wAT/il8OPD66fpFvqeoxXWu22qy2Mek6Zqmpaf950AFFFFABXx9/wAF DPFHxF8EfsB/tx+NPg/fa/pfxb8IfsfftMeKPhbqfhS2lvfFOnfEXQPgv411bwTfeGrOC3u57vX7 TxNaaZcaPbQ2tzLPqMdtFHbzO4jb7Br4+/4KGeKPiL4I/YD/AG4/Gnwfvtf0v4t+EP2Pv2mPFHwt 1PwpbS3vinTviLoHwX8a6t4JvvDVnBb3c93r9p4mtNMuNHtobW5ln1GO2ijt5ncRsAe40UUUAFFF FABRRRQAUUUUAYXijxHpfg/w14i8W65P9m0TwtoWr+I9YuQATb6Xomn3Gp6hPhmVT5VpazSYLKDt wWA5H8+H/BGrw7qnxe/aA/ak/a08UW4fUNVvr7SrG4mBkC698TPEt3418Ti0baIo5NLs9K0myymw xWesiCJFglda/Qn/AIKw/Fw/Cj9ir4kQ2lx9n1n4n3Ok/CjSCGKmSPxTJPc+JY8KyuVl8F6T4lhy MqJJY94KEqV/4JQfB9vhH+xb8OZbuAQa18UrjUvi1q42FWaPxWLW38NMSyq7B/Bek+G5juG1ZZpR GWQh2/q/gxrgX6K3ijxVJ+xzXxY4wyDw0yWe2IWSZBTlxHxHiKHV4PHKp/ZOLk24upThBpS5W/7e 8PmvDX6FHjNxtN+wzvxw494Y8H+Hpv3cTHh3hilPi7i3FYZKzeAzFVFkmNm24OtSp0moy5XL5tub 9P2fv+C0Wp+JPGrwWvhz9rX4N6T4Q8EazNKttY2ev2mm+ANFtdHuJ5Tsm1TUfEPwkh0i0s4ysslx 4x8PoqlrhN/zt+2ki/spf8FXPgP+0VGxsPCnxRl8LXnia7iHlQRIbdvhN8QlZGZYZWt/CV1pOuTZ KLLd33mvtnBnb9c/20v2OvCX7Xvw9sdJutSuPCHxM8D3F3rnwn+IthJcR3nhTxDN9kleK5FrJHPP omqz6bpo1JIGS+tZbKy1PTZo72xjWX+cf9v74p/tCax8Ofhz8D/2w/hnqWifGz4QeIb+TwV8X7aN Ljw/8UvAmq6Zb6brxmv4S2najrRvdK8NalLruiXLQ3q281pruh6FrkEkl/8Avf0dcXlnipxFwRic FmGE+v8A/EJcw8BfFzg2vicPhcyxfB9HKMVl/C/GPDmGxFWMc7y+NHDZFgOJcPhWsdlGKwUsdUwd TB4v63L+nfooY3J/Gvivw5xWX5pgHmf/ABA3NfoyeOvh/isXhcFnGP4CoZDjsr4M4+4SwmLrRhxF ldPDYLhrLOLsNgrZjkWMwEsyq4Grl+PeOl/YFUU0MNzDNb3EMVxb3EUkM8E0aSwzQyoY5YZopAyS RSIzJJG6sjoxVgQSK+RP2Jf2jfCP7Qn7Pfwm1+28beHtd+ICeAtCsviDodvrenXHibTPFmiWceje IrjWdES4OqaaNR1WxuNUs2vbWFbrT76zvbd5rW6gnl+wK/zz4l4ezbhDiHN+G85w1bB5rkeZYzLc XSq0qtCar4HE1MPKrTjVjCbpVJUnUo1LWnTcZxbTTP8AKni/hXO+BOKs+4S4gwmIy/OuG83x+UY6 jWo1sPNYnLcXWwk61KNaFOo6FWdF1cPVUVGpSlCpBuMkz+dT9tX9gP4jfsueOpf2yv2HLrU/D8Ph y9ufEni/4feHYhJceD4XL3Gsap4a0oK9vrfw9uo/MXxH4KntrmLRrKSWS0trnw0str4e/R39g3/g oJ4A/bI8KrpV6LDwd8bvD9gsvi7wCbk+RqcMIijm8VeC3uXa41Dw9cSupurGR59U8N3EgsdRe6tX 0/WdV/Q7r1r8D/28v+CcHifwX4pP7XX7Ekep+FPiN4Y1X/hLPEXw98HRrb3D3kXmS3vir4d2ECGM Xrq0x1/wOlvPYa9Zz3q6ZZvLLNomqf1Twtx7wp9IDIMs8MPGnM6GS8e5Xh45d4aeMuLUebthOE/E Cv7s8blVes1TwmdV5yr4SrUdavUjWniq+Y/2xwV4ncEfSi4Xyfwb+kNnOH4d8Tcmwscp8H/pAY5J z1tHA8D+KOI0qZjkmJrtUsDxDiZyxOArVXXxFaGInjcRmv74UV+Wn/BPf/gpB4V/au0uD4dfEP8A s7wZ+0HolkwvtFyLLSfiBb2ERN5rvhGKd98OpQJFJca74VZnutPQS6hprXelx3n9l/qXX81ce8A8 VeGfE+YcI8Y5VWyrOcvmuaE/fw2Mws3L6vmOXYqK9ljcvxcYueHxVFuMrTpzVOvSq0qf8g+J3hhx t4P8ZZpwJx/ktfJOIMqmnKnP95hMfg6rl9UzXKcbFewzHKsdCEp4XG4eUoT5alKoqWJo16NIooor 40+ACsvXND0bxLo+qeHvEOl2Gt6FrVjc6Zq+j6raQ32m6np17E0F3ZX1ncpJBc21xC7xzQyoyOjE MCK4z4v/ABb+H3wG+F/jv4y/FbxFbeE/h18NvDOp+LfF2v3MNzdCw0jSoGmmFrYWMNzqOq6neSCO x0jRdLtbvVta1W5s9K0qzu9RvLa2l/mC+On7V37SP7ad1eXfjnWvGX7PfwBvxKnhn9m3wB4qvfDP i7X9Cedjaap+0X8SvCN7Z+INd1vWrARtqvwj8F65pfwv0Ozvrzwp4qf4rz2w8Rv9/wCHnhnxV4n5 vPKOGcHTqLDwhVzLMcZOVDK8soVZSjTqY3ERp1Z81aUZxoYahRr4qvyVZUqEqdGtOn+HePP0gvDH 6PPCcOJPEjMqsIZnPEYPI+Hctw9PH5/xNiaNOEsVhcry+rWw9CdLD0q1KWOxuPxODyzCKvh6WKxd Oti8JRxHsWvaJ+yR/wAE/f8Agof8MPGVr+0j8I4/AdpffEGTxF8LI/iBpPir4z/CmfV/hv4x0mDT 7/4aeHbrXviTrfh2W81a1h0PVbfw5eahEzLpetjz0t9X1X9E3/4LQ/8ABPdZvKT4gfHi5j3hPt9j +wx+3fqGjZJwG/t2x/ZquNF8vkHzvt/lBWVi4V1J/CTwh4F8FfD/AEqLQ/AvhHwz4N0aFI0j0vwv oemaDYKsQKx5tdMtraFmUM3zujOSzMWLMxOxa6zpF7qGqaTZarpt3quiGzGtaZa31rcahpB1G3N3 p41Syile5sDf2oNzZi7jiN1bgzQb4xur+ssm+hNlmDw/Lm3HuIeJxNRzVDLcmoUMPSrOledKjUxe PrVcTFRpSqL9zhpKKn+7jGN1/klhv2ok+FK2eYXwz8DMFgeHsXnFfPKlLP8Ai3FYyrQWJo5dl83S w2V5JhKOVYapVw9Dkw88bmVKhXxCo0a/s5UaMP6M/hh/wUn/AGEvi94h03wd4P8A2nvhhaeONadY 9E8AfEDU7z4RfEPXZGIUx6H4A+LNh4J8Y61JGzIs6aXol29u7xrOI2kQN9v1/G9rOk+E/GNnqvhj xDpnh3xVp7Qi21vw7rVlpmuWTW+oW77bfVdIvorqBoL21Z8Q3luY7m3Z/leMtn0X4JftEftA/sZ6 jYaz8Dta1n4kfBrS5APGP7J3i7xBc6p4dvtBhP8ApR/Z98Ra/eXNx8EvHGlW+6Xw/wCELK7T4K+J ZY5NB1rwl4V1PWk+JPhv4bjv6I/FfD2AxGa8J5zh+McPhYVKtfLVg5ZZnXJSb9osHh1icbhswnSj GTnThicNiqkl7PDYSvWcab/pjwY/ai+GfHWd4DhrxO4Tx/hVjsxq4fDYPP3m1PiHhL22IUFQlmuN eX5RmORUcTOpTVLEVMBmGXUIT9vj8zwmFjKuv63KK8w+C3xi8AftA/CnwJ8aPhbrLa74C+Ivh+08 ReHb+ezutMv0t7gvDd6XrWkX8UGo6F4i0LUYLzRPEnh/VLe21XQNe07UdG1S2ttQsbmCP0+v5Iaa bTTTTaaas01o009U090f6ixlGUYyjJSjJKUZRacZRaupRaummmmmnZrVBRRXl/xk+Mfw9+Anw78R fFH4n69b+H/Cfhu1M1xO5SS91G8dWFjomi2RdJNT1zVZ1FtpunwkPPKxeR4baKeeLry/L8fm2Pwe V5Xg8TmGZZjiqGCwGAwdGpiMXjMXiakaOHw2GoUoyqVq9arONOnThGUpzkoxTbPQyrKszz3M8vyX JsBi81zfNcZhsvyzLcBh6uLx2Px2MqwoYXCYTDUYzq18RiK04UqVKnGU5zkoxTbKPx0+Ofw5/Z0+ GviD4qfFDW49H8N6FARHDGYpNW17VpY5G0/w74esJJYTqWuarJG0VnaLJHGiLNe3s9pp1peXlv8A zteAvBHx0/4LFfH6T4lfEttV+H/7LXw61NrLT9IsriY2VnZM0c8vhHwncSQQ2+teOddhht5vGXi9 7cpo9rJbfuIreLw3oDxeGvDPx0/4LJ/tBt4z8XjVfhz+yt8NNTaytLS2kd7bTbBpYZ5vDugzSR/Y 9c+JviWz8ibxH4ha3ksfDti1q0kP2WHQNE1T+lb4ffD7wZ8KvBnh74e/D7w/p/hbwd4V06LTND0P TIjHbWltGWd3d3Z57q8u7iSa81DULuWe+1G/nuL6+uLi7uJpn/szE4jJ/olZDUy3L6mAzr6SnEWW ulmmZ0pUMfl/g1k+Y0E55dl9ROrhsTxrjsLVSxOKhzwwFKo405PBOP8Abn+geMxWQ/QZ4ZrZRlVX LOIPpecV5Q6WdZxRlhszyr6P+Q5thoueU5XVTrYTGeImY4OrbF42n7SnllCq40pPL3D/AFjn8DeB vCPw08I+H/AfgTQNP8MeEfC+mwaToWh6XD5NnYWVuDtVclpZ55pC9xeXlzJNeX13LPeXk891PNM/ V0V5J8Vfj18F/gdpjat8W/id4M8A2pge4t4PEOuWdrquoxx7tw0fQlkk1vWpvlbFvpOn3tw21tsR 2nH8d4fC51xLmro4TD5pn+d5piatV0sNRxea5rmOMrzlVrVOSlGvi8Xia1SUqlSdqlWpOUpybk2z +B8JguIeL87dDA4TOeJ+I85xdas6OEw+OzrOs1x+KqSrV6rp0YYnHY7F4itOdWrPlq1qtScpzcpS bf4C/wDBUPW9M+JX/BRb9mn4U6vf29r4P8Fab8P7jxld3kqRWei6dr3jW+8TeOtVvJHXZDaaf4C0 nTdTupHLKtvbSMwAXn6v/wCCVOm6n8WviX+1/wDto6pZzWem/Gf4nXvhvwDBeIwvbfw1pOpXmuXs bSscTW0FpqPhDREliVYzfeHtSjwDEI4vyA8d6F4v/wCCk3/BQf4lXHwGurk6L4uv02eK7+O40i28 P/Cfw3oWgfDzUfFmo2F1La6ithfaZ5ONDZIdT1ObXIdLns7We8uI7f8ArQ+CHwd8G/AD4VeCvhB4 CtZbbwx4J0hdOtHuGEl7qN3PPNf6vrWoyAKkmpa3q93fatfmJY4FuryWO1hgtkhgj/0L+kJnOV+F PgH4beEqruHH+d+HPDGWZ9kbh7PE8KZTic0p8Z8WPHR5lPD47iDifC5LgKeHq041KmEyTMalTkjO Crf6p/So4gyXwS+jD4R+BscS6fihxF4S8GZPxPw26apYvgjI8XnVLxB44eZx5lUwmZcU8ZYLh7La WEq041auB4dzarV9nCrSjX+AP+Cv3wDHxg/ZM1jxhpVn5/ir4HamvxE08wxF7ifww0f9neO7EFVY x2sejzReKLtgAWbwtAC6qX3ejf8ABLv49t8ef2Qfh/c6ne/a/Fvw0WT4VeLC8hkuJJ/CdvaL4ev5 y5M0smpeELrQLi6upAftGqf2kA7tE5H37q+k6br+k6poWs2UGpaPrWnXuk6tp10nmW1/pupW0tnf WVxHkb4Lq1mlgmTI3RyMuea/m+/4J0alqf7G/wDwUH+Nf7Hviq7mi8P+O7nUNJ8MTXbNHHe6r4Yh u/F3w41k+afLhbxJ8P8AU9UjdYyXutUvdKst80kMS1+McB28Ufo1eInh5Uft+JvB7MF4scIQa5q9 XhbFL6jxzl1G3vQwmA9p/blWKjJ1sdisPG9o3h/Pnhlbxo+iF4reFVR/WeMPAPNY+OHAcGufE1uC 8av7N8Scow9ryp4DLFVXEdaEYSliMxxmFjdKN6f9KVfm9+3b/wAE5vht+2Bo1z4n0f7B4D+OmmWH laH46htcWHiNLVMWmg+PbW1jM2pacygWtnrcKSa3oKmKSAalp9u+iXX6Q0V/OfBPHHFPh1xHgOK+ Ds4xWSZ5l0+ajisNJclalJxdbB43DzUqGNwGJUVDE4LFU6uHrxSU6bcYtfyZ4d+I/GvhRxblfG/A Gf43h3iPKanNh8bhJpwr0JSi6+AzDC1FPC5jluLjCMMZl+NpVsLiYJKpSbjFx/nd/ZR/4KD/ABU/ ZP8AHqfsi/t7WGsabF4fns9E8L/FDVma9vfDunyEW2knxHqaGRPFvgG7hVG0jxtZTXV7pUKNDqZ1 HT1eXQP6F9P1Cw1axs9U0q+s9T0zUbWC+0/UdPuYbyxvrK6iWa2vLO7tnkt7q1uIXSWC4gkeKaJ1 kjdkYE/Ln7WX7HXwh/a/8DN4W+ImmfYPEWmRTv4L+IWkwQL4p8H38qk7radwo1LRLmTb/a3hy+c6 fqCATRmy1S3sNUsfw5+F3x6/aZ/4JL/E20+Bn7Q+l6p8RP2b9Zvbq48K61pfnX0Nrpzy4m1z4Zal fzQxWzQSPHceJvhtq1xbC1uZmvbL+zpNTGra3/UGYcI8F/SbwGL4m8MMFlvBfjZhcLVx/FnhXTqQ weR8cSowdXG8QeHtSvUVLDZhUSniMdw9UnG7c6kZKdOeYZr/AGbmvAvh79MXLMdxj4N5dlHh99In BYOvmfHHgpSq08Bw54jyoU3WzDijwqqYmqqOEzSqo1MVmXClWpFtupVjNVKNTNM6/p0orhPhp8Tf Afxh8FaH8Q/hr4m0vxd4P8RWq3WmaxpVws0TdBPZ3cR23Gn6nYy7rbUtLvore/067jltby3hnjeM d3X8eYzB4vLsXicBmGFxGBx2Cr1cLjMHi6NTD4rC4mhOVKvh8Th60YVaNejUjKnVpVIRnTnGUZRU k0fwNj8vx2VY7GZZmmCxeXZll+Jr4LH5fjsPVwmNwWMw1SVHE4XF4WvCnXw+JoVYTpVqFaEKlKpG UJxjJNIooormOQKKKKACiiigAooooAKKKKACiuB8R/Ff4W+Dy48W/EnwD4WMSlpB4j8Y+HdEMagZ LONT1G12KByS2ABzmvyd/wCChH/BUj4efCv4dzeBv2aviF4V+IPxZ8aWl1aL4u8E65pfijw/8NtH YyWt1rUmr6VPfaVd+LZ2WSDw/pEVxK2nuH17Vlit4dKstc/SPD3wm498TeIso4c4W4ezLEVs2xNO j/aVbBYulk2X4dpzr5hmOY+wlQw2DwtCM61SfNKrVUVRwtKviatGhU/W/CzwN8TfGLivIuE+C+Fc 2xdfPMZTw6zfEZfjqGQZXhWnUxOaZtm31aWGwmX4LDxqYitPmnWrKCw+Do4nGVsPh6vLf8FM/wBv PXrLVP8AhjX9l+a+8Q/GTxvdQeFPHGt+Fna41Hw2daaO1j8BeGp7V8/8JnrCT+Trl9HIg8K6dK9q sia5czzeHvq7/gnj+wV4d/Y68AHVfEEena78dPGlhD/wnPiiBVuINCsZGguo/Avhi5dFdNEsLiGG bVb1BHL4i1eBL24xY2WjWen/AIufsHfH79iL9kPS7r42/FfxT4t+L37S3iqLUGfTvCnhHVtWPw50 /UpH+22Fvr/jF/DGh6v4w8QLK83ibxLY6xqEEVvLJomlXskEmrXmu/oaf+Cp/wAe/ijmH9mf9gv4 u+NLW4BNn4t8VrrNvocYYSrGb2HQfDlzosSu65DS+OrVW8uWJCzHzI/7S8SfC/xFyDg2Pgl4ScI5 jkvh/hMTTxPiN4l8YYrKeAoeJXEuG5fa1liuKMwymX+p+U1IcuU4PDSr0MZ7OGKpfXacKePzH/Qv xd8GPFjhfgCP0dfAvgXNuHfC7AYyli/Fnxf48xuSeGVPxf4vwnL7bELGcZ5pkk/9QsjqwcciwGEn isNj/ZwxtH+0KVOlmeaftjX5u/8ABQj9s34EfBb4I/F/4c6t450vVPi14y+HPjHwb4a8AeHJ4NZ8 SWeseLdA1Dw7Y6p4gtraYQeGtJ0yXUf7UvptbutPuruws7uHRrbU9QMFlN8zD4I/8FTv2u3kPxy+ LWhfsj/DG9dkuPAfwwZJvF15YOxV4ZZvD2t3moSwXtsvlXMWvfEgQq0haTwwUaW2rmP2o/8Agn1+ zB+yL+xN8evHfhrwzfeMviTB4W0fSofiR8Q79Nd1+1vfFfjHw34ZnutFskgs/D+hXMx1qeOO903S I9ZEE720uq3Ad2f8c8O/C/wq4c8QOB8t428ScNxnxNmHF3DWXYHg7wppxznLKeY4/OcFhsEs/wCP cesLkscFTxNSEcxwvDmHzvFVKSqU8PjMPJwrn4F4UeDXglwl4o+HGT+Ivi5hfELjHNeOuEMqyzgH wSpR4gyenm2Z8QZdhMujxP4m5nHBcPRy+li6sIZpguEcLxFjatFVKWFzDCzlTxBgf8EL/wBn/QLH wZ8Qf2nLu61J/F2t6trvwc0ewEkaaRaeELBPBHivVb8xKDLc6lquvx2VqHlZUsLXQyIA7alcGP8A fe9srPUbO707ULW3vbC/triyvrK6hjntby0u4ngurW5glVop4LiGSSKaKRWSWN2R1KsQfzH/AOCO +if2T+wn8PL/AGBP+Em8V/EnW92CPM+z+NNV8N7yf4iP+Ef8vI4xGF6qa/UKvh/pQ8S5hxH4/wDi djMZjauIllPFmZcPYCTkl9UwXDmJnlOGw1DkUVThQlhJy920pVpVKs3KrOcn+cfTN4vzXi36UXjJ j8fmFfFzyPjjN+FcslKaj9Ry/hLGVMjweDwypqKpQw0sDUl7qU5V51a9SUq1SpOX8zP7PV9P/wAE 2/8AgpZ4v+BXiG9uNO+CXxuuLTS/Dt5eSsunppPiO+uL74Ua/cSyBFmn8O6zNqXw81bUJDBbwNea 9qMgEFvFj+mavxr/AOCzX7NT/FD4D6d8cvDNo58bfAeea/1GS1Ui7v8A4d6vPbJrwLxsjs3hnUIr DxHBIxYWOnR+IZIwrXDNX1v/AME9v2l1/aj/AGZPBPjbU72O58eeHEbwL8SYw6tOfFvh2C3jbV50 G0r/AMJRpM2meJfkQQRz6pc2URY2cmPu/G+MfFjww4A+kHg0q2f0YUPDLxcUEnUXFGR4SH+r/EeJ UVzt8Q5KqaxOIlyYajWhl+ApXqqd/wBL+kdCHjh4NeF/0p8viq/E+HhhvB7x1jSSdVcZ8OYGn/qt xbi4xjzt8U8PKksZipcmEw+IhlWWUOaspo+3aKKK/kU/hIKKKKACiiigAooooAKKKKAPlz47fDnx 543+O3/BPjxN4Q0e41Pw98H/ANrfxz8Rvipew6hp1lH4d8B6n+wR+258JNO1i7tr2+tLnV7ef4n/ ABS+HHh9dP0i31PUYrrXbbVZbGPSdM1TUtP+86+DPjt8OfHnjf47f8E+PE3hDR7jU/D3wf8A2t/H PxG+Kl7DqGnWUfh3wHqf7BH7bnwk07WLu2vb60udXt5/if8AFL4ceH10/SLfU9RiutdttVlsY9J0 zVNS0/7zoAKKKKACvj7/AIKGeKPiL4I/YD/bj8afB++1/S/i34Q/Y+/aY8UfC3U/CltLe+KdO+Iu gfBfxrq3gm+8NWcFvdz3ev2nia00y40e2htbmWfUY7aKO3mdxG32DXx9/wAFDPFHxF8EfsB/tx+N Pg/fa/pfxb8IfsfftMeKPhbqfhS2lvfFOnfEXQPgv411bwTfeGrOC3u57vX7TxNaaZcaPbQ2tzLP qMdtFHbzO4jYA9xooooAKKKKACiiigAooooA/nX/AOCx2var8ZP2hv2Wf2SPC100l9qt/ZarqVtA A6prnxJ8R2vg/wAOS3ZbCRvo+m6VrF+QzIsVlrDXFwRE0br/AEIeHdA0rwr4f0LwvodstlonhvRt M0DR7NSWW00rR7KDTtPtlJ5KwWlvDECeSEBPNfzrfs0f8ZY/8Fgvi58YZf8Aia+Dvg1P4svNCu/+ Yc0HhG2tvhP4HaAfKQb+Sa58X2akKz3FpcXMoDh0b+kGv6u+kf8A8Yjwr4E+D1P93V4N8PKfFXEV BWjKlxb4iYp53meFxUVaVSvl9ClhYUZ1Y81PD4pQhaEmj+3fpbf8YLwV9GnwEo/ua3h/4VUuNeLM NH3J0eOfFbGPiPOMFjY+7KpiMswtDB08POtFTpYXGclPlhNxCvAf2ofgpon7QXwH+Jvwu1bRtM1e 98Q+ENfi8Jy6lbW0x0Xxqmk3h8Ka7YT3Cn7De6brJtJkuonhfyfPt5JPs88yP79RX8yZLnGYcP5x lee5ViJ4XM8nzDCZngMTTlOE6OLwVeGIoVFKEozXLUpxuoyTcbq9mfx1w9n2acLZ9k3EuSYqpgs4 yDNMDnGWYulOdOph8dl2Jp4vC1YypyhNctalBtRnFyjeN0mfyL/8E3f2Kfg9+174c+K2keKPF/xE +G3xm+FfiLRdR0jW/CeoWMCf2Br1pd2UMd9o2pabPNLc6Jrug6iZ59M1TRryP+1LSG4mZREB+mNv +xj/AMFPfglKsPwG/bi0z4heHoAUh0f4zW+qXE8dqBiKzs7XxNo/xYs7dIxhVNlrGjIgXMQiDGMf OvwJ/wCMTf8Agsj8Sfho/wDxKfBnxxufE1rpUI/5B5t/iBZW/wATvCcdsh3MPsfiazk8IWbAboJJ riAt5LSOf6Qa/vX6Svjbx7kXHeW5hg6+Q8V+G/iNwVwrx/w1w1xzwtw9xhlGBwueZZTo43B4arm2 XV8dhHRzTBY2tLDYTHUFh/rFOMqcbU0v9OfpffSL8TuGvEvJ80wGJ4Z428JPFnw84K8UeEOD/Ejg rhTj3IstwXEeTUqGY5fg6+eZTicxwLw+dZfmGIng8BmeGjhfrdKEqcbUrfi2fFn/AAW68IYX/hWX 7OfxS8rC+YL/AMP6f9o2nmQg/EH4chd/cBIMdkU0f8Lu/wCC3X/Rnv7Of/hT6B/9FLX7SUV/Ov8A xHbL5+9iPAbwBxFV/FV/1R4mwXN/3AyvjXAYOHpTw0F2VrI/k/8A4mWyup72K+jJ9F7F1n8Vb/UX jHL+bb/mGybxEyzAw1V7UsJTWrVuWyX8nPxz/Yy/4KUfFv4qt8ex+yj4J+Enj60lh1++1P4H+P8A wL4fl1HxHpkzX8fi1dOuPjf4qvx4teSON5Lvw6LK61S7jS6mtbzV55rq49H+DX/BVj/goX498WaH 8DfDHw3+Afi34pW0UuhG2+INhf8AgPxV4g1rRE+zahBqT658Yfh94Y/4SyaaGVrjQ9LsNMuZ7qO5 Sw0VBDJFF/T/AF+S3/BQv/gmzpH7R8M3xk+Cos/BP7RmgJFqC3NpMNG0/wCJJ0tVlsbXVb6B4F0n xjZtDCvh/wAYFkYmK30vXZvsMen6noH9B8D/AEmeBfEzEZTwN45+HHhlgMpy7LpZR4f8UQyXiLG5 VwbjKlP2WGocQYbMOK8Tm+K4aqzhhadVYHO8uhgI4al7aKwv+2Zb/U3hv9MTw18YMVkXhv8AST8J fB3LMiynKpZF4XcZ0+HuK8xyXw/x9Wn7DCYbinB5pxvjM9xvB9WcMFTrLLeJMpp5XTwlFV4rBv6/ lPCf8Lu/4Ldf9Ge/s5/+FPoH/wBFLR/wu7/gt1/0Z7+zn/4U+gf/AEUtYP8AwT9/4KT6xrOvp+yz +2DJc+D/AI1+Hr//AIRbw94w8VQnRpvFWo2bC0Xwr43F55K6d47WRUh0/VJVjtfFxaOGdo/ETwSe I/3Cr4DxN4kzXwm4mrcM8VfR0+j9Co6ccZlObYLh/jjE5LxDlNbXC5xkmPXiBGnjMDiYNNNKNahU 5sPiqVHEU504/l/jFxdnXgdxhiOD+NvonfRap1XShj8kzvL+FvEfF8P8U5HX97BZ9w7ma8UY0swy 3F0+WSlFRr4arz4XG0cPiqdWjH+XH9vf4n/8FF/Fvgj4J+FP2x/gd8M/hT8CNd/aR+H39s6v8P8A VNO1SXXfGOgeH/G/i74WeHPEsNh8YviQYdAk+J3h3wlrlpPc6Rp1v/wl+g+FLcaylzcW+lat+Wf7 b/xN+LXw40L9niw+DnizS/BniX4rftUfC34Panres+GtP8WafD4c8aaT4za/E+j3zQNOsV5pmm3v +gahpOoSi0NpBq1jHczS1/bJ+0z+zz4C/ar+BvxC+AnxJ/tS38MePtKt7dNb8P3UVh4o8H+JNG1K y8Q+DPHvg/UpoLqLTPGPgLxfpOieMPCuozWt1BZ69othNc2l3bLNbS/yZfHf4W+Nv2YfEnhz4c/t 4+CPCMkXhzxfper/AAf/AGnJ/C9rc/s9fEnxHp0l3aeEPFmheJNYhv7D4F/HEQXM8N18OPGGoaLr 1prF1qifCzxD4+8LsNbb7PwY8XOGuJsJxNwhLK+DvCTOs8xOAxGU1eEoZxkWUY2NH6vSxVD61mGd 5pjcNm0qVGcaDjmVGOIWKlDDU4VoSVb/AJ3P2pvCvFXiN4s+Gn0k8h8HOEsRwLwRwbiOD+KfC/w4 4fzDFZFl+IoYvP8AMsFxhX4Z4mzXiyvmMcyq53h6Gf4n2tbCYWhw3lM6+DpUXUxEfxt+OP7SX7Vv wu1r9sqy0/8Aac8Mhv2RdH/Zm1TQ9D1/4U/D06v8YtS8deCvD9z4q028SzitLjRrDxRrt5dSND4e srnULLVNV0yy0XVdC060e2vbg+OfiX4d/wDBQj9oLwzHPcfDLQvjX8YP2NvDPjP4nalp+lazYeCT bfs83Ov6Z8N5EvUvdNsvFPxX1aBfBGj+IL+zudH0e1TXr6N11hdEYfo/Y/sg/BG8+NnxO+P/AIp8 L+GviR4o+JuqfDPxDpn/AAmvhXwp4ltfAOpfDbwjF4U0nU/Ad/faVc6hpdxqtrDaalfXcd20jX1p Zz20kS20Gz2TXfg98I/FA8XDxN8Lfhz4iHxAm8O3Pj0a74I8M6uPG1x4QSKPwnP4uGoaZcf8JJN4 Xjggj8Oy6z9tfREhiTTWtljQL+7R8PeNcTiHjp8T18NLA8XY7OMqwuNzbOM45ssoYjxCweDovE18 VVq5Us1yDibI8qxCyurTr4TA5bPFe1lmrpqh/lVU8dPCHL8DHJ6Xh1gswhnPhdk3CvE2Y5Pwvwpw rycQ4vAeBWa5rill+Cy3DYfiX/Vrjbw74x4mwT4joV8Fmec8QU8t+r0+Go13jPkr4TXFn48/av8A +Ch3w88UaN4bm8MacP2aNNnNhoGkaDret2HiP4NXF7qMHinxTolrp3iPxOsTZtdLfXdVvn0bTWfT NKe0sHa3Of8A8EvIba2/ZE8PWdqsccFp8UPj9bwQxnKw28Xxx8fxwRgZJCLEiqmTyqjBNfaN78Lv hnqX/Cb/ANo/DvwLqH/CzLPTtO+I/wBt8I6Bdf8ACwNP0fTjo+k2Pjfz9Pk/4Suz0vSGbS9Otde+ 3wWWnMbG2SK2JirhP2ffgdYfETxnr3wY/wCCdXwN+Fdl4u1q/tNL+K3xZ8C+ANA8LfAP4Lrpsdx5 Gt/GXxj4M0vTdO8U+LtCttUv5/CPwa0G81T4ga/f3bQXVt4P8KXeueNNI9HNpYDw8xOE4y4qzrKM LlmV0vEOOIxOIr1YZpiqXFvFVPiTLMvy7DPDzqY+rltDC0MBDCU6ydSWIq1qMKdPDqOI8HhmOd+O 2X5n4T+GvCXFOY8RcR4jwJqYHLsDg8NV4cy3E+GHhrX8P+Ic+z7MFjqNDJcNxBjMxxud1c0r4SUa FPA4XC4qrXr411MF94/sJ/Er/gof4O8FfGbwt+xp8Efhr8WfglpH7Q/jqaDVPiDe6Xoknhzx14h8 OeB/FvxK8M+F4Lr4tfC8XXh4+N/EGteJr6+t9H1iOfxr4m8XpP4huL+G90vSPuD/AIXd/wAFuv8A oz39nP8A8KfQP/opa/ST9lv9nPwV+yf8CPAHwH8BXOp6rpHgux1GbVPE+vG2fxJ458Z+JtZ1HxX4 ++IPiiWygtrOTxL488a63r3ivWxZW1rp8F/q01rplpZ6bBaWkHoPxR+KHgb4MeAvEnxL+JGv2nhr wd4VsH1DVtUuyWIG5YraysraMNPf6pqN08Njpmm2iS3d/fTwWttE8sqqf4VfjXgc5zuphsq+j74N Z1i82zarTy6GM4b4xx+f5nXzDGz+qU8RHLeNsJQxeaYqdanCpHA4HD062Jm1h8NTjKNNf9gfgV4k y4G8MvCHwhf0d/AHxI4n4R4H4E8O3xFmfCXiJmnFfHOeZFkeV8OvN8csB4jYOOPzziLHYX63XWDy 7CrE43FzVHB0edUV+LPxR/bD/wCCu/wV8Eaz8Rvil+zP+zD4N8GaBFHJqet6l4m0iVEaaQRW9rZ2 Nj+07d6lqmo3crLFZaXpdle6jeykRWtrM/y1+anjPV/+CgH/AAVg1A+J9F+Hln4l8J/DL7Np0fhv wfqWleAfhvo+s6jHJLcXVufiL45jfW/FF9aqn9pSRa7qt/puntZxpDpdjeQJc/REs3x3/wCCzPx/ +zwf2t8M/wBlD4X6tlnKJNHpFtOr7ZZh5gsfEPxV8UWSbEjR7rS/BelXG7E1sZZPE39I3wr+FfgP 4K+AfDnwz+Gvh+z8M+DvC1itlpemWgLMxJMl1f390+641HVdSuWlvdT1O7eW7v72aa5uJXkkJr+m OJfEzhn6NWW5HVpeFng5Q+kdiaaxuMy/hvKM8lkXhvkuYUKbjgM7xGI4qzLF43irH4Oc4yo5TmeW wwmHxU51atXBLCzz3/Rfi/xh4P8Aog5Rw5XoeCvgFhvpaYyksxx+VcI5FxJLhrwk4ezXDUXHLOI8 ViuN83x2Y8a5nl86kJYfI84yiGAwuNqVK1avl/1SpxJ+Mnw18S/8Fg/hB4H8O/Dj4dfsOfsy+F/B 3hXT007RtH0/xHoCxxRhmknubiVv2pWmvdRv7mSa+1PUruSa91G/uLi9vJ5rmeSRt7Wviz/wXI1W HyrH9mP4HeGn2kfadF1/4eTzEnOG2+I/2hNft9w7AQbeOVPOf2/or+YK/wBITC4rH180xngP4CY7 MMXia2MxeLzDhzjXH1sXisRUlVr4jFyxniBX+s1q9Wc6lWpXVSVSpKU5tybZ/GuI+lRgsbmeJznH /Rm+jHmWaY3F4jH47HZpwl4iZnXx2NxVWVfFYvHSx/ilifrmIxNac61eriVVnVqznUqOU5Nv+ab4 keCP+C7/AMT4GstYg8S+HtOaOSM2Xw++JX7Pvw+JSUFZFk1Lwl440rXLhXU7StzqsyqowiqSxb5c 8O/sDft2fDjUdc+JfxH/AGQ/h98YG022u/EWraj8Z/i74e1yytINMtZbu+1HULbwn+0R4SbW0ito ZZp4NdXWYZVTH2Z8Ktf1+V8ef8FAfHf/AArj9jD9ozxKs32eab4bat4UtJgdrx3vxAltvAVk8R2s RMl14kheIgZWRVbcmN6/sHh79LrjvFZvkXAHCnhb4J8MYXi7O8n4cnR4T4V4n4brVnnGZYbAxX1j I+NcDiZTlUxCcm6jdRtqpzqUk/3nws+nZ4l4zPeGvDDgnwW+jrwdg+O+I8g4SqYfgjgrjHhHEYiW fZvhMthF4vhzxEy3FynOrik5SdZuq5SVXnjOcZfzc/8ABOS9/bX0nxj8XPi/+yF8CPhn8R7zUYIP Cvi0eKrvR/D/AIf8MQ67qjeJ4dJ8MWF58T/hxLHDJLpkG63tZ9Wt7Gys7CGVLZpLd5v1l/4Xd/wW 6/6M9/Zz/wDCn0D/AOilrqv+CKHgP/hFv2OZfFUsG2f4mfE/xh4jhuGTDzaZoaaZ4ItoVfYpeCDU vDOsOg3OqzXFxhgSyr+vVP6R3jtlcPGnjzLH4ReEPFVPh3NlwzRzrijJ+K8dnVeOQ4ahlteli8Rl /GeV4OSw2MoYqhRjRwNDkowpwqe1rKpWqX9LX6S+TU/pC+JmTS8CPAfjalwpni4Pw/EHGeQcbZjx FiY8MYTDZTiaGOxeVeIGTYCccJmGGxmGw8cPluG9nhqdOnWVWuqter+Lf/C7v+C3X/Rnv7Of/hT6 B/8ARS1+WX7cVj+3xoPxN+HP7ZP7QPwM8DfBvxD4S1vwZ4d0DxJ8PNZ0TU9I1DxL4Zv9W8W+F5fE OnaZ8VPiHqovfKsruya/ll0ywudN0+z0qR/PFusv9eNfNX7YHwLt/wBpD9nD4q/CQwwSax4g8NXN 34RmuNqLZ+NtCZNa8JzmdvmtoZNbsbSzvpkIY6Zd3sJ3RyujfNeEn0mcn4Y49yHE4rwf8HeGckzT FU8g4ozXh3JeK8LmdHhjOa1LCZw6c8w4zzPA1KVPDy+s1qGKwOIpVo4fk5YTcKsPj/Az6YOQcHeJ 3DOLxngJ4BcH8O5zjaXC/Ged8KcPcb4LOKHB3EFejgM/9nUzXxCzjLatClhZfW6+GxuW4ujiIYbk 5KdRwrU/zB8AftV/8FjPij4L8M/EPwF+yv8As2eIvBvjDSLTXfDutW/iDS7WPUNMvU8yCZrPUf2n LPUbKdfmiubHULS0v7K5jltb22t7mGWFOv8A+F3f8Fuv+jPf2c//AAp9A/8Aopa5r/giH8cbrXvh P8Qv2c/Ekk1v4h+DviKXXNAsL3fDdxeE/Ft7dtq2mray4ljbw/4yt9Tmvw6oYZPFFnAUDKxr9yav xi4wwHhV4l8XcCVvAPwHr0MjzSccqxlfhzjR1cfkeMp08fkeOqSpcf06E62JyvE4SpiXQiqUMU69 KCj7NxWnj7x7lngn4v8AHXhpX+jB9GbE4bhvOqkMkx+J4T8QpVsz4bzClSzPhzMqs6HihSw9SvjM lxmBq4t4aEaEMY8TRhGPs3Bfi3/wu7/gt1/0Z7+zn/4U+gf/AEUteUfGg/8ABW39oLwDq/w1+K/7 Cv7MvijwvqyF1juPEnh+PUNI1FI5I7XW9A1NP2pPteja3Y+a5tdQspI5Qkk1rOJ7K5uraf8Afuiv gMt+kLQyfH4PNcp8DPAzLczy/EUsXgMwwOR8eYXGYPFUJqpRxGGxNHxEhVo1qU4qUKlOcZRaumfl +UfSqw+QZpgM7yP6Nv0bMozjKsXQx2WZplvDniZgswwGNw1SNXD4rB4vD+K9Ovh8RRqRjOnVpTjO MldPc/j/APA9t/wUa/4JXQz/ABCv/hyPD3w+8X3n9l61oPibVNA+Inw21HWRbldOu9btvh343ubv w3rUaDbpWqHV9AudUWB9OM+p2kM9kPvD4G/t9/8ABU79pLw5feK/gl+z5+y/460bS786bqhtdctt H1TSrzDNFHqnh/xH+0po/iDTUukV5LC4vdLgttRijllsZriOKRl/ffxF4c0DxdoWreGPFOjaZ4h8 O67Y3Gmazoes2VvqOl6pp90hjuLO+srqOW3uYJUJDRyoy9CMMAR/OJ+01+xF8cf+Cf8A4+m/ap/Y h1vxDL8PNOeS98WeCYXvNbv/AAlo5mFxfaXr+ls8r+OvhiyrvnuL7ztZ8NRxxX97cGXT08UQf0rw h4y+Hf0hsVmWC468O/B3IvHPM3RpcNcR8S5Ln0+BeLalFOnhMizV4LiXB5vlGdVafssHgsyxeaZn RxKhSoU6TrRweW1f6+4D+kD4U/Srxmb5d4leFHgFw39JLOHh6PB3FvGHD3E9Tw145q4dOlgeGs8l l/F+Az7IuIa9JUcvy7N8dnOc4fFqFLDUqDrwwGUV/rD/AIXd/wAFuv8Aoz39nP8A8KfQP/opaP8A hd3/AAW6/wCjPf2c/wDwp9A/+ilr6q/Yh/4KAfCz9sfwzHZ2slr4N+MWjWCTeLfhpe3itO6xKiXH iDwhcTeW+v8AhqSVh5hRTqehySR2us28aTafqGpffVfgfF/iHj+AuIcw4W4u+jP4GZHnuV1fZYvA 4zhnjaMrPWliMPVh4hyo4vB4iFquFxmFqVcLiaMo1aFWpCSkfzBx54q5n4Y8VZrwVx39D76NvDfE uTV3Rx2W4/g7xFjLletHFYWtDxVnh8dgMXTSrYLMMHVr4PGUJRrYavVpTUn+Lf8Awu7/AILdf9Ge /s5/+FPoH/0UtH/C7P8Agt1J8n/DIP7OcO/5PO/4SbQD5W7jzcf8NQy58vO7HlS5xjy3+6f2kor5 n/iOmUf9I/8AgD/4jfGz/B+ILT+aa7o+Q/4mTyL/AKRc+i9/4iXiK+3R+KbT26pp63Tu7/i3/wAJ 5/wW61P5f+FK/s5+Hs/u/M/tXQJ9uPn8/H/C2tc6/wCrx5bdM+SP9YV8v/gtzqP/AC3/AGctB8z9 593QJvIx/wAsP9TrOc5+9++6f64d/wBo6KP+I9UYf7v4IeAOH7f8YFjsZbb/AKGfEeOvt9q/Xu7n /EzdCn/uv0cvovYXa3/Gscyx9rdb5vxbmLfmpNp7NWbT/Fv/AIV5/wAFutQH/Jdv2c9Ex82P7I8P yk+Z/B/yRvVx+4x1JGc/fm7J/wAMz/8ABYTxL+78Xftw/C3RISApfwb4ftopwuQM/wDEr+DXglt4 GTkXGSeN/O4ftLRT/wCJhc6pe9gPDTwJyyqvgxGE8H+EKmIpP+anVx+DxrT9eZa6ppJI/wCJquIq HvZZ4QfRqyeuv4eKwPgLwHVxVF/zU6uZ5fmLTvrqpJt6ppRS/Fr/AIds/tkeJzu8e/8ABTP4ypC5 zcab4YtvG0FnMGPzoDF8VNDs1ABIQvpEqgEYjUfLSH/gjD4M8QE/8LL/AGp/2ivHIf8A14OsaVaG UN98E6/b+MMbzzlxIPUNX7TV8k/tkftd+Af2PPhReeO/FLxat4p1UXWmfDvwNFcrDqPi/wARpCHW MkB5LLQNK82G78RayY2i0+0eK3hW41XUNLsL32+G/Hz6Q3FWfZVwvwTm+EoZznOMpYDKcs4S4H4E yKtOvVeip1sr4bwdWjRowU61fFV8RGlhMPTq4ivWpUKVScfo+EfpO/Sr414myXg3w6z3BYbiDiDH 0csyTJuBvDjw04ar1MTWd1GlXyXhLL6uHoUIRniMVjMTioUMFhaVbFYnEUcNRqVIfiF+3H+yT+wB +w38O4bVNP8AH3xP+NvjCynXwD4S8VfEGSOK0tw0lvN428WQeDdO8JyQeHdOnSSGzto2tbjxHqsT abYPHbWmtajpPqX/AATS/wCCWnhq/wDCcHxz/an8FW+uTeK9Pjm+Hnwq8RQ3CWelaHdiOeHxd4ss Fnia51TV7cr/AGJoF+jQaXpkp1DU7ebVb21h0Ol+wZ+yB8Qf2vvipcft3ftgq+u6VrGrDW/h54N1 i0ZLLxZPZFY9F1eXSZ2eOx+G3hhIo7bwpoTI8fiGazivLwzaJC58Sf0XdOlftXjX4+cYeHXCsvBf JfE3iDjHj7EVI1/FfxCWeY2vRy3MopKfA3BNWNSnHLcHl0k6OdZjgqeHxWLrRnhas6U54vAYD+h/ pE/Sd488J+CpfR74e8YuKePvE7FVYYnxv8U48SZliMPlGbwsqnhv4dVY1aMMpwGVTjLD8Q5tl9LC 43HYiNTBV50Z1MdlmW+NeCf2dPgB8Npo7r4f/BL4T+DL2PBXUfDXw+8K6PqZZQVV5NTstKhv5pAr MokluXcKSu7HFey0UV/BWY5rmmcYh4vN8yx+aYtqzxWY4zEY7ENXvZ1sTUq1Gr62crXP8x82zvOc +xTx2e5vmedY2S5ZYzNsfisxxUo78rxGMq1qzV9bOdgr8s/+CyGtf2V+wz41sd+3/hJfGnw50UjG fM8jxPa+I9ntg6AHzz9zHfNfqZX4o/8ABdTXGsv2XPhvoUb7H1z45aLcyqCP3tno/gfx28kZU8lR eX1hKWH3WiUE/Ng/sf0Z8u/tTx+8JcNy83suNsnzG29v7IrPNnL/ALd+pc3la5+//Q9yp5z9KHwM wijzex8RcgzW1r2WRYh525dfgWXc9+nLfS1z7L/4JraL/YH7DP7OVjs2ef4Ku9axnOf+Ek8T694i L9B/rP7V347bsZPWvuOvn79k3Qx4a/Zc/Zy0LYI5NM+BvwqtrhcFc3g8D6G99IVPKtLeNPKwPRnI r6Br4PxKzH+1/Ebj/Nubm/tTjbirMea9+b67nuPxPNfrf2t79T8x8X81/t7xZ8UM8UuZZz4icbZq pN3cv7R4lzPGczfW/tr36mdrGkaX4g0jVdA1uxttU0XXNNvtI1fTLyMTWmo6XqVrLZX9jdQt8stt d2k8tvPG3DxSMp4NfzXfsd61q3/BPf8A4KL+P/2VfFV1Pb/C34w6za6F4Wv9RkYxTG+kvNT+DPiJ bg7YpbvUYdSm8C6ybdPKOv6lLHcSAaL8n9MVfiV/wWk/ZzuvF/wo8K/tLeC7WeHxx8ENQtrXxDqG ms8OpP8AD/VdQWS31FZYAbppvBviySy1GzaExjT7DXPEWpSyKltuT9q+jFxHlWKz3iTwZ4trqlwb 42ZQuFKtaq1Knk/GFGcsRwVn1KE5KDxGFzhxwtKNkp4jF4WdZulh+V/0R9DfizJMbxLxb9H7jnEx o8AfSKyFcE1q9ZqVLIePaFSWK8O+J6NOpJU3i8DnzhgqMbRjUxOOwdWvJ0cJyP8AbWivkX9hn9oy 3/ai/Zq+HvxNmuYZfFkVj/wivxEt4vLVrTx34cjhs9alkgj+S2j1yM2fiext1J8nTdcso2O9XA+u q/nvibh3NeEeIs84XzvDvC5vw/muOyfMaDvaGLwGIqYas6cmo+0ozlTdShVS5a1GUKsG4Ti3/K/G HCmdcC8V8R8GcR4V4LPuFs6zLIc2wz5nGnjsrxVXCYh0pyjH2uHqTpOrhq8VyYjDzp1qbdOpFsoo orwz5sKKKKACiiigAooooA+XPjt8OfHnjf47f8E+PE3hDR7jU/D3wf8A2t/HPxG+Kl7DqGnWUfh3 wHqf7BH7bnwk07WLu2vb60udXt5/if8AFL4ceH10/SLfU9RiutdttVlsY9J0zVNS0/7zr4M+O3w5 8eeN/jt/wT48TeENHuNT8PfB/wDa38c/Eb4qXsOoadZR+HfAep/sEftufCTTtYu7a9vrS51e3n+J /wAUvhx4fXT9It9T1GK61221WWxj0nTNU1LT/vOgAooooAK+Pv8AgoZ4o+Ivgj9gP9uPxp8H77X9 L+LfhD9j79pjxR8LdT8KW0t74p074i6B8F/GureCb7w1ZwW93Pd6/aeJrTTLjR7aG1uZZ9Rjtoo7 eZ3EbfYNfH3/AAUM8UfEXwR+wH+3H40+D99r+l/Fvwh+x9+0x4o+Fup+FLaW98U6d8RdA+C/jXVv BN94as4Le7nu9ftPE1pplxo9tDa3Ms+ox20UdvM7iNgD3GiiigAooooAKKKKACvBP2pfiwnwN/Z1 +MvxWFylpe+DvAOv32hSyAFG8VXlq2leEbdgQwxeeKL/AEi05Vh+/wCVbofe6/Ev/guP8Wj4V/Z3 8CfCSxuxFqXxb8epfajar8z3XhP4f28Wq3sbIBlR/wAJVqng2eN2I3m1lRFfDmP9U8D+CX4ieLnh 9wdKj7fC5vxLl7zOly83NkuXzeaZ47Wa0yjBY1rmXJdLm925+1/Rx8O/+Ir+OnhbwDOh9ZwWfcX5 X/bNHl5+bh3K6ks54kfK4yi+XIcuzGS506d0ue0OZmb/AMEMvhO/h/4GfE34yalbOuqfFLx3Hoem 3c5Mkl34Z8A2kka3cLsWKrc+J/EHiS0ucYeabSY2mLiKEr+41fOP7IfwlHwM/Zl+CfwtktPsOpeG fAOjN4itj1j8Xa5G3iLxh3PDeKNW1dlySQpUdq+jq28duNf+Ih+MHiFxdTq+3weZ8SY6jlVRS5lL JMqccoyRqzlFJ5TgMG2oNwUm+VuNm9/pLeIi8VvHrxU47pV1iMBnHF2ZUMlrKXNGfDuSyhkXDkot OUUnkeWZe3GDcFJvkbjZsooor8lPw0/ne/4LP+GdX+Ffxm/Zb/a08JW/k6voOqQaBfX8Z8tU13wB r9t478EpccMsj38d54mhZ2Ri1rpawTB4liQf0A+E/E2k+NfC3hrxloFx9r0Lxb4f0bxNot1jH2nS de0621XTbjGTjzrO7hkxk43YzXwR/wAFVvhJ/wALZ/Yo+KYtbMXetfDYaZ8V9EJGTbf8IdO7eJrl eQcp4Fv/ABWABnczKMHtl/8ABJf4t/8AC1P2Kfh3aXV4bvW/hZfa18K9XLH54ofDs8WoeF4ApAIi tvBWteGrONxuV2tZQG3I6J/V3F//ABnX0VPDPihfvs18JONeIPDfN5r3sRLIuI6VPiXh/E4jdrB4 GpB5Rg5XhGNSpOkoyfNJf27x5/xsn6E3g9xnH9/nfgX4h8U+EeezVpYqfDXFtCnxhwtjMV8Ull+W 1acshy+TdOMatWrSjCcnKa/Suiiiv5RP4iCiiigD80P+CgH/AATr8Ffte+H5/F3hddN8HfHzQtP2 aD4tMRg0/wAXW1nEfsvhfxv9mQyT2pCrb6V4gWK41LQCUVUvdMWTTX+M/wBhz/gol42+FHjRf2O/ 25kv/CXjDwvew+FvC/xH8XSi3ntZY0ij0rw94/1GZ2tryxvLdoG8NfENLqaw1KymsZdWu7m2uE8Q P+/dfBv7cf7Bnw3/AGy/Bh+1LaeE/i74esZ08DfEeC13TR43zR+G/FUcCibWPCl3csWMbeZfaFcT TajorK02o2Gq/wBP+GXi7w3nHDNHwZ8c6eKzbw5nUn/qrxXQi8RxN4V5pXSp08wyis41K2K4ecuX +08jaq01Ri6mFoVlT+p1v7J8HfHfhLPuD8P9H76SNLGZ54TVKs/9SeNsNCWK4w8Fc5xCVOnmmQ13 GriMdwrKfJ/bHDbVamsNF1cFh6ypf2fiPvEEMAykFSAQQQQQRkEEcEEcgjgisrXdB0PxTouq+G/E 2jaT4j8O67YXWla3oOu6dZ6vousaXfQvb3um6rpeoQ3FjqFheQSPBdWd3BNb3ELvFLG6MVP88X7H /wC3P8Uf2M/iEP2Of254NT0jQdDmttJ8E/EPV3mv38I2Ekj2+kJfauPMHiP4X36RqugeJLdppfC8 SGyuy2iW7w+Gv6K7S7tNQtLW/sLq3vbG9t4buyvbSaO5tLu0uY1mt7q1uIWeG4t7iF0lhmid45Y3 WSNmVgT+beLPhFxJ4SZ5h8FmdTDZvkGcUFmXCHGeTy+scP8AFeTVFCpQzDLMXTlUpKtGlVovGYF1 Z1sHOpTkpV8JXwmLxP5F45eA/FngdxDhstzupguIOFeIcJ/a3AvH+RSWL4U454erRp1MPmeUY2nO tQ9sqFeh/aOWSrVMRgalam+bE4HE4HHYz8q/G/8AwRe/YT16e+v/AIbeEfiN+zPqd/ctduf2afi1 44+GXhC3kZGTbYfBv+1Nb+A9hGpbei2vwtiKsAFIQsjeTn/giJ4FUlIf27/29ILMnP2IXX7FNyAv HyDUb/8AYovNcwQAN51Uy8E+ZuZ2b9tKK+Wy7j7jnKMPHCZTxlxTlmFgko0Mvz/NcFSUUklHkw2K pR5EkkoW5UkklY/kPPfBHwa4ox9TNOJvCbw24izGq3Kpjc94I4azfEym25Oo62YZbiJ+1cm5Oqmq jk23Jttn5H+DP+CKX7Fmk3Ud98VJfjn+01PDIkqaf8fvjT4q1jwPPt3ebDq/wi+Hp+G/wZ8T2tyG 2z2fir4ea5a+Xuhhhihkmjk/UjwX4I8F/Dfwvo3gj4eeEPC/gLwX4ctF0/w94Q8F6BpPhbwvoVgj M6WWjaBodpY6Tpdoju7LbWNpBCrOzBAWJPUVyfjrx14R+GfhDxB498ea/p3hfwj4X06bVdd1zVJh BZ2NnAAMk4aSe4nlaO2srO3Sa8vryaCzs4J7qeGF/KxWPz/ifMKCxmMzbP8ANcZWpYbDRxFfF5nj sTiK9SNOjh8PGpKtXq1q1WUYU6VNSnUqSUYxlKST+54S4JyPIYYTh3gbhPK8ohi8TQwmByThbJML gvreMxFSNDDYfDZfleGpvEYmvVnCjQpU6U6tScoU6cZScYlT4j/EfwT8I/BPiH4i/EXxDYeFvB3h awk1HWdZ1GQrDBCpCRQQRIr3F7f3tw8Vnp2nWcU99qN9Pb2Vlbz3M8UTfzV6xrfx4/4LK/tBL4b0 E6v8N/2U/hrqgupppYmktdJsmZ4U1fVxGx0/X/ip4msmmj0bSPOl0/wvpstysUjWsesaprj/ABn4 x+OH/BY/9oSL4f8AgJdT+H/7Lfw01OLUL29vI38jT9OeaW1HizxJHEzWur/EXxHZi7g8JeF0me00 OzNzGs628XiTX73+jD4JfBP4d/s9/Dfw98LPhhocWh+F/D1sqAkRyalrOpSJGNQ8Qa/fJHE2p67q 0sYnv72REUkR21rDbWNtaWkH9g0KOT/RJyCnjsbSwGc/SV4jyxVMvwNWOHx+X+DOT5jh3yY3Fwar YbFca47C1b0aMlOngqNT3k8C6n9vf6VYbD5D9BfhmnmOY0ss4g+l7xZk6q5XltaOFzPKvo+5Bm+F fJmOOpyVfCYzxEzLB1r4fDyVSll2Hq+8nl0qn+s1z4P/AAf+HvwI+Hvh74YfDDw/beHPCPhu18iz tIf3lzeXMmHvdX1e9Yefqes6nPuudR1G5ZpriZj9yJIoo/TKKK/jHMMwx2a47GZnmeMxOYZjmGJr 4zHY7GV6mJxeMxeJqSrYjE4nEVpTq1q9arOVSrVqSlOc5OUm22z/AD7zTNMyzvMsfnOc4/GZrm2a YzEZhmWZZhiKuLx2Px2Lqzr4rGYzFV5zrYjE4itOdWtWqzlUqVJSlKTbbCiiiuQ4Ar8b/wDgt748 /wCEb/ZL0DwfBNtuviN8VvDenXEGcebonhzTNa8T3kv3TuEGs6f4cTZlSTOH3YjKt+yFfzqf8Fo7 u4+Jv7QH7IP7Oumyt9t1iae6e3gO6WS6+KfjTw/4H0WRkHmMXhk8L6mtr+6zm5nA83IVP6Q+iTkt DOPH/gGrjbRy7h7E5pxbmFeSvDC0OF8mzDOKGIn2jHMMLgoJ/ZlOL6H9b/QY4ew2f/Si8MK2YcsM q4Vxmc8dZpiZq9PB4bgzh/NM/wANianaMMzwWXwUvszqRl0P2D/Yf8B/8K1/ZE/Z38IvB9murb4W eF9Y1K2KbGg1jxZZDxbrULrsQiWPVtcvUlJXc0gZmLMSx+qKq2Nla6bZWenWUKW9lYWtvZWlvEoW OC1tYkgt4Y1AAVIoo0RFAACqABgVar8K4lzqvxJxHxBxFir/AFnP87zXOsRzO8vb5rj6+Oq8z6v2 leV31ep/NXF/EOJ4u4s4o4rxnN9c4n4izviHFcz5pfWc6zLE5lX5pdZe1xMrvq7sKKKK8Q+dP5p/ igp/YF/4K2+H/iJADpXwl/aCvl1HWZD+502HRvihfjSfHK3MsYSJYfC/xEt4vHDWcaA22mR6TD5b rIjS/wBLFfkL/wAFmvgCPin+zBH8T9JsxP4q+BGsjxJvjQvcT+B/ELWmj+MbOMKPuWsyaB4kuJXO 2Cy8PXu0bpjn6f8A+Cd/x7P7RP7Jnwu8ZX94LvxX4f00/D3xyzSebcHxT4Mjg0yS+vHyf9L8QaMd G8UTAYVTrgQKoXaP608X3/xEzwP8JPGOl+/zzhWE/BnxAqL3qssTkdGWYcHZpiWnz1J47JKtVYzH Vor2mMqUML7SbpwR/cvjw/8AiMP0cPAzx+of7RxHwVTqfR98UqsffrzxnDmHlmnAGc4tpupVqZlw 7XrQzDMq8UquPq4bBqrOVKET7booor+Sz+GgpCAQQQCCCCCMgg8EEHggjqKWigD8HP23/wDgl/re k+JH/ad/Yga68D/Ezw5ff8JTqXw28KzHR/tmoWxaabXPhibXyotK1tgZGvPBw8vSdbheeHR0trtx o2sew/sBf8FPdG+PFxZ/BL9oFbT4f/tCadO+iW1xe240PRPiLqFk7Ws9rDZ3CwJ4b8dpPE8Oo+FJ lgt9QvVd/DyxySyaBpn7BV+Un7fn/BMzwZ+1BbX3xO+F/wDZ/gD9oDTrd7lNRt447DQPiNLbBZLa y8Wm2RXtNfQxiHSvGEGbqIMlprceoWUVhNpH9b8IeLfCXinw9l3hZ9IXEV+TA01g+AvGOnS+tcS8 E1Z+7Qy7iKbarZ/wpUqcka0cRUliMJFuU6qUcPmGU/3RwH458DeNXCuVeCv0qcViFDLaKy/wx8fq VH67xd4d1ppRw2U8WVG1iOJ+CKtVQhiI4urPFYGDc6laMY4XNMj/AFbor+ff9jD/AIKW+NvhF4vH 7KX7ekGp+EvEvhe4g8M6L8T/ABWk0Wo6fPHsj07TPiXdO08N/p13bvbnSPiTbzSWN1ZNa6hr11e2 V1P4pT+gOGaG5hiuLeaK4t7iKOaCeGRJYZoZUEkU0UsZZJIpEZXjkRmR0YMpIINfi/ip4ScW+Eee wyjiTD0cRgMwo/XuHOJsrqfXOHeKMpmoTo5lkuZU06OIpzpVaM62Hco4nC+2pe3pRhWoVKv8+eNf gXxz4FcS0si4tw2HxeWZrQ/tLhHjHJav1/hPjTI6ip1MPnHD2bU06GKo1KNbD1K+FlKOMwXt6P1i jGnXw1WvLRRRX5gfjQUUVwXxP+J3gf4N+BPEnxK+I+v2fhrwd4VsH1DV9VvGJCJvWG3tLSBA099q WoXUkNjpun2qS3d/fXEFrbRSTSop6cFgsZmOMwuX5fhcRjsfjsRRweCwWEo1MRisXi8TUjRw+Gw1 ClGdWtXr1ZwpUqVOMp1KkowhFyaR2Zfl+PzbH4LK8rweKzHM8yxeHwGX5fgaFXFY3HY3F1YUMLhM JhqMZ1sRicTXqQo0KFKE6lWrOMIRlKST4n9ov9oT4d/sxfCvxD8V/iTqQttK0iIwaVpEEkX9s+K/ ENxHIdL8M6BbSMputT1GSNstj7Pp9lFd6rqElvpthd3EX4Gfsz/Av4of8FS/2gdT/at/aUtruw+A vhnVPsHhTwestymk6/DpN3JJY/Dzww0ghY+FdImzN478RRRxXGu6rNd6fbFNRvdSn0Dm/Dmj/F// AILI/tOt4o8TR6r4J/ZW+E+otaxWcMjRx6ZotxcRXI8PadMDJa6h8TvG1rBbXHiHVo1mtvDmmJbs fMtrLQNP1b+mfwh4Q8M+APC+g+CvBmiWHhzwr4Y0u00bQdD0uEW9jpum2USxW9vBGMscKu6WaVpJ 7iZpLi4llnlkkb+zM1xOC+ihwlX4ZymvhsV9IrjTKVT4qzvCVqeIj4TcM5jTp1Y8OZViKcp048W5 rQdOrmGPoy58DRlCWFmoLL8Zi/8AQLO8Xl/0IeBsTwfkeJweN+lf4hZHGlxtxFgq9LFR8DeD82o0 68OE8jxdGU6cOOs6w0qVbNczw8+fLMPKnLBTUI5XmGN2rKys9Ns7TTtOtLaw0+wtbeysbGygitbO ys7WJILW0tLaBUht7a2gjSGCCFEihiRI41VFAFmiiv4rlKU5SnOTlKTcpSk3KUpSd3KTd2222222 23dn+ec5zqTlOcpTnOUpznOTlOc5NuUpSbblKTbcpNttttu4UUUUiQr+fP8A4L460YfCX7NPhtWJ Oq+JPiZrXlAZLHQtM8G2CtxzkHxGyqMfMWOPumv6DK/nP/4LJ/8AFXftS/safDdv30d35WbY/MD/ AMJt8RNA0F/kX95+/GgLGcfeEYCfMGr+o/oZ0KcvpD8FZhXjzYXI8DxhneJXangeDc+5JJvROOIq UZJvt3Z/Z/7PzDUpfSs8PM0xMebB8N5dx7xFjPKllvAHEzpyTaaXLiquGld9rXTaZ/Qb4O0YeHPC PhXw8FCDQfDeh6MEByEGl6Za2IUHuF8jGe+M10dFFfzDiK1TE162Iqvmq4irUrVJfzVKs5VJv5yk 2fxvicRVxeJxGLry5q2Kr1cRWlr71WtUlUqS1u9Zyb1beoVieJfDmieMfDmv+EvEunW+r+HfE+ja n4f17SrpS1tqWj6zZTadqVjcKCCYbuzuJoJNpVtrkqwOCNuilRrVcPVpV6FWpQr0KkK1GtSnKnVo 1aUlOnVpVINTp1Kc4xnCcWpRklKLTSZNCvXwtejicNWq4fE4arTr4fEUKkqVahXozVSlWo1YOM6d WlUjGdOpCSlCcVKLTSZ/Nb+wJ4j1f9hX9vb4rfsa+Pr+eHwV8SdYXS/Beo6i+y3vNdt1l1X4X69G +0WyS+NfC2oPoN9HaqDL4ln0fTZZN2mMi/0pV+F//Bab9n3Ub7wb4A/az8Aw3Fl42+DmraXo/inV tLzHqEPhS71dbzwr4g8xFMgl8IeM5oo7eRMPFH4nnuZiYLANF+nP7IH7QOn/ALTv7PHw5+L1s9qm r61o66f4y0+0YbNI8b6If7N8T2IhzvtoJNRhfUtMilAkbRtQ024+ZJ0dv6y+kBSo+JvBXh/9IzLa cPrvEVClwH4pUqEYqOD8QuGsDTp4bMa0YK1KPEuR0aWNo078tChhsLGcpV68r/3F9KOjQ8YvDzwu +lllFGn/AGjxXhqPhn40UMNGCjgPFThDLqVHCZvXhTVqMOL+G8PQx+HpX5MNh8Hg4VJyxGKlf6Xo oor+ST+GAooooAKKKKACiiigD5c+O3w58eeN/jt/wT48TeENHuNT8PfB/wDa38c/Eb4qXsOoadZR +HfAep/sEftufCTTtYu7a9vrS51e3n+J/wAUvhx4fXT9It9T1GK61221WWxj0nTNU1LT/vOvgz47 fDnx543+O3/BPjxN4Q0e41Pw98H/ANrfxz8Rvipew6hp1lH4d8B6n+wR+258JNO1i7tr2+tLnV7e f4n/ABS+HHh9dP0i31PUYrrXbbVZbGPSdM1TUtP+86ACiiigAr4+/wCChnij4i+CP2A/24/Gnwfv tf0v4t+EP2Pv2mPFHwt1PwpbS3vinTviLoHwX8a6t4JvvDVnBb3c93r9p4mtNMuNHtobW5ln1GO2 ijt5ncRt9g18ff8ABQzxR8RfBH7Af7cfjT4P32v6X8W/CH7H37THij4W6n4Utpb3xTp3xF0D4L+N dW8E33hqzgt7ue71+08TWmmXGj20Nrcyz6jHbRR28zuI2APcaKKKACiiigAooooAK/m+/a2/4yw/ 4K4/BX4ERf8AEx8IfCSbwlZeI7F/m0+aHRraf4vfEEtIu4o+o6ILDwpcMxQC+0+G2RRL80n9Fut6 zp3h3RdX8QavcLaaToWl3+s6ndP9y207TLSW9vbh8kfLDbQSyNyOFPIr+eb/AII+aPqPxv8A2m/2 qP2ufEtu5ur26v7DS1u/9J+zax8UvE174p1OOxnPEb+HtE0Cy0ZBGEWPTdbS3hVYGKD+rvo2f8Yj w545eMlT91U4F8O63DvDuIfuzo8YeIeJ/sHJ8Vh38c6mDpQxbrRpWcKOJ5pyhBqT/t36Iv8AxgvC f0kfH+r+6q+G3hRiOE+FMU7xnh+PfFXFrhjIMbhJL36lXL6FPHvEQpWlDD4znqTpQak/6LaKKK/l E/iIKKKKAMjxDoOl+KdA1zwxrlql9oniPR9T0HWLKTIjvNL1eyn0/ULVyOdlxaXE0TY52ua/ns/4 I6a9qnwY/aM/an/ZE8UXTm90u+1DVNNjkAS3fXPhl4luvB3iGazyFLya9pmsaRqMZCsk2n6Gs8RV EYyf0VV/N9+1P/xih/wV8+DfxrgzYeEvjFN4Qvdfli/0XT4ofEttc/CDxyLnpFcPY28Vn4zvVYEP e31vc5W42yL/AFd9G7/jLuGPHTwcqfvKnGvh5V4n4coP3pVeL/DzErPMqwuGTu6VXH0KmKhXqQs5 4fC+zqc0VGJ/bv0R/wDjO+DvpJ+ANb99V8RPCqtxlwnhpe9Ktx54U4xcSZJg8Gn/AAK+Z4arjoYm tTs6mGwfsqvPBRg/6QaKKK/lE/iIKKKKACiiigD5A/bE/Yy+F37Y3w+bwx4yt10bxjo0NzN4C+Il haxSa74U1GYBmhcExnVfDmoSRxJrOgXEyQXcarc2k1hqttZaja/i/wDs3ftY/Gz/AIJpfFRf2T/2 v7PUtT+D63Cjwh4vtTeawnhPR7u5khsvE/gu8eFbnxD8N7uVXbUvDqwx6x4bnW7NjYW2qWeoeHNQ /pfr5w/af/Za+FX7WPw4vPh78TNKDSRLcXXhTxbYRwp4l8Fa5JEI49W0O8dSdjlYk1PSrgvp2sW0 a297CzR209v/AEd4S+M2V5Xklfwo8W8uxHFvg7nVd1Pq0Jc2e8B5rVlLk4n4OxU1KphatCdWpWxm WQf1fGRqYiUaUpYnHYbMv608DfpBZLkvDuK8EPHTKsXxz4B8Q4p1XhKUufibwyzqtKfJxjwBjKin UwdfDVa1XEZhk8H9UzCNTFSjRnLF5lhM2940DxBofivRNJ8S+GdX07X/AA9run2uq6LrekXkGoaX qmm3sSz2l9YXts8lvc2txC6yRTROyOrAg1r1/MF8JPjT+0F/wSN+MQ+Bnx8stU8cfs1+KdRur3w3 rOlpPc2VvYyXS/avGPw5e7k2W11C1zDL42+HtzcRMl5MLy2kiuLy21bXP6MtM+Mnws1j4Xx/GrTv Hnhu4+FT+H5fFB8df2jFFoMOhwRtJc3d1czeW1nLaNHJbXljdRw6hZ38UunXNrFfxvbL4Hi14JZ1 4cY/KMdk+LhxtwBxg4VuAuN8jozxGB4go15Wo5dWpUVUngeIaLvQxWUVf37r06v1dVFTqxpfMeOX 0dOIfCXM8izLIMdT8RPC/j6UK/hj4jcOUJ4rLeKcPiZNUMqr0cP7aeW8VYaV8Njcirf7S8TSrfVY 1o0q0aPTeMfGXhX4e+F9c8beN9f0zwv4T8NafNqmu69rF1HZ6dptjABvmnmkPLO7JBbwRiS4u7mW G1tYprmaKJ/5nvif8Sfjr/wWB+PkPwi+EUeq+Cv2X/Aer2+oajq+o2kqWFpZo09uPHPjRYGVNS8V avAt7D4G8FC6xZRvKDJAE8Ra/DL8Zfi/8av+CuXx+tvgL8DDqXhP9mvwbqUOp6zrt9a3MFjJYW07 wN8QvG8CSQvd3l0Vnh8A+CGmhmMrCa5FtcjVdR0j+g79nb9nf4afsw/DHRvhb8L9I+waRp/+l6rq t15cuueKtfnhhi1DxJ4ivo44/tmqX3kxJhUjtLGzhtdM023tNOs7W1i/asuwOT/RLyHDcQZ7hsDn X0juI8tWI4a4dxVOljMB4RZRj6LVPPs7oSU6VXjDFUZv6hgJ3WBhJusvY+2WO/obKstyD6DfDGD4 p4lweW8QfS04syiOL4Q4VxtKhmGWeBORZpQao8TcRYeanQr8e43Dzk8syyopLLacm68fYOusxu/A P4B/DX9mz4a6J8LPhZoi6R4e0hWnurqdkuNZ8RazcJGNR8ReItREcb6jrOovGhmmKR29rbxW2m6b bWWl2VlZW/s1FFfxrmua5lnmZY7OM4x2KzPNczxVbHZhmGOrVMRi8Zi8RUlVr4jEV6spVKtWrUk5 SlJttvtZH+f+dZ1m/Eeb5ln+f5ljc4zvOMbiMxzXNcxxFXF47MMdi6sq2JxWLxNaU6tatWqzlOc5 ybbfRJIKKKK4DzAooooAK/nP8bgfHX/guR4Q0UD7bovwc/4R8mb/AFsVofh58PLvx/nH71Y/s/j7 VxYdI9l2275JDvP9GFfzl/8ABKw/8Lo/b3/bA/aIc/bbBF8Xvpc5O+O2PxN+Iz3+g+TIJH+WDw14 T1CwtlDSJ9lZgG+RCf6p+jh/wg8K/SL8Qpe5/q54PZhwzgq70+rZz4hZjhslyyvCWlqyeFxMKSb9 72k1Zn9r/RJ/4xrgn6WHipJ8n+qXgHmnB2X4nb6nn/ipm2D4dyfE05/ZxEfqeMp0Ve0vaTXK9Lf0 aUUUV/Kx/FAUUUUAYnibw5o/jDw34g8JeIbOPUdA8UaJqvh3XNPl/wBVfaRrVjPpupWcnfZc2dzN C2OdrnFfzx/8Es/Emtfsu/tj/tAfsReN76RbfWdS1afwl9oOIr7xN4GS4v7K/sYyI/LXxp8Nrk+I HdkDyW+haXEY43ytf0b1/Oz/AMFc/BuvfAH9o39nf9t/wFatFdQa3ouieJ5IWaKC48U+BrgaxoEW oybW3p4t8IDVfDt1H80b6X4beGSLEp83+rPoxYmhxZ/xEbwHzOrThg/F3hTER4dniJqNHBeIPCcK 2e8LYnnn7tGnXdHF4fEuDhUxTjhMLzPmjE/tv6G+LwvHP/EWfozZzXpU8B468EYqPCk8VOMaGX+K fA9OvxLwXjOeo1DD08S8Pj8Li/Zyp1sc44LBc8lKMT+iaiuU8CeM9C+I3gnwh8QPDFybzw5438M6 H4s0K5ICvNpPiDTbbVdPeRAT5cxtbqITRE7opQ8b4ZSK6uv5ZxOGr4PEYjCYqjUw+KwtarhsTQqx cKtCvQqSpVqNWErShUpVIyhOLScZRaeqP4sxeExOAxeKwONoVcLjMFiK2ExeGrwdOthsThqkqNeh WpySlCrRqwnTqQkk4zi4tXQUUUVic4UUUUAfEv7Z/wCwv8J/2yPCDWviS2j8NfEzRdPmt/A/xO02 1R9X0d8yzwaVrMKtEPEHhWW7leS50e6lWW1ae5utGu9NvZ5p5fxx+Av7WP7Q/wDwTH+JNr+zR+2B o+teI/gzIVTwj4lspbjXW8N6Ksv2eDxB8O9VnWJvEngZS0a6p4Pn+zav4d4+wWWmalBc+HtX/por w79oH9nT4T/tN+AL/wCHXxa8M2+uaTOss2k6pEI7bxF4V1Z4zHDrvhfWPLkn0rU4CF3bRJZahArW GrWeoabPcWc39HeFnjhg8pyGp4WeLWU1uOfB/Mqzmsvc0+IeCMbUcuXPuCMwqyU8FXoTqTrVsrdS GDxfNXjH2P1vHwx39a+Cv0jsvyPhqr4K+OWR4jxJ8BM3ruayt1E+KvDnMarmo8TeHWaVpxnl2Jwt SrUxGIyZ1aeX45zxEYvDrHZlTzH0rwX418J/EXwtofjfwN4g0vxT4T8SWEWp6Hr2jXSXen6hZzZC yRSpykkbq8FzbTLHc2d1FNa3UMNzDLEnT1/LnbXH7VX/AARt+K0Vvfm9+Lf7KfjTWpFUQtcW/h/V S+W8+2WX7ZH8PPiha2Ufmy2bPNo/ii1tpY/O1iCwjvdC/od+BH7RPwm/aP8AhzY/E/4W+KLTV/D0 0QGr2tzJDaa14T1KOBZ7zRPFmmmaR9G1SxQl5Vld7S5tvL1HTbu+0y4tb2fyvFvwPx3AOGwHGPCu a0uPPCbiSfNwxx3lVOUqKlUlJRyXiLDRiqmS5/hpRlRrYXEwpQxFSnUVGNLE0sXgMF4fjp9HDMfD DCZZx9wTndDxN8DuLqnNwb4l5JSlOgpVJzUeHuLMHCKq8PcUYOUZYevg8ZToQxdWlVWHjRxlHH5Z l3q/iHxBofhPQtY8T+JtWsNC8PeH9NvNY1vWdUuYrPTtL0vT4JLq9v726mZYoLa2t4pJZZHYBVU9 TgV/Mt8W/iL8XP8Agr7+0jYfBn4Ptqvhb9mP4b6lFqWq69dwSw2Udgs01ncfEXxPZu8IvPEesQ/a 9N+HnhGR/tVvbyXE0y2CSeKtRsen/bJ/ac+Jn/BRD436f+xd+ydLLefC+21dR4x8W2c8kekeMX0e 8h/tTxVrmowAiD4XeEJ2jm0+JfN/4SfV47O+tYdRu7jwvZr+5f7LX7MHw5/ZO+FOk/DH4fWgldfL 1Dxb4quoUj1rxp4nkgjivtd1VlaQxI3liDTNMjle10jTo4bKBpGWa5uP1vIMvwH0VuEcFx1xHg8L jPH7jLK51vD/AIYx1KFeHhrkGOpyoy4y4gwVRWp8Q4ylKrSybLsRC+GtUjiISqQzPDYb914XyrK/ oUcC5f4k8W4DB5h9KDj/ACapiPC3g3MaNLFQ8IOGMxpSw8vEDinL6qapcVZhRnWo8P5Tioc2D/ex xVOVWnnGEwfdfBX4MfD79n/4beG/hX8MtEj0Twr4atfKhQkS3+p382JNR1zWrwqr6hrOrXO66v7u QKGdlgt4rezgtraH1Wiiv44zHMcfnGYY3Nc1xmJzHM8yxVfHY/H4ytPEYvGYzFVJVsRicTXqylUq 1q1WcqlSpOTlKUm27s/gHNs2zPPs0zHO86zDGZrnGbY3E5jmmZ5hiKmKx2YY/GVp4jFYzF4mtKdW viMRWqTq1atSUpznJybbYUUUVxHnhRRRQAV/Of8At3/8Vl/wV6/Y88NL+8g8Pf8AChPtMHRT9j+L XinxhfbjyT52nNBG+0r+7RQu18uf6MK/nP8AHP8AxWv/AAXi8H6OP3sfhL/hH8kfOkX9g/s+3njr kt8i7Lu62HBG2c7B+/O2v6o+iZ/svFXijn23+q/gL4o5+p/8+3Qy7B4NSutn/tzStrrof2t9Bz/Y uNvGfiV+7/qZ9GTxn4nVT/n1LDZTl+Xqd9LP/hScVZ3fNZH9GFFFFfyufxSFFFFAHLeOPBnh74i+ DfFXgLxbYJqfhjxn4f1fwzr9g+ALrSdbsZ9Pvo0cqxim8i4doJ1HmW84jniKyRqR/Pd/wTW8XeIv 2OP2yvjH+wr8TNSePRPFWs3k/ga7u1a3tL3xdpFmmoeHdXsllMcVrB8R/h60Nw2TJJNqeleHdIhU 3Lsp/o6r8GP+CzvwI1vR4fhh+2l8MvP0rxn8Kdc0HQvF+raYipd2djFrMepfDzxe7gKol8OeK3bR Zp5BcT3H/CQ6HCQlppjY/qX6M+cZdn+J4u8BuJ8XTw3DnjLlcctyjF4j3qOR+ImVuWM4NzaCfNKH 1jGw/szEUsOo1cfUr4DD1JqlB2/tL6H2f5TxRjOO/ozcY46lhOEvpAZLDKMixuL97D8OeK2SuWYe H+eU0+aVP61mMP7HxVHDKFbM6uJyzCVaioU2l+89FeB/swfHTRf2kvgR8OPjForW6N4s8P2z69p9 sxK6J4t0/dp3ivRCju8yJpuu2t9DZtORJdaf9jvlBiuomb3yv5tzrJ8x4ezjNchzfDVMFmuS5jjc qzLCVVaphsdl+IqYXF0Jr+alXpTg2tHa6ummfyLxDkObcK59nXDOfYOrl+d8PZrmGS5vgKytVweZ ZXiquCxuGqL+ajiKNSm2tJct4tpphRRRXmHjhRRRQAUUUUAfLnx2+HPjzxv8dv8Agnx4m8IaPcan 4e+D/wC1v45+I3xUvYdQ06yj8O+A9T/YI/bc+Emnaxd217fWlzq9vP8AE/4pfDjw+un6Rb6nqMV1 rttqstjHpOmapqWn/edfBnx2+HPjzxv8dv8Agnx4m8IaPcan4e+D/wC1v45+I3xUvYdQ06yj8O+A 9T/YI/bc+Emnaxd217fWlzq9vP8AE/4pfDjw+un6Rb6nqMV1rttqstjHpOmapqWn/edABRRRQAV8 ff8ABQzxR8RfBH7Af7cfjT4P32v6X8W/CH7H37THij4W6n4Utpb3xTp3xF0D4L+NdW8E33hqzgt7 ue71+08TWmmXGj20Nrcyz6jHbRR28zuI2+wa+Pv+Chnij4i+CP2A/wBuPxp8H77X9L+LfhD9j79p jxR8LdT8KW0t74p074i6B8F/GureCb7w1ZwW93Pd6/aeJrTTLjR7aG1uZZ9Rjtoo7eZ3EbAHuNFF FABRRRQAUUUUAfnd/wAFUPi2PhL+xT8VpLe5W31n4iw2Hwp0VTN5LTt4zmeDxBFHj53dfBlp4mmC IMkxAsVjDsMD/gkj8JD8LP2KvAN9d2zW2s/FXU9c+KeqLJCY5Db67LBpXhlg7fPLBc+ENC0DUYWI VAb+Tygyt5svwf8A8Fn/ABPq3xU+Mn7Ln7JXhKYTaxr+q22v3tlGGk3a54+1+38B+CmnwyxxtZR2 niWaRHIZbbUknkaKFkd/3/8ACPhjSfBPhTwx4M0GE2+h+EfD2i+GNFt2KloNJ0DTbbStOhJVUUmK ztIUJVFUleFUYA/q7i7/AIwX6Knhrwuv3ObeLnGmfeI+bw2rxyDhulDhzh/DV0/+YTHVpvN8HZNS nTqTUlrF/wBucdf8a1+hN4Q8Gx/cZ346+IfE/i3nsPhxUOF+EaFPhHhbB4pPX6hmVepLPsBZNTqU qk1JWlF9DRRRX8on8RhRRRQAV+In/Bcv4TP4o/Z++HnxcsYHkv8A4T+O30vUpY4ifs/hf4h2sFhd XU0y8osXibQ/CdpCrjZ5mpPtdJCEl/buvAP2qfhMvxz/AGcvjL8KVg+033jDwFrlpoUWUA/4Smwt /wC2PCMrGT5NsHifTtIncEoSsZAkjYiRf1bwN42/4h14u+H3GM63sMJlHEuAjmlW/Ly5LmMpZVnj u9P+RRjsbbm929rtLVftv0b/ABE/4hR47eFvH1Sv9WwORcX5ZHOa3MoqHD2bSlknEbu/d1yHMcxS 5rRu1zNK7UH7JvxZX45fs2/Bf4ptOlzf+KvAWiS69JHKJlHinS4DofiyLzByTB4l0zVYSHAkGzEg DhhX0NX4e/8ABDT4st4h+BPxJ+Deo3H/ABNPhX46TWdOtJQ8c1v4a8e20s626xv94W3ifQ/Ek9wU AML6nEkyqZI2k/cKq8dOCf8AiHfi94g8IU6XsMHlfEmOqZVTs0o5Jmbjm2SW6Nf2TjsGnKPutp20 K+kn4df8Qo8d/FLgOlQ+r4DJeLcxq5LSUXFR4dziUM84cUejX9h5ll6co+65J8ugUUUV+Tn4gFFF FABRRWZret6P4b0fVPEHiDVLDRNC0Swu9U1jWNUuobHTdM02xhe5vL6+vLl44LW0tYI5Jp55nSOO NGZmABNXTp1K1SnSpU51atWcadKlTjKdSpUnJRhTpwinKc5yajGMU5Sk0km2kaUqVWvVp0KFOpWr VqkKVGjShKpVq1aklCnTp04JzqVKk2owhFOUpNRim2keKftM/CL4KfGf4PeLPC3x9ttJT4fWmn3O uX3iPUr630ebwTPpttNIni7StfnKrol/pEbSyC7dmtLi3afT9Ttr7TLy8sbj+JPxH441nQLHx18F PA/xW8da9+zVL8TI9SQjT7nT9M8QJp11f2mg+K7nwjPqcdraarqOkQPqUei3GqWC6ncadYS6gYrn R7OXTP18/aO/aH+Mf/BU3402/wCy1+y9Fe6V8B9F1BL/AMTeKb6K+sLDxDbaXdYk8c+N5YozPY+E LK4WM+DfCcsYv9X1T7HqF/bnWJNPsPDv7PfDP9gr9nX4d/s53n7Nc3gyw8VeEPEVrFL471bWbdF8 QeMfE6wqp8WXOo25F1pmqWM6iTw5/Z1xEPDcMcMGnSArPNcf6SeGXGOF+h9wbluA8U6+ZcScTccZ pkvEeH8JMNUy+vHw5yijWVRcY5hHMKGJhl/GGKp8tTAZTRngpVZ4XDwx9alWoTxGX/65eDvH2C+g VwBlGWeNOIzfi3jHxHzrh7i3CeBmEq5XiI+E2R4euqseP80jmuGxlPKuPcZS5KuWZHh6mXTq1MFh qeZ16OIw08Vlcn7Bfgv9nLwZ+zd4Ji/Zk1O08R+BtXtl1LVfFriEeJvEniuSGFdauvGqIqXFh4kt ZQtlPoVykS6Daw22mWcCWMNu0n2ZX8uvifwn+0h/wRu+M7eMvBE2ofE/9ljx7q0FreW9+7w6XqqN ukTQfEqWwmg8K/EjSbOKZdA8VW9qNP8AEFpC0i209t/bHhrTf6Hf2f8A9oT4X/tMfDjSfid8KteT V9E1AC31HT7jyoNe8L6zHGj3nh7xNpiTTPpmr2XmKWjMktreW0kGo6ZdX2mXdpez/wA0+PXhdmuV 4v8A4izkfE2K8S/Dbj/H18wyvxAqTliMwp5ji5yrV8j4wpqEJ5XxDhJ89CVOtRwtLEqhJUKGFrUc Rl+D/kH6TngznWTY/wD4jjw3xhjfGDwj8UMzxOa5N4o1pyxOa0s2xtSdfE8Nce0lCnPJuKsBP2mG lSxGHwVDGxw8/quFwVehisqwHttFFFfzcfyOFFFFABRRRQB4h+0x48/4Vh+zx8b/AIgrP9nufCXw s8c6zp0gfy2OsW3h3UP7FhR96FZbjVmsreIh1bzJV2ndivyl/wCCE3gP+x/gD8W/iHLD5Vx43+KN voELkfNcaV4G8OWM1rMG3HMa6n4u1u3UbVIkglJLBlx9Ef8ABYTx5/whf7D3jrTI5/s938RfFPgf wHaOG2SP5utp4t1CBPnUt9o0bwlqcEqgPut5JgU27mX0f/gmB4EPgH9hr4D2M0RivPEWg6t47vHZ SrTjxt4i1bxFpkpBVSQNBvtJhjbBDxRI4ZlYMf6syn/jGPod8W47+HivE7xjyHhzk2niMl4NyWfE Kr/36NLOKkqFteWs721TP7ayP/jDvoC8c5j/AAsb4x+P3DPCShtPF8O+H/D9TilYn+/QoZ/Vlhmt eWu07a3Pvqiiiv5TP4lCiiigAr5G/bp+Ao/aQ/Zc+Knw1tLQXfiZtEbxR4GAVmnXxp4UY6zodtbF c7JNaa2n8OTPtfbZ6zdYXcVI+uaK9zhniHMuE+Isi4oyer7DNeHs3y/Osvq68scXluKpYugpqLTl SlUpRhVpt8tSlKcJXjJp/ScHcVZvwNxZw1xnkFf6tnfCme5VxDlVa8uWOOyjG0cdhlUUXFzozq0I wr0m+WrRlOlNOM2n+Mf/AART+PbfEH9njXvgxrl8ZfE/wO8Qvb6bbXDn7U3gLxbLd6po3EpE039l eIIfE2lyKoZNPsF0S1YxLLbxn9nK/mus937A3/BXmS0Z00j4SftIXRKBmEVhBonxc1N2tjzstdPt /Cvxd0trYOxIsfC9s7M0MV4Sv9KNfvf0puH8toeIOC8Q+HKKp8JeMnD+W+JGTKHK4YbHZzTX+smW VZwUY/XcHnccTiMXRUYuh9eo0pLmTP6c+mpwtlGG8U8v8VeEqCpcDeP/AAtlPi3w8ocsoYTMuIKS fF2T1pwjCCzHAcRwxmKx2HjGLwqzLD0ZpTiwooor+aD+PwooooAKKKKAOU8ceBfB/wASvCmteB/H 3hvSPFvhHxFZvYazoGt2cd7p99bsQ674pBmK4t5UjubO8gaK8sbuKC8s54LqCGZP4tf2oNL0L9mn 4+fGz4R/smfGHxrrfw61zRLzw548s9GvLyOCOyhe4v8AxL8P9V1TTbgweMdI8KpbSQ3mvPbW3k20 uq6NfPcCDWLzUv27/wCCm/7f2reEbh/2Sf2arm+1343+NpbXw34u1nwss17qvg6PXWitrXwf4a+w 755fiB4hW5jglktt1x4asLlfs+zX722n0X3f/gnL/wAE+tA/ZW+Hsvin4iaXpmufHb4g6ObfxlcX At9UsvCPh+/VJX+H+kyHzrSdCBG3izUIDLDrWpJ9kinutI0+wlm/v/wMzrF/Rn8Nsd4m+ImIxmMw HiJDDU+AvBitVw1OHFcsJiMJi1x5m1DHYTHLJ8Bl8KNL+ysyo4SOKxjlh6j9ph6+W+1/1E+jZxFj voe+EeZ+MPitiswx+WeK1PCUvDL6PmIr4SlDjeWBxeBxq8Tc8wuZYLMlkGV5VDD0FkmbUMBHG49z wtV+1wuIyl1/Iv8AgjJN+y9b/BK+sfhZqQuPjtdR2978bYPEcFvY+MPNimlj02LRLdZ7hLn4eaeZ zFpN1ps8iyXtxLc6/Dp+sXq2EH7QV/Pl+2P/AME2PH/wU8aj9q/9ge41bwz4g8N3Vz4j1v4Y+F2Y anpUx82TUr/4dWJjmg1bQ7y2kni1j4bXUNzbz2T3NholpqGnXUXhy2+uv2Av+Cl/gv8AalsLH4cf EuTSvAX7QdjE1vLobM1hoXxBFpGTPqXg43cjtBq6JHJNqvhCeeS/tljmvdKbUNOivP7L+A8bvD// AIibRz36Q3hhxBmvH3DObYr69xtk+aTjX438N8fVp3lgc6wNDm9rw1hKVL2OU5lg4PB4PLsPCg3P B4N5hU/MPpGeFz8YqHEv0q/BrinOvE/g/PMZ/aXiLkGdTjifEbwkzStS5p5bxDluGUvb8IYGjR+r 5Hm+X03gMBlOFhhm6mAy95pV/VOiiiv4/P4KCiiigAooooAK/nQ+Bn/Faf8ABcb4xa6P3w8Jj4g5 cfOIv7C8BaP8Ojljyuw3fkHH3SfLHy8V/RfX85//AATb/wCKv/4Kjftr+OX/AH1vB/wvD7G5+YRf 238cvD66dtkGV/d6Vp1zbrz8yEkcA1/VH0dv9h4F+k5n3w/V/BbG8P8AP2/1pzjA4Pkv/wBPPqtr dbH9q/RS/wCE3w1+mNxL8P1X6POYcL+07f66Z/luA9nf/p79Ttbryn9GFFFFfyufxUFFFFABXE/E n4f+Gviv4A8ZfDXxhZ/bvDHjnw5q3hnWrcELKbHVrSW0kntpMEwXto0i3djcpiS1vIYLiIrJEpHb UV0YTF4rAYvC4/BV6uFxuCxFDF4TFUJyp18NisNVjWw9ejUi1KnVo1YQqU5xalGcVJO6OrA47GZZ jsHmWXYmtgswy/FYfHYHGYapKliMJjMJWhiMLicPVg1OlWoV6cKtKpFqUKkIyi00j+dT/gll498T fst/tQ/Gr9gr4qX5gW+17VdT8DPcrJb2l14w8P2iTS3OlJMwMdn8Q/h/DYeJLEy58yPQdPhiAub9 1l/orr8Av+CyHwV8Q+AvEvwj/bl+FQfSvFfgLX/D2geM9SsYQHtrzTNRXU/hx4svFjVBLHb6hHc+ FdVmu3kF3DeeFtL2/Z43U/sx+z38ZvD37QnwX+Hfxi8MvF/Z/jfw5Z6lc2cUnmHR9ci3WXiPQZmy x+0aFr1rqOlTEkiRrTzUZ45Edv6n+kVhMLx9kXAf0ismo0oUvEDBQ4d8QcNhaahRynxO4awlPDZg 6kIKNPD0+IstoUs1wFCzqVKWHr4utJzxKP7V+lhgcH4ncNeGX0sOH8PQp0vFLL4cKeKeDwdKNOhk fjHwjgqWDzWVSnSjGlhKXFmU4ejneWYe0q1WhhsTjq85VMYj2Wiiiv5QP4gCiiigAooooA+XPjt8 OfHnjf47f8E+PE3hDR7jU/D3wf8A2t/HPxG+Kl7DqGnWUfh3wHqf7BH7bnwk07WLu2vb60udXt5/ if8AFL4ceH10/SLfU9RiutdttVlsY9J0zVNS0/7zr4M+O3w58eeN/jt/wT48TeENHuNT8PfB/wDa 38c/Eb4qXsOoadZR+HfAep/sEftufCTTtYu7a9vrS51e3n+J/wAUvhx4fXT9It9T1GK61221WWxj 0nTNU1LT/vOgAooooAK+Pv8AgoZ4o+Ivgj9gP9uPxp8H77X9L+LfhD9j79pjxR8LdT8KW0t74p07 4i6B8F/GureCb7w1ZwW93Pd6/aeJrTTLjR7aG1uZZ9Rjtoo7eZ3EbfYNfH3/AAUM8UfEXwR+wH+3 H40+D99r+l/Fvwh+x9+0x4o+Fup+FLaW98U6d8RdA+C/jXVvBN94as4Le7nu9ftPE1pplxo9tDa3 Ms+ox20UdvM7iNgD3GiiigAooooAKKK8Y/aL+KMHwU+BHxb+K0zxrL4F8A+JNd01JXREutdg02eP w9YbpPkDajrsunWEeQ2ZLlQEckIfQynLMZnWaZbk2XUnXzDNswweWYGit62Mx+Ip4XDUlvrUr1YQ Wj3PUyPJ8fxFnWT8P5VReJzTPc0y/J8tw63r4/M8XRwWDorfWriK9OC0esj8KfgaD+1f/wAFlviR 8S8JqXgz4F3Hia40+RoybFofh/psHwt8MPbOzE+Zd+Kr2TxhZEndM9tcTrGkSmNP6Pa/Cv8A4IY/ C2bTfhH8XvjhrEM0us/Evx3b+GdP1C8JmuLrQ/Bdm17e38Fw5aRk1PxJ4n1O2vmLbri60GNpQxgj Y/upX9GfS0zTCf8AEVafA+U1VVyLwl4S4W8M8qcbRhJcP5ZTqZlUlCLcViP7WxuOw+Im/wB5Ulho +0b5Ypf1n9OXOcB/xGyl4cZHWVbhvwN4F4M8H8klC0YT/wBVsop1c4qzpxfKsV/buY5lhcVUa9rV lhIOo3yxUSiiiv5jP44CiiigAooooA/m8/ZnA/ZQ/wCCw3xd+D7k6f4Q+Mc/i2x0S22SQ6bFB4xt LP4veCktUXKSnTJIZ/BtnP8AMEmuryBijtLs/pDr+dT/AILH6FqPwa/aJ/ZY/a08Lwsmo6de2mma jLb749+s/DHxJYeL9AS7fIikbWdO1rVdOKn/AFtlo7wThoQor+hPw7r2m+KfD+heJ9GnF1o/iPR9 M17SbpcbbnTdXsoNQsZ12llxNa3EUgwxGG4JHNf1d9I//jLeFfAnxhpt1anGfh3T4W4ixFryrcW+ HeKeR5pi8S7XhWx9GrhpUYzd50MLz07wTZ/bv0t/+M64K+jR4+Uv3tXxB8KKXBXFeJWs6/HPhRjZ cN5zjsY7Xp18zw9bCTw8Ju88Ng1OnzQTk9iiiiv5RP4iCiiqt9fWWmWV5qWpXlrp+nafa3F9f399 cRWllY2VpE891eXl1O8cFta20Eck1xcTSJFDEjySOqKzCoxlOUYQjKc5SUYxinKUpSdoxjFXbk20 kkm23ZalQhOpOMIRlOc5RhCEIuU5zk0oxjFJuUpNpRik220krkep6npuiabqGs6xf2elaTpVldal qmp6jcw2Wn6dp9lC9zeX19eXDx29raWtvHJPcXE8iRQwo8kjqikj+aj9qD9pj4u/8FNvjNbfsl/s oJfWvwVstRWbxZ4tkF7p+n+LLTTLyE3PjTxlOsSz6b8PtFuEjm8N+Hpojf6/qYsr65s59Zn0TSNG v/ta/tS/Fb/go18Xrf8AY8/ZBS7m+FEV+G8aeNI2urDTvGEOmXSpf+JPEOoRqX074W6FK0Uum2Uk RuvFOqC0ufst5dz6BpkP7YfskfslfDT9kH4YWngHwLbLqGtXwt77x145vLWKHXfG2vxxspvLwo0p stJsfNmt9A0KKeW10izd8yXepXep6nqH9n8O5Jkf0XOHsu4/44y/CZz465/gljvDrgDMIKrhuAMF Xi1h+NuMcI3zRze955Lk1XkrYerFymqeOp4itkv+hHCvDnDn0MOFcq8UPEfK8BxB9JTifLo5l4T+ F+aU418J4XZfiYtYXxF4+wUnzU8/Ws+HcgrqnXwteDnUVPMaWKr8PXv2Vf2Vfhl+yR8MLH4dfDyz +0Xk3k33jLxlfW8EfiDxt4gWMrLqmqyRbvJtLffLBoujRSyWmjWDeRE9xdTX1/e/TFFFfyLn2fZz xRnOZcQ8Q5lis3zvOMXVx2ZZljajq4nF4ms7zqTlpGMUlGnSpU4wo0KMKdGhTp0acIR/hLififiD jPiDN+KuKs3xue8RZ9jq2Y5vm+Y1XWxeOxld3nVqTaUYxilGnRo0o06GHoQp4fD0qVClTpx5fxr4 K8J/Ebwpr3gfxzoGm+KPCXifTp9K13QdXt1ubDUbGcDdHKhw8csbqk9rdQPFd2V3FBeWc8F1BDMn 81vxg+Bv7QP/AASS+L5+Pv7Pl9qPjf8AZw8Salb2HiXQdTkurm0s9PnuSbbwh8R4bVQsbRPcTQ+C viJbQrJa30gs7xIbm+l03xB/T1WXreh6N4l0fVPD3iHS9P1zQdbsLrS9Y0fVbSC/03VNNvoXt7yx v7K5SS3urW5gkeKeCaN45I2ZWUg1+o+D/jNmnhdisyyvG5fh+LfDvimnHB8b8A5q+fKs8wUkoPE4 ZyU/7NzvCwUZ4DNKEVUhUpUY1lUp06ap/tHgL9ILOvBnG5tk2Y5VhOOfCjjSlHL/ABG8Mc8l7TJO JMuko03jMI5xqf2TxHgoKNTLM5wsFWpVaNCNdVqVKkqXz9+y5+1X8KP2tfh3B4++GWqMLi1MFp4t 8H6m8EfifwXrM0buNO1qzikkVre48qaTSdXtmk07V7eKR7aUXFve2lp9K1/M/wDtPfsk/Gn/AIJu fFFv2tP2PNQ1G4+EaXu/xZ4Oc3+rx+D9Ku545rzw34xsfO8/xL8Mb6ZRFY63NOureG5zZreX1tql ppniW8/Zr9jf9tP4W/tjeAY/EHhK5h0Px1o9tbr49+G1/ewy674YvmCRvd2wAik1jwvezkjSPEMF vHDOCLS+h0/VYbrT4PqPFrwYyrLciw/iz4RZhieLPB7Oq6pyrVY8+f8AAGa1OR1OGeMcNT5pYedC pVhRwWZyvh8VGdCM6s3icBi8z+y8cvo+ZJlHDeF8cfAnNMXxx4CcQ4lUZYirH2nE/hhndX2cqvB/ H2DpudTC1cNVr06GX5zK+ExsKmGhUrzeLyzHZx9jUUUV/N5/JAUUUUAfz8/8F3/F81zoH7OHwj0x 2ur/AMR+KvFni+fTYWzKZtJstH8M+HnaLPLXs3ijXILVipy1tcqCOQf3O+GPg6H4d/DX4e/D+3MZ g8DeB/Cfg6Aw/wCpMPhnQdP0WMxZVD5ZSyXZlF+XHyr0H8+n7cML/HL/AIK6/s3fCaEi5sPBJ+EV jrNixzH9ltde1X4seKW2jdia58JXNvGcgArbwZAUFj/SHX9W+NluHfAz6MnA8WoV8RwzxV4j5lDa df8A10zuNXJK849qWX4bEUKMre/BN3dj+3PpFJcJ/Rt+h14cQkqeJxfB/Gvi1nFPRVMS/ELiOFbh 3E1I32o5Xg8VhaE7LnpJtttOxRRRX8pH8RhRRRQAUUUUAfiz/wAFsPgPN44+Afhf45aBbP8A8JL8 DvESHVLm13R3f/CDeMbix02+nDwkTSSaN4nt/DN5bnkWFnc61eK8K+ezffP7Efx6X9pL9mL4V/FK 4nWbxFe6Cmg+NlDfPH418LyNofiKaROTCuq3ln/b1pCzOyafq1nukcksffPiH4G0H4neAvGfw68U W/2nw7458Ma54U1mIBDIdO17TrjTbmSAurLHcwR3BntZsboLmOKZCHRSPwK/4JAeOdf+Bnx9/aF/ Yi+INwLfUbPW9a13w7BI7R20ni3wPdf8I/4sGlpIwNwnifw1HpHiCykjUpLpPht7tHaOUMf60yFL xS+i5xHw9K1finwBz/8A1wyOLvLEVvD3i2q6HE+Cw8XdujlWcQWeY6q2o0qEcNSjG8ve/uThpLxo +hhxZwpO2J40+i/xO+PeG4P3sVX8K+Oa/wBW4yy7CxbbeHyXP6ceJMxrtqNHDRwtGMbyXN/RNRRR X8ln8NhRRRQAV+U//BSz/goJY/sueE2+F/wxvLXVf2hPHGnGPTYYAt6PhzomoK1vH4r1O1VZFl12 8LPH4Q0WZSJrlTrOoQy6baQWOs+w/t8/tw+E/wBjb4ZS3VvJpuu/GLxbaXNv8NvBNxI0itKCYJ/F niKCCSO4t/C2iuSzDzLebXdRjj0awmi3ahqGl/n1/wAE1P2G/FXj7xa37c37Vy33iPxt4u1SXxf8 OPD3iiAPdTX17I0sPxK8R6fcQIkLhRE3w+0hIYbPS7BLXXbe2jRPDpsv6l8HPDfhjh/hqr49eMmG lPgHJsXLDcGcI1LUsb4o8V0OaVDLsPTqxd+G8BWpuecY506mGq+wr4VqvTw+Nw8v7S8AvCTg7hbh Cv8ASb8fsHOfhjkGOnhPD7gWq1QzHxn44w3PPC5ThKVWLcuEcsxNJ1M/zJ0quDrfVsTgpLE0cLmO Fn7J/wAExv8Agn5efCC1H7Svx/tLnWPj945hudV0fTvEe+/1P4eafrplnvdR1Ke9ee5k+IfiaK5e TW72dvt2i2VzNozPHfXmurL+zFFFfi/iX4kcTeK3F2ZcY8VYqNbHY1xo4TB0E6eXZNldByWBybKc M244bL8DSk4UoJupWqSq4rE1K2LxGIr1P578X/FvjHxt47zbj7jXGRr5lmMo0MDgMMpUsp4fybDO cct4fyPCOUo4PKstoydOjTTlVr1ZV8bjKuIx2KxWJrFfjv8At8f8EwNF+NlxffHD9nU2/wAO/wBo PTLn/hILm0026bQdF+Iep2bi7juhdWzwJ4X8efaIkn07xPbPa2mo6hj/AISFop5/+Eh0/wDYiip8 OvEni/wr4lwvFPBmaVMuzCivY4rDzTrZbm+AnJOvlecYByjRx+XYlJKpRq2nTmoYjDVcPi6NDEU4 8KPFzjzwV4uwfGnh/nVXKs0w69hjcLUTxGUZ7llSUZYrJc/yyUo0M0yrGKKVbD1rTpTVPFYOthcb Qw+Ko/hT+w5/wU71q28SQfswftsw3fgL4reH7pfDOlfEPxdC+hnWNSgZYrbQPiLBdw28WieIniaI WHimR49J8Ro0Tai1rqUsV/rv7rdelfAH7cH/AAT8+F37ZHhw38wtfBPxi0azaHwr8SrKxWWWeKMF ovD3jG0haGTXvDsj8W7vJ/aegSu11pE/kS6jpeqfl9+zR+3H8a/2C/iDD+yd+3RpmsyeB9J8q08G /ER0vdcvvDOhGV7XTNQ07Uo4nn8dfDCUQNHYS2sUniHwwsdxpYt5l08eG9J/onPfDzgz6QOU4/jv wOy6jw94hYDDTzHjrwRp1E3iFF82M4h8NnJQ+v5fOpJ1MRw9Siq+DlP2GEo0ZSy/C5j/AFdxL4Ve H30o8jzPxK+jflWH4V8U8swlXNvEn6OdKonLFKFpY/ivwiclD+08qqVZupieFaMFisBOf1bA0KEp 5Vgs1/pAorJ0LXtE8UaLpfiPw3q2na9oGuWFtqmja1pF5b6hpeqadeRLPaX1hfWskttdWtxC6yQz wyPG6MCrEVrV/H1WlUo1KlGtTnSrUpzpVaVWEqdSlUpycZ06kJJShOEk4zhJKUZJppNNH8FVqNXD 1auHxFKpQr0Kk6NajWhKlVo1aUnCpSq05qM6dSnOMoThOKlCScZJNNBRRRUGYV/Of/wRE/4qv4zf thfERfmS6/4RT5/X/hM/FXjrXF4Hy/ONCLe2OOCa/fj4na3/AMI18NfiF4j3+X/YHgfxZre/cV2f 2VoGoX+/cCCu3yM7gQRjORivw/8A+CCeiGD4bftD+I9pA1Xxx4J0QPgYY+H9B1i/Kg9SU/4SUEjO AHBGMnP9UeFP/Cf9Gj6UOaP3amY1fCDh/CT2/icW4zGZhC+758LGGita13daL+1vBJf2X9D/AOmb nTfLVzWt4D8LYKe1/bcc4/H5pT7y58FGnorWs5O60X78UUUV/K5/FIUUUUAFFFFAHnHxf+F3hj41 /DDxz8KPGVubjw3488O6h4f1HaqtPaG6j3WWqWe75U1HR9QjtNW02U8Q39lbSkHZivwo/wCCSnxQ 8UfAD45/GT9gf4tStZava+Idc1vwRDNIxtv+Eq8OW+3xTp+lNJl5tP8AFnhWzsPGWiNH5dq1lo2o XqhptWBf+h6v56v+Cvnwk8S/Br4sfBv9vL4TJLYeINE8Q+H9C8bXdvEz20PiPw4VvPAmuapHDiSe y1vSbS+8G699pkjsZbLTfD+ksGk1R0l/qz6NmYYLjHB8cfR64hxVKhlfinlrxfB+LxUmqGSeJ2QU pYzh7Fxm9MPSzelQnlmYOn+/x0aWBy+DtXkn/bf0RM1y7j/A+I/0VeKcZQw2TeNWUSx3AWNxs2sP w74x8L0J5hwpj4TemFo57Rw9TJs1dFfWcyhRy3K6b5cRJP8AoVorzH4L/FXw58cPhR4B+LXhOZJd C8eeGdN1+2jWUTPp9zcxbNU0e5cKo+3aHqsV7o+oLtXy76xuEwNtenV/L+YZfjcpx+OyvMcNVweY ZbjMTl+PwlePJWwuNwdaeHxWGrR+zVoV6dSlUj0nFrofxnmuV5hkeaZlkubYStgM1yjH4zK8zwOJ g6eIwWYYDEVMJjMJXg9YVsPiKVSjVi/hnCS6BRRRXGcAUUUUAfLnx2+HPjzxv8dv+CfHibwho9xq fh74P/tb+OfiN8VL2HUNOso/DvgPU/2CP23PhJp2sXdte31pc6vbz/E/4pfDjw+un6Rb6nqMV1rt tqstjHpOmapqWn/edfBnx2+HPjzxv8dv+CfHibwho9xqfh74P/tb+OfiN8VL2HUNOso/DvgPU/2C P23PhJp2sXdte31pc6vbz/E/4pfDjw+un6Rb6nqMV1rttqstjHpOmapqWn/edABRRRQAV8ff8FDP FHxF8EfsB/tx+NPg/fa/pfxb8IfsfftMeKPhbqfhS2lvfFOnfEXQPgv411bwTfeGrOC3u57vX7Tx NaaZcaPbQ2tzLPqMdtFHbzO4jb7Br4+/4KGeKPiL4I/YD/bj8afB++1/S/i34Q/Y+/aY8UfC3U/C ltLe+KdO+IugfBfxrq3gm+8NWcFvdz3ev2nia00y40e2htbmWfUY7aKO3mdxGwB7jRRRQAUUUUAF fzD/APBRH/goDqfjn4R/HD9kjxFpMmj/ABK8KftG3ng/VdTs4h/YfjX4QeEfEniPW/DmtqEIOk+I E1DRPA8esaawe1vNx1TT5IkurnS9K/p4r+N3/goZ8EvGHiz/AIKT/E74Y/D3QLvXPEvxM8SeCdR8 L6Zbqqtf3firwN4b1HUrqSZ9kFrp9lqZ1mbUdQuHS0sLKxu728migt5pE/tj6DHD3BPEPihm9TjH D4ZT4OyLDeI2R5ricTHCQyjH8JZ3lvtMTWr1JRoPBxoZm8Ri6WIvRisJTxl6VXB0q9L/AES/Zs8L eHXFXjNn1Xj/AAuDjPgDhnCeLPDmd4zFxwFPIsz4F4jyj22MxGJqzjhnl8MLnEsVjqOLUqEY4Glj k6NfAUMRR/oR/wCCf3xB+Bnhr4O/CP8AZk+Hnj3RPHPxA8CfDPT/ABB8QLXwPBeeI/D/AIb1vX5X 1/xQNa8Y6PZ3HhG0un8Wa3qGn2lhNrf9s300UxjsHWzv3tf0Rr5G/Yu/ZJ8HfsffBzS/h/oQtdU8 W6mLbWPiR4ySDZceKvFTW4SYwvIi3EXh/Rw8mn+HNOk2i1shJdzRnVNR1O5ufrmv5s8Wcy4azjxF 4tzThTH5xm+VZjneY4555nbw8MZnuPxmMr4rMc4p4TD4bDLL8Dj8ZWq1cvwNZ4jF0MG6LxeIliJ1 KdL+RPHHN+Ec/wDFfjrOuCczz7PskzXiPNsylxHxG8LTzDiXM8wx+JxubZ/SwOFweEWV5bmePxFe vleW4h4rHYbAOg8dipYupVpUSiiivzo/KAooooAKKKKAPxv/AOCvniv4L+Nf2ffG3wf13xro/h/4 0eBZPCvxf8DeF/E0V9oE/ia1s7q50jVJPCeq6paWuj+J5JvC+qeKrdbDQdR1K7Gr2H9n3VrBdwkR eHfsaf8ABRy2u/hZ+xL+y/4Wt5Nb+MmteK9D+Hfjq9vbWR9I8IfCzwf4nuIIJYpW2LqGu678PNMt dL06GIsujLHfateujxaTDqP6W/t0fsceFf2x/g/deErs2Wj/ABE8Nfa9Z+GHjKeEltE154VWbStR mije6fwx4kSGCy1y2iWUxNFYaxDbXF9pFnE384n/AATO+EXizwn/AMFI/APgbx5oF7oPiX4X3XxL ufE+i38WyewvtJ8A+JtPtHLcxy2z6lqWmXtjfQNJa39pLa3dnNNbXMMzf6P+DGA8JOO/os8Z5VnG IzHMM+8JJcWeJz4ZzXF4ZqjmseDswwGCrZfVw+Gw1XG8I5lmMMPj6uWVF7fCZ7SjhMyxWMwNfDyz D/W36PmWeBXiX9CzxByTPsXmuacUeBcuOfGT/U/O8bg7YfOo8AZpluXV8qrYXCYOrmPAmbZtTwmZ 18nqx+s4HiWjDAZvjMfluIws80/sPooor/OA/wAkj5w+KX7Sngr4WfGj4E/BbXLm1g1v41TeO7iO 8urqO3tPD+i+CPCd/rjX+oSSMkduur6pDa6Vp8twywyNHqGDugLJ+JH7YX7WvxS/b/8AirF+xf8A saLc3/gC4vJYfHnjm0uJbHTPGVnp88K6nqWp6qkRfSfhVoExDTTjzJvGN6bWK0tb5LnSNO1P83v+ CkH7Qk/x+/a8+I/iTRNSuJvC3gyZ/hV4Iktrl2jk8P8Ahdr3TNVurOWIqJLHxL4gvPEmsQhVHnad q8NvKJACW/Y7/gkLo3xX+H/gpdFT9jW+8E6F4puE1HxZ+0J4y8Zr4d8QeLkRnk0uGy8Fa14WTxFf 6BYWk7roMOjTReHN73F3LeyajqF9qFx/pvgfBDh/6Ovhdwv46ZjlWXcQeJlLhDL8RlXDXFGcZJlG RZJxfmeKzPOHxJisNnWaYCvnmZcO5PjcoynA8O5PHE4yebZdLGYehLE4qnmGVf7F5d9HHhf6J3gx wZ9JPNslyrinxho8CZVi8k4Q4zz/AIcyHhrh3jvOMbm+ey4uxuD4hznLMTxJm3CeQ5hkOSZdwrkM MXj6meZVPH4XDSxeNpZpkv6Sfsefsf8Aw3/Y8+GNt4K8HRR6t4o1VLW9+IHj+6tEg1jxlrkUbjzG XfM2naDppmmt/D+gxTyQabbPJNPLe6te6nqd99a0UV/nHxJxJnnF+e5pxNxLmeKzjPc5xdTG5jmO Mnz1sRXqWWyUadKjSgoUcPhqMKeHwuHp0sPh6VKhSp04/wCS3FvFvEnHfEuc8X8X5xjc/wCJOIMb VzDNs2x9T2mJxeJq2V7JRp0aFGnGGHwmEw9OlhcHhaVHCYSjRw1GlSgUUUV4h86FFFFAFe7tLTUL S6sL+1t72xvbea0vbK7hjubS7tLmNobi1ureZXhuLe4hd4poZUeOWN2jkVlYg/zn/tlfsG/E39kH 4gN+2R+w7caloui+HLmbXfF3w/0JJbm48FWh/f6zd6XpZMqeIvhjfRo58ReFriOc+HrVnnhgm8OR O3hv+jiqOp3Mtnp19dw6beazNbWk88ek6ebBb7UnjiZ1sbM6re6bpoubkjyYft+oWVp5jr59zDHu kX9Z8IvF3ifwmz+rjMnjhM2yPO6Syvizg/OeSrw5xXk9bmpV8BmmHrqeHpzVKrVWFzFwdTBOpVU/ a4OvjMJif3HwJ8duMfA3ietmGQwwWd8NcRUI5NxxwFxB7OtwnxtkGIcqOJyzOcLiVPC0qqo1q8cF mrpurl0q1ZTVfAYjH4LF/m/+yl/wUp+F37RXwW8aeL9T+w+E/it8J/AGv+NfiN8PJbp0S403wvo8 2o6j4p8JTzebPqHhW6eAJMn+kan4cubiLT9WWZJtM1PV/ub4PfFDw58avhb4C+K/hOUS6B498MaX 4jsU8xZZbJ763Vr3Sbp1VV+36NqC3Wk6igVfKvrK4iKgoQP48v8AgoJpGgeEPj3rXiP4afAT40fs xWniaHXrXWdD8cWNt4d0XXZtXt7nS9bufA9voDXWlWnhzxBpl3qFtrWj6Z4k1/Q51vLq2svsWnSv pyfqT/wQ2/aSfVfD3jr9l3xFfM914Y+0/Eb4bpMScaBqV9BbeNdEgckIkdhr19p2vWlsqtNPJ4g1 64LeVakJ/V3jX9FfhnLvCLMvG7w4pZphMBisZk3EM+EMdisHmdbhjh3MKdfB5zl9HMcrxuY4XNKO W5tWy/GYXFLEVKmHydYxYqvVnh3Vn/b30h/oU8H5V4EZv9Izwlo5zgcsxuP4f4qqcCZnjcBm+I4O 4TzSlicBxBlWHzXJsxzXA51QynPMTleOweMjiatbC5DHHxx2Jr1MLKvU/oMr5h/a/wDjb4m/Zx+C OsfG3w74et/Ftn4A17wrf+MfDMsrW11q/gnVtctPDeurpV6qyCw1TTf7atdbtrqWGe2VdMliu4Xt ZZiPp6vG/wBoj4ft8VvgL8ZfhtFbpc3fjb4ZeNvDmmROMhdY1Pw9qFvos6jI/eWurNZXMJJwJYUJ yARX8P8ABVbJaHGHC1XiTCUcfw7HiDKFn+CrzqUqWKySePoQzWhKtSnTrYd1MBLERhiKNSnWw83G vSnCpTjJf5xeHdfh7Dce8F1uLcDQzPhSPFORR4ny/E1KtGjjOHamZ4alneHliKFSlXwsquWTxUae Lw9WliMLUcMRQqU6tKE1/M7+z1+1N8GvFf8AwU0+Jv7YHxU8XQeA/h3pem+N/EPhK68TWV1NrN5C +g6Z8LvCGiWuiaJHrN7deIpPCWoS3k1hpiXwgi0/UHEzRQ+cf6ffhH8T9I+MvgDQfiV4d0fxHo/h nxXA+o+Gf+Ep0+LSNV1fQXcrpviBdLS7urix03XIR/aGkJqH2XUJ9MmtLy4srX7SkQ/j+/4Js/sb XX7WXx0th4m0+4/4U/8ADSWy8Q/Eq6ZZIodVcSyNofgaKYAH7V4mvLWVdRVGiltvDtlrM8c8F6bA Tf2iW1tb2dvBaWkENraWsMVtbW1tEkFvbW8CLFDBBDEqxwwwxqscUUaqkaKqIoUAD+zvp3YPw8yL i/hLhfhzEZjjeJeGuDeHeHMRhp4yhLJ+FOFMlwtdcP5NSw9LDRxFfOsxWMrZpjq2KxbhhsA8v9jh ObHyrQ/0G/aX5f4VcNce8DcGcJ4vNsy4v4Q8P+E+EsXhKmPws8h4J4I4ewWJjwtw/RwtDCQxWJ4h zZZhiM6zLEY3GunhMtllf1bBJ5nKtSmooor+Cj/McKKKKACiiigChquqadoemajrWsXttpmk6TZX WpapqV7KsFnp+n2MD3N7fXlxIRHb2lpbRSXFzcSssUEMbyyMqIzD+Zv/AIKJ+I/CvwV/bL+Av7c3 wM8XeFPGui+Ib7SbjxbP4E8TaJ4gtbzxB4HW00fW7C7vtFvbm1tofHPw3vINBjWSUPcnTNcnMu7d s/pyIBBBAIIIIIyCDwQQeCCOor+Zz/gqX/wTPPg2TxD+0x+z3oKL4Ncz6v8AFT4c6RbkHwnM5ea/ 8beFrGBNg8KytuuPEej26g+Gpmk1WwiPh2S8h8O/179DDM+C8F4rPLeLuIK+SU+KslzXhH6lisPQ rcOcWYDiDCTweJ4XzbESr4atleJxWKWBxeV4tvE4bFYrCLLqtKlWxGHlW/vD9nxnHh5l/jc8o474 oxHDlHjXh3POBHl+NwuGxHCfHGV8U4GpgMZwZnmKniMJiMlxeNxv9m47JsfzYvB4zG4GOV16FGvi sLOv+v8A+xh+1zD+19f/AB38WeHbT7D8NfBXj/S/BPw8S4tjBquq6ZaaGl/qHijVvMAmhm8QXl6s 1nprBBpml21lbyx/b2v5p/uWvw8/4IQ2xT9nH4u3m1ALj423FsHGPMY2ngTwbKVbjOxPtoMfJG55 MAck/uHX5R9IXhbIuCPGPjfhHhrCvB5Hw7jMuyrL6EpurV9nhMjyunUrYiq0nWxWKrqricXWaTrY mtVqtJyaPxH6VHBfDXhz4/eI3AnCGDeA4b4TzDKcjyvDzqe2reywPDmTUa2IxVdqLxGNxmKjXxmO xDjGVfGV69aUYubSK/L74jf8FR/gt8NtI/ahm1SS0vvE3wL+Jq/DDwX4OtdQVNX+I2tyeGrVjIoC Ttp+maf410zxvpet6wkE9npmi6HZXGLjVtTsdLvPt79oX4s6f8C/gh8Uvi7qRjMXgPwZrOuWcEpA S+1qO2a38PaWSSAG1bXrjTdMTJxvu1zX8LHw88MfEj4v/E6xh8KeBNX+MfjTV/EH/CQaj4Yh03XN YHiSaXUhf6o3iE6Bd6bqdro9/NJKNb1KLVtHNrbTzz/2rp7AXUf7r9En6PHC3i5lnHXFvH9XEYTh bhavkeGw1enjaWXUcTiqOKp51nuHrY6vVoUMNR/sfC4fLsTiKlei8NRz14qnVo1qNOrD+lPoMfRT 4K8dcn8S+OfFGvisBwVwViOHMJhMTSzChlOHxmNw+NpcQ8S4TEZjia2Gw2DoPIMFhcpxeKrYmh9T w/ErxlKtQr4elXp/t7+w7+yj8Q/27vjBqP7b37XaSaz4Jm1j7X4I8JahbSQ6R42vNIuJIdOs7PS5 ndbb4WeDZIfsdvpx82LxRqcE1vqE19bRa+dW/pMVVRVRFCqoCqqgKqqowFUDAAAAAAAAAwK+af2X G/aBHw40i1+PPw7+EfwpvdO0vTNN8O+BPhTqGp39p4f0mxtUtbbTdQhlkvNE0n7BBDFbWmm+H9Z8 QWMVsIwNRRozBX0vX4p4++I+deIHHOIpYueS4ThzhWH+r/BfDfC2YYXMeFOHOH8IoU8NhMnxeXv+ z8bUrUqVGePzLDLlxdanCnS9lgsLg8Lhv53+k/4s8Q+KPiTi6GOnw9gOEuCaf+q3h7wjwXmmCzbg rhLhfAxp0cHgchx2Vv8AszMatejRoVMzzfCLkx+Ipwp0PY5fg8Bg8IUUUV+Hn84hRRRQAV86ftMf st/CT9q74fXHgH4qaH9pEJnufDPinThDbeKvBurSxiMap4e1N4ZjCX2xi/025juNK1WKKKLUbK4E Nu0P0XRXq5HnmccNZvl+fcP5ljMnznKsTDF5dmWX16mGxeExFO/LUo1qbUldOUJwd4Vacp0qkZ05 zi/b4c4kz7hDPcr4m4XzfMMh4gyXF0sflWb5XiamEx2BxdJvkq0K9KUZRvFyp1IO9OtSnUo1oTpV Jwl/MN4Q+In7UX/BHv4oRfDz4oWeq/Fb9lLxTrM39hanYLIdNe3mlNxcav4HlvLiSHwl40toXkud f8AalexaXrM6XM8F1JHLaeLF/ceP9tP4Cal4c+A/jLw14y03xH4R+PnxNsvhV4d1qzuBB/YnifUf DHiHW7Sy8R2FwiXulah/a+k6T4Xu9KvorW+s9Q8TaZdTR/Yd0rdb+1Evwtn+DXimx+MXww8VfF7w LfwLBqfgrwZ4E13x/wCIbx1DSQXmnaf4ehN9pN3p7obm28Qi+0j+yJ0S4j1S0mCPX8PnxL1LQdA8 c+KNF+E958TNC+Hdl4u/tzwxoPxBFvpHjDRb2w86LTZtdstFv7nTU8R6RDPLaJqtt9nuWjJbyrdm MY/0U8N/D7hj6aGHq8TcSZFjOCfEHIo1MJxXxZw/gqFPhbxBjWwVXDYXM8RgadalLLOLcBjKmFx2 MqUKMsBmNOjVpVfaU8RTw+Uf6v8AhH4W8G/tCMNW4w4v4bx/h14p8NQq4LjbjjhbLsNS4M8U44jL q+Dwmc4vLaVehLJ+Ossx9TBZlj6uGoSyzNqdCtQrKrSxVHC5F/oEUV8XfsC/tPQftW/s3+EPiBez wHxzoobwZ8S7OEopg8ZaFBbi41EQrjyrbxLp0+n+JLaNF8m3GqSaejySWMxH2jX+evFXDOb8GcS5 5wnn+GeEznh7NMZlOY0NXGOJwVaVGc6M2kquHrKKrYavFcmIw9SlWptwqRb/AMreNuDs+8PuL+JO COJ8I8DxBwrnOPyPNcM25Qji8vxE6E6lCo1FV8JiFGOIweJgvZ4nC1aOIpOVOrFv8h/27/259L+C 0/7Qv7NfxM8PXWjP8Rf2dfFup/Az4gaPFc3unaxfeKfBviHww3hrxVZ4eXTdWtvF9lqKabq9gbjT ZrG50yDV7XSXjbUtR+Nv+COf7SngnwD4Hsv2d9F0LXvGnxm+LXxu8QeJJdN0y2NjoPg/4eaf4O8H 2t74r8VeI7uNraKCxh0HxFc2GlabBqF9qN8bLTZxpn9p2d2/uP8AwXO+DK+Jfgr8OPjbp9rv1P4Z eLZfDGuTRoA3/CKeO4o0huLp8ZaLT/E+kaRZ2ikgJL4huSoPmNjV/wCCK/7LX/CufhJrH7RfimwE Xi34xxf2b4QS4h23Ok/DTSr5iLmMuFliPjLXLX+0nUqY7jSNG8OX1u5S7cH++cuXg/lf0Icz4irY TF0824nz3LMozDh7D5pUpYfNPEbhmlisDltab5Z4yjl9TKpUOMs4wWGxWGjVnCeGwlbBRxMac/8A TzKV4DZN+zlzfiuvgcdSzzjHiXJ8hzThbCZzVo4XOvFjg+hjctyjEVW41MdQyupklTC+IGf5dhMZ hIV6tOeFwVfL44yNGf7d0UUV/nOf5NhRRRQAUUUUAFeR/Hj4QeGvj78IPiD8G/FZVNJ8feGr7SPt Qjjnn0rUFMV1oviC0gkIWS78Pa5Dpms2gf8Adm7s4Ek+RyD65XhX7Qv7Ovw0/aY+H178PviTpk0t uTJd+H/EelTfYPFHg3XPKaO21/wzqyK0tjfQZAmgcTafqVuGsdUtLyykkgb6DhTF0cv4myHMMRnO P4dp4DNsBjVn2V5fDNcxyarhMRTxGHzLCZdUx2WRxlbBV6dKvGj9ew0pcj5JuajCX1HBOOw+V8X8 M5piuIM04UpZZnmW5jHibJcrp53muQV8Di6WKwub4HKauZZPDH4jL8VSo4mOHeZYSUlTbhOU1GnP +dL9kL9uzW/2DPhl+1B+zl8UtNkuvHvwx1rXLn4RaHdJdS6fL4+k1ePwr4j8PXFwqIU8ORaj9h8e Wpja2TUdLi8US2lyLvUbDzP6ePAutT+JPBHg7xDcsHude8K+HtauHEaxB59U0izvpWES4WMNJOxE agKgO0cAV/Er+2h+x78aP2TviJNp3xJa+8VeGNeuZl8E/FRDdXOleMbCyiiSCC5muJ7ufSPEOn2K 28Oo+Hb+5eezEW/Tp9S0f7HqVx/ZX+zbfHVP2dvgHqZJJ1H4LfCy+JICkm78DaFcElQWCk+ZkgMQ OgJ61/cv00eEPD7/AFf4F8XOCcVlucYzxRzjM8y4g4gyiUlleY43D5DkOGqfUMHOU6mWQnmGEzPH Y3A4mU8wo5rjsfTx8/bUo0aH+kn7QngPwsfC/hr47eHWMyjPsf4z5/nGb8U8UZFOaybNsxwvDPDO Eq/2ZgJzqVcnp1M0wWcZnmOW4ydTNKGd5lmVLM6nt6MaGG9pooor/Po/yzCiiigD5c+O3w58eeN/ jt/wT48TeENHuNT8PfB/9rfxz8Rvipew6hp1lH4d8B6n+wR+258JNO1i7tr2+tLnV7ef4n/FL4ce H10/SLfU9RiutdttVlsY9J0zVNS0/wC86+DPjt8OfHnjf47f8E+PE3hDR7jU/D3wf/a38c/Eb4qX sOoadZR+HfAep/sEftufCTTtYu7a9vrS51e3n+J/xS+HHh9dP0i31PUYrrXbbVZbGPSdM1TUtP8A vOgAooooAK+Pv+Chnij4i+CP2A/24/Gnwfvtf0v4t+EP2Pv2mPFHwt1PwpbS3vinTviLoHwX8a6t 4JvvDVnBb3c93r9p4mtNMuNHtobW5ln1GO2ijt5ncRt9g18ff8FDPFHxF8EfsB/tx+NPg/fa/pfx b8IfsfftMeKPhbqfhS2lvfFOnfEXQPgv411bwTfeGrOC3u57vX7TxNaaZcaPbQ2tzLPqMdtFHbzO 4jYA89/bY+LXxQ+DHwLs/E/wYu/AWm/ErxZ+0B+x/wDAvw3rXxP8IeIfH/gbw7/w0z+118Dv2ctY 8U654J8KfED4V6/4p/4RbQPipqniHTdEsPiJ4S+36xpmnwXWrw2TXKSYv/Cl/wDgqB/0eb+wV/4r W/aF/wDprdYP/BRL/kg/ww/7P/8A+CUf/r0b9jyv07oA/OL/AIUv/wAFQP8Ao839gr/xWt+0L/8A TW6P+FL/APBUD/o839gr/wAVrftC/wD01uvpKL9sL9km4vPijp0H7Un7Oc2ofA6MS/Gqxi+N3wzk vPg/EdSGjCT4o2yeJ2n+H8Z1dl0oP4sTSFOpMLEH7URFXR3H7SP7O9p8Hov2h7r49/Be2+AE9kup QfHK4+KXgaH4PTac+pNo6X8XxMk11fBUlk+ro+lLdJrZgbUkaxEhulMQAPkr/hS//BUD/o839gr/ AMVrftC//TW68Xsf2Fv279P+OevftHR/tafsJ3XxX8Q+DdH8CT6zqH/BOD493NjpGgaPPdy7fDlk n/BUyCfTL3WEuLa3169ub7UZbu30vT7ey/s23OoQ3/0o/wDwUb/ZXtPjGfh1rHxi+EGh/D/UvgX8 H/jb4J/aA1b4x/Dqx+EXxET40fEr4ufDXwp4N8E+KbrXIdE8Q6/c6h8ItXvrD+ydYvhrMN9HbabB LPZXRr6f1H45fBTSPipoXwK1b4wfC3S/jd4o0S58S+Gfg5qPxA8J2XxU8ReHLJLuS88QaF8PbnV4 vF2r6JaJp9+9zqun6RcWECWV20s6C2mKejl+b5nlUMxp5bjsTgYZvl1XKMzWGqyovG5ZXxGGxVfA 15QalLDV62Dw8q1K6jWjT9nUUqUpwl62V57nOSU82pZRmWMy2Ge5TWyLOFg606DzDJsRisHjMTlu JlBqc8HicRgMJPEUVJQrwo+xqqdGdSnP40/4Uv8A8FQP+jzf2Cv/ABWt+0L/APTW6P8AhS//AAVA /wCjzf2Cv/Fa37Qv/wBNbr3/AEj9qLRNT/ay1z9kS8+GnxP8O+LNL+D178bdH+IWuweAh8NPG/hD TfFPhTwbqUfhObR/HuseOxqWna/4strK7TxX4E8K2UrWN/JpV7qkMaSvy2oftzfBHTP239B/YEul 8YL8Z/EXwZvPjLp+vpolk/wvEVrqV7FF8MrjxYNY+3RfF2/8M6TrvxGsvBw0B4v+FeaFf+I7vVrX ztLtNR848k+Kv2sbz/gqB+y/+yx+0t+0v/w1L+wV44/4Z3/Z/wDjJ8dP+EK/4d4/tC+Gf+Ew/wCF SfDrxH4//wCEW/4SP/h6J4g/4R//AISD/hH/AOyf7b/sHW/7K+1/b/7I1L7P9jm/UyvlD/grF/yi y/4KWf8AZgH7ZH/rOvxGr6voAKKKKAPyz/ZOvP8AgqB+1B+yx+zT+0v/AMNS/sFeB/8Ahoj9n/4N /HT/AIQr/h3j+0L4m/4Q/wD4W38OvDnj/wD4Rb/hI/8Ah6J4f/4SD/hH/wDhIP7J/tv+wdE/tX7J 9v8A7I037R9jh9//AOFL/wDBUD/o839gr/xWt+0L/wDTW63v+CTv/KLL/gmn/wBmAfsb/wDrOvw5 r6d8S/tEfs/+C/if4T+CPjH45/B3wn8Z/H0K3PgX4ReJfib4K0L4n+NLd2uUSfwn4B1TW7XxX4jh d7K8VZdH0m8RmtLlQxMEoQA+RP8AhS//AAVA/wCjzf2Cv/Fa37Qv/wBNbrxaf9hb9u+f47ab+0iv 7Wn7Cdp8WNO8D6n8PH1aw/4Jv/Hu303WfD2p3mn3iyeINPb/AIKmSz6hrOjjTzY6HqtvqFhJb6Zq GoafqMWqwJoy6N+lHw0/aC+Avxobxgvwd+N3wh+LDfDy/j0rx+vw0+JXgzx23gbVJo7qaHTfGA8L 61qp8M38sNleyx2etCyuJI7S6dYytvKU+Z/G3/BSL9lHQ4PhTq/gH4z/AAb+M/hDx9+0NB+zz4y8 cfDL4z/DfxP4S+DGtn4Q/Fv4xahrvxL13Rdd1TS/D9lpGgfCPVotSsNVvNMu7VL+LUp2isrO5Y+j lub5nk8sZPK8ficDLMMuxuUY/wCrVZU1jMszGk6GNwGJiny18NiKbXPSqKUVUhTqxUatKnOHrZRn uc5DPH1MmzPGZbLNcpzHIsz+qVp0o4/Js2oPDZjlmMhF8mIweKpNe0o1YygqlOlXgo16NKpDmP8A hS//AAVA/wCjzf2Cv/Fa37Qv/wBNbrN1n4Bf8FOde0fV9Duv23f2JtJt9a0rUdJm1Xwx/wAE5Pjv pniTS01Kzns21LQNQ1P/AIKja7ptlrNh532vTLq/0XVrOC9hhkudOvIVe3k+sNY/ax/ZY8PfDbwd 8ZvEH7S37P8Aofwf+Iuo2mj/AA++K2sfGT4daZ8NvHWr3813b2Ol+DvHV74jg8L+J9Rvbiwv4LSx 0TVL65uJrK7ihid7aZU579oP9qTQv2dfEHwJ0fxF8Nfid4u0j48fF/wN8FNM8ceCYfAM/hDwJ4t+ Iuv6f4e8KS+PG8S+PvDPicaZqt5fSvBL4I8MeN7yKGwu5r+ysYBDNLx0K1TDV6OIouKq0KtOtSc6 dOrBVKU1Ug50q0Z0qsVKK5qdWE6c1eM4yi2nwYbEVcJicPi6Dgq+Fr0sRRdSlSr01Vo1I1KbnQrw qUK0FOKcqVanUpVI3hUhODcX+Wf7Pv8AwSW/aZ/Zsa01HwH+0N/wT+1nxfZusqfELx9/wTZ+P3i/ xsLhTlbuz1G8/wCCqEGm6BdEACR/CukaBHLyXiJZs/Z//Cl/+CoH/R5v7BX/AIrW/aF/+mt0/wDa l/4KXfCv9kz4peLPhv45+D3x+8X6T8NPgZ4I/aN+MPxU+HGj/CjVvAHwk+E/j74ieOvhjouveJ9M 8SfF/wAJ/FbxHdQeJPh7rsuqaR8Lvhj8QtSs9Kl0++FvN5tzDafo1/n0/nXt8S8V8TcZZpVzrivP 834izWvdTx+cY/E4/EKF3JUqc8TUqexoQbapYeiqdClG0KVOEEor6Hi/jfjDj/Oa/EPG/E+e8WZ3 iLqpmef5ni80xag5OUaFKpi6tX6vhqbbVHC4dUsNQhaFGlCCUV+fn7E/xa+KHxn+Bd54n+M934C1 L4leE/2gP2wPgX4k1r4YeEPEPgDwN4i/4Zm/a6+OP7OWj+KdD8E+K/iB8VNf8Lf8JToHwr0vxDqW iX/xE8W/YNY1PUILXV5rJbZI/rOvhT/gnb/yQf4n/wDZ/wD/AMFXP/Xo37YdfddfPny4UUUUAFFF FABXxn+118Tfjx4Q8SfshfC/9nnxJ8I/BPjT9pr9pnW/gxqnjj4z/Cvxl8Z/C/hPwv4b/ZL/AGp/ 2kL2/sPAHgf41/ADVtU1/VNW+AGieGLW6uPiLaadpena/ql/Lpeq3MFpAv2ZXw9+1P8A8nL/APBK L/s/X4lf+ut/+CktAFbxJ+zf/wAFG/GWjXvhzxf+1Z/wTu8U+HtSj8nUdC8R/wDBMH47a3o99F/z zvNN1L/gqpc2dymeQs0LgHkDNfGvhP8A4I/ftOfD743+Ffj38NP2rP2N/hV4v8K3Wp3q6X8Of2AP 2gdL8J682p6Xe6Vcabrnh3xF/wAFQ/FdjB4fube9eO+0nwsvhhpoRi0vNPu/LvYv6AJZYreKWeeW OGCGN5ZppXWOKKKNS8kssjlUjjjRS7u5CqoLMQATXy/a/tyfsUX3gfxN8TbL9sH9lq8+G3gvxJb+ DfGPxCtf2gfhNceB/Cfi+7gnurTwr4m8WReLX0HQfEl1bWt1cW+h6pf2uqTQW080dq0cMjL9Vw/x xxhwrhsywPDvEucZTl2c4TFYDOMswmOrxyrN8HjcPPC4rDZplcpSy/MKNbDzlSlDF4askmnHllGL X2vC3iPx7wThM3y7hTi7P8jyriDA43LM/wAnwOZYiGS55l+YYWeCxuDznJpznleaUMRhak6M4Y7C V0otOHLKMZLwb/hS/wDwVA/6PN/YK/8AFa37Qv8A9Nbo/wCFL/8ABUD/AKPN/YK/8VrftC//AE1u vrT4h/tI/s7fCLwDoHxX+LHx7+C3ww+Fviv+yP8AhF/iT8Q/il4G8FeAfEn/AAkFj/amg/2B4x8S a7pnh3WP7b0wHUdI/s7Ubn+0rH/S7Pzrf95Xingr9vP9n3xR8c/ip8Btb8f/AA+8CeKPBXxJ+HHw y+G8nir4meCdOl/aC1r4kfAv4afHbTm+D2kXeqWmo+LpLPQPido+nyWGgprN3cyRLqMC/Yr61z8q fFHyh8Dv2Gf28v2dfC2reD/hb+1r+wjpela74t8R+NtYnv8A/gm78e7vU9S17xNfyXt1Jd3dp/wV N06KS1023Nromh24tVaw0HTNNs5pby6huL+69m/4Uv8A8FQP+jzf2Cv/ABWt+0L/APTW6+y9G+OX wU8R/E/xR8EfD3xg+FuvfGfwRpVrr3jT4RaN8QPCeqfE/wAIaHffY/sWs+KPANjq8/ivQNKvP7Q0 /wCy6jquk2lncfbrPyZn+0w7/L/g9+1P4f8Ai78Yf2jfgo3w4+Jnw18Ufs1TeAH8UX3xGj8AW+i+ LdE+JVt4xvvC3izwXceDvH3jO7/4R29sPBeoXrDxlZeDvENvBc2bXXh63WRmX0c2zbM89zLG5xnO OxOZ5pmOInisdj8ZVlWxOJr1HeVSrUm227JRjFWjCEYwhGMIxivVzzPM44lzfMM+z/MsZm+c5tiq mMzHMsfXniMXjMTVd51a1Wo3KTslGMVaFOnGNOnGNOEYrwT/AIUv/wAFQP8Ao839gr/xWt+0L/8A TW68A/axvP8AgqB+y/8AssftLftL/wDDUv7BXjj/AIZ3/Z/+Mnx0/wCEK/4d4/tC+Gf+Ew/4VJ8O vEfj/wD4Rb/hI/8Ah6J4g/4R/wD4SD/hH/7J/tv+wdb/ALK+1/b/AOyNS+z/AGOb6s+CP7cd3+0W PBnjH4Pfsp/tIeLP2ePiHq62ngn9pmS7/Z28PfDvxJ4XlvprK0+K+meC/FHx/wBF+Olx8KNU8k3m ha+nwmPiPxBpU1p4h0Twhf8Aha/sNeuqH/BWL/lFl/wUs/7MA/bI/wDWdfiNXnHlH1fRRRQB8zft qfGfxR+zj+xv+1p+0N4HsNA1Xxp8Bv2Zvjx8Z/CGl+K7XUb7wvqXij4XfCzxV448P2HiSy0jVND1 a80C81bQ7S31i10vW9H1G406S5istU0+5eK7h4v/AIUv/wAFQP8Ao839gr/xWt+0L/8ATW65f/gq p/yi/wD+CkH/AGYV+2D/AOs9fESv1FoA/OL/AIUv/wAFQP8Ao839gr/xWt+0L/8ATW6ZL8E/+Cnk 0ckM37ZP7A8sMqPFLFL/AME1P2g5I5Y5FKvHIjf8FWiro6kq6MCrKSCCCRX1ddftPfs1WPxJ8Q/B m9/aG+Btn8YPCPhy/wDGPiv4U3Xxa8A2/wASfDHhHS9NTWdT8VeIfAsuvp4o0Xw5p2kSR6rf65qW l22mWmmul9cXUdqyym94O/aL/Z8+Inw5174w/D/47fBvx18JPCsmtw+J/il4O+J/gnxP8OfDkvhq 3jvPEcWveN9E1y+8M6PJoFpLFda2moanbtpVvLHPfCCJ1YtNppptNO6a0aa2afRoabTTTaaaaadm mtU01qmnsz81/gf+wd+3X+znp/jjR/hJ+1n+wp4c0T4gePdR+I2raC3/AATi+P1xouj69qmkaJot 1Y+E7OL/AIKnWsmi+G/s2gWl5b6NcXGpmy1G81MWF5a6K+laJpHt/wDwpf8A4Kgf9Hm/sFf+K1v2 hf8A6a3XQeIv+Clf7JGjeMPgtbad8b/gr4l+DXxh8D/tBeNW/aW0T42fDO7+BngpP2fNV+Dmia/p PiLx/Br8/hVL3VtU+MujWFuTr1uNOvrCWzvUNxfWsdfTPiD9ov8AZ88J6j8LNI8U/Hb4N+GtW+Ob 2kXwT0vxB8T/AATo2o/GGTUIbG4sI/hZZajrltc/EF7231PTZ7RPCUWrtcw6jYywh0u7dpPRzfOM 1z/McRm2d5his0zTFqj9azDHVp4jGYqVChSw1KpicRUbqV6qoUacJ1qsp1arjz1ZzqSlJ+tnuf51 xPmuKzziLNMbnWc45Yf67mmY154rH4yWFw1HB0amLxVVyrYmusPh6NOdetKdas4e0rVKlWU5y/Nn 9oP9hf8A4KB/tM/De5+FXxK/ba/Y6tvCN7rvh7XdSsfCH/BPP476Cdf/AOEd1FNSt9C8Qz3X/BUD V7q58PXN1HBd3Fvo9zoOrJqFjpt3ba1BHbT2t3vfCj9i/wDbq+BnhiHwd8I/2kf+Cc/gPw/F5bS2 mhf8EyP2gobjUJ4kMaXmtapL/wAFXJtV13Udh2NqWs3t/fumFe5ZQAPs7x5+1Fonw9/aW+Bn7NGt /DT4ny6j+0Ba+N38FfFWzg8BN8KrfVvh/wCC/EHjzxB4Y1eW48e2/wARY9eTQNAa4gksPhzqHhxn 1Cxhn8RW9y8tvH4J8Qv+CjWi+B/iZ+0v4A0j9lP9q/4paB+yHdeE7b48/Ff4Zab+zzqngrwrH4s+ EXhT43R3WkeFPEX7RXhf46eN49G8B+MNMutYtfBHwd8Q6o2oQahp+i6frMkEL3HbPiniOfDtHhF5 1mMeGKGOr5pDIKWJqUcqnmeIVGNXMcRgqThQxeOdPD0KUMXioVsRSoUadClUhRhGC9CfGnFlThTD 8CviHNocG4bMsTnMOGKOMq0MkqZxi40IV81xeXUJU8NjsydLC4ahTx2Np4jFUMPQo4ahVp0Kcaaj /wCFL/8ABUD/AKPN/YK/8VrftC//AE1utr9if4tfFD4z/Au88T/Ge78Bal8SvCf7QH7YHwL8Sa18 MPCHiHwB4G8Rf8MzftdfHH9nLR/FOh+CfFfxA+Kmv+Fv+Ep0D4V6X4h1LRL/AOIni37BrGp6hBa6 vNZLbJH9l/DL4k+BvjJ8OfAfxb+GPiTT/GPw4+J3g/w54+8B+LNKM39m+JPCHi3SLTXfDut2QuYr e6jt9S0q+tbuOG6t7e7hEvlXVvBOkkSfn5/wTt/5IP8AE/8A7P8A/wDgq5/69G/bDrwD5g+66KKK ACiiigAooooA+M/2uvib8ePCHiT9kL4X/s8+JPhH4J8aftNftM638GNU8cfGf4V+MvjP4X8J+F/D f7Jf7U/7SF7f2HgDwP8AGv4Aatqmv6pq3wA0Twxa3Vx8RbTTtL07X9Uv5dL1W5gtIF8S+Lf7A/7Y /wAd7OS0+Lvx1/4JqeOmeHyI9U1f/gl58fF8RWcW0Ls03xTY/wDBVq08SaV8qqpbTdVtGKqozhQB 6x+1P/ycv/wSi/7P1+JX/rrf/gpLX6WyyxW8Us88scMEMbyzTSuscUUUal5JZZHKpHHGil3dyFVQ WYgAmvQyvN81yPHUczyTM8wyfMsNLmw+YZXjcTl+OoSunzUcXhKtGvSldJ3hUi7pa6Hq5Lnud8N5 jh844dzjNchzbCS58LmmS5hi8rzHDTunzYfG4GtQxNGV0nzU6sXdJ30R+Fn7M3/BLv8AbU/ZL1z4 g638Hf22v2VNMtPiHFo0OoeCdY/YG+OmueANOOiSXclnqOnWF/8A8FNJfF51uNb67tI7678c3Np9 hu7mG5027mFjc2P11/wpf/gqB/0eb+wV/wCK1v2hf/prde82v7cn7FF94H8TfE2y/bB/ZavPht4L 8SW/g3xj8QrX9oH4TXHgfwn4vu4J7q08K+JvFkXi19B0HxJdW1rdXFvoeqX9rqk0FtPNHatHDIy9 38Q/2kf2dvhF4B0D4r/Fj49/Bb4YfC3xX/ZH/CL/ABJ+IfxS8DeCvAPiT/hILH+1NB/sDxj4k13T PDusf23pgOo6R/Z2o3P9pWP+l2fnW/7yu/ibiniHjLNqufcU5ti88zqvQwuHxOa5hKNbMMZTwWHp 4TCyxuK5VWxtelhqVKh9axU62JnSpU4VK01Tgl6fGHGvFXiBnlbibjTPMdxJxDicNgsLjM7zScK+ aY+ll2FpYLBzzHG8kcRmGJo4ShRw31zGzr4ypRo0adWvONKmo/AHxi/Y8/4KG/Hb4Z+LfhJ8Q/2x f2Gbrwb420+LTdbj0r/gnD8fbHVEht7601K2udMvbr/gqdqNvZ6hZ31ja3lldTWF2kFzBFKbeTbt Pc6N+z//AMFLPD2kaVoGh/tf/sA6Xouh6dY6RpGmWX/BNL9oOGz07TNNtorOwsbWFf8Agq3titrS 1higgjXhIo1UcCvW/BX7ef7Pvij45/FT4Da34/8Ah94E8UeCviT8OPhl8N5PFXxM8E6dL+0FrXxI +Bfw0+O2nN8HtIu9UtNR8XSWegfE7R9PksNBTWbu5kiXUYF+xX1rn6C0b45fBTxH8T/FHwR8PfGD 4W698Z/BGlWuveNPhFo3xA8J6p8T/CGh332P7FrPijwDY6vP4r0DSrz+0NP+y6jquk2lncfbrPyZ n+0w7/PnmmY1Mrw+SzxuJllOFx+LzTD5c6svqlLMcfh8FhMZjY0b8n1nEYbLsDQqVWnJ0sNTgmkn fyp51m1XJsLw7UzHFyyLBZnjs6wuUutP6jQzbM8Ll2Bx+Yww9+T63isHlOW4apWac3RwlKEWkpc3 xp/wpf8A4Kgf9Hm/sFf+K1v2hf8A6a3R/wAKX/4Kgf8AR5v7BX/itb9oX/6a3Xv/AMGf2otE+Mnx m/aI+B0fw0+J/wAO/F37OF18PU8R3HxBg8BRaV4y0n4nQeMLvwl4n8DSeC/HvjS+fQdQsvBt/dCP xhY+D/EcMV1ZG58OwCUkcH+xv+2m/wC2j4L8I/FPwl+zB+0Z8Kfg78QvAcfxA8AfFb4wX/7M0Xh3 xfpt1f2Nppul2Phz4VftI/Fb4m6TrWp2t1d6vap4q8A+H9Kg0/SNQi1LVrDVpdJ0zVOA8w+Vvjlr P/BRj9mXw38Pvih44/aL/Yp+KfgvUf2mf2Ovgx4v8D+FP2F/jp8LPFGp+F/2lv2tfgp+zf4gv/Df j/V/+CjPxX0nw3r/AIb0n4r3fifR7rVPh14t0651HRrewvdLa2u5Z4f0zr5G/wCCnX/JtHgT/s/X /glL/wCvSP2Oa+uaACvmb9tT4z+KP2cf2N/2tP2hvA9hoGq+NPgN+zN8ePjP4Q0vxXa6jfeF9S8U fC74WeKvHHh+w8SWWkapoerXmgXmraHaW+sWul63o+o3GnSXMVlqmn3LxXcP0zXwV/wVU/5Rf/8A BSD/ALMK/bB/9Z6+IlAHUf8ACl/+CoH/AEeb+wV/4rW/aF/+mt0f8KX/AOCoH/R5v7BX/itb9oX/ AOmt1+jteG3X7T37NVj8SfEPwZvf2hvgbZ/GDwj4cv8Axj4r+FN18WvANv8AEnwx4R0vTU1nU/FX iHwLLr6eKNF8OadpEkeq3+ualpdtplpprpfXF1HasspAPg74sfsfft//ABw8B698Nfif+1T/AME/ PFPhDxFbGC+068/4JqftDLJDMuTa6lpl5F/wVcS60vV9PlIuNO1OxlhvLOdQ8MoywbW+Hn7L3/BS T4X+APA3w08M/tqfsQ3Phv4eeD/DPgfQLjX/APgnD8eL/XJtF8J6LZaDpcur32nf8FSdGsLvUnsr CBry5tNJ063muDJJFZwKwjX7p8HftF/s+fET4c698Yfh/wDHb4N+OvhJ4Vk1uHxP8UvB3xP8E+J/ hz4cl8NW8d54ji17xvomuX3hnR5NAtJYrrW01DU7dtKt5Y574QROrH5m8Rf8FK/2SNG8YfBa2074 3/BXxL8GvjD4H/aC8at+0tonxs+Gd38DPBSfs+ar8HNE1/SfEXj+DX5/CqXurap8ZdGsLcnXrcad fWEtneobi+tY69R51m0smjw9LMcXLI4Zi83p5VOtOeCo5nLDPCVMdQoSbhQxNbDclDEVKSg8RTpY eNf2n1eh7P2XxDnksghwrPNcdPhynm0s9o5LOvOeXUM4nhPqNXMsPhpt08Pi8Rg1DD4qrQVOWKpU MLHE+1+q4b2XP/8ACl/+CoH/AEeb+wV/4rW/aF/+mt0f8KX/AOCoH/R5v7BX/itb9oX/AOmt19c+ IP2i/wBnzwnqPws0jxT8dvg34a1b45vaRfBPS/EHxP8ABOjaj8YZNQhsbiwj+FllqOuW1z8QXvbf U9NntE8JRau1zDqNjLCHS7t2k4Xx5+1Fonw9/aW+Bn7NGt/DT4ny6j+0Ba+N38FfFWzg8BN8KrfV vh/4L8QePPEHhjV5bjx7b/EWPXk0DQGuIJLD4c6h4cZ9QsYZ/EVvcvLbx+WeMeAf8KX/AOCoH/R5 v7BX/itb9oX/AOmt14B+1jef8FQP2X/2WP2lv2l/+Gpf2CvHH/DO/wCz/wDGT46f8IV/w7x/aF8M /wDCYf8ACpPh14j8f/8ACLf8JH/w9E8Qf8I//wAJB/wj/wDZP9t/2Drf9lfa/t/9kal9n+xzfYWm ftpv4o/aW+LX7NngD9mD9oz4hTfAnx58Lvh/8XPjHoF/+zNo/wAJfBmpfFT4deCPipp2qTQePP2k fB3xf17RfDngrx7pOpeJ38J/CTX9VWe01TTvDmk+I76Kzgvua/4Kxf8AKLL/AIKWf9mAftkf+s6/ EagC58dvhz488b/Hb/gnx4m8IaPcan4e+D/7W/jn4jfFS9h1DTrKPw74D1P9gj9tz4SadrF3bXt9 aXOr28/xP+KXw48Prp+kW+p6jFda7barLYx6Tpmqalp/3nXwZ8dvhz488b/Hb/gnx4m8IaPcan4e +D/7W/jn4jfFS9h1DTrKPw74D1P9gj9tz4SadrF3bXt9aXOr28/xP+KXw48Prp+kW+p6jFda7bar LYx6Tpmqalp/3nQAUUUUAFfH3/BQzxR8RfBH7Af7cfjT4P32v6X8W/CH7H37THij4W6n4Utpb3xT p3xF0D4L+NdW8E33hqzgt7ue71+08TWmmXGj20Nrcyz6jHbRR28zuI2+wa+Pv+Chnij4i+CP2A/2 4/Gnwfvtf0v4t+EP2Pv2mPFHwt1PwpbS3vinTviLoHwX8a6t4JvvDVnBb3c93r9p4mtNMuNHtobW 5ln1GO2ijt5ncRsAeC/8FEv+SD/DD/s//wD4JR/+vRv2PK/SPxDp13rGga5pFhqlzod9qmj6np1l rVkA15o93fWU9tbapaKWUNc6fNKl3ACygywoCwHI/Lz/AIKf+LPCvgL9l7wr468deJvD/gvwT4L/ AG3/APgl54s8Y+MfFms6d4c8K+E/Cvhz/gpp+yJrHiHxN4m8Q6xc2ekaD4f0HSLO81TWdZ1S8tdO 0vTrW5vr65gtoJZV9c/4exf8Esv+kln7AH/iZH7Ov/zxqAPzy/Z++H37cP7PX/BOH4dfskeBP2Gt X8IfGn9mvS/gX4B8YfEfSde/ZF8b+Ev2gvDnhj4ueCIPjb8Wv2brXxz8aAdQ+NPjXwJZ+J/jV4WX 9qTwb8L/AA1pvxNuLW31061q2nxaRdeTeF/2Pv2yNH+Fvwd8YeMP2avH3xS1H9m//grP8b/20da/ Z18ceP8A9lw+L/jt8Jfjp4O+Lc+h+LvDd34J8Z+Ef2e4vjH8HPHPxvg8d3fhHWLr4Y+Cr/4j+DPG L+Er/UbOfwrr3iH9Zv8Ah7F/wSy/6SWfsAf+Jkfs6/8AzxqP+HsX/BLL/pJZ+wB/4mR+zr/88agD 4h/aQ/Y6+Jn7UXjz9sb40Xv7Jq6Bq/xc/wCCO2vfswfBfw18TdW+Amo+OPDXxv8AFHjH9q7Ude+G ct34W+I3jTwj4Z1PW7Dxp8LdR1jxVpviyfwFN/a9vaHxtc3Gj69Fp/mHw7/YZ/aL8OftmXPjP41e F/2q/H/gvxV8c/2Tf2jfAfjL4L+Ov2Kbf4U+AfEnwm/Z1+EfwN8QeF/2hrb4qzaT+0uT4J1Hwf43 lnb4E+IfGXhz4gfDvxvqSabplt421Xxf/b36W/8AD2L/AIJZf9JLP2AP/EyP2df/AJ41H/D2L/gl l/0ks/YA/wDEyP2df/njUAee6np/x6P/AAVW8PfFKD9lP4yXfwJ039lXxJ+zxc/HWHxl+zAngoeK PEvxS8CfFGDxNH4Tuv2iLf41P4M0/T9B1Hw5qVx/wqgeJx4mjjXT/CuoeHJU8Rn4K8Z/sCft46tp +p/ts6Z4umf9qTTf25rT9uXw1+yEdF+C0VxPpXheVf2d9G+A7ftEyeKo7SzuvEH7BdtL8PNWjj8Z Wvw4HxH1/V9UknS1uLjU3/Tf/h7F/wAEsv8ApJZ+wB/4mR+zr/8APGo/4exf8Esv+kln7AH/AImR +zr/APPGoAT/AIKwkn/glj/wUrJBUn/gn/8AtkEqcZBP7OnxG4O0lcjocEjPQkc19YV+OP8AwU2/ 4Kbf8E2/Hv8AwTb/AOCg3gXwL/wUG/Yg8aeNvGn7EH7V/hPwd4O8J/tX/AbxH4q8WeKvEfwG8faP 4e8M+GfD2j+PrzV9e8Qa7q95Z6Xo2jaXZ3Wo6pqN1bWNjbT3M8UTfsdQAUUUUAfKH/BJ3/lFl/wT T/7MA/Y3/wDWdfhzXgfwn+F/x+/Z5/bh/bh8RN+y5rHxo0D9sX4r/DX4r/DX9qnRvFvwXh0P4Y6D 4U+Anw3+FMXwh+Nuh+N/ib4T+L2l+HPht4x8Aav4q8HP8IvAPxLj1fSviFd3KQWWu22qwWvjn/BM n/gpt/wTb8Bf8E2/+CfPgXx1/wAFBv2IPBfjbwX+xB+yh4T8Y+DvFn7V/wABvDnirwn4q8OfAbwD o/iHwz4m8Pax4+s9X0HxBoWr2d5pes6Nqlna6jpeo2tzY31tBcwSxL9v/wDD2L/gll/0ks/YA/8A EyP2df8A541AH44+Hf2Ov+Cjfx+8N/taaH8Wvhz48+CnxA/ag/4JOXv7JsnjPXtc/ZH8P/C/wP8A tF+GNX8f6nc+F/BXhj9mTxTrHizSv2dtc1H4xa/p3wi8Q+MX+IXxStfClp41ufG8/he6u9A0/Xvt TxN8D/iT+1F8Pv8Agnz4M8V/8E9dT/Z88J/szfthfBXxx8TvhT8QvEf7L/iXwLZeBfhv+zt+0F4W XxB4Etfhr8Y/iHb+KPAngn4l+IvAen+GLTXNP0TxzqP9pWeuw+BE0zT9Yv7P66/4exf8Esv+kln7 AH/iZH7Ov/zxqfF/wVd/4JbTSRww/wDBSj9gOWaV0iiii/bG/Z3kklkkYKkcaL8Rizu7EKiKCzMQ ACSBTSbaSTbbSSSu23okktW29kNJyajFNybSSSbbbdkklq23oktWz8d/iN/wTs/aqtvGWm+Jp/h9 8b9U+CjfHL/grN4Y8RfB39mPxZ+xpbfFGH4Wftv/AB/8H/ELwD8S/DNj+1DJqXwan8FeLvCXhfxD oXxA8Lp4g8E/FnwtB42t7rSoI4b74g6BqH6BftefD/452vwM/wCCfvw6+Cn7LH7RPxwPwV+NP7Jf xX8axf8ACw/2TLPxt4N8Ifs+Xnhu61vw98Q9b+Iv7Q3wr8N+K/ixrFgJ4UuvhrJ4l8Car4h0rWp5 vE+i6XdaJcal9Nav/wAFQv8Agmh4fkhh17/goj+wvok1wjS28Wr/ALW3wB02SeNW2NJDHe/ECFpU VvlZ0DKG4JB4rI/4exf8Esv+kln7AH/iZH7Ov/zxq0rUa2Hqzo4ijVoVqbSnSrU50qsG0pJTpzUZ Rbi00mldNPZo1xGHxGErTw+KoVsNiKTSqUMRSnRrU20pJTpVIxnBuLUkpRTaaa0aPy4/4Kb/ALGP 7Snx/wD2qPFnxl+EX7K/xT8c+L9W/Yf+BHhD9mf4q6b8bvgX4G+H37O/7Xfwy+O3x8+JujeIf2hf APi74126fE3wf4EXxx4I1u70XT/gz+0R4U125ivtM0K1tNTC+ItO/o40xNRj03T49YntLrVksbRN UudPt5bSwuNRW3jW+nsrSe4u57W0muRLJbW811cywwskclxM6mRvg7/h7F/wSy/6SWfsAf8AiZH7 Ov8A88aj/h7F/wAEsv8ApJZ+wB/4mR+zr/8APGrIxOD/AOCdv/JB/if/ANn/AP8AwVc/9ejfth19 11+en/BMDxZ4V8e/sveKvHXgXxN4f8aeCfGn7b//AAVD8WeDvGPhPWdO8R+FfFnhXxH/AMFNP2u9 Y8PeJvDPiHR7m80jXvD+vaReWeqaNrOl3l1p2qaddW19Y3M9tPFK36F0AFFFFABRRRQAV8PftT/8 nL/8Eov+z9fiV/663/4KS19w1+b37fPxY+FnwO+Ln/BL/wCKXxr+Jfw/+D/wy8L/ALevjf8A4Sb4 i/FLxl4c+H/gTw7/AG3/AME0P+Civh3Rv7d8XeLNS0jw/pH9r+INX0rQtM/tDULf7frGp6fplr5t 7e20EoB9f/t5fA7xz+0x+xT+1f8As8/DLxNB4P8AiF8a/wBnz4sfDHwZ4iu7q5sbCw8R+M/BWsaF pS6rfWUc17ZaNfXd7Hp2s3llBPeWml3d3cWsE88ccT/A/iTXv20dR+A/7OPh/wCD/wDwT9+J/wCz bb/Dvx74U8IfF/4e+FNY/wCCf3ij4oaL4C0f4MfEXRtK1n9lm/8AHfxp8dfAu28KaB8VG8E+F9a8 S/FS20jx8PhVr/ii88J/DS91C4uLmz+q/wDh7F/wSy/6SWfsAf8AiZH7Ov8A88aj/h7F/wAEsv8A pJZ+wB/4mR+zr/8APGoA/LD4Cfsp/tb/ALPeh/8ABKv4reNv2SfGPx5vf2Nv2fP2nf2WPiJ8BNA+ IH7Oc/j7wD4l8feMvhovw7/aP+EN143+LHw9+DXiHQ73wj8K9Q8E3NpceNfBvi/w94A+IGnvZ+DN Ne213QdK9U+Mv7CPxc+Iup/8FEfinon7O2kab8Ufj/8AtKf8Ex/iF8GdTv8AW/hLH44j+HX7OVv+ xtrfxAsYfE9p4suLbwv/AMKt8S/Dv4pvHpr63px1vVNBmv8AwWniK31bw5d6p99/8PYv+CWX/SSz 9gD/AMTI/Z1/+eNWvpH/AAVC/wCCaHiCSaHQf+CiP7C+tzW6LLcRaR+1t8AdSkgjZtiyTR2XxAma JGb5VdwqluASeK1o0a2Iqwo4ejVr1qjahSo051as2k5NQpwUpSaim2knZJvZM2w+HxGLrQw+FoVs TiKrap0MPSnWrVGk5NQpU4ynNqKcmoxbSTb0TPz5/Yz/AGLvjd8IP2w9U8R/HHw1+1L4quPCP7R3 7bfxZ+G3xm0Dxd+xcv7JmseB/wBq7xh448dwP4l8P2a+Hf20E8anStW8J+DNe8H6rp3i7wfpHjjw X4Z1jQNZj+G+l6JbaH9H/Bjwf8cNd/bg/b81X4ifssfGz4ZfBf8AaO8A/BvwD4L+MWueNv2YdQ0C +j+Dvhb4oeDfEGpHQvh7+0T41+KmjQ+MV8aadq3w/lvvh7b3wsY7g+NLPwTqcEenS+xy/wDBV3/g ltDJJDN/wUo/YDimid4pYpf2xv2d45IpI2KvHIjfEYMjowKujAMrAggEEUz/AIexf8Esv+kln7AH /iZH7Ov/AM8as2mm00002mmrNNaNNPVNPdGTTi3GSakm0000007NNPVNPRp6pnjf7AOp/tX/ALOX wM/Zy/Yk+Lf7G/xIvdR/Z08E/D79nqT9pXwT4/8A2dZP2dPGHwx+Fmj2HgPwp8XtNtNR+NNj8dtP 1HXPBegabqmu/D24+CI1rSvFst9pcM9x4eex8TT+yf8ABWL/AJRZf8FLP+zAP2yP/WdfiNR/w9i/ 4JZf9JLP2AP/ABMj9nX/AOeNXxB/wU2/4Kbf8E2/Hv8AwTb/AOCg3gXwL/wUG/Yg8aeNvGn7EH7V /hPwd4O8J/tX/AbxH4q8WeKvEfwG8faP4e8M+GfD2j+PrzV9e8Qa7q95Z6Xo2jaXZ3Wo6pqN1bWN jbT3M8UTIR+x1FFFAHwV/wAFVP8AlF//AMFIP+zCv2wf/WeviJX6i1+XX/BVT/lF/wD8FIP+zCv2 wf8A1nr4iV6N/wAPYv8Agll/0ks/YA/8TI/Z1/8AnjUAfDPwZ+FX7aH7NHwW/bq/Z+8Afse2njr4 4+Mvib+3J8e/g1+1d4p8S/APWfgX8e9b+OnjD4hfEv4R6Z8WdE1z4vaL8arf4gWmm+KtE+Cut+G9 a+Gtr8OIrPwlY/a/iDY+C75dTr5p1z9i39tj4tfCj9vax174HfFC/u/i9+0J+wD+1V4K+Hf7RPjT 9kPQ7z9ovw3+zVqnweh+K37OnxEt/wBmTxGPhN4H8ReNvD3wHj0TTzc2k3g258Oa58NrLxb8SNQv Lfxgvhv9fP8Ah7F/wSy/6SWfsAf+Jkfs6/8AzxqP+HsX/BLL/pJZ+wB/4mR+zr/88agDxfVPgx4w /ac/a1/YK/aF8ffsb658KPh/8B/AX7Z9lr/hD43Xv7OfiDxH8P8Axz8RbH9mrSPhf4hi0P4U/Fb4 s+Hbi58R6T4U+I+naPf+HNY1fUPD1hpMg8TxeF5tV0e2uvyc8Ef8E0P2svCfh/4AaB8Yfh1+1P4n +HWofsI/sw/s4+J/h9+yf8Rv2FLPxZ8GfiF+zZ8YPiv8SbbQvGmp/tJ6kLCX4f6o3jTwRr3hPxh+ z78Rl8QaL4h8CtpfiDSr6x03wBeaN+50X/BV3/gltNJHDD/wUo/YDlmldIooov2xv2d5JJZJGCpH Gi/EYs7uxCoigszEAAkgVqav/wAFQv8Agmh4fkhh17/goj+wvok1wjS28Wr/ALW3wB02SeNW2NJD He/ECFpUVvlZ0DKG4JB4rWNCvOlUrwo1Z0KLhGtWjTnKlSlUbVONSoouEHNpqClJOTTUbs3hhsTU oVsVTw9eeGw8qca+IhSqSoUZVW1SjWqqLp05VGmqanKLm01FNnk37Wen/HrUP23f2DvGvw8/ZT+M nxZ+GfwI8QfGDXviP8S/BvjL9mDRPDulwfF/4SeJvhZplnZaH8Uv2iPhz8RNWvvC2qXtnr/i0af4 Hns18N3KP4WvPFOvx3Hh+Hxu90v9tH4LftM/8FMtS+Ev7Gfjn4qJ+1Z4x+DviL4A/GO4+KH7Mfh3 4EaVfeG/2QvhH8G7+++LVh4o+NMfx30nR/DfxB8Kau2sWPhv9n/xveaxomntNotnqa39ssn1N/w9 i/4JZf8ASSz9gD/xMj9nX/541H/D2L/gll/0ks/YA/8AEyP2df8A541ZGB69+xL+zkn7IX7IP7NH 7Ly68vimb4C/BP4dfC7UPE0cMttB4i1jwl4Z0/Stb1y0tJmeWxsdW1eC9v7Cwkd2sbKeC0LMYdx+ Zf8Agnb/AMkH+J//AGf/AP8ABVz/ANejfth13n/D2L/gll/0ks/YA/8AEyP2df8A541eR/8ABMDx Z4V8e/sveKvHXgXxN4f8aeCfGn7b/wDwVD8WeDvGPhPWdO8R+FfFnhXxH/wU0/a71jw94m8M+IdH ubzSNe8P69pF5Z6po2s6XeXWnapp11bX1jcz208UrAH6F0UUUAFFFFABRRRQB8PftT/8nL/8Eov+ z9fiV/663/4KS17/APt5fA7xz+0x+xT+1f8As8/DLxNB4P8AiF8a/wBnz4sfDHwZ4iu7q5sbCw8R +M/BWsaFpS6rfWUc17ZaNfXd7Hp2s3llBPeWml3d3cWsE88ccT/mx+2B+2v+zD4b/bO/YB8F+KPj B4H8JW/7P/7VnxF+Knxw+IPjHxP4e8H/AAo+FPhm5/4J/ftx/CWyi8b/ABJ8T6rpPhbRtZvfiB8V PAnhiHS5L95Y9Y8QWWl3b22qSx2T/bX/AA9i/wCCWX/SSz9gD/xMj9nX/wCeNXsZxw9n3Dzy+Oe5 NmeTSzbLMNnOWRzPBYjAyzDKcY6iwmZYSOIp03XwWJdKp7DE01KlVUJOEpJXPfz7hXibhaWVR4ly DOMglnmT4TiDJo5xl2Ky6WaZHj5VY4HN8DHF0qUsTl2MdCt9WxdJSoVlTk6c5JXPlTxJr37aOo/A f9nHw/8AB/8A4J+/E/8AZtt/h3498KeEPi/8PfCmsf8ABP7xR8UNF8BaP8GPiLo2laz+yzf+O/jT 46+Bdt4U0D4qN4J8L614l+KltpHj4fCrX/FF54T+Gl7qFxcXNn8t/AT9lP8Aa3/Z70P/AIJV/Fbx t+yT4x+PN7+xt+z5+07+yx8RPgJoHxA/Zzn8feAfEvj7xl8NF+Hf7R/whuvG/wAWPh78GvEOh3vh H4V6h4JubS48a+DfF/h7wB8QNPez8Gaa9trug6V+p/8Aw9i/4JZf9JLP2AP/ABMj9nX/AOeNR/w9 i/4JZf8ASSz9gD/xMj9nX/541eOeAfAnxl/YR+LnxF1P/goj8U9E/Z20jTfij8f/ANpT/gmP8Qvg zqd/rfwlj8cR/Dr9nK3/AGNtb+IFjD4ntPFlxbeF/wDhVviX4d/FN49NfW9OOt6poM1/4LTxFb6t 4cu9UufsZ/sXfG74Qfth6p4j+OPhr9qXxVceEf2jv22/iz8NvjNoHi79i5f2TNY8D/tXeMPHHjuB /Evh+zXw7+2gnjU6Vq3hPwZr3g/VdO8XeD9I8ceC/DOsaBrMfw30vRLbQ/0J03/gp7/wTU1q2urz R/8Agob+w1q1pY5+23Wm/tafAO/trPEZlP2qe18fyxW+IlaQ+ayYjBc/KCaxf+HsX/BLL/pJZ+wB /wCJkfs6/wDzxq1nQr0qdKrUo1adLEKUqFSdOcKdaMJcs5Upyio1FCXuycHJRlo7M3qYbE0aVCtW w9elRxUZyw1apSqU6WIjTlyVJUKkoqFWMJ+7N03JRl7raeh57+zfp/x6sP8AgoP+2z4+8a/sp/GT 4dfCT40+H/gJoPw/+Lfifxl+zBqvhbVJ/gJo/wASPD+sXl14d+H/AO0R42+KWl2PjV/Fel6n4FOo fDyC8bTVuh41s/BWpRJpsvz/AP8ABGb4A+Pf2V/gt8Mvgz8TP2Iv2lPgT8UdE+D2k6D8VvjH47+O vwG+J3wS8U+KfDOoZXTPAnhjwJ+2P8Y/FXh06s+qXWoaXNYfBHwNo/2Gwu7fWbrS5xpen3n2F/w9 i/4JZf8ASSz9gD/xMj9nX/541H/D2L/gll/0ks/YA/8AEyP2df8A541ZGBV/4Kdf8m0eBP8As/X/ AIJS/wDr0j9jmvrmvyH/AG6P+ChP7Avxx+Efwo+FvwU/bh/ZA+MHxN8Uft6/8EuP+EZ+HXwt/aW+ C/xA8d+Iv7E/4KX/ALJXiLWf7C8I+E/Gur+INX/sjw/pGq67qf8AZ+n3H2DR9M1DU7ryrKyuZ4v1 4oAK+Cv+Cqn/ACi//wCCkH/ZhX7YP/rPXxEr71r4K/4Kqf8AKL//AIKQf9mFftg/+s9fESgD9Ra/ Br4M/Cr9tD9mj4Lft1fs/eAP2PbTx18cfGXxN/bk+Pfwa/au8U+JfgHrPwL+Pet/HTxh8QviX8I9 M+LOia58XtF+NVv8QLTTfFWifBXW/DetfDW1+HEVn4SsftfxBsfBd8up19zf8PYv+CWX/SSz9gD/ AMTI/Z1/+eNR/wAPYv8Agll/0ks/YA/8TI/Z1/8AnjUAfkHrn7Fv7bHxa+FH7e1jr3wO+KF/d/F7 9oT9gH9qrwV8O/2ifGn7Ieh3n7Rfhv8AZq1T4PQ/Fb9nT4iW/wCzJ4jHwm8D+IvG3h74Dx6Jp5ub Sbwbc+HNc+G1l4t+JGoXlv4wXw3+imqfBjxh+05+1r+wV+0L4+/Y31z4UfD/AOA/gL9s+y1/wh8b r39nPxB4j+H/AI5+Itj+zVpHwv8AEMWh/Cn4rfFnw7cXPiPSfCnxH07R7/w5rGr6h4esNJkHieLw vNquj2117R/w9i/4JZf9JLP2AP8AxMj9nX/541H/AA9i/wCCWX/SSz9gD/xMj9nX/wCeNQB+Gngj /gmh+1l4T8P/AAA0D4w/Dr9qfxP8OtQ/YR/Zh/Zx8T/D79k/4jfsKWfiz4M/EL9mz4wfFf4k22he NNT/AGk9SFhL8P8AVG8aeCNe8J+MP2ffiMviDRfEPgVtL8QaVfWOm+ALzRv2J/az0/49ah+27+wd 41+Hn7Kfxk+LPwz+BHiD4wa98R/iX4N8ZfswaJ4d0uD4v/CTxN8LNMs7LQ/il+0R8OfiJq194W1S 9s9f8WjT/A89mvhu5R/C154p1+O48Pw+hf8AD2L/AIJZf9JLP2AP/EyP2df/AJ41H/D2L/gll/0k s/YA/wDEyP2df/njUAeafBL9ieax/wCCgH7c/wC1X8TPDPjfSf8AhN/i98B/EPwA13R/jh450fwl 4q8NeD/2SfhD8NPFV/4g+EngX4lWng7V5dM8d6D4p0NF+LHgSfVbhdPg1DS47jRRo183pf8AwVi/ 5RZf8FLP+zAP2yP/AFnX4jUf8PYv+CWX/SSz9gD/AMTI/Z1/+eNXxB/wU2/4Kbf8E2/Hv/BNv/go N4F8C/8ABQb9iDxp428afsQftX+E/B3g7wn+1f8AAbxH4q8WeKvEfwG8faP4e8M+GfD2j+PrzV9e 8Qa7q95Z6Xo2jaXZ3Wo6pqN1bWNjbT3M8UTAH3X8dvhz488b/Hb/AIJ8eJvCGj3Gp+Hvg/8Atb+O fiN8VL2HUNOso/DvgPU/2CP23PhJp2sXdte31pc6vbz/ABP+KXw48Prp+kW+p6jFda7barLYx6Tp mqalp/3nXwZ8dvhz488b/Hb/AIJ8eJvCGj3Gp+Hvg/8Atb+OfiN8VL2HUNOso/DvgPU/2CP23PhJ p2sXdte31pc6vbz/ABP+KXw48Prp+kW+p6jFda7barLYx6Tpmqalp/3nQAUUUUAFfH3/AAUM8UfE XwR+wH+3H40+D99r+l/Fvwh+x9+0x4o+Fup+FLaW98U6d8RdA+C/jXVvBN94as4Le7nu9ftPE1pp lxo9tDa3Ms+ox20UdvM7iNvsGvj7/goZ4o+Ivgj9gP8Abj8afB++1/S/i34Q/Y+/aY8UfC3U/Clt Le+KdO+IugfBfxrq3gm+8NWcFvdz3ev2nia00y40e2htbmWfUY7aKO3mdxGwB7jRRRQAUUUUAFFF FABRRRQAUUUUAFFFFABRRRQAV5z8Yf8AkkfxS/7Jz43/APUZ1OvRq85+MP8AySP4pf8AZOfG/wD6 jOp16uRf8jzJv+xrl3/qXRPb4Z/5KPh//sd5V/6n4c/Fv/ggv/ySP49/9lG8Nf8AqMyV+9Vfgr/w QX/5JH8e/wDso3hr/wBRmSv3qr9++l//AMpIeKX/AGNcq/8AWayU/qH6en/KXHjR/wBjrI//AFj+ HQooor+bD+QwooooAKKKKACiiigAooooAKKKKACvwV/4L0f8kj+An/ZRvEv/AKjMdfvVX4K/8F6P +SR/AT/so3iX/wBRmOv6T+iB/wApIeFv/Y1zX/1ms6P67+gZ/wApb+C//Y7zv/1kOIT9pPg9/wAk j+Fv/ZOfBH/qM6ZXo1ec/B7/AJJH8Lf+yc+CP/UZ0yvRq/Ac9/5Hmc/9jXMf/Uusfy/xN/yUfEH/ AGO81/8AU/EBRRRXlHiBRRRQAUUUUAFFFFAHnPxh/wCSR/FL/snPjf8A9RnU6/Fv/ggv/wAkj+Pf /ZRvDX/qMyV+0nxh/wCSR/FL/snPjf8A9RnU6/Fv/ggv/wAkj+Pf/ZRvDX/qMyV/VHh5/wAoqfSJ /wCyq8I//V1jT+1/Cn/lCT6V/wD2WvgV/wCtDmB+9VFFFfyufxQFFFFABRRRQAUUV598Ufip8P8A 4L+B9c+I3xO8T6d4S8H+Hrc3Go6tqMjAM5DeRY2FrEsl5qeqXsg8jT9L0+C5v764Kw2tvLIdtdWC wONzLGYXLsuwmJx+Px2Io4TBYLB0KuJxeLxWInGlQw2Gw9GM61evWqSjTpUqUJVKk5KMIuTSOzLs uzDN8fgsqyrA4vM8zzHFUMFl+XYDDVsZjsdjMVUjRw2EwmFw8KlfE4nEVpwpUaFGnOpVqSjCEZSa R299fWWmWV3qWpXlrp+nafbT3t/f31xFaWVlZ2sTz3N3d3U7xwW1tbQo80880iRQxI8kjqikj+fP 9rb/AIKS/En9oXxmP2V/2ALDXtf1TxDczaLrXxR8OxzW2r6vHujivY/Al88lqvhjwzZq0n9tfEPV ZLHbbh7nS7jStNhj1vUfFvip8f8A9qD/AIKy/Eq6+B/7O2i6p8Pv2d9Ju45PE2panLcWNjd6as6t a678VNY0/wC0QyPO8DXPh34daRJe+bdIZ5hrEumtrGlfuJ+yL+xd8IP2PPBa6D4D05dV8YaraQJ4 2+JOq20Q8TeLLmN/OMRZWlXRtAt5z/xLfDunyC0t0jinvZdS1U3Op3P9iYDgvgb6M+AwfE3ivgsu 428ZsVh6WO4V8JHWpYvJOD3ViquEzzxFrUJzp4jFQvCtg+HqU5KfuuXtXV+vZT/fWV+Hvhv9D7Lc Bxj435flPiJ9IHGYWhmfBXgU69LHcOcButBVsDxJ4s18NUnRxWMpp08RgOFaFSam1Bz9u6zzHI/n D9gn/gmh4F/ZWs7H4ifEM6Z8Qv2gbyJ57jxIyS3Wh+BDewsl1pnguO9RJJr90lmg1Hxdd28OqX0c ktvYQ6VYT3cF7+pVFFfzHx5x/wAW+JfEmN4s4zzjEZxnGNfL7Sq+TDYLCxlKVDL8twkLUMBl+G55 KhhMNCFOLlOpJTrVatWf8ceJnihxz4wcXZjxv4g59i8/z/MZKLrV2qeEwGDhKcsNleU4Gny4XLMq waqTWGwOEp06MHOpWmp4itXrVCiiivjT4A/nP/4LD/8AJ2/7GP8A3Df/AFZmkV/RhX85/wDwWH/5 O3/Yx/7hv/qzNIr+jCv6o8bP+TFfRT/7JXxE/wDWwpH9r/SK/wCUavoR/wDZFeK//re4cKKKK/lc /igKKKKACiiigAooooAKKKKACiiigAooooA+XPjt8OfHnjf47f8ABPjxN4Q0e41Pw98H/wBrfxz8 Rvipew6hp1lH4d8B6n+wR+258JNO1i7tr2+tLnV7ef4n/FL4ceH10/SLfU9RiutdttVlsY9J0zVN S0/7zr4M+O3w58eeN/jt/wAE+PE3hDR7jU/D3wf/AGt/HPxG+Kl7DqGnWUfh3wHqf7BH7bnwk07W Lu2vb60udXt5/if8Uvhx4fXT9It9T1GK61221WWxj0nTNU1LT/vOgAooooAK+Pv+Chnij4i+CP2A /wBuPxp8H77X9L+LfhD9j79pjxR8LdT8KW0t74p074i6B8F/GureCb7w1ZwW93Pd6/aeJrTTLjR7 aG1uZZ9Rjtoo7eZ3EbfYNfH3/BQzxR8RfBH7Af7cfjT4P32v6X8W/CH7H37THij4W6n4Utpb3xTp 3xF0D4L+NdW8E33hqzgt7ue71+08TWmmXGj20Nrcyz6jHbRR28zuI2APcaKKKACiiigAooooAKKK KACiiigAooooAKKKKACvOfjD/wAkj+KX/ZOfG/8A6jOp16NXnPxh/wCSR/FL/snPjf8A9RnU69XI v+R5k3/Y1y7/ANS6J7fDP/JR8P8A/Y7yr/1Pw5+Lf/BBf/kkfx7/AOyjeGv/AFGZK/eqvwV/4IL/ APJI/j3/ANlG8Nf+ozJX71V+/fS//wCUkPFL/sa5V/6zWSn9Q/T0/wCUuPGj/sdZH/6x/DoUUUV/ Nh/IYUUUUAFFFFABRRRQAUUUUAFFFFABX4K/8F6P+SR/AT/so3iX/wBRmOv3qr8BP+C9suqD4dfs 7QxWts+iyeNfHMt/eNMVvLfVIdC0NNItYLfG2W2u7SfW5bqYkG3lsrONQRcsR/S30PYOf0kfC6Kc I2zLOZ3nOMFanwvnlRpOTSc5KLjTgnzVKjjCCcpJP+vvoEU3U+lz4MRUoRazjiCpepONOLVLgziS q4qU2k5zUHClBPmq1JQpwTnOKf7a/B7/AJJH8Lf+yc+CP/UZ0yvRq8o+A1lcab8Dfgxp13qNzq93 p/wn+HVldateKi3mqXFr4Q0eCbUbpYgI1ub2SNrmdYwEEsrBAFwK9Xr8B4hjGOf55GE1VhHOMzjG pFSjGpFY2uozjGcYzippKSU4xkk7SindH8v8VRjDijiSEKka0IZ9nEYVYxnGNWMcwxCjUjGpGFSM ZpKSjOEZpNKUYyukUUUV454IUUUUAFFFFABRRRQB5z8Yf+SR/FL/ALJz43/9RnU6/Fv/AIIL/wDJ I/j3/wBlG8Nf+ozJX2l+3J+19Z/szTWvhL4k+Er2b4WfGr4d+OPDegfEXQPOu7vwp8QrXS722l0j xTopVvtWh6tZavo91p2paXOupWj2utK2kapBCZ7T8X/+CW/7X+mfATwf4o+EPhnwlqHj/wCN3xw+ L/g/RPh74ZVpdO8O2Md1psOkT+JfFmuLDPJbaNpUty93cWWnW9zf3NvZXXmyaVag6lF/c/hX4X8c 5t9Fjxghl2R1cXS4zznw3zbh7GUsThP7PxeXZFnmbQ4gxNfHTrxw2XwyCWDxLzlZhUws8BTpRxFa Kw9fDVq3+k/gp4NeJGefQq8fKeU8N1sdR8QM/wDCTPOFcfRxeAWV47KuGeJM8p8UYzE5lUxMMHlV PhiWX4x5+s1rYKeWUqMcViIxwmJwlfEf1cUU1A4VQ7KzhVDsilFZ8DcyoXkKKTkqpdyowC7EZLq/ hj8f68z/ADYe71v5q9n56pP70n5BRRRQAUVQi1TTZ9SvdGhvrWXVtOs9P1C/06OaNryzsdWl1GDT Lq5gDGSGC/m0nU47WR1CzNYXQQnyXx+cv7d//BR74dfshaVc+EfD66f4++PGpWKyaP4IjuHfTPDC XcYaz1zx7c2cizWNoUdbqx8PW8sOt65H5XlvpenXK6zF9fwVwHxb4hcS5fwlwhkmMzjPcycJUcJR p8kaOGlGnOWPxuIq8lDBZdSpVadatjsTUpYaFOcJOo3UpqX3nh74Zcc+KnF2V8DcCcO4/PuJc2dO eHwNCk6cMPg5xpVJZnmGKrezw2XZTQo1qVevmWMq0cJTo1Kc3Vftaan9G/tR/tbfB79knwLJ4w+J +tj+0r2K4Twl4I0p4Z/FvjLUYFBNrpGnvInk2UDvF/aeuXzQaTpaSRi4uWu7iys7v8EPA/wq/ar/ AOCvnxQg+Jvxc1PVPhl+zL4b1WddCtrOKeLRrWxEzx3OifDfT72JIPE/iq5SE2fiLx/qcNxaWE4e NxLHY6f4ST179lv/AIJ5/F79rjx8v7V37fOpa9d2Wuy2+qeHvhlq3n6VrPiPT0MkmnQ63p0BtG8C eA7NWQ6T4T06Gz1LVYpJJ7pdJs5PN1z+hzR9H0nw9pWnaFoOmafouiaPZW2m6TpGlWdvp+maZp9n EsFpY2FjaRxW1paW0CJDBbwRRxRRoqRoqgCv6hxXFnA30YMJi8g8NsZlfHnjjiMNUwXEXicqNLG8 NcAVKsHSxmTcBUcRTnTzDNaSlUoY3Pq8HTi06Tpy9pispwX9mY7jfw2+hpgMdwx4RY/JfE36R+Kw dXLuLPGNYejmPCPhfVr03Rx/D/hjQxVKdLNM7oxlVw2YcTYiEqUWnRdOXtsbkeXef/Bz4MfDX4B+ AtH+Gvwq8L2HhXwro0YKW1om+81O/eKKK61rXNQcG71jW78QxtfanfSS3MwjiiDJbwQQxeo0UV/H eYZjj82x2LzTNMbisxzLMMRVxeOx+Or1cVjMZiq83UrYjE4itKdWtWqzk51KlScpyk222z+B81zX NM9zLH5znWY43Ns3zTFV8dmWZ5liq2Nx+PxuJqSq4jFYzF4idSviMRWqSlOrVqznOcm3KTbCiiiu M88KKKKAP5z/APgsP/ydv+xj/wBw3/1ZmkV/RhX85/8AwWH/AOTt/wBjH/uG/wDqzNIr+jCv6o8b P+TFfRT/AOyV8RP/AFsKR/a/0iv+UavoR/8AZFeK/wD63uHCiiiv5XP4oCiiigAooooAKKKKACii igAooooAKKKKAPlz47fDnx543+O3/BPjxN4Q0e41Pw98H/2t/HPxG+Kl7DqGnWUfh3wHqf7BH7bn wk07WLu2vb60udXt5/if8Uvhx4fXT9It9T1GK61221WWxj0nTNU1LT/vOvgz47fDnx543+O3/BPj xN4Q0e41Pw98H/2t/HPxG+Kl7DqGnWUfh3wHqf7BH7bnwk07WLu2vb60udXt5/if8Uvhx4fXT9It 9T1GK61221WWxj0nTNU1LT/vOgAooooAK+Pv+Chnij4i+CP2A/24/Gnwfvtf0v4t+EP2Pv2mPFHw t1PwpbS3vinTviLoHwX8a6t4JvvDVnBb3c93r9p4mtNMuNHtobW5ln1GO2ijt5ncRt9g18ff8FDP FHxF8EfsB/tx+NPg/fa/pfxb8IfsfftMeKPhbqfhS2lvfFOnfEXQPgv411bwTfeGrOC3u57vX7Tx NaaZcaPbQ2tzLPqMdtFHbzO4jYA9xooooAKKKKACiiigAooooAKKKKACiiigAooooAK85+MP/JI/ il/2Tnxv/wCozqdejV5z8Yf+SR/FL/snPjf/ANRnU69XIv8AkeZN/wBjXLv/AFLont8M/wDJR8P/ APY7yr/1Pw5+Lf8AwQX/AOSR/Hv/ALKN4a/9RmSv3qr8Ff8Aggv/AMkj+Pf/AGUbw1/6jMlfvVX7 99L/AP5SQ8Uv+xrlX/rNZKf1D9PT/lLjxo/7HWR/+sfw6FFFFfzYfyGFFFFABRRRQAUUUUAFFFFA BRRRQAV+Cv8AwXo/5JH8BP8Aso3iX/1GY6/eqvwV/wCC9H/JI/gJ/wBlG8S/+ozHX9J/RA/5SQ8L f+xrmv8A6zWdH9d/QM/5S38F/wDsd53/AOshxCftJ8Hv+SR/C3/snPgj/wBRnTK9Grzn4Pf8kj+F v/ZOfBH/AKjOmV6NX4Dnv/I8zn/sa5j/AOpdY/l/ib/ko+IP+x3mv/qfiAoooryjxAooooAKKKKA CivNvit8ZPhL8CfB978QPjT8S/Avwo8EafJHBdeK/iF4q0XwjoS3c4b7LYRajrl5ZW9zqV6yNFYa ZbPNqF/Ptt7K2nndY2/N7xd/wVj8KarcXGnfs1/s4/Hf49GOR4ofHfifRIf2cfg+zxlo3kXxF8Z4 9G+J2t2DzqUtNZ8CfBjxrot/AjX9jqNxYS2Nze+hluUZrnFf6tlOW4/M8Ro3QwGEr4uqk7+9KFCn UlGKs25SSikm20k2fHca+InAPhtlf9ueIXG3CfA2T3lGOZ8W8Q5Vw9gqlSPKnSo4jNsXhKVas3On GNGjKdWc6kIRg5Tin9E/8FFP2eh+0j+yl8RvCGn2RvPGPhi0/wCFieAEjjElzJ4q8I291dLptqpw DP4i0SbWfDMIZ0RJtYinc/uRX4r/APBDz9nk+LPix42/aJ1yxL6P8LNOfwl4OlmiBjm8deLLKRNX u7eQscTeH/CMk9rcxMg/5G+ymjcPARX1Zq/7av8AwUP8Xokuj2H7H3wEimkZptKn8OfGH9qDVLa2 LR7YbXxU/jP9lbTBfbPN3Xlz4DvrOOQoBp1yil3+dPh3p37Uvwv8Pal4X+Hv7YHib4U6HrHijxD4 zv8AS/hL8DP2dbGwbxF4ovDe6vc2/wDwt/4b/G7UY7Qv5VvYWc2p3K6fY2tnYW8os7WKBf7X8O83 8YeG/APxI8IaHD+Jw64yzLASybHYrMssw6yrK8ypzo8aYapSnjniqdPMsJgMvwdCgsPy/wDClmte yqS535PD/wC3m+iF4N/Rp8ZPo80fGTE5/j+Nc3yqWRYnhXhDjjOMPlWTZxSqUPEHCU83hkFPJatH N8BleV5fQw2GzGpTi83znEy5Ks1OX9NFFfzgjXv221Ib/h5l+1g+CDtk+Ev/AATmMbYOdriP9g6K QoejCOWNypO2RGww6nSfi5+3l4cbzLD9tXUfGbqG8uL4t/s9/AnWbR2Yqw+0x/CPwv8AA27kRNpV Ft76zby3cPI8myVP59r+AviPSjzU8twGJf8AJQzbAxl9+JqYeH/k5/DOV/ta/oV5hX9li+NuLcjp 6f7Tmnh9xRWoatL4ckwWcYnTd/7Psna7sn/QrXI+PvHHhv4Z+CPFnxD8YX6aZ4X8FeHtW8Ta9fNg tDpmj2c17c+TGWUz3UqQmGztUPm3d1JDbQhpZUU/izov7c3/AAUE8HCF/Evgf9kX9oCCN1W6i8OT /F39lbVZLbagea0/tfUP2tNLutQjIkdbS4l0axvnKIb7SI8uvzZ+3d+3T4l/aS+G3g74FeIPAXjX 9jrw/wCIfEzXvxc+Ivxftb/xh8Hzp2gxw3+hWp+KXwEsPiro2g+C7i/8/WdQ1n4s2HwsaHUfD+k2 13aWcNyr3K4W8Hc9xPGGR5TxxRqcH8L1cdGpxHxRjqlF5ZlWS4RPE5nWjjsPPE4WeNnhKVWjlmGj OdTGY6pQo04SUpOP9ufRf+kx9EL6SfiRwdwhlX0lfC7JcpzrNMK85xXEnEVDgzOsNkdG+KzOWW8P 8YU8kzzMc3q4OlUwuV5ZhMsxGKxOa18HhHRUqunyZo3/AAU9/aFg8eftNeJvAdvHB46/ac8QeC7D wxfXDjUZvhpoPhhvEuk6Do/hbT54zYz6wuja7p2lQaldj7HFc2l3rE1hPqF2k9v+u37Bn/BMGy+H 2pWf7RH7UV5bfE/45a5cDxTpujanfx+KtC8HarqEjXx17VtWmnvrfxr45eSVboau0tzo+jXzNcaT Jqd/BZa9F4Z+zZ/wRe/Z88ZeF/DfxI8UftHn46eFPEFpDq2i3/wPvvDtr8PNdtGYAGw8bW934wl8 S6TIyTRm+0aXQZpDgRyW7ROH/bf4KfAb4X/s8+EIfAvwn0G88O+GYWWUWF14j8SeId1wARJcCTxF q2qvbyTMWkmSzNtAzsdsKqFVf6r+kP4++E+H4ex3C30dM0rZFiM+pZXlXGWbZJwliMulxBkORZNg OH8oyWHFWa5lgM6y7K8BlmXUMNLL8vyCtQzOPtJTzDDwxOYLM/8Aar6Vf0n/AAPwvCuZcF/ROzrE cN4rialk2SeIGd8O8DYrKZ8U8M8NZBlvC2R8P0+Nc6zfLOIcqybLMnyrDYSWVZXwvXwucxdWdXNM LTxeaRzj2Ciiiv8APA/ymCiiigAooooAKKKKAP5z/wDgsP8A8nb/ALGP/cN/9WZpFf0YV/Of/wAF h/8Ak7f9jH/uG/8AqzNIr+jCv6o8bP8AkxX0U/8AslfET/1sKR/a/wBIr/lGr6Ef/ZFeK/8A63uH Ciiiv5XP4oCiiigAooooAKKKKACiiigAooooAKKKKAPlz47fDnx543+O3/BPjxN4Q0e41Pw98H/2 t/HPxG+Kl7DqGnWUfh3wHqf7BH7bnwk07WLu2vb60udXt5/if8Uvhx4fXT9It9T1GK61221WWxj0 nTNU1LT/ALzr4M+O3w58eeN/jt/wT48TeENHuNT8PfB/9rfxz8Rvipew6hp1lH4d8B6n+wR+258J NO1i7tr2+tLnV7ef4n/FL4ceH10/SLfU9RiutdttVlsY9J0zVNS0/wC86ACiiigAr4+/4KGeKPiL 4I/YD/bj8afB++1/S/i34Q/Y+/aY8UfC3U/CltLe+KdO+IugfBfxrq3gm+8NWcFvdz3ev2nia00y 40e2htbmWfUY7aKO3mdxG32DXx9/wUM8UfEXwR+wH+3H40+D99r+l/Fvwh+x9+0x4o+Fup+FLaW9 8U6d8RdA+C/jXVvBN94as4Le7nu9ftPE1pplxo9tDa3Ms+ox20UdvM7iNgD3GiiigAooooAKKKKA CiiigAooooAKKKKACiiigArzn4w/8kj+KX/ZOfG//qM6nXo1ec/GH/kkfxS/7Jz43/8AUZ1OvVyL /keZN/2Ncu/9S6J7fDP/ACUfD/8A2O8q/wDU/Dn4t/8ABBf/AJJH8e/+yjeGv/UZkr96q/BX/ggv /wAkj+Pf/ZRvDX/qMyV+9Vfv30v/APlJDxS/7GuVf+s1kp/UP09P+UuPGj/sdZH/AOsfw6FFFFfz YfyGFFFFABRRRQAUUUUAFFFFABRRRQAV+Cv/AAXo/wCSR/AT/so3iX/1GY6/eqvwV/4L0f8AJI/g J/2UbxL/AOozHX9J/RA/5SQ8Lf8Asa5r/wCs1nR/Xf0DP+Ut/Bf/ALHed/8ArIcQn7SfB7/kkfwt /wCyc+CP/UZ0yvRq85+D3/JI/hb/ANk58Ef+ozplejV+A57/AMjzOf8Asa5j/wCpdY/l/ib/AJKP iD/sd5r/AOp+ICiiivKPECiiigAr8jP2mf8AgoV4qv8Axr4q+Af7Gdj4b8ReMPBup3fhf4wftE+M LW61b4SfBnxDbHyNV8FeDdEsZ7OT40/GrRCzRaz4dtNW0jwB8NtTAtviB4lv/E2nXnwyv/Vv+Ck3 x48X/Db4a+Avg18K9fvPCvxZ/ag8Y3/w20fxppNytvrvwy+HOieGtU8W/GD4oaE2fMg8RaP4V06H wV4H1aNZk8PfE74h+A9fvbS907TbyzuPzm8G+DvDPw+8K6D4J8G6PaaB4X8NadBpWjaTZB/JtLS3 BwXkleS4urq4kaS6vr+7mnvtRvpri+vri4vLieeT9y8HvCyjxtVr51ncqkeHsvxCw31elOVKtmmN jCFaeH9rG06OFoU6lKWJqU3GrUdWFGhOElUq0v8AKz9pD9PjMvouYDKPDPwwpYKv4wcY5NPO3nGY Yeljsv4F4aq4rE5fhc4/s+up4bM89zTGYPH0snweMhVy/CRwFfH5phsVRlg8FjuK0z4PaJP4vt/i j8TNd8UfHb41RRTxn4x/GXULbxZ4x08XjRyX9p4IsYrHTvBnwl8P3k0MUs3hD4Q+FfAnhIyxRzto j3Qe4f1uiiv7WyzKcsyXCU8BlOAwuXYOkkoYfB0KdCmnZJzkoRXPUla86s3KpUleU5Sk23/zA8c+ IHHHiZxDjOLPEHizP+M+JMfJyxOc8R5pi81xsoc0pww9Kpi6tRYbB0OZwwuBwqo4PCUuWjhqFKlG MEUV81+F/wBrr4BeMPiM/wAKtE8Xa6PGB8b+OPhpYjWvhn8U/C/hXX/iB8NX1xfHXg7wn8Q/E/gr R/h74x8ReGk8Na/c6hpfhXxRrF19i0m+v4I5rKBrivpSt8NjMJjYTqYPFYbF06dR0qk8NXpV4Qqq MZunOVKU1GooThJwk1JRnGTVpJvys84b4i4YxGHwnEuQZ1w9isZhIZhhMNnmVY7KcRisBVq1qFPG 4ejj6GHqV8JUr4bEUYYmlGVGdWhWpxm50pqJRWdrGsaT4e0nVNf1/VNO0PQtD0691jWta1i9ttM0 nR9J0y2lvdR1TVNSvZYLPT9O0+zgmu729u5oba0toZZ55Y4o3cWbS7tb+1tr6xube9sr23hu7O8t Jo7m1u7W5jWa3uba4hZ4Z7eeF0lhmid45Y3V0ZlYE9HNHm5OaPOoqTjdcyi20pcu/K2mk7WbTW6P JdGsqKxDpVFh5VJUY13Tl7GVaEYznSVW3I6kYThOVNS5oxnGTSUk3YooopmZ4/Y/Ceb4e+Lb74m/ s4+NvEH7NXxT1G+Gp654g+GcNgng34gXmLdJk+MPwi1KGf4cfFJL22tYdOm13XdDh+IWk6d5ieDf HfhO+aPUIv0+/ZJ/b/m+JnjLS/2ef2lfDWhfCb9pK+0/Ub7wZd+HLrULn4M/tC6XoVr9r1rV/g7r etFtU0fxdpFgkmseLPgl4subnxp4Y0pLvWPD2tfEfwbpOp+NYPiGuA+Jfw70f4neF5fDuqXep6Nf WuoaZ4i8JeL/AA9dHTfFvgDxx4du49U8JePfBmsIrTaP4q8KazBbappF9GGjMkT2d9BeaZd31lc/ jfiJ4O5DxdhcTjcrw2HyfiSMJ1KOLw1ONDC4+qk2qOZUacVTn7V+79dhBYmlJxnOVelB0Jf6VfQ2 /aReLX0ds/yXhnjzO848RvBWtiMPgs04fzrFVc0zzhLL6k4U55nwTmeMqSxdD+zofvv9WcRiZ5Hj qMK2Gw1HKsbiY5pQ/pPor43/AGD/ANofXv2kv2d9D8VeO00u3+LngbxJ4t+DvxqtdFgaz0lvih8M tYm8Pa34g0fTnlnk0rw98QtMj0X4neFdJnuLm50zwp410Sxurme5gllb7Ir+EcRQrYWvXwuIpypY jDVqlCvSmrTpVqM5U6tOS1tKE4yjJX3TP+sXKM2y3P8AKcrz3J8ZRzDKM6y7BZtlWPw7csPjstzH DUsZgcZQk0nKjicLWpVqTaTcJxbS2CiiisT0QooooAKKKKAP5z/+Cw//ACdv+xj/ANw3/wBWZpFf 0YV/Of8A8Fh/+Tt/2Mf+4b/6szSK/owr+qPGz/kxX0U/+yV8RP8A1sKR/a/0iv8AlGr6Ef8A2RXi v/63uHCiiiv5XP4oCiiigAooooAKKKKACiiigAooooAKKKKAPlz47fDnx543+O3/AAT48TeENHuN T8PfB/8Aa38c/Eb4qXsOoadZR+HfAep/sEftufCTTtYu7a9vrS51e3n+J/xS+HHh9dP0i31PUYrr XbbVZbGPSdM1TUtP+86+DPjt8OfHnjf47f8ABPjxN4Q0e41Pw98H/wBrfxz8Rvipew6hp1lH4d8B 6n+wR+258JNO1i7tr2+tLnV7ef4n/FL4ceH10/SLfU9RiutdttVlsY9J0zVNS0/7zoAKKKKACvj7 /goZ4o+Ivgj9gP8Abj8afB++1/S/i34Q/Y+/aY8UfC3U/CltLe+KdO+IugfBfxrq3gm+8NWcFvdz 3ev2nia00y40e2htbmWfUY7aKO3mdxG32DXx9/wUM8UfEXwR+wH+3H40+D99r+l/Fvwh+x9+0x4o +Fup+FLaW98U6d8RdA+C/jXVvBN94as4Le7nu9ftPE1pplxo9tDa3Ms+ox20UdvM7iNgD3GiiigA ooooAKKKKACiiigAooooAKKKKACiiigArzn4w/8AJI/il/2Tnxv/AOozqdejV5z8Yf8AkkfxS/7J z43/APUZ1OvVyL/keZN/2Ncu/wDUuie3wz/yUfD/AP2O8q/9T8Ofi3/wQX/5JH8e/wDso3hr/wBR mSv3qr8Ff+CC/wDySP49/wDZRvDX/qMyV+9Vfv30v/8AlJDxS/7GuVf+s1kp/UP09P8AlLjxo/7H WR/+sfw6FFFFfzYfyGFFFFABRRRQAUUUUAFFFFABRRRQAV+Cv/Bej/kkfwE/7KN4l/8AUZjr96q/ BX/gvR/ySP4Cf9lG8S/+ozHX9J/RA/5SQ8Lf+xrmv/rNZ0f139Az/lLfwX/7Hed/+shxCftJ8Hv+ SR/C3/snPgj/ANRnTK9Grzn4Pf8AJI/hb/2TnwR/6jOmV6NX4Dnv/I8zn/sa5j/6l1j+X+Jv+Sj4 g/7Hea/+p+ICiiivKPECiiigD8Wf+CnGnXelftRfsH+Pr6LPha+8Ifte/Ay3uZGjEEPxJ+Ill+z/ APF3wlEodGb7bc+Bv2b/AItJbGN42MC3sZLCTy28Vr9hf2qv2cfDf7VHwV8SfCbXdVu/C2qz3Ok+ Kfh58QdLtYbzXfhj8UPCN/FrngL4haJbzywRXtx4d161t31PQ7i4g03xb4buNc8G66ZvD/iHVbWf 8JvDHjDxbonjfXfgL8d/D1v8Of2jfAtkLzxD4Uje5Phj4g+GEuBY2fxi+CesXyxt41+E/iScxtHc wGTX/Amr3LeB/iHYaF4ssZLS4/rr6PHGOW/2XieDsXWp4bMqeNr4/LY1JRgsfh8RTputRotu08Vh qtKdSVO6nUoVYypxlGhWcf8AnU/bIfRs42fHeTfST4ey3G51wTjeGMq4U42q4OlVxVThLN8nxWMh lmZ5jCnFvC5FnWCx2FwVHGOMsPhc3wNWljK9GpmuW0q3qlFFFf08f4VH4i/Cr4OfF34efHvw/wDG vxx4e+Lnj/4UL+3J+2Nbad8J5PB1yifBbxD8WfiT410T4Z/tS+FND8PeF9O8TeNfBOs+G9c8SeGf FGueL77xfpHhfw38Srf4jeE59G8P6Jq0qQeBfhr4vtvjZ8OrhfhZ8UrH9ryw/be+LPiv4zfHW68B eOLLwZ4g/ZTv/EXxSudB0yb4z3eiRfDzxP8ADfUfhPqHw08J+BPhJY+J7/VfDHjXT7e4g8MaXqfh jW7+D9waK+Kp8FYaiqEaeNrOFLFU8W1XpxrzVaMcvhUq4epOfPh8Qo5Zh6eErp1JYCjWxlDDxVGt Sp4f+nsZ9J3PMxqZpiMXwxllPFZhkGL4djPLMbWyvDVMtnV4trYTLs3wWGw7w+cZPOtxtnGL4iyq ccLS4szHL+Gs1zitPM8rx+Lzn+efTfh38Tvit8FPgV8Ar34EfGKbWPhZ/wAE9/2wfgt4+u/H/wAL vFegeBpvjdqHhj4OaP4M8N6ZrnizS7LT/E95c694Sm1vwt4t0xbzwrqyGC58LeI9U1LTdettFl8U fB281zxT8GJ9I8IeLvgt8FtO/Z++ES/Aq/0T9hr45fEfxR8IPjl4R+J/jvxN8aU0zwZ4Lm8KeI/g D8RvE+uv4WvdR8a+JPA8+gfE7wzby29prE2mQaoPEv8AQnRXJ/qDhZR/e4116nssHQnOph5U1Uo4 DC4XB4ajOWFxWGxPsVSw3t6sIYmDnjlhsVGVNYd0a30Mfpc55Qq2y/henlOFjjeI8yw9HB5xRxcs HmfFuf57xNneaYajn2Q53kzzKePzeOWYHEYvJcXTwvC0s5yGtQxjzr6/l/wr8G/gxYN+2D+178Zf F3gfVW1qPx58MbL4S+LfEdjrB0u28Py/s3fDHRPF2ofDg6kBosTajq8Op+G/Fuu+Govtd/NpA8P6 xeyDR0srf7qoor7LAYCjl9KvToqP+0Y7H4+rNQjCVStj8ZWxc3NxS55U1VjRjOV5OlSppu0Ul/NX F3FuZcY4/LMdmUqi/sjhXhHhLAYeWJr4ijhct4R4byzh7CxwyryksNTxby+pmdbDUVChDG4/FzhF upKciiivJ3PxH+P3xJm/Zi/ZonB+JEsFlJ8W/i4NPXVvBP7LfgbVVV5PFfiud/8AiV6p8WNb0xpj 8HvhG8z6x4l1V7bxV4jstO+Guj69rY5OIOIMq4YyrFZxnOKhhcFhYNtya9pXqtN08NhqbadbE1mu WlSjq3eUnGEZzj9D4Q+EXHvjlx9kXhv4b5Fic94lz7EwpQhShUWCyzBKpTjjM6zrGRhOnluS5bTq Kvj8dXShThy0qUauJrUKFX9BP+CSVheT+Bv2wfHyQyR+F/id+27471PwXMQggu7D4XfA/wDZ7/Zw 8Y3Np5aIrQ/8La+CHxHt5X+YyXsF3IzuzFj+sleZfBj4QeBPgD8KfAPwY+GelSaP4E+G/hrTvC/h 2zuLqbUNQktNPixNqWs6rdF7zWvEGtXj3Os+Itdv5JdR13Xb/UNX1Gae+vbiV/Ta/wA087zKWc5z m2bzpqlPNczx+YzpRd405Y7FVcTKmnpdQdVxWiVlolsf9vnhhwTQ8NfDXw88OsNi54/D8A8D8J8F 0MdVjy1MbR4WyHAZHSxdSN5OM8RDAxrSTlJqU2nJvVlFFFeYfchRRRQAUUUUAfzn/wDBYf8A5O3/ AGMf+4b/AOrM0iv6MK/nP/4LD/8AJ2/7GP8A3Df/AFZmkV/RhX9UeNn/ACYr6Kf/AGSviJ/62FI/ tf6RX/KNX0I/+yK8V/8A1vcOFFFFfyufxQFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAfLnx2+HPjz xv8AHb/gnx4m8IaPcan4e+D/AO1v45+I3xUvYdQ06yj8O+A9T/YI/bc+Emnaxd217fWlzq9vP8T/ AIpfDjw+un6Rb6nqMV1rttqstjHpOmapqWn/AHnXwZ8dvhz488b/AB2/4J8eJvCGj3Gp+Hvg/wDt b+OfiN8VL2HUNOso/DvgPU/2CP23PhJp2sXdte31pc6vbz/E/wCKXw48Prp+kW+p6jFda7barLYx 6Tpmqalp/wB50AFFFFABXx9/wUM8UfEXwR+wH+3H40+D99r+l/Fvwh+x9+0x4o+Fup+FLaW98U6d 8RdA+C/jXVvBN94as4Le7nu9ftPE1pplxo9tDa3Ms+ox20UdvM7iNvsGvj7/AIKGeKPiL4I/YD/b j8afB++1/S/i34Q/Y+/aY8UfC3U/CltLe+KdO+IugfBfxrq3gm+8NWcFvdz3ev2nia00y40e2htb mWfUY7aKO3mdxGwB7jRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAV5z8Yf+SR/FL/ALJz43/9 RnU69Gr8cv8AgpX+0X8cP2SfEeheMdEji8c/AL42+EPEXwz8ZeC9ZYRHwl46j0m9is9f8K69HA95 o91r3h68Mw0WZdR0K/l8KazcPY2Oo6kdUX9G8KOCc18QuOsl4ZyKvl9PO8RVljcrwmY4lYOnmtfK 0sxrZZhsVUi8NRx+IwWGxVTBrGVMPhq9ajHDPEU6telf9a8EPDrOvFTxJ4e4O4axOV0uIsVWnmOT YHNcYsvp53iclSzXEZNg8bVg8JQzPFZdhMbVy9Y+thcJicRh4YOWKpVcRR5vIv8Aggv/AMkj+Pf/ AGUbw1/6jMlfvVX8iv8AwSm+KHxt1D4jad+zH8KbuLwv4Y8feN7T4lfF/wAcWUJl8S2Pw98EaXEu p6Bo93IskPh9PEkrW/h59ctYJNYhv9d0z+zrvSvJnuJ/66q/c/pt8LYzh/x74ozPG4vATlxb9Tzz A4DDV5V8Zg8qpZdgcow2IzJRpqjhquPxmW5hLD4WNWpXjhsPTxFeNKOJoxl/Sf7RfgvH8L/Sc4yz nMcdllSfHKy/iPLcsweJlicfgMloZRlmQ4TFZso01h8JWzPH5RmssJgo16uJhg8LSxWJhQhjMPGR RRRX8jH8JBRRRQAUUUUAFFFFABRRRQAUUUUAFfgr/wAF6P8AkkfwE/7KN4l/9RmOv3mmiWeKWFzI qTRvEzQyywSqsilGMU8DxzQyAElJYZEljbDxurqGH8eH/BSD48fHPUdevv2T/jqbTxNqnwJ+Jer6 p4P+JbQRad4g8WeBdf0aN/CsniazsYItJv8AU5/D93pN6+sWMNhK0zXVrqUF7fpNfv8A2B9CPg7M eI/HLh3PctxOXtcFVq2cZtltfEOhmNbJsdlmaZPVzLL6coexxVLLsxxuW0MfRdaniILMsLVw9LEw WI9h/ev7OfgDNuLPpIcJ8S5RjMrcfDuvXz7PMoxOLeGzXEZBmOT5zkNbN8qpTp+wxtDKc1zDKMNm dD6xSxdOOb4OthaGKpxxTw/9Zvwe/wCSR/C3/snPgj/1GdMr0avye/4Jh/Gj43/tL6D4o+LPjySH wx8JvB+l6B8HfhJ4B0ePZp1zc+H9N0yfxb4w1y/niW/8QawY4PD2mWV87w6VYyzeI7PTNOspGvDN +sNfz/4o8I4/gXjziLhjNsVl+JzbL8dKeZwy3EPF4bA4zHRjj55ZPFckKdbGZfDE08LmP1f2mHo4 +nicNSr140PbT/lvxo4EzPw18TOLODc8xmV4vPMqzKdTOKeUYp47CZbj8xhHM6mUTxqp06OIx+V0 8ZSweavC+1wtDM6WLwlDEYmGH9vUKKKK/Pz8uCiiigAr55/aN/ZY+CX7VfhPT/Cvxj8IjV5/DmoS 674B8a6JqF94Y+JPwv8AFLwG3Txb8NPH2hzWfiTwdryxYt7uXS75LDXdN87QvE2n614evdQ0m7+h qKunUqUqkKtKc6VWnONSnUpylCpTnBqUJwnFqUZxklKMotOLSaaaOfGYPCZhhMTgMfhcPjcDjcPW wmMweLo08ThcXhcRTlSxGGxOHrRnRr0K9Kc6dajVhKnUpylCcZRbT/Av4g/sfftq/s+iWbwdBYft v/DCz8w289heeDfhL+1VpGnRsTDFq/h7WJ/C3wF+MV7Dbh5dQ8QeH/EnwGv5THBaaT8NNcvriSc/ Mdr+098HLfxNH4D8da/qfwT+JMhKJ8M/2gvC/iT4EePbuVWCuNE8PfFPS/C0/i21G5JItW8Gv4h0 S7tpra9sdTurG6tbmb+pCuR8cfD7wF8TvDt54Q+JPgjwh8QvCeoY+3+GPHHhrRvFnh2+wrIPtmi6 9ZahptzhXdR51s+FdgOGIP7Zw1498aZHTp4bMXhuI8JTUYp5ip08wjCKsoxzCg1KrJ7yqYyji6rf 27Wt/l543/skfoyeKeMxuecFwzzwX4gxkqlapDgyWGxnB9XE1ZXdWrwfmkZ0MDSivdp4LhvMuHcD TWqwzk5OX4No6SIkkbrJHIqujowZHRgGV0ZSVZWUgqwJBBBBINOr7y1j/gkt+wLdytP4R+CV98E5 fMeWKH9mz4sfGX9mrRoJHaJ2A8KfAr4g+APB9xbF4Y2bTr7w/d6Y7bmksnMjlvO9T/4JI/D1p3k8 I/tb/tveAYWPyWmmfEz4U+PIIowqhYkl+N/wP+K964DL5nmz3c1w7MyyTvEfLr9WwX0leH6kY/2j w5nGFnb31gsRgsfFPqoyrTy6Ul5uEfQ/gHif9iJ4v4StVXBvjR4b59h1NqhU4lynibhOvUp9JVaO V4bjKnSn3hDEVkrXU3ey+UaK+lx/wSVuc/N/wUW/b1df4kOi/wDBPVAy91Lw/sCRypuGRuikjkXO UdGAYbukf8EkPhbFN5njL9qH9tj4jxMCJLXV/jF4R+H8MgypUeZ8Bvhd8ILuEqqlA1tcwOwdmkZ5 Ajp3VfpI8GqDdDJ+Jqk+kauGyqjFvznDNq7XryP0PlcB+xP+ktUxEIZp4keB2Ewra56+X51x5mVa Cvq1hsT4fZTCbS2X1mKb0bjufId3d2lhbT3t9dW9lZ2sTzXN3dzR21tbwxjc8088zJFDEigl5JHV FAySBXg9h+0n8PPGOt3XhL4I2fjT9pvxvZzfZbnwp+zX4R1X4vNpt7jP2TxX4z8Oo3ww+HRBKRyX fxM8d+DNNglmtorm+hkuYFk/YDw7/wAEof8Agn7ot3a6jrv7Oui/F/UbOZLq3v8A9pHxj8Sf2obi K8jVBHeQj9onxl8ToLa5hZFktXtIYBYy/PYrbEDH3xoHh7QPCmj2Hh7wvoej+G/D+lQLa6XoegaZ ZaPo+m2qklbaw0zToLays4FLMVht4I4wSSFBJr4zOfpK4+rCdPIOHMNhJNNRxWaYueMkr/aWEw1P CwjOOvLzYqtC9nKLV4v+mPDP9iLwngcThsb4u+NOdcQ0YSjUr5DwFw/heG6UnBt+xnxDneKz/EYj D1Woqr7HI8txCpucKVenUcK8Pw8+Hv7Bv7Wnx4e0vPjx4qsv2RfhbcOk938OfhP4i0nx9+0p4lsM q39k+KfitHYXfwv+DQuAJbXWbP4W2/xc8Qy2kkdz4V+L/g/VUFxD+wHwS+BHwh/Zx+H+m/C74JeA 9D+HvgjTJ7q+XStHS4mudU1jUXE2reJfE2ualcX2v+LvFuu3I+2eIfF3inVNY8TeIL5nvtZ1W+u3 eZvW6K/A+JOLuIuLcWsZn+Z4jHzhzewpScaWEw0ZWvHDYSkoYeimlFSlCmqlTli6s5yXMf64+Cn0 ePBv6PHD8+HPCLgXKOE8LiVSeZ5hSjVx3EGeVaSfJWzviDMKmKzfM5QlKpOhRxOLlhMG6tSGBw+G pS9mFFFFfNn7UFFFFABRRRQAUUVn6tp/9raVqelm8v8AThqWn3unnUNLunstTsftltJbfbNOvYv3 lpf23mefZ3Ufz29wkcqfMgq6ajKcIzn7OEpxU58rnyRbSlPkTTlyq75U05Wsmrl04wlUpxqT9lTl OEalRRc3Tg5JSnyJpz5I3lyppytZNNn87/8AwWH/AOTt/wBjH/uG/wDqzNIr+jCv4tP2yP2hPjdq v7QXgrwz+0Na6Zr3j/8AZW8X3vhe68R6VaR6BcfEHR9J8WWPiHStY1Cxt4m0uzvNYsLaK7ttQ0yz tLO607UbGZtJiuIbiW8/ou/4J3fGf44/tQ+FfHn7SHxYlg0Dwl4v8Qv4X+Dvw30WPyvD+geGPC0s 8GveIDdPEt/4i1XWvEEsmjXOr6tM7QT+GL+PSbHR7C+e0f8Avv6RHhDxHw99H7wMzPMcwyCWV8DZ DxBl9fMcJmTxNDP8bxfxPRzLh6jw5D2EMRjI47JFiM+lVxVDAww2WYPE+3cMcqWCq/6gfSt8COLO Fvot/RszjNc04Xlk3htwxxTleJzXA5s8XhuKMw484yw2bcKYfhKmsPTxWYRzPhyOK4mnWxuHy6ng 8nwGL+tOnmSo5dX/AEdooor+AT/LwKKKKACiiigAooooAKKKKACiiigAooooA+XPjt8OfHnjf47f 8E+PE3hDR7jU/D3wf/a38c/Eb4qXsOoadZR+HfAep/sEftufCTTtYu7a9vrS51e3n+J/xS+HHh9d P0i31PUYrrXbbVZbGPSdM1TUtP8AvOvgz47fDnx543+O3/BPjxN4Q0e41Pw98H/2t/HPxG+Kl7Dq GnWUfh3wHqf7BH7bnwk07WLu2vb60udXt5/if8Uvhx4fXT9It9T1GK61221WWxj0nTNU1LT/ALzo AKKKKACvj7/goZ4o+Ivgj9gP9uPxp8H77X9L+LfhD9j79pjxR8LdT8KW0t74p074i6B8F/GureCb 7w1ZwW93Pd6/aeJrTTLjR7aG1uZZ9Rjtoo7eZ3EbfYNfH3/BQzxR8RfBH7Af7cfjT4P32v6X8W/C H7H37THij4W6n4Utpb3xTp3xF0D4L+NdW8E33hqzgt7ue71+08TWmmXGj20Nrcyz6jHbRR28zuI2 APcaKKKACiiigAooooAKKKKACiiigAor8h/+Ce37C/wj+OP7Av7D3xr+KXxX/b18UfE34wfsgfs0 /FL4i+Jv+Ho//BS/RP8AhIvHfxA+C/grxZ4u13+xvDv7WukeH9I/tfxBq+oah/ZmhaVpmj2H2j7L pmn2VlFBbRfX/wDw7F/Zo/6Hv9vX/wAWtf8ABUj/AOjGoA+uaK+Rv+HYv7NH/Q9/t6/+LWv+CpH/ ANGNR/w7F/Zo/wCh7/b1/wDFrX/BUj/6MagD65r5K/bj/Z+i/aX/AGY/ib8Mbe1jufE76SfE3gJ3 RWlg8ceGA+qaFFA7MogbWTHceG7m4JPl6frd6drZ2mP/AIdi/s0f9D3+3r/4ta/4Kkf/AEY1H/Ds X9mj/oe/29f/ABa1/wAFSP8A6Mavb4a4hzPhPiLI+KMmrPD5tw9m2AznLq2toYzLsVSxdDnimuel KpSUK1Nvlq0pTpyvGTT+j4Q4pzjgfivhvjLh/EPCZ5wrnmV8QZTiPe5aePynGUcbhvaRjKLqUZ1a MYV6TfLWoyqUp3hOSf52f8EQv2d38FfCTxr+0B4g05rfX/inq0vhXwqbmF47m08EeDr6a21OaLeV aNdd8YRXtvdwSRBseFNPnRyk2B+5lfHWn/8ABLT9lbSLOHT9I8U/ty6Tp9v5n2fT9K/4Kmf8FPtN sLfzZXnl8iysv2wILaHzZ5ZZ5fKiXzJpJJX3SSOxuf8ADsX9mj/oe/29f/FrX/BUj/6MavrfFzxG zHxZ8ReKOPsypSw08+zB1MHgJVvbrLMqwtKng8py6NVRpxqPB5fh8PSq1YUqUcRiFWxPs4SrSR9x 46+LOa+OPixxp4n5vRnhKnE2aOrgMtlXeIWUZJg6NLL8jymNZQpwqPAZXhcLQr1qdKjDFYqNfF+y hOvJH1zRXyN/w7F/Zo/6Hv8Ab1/8Wtf8FSP/AKMaj/h2L+zR/wBD3+3r/wCLWv8AgqR/9GNX5ufk h9c0V8jf8Oxf2aP+h7/b1/8AFrX/AAVI/wDoxqP+HYv7NH/Q9/t6/wDi1r/gqR/9GNQB9c0V8Jf8 E431WL9m3xBoeq+K/HvjVPAv7X//AAUX+Fvh7Xfif8Q/HXxY8cjwJ8Jf+Chn7UXwy+HOha58RviZ 4h8WeP8AxZ/wifgDwn4a8KabqfizxLresHSNF0+3udQuDArV920AFFFfCX/BRx9Vl/Zt8P6HpXiv x74KTx1+1/8A8E6Phb4h134YfEPx18J/HJ8CfFr/AIKGfsu/DL4jaFofxG+GfiHwn4/8J/8ACWeA PFniXwpqWp+E/EuiawNI1rULe21C3M7NQB920V8jf8Oxf2aP+h7/AG9f/FrX/BUj/wCjGo/4di/s 0f8AQ9/t6/8Ai1r/AIKkf/RjUAfXNFfI3/DsX9mj/oe/29f/ABa1/wAFSP8A6Maj/h2L+zR/0Pf7 ev8A4ta/4Kkf/RjUAfXNfz4/8Ftf2YNT8V3nwc+O/gbRZNR8QalrGm/BLxNZWEIN1qV1rt7c3fw5 uWVWVWkOqT6z4fluplLySaj4fsmmWOK3jH6q/wDDsX9mj/oe/wBvX/xa1/wVI/8Aoxqp33/BLT9l bVIYrfVPFX7cuqW8N7p+pQ2+pf8ABU3/AIKfX8EOpaTfW+qaTqMUN3+2BNFFqGk6paWmp6Xeoi3W nalaWt/ZSwXdtBNH+peDPijmng54iZFx7ldD65LLHisPj8tlVdGlmeWY/C1cJjMHWkk9OWpDE0G0 1DF4bD1dHTUl+0fR+8Z868AfFbhrxNyXD/X55O8bhcyymdaVChnGUZng62Bx2ArzipactWGLw7km qeOwmFraOkmvUf2Z/grpX7O/wH+GPwc0kQOPBXheystXvLdWSLVvFF6ZNU8Wa0quWdV1fxJfapqM cbsxghuI7dW2QoB7pXyN/wAOxf2aP+h7/b1/8Wtf8FSP/oxqP+HYv7NH/Q9/t6/+LWv+CpH/ANGN X59nGbZhn+bZpnmbYmeMzTOcxxua5li6jvUxOPzDE1MXi8RP+9WxFapUlbS8nbQ/Lc/zzNOJ89zn iTPMXUx+dcQZrmGd5vjqrvVxmZ5ri62Ox2KqP+eviq9WrLpeTtofXNFfI3/DsX9mj/oe/wBvX/xa 1/wVI/8AoxqP+HYv7NH/AEPf7ev/AIta/wCCpH/0Y1eceSfXNFfI3/DsX9mj/oe/29f/ABa1/wAF SP8A6Mavlf8AbB/Y++G37NHw2+F/xf8Ag/8AFD9tbR/HOj/trf8ABOTwpDN4r/4KN/8ABQb4p+F9 R8L/ABT/AOCg37MXwp+IfhvxJ8PPit+0741+Hni7QPF3w88a+KfCusaP4q8Lazp0+nazcstsl0lv cQgH6w0UUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFfn1+3J4bb4h/En/AIJ1fCDUfGfxc8Ie Bvi9+2t4t8KfEmH4MfG/4x/s++KPFfhfw5/wT5/bw+K2k+G7/wCIfwJ8dfDn4hw6BD8Q/hz4G8VX Wj2Pim007U9R8MaWuqW17awm3f0z/h2L+zR/0Pf7ev8A4ta/4Kkf/RjUAfXNFfI3/DsX9mj/AKHv 9vX/AMWtf8FSP/oxqP8Ah2L+zR/0Pf7ev/i1r/gqR/8ARjUAfXNFfI3/AA7F/Zo/6Hv9vX/xa1/w VI/+jGo/4di/s0f9D3+3r/4ta/4Kkf8A0Y1AH4/f8Fjf2RNd8XfHL4GfFD4daQLjVPjhreg/BHXo 4YikT+PlmWHwVqeoTgsQdV8PPdadcTlUhstP8GRyzMA5av3y+D3wx8P/AAX+FvgH4U+F41TQ/AXh bSPDdnII/Le9fT7VI7zVLhN8h+2avfm51S+Yu5e8vJ3LEsTXgV5/wS0/ZW1BrN9Q8Vfty6g+nXke pac9/wD8FTP+Cn14+nalDHNDDqOnvc/tgStY6hFBcXEEd9aGG6SC5uYFlEVxMj3P+HYv7NH/AEPf 7ev/AIta/wCCpH/0Y1fsfGvjPxJxv4aeGXhpmUp/2Z4cUc1p0a7rOUs0eKr8mUPEU7KMVkGUL+yc BZ3WHqVU9ZXf794ifSD4u8RfCDwd8IM2nP8AsfwloZ3SoYl15TnnMsbivZ5E8VSsowXDGRJ5HlnK 7xwtaupXcrv65or5G/4di/s0f9D3+3r/AOLWv+CpH/0Y1H/DsX9mj/oe/wBvX/xa1/wVI/8Aoxq/ HD8BPrmivkb/AIdi/s0f9D3+3r/4ta/4Kkf/AEY1H/DsX9mj/oe/29f/ABa1/wAFSP8A6MagD65o r8nv2wf2Pvht+zR8Nvhf8X/g/wDFD9tbR/HOj/trf8E5PCkM3iv/AIKN/wDBQb4p+F9R8L/FP/go N+zF8KfiH4b8SfDz4rftO+Nfh54u0Dxd8PPGvinwrrGj+KvC2s6dPp2s3LLbJdJb3EP6w0AFFFFA BRRRQAUUUUAFFFFAHy58dvhz488b/Hb/AIJ8eJvCGj3Gp+Hvg/8Atb+OfiN8VL2HUNOso/DvgPU/ 2CP23PhJp2sXdte31pc6vbz/ABP+KXw48Prp+kW+p6jFda7barLYx6Tpmqalp/3nXwZ8dvhz488b /Hb/AIJ8eJvCGj3Gp+Hvg/8Atb+OfiN8VL2HUNOso/DvgPU/2CP23PhJp2sXdte31pc6vbz/ABP+ KXw48Prp+kW+p6jFda7barLYx6Tpmqalp/3nQAUUUUAFfH3/AAUM8UfEXwR+wH+3H40+D99r+l/F vwh+x9+0x4o+Fup+FLaW98U6d8RdA+C/jXVvBN94as4Le7nu9ftPE1pplxo9tDa3Ms+ox20UdvM7 iNvsGvj7/goZ4o+Ivgj9gP8Abj8afB++1/S/i34Q/Y+/aY8UfC3U/CltLe+KdO+IugfBfxrq3gm+ 8NWcFvdz3ev2nia00y40e2htbmWfUY7aKO3mdxGwB7jRRRQAUUUUAFFFFABRRRQAUUUUAfKH/BJ3 /lFl/wAE0/8AswD9jf8A9Z1+HNa3w0/bv8M/Gjxh8YdH+EfwD/aM+Ifw5+C/iH4r+BNa+P2g+Hvh hD8JPFvxS+C81/pfjz4YfDe21r4taT8WvGniOx8WaVq3gWy1/TvhWvw21Dxjpl7pMHjspELp8n/g k7/yiy/4Jp/9mAfsb/8ArOvw5rxDTv8AgnP8dPCPwv8A2qv2Zvhp+1/YeAP2Xf2hLn9pzxP4C0bS /gp4gX9oX4A+N/2odY8YeOfFCeDfjrpHx68P6FqXgDw18U/HPiXxloWgS/CLTPG7aZq0nhaP4l6b LaW3iMgHrN5/wUw+C3hf4SftAfE/4qfDz43fB7X/ANm34ifD74UfED4IeM/DXgnX/jPqXj/4x6f8 Pb/4J+G/A2kfCj4h/EnwV4zvvjBJ8UvBmleCxo/juRLfWr7UdM8Xt4WudA19dN8X+Lv/AAUN+Lvw /wDjv+xn4fl/ZW/aX0LT/j34C/a+uta/Zpl8H/Bbxd+0D4j8WfB5/wBne68AX2m634I+Nvir4M+E PDq6J4/8datqeq+K/jN4b0Xy4LbS9evdN8SDR9Dv/MvD3/BHTW7T4e/tKeE9Q+OXwl8Ea78cfiJ+ y5+0H4B1b9nX9leL4MeE/gL+0p+yjrnhzXPAHjrwt4AvvjV8QLbxT4Mv7r4f+AJ/FPhDxFro8T+I 9RXx7qF18RYG8W6VB4S+4vC/7MPxr1r42/s2ftDfH744fDbxx8RPgD4H/aT8DXdh8KPgT4j+E/g3 xZp3x/k+B8llPaad4q+O/wAY9Z8PXfgtvg7O97LPruvxeLZvFO+2tfCEGiJa6mAeQ6l/wVx/Zig0 L4N+LtA8PfF/xn4L+Knwg+Dfx78U+LvD3hzwdaaX+z98I/jz4vvvAPw38YfHGw8W+PvC/iWwXUfG OheMNF1Xw/8ADXQfib4r8OJ4E8Z63rug2HhvQ5dZk9e+M/xx+Nnw4/bU/Y4+Eel3fwwufgd+0ZN8 ZtA8SaZeeDPFMvxV0zxF8MPhD4s+JFpq+keO4viFbeErXQb6607R9On0C6+Gepak6JfXKeJrYTRW sf5/+Fv+CJGjfDm++CPiLwr4x/Zd+Jni34f/ALOfw5/Zv+Idx+1l+xFpX7RPhbxTpPwn8V+O/Fng b4ifC3QJPjj4E1/4LeP7aT4i+I9E8RfZ/G3jTw54q0eHwy2o6NHqfhayvrj7x/aI/Ze/aD+Ln7T/ AOzF8evh98fvg38PPCf7NOo+MdY074e+Mv2avG3xN8ReLNS+JHg7Wvh546N78QtE/al+FWm6VYy+ ENWjHhK1g+HV7ceHvElq+saxfeLdLuF8OW4B9sz+KvC9tqQ0a58SaBb6uZoLYaVPrGnRakbi6EZt oBYyXC3RmuBNEYIhFvlEsflq29c/mv8AAP41/tlftjWHjb43/B3x/wDs5fBf4DaV8d/jV8Ivhf4Q +IHwD+Inxm8e/EPw7+z78X/FvwQ8afEDxX400D9pP4N6T4RPjjxp8PvF8/gXw3pHgrWH8LeH10TW /EOr+MLnUrjw7pv2Trf7KX7LniX4kR/GTxH+zZ8AvEHxei1rQ/EcXxV1v4O/DvVfiRF4h8Mrp6eG 9ej8c3/h2fxOmteHk0nSk0PVF1QX2krpmnrYT24srYR/J3w3/Y3/AGmP2d/FPxN8Pfs0/tQ/DDwn +zf8T/jB8QvjfF8MPit+zd4g+KXj74S+LPjB4w1D4h/FrQvhJ8RtA/aF+F/hu28FeLPH3iDxV4y0 HRvHHww8Yz+Btb8RanFHeeJdDls9G0wA9d0n9u74M6zF8P5rTS/H6p8SP20fi/8AsJaB52iaMjQ/ Gb4J3nxxsfF+qamE8SSfZ/ANzN+z/wCNzoet25u9ZvEu/DrXfhvTzf3y6Z80eMP+CrWlwfsd6v8A to/Cr9lH49/Ez4Yy+OPgl4Z+Gsl54n/Z+8Jw/GPw18Z/irofwstfH3g+4tfjF4u1Xw5p2gatrMFr eeFPip4d+HvxATxHfaHomueFfDWl3PiDxR4WoaV/wTP+KGl/GrwL4ri/aq0qL4FfC79vD4yft6eC vgva/AWFPE9748+PWj/G0eOvDHjn4t3XxXvG1vSNE8W/HLxRrnw8uvDfgPwamjaRPfaB4u0zx3dy +HvEHhTnLP8A4JSeJ774f/thaR4j+N/ws8M+PP2rtR+AHi97j4B/s26v8Ifgf4W+L37O3xJvvivo fxy1r4F6t8fviQPFnxR+KXiweGYfjlrWkfEDwInj7w14I8KaS0en6zp0/im+AN39pv8A4KO/Ev4K /tD/ALMHg/RfhHpumfBa50/4N+Iv2+dQ+I0kMvxH/Zn0T9rrx03wJ/ZW062vvAXjPxB8ObbXR8cL LxOvxgvZNW8b+GNK8D+D9QvvD2rzWeqWPiqD9fa/Hzxp/wAEePgr+0H4Z/ag1f8Aa71DQvjR+0H+ 1Kl9Drnxl8J+GfGPwx034YafafCzw18M/h3oXwr8By/FfxsdK0j4XTeHD468NnW/FWtahdeOtb17 xBeXi3Wpybf1M+GWgeLvCvw3+H/hf4geM4fiP488N+CfCug+NfiHB4fPhODx54s0fQ7HT/EXjKLw sda8Rnw3H4n1e3vNbXQf+Eh1z+yBfCw/tfUvs/2yYA/Pv/gnb/yQf4n/APZ//wDwVc/9ejfth191 18Kf8E7f+SD/ABP/AOz/AP8A4Kuf+vRv2w6+66ACvhT/AIKJf8kH+GH/AGf/AP8ABKP/ANejfseV 9118Kf8ABRL/AJIP8MP+z/8A/glH/wCvRv2PKAPvf4vfFfwD8CPhX8R/jX8VPEFv4U+Gnwm8EeJ/ iL498S3UVzcQ6J4S8HaNea9r2pG0sobi+vZLbTbG4kgsLC3ub++nEdnY21xdTQwv8w+Ef2y/GXjX 4QQfFzSP2Fv20oDrGq6BbeC/htrGk/s06R8SfG3h3xHoWoeILLx1ZWF9+01F4V8GeGre0sBbanZf Fnxd8OvGmn6pqGl6ZceEVu76KOvcf2mvgD4K/aq/Z4+Nv7NfxGk1O38D/HX4YeNPhb4mvdFmit9a 0zS/Geg3uhzavos88VxbQ6xo7XaappUl1bXNqt/aW5ura4t/Mhk+BPiR+wh+158bvhd8HfBfxu/a 8+AfxM8QfBX4maX4ssRrv7GXiq4+Dvxg8LWvwu8e/DK80z9o34LXn7XN9Y/FPxYl54y074peGtVs fFPg7wF4b+JHhHRNRm+GOtxRW72QB6lqf/BTX4MXnhD9lTXPhN8Nvjp+0H42/bJ8A638Uvgz8Ffh N4a8CWvxPHw+8Iab4cvPiB4q8eP8VviR8L/hv8PdM+H+o+L/AA34V8St4p+IlhNN4v1e28P+HIfE F6s4i8Dsv+CoU3w7/aj/AGrfhb8Z/hn8Zbj4afDb45/sh/DjR/GPhf4c+HJPCX7Pek/tP/Br9nw+ HB8dvGM3jCwh1O51n46/FbUNCuYPhunxM1vwjppGteItM0nwJbWfia5h+Gn/AAS4+LnwE8Kfscah 8B/2ovAfhn44fsc/Dr41/s+6J428a/s4ap4t+GHxR/Zr+Mfjbwv4xHgL4gfCbw18e/h3rFt4w8Ia h8Pvh5rGkeNPBvxP8NaRPr+iayW8FWuia/BpOiex+Pf+Cd2rfEXQf2uLLX/jdZRa7+1n8av2PPjX rWr6d8LZLfT/AAjq37K2k/s3WGo6RYaLN8R7mbVbL4j3n7P017azy6xp8ngmDxjHZSReL28OG814 A9P+G/8AwUE+DvxQ/aIu/wBnnQfCvxOsZZ/Enxo8C+Cfi7rOmeC4PhH8T/iL+zrrQ8O/G/wB4Iud P8d6l8Rk1/4ea3ba/p15eeMPhv4R8LeIp/B3jI+CPEfiiPw5fui/s7/HL41+MP2r/wBtX4DfFi8+ F+o+HPgPB8AvEPwy1H4f+DfFPhLVE8OfGfSviXrUuk+OrrxH8QvHFt4m13RrbwnpEDa/oVh4K0y6 kkvWTwzbKY2rxP8AZi/4Jm6N+yv+0V4x+KXgV/2XdV+H3ib4qfGn4u6Xda/+yDpT/tgeE9W+O2re LfFfi7wZpP7X+m/FfT5rzwBp3jDxjq7+H7PXfg9q3iO08AXH/CtbnxHc6ba2Gr23rXwW/ZZ+P/w6 /a5/aR/aM8cfHr4MeOvAn7Rel+A9D1L4V+Hf2aPGngbxL4b0n4S2fi3SPhtFD8TdX/ak+Iejavdx 6L4wv4PHs9x8KrO28W6hb2t9oNj4FtPO0uUA9T/ao/az+HX7MH7Mn7Qf7Sl5c6d48sPgH8HvHnxZ vfCHhrX9Kk1jxIvg7QrrUrPQLOaOS7Wxm17VEsNDh1Ge3ltrO41GGaaORV8t/GH+IH7X/wCz18JP HP7UP7X/AMUf2ftZ+F/wm+CHxG+Nfxk+DXwM/Zx8fab448OWngPwBq/jnUfDvw6+LHjD9qXWNF8W 3mgR6RdaZPe+I/hhoEHj26iS+sY/htb3QsLbuvFv/BOr9iXxL8MPjN8KdH/Zk+CHwx0T48/CLx18 D/iFrnwg+FPw9+GfjK++HvxD0v8AszxDpNp4o8KeGdP1K3BeOx1W0SR57SDWtJ0jU3tZbjTrYp5F D+yD+1149+BHxD/Zb/aS/a/+GfxX+DPjr4D/ABO/Z/1TxF4X/Zh1z4f/AB58W+HviF8Ntb+G9p4q 8f8Aj+//AGi/HHgS78W6NZa2dY1qfwd8JvB1n4t8QWEeoRQ+F9OvbrQlAPQPjN/wUT+A3wLuPHdp 4z07x/LdeAvgd+z/APHe8j0vSvDCQaxoP7TXxl1/4CfCXwvpep674v0PR7LxXqnxJ0E6ZrNx4q1H w14H8Nabqmna7rfjWz0iLWLvSue8T/t4eNfDXx//AGOfgTc/sXftAW99+1f4Y+LPiXWL3VPF/wCz rb6z8CoPhT4k8A6Dq7+N9H0T4z+I/DnirTbCx8d2fi/xPqHw88deJJ7HwrJo7+CdN+I/iLUdV8Oe HPGPC/8AwTv/AGjrPWfjH8QviR+1H8B/jP8AEf4r/su/Az9lUeHfiB+xdLffs66d4A+DfxB+IXin VbLXvg9/w0jL4i8bab8TvDnxG13R/E2na78UvM0/xTe33ifTL4+FDo3wy0PpvhB/wTg8UfAyz/Yc n8CfHfRpde/ZA1z9obTtSg8RfCzX9W8D+Kvgz+0744s/GPjf4O/DTw3J8Yx4h+D+jfDSz0Xwp4M/ Z8vNY8cfFm2+HfgrwjovhzxBo3ju0R3AB84f8EkP+Cm/x2/by8T6ZpfjrVP2cPiFoc37Mvhz4z/E vVfgH4C+I3w0uf2c/i34s8V6dpfhX9nzxtbfED4w/GG3+JOreJvCS+K/GcXi7wxd+EB4ch8LLpni Hwtby+I9Dup/tr/gp1/ybR4E/wCz9f8AglL/AOvSP2Oa8J/YY/4JgePf2VPG/wCz94x+J/7SXhT4 xp+yv+yz41/ZK+C2l/Dr9n6++A0l18P/AB74y+HHjTWtb+MOtan8cvjVqvxO8S2d78M9Fg8PWVlN 4K8DaA99rGr6d4Li16/m1Nvdv+CnX/JtHgT/ALP1/wCCUv8A69I/Y5oA+uaKKKACiiigAooooAKK KKACiiigAooooAKKKKAPh79qf/k5f/glF/2fr8Sv/XW//BSWvrb9pn9pD4a/sm/BrxN8cPitJr0n hjw9feFtBstE8I6LN4l8aeMvGfj3xXovgTwB4C8E+HLeSGXXPF3jfxr4j0LwzoGntcWlob/U4rjU 7/TdKt73UbX5J/an/wCTl/8AglF/2fr8Sv8A11v/AMFJa+h/2zf2X7T9rv4Fah8Jk8can8LvFml+ OfhV8Xfhb8UNI0i18RXvw5+L/wAD/iT4X+LPww8Xt4bvrzTrPxLpumeMfCGlLr3hyfUtL/t3w/Pq mlQavo93d2+rWQB5r8Rv25dZ+E3wNk+PHj/9iv8AbF0LRNE0X4g+L/iL4Qj039mzWvGnwp+Hvw10 mz8QeIvH/jQaB+0tqvg6/wBJn0G4udV0Tw14A8Y+OPiRrMekazYWXgZ9YsW019Lxp+3j4B0j42+E P2ffhb8KvjX+0n8RvEXwv8IfG/xJD8D9K+HD+HvhX8G/iBrupeHvA/xE+I/if4r/ABO+FWi2tj4t vtB8SzeHvC3hO78XfEXVtO8M61qNl4MmtYbaS7+Tf2pP+Can7Qf7ZmgeC7P4+/tP/AjxBqln8LPj x8HPHmjW37H3iPUfhJLoHxrT4fpZfE34UfC7xr+1R4ut/AP7SPw4tvBWraR4Q+MPi7X/AIoafp2l +O/ES6L4B8PSFxfei+E/2D/2gfhT8WPh78cfgx+058MvC3xA1D9mT4EfsxftPab4x/Zv8SeOPh58 YtH/AGe7zxXfeAPiJ8PPDml/tGeBvEPwj8faanxB8faKja34z+KvhqbRte0/7boN3d6D5urAHD/s x/8ABTYeKfil4q+DPxp8EfFNLzVf2+f2u/2Svh78b7D4eaRoXwGsde+E/jX4xaz8LvhLq3iW98SW HiXV/GupfB74XXl9J4r8O+C/EHgWTXoYfDniPxno/jbUI/Dx+mf2Xf8AgoF8Jf2ufEur+Ffhz4U+ JfhKe6+Gmk/Gj4U+I/iTpPg6x8NfHL4MeIdbv/DmifF34bJ4S8e+LNfi8I3GqW+nTS6R8SNH+G/j 6LSPEvhXWZfCEOk+ItNvpfN1/wCCcFhPofg3w7qvxVXU9L8M/wDBRb46/t7albP4Ce3TxBYfG+4+ P8l58GWMfjdpNOXRLf46yWrfECOS6fVR4aMq+DNLbWgukZX/AAT+/wCCcC/sEWz+FfCt/wDsta14 P8M/DuX4YfDvxr4S/Y50r4U/tQap4XsdS0a48KRftA/Hrw58XdQ03413Gj6Zo9vY+Ibiy+GHw8vP HOtWmm+MdXvbTWre6S+APYf2JPj18Xfi3of7T1r8f9S+F03ib9n/APaq+JPwMj8Q/DPwn4j+H3hD UPC3gzwZ8N/Elnq93ovjL4hfEnUrTURP4v1GPUb2TxUbK5itoLiHT9MQvbJq/tlftaL+zz8DG8bf C6y8JfE/4o+Mvix8Cf2fvhP4Wu/EiQ+Gbr4sftIfFzwl8Gvh9deNNS0U3uoad4P0TWvFo8UeJ2sY hqd34e8P6taaU8d/LBNFw/7Kn7HXxY+EMf7UWiftF/Fn4C/tHeA/2o/ij4x+LnirwT4e/Zb8SfC3 S7bxB8QfD3hnwn4w8N6vb+Ov2lv2hNG8XfDzUfD/AIU0+1t/DGo6DaXqT3eqvqmv6zZXUGnWmp8Z f+Cb/wCzD8QPgZ8QPg38J/hv8P8A9ljVfGOu/C7x7o/xN/Z6+F/w88AeK/CnxW+BPj3S/in8EfiE IdD8Padp/iW7+HfxB0ay1my0jX0uLG9sbnW9GZ7W21y+lYAn1r4n/Hr9k/wdqXxY/a8+L/wm+Lvw 8uPEnwY+HNho/wABf2ZfF3wm8XaP8Rvjh8a/h58FPC96+oeNv2qvi1pOs+BIPEfxE0ttR099N0vx Ho2lwXmrjXfE08UWhy1fit/wUV+D/wALPFXxA+Ho8EfFbx38SfBH7RHwv/Za0vwH4RtfhppWpfEf 4x/Fz4CWX7SPhPQfBHiL4mfE74eeALW0PwzuLuW71P4geMfAltJ4j0u68M6R/auq32gQ6zxPxP8A 2R/2v/2iPgV42+EH7QP7VfwLv9SvJ/hT4m+HPiX4R/sm+L/ANjoPxR+Cfxn+Hnxu8CePfHmheLf2 qfidc+NNLm8T/DTRrbXPAfhrXfh1Zy6VqetWkHiEztpt9p/lOp/8E0vjJ4j8F/tXaT8Rfj5+zl8c /E37ZXxl8BfFD4v2nx0/Ysv/ABh8HbPQ/BvwG8HfBmDwT4I+F+gftNeD9c0OXQNT8C+GvGnw48ba h8Sda8V+E00i10nWr3xh4nkn+IrgFv8AaZ/4KwXP7Mnjj46+GfFf7Hvxwu/DPwM/YRt/21/EPj0+ Lvgva2Wntf2XxQ/s34W+KPDsHxA1HXtNvb7xX8OY/hlB4n8Iw+P1/wCFg6xOs/h63+H2mW/xE1j7 B+B2gft0LqXhbxN+0N8Wf2Zb7RNW0SS98a/CX4Xfs9/Ejw9rHhPXb7TfOsNF8L/GbxF+0v4ssvEN n4a1KRbDW9Y1j4PWL+NY7eTVNJ03wCk6aRF8rat/wS3s/ENp4c8F+MPjdq/xH+FniX/gnZpn/BOT 9piw+IvhjUNf+Knxo8AeGNE8WQeFPip4c+Ktp460uP4ffFNfE3jXxFr3izU9d8G/Ey18SRX6R2qa DrNlBr7fSX7Ovwj/AG0/hpL4S8N/G79q74S/G/4d+BtGfQbW70r9mTxB8O/jR8QoLTSTpmgaz8T/ AIhXP7RXjrwTceILQ+TfeJLrwT8JPCFv4r1i1/tK3t/DFje3OggA4n/gp1/ybR4E/wCz9f8AglL/ AOvSP2Oa+ua+Rv8Agp1/ybR4E/7P1/4JS/8Ar0j9jmvrmgAooooAKKKKACiiigAooooA+XPjt8Of Hnjf47f8E+PE3hDR7jU/D3wf/a38c/Eb4qXsOoadZR+HfAep/sEftufCTTtYu7a9vrS51e3n+J/x S+HHh9dP0i31PUYrrXbbVZbGPSdM1TUtP+86+DPjt8OfHnjf47f8E+PE3hDR7jU/D3wf/a38c/Eb 4qXsOoadZR+HfAep/sEftufCTTtYu7a9vrS51e3n+J/xS+HHh9dP0i31PUYrrXbbVZbGPSdM1TUt P+86ACiiigAr4+/4KGeKPiL4I/YD/bj8afB++1/S/i34Q/Y+/aY8UfC3U/CltLe+KdO+IugfBfxr q3gm+8NWcFvdz3ev2nia00y40e2htbmWfUY7aKO3mdxG32DXx9/wUM8UfEXwR+wH+3H40+D99r+l /Fvwh+x9+0x4o+Fup+FLaW98U6d8RdA+C/jXVvBN94as4Le7nu9ftPE1pplxo9tDa3Ms+ox20Udv M7iNgD3GiiigAooooAKKKKACiiigAooooA/J39iL47/tQ/s1/sX/ALIn7Ofjr/glt+2/q3jb4A/s wfAL4KeMdU8J/Ev/AIJl33hXUvFXwr+FPhPwL4h1Dwzfax/wUS0HV7zw/eavoV5caNdapoejajca dJbTX2ladcvLZw/T/wDw3F8eP+kU37f/AP4cD/glz/8ATJ6+w6KAPjz/AIbi+PH/AEim/b//APDg f8Euf/pk9H/DcXx4/wCkU37f/wD4cD/glz/9Mnr7DooA+PP+G4vjx/0im/b/AP8Aw4H/AAS5/wDp k9H/AA3F8eP+kU37f/8A4cD/AIJc/wD0yevsOigD48/4bi+PH/SKb9v/AP8ADgf8Euf/AKZPR/w3 F8eP+kU37f8A/wCHA/4Jc/8A0yevsOigD48/4bi+PH/SKb9v/wD8OB/wS5/+mT0f8NxfHj/pFN+3 /wD+HA/4Jc//AEyevsOigD48/wCG4vjx/wBIpv2//wDw4H/BLn/6ZPR/w3F8eP8ApFN+3/8A+HA/ 4Jc//TJ6+w6KAPi/9gXwb8SPBX7PmrQ/Ff4ceIPhH4y8b/tP/t2fGtvhx4s1v4f+IfFXhTwr+0H+ 3H+0V8dvh5p/ibVfhX41+I3w9k8QSfD34jeF73WbXwt458T6dpmo3VzpZ1We5s5wv2hRRQAV8X/t 9eDfiR41/Z80mH4UfDjxB8XPGXgj9p/9hP41r8OPCet/D/w94q8V+Ff2fP24/wBnX47fEPT/AAzq vxU8a/Dn4ex+II/h78OfFF7o1r4p8c+GNO1PUbW20sarBc3kAb7QooA+PP8AhuL48f8ASKb9v/8A 8OB/wS5/+mT0f8NxfHj/AKRTft//APhwP+CXP/0yevsOigD48/4bi+PH/SKb9v8A/wDDgf8ABLn/ AOmT0f8ADcXx4/6RTft//wDhwP8Aglz/APTJ6+w6KAPjz/huL48f9Ipv2/8A/wAOB/wS5/8Apk9H /DcXx4/6RTft/wD/AIcD/glz/wDTJ6+w6KAPjz/huL48f9Ipv2//APw4H/BLn/6ZPR/w3F8eP+kU 37f/AP4cD/glz/8ATJ6+w6KAPjz/AIbi+PH/AEim/b//APDgf8Euf/pk9H/DcXx4/wCkU37f/wD4 cD/glz/9Mnr7DooA+PP+G4vjx/0im/b/AP8Aw4H/AAS5/wDpk9fPH7TXxb/aS/al8E/Db4QaH/wT h/a/+GLyftcfsH/E/XfiD8UviH/wTzHgTwj4G+AP7bv7Pfx8+I2ua7F8Mv27fiZ4/vPsfgD4Z+JX 0zTfCngPxNrGq6x/Z+m2+ngXTXEH6lUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAHwv+2f pPxXtPG37C3xf+FnwN+IH7Qifs8/tceJPif8Qfh98LfEfwW8OeOz4G8T/sRftmfAODXNCl+PfxZ+ CngDUv7N8f8Axr8CJqemyePLPWP7Hu9Q1LTdP1I6bPb10v8Aw3F8eP8ApFN+3/8A+HA/4Jc//TJ6 +w6KAPjz/huL48f9Ipv2/wD/AMOB/wAEuf8A6ZPR/wANxfHj/pFN+3//AOHA/wCCXP8A9Mnr7Doo A+PP+G4vjx/0im/b/wD/AA4H/BLn/wCmT0f8NxfHj/pFN+3/AP8AhwP+CXP/ANMnr7DooA+PP+G4 vjx/0im/b/8A/Dgf8Euf/pk9H/DcXx4/6RTft/8A/hwP+CXP/wBMnr7DooA+PP8AhuL48f8ASKb9 v/8A8OB/wS5/+mT0f8NxfHj/AKRTft//APhwP+CXP/0yevsOigD48/4bi+PH/SKb9v8A/wDDgf8A BLn/AOmT0f8ADcXx4/6RTft//wDhwP8Aglz/APTJ6+w6KAPy1/aa+Lf7SX7Uvgn4bfCDQ/8AgnD+ 1/8ADF5P2uP2D/ifrvxB+KXxD/4J5jwJ4R8DfAH9t39nv4+fEbXNdi+GX7dvxM8f3n2PwB8M/Er6 ZpvhTwH4m1jVdY/s/TbfTwLpriD9SqKKACiiigAooooAKKKKACiiigD5c+O3w58eeN/jt/wT48Te ENHuNT8PfB/9rfxz8Rvipew6hp1lH4d8B6n+wR+258JNO1i7tr2+tLnV7ef4n/FL4ceH10/SLfU9 RiutdttVlsY9J0zVNS0/7zr4M+O3w58eeN/jt/wT48TeENHuNT8PfB/9rfxz8Rvipew6hp1lH4d8 B6n+wR+258JNO1i7tr2+tLnV7ef4n/FL4ceH10/SLfU9RiutdttVlsY9J0zVNS0/7zoAKKKKACvI P2hPB/xD+IXwD+OHgH4R+OJPhl8V/HHwg+Jfg/4Y/EmEMZvh98Q/EvgvWtF8F+OIgsNwxk8J+JL3 TdeQLbzsWsABDKcI3r9FAH502/7Xa+DvhN8O/HHx9+AH7U/w08ceLH1rQvEnwz8A/st/tDftRav4 T8YeEZLew8Ux3N7+yn8NPjXYp4JvdRke5+H3jnVptJ0nx9oDw6no2bqLU9O03Z1j9sr4U6F4A8G/ Eq98A/thT+HfHeoeIdN0TTtH/wCCfP7eviLx/Y3Hhi5itNSk8ZfCjw/+zZqfxS+HWn3MsyP4e1b4 g+DvDGl+LrYS3vhO81qzgmnj+/aKAPgLWP2yvhToXgDwb8Sr3wD+2FP4d8d6h4h03RNO0f8A4J8/ t6+IvH9jceGLmK01KTxl8KPD/wCzZqfxS+HWn3MsyP4e1b4g+DvDGl+LrYS3vhO81qzgmnjNY/bK +FOheAPBvxKvfAP7YU/h3x3qHiHTdE07R/8Agnz+3r4i8f2Nx4YuYrTUpPGXwo8P/s2an8Uvh1p9 zLMj+HtW+IPg7wxpfi62Et74TvNas4Jp4/v2igD4C1j9sr4U6F4A8G/Eq98A/thT+HfHeoeIdN0T TtH/AOCfP7eviLx/Y3Hhi5itNSk8ZfCjw/8As2an8Uvh1p9zLMj+HtW+IPg7wxpfi62Et74TvNas 4Jp4zWP2yvhToXgDwb8Sr3wD+2FP4d8d6h4h03RNO0f/AIJ8/t6+IvH9jceGLmK01KTxl8KPD/7N mp/FL4dafcyzI/h7VviD4O8MaX4uthLe+E7zWrOCaeP79ooA+AtY/bK+FOheAPBvxKvfAP7YU/h3 x3qHiHTdE07R/wDgnz+3r4i8f2Nx4YuYrTUpPGXwo8P/ALNmp/FL4dafcyzI/h7VviD4O8MaX4ut hLe+E7zWrOCaeM1j9sr4U6F4A8G/Eq98A/thT+HfHeoeIdN0TTtH/wCCfP7eviLx/Y3Hhi5itNSk 8ZfCjw/+zZqfxS+HWn3MsyP4e1b4g+DvDGl+LrYS3vhO81qzgmnj+/aKAPgLWP2yvhToXgDwb8Sr 3wD+2FP4d8d6h4h03RNO0f8A4J8/t6+IvH9jceGLmK01KTxl8KPD/wCzZqfxS+HWn3MsyP4e1b4g +DvDGl+LrYS3vhO81qzgmnjNY/bK+FOheAPBvxKvfAP7YU/h3x3qHiHTdE07R/8Agnz+3r4i8f2N x4YuYrTUpPGXwo8P/s2an8Uvh1p9zLMj+HtW+IPg7wxpfi62Et74TvNas4Jp4/v2igD4C1j9sr4U 6F4A8G/Eq98A/thT+HfHeoeIdN0TTtH/AOCfP7eviLx/Y3Hhi5itNSk8ZfCjw/8As2an8Uvh1p9z LMj+HtW+IPg7wxpfi62Et74TvNas4Jp4zWP2yvhToXgDwb8Sr3wD+2FP4d8d6h4h03RNO0f/AIJ8 /t6+IvH9jceGLmK01KTxl8KPD/7Nmp/FL4dafcyzI/h7VviD4O8MaX4uthLe+E7zWrOCaeP79ooA +AtY/bK+FOheAPBvxKvfAP7YU/h3x3qHiHTdE07R/wDgnz+3r4i8f2Nx4YuYrTUpPGXwo8P/ALNm p/FL4dafcyzI/h7VviD4O8MaX4uthLe+E7zWrOCaeM1j9sr4U6F4A8G/Eq98A/thT+HfHeoeIdN0 TTtH/wCCfP7eviLx/Y3Hhi5itNSk8ZfCjw/+zZqfxS+HWn3MsyP4e1b4g+DvDGl+LrYS3vhO81qz gmnj+/aKAPgLWP2yvhToXgDwb8Sr3wD+2FP4d8d6h4h03RNO0f8A4J8/t6+IvH9jceGLmK01KTxl 8KPD/wCzZqfxS+HWn3MsyP4e1b4g+DvDGl+LrYS3vhO81qzgmnjNY/bK+FOheAPBvxKvfAP7YU/h 3x3qHiHTdE07R/8Agnz+3r4i8f2Nx4YuYrTUpPGXwo8P/s2an8Uvh1p9zLMj+HtW+IPg7wxpfi62 Et74TvNas4Jp4/v2igD4C1j9sr4U6F4A8G/Eq98A/thT+HfHeoeIdN0TTtH/AOCfP7eviLx/Y3Hh i5itNSk8ZfCjw/8As2an8Uvh1p9zLMj+HtW+IPg7wxpfi62Et74TvNas4Jp4zWP2yvhToXgDwb8S r3wD+2FP4d8d6h4h03RNO0f/AIJ8/t6+IvH9jceGLmK01KTxl8KPD/7Nmp/FL4dafcyzI/h7VviD 4O8MaX4uthLe+E7zWrOCaeP79ooA+AtY/bK+FOheAPBvxKvfAP7YU/h3x3qHiHTdE07R/wDgnz+3 r4i8f2Nx4YuYrTUpPGXwo8P/ALNmp/FL4dafcyzI/h7VviD4O8MaX4uthLe+E7zWrOCaeM1j9sr4 U6F4A8G/Eq98A/thT+HfHeoeIdN0TTtH/wCCfP7eviLx/Y3Hhi5itNSk8ZfCjw/+zZqfxS+HWn3M syP4e1b4g+DvDGl+LrYS3vhO81qzgmnj+/aKAPgLWP2yvhToXgDwb8Sr3wD+2FP4d8d6h4h03RNO 0f8A4J8/t6+IvH9jceGLmK01KTxl8KPD/wCzZqfxS+HWn3MsyP4e1b4g+DvDGl+LrYS3vhO81qzg mnjNY/bK+FOheAPBvxKvfAP7YU/h3x3qHiHTdE07R/8Agnz+3r4i8f2Nx4YuYrTUpPGXwo8P/s2a n8Uvh1p9zLMj+HtW+IPg7wxpfi62Et74TvNas4Jp4/v2igD4C1j9sr4U6F4A8G/Eq98A/thT+HfH eoeIdN0TTtH/AOCfP7eviLx/Y3Hhi5itNSk8ZfCjw/8As2an8Uvh1p9zLMj+HtW+IPg7wxpfi62E t74TvNas4Jp4zWP2yvhToXgDwb8Sr3wD+2FP4d8d6h4h03RNO0f/AIJ8/t6+IvH9jceGLmK01KTx l8KPD/7Nmp/FL4dafcyzI/h7VviD4O8MaX4uthLe+E7zWrOCaeP79ooA+AtY/bK+FOheAPBvxKvf AP7YU/h3x3qHiHTdE07R/wDgnz+3r4i8f2Nx4YuYrTUpPGXwo8P/ALNmp/FL4dafcyzI/h7VviD4 O8MaX4uthLe+E7zWrOCaeM1j9sr4U6F4A8G/Eq98A/thT+HfHeoeIdN0TTtH/wCCfP7eviLx/Y3H hi5itNSk8ZfCjw/+zZqfxS+HWn3MsyP4e1b4g+DvDGl+LrYS3vhO81qzgmnj+/aKAPgLWP2yvhTo XgDwb8Sr3wD+2FP4d8d6h4h03RNO0f8A4J8/t6+IvH9jceGLmK01KTxl8KPD/wCzZqfxS+HWn3Ms yP4e1b4g+DvDGl+LrYS3vhO81qzgmnjNY/bK+FOheAPBvxKvfAP7YU/h3x3qHiHTdE07R/8Agnz+ 3r4i8f2Nx4YuYrTUpPGXwo8P/s2an8Uvh1p9zLMj+HtW+IPg7wxpfi62Et74TvNas4Jp4/v2igD4 C1j9sr4U6F4A8G/Eq98A/thT+HfHeoeIdN0TTtH/AOCfP7eviLx/Y3Hhi5itNSk8ZfCjw/8As2an 8Uvh1p9zLMj+HtW+IPg7wxpfi62Et74TvNas4Jp4zWP2yvhToXgDwb8Sr3wD+2FP4d8d6h4h03RN O0f/AIJ8/t6+IvH9jceGLmK01KTxl8KPD/7Nmp/FL4dafcyzI/h7VviD4O8MaX4uthLe+E7zWrOC aeP79ooA+AtY/bK+FOheAPBvxKvfAP7YU/h3x3qHiHTdE07R/wDgnz+3r4i8f2Nx4YuYrTUpPGXw o8P/ALNmp/FL4dafcyzI/h7VviD4O8MaX4uthLe+E7zWrOCaeM1j9sr4U6F4A8G/Eq98A/thT+Hf HeoeIdN0TTtH/wCCfP7eviLx/Y3Hhi5itNSk8ZfCjw/+zZqfxS+HWn3MsyP4e1b4g+DvDGl+LrYS 3vhO81qzgmnj+/aKAPgLWP2yvhToXgDwb8Sr3wD+2FP4d8d6h4h03RNO0f8A4J8/t6+IvH9jceGL mK01KTxl8KPD/wCzZqfxS+HWn3MsyP4e1b4g+DvDGl+LrYS3vhO81qzgmnjNY/bK+FOheAPBvxKv fAP7YU/h3x3qHiHTdE07R/8Agnz+3r4i8f2Nx4YuYrTUpPGXwo8P/s2an8Uvh1p9zLMj+HtW+IPg 7wxpfi62Et74TvNas4Jp4/v2igD4C1j9sr4U6F4A8G/Eq98A/thT+HfHeoeIdN0TTtH/AOCfP7ev iLx/Y3Hhi5itNSk8ZfCjw/8As2an8Uvh1p9zLMj+HtW+IPg7wxpfi62Et74TvNas4Jp4zWP2yvhT oXgDwb8Sr3wD+2FP4d8d6h4h03RNO0f/AIJ8/t6+IvH9jceGLmK01KTxl8KPD/7Nmp/FL4dafcyz I/h7VviD4O8MaX4uthLe+E7zWrOCaeP79ooA+AtY/bK+FOheAPBvxKvfAP7YU/h3x3qHiHTdE07R /wDgnz+3r4i8f2Nx4YuYrTUpPGXwo8P/ALNmp/FL4dafcyzI/h7VviD4O8MaX4uthLe+E7zWrOCa eM1j9sr4U6F4A8G/Eq98A/thT+HfHeoeIdN0TTtH/wCCfP7eviLx/Y3Hhi5itNSk8ZfCjw/+zZqf xS+HWn3MsyP4e1b4g+DvDGl+LrYS3vhO81qzgmnj+/aKAPgLWP2yvhToXgDwb8Sr3wD+2FP4d8d6 h4h03RNO0f8A4J8/t6+IvH9jceGLmK01KTxl8KPD/wCzZqfxS+HWn3MsyP4e1b4g+DvDGl+LrYS3 vhO81qzgmnjNY/bK+FOheAPBvxKvfAP7YU/h3x3qHiHTdE07R/8Agnz+3r4i8f2Nx4YuYrTUpPGX wo8P/s2an8Uvh1p9zLMj+HtW+IPg7wxpfi62Et74TvNas4Jp4/v2igD4C1j9sr4U6F4A8G/Eq98A /thT+HfHeoeIdN0TTtH/AOCfP7eviLx/Y3Hhi5itNSk8ZfCjw/8As2an8Uvh1p9zLMj+HtW+IPg7 wxpfi62Et74TvNas4Jp4zWP2yvhToXgDwb8Sr3wD+2FP4d8d6h4h03RNO0f/AIJ8/t6+IvH9jceG LmK01KTxl8KPD/7Nmp/FL4dafcyzI/h7VviD4O8MaX4uthLe+E7zWrOCaeP79ooA+AtY/bK+FOhe APBvxKvfAP7YU/h3x3qHiHTdE07R/wDgnz+3r4i8f2Nx4YuYrTUpPGXwo8P/ALNmp/FL4dafcyzI /h7VviD4O8MaX4uthLe+E7zWrOCaeM1j9sr4U6F4A8G/Eq98A/thT+HfHeoeIdN0TTtH/wCCfP7e viLx/Y3Hhi5itNSk8ZfCjw/+zZqfxS+HWn3MsyP4e1b4g+DvDGl+LrYS3vhO81qzgmnj+/aKAPgL WP2yvhToXgDwb8Sr3wD+2FP4d8d6h4h03RNO0f8A4J8/t6+IvH9jceGLmK01KTxl8KPD/wCzZqfx S+HWn3MsyP4e1b4g+DvDGl+LrYS3vhO81qzgmnjNY/bK+FOheAPBvxKvfAP7YU/h3x3qHiHTdE07 R/8Agnz+3r4i8f2Nx4YuYrTUpPGXwo8P/s2an8Uvh1p9zLMj+HtW+IPg7wxpfi62Et74TvNas4Jp 4/v2igD4C1j9sr4U6F4A8G/Eq98A/thT+HfHeoeIdN0TTtH/AOCfP7eviLx/Y3Hhi5itNSk8ZfCj w/8As2an8Uvh1p9zLMj+HtW+IPg7wxpfi62Et74TvNas4Jp4zWP2yvhToXgDwb8Sr3wD+2FP4d8d 6h4h03RNO0f/AIJ8/t6+IvH9jceGLmK01KTxl8KPD/7Nmp/FL4dafcyzI/h7VviD4O8MaX4uthLe +E7zWrOCaeP79ooA+AtY/bK+FOheAPBvxKvfAP7YU/h3x3qHiHTdE07R/wDgnz+3r4i8f2Nx4YuY rTUpPGXwo8P/ALNmp/FL4dafcyzI/h7VviD4O8MaX4uthLe+E7zWrOCaeM1j9sr4U6F4A8G/Eq98 A/thT+HfHeoeIdN0TTtH/wCCfP7eviLx/Y3Hhi5itNSk8ZfCjw/+zZqfxS+HWn3MsyP4e1b4g+Dv DGl+LrYS3vhO81qzgmnj+/aKAPgLWP2yvhToXgDwb8Sr3wD+2FP4d8d6h4h03RNO0f8A4J8/t6+I vH9jceGLmK01KTxl8KPD/wCzZqfxS+HWn3MsyP4e1b4g+DvDGl+LrYS3vhO81qzgmnjNY/bK+FOh eAPBvxKvfAP7YU/h3x3qHiHTdE07R/8Agnz+3r4i8f2Nx4YuYrTUpPGXwo8P/s2an8Uvh1p9zLMj +HtW+IPg7wxpfi62Et74TvNas4Jp4/v2igD4C1j9sr4U6F4A8G/Eq98A/thT+HfHeoeIdN0TTtH/ AOCfP7eviLx/Y3Hhi5itNSk8ZfCjw/8As2an8Uvh1p9zLMj+HtW+IPg7wxpfi62Et74TvNas4Jp4 zWP2yvhToXgDwb8Sr3wD+2FP4d8d6h4h03RNO0f/AIJ8/t6+IvH9jceGLmK01KTxl8KPD/7Nmp/F L4dafcyzI/h7VviD4O8MaX4uthLe+E7zWrOCaeP79ooA+AtY/bK+FOheAPBvxKvfAP7YU/h3x3qH iHTdE07R/wDgnz+3r4i8f2Nx4YuYrTUpPGXwo8P/ALNmp/FL4dafcyzI/h7VviD4O8MaX4uthLe+ E7zWrOCaeM1j9sr4U6F4A8G/Eq98A/thT+HfHeoeIdN0TTtH/wCCfP7eviLx/Y3Hhi5itNSk8ZfC jw/+zZqfxS+HWn3MsyP4e1b4g+DvDGl+LrYS3vhO81qzgmnj+/aKAPgLWP2yvhToXgDwb8Sr3wD+ 2FP4d8d6h4h03RNO0f8A4J8/t6+IvH9jceGLmK01KTxl8KPD/wCzZqfxS+HWn3MsyP4e1b4g+DvD Gl+LrYS3vhO81qzgmnjNY/bK+FOheAPBvxKvfAP7YU/h3x3qHiHTdE07R/8Agnz+3r4i8f2Nx4Yu YrTUpPGXwo8P/s2an8Uvh1p9zLMj+HtW+IPg7wxpfi62Et74TvNas4Jp4/v2igD4C1j9sr4U6F4A 8G/Eq98A/thT+HfHeoeIdN0TTtH/AOCfP7eviLx/Y3Hhi5itNSk8ZfCjw/8As2an8Uvh1p9zLMj+ HtW+IPg7wxpfi62Et74TvNas4Jp4zWP2yvhToXgDwb8Sr3wD+2FP4d8d6h4h03RNO0f/AIJ8/t6+ IvH9jceGLmK01KTxl8KPD/7Nmp/FL4dafcyzI/h7VviD4O8MaX4uthLe+E7zWrOCaeP79ooA+AtY /bK+FOheAPBvxKvfAP7YU/h3x3qHiHTdE07R/wDgnz+3r4i8f2Nx4YuYrTUpPGXwo8P/ALNmp/FL 4dafcyzI/h7VviD4O8MaX4uthLe+E7zWrOCaeM1j9sr4U6F4A8G/Eq98A/thT+HfHeoeIdN0TTtH /wCCfP7eviLx/Y3Hhi5itNSk8ZfCjw/+zZqfxS+HWn3MsyP4e1b4g+DvDGl+LrYS3vhO81qzgmnj +/aKAPgLWP2yvhToXgDwb8Sr3wD+2FP4d8d6h4h03RNO0f8A4J8/t6+IvH9jceGLmK01KTxl8KPD /wCzZqfxS+HWn3MsyP4e1b4g+DvDGl+LrYS3vhO81qzgmnjNY/bK+FOheAPBvxKvfAP7YU/h3x3q HiHTdE07R/8Agnz+3r4i8f2Nx4YuYrTUpPGXwo8P/s2an8Uvh1p9zLMj+HtW+IPg7wxpfi62Et74 TvNas4Jp4/v2igD4C1j9sr4U6F4A8G/Eq98A/thT+HfHeoeIdN0TTtH/AOCfP7eviLx/Y3Hhi5it NSk8ZfCjw/8As2an8Uvh1p9zLMj+HtW+IPg7wxpfi62Et74TvNas4Jp4zWP2yvhToXgDwb8Sr3wD +2FP4d8d6h4h03RNO0f/AIJ8/t6+IvH9jceGLmK01KTxl8KPD/7Nmp/FL4dafcyzI/h7VviD4O8M aX4uthLe+E7zWrOCaeP79ooA+AtY/bK+FOheAPBvxKvfAP7YU/h3x3qHiHTdE07R/wDgnz+3r4i8 f2Nx4YuYrTUpPGXwo8P/ALNmp/FL4dafcyzI/h7VviD4O8MaX4uthLe+E7zWrOCaeM1j9sr4U6F4 A8G/Eq98A/thT+HfHeoeIdN0TTtH/wCCfP7eviLx/Y3Hhi5itNSk8ZfCjw/+zZqfxS+HWn3MsyP4 e1b4g+DvDGl+LrYS3vhO81qzgmnj+/aKAPgLWP2yvhToXgDwb8Sr3wD+2FP4d8d6h4h03RNO0f8A 4J8/t6+IvH9jceGLmK01KTxl8KPD/wCzZqfxS+HWn3MsyP4e1b4g+DvDGl+LrYS3vhO81qzgmnjN Y/bK+FOheAPBvxKvfAP7YU/h3x3qHiHTdE07R/8Agnz+3r4i8f2Nx4YuYrTUpPGXwo8P/s2an8Uv h1p9zLMj+HtW+IPg7wxpfi62Et74TvNas4Jp4/v2igD4C1j9sr4U6F4A8G/Eq98A/thT+HfHeoeI dN0TTtH/AOCfP7eviLx/Y3Hhi5itNSk8ZfCjw/8As2an8Uvh1p9zLMj+HtW+IPg7wxpfi62Et74T vNas4Jp4zWP2yvhToXgDwb8Sr3wD+2FP4d8d6h4h03RNO0f/AIJ8/t6+IvH9jceGLmK01KTxl8KP D/7Nmp/FL4dafcyzI/h7VviD4O8MaX4uthLe+E7zWrOCaeP79ooA+AtY/bK+FOheAPBvxKvfAP7Y U/h3x3qHiHTdE07R/wDgnz+3r4i8f2Nx4YuYrTUpPGXwo8P/ALNmp/FL4dafcyzI/h7VviD4O8Ma X4uthLe+E7zWrOCaeM1j9sr4U6F4A8G/Eq98A/thT+HfHeoeIdN0TTtH/wCCfP7eviLx/Y3Hhi5i tNSk8ZfCjw/+zZqfxS+HWn3MsyP4e1b4g+DvDGl+LrYS3vhO81qzgmnj+/aKAPzYubPxR+1P8Xf2 Dvi98OvCfxC8M/Bn4L/Fn42fHTxrr/xe+G/xL+Afjhtasv2ePjZ+y34R+G8/wU+NvhP4efF+1fxX fftEeJPiDaeIdX8EWXhxNF+FcVxBqFyPFvhia+/SeiigAooooAKKKKACiiigAooooAKKKKACiiig AooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKAC iiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKK KKACiiigAooooAKKKKACiiigAooooAKKKKAP/9kKZW5kc3RyZWFtCmVuZG9iago5IDAgb2JqCjIw MTU0MAplbmRvYmoKMTUgMCBvYmoKPDwgL0xlbmd0aCAxNiAwIFIgL04gMyAvQWx0ZXJuYXRlIC9E ZXZpY2VSR0IgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBnZZ3VFPZFofPvTe90BIi ICX0GnoJINI7SBUEUYlJgFAChoQmdkQFRhQRKVZkVMABR4ciY0UUC4OCYtcJ8hBQxsFRREXl3Yxr Ce+tNfPemv3HWd/Z57fX2Wfvfde6AFD8ggTCdFgBgDShWBTu68FcEhPLxPcCGBABDlgBwOFmZgRH +EQC1Py9PZmZqEjGs/buLoBku9ssv1Amc9b/f5EiN0MkBgAKRdU2PH4mF+UClFOzxRky/wTK9JUp MoYxMhahCaKsIuPEr2z2p+Yru8mYlybkoRpZzhm8NJ6Mu1DemiXho4wEoVyYJeBno3wHZb1USZoA 5fco09P4nEwAMBSZX8znJqFsiTJFFBnuifICAAiUxDm8cg6L+TlongB4pmfkigSJSWKmEdeYaeXo yGb68bNT+WIxK5TDTeGIeEzP9LQMjjAXgK9vlkUBJVltmWiR7a0c7e1Z1uZo+b/Z3x5+U/09yHr7 VfEm7M+eQYyeWd9s7KwvvRYA9iRamx2zvpVVALRtBkDl4axP7yAA8gUAtN6c8x6GbF6SxOIMJwuL 7OxscwGfay4r6Df7n4Jvyr+GOfeZy+77VjumFz+BI0kVM2VF5aanpktEzMwMDpfPZP33EP/jwDlp zcnDLJyfwBfxhehVUeiUCYSJaLuFPIFYkC5kCoR/1eF/GDYnBxl+nWsUaHVfAH2FOVC4SQfIbz0A QyMDJG4/egJ961sQMQrIvrxorZGvc48yev7n+h8LXIpu4UxBIlPm9gyPZHIloiwZo9+EbMECEpAH dKAKNIEuMAIsYA0cgDNwA94gAISASBADlgMuSAJpQASyQT7YAApBMdgBdoNqcADUgXrQBE6CNnAG XARXwA1wCwyAR0AKhsFLMAHegWkIgvAQFaJBqpAWpA+ZQtYQG1oIeUNBUDgUA8VDiZAQkkD50Cao GCqDqqFDUD30I3Qaughdg/qgB9AgNAb9AX2EEZgC02EN2AC2gNmwOxwIR8LL4ER4FZwHF8Db4Uq4 Fj4Ot8IX4RvwACyFX8KTCEDICAPRRlgIG/FEQpBYJAERIWuRIqQCqUWakA6kG7mNSJFx5AMGh6Fh mBgWxhnjh1mM4WJWYdZiSjDVmGOYVkwX5jZmEDOB+YKlYtWxplgnrD92CTYRm40txFZgj2BbsJex A9hh7DscDsfAGeIccH64GFwybjWuBLcP14y7gOvDDeEm8Xi8Kt4U74IPwXPwYnwhvgp/HH8e348f xr8nkAlaBGuCDyGWICRsJFQQGgjnCP2EEcI0UYGoT3QihhB5xFxiKbGO2EG8SRwmTpMUSYYkF1Ik KZm0gVRJaiJdJj0mvSGTyTpkR3IYWUBeT64knyBfJQ+SP1CUKCYUT0ocRULZTjlKuUB5QHlDpVIN qG7UWKqYup1aT71EfUp9L0eTM5fzl+PJrZOrkWuV65d7JU+U15d3l18unydfIX9K/qb8uAJRwUDB U4GjsFahRuG0wj2FSUWaopViiGKaYolig+I1xVElvJKBkrcST6lA6bDSJaUhGkLTpXnSuLRNtDra ZdowHUc3pPvTk+nF9B/ovfQJZSVlW+Uo5RzlGuWzylIGwjBg+DNSGaWMk4y7jI/zNOa5z+PP2zav aV7/vCmV+SpuKnyVIpVmlQGVj6pMVW/VFNWdqm2qT9QwaiZqYWrZavvVLquNz6fPd57PnV80/+T8 h+qwuol6uPpq9cPqPeqTGpoavhoZGlUalzTGNRmabprJmuWa5zTHtGhaC7UEWuVa57VeMJWZ7sxU ZiWzizmhra7tpy3RPqTdqz2tY6izWGejTrPOE12SLls3Qbdct1N3Qk9LL1gvX69R76E+UZ+tn6S/ R79bf8rA0CDaYItBm8GooYqhv2GeYaPhYyOqkavRKqNaozvGOGO2cYrxPuNbJrCJnUmSSY3JTVPY 1N5UYLrPtM8Ma+ZoJjSrNbvHorDcWVmsRtagOcM8yHyjeZv5Kws9i1iLnRbdFl8s7SxTLessH1kp WQVYbbTqsPrD2sSaa11jfceGauNjs86m3ea1rakt33a/7X07ml2w3Ra7TrvP9g72Ivsm+zEHPYd4 h70O99h0dii7hH3VEevo4bjO8YzjByd7J7HTSaffnVnOKc4NzqMLDBfwF9QtGHLRceG4HHKRLmQu jF94cKHUVduV41rr+sxN143ndsRtxN3YPdn9uPsrD0sPkUeLx5Snk+cazwteiJevV5FXr7eS92Lv au+nPjo+iT6NPhO+dr6rfS/4Yf0C/Xb63fPX8Of61/tPBDgErAnoCqQERgRWBz4LMgkSBXUEw8EB wbuCHy/SXyRc1BYCQvxDdoU8CTUMXRX6cxguLDSsJux5uFV4fnh3BC1iRURDxLtIj8jSyEeLjRZL FndGyUfFRdVHTUV7RZdFS5dYLFmz5EaMWowgpj0WHxsVeyR2cqn30t1Lh+Ps4grj7i4zXJaz7Npy teWpy8+ukF/BWXEqHhsfHd8Q/4kTwqnlTK70X7l35QTXk7uH+5LnxivnjfFd+GX8kQSXhLKE0USX xF2JY0muSRVJ4wJPQbXgdbJf8oHkqZSQlKMpM6nRqc1phLT4tNNCJWGKsCtdMz0nvS/DNKMwQ7rK adXuVROiQNGRTChzWWa7mI7+TPVIjCSbJYNZC7Nqst5nR2WfylHMEeb05JrkbssdyfPJ+341ZjV3 dWe+dv6G/ME17msOrYXWrlzbuU53XcG64fW+649tIG1I2fDLRsuNZRvfbore1FGgUbC+YGiz7+bG QrlCUeG9Lc5bDmzFbBVs7d1ms61q25ciXtH1YsviiuJPJdyS699ZfVf53cz2hO29pfal+3fgdgh3 3N3puvNYmWJZXtnQruBdreXM8qLyt7tX7L5WYVtxYA9pj2SPtDKosr1Kr2pH1afqpOqBGo+a5r3q e7ftndrH29e/321/0wGNA8UHPh4UHLx/yPdQa61BbcVh3OGsw8/rouq6v2d/X39E7Ujxkc9HhUel x8KPddU71Nc3qDeUNsKNksax43HHb/3g9UN7E6vpUDOjufgEOCE58eLH+B/vngw82XmKfarpJ/2f 9rbQWopaodbc1om2pDZpe0x73+mA050dzh0tP5v/fPSM9pmas8pnS8+RzhWcmzmfd37yQsaF8YuJ F4c6V3Q+urTk0p2usK7ey4GXr17xuXKp2737/FWXq2euOV07fZ19ve2G/Y3WHruell/sfmnpte9t velws/2W462OvgV95/pd+y/e9rp95Y7/nRsDiwb67i6+e/9e3D3pfd790QepD14/zHo4/Wj9Y+zj oicKTyqeqj+t/dX412apvfTsoNdgz7OIZ4+GuEMv/5X5r0/DBc+pzytGtEbqR61Hz4z5jN16sfTF 8MuMl9Pjhb8p/rb3ldGrn353+71nYsnE8GvR65k/St6ovjn61vZt52To5NN3ae+mp4req74/9oH9 oftj9MeR6exP+E+Vn40/d3wJ/PJ4Jm1m5t/3hPP7CmVuZHN0cmVhbQplbmRvYmoKMTYgMCBvYmoK MjYxMgplbmRvYmoKMTAgMCBvYmoKWyAvSUNDQmFzZWQgMTUgMCBSIF0KZW5kb2JqCjE3IDAgb2Jq Cjw8IC9MZW5ndGggMTggMCBSIC9OIDMgL0FsdGVybmF0ZSAvRGV2aWNlUkdCIC9GaWx0ZXIgL0Zs YXRlRGVjb2RlID4+CnN0cmVhbQp4AZ2Wd1RT2RaHz703vdASIiAl9Bp6CSDSO0gVBFGJSYBQAoaE JnZEBUYUESlWZFTAAUeHImNFFAuDgmLXCfIQUMbBUURF5d2MawnvrTXz3pr9x1nf2ee319ln733X ugBQ/IIEwnRYAYA0oVgU7uvBXBITy8T3AhgQAQ5YAcDhZmYER/hEAtT8vT2ZmahIxrP27i6AZLvb LL9QJnPW/3+RIjdDJAYACkXVNjx+JhflApRTs8UZMv8EyvSVKTKGMTIWoQmirCLjxK9s9qfmK7vJ mJcm5KEaWc4ZvDSejLtQ3pol4aOMBKFcmCXgZ6N8B2W9VEmaAOX3KNPT+JxMADAUmV/M5yahbIky RRQZ7onyAgAIlMQ5vHIOi/k5aJ4AeKZn5IoEiUliphHXmGnl6Mhm+vGzU/liMSuUw03hiHhMz/S0 DI4wF4Cvb5ZFASVZbZloke2tHO3tWdbmaPm/2d8eflP9Pch6+1XxJuzPnkGMnlnfbOysL70WAPYk Wpsds76VVQC0bQZA5eGsT+8gAPIFALTenPMehmxeksTiDCcLi+zsbHMBn2suK+g3+5+Cb8q/hjn3 mcvu+1Y7phc/gSNJFTNlReWmp6ZLRMzMDA6Xz2T99xD/48A5ac3Jwyycn8AX8YXoVVHolAmEiWi7 hTyBWJAuZAqEf9Xhfxg2JwcZfp1rFGh1XwB9hTlQuEkHyG89AEMjAyRuP3oCfetbEDEKyL68aK2R r3OPMnr+5/ofC1yKbuFMQSJT5vYMj2RyJaIsGaPfhGzBAhKQB3SgCjSBLjACLGANHIAzcAPeIACE gEgQA5YDLkgCaUAEskE+2AAKQTHYAXaDanAA1IF60AROgjZwBlwEV8ANcAsMgEdACobBSzAB3oFp CILwEBWiQaqQFqQPmULWEBtaCHlDQVA4FAPFQ4mQEJJA+dAmqBgqg6qhQ1A99CN0GroIXYP6oAfQ IDQG/QF9hBGYAtNhDdgAtoDZsDscCEfCy+BEeBWcBxfA2+FKuBY+DrfCF+Eb8AAshV/CkwhAyAgD 0UZYCBvxREKQWCQBESFrkSKkAqlFmpAOpBu5jUiRceQDBoehYZgYFsYZ44dZjOFiVmHWYkow1Zhj mFZMF+Y2ZhAzgfmCpWLVsaZYJ6w/dgk2EZuNLcRWYI9gW7CXsQPYYew7HA7HwBniHHB+uBhcMm41 rgS3D9eMu4Drww3hJvF4vCreFO+CD8Fz8GJ8Ib4Kfxx/Ht+PH8a/J5AJWgRrgg8hliAkbCRUEBoI 5wj9hBHCNFGBqE90IoYQecRcYimxjthBvEkcJk6TFEmGJBdSJCmZtIFUSWoiXSY9Jr0hk8k6ZEdy GFlAXk+uJJ8gXyUPkj9QlCgmFE9KHEVC2U45SrlAeUB5Q6VSDahu1FiqmLqdWk+9RH1KfS9HkzOX 85fjya2Tq5FrleuXeyVPlNeXd5dfLp8nXyF/Sv6m/LgCUcFAwVOBo7BWoUbhtMI9hUlFmqKVYohi mmKJYoPiNcVRJbySgZK3Ek+pQOmw0iWlIRpC06V50ri0TbQ62mXaMB1HN6T705PpxfQf6L30CWUl ZVvlKOUc5Rrls8pSBsIwYPgzUhmljJOMu4yP8zTmuc/jz9s2r2le/7wplfkqbip8lSKVZpUBlY+q TFVv1RTVnaptqk/UMGomamFq2Wr71S6rjc+nz3eez51fNP/k/IfqsLqJerj6avXD6j3qkxqaGr4a GRpVGpc0xjUZmm6ayZrlmuc0x7RoWgu1BFrlWue1XjCVme7MVGYls4s5oa2u7act0T6k3as9rWOo s1hno06zzhNdki5bN0G3XLdTd0JPSy9YL1+vUe+hPlGfrZ+kv0e/W3/KwNAg2mCLQZvBqKGKob9h nmGj4WMjqpGr0SqjWqM7xjhjtnGK8T7jWyawiZ1JkkmNyU1T2NTeVGC6z7TPDGvmaCY0qzW7x6Kw 3FlZrEbWoDnDPMh8o3mb+SsLPYtYi50W3RZfLO0sUy3rLB9ZKVkFWG206rD6w9rEmmtdY33Hhmrj Y7POpt3mta2pLd92v+19O5pdsN0Wu067z/YO9iL7JvsxBz2HeIe9DvfYdHYou4R91RHr6OG4zvGM 4wcneyex00mn351ZzinODc6jCwwX8BfULRhy0XHhuBxykS5kLoxfeHCh1FXbleNa6/rMTdeN53bE bcTd2D3Z/bj7Kw9LD5FHi8eUp5PnGs8LXoiXr1eRV6+3kvdi72rvpz46Pok+jT4Tvna+q30v+GH9 Av12+t3z1/Dn+tf7TwQ4BKwJ6AqkBEYEVgc+CzIJEgV1BMPBAcG7gh8v0l8kXNQWAkL8Q3aFPAk1 DF0V+nMYLiw0rCbsebhVeH54dwQtYkVEQ8S7SI/I0shHi40WSxZ3RslHxUXVR01Fe0WXRUuXWCxZ s+RGjFqMIKY9Fh8bFXskdnKp99LdS4fj7OIK4+4uM1yWs+zacrXlqcvPrpBfwVlxKh4bHx3fEP+J E8Kp5Uyu9F+5d+UE15O7h/uS58Yr543xXfhl/JEEl4SyhNFEl8RdiWNJrkkVSeMCT0G14HWyX/KB 5KmUkJSjKTOp0anNaYS0+LTTQiVhirArXTM9J70vwzSjMEO6ymnV7lUTokDRkUwoc1lmu5iO/kz1 SIwkmyWDWQuzarLeZ0dln8pRzBHm9OSa5G7LHcnzyft+NWY1d3Vnvnb+hvzBNe5rDq2F1q5c27lO d13BuuH1vuuPbSBtSNnwy0bLjWUb326K3tRRoFGwvmBos+/mxkK5QlHhvS3OWw5sxWwVbO3dZrOt atuXIl7R9WLL4oriTyXckuvfWX1X+d3M9oTtvaX2pft34HYId9zd6brzWJliWV7Z0K7gXa3lzPKi 8re7V+y+VmFbcWAPaY9kj7QyqLK9Sq9qR9Wn6qTqgRqPmua96nu37Z3ax9vXv99tf9MBjQPFBz4e FBy8f8j3UGutQW3FYdzhrMPP66Lqur9nf19/RO1I8ZHPR4VHpcfCj3XVO9TXN6g3lDbCjZLGseNx x2/94PVDexOr6VAzo7n4BDghOfHix/gf754MPNl5in2q6Sf9n/a20FqKWqHW3NaJtqQ2aXtMe9/p gNOdHc4dLT+b/3z0jPaZmrPKZ0vPkc4VnJs5n3d+8kLGhfGLiReHOld0Prq05NKdrrCu3suBl69e 8blyqdu9+/xVl6tnrjldO32dfb3thv2N1h67npZf7H5p6bXvbb3pcLP9luOtjr4Ffef6Xfsv3va6 feWO/50bA4sG+u4uvnv/Xtw96X3e/dEHqQ9eP8x6OP1o/WPs46InCk8qnqo/rf3V+Ndmqb307KDX YM+ziGePhrhDL/+V+a9PwwXPqc8rRrRG6ketR8+M+YzderH0xfDLjJfT44W/Kf6295XRq59+d/u9 Z2LJxPBr0euZP0reqL45+tb2bedk6OTTd2nvpqeK3qu+P/aB/aH7Y/THkensT/hPlZ+NP3d8Cfzy eCZtZubf94Tz+wplbmRzdHJlYW0KZW5kb2JqCjE4IDAgb2JqCjI2MTIKZW5kb2JqCjE0IDAgb2Jq ClsgL0lDQ0Jhc2VkIDE3IDAgUiBdCmVuZG9iagoxOSAwIG9iago8PCAvTGVuZ3RoIDIwIDAgUiAv TiAzIC9BbHRlcm5hdGUgL0RldmljZVJHQiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0K eAGFVd9v21QUPolvUqQWPyBYR4eKxa9VU1u5GxqtxgZJk6XtShal6dgqJOQ6N4mpGwfb6baqT3uB Nwb8AUDZAw9IPCENBmJ72fbAtElThyqqSUh76MQPISbtBVXhu3ZiJ1PEXPX6yznfOec7517bRD1f abWaGVWIlquunc8klZOnFpSeTYrSs9RLA9Sr6U4tkcvNEi7BFffO6+EdigjL7ZHu/k72I796i9zR iSJPwG4VHX0Z+AxRzNRrtksUvwf7+Gm3BtzzHPDTNgQCqwKXfZwSeNHHJz1OIT8JjtAq6xWtCLwG PLzYZi+3YV8DGMiT4VVuG7oiZpGzrZJhcs/hL49xtzH/Dy6bdfTsXYNY+5yluWO4D4neK/ZUvok/ 17X0HPBLsF+vuUlhfwX4j/rSfAJ4H1H0qZJ9dN7nR19frRTeBt4Fe9FwpwtN+2p1MXscGLHR9SXr mMgjONd1ZxKzpBeA71b4tNhj6JGoyFNp4GHgwUp9qplfmnFW5oTdy7NamcwCI49kv6fN5IAHgD+0 rbyoBc3SOjczohbyS1drbq6pQdqumllRC/0ymTtej8gpbbuVwpQfyw66dqEZyxZKxtHpJn+tZnpn EdrYBbueF9qQn93S7HQGGHnYP7w6L+YGHNtd1FJitqPAR+hERCNOFi1i1alKO6RQnjKUxL1GNjwl MsiEhcPLYTEiT9ISbN15OY/jx4SMshe9LaJRpTvHr3C/ybFYP1PZAfwfYrPsMBtnE6SwN9ib7AhL wTrBDgUKcm06FSrTfSj187xPdVQWOk5Q8vxAfSiIUc7Z7xr6zY/+hpqwSyv0I0/QMTRb7RMgBxNo dTfSPqdraz/sDjzKBrv4zu2+a2t0/HHzjd2Lbcc2sG7GtsL42K+xLfxtUgI7YHqKlqHK8HbCCXgj HT1cAdMlDetv4FnQ2lLasaOl6vmB0CMmwT/IPszSueHQqv6i/qluqF+oF9TfO2qEGTumJH0qfSv9 KH0nfS/9TIp0Wboi/SRdlb6RLgU5u++9nyXYe69fYRPdil1o1WufNSdTTsp75BfllPy8/LI8G7AU uV8ek6fkvfDsCfbNDP0dvRh0CrNqTbV7LfEEGDQPJQadBtfGVMWEq3QWWdufk6ZSNsjG2PQjp3Zc nOWWing6noonSInvi0/Ex+IzAreevPhe+CawpgP1/pMTMDo64G0sTCXIM+KdOnFWRfQKdJvQzV1+ Bt8OokmrdtY2yhVX2a+qrykJfMq4Ml3VR4cVzTQVz+UoNne4vcKLoyS+gyKO6EHe+75Fdt0Mbe5b RIf/wjvrVmhbqBN97RD1vxrahvBOfOYzoosH9bq94uejSOQGkVM6sN/7HelL4t10t9F4gPdVzydE Ox83Gv+uNxo7XyL/FtFl8z9ZAHF4CmVuZHN0cmVhbQplbmRvYmoKMjAgMCBvYmoKMTA0NwplbmRv YmoKNyAwIG9iagpbIC9JQ0NCYXNlZCAxOSAwIFIgXQplbmRvYmoKMyAwIG9iago8PCAvVHlwZSAv UGFnZXMgL01lZGlhQm94IFswIDAgNzkyIDYxMl0gL0NvdW50IDEgL0tpZHMgWyAyIDAgUiBdID4+ CmVuZG9iagoyMSAwIG9iago8PCAvVHlwZSAvQ2F0YWxvZyAvUGFnZXMgMyAwIFIgPj4KZW5kb2Jq CjExIDAgb2JqCjw8IC9UeXBlIC9Gb250IC9TdWJ0eXBlIC9UcnVlVHlwZSAvQmFzZUZvbnQgL0pN QU1MQStNaWNyb3NvZnRTYW5zU2VyaWYgL0ZvbnREZXNjcmlwdG9yCjIyIDAgUiAvRW5jb2Rpbmcg L01hY1JvbWFuRW5jb2RpbmcgL0ZpcnN0Q2hhciAzMiAvTGFzdENoYXIgMTE3IC9XaWR0aHMgWyAy NjYKMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAyNzggMCA1NTYgNTU2IDU1NiAwIDU1NiAwIDAg NTU2IDAgMCAwIDAgMCAwIDAgMAowIDAgMCAwIDAgNjY3IDAgMCAwIDI3OCAwIDY2NyAwIDAgMCAw IDY2NyAwIDcyMiAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwCjAgNTU2IDAgMCAwIDAgMCAwIDAg MjI4IDAgMCAyMjggODMzIDU1NiA1NTYgMCAwIDAgMCAyNzggNTU2IF0gPj4KZW5kb2JqCjIyIDAg b2JqCjw8IC9UeXBlIC9Gb250RGVzY3JpcHRvciAvRm9udE5hbWUgL0pNQU1MQStNaWNyb3NvZnRT YW5zU2VyaWYgL0ZsYWdzIDMyIC9Gb250QkJveApbLTU4MCAtMjE2IDE0ODMgOTIyXSAvSXRhbGlj QW5nbGUgMCAvQXNjZW50IDkyMiAvRGVzY2VudCAtMjEwIC9DYXBIZWlnaHQgNzUwCi9TdGVtViAw IC9YSGVpZ2h0IDY0NiAvTWF4V2lkdGggMTUxOCAvRm9udEZpbGUyIDIzIDAgUiA+PgplbmRvYmoK MjMgMCBvYmoKPDwgL0xlbmd0aCAyNCAwIFIgL0xlbmd0aDEgODkxMiAvRmlsdGVyIC9GbGF0ZURl Y29kZSA+PgpzdHJlYW0KeAGFWQt4VNW13nufc+b9zkxmkgFmJkMAOeCERAJRrjkQEsCAhIg1sYyZ QAIhChlIFLTQYDENJFgSxQfiV3Jbv0KtH5yAlUDhQjHXN7dWb9V7W4VPKQ9rJOWCciGZuf8+kwD2 8d2TWXuvvdZ+rL3W2muvc9K0+uFaYiEbiECUJSuq40R7XKdQ9S55pCmoNYnhT4SwjqXxZStSbfND hOhHLnvo0aWpdtr7hNhK6mqra1JtMoA6vw6EVJvehnp03Yqmtam2awvqhQ81LBnip72E9oQV1WuH 1idYjwRXVq+oTfXP0vjxhsamobYP9Zb46tqh/rQC8vyo5fg7wWt60tGyg9c2Qih6echu4iNVRE8Y cZAIuZcQ8YfsdSKBy/kSIZmfvfRwlX3aZeI3aNPvvTxtL0eOv/6rF68tSpSYP9PH0DRq/TkD4/Sx RDkhltHXFl19zPzZdQ7n8sfTvVDpoZP3j8gqiEy30MmkEDAfsBWwEyARhd66f0SgIGe6i47DeAXl BkAHoAugAiRygY7ReNn7/YECZbqJjkYzQrnw86mosQTlZaO1IFIbWRpZFqmLLI/UR5oiD0d+EFkX +X3kA0twIGdAGXh/QPzrxYzmi3Trxb0XT10Ufv9BunfED9al+3+wLiNnnbKubF1sXXyd9MgakFfE UTzUgOLBlel++4PND25duXPl3pXSgyubV2c2Pez2jFhWj+KX9Qfrz9f/b724dDlabyyntXVuv702 UMv21h2tu1CbrBVr61pWZWY0pj9WlBF6FBCZPovOwFZnkGaAQMroHdp+bsdubicNgGbAUYAE7Dbw mmke1JIHteShfwPNBSUXWsxFK05D2ugQtBvCDCFSBRChvlFQ3yhyDCCQIJ1IcgAxQBywAdAB0EEO +6vmQIExMj1AbRhrg2VsZC/gKEBCrxT2O9QnARc0ahBlA0AFvA84RW37pN/bp4eBFwL4WD5CJHaU VQDeuwswzDkJXK/1nQ+sGbAXcAGQxFy6nc3aXJyGuTkNcwVQFgI49SSA95a0FTgnAmgGbAUcAwz1 2GdYsXO6H+3fAfiIJCAlF28xbXwEWCFgPuDmsfrb40dA4lMxqMq2X84rqNJmi4O0FbAT8DsA76K7 LgufawPgKOCCxuGDjf6C+G9oPuwVpIb9VmcBjgfbZ3YXHEweo/r9fn5OfNQCKSxYLoKSYg0zygjV g6qHbHroWw/5eYsfGKLUmB0FSsLsLDj1DcXPfWn0JdZ0iSonYydZ8JOcT5RPhKW/feS3bPu/0eC+ nH3KPiGmxlW242kiv/AUkbd3Enkb8KcAnU/r5KefEeTnW0T5uWdF+Vng25/55TOsYbqdToJ2J0Ge SUSgOTSd5MIeGag9qNP3tQjyweQpGtmP7cSnW6lXk9oLrXohqxc+4CUiTaPufeMDXYepG67jxnbc SroQv9Z/jUWuNVxrviYoV8uuxq72XxV7kseU5FWnp6Dsq/hXTCuUr+jRv9D4lzTnSxo/T6vOx8/3 nxe6gJ2Ln2MXztHmc0fPXTgn9J+l+EXObjjbdbb/rFh2pv8MKzsTOxM/c+yMWPZnGv8z3XD61On+ 04Lyp64/sZyOsg4W7JrfVdW1s2tv14Uu3anLFL//aRkViHxOlU/pzj/s/cPRPwj2D5UP2an3qb03 3ssivYW983urenf27u290JvsNWw/sv0o++//EuWPWpj83gmdfAL122/p5LdQP9kuylvaMwLtG98K bF5fE3i82SCvBzS36OW9UPamFiq3thD5CeAbUUcG5w+yZuVXF+jE/jv65/cv72/ul/xTPL58j2ey x3Wbx57nseR6jJM8uhyPEPGQWz1jxtrHjbWPIeMD9vGR8YXjhcjoo6PZeNk+QbZnhW2jw/ZRAVsw YA9K1O5wWixWm8VoMlt0eoNFECW4GrMQwRcos8ftrNm+wX7ULtiFgBAR5gvNwlHhgqAX6YSAn460 +vSZVo/Da3WJbmvcT8v8cX+/X+AGM/vTfAVx/wY/K8ujqquUlC6coaZR1PfMUPPk0h4hWK7myqWq sez7Fd2U/qQSVJVt6qFkoSpu6mGoXEX3f7+ih2Zwdov/IJyGqKWxlicr5ZFqTek9FeqGkZVqLkc6 RlaSRrmpSeZPY2OqBqa1QZC7x40pVscXV6sTimMzU9QhnnqhWO0vrq5DEVMvhGc2NtKb+cMzNDXy R0bFsSb+p+Eoed0EDorUyo2Q5fqjjdNGcMnwgKN1fPiBxqbvAobzyfgDGVSfOgnKwih017aizcoL TgFJA87sNnJNlpXPKFWnlZeq9rLvq5lhNN5CIx8NS3iGjKv9EMkYLlPX8s2lmM25hCTP3ig5lqhL fsnrGw+7nPxaOoEM6NPk16z/Bv3/x3g+kcop/p++H1AbnUDTtF5vUSN562/6byaziT+5JtmT/DN5 CdmMKbko+a/Jb4Z6ma5jnFCZ3EXeRv064DjZqNVHgB8hjwJ/CHUn0fIb1kD2kF+QF8DbQbaRdvKe 1t6GNtSCNOcLDftnxQlygtTRr0mM8Gzuu89uZF27yUH02E3KaT2ZQ9bjbyNpQ7dVWK2TIBOkA2RV cisbT1Zg9S72gmAiPZCgnbbTTvp7oRPzNrI6tp6q9FM2QshjP2cPskZazuaSEJkrnRUvkueTdeQV 8u+kBX+LyELI8io9lAwk6rDORnIY825LtiT3kHJyi86NuUtISaJCipGt+hi7SLLJnWQWKSMVpJHs pjGMfubvaIRMRI8YeZw8TQ5RQ/LD5J5kp64clEWI4zKVxUP0TtqCDDGdmEipuF73InD+N5e8S/8k 7peOkx+RpYCVyvSF5fPmzpl9R8HUKfmTb8vLnZQTuXXiBHn8LePGjskeHc4KBQOjRo7wZ2b4vOke d5rL6bDbrBazyWjQ6yRRYJRMoKqvqKK4Xs0oiqkl4ZlhR1Atubt/XkQlLn8o7MyrnJjqokqyStJK VXdZRTdRplaqOvk7/LtVIdtxMYRh8/zBYlXMxi98V3WNOq68IhR2fOC/zq/ElGpmUUUo5FdZNn5z wMLvrupgjeooAx0MjTJHJWUVHHqSn08F0TE1VOlXSXmFOgrNnmQ/2nj+XsKDcLdj35Hxbtrm6C7J KJqpEnc3KflcJR7eqX8qUck0dRwCZ7YDGKbyqSSC+/SiStNU6pmHDX1nfj7q1NS/3X1xTX24uGY5 tFgTu6HH/pQWQ8G2YFt5hTPPH4K8mK3bbCoKF9WaJk4g3SYzUDMwaD/eTUvupBrCSopv72bEYIWu XFy6Yg71qtIeAxKeCSWBk3aDgytjy80sgmGpTgTdNIyquiJVr60bXK4q1SppD3ZPONa2pcdBFsdk S024pnpRhSpUQ8ZuImQX1y1UR5SW3Q8SlgfE6oLcqjO1gtsoWFwXbEOb942hDM/ktv0OvaauNsa9 gcbCM8EzFlW0ho75cTNVtBarTlmdheGzHjvtF9qKfcuDvNnW1hpUuxZU3MwN8T4wtW/ihGBbcRir YbLi+hncXpFh+2g+N6eGG6I6qG5YXA9N4Ve9Zdi5Q20OteSbEMwAQwyPGlJtTayeb6MeI0VUwbb2 Wm2bW7RtwSWDxfUzOfCBcHByLw7O/RXFdeFi6LI9tSCUAUTI/tuxoZCaIfOBbW3FXL7qGkjOtYJf Bu6pooqhBtzeL1MIXaQqC7WKLNT0jxWV6pmVQ6ShDuCIsIGqxGZWVvJNYYXS8ooisIvD1TO5u91M iQ1R0KV4mMmlDc/BDGpwSZAfrTAGT+VF7VTStmSqpqtQJZ04obTsxihVynaEg22XEbBi4b6vsMhN lOohii7bcZlwZkm4JNbWVhIOlrTF2qp7khsWh4OOcFt3aWlbvDiGVXHIKeiH2v1qyZZK1RGro7fD 0NznSnDYWXZJsK4aDfwKwyHI5MS+UmwM/cdsAk+Hv+NktTkgg2pBwPEHS/gWeeDgwYSfRax+bwX8 fwnmLq7RCpwLJETMz0+IUJldvPyeoY37Q1hLO4c8rC0YomKSUIifnfYehSxGQ92woCLVDpLF/n1E iciwW4xzjg1zPPdyzoZhzvXhsTBsyPOxf+7LCNLX/bjNGXYFCyKaCCn7q2lFFYKfgcIx5hc4ZpIR 1qepXhk4y+bbR8RrgwXfD6sOWZWKKo75p1UGHU4EO27pe8KlC+6v4LbHaO6NjvfDb+PSTEPwdKh0 mkrTOZ0gQEJjCN/eqWBeHxgsbht2NZUVLay4eb7hs3czDQMXDq+mDVBn427Bw2XnE6hztDaacN31 /seAIDbO6A7TTQu6FbrpnvsrDjoICW5aWLGPUVYUmwHT4sJmFSSXBVEXkNfERrII8AWgEBAALJa+ R14C7zCvNXiTvAT63fRD5AwA3cukHW0Os9EvjLoV06a+8+BjDV5SX0M7SL4H2j9/GFgCXjPxZQgj +KPXyn9cDKd3RrBN17uYgVmut/4RYv0bIj5X4bHjG5WTuK7z0ohbw91kBLmdPEXepOPpevoOS2ML 2FlhrnBZPCielkSpQzqvW6J7Qx/Gy3MuNDgGggtc7jxnyJkdcoZy6aXEWjoicVpHrpKHJP7F6aZn EtcSdEM3ImMTSLaSzlSKbw2KKNG9OTmKtEFSpX5JjMo00+eY10cifZNyQuHJeXTjiRMnsOai5FnR K32IFdPIA4rLtoN/13GY7bOJaNhxm0jxTtuv3IK2mGbezEYzamUjGXNu1imyjjKdS8dsooetY27d D1iXh0ZlmVY9EI1qi0Wjjj5SKEf7OEzKoUGnIwSguciPWDiLOR0uVkA/S2QlwvTT9o6O9raODunD QcOghV1iV67upha6kN5L7Ym/Jn6VeCVxie/1C64eyGsgMxWZ6cUdkmJx5Et4z3sCwio2R76op+23 kZmkCR2JyRg3UdZlotGqVU5XQSTal9srR0mk8CO5z1nAVeHUhScH0/IEcnj1BVqZ1yk+PncbNWGl QnxvNGElH2lUIvZ0avcEPIWe+R7RbPabZbNgNemp3WrcoXNQh0P0bqcdXmr3BrzMJXh7km8pGWZH vpf6dJvTqGWzVclMW8cyrFBSpqYkTUG9jr43XAUyVxgMU/hAtO/EpJwHomhGQ6Hb8glyzTHhLJ0+ nJ+fl4vEUkf0IdE0MPkX9DcvbWle+aLpdcfgf/zxa3XwssR6f3yJ1v6h9dH2LZt+e/Yv3V2XE3MV 2DeAXbjxDmQiVlKvzLBYrVt0erdOp7foqc4oWF+YL1VJTJLwpixYU+/V7XGygbD5lH/BoQ5KqT2i ozrF6pit67LTaESOOj6KRk9Eo33eAmcBdKnpleOTclqlW2VxvaOXhp1hZ2gyzXPmhZxUdL9xZPAn bMe2NxLrE3fSBxI/ow/8Qnh7YArrGoxxqy6GlF689emg63ECzv2TTHAzJmSRGXgDEAQibFd0go2N YreyB9hKJjGB6nuSp5WQ2Z5PmZOFWDUTzSIb7ZjDGJEMZB3TS1C2QVM2LO+LcDXLBZA3Wpg5r6+g KpqStnV9L6VhGpocEr2Df/mQhQcdwq+lyVfflSx7INlLkOw8JDOTxUrA2KlTGNV1+nKkTiaYOqne 4DUwEzGIRGdqpj3Jq69arbo7gCQUl9kMTLGSBmahD7JzVkqq+OmA4WV5Xl+uo7cXAnGz98lE8wZ4 I867ZwjE89d+I4YHdgq3DHwsbJQO7UkoexIOSHQYCmuGRAJZoligB3zhEodWHVCsqVVx+ptDORL/ vDE+PC5fL3mlKdIyaY3UKulmSfcBbZWek3ZJB6Q3pW8l4/MSXStx+VZFV90QEZbVDkgebX79dSyY 0oZUrmnjGyX3ETMMZXaaQ+bp5gXmajPcqQ7imIRM4XbhBUE04YowmERJJ0i7TJSYJVNP8uR+d3Y+ 6mOKz+TIN2ETaSRMBKdgEJolbRsQOqGM4tuQoLw1zCI9yL610lnWNdZdVqHHes7KIOjNcuZCj443 ZNkJm3Jv9MIPQaqKakW3jt9sfniKmTC8iQkQawTU9jgxI0KbDcYRxsdNgttkEjTfHbr4HL1o+WTD 9abe4JhmmIbkj+rh2XlOGqJSeZIMXjl9/Dh7l+oGX2B/PJkQpUODt7CPB3+Bk8c9Z0DTlYesV6yW TqPR7OkkgtmxHnv8WvMUIP+NQME3O0WiOIYeiVkFSTE68i2mZnNP8orWDciA4uXdzIpXamDpZjiU l67x7vJqyrhhs1zu5VVRuBhCfWEfTiYCb1ooNx3RQ4R7hYHzqDImHHqJhV/9n58kziQuJ7YeP04b f7OzorU50SkdKjrZ9tmZwdfYlS1PVGwandqJVI+d8Lvsr4p3luU+yzKLwOYKiwSu0RHQpdtNIKyS y2UkxN3mphPc09zM4Pa5mZFJNo8t2zbZJgoZ6/U2r22sbYpNtGnmtvUkLymZfJiNMpvThRhnQMhd SwQr8eibDcMq4IgS4f0MyiicqZGGB1mrkzKX0+jpfA7xSWcY8ZRRIIbZo+iaUXTXqAOjuGpWwSPy ND1EoQw4SM5NuoKqnN68iIzbSXOWaLT1Vlm2Xbf5JExQFQ2FBa4uHs80Ner0nnQv1dQYCkn1H7Rl vxJPbD/ONr/8ySZ1+/ayga20+9c/T7yRmERb654YfFI6NOM/W55/LyBO+oQ+tXrLVVzy5O7kWeGs +C/4z1SQZim5gfFWZ75+pHfk2JFTRorsucxdmQcy38z8OFOij7mpcMD2pu1j21nbtzbJYPVZmZEa e5KnFDMGCTlWRz59zsVPlMKjgEtxWdy+fIPL52JW4re4nvPlGDJ8GeMy6jLWZryVoctIf9bv0D9r SQ8GQ5jA15Li4hNOBjeFj0+SYeGKzsiwu2iwJYA7Q3dHoCd57tecGkBGcAVLgSZutLt5beeR2MeZ diUrUMdC9qXsviy6K4vOzuJR5ebDKnPXzM2FY8rcVRH74KaFfb1RmaAp8+g4Dy6rMfkRxh++1UwO Bz3u9LzcfK8unDVmsiOUx104Sx92wSYeZ1iQH08sXbs0uie344ufvsceX+RbuXbAcNhDf/3e6cPU +5eTC+5buPjHv2qlTauXzXyVzvpZ32A5t0M7gtpseDbPuPL2Sc/ruB4dfCc6wuzUWCeJpAXh/P3X OI3WGhzfyIMFBWcgdKEMMfmHm8k8m5p9BI+Y/fZ7PEremHXcAUaoVKfNMTB8NwxPJmIyeZDPNRRm MQlk0cbrsuEdI8m/HSQjkl/uN5rzkVJ8qdwK5HsjfjyCkQXex73Mm0G9Hsr8kvUZn9uZ7nBBYidt IR0Gn8HtaHHyqGHngjs7DC1G7bjBcT5SpnCaUTEY8W+aUQFjS07O9wLUEJgd2B34JHAuIE3VKmFZ 4M0AGxu4L/Bc4ABQSTtOq1ZpCd7QLXYJtnTmOS4h2OTlFSIRKOgr4NEXCQy/7KAensDwiDlc53mQ yniRzwSduuwjcys3P3F47v2bNx458uOfn1fqt82iJWzPE/GXBw1DlZjduvPY+qLEoym9CF9BLw7y sDLxacPPDYjmTmGV0Cn8qyAZBfyjJozwLpieITbmsNt1Nl3L9TvlTEoTErG22Bh3WgSedxQb14RN cUl1zGmrZTfFhlQE1fYEO8M1kZRRLvXNe6Gzn1TpsiPR+o6OI0eEn+5MPDp4F9vzo9UQHx+p4V+z kV3LkNhMvGSHYnI9ayKZ5C64G06TMoGLQRyWZyWdR1esE6yCTjt9unSD4BPGCYLe6DWONSIRsm/E fyr6Nf8B8n5KbMGz0ejgU2jBwJ+yaYawnPmMS9mVDDobJ/5cxpUMkdvtxs74xrCdKBJzfv6GUvNc 4nSQcBYv07QLAmknThwr+IKn3198nvgrtX/eunt3K0D8l8RniW8TVxKfQt8GaqRZA3eeeOfdEyfe fecErBROXmRjpYn4qtqsFAvjcZW9LFJhnHmtmZkdVv2zJrv7WbYG+fSudJpuNTla1uqpXu/Vj9UL hnF6it8u/QH9m/qP9aJeCz1I9I6n0in9Wh+d5dvlO+D71se3hVxURnRBKopD+VH0jVQ6VVBwArkd /E/iwWLMZCcOKG7sPE/YyWPIFDb2zjlND2Vu3Hj4lVem5EyayCz3/CjO7t9GDYkr2wZfXHGHAbto 1SJ0Nnzth0rAZ6bsRcMrBmYTRgk/FH4q7IG/WXDxTeD+ZuHG1MIfYVbJ7jA9w9IdcLPh++3cAc3L 4Iw9yfdStpPwpgWXk6673Lw+LS6Swr5IYZ4LR4gbB1aqimbrwnC6vJToqBHrnlQT248sqv/pxsOH W7voJvbaYDl8jl259kf+ZsjfgvEkR+Pb9T96PAhRODhUpBLVUb1mQRM142XLiv9l2JHxO6mL/9OT VEiN8eoltbp47erlDTXiY7WrG4SGlbVC05oGcWnDw6ulxtpHalfSYjqHltIyWk6r6XL6EF1BV9IG 2pRam+KdOPXGquP/tblr3vR5c6fL85YvWd3Q2LC06Z7qlY33YPql5P8Aw6irPwplbmRzdHJlYW0K ZW5kb2JqCjI0IDAgb2JqCjYzMDEKZW5kb2JqCjEyIDAgb2JqCjw8IC9UeXBlIC9Gb250IC9TdWJ0 eXBlIC9UcnVlVHlwZSAvQmFzZUZvbnQgL0RCVVFUVitDb21pY1NhbnNNUyAvRm9udERlc2NyaXB0 b3IKMjUgMCBSIC9FbmNvZGluZyAvTWFjUm9tYW5FbmNvZGluZyAvRmlyc3RDaGFyIDMyIC9MYXN0 Q2hhciAxMTYgL1dpZHRocyBbIDI5OQowIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAg MCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwCjAgNjgwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgNTEyIDAgMCAwIDU0OCAwIDAK NTc4IDAgMCAwIDAgMCAwIDAgMCAwIDQ4MCAwIDQ3MSBdID4+CmVuZG9iagoyNSAwIG9iago8PCAv VHlwZSAvRm9udERlc2NyaXB0b3IgL0ZvbnROYW1lIC9EQlVRVFYrQ29taWNTYW5zTVMgL0ZsYWdz IDMyIC9Gb250QkJveApbLTkzIC0zMTIgMTE4NiAxMTAyXSAvSXRhbGljQW5nbGUgMCAvQXNjZW50 IDExMDIgL0Rlc2NlbnQgLTI5MiAvQ2FwSGVpZ2h0Cjc4NCAvU3RlbVYgMCAvWEhlaWdodCA1NDgg L01heFdpZHRoIDEyNDEgL0ZvbnRGaWxlMiAyNiAwIFIgPj4KZW5kb2JqCjI2IDAgb2JqCjw8IC9M ZW5ndGggMjcgMCBSIC9MZW5ndGgxIDY2MzIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFt CngBzTkLdBPXle+NRh9Lxh75byzjkccfbMnYsWRbI0bPwpYcqPEH24BEIpBsy7GTGMS3CQlBEGdT BMVOAg1JQzE9lGwTwGNwN0qbEJd1Cds0DWWdboJN5G6zbbe7bntySrd7dm3vHUkQSOme/ZyzZ0ea eff/7r3vvo9GO7bt9KNEFEQyZO/q9wVQ9NL+CJpLXbt2sDFc2YoQZe4JPNQfwxMGEFIVPvTo4z0x POUUQorpXr+vO4ajf4e2uhcIMRyboS3o7d/xWAzXnoGWfXRLV5yfMgR4Sr/vsXj/aFrib/b1+2Py 2RPQFgS2bN8Rx4PQOgLb/HF57EJI/i/PXPoh+29KNPTM16U2CSEMUir0ClKiR5EcUYhBdgSS1Agu g3hxlC9H6NfNP/duShZuoixV1PyZy87lEvD9f3x5dqFubl/CU6qfAJoAFmIX2FX9ZO51IP1moW7+ twlPRS3FmdFG9TZKxlloL85EgzjTvki2d3hw+MTwyPA7w3L0XcwgBjP2hL37B/ef2D+yfziMmfPv 7BclRsLCuH3BwaQ1pGhV9vMvvGAmu3ebyJEjZvLEEyby4osmsm2biRw7ZiJer4k88oiJNDWZSEeH iTQ3m8i6dSayYoWJWK0mYrOZyKpVJlJXZyItLSbS02MiPp+JHH3CTE4fM5Ovec1k0yNmsrXJTL7U YSaNzWbSt85MWleYiWA1E95mJstXmYmzzkzWtJjJ6h4zedhnJpcz8OuvT5EzZ6bIK69MkWBwihw/ PkXOnp0i585NkZGRKSKKU+Tw4Smyb98U6e+fIkND10ln53UyMHCd7Nx5nWzcOEVGR6+TzZunyMmT 10no9Qg5eCZCXnslQrYHI/YF8urxGfLS8Qj59vFp8uTZGXLobITsOTtN/uLcDPnquQjxn5smz47M kJdHImTDyDT5S3GG7BUjZL04Tb5yeIY8djhCHjw8TbbsmyGP74uQtfumyaP9M2RHf4Q09E+T7qEZ 8sBQhAwOfUJcQ9PEMzRFujpnSE1nhHyj8xNyf+c0sXROkYcGZkjtQIScGPiE2AemSf3AFCE7I+Tp nZ+Qtp3TxLFziqzcGCFPbZwmgdEI2TU6TfaPThH35gg5sHmafP1khAyf/IR8+eQ0mblhi9ywfXLD Nv2xbepj2/WPbTc+sn38ke3vJm0/nbR9OGn726u2a1dtP7lqs3958gPb1Q9sP37P9v57th+9Z/vh u7a/edd25V3be5dt7162/eCSbeKS7a8v2b5/0TZ+0fbORdult20X37Z99Jbtg7dsl9+yvf2WjUty 5ic69Wonq3LmKZxLaGcu5dQh52JVlipDlaZKUTGqJFWiSq1SqRQqWkWpYK7gRnG8CzV2suIf2rkw Vq/ZIMq5OiymNKLGjrrGsHKhrVFUtT7gGsX4sDvrTYTxwjNfzTDcdWXdwm4Dtwj3akc7O519rIg6 XKLd63acf13YE8bPjvn5M8LuMN5znuFfCcuCY03WV4RdYRw438xL5DGGDwq9YewE/vEwZR9bbj0u dIWx+bzAS2TgnxUeCONcMHROcIVx6pieHxE6wlhlN/l5UVgzz/CHhabP/Pw+4Uu/yuL7hYZpPz8k 1F8z8Z2C/QrFjwqm4Qf5zULFUYY/GcZBe2a79aRgPNDBS5Sd43rrTsE6ls9vhO7t2m7rRqBsFKpf 8/MSdSBMBe1J3dYBwXbRz0v2Kq4E7hX//yktqw7nNopMu0v05bobRT8AKHc0A9W5v5NcW4leEN7E 1XjgQi6/G6DF2HdBzR8BSI1Xj9XyTwhzYSyMpfMvCr8J49Kxlfw24edhrDtP88fCeHis3HpMuBbG yvMVvES2B2jeK7z2YTP/iDB8JZ9vEp5/g+E7hKdP1fLNwq4jKn6d8PAzHfwKwfd4Gm8V2ntLeZtg b6X4FoEzavkeITuvhPd5260+ITm1g5cwiV7nLbHWCWWWUn7VTLt1lVDt6OAlrYrW7P9BgrP+izrY 2ddehxtbXaMqyFb9g7H2AqVRp9S7vDl6d51h+/btSAE7ogK2Humm09GS+Kaw9NbmIPFvXXfCt2h/ 0uYDRbrvfV1BV1Ar6kUOuFvRGLoIn8eRBahX4DkNz9eAdwodQXnoDXgagWsEOS3QfoWeQfPoGjqK VfD8DO7XQP5DlBrVvoZTQeciSgIpiTINn6OgM4zewDrsBGwM4AOg9yvswwLOxbmgPw8cSUbyJBen guXPwP6zeA/wU6N9XEO56AIewKuxgD7EpViJzSB1AAfgjHAFtA7A51vIjR/CTokHFs3Ai1sAyXmw rkGb75GOWrzxHtT/T6RsOJI8i09RtdQfqRC1aL4NvQb5OmJfv37d2o72tjWtLc1NqxtXrby/wemo r1thryU2YbmVt9RUV5lNlfdVlC8rMxpKS5YWFxUWcPl6Nm9Jri5ncXZWZkZ6WmqKlklOWpSoUSeo lAo5LaMwMjq5Bi8rFnlFuohbubJMwjkfEHx3ELwiC6SGu2VEVtLzAesuSTtI9nxB0h6TtN+WxAwr IKHMyDo5VnzfwbFhvGGNC+CvOjg3K85G4aYoTBdFkUWA6PWgwTqzeh2siL2sU2zY1Rtyeh1lRjyq Uddz9X51mRGNqjUAagASl3KBUbyU4ChALXVaRymkWgQxikbO4RQNHKiCGVmh09cttq5xOR05er27 zCji+i6uU0RcnZhsiIqg+mg3oqJeVEa7YftECAcdZEeN46FDYQZ1eg2J3Vy370GXKPOBDaeoNYgl nEMs2f1pVpkxjE/D7pVQH8awi72JjAvBUUPQ4XCDZEjmDIWevVu8zNjY5tKDP5zzECs52OaK+gbi OKscrPvvCGGU0cYiHk1KjgOJi+4E/JCNGC8KRcUlCPq4FTKWeuFWwf4qsl2w1ba5OJEqtEgPvwWF uiyQGbjcGPrugzi8IcYKvojyQoZjQzcRDAg3+893U3xxiqKQuYkkpjRst4dehDUhXgaiwSCWlkoj pqyHFINnJIpXlRl3iWVcgGHFMic41eoCJbe1HPKp10vZPhi2o05AxOAaVwxnUWfOeWQvN7hFyitx xm9x0tdKnOAtzm11LwdlNRY9nqeLqqLb32QmI9XZaxVxxn/C9sf4UMZOdpSWF4ZaXUW+0MGcIm/o kBuqqwFmVyjUwLENIW/IF14IdnIsw4VGy8pCASfMilhI4YXxgzmi/ZC7F0NSRVMsG07O6Y1/d/Vm icFOFnh0UfRbKNKFwIdBK/J2dvVKrc8f4hyxgo4elBxQ2XZfvKKdoxXlIO/zwgj0gVDjGpdYzgXE NK4uVvJAiNZZX3us0GJUp5hWLyJvV1xLLHeCrhRsSJoOkoOSLW4NVLRpYWbUzOZcMCEzckt+iBn1 MBWKnCFXd4+Y583phgWjh3Xl6EW7WxpGzuV3SxOEY8SSmXh1xbUgti9I3xKGsEVloYp1UTkyt1R8 QGAb4MHVCcBgREUMlcqxTmBdOAfdEoNe4hISdJcdQGSF9StBGVpQrV8Jm3W03qUlJxrIvVzKiQUA boiq2z7R4IT8c59i/fxZ12LSkkMlrNPvuMPBu4wCEnUwbu3eflJSLuLJABdUoOJcKUVRZqQAZoGt gulcL9Fio5glFSDr4vycm4Masre6pMGRch0d38Z2rnHNBld0tONV0nEXFuNLSwOsS40drjgkpta7 ZDkU0CRIGimJK6bUP7jhtgggrkRpFOhCRXTd7BZlUJNRAoYgGO/K2NOt1utjHUgGvqATVqruUAov /E7Sijafq8WjEK2GuJ8xr8Xld+F3eZcYkoG/dBHV2LEhFFLfxfszM/pN6lXq1bvn9HdhTjccckMo 0WmN2NAqEYG7dlgwLSnmmDd/xtxoY+N/agzfyxicY2iEghS8YZEHUAudhUx0J1pPn0DPyT5CB2U/ QCtAJPZOA8EbHQWcwRBi0do/eTcB5P/FdesdyH/HhCwuDAHAJY9jdzYKQJRxQjWqRpO4Ff+Rep76 rUw66VEoiJAsCOdlGUg57PkK5TAcb+T0sAypE0pKjJRCflImo5CSPomRQbWuL8vQzPxeaJoTmBsC Myc0MzD/foFqJUqtMCfcV2HS6rWFeq0+KENzQQpOlYqef305KO+BbLUsfE/eqOBgqTtmD2RoSjN4 TdUia0YV24Jdsg0ZPZreRQ+n9bB7lw0uS07JqNdQSwvql8HkrAhWyCrYepmmKtnYYtxk3GKkFboi nSG/WscXuAv6CpTJBRZkkm6FUWcJKIKKIcWw4qpCrjBUJVeXV1O21VkGDzjuaZq7zNyY/JSZnJ3w eBBzc+6nnj0TWXN7JrNq5yY891VgCunzKS2TUlNtqpROfwouv7iIy1cqlJQ2LTPDVFlTXUMro9Qq c021vhJk5Glkfvv8Z3/4w83x4OADR/9KKM1Y+lJfY1tJ0y+ttd++MHCwZv6fLmdmGHNzqj6itAYr 5Zl/f/45OMSnYhlV+O2twsr1JfZsT3PxQ/M/nn/5rca2rY9Fkjya/LySGv2A1QjlR8FGcVF2k06D uqtEbjtJUJYU88WPFx8oltPKYktSmUVKcJ8SKzWmJEVPTk8pVWrZpHloya4lJzS0Rm9ZkpdZm0lF MhcyqUwzM+nZOjE36Zn1oFpIyoRnlpllpPDlEGxxEpZi1ppRLAPKJKxUZGZkZuThNIXMXF2zDPiK 9LRYLijZsdTKsgzv8/f9+hE/bvrl+ke/kqbWYJyirlIyCstNjaawivn6z3bs8NYXrGDrjCWsuWrg SYw+w64yS0tOetG5rzy50jiQwmmXmqk3DH4+NWXuW6dOcak8TpDiXr9wjV4Ov/fyUDG6aj/boHKk rCj0pfgKdzAB7a4lAe4UM6wdzh7mRO2EdlLL3K9uYO7nHAVrVeuY9dzagm6mq0CtQunqQnUxU7qk uKCaqSrwy/2cuojTJtHZrEWVnWZBKgXSZGsxm+LkNqh3a0Pa0/RpTqnlLHl0OV1Ly/LoFnovPUJ/ QC/QCrrIUqITdeO6qzpa503ETGJFYiBxMHGwRF6UWJ1IJVaUBErGS2Seco9n654JTxakeuvcDzxb UW0tMzfBzGozeY8nnu4q5lapQY3Jl2CoMAIPKCulQgbzsbC6poja+PeHXnrqwD+c7tu3tfKb8/st r25xenY5irmaCy+d2f3Npdj0naZ1y7bu+RmmxXGLc7C7rWD1d9o7FusfqeK2tDpkg29ffN61Al41 Y/TcwiW6WlGHBPSMvTtxEVWZUplfWVnZUNFWuTd5MPlEsjpZg1JTNZYKRQHSJpdZknW4RbdJ17lo r25Qd0I3ontHF9H9VqfWURZrguWEecT8gTlips0MqSB20kq8JECCZIgMk3FylWgI4/mpZxbmVywH MNkgCbPlDACfV1xRlRl+iEVnGSPNLcBrqmtxKhAlVrwOFXlYygwUIgXVCFNTdvX+jMzUFPnGvd0m N6tbXkISVDKZTJlqLW1LAkMYt32v7zQxKlRpSWm0QFa3vficZ/HDi9/avvz0/NMNxLI0aUn240eo yJMG0wP3lda4fM192/o3uzb3P7p67J2rO93axJIayNnBhbdlX6OXwDuHB+2WrAwltThDkaTJS2OU tIWFRZLJZXMrcu253lx5LpOlSRzQ5jHlTC3TwmxitjAKxpC3bnl03fTAMjk5wdzwNEurprQWTSDm F7WT77+v5WHtgcirzMXFCiiE1DSAtVJWIGBIAIQrO6r0rJPJvrHJvZzqcsldnXj812taqZ/v6Uo1 daQ2rHh6btrvpy7qB/T+02/ufgL+GMBoxcK4LCTficrQLrurUGuRW7IVyXk4T61ZNpgeNJxIHzLQ Fem1Bnt6i6E1fZPBm77FsDc9YFAbjsvTjxdasrVKCyO3IC2jZbUBraiVa39XjplyttxeHigfLhfL Z8qVHqhzaYRhCZn9lPlUWld/X+6pnZ2dgJjypcUzNQ9nREe1ukpWVBwd0szPRzYZx0dYIVuazqdn bk3FmO5fulyRtuqou7r0WoK1dEMy/Op+MqWXtdXIOujkuVGjacpcXHSsiFopS0pcb7RqTa8Xlda8 UGi2Ekad9iUjL60d0Wv+d2gkBn3hCX9JYArLMI3lWAFvRFTy7QFflx/fD7+w/LgXb8PSfyIYpcAt XQqAkKNu7ZqOdYb6Lf19Xe2+zdub2v8D66G6bAplbmRzdHJlYW0KZW5kb2JqCjI3IDAgb2JqCjQ1 ODcKZW5kb2JqCjEzIDAgb2JqCjw8IC9UeXBlIC9Gb250IC9TdWJ0eXBlIC9UcnVlVHlwZSAvQmFz ZUZvbnQgL0RSRFNXVStDb21pY1NhbnNNUy1Cb2xkIC9Gb250RGVzY3JpcHRvcgoyOCAwIFIgL0Vu Y29kaW5nIC9NYWNSb21hbkVuY29kaW5nIC9GaXJzdENoYXIgMzIgL0xhc3RDaGFyIDExNyAvV2lk dGhzIFsgNDM0CjAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDYxMCAwIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCA2MTkKMCAwIDAgMCAwIDU0NiAwIDAgMCAwIDAgMCA1MzMg MCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCA1NTYgNTkzIDUxNAowIDU1OSAwIDAgNTc4 IDI4MCAwIDAgMjc0IDAgNTIzIDUyNiAwIDAgNDgwIDAgNDcxIDUyMCBdID4+CmVuZG9iagoyOCAw IG9iago8PCAvVHlwZSAvRm9udERlc2NyaXB0b3IgL0ZvbnROYW1lIC9EUkRTV1UrQ29taWNTYW5z TVMtQm9sZCAvRmxhZ3MgMzIgL0ZvbnRCQm94ClstMTEyIC0zMDMgMTIyOSAxMTAyXSAvSXRhbGlj QW5nbGUgMCAvQXNjZW50IDExMDIgL0Rlc2NlbnQgLTI5MiAvQ2FwSGVpZ2h0Cjc4NCAvU3RlbVYg MCAvWEhlaWdodCA2NjcgL01heFdpZHRoIDEyNjkgL0ZvbnRGaWxlMiAyOSAwIFIgPj4KZW5kb2Jq CjI5IDAgb2JqCjw8IC9MZW5ndGggMzAgMCBSIC9MZW5ndGgxIDY0NzIgL0ZpbHRlciAvRmxhdGVE ZWNvZGUgPj4Kc3RyZWFtCngBhVkLeBPXlb53nnpao5c9WLY88oxk2ZYsvy0ZxVYsC4wFfmAgMhuD /MRkAzaP0NCQ4NI4SQUpNIQmS/Og27BpSduMk6ZL+JqWJnbazYZv0wbYljw+0oRtQtdtWko2pbW1 Z0YygWyynW809557z71zHv8590javvW2YWRAE4hEkcFN/eNIvXQaaKYHd2wXMjTRCu3DI+MbNmXp NxFi3t1w686RDK37M0LGZ0aH+4cyNPobtPWjMJChcS200uim7bdnaO1JaNtuHRvMzuteBdqzqf/2 7PsR7I+Ezf2bhqGFa1EBPHzjY9u2qyTivw3t9vGtw1l+nAD6g8zcwjMHIQx9C5pELBpDNCIQhyJI 4TyOPgJ9sTpPI1SbaxHWm8KXUb6iNkJPeavXKu1PP/gGn3bMHdSe1fwCeLWwQ+aCfTW/mHsKIZ0n 7Zh/S3tW3Sk7qTaWSO941UQVEfA2ezu9671jXjogBcoIi1kTIV7Oxbul/dLjEinmxIoNMZcuJmhi RUzMScUKiVgBiuVreE2uxqaxaDhNjsag0Wk0GkZDaQgN0qC4fHIQxQcE+aMe8TjWda+VabEFy5Y4 iq9q4Z9HGKcn788tv+7iFyh+2xTGsY2CjFYl5Eiyt5VvwYVxmetJyP2FvXF5GDqocCoXtfQCW08L jnclpjRARW/OtM8Sep0lmkg6XL0teNu2baAu0wIfK6pWPpSAqtOn0h+lX0AoPZc+NXc6/TH9Ido4 vx4hchfwPXmtma7vYyu2Ii9eh35OpKhvEkbyUQTbYwqvwy+Sveid67n/PhWJL7tpzeq2WGu05cZI c9MN4cWNoWBDfV1tTXVVZaDC7ysvK/WWeNySWOwSipyFBY78RXxert1mtZg5U47RoNdpNSxDUySB kS8mLkkKsicpUx6xrc2v0GI/DPRfM5CUBRhacj2PLCjr+mHqOs4IcI58ijOS4Yxc5cScEEZhv0+I iYJ8qlUUjuO13Qno398q9gryrNpfofYpj0oYgXC5YIUQ40dbBRknhZi8ZMdoKpZs9fvwlF4XFaPD Or8PTen00NVDT/aK41PY24TVDuGNNU4RSGMEHWWf2BqTy0VYCtuQ7lj/kNzVnYi1OlyuXr9PxtFB cUBGYotsKldZUFR9jcxEZVZ9jbBRBnXQXmHKdzK17ziHBpLlhiFxqP/mhEz2wx4x2Vwul4qtcukX 3+P9vuP4XwCZ2uhxDAh9HvnSE1PlE62tvcCZImOp1L3Xs/t98ZUJF8gjxvYJioArE6pswI75AOw+ fI0KU5w5o/FUjinbMRiv7QyDNTJzak9lV3rwjgWVsfIWcRnEjiwMQhitTIgy4Q4qj+EgSg0GwTJw 9WJ490bQI5niGkEWmXZzopC6jMAh4ux/Xz/Snx1h3NxlpEwqbrvqehn3L/Tl8nK5rEzxGBsFE4Nk TSpd5/ftkP3iOCfI/hgI1ZWARb2NAbCny6VYe+/xCBoAQp7oTmRoAQ04nkGRQHmvTCSVmZMLM/bV yszEwszV5UkRYPUDNdXZZY3n6m3icq2x0UYZ5/4/08OZeYBxTJiiaHeqK+HpT+11eJKpfb2AriUQ XanUElFYkkqm+o+nJwZEgRNTU35/ajwGUZFR6Xj65F6HHNnXO4rBqHJNxhoxMZbM3jtGeXliQIA5 yqPebplywzw4zZMcGBxV2v7hlNiaAbSaBFsB2ZH+LKJjU5UB4O9Pggc2AlO8OyEHxHHZJrZkIA8D Ks429mSAlhmNybaojJKD2VVyIAZrFWVTSjgoAip7id2A6Jr0+alawfFsDapFvYoccm4UQsETSyWG RuSipGMIEsaIkHC45Eiv4kYxMdyrBIjIyaXns+jKrgLdPsW9wAxqy6xbIyQIB9mrgA8GhCXwEFvC MMHJTIZU4NgSFhLYgRbY4C1ZDqV33T5AkO5oGyyGFpZG2+AYUPGupBxVkc8SyZFRAMSQNVdlokAI +hOZMu/5XNEy3IpApUJsuPUaAa/bFAhVwOxuny0nodgiawwQQQNLYm2KFn4fAX0BpjUQzlFlLONF XgGgkBCHxV4RMBTpSijOUWyt+jfeI8a71yaU0Ie8g4TUMhkBbiIQ8EFLbWb08wAej18P8BMA8CX7 emUuqWIcf+Zm8VXZlyEKoQkSqirqN+gN6hKcv+uRSEVRmNqKgtRP0FqqAEnUThSgHkcbiSa0l6hC 91CVqJWqQxL5K9RDzqBFVCmqg9M0Uw8hqAYZ9EOgBbTm/9Q1nxy6C7XQJyOf3yOvmQKBr7mg+vo7 FwPVm1KWaVU+HdKrrQGeRgQlHlwm+HDIrPZtyIaWoeO4Hf+U8BBfJy6Sq8hZahW1n86nh+gfMf3M r4GPQBNQjUwwI1AFsgjVmF1mt8vsmiDR3ASB5hEz8pfDE/QIaP8GPkoRxONQRZZGFiFCZySNXsJk LjIHzM3mTvN6M2MuZazc2dk+FJgNc9PcdFUlZlzFJZ662ob6mmqpplopKMhbUvOPNwUaGgJNnTjc 2RQI46d1BcWNjcWF2kVC8yZ4U3X6feoN+hIKoPZIFWJoq93qtpJWo+RgJBE58AHHEYfsOOl4zXHe 8aGDdXgqvSKRJ/iwTycVVXJn5073TaPmae69vi3cLDc33cedBlFAkBKPWMwSdltuTXVDvSKTIhBL qTJy2OKqzs1bGGSorrXlNpspctfR3z4wMjgibe/whstKaudn59995xsPYvdfMOVb6vA1jfDmQg9V ut6vZafnf/+HTY/UWjtrfaV1i33vP/HYWdyJ+7CXYcpvWzVeXVqvIEtMv0ktp8+iSvRg5FahCBHl RRIhlS5ySLRkZZGRMwrGSiN1wHjEKBtPGl8znjd+aGSNpUSuTswXiYC4W0yJh8Vj4gnxFfGceFG8 IurEEoef1tl1hKAb103qDumO6p7TzejO6C7oLut0uhKCloocgZm5l+f6toS5P8MDNQf6ttz5Hj87 d+c0z83O3gn+4qZ51U6MmQQzgGkYsRhuSiwGF8JIg8fMNbAKkbEerViPIV+o/SAHT6bCnZ3h4Plg y/zHLUq3dYyw/Trc7XXXJ85N47o7qkupxwqOz//HfDPZFQx20mJnMNhl2oE7MPc/TEfjYncxrSkz 74y4wSIoDAiwM+Br5EPJyI3jbuyWUIFkI1krS6TYg+y32GfZl9jX2XfZS6yG9fhtRJEomShCR0gB U7Op07TeNGbabdpvYk2lEl/BvQ2YUHR8mecUhVFzBhyB2b6sxoqunjpzrdXSYMlrwio0OFCumGFB RzZXQUxdbYkHP2qOMu2hUNxmxfhrxbevmf7uT/79Bz8TqsyYMNeYH9mwecMgUcHumz9Zt3x5Hc77 Bq7EdQ9jSq/V7v7qq2n00CRxCROBdWO/07R37lndEgFtg+kfU3HKhgqQH90QcaFSiRYl/QEa02yF nvEJhfmmQskW8EhFmiPwvaeCO9s3y50GdcBjWV0A57Phqkq6uCQHi8WEuRZlwZ2D7ba8XAXnDK6t b6iAWUYNgPoGDzlTMXTzvqo//hEPfbz+zofydHoHWV7SPf+6Vmsr0t/3ajLZNFblbBny+TGB8R/x TfU3rpEc3p3dP1mlXb/GULeE+L7QU6PTntl3z72l3t+DJmvTZ6lbmBJUBJokIs0UEiS+RPoQ4QPo CJLRSfQaOg8pla2gTXYTcZtp0nTIdNT0nGnGdMZ0wXTZpDUhnimTCgJ2t6QDPefC3JuzqLkZAvnP faD0rJJUQEnVWbX14C8likE3uznrMwWQ4DPGCh5THUbcuO8ud139Ckbwtv8j235f8+++du+jR16u vW81xl8Z2P1EdElZlbutnh/kqU1twaXbjSHj/JdKS5868t773zxK9oXD6+d/uPipPXtWJyB2pfRP ydNUCZJQOOIOcIKzmat07ubGnQxndTqsksYh7Qc2qDYYg8uTJ8FRfXqWexuyEcivis9NA+JAg2xS VBOQog0kJvBLniK1GnosQ1S/eejR+4+cHt37nWIpVL5z54q1a5a37Yi+mF+/4tjDzXfe/aufnf5T MLa2ylPa99ADt2wMh0Y6qjs6YkpOD6R/SVVQdlSIPKg30jTOT/AH+CfMlMBH+C4+yY/zNG8zu5yS xiYtuIZCbImGyTXUU9vdd7sptyHfa5ZcElUCKX2We/X0qb6sFnNnT4EWn6EGSzshcDIeybgBkmyD h1j3h4e/PfngX7+/7aE7gt+Zf7ryvsQ9fT3Vo0/uO953t3fL+L1d0Yqtd12Ye/rFYPsjm1eXxA/V 1jZUDW9tC5Pdu3ZVVd5Q61Hy5sb0i9Q6+H4dQTsi3SU6S76FSFkOW45ZTlhesZyzXLRcsWj2W7CF vbFIIhk6ZA8Rk6FDoaOh50IzoTOhC6HLIU0I2SSIJbalvqzmBuQWJVQj1JyvIWtuhJhSEsPMDAdh xYPKd57mAXl9W5pnFehtUQ6zDMSUaMpGlKieKZAblcygeJCFlKFmS0Vvq5IxMpkz42a8f9mT65+K Bw00w1E5Nnp1aNjJ2yw0oS0fW1vRJZasDt6kZ2maJRjrysbBYivDkAfblibbDt2x65viWI+dCy4b 6j54/z8sGl7UbmgYqdk///X2lfEGa3Hux/+GT7t2eIt2FoWW3RLeNbRhAFCwN/0b/Fv6HNQJIhqI LCUtVsVkBy3fsjxrecnyuuVdyyWLxuKRGIl22p3EpPOQ86jzOeeM84zzgvOyU4OcjFYi7Q7eZTJI Al8JsCF5KWMpNfWcBgud7dsyqyRTJY9mlFVyjdWWOT5gBG6LenzACIHbI+vWRSJ9fXa2IxzuYG3K 00Y9s6apaY3ymRNDfws1xuON0PRiQ6/S7Z2Hn9Qwuid9Bh9mYlDrtEbqSMJKECniIPEt4lniJeJ1 4l3iEqEh2Bz1FPz0CajRIVpCJvCq4tGMtG5bJuErcM2148OpcEeZd/Hi5Qd/vDxMb2h0Fy9tVN7a mn6eoqlWtBhtjSwPmBsCT5tJhw7lI2IMpdBhdAydQK+gc+giuoK0u9F+MDsbzpHKAgxhCNUwBqnm Bt7ud5X4JUGqlCJSlzQuHQCLhzn1QAKohZUD+G0An3oAQ92SAVw4G2BKpgAcwQ2ZGxCmZG/1ZL5q WoWhproIwyMvtxBnGcgv3pGTk2NiqfKbp6oJljF2gqUNBWz34i9r8QP//EJbJS7vWrpzw+jm/vy7 8tmQpec/j7oa/OUFWwpC8XgImiRek3R+oTC47FH9wcdueX1phbXjoxXBdiW/SOkZ8hJlhHqzEAUi BWWchyc4ScNLiHVqmAjqQkSBZCiySZQTjM69DTUhZEBIgFeVaqh3ZaovhvQsZD4IGgtBPD/5AMtO PIxNP99xy669379jabi1vu2myDLauHj33vff+t6rRw6cef+JfyUjeMv63bdHahbHduAW8FRP+gXy e5QTJFoVuYGgc2kpX6fP1xMp/WH9Mf0J/Sv6c/qL+it6zW79fj2hZ535DC0V8KwUMXWZkqZx04Tp gOkIFAwgct9cWME2IEUpIcEzgG4I7LoShrUqlQI4xax6BUwOZjfbyO9q99xFv9OPO8JNxQIVbRqz T/3q58Qv/mnPsPTSvDYU90pBYn/RHUXB+Na75z+qAXkXpU+Sz9C3QZX7YuRQaYnDDvVfoc6QbyBS hsOGY4YThlcM5wwXDVcMmt0GbGArackuEZPSIemo9Jw0I52RLkiXJY1UwhQytN/uJyb9h/xH/c/5 Z/xn/Bf8l/0aHZ/PEwE+xR/mj/En+Ff4c/xF/gqvFfzj/v38hP9x/oD/NT/rp3m7jubsJVIhLbkK Bfu4fcJ+wE7ZA31KLlSOLQWcvIJPsEffFjiQX1XDSDHO7Aw3o8Y+5D+Lik3VPIp1yAqsQjMPCm+1 Y2dVjAJ8Sa89ZC+ttxBfa/D6GEvTX5eH3ZOYolY2Pkg0lWwr6+og3aRm/tZdxqW5/1Us1UPM7MT3 k47twQ6D0B4Rg+1/Wak1FawLLQdL1qVl8n2qDFVBrRgWJa1SOhNGtjrvs83iZ4T8QsleZB2z7rem rZSVqUT6cigwa9QwPMXNTPNvgeo8xKRSXmVKZqBnQU9bRkcFAyoOFg5yJSZB+zz1BITTIPOdJ5cl yF8SEHM9nomvfLV/k73EadvWuLLQal0UyB2bxITVtHPxKtJKtETn/xS199iDy+KBcOzuKzN7ntyy LOj7UdX9r8f0BmHFwG01pw59oT04/2X1Oxs8EJr/ED2tdj79sEDiIjAJvxbTmMEs1mAt1mE9NmAj zsEmzGEzttDbxvsHh5nRneOjw5txFC/DXfDj2gAexMN4FG/Et+LNeAxvxdvxbZn9MXzzU/5FgB+u UR5CrStbe25aXR4d27RxsKd/87YVPf6WsVuHYPp/AfMqK7YKZW5kc3RyZWFtCmVuZG9iagozMCAw IG9iago0NzUwCmVuZG9iagozMSAwIG9iagooMTIwNzI3LnJwa2ktZW11bCkKZW5kb2JqCjMyIDAg b2JqCihNYWMgT1MgWCAxMC44LjMgUXVhcnR6IFBERkNvbnRleHQpCmVuZG9iagozMyAwIG9iagoo UmFuZHkgQnVzaCkKZW5kb2JqCjM0IDAgb2JqCigpCmVuZG9iagozNSAwIG9iagooUHJldmlldykK ZW5kb2JqCjM2IDAgb2JqCihEOjIwMTMwMzE5MDk1MDUwWjAwJzAwJykKZW5kb2JqCjM3IDAgb2Jq CigpCmVuZG9iagozOCAwIG9iagpbICgpIF0KZW5kb2JqCjEgMCBvYmoKPDwgL1RpdGxlIDMxIDAg UiAvQXV0aG9yIDMzIDAgUiAvU3ViamVjdCAzNCAwIFIgL1Byb2R1Y2VyIDMyIDAgUiAvQ3JlYXRv cgozNSAwIFIgL0NyZWF0aW9uRGF0ZSAzNiAwIFIgL01vZERhdGUgMzYgMCBSIC9LZXl3b3JkcyAz NyAwIFIgL0FBUEw6S2V5d29yZHMKMzggMCBSID4+CmVuZG9iagp4cmVmCjAgMzkKMDAwMDAwMDAw MCA2NTUzNSBmIAowMDAwMjI3NjkyIDAwMDAwIG4gCjAwMDAwMDA3MjIgMDAwMDAgbiAKMDAwMDIw OTUxNCAwMDAwMCBuIAowMDAwMDAwMDIyIDAwMDAwIG4gCjAwMDAwMDA3MDMgMDAwMDAgbiAKMDAw MDAwMDgyNiAwMDAwMCBuIAowMDAwMjA5NDc4IDAwMDAwIG4gCjAwMDAwMDEwMTYgMDAwMDAgbiAK MDAwMDIwMjczOSAwMDAwMCBuIAowMDAwMjA1NDk3IDAwMDAwIG4gCjAwMDAyMDk2NDcgMDAwMDAg biAKMDAwMDIxNjY4NSAwMDAwMCBuIAowMDAwMjIxOTY4IDAwMDAwIG4gCjAwMDAyMDgyNzAgMDAw MDAgbiAKMDAwMDIwMjc2MSAwMDAwMCBuIAowMDAwMjA1NDc2IDAwMDAwIG4gCjAwMDAyMDU1MzQg MDAwMDAgbiAKMDAwMDIwODI0OSAwMDAwMCBuIAowMDAwMjA4MzA3IDAwMDAwIG4gCjAwMDAyMDk0 NTcgMDAwMDAgbiAKMDAwMDIwOTU5NyAwMDAwMCBuIAowMDAwMjEwMDQwIDAwMDAwIG4gCjAwMDAy MTAyNzMgMDAwMDAgbiAKMDAwMDIxNjY2NCAwMDAwMCBuIAowMDAwMjE3MDQzIDAwMDAwIG4gCjAw MDAyMTcyNzAgMDAwMDAgbiAKMDAwMDIyMTk0NyAwMDAwMCBuIAowMDAwMjIyMzUzIDAwMDAwIG4g CjAwMDAyMjI1ODYgMDAwMDAgbiAKMDAwMDIyNzQyNiAwMDAwMCBuIAowMDAwMjI3NDQ3IDAwMDAw IG4gCjAwMDAyMjc0ODIgMDAwMDAgbiAKMDAwMDIyNzUzNCAwMDAwMCBuIAowMDAwMjI3NTYzIDAw MDAwIG4gCjAwMDAyMjc1ODIgMDAwMDAgbiAKMDAwMDIyNzYwOCAwMDAwMCBuIAowMDAwMjI3NjUw IDAwMDAwIG4gCjAwMDAyMjc2NjkgMDAwMDAgbiAKdHJhaWxlcgo8PCAvU2l6ZSAzOSAvUm9vdCAy MSAwIFIgL0luZm8gMSAwIFIgL0lEIFsgPDM0ZjJmOWZhMjczOTk0YjBhNDU0ZTM2ZDlhYjJhYTdl Pgo8MzRmMmY5ZmEyNzM5OTRiMGE0NTRlMzZkOWFiMmFhN2U+IF0gPj4Kc3RhcnR4cmVmCjIyNzg2 NwolJUVPRgo= --Multipart_Tue_Mar_19_11:51:33_2013-1-- From aservin@lacnic.net Tue Mar 19 03:57:07 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1B5FD21F88CF for ; Tue, 19 Mar 2013 03:57:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.426 X-Spam-Level: ** X-Spam-Status: No, score=2.426 tagged_above=-999 required=5 tests=[AWL=-1.516, BAYES_00=-2.599, FH_HOST_EQ_D_D_D_D=0.765, HOST_EQ_DIALUP=0.862, RCVD_IN_PBL=0.905, RCVD_IN_SORBS_DUL=0.877, RCVD_IN_XBL=3.033, RDNS_DYNAMIC=0.1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ntEsanyfeumf for ; Tue, 19 Mar 2013 03:57:06 -0700 (PDT) Received: from mail.lacnic.net.uy (mail.lacnic.net.uy [IPv6:2001:13c7:7001:4000::3]) by ietfa.amsl.com (Postfix) with ESMTP id 0B22721F8887 for ; Tue, 19 Mar 2013 03:57:06 -0700 (PDT) Received: from [192.168.1.133] (r186-48-199-250.dialup.adsl.anteldata.net.uy [186.48.199.250]) by mail.lacnic.net.uy (Postfix) with ESMTP id D38BF308455 for ; Tue, 19 Mar 2013 07:56:42 -0300 (UYT) Message-ID: <51484472.1040802@lacnic.net> Date: Tue, 19 Mar 2013 07:56:50 -0300 From: Arturo Servin User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: sidr@ietf.org References: <89FE469F-C657-4E38-91F8-F1B3E791BFE5@verisign.com> <20130319040619.A22F217098@thrintun.hactrn.net> In-Reply-To: <20130319040619.A22F217098@thrintun.hactrn.net> X-Enigmail-Version: 1.5.1 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-LACNIC.uy-MailScanner-Information: Please contact the ISP for more information X-LACNIC.uy-MailScanner: Found to be clean X-LACNIC.uy-MailScanner-SpamCheck: X-LACNIC.uy-MailScanner-From: aservin@lacnic.net Subject: Re: [sidr] RPKI operations list? X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Mar 2013 10:57:07 -0000 Thanks! I think it would be very valuable to interchange operational experience and help our still small community to communicate (and make it grow) Regards .as On 19/03/2013 01:06, Rob Austein wrote: > At Sun, 3 Feb 2013 13:01:25 -0500, Osterweil, Eric wrote: >> >> Is there an operations list somewhere for RPKI repository >> operations? We're hoping there's some forum where all of the RIRs >> and (any other repo ops) are listening/talking? We've been seeing >> some anomalies in the deployed RPKI repositories and we'd like to >> plug in (especially if there are already some conversations going >> about what we've been seeing). > > Sorry, I was on holiday back when Eric first posted this, thanks to > Andrew Chi for pointing it out to me. > > rpki@rpki.net is available for this purpose. Traffic is sporadic but > generally low. List was very recently converted to Mailman. > > List info: > https://lists.rpki.net/mailman/listinfo/rpki > > Mailman web interface uses a server certificate issued by private CA. > CA certificate, and PGP signed version for anyone who might care: > http://www.hactrn.net/cacert.cer > http://www.hactrn.net/cacert.asc > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From carlosm3011@gmail.com Tue Mar 19 08:01:45 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4703A21F8CF4 for ; Tue, 19 Mar 2013 08:01:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.824 X-Spam-Level: X-Spam-Status: No, score=-1.824 tagged_above=-999 required=5 tests=[AWL=-0.776, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RDNS_NONE=0.1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 25uxObRgjpvx for ; Tue, 19 Mar 2013 08:01:42 -0700 (PDT) Received: from mail-ie0-x22f.google.com (mail-ie0-x22f.google.com [IPv6:2607:f8b0:4001:c03::22f]) by ietfa.amsl.com (Postfix) with ESMTP id 8FBEE21F8CDD for ; Tue, 19 Mar 2013 08:01:42 -0700 (PDT) Received: by mail-ie0-f175.google.com with SMTP id c12so678966ieb.6 for ; Tue, 19 Mar 2013 08:01:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=x-received:message-id:date:from:reply-to:user-agent:mime-version:to :cc:subject:references:in-reply-to:content-type :content-transfer-encoding; bh=XAVDNLOkHpA38xgKvPe2cKtX77LHAfYJiC02Hs6A/LE=; b=i21h3mWYOucfZe4d+cPsR/vxLxl4Nwus2E1UI8kWw9FJhU/pAn9k55eK5xWgmUbsN9 6Pj1Na6v05sjZuLePzhX6Y2Xmkb/b1HOTWhUHs15EpYXdELjZiuY0uU83GL29WA/n1H/ 9J4mY6h04jCjWd1qE/yK2euRyACfyfdWDRb1IqPpKolMn3jBusM6o6ktRYHlWS9bLQol GH7aqEeXxv7yF6hAhPvkC7SCEcC28ZVon8z1iEamUxUBlNLMqV51lUugVrdobVqJxgc5 uiudMiVZClOe0DC7n3uoPWhT7CMO1vd5dXYH3DouUQ5FGjH/auDOmDQbYRC9AFJmb6jp 4r1Q== X-Received: by 10.50.7.240 with SMTP id m16mr1561245iga.91.1363705302150; Tue, 19 Mar 2013 08:01:42 -0700 (PDT) Received: from 85-7-200.lacnic.net.uy ([200.7.85.152]) by mx.google.com with ESMTPS id xf4sm712376igb.8.2013.03.19.08.01.39 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 19 Mar 2013 08:01:41 -0700 (PDT) Message-ID: <51487DD1.6040900@gmail.com> Date: Tue, 19 Mar 2013 12:01:37 -0300 From: "Carlos M. Martinez" User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: Arturo Servin References: <89FE469F-C657-4E38-91F8-F1B3E791BFE5@verisign.com> <20130319040619.A22F217098@thrintun.hactrn.net> <51484472.1040802@lacnic.net> In-Reply-To: <51484472.1040802@lacnic.net> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: sidr@ietf.org Subject: Re: [sidr] RPKI operations list? X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: carlos@lacnic.net List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Mar 2013 15:01:45 -0000 Make it grow? I hope there wasn't an IETF-pun intended there ... :D On 3/19/13 7:56 AM, Arturo Servin wrote: > > Thanks! > > I think it would be very valuable to interchange operational experience > and help our still small community to communicate (and make it grow) > > Regards > .as > > On 19/03/2013 01:06, Rob Austein wrote: >> At Sun, 3 Feb 2013 13:01:25 -0500, Osterweil, Eric wrote: >>> >>> Is there an operations list somewhere for RPKI repository >>> operations? We're hoping there's some forum where all of the RIRs >>> and (any other repo ops) are listening/talking? We've been seeing >>> some anomalies in the deployed RPKI repositories and we'd like to >>> plug in (especially if there are already some conversations going >>> about what we've been seeing). >> >> Sorry, I was on holiday back when Eric first posted this, thanks to >> Andrew Chi for pointing it out to me. >> >> rpki@rpki.net is available for this purpose. Traffic is sporadic but >> generally low. List was very recently converted to Mailman. >> >> List info: >> https://lists.rpki.net/mailman/listinfo/rpki >> >> Mailman web interface uses a server certificate issued by private CA. >> CA certificate, and PGP signed version for anyone who might care: >> http://www.hactrn.net/cacert.cer >> http://www.hactrn.net/cacert.asc >> _______________________________________________ >> sidr mailing list >> sidr@ietf.org >> https://www.ietf.org/mailman/listinfo/sidr >> > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From aservin@lacnic.net Tue Mar 19 08:02:49 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 414BB21F8CD2 for ; Tue, 19 Mar 2013 08:02:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ahBBm4jNU3dZ for ; Tue, 19 Mar 2013 08:02:48 -0700 (PDT) Received: from mail.lacnic.net.uy (mail.lacnic.net.uy [IPv6:2001:13c7:7001:4000::3]) by ietfa.amsl.com (Postfix) with ESMTP id 82ED721F8CB5 for ; Tue, 19 Mar 2013 08:02:48 -0700 (PDT) Received: from 85-7-200.lacnic.net.uy (unknown [IPv6:2001:13c7:7001:5128:ac76:b996:a1fd:c9a]) by mail.lacnic.net.uy (Postfix) with ESMTP id D6C9A308436; Tue, 19 Mar 2013 12:02:33 -0300 (UYT) Message-ID: <51487E14.9090004@lacnic.net> Date: Tue, 19 Mar 2013 12:02:44 -0300 From: Arturo Servin User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: carlos@lacnic.net References: <89FE469F-C657-4E38-91F8-F1B3E791BFE5@verisign.com> <20130319040619.A22F217098@thrintun.hactrn.net> <51484472.1040802@lacnic.net> <51487DD1.6040900@gmail.com> In-Reply-To: <51487DD1.6040900@gmail.com> X-Enigmail-Version: 1.5.1 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-LACNIC.uy-MailScanner-Information: Please contact the ISP for more information X-LACNIC.uy-MailScanner: Found to be clean X-LACNIC.uy-MailScanner-SpamCheck: X-LACNIC.uy-MailScanner-From: aservin@lacnic.net Cc: sidr@ietf.org Subject: Re: [sidr] RPKI operations list? X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Mar 2013 15:02:49 -0000 Sorry, typo. Morning without coffee. :) On 3/19/13 12:01 PM, Carlos M. Martinez wrote: > Make it grow? I hope there wasn't an IETF-pun intended there ... > > > > :D > > > On 3/19/13 7:56 AM, Arturo Servin wrote: >> >> Thanks! >> >> I think it would be very valuable to interchange operational experience >> and help our still small community to communicate (and make it grow) >> >> Regards >> .as >> >> On 19/03/2013 01:06, Rob Austein wrote: >>> At Sun, 3 Feb 2013 13:01:25 -0500, Osterweil, Eric wrote: >>>> >>>> Is there an operations list somewhere for RPKI repository >>>> operations? We're hoping there's some forum where all of the RIRs >>>> and (any other repo ops) are listening/talking? We've been seeing >>>> some anomalies in the deployed RPKI repositories and we'd like to >>>> plug in (especially if there are already some conversations going >>>> about what we've been seeing). >>> >>> Sorry, I was on holiday back when Eric first posted this, thanks to >>> Andrew Chi for pointing it out to me. >>> >>> rpki@rpki.net is available for this purpose. Traffic is sporadic but >>> generally low. List was very recently converted to Mailman. >>> >>> List info: >>> https://lists.rpki.net/mailman/listinfo/rpki >>> >>> Mailman web interface uses a server certificate issued by private CA. >>> CA certificate, and PGP signed version for anyone who might care: >>> http://www.hactrn.net/cacert.cer >>> http://www.hactrn.net/cacert.asc >>> _______________________________________________ >>> sidr mailing list >>> sidr@ietf.org >>> https://www.ietf.org/mailman/listinfo/sidr >>> >> _______________________________________________ >> sidr mailing list >> sidr@ietf.org >> https://www.ietf.org/mailman/listinfo/sidr >> From christopher.morrow@gmail.com Tue Mar 19 10:14:25 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1653E21F8EFC for ; Tue, 19 Mar 2013 10:14:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.6 X-Spam-Level: X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BxmN4ocuok9c for ; Tue, 19 Mar 2013 10:14:24 -0700 (PDT) Received: from mail-la0-x22d.google.com (mail-la0-x22d.google.com [IPv6:2a00:1450:4010:c03::22d]) by ietfa.amsl.com (Postfix) with ESMTP id BC5FA21F8DD9 for ; Tue, 19 Mar 2013 10:14:23 -0700 (PDT) Received: by mail-la0-f45.google.com with SMTP id er20so1383492lab.4 for ; Tue, 19 Mar 2013 10:14:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:x-received:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type; bh=TLPBfbcjhAg3yOS4hThtuI4DvdN+43sKcniFkmL4dPY=; b=mW8qhcRCAYD8N+E93UdqyNEhBYovi1ZsWFI2ahjK4yBr/GUCY38rDrFGB6ycthh9iU /r08yR6bwKHos6r89hHE7KBha9LYI+hYBTciTCuifp20VbjPf+QaHd3am+jyDb+SYH9i 9Wn8p74Yy1Ks7NNNcT3OOdiwoe1pDfVMxHm8Muxvn5HgrqClDP+1mCzCio72B0K91wHm iCnIG6xn44Jl47aQr5p37oG31jkAP865J8sYqxj8EpmA5eAmkjH4kferJgNJfjXVr5B+ zfx/Ar4yq02L0cJEQQ6vPwLf1BGCk7pPpqPBK46KvzT2JINWPurVerYQMiL9RiA9SBzH 42KQ== MIME-Version: 1.0 X-Received: by 10.112.47.41 with SMTP id a9mr8317153lbn.134.1363713262168; Tue, 19 Mar 2013 10:14:22 -0700 (PDT) Sender: christopher.morrow@gmail.com Received: by 10.152.28.34 with HTTP; Tue, 19 Mar 2013 10:14:22 -0700 (PDT) In-Reply-To: References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> Date: Tue, 19 Mar 2013 13:14:22 -0400 X-Google-Sender-Auth: gVNplr5mgrHJVaqKhKRQBZecgnM Message-ID: From: Christopher Morrow To: Randy Bush Content-Type: text/plain; charset=ISO-8859-1 Cc: Arturo Servin , sidr@ietf.org Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Mar 2013 17:14:25 -0000 On Tue, Mar 19, 2013 at 5:51 AM, Randy Bush wrote: >> oops, so... we need to be clear in terminology here there are at least: >> o publication points - places/machines AS Operators would make their >> authoritative information available to the world. >> o 'gatherer' machines - machines an AS Operator would use to gather >> repository data from all of the publication points. >> o caches - systems inside of and AS which provide the digested data >> to the routers of that operator's network. > > from the emulation preso series your slide confuses me... with the arrows from ARIN -> cache1-asia (etc) seeming to imply a push from rpki-ARIN (which I assume is the pub point for arin?) to the cache1-asia system? From achi@bbn.com Tue Mar 19 10:30:25 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B3F4121F8DB2 for ; Tue, 19 Mar 2013 10:30:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.384 X-Spam-Level: X-Spam-Status: No, score=-6.384 tagged_above=-999 required=5 tests=[AWL=0.215, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id D13Z4gPshsgj for ; Tue, 19 Mar 2013 10:30:25 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) by ietfa.amsl.com (Postfix) with ESMTP id 51EF021F8CA4 for ; Tue, 19 Mar 2013 10:30:25 -0700 (PDT) Received: from dhcp89-089-010.bbn.com ([128.89.89.10]:52245 helo=[127.0.0.1]) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1UI0Mi-0003gn-DS; Tue, 19 Mar 2013 13:30:24 -0400 Message-ID: <5148A0AB.8030703@bbn.com> Date: Tue, 19 Mar 2013 13:30:19 -0400 From: Andrew Chi User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: Rob Austein References: <89FE469F-C657-4E38-91F8-F1B3E791BFE5@verisign.com> <20130319040619.A22F217098@thrintun.hactrn.net> In-Reply-To: <20130319040619.A22F217098@thrintun.hactrn.net> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Cc: sidr@ietf.org Subject: Re: [sidr] RPKI operations list? X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Mar 2013 17:30:25 -0000 On 3/19/2013 12:06 AM, Rob Austein wrote: > rpki@rpki.net is available for this purpose. Thanks, Rob! From randy@psg.com Tue Mar 19 22:29:31 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5ECED21F8BEB for ; Tue, 19 Mar 2013 22:29:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FUM0YpGGK1JP for ; Tue, 19 Mar 2013 22:29:31 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id 080F021F8B84 for ; Tue, 19 Mar 2013 22:29:31 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.80.1 (FreeBSD)) (envelope-from ) id 1UIBab-000J4K-Db; Wed, 20 Mar 2013 05:29:30 +0000 Date: Wed, 20 Mar 2013 07:29:26 +0200 Message-ID: From: Randy Bush To: Christopher Morrow In-Reply-To: References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Cc: sidr wg list Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 05:29:31 -0000 > your slide confuses me... with the arrows from ARIN -> cache1-asia > (etc) seeming to imply a push from rpki-ARIN (which I assume is the > pub point for arin?) to the cache1-asia system? push is your imagination. control flow is not intended, otherwise interpub would be unnecessarily 'interesing'. the arrows show direction of data flow. randy From christopher.morrow@gmail.com Tue Mar 19 22:31:05 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 830A121F8EF1 for ; Tue, 19 Mar 2013 22:31:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.6 X-Spam-Level: X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Qz6fo-rIEn3T for ; Tue, 19 Mar 2013 22:31:05 -0700 (PDT) Received: from mail-la0-x235.google.com (mail-la0-x235.google.com [IPv6:2a00:1450:4010:c03::235]) by ietfa.amsl.com (Postfix) with ESMTP id C277121F8B84 for ; Tue, 19 Mar 2013 22:31:04 -0700 (PDT) Received: by mail-la0-f53.google.com with SMTP id fr10so2357525lab.26 for ; Tue, 19 Mar 2013 22:31:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:x-received:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type; bh=xbuYg8/A/SQ3sq+4jWkkwXs+AKVDVlHwXDpL9GYdROc=; b=v0qqBmGuLWmE23b2Ylyrb8jem+pxz37fkektKriJIBFhh/msxrDikgwZ785nZ7ETdq cgafJdduj24Y5yMBfr4uoih/4T4tfTYvKq3xllpRFvJ5BfvId/5vsJJ+ruMiC29ANcGz qDm+YAtDmfRSNp5Fv6sxH1RT+uVAcjh39lp6NeTll/DqXN88lQZZN/zIGOygNFYlT6oo OTyj1xdBQSsrOnYewxUcHkPldpW9Fi61inY/KjNhu5+6UNo26KevqmIgN07m3u4hF/D9 sPChGVt6UNr40nMoT8TgliR0kb89qnCmxaffOkmmwLGC05sKMNKmE2+YCln5wqDmqNdB MstQ== MIME-Version: 1.0 X-Received: by 10.112.49.201 with SMTP id w9mr8863919lbn.2.1363757463760; Tue, 19 Mar 2013 22:31:03 -0700 (PDT) Sender: christopher.morrow@gmail.com Received: by 10.152.28.34 with HTTP; Tue, 19 Mar 2013 22:31:03 -0700 (PDT) In-Reply-To: References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> Date: Wed, 20 Mar 2013 01:31:03 -0400 X-Google-Sender-Auth: uHDcR8Nw1_VjrBmL4i5tEE66uLY Message-ID: From: Christopher Morrow To: Randy Bush Content-Type: text/plain; charset=ISO-8859-1 Cc: sidr wg list Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 05:31:05 -0000 On Wed, Mar 20, 2013 at 1:29 AM, Randy Bush wrote: >> your slide confuses me... with the arrows from ARIN -> cache1-asia >> (etc) seeming to imply a push from rpki-ARIN (which I assume is the >> pub point for arin?) to the cache1-asia system? > > push is your imagination. control flow is not intended, otherwise > interpub would be unnecessarily 'interesing'. the arrows show direction > of data flow. ah-ha! :) gotcha. From danny@tcb.net Wed Mar 20 05:25:53 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 77BD221F8F6F for ; Wed, 20 Mar 2013 05:25:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.437 X-Spam-Level: X-Spam-Status: No, score=-100.437 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j+F5vxcc4AHA for ; Wed, 20 Mar 2013 05:25:53 -0700 (PDT) Received: from mail.friendswithtools.org (unknown [64.78.239.70]) by ietfa.amsl.com (Postfix) with ESMTP id D790621F87A4 for ; Wed, 20 Mar 2013 05:25:52 -0700 (PDT) Received: from dspam (unknown [127.0.0.1]) by mail.friendswithtools.org (Postfix) with SMTP id 60EAC300079 for ; Wed, 20 Mar 2013 12:25:52 +0000 (UTC) Received: from mail2.tcb.net (localhost [127.0.0.1]) by mail.friendswithtools.org (Postfix) with ESMTP id 35582300074 for ; Wed, 20 Mar 2013 06:25:52 -0600 (MDT) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Date: Wed, 20 Mar 2013 06:25:52 -0600 From: Danny McPherson To: In-Reply-To: <5147450F.7090107@bbn.com> References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <5147450F.7090107@bbn.com> Message-ID: X-Sender: danny@tcb.net User-Agent: Roundcube Webmail/0.8.2 X-DSPAM-Result: Innocent X-DSPAM-Processed: Wed Mar 20 06:25:52 2013 X-DSPAM-Confidence: 0.9898 X-DSPAM-Improbability: 1 in 9709 chance of being spam X-DSPAM-Probability: 0.0000 X-DSPAM-Signature: 5149aad042072067918430 X-DSPAM-Factors: 27, Stephen+Kent, 0.01000, it+is, 0.01000, be+#+in, 0.01000, To*sidr+ietf.org, 0.01000, on+the, 0.01000, the+#+#+#+the, 0.01000, not+#+to, 0.01000, the+#+of, 0.01000, is+#+a, 0.01000, From*Danny+#+danny, 0.01000, From*Danny+#+#+tcb.net, 0.01000, Subject*Re+sidr, 0.01000, From*Danny+McPherson, 0.01000, On+#+03, 0.01000, to+be, 0.01000, On+2013, 0.01000, a+#+#+the, 0.01000, From*McPherson+danny, 0.01000, From*Danny McPherson , 0.01000, 2013+03, 0.01000, From*McPherson+#+tcb.net, 0.01000, From*danny+tcb.net, 0.01000, On+#+#+#+10, 0.40000, if+#+have, 0.40000, that+#+this, 0.40000, system+#+at, 0.40000, after+it, 0.40000 Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 12:25:53 -0000 On 2013-03-18 10:47, Stephen Kent wrote: > There are at least two issue here: how quickly a new/changed ROA is > published > after it is created/modified, and how quickly one should expect all > RPs to have acquired this info. The RPKI propagation model for ROAs > was > based on the observation that, typically, the binding between an > address space holder > and the AS originating routes to that space changed very > infrequently, and > not very fast. Conversations with RIR staff supported this notion, > based on > IRR DB experience. So, suggesting that this data needs to be > propagated in > minutes, vs. 1/2 a day, is quite a change. No, it's not. The system converges at the speed of routing today, if I have to wait 12 hours to mitigate an attack for someone then that could be a problem. If the RIR's actually conducted any qualitative study to this effect I'd appreciate a reference - I've seen none. However, I can say for certain that there are many companies that need "minutes" of convergence, just like they have today, else they won't be able to perform things like DDoS mitigation for hours or longer, and that's not acceptable to many current operations. We have a business that utilizes this today. We've already had this discussion here. -danny From danny@tcb.net Wed Mar 20 05:50:37 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C7A6C11E80A3 for ; Wed, 20 Mar 2013 05:50:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.437 X-Spam-Level: X-Spam-Status: No, score=-100.437 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DfmZQITi6lUE for ; Wed, 20 Mar 2013 05:50:36 -0700 (PDT) Received: from mail.friendswithtools.org (unknown [64.78.239.70]) by ietfa.amsl.com (Postfix) with ESMTP id 7CD6A11E80A2 for ; Wed, 20 Mar 2013 05:50:36 -0700 (PDT) Received: from dspam (unknown [127.0.0.1]) by mail.friendswithtools.org (Postfix) with SMTP id 47111300079 for ; Wed, 20 Mar 2013 12:50:36 +0000 (UTC) Received: from mail2.tcb.net (localhost [127.0.0.1]) by mail.friendswithtools.org (Postfix) with ESMTP id 2453F300074 for ; Wed, 20 Mar 2013 06:50:36 -0600 (MDT) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Date: Wed, 20 Mar 2013 06:50:36 -0600 From: Danny McPherson To: Message-ID: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> X-Sender: danny@tcb.net User-Agent: Roundcube Webmail/0.8.2 X-DSPAM-Result: Innocent X-DSPAM-Processed: Wed Mar 20 06:50:36 2013 X-DSPAM-Confidence: 0.9898 X-DSPAM-Improbability: 1 in 9709 chance of being spam X-DSPAM-Probability: 0.0000 X-DSPAM-Signature: 5149b09c42075275514395 X-DSPAM-Factors: 27, a+#+#+to, 0.01000, To*sidr+ietf.org, 0.01000, is+a, 0.01000, From*Danny+#+danny, 0.01000, From*Danny+#+#+tcb.net, 0.01000, From*Danny+McPherson, 0.01000, From*McPherson+danny, 0.01000, From*Danny McPherson , 0.01000, From*McPherson+#+tcb.net, 0.01000, From*danny+tcb.net, 0.01000, RPKI's+#+#+coupling, 0.40000, since+#+#+#+coupling, 0.40000, infrastructure+#+#+#+routing, 0.40000, here+The, 0.40000, The+#+#+#+Key, 0.40000, we've+#+#+#+vocal, 0.40000, it+#+#+#+risks, 0.40000, also+creates, 0.40000, Url*edu/~goldbe/papers/Cooper_RPKI_BFOC, 0.40000, unreachable+Given, 0.40000, tight+coupling, 0.40000, make+IP, 0.40000, operational+#+#+RPKI's, 0.40000, also+#+#+#+misconfigurations, 0.40000, unreachable+#+#+#+concerned, 0.40000, deployment+since, 0.40000, perspective+#+RPKI's, 0.40000 Subject: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 12:50:37 -0000 Interesting presentation here: http://www.cs.bu.edu/~goldbe/papers/Cooper_RPKI_BFOC.pdf "The RPKI (Resource Public Key Infrastructure) is a new infrastructure to secure Internet routing It’s been in deployment since ~2011 But, it also creates new risks (misconfigurations and takedowns) that could make IP prefixes unreachable" Given we've been concerned (and vocal) about this from an operational perspective since RPKI's proposed "tight coupling" into BGPSEC discussions many years ago... -danny From jcurran@istaff.org Wed Mar 20 06:17:17 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C828721F8CF6 for ; Wed, 20 Mar 2013 06:17:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P6YrFKWxRxTk for ; Wed, 20 Mar 2013 06:17:17 -0700 (PDT) Received: from mho-02-ewr.mailhop.org (mho-04-ewr.mailhop.org [204.13.248.74]) by ietfa.amsl.com (Postfix) with ESMTP id 1879A21F8CEF for ; Wed, 20 Mar 2013 06:17:16 -0700 (PDT) Received: from ip-64-134-156-35.public.wayport.net ([64.134.156.35] helo=[192.168.5.48]) by mho-02-ewr.mailhop.org with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.72) (envelope-from ) id 1UIItI-0004k5-H1; Wed, 20 Mar 2013 13:17:16 +0000 X-Mail-Handler: Dyn Standard SMTP by Dyn X-Originating-IP: 64.134.156.35 X-Report-Abuse-To: abuse@dyndns.com (see http://www.dyndns.com/services/sendlabs/outbound_abuse.html for abuse reporting information) X-MHO-User: U2FsdGVkX1+OaST9D3O0ShpOCuvz0fny Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 6.3 \(1503\)) From: John Curran In-Reply-To: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> Date: Wed, 20 Mar 2013 07:17:15 -0600 Content-Transfer-Encoding: quoted-printable Message-Id: References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> To: Danny McPherson X-Mailer: Apple Mail (2.1503) Cc: sidr@ietf.org Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 13:17:17 -0000 On Mar 20, 2013, at 6:50 AM, Danny McPherson wrote: > Interesting presentation here: >=20 > http://www.cs.bu.edu/~goldbe/papers/Cooper_RPKI_BFOC.pdf >=20 > "The RPKI (Resource Public Key Infrastructure) is a new infrastructure = to secure Internet routing > It=92s been in deployment since ~2011 But, it also creates new risks = (misconfigurations and takedowns) > that could make IP prefixes unreachable" >=20 > Given we've been concerned (and vocal) about this from an operational = perspective since RPKI's proposed "tight coupling" into BGPSEC = discussions many years ago... So, I'm a little confused... (wouldn't be the first time :-) The presentation states "Importantly, RPKI validity must impact routing=20= decisions.", which I guess we have to take as a truism if RPKI is to = have=20 any effect at all on routing security. It then goes on to equate cert revocation (and resulting loss of a ROA) with an impact to reachability.=20= I don't understand how they conclude that loss of a ROA would be a=20 reachability impacting event (on its own), since any party using =20 routing policy as outlined in is almost certainly going to end up using an announcement which is=20 now NotFound origin instead...=20 Danny - Is there really a "tight coupling" if providers are=20 following the recommend BGP origin validation best practices? /John From arturo.servin@gmail.com Wed Mar 20 06:20:36 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AC69321F8EF2 for ; Wed, 20 Mar 2013 06:20:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UsGXl3hT19PH for ; Wed, 20 Mar 2013 06:20:36 -0700 (PDT) Received: from mail-ob0-x235.google.com (mail-ob0-x235.google.com [IPv6:2607:f8b0:4003:c01::235]) by ietfa.amsl.com (Postfix) with ESMTP id D0F0621F8E2C for ; Wed, 20 Mar 2013 06:20:35 -0700 (PDT) Received: by mail-ob0-f181.google.com with SMTP id ni5so1552211obc.40 for ; Wed, 20 Mar 2013 06:20:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=x-received:message-id:date:from:user-agent:mime-version:to:subject :references:in-reply-to:content-type:content-transfer-encoding; bh=M2ZnlLC0yyxzXV5rSTnnkaB/GWH6enaaZtJgp+4QWuI=; b=y4gOkU20DST0/mzk1z0qxUj0Kl5nAINiMxa/JLkEztLEZzsobbpawlxFI+lOhCOt1P eEEEu3Xh05hTrK3bxbKd4lXpL/T0hevkkyWeO9UCzUp0Ndx9fq872AyQu6UBpZQV2Vdz QA+yyN3Y4+JRVrpfQvApi/6nLYSxIRN3lGjrpyPyi7IvLBZ3UOUKzSNZYqyOwEQl+XQj x0NpNiIxYyNed8vV8OHyNiRWyXmscZIUlZ7R4L0/RxDZKZvNuqXKCIOwUsnS1VaR5+xB Jt4cbWH5NSM3ZodZyEtM7DviBE7IjgJNPWqG4NQkHzk0xNpEoxWglbqAhTLKP3lYcPsE RQQA== X-Received: by 10.60.14.71 with SMTP id n7mr3940803oec.135.1363785635164; Wed, 20 Mar 2013 06:20:35 -0700 (PDT) Received: from 85-7-200.lacnic.net.uy ([2001:13c7:7001:5128:ed04:56f9:69f7:9174]) by mx.google.com with ESMTPS id d10sm1806024oeh.7.2013.03.20.06.20.33 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 20 Mar 2013 06:20:34 -0700 (PDT) Message-ID: <5149B7A5.90301@gmail.com> Date: Wed, 20 Mar 2013 10:20:37 -0300 From: Arturo Servin User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: sidr@ietf.org References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> In-Reply-To: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 13:20:36 -0000 And THE organization can also take down bgp-peers, shutdown interfaces, etc. At the end, it is its space, they can revoke certs. Cheers, as On 3/20/13 9:50 AM, Danny McPherson wrote: > > Interesting presentation here: > > http://www.cs.bu.edu/~goldbe/papers/Cooper_RPKI_BFOC.pdf > > "The RPKI (Resource Public Key Infrastructure) is a new infrastructure > to secure Internet routing > It’s been in deployment since ~2011 But, it also creates new risks > (misconfigurations and takedowns) > that could make IP prefixes unreachable" > > Given we've been concerned (and vocal) about this from an operational > perspective since RPKI's proposed "tight coupling" into BGPSEC > discussions many years ago... > > -danny > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr From danny@tcb.net Wed Mar 20 06:21:52 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C999F21F8E2C for ; Wed, 20 Mar 2013 06:21:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.437 X-Spam-Level: X-Spam-Status: No, score=-100.437 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QmKgIkVvEIx6 for ; Wed, 20 Mar 2013 06:21:52 -0700 (PDT) Received: from mail.friendswithtools.org (unknown [64.78.239.70]) by ietfa.amsl.com (Postfix) with ESMTP id E25D621F8EF2 for ; Wed, 20 Mar 2013 06:21:51 -0700 (PDT) Received: from dspam (unknown [127.0.0.1]) by mail.friendswithtools.org (Postfix) with SMTP id DBFBB300025 for ; Wed, 20 Mar 2013 13:21:50 +0000 (UTC) Received: from [10.91.233.128] (mobile-198-228-224-023.mycingular.net [198.228.224.23]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by mail.friendswithtools.org (Postfix) with ESMTPSA id 6D7A3300013; Wed, 20 Mar 2013 07:21:50 -0600 (MDT) References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> Mime-Version: 1.0 (1.0) In-Reply-To: Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-Id: <6B94F864-DB4B-4499-A098-FCBEA39760C9@tcb.net> X-Mailer: iPhone Mail (10B146) From: Danny McPherson Date: Wed, 20 Mar 2013 09:21:47 -0400 To: John Curran X-DSPAM-Result: Innocent X-DSPAM-Processed: Wed Mar 20 07:21:50 2013 X-DSPAM-Confidence: 0.9898 X-DSPAM-Improbability: 1 in 9709 chance of being spam X-DSPAM-Probability: 0.0000 X-DSPAM-Signature: 5149b7ee42071899419656 X-DSPAM-Factors: 27, From*Danny+#+danny, 0.01000, From*Danny+#+#+tcb.net, 0.01000, Subject*Re+sidr, 0.01000, From*Danny+McPherson, 0.01000, Cc*sidr+ietf.org, 0.01000, Cc*sidr+ietf.org, 0.01000, From*McPherson+danny, 0.01000, From*Danny McPherson , 0.01000, From*McPherson+#+tcb.net, 0.01000, From*danny+tcb.net, 0.01000, providers+#+#+the, 0.40000, following+#+recommend, 0.40000, practices+#+said, 0.40000, tight+coupling, 0.40000, are+#+#+#+BGP, 0.40000, To*John+#+#+istaff.org, 0.40000, I+#+BGPSEC, 0.40000, Cc*ietf.org+#+ietf.org, 0.40000, BGP+origin, 0.40000, best+#+I, 0.40000, the+#+BGP, 0.40000, following+#+#+#+origin, 0.40000, origin+#+#+practices, 0.40000, Subject*sidr+#+University, 0.40000, Cc*ietf.org+sidr, 0.40000, Subject*Princeton+#+#+IP, 0.40000, a+tight, 0.40000 Cc: "sidr@ietf.org" Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 13:21:53 -0000 > Danny - Is there really a "tight coupling" if providers are > following the recommend BGP origin validation best practices? I said BGPSEC... -danny From danny@tcb.net Wed Mar 20 06:27:38 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C3C1021F8F44 for ; Wed, 20 Mar 2013 06:27:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -99.739 X-Spam-Level: X-Spam-Status: No, score=-99.739 tagged_above=-999 required=5 tests=[AWL=-0.698, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, MIME_QP_LONG_LINE=1.396, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PzvGB7HMB7p2 for ; Wed, 20 Mar 2013 06:27:37 -0700 (PDT) Received: from mail.friendswithtools.org (unknown [64.78.239.70]) by ietfa.amsl.com (Postfix) with ESMTP id DE8FD21F8E2C for ; Wed, 20 Mar 2013 06:27:36 -0700 (PDT) Received: from dspam (unknown [127.0.0.1]) by mail.friendswithtools.org (Postfix) with SMTP id 80751300025 for ; Wed, 20 Mar 2013 13:27:36 +0000 (UTC) Received: from [10.91.233.128] (mobile-198-228-224-023.mycingular.net [198.228.224.23]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by mail.friendswithtools.org (Postfix) with ESMTPSA id 4192D300013 for ; Wed, 20 Mar 2013 07:27:36 -0600 (MDT) References: <6B94F864-DB4B-4499-A098-FCBEA39760C9@tcb.net> From: Danny McPherson Content-Type: text/plain; charset=us-ascii X-Mailer: iPhone Mail (10B146) Message-Id: <53AEFF95-FD3F-4AE8-A1DF-22845F97A55C@tcb.net> Date: Wed, 20 Mar 2013 09:27:33 -0400 To: sidr@ietf.org Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (1.0) X-DSPAM-Result: Innocent X-DSPAM-Processed: Wed Mar 20 07:27:36 2013 X-DSPAM-Confidence: 0.9898 X-DSPAM-Improbability: 1 in 9709 chance of being spam X-DSPAM-Probability: 0.0000 X-DSPAM-Signature: 5149b94842071141815902 X-DSPAM-Factors: 27, as+well, 0.01000, To*sidr+ietf.org, 0.01000, From*Danny+#+danny, 0.01000, From*Danny+#+#+tcb.net, 0.01000, From*Danny+McPherson, 0.01000, From*McPherson+danny, 0.01000, From*Danny McPherson , 0.01000, From*McPherson+#+tcb.net, 0.01000, From*danny+tcb.net, 0.01000, providers+#+#+the, 0.40000, following+#+recommend, 0.40000, statement+#+#+to, 0.40000, practices+#+said, 0.40000, tight+coupling, 0.40000, envisaged+deployment, 0.40000, statement+#+apply, 0.40000, are+#+#+#+BGP, 0.40000, I+#+BGPSEC, 0.40000, BGPSEC+#+my, 0.40000, BGP+origin, 0.40000, best+#+I, 0.40000, the+#+BGP, 0.40000, However+my, 0.40000, BGPSEC+#+#+#+does, 0.40000, following+#+#+#+origin, 0.40000, as+#+#+#+envisaged, 0.40000, origin+#+#+practices, 0.40000 Subject: [sidr] Fwd: Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 13:27:38 -0000 >> Danny - Is there really a "tight coupling" if providers are=20 >> following the recommend BGP origin validation best practices? >=20 > I said BGPSEC... =20 However, my statement does apply to origin validation as well, in some envis= aged deployment models... -danny From jcurran@istaff.org Wed Mar 20 06:33:20 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DD79F21F84BE for ; Wed, 20 Mar 2013 06:33:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dpwvy0Pv+i6U for ; Wed, 20 Mar 2013 06:33:20 -0700 (PDT) Received: from mho-01-ewr.mailhop.org (mho-03-ewr.mailhop.org [204.13.248.66]) by ietfa.amsl.com (Postfix) with ESMTP id 59E7D21F8461 for ; Wed, 20 Mar 2013 06:33:20 -0700 (PDT) Received: from ip-64-134-156-35.public.wayport.net ([64.134.156.35] helo=[192.168.5.48]) by mho-01-ewr.mailhop.org with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.72) (envelope-from ) id 1UIJ8p-0006Ks-SH; Wed, 20 Mar 2013 13:33:19 +0000 X-Mail-Handler: Dyn Standard SMTP by Dyn X-Originating-IP: 64.134.156.35 X-Report-Abuse-To: abuse@dyndns.com (see http://www.dyndns.com/services/sendlabs/outbound_abuse.html for abuse reporting information) X-MHO-User: U2FsdGVkX1/LxEavTN149TA94ynHZpm1 Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 6.3 \(1503\)) From: John Curran In-Reply-To: <6B94F864-DB4B-4499-A098-FCBEA39760C9@tcb.net> Date: Wed, 20 Mar 2013 07:33:18 -0600 Content-Transfer-Encoding: 7bit Message-Id: <47050C6B-E194-43FC-8AF5-DA29879A67C8@istaff.org> References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> <6B94F864-DB4B-4499-A098-FCBEA39760C9@tcb.net> To: Danny McPherson X-Mailer: Apple Mail (2.1503) Cc: "sidr@ietf.org" Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 13:33:21 -0000 On Mar 20, 2013, at 7:21 AM, Danny McPherson wrote: >> Danny - Is there really a "tight coupling" if providers are >> following the recommend BGP origin validation best practices? > > I said BGPSEC... Got it - the presentation suggests that RPKI poses risks to network reachability due to attack vectors on the certificate infrastructure that impact ROAs, the loss of which may not actually cause reachability issues if people are following best-practices, but would be true if there were a tight-coupling to routing, which there isn't with BGP origin preference, but might be with BGPSEC... I'm not sure I'd use that particular presentation's logic to try to make a point, but it's your example... ;-) /John From kent@bbn.com Wed Mar 20 06:44:11 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 661A521F84F2 for ; Wed, 20 Mar 2013 06:44:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.598 X-Spam-Level: X-Spam-Status: No, score=-106.598 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id q2YZVwHAudd8 for ; Wed, 20 Mar 2013 06:44:10 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) by ietfa.amsl.com (Postfix) with ESMTP id 9E4A621F84E8 for ; Wed, 20 Mar 2013 06:44:10 -0700 (PDT) Received: from dommiel.bbn.com ([192.1.122.15]:57274 helo=comsec.home) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1UIJJJ-0002XM-QB for sidr@ietf.org; Wed, 20 Mar 2013 09:44:10 -0400 Message-ID: <5149BD29.3030309@bbn.com> Date: Wed, 20 Mar 2013 09:44:09 -0400 From: Stephen Kent User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: sidr@ietf.org References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <5147450F.7090107@bbn.com> In-Reply-To: Content-Type: multipart/alternative; boundary="------------010608080509090208060902" Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 13:44:11 -0000 This is a multi-part message in MIME format. --------------010608080509090208060902 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Danny, > On 2013-03-18 10:47, Stephen Kent wrote: > >> There are at least two issue here: how quickly a new/changed ROA is >> published >> after it is created/modified, and how quickly one should expect all >> RPs to have acquired this info. The RPKI propagation model for ROAs was >> based on the observation that, typically, the binding between an >> address space holder >> and the AS originating routes to that space changed very >> infrequently, and >> not very fast. Conversations with RIR staff supported this notion, >> based on >> IRR DB experience. So, suggesting that this data needs to be >> propagated in >> minutes, vs. 1/2 a day, is quite a change. > > No, it's not. My comment applies to the statement about the frequency with which IRR DB entries, some of which are very analogous to ROAs, change. Your assertion (below) might be that folks who do not rely on these dabatases accept changes in asserted prefix/ASN bindings at the speed of routing updates. I agree with that observaiton, but note that it's also what made the Pakistan Telecom vs. YouTube incident possible. > The system converges at the speed of routing today, if I have to wait > 12 hours to mitigate an attack for someone then that could be a > problem. If the RIR's actually conducted any qualitative study to this > effect I'd appreciate a reference - I've seen none. However, I can say > for certain that there are many companies that need "minutes" of > convergence, just like they have today, else they won't be able to > perform things like DDoS mitigation for hours or longer, and that's > not acceptable to many current operations. We have a business that > utilizes this today. You cite DDoS mitigation as _an_ example, whereas it seems to be more _the_ example. Also, it's not clear that asserting a new origin AS for a target of such an attack is the only way to deal with the problem, just the way that it is performed today, for ASes that do not make arrangements in advance to counter such attacks. Steve --------------010608080509090208060902 Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit Danny,
On 2013-03-18 10:47, Stephen Kent wrote:

There are at least two issue here: how quickly a new/changed ROA is published
after it is created/modified, and how quickly one should expect all
RPs to have acquired this info. The RPKI propagation model for ROAs was
based on the observation that, typically, the binding between an
address space holder
and the AS originating routes to that space changed very infrequently, and
not very fast. Conversations with RIR staff supported this notion, based on
IRR DB experience. So, suggesting that this data needs to be propagated in
minutes, vs. 1/2 a day, is quite a change.

No, it's not.
My comment applies to the statement about the frequency with which IRR DB entries, some of which are
very analogous to ROAs, change. Your assertion (below) might be that folks who do not rely on these
dabatases accept changes in asserted prefix/ASN bindings at the speed of routing updates. I
agree with that observaiton, but note that it's also what made the Pakistan Telecom vs. YouTube
incident possible.
The system converges at the speed of routing today, if I have to wait 12 hours to mitigate an attack for someone then that could be a problem. If the RIR's actually conducted any qualitative study to this effect I'd appreciate a reference - I've seen none.  However, I can say for certain that there are many companies that need "minutes" of convergence, just like they have today, else they won't be able to perform things like DDoS mitigation for hours or longer, and that's not acceptable to many current operations.  We have a business that utilizes this today.
You cite DDoS mitigation as an example, whereas it seems to be more the example. Also, it's not clear
that asserting a new origin AS for a target of such an attack is the only way to deal with the problem,
just the way that it is performed today, for ASes that do not make arrangements in advance to counter
such attacks.

Steve
--------------010608080509090208060902-- From carlosm3011@gmail.com Wed Mar 20 07:17:44 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 463F521F8F50 for ; Wed, 20 Mar 2013 07:17:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.308 X-Spam-Level: X-Spam-Status: No, score=-1.308 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, MISSING_HEADERS=1.292, NO_RELAYS=-0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mgBuKPStN+7o for ; Wed, 20 Mar 2013 07:17:43 -0700 (PDT) Received: from mail-ob0-x229.google.com (mail-ob0-x229.google.com [IPv6:2607:f8b0:4003:c01::229]) by ietfa.amsl.com (Postfix) with ESMTP id 7797A21F8F76 for ; Wed, 20 Mar 2013 07:17:43 -0700 (PDT) Received: by mail-ob0-f169.google.com with SMTP id oi10so386946obb.28 for ; Wed, 20 Mar 2013 07:17:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=x-received:message-id:date:from:reply-to:user-agent:mime-version:cc :subject:references:in-reply-to:content-type :content-transfer-encoding; bh=vwrL7aeTMAmVeT6FT7TcxxmkeOWFOhs1BqMfe2TVzfM=; b=iHNcmCvJ4ALdyBNlySOmIFC0tONAlZ3gJqPDY0+Wq9EebCjSSios3mkexMbjYyIsFt m+tVJY+BELitLXKggXB2JmlbpMAjO6E6VWtxuiizCGJGlK4wknhqSZa4M0IythNhMv7G OJ5sKccRLp0W75tLdveBjb6tfJv06jyDpzlPfRpY/w9ifsSTOqyyRcwd3zCkxR3Vzeps //wWxd3bKJTlFUUTZZTuKTSoFSZhQApxc1gabnKjG/1F62sTHiH/UiOxPekIpu7NnZsU bQ5ShgLRraMSG3wWit5tN7RstKBBfmELhS+6BBuIIK8Td25O5jvVP6yP3ESYXxttEclj Q7og== X-Received: by 10.60.165.72 with SMTP id yw8mr4147692oeb.7.1363789062253; Wed, 20 Mar 2013 07:17:42 -0700 (PDT) Received: from 85-7-200.lacnic.net.uy ([2001:13c7:7001:5128:4d73:c433:ac72:9b15]) by mx.google.com with ESMTPS id 6sm971257obi.0.2013.03.20.07.17.39 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 20 Mar 2013 07:17:41 -0700 (PDT) Message-ID: <5149C506.7080001@gmail.com> Date: Wed, 20 Mar 2013 11:17:42 -0300 From: "Carlos M. Martinez" User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 CC: sidr@ietf.org References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> In-Reply-To: Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 8bit Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: carlos@lacnic.net List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 14:17:44 -0000 I agree with John's observations. We need to stop making the statement "no roa == no route", because it's simply not true. So far in my reading of the full paper, many of the 'vulnerabilities' they mention (quotes intended, I'm not sure the word is properly applied given the context) appear to (1) depend of how RPs handle the 'Unknown' validity state, and, more deeply, (2) to the very nature of the tree-based model of trust. For (1), I believe that we're still a long way from dropping unknowns, and we're definitely going to 'build the road as we go' (paraphrasing a very well known Chilean poet). Additional work might be needed in this area. For (2), I share the misgivings, but, do we have anything better ? Should we stop using tree-based models of trust until we do? I don't think so. Until now, this has worked reasonably well. Given the sheer amount of certification authorities out there, the fiascos like Digi Notar have not been that many. In the case of the RPKI we are talking about a more restricted universe that can be audited more easily and into which other safeguards could be built. cheers! ~Carlos On 3/20/13 10:17 AM, John Curran wrote: > On Mar 20, 2013, at 6:50 AM, Danny McPherson wrote: > >> Interesting presentation here: >> >> http://www.cs.bu.edu/~goldbe/papers/Cooper_RPKI_BFOC.pdf >> >> "The RPKI (Resource Public Key Infrastructure) is a new infrastructure to secure Internet routing >> It’s been in deployment since ~2011 But, it also creates new risks (misconfigurations and takedowns) >> that could make IP prefixes unreachable" >> >> Given we've been concerned (and vocal) about this from an operational perspective since RPKI's proposed "tight coupling" into BGPSEC discussions many years ago... > > So, I'm a little confused... (wouldn't be the first time :-) > > The presentation states "Importantly, RPKI validity must impact routing > decisions.", which I guess we have to take as a truism if RPKI is to have > any effect at all on routing security. It then goes on to equate cert > revocation (and resulting loss of a ROA) with an impact to reachability. > > I don't understand how they conclude that loss of a ROA would be a > reachability impacting event (on its own), since any party using > routing policy as outlined in is > almost certainly going to end up using an announcement which is > now NotFound origin instead... > > Danny - Is there really a "tight coupling" if providers are > following the recommend BGP origin validation best practices? > > /John > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From danny@tcb.net Wed Mar 20 07:59:02 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D420621F8314 for ; Wed, 20 Mar 2013 07:59:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -99.39 X-Spam-Level: X-Spam-Status: No, score=-99.39 tagged_above=-999 required=5 tests=[AWL=-0.349, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=1.396, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zkiiFGlqEwGl for ; Wed, 20 Mar 2013 07:59:01 -0700 (PDT) Received: from mail.friendswithtools.org (unknown [64.78.239.70]) by ietfa.amsl.com (Postfix) with ESMTP id 9A45C21F83EF for ; Wed, 20 Mar 2013 07:59:00 -0700 (PDT) Received: from dspam (unknown [127.0.0.1]) by mail.friendswithtools.org (Postfix) with SMTP id 55A15300021 for ; Wed, 20 Mar 2013 14:59:00 +0000 (UTC) Received: from [10.91.233.128] (mobile-198-228-224-023.mycingular.net [198.228.224.23]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by mail.friendswithtools.org (Postfix) with ESMTPSA id B8D53300013; Wed, 20 Mar 2013 08:58:59 -0600 (MDT) References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <5147450F.7090107@bbn.com> <5149BD29.3030309@bbn.com> Mime-Version: 1.0 (1.0) In-Reply-To: <5149BD29.3030309@bbn.com> Content-Type: multipart/alternative; boundary=Apple-Mail-2C83F4A0-67FE-4DB2-A157-3698B4FEE900 Content-Transfer-Encoding: 7bit Message-Id: X-Mailer: iPhone Mail (10B146) From: Danny McPherson Date: Wed, 20 Mar 2013 10:58:58 -0400 To: Stephen Kent X-DSPAM-Result: Innocent X-DSPAM-Processed: Wed Mar 20 08:59:00 2013 X-DSPAM-Confidence: 0.9899 X-DSPAM-Improbability: 1 in 9809 chance of being spam X-DSPAM-Probability: 0.0000 X-DSPAM-Signature: 5149ceb442071500419823 X-DSPAM-Factors: 27, Stephen+Kent, 0.01000, Stephen+Kent, 0.01000, it+is, 0.01000, it+is, 0.01000, as+an, 0.01000, as+an, 0.01000, be+#+in, 0.01000, be+#+in, 0.01000, it+#+to, 0.01000, it+#+to, 0.01000, that+#+not, 0.01000, that+#+not, 0.01000, a+new, 0.01000, a+new, 0.01000, the+#+#+#+is, 0.01000, the+#+#+#+is, 0.01000, Mime-Version*1.0+1.0, 0.01000, From*Danny+#+danny, 0.01000, From*Danny+#+#+tcb.net, 0.01000, to+#+#+the, 0.01000, to+#+#+the, 0.01000, Subject*Re+sidr, 0.01000, From*Danny+McPherson, 0.01000, it+#+#+be, 0.01000, it+#+#+be, 0.01000, to+be, 0.01000, to+be, 0.01000 Cc: "sidr@ietf.org" Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 14:59:03 -0000 --Apple-Mail-2C83F4A0-67FE-4DB2-A157-3698B4FEE900 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable On Mar 20, 2013, at 9:44 AM, Stephen Kent =20 > You cite DDoS mitigation as an example, whereas it seems to be more the ex= ample. Bah.. How many examples do you need? =20 > Also, it's not clear > that asserting a new origin AS for a target of such an attack is the only w= ay to deal with the problem, > just the way that it is performed today, for ASes that do not make arrange= ments in advance to counter > such attacks. Hah, right. If you've any magic the industry would be interested in it Dr. K= ent. Until then, please try not to break current capabilities that real ope= rators broadly use.. -danny= --Apple-Mail-2C83F4A0-67FE-4DB2-A157-3698B4FEE900 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 7bit


On Mar 20, 2013, at 9:44 AM, Stephen Kent <kent@bbn.com> 
You cite DDoS mitigation as an example, whereas it seems to be more the example.

Bah..  How many examples do you need?  

Also, it's not clear
that asserting a new origin AS for a target of such an attack is the only way to deal with the problem,
just the way that it is performed today, for ASes that do not make arrangements in advance to counter
such attacks.

Hah, right. If you've any magic the industry would be interested in it Dr. Kent.  Until then, please try not to break current capabilities that real operators broadly use..

-danny
--Apple-Mail-2C83F4A0-67FE-4DB2-A157-3698B4FEE900-- From rogaglia@cisco.com Wed Mar 20 08:01:05 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3BD0121F8B6E for ; Wed, 20 Mar 2013 08:01:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.599 X-Spam-Level: X-Spam-Status: No, score=-10.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lYPdYPMhrHu9 for ; Wed, 20 Mar 2013 08:01:04 -0700 (PDT) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) by ietfa.amsl.com (Postfix) with ESMTP id 72AE921F84E0 for ; Wed, 20 Mar 2013 08:01:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=7671; q=dns/txt; s=iport; t=1363791664; x=1365001264; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=y8FllX7e5G2uzG5QMmFnacFROSGyDSKErlIegL/L3s8=; b=i6Z7VZVaUfOJxPBYYW61mjQZgZCidjfrmiTLUXXX9YJEkb86/CDC9JDJ 4hBoYv4gRGGon3guNnsb+71jNicnOU8gtMonOD9fx7mFJpVEar4a/j+0D x9XtaGF4uIG3QzMaAIWT7gX6UQrR8iRhOnSdiFebOIj8SUX3YckpzX1ya o=; X-Files: smime.p7s : 4389 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AgEFAMjOSVGtJV2c/2dsb2JhbABDFsUDgU4WdIIkAQEBAgEBAQEBawsQAgEIIiQCJQslAgQOBQgGiAAGDMJfjl4xB4JfYQOPPYEoln2BVIE2gig X-IronPort-AV: E=Sophos;i="4.84,879,1355097600"; d="p7s'?scan'208";a="189571552" Received: from rcdn-core-5.cisco.com ([173.37.93.156]) by rcdn-iport-3.cisco.com with ESMTP; 20 Mar 2013 15:00:44 +0000 Received: from xhc-rcd-x14.cisco.com (xhc-rcd-x14.cisco.com [173.37.183.88]) by rcdn-core-5.cisco.com (8.14.5/8.14.5) with ESMTP id r2KF0iF9014748 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Wed, 20 Mar 2013 15:00:44 GMT Received: from xmb-rcd-x02.cisco.com ([169.254.4.47]) by xhc-rcd-x14.cisco.com ([173.37.183.88]) with mapi id 14.02.0318.004; Wed, 20 Mar 2013 10:00:43 -0500 From: "Roque Gagliano (rogaglia)" To: Danny McPherson Thread-Topic: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations Thread-Index: AQHOJXux2KKxpXO3jkWkjfgIBpzqcA== Date: Wed, 20 Mar 2013 15:00:43 +0000 Message-ID: References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> In-Reply-To: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [10.61.104.251] Content-Type: multipart/signed; boundary="Apple-Mail=_34CDEAF5-C223-4E47-AE79-8F8E3B590F9B"; protocol="application/pkcs7-signature"; micalg=sha1 MIME-Version: 1.0 Cc: "" Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 15:01:05 -0000 --Apple-Mail=_34CDEAF5-C223-4E47-AE79-8F8E3B590F9B Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 Danny, Thanks for the link. I read the doc. I do not believe the work has been peer-reviewed and I detected a couple = of bizarre statements (such as deleting an object =3D revocation or the = idea of "overwriting" a ROA to replace an existing one). What I believe it adds to our work are a number of scenarios on how to = implement grand-parenting (not all valid) if we ever decide to take that = problem. What specific finding(s) concerns you? Roque On Mar 20, 2013, at 1:50 PM, Danny McPherson wrote: >=20 > Interesting presentation here: >=20 > http://www.cs.bu.edu/~goldbe/papers/Cooper_RPKI_BFOC.pdf >=20 > "The RPKI (Resource Public Key Infrastructure) is a new infrastructure = to secure Internet routing > It=92s been in deployment since ~2011 But, it also creates new risks = (misconfigurations and takedowns) > that could make IP prefixes unreachable" >=20 > Given we've been concerned (and vocal) about this from an operational = perspective since RPKI's proposed "tight coupling" into BGPSEC = discussions many years ago... >=20 > -danny >=20 > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr --Apple-Mail=_34CDEAF5-C223-4E47-AE79-8F8E3B590F9B Content-Disposition: attachment; filename="smime.p7s" Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIMXDCCBWYw ggROoAMCAQICEDG+eY7Bhz6hDsSIPCMJYUYwDQYJKoZIhvcNAQEFBQAwgd0xCzAJBgNVBAYTAlVT MRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29y azE7MDkGA1UECxMyVGVybXMgb2YgdXNlIGF0IGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9ycGEg KGMpMDkxHjAcBgNVBAsTFVBlcnNvbmEgTm90IFZhbGlkYXRlZDE3MDUGA1UEAxMuVmVyaVNpZ24g Q2xhc3MgMSBJbmRpdmlkdWFsIFN1YnNjcmliZXIgQ0EgLSBHMzAeFw0xMjA1MDgwMDAwMDBaFw0x MzA1MTEyMzU5NTlaMIIBEzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlT aWduIFRydXN0IE5ldHdvcmsxRjBEBgNVBAsTPXd3dy52ZXJpc2lnbi5jb20vcmVwb3NpdG9yeS9S UEEgSW5jb3JwLiBieSBSZWYuLExJQUIuTFREKGMpOTgxHjAcBgNVBAsTFVBlcnNvbmEgTm90IFZh bGlkYXRlZDEzMDEGA1UECxMqRGlnaXRhbCBJRCBDbGFzcyAxIC0gTmV0c2NhcGUgRnVsbCBTZXJ2 aWNlMRcwFQYDVQQDFA5Sb3F1ZSBHYWdsaWFubzEhMB8GCSqGSIb3DQEJARYScm9nYWdsaWFAY2lz Y28uY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs+CGyKUNmmBJ4PgQDVA8hF5E ByrcJ8BQ2C8mSv3vSZqCZNXAyte/JRsl11BJmqwdLiH6baDaJbBKRzNFfaf8Wwe8aS3QvqpHfKtU pYvn+EKseVnXsIKssRV2AwNODN6VMwSA72Jiolo3z4xeoeLw9X/CnFYTJa4AcGM1LKk+rMGTQlly XXl+qc7LeAd+wk7bKsUFmg4uCfvCDhVSQj25S5tnmFl5WPGD2u7QEa2WLkkL5nH+BEedZmRejRgP smmAxDfBX1FVTnCOgz75hNFlrnkYJfPCXLRyfPHvaIGP/NBz6TJbwB3YZSweYHxWAEMglqgRvqIW 3Tr5k5x9yyNYVQIDAQABo4HoMIHlMAkGA1UdEwQCMAAwRAYDVR0gBD0wOzA5BgtghkgBhvhFAQcX ATAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy52ZXJpc2lnbi5jb20vcnBhMAsGA1UdDwQEAwIF oDAdBgNVHSUEFjAUBggrBgEFBQcDBAYIKwYBBQUHAwIwFAYKYIZIAYb4RQEGBwQGFgROb25lMFAG A1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9pbmRjMWRpZ2l0YWxpZC1nMy1jcmwudmVyaXNpZ24uY29t L0luZEMxRGlnaXRhbElELUczLmNybDANBgkqhkiG9w0BAQUFAAOCAQEAuFfFZrObA9gprpHyG6cq O4UZjtN5/moV6mUYbt+ffGrXMbVt06vgnba7r6ldS5eWPQZZQtAAKKqweAmZY37ZcvVQwDsMXOMG 4+MN60sPVKwrrSQz9xXcImVCzBxFsq22S4el6pGx38xytsPgKw4cs8ZVxPLEjZtcOGnl8R8fak2g WyAMt8zkIxu/84zcobhcY5EEPJxYg9WKHi617fD6/jjQqvwvW4zi2XkIjw+HpZSwdPxk2+Cg6id4 SS6WlTwe90rdJmRrCP4gTXyJOdARR7hJU714lamn9QdQuPX7WLJXuMmoyrhvZZUeHpvodO/eNiO2 KvxMUu0uXWiDcDgTvzCCBu4wggXWoAMCAQICEHEVZgVK5JEhTem8RPms09wwDQYJKoZIhvcNAQEF BQAwgcoxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVy aVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDE5OTkgVmVyaVNpZ24sIEluYy4gLSBG b3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3MgMSBQdWJsaWMg UHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEczMB4XDTA5MDUwMTAwMDAwMFoXDTE5 MDQzMDIzNTk1OVowgd0xCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0G A1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE7MDkGA1UECxMyVGVybXMgb2YgdXNlIGF0IGh0 dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9ycGEgKGMpMDkxHjAcBgNVBAsTFVBlcnNvbmEgTm90IFZh bGlkYXRlZDE3MDUGA1UEAxMuVmVyaVNpZ24gQ2xhc3MgMSBJbmRpdmlkdWFsIFN1YnNjcmliZXIg Q0EgLSBHMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAO3ER98qKB18Bmu71yEyyWwT j+mxjUFONPfaC+Nq+mWIIAsRE+mb4ElOi2/VAdBfDUeRilpMdD4/xpEJu0w0no1uoYJRYvdpdliW B6+eFBgHT1q9n9IxslQZc0ZqGUIR7BJzIY313DDN5dlWCjHFNm0pFJe9LdqJRxmI2EsEPeu2PGce dAATDdCG2pNn+DMDrho8a2l49sAsjuGDP3f5mf/+n1JawrSHCthsqUfBVCllQz5KwJYfwa33d69s sQRevsG2lC2XkC0n0rse6YNqhPbEsq4jBmUmpSdYKwcitG+mYkgad/LVUCeaKdOW+yj1uiR2YuOM Wev7btVCxL5Bx/UCAwEAAaOCArkwggK1MDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0 cDovL29jc3AudmVyaXNpZ24uY29tMBIGA1UdEwEB/wQIMAYBAf8CAQAwcAYDVR0gBGkwZzBlBgtg hkgBhvhFAQcXATBWMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy52ZXJpc2lnbi5jb20vY3BzMCoG CCsGAQUFBwICMB4aHGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9ycGEwNAYDVR0fBC0wKzApoCeg JYYjaHR0cDovL2NybC52ZXJpc2lnbi5jb20vcGNhMS1nMy5jcmwwDgYDVR0PAQH/BAQDAgEGMG4G CCsGAQUFBwEMBGIwYKFeoFwwWjBYMFYWCWltYWdlL2dpZjAhMB8wBwYFKw4DAhoEFEtruSiWBgy7 0FI4mymsSweLIQUYMCYWJGh0dHA6Ly9sb2dvLnZlcmlzaWduLmNvbS92c2xvZ28xLmdpZjAuBgNV HREEJzAlpCMwITEfMB0GA1UEAxMWUHJpdmF0ZUxhYmVsNC0yMDQ4LTExODAdBgNVHQ4EFgQUeUdh CEH9OASiS+e1zPVD9kkrEfgwgfEGA1UdIwSB6TCB5qGB0KSBzTCByjELMAkGA1UEBhMCVVMxFzAV BgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTow OAYDVQQLEzEoYykgMTk5OSBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5 MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAxIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24g QXV0aG9yaXR5IC0gRzOCEQCLW3VWhFSFCwDPrzhIzrGkMA0GCSqGSIb3DQEBBQUAA4IBAQA5Tc9B mYG1qQW1UjjpOYSJbOQ0qFrn2GwJTCQaulmkhztzIfGTgc+/aGNaZ/41hSuhw12jSsI6Gd0w1sxN 7/HSgZfKVFpDvzeLeo4ZjQ9DqIzyr2CzFYqzlZw84J6zJ5ikNXIX5fwqXYfTig3C0UUq+MD0rCqT OtWuEnAI6/s74nfs6CtkNXbNutrg0csU1nFYm77VPn222egkxSRmTF2RH3azFz5/DcYhiS+zN7ih /1yybUneZVJC+w6I0u1KHb9L4/jMcvpIDmWOScjW+JmYO7eUPjFxBof6bFlTLtffK+1fYwCsFe0D uFUWjMZoA+ciqHMLsbyg2lJY3QoOf8GCMYIEizCCBIcCAQEwgfIwgd0xCzAJBgNVBAYTAlVTMRcw FQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE7 MDkGA1UECxMyVGVybXMgb2YgdXNlIGF0IGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9ycGEgKGMp MDkxHjAcBgNVBAsTFVBlcnNvbmEgTm90IFZhbGlkYXRlZDE3MDUGA1UEAxMuVmVyaVNpZ24gQ2xh c3MgMSBJbmRpdmlkdWFsIFN1YnNjcmliZXIgQ0EgLSBHMwIQMb55jsGHPqEOxIg8IwlhRjAJBgUr DgMCGgUAoIICbTAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xMzAz MjAxNTAwNDFaMCMGCSqGSIb3DQEJBDEWBBRmle4ETH1l4hJgbDAE1huOgTrSfzCCAQMGCSsGAQQB gjcQBDGB9TCB8jCB3TELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYD VQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2UgYXQgaHR0 cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykwOTEeMBwGA1UECxMVUGVyc29uYSBOb3QgVmFs aWRhdGVkMTcwNQYDVQQDEy5WZXJpU2lnbiBDbGFzcyAxIEluZGl2aWR1YWwgU3Vic2NyaWJlciBD QSAtIEczAhAxvnmOwYc+oQ7EiDwjCWFGMIIBBQYLKoZIhvcNAQkQAgsxgfWggfIwgd0xCzAJBgNV BAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3Qg TmV0d29yazE7MDkGA1UECxMyVGVybXMgb2YgdXNlIGF0IGh0dHBzOi8vd3d3LnZlcmlzaWduLmNv bS9ycGEgKGMpMDkxHjAcBgNVBAsTFVBlcnNvbmEgTm90IFZhbGlkYXRlZDE3MDUGA1UEAxMuVmVy aVNpZ24gQ2xhc3MgMSBJbmRpdmlkdWFsIFN1YnNjcmliZXIgQ0EgLSBHMwIQMb55jsGHPqEOxIg8 IwlhRjANBgkqhkiG9w0BAQEFAASCAQCnD4tpq3ug3KMnDLlYTrIqc6jv8qFsg8dizJXD44Kw4cbd km+bVtRc3Deeh1rGIcg/1ankkwaTP94THtZeBRad1cndDATvxPEEkMEMq39PJFxRPt/YLFiD27yR R4I6ZW4TvxQBSechSeB/aFr8LzTFMXf2iCE1Fv4ian+Hn54Ajehy0y4bOkxMyVfD/HiEowEUXBFw rDFE/PQlR3DnFkNDkXjtPuTYoBijP6++P0bYSaR9RcsH8BPNK4YdQYok0hVk1YaODpwCFXJX374a gYLYskyifRw6YxEHSBcaQ13jn0qXM12piV52ylAI6o4uLMa1N2K/YcpfRfOmrOeXaDPfAAAAAAAA --Apple-Mail=_34CDEAF5-C223-4E47-AE79-8F8E3B590F9B-- From rlb@ipv.sx Wed Mar 20 08:15:23 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E022621F8825 for ; Wed, 20 Mar 2013 08:15:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.588 X-Spam-Level: X-Spam-Status: No, score=-1.588 tagged_above=-999 required=5 tests=[AWL=-0.278, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1, SARE_HTML_USL_OBFU=1.666] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id a58reX7bqh8q for ; Wed, 20 Mar 2013 08:15:23 -0700 (PDT) Received: from mail-oa0-f51.google.com (mail-oa0-f51.google.com [209.85.219.51]) by ietfa.amsl.com (Postfix) with ESMTP id 116CE21F8623 for ; Wed, 20 Mar 2013 08:15:23 -0700 (PDT) Received: by mail-oa0-f51.google.com with SMTP id h2so1882452oag.24 for ; Wed, 20 Mar 2013 08:15:22 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:x-received:x-originating-ip:in-reply-to:references :date:message-id:subject:from:to:cc:content-type:x-gm-message-state; bh=S88plY4r5dYE68YC7dx0uecGakEI/BctN5LiUh86vWQ=; b=YShaIcoAXptjqPmjn/moTMPIdJzdW4qEMqjKoeQIW2Oa/7wLRfR3duKtYQyT/8KlXw NR3JwxqyhcrZdMDO7NJDYOWFgeSRnoIeOxuWKiXJuZqQ1J4/UVXJtrG3RFlxm2AxXcMA rTEumnWlZCRiGLos2CK60Q6HfDWEyuDb5BJ3TBoOFQWnI0PEX8EmqwkeDrtIz0lsvcH+ G04Ep3TG04DqWoRT7u/wjn+fEEsDxuyyhIEB+ykcxdHXqwYI3j4XubuYLZVUZlBEqtHs OIMkjDSpjTSuZ7wLhwcJ7ezuEZISIYFYDxQ6tNfYe96Dg817kI27rE5G6z0hDHmQ9HmF QV5g== MIME-Version: 1.0 X-Received: by 10.60.172.80 with SMTP id ba16mr4402878oec.116.1363792522302; Wed, 20 Mar 2013 08:15:22 -0700 (PDT) Received: by 10.60.40.233 with HTTP; Wed, 20 Mar 2013 08:15:22 -0700 (PDT) X-Originating-IP: [192.1.51.16] In-Reply-To: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> Date: Wed, 20 Mar 2013 11:15:22 -0400 Message-ID: From: Richard Barnes To: Danny McPherson Content-Type: multipart/alternative; boundary=bcaec5523bb6d7363a04d85cb023 X-Gm-Message-State: ALoCoQnhCxsV8PlSzLJHFNC+CulNvaFMwfmTNDHJtVq05+XQKlJGYyvdF0DOnpNikEcv1KlfAVta Cc: sidr@ietf.org Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 15:15:24 -0000 --bcaec5523bb6d7363a04d85cb023 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable Hey Danny, I read the paper. Maybe it's that I'm missing the voice-over for the slides, but I don't really see anything new here. Every new security mechanism creates a new DOS possibility. If you screw up your HTTPS cert or your CA revokes it, your website goes down. This happens because only hard failures can provide real security guarantees. As the presentation notes, soft failure produces vulnerability -- a "depref invalid" policy allows sub-prefix hijacking. One other thing to note is that manipulation is indistinguishable from legitimate revocation, at a technical level. So the only solution here is at the human layer, for RPKI relying party software to have operator overrides. Randy stated this better than I at a RIPE meeting many moons ago -- with the RPKI, we're automatically handling a common error (hijacks and fat-fingers) at the expense of having to deal manually with an uncommon error (manipulation). --Richard On Wed, Mar 20, 2013 at 8:50 AM, Danny McPherson wrote: > > Interesting presentation here: > > http://www.cs.bu.edu/~goldbe/**papers/Cooper_RPKI_BFOC.pdf > > "The RPKI (Resource Public Key Infrastructure) is a new infrastructure to > secure Internet routing > It=92s been in deployment since ~2011 But, it also creates new risks > (misconfigurations and takedowns) > that could make IP prefixes unreachable" > > Given we've been concerned (and vocal) about this from an operational > perspective since RPKI's proposed "tight coupling" into BGPSEC discussion= s > many years ago... > > -danny > > ______________________________**_________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/**listinfo/sidr > --bcaec5523bb6d7363a04d85cb023 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: quoted-printable Hey Danny,

I read the paper. =A0Maybe it's that I= 9;m missing the voice-over for the slides, but I don't really see anyth= ing new here. =A0Every new security mechanism creates a new DOS possibility= . =A0If you screw up your HTTPS cert or your CA revokes it, your website go= es down. =A0This happens because only hard failures can provide real securi= ty guarantees. =A0As the presentation notes, soft failure produces vulnerab= ility -- a "depref invalid" policy allows sub-prefix hijacking.

One other thing to note is that manipulation is indisti= nguishable from legitimate revocation, at a technical level. =A0So the only= solution here is at the human layer, for RPKI relying party software to ha= ve operator overrides. =A0Randy stated this better than I at a RIPE meeting= many moons ago -- with the RPKI, we're automatically handling a common= error (hijacks and fat-fingers) at the expense of having to deal manually = with an uncommon error (manipulation).

--Richard



<= br>
On Wed, Mar 20, 2013 at 8:50 AM, Danny McPher= son <danny@tcb.net> wrote:

Interesting presentation here:

http://www.cs.bu.edu/~goldbe/papers/Cooper_RPKI_BFOC.pdf=

"The RPKI (Resource Public Key Infrastructure) is a new infrastructure= to secure Internet routing
It=92s been in deployment since ~2011 But, it also creates new risks (misco= nfigurations and takedowns)
that could make IP prefixes unreachable"

Given we've been concerned (and vocal) about this from an operational p= erspective since RPKI's proposed "tight coupling" into BGPSEC= discussions many years ago...

-danny

_______________________________________________
sidr mailing list
sidr@ietf.org
ht= tps://www.ietf.org/mailman/listinfo/sidr

--bcaec5523bb6d7363a04d85cb023-- From danny@tcb.net Wed Mar 20 08:21:22 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A4B4121F8FE9 for ; Wed, 20 Mar 2013 08:21:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.437 X-Spam-Level: X-Spam-Status: No, score=-100.437 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2TWRqcCmrm1b for ; Wed, 20 Mar 2013 08:21:21 -0700 (PDT) Received: from mail.friendswithtools.org (unknown [64.78.239.70]) by ietfa.amsl.com (Postfix) with ESMTP id F070D21F8FE6 for ; Wed, 20 Mar 2013 08:21:20 -0700 (PDT) Received: from dspam (unknown [127.0.0.1]) by mail.friendswithtools.org (Postfix) with SMTP id 926E2300021 for ; Wed, 20 Mar 2013 15:21:20 +0000 (UTC) Received: from mail2.tcb.net (localhost [127.0.0.1]) by mail.friendswithtools.org (Postfix) with ESMTP id 2EEC2300013; Wed, 20 Mar 2013 09:21:20 -0600 (MDT) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Date: Wed, 20 Mar 2013 09:21:20 -0600 From: Danny McPherson To: "Roque Gagliano (rogaglia)" In-Reply-To: References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> Message-ID: X-Sender: danny@tcb.net User-Agent: Roundcube Webmail/0.8.2 X-DSPAM-Result: Whitelisted X-DSPAM-Processed: Wed Mar 20 09:21:20 2013 X-DSPAM-Confidence: 0.9899 X-DSPAM-Improbability: 1 in 9809 chance of being spam X-DSPAM-Probability: 0.0000 X-DSPAM-Signature: 5149d3f042073006414164 X-DSPAM-Factors: 27, Subject*Princeton+#+#+IP, 0.01000, Subject*IP+#+Reachability, 0.01000, as+an, 0.01000, Subject*Impacting+#+#+Reachability, 0.01000, Subject*University+#+#+Address, 0.01000, Subject*Princeton+#+#+#+Address, 0.01000, Subject*University+Impacting, 0.01000, it+#+to, 0.01000, the+#+of, 0.01000, do+not, 0.01000, the+#+#+#+is, 0.01000, From*Danny+#+danny, 0.01000, Subject*Princeton+#+Impacting, 0.01000, From*Danny+#+#+tcb.net, 0.01000, Subject*IP+Address, 0.01000, to+#+that, 0.01000, Subject*Re+sidr, 0.01000, I+#+#+#+to, 0.01000, From*Danny+McPherson, 0.01000, On+#+03, 0.01000, Subject*University+#+#+#+Reachability, 0.01000, Cc*sidr+ietf.org, 0.01000, the+#+#+#+a, 0.01000, a+#+of, 0.01000, a+#+of, 0.01000, Subject*via+RPKI, 0.01000, Subject*University+#+IP, 0.01000 Cc: sidr@ietf.org Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 15:21:22 -0000 On 2013-03-20 09:00, Roque Gagliano (rogaglia) wrote: > I do not believe the work has been peer-reviewed and I detected a > couple of bizarre statements (such as deleting an object = revocation > or the idea of "overwriting" a ROA to replace an existing one). Much of the work presented here is not "peer reviewed'. Paper is here: http://www.cs.bu.edu/~goldbe/papers/RPKImanip.html I'm sure the authors would welcome comments. > What I believe it adds to our work are a number of scenarios on how > to implement grand-parenting (not all valid) if we ever decide to > take > that problem. > > What specific finding(s) concerns you? The general observation as an operator that this would potentially impact my operations (and reachability to my peers, etc..) but is outside of my control, and that sufficient buffers are required here. Nothing new, just another datapoint for folks with various perspectives.. -danny From danny@tcb.net Wed Mar 20 08:24:32 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2889121F8FA1 for ; Wed, 20 Mar 2013 08:24:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.437 X-Spam-Level: X-Spam-Status: No, score=-100.437 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id etzjyeNDREJ4 for ; Wed, 20 Mar 2013 08:24:31 -0700 (PDT) Received: from mail.friendswithtools.org (unknown [64.78.239.70]) by ietfa.amsl.com (Postfix) with ESMTP id B529121F8F9E for ; Wed, 20 Mar 2013 08:24:31 -0700 (PDT) Received: from dspam (unknown [127.0.0.1]) by mail.friendswithtools.org (Postfix) with SMTP id 80135300015 for ; Wed, 20 Mar 2013 15:24:31 +0000 (UTC) Received: from mail2.tcb.net (localhost [127.0.0.1]) by mail.friendswithtools.org (Postfix) with ESMTP id 580B7300013; Wed, 20 Mar 2013 09:24:31 -0600 (MDT) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Date: Wed, 20 Mar 2013 09:24:31 -0600 From: Danny McPherson To: Richard Barnes In-Reply-To: References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> Message-ID: X-Sender: danny@tcb.net User-Agent: Roundcube Webmail/0.8.2 X-DSPAM-Result: Whitelisted X-DSPAM-Processed: Wed Mar 20 09:24:31 2013 X-DSPAM-Confidence: 0.9899 X-DSPAM-Improbability: 1 in 9809 chance of being spam X-DSPAM-Probability: 0.0000 X-DSPAM-Signature: 5149d4af42071480826719 X-DSPAM-Factors: 27, the+#+#+#+to, 0.01000, Subject*sidr+#+University, 0.01000, Subject*Princeton+#+#+IP, 0.01000, Subject*IP+#+Reachability, 0.01000, as+an, 0.01000, Subject*Impacting+#+#+Reachability, 0.01000, for+the, 0.01000, Subject*RPKI+Manipulations, 0.01000, Subject*University+#+#+Address, 0.01000, Subject*Princeton+#+#+#+Address, 0.01000, Subject*sidr+#+#+#+IP, 0.01000, Subject*University+Impacting, 0.01000, Subject*via+#+Manipulations, 0.01000, the+#+of, 0.01000, the+#+#+#+is, 0.01000, From*Danny+#+danny, 0.01000, Subject*Princeton+#+Impacting, 0.01000, From*Danny+#+#+tcb.net, 0.01000, Subject*sidr+#+#+Impacting, 0.01000, Subject*IP+Address, 0.01000, Subject*Re+sidr, 0.01000, From*Danny+McPherson, 0.01000, On+#+03, 0.01000, Subject*University+#+#+#+Reachability, 0.01000, Cc*sidr+ietf.org, 0.01000, Subject*via+RPKI, 0.01000, Subject*University+#+IP, 0.01000 Cc: sidr@ietf.org Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 15:24:32 -0000 On 2013-03-20 09:15, Richard Barnes wrote: > > One other thing to note is that manipulation is indistinguishable > from legitimate revocation, at a technical level.  So the only > solution here is at the human layer, for RPKI relying party software > to have operator overrides.  Randy stated this better than I at a > RIPE > meeting many moons ago -- with the RPKI, we're automatically handling > a common error (hijacks and fat-fingers) at the expense of having to > deal manually with an uncommon error (manipulation). Yeh, I understand. I'm saying as an operator this continues to concern me. Just a datapoint for the WG. Take it or leave it.. -danny From russw@riw.us Wed Mar 20 08:45:31 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6C9D411E80A2 for ; Wed, 20 Mar 2013 08:45:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mPTIqFSKvcqS for ; Wed, 20 Mar 2013 08:45:31 -0700 (PDT) Received: from da31.namelessnet.net (da31.namelessnet.net [74.124.205.66]) by ietfa.amsl.com (Postfix) with ESMTP id DEA5911E809C for ; Wed, 20 Mar 2013 08:45:30 -0700 (PDT) Received: from cpe-098-122-147-095.nc.res.rr.com ([98.122.147.95] helo=[192.168.100.75]) by da31.namelessnet.net with esmtpa (Exim 4.80) (envelope-from ) id 1UILCk-0001KB-Bn for sidr@ietf.org; Wed, 20 Mar 2013 08:45:30 -0700 Message-ID: <5149D9A2.7030107@riw.us> Date: Wed, 20 Mar 2013 11:45:38 -0400 From: Russ White User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: sidr@ietf.org References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> <5149C506.7080001@gmail.com> In-Reply-To: <5149C506.7080001@gmail.com> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit X-Antivirus-Scanner: Seems clean. You should still use an Antivirus Scanner Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 15:45:31 -0000 > I agree with John's observations. We need to stop making the statement > "no roa == no route", because it's simply not true. There's something I probably don't understand here... 1. SIDR's ROA/RPKI infrastructure is designed to provide security for route origination. 2. Security for route origination means that you shouldn't be able to advertise routes unless someone in the infrastructure (other than you) has stated (publicly through a signed certificate) "this is a valid route." 3. But... If there's no certificate for a route, it's perfectly fine to advertise it and route to it. It seems, to me, that if the RPKI can't be used to actually validate who owns what route with certainty, we're going to a lot of trouble for nothing... Or maybe folks are trying to have their cake and eat it to. "We'll provide solid security which you can ignore if you like, no problem." I know this goes back to the difference between "unknown," and "invalid," but if all address space which no-one actually claims is open for whatever use anyone wants, then are we really making any progress in any meaningful way? Just a thought... :-) Russ From rogaglia@cisco.com Wed Mar 20 08:58:14 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A58A121F8FE2 for ; Wed, 20 Mar 2013 08:58:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.599 X-Spam-Level: X-Spam-Status: No, score=-10.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EDZRoVFfEpYQ for ; Wed, 20 Mar 2013 08:58:09 -0700 (PDT) Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by ietfa.amsl.com (Postfix) with ESMTP id 6FAA721F8FE3 for ; Wed, 20 Mar 2013 08:58:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=7563; q=dns/txt; s=iport; t=1363795087; x=1365004687; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=dQWPthbbKp5KbjQOa/jCYU1U/6S6U7IBgVLyOet9vLs=; b=kLiN8nugKRoJQADGmX//JA0BHE3v8NlKrbqYdk+ahClOshShGgQzi31j +JTGa9uUkIgqqVdb7d72Le3WEtyBOje6w8fPN6vYtlrWn78l2wD+UjKMy xW5HyIPzF2qco52GR3dSh4Lm2nb5Vz4Pp8ZnjTbxfW9rFk+B87+xbvqQm A=; X-Files: smime.p7s : 4389 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AgEFAGXbSVGtJXHB/2dsb2JhbABDFsUFgU8WdIIkAQEBAwF5BQsCAQgYCiQCMCUCBA4FCAaIAAYMwmmOXhYbAgWCX2EDjz2BKJZ9gVSBNoIo X-IronPort-AV: E=Sophos;i="4.84,879,1355097600"; d="p7s'?scan'208";a="189570046" Received: from rcdn-core2-6.cisco.com ([173.37.113.193]) by rcdn-iport-5.cisco.com with ESMTP; 20 Mar 2013 15:58:07 +0000 Received: from xhc-rcd-x01.cisco.com (xhc-rcd-x01.cisco.com [173.37.183.75]) by rcdn-core2-6.cisco.com (8.14.5/8.14.5) with ESMTP id r2KFw68c020868 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Wed, 20 Mar 2013 15:58:07 GMT Received: from xmb-rcd-x02.cisco.com ([169.254.4.47]) by xhc-rcd-x01.cisco.com ([173.37.183.75]) with mapi id 14.02.0318.004; Wed, 20 Mar 2013 10:58:06 -0500 From: "Roque Gagliano (rogaglia)" To: Danny McPherson Thread-Topic: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations Thread-Index: AQHOJXux2KKxpXO3jkWkjfgIBpzqcA== Date: Wed, 20 Mar 2013 15:58:06 +0000 Message-ID: References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [10.61.104.251] Content-Type: multipart/signed; boundary="Apple-Mail=_AB880E88-1F8F-4629-974A-B9664562D1C7"; protocol="application/pkcs7-signature"; micalg=sha1 MIME-Version: 1.0 Cc: "" Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 15:58:15 -0000 --Apple-Mail=_AB880E88-1F8F-4629-974A-B9664562D1C7 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii inline. On Mar 20, 2013, at 4:21 PM, Danny McPherson wrote: > On 2013-03-20 09:00, Roque Gagliano (rogaglia) wrote: >=20 >> I do not believe the work has been peer-reviewed and I detected a >> couple of bizarre statements (such as deleting an object =3D = revocation >> or the idea of "overwriting" a ROA to replace an existing one). >=20 > Much of the work presented here is not "peer reviewed'. Paper is = here: >=20 > http://www.cs.bu.edu/~goldbe/papers/RPKImanip.html >=20 > I'm sure the authors would welcome comments. >=20 >> What I believe it adds to our work are a number of scenarios on how >> to implement grand-parenting (not all valid) if we ever decide to = take >> that problem. >>=20 >> What specific finding(s) concerns you? >=20 > The general observation as an operator that this would potentially = impact my operations (and reachability to my peers, etc..) but is = outside of my control, and that sufficient buffers are required here. = Nothing new, just another datapoint for folks with various = perspectives.. >=20 got it.=20 Roque > -danny >=20 >=20 >=20 >=20 --Apple-Mail=_AB880E88-1F8F-4629-974A-B9664562D1C7 Content-Disposition: attachment; filename="smime.p7s" Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIMXDCCBWYw ggROoAMCAQICEDG+eY7Bhz6hDsSIPCMJYUYwDQYJKoZIhvcNAQEFBQAwgd0xCzAJBgNVBAYTAlVT MRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29y azE7MDkGA1UECxMyVGVybXMgb2YgdXNlIGF0IGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9ycGEg KGMpMDkxHjAcBgNVBAsTFVBlcnNvbmEgTm90IFZhbGlkYXRlZDE3MDUGA1UEAxMuVmVyaVNpZ24g Q2xhc3MgMSBJbmRpdmlkdWFsIFN1YnNjcmliZXIgQ0EgLSBHMzAeFw0xMjA1MDgwMDAwMDBaFw0x MzA1MTEyMzU5NTlaMIIBEzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlT aWduIFRydXN0IE5ldHdvcmsxRjBEBgNVBAsTPXd3dy52ZXJpc2lnbi5jb20vcmVwb3NpdG9yeS9S UEEgSW5jb3JwLiBieSBSZWYuLExJQUIuTFREKGMpOTgxHjAcBgNVBAsTFVBlcnNvbmEgTm90IFZh bGlkYXRlZDEzMDEGA1UECxMqRGlnaXRhbCBJRCBDbGFzcyAxIC0gTmV0c2NhcGUgRnVsbCBTZXJ2 aWNlMRcwFQYDVQQDFA5Sb3F1ZSBHYWdsaWFubzEhMB8GCSqGSIb3DQEJARYScm9nYWdsaWFAY2lz Y28uY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs+CGyKUNmmBJ4PgQDVA8hF5E ByrcJ8BQ2C8mSv3vSZqCZNXAyte/JRsl11BJmqwdLiH6baDaJbBKRzNFfaf8Wwe8aS3QvqpHfKtU pYvn+EKseVnXsIKssRV2AwNODN6VMwSA72Jiolo3z4xeoeLw9X/CnFYTJa4AcGM1LKk+rMGTQlly XXl+qc7LeAd+wk7bKsUFmg4uCfvCDhVSQj25S5tnmFl5WPGD2u7QEa2WLkkL5nH+BEedZmRejRgP smmAxDfBX1FVTnCOgz75hNFlrnkYJfPCXLRyfPHvaIGP/NBz6TJbwB3YZSweYHxWAEMglqgRvqIW 3Tr5k5x9yyNYVQIDAQABo4HoMIHlMAkGA1UdEwQCMAAwRAYDVR0gBD0wOzA5BgtghkgBhvhFAQcX ATAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy52ZXJpc2lnbi5jb20vcnBhMAsGA1UdDwQEAwIF oDAdBgNVHSUEFjAUBggrBgEFBQcDBAYIKwYBBQUHAwIwFAYKYIZIAYb4RQEGBwQGFgROb25lMFAG A1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9pbmRjMWRpZ2l0YWxpZC1nMy1jcmwudmVyaXNpZ24uY29t L0luZEMxRGlnaXRhbElELUczLmNybDANBgkqhkiG9w0BAQUFAAOCAQEAuFfFZrObA9gprpHyG6cq O4UZjtN5/moV6mUYbt+ffGrXMbVt06vgnba7r6ldS5eWPQZZQtAAKKqweAmZY37ZcvVQwDsMXOMG 4+MN60sPVKwrrSQz9xXcImVCzBxFsq22S4el6pGx38xytsPgKw4cs8ZVxPLEjZtcOGnl8R8fak2g WyAMt8zkIxu/84zcobhcY5EEPJxYg9WKHi617fD6/jjQqvwvW4zi2XkIjw+HpZSwdPxk2+Cg6id4 SS6WlTwe90rdJmRrCP4gTXyJOdARR7hJU714lamn9QdQuPX7WLJXuMmoyrhvZZUeHpvodO/eNiO2 KvxMUu0uXWiDcDgTvzCCBu4wggXWoAMCAQICEHEVZgVK5JEhTem8RPms09wwDQYJKoZIhvcNAQEF BQAwgcoxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVy aVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDE5OTkgVmVyaVNpZ24sIEluYy4gLSBG b3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3MgMSBQdWJsaWMg UHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEczMB4XDTA5MDUwMTAwMDAwMFoXDTE5 MDQzMDIzNTk1OVowgd0xCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0G A1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE7MDkGA1UECxMyVGVybXMgb2YgdXNlIGF0IGh0 dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9ycGEgKGMpMDkxHjAcBgNVBAsTFVBlcnNvbmEgTm90IFZh bGlkYXRlZDE3MDUGA1UEAxMuVmVyaVNpZ24gQ2xhc3MgMSBJbmRpdmlkdWFsIFN1YnNjcmliZXIg Q0EgLSBHMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAO3ER98qKB18Bmu71yEyyWwT j+mxjUFONPfaC+Nq+mWIIAsRE+mb4ElOi2/VAdBfDUeRilpMdD4/xpEJu0w0no1uoYJRYvdpdliW B6+eFBgHT1q9n9IxslQZc0ZqGUIR7BJzIY313DDN5dlWCjHFNm0pFJe9LdqJRxmI2EsEPeu2PGce dAATDdCG2pNn+DMDrho8a2l49sAsjuGDP3f5mf/+n1JawrSHCthsqUfBVCllQz5KwJYfwa33d69s sQRevsG2lC2XkC0n0rse6YNqhPbEsq4jBmUmpSdYKwcitG+mYkgad/LVUCeaKdOW+yj1uiR2YuOM Wev7btVCxL5Bx/UCAwEAAaOCArkwggK1MDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0 cDovL29jc3AudmVyaXNpZ24uY29tMBIGA1UdEwEB/wQIMAYBAf8CAQAwcAYDVR0gBGkwZzBlBgtg hkgBhvhFAQcXATBWMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy52ZXJpc2lnbi5jb20vY3BzMCoG CCsGAQUFBwICMB4aHGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9ycGEwNAYDVR0fBC0wKzApoCeg JYYjaHR0cDovL2NybC52ZXJpc2lnbi5jb20vcGNhMS1nMy5jcmwwDgYDVR0PAQH/BAQDAgEGMG4G CCsGAQUFBwEMBGIwYKFeoFwwWjBYMFYWCWltYWdlL2dpZjAhMB8wBwYFKw4DAhoEFEtruSiWBgy7 0FI4mymsSweLIQUYMCYWJGh0dHA6Ly9sb2dvLnZlcmlzaWduLmNvbS92c2xvZ28xLmdpZjAuBgNV HREEJzAlpCMwITEfMB0GA1UEAxMWUHJpdmF0ZUxhYmVsNC0yMDQ4LTExODAdBgNVHQ4EFgQUeUdh CEH9OASiS+e1zPVD9kkrEfgwgfEGA1UdIwSB6TCB5qGB0KSBzTCByjELMAkGA1UEBhMCVVMxFzAV BgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTow OAYDVQQLEzEoYykgMTk5OSBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5 MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAxIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24g QXV0aG9yaXR5IC0gRzOCEQCLW3VWhFSFCwDPrzhIzrGkMA0GCSqGSIb3DQEBBQUAA4IBAQA5Tc9B mYG1qQW1UjjpOYSJbOQ0qFrn2GwJTCQaulmkhztzIfGTgc+/aGNaZ/41hSuhw12jSsI6Gd0w1sxN 7/HSgZfKVFpDvzeLeo4ZjQ9DqIzyr2CzFYqzlZw84J6zJ5ikNXIX5fwqXYfTig3C0UUq+MD0rCqT OtWuEnAI6/s74nfs6CtkNXbNutrg0csU1nFYm77VPn222egkxSRmTF2RH3azFz5/DcYhiS+zN7ih /1yybUneZVJC+w6I0u1KHb9L4/jMcvpIDmWOScjW+JmYO7eUPjFxBof6bFlTLtffK+1fYwCsFe0D uFUWjMZoA+ciqHMLsbyg2lJY3QoOf8GCMYIEizCCBIcCAQEwgfIwgd0xCzAJBgNVBAYTAlVTMRcw FQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE7 MDkGA1UECxMyVGVybXMgb2YgdXNlIGF0IGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9ycGEgKGMp MDkxHjAcBgNVBAsTFVBlcnNvbmEgTm90IFZhbGlkYXRlZDE3MDUGA1UEAxMuVmVyaVNpZ24gQ2xh c3MgMSBJbmRpdmlkdWFsIFN1YnNjcmliZXIgQ0EgLSBHMwIQMb55jsGHPqEOxIg8IwlhRjAJBgUr DgMCGgUAoIICbTAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xMzAz MjAxNTU4MDNaMCMGCSqGSIb3DQEJBDEWBBQqLM3RACYc4/6bG+VKNdKkyw1upzCCAQMGCSsGAQQB gjcQBDGB9TCB8jCB3TELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYD VQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2UgYXQgaHR0 cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykwOTEeMBwGA1UECxMVUGVyc29uYSBOb3QgVmFs aWRhdGVkMTcwNQYDVQQDEy5WZXJpU2lnbiBDbGFzcyAxIEluZGl2aWR1YWwgU3Vic2NyaWJlciBD QSAtIEczAhAxvnmOwYc+oQ7EiDwjCWFGMIIBBQYLKoZIhvcNAQkQAgsxgfWggfIwgd0xCzAJBgNV BAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3Qg TmV0d29yazE7MDkGA1UECxMyVGVybXMgb2YgdXNlIGF0IGh0dHBzOi8vd3d3LnZlcmlzaWduLmNv bS9ycGEgKGMpMDkxHjAcBgNVBAsTFVBlcnNvbmEgTm90IFZhbGlkYXRlZDE3MDUGA1UEAxMuVmVy aVNpZ24gQ2xhc3MgMSBJbmRpdmlkdWFsIFN1YnNjcmliZXIgQ0EgLSBHMwIQMb55jsGHPqEOxIg8 IwlhRjANBgkqhkiG9w0BAQEFAASCAQCLEtUW0wmUW1dXpiG2qO3wS7p563DaWE1TvSyjVcCSCDHe 33hzWFUHflzxNSB92Jf9crUdqmrwvl8jxQqj0uunFWzaWgmoRucsUycmNZUmkFeTWYmQvVDjLdML 5X35e3S5MeMiynCzb9G3Qpvwsp5A3IGCs9lbLKsIvoKSl3z8u/c0tzkFO5/cXPAK48JH7bWVscbE Kh6buiz9ENAIXij9D8WZDincFujgW/KCS+3CTCRdDFLe4Z6bwtzR5xrCb9Nr2lxyzagmrBoTy/4n BZCO3URkLXf3+1+gRfPvlRZCrC4Nwpb1UIogOFmXz6701LbhIYnnM78MV6TJXjHHIdTtAAAAAAAA --Apple-Mail=_AB880E88-1F8F-4629-974A-B9664562D1C7-- From jakob.heitz@ericsson.com Wed Mar 20 12:01:23 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B86D821F909C for ; Wed, 20 Mar 2013 12:01:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.524 X-Spam-Level: X-Spam-Status: No, score=-2.524 tagged_above=-999 required=5 tests=[AWL=0.075, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YYpQ3FC41dhu for ; Wed, 20 Mar 2013 12:01:23 -0700 (PDT) Received: from usevmg21.ericsson.net (usevmg21.ericsson.net [198.24.6.65]) by ietfa.amsl.com (Postfix) with ESMTP id 2241E21F90A8 for ; Wed, 20 Mar 2013 12:01:19 -0700 (PDT) X-AuditID: c6180641-b7faf6d00000096b-e0-514a077ea2e4 Received: from EUSAAHC005.ericsson.se (Unknown_Domain [147.117.188.87]) by usevmg21.ericsson.net (Symantec Mail Security) with SMTP id 97.A9.02411.E770A415; Wed, 20 Mar 2013 20:01:18 +0100 (CET) Received: from EUSAAMB109.ericsson.se ([147.117.188.126]) by EUSAAHC005.ericsson.se ([147.117.188.87]) with mapi id 14.02.0318.004; Wed, 20 Mar 2013 15:01:18 -0400 From: Jakob Heitz To: Russ White , "sidr@ietf.org" Thread-Topic: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations Thread-Index: AQHOJXW+KmCVIZxJKkGBjQ60Y5UfC5iu/BIA///yzfA= Date: Wed, 20 Mar 2013 19:01:17 +0000 Message-ID: <2F3EBB88EC3A454AAB08915FBF0B8C7E1D01BA@eusaamb109.ericsson.se> References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> <5149C506.7080001@gmail.com> <5149D9A2.7030107@riw.us> In-Reply-To: <5149D9A2.7030107@riw.us> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [147.117.188.134] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFjrILMWRmVeSWpSXmKPExsUyuXRPuG4du1egwY+V+hbr5h5gt1g26Tyj A5PHkiU/mTxOP5zMHsAUxWWTkpqTWZZapG+XwJWx8ecrxoI27or5f54wNTA+5Ohi5OCQEDCR eLe2pouRE8gUk7hwbz1bFyMXh5DAEUaJgzenQznLGSV+7V3KClLFJqAj8e16FzOILSJgJ7Hr x1ywuLBAqsS5mz1sEPE0iUX3PzNC2FYSU7Y/AKthEVCVmPBqIhOIzSvgLXH23n92EFtIYDGj RGOPDIjNKaAmMX9PD1g9I9BF30+tAatnFhCXuPVkPhPEpQISS/acZ4awRSVePv7HCmErSyx5 sp8Fol5HYsHuT2wQtrbEsoWvmSH2CkqcnPmEZQKj6CwkY2chaZmFpGUWkpYFjCyrGDlKi1PL ctONDDcxAqPhmASb4w7GBZ8sDzFKc7AoifOGul4IEBJITyxJzU5NLUgtii8qzUktPsTIxMEp 1cDoGXVbkkX2uUZFTqGd8ZPTsUsD+MzP2HasVBe73v/V6Om/q19bf9/e2BK8adLG0/sU5Hvj F3ebrLpqbNAbnmFhvcp5dcrjw9pdWXoTOT45scQUr+R76OxUUc0QknjvuqP56pU/RJPD1p1l uuXwfOay4IZzFp5Lpt7ITor+9dbtWJfL7ZOMWXeUWIozEg21mIuKEwEDnjj/VAIAAA== Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 19:01:23 -0000 On , Russ White <> wrote: >> I agree with John's observations. We need to stop making the >> statement "no roa =3D=3D no route", because it's simply not true. >=20 > There's something I probably don't understand here... >=20 > 1. SIDR's ROA/RPKI infrastructure is designed to provide security for > route origination.=20 >=20 > 2. Security for route origination means that you shouldn't be able to > advertise routes unless someone in the infrastructure (other than you) > has stated (publicly through a signed certificate) "this is a > valid route." >=20 > 3. But... If there's no certificate for a route, it's > perfectly fine to > advertise it and route to it. >=20 > It seems, to me, that if the RPKI can't be used to actually > validate who > owns what route with certainty, we're going to a lot of trouble for > nothing... Or maybe folks are trying to have their cake and eat it to. > "We'll provide solid security which you can ignore if you like, no > problem."=20 >=20 > I know this goes back to the difference between "unknown," and > "invalid," but if all address space which no-one actually > claims is open > for whatever use anyone wants, then are we really making any > progress in > any meaningful way? There is a difference. Invalid: someone is certified to own it and someone ELSE is originating. Unknown: No one is certified owner. --=20 Jakob Heitz. From russw@riw.us Wed Mar 20 12:09:57 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1AC8911E80EF for ; Wed, 20 Mar 2013 12:09:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iXrJHn5A53vG for ; Wed, 20 Mar 2013 12:09:56 -0700 (PDT) Received: from da31.namelessnet.net (da31.namelessnet.net [74.124.205.66]) by ietfa.amsl.com (Postfix) with ESMTP id A0AA611E80EE for ; Wed, 20 Mar 2013 12:09:56 -0700 (PDT) Received: from cpe-098-122-147-095.nc.res.rr.com ([98.122.147.95] helo=[192.168.100.75]) by da31.namelessnet.net with esmtpa (Exim 4.80) (envelope-from ) id 1UIOOZ-0007Oc-LI; Wed, 20 Mar 2013 12:09:55 -0700 Message-ID: <514A098C.3040502@riw.us> Date: Wed, 20 Mar 2013 15:10:04 -0400 From: Russ White User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: Jakob Heitz References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> <5149C506.7080001@gmail.com> <5149D9A2.7030107@riw.us> <2F3EBB88EC3A454AAB08915FBF0B8C7E1D01BA@eusaamb109.ericsson.se> In-Reply-To: <2F3EBB88EC3A454AAB08915FBF0B8C7E1D01BA@eusaamb109.ericsson.se> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Antivirus-Scanner: Seems clean. You should still use an Antivirus Scanner Cc: "sidr@ietf.org" Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 19:09:57 -0000 > There is a difference. > Invalid: someone is certified to own it and someone ELSE is originating. > Unknown: No one is certified owner. Yes, I know that --but when someone says this: > I agree with John's observations. We need to stop making the > statement "no roa == no route", because it's simply not true. In response to a paper that says removing ROAs is a form of DoS, or that there are potential problems in the space of the relationship between the registry and the address owner, then we've moved from "unknown," to "contested." The response given essentially says, "don't worry about attacks, because in the case of attacks, we'll just ignore those ROA thingies." If that's the case, then why bother with the ROAs in the first place? Again, you can't have your cake and eat it too... Either ROAs mean something, and attacks against the ROA system are a real threat, or the attacks are not worth worrying about --in which case, the ROAs themselves don't mean anything from day one. :-) Russ From jcurran@istaff.org Wed Mar 20 12:41:59 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1BF0A11E80CC for ; Wed, 20 Mar 2013 12:41:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KF5DQCRVRnFq for ; Wed, 20 Mar 2013 12:41:58 -0700 (PDT) Received: from mho-01-ewr.mailhop.org (mho-03-ewr.mailhop.org [204.13.248.66]) by ietfa.amsl.com (Postfix) with ESMTP id A08E211E80ED for ; Wed, 20 Mar 2013 12:41:54 -0700 (PDT) Received: from ip-64-134-156-35.public.wayport.net ([64.134.156.35] helo=[192.168.5.48]) by mho-01-ewr.mailhop.org with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.72) (envelope-from ) id 1UIOtU-000PcN-7C; Wed, 20 Mar 2013 19:41:52 +0000 X-Mail-Handler: Dyn Standard SMTP by Dyn X-Originating-IP: 64.134.156.35 X-Report-Abuse-To: abuse@dyndns.com (see http://www.dyndns.com/services/sendlabs/outbound_abuse.html for abuse reporting information) X-MHO-User: U2FsdGVkX1/GuSpaX70wpScsoiprhcOS Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 6.3 \(1503\)) From: John Curran In-Reply-To: <514A098C.3040502@riw.us> Date: Wed, 20 Mar 2013 13:41:51 -0600 Content-Transfer-Encoding: 7bit Message-Id: <4B7D7C8E-273F-44DA-A705-0EB88E6459B4@istaff.org> References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> <5149C506.7080001@gmail.com> <5149D9A2.7030107@riw.us> <2F3EBB88EC3A454AAB08915FBF0B8C7E1D01BA@eusaamb109.ericsson.se> <514A098C.3040502@riw.us> To: Russ White X-Mailer: Apple Mail (2.1503) Cc: "sidr@ietf.org" Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 19:41:59 -0000 On Mar 20, 2013, at 1:10 PM, Russ White wrote: > In response to a paper that says removing ROAs is a form of DoS, or that > there are potential problems in the space of the relationship between > the registry and the address owner, then we've moved from "unknown," to > "contested." The response given essentially says, "don't worry about > attacks, because in the case of attacks, we'll just ignore those ROA > thingies." The problem in the paper was equating removing ROAs with DoS attacks with actual reachability implications. > If that's the case, then why bother with the ROAs in the first place? ROAs provide a method to give your correct routes precedence over other routes from (hostile) sources. It is an optional service, and loss of the RPKI system is not loss of connectivity. The fact that it is optional doesn't mean that it won't be valued by many folks for its use in routine operations. (Just as you may value having an alarm system for your home because of the protection it provides, its failure doesn't also automatically unlock your front door...) > Again, you can't have your cake and eat it too... Either ROAs mean > something, and attacks against the ROA system are a real threat, or the > attacks are not worth worrying about --in which case, the ROAs > themselves don't mean anything from day one. Loss of a ROA (e.g. due to an attack on the RPKI system) does not cause a _reachability event_ if folks are using best practices for route precedence; that's what was implied in the paper and is wrong. Successful attacks against the RPKI system do have an impact, but it is simply that you are again vulnerable to route hijacking. FYI, /John From russw@riw.us Wed Mar 20 12:51:11 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EB0BC11E8107 for ; Wed, 20 Mar 2013 12:51:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pZgU7UyH5Tcy for ; Wed, 20 Mar 2013 12:51:10 -0700 (PDT) Received: from da31.namelessnet.net (da31.namelessnet.net [74.124.205.66]) by ietfa.amsl.com (Postfix) with ESMTP id 777DF11E8106 for ; Wed, 20 Mar 2013 12:51:10 -0700 (PDT) Received: from cpe-098-122-147-095.nc.res.rr.com ([98.122.147.95] helo=[192.168.100.75]) by da31.namelessnet.net with esmtpa (Exim 4.80) (envelope-from ) id 1UIP2T-0001gc-Jg; Wed, 20 Mar 2013 12:51:09 -0700 Message-ID: <514A1336.4040202@riw.us> Date: Wed, 20 Mar 2013 15:51:18 -0400 From: Russ White User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: John Curran References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> <5149C506.7080001@gmail.com> <5149D9A2.7030107@riw.us> <2F3EBB88EC3A454AAB08915FBF0B8C7E1D01BA@eusaamb109.ericsson.se> <514A098C.3040502@riw.us> <4B7D7C8E-273F-44DA-A705-0EB88E6459B4@istaff.org> In-Reply-To: <4B7D7C8E-273F-44DA-A705-0EB88E6459B4@istaff.org> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Antivirus-Scanner: Seems clean. You should still use an Antivirus Scanner Cc: "sidr@ietf.org" Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 19:51:11 -0000 > Loss of a ROA (e.g. due to an attack on the RPKI system) does not > cause a _reachability event_ if folks are using best practices for > route precedence; that's what was implied in the paper and is wrong. > Successful attacks against the RPKI system do have an impact, but it > is simply that you are again vulnerable to route hijacking. How often do you think an attacker would bother with taking out a ROA without taking out the route as well? But this misses the larger point --if the ROAs are supposed to provide security, then either: 1. Removing the ROAs is a problem in terms of increased risk, which is a problem which needs to be addressed. -OR- 2. Removing the ROAs isn't a problem, in which case we have to ask --why bother? You're trying to have your cake and eat it to. ROAs are important unless they're not important, and you can't tell the difference by looking at the RPKI system itself. :-) Russ From Sandra.Murphy@sparta.com Wed Mar 20 13:14:42 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3D0EA11E810E for ; Wed, 20 Mar 2013 13:14:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Qswhq2ipJU9t for ; Wed, 20 Mar 2013 13:14:41 -0700 (PDT) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by ietfa.amsl.com (Postfix) with ESMTP id ABA8A11E80DE for ; Wed, 20 Mar 2013 13:14:40 -0700 (PDT) Received: from Beta5.sparta.com ([10.62.8.21]) by M4.sparta.com (8.14.4/8.14.4) with ESMTP id r2KKEd3k017981; Wed, 20 Mar 2013 15:14:39 -0500 Received: from Hermes.columbia.ads.sparta.com ([10.62.56.107]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id r2KKEdAv000636; Wed, 20 Mar 2013 15:14:39 -0500 Received: from HERMES.columbia.ads.sparta.com ([fe80::e4a8:a383:2128:c0e5]) by Hermes.columbia.ads.sparta.com ([fe80::e4a8:a383:2128:c0e5%18]) with mapi id 14.02.0247.003; Wed, 20 Mar 2013 16:14:11 -0400 From: "Murphy, Sandra" To: Russ White , "sidr@ietf.org" Thread-Topic: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations Thread-Index: AQHOJXWpQGb39vzJNEixSQHk1va2Q5iu/BIAgAABCCw= Date: Wed, 20 Mar 2013 20:14:11 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F66D0FD186@Hermes.columbia.ads.sparta.com> References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> <5149C506.7080001@gmail.com>,<5149D9A2.7030107@riw.us> In-Reply-To: <5149D9A2.7030107@riw.us> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.137] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 20:14:42 -0000 Speaking as a regular ol' member=0A= =0A= >It seems, to me, that if the RPKI can't be used to actually validate who= =0A= >owns what route with certainty, we're going to a lot of trouble for=0A= >nothing... Or maybe folks are trying to have their cake and eat it to.=0A= >"We'll provide solid security which you can ignore if you like, no=0A= >problem."=0A= =0A= Routing policy has always been left to the local operator. You suggest a c= hange to a mandated global common policy. I don't think that could ever fl= y with the operators.=0A= =0A= >I know this goes back to the difference between "unknown," and=0A= >"invalid," but if all address space which no-one actually claims is open= =0A= >for whatever use anyone wants, then are we really making any progress in= =0A= >any meaningful way?=0A= =0A= So a flag day would be preferable, when everyone would be required to have = certified their address space?=0A= =0A= If not, incremental deployment requires handling the case of "no-one actual= ly claims" the space.=0A= =0A= For the "no-one actually claims" space, that space will be subject to the s= ame attacks as exist now. Pretty much the same with any new but unused pro= tection system.=0A= =0A= --Sandy, speaking as regular ol' member=0A= =0A= From jcurran@istaff.org Wed Mar 20 13:19:40 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6878411E8104 for ; Wed, 20 Mar 2013 13:19:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TEiG1g1v1KHk for ; Wed, 20 Mar 2013 13:19:39 -0700 (PDT) Received: from mho-01-ewr.mailhop.org (mho-03-ewr.mailhop.org [204.13.248.66]) by ietfa.amsl.com (Postfix) with ESMTP id D67DB11E80DE for ; Wed, 20 Mar 2013 13:19:39 -0700 (PDT) Received: from ip-64-134-156-35.public.wayport.net ([64.134.156.35] helo=[192.168.5.48]) by mho-01-ewr.mailhop.org with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.72) (envelope-from ) id 1UIPU1-000NAK-C7; Wed, 20 Mar 2013 20:19:37 +0000 X-Mail-Handler: Dyn Standard SMTP by Dyn X-Originating-IP: 64.134.156.35 X-Report-Abuse-To: abuse@dyndns.com (see http://www.dyndns.com/services/sendlabs/outbound_abuse.html for abuse reporting information) X-MHO-User: U2FsdGVkX19IKdtBoMTcVrNmFFVct7vY Content-Type: text/plain; charset=iso-8859-1 Mime-Version: 1.0 (Mac OS X Mail 6.3 \(1503\)) From: John Curran In-Reply-To: <514A1336.4040202@riw.us> Date: Wed, 20 Mar 2013 14:19:35 -0600 Content-Transfer-Encoding: 7bit Message-Id: References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> <5149C506.7080001@gmail.com> <5149D9A2.7030107@riw.us> <2F3EBB88EC3A454AAB08915FBF0B8C7E1D01BA@eusaamb109.ericsson.se> <514A098C.3040502@riw.us> <4B7D7C8E-273F-44DA-A705-0EB88E6459B4@istaff.org> <514A1336.4040202@riw.us> To: Russ White X-Mailer: Apple Mail (2.1503) Cc: "sidr@ietf.org" Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 20:19:40 -0000 On Mar 20, 2013, at 1:51 PM, Russ White wrote: > How often do you think an attacker would bother with taking out a ROA > without taking out the route as well? Invert the question... Of the thousands of entities that could today inject (hostile) routes and do a hijack today, how many of them will be able to also mount an attack against the RPKI infrastructure? > But this misses the larger point > --if the ROAs are supposed to provide security, then either: > > 1. Removing the ROAs is a problem in terms of increased risk, which is a > problem which needs to be addressed. I never argued with addressing the risks that might be posed; I was pointing out that the risk does not equate (on its own) with a reachability event, as alluded to by the paper. /John From russw@riw.us Wed Mar 20 13:20:38 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B2C5211E810E for ; Wed, 20 Mar 2013 13:20:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AEq6EGBTWE0l for ; Wed, 20 Mar 2013 13:20:36 -0700 (PDT) Received: from da31.namelessnet.net (da31.namelessnet.net [74.124.205.66]) by ietfa.amsl.com (Postfix) with ESMTP id CEC5B11E8104 for ; Wed, 20 Mar 2013 13:20:36 -0700 (PDT) Received: from cpe-098-122-147-095.nc.res.rr.com ([98.122.147.95] helo=[192.168.100.75]) by da31.namelessnet.net with esmtpa (Exim 4.80) (envelope-from ) id 1UIPUp-0003It-1S; Wed, 20 Mar 2013 13:20:27 -0700 Message-ID: <514A1A13.6040405@riw.us> Date: Wed, 20 Mar 2013 16:20:35 -0400 From: Russ White User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: "Murphy, Sandra" References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> <5149C506.7080001@gmail.com>, <5149D9A2.7030107@riw.us> <24B20D14B2CD29478C8D5D6E9CBB29F66D0FD186@Hermes.columbia.ads.sparta.com> In-Reply-To: <24B20D14B2CD29478C8D5D6E9CBB29F66D0FD186@Hermes.columbia.ads.sparta.com> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Antivirus-Scanner: Seems clean. You should still use an Antivirus Scanner Cc: "sidr@ietf.org" Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 20:20:39 -0000 >> It seems, to me, that if the RPKI can't be used to actually validate who >> owns what route with certainty, we're going to a lot of trouble for >> nothing... Or maybe folks are trying to have their cake and eat it to. >> "We'll provide solid security which you can ignore if you like, no >> problem." > > Routing policy has always been left to the local operator. You suggest a change to a mandated global common policy. I don't think that could ever fly with the operators. Of course --but clearly there is a difference between "not present," and "under attack," something the current RPKI codes don't take into account. > So a flag day would be preferable, when everyone would be required to have certified their address space? Since it's going to take 20 years to deploy anyway (according to various comments at the mic over the years, and on this and other lists)... Or perhaps we need a way of telling whether something should have an entry or not. :-) Russ From russw@riw.us Wed Mar 20 13:26:28 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4EE8411E8125 for ; Wed, 20 Mar 2013 13:26:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QeeEzJNF0wlh for ; Wed, 20 Mar 2013 13:26:27 -0700 (PDT) Received: from da31.namelessnet.net (da31.namelessnet.net [74.124.205.66]) by ietfa.amsl.com (Postfix) with ESMTP id B25CE11E80DE for ; Wed, 20 Mar 2013 13:26:27 -0700 (PDT) Received: from cpe-098-122-147-095.nc.res.rr.com ([98.122.147.95] helo=[192.168.100.75]) by da31.namelessnet.net with esmtpa (Exim 4.80) (envelope-from ) id 1UIPab-0003bH-I7; Wed, 20 Mar 2013 13:26:25 -0700 Message-ID: <514A1B7A.6080603@riw.us> Date: Wed, 20 Mar 2013 16:26:34 -0400 From: Russ White User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: John Curran References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> <5149C506.7080001@gmail.com> <5149D9A2.7030107@riw.us> <2F3EBB88EC3A454AAB08915FBF0B8C7E1D01BA@eusaamb109.ericsson.se> <514A098C.3040502@riw.us> <4B7D7C8E-273F-44DA-A705-0EB88E6459B4@istaff.org> <514A1336.4040202@riw.us> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Antivirus-Scanner: Seems clean. You should still use an Antivirus Scanner Cc: "sidr@ietf.org" Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 20:26:28 -0000 >> 1. Removing the ROAs is a problem in terms of increased risk, which is a >> problem which needs to be addressed. > > I never argued with addressing the risks that might be posed; I was pointing > out that the risk does not equate (on its own) with a reachability event, as > alluded to by the paper. That all depends on the policy undertaken by each specific provider, doesn't it? How can you tell the difference between a route with no ROA because the registry has decertified, and a route with no ROA simply because one hasn't ever been created? If the registries issue "negative ROAs," for all the address space they own, doesn't that immediately break anyone who doesn't participate? It seems, to me, that there's a problem in here that's likely to bite someone in the butt once things really start to deploy (if they ever really do start to deploy). But, it's fine, we can put our fingers in our ears, say, "lalalala" as loud as possible, and hope it's not "me" who gets the first crack as being bitten by this particular bug. As Danny said --this is a salient point in the conversation. I'll extend that to say that if I were a provider, this would be a salient point in my decision about deploying --or not-- this mechanism. :-) Russ From arturo.servin@gmail.com Wed Mar 20 13:30:39 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E22EE1F0D0D for ; Wed, 20 Mar 2013 13:30:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vSo3Ja5nn6Az for ; Wed, 20 Mar 2013 13:30:29 -0700 (PDT) Received: from mail-oa0-f51.google.com (mail-oa0-f51.google.com [209.85.219.51]) by ietfa.amsl.com (Postfix) with ESMTP id 598ED11E80F2 for ; Wed, 20 Mar 2013 13:30:26 -0700 (PDT) Received: by mail-oa0-f51.google.com with SMTP id h2so2325291oag.10 for ; Wed, 20 Mar 2013 13:30:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=x-received:message-id:date:from:user-agent:mime-version:to:cc :subject:references:in-reply-to:content-type :content-transfer-encoding; bh=Ixxk0J0gjeQ19n+Cvq/tfRqaLh+1foI7iF4qiHLeH/k=; b=07KlMMJj5WIxL4yyMhRnXt0w6pJT/ROrMAmOkENj4OrXk3HQR5Ttby3lhjU+J1Y7oZ r21DxZ2II9XjbgBt+DZN95qXNxySSESBLoH9JzMuM5Q4aZVBKXTydrQxBFdM8xE1RTAv fsr+LOF4YoSQXlePNlDsdeDBz3L+D7lZU7BgcPqK6I6rlo7Vux09vXiuHAMA322BlXdV yQiUo0y7Sc0IYRVKShTA+8h+SkTL7nWYqKVjTUAPgwz6jvGWm/3SZexvHiQphHYDqsYA dIr+AjCEGPXcpz9mmxZ0FAkegf1JQ0V5NY+D3tjI+Fb0VM5b8EWAER/A5IqoaEtF7zJ0 xmjg== X-Received: by 10.60.24.197 with SMTP id w5mr5069436oef.6.1363811425916; Wed, 20 Mar 2013 13:30:25 -0700 (PDT) Received: from 85-7-200.lacnic.net.uy ([2001:13c7:7001:5128:a48f:ccf8:3ccc:d923]) by mx.google.com with ESMTPS id be1sm3738407obb.11.2013.03.20.13.30.22 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 20 Mar 2013 13:30:24 -0700 (PDT) Message-ID: <514A1C4D.7020306@gmail.com> Date: Wed, 20 Mar 2013 17:30:05 -0300 From: Arturo Servin User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: Russ White References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> <5149C506.7080001@gmail.com>, <5149D9A2.7030107@riw.us> <24B20D14B2CD29478C8D5D6E9CBB29F66D0FD186@Hermes.columbia.ads.sparta.com> <514A1A13.6040405@riw.us> In-Reply-To: <514A1A13.6040405@riw.us> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: "Murphy, Sandra" , "sidr@ietf.org" Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 20:30:40 -0000 That could be attacked as well. Then we will have something to tell that an entry exists for the table that tells that roas exists. :) What we probably need need is something that flags that a Certificate or a ROA has disappeared in the last X time. Then as operator we could take the action to decide if this was an attack or a valid revocation. Regards, as On 3/20/13 5:20 PM, Russ White wrote: > >>> It seems, to me, that if the RPKI can't be used to actually validate who >>> owns what route with certainty, we're going to a lot of trouble for >>> nothing... Or maybe folks are trying to have their cake and eat it to. >>> "We'll provide solid security which you can ignore if you like, no >>> problem." >> >> Routing policy has always been left to the local operator. You suggest a change to a mandated global common policy. I don't think that could ever fly with the operators. > > Of course --but clearly there is a difference between "not present," and > "under attack," something the current RPKI codes don't take into account. > >> So a flag day would be preferable, when everyone would be required to have certified their address space? > > Since it's going to take 20 years to deploy anyway (according to various > comments at the mic over the years, and on this and other lists)... > > Or perhaps we need a way of telling whether something should have an > entry or not. > > :-) > > Russ > > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From Sandra.Murphy@sparta.com Wed Mar 20 13:36:39 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 898A91F0D07 for ; Wed, 20 Mar 2013 13:36:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id llPJoezcwvCF for ; Wed, 20 Mar 2013 13:36:39 -0700 (PDT) Received: from Uther.sparta.com (uther.sparta.com [157.185.0.2]) by ietfa.amsl.com (Postfix) with ESMTP id 02EB51F0C36 for ; Wed, 20 Mar 2013 13:36:38 -0700 (PDT) Received: from durin.laguna.sparta.com ([10.62.216.7]) by Uther.sparta.com (8.13.8/8.13.8) with ESMTP id r2KKabBt007884; Wed, 20 Mar 2013 13:36:37 -0700 Received: from Hermes.columbia.ads.sparta.com ([10.62.56.107]) by durin.laguna.sparta.com (8.13.8/8.13.8) with ESMTP id r2KKaYdU016824; Wed, 20 Mar 2013 13:36:34 -0700 Received: from HERMES.columbia.ads.sparta.com ([fe80::e4a8:a383:2128:c0e5]) by Hermes.columbia.ads.sparta.com ([fe80::e4a8:a383:2128:c0e5%18]) with mapi id 14.02.0247.003; Wed, 20 Mar 2013 16:35:54 -0400 From: "Murphy, Sandra" To: Russ White , John Curran Thread-Topic: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations Thread-Index: AQHOJak2aGTqYz9g6EmVIv+xxilSb5ivCEl/ Date: Wed, 20 Mar 2013 20:35:53 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F66D0FD1E2@Hermes.columbia.ads.sparta.com> References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> <5149C506.7080001@gmail.com> <5149D9A2.7030107@riw.us> <2F3EBB88EC3A454AAB08915FBF0B8C7E1D01BA@eusaamb109.ericsson.se> <514A098C.3040502@riw.us> <4B7D7C8E-273F-44DA-A705-0EB88E6459B4@istaff.org> <514A1336.4040202@riw.us> , <514A1B7A.6080603@riw.us> In-Reply-To: <514A1B7A.6080603@riw.us> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.137] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: "sidr@ietf.org" Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 20:36:39 -0000 Speaking as regular ol' member=0A= =0A= >That all depends on the policy undertaken by each specific provider,=0A= >doesn't it? How can you tell the difference between a route with no ROA=0A= >because the registry has decertified, and a route with no ROA simply=0A= >because one hasn't ever been created?=0A= =0A= To an ISP who wants to reclaim address space from a customer who has walked= or violated their agreement, the ability to decertify that allocated space= is a very good feature.=0A= =0A= You certainly would not want to end up with a system that would not allow r= eclaiming address space.=0A= =0A= --Sandy= From russw@riw.us Wed Mar 20 13:41:46 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4577B11E8103 for ; Wed, 20 Mar 2013 13:41:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xz99R52hYiQe for ; Wed, 20 Mar 2013 13:41:45 -0700 (PDT) Received: from da31.namelessnet.net (da31.namelessnet.net [74.124.205.66]) by ietfa.amsl.com (Postfix) with ESMTP id 39E1911E80F9 for ; Wed, 20 Mar 2013 13:41:45 -0700 (PDT) Received: from cpe-098-122-147-095.nc.res.rr.com ([98.122.147.95] helo=[192.168.100.75]) by da31.namelessnet.net with esmtpa (Exim 4.80) (envelope-from ) id 1UIPpM-0004SC-RL; Wed, 20 Mar 2013 13:41:40 -0700 Message-ID: <514A1F0B.3020301@riw.us> Date: Wed, 20 Mar 2013 16:41:47 -0400 From: Russ White User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: Arturo Servin References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> <5149C506.7080001@gmail.com>, <5149D9A2.7030107@riw.us> <24B20D14B2CD29478C8D5D6E9CBB29F66D0FD186@Hermes.columbia.ads.sparta.com> <514A1A13.6040405@riw.us> <514A1C4D.7020306@gmail.com> In-Reply-To: <514A1C4D.7020306@gmail.com> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Antivirus-Scanner: Seems clean. You should still use an Antivirus Scanner Cc: "Murphy, Sandra" , "sidr@ietf.org" Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 20:41:46 -0000 > What we probably need need is something that flags that a Certificate > or a ROA has disappeared in the last X time. Then as operator we could > take the action to decide if this was an attack or a valid revocation. That is probably a good idea... But since the ROAs are time based themselves, it might be hard to do (?). :-) Russ From dougm@nist.gov Wed Mar 20 14:30:25 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 96DD421F8DDC for ; Wed, 20 Mar 2013 14:30:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id akcrkn0UpwMt for ; Wed, 20 Mar 2013 14:30:25 -0700 (PDT) Received: from wsget1.nist.gov (wsget1.nist.gov [129.6.13.150]) by ietfa.amsl.com (Postfix) with ESMTP id CBF8B21F8A18 for ; Wed, 20 Mar 2013 14:30:24 -0700 (PDT) Received: from WSXGHUB1.xchange.nist.gov (129.6.18.96) by wsget1.nist.gov (129.6.13.150) with Microsoft SMTP Server (TLS) id 14.3.123.3; Wed, 20 Mar 2013 17:30:18 -0400 Received: from MBCLUSTER.xchange.nist.gov ([fe80::d479:3188:aec0:cb66]) by WSXGHUB1.xchange.nist.gov ([129.6.18.96]) with mapi; Wed, 20 Mar 2013 17:30:23 -0400 From: "Montgomery, Douglas" To: Russ White , Arturo Servin Importance: low X-Priority: 5 Date: Wed, 20 Mar 2013 17:30:09 -0400 Thread-Topic: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations Thread-Index: Ac4lsiF3fGvrNwIdTa6vzsR7lEDB8g== Message-ID: In-Reply-To: <514A1F0B.3020301@riw.us> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.3.2.130206 acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Cc: "Murphy, Sandra" , "sidr@ietf.org" Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 21:30:25 -0000 On 3/20/13 4:41 PM, "Russ White" wrote: > >> What we probably need need is something that flags that a Certificate >> or a ROA has disappeared in the last X time. Then as operator we could >> take the action to decide if this was an attack or a valid revocation. > >That is probably a good idea... But since the ROAs are time based >themselves, it might be hard to do (?). ? Maybe you mean they are signed by certs that have validity periods? Monitor and log rpki-rtr protocol - look for ROA withdraws. Wireshark module to do that for you is here: http://www-x.antd.nist.gov/bgpsrx/ Given that the kind of transformations that Sharon's work describes might be the desirable actions of an ISP reclaiming resources from an ex-customer, what actions will we take to decide otherwise? Sandy's point that such action might be viewed differently looking up the tree, rather than down. dougm From jcurran@istaff.org Wed Mar 20 15:16:07 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D0B721F8CA3 for ; Wed, 20 Mar 2013 15:16:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TcleOzFCZX31 for ; Wed, 20 Mar 2013 15:16:06 -0700 (PDT) Received: from mho-02-ewr.mailhop.org (mho-04-ewr.mailhop.org [204.13.248.74]) by ietfa.amsl.com (Postfix) with ESMTP id BCF3E21F8C7D for ; Wed, 20 Mar 2013 15:16:06 -0700 (PDT) Received: from ip-64-134-156-35.public.wayport.net ([64.134.156.35] helo=[192.168.5.48]) by mho-02-ewr.mailhop.org with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.72) (envelope-from ) id 1UIRIi-000AIh-Pn; Wed, 20 Mar 2013 22:16:04 +0000 X-Mail-Handler: Dyn Standard SMTP by Dyn X-Originating-IP: 64.134.156.35 X-Report-Abuse-To: abuse@dyndns.com (see http://www.dyndns.com/services/sendlabs/outbound_abuse.html for abuse reporting information) X-MHO-User: U2FsdGVkX1/bDokMoQCNVluJZTlQambI Content-Type: text/plain; charset=iso-8859-1 Mime-Version: 1.0 (Mac OS X Mail 6.3 \(1503\)) From: John Curran In-Reply-To: <514A1B7A.6080603@riw.us> Date: Wed, 20 Mar 2013 16:16:04 -0600 Content-Transfer-Encoding: quoted-printable Message-Id: <5E9D1F98-D6D7-4478-AB1C-96B6242CEBD8@istaff.org> References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> <5149C506.7080001@gmail.com> <5149D9A2.7030107@riw.us> <2F3EBB88EC3A454AAB08915FBF0B8C7E1D01BA@eusaamb109.ericsson.se> <514A098C.3040502@riw.us> <4B7D7C8E-273F-44DA-A705-0EB88E6459B4@istaff.org> <514A1336.4040202@riw.us> <514A1B7A.6080603@riw.us> To: Russ White X-Mailer: Apple Mail (2.1503) Cc: "sidr@ietf.org" Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 22:16:07 -0000 On Mar 20, 2013, at 2:26 PM, Russ White wrote: >> I never argued with addressing the risks that might be posed; I was = pointing=20 >> out that the risk does not equate (on its own) with a reachability = event, as=20 >> alluded to by the paper. >=20 > That all depends on the policy undertaken by each specific provider, > doesn't it? Correct. We have an ID which makes recommendations (but it is still up to each provider what their specific policy will be) =46rom -=20 "Announcements with Valid origins SHOULD be preferred over those with NotFound or Invalid origins, if the latter are accepted at all. Announcements with NotFound origins SHOULD be preferred over those with Invalid origins. Announcements with Invalid origins SHOULD NOT be used, but MAY be used to meet special operational needs. In such circumstances, the announcement SHOULD have a lower preference than that given to Valid or NotFound. When first deploying origin validation, it may be prudent to not drop announcements with Invalid orgins until inspection of logs, SNMP, or other data indicate that the correct result would be obtained." > How can you tell the difference between a route with no ROA > because the registry has decertified, and a route with no ROA simply > because one hasn't ever been created? No ROA is no ROA... Should give way to routes with Valid origins. > It seems, to me, that there's a problem in here that's likely to bite > someone in the butt once things really start to deploy (if they ever > really do start to deploy). If that's the case, you might want to make some suggestions of = alternative=20 text for "Section 5. Routing Policy" of draft-ietf-sidr-origin-ops-20>. =20= As it is, it looks fairly solid in describing the situation at initial=20= deployment and factors that an operator might want to consider in = setting their local policy. Thanks! /John From arturo.servin@gmail.com Wed Mar 20 15:22:21 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 70DDD21F8D45 for ; Wed, 20 Mar 2013 15:22:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1kZw6LeXT0dx for ; Wed, 20 Mar 2013 15:22:21 -0700 (PDT) Received: from mail-qc0-x22f.google.com (mail-qc0-x22f.google.com [IPv6:2607:f8b0:400d:c01::22f]) by ietfa.amsl.com (Postfix) with ESMTP id D710D21F8D3A for ; Wed, 20 Mar 2013 15:22:20 -0700 (PDT) Received: by mail-qc0-f175.google.com with SMTP id j3so1090426qcs.6 for ; Wed, 20 Mar 2013 15:22:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=x-received:message-id:date:from:user-agent:mime-version:to:subject :references:in-reply-to:content-type:content-transfer-encoding; bh=QsUuI2KktO/Sj71ouolkBLcpb/ZKQLOMU4O5wqsNKwM=; b=ZJbezqnv1RtW1DbWweM2zVx8OMsoWfbelL9z2a1ZP7uny2+30n8f+yZjEognTtJm2G OtH8Bt0m/MK/0XUBMNba9eN1uT6ZE7LcFcX+QxucARbFpk7PehgiQdLENRXUcoWjwoHr cwN4KzPmuNV/BmiU/I6DXVvbQg8pTcQ6SHxQ3Szw1nuwfti8neVhav3ErvqUGznVGrUC AT61Kh8rTT72DxbOTee7Pc7ffAb2lQVRVn/UQAYnA8FAL8WFggSffNv1M7u9EM8pP71g tZCM2JGQ6JlJqcOfopanyOsC9D747l7bJpGw7Hitye0LJBhpqqivLZrWgfzl+FREZq5A RUOQ== X-Received: by 10.224.216.135 with SMTP id hi7mr7965095qab.28.1363818140328; Wed, 20 Mar 2013 15:22:20 -0700 (PDT) Received: from ?IPv6:2800:af:ba30:ff0c:64bc:d0e7:d75:316b? ([2800:af:ba30:ff0c:64bc:d0e7:d75:316b]) by mx.google.com with ESMTPS id e3sm48965656qeo.0.2013.03.20.15.22.17 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 20 Mar 2013 15:22:18 -0700 (PDT) Message-ID: <514A3698.2070509@gmail.com> Date: Wed, 20 Mar 2013 19:22:16 -0300 From: Arturo Servin User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: sidr@ietf.org References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> <5149C506.7080001@gmail.com>, <5149D9A2.7030107@riw.us> <24B20D14B2CD29478C8D5D6E9CBB29F66D0FD186@Hermes.columbia.ads.sparta.com> <514A1A13.6040405@riw.us> <514A1C4D.7020306@gmail.com> <514A1F0B.3020301@riw.us> In-Reply-To: <514A1F0B.3020301@riw.us> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 22:22:21 -0000 On 20/03/2013 17:41, Russ White wrote: > >> What we probably need need is something that flags that a Certificate >> or a ROA has disappeared in the last X time. Then as operator we could >> take the action to decide if this was an attack or a valid revocation. > > That is probably a good idea... But since the ROAs are time based > themselves, it might be hard to do (?). > > :-) Not sure if it is so hard. If the ROA expires because of the date is not longer valid, then there is normal and a high probability that there is no attack. Only, if the ROA is valid in the previous state and in the current is revoked or missing, then you will alert. > > Russ > /as From oliver.borchert@nist.gov Wed Mar 20 16:00:05 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DE3871F0D1F for ; Wed, 20 Mar 2013 16:00:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AffvN-RtyYxu for ; Wed, 20 Mar 2013 16:00:05 -0700 (PDT) Received: from wsget1.nist.gov (wsget1.nist.gov [129.6.13.150]) by ietfa.amsl.com (Postfix) with ESMTP id E535A1F0D1C for ; Wed, 20 Mar 2013 16:00:04 -0700 (PDT) Received: from WSXGHUB1.xchange.nist.gov (129.6.18.96) by wsget1.nist.gov (129.6.13.150) with Microsoft SMTP Server (TLS) id 14.3.123.3; Wed, 20 Mar 2013 18:59:57 -0400 Received: from MBCLUSTER.xchange.nist.gov ([fe80::d479:3188:aec0:cb66]) by WSXGHUB1.xchange.nist.gov ([129.6.18.96]) with mapi; Wed, 20 Mar 2013 19:00:03 -0400 From: "Borchert, Oliver" To: Arturo Servin , "sidr@ietf.org" Date: Wed, 20 Mar 2013 19:00:02 -0400 Thread-Topic: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations Thread-Index: Ac4luWefngVxLAPdTLS5h82XJqdicwABLwuA Message-ID: References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> <5149C506.7080001@gmail.com>, <5149D9A2.7030107@riw.us> <24B20D14B2CD29478C8D5D6E9CBB29F66D0FD186@Hermes.columbia.ads.sparta.com> <514A1A13.6040405@riw.us> <514A1C4D.7020306@gmail.com> <514A1F0B.3020301@riw.us> <514A3698.2070509@gmail.com> In-Reply-To: <514A3698.2070509@gmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 23:00:06 -0000 > On 20/03/2013 17:41, Russ White wrote: > > > >> What we probably need need is something that flags that a > >> Certificate or a ROA has disappeared in the last X time. Then as > >> operator we could take the action to decide if this was an attack or a valid > revocation. > > > > That is probably a good idea... But since the ROAs are time based > > themselves, it might be hard to do (?). > > > > :-) > > Not sure if it is so hard. > > If the ROA expires because of the date is not longer valid, then there > is normal and a high probability that there is no attack. > > Only, if the ROA is valid in the previous state and in the current is > revoked or missing, then you will alert. > > > > > Russ > > > > /as But what does the alert tell me? What if one is multi homed, uses two ROAs then switches to be single homed and revokes the second ROA. In this case the owner revoked the ROA and this is not an attack - here the alert is not of help at all! Oliver From kotikalapudi.sriram@nist.gov Wed Mar 20 16:23:58 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4A30021F86EC for ; Wed, 20 Mar 2013 16:23:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aVZ1gc7DI9ug for ; Wed, 20 Mar 2013 16:23:57 -0700 (PDT) Received: from wsget1.nist.gov (wsget1.nist.gov [129.6.13.150]) by ietfa.amsl.com (Postfix) with ESMTP id B0E1221F86C4 for ; Wed, 20 Mar 2013 16:23:57 -0700 (PDT) Received: from WSXGHUB1.xchange.nist.gov (129.6.18.96) by wsget1.nist.gov (129.6.13.150) with Microsoft SMTP Server (TLS) id 14.3.123.3; Wed, 20 Mar 2013 19:23:49 -0400 Received: from MBCLUSTER.xchange.nist.gov ([fe80::d479:3188:aec0:cb66]) by WSXGHUB1.xchange.nist.gov ([129.6.18.96]) with mapi; Wed, 20 Mar 2013 19:23:55 -0400 From: "Sriram, Kotikalapudi" To: "Danny McPherson (danny@tcb.net)" , "Stephen Kent (kent@bbn.com)" Date: Wed, 20 Mar 2013 19:23:54 -0400 Thread-Topic: DDoS mitigation example (was: RE: [sidr] comments on the repository analysis I-D) Thread-Index: Ac4lwfzI1A7FgZCFTJKgyHMdjZJEnw== Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 Cc: "sidr wg list \(sidr@ietf.org\)" Subject: [sidr] DDoS mitigation example (was: RE: comments on the repository analysis I-D) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 23:23:58 -0000 VGhlIEREb1MgbWl0aWdhdGlvbiBleGFtcGxlIHdhcyBkaXNjdXNzZWQgYmVmb3JlLg0KSXQgYXBw ZWFyZWQgdGhlcmUgd2FzIGEgcmVhc29uYWJsZSBzb2x1dGlvbi4NClBsZWFzZSBzZWUgdGhpcyBw b3N0Og0KaHR0cDovL3d3dy5pZXRmLm9yZy9tYWlsLWFyY2hpdmUvd2ViL3NpZHIvY3VycmVudC9t c2cwNTYwNS5odG1sIA0KDQpTcmlyYW0NCg0KPg0KPkZyb206IHNpZHItYm91bmNlc0BpZXRmLm9y ZyBbbWFpbHRvOnNpZHItYm91bmNlc0BpZXRmLm9yZ10gT24gQmVoYWxmIE9mDQo+RGFubnkgTWNQ aGVyc29uDQo+U2VudDogV2VkbmVzZGF5LCBNYXJjaCAyMCwgMjAxMyAxMDo1OSBBTQ0KPlRvOiBT dGVwaGVuIEtlbnQNCj5DYzogc2lkckBpZXRmLm9yZw0KPg0KPk9uIE1hciAyMCwgMjAxMywgYXQg OTo0NCBBTSwgU3RlcGhlbiBLZW50IDxrZW50QGJibi5jb20+IA0KPj5Zb3UgY2l0ZSBERG9TIG1p dGlnYXRpb24gYXMgYW4gZXhhbXBsZSwgd2hlcmVhcyBpdCBzZWVtcyB0byBiZSBtb3JlIHRoZSBl eGFtcGxlLg0KPg0KPkJhaC4uIMKgSG93IG1hbnkgZXhhbXBsZXMgZG8geW91IG5lZWQ/DQo+DQo+ PkFsc28sIGl0J3Mgbm90IGNsZWFyDQo+PnRoYXQgYXNzZXJ0aW5nIGEgbmV3IG9yaWdpbiBBUyBm b3IgYSB0YXJnZXQgb2Ygc3VjaCBhbiBhdHRhY2sgaXMgdGhlIG9ubHkgd2F5IHRvDQo+PmRlYWwg d2l0aCB0aGUgcHJvYmxlbSwganVzdCB0aGUgd2F5IHRoYXQgaXQgaXMgcGVyZm9ybWVkIHRvZGF5 LCBmb3IgQVNlcyB0aGF0IGRvDQo+Pm5vdCBtYWtlIGFycmFuZ2VtZW50cyBpbiBhZHZhbmNlIHRv IGNvdW50ZXIgc3VjaCBhdHRhY2tzLg0KPg0KPkhhaCwgcmlnaHQuIElmIHlvdSd2ZSBhbnkgbWFn aWMgdGhlIGluZHVzdHJ5IHdvdWxkIGJlIGludGVyZXN0ZWQgaW4gaXQgRHIuDQo+S2VudC4gwqBV bnRpbCB0aGVuLCBwbGVhc2UgdHJ5IG5vdCB0byBicmVhayBjdXJyZW50IGNhcGFiaWxpdGllcyB0 aGF0IHJlYWwgb3BlcmF0b3JzDQo+YnJvYWRseSB1c2UuLg0KPg0KPi1kYW5ueQ0K From arturo.servin@gmail.com Wed Mar 20 16:32:50 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 27E6321F8A68 for ; Wed, 20 Mar 2013 16:32:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tW7tm4kg5iQP for ; Wed, 20 Mar 2013 16:32:49 -0700 (PDT) Received: from mail-qe0-f43.google.com (mail-qe0-f43.google.com [209.85.128.43]) by ietfa.amsl.com (Postfix) with ESMTP id 8EA0621F8A54 for ; Wed, 20 Mar 2013 16:32:49 -0700 (PDT) Received: by mail-qe0-f43.google.com with SMTP id 1so1489942qee.30 for ; Wed, 20 Mar 2013 16:32:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=x-received:message-id:date:from:user-agent:mime-version:to:subject :references:in-reply-to:content-type:content-transfer-encoding; bh=08jteqgae/pVjFW8bmo+4tKzd0ApxtkYDPF/FFWaGY8=; b=n6OqwkxZbrtS2WYDGWzcB4LsJ3PEIkwr3ELJXs8JuNC2plbYbDL6Rx1WKE7VkzuKh4 dnZPwE9HwL/ujo2tKGt4P4qYBAVhOs1TgOJLtqPUx16jBGUUvjo2tZQFByvVEpCm6BGX VbJYsfv/ISebt0grHFALE/Xv19tTYKqAtxOQQmAW49RUDTtd0LnrAd257nlH0D7T5rAP zm9pkBmca8gDMefRDfk7r9qFVt2d/CFId0mCTXVJu0CrKFxhmr7VjaLTOkoH3aonE4UO tJxzt/bUN+egcab74qmdBPuHQHFM9idFxkrCVbqIjvYOzJa45KL5Ag8Fmv4aM2i9qD/+ 5i8g== X-Received: by 10.224.18.138 with SMTP id w10mr8082268qaa.20.1363822369026; Wed, 20 Mar 2013 16:32:49 -0700 (PDT) Received: from ?IPv6:2800:af:ba30:ff0c:9c16:f3fa:8f23:3403? ([2800:af:ba30:ff0c:9c16:f3fa:8f23:3403]) by mx.google.com with ESMTPS id j6sm49603798qek.8.2013.03.20.16.32.45 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 20 Mar 2013 16:32:47 -0700 (PDT) Message-ID: <514A471B.2040900@gmail.com> Date: Wed, 20 Mar 2013 20:32:43 -0300 From: Arturo Servin User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: sidr@ietf.org References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> <5149C506.7080001@gmail.com>, <5149D9A2.7030107@riw.us> <24B20D14B2CD29478C8D5D6E9CBB29F66D0FD186@Hermes.columbia.ads.sparta.com> <514A1A13.6040405@riw.us> <514A1C4D.7020306@gmail.com> <514A1F0B.3020301@riw.us> <514A3698.2070509@gmail.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2013 23:32:50 -0000 On 20/03/2013 20:00, Borchert, Oliver wrote: >> On 20/03/2013 17:41, Russ White wrote: >>> >>>> What we probably need need is something that flags that a >>>> Certificate or a ROA has disappeared in the last X time. Then as >>>> operator we could take the action to decide if this was an attack or a valid >> revocation. >>> >>> That is probably a good idea... But since the ROAs are time based >>> themselves, it might be hard to do (?). >>> >>> :-) >> >> Not sure if it is so hard. >> >> If the ROA expires because of the date is not longer valid, then there >> is normal and a high probability that there is no attack. >> >> Only, if the ROA is valid in the previous state and in the current is >> revoked or missing, then you will alert. >> >>> >>> Russ >>> >> >> /as > > But what does the alert tell me? > What if one is multi homed, uses two ROAs then switches to be single homed and revokes the second ROA. In this case the owner revoked the ROA and this is not an attack - here the alert is not of help at all! > > Oliver That is the problem. It is almost impossible to know when a ROA is revoked legally or by accident/attack. This would only be a mechanism to alert when something changes, then you to decide as operator what to do. But most probably you will end up ignoring all the alerts unless there is a big fuss about it. /as > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From danny@tcb.net Wed Mar 20 19:57:30 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E12431F0D0F for ; Wed, 20 Mar 2013 19:57:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -99.041 X-Spam-Level: X-Spam-Status: No, score=-99.041 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, MIME_QP_LONG_LINE=1.396, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mkTiOuYwSU8f for ; Wed, 20 Mar 2013 19:57:30 -0700 (PDT) Received: from mail.friendswithtools.org (unknown [64.78.239.70]) by ietfa.amsl.com (Postfix) with ESMTP id 7C00711E80A6 for ; Wed, 20 Mar 2013 19:57:30 -0700 (PDT) Received: from dspam (unknown [127.0.0.1]) by mail.friendswithtools.org (Postfix) with SMTP id E77BE300025 for ; Thu, 21 Mar 2013 02:57:29 +0000 (UTC) Received: from [192.168.1.12] (pool-71-171-117-166.clppva.fios.verizon.net [71.171.117.166]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by mail.friendswithtools.org (Postfix) with ESMTPSA id 21908300013; Wed, 20 Mar 2013 20:57:29 -0600 (MDT) References: Mime-Version: 1.0 (1.0) In-Reply-To: Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Message-Id: <59A767F5-C1DC-4EE9-883C-F301DEE8EA5D@tcb.net> X-Mailer: iPhone Mail (10B146) From: Danny McPherson Date: Wed, 20 Mar 2013 22:57:28 -0400 To: "Sriram, Kotikalapudi" X-DSPAM-Result: Whitelisted X-DSPAM-Processed: Wed Mar 20 20:57:29 2013 X-DSPAM-Confidence: 0.9898 X-DSPAM-Improbability: 1 in 9709 chance of being spam X-DSPAM-Probability: 0.0000 X-DSPAM-Signature: 514a771942076595620794 X-DSPAM-Factors: 27, Mime-Version*1.0+1.0, 0.01000, From*Danny+#+danny, 0.01000, From*Danny+#+#+tcb.net, 0.01000, From*Danny+McPherson, 0.01000, Cc*sidr+ietf.org, 0.01000, Cc*sidr+ietf.org, 0.01000, From*McPherson+danny, 0.01000, From*Danny McPherson , 0.01000, From*McPherson+#+tcb.net, 0.01000, On+#+#+#+at, 0.01000, From*danny+tcb.net, 0.01000, Url*ietf, 0.01000, 2013+at, 0.40000, Mar+#+2013, 0.40000, 23+#+Sriram, 0.40000, Sriram+Kotikalapudi, 0.40000, Cc*kent+bbn.com, 0.40000, Cc*kent+bbn.com, 0.40000, Cc*sidr+#+#+#+ietf.org, 0.40000, Subject*was+#+sidr, 0.40000, To*Kotikalapudi+#+nist.gov, 0.40000, Subject*repository+#+I-D, 0.40000, Joel+#+me, 0.40000, discussed+before, 0.40000, Subject*on+the, 0.40000, wrote+#+#+mitigation, 0.40000, post+#+#+for, 0.40000 Cc: "sidr wg list \(sidr@ietf.org\)" Subject: Re: [sidr] DDoS mitigation example (was: RE: comments on the repository analysis I-D) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2013 02:57:31 -0000 On Mar 20, 2013, at 7:23 PM, "Sriram, Kotikalapudi" wrote: > The DDoS mitigation example was discussed before. > It appeared there was a reasonable solution. > Please see this post: > http://www.ietf.org/mail-archive/web/sidr/current/msg05605.html=20 Might work for Joel, not me... -danny= From oleg@ripe.net Thu Mar 21 03:09:33 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9BC8A21F8DB6 for ; Thu, 21 Mar 2013 03:09:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.449 X-Spam-Level: X-Spam-Status: No, score=-1.449 tagged_above=-999 required=5 tests=[AWL=-1.150, BAYES_00=-2.599, MANGLED_BELOW=2.3] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2Ji4Mr+30RGl for ; Thu, 21 Mar 2013 03:09:33 -0700 (PDT) Received: from postgirl.ripe.net (postgirl.ipv6.ripe.net [IPv6:2001:67c:2e8:11::c100:1342]) by ietfa.amsl.com (Postfix) with ESMTP id E742121F893B for ; Thu, 21 Mar 2013 03:09:32 -0700 (PDT) Received: from ayeaye.ripe.net ([193.0.23.5]) by postgirl.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1UIcR8-0001Y5-Vf; Thu, 21 Mar 2013 11:09:32 +0100 Received: from dog.ripe.net ([193.0.1.217] helo=guest137.guestnet.ripe.net) by ayeaye.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1UIcR7-0008U7-1I; Thu, 21 Mar 2013 11:09:29 +0100 Message-ID: <514ADC58.5080803@ripe.net> Date: Thu, 21 Mar 2013 11:09:28 +0100 From: Oleg Muravskiy Organization: RIPE NCC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:19.0) Gecko/20100101 Firefox/19.0 SeaMonkey/2.16.2 MIME-Version: 1.0 To: Christopher Morrow References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> In-Reply-To: X-Enigmail-Version: 1.5.1 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Anti-Virus: Kaspersky Anti-Virus for Linux Mail Server 5.6.48/RELEASE, bases: 20120425 #7816575, check: 20130321 clean X-RIPE-Spam-Level: ----- X-RIPE-Spam-Report: Spam Total Points: -5.4 points pts rule name description ---- ---------------------- ------------------------------------ -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP -2.5 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] X-RIPE-Signature: c408758d4ce2e8eb06762a65a3365b74cbfc54a4dbe09c1120ba1dc257254dc9 Cc: sidr@ietf.org Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2013 10:09:33 -0000 Hi Christopher, Christopher Morrow wrote: > Comment 1 (also related with 44): I agree that ISPs may operate caches in behalf end-users ASNs, but also I think that more than 1 > cache may be operated by a single ISP. Imagine a global ASN operator with routers in several places. Are they going to have just > one master cache? Or are they have one or two (backup), and just in one location? Considering this, even the 40k clients may be > low as worse case IMHO. > oops, so... we need to be clear in terminology here there are at least: > o publication points - places/machines AS Operators would make their > authoritative information available to the world. In our analysis we associate number of CAs in the global RPKI with the number of distinct IP resource holders. You seem to associate publication points (that directly relate to CAs) with AS Operators. Since it's a second place where publication points are associated with AS Operators (another is the "RPKI rsync Download Delay Modeling" presentation), I wonder if I miss something? -- Oleg Muravskiy RIPE NCC From hschiller@google.com Thu Mar 21 07:13:37 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A081521F8E5E for ; Thu, 21 Mar 2013 07:13:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.977 X-Spam-Level: X-Spam-Status: No, score=-101.977 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CcSQEpAN-GnL for ; Thu, 21 Mar 2013 07:13:37 -0700 (PDT) Received: from mail-la0-x22c.google.com (mail-la0-x22c.google.com [IPv6:2a00:1450:4010:c03::22c]) by ietfa.amsl.com (Postfix) with ESMTP id 69C3321F90D3 for ; Thu, 21 Mar 2013 07:13:36 -0700 (PDT) Received: by mail-la0-f44.google.com with SMTP id eb20so5267325lab.31 for ; Thu, 21 Mar 2013 07:13:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:x-received:in-reply-to:references:date:message-id :subject:from:to:cc:content-type; bh=aEExAhJ17jRMG6O59YcJ99G1RqqhK3zgbaIg3zCKlX8=; b=dWYVmZUpewnLwmd9ue/UxQRCyjSXLMeNrnj7V6yOJxhRbsOi4d1lUTQLWzyvvfr3R9 sAv+ge/EjWx4GcXTOjIRMvPpcWZz1TXmshs2OoXk9FE47Lfdw06D1Kdc/qQvIqBPtM98 6gDW9xS3jc+QerF1i5vc02Gp5MAs6/5cgbRSPiLaRCVczIYdKlnuz4+/nADdIZW91J3M wxx5wuuQ8VDNZeJhDq9hoZn8rc76ujrNd/jrdKvI09nr+xaVdPXBZ210CUjAw2HqUOFM mwSFFzJog6Ye0Bd1aeK2coSyf/NsnvWrwBUJHeWQf6tzfHpgzX13nS3Lp8FObniplQL1 +XYg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:x-received:in-reply-to:references:date:message-id :subject:from:to:cc:content-type:x-gm-message-state; bh=aEExAhJ17jRMG6O59YcJ99G1RqqhK3zgbaIg3zCKlX8=; b=mvS7lco2WFI0t9FphXrfUksp7wW2O92x0mDv8XMOY9pmLXHbSSIv3itcr+us2xHLSd w+u6x8JRho807JpQAsr6bAGUW+4lEmuvPXiegM+ykYcOkUf3JHhqbwG/GPzPcw7/REy4 rNfBAbtaDR7nbGYmA2TvtcG+h8A38peEZ6/B9UumRopVPNposiagAfmBId8VhxKTIm4a mDD5FHrHbfwUK7AfLYWMIGPLGY+5VQBukBUwicJxzkx596yCC5culUh3PhhiTPUjbjk9 GX2nIR0+gdkP7bbag5i49Crx9Qx4NEeEcRer3wN8dmUSUE6pGF1vpgH/Hl9PA51doR1b Q58A== MIME-Version: 1.0 X-Received: by 10.112.28.101 with SMTP id a5mr11845802lbh.0.1363875215249; Thu, 21 Mar 2013 07:13:35 -0700 (PDT) Received: by 10.112.38.232 with HTTP; Thu, 21 Mar 2013 07:13:35 -0700 (PDT) In-Reply-To: <59A767F5-C1DC-4EE9-883C-F301DEE8EA5D@tcb.net> References: <59A767F5-C1DC-4EE9-883C-F301DEE8EA5D@tcb.net> Date: Thu, 21 Mar 2013 10:13:35 -0400 Message-ID: From: Heather Schiller To: Danny McPherson Content-Type: multipart/alternative; boundary=bcaec5555450b93dd404d86ff196 X-Gm-Message-State: ALoCoQl1yQpGZGxNlxe+tOJ0EXUhgdFxZZxGQT6k3ZPr5dFh6jcuzuE+jmWTK3IrQ2A/oVMhi92iOS0WVbrv/6n1dSP04sFTugx0+HfHRK5invfJDOSEfuJwZwWw5q1L+dw+NdEv62SgCpWg5OmXRxgh692DR6fXvs4+UzoWHxFzivbSMcGWMQGGInOd5C464mgC2pelkkuu Cc: "Sriram, Kotikalapudi" , "sidr wg list \(sidr@ietf.org\)" Subject: Re: [sidr] DDoS mitigation example (was: RE: comments on the repository analysis I-D) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2013 14:13:37 -0000 --bcaec5555450b93dd404d86ff196 Content-Type: text/plain; charset=ISO-8859-1 ..in line.. On Wed, Mar 20, 2013 at 10:57 PM, Danny McPherson wrote: > > On Mar 20, 2013, at 7:23 PM, "Sriram, Kotikalapudi" < > kotikalapudi.sriram@nist.gov> wrote: > > > The DDoS mitigation example was discussed before. > > It appeared there was a reasonable solution. > > Please see this post: > > http://www.ietf.org/mail-archive/web/sidr/current/msg05605.html > > Might work for Joel, not me... > > -danny > Could you help us understand why? In the thread, it sounds like it will/does work for Joel as your customer, as he specifically mentions using Verisign for mitigation. Is Joel mistaken? Is there something about Verisign's deployment that prevents this from working as a temporary measure in an emergency situation? > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > --bcaec5555450b93dd404d86ff196 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable

..in line..

On Wed, Mar 20, 2013 at 10:57 PM, Danny McPherson <danny@tc= b.net> wrote:

On Mar 20, 2013, at 7:23 PM, "Sriram, Kotikalapudi" <kotikalapudi.sriram@nist.gov&g= t; wrote:

> The DDoS mitigation example was discussed before.
> It appeared there was a reasonable solution.
> Please see this post:
> http://www.ietf.org/mail-archive/web/sidr/current/m= sg05605.html

Might work for Joel, not me...

-danny


Could you help us understand why? =A0In the thread, it sounds like it will= /does work for Joel as your customer, as he specifically mentions using Ver= isign for mitigation. =A0Is Joel mistaken? =A0Is there something about Veri= sign's deployment that prevents this from working as a temporary measur= e in an emergency situation? =A0=A0


=A0
=
_______________________________________________
sidr mailing list
sidr@ietf.org
ht= tps://www.ietf.org/mailman/listinfo/sidr

--bcaec5555450b93dd404d86ff196-- From shane@castlepoint.net Thu Mar 21 07:25:16 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 058CB21F8D92 for ; Thu, 21 Mar 2013 07:25:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.437 X-Spam-Level: X-Spam-Status: No, score=-0.437 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tlowieJk+SkQ for ; Thu, 21 Mar 2013 07:25:13 -0700 (PDT) Received: from mail.friendswithtools.org (unknown [64.78.239.70]) by ietfa.amsl.com (Postfix) with ESMTP id 488EC21F90A4 for ; Thu, 21 Mar 2013 07:25:13 -0700 (PDT) Received: from dspam (unknown [127.0.0.1]) by mail.friendswithtools.org (Postfix) with SMTP id 8FC29300027 for ; Thu, 21 Mar 2013 14:25:12 +0000 (UTC) Received: from [10.9.0.10] (web.hollyman.com [64.78.239.73]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by mail.friendswithtools.org (Postfix) with ESMTPSA id CB6F3300011; Thu, 21 Mar 2013 08:25:11 -0600 (MDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 6.3 \(1503\)) From: Shane Amante In-Reply-To: <24B20D14B2CD29478C8D5D6E9CBB29F66D0FD1E2@Hermes.columbia.ads.sparta.com> Date: Thu, 21 Mar 2013 08:25:11 -0600 Content-Transfer-Encoding: quoted-printable Message-Id: <32D296FE-E44D-4F6A-BF95-262DC3A358A6@castlepoint.net> References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> <5149C506.7080001@gmail.com> <5149D9A2.7030107@riw.us> <2F3EBB88EC3A454AAB08915FBF0B8C7E1D01BA@eusaamb109.ericsson.se> <514A098C.3040502@riw.us> <4B7D7C8E-273F-44DA-A705-0EB88E6459B4@istaff.org> <514A1336.4040202@riw.us> , <514A1B7A.6080603@riw.us> <24B20D14B2CD29478C8D5D6E9CBB29F66D0FD1E2@Hermes.columbia.ads.sparta.com> To: "Murphy, Sandra" X-Mailer: Apple Mail (2.1503) X-DSPAM-Result: Whitelisted X-DSPAM-Processed: Thu Mar 21 08:25:12 2013 X-DSPAM-Confidence: 0.9899 X-DSPAM-Improbability: 1 in 9809 chance of being spam X-DSPAM-Probability: 0.0000 X-DSPAM-Signature: 514b184842072732915769 X-DSPAM-Factors: 27, 2013+at, 0.01000, Mar+#+2013, 0.01000, to+#+#+#+to, 0.01000, to+#+#+#+to, 0.01000, Mime-Version*OS+X, 0.01000, not+be, 0.01000, Cc*ietf.org+#+ietf.org, 0.01000, From*Amante+shane, 0.01000, mailing+list, 0.01000, the+#+#+the, 0.01000, Subject*sidr+#+University, 0.01000, Cc*ietf.org+sidr, 0.01000, Subject*Princeton+#+#+IP, 0.01000, the+#+to, 0.01000, the+#+to, 0.01000, be+#+to, 0.01000, Subject*IP+#+Reachability, 0.01000, as+an, 0.01000, want+to, 0.01000, Subject*Impacting+#+#+Reachability, 0.01000, On+Mar, 0.01000, Subject*RPKI+Manipulations, 0.01000, Subject*University+#+#+Address, 0.01000, Subject*Princeton+#+#+#+Address, 0.01000, Subject*sidr+#+#+#+IP, 0.01000, Subject*University+Impacting, 0.01000, a+#+#+to, 0.01000 Cc: "sidr@ietf.org" Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2013 14:25:16 -0000 On Mar 20, 2013, at 2:35 PM, "Murphy, Sandra" = wrote: > Speaking as regular ol' member >=20 >> That all depends on the policy undertaken by each specific provider, >> doesn't it? How can you tell the difference between a route with no = ROA >> because the registry has decertified, and a route with no ROA simply >> because one hasn't ever been created? >=20 > To an ISP who wants to reclaim address space from a customer who has = walked or violated their agreement, the ability to decertify that = allocated space is a very good feature. One would hope that ISP's are smart enough to have signed legally = binding agreements with their customers to whom they've 'leased' IP = address space, as part of the customer's Internet transit service. And, = if such a situation were to arise, they would first look to seek advice = from their legal counsel *before* taking any actions which may result in = damages/harm being caused to that former customer's operations, such as = revocation of certificates that would decertify the address space = occupied by that customer. Generally, but perhaps not always, both = parties usually come to a mutual agreement as to a timetable whereby the = former customer is able to renumber out of the former address space in = order to return it. > You certainly would not want to end up with a system that would not = allow reclaiming address space. One should question the validity of this statement in the face of IPv6, = which (for all intents and purposes) is nearly "unlimited". On the one = hand, RIR's have (IMO) extremely generous allocation policies for IPv6 = address space, at the moment, and any business would be foolish to not = consider approaching their RIR(s) to acquire PIv6 space to number their = networks to never have to worry about having to renumber (ever). On the = other hand, for those sites that may not be fortunate enough to acquire = PIv6 space and, instead, need PAv6 addresses ... the future is far from = certain. However, in my opinion, the following are at least plausible = in the near future: a) "Loss" of IPv6 addresses, due to customer's walking, is considered by = ISP's as an acceptable cost of doing business, i.e.: not worth the costs = to engage legal counsel to reclaim them; b) We (the IETF -or- /the market/) figure out less painful multi-homing = with PAv6 addresses. The IETF may yet figure this out with something = like ILNP (Experimental) or something that is developed in HOMENET. = OTOH, the market may solve this on its own by adopting ULAv6+NPTv6. Just my $0.02, -shane > --Sandy > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr >=20 From randy@psg.com Thu Mar 21 07:36:10 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3C13121F90A6 for ; Thu, 21 Mar 2013 07:36:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.569 X-Spam-Level: X-Spam-Status: No, score=-2.569 tagged_above=-999 required=5 tests=[AWL=0.030, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HFEy8KkMfdWz for ; Thu, 21 Mar 2013 07:36:09 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id D2CB021F9083 for ; Thu, 21 Mar 2013 07:36:09 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.80.1 (FreeBSD)) (envelope-from ) id 1UIgb9-00040n-Ts for sidr@ietf.org; Thu, 21 Mar 2013 14:36:08 +0000 Date: Thu, 21 Mar 2013 16:36:05 +0200 Message-ID: From: Randy Bush To: sidr wg list In-Reply-To: <32D296FE-E44D-4F6A-BF95-262DC3A358A6@castlepoint.net> References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> <5149C506.7080001@gmail.com> <5149D9A2.7030107@riw.us> <2F3EBB88EC3A454AAB08915FBF0B8C7E1D01BA@eusaamb109.ericsson.se> <514A098C.3040502@riw.us> <4B7D7C8E-273F-44DA-A705-0EB88E6459B4@istaff.org> <514A1336.4040202@riw.us> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2013 14:36:10 -0000 aside from sharon, who is at bu, having gotten her degree at princeton, how did it get in the $subject? randy, who is not learning anything else new from this rinse repeat From shane@castlepoint.net Thu Mar 21 08:20:05 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A56B921F90B9 for ; Thu, 21 Mar 2013 08:20:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.437 X-Spam-Level: X-Spam-Status: No, score=-0.437 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UfBovT6tyy-w for ; Thu, 21 Mar 2013 08:20:03 -0700 (PDT) Received: from mail.friendswithtools.org (unknown [64.78.239.70]) by ietfa.amsl.com (Postfix) with ESMTP id 0B92B21F8775 for ; Thu, 21 Mar 2013 08:20:03 -0700 (PDT) Received: from dspam (unknown [127.0.0.1]) by mail.friendswithtools.org (Postfix) with SMTP id 7333430007E for ; Thu, 21 Mar 2013 15:20:02 +0000 (UTC) Received: from [10.9.0.10] (web.hollyman.com [64.78.239.73]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by mail.friendswithtools.org (Postfix) with ESMTPSA id 4691F30007A; Thu, 21 Mar 2013 09:20:01 -0600 (MDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 6.3 \(1503\)) From: Shane Amante In-Reply-To: Date: Thu, 21 Mar 2013 09:20:02 -0600 Content-Transfer-Encoding: quoted-printable Message-Id: <3FB26F14-CF1B-4E5F-A8BA-416F32DB983E@castlepoint.net> References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> <5149C506.7080001@gmail.com> <5149D9A2.7030107@riw.us> <2F3EBB88EC3A454AAB08915FBF0B8C7E1D01BA@eusaamb109.ericsson.se> <514A098C.3040502@riw.us> <4B7D7C8E-273F-44DA-A705-0EB88E6459B4@istaff.org> <514A1336.4040202@riw.us> To: Randy Bush X-Mailer: Apple Mail (2.1503) X-DSPAM-Result: Whitelisted X-DSPAM-Processed: Thu Mar 21 09:20:02 2013 X-DSPAM-Confidence: 0.9899 X-DSPAM-Improbability: 1 in 9809 chance of being spam X-DSPAM-Probability: 0.0000 X-DSPAM-Signature: 514b252242071590738164 X-DSPAM-Factors: 27, 2013+at, 0.01000, Mar+#+2013, 0.01000, Mime-Version*OS+X, 0.01000, From*Amante+shane, 0.01000, Subject*sidr+#+University, 0.01000, Subject*Princeton+#+#+IP, 0.01000, Subject*IP+#+Reachability, 0.01000, Subject*Impacting+#+#+Reachability, 0.01000, On+Mar, 0.01000, Subject*RPKI+Manipulations, 0.01000, Subject*University+#+#+Address, 0.01000, Subject*Princeton+#+#+#+Address, 0.01000, Subject*sidr+#+#+#+IP, 0.01000, Subject*University+Impacting, 0.01000, Subject*IP+#+#+via, 0.01000, Subject*via+#+Manipulations, 0.01000, Subject*Reachability+#+RPKI, 0.01000, Mime-Version*1.0+Mac, 0.01000, From*Shane+#+shane, 0.01000, not+#+to, 0.01000, From*Shane Amante , 0.01000, Subject*Impacting+#+#+#+via, 0.01000, Subject*Princeton+#+Impacting, 0.01000, Mar+#+#+at, 0.01000, From*Amante+#+castlepoint.net, 0.01000, Subject*Address+#+#+RPKI, 0.01000, Mime-Version*Mac+OS, 0.01000 Cc: sidr wg list Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2013 15:20:05 -0000 On Mar 21, 2013, at 8:36 AM, Randy Bush wrote: > randy, who is not learning anything else new from this rinse repeat So, you're stating that operator input wrt impacts the RPKI will have on = their networks is not useful to SIDR? OK, got it. -shane= From randy@psg.com Thu Mar 21 08:22:34 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1F91021F9061 for ; Thu, 21 Mar 2013 08:22:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.572 X-Spam-Level: X-Spam-Status: No, score=-2.572 tagged_above=-999 required=5 tests=[AWL=0.027, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M+nauMAfRPu5 for ; Thu, 21 Mar 2013 08:22:33 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id AC40121F8FCD for ; Thu, 21 Mar 2013 08:22:33 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.80.1 (FreeBSD)) (envelope-from ) id 1UIhK4-0004CO-Nm; Thu, 21 Mar 2013 15:22:33 +0000 Date: Thu, 21 Mar 2013 17:22:31 +0200 Message-ID: From: Randy Bush To: Shane Amante In-Reply-To: <3FB26F14-CF1B-4E5F-A8BA-416F32DB983E@castlepoint.net> References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> <5149C506.7080001@gmail.com> <5149D9A2.7030107@riw.us> <2F3EBB88EC3A454AAB08915FBF0B8C7E1D01BA@eusaamb109.ericsson.se> <514A098C.3040502@riw.us> <4B7D7C8E-273F-44DA-A705-0EB88E6459B4@istaff.org> <514A1336.4040202@riw.us> <3FB26F14-CF1B-4E5F-A8BA-416F32DB983E@castlepoint.net> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Cc: sidr wg list Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2013 15:22:34 -0000 >> randy, who is not learning anything else new from this rinse repeat > So, you're stating that operator input wrt impacts the RPKI will have > on their networks is not useful to SIDR? OK, got it. no. i am saying nobody seems to be saying anything that has not already been said. but if you're uninterested in input, i can understand that randy From Sandra.Murphy@sparta.com Thu Mar 21 08:27:46 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 99F0021F90AC for ; Thu, 21 Mar 2013 08:27:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id X-yHJtS1iBpr for ; Thu, 21 Mar 2013 08:27:40 -0700 (PDT) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by ietfa.amsl.com (Postfix) with ESMTP id 78CA621F913C for ; Thu, 21 Mar 2013 08:27:38 -0700 (PDT) Received: from Beta5.sparta.com ([10.62.8.21]) by M4.sparta.com (8.14.4/8.14.4) with ESMTP id r2LFRaKF021879; Thu, 21 Mar 2013 10:27:36 -0500 Received: from Hermes.columbia.ads.sparta.com ([10.62.56.107]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id r2LFRagx016791; Thu, 21 Mar 2013 10:27:36 -0500 Received: from HERMES.columbia.ads.sparta.com ([fe80::e4a8:a383:2128:c0e5]) by Hermes.columbia.ads.sparta.com ([fe80::e4a8:a383:2128:c0e5%18]) with mapi id 14.02.0247.003; Thu, 21 Mar 2013 11:27:08 -0400 From: "Murphy, Sandra" To: Shane Amante , Randy Bush Thread-Topic: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations Thread-Index: AQHOJkGDzo6UGAMCNUiNviWRRU9mtZiwhagA//++VWE= Date: Thu, 21 Mar 2013 15:27:07 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F66D0FE430@Hermes.columbia.ads.sparta.com> References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> <5149C506.7080001@gmail.com> <5149D9A2.7030107@riw.us> <2F3EBB88EC3A454AAB08915FBF0B8C7E1D01BA@eusaamb109.ericsson.se> <514A098C.3040502@riw.us> <4B7D7C8E-273F-44DA-A705-0EB88E6459B4@istaff.org> <514A1336.4040202@riw.us> , <3FB26F14-CF1B-4E5F-A8BA-416F32DB983E@castlepoint.net> In-Reply-To: <3FB26F14-CF1B-4E5F-A8BA-416F32DB983E@castlepoint.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.137] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: sidr wg list Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2013 15:27:47 -0000 =0A= >> randy, who is not learning anything else new from this rinse repeat=0A= =0A= >So, you're stating that operator input wrt impacts the RPKI will have on t= heir networks is not useful to =0A= >SIDR? OK, got it.=0A= =0A= Randy said "nothing new", not "nothing".=0A= =0A= --Sandy, speaking as regular ol' member.= From christopher.morrow@gmail.com Thu Mar 21 08:27:47 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4031221F90AC for ; Thu, 21 Mar 2013 08:27:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.45 X-Spam-Level: X-Spam-Status: No, score=-101.45 tagged_above=-999 required=5 tests=[AWL=-1.150, BAYES_00=-2.599, MANGLED_BELOW=2.3, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XyLgJ9ulWjwE for ; Thu, 21 Mar 2013 08:27:46 -0700 (PDT) Received: from mail-la0-x234.google.com (mail-la0-x234.google.com [IPv6:2a00:1450:4010:c03::234]) by ietfa.amsl.com (Postfix) with ESMTP id A703521F913E for ; Thu, 21 Mar 2013 08:27:39 -0700 (PDT) Received: by mail-la0-f52.google.com with SMTP id fs12so5433579lab.11 for ; Thu, 21 Mar 2013 08:27:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:x-received:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type; bh=mdOZbV5CWd2ma+AzsXCV0KoWy2pH7h1osNzMLEXhW30=; b=t/XfNHls+LhQIgd56bI8+UYCqXebmXizPhgsidbCJQ6EHd07xbLhT9jPr6YbXPrTi8 ut/jqHzNmZRyeD9/5xKVZdCUj44T0e+MCkvu+GlXEz0MxN9fI2KP/hEZT/+qDQdwpa0s 4lpIWveguk/aHMhIAe4EvRPSlycd/onCZjLbbVnPnwGIyovbTQiO+OpZLT3DoyKGcfID mZuEAgELf701ljpQsDmIwjSRzzXZKIXA7+0bO6yL2skeNdg4toEjwkXbA2PecjArHS8x REW3vhlCqhdrJYMeSa7zqMOrfezOUuIKeGatShc9G64wvmCHS1KX6pKcrM9BF81rcbrO rceg== MIME-Version: 1.0 X-Received: by 10.152.109.112 with SMTP id hr16mr7904678lab.38.1363879658289; Thu, 21 Mar 2013 08:27:38 -0700 (PDT) Sender: christopher.morrow@gmail.com Received: by 10.152.28.34 with HTTP; Thu, 21 Mar 2013 08:27:38 -0700 (PDT) In-Reply-To: <514ADC58.5080803@ripe.net> References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> Date: Thu, 21 Mar 2013 11:27:38 -0400 X-Google-Sender-Auth: QJscpdODkq8urSFNJ4thESSk2-4 Message-ID: From: Christopher Morrow To: Oleg Muravskiy Content-Type: text/plain; charset=ISO-8859-1 Cc: sidr@ietf.org Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2013 15:27:47 -0000 On Thu, Mar 21, 2013 at 6:09 AM, Oleg Muravskiy wrote: > Hi Christopher, > > Christopher Morrow wrote: >> Comment 1 (also related with 44): I agree that ISPs may operate caches in behalf end-users ASNs, but also I think that more than 1 >> cache may be operated by a single ISP. Imagine a global ASN operator with routers in several places. Are they going to have just >> one master cache? Or are they have one or two (backup), and just in one location? Considering this, even the 40k clients may be >> low as worse case IMHO. >> oops, so... we need to be clear in terminology here there are at least: >> o publication points - places/machines AS Operators would make their >> authoritative information available to the world. > > In our analysis we associate number of CAs in the global RPKI with the number of distinct IP resource holders. > sure, and as a proxy for that 'AS Operator', it's not a 1:1 correlation to be sure but it should be reasonably close, no? > You seem to associate publication points (that directly relate to CAs) with AS Operators. > Since it's a second place where publication points are associated with AS Operators (another is the "RPKI rsync Download Delay > Modeling" presentation), I wonder if I miss something? most likely you are not... I think I jump to 'CA == REPO == AS-Operator == ASN allocated' because lacking any direct data otherwise it seems like a good estimation of numbers. Essentially each ASN allocated is going to be a repository that needs to be gathered, right? If there are 10% more repositories due to EndSite allocations without an ASN also allocated to them I think it's still in the ballpark to say "number of Repos == ASN allocation number". I could be wrong. From randy@psg.com Thu Mar 21 08:43:52 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A8F1B21F8BA1 for ; Thu, 21 Mar 2013 08:43:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.574 X-Spam-Level: X-Spam-Status: No, score=-2.574 tagged_above=-999 required=5 tests=[AWL=0.025, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id no7N9kr1Tv8P for ; Thu, 21 Mar 2013 08:43:52 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id 4432F21F8B97 for ; Thu, 21 Mar 2013 08:43:52 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.80.1 (FreeBSD)) (envelope-from ) id 1UIheh-0004Gm-Ce; Thu, 21 Mar 2013 15:43:51 +0000 Date: Thu, 21 Mar 2013 17:43:49 +0200 Message-ID: From: Randy Bush To: Christopher Morrow In-Reply-To: References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Cc: sidr wg list Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2013 15:43:52 -0000 >> In our analysis we associate number of CAs in the global RPKI with >> the number of distinct IP resource holders. > sure, and as a proxy for that 'AS Operator', it's not a 1:1 > correlation to be sure but it should be reasonably close, no? do we have anything other than conjecture on which to base estimations of the numbers of CAs or repositories? > I jump to 'CA == REPO == AS-Operator == ASN allocated' because lacking > any direct data otherwise it seems like a good estimation of numbers. great example of conjecture. do you have any fact/measurement-based idea of how many CAs or repositories there might be five or ten years from now? the only data i have is the small number of IRR repositories and whois servers. and i suspect/hope that is a poor estimator. but i very strongly doubt that any significant portion of the stub ASs, 84% of the ASs, will run CAs. randy From christopher.morrow@gmail.com Thu Mar 21 08:54:01 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C763221F88B0 for ; Thu, 21 Mar 2013 08:53:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.408 X-Spam-Level: X-Spam-Status: No, score=-102.408 tagged_above=-999 required=5 tests=[AWL=0.192, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mUgDSUNxpk15 for ; Thu, 21 Mar 2013 08:53:59 -0700 (PDT) Received: from mail-la0-x236.google.com (mail-la0-x236.google.com [IPv6:2a00:1450:4010:c03::236]) by ietfa.amsl.com (Postfix) with ESMTP id 4395921F88BE for ; Thu, 21 Mar 2013 08:53:56 -0700 (PDT) Received: by mail-la0-f54.google.com with SMTP id gw10so5496500lab.13 for ; Thu, 21 Mar 2013 08:53:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:x-received:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type; bh=Ii/cBbSgKth/ikhNnEGUyru2MgNLZ10wF1pvNN4u6oo=; b=X04hhkzDfSZ35ofKUFeaFwuk+bw4JH4wPeHJ+lrvc6VPPNwmHk2Z8vlSr7TU8ffyoD hlLruV3LQTV6Nd7CrnhVtNM3BvItYW5ECdJLhOJYp7RpUAHdVHQmxJaPSo287lkl/LOp ANCcPUM009B5IiOZXt8xBf6GwDziUYjNGRkpBb3TGrDsboQiDB09yTN6anQU3U5SHpBl NbS45I1XGOjgfEU4f40iPP989SjQzQGbfzqkPZT9HS2ZhB89B3kwqEnGEoQ3w5Q8V0eZ 27+oPZak0BGt9Ef+/oGcHm4BspVdR8SXoTXEWC/h4ge2RUltxHUWjXgwHFktOJHVedln iThg== MIME-Version: 1.0 X-Received: by 10.152.110.6 with SMTP id hw6mr7960378lab.43.1363881235089; Thu, 21 Mar 2013 08:53:55 -0700 (PDT) Sender: christopher.morrow@gmail.com Received: by 10.152.28.34 with HTTP; Thu, 21 Mar 2013 08:53:55 -0700 (PDT) In-Reply-To: References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> Date: Thu, 21 Mar 2013 11:53:55 -0400 X-Google-Sender-Auth: r9sq7Fk-HDcOtsO_FvsmoT8tNVo Message-ID: From: Christopher Morrow To: Randy Bush Content-Type: text/plain; charset=ISO-8859-1 Cc: sidr wg list Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2013 15:54:04 -0000 On Thu, Mar 21, 2013 at 11:43 AM, Randy Bush wrote: >>> In our analysis we associate number of CAs in the global RPKI with >>> the number of distinct IP resource holders. >> sure, and as a proxy for that 'AS Operator', it's not a 1:1 >> correlation to be sure but it should be reasonably close, no? > > do we have anything other than conjecture on which to base estimations > of the numbers of CAs or repositories? no, since there aren't any CA's in existence... we have, or I have, a model that says: "If you want to publish a ROA, you need to have a CA and you need to run a publication point" To me that means at the least every ASN will have a publication point (and this a roa and a CA). >> I jump to 'CA == REPO == AS-Operator == ASN allocated' because lacking >> any direct data otherwise it seems like a good estimation of numbers. > > great example of conjecture. do you have any fact/measurement-based > idea of how many CAs or repositories there might be five or ten years > from now? the only data i have is the small number of IRR repositories > and whois servers. and i suspect/hope that is a poor estimator. I really don't know how to estimate ASIDE from saying: "it seems reasonable that the repo number will track with assigned ASN" I could be wrong, I could also be corrected if someone else has a compelling story... I don't think it's harmful to say "tracks to ASN numbers" though, if it's too large a number we can be surprised by performance... if it's too small, we can also be surprised :) > but i very strongly doubt that any significant portion of the stub ASs, > 84% of the ASs, will run CAs. they may not. they may use a hosted-model product. I suspect that very soon after 'hosted model' comes into being in the large, the operators of these systems will realize that if someone dislikes one of their customers they can't survive as a business if all other customers also disappear. They will be forced to run the system with unique names/ips for each customer (names at a minimum so they can shift problem children away). So, in the above case... CA == ASN == REPO -chris From joelja@bogus.com Thu Mar 21 09:46:14 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 79E6F21F8EF2 for ; Thu, 21 Mar 2013 09:46:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.276 X-Spam-Level: X-Spam-Status: No, score=-102.276 tagged_above=-999 required=5 tests=[AWL=0.323, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WSvgwwO5dA8y for ; Thu, 21 Mar 2013 09:46:13 -0700 (PDT) Received: from nagasaki.bogus.com (nagasaki.bogus.com [IPv6:2001:418:1::81]) by ietfa.amsl.com (Postfix) with ESMTP id 7880A21F8F02 for ; Thu, 21 Mar 2013 09:46:13 -0700 (PDT) Received: from joels-MacBook-Air.local (host-64-47-153-50.masergy.com [64.47.153.50]) (authenticated bits=0) by nagasaki.bogus.com (8.14.4/8.14.4) with ESMTP id r2LGk14J084683 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Thu, 21 Mar 2013 16:46:02 GMT (envelope-from joelja@bogus.com) Message-ID: <514B3945.1020406@bogus.com> Date: Thu, 21 Mar 2013 09:45:57 -0700 From: joel jaeggli User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:19.0) Gecko/20130117 Thunderbird/19.0 MIME-Version: 1.0 To: Danny McPherson , "Sriram, Kotikalapudi" References: <59A767F5-C1DC-4EE9-883C-F301DEE8EA5D@tcb.net> In-Reply-To: <59A767F5-C1DC-4EE9-883C-F301DEE8EA5D@tcb.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.2.7 (nagasaki.bogus.com [147.28.0.81]); Thu, 21 Mar 2013 16:46:02 +0000 (UTC) Cc: "sidr wg list \(sidr@ietf.org\)" Subject: Re: [sidr] DDoS mitigation example (was: RE: comments on the repository analysis I-D) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2013 16:46:14 -0000 On 3/20/13 7:57 PM, Danny McPherson wrote: > On Mar 20, 2013, at 7:23 PM, "Sriram, Kotikalapudi" wrote: > >> The DDoS mitigation example was discussed before. >> It appeared there was a reasonable solution. >> Please see this post: >> http://www.ietf.org/mail-archive/web/sidr/current/msg05605.html > Might work for Joel, not me... That's entirely possible. I was only filtering through my experience as one customer. > -danny > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From sharon.goldbe@gmail.com Thu Mar 21 09:48:52 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3ECFB21F90DD for ; Thu, 21 Mar 2013 09:48:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.978 X-Spam-Level: X-Spam-Status: No, score=-1.978 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, NO_RELAYS=-0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3zhc-63d74HA for ; Thu, 21 Mar 2013 09:48:51 -0700 (PDT) Received: from mail-we0-x22d.google.com (mail-we0-x22d.google.com [IPv6:2a00:1450:400c:c03::22d]) by ietfa.amsl.com (Postfix) with ESMTP id 3B35E21F9069 for ; Thu, 21 Mar 2013 09:48:51 -0700 (PDT) Received: by mail-we0-f173.google.com with SMTP id x51so2491410wey.18 for ; Thu, 21 Mar 2013 09:48:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=x-received:mime-version:sender:in-reply-to:references:from:date :x-google-sender-auth:message-id:subject:to:cc:content-type; bh=1jSkasEasjwgLqltSd9P04lIR7RK4/zCzj9Avk4mp7o=; b=v7SOdtrikK0vwKQdNlmtHAEiE3DOyKCnltqmlEAJUu/HlLDauSR0a2M1i19vlmQYiL 5LmvaEaCFAfsKWiSSRw6G7wwZtQlqkbfYfJLo6OVgwM/S7hykQBrpt4zq/rDjOcBZ2s2 Nz9LT7aukvM5LIDstkDwZ9BO1XqHefB3TTlbje2dP7IyTTdX8Sbd5N3x7Zli1fUkOipW v3e80+JhZEDMrhx36c2cVqgIdWtiUEshSzJ1tGj50IYbRhNUSuBumLLGe0fSbCz5BdPS cpbkR8SdoOx8ga4nsDqktR/t6CYtJSqdqykQ9Rvh69ETH3PfnF4rrTum58FwJW10ok0W iiWA== X-Received: by 10.180.187.129 with SMTP id fs1mr1268997wic.5.1363884530420; Thu, 21 Mar 2013 09:48:50 -0700 (PDT) MIME-Version: 1.0 Sender: sharon.goldbe@gmail.com Received: by 10.194.59.135 with HTTP; Thu, 21 Mar 2013 09:48:10 -0700 (PDT) In-Reply-To: <24B20D14B2CD29478C8D5D6E9CBB29F66D0FE430@Hermes.columbia.ads.sparta.com> References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> <5149C506.7080001@gmail.com> <5149D9A2.7030107@riw.us> <2F3EBB88EC3A454AAB08915FBF0B8C7E1D01BA@eusaamb109.ericsson.se> <514A098C.3040502@riw.us> <4B7D7C8E-273F-44DA-A705-0EB88E6459B4@istaff.org> <514A1336.4040202@riw.us> <3FB26F14-CF1B-4E5F-A8BA-416F32DB983E@castlepoint.net> <24B20D14B2CD29478C8D5D6E9CBB29F66D0FE430@Hermes.columbia.ads.sparta.com> From: Sharon Goldberg Date: Thu, 21 Mar 2013 12:48:10 -0400 X-Google-Sender-Auth: pRA1LZpqATy_gKuloz0EB6edEDo Message-ID: To: sidr wg list Content-Type: text/plain; charset=ISO-8859-1 Cc: Ethan Heilman , Kyle Brogle , Danny Cooper Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2013 16:50:15 -0000 Thanks for the interest in our work. We wanted to clarify a few points: -- We have a technical report, which contains motivation and details that the slide deck does not. See http://www.cs.bu.edu/~goldbe/papers/RPKImanip.pdf -- As we point out in the paper (and as John Curran, Carlos, and others have noted here) a missing ROA will not necessarily make the target unreachable. That depends on the policy at relying parties. We discuss this in Section 3 of the report. For example, if a route for a prefix becomes invalid due to a missing/invalid ROA, and if everyone uses a "drop invalid" policy, that prefix would become unreachable. However, with other policies (e.g. depref invalid) the prefix may still be reachable. -- Per John Curran and others' points, we want to emphasize that a missing ROA can make a route either unknown or invalid. That depends on whether there is another ROA for a covering prefix and a different AS (see http://tools.ietf.org/html/rfc6483#section-2). -- We show that it is possible to revoke a ROA surreptitiously, through methods other than (the obvious) revocation lists. See Section 2.2.1 of the report. -- We show that targeted revocation can be accomplished by entities other than a ROA's issuer, some of which may control many ROAs. The means by which this is accomplished often looks similar to grandparenting. See Sections 2.2.2, 2.2.3, and 2.3 of the report. -- We agree with the observation that watching the RPKI repositories for changes/anomalies is a good first to step to mitigating the impact of manipulations. We are working on such a system right now. More comments are welcome. Sharon, Leo, Danny, Ethan, and Kyle (At Boston University, not Princeton!) -- Sharon Goldberg Computer Science, Boston University http://www.cs.bu.edu/~goldbe From randy@psg.com Thu Mar 21 10:55:10 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3B42721F8D46 for ; Thu, 21 Mar 2013 10:55:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.576 X-Spam-Level: X-Spam-Status: No, score=-2.576 tagged_above=-999 required=5 tests=[AWL=0.023, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Pq8RF4VNyxgz for ; Thu, 21 Mar 2013 10:55:09 -0700 (PDT) Received: from psg.com (psg.com [IPv6:2001:418:1::62]) by ietfa.amsl.com (Postfix) with ESMTP id 300F921F88CA for ; Thu, 21 Mar 2013 10:55:09 -0700 (PDT) Received: from [146.185.34.169] (helo=[10.123.132.75]) by psg.com with esmtpsa (TLSv1:RC4-MD5:128) (Exim 4.80.1 (FreeBSD)) (envelope-from ) id 1UIjhk-00080u-3G; Thu, 21 Mar 2013 17:55:09 +0000 User-Agent: K-9 Mail for Android In-Reply-To: References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Randy Bush Date: Thu, 21 Mar 2013 19:55:00 +0200 To: Christopher Morrow Message-ID: <489fe43c-ec45-4bba-86e4-b8a39df1e731@email.android.com> Cc: sidr wg list Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2013 17:55:10 -0000 > I have, a model that says: > "If you want to publish a ROA, you need to have a CA and you need to >run a publication point" >land this a roa and a CA). Wherever did you get that? what is the ratio of hosted LIRs to delegated today? -- phone email, so sucky From jcurran@istaff.org Thu Mar 21 12:27:44 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8380821F9061 for ; Thu, 21 Mar 2013 12:27:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id L6w8Utz28LEI for ; Thu, 21 Mar 2013 12:27:43 -0700 (PDT) Received: from mho-02-ewr.mailhop.org (mho-04-ewr.mailhop.org [204.13.248.74]) by ietfa.amsl.com (Postfix) with ESMTP id D56BA21F905C for ; Thu, 21 Mar 2013 12:27:43 -0700 (PDT) Received: from pool-71-191-247-90.washdc.fios.verizon.net ([71.191.247.90] helo=[192.168.1.7]) by mho-02-ewr.mailhop.org with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.72) (envelope-from ) id 1UIl9L-000Itt-5H; Thu, 21 Mar 2013 19:27:43 +0000 X-Mail-Handler: Dyn Standard SMTP by Dyn X-Originating-IP: 71.191.247.90 X-Report-Abuse-To: abuse@dyndns.com (see http://www.dyndns.com/services/sendlabs/outbound_abuse.html for abuse reporting information) X-MHO-User: U2FsdGVkX188pJfZT5LWQBmMN/P9Yi0U Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 6.3 \(1503\)) From: John Curran In-Reply-To: Date: Thu, 21 Mar 2013 15:27:46 -0400 Content-Transfer-Encoding: 7bit Message-Id: <8925B9D1-F901-47C4-9F05-C4FECC9B13F5@istaff.org> References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> <5149C506.7080001@gmail.com> <5149D9A2.7030107@riw.us> <2F3EBB88EC3A454AAB08915FBF0B8C7E1D01BA@eusaamb109.ericsson.se> <514A098C.3040502@riw.us> <4B7D7C8E-273F-44DA-A705-0EB88E6459B4@istaff.org> <514A1336.4040202@riw.us> <3FB26F14-CF1B-4E5F-A8BA-416F32DB983E@castlepoint.net> <24B20D14B2CD29478C8D5D6E9CBB29F66D0FE430@Hermes.columbia.ads.sparta.com> To: Sharon Goldberg X-Mailer: Apple Mail (2.1503) Cc: Danny Cooper , Kyle Brogle , Ethan Heilman , sidr wg list Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2013 19:27:44 -0000 On Mar 21, 2013, at 12:48 PM, Sharon Goldberg wrote: > Thanks for the interest in our work. We wanted to clarify a few points: > > -- We have a technical report, which contains motivation and details > that the slide deck does not. See > http://www.cs.bu.edu/~goldbe/papers/RPKImanip.pdf Sharon - Thanks for the pointer to the paper - it appears to be a far more complete treatment of the topic than the summary slide deck. /John From christopher.morrow@gmail.com Thu Mar 21 12:43:16 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9843621F8C99 for ; Thu, 21 Mar 2013 12:43:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.436 X-Spam-Level: X-Spam-Status: No, score=-102.436 tagged_above=-999 required=5 tests=[AWL=0.164, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h+t6Esi68vo9 for ; Thu, 21 Mar 2013 12:43:16 -0700 (PDT) Received: from mail-la0-x22c.google.com (mail-la0-x22c.google.com [IPv6:2a00:1450:4010:c03::22c]) by ietfa.amsl.com (Postfix) with ESMTP id B2C3121F8C8F for ; Thu, 21 Mar 2013 12:43:15 -0700 (PDT) Received: by mail-la0-f44.google.com with SMTP id eb20so5940647lab.31 for ; Thu, 21 Mar 2013 12:43:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:x-received:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type; bh=DR9GQIdfXJH8vmt8eHqZWulXlciq5oO/UZK428E3F0k=; b=KfLtSXH9kxQlusD1YuCRXoaH71QhoUpBW6yvchdvRC6OUW//aQVHK92g5MIOG7eUVY sFWv96qv230sbCXA1Mh0IWAtkdc/8XdiBoplTUnyDWugdepIe2laZNKPcjHDJ1AgsViz 9VseDhspCwOzMy576DLzk/KYb/CvSgspYGcYW3Vhi919YM6geQZsNxg71MzPaGTe12ZZ WaAwe8kcvUy0Wx9DNwNULKSRhMuGxp/uM6lMyQt90acPpJpXpBXcT8Mn+t9RjhOvSbdR B8Qd1umBFffKiwbVHyOHtYrjySmnoLJsl1mHJM0edqImsllWp4QnZo1u9TckzWfPLM1k gWFg== MIME-Version: 1.0 X-Received: by 10.152.104.199 with SMTP id gg7mr8275560lab.14.1363894994661; Thu, 21 Mar 2013 12:43:14 -0700 (PDT) Sender: christopher.morrow@gmail.com Received: by 10.152.28.34 with HTTP; Thu, 21 Mar 2013 12:43:14 -0700 (PDT) In-Reply-To: <489fe43c-ec45-4bba-86e4-b8a39df1e731@email.android.com> References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <489fe43c-ec45-4bba-86e4-b8a39df1e731@email.android.com> Date: Thu, 21 Mar 2013 15:43:14 -0400 X-Google-Sender-Auth: jHD9eqm2bQ4BptLUkbsZFe1oKKs Message-ID: From: Christopher Morrow To: Randy Bush Content-Type: text/plain; charset=ISO-8859-1 Cc: sidr wg list Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2013 19:43:16 -0000 On Thu, Mar 21, 2013 at 1:55 PM, Randy Bush wrote: >> I have, a model that says: >> "If you want to publish a ROA, you need to have a CA and you need to >>run a publication point" >>land this a roa and a CA). > > Wherever did you get that? I figured in the worst case you'd end up with 1:1... I don't think it'll be much worse than 1:1, it could be better, of course. > what is the ratio of hosted LIRs to delegated today? not sure... I believe that hosted == delegated though in the long run, from the perspective of what ip/name you have to connect to in order to access the data stored in the repositories. From danny@tcb.net Thu Mar 21 13:01:19 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1988B21F8CAC for ; Thu, 21 Mar 2013 13:01:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.437 X-Spam-Level: X-Spam-Status: No, score=-100.437 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Q5AGfVEUX79d for ; Thu, 21 Mar 2013 13:01:18 -0700 (PDT) Received: from mail.friendswithtools.org (unknown [64.78.239.70]) by ietfa.amsl.com (Postfix) with ESMTP id 9EFC521F8CA7 for ; Thu, 21 Mar 2013 13:01:18 -0700 (PDT) Received: from dspam (unknown [127.0.0.1]) by mail.friendswithtools.org (Postfix) with SMTP id 5C3AE30007D for ; Thu, 21 Mar 2013 20:01:18 +0000 (UTC) Received: from mail2.tcb.net (localhost [127.0.0.1]) by mail.friendswithtools.org (Postfix) with ESMTP id D73FD30007A; Thu, 21 Mar 2013 14:01:17 -0600 (MDT) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Date: Thu, 21 Mar 2013 14:01:17 -0600 From: Danny McPherson To: joel jaeggli In-Reply-To: <514B3945.1020406@bogus.com> References: <59A767F5-C1DC-4EE9-883C-F301DEE8EA5D@tcb.net> <514B3945.1020406@bogus.com> Message-ID: X-Sender: danny@tcb.net User-Agent: Roundcube Webmail/0.8.2 X-DSPAM-Result: Whitelisted X-DSPAM-Processed: Thu Mar 21 14:01:18 2013 X-DSPAM-Confidence: 0.9899 X-DSPAM-Improbability: 1 in 9809 chance of being spam X-DSPAM-Probability: 0.0000 X-DSPAM-Signature: 514b670e42072032075557 X-DSPAM-Factors: 27, Subject*repository+#+I-D, 0.01000, Subject*on+the, 0.01000, Cc*ietf.org+#+ietf.org, 0.01000, Subject*comments+on, 0.01000, Cc*ietf.org+sidr, 0.01000, Subject*comments+#+the, 0.01000, From*Danny+#+danny, 0.01000, From*Danny+#+#+tcb.net, 0.01000, Subject*repository+analysis, 0.01000, Subject*Re+sidr, 0.01000, From*Danny+McPherson, 0.01000, On+#+03, 0.01000, Cc*sidr+ietf.org, 0.01000, Cc*sidr+ietf.org, 0.01000, Subject*analysis+I-D, 0.01000, On+2013, 0.01000, Cc*sidr+#+#+ietf.org, 0.01000, From*McPherson+danny, 0.01000, From*Danny McPherson , 0.01000, 2013+03, 0.01000, From*McPherson+#+tcb.net, 0.01000, From*danny+tcb.net, 0.01000, Cc*sidr+#+sidr, 0.01000, On+#+#+#+10, 0.40000, That's+#+#+#+was, 0.40000, entirely+possible, 0.40000, me+#+entirely, 0.40000 Cc: "sidr wg list \(sidr@ietf.org\)" Subject: Re: [sidr] DDoS mitigation example (was: RE: comments on the repository analysis I-D) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2013 20:01:19 -0000 On 2013-03-21 10:45, joel jaeggli wrote: >> Might work for Joel, not me... > That's entirely possible. I was only filtering through my experience > as one customer. Yep, I concur, hence my comment :-) We have _lots of customers with varying requirements and capabilities, not that that's in scope of SIDR. -danny From kent@bbn.com Thu Mar 21 13:11:23 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 40B5021F8AB2 for ; Thu, 21 Mar 2013 13:11:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.599 X-Spam-Level: X-Spam-Status: No, score=-106.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Jk+r5G9tV1Rb for ; Thu, 21 Mar 2013 13:11:11 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) by ietfa.amsl.com (Postfix) with ESMTP id F276521F8667 for ; Thu, 21 Mar 2013 13:11:10 -0700 (PDT) Received: from dhcp89-089-218.bbn.com ([128.89.89.218]:49466) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1UIlpN-000CBZ-Qj; Thu, 21 Mar 2013 16:11:09 -0400 Message-ID: <514B695D.2050307@bbn.com> Date: Thu, 21 Mar 2013 16:11:09 -0400 From: Stephen Kent User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: sidr@ietf.org, Chris Morrow , Oleg Muravskiy References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> In-Reply-To: Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2013 20:11:23 -0000 Chris, > ...most likely you are not... I think I jump to 'CA == REPO == > AS-Operator == ASN allocated' because lacking any direct data > otherwise it seems like a good estimation of numbers. Essentially each > ASN allocated is going to be a repository that needs to be gathered, > right? If there are 10% more repositories due to EndSite allocations > without an ASN also allocated to them I think it's still in the > ballpark to say "number of Repos == ASN allocation number". > > I could be wrong. > So far the 1,300+ folks who have signed up for managed CA services have also let the RIRs manage their pub points, which dramatically reduces the number of repositories. That could change over time, e.g., if these folks become unhappy with the repository management, but for now I think it is reasonable to assume a much smaller number of repositories, which is what Sriram and I did in our model. From kent@bbn.com Thu Mar 21 13:15:13 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 662D721F8970 for ; Thu, 21 Mar 2013 13:15:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.599 X-Spam-Level: X-Spam-Status: No, score=-106.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id joa003mTLnpx for ; Thu, 21 Mar 2013 13:15:12 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) by ietfa.amsl.com (Postfix) with ESMTP id 9C09721F8A18 for ; Thu, 21 Mar 2013 13:15:11 -0700 (PDT) Received: from dhcp89-089-218.bbn.com ([128.89.89.218]:49467) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1UIltB-000CSX-JJ; Thu, 21 Mar 2013 16:15:05 -0400 Message-ID: <514B6A49.6030401@bbn.com> Date: Thu, 21 Mar 2013 16:15:05 -0400 From: Stephen Kent User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: sidr@ietf.org, Chris Morrow , Randy Bush References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> In-Reply-To: Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2013 20:15:13 -0000 Chris, > On Thu, Mar 21, 2013 at 11:43 AM, Randy Bush wrote: >>>> In our analysis we associate number of CAs in the global RPKI with >>>> the number of distinct IP resource holders. >>> sure, and as a proxy for that 'AS Operator', it's not a 1:1 >>> correlation to be sure but it should be reasonably close, no? >> do we have anything other than conjecture on which to base estimations >> of the numbers of CAs or repositories? > no, since there aren't any CA's in existence... well, there are over 1,300 so far, but almost all are managed CAs. > we have, or I have, a > model that says: > "If you want to publish a ROA, you need to have a CA and you need to > run a publication point" still true, even for managed CAs. > To me that means at the least every ASN will have a publication point > (and this a roa and a CA). it's a ROA, a manifest, a CRL, maybe a GB record, and a CA cert in the parent's pub point. > >>> I jump to 'CA == REPO == AS-Operator == ASN allocated' because lacking >>> any direct data otherwise it seems like a good estimation of numbers. >> great example of conjecture. do you have any fact/measurement-based >> idea of how many CAs or repositories there might be five or ten years >> from now? the only data i have is the small number of IRR repositories >> and whois servers. and i suspect/hope that is a poor estimator. > I really don't know how to estimate ASIDE from saying: "it seems > reasonable that the repo number will track with assigned ASN" see my earlier comment re this possible equivalency. > I could be wrong, I could also be corrected if someone else has a > compelling story... I don't think it's harmful to say "tracks to ASN > numbers" though, if it's too large a number we can be surprised by > performance... if it's too small, we can also be surprised :) > >> but i very strongly doubt that any significant portion of the stub ASs, >> 84% of the ASs, will run CAs. > they may not. > they may use a hosted-model product. but even in the "hosted model" each of these fokks is represented by a CA and a pub point. I think the only issue is whether each is a separate repository. > I suspect that very soon after 'hosted model' comes into being in the > large, the operators of these systems will realize that if someone > dislikes one of their customers they can't survive as a business if > all other customers also disappear. They will be forced to run the > system with unique names/ips for each customer (names at a minimum so > they can shift problem children away). > > So, in the above case... CA == ASN == REPO > I don't understand that last argument. Can you expand on it? Thanks, Steve From morrowc@ops-netman.net Thu Mar 21 13:29:26 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EB4C021F8C9A for ; Thu, 21 Mar 2013 13:29:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FIMJBPg+K3yE for ; Thu, 21 Mar 2013 13:29:26 -0700 (PDT) Received: from mailserver.ops-netman.net (mailserver.ops-netman.net [208.76.12.119]) by ietfa.amsl.com (Postfix) with ESMTP id 4DECF21F8A0D for ; Thu, 21 Mar 2013 13:29:26 -0700 (PDT) Received: from donkey.her.corp.google.com (unknown [IPv6:2620:0:100a:0:baac:6fff:fe92:fb7a]) (Authenticated sender: morrowc@OPS-NETMAN.NET) by mailserver.ops-netman.net (Postfix) with ESMTPSA id 545463202CF; Thu, 21 Mar 2013 20:29:01 +0000 (UTC) Message-ID: <514B6D8D.5030504@ops-netman.net> Date: Thu, 21 Mar 2013 16:29:01 -0400 From: Chris Morrow User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130308 Thunderbird/17.0.4 MIME-Version: 1.0 To: Stephen Kent References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514B695D.2050307@bbn.com> In-Reply-To: <514B695D.2050307@bbn.com> X-Enigmail-Version: 1.4.6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: sidr@ietf.org Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2013 20:29:27 -0000 On 03/21/2013 04:11 PM, Stephen Kent wrote: > Chris, > >> ...most likely you are not... I think I jump to 'CA == REPO == >> AS-Operator == ASN allocated' because lacking any direct data >> otherwise it seems like a good estimation of numbers. Essentially each >> ASN allocated is going to be a repository that needs to be gathered, >> right? If there are 10% more repositories due to EndSite allocations >> without an ASN also allocated to them I think it's still in the >> ballpark to say "number of Repos == ASN allocation number". >> >> I could be wrong. >> > So far the 1,300+ folks who have signed up for managed CA services have > also > let the RIRs manage their pub points, which dramatically reduces the > number of repositories. That could change over time, e.g., if these TODAY it reduces the number, yes. 100% agree. TOMORROW the number of repositories, even those which are 'hosted' will be split up by name and/or ip-address... I have a feeling these will be like DNS servers and likely ripe (ha!) points for attack by bad folks. So sharing fate for all customers just seems like a bad idea. > folks become unhappy with the repository management, but for now I think > it is reasonable to assume a much smaller number of repositories, which > is what Sriram and I did in our model. yup. but having the ability to increase the number of repositories in the model means we can say: "today with N repositories and M objects we see times of Y. Tomorrow when we have X repositories with Y objects we should see times of Z" -chris From danny@tcb.net Thu Mar 21 13:42:17 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8FE1B21F8613 for ; Thu, 21 Mar 2013 13:42:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.437 X-Spam-Level: X-Spam-Status: No, score=-100.437 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iCdsWcH5+ocy for ; Thu, 21 Mar 2013 13:42:17 -0700 (PDT) Received: from mail.friendswithtools.org (unknown [64.78.239.70]) by ietfa.amsl.com (Postfix) with ESMTP id CC6F621F85EE for ; Thu, 21 Mar 2013 13:42:16 -0700 (PDT) Received: from dspam (unknown [127.0.0.1]) by mail.friendswithtools.org (Postfix) with SMTP id A13C930007D for ; Thu, 21 Mar 2013 20:42:11 +0000 (UTC) Received: from mail2.tcb.net (localhost [127.0.0.1]) by mail.friendswithtools.org (Postfix) with ESMTP id 7483430007A for ; Thu, 21 Mar 2013 14:42:11 -0600 (MDT) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Date: Thu, 21 Mar 2013 14:42:11 -0600 From: Danny McPherson To: In-Reply-To: <514B6D8D.5030504@ops-netman.net> References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514B695D.2050307@bbn.com> <514B6D8D.5030504@ops-netman.net> Message-ID: X-Sender: danny@tcb.net User-Agent: Roundcube Webmail/0.8.2 X-DSPAM-Result: Whitelisted X-DSPAM-Processed: Thu Mar 21 14:42:11 2013 X-DSPAM-Confidence: 0.9899 X-DSPAM-Improbability: 1 in 9809 chance of being spam X-DSPAM-Probability: 0.0000 X-DSPAM-Signature: 514b70a342071615918567 X-DSPAM-Factors: 27, to+#+the, 0.01000, Subject*repository+#+I-D, 0.01000, Subject*on+the, 0.01000, Subject*comments+on, 0.01000, a+#+to, 0.01000, Subject*sidr+#+#+the, 0.01000, to+#+#+and, 0.01000, Subject*the+#+analysis, 0.01000, the+#+to, 0.01000, it+is, 0.01000, Subject*sidr+#+#+#+repository, 0.01000, Subject*comments+#+#+#+analysis, 0.01000, Subject*on+#+repository, 0.01000, To*sidr+ietf.org, 0.01000, the+#+#+#+the, 0.01000, the+#+of, 0.01000, the+#+of, 0.01000, in+the, 0.01000, Subject*comments+#+the, 0.01000, Subject*sidr+#+on, 0.01000, From*Danny+#+danny, 0.01000, From*Danny+#+#+tcb.net, 0.01000, of+#+#+the, 0.01000, need+to, 0.01000, Subject*repository+analysis, 0.01000, Subject*Re+sidr, 0.01000, From*Danny+McPherson, 0.01000 Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2013 20:42:17 -0000 On 2013-03-21 14:29, Chris Morrow wrote: > TODAY it reduces the number, yes. 100% agree. > TOMORROW the number of repositories, even those which are 'hosted' > will > be split up by name and/or ip-address... > > I have a feeling these will be like DNS servers and likely ripe (ha!) > points for attack by bad folks. So sharing fate for all customers > just > seems like a bad idea. > >> folks become unhappy with the repository management, but for now I >> think >> it is reasonable to assume a much smaller number of repositories, >> which >> is what Sriram and I did in our model. > > yup. but having the ability to increase the number of repositories in > the model means we can say: "today with N repositories and M objects > we > see times of Y. Tomorrow when we have X repositories with Y objects > we > should see times of Z" Agreed. Additionally, this perspective may well change when things like BGPSEC router keys need to be published and then ingested by operational routers for update signing, as the trust model is fairly different, methinks. Even the "84%'r" morons (i.e., all those stub ASes) might recognize this as a threat to their operational autonomy. fail open, -danny From morrowc@ops-netman.net Thu Mar 21 13:46:57 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 104B821F8C99 for ; Thu, 21 Mar 2013 13:46:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NoL685KGLjbw for ; Thu, 21 Mar 2013 13:46:55 -0700 (PDT) Received: from mailserver.ops-netman.net (mailserver.ops-netman.net [IPv6:2606:700:e:b00b:5054:ff:fe79:69db]) by ietfa.amsl.com (Postfix) with ESMTP id 4953421F8C71 for ; Thu, 21 Mar 2013 13:46:55 -0700 (PDT) Received: from donkey.her.corp.google.com (unknown [IPv6:2620:0:100a:0:baac:6fff:fe92:fb7a]) (Authenticated sender: morrowc@OPS-NETMAN.NET) by mailserver.ops-netman.net (Postfix) with ESMTPSA id 85F11320199; Thu, 21 Mar 2013 20:46:53 +0000 (UTC) Message-ID: <514B71BD.4020101@ops-netman.net> Date: Thu, 21 Mar 2013 16:46:53 -0400 From: Chris Morrow User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130308 Thunderbird/17.0.4 MIME-Version: 1.0 To: Stephen Kent References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514B6A49.6030401@bbn.com> In-Reply-To: <514B6A49.6030401@bbn.com> X-Enigmail-Version: 1.4.6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: sidr@ietf.org Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2013 20:46:57 -0000 On 03/21/2013 04:15 PM, Stephen Kent wrote: > Chris, > >> On Thu, Mar 21, 2013 at 11:43 AM, Randy Bush wrote: >>>>> In our analysis we associate number of CAs in the global RPKI with >>>>> the number of distinct IP resource holders. >>>> sure, and as a proxy for that 'AS Operator', it's not a 1:1 >>>> correlation to be sure but it should be reasonably close, no? >>> do we have anything other than conjecture on which to base estimations >>> of the numbers of CAs or repositories? >> no, since there aren't any CA's in existence... > well, there are over 1,300 so far, but almost all are managed CAs. >> we have, or I have, a >> model that says: >> "If you want to publish a ROA, you need to have a CA and you need to >> run a publication point" > > still true, even for managed CAs. > >> To me that means at the least every ASN will have a publication point >> (and this a roa and a CA). > > it's a ROA, a manifest, a CRL, maybe a GB record, and a CA cert in the > parent's pub point. sure, I abbreviated the list. >> >>>> I jump to 'CA == REPO == AS-Operator == ASN allocated' because lacking >>>> any direct data otherwise it seems like a good estimation of numbers. >>> great example of conjecture. do you have any fact/measurement-based >>> idea of how many CAs or repositories there might be five or ten years >>> from now? the only data i have is the small number of IRR repositories >>> and whois servers. and i suspect/hope that is a poor estimator. >> I really don't know how to estimate ASIDE from saying: "it seems >> reasonable that the repo number will track with assigned ASN" > > see my earlier comment re this possible equivalency. > >> I could be wrong, I could also be corrected if someone else has a >> compelling story... I don't think it's harmful to say "tracks to ASN >> numbers" though, if it's too large a number we can be surprised by >> performance... if it's too small, we can also be surprised :) >> >>> but i very strongly doubt that any significant portion of the stub ASs, >>> 84% of the ASs, will run CAs. >> they may not. >> they may use a hosted-model product. > > but even in the "hosted model" each of these folks is represented by > a CA and a pub point. I think the only issue is whether each is a separate > repository. correct. one contiguous repo is a great target ... once or twice that'll work, then the repository operator will split all customers into separate names at the least that she can steer to infrastructure in case of a problem. > >> I suspect that very soon after 'hosted model' comes into being in the >> large, the operators of these systems will realize that if someone >> dislikes one of their customers they can't survive as a business if >> all other customers also disappear. They will be forced to run the >> system with unique names/ips for each customer (names at a minimum so >> they can shift problem children away). >> >> So, in the above case... CA == ASN == REPO >> > > I don't understand that last argument. Can you expand on it? Today, if you look at: dig NS ly ly.cctld.authdns.ripe.net. is one of the servers listed... ripe sets up a separate name/ip for each CC they serve. This gives them the flexibility to move one victim off to a dedicated server(s) in the case of really bad problems. I suspect that the hosted repository model will evolve to this over time. -chris From christopher.morrow@gmail.com Thu Mar 21 13:59:52 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 49D3C21F8CCB for ; Thu, 21 Mar 2013 13:59:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.456 X-Spam-Level: X-Spam-Status: No, score=-102.456 tagged_above=-999 required=5 tests=[AWL=0.144, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hm9pCpV09GWL for ; Thu, 21 Mar 2013 13:59:51 -0700 (PDT) Received: from mail-la0-x22f.google.com (mail-la0-x22f.google.com [IPv6:2a00:1450:4010:c03::22f]) by ietfa.amsl.com (Postfix) with ESMTP id 0507821F8630 for ; Thu, 21 Mar 2013 13:59:44 -0700 (PDT) Received: by mail-la0-f47.google.com with SMTP id fj20so5943764lab.6 for ; Thu, 21 Mar 2013 13:59:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:x-received:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type; bh=Q4qy95IbVYErIKccZrYtwIl2Iypqzi2plt8sslTn8ps=; b=SYBkcyTBweXJb0ZH2uaQrNTFeu1bMK+ExeKF42vbGGol3FHK+o3PQanln7QXORiLch GkEt72aktA9+BFwVzp6D+fItkJczOWxATiqMOYJPekMzsTRiiuzdgDrEDQ8INPHxl6yq 9Tf+SeCaZGlmqD6e5RAURUngT59jaTFSSAQQq+r2uY7fEG6YyQE1s6ZeDHoBenWf4YtL Eg2xWeWSDBz29npQZxiw0deHg1DFKMNefTdIJy3HfQJ/rqqewpqQTKX6bg8Tnz1a3nlm Lao0ryimuhhZc0us7Br0cS53hH7zBPhW2p4J6Sz6DipsNLG4btD32DHn68fajQNAVbVI 5DFA== MIME-Version: 1.0 X-Received: by 10.112.47.41 with SMTP id a9mr12315485lbn.134.1363899583918; Thu, 21 Mar 2013 13:59:43 -0700 (PDT) Sender: christopher.morrow@gmail.com Received: by 10.152.28.34 with HTTP; Thu, 21 Mar 2013 13:59:43 -0700 (PDT) In-Reply-To: References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514B695D.2050307@bbn.com> <514B6D8D.5030504@ops-netman.net> Date: Thu, 21 Mar 2013 16:59:43 -0400 X-Google-Sender-Auth: YwgDqxPLevr3miUcKNDtyfaUZF8 Message-ID: From: Christopher Morrow To: Danny McPherson Content-Type: text/plain; charset=ISO-8859-1 Cc: sidr@ietf.org Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2013 20:59:52 -0000 On Thu, Mar 21, 2013 at 4:42 PM, Danny McPherson wrote: > On 2013-03-21 14:29, Chris Morrow wrote: > >> TODAY it reduces the number, yes. 100% agree. >> TOMORROW the number of repositories, even those which are 'hosted' will >> be split up by name and/or ip-address... >> >> I have a feeling these will be like DNS servers and likely ripe (ha!) >> points for attack by bad folks. So sharing fate for all customers just >> seems like a bad idea. >> >>> folks become unhappy with the repository management, but for now I think >>> it is reasonable to assume a much smaller number of repositories, which >>> is what Sriram and I did in our model. >> >> >> yup. but having the ability to increase the number of repositories in >> the model means we can say: "today with N repositories and M objects we >> see times of Y. Tomorrow when we have X repositories with Y objects we >> should see times of Z" > > > Agreed. > > Additionally, this perspective may well change when things like BGPSEC > router keys need to be published and then ingested by operational routers > for update signing, as the trust model is fairly different, methinks. so, to me, this is just 'more objects with a tight(er) timeframe on delivery' right? meaning: today you have (for sake of the conversation) relatively static content in the repository, where data changes 1/2/3 objects/day, and it's important to get the data distributed, but (again, for the conversation) 24hrs is 'fine' as a timeline between: "publish object" and "rendered onto the router". but: tomorrow if you followed (for the sake of the conversation) Sriram's model of 'roll router keys hourly to ensure ttls on routes' (loosely paraphrased and with times I don't even think he put into his slides/discussions), you'd be talking about #-of-routers * 24 objects changing every day, and with a timescale for: "publish" to "render" on the order of 1hr. (likely less than 1hr, something closer to 5-10 minutes has been discussed previously). right? -chris From kent@bbn.com Thu Mar 21 14:14:12 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 303A821F8CAD for ; Thu, 21 Mar 2013 14:14:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.599 X-Spam-Level: X-Spam-Status: No, score=-106.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N2AhGNTRLt2v for ; Thu, 21 Mar 2013 14:14:11 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) by ietfa.amsl.com (Postfix) with ESMTP id 8E42021F8C71 for ; Thu, 21 Mar 2013 14:14:11 -0700 (PDT) Received: from dhcp89-089-218.bbn.com ([128.89.89.218]:49828) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1UImoM-000G17-G4; Thu, 21 Mar 2013 17:14:10 -0400 Message-ID: <514B7822.1000609@bbn.com> Date: Thu, 21 Mar 2013 17:14:10 -0400 From: Stephen Kent User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: Chris Morrow References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514B695D.2050307@bbn.com> <514B6D8D.5030504@ops-netman.net> In-Reply-To: <514B6D8D.5030504@ops-netman.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: sidr@ietf.org Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2013 21:14:12 -0000 Chris, > ... > > TODAY it reduces the number, yes. 100% agree. > TOMORROW the number of repositories, even those which are 'hosted' will > be split up by name and/or ip-address... I think the operative term is "might" vs. "will." > I have a feeling these will be like DNS servers and likely ripe (ha!) > points for attack by bad folks. So sharing fate for all customers just > seems like a bad idea. A single repository need not translate into a single instance of the files associated with that repository, right? >> folks become unhappy with the repository management, but for now I think >> it is reasonable to assume a much smaller number of repositories, which >> is what Sriram and I did in our model. > yup. but having the ability to increase the number of repositories in > the model means we can say: "today with N repositories and M objects we > see times of Y. Tomorrow when we have X repositories with Y objects we > should see times of Z" yes, it is reasonable to incorporate knobs into models to allow folks to explore their favorite scenarios. Steve From morrowc@ops-netman.net Thu Mar 21 14:24:19 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5424B21F8CF7 for ; Thu, 21 Mar 2013 14:24:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mqNd8K-eG3r6 for ; Thu, 21 Mar 2013 14:24:18 -0700 (PDT) Received: from mailserver.ops-netman.net (mailserver.ops-netman.net [208.76.12.119]) by ietfa.amsl.com (Postfix) with ESMTP id 9763E21F8581 for ; Thu, 21 Mar 2013 14:24:17 -0700 (PDT) Received: from donkey.her.corp.google.com (unknown [IPv6:2620:0:100a:0:baac:6fff:fe92:fb7a]) (Authenticated sender: morrowc@OPS-NETMAN.NET) by mailserver.ops-netman.net (Postfix) with ESMTPSA id D5016320053; Thu, 21 Mar 2013 21:23:55 +0000 (UTC) Message-ID: <514B7A6C.2000103@ops-netman.net> Date: Thu, 21 Mar 2013 17:23:56 -0400 From: Chris Morrow User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130308 Thunderbird/17.0.4 MIME-Version: 1.0 To: Stephen Kent References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514B695D.2050307@bbn.com> <514B6D8D.5030504@ops-netman.net> <514B7822.1000609@bbn.com> In-Reply-To: <514B7822.1000609@bbn.com> X-Enigmail-Version: 1.4.6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: sidr@ietf.org Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2013 21:24:19 -0000 On 03/21/2013 05:14 PM, Stephen Kent wrote: > Chris, >> ... >> >> TODAY it reduces the number, yes. 100% agree. >> TOMORROW the number of repositories, even those which are 'hosted' will >> be split up by name and/or ip-address... > > I think the operative term is "might" vs. "will." sure, I'm just looking at what's happened in other things that look like this. I could be wrong. > >> I have a feeling these will be like DNS servers and likely ripe (ha!) >> points for attack by bad folks. So sharing fate for all customers just >> seems like a bad idea. > > A single repository need not translate into a single instance of the files > associated with that repository, right? > it's a single hostname/ip-address-set right? rsync://repository.arin.net/ I think we'll see, for example: rsync://customer1.repository.arin.net/ hostnames are free, ip-addresses (for a registry) are free :) having all your customers down because someone dislikes visa.com (who chose to use the hosted repository model) is ... unsatisfactory (and likely expensive) >>> folks become unhappy with the repository management, but for now I think >>> it is reasonable to assume a much smaller number of repositories, which >>> is what Sriram and I did in our model. >> yup. but having the ability to increase the number of repositories in >> the model means we can say: "today with N repositories and M objects we >> see times of Y. Tomorrow when we have X repositories with Y objects we >> should see times of Z" > > yes, it is reasonable to incorporate knobs into models to allow > folks to explore their favorite scenarios. cool. thanks! From danny@tcb.net Thu Mar 21 14:42:47 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 96F9A21F8D27 for ; Thu, 21 Mar 2013 14:42:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.437 X-Spam-Level: X-Spam-Status: No, score=-100.437 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id of5sqvMzOBLy for ; Thu, 21 Mar 2013 14:42:47 -0700 (PDT) Received: from mail.friendswithtools.org (unknown [64.78.239.70]) by ietfa.amsl.com (Postfix) with ESMTP id 9CB8221F8C9E for ; Thu, 21 Mar 2013 14:42:45 -0700 (PDT) Received: from dspam (unknown [127.0.0.1]) by mail.friendswithtools.org (Postfix) with SMTP id 33D0E300056 for ; Thu, 21 Mar 2013 21:42:45 +0000 (UTC) Received: from mail2.tcb.net (localhost [127.0.0.1]) by mail.friendswithtools.org (Postfix) with ESMTP id B709E300035; Thu, 21 Mar 2013 15:42:44 -0600 (MDT) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Date: Thu, 21 Mar 2013 15:42:44 -0600 From: Danny McPherson To: Christopher Morrow In-Reply-To: References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514B695D.2050307@bbn.com> <514B6D8D.5030504@ops-netman.net> Message-ID: X-Sender: danny@tcb.net User-Agent: Roundcube Webmail/0.8.2 X-DSPAM-Result: Whitelisted X-DSPAM-Processed: Thu Mar 21 15:42:45 2013 X-DSPAM-Confidence: 0.9899 X-DSPAM-Improbability: 1 in 9809 chance of being spam X-DSPAM-Probability: 0.0000 X-DSPAM-Signature: 514b7ed542071649868400 X-DSPAM-Factors: 27, to+#+the, 0.01000, Subject*repository+#+I-D, 0.01000, Subject*on+the, 0.01000, Subject*comments+on, 0.01000, the+#+#+the, 0.01000, Subject*sidr+#+#+the, 0.01000, Subject*the+#+analysis, 0.01000, Subject*Re+#+#+#+the, 0.01000, Subject*sidr+#+#+#+repository, 0.01000, for+#+#+the, 0.01000, for+the, 0.01000, for+the, 0.01000, as+a, 0.01000, Subject*comments+#+#+#+analysis, 0.01000, the+#+#+is, 0.01000, Subject*on+#+repository, 0.01000, Subject*Re+#+#+on, 0.01000, I+think, 0.01000, on+the, 0.01000, the+#+of, 0.01000, the+#+of, 0.01000, in+the, 0.01000, in+the, 0.01000, Subject*comments+#+the, 0.01000, a+#+#+#+to, 0.01000, I+#+a, 0.01000, Subject*sidr+#+on, 0.01000 Cc: sidr@ietf.org Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2013 21:42:47 -0000 > so, to me, this is just 'more objects with a tight(er) timeframe on > delivery' right? > > meaning: today you have (for sake of the conversation) relatively > static content in the repository, where data changes 1/2/3 > objects/day, and it's important to get the data distributed, but > (again, for the conversation) 24hrs is 'fine' as a timeline between: > "publish object" and "rendered onto the router". > > but: tomorrow if you followed (for the sake of the conversation) > Sriram's model of 'roll router keys hourly to ensure ttls on routes' > (loosely paraphrased and with times I don't even think he put into > his > slides/discussions), you'd be talking about #-of-routers * 24 objects > changing every day, and with a timescale for: "publish" to "render" > on > the order of 1hr. (likely less than 1hr, something closer to 5-10 > minutes has been discussed previously). > > right? Yeah, I think so under steady state. It gets more interesting when the RIR is attacked and I can't reach them, or I have a failure of a control card or systems where I cache them locally, or something to that effect. AND I have to know when *everyone* else in the system picks them up and pushes them out to their routers in preparation for validation so that I know when it's safe to starting signing with them, etc.. -danny From christopher.morrow@gmail.com Thu Mar 21 18:43:27 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8333B21F8BD9 for ; Thu, 21 Mar 2013 18:43:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.472 X-Spam-Level: X-Spam-Status: No, score=-102.472 tagged_above=-999 required=5 tests=[AWL=0.128, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Iy7TrnbAUvGa for ; Thu, 21 Mar 2013 18:43:27 -0700 (PDT) Received: from mail-la0-x231.google.com (mail-la0-x231.google.com [IPv6:2a00:1450:4010:c03::231]) by ietfa.amsl.com (Postfix) with ESMTP id B4C8321F8B6B for ; Thu, 21 Mar 2013 18:43:26 -0700 (PDT) Received: by mail-la0-f49.google.com with SMTP id fs13so6256631lab.22 for ; Thu, 21 Mar 2013 18:43:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:x-received:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type; bh=RqhWUeNx+31IpHJffsNtPv3ZtHopmtstujhOqbgh5A8=; b=tl0mn1UXkColzWzEQJwh87AKuuv6X7QyJv/OkGyCGlwV3KMrd4G2n7lg9yn0+JewS3 3VXKpzQSbRVQY/e88GKofsgzyJbzTeWeEwvczH61KI7xcrX35tByT0hWhJSKU/AaqM5m Cs5Y6fswFoGlqe4aqDhrX59zh9Pr/7b4kjeyOnv/0XZi7QFUlullKrAK+VUiL2SIVJFd gRvY3DQ2bCIQ6xqtuQyi5mRg/YSTZ99gkHJ50NKjIaglQfoD+e5hsEWzwHVvWqfh48A7 kF0DkuJr3qGqDzMAm1/JWvIgJCatlAVNGvJxkEeLp5EnwtkHJKe6QgtTz8V6Kbf5jYUI z/Ow== MIME-Version: 1.0 X-Received: by 10.112.49.165 with SMTP id v5mr184249lbn.67.1363916605485; Thu, 21 Mar 2013 18:43:25 -0700 (PDT) Sender: christopher.morrow@gmail.com Received: by 10.152.28.34 with HTTP; Thu, 21 Mar 2013 18:43:25 -0700 (PDT) In-Reply-To: References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514B695D.2050307@bbn.com> <514B6D8D.5030504@ops-netman.net> Date: Thu, 21 Mar 2013 21:43:25 -0400 X-Google-Sender-Auth: 0OR9YvmMUPRORofXkkqXpXN3qHw Message-ID: From: Christopher Morrow To: Danny McPherson Content-Type: text/plain; charset=ISO-8859-1 Cc: sidr@ietf.org Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Mar 2013 01:43:27 -0000 On Thu, Mar 21, 2013 at 5:42 PM, Danny McPherson wrote: > >> so, to me, this is just 'more objects with a tight(er) timeframe on >> delivery' right? >> >> meaning: today you have (for sake of the conversation) relatively >> static content in the repository, where data changes 1/2/3 >> objects/day, and it's important to get the data distributed, but >> (again, for the conversation) 24hrs is 'fine' as a timeline between: >> "publish object" and "rendered onto the router". >> >> but: tomorrow if you followed (for the sake of the conversation) >> Sriram's model of 'roll router keys hourly to ensure ttls on routes' >> (loosely paraphrased and with times I don't even think he put into his >> slides/discussions), you'd be talking about #-of-routers * 24 objects >> changing every day, and with a timescale for: "publish" to "render" on >> the order of 1hr. (likely less than 1hr, something closer to 5-10 >> minutes has been discussed previously). >> >> right? > > > Yeah, I think so under steady state. > > It gets more interesting when the RIR is attacked and I can't reach them, or > I have a failure of a control card or systems where I cache them locally, or > something to that effect. > > AND I have to know when *everyone* else in the system picks them up and > pushes them out to their routers in preparation for validation so that I > know when it's safe to starting signing with them, etc.. true, but the repository conversation stops at: "all gatherers in the system have the data" inside each ASN it's really up to the ASN operator to get from gatherer -> cache -> router in a 'timely fashion'. From danny@tcb.net Thu Mar 21 19:30:42 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 692EE21F8E67 for ; Thu, 21 Mar 2013 19:30:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.437 X-Spam-Level: X-Spam-Status: No, score=-100.437 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ACYJxj52I2lq for ; Thu, 21 Mar 2013 19:30:42 -0700 (PDT) Received: from mail.friendswithtools.org (unknown [64.78.239.70]) by ietfa.amsl.com (Postfix) with ESMTP id EF32421F8E65 for ; Thu, 21 Mar 2013 19:30:41 -0700 (PDT) Received: from dspam (unknown [127.0.0.1]) by mail.friendswithtools.org (Postfix) with SMTP id AD5F2300035 for ; Fri, 22 Mar 2013 02:30:41 +0000 (UTC) Received: from mail2.tcb.net (localhost [127.0.0.1]) by mail.friendswithtools.org (Postfix) with ESMTP id 27184300025; Thu, 21 Mar 2013 20:30:41 -0600 (MDT) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Date: Thu, 21 Mar 2013 20:30:41 -0600 From: Danny McPherson To: Christopher Morrow In-Reply-To: References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514B695D.2050307@bbn.com> <514B6D8D.5030504@ops-netman.net> Message-ID: <94f36e1e5f9f1cec9d70bf3fc588faa8@tcb.net> X-Sender: danny@tcb.net User-Agent: Roundcube Webmail/0.8.2 X-DSPAM-Result: Whitelisted X-DSPAM-Processed: Thu Mar 21 20:30:41 2013 X-DSPAM-Confidence: 0.9899 X-DSPAM-Improbability: 1 in 9809 chance of being spam X-DSPAM-Probability: 0.0000 X-DSPAM-Signature: 514bc25142076687610116 X-DSPAM-Factors: 27, to+#+#+#+to, 0.01000, tight+coupling, 0.01000, Subject*repository+#+I-D, 0.01000, not+be, 0.01000, Subject*on+the, 0.01000, the+#+#+#+to, 0.01000, Subject*comments+on, 0.01000, and+the, 0.01000, the+#+#+the, 0.01000, Subject*sidr+#+#+the, 0.01000, Subject*the+#+analysis, 0.01000, the+#+to, 0.01000, the+#+to, 0.01000, Subject*Re+#+#+#+the, 0.01000, Subject*sidr+#+#+#+repository, 0.01000, for+the, 0.01000, as+a, 0.01000, Subject*comments+#+#+#+analysis, 0.01000, to+the, 0.01000, I+have, 0.01000, the+#+#+of, 0.01000, Subject*on+#+repository, 0.01000, it+#+to, 0.01000, Subject*Re+#+#+on, 0.01000, in+the, 0.01000, not+#+the, 0.01000, Subject*comments+#+the, 0.01000 Cc: sidr@ietf.org Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Mar 2013 02:30:42 -0000 > true, but the repository conversation stops at: "all gatherers in the > system have the data" > > inside each ASN it's really up to the ASN operator to get from > gatherer -> cache -> router in a 'timely fashion'. If you're signing a route with something, and your upstreams are signing their secure path elements of that route with something, and my routers haven't been provisioned (from data obtained from the RPKI) to validate with the corresponding public versions of those somethings (for whatever reason - e.g., latency in fetching, DoS, failure, etc..), then this *tight coupling* between the public key repositories (i.e., RPKI) will result in my router as a relying party not having the information it need to validate those signed somethings, and I therefore "downgrade" or break for that route. You not knowing when I have the information to validate something because I may not have fetched it from the RPKI yet (or ingested it in my routers yet, for whatever reason) means you can't send a route with the new signatures because it will fail validation, thereby causing a downgrade attack or something to break for the route. This "looseness" about an expanding array of validation states and acceptable downgrade attacks in BGPSEC because the RPKI may not be available, or local systems may be operating on stale data, continues to give me pause given the overhead we're introducing and the expanding set of residual vulnerabilities some are willing to accept. -danny From randy@psg.com Thu Mar 21 21:27:44 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D377F21F8A98 for ; Thu, 21 Mar 2013 21:27:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nlHChD4qmTHz for ; Thu, 21 Mar 2013 21:27:42 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id 1763021F8A11 for ; Thu, 21 Mar 2013 21:27:41 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.80.1 (FreeBSD)) (envelope-from ) id 1UItZn-0008W7-OS; Fri, 22 Mar 2013 04:27:37 +0000 Date: Fri, 22 Mar 2013 06:27:27 +0200 Message-ID: From: Randy Bush To: Chris Morrow In-Reply-To: <514B6D8D.5030504@ops-netman.net> References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514B695D.2050307@bbn.com> <514B6D8D.5030504@ops-netman.net> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Cc: sidr@ietf.org Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Mar 2013 04:27:44 -0000 >> So far the 1,300+ folks who have signed up for managed CA services >> have also let the RIRs manage their pub points, which dramatically >> reduces the number of repositories. That could change over time, >> e.g., if these this is measurement > TODAY it reduces the number, yes. 100% agree. > TOMORROW the number of repositories, even those which are 'hosted' > will be split up by name and/or ip-address... this is pure conjecture. can we please reduce the ratio of the latter to the former? randy From morrowc@ops-netman.net Thu Mar 21 21:32:41 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A07AB21F8C7D for ; Thu, 21 Mar 2013 21:32:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xBqnH1vBbz5V for ; Thu, 21 Mar 2013 21:32:40 -0700 (PDT) Received: from mailserver.ops-netman.net (mailserver.ops-netman.net [IPv6:2606:700:e:b00b:5054:ff:fe79:69db]) by ietfa.amsl.com (Postfix) with ESMTP id B872821F8A54 for ; Thu, 21 Mar 2013 21:32:38 -0700 (PDT) Received: from [IPv6:2001:470:e03a:b00b:20e0:da86:c2b5:de4f] (unknown [IPv6:2001:470:e03a:b00b:20e0:da86:c2b5:de4f]) (Authenticated sender: morrowc@OPS-NETMAN.NET) by mailserver.ops-netman.net (Postfix) with ESMTPSA id A3743320057; Fri, 22 Mar 2013 04:32:37 +0000 (UTC) Message-ID: <514BDEE5.7030005@ops-netman.net> Date: Fri, 22 Mar 2013 00:32:37 -0400 From: Chris Morrow User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130308 Thunderbird/17.0.4 MIME-Version: 1.0 To: Randy Bush References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514B695D.2050307@bbn.com> <514B6D8D.5030504@ops-netman.net> In-Reply-To: X-Enigmail-Version: 1.5.1 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: sidr@ietf.org Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Mar 2013 04:32:42 -0000 On 03/22/2013 12:27 AM, Randy Bush wrote: >>> So far the 1,300+ folks who have signed up for managed CA services >>> have also let the RIRs manage their pub points, which dramatically >>> reduces the number of repositories. That could change over time, >>> e.g., if these > > this is measurement > >> TODAY it reduces the number, yes. 100% agree. >> TOMORROW the number of repositories, even those which are 'hosted' >> will be split up by name and/or ip-address... > > this is pure conjecture. can we please reduce the ratio of the latter > to the former? sure thing. how do you propose we measure how large the number of CA/Repositories is going to be in 1yr? 5 yrs? 10 yrs? -chris From randy@psg.com Thu Mar 21 22:50:03 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 312DD21F8FE8 for ; Thu, 21 Mar 2013 22:50:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YYoHc8eRCOd8 for ; Thu, 21 Mar 2013 22:50:02 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id C143821F8FE5 for ; Thu, 21 Mar 2013 22:50:02 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.80.1 (FreeBSD)) (envelope-from ) id 1UIurZ-0008ep-9a; Fri, 22 Mar 2013 05:50:01 +0000 Date: Fri, 22 Mar 2013 07:50:01 +0200 Message-ID: From: Randy Bush To: Chris Morrow In-Reply-To: <514BDEE5.7030005@ops-netman.net> References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514B695D.2050307@bbn.com> <514B6D8D.5030504@ops-netman.net> <514BDEE5.7030005@ops-netman.net> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Cc: sidr wg list Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Mar 2013 05:50:03 -0000 > how do you propose we measure how large the number of CA/Repositories is > going to be in 1yr? 5 yrs? 10 yrs? we can not measure the future until it gets here. the best we can do is estimate it based on the present and past. i could conject that ten years from now we will have one repository run by itu-i. i could conject that ten years from now we have one repository per announced prefix. all pure bs. randy From morrowc@ops-netman.net Fri Mar 22 06:55:24 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D5EFE21F84B5 for ; Fri, 22 Mar 2013 06:55:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iFX5K6F4+F68 for ; Fri, 22 Mar 2013 06:55:24 -0700 (PDT) Received: from mailserver.ops-netman.net (mailserver.ops-netman.net [208.76.12.119]) by ietfa.amsl.com (Postfix) with ESMTP id 52EDC21F842F for ; Fri, 22 Mar 2013 06:55:24 -0700 (PDT) Received: from donkey.her.corp.google.com (unknown [IPv6:2620:0:100a:0:baac:6fff:fe92:fb7a]) (Authenticated sender: morrowc@OPS-NETMAN.NET) by mailserver.ops-netman.net (Postfix) with ESMTPSA id EDE98320058; Fri, 22 Mar 2013 13:55:01 +0000 (UTC) Message-ID: <514C62B2.1070604@ops-netman.net> Date: Fri, 22 Mar 2013 09:54:58 -0400 From: Chris Morrow User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130308 Thunderbird/17.0.4 MIME-Version: 1.0 To: Randy Bush References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514B695D.2050307@bbn.com> <514B6D8D.5030504@ops-netman.net> <514BDEE5.7030005@ops-netman.net> In-Reply-To: X-Enigmail-Version: 1.4.6 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: sidr wg list Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Mar 2013 13:55:25 -0000 On 03/22/2013 01:50 AM, Randy Bush wrote: >> how do you propose we measure how large the number of CA/Repositories is >> going to be in 1yr? 5 yrs? 10 yrs? > > we can not measure the future until it gets here. the best we can do is > estimate it based on the present and past. which was what I was doing, actually. > i could conject that ten years from now we will have one repository run > by itu-i. i could conject that ten years from now we have one > repository per announced prefix. all pure bs. sure. but again, past experience points to the hosted model eventually looking like distinct repositories per customer, which looks like 'number of repositories == number of ASN allocated'. -chris From randy@psg.com Fri Mar 22 06:57:37 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9D05521F8546 for ; Fri, 22 Mar 2013 06:57:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oJq2m-xtR4-u for ; Fri, 22 Mar 2013 06:57:37 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id 474BA21F84EF for ; Fri, 22 Mar 2013 06:57:37 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.80.1 (FreeBSD)) (envelope-from ) id 1UJ2TO-0009ht-UM; Fri, 22 Mar 2013 13:57:35 +0000 Date: Fri, 22 Mar 2013 15:57:36 +0200 Message-ID: From: Randy Bush To: Chris Morrow In-Reply-To: <514C62B2.1070604@ops-netman.net> References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514B695D.2050307@bbn.com> <514B6D8D.5030504@ops-netman.net> <514BDEE5.7030005@ops-netman.net> <514C62B2.1070604@ops-netman.net> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Cc: sidr wg list Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Mar 2013 13:57:37 -0000 > past experience points to the hosted model eventually looking like > distinct repositories per customer, which looks like 'number of > repositories == number of ASN allocated'. actual experience is five large hosted repositories. randy From eosterweil@verisign.com Fri Mar 22 07:39:05 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4D18F21F8A85 for ; Fri, 22 Mar 2013 07:39:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6At88hMYbROA for ; Fri, 22 Mar 2013 07:39:03 -0700 (PDT) Received: from exprod6og106.obsmtp.com (exprod6og106.obsmtp.com [64.18.1.191]) by ietfa.amsl.com (Postfix) with ESMTP id 0A68421F8A47 for ; Fri, 22 Mar 2013 07:39:03 -0700 (PDT) Received: from osprey.verisign.com ([216.168.239.75]) (using TLSv1) by exprod6ob106.postini.com ([64.18.5.12]) with SMTP ID DSNKUUxtBhUo8L054LAVBgCti5zTfi0Kucav@postini.com; Fri, 22 Mar 2013 07:39:03 PDT Received: from dul1wnexcn01.vcorp.ad.vrsn.com (dul1wnexcn01.vcorp.ad.vrsn.com [10.170.12.138]) by osprey.verisign.com (8.13.6/8.13.4) with ESMTP id r2MEd2J0029886 for ; Fri, 22 Mar 2013 10:39:02 -0400 Received: from dul1osterwe-m2.vcorp.ad.vrsn.com ([10.88.29.76]) by dul1wnexcn01.vcorp.ad.vrsn.com with Microsoft SMTPSVC(6.0.3790.4675); Fri, 22 Mar 2013 10:39:01 -0400 Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\)) From: "Osterweil, Eric" In-Reply-To: <514A471B.2040900@gmail.com> Date: Fri, 22 Mar 2013 10:39:01 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: <84CF0B6E-F39E-403E-A39E-1BFEEC1DA0C6@verisign.com> References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> <5149C506.7080001@gmail.com>, <5149D9A2.7030107@riw.us> <24B20D14B2CD29478C8D5D6E9CBB29F66D0FD186@Hermes.columbia.ads.sparta.com> <514A1A13.6040405@riw.us> <514A1C4D.7020306@gmail.com> <514A1F0B.3020301@riw.us> <514A3698.2070509@gmail.com> <514A471B.2040900@gmail.com> To: sidr@ietf.org X-Mailer: Apple Mail (2.1499) X-OriginalArrivalTime: 22 Mar 2013 14:39:01.0441 (UTC) FILETIME=[FE913B10:01CE270A] Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Mar 2013 14:39:05 -0000 On Mar 20, 2013, at 7:32 PM, Arturo Servin = wrote: >=20 >=20 > On 20/03/2013 20:00, Borchert, Oliver wrote: >> But what does the alert tell me?=20 >> What if one is multi homed, uses two ROAs then switches to be single = homed and revokes the second ROA. In this case the owner revoked the ROA = and this is not an attack - here the alert is not of help at all! >>=20 >> Oliver >=20 > That is the problem. It is almost impossible to know when a ROA = is > revoked legally or by accident/attack. This would only be a mechanism = to > alert when something changes, then you to decide as operator what to = do. > But most probably you will end up ignoring all the alerts unless there > is a big fuss about it. I think this thread brings up a very important (but subtle point). = Knowing that i) a ROA exists, but is not present is different than ii) a = ROA that has been removed by a resource holder, and _that_ is different = than iii) the grand-parenting issue=85 (though that could be a vector to = effect case i), above)=85 For example: i) An adversary intercepts a TCP session and selectively removes = branches of a repo (including some ROAs) during an rsync session so that = attestation is affected=85 Yes, yes, I know the crypto makes this = apparent, but that's at the cache-level=85 The RP just knows that there = ain't no ROA there... ii) (As mentioned above), resource holder changes their peering=85 iii) A resource holder surgically takes a descendant's allocations away=85= I think it is very important (as I think Doug M alluded to) that there = be an understanding and some expressiveness around these corner cases. = If something is there, if something is validated, if something is not = there, if something is missing (i.e. _should_ be there, but isn't) are = all different. With an understanding of these sorts of things, = operators might be able to find policy knobs that they can use, and with = _that_ maybe we can get some informed requirements=85 Well, ideally, = anyway=85 ;) Eric= From eosterweil@verisign.com Fri Mar 22 08:08:15 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B266C21F8C8C for ; Fri, 22 Mar 2013 08:08:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uMeYnZ9aUzUZ for ; Fri, 22 Mar 2013 08:08:15 -0700 (PDT) Received: from exprod6og105.obsmtp.com (exprod6og105.obsmtp.com [64.18.1.189]) by ietfa.amsl.com (Postfix) with ESMTP id BE64121F8A53 for ; Fri, 22 Mar 2013 08:08:09 -0700 (PDT) Received: from peregrine.verisign.com ([216.168.239.74]) (using TLSv1) by exprod6ob105.postini.com ([64.18.5.12]) with SMTP ID DSNKUUxz2UzNeDz42AoRugU8mKV3i7fZ7TaG@postini.com; Fri, 22 Mar 2013 08:08:09 PDT Received: from DUL1WNSMTP01.vcorp.ad.vrsn.com (dul1wnexcn03.vcorp.ad.vrsn.com [10.170.12.113]) by peregrine.verisign.com (8.13.6/8.13.4) with ESMTP id r2MF876b017958 for ; Fri, 22 Mar 2013 11:08:08 -0400 Received: from dul1osterwe-m2.vcorp.ad.vrsn.com ([10.88.29.76]) by DUL1WNSMTP01.vcorp.ad.vrsn.com with Microsoft SMTPSVC(7.5.7601.17514); Fri, 22 Mar 2013 11:08:04 -0400 Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\)) From: "Osterweil, Eric" In-Reply-To: Date: Fri, 22 Mar 2013 11:08:04 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514B695D.2050307@bbn.com> <514B6D8D.5030504@ops-netman.net> <514BDEE5.7030005@ops-netman.net> <514C62B2.1070604@ops-netman.net> To: Randy Bush X-Mailer: Apple Mail (2.1499) X-OriginalArrivalTime: 22 Mar 2013 15:08:04.0399 (UTC) FILETIME=[0D7383F0:01CE270F] Cc: Chris Morrow , sidr wg list Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Mar 2013 15:08:15 -0000 On Mar 22, 2013, at 9:57 AM, Randy Bush wrote: >> past experience points to the hosted model eventually looking like >> distinct repositories per customer, which looks like 'number of >> repositories =3D=3D number of ASN allocated'. >=20 > actual experience is five large hosted repositories. Randy, sound _engineering_ is predicated (in large part) on evaluation = and reducing risks. Using predictive models (especially those based on = sound reasonable or observable assumptions) to estimate unknowns is = pretty common, among conscientious engineers (and scientists, fwiw). = This is particularly true during the early phases of design work and = requirements analysis (the latter of which, I think we are still = missing?). It seems to me that Chris is practicing very advisable = prudence. Conversely, the ready-fire-aim approach is=85 well, an odd = position to be advocating here=85 I'd suggest that if you don't like Chris' model, you propose one that = you have more faith in. I (for one) would greatly appreciate seeing = your insights in that regard. Eric= From shane@castlepoint.net Fri Mar 22 08:58:48 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E6C8A21F8E67 for ; Fri, 22 Mar 2013 08:58:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.437 X-Spam-Level: X-Spam-Status: No, score=-0.437 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id L-aXsv6Kr9I0 for ; Fri, 22 Mar 2013 08:58:48 -0700 (PDT) Received: from mail.friendswithtools.org (unknown [64.78.239.70]) by ietfa.amsl.com (Postfix) with ESMTP id 6530021F8E12 for ; Fri, 22 Mar 2013 08:58:48 -0700 (PDT) Received: from dspam (unknown [127.0.0.1]) by mail.friendswithtools.org (Postfix) with SMTP id 0D5C7300035 for ; Fri, 22 Mar 2013 15:58:48 +0000 (UTC) Received: from [10.9.0.10] (web.hollyman.com [64.78.239.73]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by mail.friendswithtools.org (Postfix) with ESMTPSA id 61073300025; Fri, 22 Mar 2013 09:58:47 -0600 (MDT) Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 6.3 \(1503\)) From: Shane Amante In-Reply-To: Date: Fri, 22 Mar 2013 09:58:47 -0600 Content-Transfer-Encoding: quoted-printable Message-Id: <5F0CA37A-914D-4C3B-AC88-96C41A3AEA36@castlepoint.net> References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514B695D.2050307@bbn.com> <514B6D8D.5030504@ops-netman.net> <514BDEE5.7030005@ops-netman.net> <514C62B2.1070604@ops-netman.net> To: "Osterweil, Eric" X-Mailer: Apple Mail (2.1503) X-DSPAM-Result: Whitelisted X-DSPAM-Processed: Fri Mar 22 09:58:47 2013 X-DSPAM-Confidence: 0.9899 X-DSPAM-Improbability: 1 in 9809 chance of being spam X-DSPAM-Probability: 0.0000 X-DSPAM-Signature: 514c7fb742078138614969 X-DSPAM-Factors: 27, 2013+at, 0.01000, 2013+at, 0.01000, Mar+#+2013, 0.01000, Mar+#+2013, 0.01000, Cc*sidr+#+#+#+ietf.org, 0.01000, Subject*repository+#+I-D, 0.01000, Mime-Version*OS+X, 0.01000, Subject*on+the, 0.01000, the+#+#+#+to, 0.01000, Subject*comments+on, 0.01000, From*Amante+shane, 0.01000, the+#+#+the, 0.01000, of+#+#+of, 0.01000, of+#+#+of, 0.01000, Subject*sidr+#+#+the, 0.01000, Cc*sidr+wg, 0.01000, to+#+#+and, 0.01000, Subject*the+#+analysis, 0.01000, the+#+to, 0.01000, com+wrote, 0.01000, com+wrote, 0.01000, Subject*Re+#+#+#+the, 0.01000, Subject*sidr+#+#+#+repository, 0.01000, On+Mar, 0.01000, On+Mar, 0.01000, for+the, 0.01000, Subject*comments+#+#+#+analysis, 0.01000 Cc: Chris Morrow , sidr wg list Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Mar 2013 15:58:49 -0000 On Mar 22, 2013, at 9:08 AM, "Osterweil, Eric" = wrote: > On Mar 22, 2013, at 9:57 AM, Randy Bush wrote: >=20 >>> past experience points to the hosted model eventually looking like >>> distinct repositories per customer, which looks like 'number of >>> repositories =3D=3D number of ASN allocated'. >>=20 >> actual experience is five large hosted repositories. >=20 > Randy, sound _engineering_ is predicated (in large part) on evaluation = and reducing risks. Using predictive models (especially those based on = sound reasonable or observable assumptions) to estimate unknowns is = pretty common, among conscientious engineers (and scientists, fwiw). = This is particularly true during the early phases of design work and = requirements analysis (the latter of which, I think we are still = missing?). It seems to me that Chris is practicing very advisable = prudence. Conversely, the ready-fire-aim approach is=85 well, an odd = position to be advocating here=85 >=20 > I'd suggest that if you don't like Chris' model, you propose one that = you have more faith in. I (for one) would greatly appreciate seeing = your insights in that regard. To add to Eric's excellent points above. _Capacity_Planning_ of = networks, (which we've done since the dawn of time), depends on = observations of historical utilization of physical/logical paths across = the network. However, historical utilization does not tell you the = whole story, due to (as just one example) [very] large, but *pending* = (i.e.: not turned up) customer wins. In that case, we apply sound = engineering to /forecast/ and then input that forecast into __models__ = to determine what will be the growth of the network and then = plan/execute augments appropriately. In some circumstances, these = exercises are performed over much longer time-scales, particularly when = the operator is facing the need to actually build and/or move physical = infrastructure to accommodate for the predicted growth, (i.e.: build new = facilities, move from old to new facilities, lay new conduit/cable, = etc.). In any of these exercises, sometimes you are "surprised" by the = results, (typically costs), and need to explore alternatives ... = exploration of those alternatives is part of trying to 'reduce risks', = as Eric points out. So, +1 to "sound engineering" comment, above. -shane= From wwwrun@rfc-editor.org Fri Mar 22 10:12:32 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C21CB21F85BC; Fri, 22 Mar 2013 10:12:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.6 X-Spam-Level: X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4jIMhDZrqNwx; Fri, 22 Mar 2013 10:12:31 -0700 (PDT) Received: from rfc-editor.org (unknown [IPv6:2001:1890:123a::1:2f]) by ietfa.amsl.com (Postfix) with ESMTP id D46D121F84DF; Fri, 22 Mar 2013 10:12:31 -0700 (PDT) Received: by rfc-editor.org (Postfix, from userid 30) id 008D762186; Fri, 22 Mar 2013 10:12:20 -0700 (PDT) To: ietf-announce@ietf.org, rfc-dist@rfc-editor.org From: rfc-editor@rfc-editor.org Message-Id: <20130322171221.008D762186@rfc-editor.org> Date: Fri, 22 Mar 2013 10:12:20 -0700 (PDT) Cc: sidr@ietf.org, rfc-editor@rfc-editor.org Subject: [sidr] RFC 6907 on Use Cases and Interpretations of Resource Public Key Infrastructure (RPKI) Objects for Issuers and Relying Parties X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Mar 2013 17:12:32 -0000 A new Request for Comments is now available in online RFC libraries. RFC 6907 Title: Use Cases and Interpretations of Resource Public Key Infrastructure (RPKI) Objects for Issuers and Relying Parties Author: T. Manderson, K. Sriram, R. White Status: Informational Stream: IETF Date: March 2013 Mailbox: terry.manderson@icann.org, ksriram@nist.gov, russ@riw.us Pages: 31 Characters: 66099 Updates/Obsoletes/SeeAlso: None I-D Tag: draft-ietf-sidr-usecases-06.txt URL: http://www.rfc-editor.org/rfc/rfc6907.txt This document describes a number of use cases together with directions and interpretations for organizations and relying parties when creating or encountering Resource Public Key Infrastructure (RPKI) object scenarios in the public RPKI. All of these items are discussed here in relation to the Internet routing system. This document is a product of the Secure Inter-Domain Routing Working Group of the IETF. INFORMATIONAL: This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited. This announcement is sent to the IETF-Announce and rfc-dist lists. To subscribe or unsubscribe, see http://www.ietf.org/mailman/listinfo/ietf-announce http://mailman.rfc-editor.org/mailman/listinfo/rfc-dist For searching the RFC series, see http://www.rfc-editor.org/rfcsearch.html. For downloading RFCs, see http://www.rfc-editor.org/rfc.html. Requests for special distribution should be addressed to either the author of the RFC in question, or to rfc-editor@rfc-editor.org. Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution. The RFC Editor Team Association Management Solutions, LLC From danny@tcb.net Fri Mar 22 11:52:54 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3952221F9002 for ; Fri, 22 Mar 2013 11:52:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.437 X-Spam-Level: X-Spam-Status: No, score=-100.437 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 37Z43wS-WBHf for ; Fri, 22 Mar 2013 11:52:53 -0700 (PDT) Received: from mail.friendswithtools.org (unknown [64.78.239.70]) by ietfa.amsl.com (Postfix) with ESMTP id D011D21F8FFC for ; Fri, 22 Mar 2013 11:52:53 -0700 (PDT) Received: from dspam (unknown [127.0.0.1]) by mail.friendswithtools.org (Postfix) with SMTP id 6F16B300056 for ; Fri, 22 Mar 2013 18:52:53 +0000 (UTC) Received: from mail2.tcb.net (localhost [127.0.0.1]) by mail.friendswithtools.org (Postfix) with ESMTP id 477EA300055 for ; Fri, 22 Mar 2013 12:52:53 -0600 (MDT) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Date: Fri, 22 Mar 2013 12:52:53 -0600 From: Danny McPherson To: In-Reply-To: References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514B695D.2050307@bbn.com> <514B6D8D.5030504@ops-netman.net> <514BDEE5.7030005@ops-netman.net> Message-ID: <4e0ebb62c9266b4a799b6ab67b3c61a3@tcb.net> X-Sender: danny@tcb.net User-Agent: Roundcube Webmail/0.8.2 X-DSPAM-Result: Whitelisted X-DSPAM-Processed: Fri Mar 22 12:52:53 2013 X-DSPAM-Confidence: 0.9899 X-DSPAM-Improbability: 1 in 9809 chance of being spam X-DSPAM-Probability: 0.0000 X-DSPAM-Signature: 514ca88542074315621023 X-DSPAM-Factors: 27, Subject*repository+#+I-D, 0.01000, Subject*on+the, 0.01000, Subject*comments+on, 0.01000, and+the, 0.01000, the+#+#+the, 0.01000, Subject*sidr+#+#+the, 0.01000, to+#+#+and, 0.01000, Subject*the+#+analysis, 0.01000, have+to, 0.01000, Subject*Re+#+#+#+the, 0.01000, Subject*sidr+#+#+#+repository, 0.01000, Subject*comments+#+#+#+analysis, 0.01000, the+#+#+is, 0.01000, Subject*on+#+repository, 0.01000, it+#+to, 0.01000, Subject*Re+#+#+on, 0.01000, To*sidr+ietf.org, 0.01000, I+think, 0.01000, the+#+#+#+the, 0.01000, Subject*comments+#+the, 0.01000, Subject*sidr+#+on, 0.01000, From*Danny+#+danny, 0.01000, From*Danny+#+#+tcb.net, 0.01000, Subject*repository+analysis, 0.01000, Subject*Re+sidr, 0.01000, From*Danny+McPherson, 0.01000, On+#+03, 0.01000 Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Mar 2013 18:52:54 -0000 On 2013-03-21 23:50, Randy Bush wrote: > i could conject that ten years from now we will have one repository > run > by itu-i. Assuming you meant ITU-T, that option isn't looking nearly as bad as it did a few years ago, at least I'll know what it takes to get operational requirements considered there. I think the disconnect emerging is the dichotomy between those who have to operate, sustain, and rely on this infrastructure, and the "running code and run away" school of thought. I'd have thought the latter would have matured at this stage - Fortunately, at least all the RIRs recognize the seriousness and implications... -danny From oleg@ripe.net Fri Mar 22 17:50:48 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ECEF121F8F05 for ; Fri, 22 Mar 2013 17:50:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.378 X-Spam-Level: X-Spam-Status: No, score=-1.378 tagged_above=-999 required=5 tests=[AWL=-0.072, BAYES_00=-2.599, HTML_MESSAGE=0.001, MISSING_HEADERS=1.292] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id waBgkFpireU8 for ; Fri, 22 Mar 2013 17:50:47 -0700 (PDT) Received: from postgirl.ripe.net (postgirl.ipv6.ripe.net [IPv6:2001:67c:2e8:11::c100:1342]) by ietfa.amsl.com (Postfix) with ESMTP id E7CB721F8EDE for ; Fri, 22 Mar 2013 17:50:44 -0700 (PDT) Received: from ayeaye.ripe.net ([193.0.23.5]) by postgirl.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1UJCfR-0004Dg-Ou for sidr@ietf.org; Sat, 23 Mar 2013 01:50:43 +0100 Received: from dog.ripe.net ([193.0.1.217] helo=ommbp.lan) by ayeaye.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1UJCfQ-0002e8-73; Sat, 23 Mar 2013 01:50:40 +0100 Message-ID: <514CFC5F.3090401@ripe.net> Date: Sat, 23 Mar 2013 01:50:39 +0100 From: Oleg Muravskiy Organization: RIPE NCC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:19.0) Gecko/20100101 Firefox/19.0 SeaMonkey/2.16.2 MIME-Version: 1.0 CC: sidr@ietf.org References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> In-Reply-To: X-Enigmail-Version: 1.5.1 Content-Type: multipart/alternative; boundary="------------020302080707070206020302" X-Anti-Virus: Kaspersky Anti-Virus for Linux Mail Server 5.6.48/RELEASE, bases: 20120425 #7816575, check: 20130323 clean X-RIPE-Spam-Level: ---- X-RIPE-Spam-Report: Spam Total Points: -4.4 points pts rule name description ---- ---------------------- ------------------------------------ -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP -2.5 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain 1.0 MISSING_HEADERS Missing To: header -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] 0.0 HTML_MESSAGE BODY: HTML included in message X-RIPE-Signature: c408758d4ce2e8eb06762a65a3365b743c5ca11235c57a1f3565191c069e3d94 Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 23 Mar 2013 00:50:48 -0000 This is a multi-part message in MIME format. --------------020302080707070206020302 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Christopher Morrow wrote: > > On Thu, Mar 21, 2013 at 6:09 AM, Oleg Muravskiy wrote: >> >> Hi Christopher, >> Christopher Morrow wrote: >>> >>> Comment 1 (also related with 44): I agree that ISPs may operate caches in behalf end-users ASNs, but also I think that more than >>> 1 cache may be operated by a single ISP. Imagine a global ASN operator with routers in several places. Are they going to have >>> just one master cache? Or are they have one or two (backup), and just in one location? Considering this, even the 40k clients >>> may be low as worse case IMHO. oops, so... we need to be clear in terminology here there are at least: o publication points - >>> places/machines AS Operators would make their authoritative information available to the world. >> >> In our analysis we associate number of CAs in the global RPKI with the number of distinct IP resource holders. > > sure, and as a proxy for that 'AS Operator', it's not a 1:1 correlation to be sure but it should be reasonably close, no? Well, I don't see why resource holders should correlate to AS operators. Maybe... But see below. >> You seem to associate publication points (that directly relate to CAs) with AS Operators. Since it's a second place where >> publication points are associated with AS Operators (another is the "RPKI rsync Download Delay Modeling" presentation), I wonder >> if I miss something? > > most likely you are not... I think I jump to 'CA == REPO == AS-Operator == ASN allocated' because lacking any direct data > otherwise it seems like a good estimation of numbers. Essentially each ASN allocated is going to be a repository that needs to be > gathered, right? If there are 10% more repositories due to EndSite allocations without an ASN also allocated to them I think it's > still in the ballpark to say "number of Repos == ASN allocation number". I could be wrong. Ok, then I'll continue with mine line of thinking. >From the RIR stats files that RIRs publish daily we could get the numbers of distinct resource holders. They are: AFRINIC 1310 APNIC 7957 ARIN 35380 LACNIC 4278 For the RIPE NCC you could not get this data from stats files, and the exact number is difficult to get because of our model of provider-independent end users. But in our registry I could count that it is at least 28912. That brings the total to77837. Now, these are only the first level resource holders under RIRs. They all *must* have their own CAs in order to participate in RPKI. However, many of these first-level resource holders are NIRs or LIRs, who distribute resources further down to their clients. They could choose to manage their clients' RPKI objects within their single CA, but could also give their clients own certificates, creating next level of CA hierarchy. I find it difficult to estimate how many LIRs will do this, and for how many of their clients. But for RIPE NCC I could see that the number of organisation objects in RIPE DB is 70746, and that should be the upper bound of the number of CAs in our region. I don't have that number for other regions, and don't know if it's applicable in the same way, especially where NIRs are present. Hope that's clear and helps. -- Oleg Muravskiy RIPE NCC --------------020302080707070206020302 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit
Christopher Morrow wrote:

On Thu, Mar 21, 2013 at 6:09 AM, Oleg Muravskiy <oleg@ripe.net> wrote:

Hi Christopher,
Christopher Morrow wrote:

Comment 1 (also related with 44): I agree that ISPs may operate caches in behalf end-users ASNs, but also I think that more than 1 cache may be operated by a single ISP. Imagine a global ASN operator with routers in several places. Are they going to have just one master cache? Or are they have one or two (backup), and just in one location? Considering this, even the 40k clients may be low as worse case IMHO. oops, so... we need to be clear in terminology here there are at least: o publication points - places/machines AS Operators would make their authoritative information available to the world.

In our analysis we associate number of CAs in the global RPKI with the number of distinct IP resource holders.

sure, and as a proxy for that 'AS Operator', it's not a 1:1 correlation to be sure but it should be reasonably close, no?

Well, I don't see why resource holders should correlate to AS operators. Maybe... But see below.

You seem to associate publication points (that directly relate to CAs) with AS Operators. Since it's a second place where publication points are associated with AS Operators (another is the "RPKI rsync Download Delay Modeling" presentation), I wonder if I miss something?

most likely you are not... I think I jump to 'CA == REPO == AS-Operator == ASN allocated' because lacking any direct data otherwise it seems like a good estimation of numbers. Essentially each ASN allocated is going to be a repository that needs to be gathered, right? If there are 10% more repositories due to EndSite allocations without an ASN also allocated to them I think it's still in the ballpark to say "number of Repos == ASN allocation number". I could be wrong.

Ok, then I'll continue with mine line of thinking.
From the RIR stats files that RIRs publish daily we could get the numbers of distinct resource holders. They are:

AFRINIC  1310
APNIC    7957
ARIN     35380
LACNIC   4278

For the RIPE NCC you could not get this data from stats files, and the exact number is difficult to get because of our model of provider-independent end users. But in our registry I could count that it is at least 28912.
That brings the total to 77837.

Now, these are only the first level resource holders under RIRs. They all *must* have their own CAs in order to participate in RPKI. However, many of these first-level resource holders are NIRs or LIRs, who distribute resources further down to their clients. They could choose to manage their clients' RPKI objects within their single CA, but could also give their clients  own certificates, creating next level of CA hierarchy. I find it difficult to estimate how many LIRs will do this, and for how many of their clients. But for RIPE NCC I could see that the number of organisation objects in RIPE DB is 70746, and that should be the upper bound of the number of CAs in our region. I don't have that number for other regions, and don't know if it's applicable in the same way, especially where NIRs are present.

Hope that's clear and helps.


 --
Oleg Muravskiy
RIPE NCC
--------------020302080707070206020302-- From oleg@ripe.net Fri Mar 22 18:34:04 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7A7F921F8EDE for ; Fri, 22 Mar 2013 18:34:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[AWL=0.598, BAYES_00=-2.599, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3PIB5q4SZrCs for ; Fri, 22 Mar 2013 18:34:04 -0700 (PDT) Received: from postgirl.ripe.net (postgirl.ipv6.ripe.net [IPv6:2001:67c:2e8:11::c100:1342]) by ietfa.amsl.com (Postfix) with ESMTP id ACA4921F8E92 for ; Fri, 22 Mar 2013 18:34:03 -0700 (PDT) Received: from dodo.ripe.net ([193.0.23.4]) by postgirl.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1UJDLM-0005R8-Rh; Sat, 23 Mar 2013 02:34:01 +0100 Received: from dog.ripe.net ([193.0.1.217] helo=ommbp.lan) by dodo.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1UJDLL-00059J-Lh; Sat, 23 Mar 2013 02:33:59 +0100 Message-ID: <514D0686.1000805@ripe.net> Date: Sat, 23 Mar 2013 02:33:58 +0100 From: Oleg Muravskiy Organization: RIPE NCC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:19.0) Gecko/20100101 Firefox/19.0 SeaMonkey/2.16.2 MIME-Version: 1.0 To: Randy Bush , Christopher Morrow References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <489fe43c-ec45-4bba-86e4-b8a39df1e731@email.android.com> In-Reply-To: <489fe43c-ec45-4bba-86e4-b8a39df1e731@email.android.com> X-Enigmail-Version: 1.5.1 Content-Type: multipart/alternative; boundary="------------090009060505070607030403" X-Anti-Virus: Kaspersky Anti-Virus for Linux Mail Server 5.6.48/RELEASE, bases: 20120425 #7816575, check: 20130323 clean X-RIPE-Spam-Level: ----- X-RIPE-Spam-Report: Spam Total Points: -5.4 points pts rule name description ---- ---------------------- ------------------------------------ -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP -2.5 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] 0.0 HTML_MESSAGE BODY: HTML included in message X-RIPE-Signature: c408758d4ce2e8eb06762a65a3365b7422d942892c269e15f4d9709239c96158 Cc: sidr wg list Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 23 Mar 2013 01:34:04 -0000 This is a multi-part message in MIME format. --------------090009060505070607030403 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Randy Bush wrote: >> I have, a model that says: >> "If you want to publish a ROA, you need to have a CA and you need to >> run a publication point" >> land this a roa and a CA). > Wherever did you get that? what is the ratio of hosted LIRs to delegated today? Although in a hosted model it's possible to run just one CA and one publication point for all hosted clients, in practice no one from RIRs is doing that. In our hosted system we have 1370 CAs, and each CA has it's own publication point, although they all appear to be in the same rsync tree. If the number of CAs is used to estimate the size of a global RPKI repository (number of objects), then the distinction between hosted and delegated model doesn't matter. It matters if you want to estimate the number of different repositories to query. But I don't know what to do with that number afterwards. -- Oleg Muravskiy RIPE NCC --------------090009060505070607030403 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit
Randy Bush wrote:
I have, a model that says:
 "If you want to publish a ROA, you need to have a CA and you need to
run a publication point"
land this a roa and a CA).

Wherever did you get that?   what is the ratio of hosted LIRs to delegated today?

Although in a hosted model it's possible to run just one CA and one publication point for all hosted clients, in practice no one from RIRs is doing that.
In our hosted system we have 1370 CAs, and each CA has it's own publication point, although they all appear to be in the same rsync tree.

If the number of CAs is used to estimate the size of a global RPKI repository (number of objects), then the distinction between hosted and delegated model doesn't matter. It matters if you want to estimate the number of different repositories to query. But I don't know what to do with that number afterwards.

-- 
Oleg Muravskiy
RIPE NCC
--------------090009060505070607030403-- From christopher.morrow@gmail.com Fri Mar 22 19:38:08 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E4C9521F8C7D for ; Fri, 22 Mar 2013 19:38:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.485 X-Spam-Level: X-Spam-Status: No, score=-102.485 tagged_above=-999 required=5 tests=[AWL=0.115, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4WOrogJCc+IP for ; Fri, 22 Mar 2013 19:38:08 -0700 (PDT) Received: from mail-la0-x22f.google.com (mail-la0-x22f.google.com [IPv6:2a00:1450:4010:c03::22f]) by ietfa.amsl.com (Postfix) with ESMTP id AE8EE21F8C45 for ; Fri, 22 Mar 2013 19:38:07 -0700 (PDT) Received: by mail-la0-f47.google.com with SMTP id fj20so8488099lab.34 for ; Fri, 22 Mar 2013 19:38:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:x-received:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type; bh=eZsJXNisoJl755oU456M3CYfVvAOJvD6aH0JyTv/db4=; b=QYQP0c6hpIRFn4GULsWG9/5oJq+Z2qYOGSj1kBgLYJPLjGeSxRBV+BDNyz4sSQSwNr jY7zHMmUmgwdFlkzNbnnRhLDwEnH/WqKhj7x1keQwVCmtmjJKyXFoZCmCxEBqcjSa1Eo /tcvut21ukJfTcwD5lVw/bgO/47kNbw2n84fwWvrp3qx92SLGQNQzTBfa8xL4Yv+vZI4 0bX9LDbIBOzRBbrNovjuW+TlH8DVg2ruHxyFMVYaZm7Db02OuAs4CsCPP4TlljTRoo0d DXK+sYvrrHNdjI6BoEgCVLCInLJq2rQ2m9BCwElLPnuh6TFeGI4MB+C2BTc+OIQ/DDYc cEow== MIME-Version: 1.0 X-Received: by 10.112.146.193 with SMTP id te1mr1683844lbb.27.1364006286606; Fri, 22 Mar 2013 19:38:06 -0700 (PDT) Sender: christopher.morrow@gmail.com Received: by 10.152.28.34 with HTTP; Fri, 22 Mar 2013 19:38:06 -0700 (PDT) In-Reply-To: <514CFC5F.3090401@ripe.net> References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514CFC5F.3090401@ripe.net> Date: Fri, 22 Mar 2013 22:38:06 -0400 X-Google-Sender-Auth: ZPRPl-PTh8RVgMy0P2lSwav4R0Q Message-ID: From: Christopher Morrow To: Oleg Muravskiy Content-Type: text/plain; charset=ISO-8859-1 Cc: sidr@ietf.org Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 23 Mar 2013 02:38:09 -0000 (holy giant text batman!) On Fri, Mar 22, 2013 at 8:50 PM, Oleg Muravskiy wrote: > > Christopher Morrow wrote: > > > On Thu, Mar 21, 2013 at 6:09 AM, Oleg Muravskiy wrote: > > > Hi Christopher, > > Christopher Morrow wrote: > > > Comment 1 (also related with 44): I agree that ISPs may operate caches in > behalf end-users ASNs, but also I think that more than 1 cache may be > operated by a single ISP. Imagine a global ASN operator with routers in > several places. Are they going to have just one master cache? Or are they > have one or two (backup), and just in one location? Considering this, even > the 40k clients may be low as worse case IMHO. oops, so... we need to be > clear in terminology here there are at least: o publication points - > places/machines AS Operators would make their authoritative information > available to the world. > > > In our analysis we associate number of CAs in the global RPKI with the > number of distinct IP resource holders. > > > sure, and as a proxy for that 'AS Operator', it's not a 1:1 correlation to > be sure but it should be reasonably close, no? > > > Well, I don't see why resource holders should correlate to AS operators. > Maybe... But see below. > ah! I made you look :) > > You seem to associate publication points (that directly relate to CAs) with > AS Operators. Since it's a second place where publication points are > associated with AS Operators (another is the "RPKI rsync Download Delay > Modeling" presentation), I wonder if I miss something? > > > most likely you are not... I think I jump to 'CA == REPO == AS-Operator == > ASN allocated' because lacking any direct data otherwise it seems like a > good estimation of numbers. Essentially each ASN allocated is going to be a > repository that needs to be gathered, right? If there are 10% more > repositories due to EndSite allocations without an ASN also allocated to > them I think it's still in the ballpark to say "number of Repos == ASN > allocation number". I could be wrong. > > > Ok, then I'll continue with mine line of thinking. > From the RIR stats files that RIRs publish daily we could get the numbers of > distinct resource holders. They are: > > AFRINIC 1310 > APNIC 7957 > ARIN 35380 > LACNIC 4278 > > For the RIPE NCC you could not get this data from stats files, and the exact > number is difficult to get because of our model of provider-independent end > users. But in our registry I could count that it is at least 28912. > That brings the total to 77837. > > Now, these are only the first level resource holders under RIRs. They all > *must* have their own CAs in order to participate in RPKI. However, many of > these first-level resource holders are NIRs or LIRs, who distribute > resources further down to their clients. They could choose to manage their > clients' RPKI objects within their single CA, but could also give their > clients own certificates, creating next level of CA hierarchy. I find it > difficult to estimate how many LIRs will do this, and for how many of their > clients. But for RIPE NCC I could see that the number of organisation > objects in RIPE DB is 70746, and that should be the upper bound of the cool! so already the number of repositories could be north of 100k (given the other 5 regions)... 'could be'. In the end I think it'd be nice of the models (some of them at least) had the ability to see 'what if 5 repos? what if 500? 500,000?' which I think is what Capitan Kent got to in his last mail.... "yes, it's a parameter we can twiddle". Some of the more real-world measurement, which Admiral Bush is after, is indeed harder to do this with (I think), but knowing behaviour of the current system should help to extrapolate I would think. > number of CAs in our region. I don't have that number for other regions, and > don't know if it's applicable in the same way, especially where NIRs are > present. > > Hope that's clear and helps. > yes! thanks. -chris > -- > Oleg Muravskiy > RIPE NCC > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From christopher.morrow@gmail.com Fri Mar 22 19:40:17 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 26D1421F8E11 for ; Fri, 22 Mar 2013 19:40:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.495 X-Spam-Level: X-Spam-Status: No, score=-102.495 tagged_above=-999 required=5 tests=[AWL=0.105, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Cm0Hv6t8cLhw for ; Fri, 22 Mar 2013 19:40:16 -0700 (PDT) Received: from mail-la0-x22e.google.com (mail-la0-x22e.google.com [IPv6:2a00:1450:4010:c03::22e]) by ietfa.amsl.com (Postfix) with ESMTP id 413B321F8DD1 for ; Fri, 22 Mar 2013 19:40:16 -0700 (PDT) Received: by mail-la0-f46.google.com with SMTP id fq12so8301914lab.5 for ; Fri, 22 Mar 2013 19:40:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:x-received:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type; bh=y6Zj2vTYaXblqcjwkhmNHqgTVFz/EZlU6D8esYPZWII=; b=FK4zSp8HR/N3lg7vsqFkNRDokbCssol5fZCPjzhnAlfxRErAGrTb24SZgmkuSRx4iz Y/Q8qto7hl+Y00V9KTEDSZz9Or7ZSJFduATIdqNAv7TKQFSstexqjNU6FY89fNF4XqEm hjj17sRb5QONeMN00Ik6HvP+TFWzD+jFiuQCWDe7RF4iCqPyJnQxe7uW7T7+Hrkp7qwq +9f/TNG/FpTM/lkiotjRj3ht/mCNDGdbdG8CA3epxjtl66EE1S92NRgdQiqhHC2r1gfm Z1qEBVmMd5doNyRrvNFWArAcLqupp/byL/+JR6R66y7mBQ7Qf2+D6ve26FSTVIJPI63q aRjQ== MIME-Version: 1.0 X-Received: by 10.112.47.41 with SMTP id a9mr2183216lbn.134.1364006415104; Fri, 22 Mar 2013 19:40:15 -0700 (PDT) Sender: christopher.morrow@gmail.com Received: by 10.152.28.34 with HTTP; Fri, 22 Mar 2013 19:40:15 -0700 (PDT) In-Reply-To: <514D0686.1000805@ripe.net> References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <489fe43c-ec45-4bba-86e4-b8a39df1e731@email.android.com> <514D0686.1000805@ripe.net> Date: Fri, 22 Mar 2013 22:40:15 -0400 X-Google-Sender-Auth: 6grduJ9YZtt3U8yjiM3HqGUp5H8 Message-ID: From: Christopher Morrow To: Oleg Muravskiy Content-Type: text/plain; charset=ISO-8859-1 Cc: sidr wg list Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 23 Mar 2013 02:40:17 -0000 On Fri, Mar 22, 2013 at 9:33 PM, Oleg Muravskiy wrote: > > Randy Bush wrote: > > I have, a model that says: > "If you want to publish a ROA, you need to have a CA and you need to > run a publication point" > land this a roa and a CA). > > Wherever did you get that? what is the ratio of hosted LIRs to delegated > today? > > > Although in a hosted model it's possible to run just one CA and one > publication point for all hosted clients, in practice no one from RIRs is > doing that. > In our hosted system we have 1370 CAs, and each CA has it's own publication > point, although they all appear to be in the same rsync tree. so, this leads to some confusion, but does make the repository one monolithic item to kill/sync-from. It's convenient, right up until it's not :( I'm not sure when that point will arrive, but ... > If the number of CAs is used to estimate the size of a global RPKI > repository (number of objects), then the distinction between hosted and > delegated model doesn't matter. It matters if you want to estimate the > number of different repositories to query. But I don't know what to do with > that number afterwards. I hope that the next step after that estimate is: "real world testing shows pulling a repository/update-set takes X seconds, as we get larger in the number of repositories, we need to keep that in mind" -chris From randy@psg.com Fri Mar 22 21:06:28 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 30C3021F91AC for ; Fri, 22 Mar 2013 21:06:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Q1grJN6ZNXKD for ; Fri, 22 Mar 2013 21:06:27 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id C83C921F9161 for ; Fri, 22 Mar 2013 21:06:27 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.80.1 (FreeBSD)) (envelope-from ) id 1UJFiq-000CPo-2l; Sat, 23 Mar 2013 04:06:24 +0000 Date: Sat, 23 Mar 2013 13:06:21 +0900 Message-ID: From: Randy Bush To: Oleg Muravskiy In-Reply-To: <514D0686.1000805@ripe.net> References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <489fe43c-ec45-4bba-86e4-b8a39df1e731@email.android.com> <514D0686.1000805@ripe.net> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Cc: sidr wg list Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 23 Mar 2013 04:06:28 -0000 > Although in a hosted model it's possible to run just one CA and one > publication point for all hosted clients yucchhy > in practice no one from RIRs is doing that. thank you > If the number of CAs is used to estimate the size of a global RPKI > repository (number of objects), then the distinction between hosted > and delegated model doesn't matter. It matters if you want to estimate > the number of different repositories to query. as you know, performance of the current transport, rsync, is most dependent on the number of repositories, not publication points or objects. > But I don't know what to do with that number afterwards. multiply by a million and post your estimate on the sidr list as a realistic prediction? :) randy From arturo.servin@gmail.com Sat Mar 23 07:38:38 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1D49D21F8477 for ; Sat, 23 Mar 2013 07:38:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.416 X-Spam-Level: X-Spam-Status: No, score=-2.416 tagged_above=-999 required=5 tests=[AWL=-0.184, BAYES_00=-2.599, NO_RELAYS=-0.001, URI_HEX=0.368] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YABOU8NEQzr7 for ; Sat, 23 Mar 2013 07:38:37 -0700 (PDT) Received: from mail-gg0-x22f.google.com (mail-gg0-x22f.google.com [IPv6:2607:f8b0:4002:c02::22f]) by ietfa.amsl.com (Postfix) with ESMTP id 6383621F8948 for ; Sat, 23 Mar 2013 07:38:33 -0700 (PDT) Received: by mail-gg0-f175.google.com with SMTP id l1so235781ggn.6 for ; Sat, 23 Mar 2013 07:38:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=x-received:message-id:date:from:user-agent:mime-version:to:subject :references:in-reply-to:content-type:content-transfer-encoding; bh=E0GTEzAZTP3FzqBxrhVu9GzKUIlS9iffIRdTittBxRo=; b=OoVaEo0Bf9wyGscClWq103mC4nd+uXMwrbJEfMLGXNASZvG6aMtmMkr6lQD39Q52fN k+CtoUz/Z9RbHPhM+6IVDCCJZOl1ynIxr9hhiXMch78eKGjxVoeJktyVMlUXUnMH6QPv EUYxYdPRZF68WJNJNrsPoDsSzpwXAgd1ZrfKEvvvROUwEjt2I4cEJd5JSMKqH8TuB9JT FaAhZVArZbqZQsZuY2pIWlFaY8zo06wI2KKfKyZet9dLfMOLZ9gCQ08/hzJEB0BqDBNQ kJl1FbcVqqymDZpdIopm6JrUJwyIVYMZLRkoCaBHBJ2Kruz0TPza2RH/Nfh3P+cQtQtN tQKA== X-Received: by 10.236.118.71 with SMTP id k47mr1501285yhh.30.1364049506040; Sat, 23 Mar 2013 07:38:26 -0700 (PDT) Received: from Arturos-MacBook-Pro.local ([2800:af:ba30:cf2a:9152:f350:a591:5e91]) by mx.google.com with ESMTPS id m70sm8655800yhe.12.2013.03.23.07.38.23 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Sat, 23 Mar 2013 07:38:24 -0700 (PDT) Message-ID: <514DBE5D.1020304@gmail.com> Date: Sat, 23 Mar 2013 11:38:21 -0300 From: Arturo Servin User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: sidr@ietf.org References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <489fe43c-ec45-4bba-86e4-b8a39df1e731@email.android.com> <514D0686.1000805@ripe.net> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 23 Mar 2013 14:38:38 -0000 On 3/22/13 11:40 PM, Christopher Morrow wrote: > On Fri, Mar 22, 2013 at 9:33 PM, Oleg Muravskiy wrote: hoping not to cut important parts >> >> Although in a hosted model it's possible to run just one CA and one >> publication point for all hosted clients, in practice no one from RIRs is >> doing that. >> In our hosted system we have 1370 CAs, and each CA has it's own publication >> point, although they all appear to be in the same rsync tree. > > so, this leads to some confusion, but does make the repository one > monolithic item to kill/sync-from. It's convenient, right up until > it's not :( I'm not sure when that point will arrive, but ... > I liked what you proposed in [1] ca-1234ab.repository.ur-rir.net ca-1235bb.repository.ur-rir.net This would help to move a problematic CA out of the monolithic repo. However, this would make a cache to create multiple rsync sessions to retrieve objects and lowering its performance (according to Rob's measurements with RIPE NCC repo). Isn't it? [1] http://www.ietf.org/mail-archive/web/sidr/current/msg05835.html /as From eosterweil@verisign.com Sat Mar 23 09:28:39 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 192F121F893D for ; Sat, 23 Mar 2013 09:28:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XUMHGI9hKY5H for ; Sat, 23 Mar 2013 09:28:38 -0700 (PDT) Received: from exprod6og126.obsmtp.com (exprod6og126.obsmtp.com [64.18.1.77]) by ietfa.amsl.com (Postfix) with ESMTP id B969421F8936 for ; Sat, 23 Mar 2013 09:28:37 -0700 (PDT) Received: from peregrine.verisign.com ([216.168.239.74]) (using TLSv1) by exprod6ob126.postini.com ([64.18.5.12]) with SMTP ID DSNKUU3YMrgBBqRSjqc65KEHX3m9ERWzAHLu@postini.com; Sat, 23 Mar 2013 09:28:37 PDT Received: from dul1wnexcn01.vcorp.ad.vrsn.com (dul1wnexcn01.vcorp.ad.vrsn.com [10.170.12.138]) by peregrine.verisign.com (8.13.6/8.13.4) with ESMTP id r2NGSUKa010904; Sat, 23 Mar 2013 12:28:33 -0400 Received: from [10.100.0.114] ([10.100.0.114]) by dul1wnexcn01.vcorp.ad.vrsn.com with Microsoft SMTPSVC(6.0.3790.4675); Sat, 23 Mar 2013 12:28:30 -0400 Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\)) From: "Osterweil, Eric" In-Reply-To: Date: Sat, 23 Mar 2013 12:28:30 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <489fe43c-ec45-4bba-86e4-b8a39df1e731@email.android.com> <514D0686.1000805@ripe.net> To: Randy Bush X-Mailer: Apple Mail (2.1499) X-OriginalArrivalTime: 23 Mar 2013 16:28:30.0100 (UTC) FILETIME=[7434CD40:01CE27E3] Cc: sidr wg list Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 23 Mar 2013 16:28:39 -0000 On Mar 23, 2013, at 12:06 AM, Randy Bush wrote: >> If the number of CAs is used to estimate the size of a global RPKI >> repository (number of objects), then the distinction between hosted >> and delegated model doesn't matter. It matters if you want to = estimate >> the number of different repositories to query. >=20 > as you know, performance of the current transport, rsync, is most > dependent on the number of repositories, not publication points or > objects. Actually, our numbers from RPKI Spider and one of the presentations (not = ours) at the last sidr wg showed that rsync scaling depends both on the = size of the repo and the number of objects... >=20 >> But I don't know what to do with that number afterwards. >=20 > multiply by a million and post your estimate on the sidr list as a > realistic prediction? :) Yup, that has been something some people have been advocating: http://www.ietf.org/mail-archive/web/sidr/current/msg05351.html ``i would assume a million'' Eric= From eosterweil@verisign.com Sat Mar 23 09:40:01 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5F76D21F89D7 for ; Sat, 23 Mar 2013 09:40:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tC86Fh7AGYBp for ; Sat, 23 Mar 2013 09:40:00 -0700 (PDT) Received: from exprod6og126.obsmtp.com (exprod6og126.obsmtp.com [64.18.1.77]) by ietfa.amsl.com (Postfix) with ESMTP id 97ECF21F89C3 for ; Sat, 23 Mar 2013 09:40:00 -0700 (PDT) Received: from peregrine.verisign.com ([216.168.239.74]) (using TLSv1) by exprod6ob126.postini.com ([64.18.5.12]) with SMTP ID DSNKUU3a4KjzVkYnDHcME/lXkMto2nonNUtq@postini.com; Sat, 23 Mar 2013 09:40:00 PDT Received: from DUL1WNSMTP01.vcorp.ad.vrsn.com (dul1wnexcn03.vcorp.ad.vrsn.com [10.170.12.113]) by peregrine.verisign.com (8.13.6/8.13.4) with ESMTP id r2NGdxDQ011172 for ; Sat, 23 Mar 2013 12:39:59 -0400 Received: from [10.100.0.114] ([10.100.0.114]) by DUL1WNSMTP01.vcorp.ad.vrsn.com with Microsoft SMTPSVC(7.5.7601.17514); Sat, 23 Mar 2013 12:39:56 -0400 Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\)) From: "Osterweil, Eric" In-Reply-To: <514DBE5D.1020304@gmail.com> Date: Sat, 23 Mar 2013 12:39:56 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: <089AD32D-16F3-44F4-BC6E-0F291B7C1926@verisign.com> References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <489fe43c-ec45-4bba-86e4-b8a39df1e731@email.android.com> <514D0686.1000805@ripe.net> <514DBE5D.1020304@gmail.com> To: Arturo Servin X-Mailer: Apple Mail (2.1499) X-OriginalArrivalTime: 23 Mar 2013 16:39:56.0539 (UTC) FILETIME=[0D5B14B0:01CE27E5] Cc: sidr@ietf.org Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 23 Mar 2013 16:40:01 -0000 On Mar 23, 2013, at 10:38 AM, Arturo Servin = wrote: > This would help to move a problematic CA out of the monolithic = repo. > However, this would make a cache to create multiple rsync sessions to > retrieve objects and lowering its performance (according to Rob's > measurements with RIPE NCC repo). Isn't it? Just to make a general observation: I'm a little worried that this is a = case of the tail wagging the dog=85 The issue that Chris seems to be = raising (at least, to me) is one of scale and resilience=85 It seems to = me that our efforts to optimize _rsync's_ performance at all costs is = starting to require us to relax our security and stability concerns. At = a high level, I think that actually points to rsync as a suboptimal = component. Regardless of the transport used, Chris' comments seem sound = to me, and I haven't seem too many comments that rebuff his general = concerns. The fact that rsync doesn't fit well into the model of = securing repositories while still making them lively enough for caches = is worrisome to me. I would think that it ought to suggest something = other than relaxing our security and stability concerns=85 Just my = 0.02=85 Eric= From randy@psg.com Sat Mar 23 17:26:52 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DA66B21F8CB6 for ; Sat, 23 Mar 2013 17:26:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kxRk-dI25sHc for ; Sat, 23 Mar 2013 17:26:52 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id 2879621F8CA5 for ; Sat, 23 Mar 2013 17:26:52 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.80.1 (FreeBSD)) (envelope-from ) id 1UJYlt-000GMc-RE; Sun, 24 Mar 2013 00:26:50 +0000 Date: Sun, 24 Mar 2013 09:26:48 +0900 Message-ID: From: Randy Bush To: Stephen Kent In-Reply-To: <51423B3E.6030804@bbn.com> References: <51423B3E.6030804@bbn.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Cc: sidr wg list Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 24 Mar 2013 00:26:53 -0000 > During the first SIDR session I commented that I agree with the need > to explore new paradigms for distributing RPKI repository data, but > that i was very disappointed with the analysis being used to motivate > the exploration. the ripe crew have looked at server load issues. we've got client measurements going back to day one, and every cache displays continuous and historical performance measurements. tim, oleg, bryan, rob, i, and others have and continue to explore protocols other than rsync. as we have all said before, no one thinks rsync is gonna scale forever. but it's scaling well enough for the near term (see actual measurements by all rpki.net caches, emulation reports, etc). and it looks as if we have plenty of time to do a next gen effort carefully. there seems to be a good bunch of actual measurers/designers/implementors. they seem to be too busy to post a dozen messages a day to the list. this is a feature, not a bug. randy From kent@bbn.com Mon Mar 25 07:45:46 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9C3BA11E80C5 for ; Mon, 25 Mar 2013 07:45:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -104.74 X-Spam-Level: X-Spam-Status: No, score=-104.74 tagged_above=-999 required=5 tests=[BAYES_20=-0.74, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dhg5LWbGZ6w1 for ; Mon, 25 Mar 2013 07:45:46 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) by ietfa.amsl.com (Postfix) with ESMTP id 064E011E80BA for ; Mon, 25 Mar 2013 07:45:42 -0700 (PDT) Received: from dhcp89-089-218.bbn.com ([128.89.89.218]:50730) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1UK8eK-0003MA-B2; Mon, 25 Mar 2013 10:45:24 -0400 Message-ID: <51506304.7060809@bbn.com> Date: Mon, 25 Mar 2013 10:45:24 -0400 From: Stephen Kent User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: sidr@ietf.org, Oleg Muravskiy References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <489fe43c-ec45-4bba-86e4-b8a39df1e731@email.android.com> <514D0686.1000805@ripe.net> In-Reply-To: <514D0686.1000805@ripe.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2013 14:45:46 -0000 ... > > If the number of CAs is used to estimate the size of a global RPKI > repository (number of objects), then the distinction between hosted > and delegated model doesn't matter. It matters if you want to estimate > the number of different repositories to query. But I don't know what > to do with that number afterwards. > > -- > Oleg Muravskiy > RIPE NCC Oleg, The time it takes for an RP to acquire all updated/new objects is a function of both the number of objects and the number of repositories, as illustrated by the measurements that Rob, Andrew et al. have posted, and reflected in the models that have been developed. That's why the projected number of repositories (in the future) has become a contentious topic. Steve From kent@bbn.com Mon Mar 25 07:53:31 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1823F11E80D3 for ; Mon, 25 Mar 2013 07:53:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -104.79 X-Spam-Level: X-Spam-Status: No, score=-104.79 tagged_above=-999 required=5 tests=[AWL=0.050, BAYES_00=-2.599, FR_3TAG_3TAG=1.758, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xIE-3pXUss-T for ; Mon, 25 Mar 2013 07:53:30 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) by ietfa.amsl.com (Postfix) with ESMTP id 27DE811E80C5 for ; Mon, 25 Mar 2013 07:53:30 -0700 (PDT) Received: from dhcp89-089-218.bbn.com ([128.89.89.218]:50731) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1UK8m6-0003bo-GX; Mon, 25 Mar 2013 10:53:26 -0400 Message-ID: <515064E6.7030508@bbn.com> Date: Mon, 25 Mar 2013 10:53:26 -0400 From: Stephen Kent User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: sidr@ietf.org, Oleg Muravskiy References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514CFC5F.3090401@ripe.net> In-Reply-To: <514CFC5F.3090401@ripe.net> Content-Type: multipart/alternative; boundary="------------030300010205040403080209" Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2013 14:53:31 -0000 This is a multi-part message in MIME format. --------------030300010205040403080209 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit ... > Ok, then I'll continue with mine line of thinking. > From the RIR stats files that RIRs publish daily we could get the > numbers of distinct resource holders. They are: > > AFRINIC 1310 > APNIC 7957 > ARIN 35380 > LACNIC 4278 What is the definition of a "distinct resource holder?" Does this correspond to an account with the RIR, or is there some other definition? > Now, these are only the first level resource holders under RIRs. They > all *must* have their own CAs in order to participate in RPKI. > However, many of these first-level resource holders are NIRs Many are NIRs? There are no many NIRs in the world, and today the ones in APNIC (the region with the most NIRs) act as RAs, not CAs. So it's not clear that one should be counting them. > or LIRs, who distribute resources further down to their clients. They > could choose to manage their clients' RPKI objects within their single > CA, but could also give their clients own certificates, creating next > level of CA hierarchy. The distinction you cite here is not quite correct. Even if an LIR manages RPKI objects for folks to whom that have sub-allocated resources, each of those folks is represented by a CA. The question is who runs that CA, and whether the CA's pub point lives in a different repository. > I find it difficult to estimate how many LIRs will do this, and for > how many of their clients. But for RIPE NCC I could see that the > number of organisation objects in RIPE DB is 70746, and that should be > the upper bound of the number of CAs in our region. I don't have that > number for other regions, and don't know if it's applicable in the > same way, especially where NIRs are present. > NIRs are probably not relevant in this counting approach. Steve --------------030300010205040403080209 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit ...
Ok, then I'll continue with mine line of thinking.
From the RIR stats files that RIRs publish daily we could get the numbers of distinct resource holders. They are:

 AFRINIC  1310
APNIC    7957
ARIN     35380
LACNIC   4278
What is the definition of a "distinct resource holder?" Does this correspond to an account with the RIR, or is there some other definition?
Now, these are only the first level resource holders under RIRs. They all *must* have their own CAs in order to participate in RPKI. However, many of these first-level resource holders are NIRs
Many are NIRs? There are no many NIRs in the world, and today the ones in APNIC (the region with the most NIRs) act as RAs, not CAs. So it's not clear that one should be counting them.
or LIRs, who distribute resources further down to their clients. They could choose to manage their clients' RPKI objects within their single CA, but could also give their clients  own certificates, creating next level of CA hierarchy.
The distinction you cite here is not quite correct. Even if an LIR manages RPKI objects for folks to whom that have sub-allocated resources, each of those folks is represented by a CA. The question is who runs that CA, and whether the CA's pub point lives in a different repository.
I find it difficult to estimate how many LIRs will do this, and for how many of their clients. But for RIPE NCC I could see that the number of organisation objects in RIPE DB is 70746, and that should be the upper bound of the number of CAs in our region. I don't have that number for other regions, and don't know if it's applicable in the same way, especially where NIRs are present.

NIRs are probably not relevant in this counting approach.

Steve
 --------------030300010205040403080209-- From oleg@ripe.net Mon Mar 25 08:14:36 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4CA2C21F8FE8 for ; Mon, 25 Mar 2013 08:14:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5pIc0hc-oGEq for ; Mon, 25 Mar 2013 08:14:34 -0700 (PDT) Received: from postgirl.ripe.net (postgirl.ipv6.ripe.net [IPv6:2001:67c:2e8:11::c100:1342]) by ietfa.amsl.com (Postfix) with ESMTP id 9DEED21F8E84 for ; Mon, 25 Mar 2013 08:14:34 -0700 (PDT) Received: from ayeaye.ripe.net ([193.0.23.5]) by postgirl.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1UK96U-0003Xj-It; Mon, 25 Mar 2013 16:14:31 +0100 Received: from dog.ripe.net ([193.0.1.217] helo=guest137.guestnet.ripe.net) by ayeaye.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1UK96T-0000An-E6; Mon, 25 Mar 2013 16:14:29 +0100 Message-ID: <515069D5.5040403@ripe.net> Date: Mon, 25 Mar 2013 16:14:29 +0100 From: Oleg Muravskiy Organization: RIPE NCC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:19.0) Gecko/20100101 Firefox/19.0 SeaMonkey/2.16.2 MIME-Version: 1.0 To: Stephen Kent , sidr@ietf.org References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514CFC5F.3090401@ripe.net> <515064E6.7030508@bbn.com> In-Reply-To: <515064E6.7030508@bbn.com> X-Enigmail-Version: 1.5.1 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Anti-Virus: Kaspersky Anti-Virus for Linux Mail Server 5.6.48/RELEASE, bases: 20120425 #7816575, check: 20130325 clean X-RIPE-Spam-Level: ---- X-RIPE-Spam-Report: Spam Total Points: -4.2 points pts rule name description ---- ---------------------- ------------------------------------ -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP -1.3 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] X-RIPE-Signature: c408758d4ce2e8eb06762a65a3365b7443af8f2156f7ce4b7e9376bd05220421 Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2013 15:14:37 -0000 Hi Stephen, Stephen Kent wrote: > ... >> Ok, then I'll continue with mine line of thinking. >> From the RIR stats files that RIRs publish daily we could get the numbers of distinct resource holders. They are: >> >> AFRINIC 1310 >> APNIC 7957 >> ARIN 35380 >> LACNIC 4278 > What is the definition of a "distinct resource holder?" Does this correspond to an account with the RIR, or is there some other > definition? >> Now, these are only the first level resource holders under RIRs. They all *must* have their own CAs in order to participate in >> RPKI. However, many of these first-level resource holders are NIRs > Many are NIRs? No. You broke the line in the wrong place. I meant "many (NIRs or LIRs)". > There are no many NIRs in the world, and today the ones in APNIC (the region with the most NIRs) act as RAs, not CAs. So it's not > clear that one should be counting them. >> or LIRs, who distribute resources further down to their clients. They could choose to manage their clients' RPKI objects within >> their single CA, but could also give their clients own certificates, creating next level of CA hierarchy. > The distinction you cite here is not quite correct. Even if an LIR manages RPKI objects for folks to whom that have sub-allocated > resources, each of those folks is represented by a CA. Not necessarily. The LIR could create a ROA for client's assignment, using LIR's allocation certificate. I'm not saying they should do it like this, but they could. And I have a feeling that might become a common case. But I think LIRs could say for themselves. For example, how many their clients maintain Whois objects themselves, and for how many LIRs doing it? > The question is who runs that CA, and whether the CA's pub point lives in a different repository. >> I find it difficult to estimate how many LIRs will do this, and for how many of their clients. But for RIPE NCC I could see that >> the number of organisation objects in RIPE DB is 70746, and that should be the upper bound of the number of CAs in our region. I >> don't have that number for other regions, and don't know if it's applicable in the same way, especially where NIRs are present. >> > NIRs are probably not relevant in this counting approach. My point was that it's quite difficult to estimate the upper bound of possible CAs. NIR or LIR does not matter, I agree. -- Oleg Muravskiy RIPE NCC From kent@bbn.com Mon Mar 25 08:19:46 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8645721F8FFF for ; Mon, 25 Mar 2013 08:19:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -105.049 X-Spam-Level: X-Spam-Status: No, score=-105.049 tagged_above=-999 required=5 tests=[AWL=0.259, BAYES_00=-2.599, MISSING_HEADERS=1.292, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NalINVkBQJZ5 for ; Mon, 25 Mar 2013 08:19:45 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) by ietfa.amsl.com (Postfix) with ESMTP id B661721F8FFD for ; Mon, 25 Mar 2013 08:19:45 -0700 (PDT) Received: from dhcp89-089-218.bbn.com ([128.89.89.218]:50934) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1UK9BY-0005Ck-HV; Mon, 25 Mar 2013 11:19:44 -0400 Message-ID: <51506B10.6050600@bbn.com> Date: Mon, 25 Mar 2013 11:19:44 -0400 From: Stephen Kent User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> <5149C506.7080001@gmail.com> <5149D9A2.7030107@riw.us> <2F3EBB88EC3A454AAB08915FBF0B8C7E1D01BA@eusaamb109.ericsson.se> <514A098C.3040502@riw.us> <4B7D7C8E-273F-44DA-A705-0EB88E6459B4@istaff.org> <514A1336.4040202@riw.us> <3FB26F14-CF1B-4E5F-A8BA-416F32DB983E@castlepoint.net> <24B20D14B2CD29478C8D5D6E9CBB29F66D0FE430@Hermes.columbia.ads.sparta.com> In-Reply-To: Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Cc: dannyc@bu.edu, broglek@bu.edu, eth3rs@gmail.com, sidr@ietf.org Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2013 15:19:46 -0000 Sharon, > -- We show that it is possible to revoke a ROA surreptitiously, > through methods other than (the obvious) revocation lists. See Section > 2.2.1 of the report. The terminology above is not quite correct, since only one of the five "methods" results in revocation per se. I suggest using the technical term "whacking" instead. (You're a Princeton grad, so a NJ-inspired term of this sort seems appropriate :-.) Nonetheless, all of the methods for whacking a ROA described in the paper are detectable by anyone who monitors the RPKI. One might argue that each resource holder should monitor his/her RPKI pub point to detect any action that causes one's ROA to become unverifiable. That's a very easy check, to perform. Also, the scenario addressed in 2.2.1 is specific to a very narrowly-defined class of resource holders who elected the third of three approaches (not the preferred approach) to participating in the RPKI. > -- We show that targeted revocation can be accomplished by entities > other than a ROA's issuer, some of which may control many ROAs. The > means by which this is accomplished often looks similar to > grandparenting. See Sections 2.2.2, 2.2.3, and 2.3 of the report. As above, the actions described in these sections are all easily detectable by the targeted entity. So, the question is what that entity would/could do if it detects this sort of activity by its parent (or grandparent). Unless the parent was compelled to whack a ROA by a LEO, there is likely to be a legal remedy that can be invoked. if a LEO is involved, then the situation is more complex, but I've been working on a memo that describes remedies for that context as well. I'll share it when it's been vetted by some more folks. Steve From randy@psg.com Mon Mar 25 08:34:06 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C84DD21E8047 for ; Mon, 25 Mar 2013 08:34:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.392 X-Spam-Level: X-Spam-Status: No, score=-1.392 tagged_above=-999 required=5 tests=[AWL=1.207, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Mpeh0+ck2kUG for ; Mon, 25 Mar 2013 08:34:06 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id 5A87521E8045 for ; Mon, 25 Mar 2013 08:34:06 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.80.1 (FreeBSD)) (envelope-from ) id 1UK9PQ-000Mgn-KD; Mon, 25 Mar 2013 15:34:04 +0000 Date: Tue, 26 Mar 2013 00:34:03 +0900 Message-ID: From: Randy Bush To: Stephen Kent In-Reply-To: <51506B10.6050600@bbn.com> References: <98cb8eeecc958523d8786b5503cc2d56@tcb.net> <5149C506.7080001@gmail.com> <5149D9A2.7030107@riw.us> <2F3EBB88EC3A454AAB08915FBF0B8C7E1D01BA@eusaamb109.ericsson.se> <514A098C.3040502@riw.us> <4B7D7C8E-273F-44DA-A705-0EB88E6459B4@istaff.org> <514A1336.4040202@riw.us> <3FB26F14-CF1B-4E5F-A8BA-416F32DB983E@castlepoint.net> <24B20D14B2CD29478C8D5D6E9CBB29F66D0FE430@Hermes.columbia.ads.sparta.com> <51506B10.6050600@bbn.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Cc: sidr wg list Subject: Re: [sidr] Princeton University:: Impacting IP Address Reachability via RPKI Manipulations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2013 15:34:07 -0000 > Nonetheless, all of the methods for whacking a ROA described in the > paper are detectable by anyone who monitors the RPKI. One might argue > that each resource holder should monitor his/her RPKI pub point to > detect any action that causes one's ROA to become unverifiable. thanks to shane for whacking me on this general area in taipei. the results are in draft-ietf-sidr-origin-ops-20.txt Operators should use tools which warn them of any impending ROA or certificate expiry which could affect the validity of their own data. Ghostbuster Records, see [RFC6493], can be used to facilitate contact with upstream CAs to effect repair. and As reliable access to the global RPKI and an operator's caches (and possibly other hosts, e.g. DNS root servers) is important, an operator SHOULD take advantage of relying party tools which report changes in BGP or RPKI data which would negatively affect validation of such prefixes. > As above, the actions described in these sections are all easily > detectable by the targeted entity. suggestions for strengthening the draft appreciated. terse, steve, terse :) randy From kent@bbn.com Mon Mar 25 11:45:07 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5205821F90E2 for ; Mon, 25 Mar 2013 11:45:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -105.781 X-Spam-Level: X-Spam-Status: No, score=-105.781 tagged_above=-999 required=5 tests=[AWL=0.818, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j+BfmmGCNh57 for ; Mon, 25 Mar 2013 11:45:06 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.1.81]) by ietfa.amsl.com (Postfix) with ESMTP id 85C9F21F90DF for ; Mon, 25 Mar 2013 11:45:06 -0700 (PDT) Received: from dhcp89-089-218.bbn.com ([128.89.89.218]:51007) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1UKCOE-000OSg-Ob; Mon, 25 Mar 2013 14:45:02 -0400 Message-ID: <51509B2E.2070108@bbn.com> Date: Mon, 25 Mar 2013 14:45:02 -0400 From: Stephen Kent User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: Oleg Muravskiy References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514CFC5F.3090401@ripe.net> <515064E6.7030508@bbn.com> <515069D5.5040403@ripe.net> In-Reply-To: <515069D5.5040403@ripe.net> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Cc: sidr@ietf.org Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2013 18:45:07 -0000 Oleg, > No. You broke the line in the wrong place. I meant "many (NIRs or LIRs)". In your text the "many" is distributed over both terms, NIRs and LIRs. You should have just omitted NIRs, since there are not "many" of them . > Not necessarily. The LIR could create a ROA for client's assignment, > using LIR's allocation certificate. I'm not saying they should do it > like this, but they could. And I have a feeling that might become a > common case. But I think LIRs could say for themselves. For example, > how many their clients maintain Whois objects themselves, and for how > many LIRs doing it? I agree that an LIR could behave the way you indicated, but in so doing it needs to track which other LIRs provide service to the customer in question, in order to generate ROAs for each of them. If it fails to do so, any connections to other LIRs may be ignored, as the NLRI in question will be represented by a valid ROA pointing to another AS#. That might create a liability for the LIR. That's why Section 7.3.2 of RFC 6480 cites this as the least desirable option. >> The question is who runs that CA, and whether the CA's pub point lives in a different repository. >>> I find it difficult to estimate how many LIRs will do this, and for how many of their clients. But for RIPE NCC I could see that >>> the number of organisation objects in RIPE DB is 70746, and that should be the upper bound of the number of CAs in our region. I >>> don't have that number for other regions, and don't know if it's applicable in the same way, especially where NIRs are present. >>> >> NIRs are probably not relevant in this counting approach. > My point was that it's quite difficult to estimate the upper bound of possible CAs. NIR or LIR does not matter, I agree. > From oleg@ripe.net Tue Mar 26 03:02:05 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 80D2721F89E1 for ; Tue, 26 Mar 2013 03:02:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=-0.001, BAYES_00=-2.599, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9lWY8hvBzOwB for ; Tue, 26 Mar 2013 03:02:02 -0700 (PDT) Received: from postgirl.ripe.net (postgirl.ipv6.ripe.net [IPv6:2001:67c:2e8:11::c100:1342]) by ietfa.amsl.com (Postfix) with ESMTP id BBF9A21F89D3 for ; Tue, 26 Mar 2013 03:02:01 -0700 (PDT) Received: from ayeaye.ripe.net ([193.0.23.5]) by postgirl.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1UKQhb-0002pD-7W; Tue, 26 Mar 2013 11:02:01 +0100 Received: from dog.ripe.net ([193.0.1.217] helo=guest137.guestnet.ripe.net) by ayeaye.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1UKQhY-0003A8-C9; Tue, 26 Mar 2013 11:01:56 +0100 Message-ID: <51517215.9010602@ripe.net> Date: Tue, 26 Mar 2013 11:01:57 +0100 From: Oleg Muravskiy Organization: RIPE NCC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:19.0) Gecko/20100101 Firefox/19.0 SeaMonkey/2.16.2 MIME-Version: 1.0 To: Stephen Kent , sidr@ietf.org References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514CFC5F.3090401@ripe.net> <515064E6.7030508@bbn.com> In-Reply-To: <515064E6.7030508@bbn.com> X-Enigmail-Version: 1.5.1 Content-Type: multipart/alternative; boundary="------------010807080008080301050106" X-Anti-Virus: Kaspersky Anti-Virus for Linux Mail Server 5.6.48/RELEASE, bases: 20120425 #7816575, check: 20130326 clean X-RIPE-Spam-Level: ---- X-RIPE-Spam-Report: Spam Total Points: -4.2 points pts rule name description ---- ---------------------- ------------------------------------ -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP -1.3 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] 0.0 HTML_MESSAGE BODY: HTML included in message X-RIPE-Signature: c408758d4ce2e8eb06762a65a3365b743a2a4c0026d8c81eae19288cf7724092 Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2013 10:02:05 -0000 This is a multi-part message in MIME format. --------------010807080008080301050106 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Stephen Kent wrote: > ... >> Ok, then I'll continue with mine line of thinking. >> From the RIR stats files that RIRs publish daily we could get the numbers of distinct resource holders. They are: >> >> AFRINIC 1310 >> APNIC 7957 >> ARIN 35380 >> LACNIC 4278 > What is the definition of a "distinct resource holder?" Does this correspond to an account with the RIR, or is there some other > definition? I count the number of distinct reg-ids in the RIR statistics files (ftp..net/pub/stats//delegated--extended-latest, where is in {afrinic,apnic,arin,lacnic}). The file format document defines this field as: This is an in-series identifier which uniquely identifies a single organisation, an Internet number resource holder. All records in the file with the same reg-id are registered to the same resource holder. -- Oleg Muravskiy RIPE NCC --------------010807080008080301050106 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit
Stephen Kent wrote:
...
Ok, then I'll continue with mine line of thinking.
From the RIR stats files that RIRs publish daily we could get the numbers of distinct resource holders. They are:

 AFRINIC  1310
APNIC    7957
ARIN     35380
LACNIC   4278
What is the definition of a "distinct resource holder?" Does this correspond to an account with the RIR, or is there some other definition?

I count the number of distinct reg-ids in the RIR statistics files (ftp.<RIR>.net/pub/stats/<RIR>/delegated-<RIR>-extended-latest, where <RIR> is in {afrinic,apnic,arin,lacnic}). The file format document defines this field as:

This is an in-series identifier which uniquely identifies a single organisation, an Internet number resource holder. All records in the file with the same reg-id are registered to the same resource holder.
 
-- 
Oleg Muravskiy
RIPE NCC
--------------010807080008080301050106-- From randy@psg.com Tue Mar 26 04:19:15 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A7F8121F8A68 for ; Tue, 26 Mar 2013 04:19:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.197 X-Spam-Level: X-Spam-Status: No, score=-2.197 tagged_above=-999 required=5 tests=[AWL=0.402, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nRwR9HJ+z0Ph for ; Tue, 26 Mar 2013 04:19:15 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id 3E8E021F8A53 for ; Tue, 26 Mar 2013 04:19:15 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.80.1 (FreeBSD)) (envelope-from ) id 1UKRuL-00008U-Fn; Tue, 26 Mar 2013 11:19:13 +0000 Date: Tue, 26 Mar 2013 20:19:12 +0900 Message-ID: From: Randy Bush To: Oleg Muravskiy In-Reply-To: <51517215.9010602@ripe.net> References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514CFC5F.3090401@ripe.net> <515064E6.7030508@bbn.com> <51517215.9010602@ripe.net> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Cc: sidr wg list Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2013 11:19:15 -0000 > I count the number of distinct reg-ids in the RIR statistics files > (ftp..net/pub/stats//delegated--extended-latest, where > is in {afrinic,apnic,arin,lacnic}). at least for arin, this algorithm produces a result off by a quite large factor. randy From oleg@ripe.net Tue Mar 26 04:55:17 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 27B6321F8A8E for ; Tue, 26 Mar 2013 04:55:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XIWXQ+-XbQpo for ; Tue, 26 Mar 2013 04:55:16 -0700 (PDT) Received: from postgirl.ripe.net (postgirl.ipv6.ripe.net [IPv6:2001:67c:2e8:11::c100:1342]) by ietfa.amsl.com (Postfix) with ESMTP id 7A76821F8A7E for ; Tue, 26 Mar 2013 04:55:14 -0700 (PDT) Received: from dodo.ripe.net ([193.0.23.4]) by postgirl.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1UKST8-000599-Do; Tue, 26 Mar 2013 12:55:11 +0100 Received: from dog.ripe.net ([193.0.1.217] helo=guest137.guestnet.ripe.net) by dodo.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1UKST7-0007Cl-7q; Tue, 26 Mar 2013 12:55:09 +0100 Message-ID: <51518C9C.8040602@ripe.net> Date: Tue, 26 Mar 2013 12:55:08 +0100 From: Oleg Muravskiy Organization: RIPE NCC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:19.0) Gecko/20100101 Firefox/19.0 SeaMonkey/2.16.2 MIME-Version: 1.0 To: Stephen Kent References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514CFC5F.3090401@ripe.net> <515064E6.7030508@bbn.com> <515069D5.5040403@ripe.net> <51509B2E.2070108@bbn.com> In-Reply-To: <51509B2E.2070108@bbn.com> X-Enigmail-Version: 1.5.1 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Anti-Virus: Kaspersky Anti-Virus for Linux Mail Server 5.6.48/RELEASE, bases: 20120425 #7816575, check: 20130326 clean X-RIPE-Spam-Level: ---- X-RIPE-Spam-Report: Spam Total Points: -4.2 points pts rule name description ---- ---------------------- ------------------------------------ -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP -1.3 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] X-RIPE-Signature: c408758d4ce2e8eb06762a65a3365b74f663d2752a1855c332fd9d7b177929dc Cc: sidr@ietf.org Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2013 11:55:17 -0000 Hi Steve, Stephen Kent wrote: > Oleg, >> No. You broke the line in the wrong place. I meant "many (NIRs or LIRs)". > In your text the "many" is distributed over both terms, NIRs and LIRs. You should have just omitted NIRs, > since there are not "many" of them . >> Not necessarily. The LIR could create a ROA for client's assignment, using LIR's allocation certificate. I'm not saying they >> should do it like this, but they could. And I have a feeling that might become a common case. But I think LIRs could say for >> themselves. For example, how many their clients maintain Whois objects themselves, and for how many LIRs doing it? > I agree that an LIR could behave the way you indicated, but in so doing it needs to track which > other LIRs provide service to the customer in question, in order to generate ROAs for each of them. If > it fails to do so, any connections to other LIRs may be ignored, as the NLRI in question will be > represented by a valid ROA pointing to another AS#. That might create a liability for the LIR. That's why > Section 7.3.2 of RFC 6480 cites this as the least desirable option. If I understand correctly, you refer to multi-homed end-users here. In our region such users normally receive a provider-independent (PI) address space from RIPE NCC directly, so they will have their own CA and will have to maintain it. However, there are also many end-users with provider-aggregatable address space that they received from LIRs. And this is where I find it quite difficult to continue with estimations, because - these end-users could still be multi-homed - or they might need to have own CAs for some other reason - their LIRs might prefer to give them responsibility for their CA - or prefer to not give them that responsibility >From my perspective I do not know any source of data to collect/guess the number of end-users who will need their own CA, or the number of LIRs who would prefer to delegate CAs to their clients. I think LIRs / operators might know better. This is what I said in my previous email. -- Oleg Muravskiy RIPE NCC From randy@psg.com Tue Mar 26 05:19:51 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 23E9221F8A99 for ; Tue, 26 Mar 2013 05:19:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.297 X-Spam-Level: X-Spam-Status: No, score=-2.297 tagged_above=-999 required=5 tests=[AWL=0.302, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eP8OPel2Me3m for ; Tue, 26 Mar 2013 05:19:50 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id AE65A21F8A93 for ; Tue, 26 Mar 2013 05:19:50 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.80.1 (FreeBSD)) (envelope-from ) id 1UKSqy-0000L9-3w; Tue, 26 Mar 2013 12:19:48 +0000 Date: Tue, 26 Mar 2013 21:19:46 +0900 Message-ID: From: Randy Bush To: Oleg Muravskiy In-Reply-To: <51518C9C.8040602@ripe.net> References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514CFC5F.3090401@ripe.net> <515064E6.7030508@bbn.com> <515069D5.5040403@ripe.net> <51509B2E.2070108@bbn.com> <51518C9C.8040602@ripe.net> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Cc: sidr wg list Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2013 12:19:51 -0000 > In our region such users normally receive a provider-independent (PI) > address space from RIPE NCC directly, so they will have their own CA > and will have to maintain it. if PI becomes certifyable, while there will be a CA cert for each, and EE/ROA etc, at least in the near term, it is likely most will be in the one repository. similar PA delegated by LIRs. randy From kent@bbn.com Tue Mar 26 07:34:26 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 570F821F8C08 for ; Tue, 26 Mar 2013 07:34:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -105.985 X-Spam-Level: X-Spam-Status: No, score=-105.985 tagged_above=-999 required=5 tests=[AWL=0.613, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aDxaupLQvHRN for ; Tue, 26 Mar 2013 07:34:25 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.1.81]) by ietfa.amsl.com (Postfix) with ESMTP id A786421F8B5E for ; Tue, 26 Mar 2013 07:34:25 -0700 (PDT) Received: from dhcp89-089-218.bbn.com ([128.89.89.218]:49290) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1UKUxE-000418-3o; Tue, 26 Mar 2013 10:34:24 -0400 Message-ID: <5151B1EF.7070009@bbn.com> Date: Tue, 26 Mar 2013 10:34:23 -0400 From: Stephen Kent User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: Oleg Muravskiy References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514CFC5F.3090401@ripe.net> <515064E6.7030508@bbn.com> <51517215.9010602@ripe.net> In-Reply-To: <51517215.9010602@ripe.net> Content-Type: multipart/alternative; boundary="------------010207010702070707020108" Cc: sidr@ietf.org Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2013 14:34:26 -0000 This is a multi-part message in MIME format. --------------010207010702070707020108 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Oleg, Thanks for clarifying the term. I defer to others' understanding of the database in question as to whether this is a good estimator. Steve ------ On 3/26/13 6:01 AM, Oleg Muravskiy wrote: > > Stephen Kent wrote: >> ... >>> Ok, then I'll continue with mine line of thinking. >>> From the RIR stats files that RIRs publish daily we could get the >>> numbers of distinct resource holders. They are: >>> >>> AFRINIC 1310 >>> APNIC 7957 >>> ARIN 35380 >>> LACNIC 4278 >> What is the definition of a "distinct resource holder?" Does this >> correspond to an account with the RIR, or is there some other definition? > > I count the number of distinct reg-ids in the RIR statistics files > (ftp..net/pub/stats//delegated--extended-latest, where > is in {afrinic,apnic,arin,lacnic}). The file format document > defines this field as: > > This is an in-series identifier which uniquely identifies a single > organisation, an Internet number resource holder. All records in > the file with the same reg-id are registered to the same resource > holder. > > > -- > Oleg Muravskiy > RIPE NCC --------------010207010702070707020108 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Oleg,

Thanks for clarifying the term.

I defer to others' understanding of the database in question as to whether this is a good estimator.

Steve
------
On 3/26/13 6:01 AM, Oleg Muravskiy wrote:

Stephen Kent wrote:
...
Ok, then I'll continue with mine line of thinking.
From the RIR stats files that RIRs publish daily we could get the numbers of distinct resource holders. They are:

 AFRINIC  1310
APNIC    7957
ARIN     35380
LACNIC   4278
What is the definition of a "distinct resource holder?" Does this correspond to an account with the RIR, or is there some other definition?

I count the number of distinct reg-ids in the RIR statistics files (ftp.<RIR>.net/pub/stats/<RIR>/delegated-<RIR>-extended-latest, where <RIR> is in {afrinic,apnic,arin,lacnic}). The file format document defines this field as:

This is an in-series identifier which uniquely identifies a single organisation, an Internet number resource holder. All records in the file with the same reg-id are registered to the same resource holder.
 
-- 
Oleg Muravskiy
RIPE NCC

--------------010207010702070707020108-- From kent@bbn.com Tue Mar 26 08:03:43 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A6CB721F8B58 for ; Tue, 26 Mar 2013 08:03:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.108 X-Spam-Level: X-Spam-Status: No, score=-106.108 tagged_above=-999 required=5 tests=[AWL=0.491, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0ot6Pqq0j+D3 for ; Tue, 26 Mar 2013 08:03:43 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) by ietfa.amsl.com (Postfix) with ESMTP id 12E5921F8AC1 for ; Tue, 26 Mar 2013 08:03:43 -0700 (PDT) Received: from dhcp89-089-218.bbn.com ([128.89.89.218]:49299) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1UKVPa-0007Dg-E0; Tue, 26 Mar 2013 11:03:42 -0400 Message-ID: <5151B8CE.3000505@bbn.com> Date: Tue, 26 Mar 2013 11:03:42 -0400 From: Stephen Kent User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: Oleg Muravskiy References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514CFC5F.3090401@ripe.net> <515064E6.7030508@bbn.com> <515069D5.5040403@ripe.net> <51509B2E.2070108@bbn.com> <51518C9C.8040602@ripe.net> In-Reply-To: <51518C9C.8040602@ripe.net> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Cc: sidr@ietf.org Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2013 15:03:43 -0000 Oleg, > ... >> >> I agree that an LIR could behave the way you indicated, but in so doing it needs to track which >> other LIRs provide service to the customer in question, in order to generate ROAs for each of them. If >> it fails to do so, any connections to other LIRs may be ignored, as the NLRI in question will be >> represented by a valid ROA pointing to another AS#. That might create a liability for the LIR. That's why >> Section 7.3.2 of RFC 6480 cites this as the least desirable option. > If I understand correctly, you refer to multi-homed end-users here. yes, but not PI space holders. > In our region such users normally receive a provider-independent (PI) address space from RIPE NCC directly, so they will have their > own CA and will have to maintain it. I don't know if that is the most common practice, vs. a PA-space user moving from being single-homed to multi-homed. This is what the cited text refers to. > However, there are also many end-users with provider-aggregatable address space that they received from LIRs. And this is where I > find it quite difficult to continue with estimations, because > - these end-users could still be multi-homed if they are not multi-homed, they are invisible to BGP and thus do not need RKI credentials. So, let's assume that the entities in question are multi-homed, with a PA space allocation. > - or they might need to have own CAs for some other reason The preferred approach, as noted, is for multi-homed subscribers to be represented by a CA. > - their LIRs might prefer to give them responsibility for their CA agreed. > - or prefer to not give them that responsibility also an option. > >From my perspective I do not know any source of data to collect/guess the number of end-users who will need their own CA, or the > number of LIRs who would prefer to delegate CAs to their clients. I think LIRs / operators might know better. This is what I said in > my previous email. As best I know, so far we have no LIRs who have gotten this far in the RPKI space, so I too look forward to hearing from those who are considering this next step. But, irrespective of this detail, isn't it reasonable to use the number of (live) ASes as the basis for the number of pub points (CAs)? To first order, any entity that needs to be explicitly represented in the RPKI is associated with an AS#, whether they are an LIR, a PI space holder, or a multi-homed holder of PA space (from an LIR). Steve From oleg@ripe.net Tue Mar 26 09:06:04 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 10F471F0C74 for ; Tue, 26 Mar 2013 09:06:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B-jMrA3cuATi for ; Tue, 26 Mar 2013 09:06:03 -0700 (PDT) Received: from postgirl.ripe.net (postgirl.ipv6.ripe.net [IPv6:2001:67c:2e8:11::c100:1342]) by ietfa.amsl.com (Postfix) with ESMTP id 5FAB521F8AF0 for ; Tue, 26 Mar 2013 09:06:02 -0700 (PDT) Received: from dodo.ripe.net ([193.0.23.4]) by postgirl.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1UKWNo-0005yW-Fj; Tue, 26 Mar 2013 17:05:59 +0100 Received: from dog.ripe.net ([193.0.1.217] helo=guest137.guestnet.ripe.net) by dodo.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1UKWNn-0004SC-Al; Tue, 26 Mar 2013 17:05:55 +0100 Message-ID: <5151C763.5060403@ripe.net> Date: Tue, 26 Mar 2013 17:05:55 +0100 From: Oleg Muravskiy Organization: RIPE NCC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:19.0) Gecko/20100101 Firefox/19.0 SeaMonkey/2.16.2 MIME-Version: 1.0 To: Stephen Kent References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514CFC5F.3090401@ripe.net> <515064E6.7030508@bbn.com> <515069D5.5040403@ripe.net> <51509B2E.2070108@bbn.com> <51518C9C.8040602@ripe.net> <5151B8CE.3000505@bbn.com> In-Reply-To: <5151B8CE.3000505@bbn.com> X-Enigmail-Version: 1.5.1 Content-Type: multipart/alternative; boundary="------------000809080704080100040003" X-Anti-Virus: Kaspersky Anti-Virus for Linux Mail Server 5.6.48/RELEASE, bases: 20120425 #7816575, check: 20130326 clean X-RIPE-Spam-Level: ---- X-RIPE-Spam-Report: Spam Total Points: -4.2 points pts rule name description ---- ---------------------- ------------------------------------ -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP -1.3 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] 0.0 HTML_MESSAGE BODY: HTML included in message X-RIPE-Signature: c408758d4ce2e8eb06762a65a3365b7470459d3c68234bcf7447277e34fa736a Cc: sidr@ietf.org Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2013 16:06:04 -0000 This is a multi-part message in MIME format. --------------000809080704080100040003 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Stephen Kent wrote: > Oleg, > >> ... >>> I agree that an LIR could behave the way you indicated, but in so doing it needs to track which >>> other LIRs provide service to the customer in question, in order to generate ROAs for each of them. If >>> it fails to do so, any connections to other LIRs may be ignored, as the NLRI in question will be >>> represented by a valid ROA pointing to another AS#. That might create a liability for the LIR. That's why >>> Section 7.3.2 of RFC 6480 cites this as the least desirable option. >> If I understand correctly, you refer to multi-homed end-users here. > yes, but not PI space holders. >> In our region such users normally receive a provider-independent (PI) address space from RIPE NCC directly, so they will have their >> own CA and will have to maintain it. > I don't know if that is the most common practice, vs. a PA-space user moving from being single-homed to > multi-homed. This is what the cited text refers to. >> However, there are also many end-users with provider-aggregatable address space that they received from LIRs. And this is where I >> find it quite difficult to continue with estimations, because >> - these end-users could still be multi-homed > if they are not multi-homed, they are invisible to BGP and thus do not need RKI credentials. So, let's > assume that the entities in question are multi-homed, with a PA space allocation. >> - or they might need to have own CAs for some other reason > The preferred approach, as noted, is for multi-homed subscribers to be represented by a CA. >> - their LIRs might prefer to give them responsibility for their CA > agreed. >> - or prefer to not give them that responsibility > also an option. >> >From my perspective I do not know any source of data to collect/guess the number of end-users who will need their own CA, or the >> number of LIRs who would prefer to delegate CAs to their clients. I think LIRs / operators might know better. This is what I said in >> my previous email. > As best I know, so far we have no LIRs who have gotten this far in the RPKI space, so I too look forward > to hearing from those who are considering this next step. > > But, irrespective of this detail, isn't it reasonable to use the number of (live) ASes as the basis for > the number of pub points (CAs)? To first order, any entity that needs to be explicitly represented in the > RPKI is associated with an AS#, whether they are an LIR, a PI space holder, or a multi-homed holder > of PA space (from an LIR). I don't know. I see that the 1 AS = 1 CA is often referred as reasonable. But I do not see why an AS operator, using single AS#, cannot serve multiple organisations that got their address space from somewhere else. So all these organisations will have CAs, will create ROAs, but would not operate own ASes. -- Oleg Muravskiy RIPE NCC --------------000809080704080100040003 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit
Stephen Kent wrote:
Oleg,

...
  I agree that an LIR could behave the way you indicated, but in so doing it needs to track which
other LIRs provide service to the customer in question, in order to generate ROAs for each of them. If
it fails to do so, any connections to other LIRs may be ignored, as the NLRI in question will be
represented by a valid ROA pointing to another AS#. That might create a liability for the LIR. That's why
Section 7.3.2 of RFC 6480 cites this as the least desirable option.
If I understand correctly, you refer to multi-homed end-users here.
yes, but not PI space holders.
In our region such users normally receive a provider-independent (PI) address space from RIPE NCC directly, so they will have their
own CA and will have to maintain it.
I don't know if that is the most common practice, vs. a PA-space user moving from being single-homed to
multi-homed. This is what the cited text refers to.
However, there are also many end-users with provider-aggregatable address space that they received from LIRs. And this is where I
find it quite difficult to continue with estimations, because
- these end-users could still be multi-homed
if they are not multi-homed, they are invisible to BGP and thus do not need RKI credentials. So, let's
assume that the entities in question are multi-homed, with a PA space allocation.
- or they might need to have own CAs for some other reason
The preferred approach, as noted, is for multi-homed subscribers to be represented by a CA.
- their LIRs might prefer to give them responsibility for their CA
agreed.
- or prefer to not give them that responsibility
also an option.
>From my perspective I do not know any source of data to collect/guess the number of end-users who will need their own CA, or the
number of LIRs who would prefer to delegate CAs to their clients. I think LIRs / operators might know better. This is what I said in
my previous email.
As best I know, so far we have no LIRs who have gotten this far in the RPKI space, so I too look forward
to hearing from those who are considering this next step.

But, irrespective of this detail, isn't it reasonable to use the number of (live) ASes as the basis for
the number of pub points (CAs)? To first order, any entity that needs to be explicitly represented in the
RPKI is associated with an AS#, whether they are an LIR, a PI space holder, or a multi-homed holder
of PA space (from  an LIR).

I don't know. I see that the 1 AS = 1 CA is often referred as reasonable.
But I do not see why an AS operator, using single AS#, cannot serve multiple organisations that got their address space from somewhere else.
So all these organisations will have CAs, will create ROAs, but would not operate own ASes.

-- 
Oleg Muravskiy
RIPE NCC
--------------000809080704080100040003-- From oleg@ripe.net Tue Mar 26 09:09:44 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A29C421F8BBB for ; Tue, 26 Mar 2013 09:09:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4yehBfSLC42p for ; Tue, 26 Mar 2013 09:09:43 -0700 (PDT) Received: from postgirl.ripe.net (postgirl.ipv6.ripe.net [IPv6:2001:67c:2e8:11::c100:1342]) by ietfa.amsl.com (Postfix) with ESMTP id 7FE3421F8BB6 for ; Tue, 26 Mar 2013 09:09:43 -0700 (PDT) Received: from dodo.ripe.net ([193.0.23.4]) by postgirl.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1UKWRR-0006CP-1N; Tue, 26 Mar 2013 17:09:42 +0100 Received: from dog.ripe.net ([193.0.1.217] helo=guest137.guestnet.ripe.net) by dodo.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1UKWRP-0004xG-SJ; Tue, 26 Mar 2013 17:09:39 +0100 Message-ID: <5151C843.2040803@ripe.net> Date: Tue, 26 Mar 2013 17:09:39 +0100 From: Oleg Muravskiy Organization: RIPE NCC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:19.0) Gecko/20100101 Firefox/19.0 SeaMonkey/2.16.2 MIME-Version: 1.0 To: Randy Bush References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514CFC5F.3090401@ripe.net> <515064E6.7030508@bbn.com> <51517215.9010602@ripe.net> In-Reply-To: X-Enigmail-Version: 1.5.1 Content-Type: multipart/alternative; boundary="------------090902020102060505070505" X-Anti-Virus: Kaspersky Anti-Virus for Linux Mail Server 5.6.48/RELEASE, bases: 20120425 #7816575, check: 20130326 clean X-RIPE-Spam-Level: ---- X-RIPE-Spam-Report: Spam Total Points: -4.2 points pts rule name description ---- ---------------------- ------------------------------------ -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP -1.3 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] 0.0 HTML_MESSAGE BODY: HTML included in message X-RIPE-Signature: c408758d4ce2e8eb06762a65a3365b7442cdd036628cf50ea6106e94c59030ea Cc: sidr wg list Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2013 16:09:45 -0000 This is a multi-part message in MIME format. --------------090902020102060505070505 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Hi Randy, Randy Bush wrote: >> I count the number of distinct reg-ids in the RIR statistics files >> (ftp..net/pub/stats//delegated--extended-latest, where >> is in {afrinic,apnic,arin,lacnic}). > at least for arin, this algorithm produces a result off by a quite large > factor. > > randy I do $ cut -f8 -d'|' delegated-arin-extended-latest |sort -u|wc -l 35394 -- Oleg Muravskiy RIPE NCC --------------090902020102060505070505 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit Hi Randy,

Randy Bush wrote:
I count the number of distinct reg-ids in the RIR statistics files
(ftp.<RIR>.net/pub/stats/<RIR>/delegated-<RIR>-extended-latest, where
<RIR> is in {afrinic,apnic,arin,lacnic}). 

at least for arin, this algorithm produces a result off by a quite large
factor.

randy

I do

$ cut -f8 -d'|' delegated-arin-extended-latest |sort -u|wc -l
35394


-- 
Oleg Muravskiy
RIPE NCC
--------------090902020102060505070505-- From kent@bbn.com Tue Mar 26 09:25:43 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E0E8B21F88A2 for ; Tue, 26 Mar 2013 09:25:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.19 X-Spam-Level: X-Spam-Status: No, score=-106.19 tagged_above=-999 required=5 tests=[AWL=0.409, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BhAviedatpJu for ; Tue, 26 Mar 2013 09:25:43 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.1.81]) by ietfa.amsl.com (Postfix) with ESMTP id 10D1E21F8550 for ; Tue, 26 Mar 2013 09:25:39 -0700 (PDT) Received: from dhcp89-089-218.bbn.com ([128.89.89.218]:49867) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1UKWgt-00077n-3Y; Tue, 26 Mar 2013 12:25:39 -0400 Message-ID: <5151CC02.20200@bbn.com> Date: Tue, 26 Mar 2013 12:25:38 -0400 From: Stephen Kent User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: Oleg Muravskiy References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514CFC5F.3090401@ripe.net> <515064E6.7030508@bbn.com> <515069D5.5040403@ripe.net> <51509B2E.2070108@bbn.com> <51518C9C.8040602@ripe.net> <5151B8CE.3000505@bbn.com> <5151C763.5060403@ripe.net> In-Reply-To: <5151C763.5060403@ripe.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: sidr@ietf.org Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2013 16:25:44 -0000 Oleg, Glad to see we are converging, a bit. >> ... >> But, irrespective of this detail, isn't it reasonable to use the >> number of (live) ASes as the basis for >> the number of pub points (CAs)? To first order, any entity that needs >> to be explicitly represented in the >> RPKI is associated with an AS#, whether they are an LIR, a PI space >> holder, or a multi-homed holder >> of PA space (from an LIR). > > I don't know. I see that the 1 AS = 1 CA is often referred as reasonable. > But I do not see why an AS operator, using single AS#, cannot serve > multiple organisations that got their address space from somewhere else. > So all these organisations will have CAs, will create ROAs, but would > not operate own ASes. In what sense do you mean "serve" here? Do you mean that the organizations in question have, for example, PI space but no AS#'s, and thus their ROAs all point to the AS# of the AS operator? Is that common? Also, I should amend my comment above, slightly. When we model the number of pub points (CAs) we do add in a factor to account for orgs that have allocations from multiple sources, but may be represented by a single AS#. Steve From oleg@ripe.net Tue Mar 26 09:51:06 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4A77521F8AA6 for ; Tue, 26 Mar 2013 09:51:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S6zTVfbS4CvP for ; Tue, 26 Mar 2013 09:51:05 -0700 (PDT) Received: from postgirl.ripe.net (postgirl.ipv6.ripe.net [IPv6:2001:67c:2e8:11::c100:1342]) by ietfa.amsl.com (Postfix) with ESMTP id 9089E21F8B90 for ; Tue, 26 Mar 2013 09:51:04 -0700 (PDT) Received: from dodo.ripe.net ([193.0.23.4]) by postgirl.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1UKX5R-0000NC-OS for sidr@ietf.org; Tue, 26 Mar 2013 17:51:03 +0100 Received: from dog.ripe.net ([193.0.1.217] helo=guest137.guestnet.ripe.net) by dodo.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1UKX5Q-0001BQ-IA; Tue, 26 Mar 2013 17:51:00 +0100 Message-ID: <5151D1F4.30307@ripe.net> Date: Tue, 26 Mar 2013 17:51:00 +0100 From: Oleg Muravskiy Organization: RIPE NCC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:19.0) Gecko/20100101 Firefox/19.0 SeaMonkey/2.16.2 MIME-Version: 1.0 To: sidr References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514CFC5F.3090401@ripe.net> <515064E6.7030508@bbn.com> <515069D5.5040403@ripe.net> <51509B2E.2070108@bbn.com> <51518C9C.8040602@ripe.net> <5151B8CE.3000505@bbn.com> <5151C763.5060403@ripe.net> <5151CC02.20200@bbn.com> In-Reply-To: <5151CC02.20200@bbn.com> X-Enigmail-Version: 1.5.1 Content-Type: multipart/alternative; boundary="------------020302070104050306050005" X-Anti-Virus: Kaspersky Anti-Virus for Linux Mail Server 5.6.48/RELEASE, bases: 20120425 #7816575, check: 20130326 clean X-RIPE-Spam-Level: ---- X-RIPE-Spam-Report: Spam Total Points: -4.2 points pts rule name description ---- ---------------------- ------------------------------------ -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP -1.3 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] 0.0 HTML_MESSAGE BODY: HTML included in message X-RIPE-Signature: c408758d4ce2e8eb06762a65a3365b74237b4b966b42e8142449a6e6f09e16dd Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2013 16:51:06 -0000 This is a multi-part message in MIME format. --------------020302070104050306050005 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Stephen Kent wrote: > Oleg, > > Glad to see we are converging, a bit. >>> ... >>> But, irrespective of this detail, isn't it reasonable to use the number of (live) ASes as the basis for >>> the number of pub points (CAs)? To first order, any entity that needs to be explicitly represented in the >>> RPKI is associated with an AS#, whether they are an LIR, a PI space holder, or a multi-homed holder >>> of PA space (from an LIR). >> >> I don't know. I see that the 1 AS = 1 CA is often referred as reasonable. >> But I do not see why an AS operator, using single AS#, cannot serve multiple organisations that got their address space from >> somewhere else. >> So all these organisations will have CAs, will create ROAs, but would not operate own ASes. > In what sense do you mean "serve" here? Do you mean that the organizations in question have, for example, > PI space but no AS#'s, and thus their ROAs all point to the AS# of the AS operator? Yes > Is that common? This is what I don't know. I think we need operators to tell. I'm not opposed to the 1AS = 1CA idea. It's just that in my mind RPKI associates with IP space holders, not AS operators, because this is how we do RPKI on RIR level. And on this level we already have more distinct IP space holders than the number of active AS. I don't know much about LIR to end user level, maybe the number of CAs there will be insignificant. > > Also, I should amend my comment above, slightly. When we model the number of pub points (CAs) we do > add in a factor to account for orgs that have allocations from multiple sources, but may be represented > by a single AS#. > > Steve > -- Oleg Muravskiy RIPE NCC --------------020302070104050306050005 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit
Stephen Kent wrote:
Oleg,

Glad to see we are converging, a bit.
...
But, irrespective of this detail, isn't it reasonable to use the number of (live) ASes as the basis for
the number of pub points (CAs)? To first order, any entity that needs to be explicitly represented in the
RPKI is associated with an AS#, whether they are an LIR, a PI space holder, or a multi-homed holder
of PA space (from  an LIR).

I don't know. I see that the 1 AS = 1 CA is often referred as reasonable.
But I do not see why an AS operator, using single AS#, cannot serve multiple organisations that got their address space from somewhere else.
So all these organisations will have CAs, will create ROAs, but would not operate own ASes.
In what sense do you mean "serve" here? Do you mean that the organizations in question have, for example,
PI space but no AS#'s, and thus their ROAs all point to the AS# of the AS operator?
Yes
Is that common?
This is what I don't know. I think we need operators to tell.

I'm not opposed to the 1AS = 1CA idea. It's just that in my mind RPKI associates with IP space holders,  not AS operators, because this is how we do RPKI on RIR level. And on this level we already have more distinct IP space holders than the number of active AS. I don't know much about LIR to end user level, maybe the number of CAs there will be insignificant.

Also, I should amend my comment above, slightly. When we model the number of pub points (CAs) we do
add in a factor to account for orgs that have allocations from multiple sources, but may be represented
by a single AS#.

Steve 


-- 
Oleg Muravskiy
RIPE NCC
--------------020302070104050306050005-- From carlosm3011@gmail.com Tue Mar 26 10:50:34 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 89FAC21F85A4 for ; Tue, 26 Mar 2013 10:50:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XZUzwfBAES21 for ; Tue, 26 Mar 2013 10:50:32 -0700 (PDT) Received: from mail-oa0-f45.google.com (mail-oa0-f45.google.com [209.85.219.45]) by ietfa.amsl.com (Postfix) with ESMTP id 69DF321F85A1 for ; Tue, 26 Mar 2013 10:50:26 -0700 (PDT) Received: by mail-oa0-f45.google.com with SMTP id o6so7993890oag.18 for ; Tue, 26 Mar 2013 10:50:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=x-received:message-id:date:from:reply-to:user-agent:mime-version:to :cc:subject:references:in-reply-to:content-type :content-transfer-encoding; bh=ApcB5PBL9fOQFxjtZfcAzxX5uFBochBj9NcEBbUbM6I=; b=Q6BPo3LURNnRdysDSUDUkximNBWU5AmkIVfkHT7pMhQC+DEJrb+gdbqdkJhS+OiyC6 uD6HK8cSe4CFsngHFCov6jLvxvRUKZvf85h0x6/b4xlIpEoshs9phi2geOgvUQAziCQq 2Flt/48lo4H7rRhkTrB8NXrQBZyWpDwyuQoY3rWaXwT69XSD0tWR9lnqsSaxMmpJkUr0 xLCD6vKsAFqNRbm46Wd+frG0bZD2SslcR4p90G1VdISWasmsjkSASA1kpJ2VZuyCvbG2 zp26iNfSoDnZhzuBoe3eKbqu8hwOukSK+XhgPtpyJlQtMjtzjHsuHmc5+K9tLFpBCIOW LYvQ== X-Received: by 10.182.127.115 with SMTP id nf19mr2545181obb.49.1364320225885; Tue, 26 Mar 2013 10:50:25 -0700 (PDT) Received: from europa.local ([2001:13c7:7001:5128:852:f72:1f93:f7d3]) by mx.google.com with ESMTPS id ri1sm17774038obc.12.2013.03.26.10.50.22 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 26 Mar 2013 10:50:24 -0700 (PDT) Message-ID: <5151DFDB.6000504@gmail.com> Date: Tue, 26 Mar 2013 14:50:19 -0300 From: "Carlos M. Martinez" User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130216 Thunderbird/17.0.3 MIME-Version: 1.0 To: Oleg Muravskiy References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514CFC5F.3090401@ripe.net> <515064E6.7030508@bbn.com> <515069D5.5040403@ripe.net> <51509B2E.2070108@bbn.com> <51518C9C.8040602@ripe.net> <5151B8CE.3000505@bbn.com> <5151C763.5060403@ripe.net> <5151CC02.20200@bbn.com> <5151D1F4.30307@ripe.net> In-Reply-To: <5151D1F4.30307@ripe.net> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: sidr Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: carlos@lacnic.net List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2013 17:50:34 -0000 Adding to what Oleg mentions in LACNIC we also equal a user of the RPKI system with a legitimate resource holder. It doesn't matter for us whether the user (resource holder) has an AS or not. In practice, we have quite a few resource holders with no AS, although no one of them has yet created ROAs. regards, ~Carlos On 3/26/13 1:51 PM, Oleg Muravskiy wrote: > > Stephen Kent wrote: >> Oleg, >> >> Glad to see we are converging, a bit. >>>> ... >>>> But, irrespective of this detail, isn't it reasonable to use the >>>> number of (live) ASes as the basis for >>>> the number of pub points (CAs)? To first order, any entity that >>>> needs to be explicitly represented in the >>>> RPKI is associated with an AS#, whether they are an LIR, a PI space >>>> holder, or a multi-homed holder >>>> of PA space (from an LIR). >>> >>> I don't know. I see that the 1 AS = 1 CA is often referred as >>> reasonable. >>> But I do not see why an AS operator, using single AS#, cannot serve >>> multiple organisations that got their address space from somewhere else. >>> So all these organisations will have CAs, will create ROAs, but would >>> not operate own ASes. >> In what sense do you mean "serve" here? Do you mean that the >> organizations in question have, for example, >> PI space but no AS#'s, and thus their ROAs all point to the AS# of the >> AS operator? > Yes >> Is that common? > This is what I don't know. I think we need operators to tell. > > I'm not opposed to the 1AS = 1CA idea. It's just that in my mind RPKI > associates with IP space holders, not AS operators, because this is how > we do RPKI on RIR level. And on this level we already have more distinct > IP space holders than the number of active AS. I don't know much about > LIR to end user level, maybe the number of CAs there will be insignificant. >> >> Also, I should amend my comment above, slightly. When we model the >> number of pub points (CAs) we do >> add in a factor to account for orgs that have allocations from >> multiple sources, but may be represented >> by a single AS#. >> >> Steve >> > > -- > Oleg Muravskiy > RIPE NCC > > > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From kent@bbn.com Tue Mar 26 11:10:12 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2EC4521F889B for ; Tue, 26 Mar 2013 11:10:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -105.948 X-Spam-Level: X-Spam-Status: No, score=-105.948 tagged_above=-999 required=5 tests=[AWL=0.051, BAYES_00=-2.599, J_CHICKENPOX_21=0.6, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KzInODmyXfNy for ; Tue, 26 Mar 2013 11:10:11 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) by ietfa.amsl.com (Postfix) with ESMTP id 4357F21F877B for ; Tue, 26 Mar 2013 11:10:10 -0700 (PDT) Received: from dhcp89-089-218.bbn.com ([128.89.89.218]:50065) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1UKYK2-000FfU-0Y; Tue, 26 Mar 2013 14:10:10 -0400 Message-ID: <5151E481.8070409@bbn.com> Date: Tue, 26 Mar 2013 14:10:09 -0400 From: Stephen Kent User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: Oleg Muravskiy , sidr References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514CFC5F.3090401@ripe.net> <515064E6.7030508@bbn.com> <515069D5.5040403@ripe.net> <51509B2E.2070108@bbn.com> <51518C9C.8040602@ripe.net> <5151B8CE.3000505@bbn.com> <5151C763.5060403@ripe.net> <5151CC02.20200@bbn.com> <5151D1F4.30307@ripe.net> In-Reply-To: <5151D1F4.30307@ripe.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2013 18:10:12 -0000 Oleg, > ... > > I'm not opposed to the 1AS = 1CA idea. It's just that in my mind RPKI > associates with IP space holders, not AS operators, because this is > how we do RPKI on RIR level. And on this level we already have more > distinct IP space holders than the number of active AS. I don't know > much about LIR to end user level, maybe the number of CAs there will > be insignificant. The RPKI is about who holds both sets of resources: addresses and AS#s. So, yes, as an RIR issuing certs for address space, the focus is on address space holders. When we discuss using AS#'s to estimate the number of CAs it is just because that seems like a reasonable estimator, not because it is the basis for the management of address space. I am curious, though. When RIPE acts as a CA on behalf of 1300+ entities with address space, have you included the AS#s in the CA certs you issued, when the address space holders have AS#'s from RIPE? Steve From kent@bbn.com Tue Mar 26 11:12:58 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7263C21F86C1 for ; Tue, 26 Mar 2013 11:12:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.255 X-Spam-Level: X-Spam-Status: No, score=-106.255 tagged_above=-999 required=5 tests=[AWL=0.344, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lmSdQSOpYQVc for ; Tue, 26 Mar 2013 11:12:57 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) by ietfa.amsl.com (Postfix) with ESMTP id B0FB521F8558 for ; Tue, 26 Mar 2013 11:12:57 -0700 (PDT) Received: from dhcp89-089-218.bbn.com ([128.89.89.218]:50069) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1UKYMi-000FjM-OJ; Tue, 26 Mar 2013 14:12:56 -0400 Message-ID: <5151E528.4090102@bbn.com> Date: Tue, 26 Mar 2013 14:12:56 -0400 From: Stephen Kent User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: sidr@ietf.org, "Carlos M. Martinez" References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514CFC5F.3090401@ripe.net> <515064E6.7030508@bbn.com> <515069D5.5040403@ripe.net> <51509B2E.2070108@bbn.com> <51518C9C.8040602@ripe.net> <5151B8CE.3000505@bbn.com> <5151C763.5060403@ripe.net> <5151CC02.20200@bbn.com> <5151D1F4.30307@ripe.net> <5151DFDB.6000504@gmail.com> In-Reply-To: <5151DFDB.6000504@gmail.com> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2013 18:12:58 -0000 Carlos, > Adding to what Oleg mentions in LACNIC we also equal a user of the RPKI > system with a legitimate resource holder. It doesn't matter for us > whether the user (resource holder) has an AS or not. If the address space holder has an AS# allocated by LACNIC, then that AS# belongs in the cert you issue to that entity. > In practice, we have quite a few resource holders with no AS, although > no one of them has yet created ROAs. Do you mean to say that these address space holders do not have ASes, or that they do not have ASes allocated through LACNIC? Steve From carlosm3011@gmail.com Tue Mar 26 11:22:49 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DC77021F8C48 for ; Tue, 26 Mar 2013 11:22:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Cd8U8BhjTgRd for ; Tue, 26 Mar 2013 11:22:49 -0700 (PDT) Received: from mail-oa0-f49.google.com (mail-oa0-f49.google.com [209.85.219.49]) by ietfa.amsl.com (Postfix) with ESMTP id 2F85F21F8BDE for ; Tue, 26 Mar 2013 11:22:49 -0700 (PDT) Received: by mail-oa0-f49.google.com with SMTP id j6so7793537oag.22 for ; Tue, 26 Mar 2013 11:22:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=x-received:message-id:date:from:reply-to:user-agent:mime-version:to :cc:subject:references:in-reply-to:content-type :content-transfer-encoding; bh=RtF6xuCoHGWp4wpbi7wzBNjwXZKzAXBNPEWGXYRmOvQ=; b=u8O7ZjX1frn0gEjFDP90m/2iUQ54Tf1CYbA9xFEjFDzU5wgYTwnS54V98RnQVVF04d vmh2AXKGkbGBA+zgtrIva9DVV+drvGf+Mi+qrisXitUheU6ab2bJ+TWKNnlSIMHp9FTx 8pzyGvUKJnzsADXKgehG3tGF4alNfZb+9Um3ADVRmz37e0d+8S/OtXbgx70YoDNOR15k wyl74uAUHHciemY5aqQDCBcaEfi7rojfVYR2OzexuslPns5UkCWHBUM9DH4YFI8r86/U a1RUkaX8ypPgxOcd1FcRXLQuMrHH2M8s5nkTY4CgqP5QJ5cWe8RylhzjuH3XRF0Fhdp6 45kA== X-Received: by 10.60.37.229 with SMTP id b5mr14538837oek.21.1364322168746; Tue, 26 Mar 2013 11:22:48 -0700 (PDT) Received: from europa.local ([2001:13c7:7001:5128:852:f72:1f93:f7d3]) by mx.google.com with ESMTPS id w10sm18586391oed.2.2013.03.26.11.22.45 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 26 Mar 2013 11:22:47 -0700 (PDT) Message-ID: <5151E771.9060805@gmail.com> Date: Tue, 26 Mar 2013 15:22:41 -0300 From: "Carlos M. Martinez" User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130216 Thunderbird/17.0.3 MIME-Version: 1.0 To: Stephen Kent References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514CFC5F.3090401@ripe.net> <515064E6.7030508@bbn.com> <515069D5.5040403@ripe.net> <51509B2E.2070108@bbn.com> <51518C9C.8040602@ripe.net> <5151B8CE.3000505@bbn.com> <5151C763.5060403@ripe.net> <5151CC02.20200@bbn.com> <5151D1F4.30307@ripe.net> <5151DFDB.6000504@gmail.com> <5151E528.4090102@bbn.com> In-Reply-To: <5151E528.4090102@bbn.com> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: "Carlos M. Martinez" , sidr@ietf.org Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: carlos@lacnic.net List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2013 18:22:50 -0000 Hi Steve, On 3/26/13 3:12 PM, Stephen Kent wrote: > Carlos, >> Adding to what Oleg mentions in LACNIC we also equal a user of the RPKI >> system with a legitimate resource holder. It doesn't matter for us >> whether the user (resource holder) has an AS or not. > If the address space holder has an AS# allocated by LACNIC, then that > AS# belongs in the > cert you issue to that entity. Yessir. AS numbers are listed in their resource cert(s). >> In practice, we have quite a few resource holders with no AS, although >> no one of them has yet created ROAs. > Do you mean to say that these address space holders do not have ASes, or > that > they do not have ASes allocated through LACNIC? Good question. What I can affirm is that they don't have ASes allocated by LACNIC. However, from my personal 'feeling' of the region I'm willing to bet that most if not all of them have no ASes at all, although there could be some 'outliers' that have ASes allocated by other RIRs. We also have a third situation: Members with only AS numbers and no LACNIC-allocated addressing resources. We also issue resource certs for them listing only the AS numbers, even though as of today they are a bit useless. ~Carlos Every now and then I get email with questions about how to multihome with no AS > > Steve > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr From kent@bbn.com Tue Mar 26 12:01:24 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 53B3921F8D11 for ; Tue, 26 Mar 2013 12:01:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -105.993 X-Spam-Level: X-Spam-Status: No, score=-105.993 tagged_above=-999 required=5 tests=[AWL=0.006, BAYES_00=-2.599, J_CHICKENPOX_21=0.6, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nNo9Wr+wnepR for ; Tue, 26 Mar 2013 12:01:24 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) by ietfa.amsl.com (Postfix) with ESMTP id BC01921F8CC2 for ; Tue, 26 Mar 2013 12:01:20 -0700 (PDT) Received: from dhcp89-089-218.bbn.com ([128.89.89.218]:50114) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1UKZ7X-000HW0-18; Tue, 26 Mar 2013 15:01:19 -0400 Message-ID: <5151F07E.8010105@bbn.com> Date: Tue, 26 Mar 2013 15:01:18 -0400 From: Stephen Kent User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: carlos@lacnic.net References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514CFC5F.3090401@ripe.net> <515064E6.7030508@bbn.com> <515069D5.5040403@ripe.net> <51509B2E.2070108@bbn.com> <51518C9C.8040602@ripe.net> <5151B8CE.3000505@bbn.com> <5151C763.5060403@ripe.net> <5151CC02.20200@bbn.com> <5151D1F4.30307@ripe.net> <5151DFDB.6000504@gmail.com> <5151E528.4090102@bbn.com> <5151E771.9060805@gmail.com> In-Reply-To: <5151E771.9060805@gmail.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: sidr@ietf.org Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2013 19:01:24 -0000 Carols, I am very happy to hear that LACNIC has been putting AS#s (allocated by LACNIC) in the certs you are issuing! If you compare the cert you have issued (w/o AS#'s) against RV or RIS data, what do you see: - are these prefixed advertised? - do they have one ASN associated with the advertisement, or more than one? Steve From carlos@lacnic.net Tue Mar 26 12:13:33 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 57E8621F8D01 for ; Tue, 26 Mar 2013 12:13:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, J_CHICKENPOX_21=0.6, NO_RELAYS=-0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JQwor-S7+KWY for ; Tue, 26 Mar 2013 12:13:33 -0700 (PDT) Received: from mail.lacnic.net.uy (mail.lacnic.net.uy [IPv6:2001:13c7:7001:4000::3]) by ietfa.amsl.com (Postfix) with ESMTP id C41C721F8CF9 for ; Tue, 26 Mar 2013 12:13:32 -0700 (PDT) Received: from europa.local (unknown [IPv6:2001:13c7:7001:5128:852:f72:1f93:f7d3]) by mail.lacnic.net.uy (Postfix) with ESMTP id 54FEB30841C; Tue, 26 Mar 2013 16:13:09 -0300 (UYT) Message-ID: <5151F34D.9010607@lacnic.net> Date: Tue, 26 Mar 2013 16:13:17 -0300 From: "Carlos M. Martinez" User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130216 Thunderbird/17.0.3 MIME-Version: 1.0 To: Stephen Kent References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514CFC5F.3090401@ripe.net> <515064E6.7030508@bbn.com> <515069D5.5040403@ripe.net> <51509B2E.2070108@bbn.com> <51518C9C.8040602@ripe.net> <5151B8CE.3000505@bbn.com> <5151C763.5060403@ripe.net> <5151CC02.20200@bbn.com> <5151D1F4.30307@ripe.net> <5151DFDB.6000504@gmail.com> <5151E528.4090102@bbn.com> <5151E771.9060805@gmail.com> <5151F07E.8010105@bbn.com> In-Reply-To: <5151F07E.8010105@bbn.com> X-Enigmail-Version: 1.5.1 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-LACNIC.uy-MailScanner-Information: Please contact the ISP for more information X-LACNIC.uy-MailScanner: Found to be clean X-LACNIC.uy-MailScanner-SpamCheck: X-LACNIC.uy-MailScanner-From: carlos@lacnic.net Cc: sidr@ietf.org Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2013 19:13:34 -0000 I haven't performed that analysis (how many source ASes per ORG-ID), it could be an interesting one.... I'll try to find the time to do that before Berlin. Glad you like our resource certs :D Warm regards, ~Carlos On 3/26/13 4:01 PM, Stephen Kent wrote: > Carols, > > I am very happy to hear that LACNIC has been putting AS#s (allocated > by LACNIC) in the > certs you are issuing! > > If you compare the cert you have issued (w/o AS#'s) against RV or RIS > data, what do you > see: > - are these prefixed advertised? > - do they have one ASN associated with the advertisement, or more > than one? > > Steve From internet-drafts@ietf.org Tue Mar 26 13:47:31 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AA9E521F8E03; Tue, 26 Mar 2013 13:47:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.52 X-Spam-Level: X-Spam-Status: No, score=-102.52 tagged_above=-999 required=5 tests=[AWL=0.080, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0TCgLoUuMuvi; Tue, 26 Mar 2013 13:47:21 -0700 (PDT) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id D7EBB21F8DFD; Tue, 26 Mar 2013 13:47:20 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: internet-drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 4.43 Message-ID: <20130326204720.10356.96489.idtracker@ietfa.amsl.com> Date: Tue, 26 Mar 2013 13:47:20 -0700 Cc: sidr@ietf.org Subject: [sidr] I-D Action: draft-ietf-sidr-bgpsec-algs-04.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2013 20:47:32 -0000 A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the Secure Inter-Domain Routing Working Group= of the IETF. Title : BGP Algorithms, Key Formats, & Signature Formats Author(s) : Sean Turner Filename : draft-ietf-sidr-bgpsec-algs-04.txt Pages : 7 Date : 2013-03-26 Abstract: This document specifies the algorithms, algorithms' parameters, asymmetric key formats, asymmetric key size and signature format used in BGPSEC (Border Gateway Protocol Security). This document updates the Profile for Algorithms and Key Sizes for use in the Resource Public Key Infrastructure (RFC 6485). The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-sidr-bgpsec-algs There's also a htmlized version available at: http://tools.ietf.org/html/draft-ietf-sidr-bgpsec-algs-04 A diff from the previous version is available at: http://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-sidr-bgpsec-algs-04 Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From aservin@lacnic.net Tue Mar 26 14:35:22 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 96C1221F85CE for ; Tue, 26 Mar 2013 14:35:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, J_CHICKENPOX_21=0.6, NO_RELAYS=-0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mn38O9sUk8Zp for ; Tue, 26 Mar 2013 14:35:22 -0700 (PDT) Received: from mail.lacnic.net.uy (mail.lacnic.net.uy [IPv6:2001:13c7:7001:4000::3]) by ietfa.amsl.com (Postfix) with ESMTP id 1AE2C21F85A2 for ; Tue, 26 Mar 2013 14:35:22 -0700 (PDT) Received: from Arturos-MacBook-Pro.local (unknown [IPv6:2800:af:ba30:ef49:2c62:7d16:669f:a015]) by mail.lacnic.net.uy (Postfix) with ESMTP id 965F930844D for ; Tue, 26 Mar 2013 18:35:08 -0300 (UYT) Message-ID: <5152148C.5090505@lacnic.net> Date: Tue, 26 Mar 2013 18:35:08 -0300 From: Arturo Servin User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: sidr@ietf.org References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514CFC5F.3090401@ripe.net> <515064E6.7030508@bbn.com> <515069D5.5040403@ripe.net> <51509B2E.2070108@bbn.com> <51518C9C.8040602@ripe.net> <5151B8CE.3000505@bbn.com> <5151C763.5060403@ripe.net> <5151CC02.20200@bbn.com> <5151D1F4.30307@ripe.net> <5151DFDB.6000504@gmail.com> <5151E528.4090102@bbn.com> <5151E771.9060805@gmail.com> <5151F07E.8010105@bbn.com> In-Reply-To: <5151F07E.8010105@bbn.com> X-Enigmail-Version: 1.5.1 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-LACNIC.uy-MailScanner-Information: Please contact the ISP for more information X-LACNIC.uy-MailScanner: Found to be clean X-LACNIC.uy-MailScanner-SpamCheck: X-LACNIC.uy-MailScanner-From: aservin@lacnic.net Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2013 21:35:22 -0000 On 3/26/13 4:01 PM, Stephen Kent wrote: > Carols, > > I am very happy to hear that LACNIC has been putting AS#s (allocated by > LACNIC) in the > certs you are issuing! > > If you compare the cert you have issued (w/o AS#'s) against RV or RIS > data, what do you > see: > - are these prefixed advertised? Last time around ~79% of our allocations for IPv4 were announced and ~28% of IPv6. > - do they have one ASN associated with the advertisement, or more > than one? Mmm, do not know. Regards, as From turners@ieca.com Tue Mar 26 14:43:37 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3181E21F8707 for ; Tue, 26 Mar 2013 14:43:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.295 X-Spam-Level: X-Spam-Status: No, score=-102.295 tagged_above=-999 required=5 tests=[AWL=-0.030, BAYES_00=-2.599, IP_NOT_FRIENDLY=0.334, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eOs4XsazGa0x for ; Tue, 26 Mar 2013 14:43:36 -0700 (PDT) Received: from gateway01.websitewelcome.com (gateway01.websitewelcome.com [67.18.80.19]) by ietfa.amsl.com (Postfix) with ESMTP id A998A21F86F5 for ; Tue, 26 Mar 2013 14:43:36 -0700 (PDT) Received: by gateway01.websitewelcome.com (Postfix, from userid 5007) id 530FA6A83009A; Tue, 26 Mar 2013 16:43:36 -0500 (CDT) Received: from gator1743.hostgator.com (gator1743.hostgator.com [184.173.253.227]) by gateway01.websitewelcome.com (Postfix) with ESMTP id 4753B6A830073 for ; Tue, 26 Mar 2013 16:43:36 -0500 (CDT) Received: from [108.45.16.214] (port=57976 helo=thunderfish.local) by gator1743.hostgator.com with esmtpsa (TLSv1:DHE-RSA-AES256-SHA:256) (Exim 4.80) (envelope-from ) id 1UKbea-0001HF-4J for sidr@ietf.org; Tue, 26 Mar 2013 16:43:36 -0500 Message-ID: <51521687.7010105@ieca.com> Date: Tue, 26 Mar 2013 17:43:35 -0400 From: Sean Turner User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: sidr@ietf.org References: <20130326204720.10356.96489.idtracker@ietfa.amsl.com> In-Reply-To: <20130326204720.10356.96489.idtracker@ietfa.amsl.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - gator1743.hostgator.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - ieca.com X-BWhitelist: no X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: (thunderfish.local) [108.45.16.214]:57976 X-Source-Auth: sean.turner@ieca.com X-Email-Count: 24 X-Source-Cap: ZG9tbWdyNDg7ZG9tbWdyNDg7Z2F0b3IxNzQzLmhvc3RnYXRvci5jb20= Subject: Re: [sidr] I-D Action: draft-ietf-sidr-bgpsec-algs-04.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2013 21:43:37 -0000 This is a keep-alive version. I changed the issue and expiry dates and the draft number. spt On 3/26/13 4:47 PM, internet-drafts@ietf.org wrote: > > A New Internet-Draft is available from the on-line Internet-Drafts directories. > This draft is a work item of the Secure Inter-Domain Routing Working Group of the IETF. > > Title : BGP Algorithms, Key Formats, & Signature Formats > Author(s) : Sean Turner > Filename : draft-ietf-sidr-bgpsec-algs-04.txt > Pages : 7 > Date : 2013-03-26 > > Abstract: > This document specifies the algorithms, algorithms' parameters, > asymmetric key formats, asymmetric key size and signature format used > in BGPSEC (Border Gateway Protocol Security). This document updates > the Profile for Algorithms and Key Sizes for use in the Resource > Public Key Infrastructure (RFC 6485). > > > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-sidr-bgpsec-algs > > There's also a htmlized version available at: > http://tools.ietf.org/html/draft-ietf-sidr-bgpsec-algs-04 > > A diff from the previous version is available at: > http://www.ietf.org/rfcdiff?url2=draft-ietf-sidr-bgpsec-algs-04 > > > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From internet-drafts@ietf.org Tue Mar 26 14:56:04 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 791F821F86DE; Tue, 26 Mar 2013 14:56:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.525 X-Spam-Level: X-Spam-Status: No, score=-102.525 tagged_above=-999 required=5 tests=[AWL=0.075, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2X9vphM1ceJx; Tue, 26 Mar 2013 14:56:03 -0700 (PDT) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id DEF9F21F8633; Tue, 26 Mar 2013 14:56:03 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: internet-drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 4.43 Message-ID: <20130326215603.853.23251.idtracker@ietfa.amsl.com> Date: Tue, 26 Mar 2013 14:56:03 -0700 Cc: sidr@ietf.org Subject: [sidr] I-D Action: draft-ietf-sidr-bgpsec-threats-05.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2013 21:56:04 -0000 A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the Secure Inter-Domain Routing Working Group= of the IETF. Title : Threat Model for BGP Path Security Author(s) : Stephen Kent Andrew Chi Filename : draft-ietf-sidr-bgpsec-threats-05.txt Pages : 20 Date : 2013-03-26 Abstract: This document describes a threat model for the context in which BGP path security mechanisms will be developed. It assumes the context established by the SIDR WG charter, as of April 19, 2011. The charter established two goals for the SIDR work: o Enabling an AS to verify the authorization of an origin AS to The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-sidr-bgpsec-threats There's also a htmlized version available at: http://tools.ietf.org/html/draft-ietf-sidr-bgpsec-threats-05 A diff from the previous version is available at: http://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-sidr-bgpsec-threats-05 Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From achi@bbn.com Tue Mar 26 15:27:41 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C05ED21F8C11 for ; Tue, 26 Mar 2013 15:27:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.307 X-Spam-Level: X-Spam-Status: No, score=-5.307 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, MISSING_HEADERS=1.292, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Rxmhtc5raUd7 for ; Tue, 26 Mar 2013 15:27:41 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) by ietfa.amsl.com (Postfix) with ESMTP id 456DC21F8BED for ; Tue, 26 Mar 2013 15:27:41 -0700 (PDT) Received: from dhcp89-089-010.bbn.com ([128.89.89.10]:62696 helo=[127.0.0.1]) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1UKcLE-000OI7-FN for sidr@ietf.org; Tue, 26 Mar 2013 18:27:40 -0400 Message-ID: <515220CD.8050705@bbn.com> Date: Tue, 26 Mar 2013 18:27:25 -0400 From: Andrew Chi User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 CC: sidr References: <24B20D14B2CD29478C8D5D6E9CBB29F65C23437D@Hermes.columbia.ads.sparta.com> <31089dec6d0c4ff57b8ba5e680c6c29b@tcb.net> <513E30FC.1050504@bbn.com> In-Reply-To: <513E30FC.1050504@bbn.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [sidr] ORIGINs X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2013 22:27:41 -0000 On 3/11/2013 3:31 PM, Stephen Kent wrote: > Residual Vulnerabilities section. I suggest the following updated text > for that section, to better explain the criteria for inclusion and > exclusion in that document: > > -bgpsec-threats-05 has been updated with the revised paragraph. Editorial change: I also removed the TCPMD5 reference at the end since it's within a quote (and obsoleted). Andrew From randy@psg.com Tue Mar 26 18:24:12 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 42A4221F86F4 for ; Tue, 26 Mar 2013 18:24:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.358 X-Spam-Level: X-Spam-Status: No, score=-2.358 tagged_above=-999 required=5 tests=[AWL=0.241, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xNf-W8sWfqVa for ; Tue, 26 Mar 2013 18:24:11 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id A474F21F86F0 for ; Tue, 26 Mar 2013 18:24:11 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.80.1 (FreeBSD)) (envelope-from ) id 1UKf62-0002wZ-TB; Wed, 27 Mar 2013 01:24:11 +0000 Date: Wed, 27 Mar 2013 10:24:09 +0900 Message-ID: From: Randy Bush To: Oleg Muravskiy In-Reply-To: <5151C843.2040803@ripe.net> References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514CFC5F.3090401@ripe.net> <515064E6.7030508@bbn.com> <51517215.9010602@ripe.net> <5151C843.2040803@ripe.net> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Cc: sidr wg list Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2013 01:24:12 -0000 hi oleg, >>> I count the number of distinct reg-ids in the RIR statistics files >>> (ftp..net/pub/stats//delegated--extended-latest, where >>> is in {afrinic,apnic,arin,lacnic}). >> at least for arin, this algorithm produces a result off by a quite >> large factor. > I do > $ cut -f8 -d'|' delegated-arin-extended-latest |sort -u|wc -l > 35394 sorry. it is not you, it is the arin database (personally, all the rir databases suck, they just suck differently:-). what the arin database considers to be an organization does not correspond to what you consider one, z/s aside. e.g. check how many 'goog's you find. randy From jcurran@arin.net Wed Mar 27 05:22:18 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AE2AE21F911C for ; Wed, 27 Mar 2013 05:22:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id diod6FlmWo2e for ; Wed, 27 Mar 2013 05:22:16 -0700 (PDT) Received: from smtp1.arin.net (smtp1.arin.net [IPv6:2001:500:4:13::33]) by ietfa.amsl.com (Postfix) with ESMTP id 8D24D21F9122 for ; Wed, 27 Mar 2013 05:22:16 -0700 (PDT) Received: by smtp1.arin.net (Postfix, from userid 323) id 3639F16507B; Wed, 27 Mar 2013 08:22:16 -0400 (EDT) Received: from CHAXCH06.corp.arin.net (chaxch06.corp.arin.net [192.149.252.95]) by smtp1.arin.net (Postfix) with ESMTP id 9CCC8165067; Wed, 27 Mar 2013 08:22:15 -0400 (EDT) Received: from CHAXCH03.corp.arin.net (10.1.30.17) by CHAXCH06.corp.arin.net (192.149.252.95) with Microsoft SMTP Server (TLS) id 14.2.328.9; Wed, 27 Mar 2013 08:22:01 -0400 Received: from CHAXCH01.corp.arin.net ([169.254.1.209]) by CHAXCH03.corp.arin.net ([10.1.30.17]) with mapi id 14.02.0328.009; Wed, 27 Mar 2013 08:22:15 -0400 From: John Curran To: Oleg Muravskiy Thread-Topic: [sidr] comments on the repository analysis I-D Thread-Index: AQHOKuW2OecXW1BUBUGoVai/y3Vu7A== Date: Wed, 27 Mar 2013 12:22:13 +0000 Message-ID: <8DA1853CE466B041B104C1CAEE00B3748FA49A81@CHAXCH01.corp.arin.net> References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514CFC5F.3090401@ripe.net> <515064E6.7030508@bbn.com> <51517215.9010602@ripe.net> <5151C843.2040803@ripe.net> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [192.149.252.96] Content-Type: text/plain; charset="us-ascii" Content-ID: <3EF6FE2F31011940AD1EA8697362FBEC@corp.arin.net> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: sidr wg list Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2013 12:22:18 -0000 On Mar 26, 2013, at 9:24 PM, Randy Bush wrote: > sorry. it is not you, it is the arin database (personally, all the rir > databases suck, they just suck differently:-). what the arin database > considers to be an organization does not correspond to what you consider > one, Randy is correct - while "organization ids" do map to organizations, it is often a many-to-one relationship and hence not necessarily useful as an indicator of number of organizations (in the typical use of the term) actually involved. It is a valid upper bound, but the true value may be less due to multiple network management entities (Foo-wireline,=20 Foo-wireless, etc.), multiple contracts with ARIN, or multiple entries=20 for hierarchical organizations (e.g. large governments with multiple=20 agencies/departments) FYI, /John From oleg@ripe.net Wed Mar 27 06:42:43 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0C27021F8F1F for ; Wed, 27 Mar 2013 06:42:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4PyDRTy3S4ML for ; Wed, 27 Mar 2013 06:42:42 -0700 (PDT) Received: from postgirl.ripe.net (postgirl.ipv6.ripe.net [IPv6:2001:67c:2e8:11::c100:1342]) by ietfa.amsl.com (Postfix) with ESMTP id 9DF3F21F8A53 for ; Wed, 27 Mar 2013 06:42:41 -0700 (PDT) Received: from ayeaye.ripe.net ([193.0.23.5]) by postgirl.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1UKqce-0003tY-GQ; Wed, 27 Mar 2013 14:42:38 +0100 Received: from dog.ripe.net ([193.0.1.217] helo=guest137.guestnet.ripe.net) by ayeaye.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1UKqcd-0006hZ-B8; Wed, 27 Mar 2013 14:42:35 +0100 Message-ID: <5152F74B.9020800@ripe.net> Date: Wed, 27 Mar 2013 14:42:35 +0100 From: Oleg Muravskiy Organization: RIPE NCC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:19.0) Gecko/20100101 Firefox/19.0 SeaMonkey/2.16.2 MIME-Version: 1.0 To: John Curran References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514CFC5F.3090401@ripe.net> <515064E6.7030508@bbn.com> <51517215.9010602@ripe.net> <5151C843.2040803@ripe.net> <8DA1853CE466B041B104C1CAEE00B3748FA49A81@CHAXCH01.corp.arin.net> In-Reply-To: <8DA1853CE466B041B104C1CAEE00B3748FA49A81@CHAXCH01.corp.arin.net> X-Enigmail-Version: 1.5.1 Content-Type: multipart/alternative; boundary="------------080709080301030509080801" X-Anti-Virus: Kaspersky Anti-Virus for Linux Mail Server 5.6.48/RELEASE, bases: 20120425 #7816575, check: 20130327 clean X-RIPE-Spam-Level: ---- X-RIPE-Spam-Report: Spam Total Points: -4.2 points pts rule name description ---- ---------------------- ------------------------------------ -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP -1.3 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] 0.0 HTML_MESSAGE BODY: HTML included in message X-RIPE-Signature: c408758d4ce2e8eb06762a65a3365b748881d5b6e10fc7f2e9234e3eb627501c Cc: sidr wg list Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2013 13:42:43 -0000 This is a multi-part message in MIME format. --------------080709080301030509080801 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit John Curran wrote: > On Mar 26, 2013, at 9:24 PM, Randy Bush wrote: > >> sorry. it is not you, it is the arin database (personally, all the rir >> databases suck, they just suck differently:-). what the arin database >> considers to be an organization does not correspond to what you consider >> one, > Randy is correct - while "organization ids" do map to organizations, > it is often a many-to-one relationship and hence not necessarily useful > as an indicator of number of organizations (in the typical use of the > term) actually involved. It is a valid upper bound, but the true value > may be less due to multiple network management entities (Foo-wireline, > Foo-wireless, etc.), multiple contracts with ARIN, or multiple entries > for hierarchical organizations (e.g. large governments with multiple > agencies/departments) Yes, we also have cases when multiple members belong to a single legal entity. But I think we are not interested in different organisations as such, but rather the number of CAs. So the actual question is whether the number of RPKI CAs will differ from the number of "organization ids" in ARIN stats file? -- Oleg Muravskiy RIPE NCC --------------080709080301030509080801 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit
John Curran wrote:
On Mar 26, 2013, at 9:24 PM, Randy Bush <randy@psg.com> wrote:


sorry.  it is not you, it is the arin database (personally, all the rir
databases suck, they just suck differently:-).  what the arin database
considers to be an organization does not correspond to what you consider
one,

Randy is correct - while "organization ids" do map to organizations,
it is often a many-to-one relationship and hence not necessarily useful
as an indicator of number of organizations (in the typical use of the
term) actually involved.  It is a valid upper bound, but the true value
may be less due to multiple network management entities (Foo-wireline, 
Foo-wireless, etc.), multiple contracts with ARIN, or multiple entries 
for hierarchical organizations (e.g. large governments with multiple 
agencies/departments)
Yes, we also have cases when multiple members belong to a single legal entity.
But I think we are not interested in different organisations as such, but rather the number of CAs.
So the actual question is whether the number of RPKI CAs will differ from the number of "organization ids" in ARIN stats file? 

-- 
Oleg Muravskiy
RIPE NCC
--------------080709080301030509080801-- From aservin@lacnic.net Wed Mar 27 06:49:57 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 255C021F905A for ; Wed, 27 Mar 2013 06:49:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.3 X-Spam-Level: X-Spam-Status: No, score=-2.3 tagged_above=-999 required=5 tests=[AWL=0.300, BAYES_00=-2.599, NO_RELAYS=-0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id viHQouc4gbvL for ; Wed, 27 Mar 2013 06:49:56 -0700 (PDT) Received: from mail.lacnic.net.uy (mail.lacnic.net.uy [IPv6:2001:13c7:7001:4000::3]) by ietfa.amsl.com (Postfix) with ESMTP id 9FF7121F9057 for ; Wed, 27 Mar 2013 06:49:50 -0700 (PDT) Received: from 85-7-200.lacnic.net.uy (unknown [IPv6:2001:13c7:7001:5128:9d95:d038:6391:cda8]) by mail.lacnic.net.uy (Postfix) with ESMTP id 1767E308457 for ; Wed, 27 Mar 2013 10:49:38 -0300 (UYT) Message-ID: <5152F8F9.6040505@lacnic.net> Date: Wed, 27 Mar 2013 10:49:45 -0300 From: Arturo Servin User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: sidr@ietf.org References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514CFC5F.3090401@ripe.net> <515064E6.7030508@bbn.com> <51517215.9010602@ripe.net> <5151C843.2040803@ripe.net> <8DA1853CE466B041B104C1CAEE00B3748FA49A81@CHAXCH01.corp.arin.net> <5152F74B.9020800@ripe.net> In-Reply-To: <5152F74B.9020800@ripe.net> X-Enigmail-Version: 1.5.1 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-LACNIC.uy-MailScanner-Information: Please contact the ISP for more information X-LACNIC.uy-MailScanner: Found to be clean X-LACNIC.uy-MailScanner-SpamCheck: X-LACNIC.uy-MailScanner-From: aservin@lacnic.net Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2013 13:49:57 -0000 I think we are around the bushes. We want to know an estimate of the number of CAs in the future. The current number does not work because of all the reasons that we already know. Then, I found #CA = #AS a good estimate (yes, there are multiple factors like an RIR or an ISP may provide a hosted solution and reduce this number in half, a 20% or even keep it very low if only Tier-1 and large ISPs/enterprises decide to have CAs and the rest is happy with the RIR hosted model). Regards, as On 3/27/13 10:42 AM, Oleg Muravskiy wrote: > > John Curran wrote: >> On Mar 26, 2013, at 9:24 PM, Randy Bush wrote: >> >>> sorry. it is not you, it is the arin database (personally, all the rir >>> databases suck, they just suck differently:-). what the arin database >>> considers to be an organization does not correspond to what you consider >>> one, >> Randy is correct - while "organization ids" do map to organizations, >> it is often a many-to-one relationship and hence not necessarily useful >> as an indicator of number of organizations (in the typical use of the >> term) actually involved. It is a valid upper bound, but the true value >> may be less due to multiple network management entities (Foo-wireline, >> Foo-wireless, etc.), multiple contracts with ARIN, or multiple entries >> for hierarchical organizations (e.g. large governments with multiple >> agencies/departments) > Yes, we also have cases when multiple members belong to a single legal > entity. > But I think we are not interested in different organisations as such, > but rather the number of CAs. > So the actual question is whether the number of RPKI CAs will differ > from the number of "organization ids" in ARIN stats file? > > -- > Oleg Muravskiy > RIPE NCC > > > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From jcurran@arin.net Wed Mar 27 06:53:47 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 24EB721F90E3 for ; Wed, 27 Mar 2013 06:53:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[AWL=4.000, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Dk1hsd-Uqoap for ; Wed, 27 Mar 2013 06:53:46 -0700 (PDT) Received: from smtp2.arin.net (smtp2.arin.net [192.149.252.32]) by ietfa.amsl.com (Postfix) with ESMTP id D9A1021F90E1 for ; Wed, 27 Mar 2013 06:53:45 -0700 (PDT) Received: by smtp2.arin.net (Postfix, from userid 323) id 8A381213643; Wed, 27 Mar 2013 09:53:15 -0400 (EDT) Received: from CHAXCH05.corp.arin.net (chaxch05.corp.arin.net [192.149.252.94]) by smtp2.arin.net (Postfix) with ESMTP id 030F2213643; Wed, 27 Mar 2013 09:53:15 -0400 (EDT) Received: from CHAXCH03.corp.arin.net (10.1.30.17) by CHAXCH05.corp.arin.net (192.149.252.94) with Microsoft SMTP Server (TLS) id 14.2.328.9; Wed, 27 Mar 2013 09:52:31 -0400 Received: from CHAXCH01.corp.arin.net ([169.254.1.209]) by CHAXCH03.corp.arin.net ([10.1.30.17]) with mapi id 14.02.0328.009; Wed, 27 Mar 2013 09:53:04 -0400 From: John Curran To: Oleg Muravskiy Thread-Topic: [sidr] comments on the repository analysis I-D Thread-Index: AQHOKuW2OecXW1BUBUGoVai/y3Vu7Ji5zyOAgAAC8AA= Date: Wed, 27 Mar 2013 13:53:01 +0000 Message-ID: <8DA1853CE466B041B104C1CAEE00B3748FA4BF41@CHAXCH01.corp.arin.net> References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514CFC5F.3090401@ripe.net> <515064E6.7030508@bbn.com> <51517215.9010602@ripe.net> <5151C843.2040803@ripe.net> <8DA1853CE466B041B104C1CAEE00B3748FA49A81@CHAXCH01.corp.arin.net> <5152F74B.9020800@ripe.net> In-Reply-To: <5152F74B.9020800@ripe.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [192.149.252.96] Content-Type: text/plain; charset="us-ascii" Content-ID: <20A491C8AFAEDD4C85EB1D415A2A1017@corp.arin.net> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: sidr wg list Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2013 13:53:47 -0000 On Mar 27, 2013, at 9:42 AM, Oleg Muravskiy wrote: > Yes, we also have cases when multiple members belong to a single legal en= tity. > But I think we are not interested in different organisations as such, but= rather the number of CAs. > So the actual question is whether the number of RPKI CAs will differ from= the number of "organization ids" in ARIN stats file? Agreed... very hard to predict. For those cases where it is distinct netw= ork=20 management, it could go either way. For those where it is hierarchical org= s, likely to remain distinct. For those were it is contractual in natural, I= would expect modest consolidation over time. I believe it is fine as an indicator of potential CA entities within +/- 50= %, but even that is simply the best estimate at this time. /John From Sandra.Murphy@sparta.com Wed Mar 27 07:25:06 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 573AC21F9161 for ; Wed, 27 Mar 2013 07:25:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NVDPtnyafSt7 for ; Wed, 27 Mar 2013 07:25:05 -0700 (PDT) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by ietfa.amsl.com (Postfix) with ESMTP id DB33421F861B for ; Wed, 27 Mar 2013 07:25:03 -0700 (PDT) Received: from Beta5.sparta.com ([10.62.8.21]) by M4.sparta.com (8.14.4/8.14.4) with ESMTP id r2REP2wf015932; Wed, 27 Mar 2013 09:25:02 -0500 Received: from Hermes.columbia.ads.sparta.com ([10.62.56.107]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id r2REOvE1001829; Wed, 27 Mar 2013 09:24:57 -0500 Received: from HERMES.columbia.ads.sparta.com ([fe80::e4a8:a383:2128:c0e5]) by Hermes.columbia.ads.sparta.com ([fe80::e4a8:a383:2128:c0e5%18]) with mapi id 14.02.0247.003; Wed, 27 Mar 2013 10:24:31 -0400 From: "Murphy, Sandra" To: John Curran , Oleg Muravskiy Thread-Topic: [sidr] comments on the repository analysis I-D Thread-Index: AQHOIPdkDprP21vPNUq5Bc/FsjzT/pirzDYAgAARPICABFwFAIAAWOUAgAJAZoCAA/9fAIABQOSAgAAVlgCAAFEmgIAAmu2AgAC33YCAABZ0gIAAAuqA///FQvU= Date: Wed, 27 Mar 2013 14:24:30 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F66EDDCA7F@Hermes.columbia.ads.sparta.com> References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514CFC5F.3090401@ripe.net> <515064E6.7030508@bbn.com> <51517215.9010602@ripe.net> <5151C843.2040803@ripe.net> <8DA1853CE466B041B104C1CAEE00B3748FA49A81@CHAXCH01.corp.arin.net> <5152F74B.9020800@ripe.net>, <8DA1853CE466B041B104C1CAEE00B3748FA4BF41@CHAXCH01.corp.arin.net> In-Reply-To: <8DA1853CE466B041B104C1CAEE00B3748FA4BF41@CHAXCH01.corp.arin.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.137] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: sidr wg list Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2013 14:25:06 -0000 On Wednesday, March 27, 2013 9:53 AM, John Curran said:=0A= =0A= >I believe it is fine as an indicator of potential CA entities within +/- 5= 0%,=0A= >but even that is simply the best estimate at this time.=0A= =0A= No smiley?=0A= =0A= --Sandy, speaking as regular ol' member=0A= From jcurran@arin.net Wed Mar 27 07:54:45 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9F7F221F9096 for ; Wed, 27 Mar 2013 07:54:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.599 X-Spam-Level: X-Spam-Status: No, score=-4.599 tagged_above=-999 required=5 tests=[AWL=-2.000, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wFI7O92XuC6Z for ; Wed, 27 Mar 2013 07:54:44 -0700 (PDT) Received: from smtp1.arin.net (smtp1.arin.net [IPv6:2001:500:4:13::33]) by ietfa.amsl.com (Postfix) with ESMTP id 0567421F9007 for ; Wed, 27 Mar 2013 07:54:44 -0700 (PDT) Received: by smtp1.arin.net (Postfix, from userid 323) id AC6EE16519C; Wed, 27 Mar 2013 10:54:43 -0400 (EDT) Received: from CHAXCH05.corp.arin.net (chaxch05.corp.arin.net [192.149.252.94]) by smtp1.arin.net (Postfix) with ESMTP id 471E2165075; Wed, 27 Mar 2013 10:54:43 -0400 (EDT) Received: from CHAXCH04.corp.arin.net (10.1.30.19) by CHAXCH05.corp.arin.net (192.149.252.94) with Microsoft SMTP Server (TLS) id 14.2.328.9; Wed, 27 Mar 2013 10:54:00 -0400 Received: from CHAXCH01.corp.arin.net ([169.254.1.209]) by CHAXCH04.corp.arin.net ([10.1.30.19]) with mapi id 14.02.0328.009; Wed, 27 Mar 2013 10:54:36 -0400 From: John Curran To: "Murphy, Sandra" Thread-Topic: [sidr] comments on the repository analysis I-D Thread-Index: AQHOKuW2OecXW1BUBUGoVai/y3Vu7Ji5zyOAgAAC8ACAAAjGAIAACGyA Date: Wed, 27 Mar 2013 14:54:35 +0000 Message-ID: <8DA1853CE466B041B104C1CAEE00B3748FA4D94F@CHAXCH01.corp.arin.net> References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514CFC5F.3090401@ripe.net> <515064E6.7030508@bbn.com> <51517215.9010602@ripe.net> <5151C843.2040803@ripe.net> <8DA1853CE466B041B104C1CAEE00B3748FA49A81@CHAXCH01.corp.arin.net> <5152F74B.9020800@ripe.net>, <8DA1853CE466B041B104C1CAEE00B3748FA4BF41@CHAXCH01.corp.arin.net> <24B20D14B2CD29478C8D5D6E9CBB29F66EDDCA7F@Hermes.columbia.ads.sparta.com> In-Reply-To: <24B20D14B2CD29478C8D5D6E9CBB29F66EDDCA7F@Hermes.columbia.ads.sparta.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [192.149.252.96] Content-Type: text/plain; charset="us-ascii" Content-ID: <2DF9EF80366F904FB498FA182A31E3C5@corp.arin.net> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: sidr wg list Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2013 14:54:45 -0000 On Mar 27, 2013, at 10:24 AM, "Murphy, Sandra" w= rote: > On Wednesday, March 27, 2013 9:53 AM, John Curran said: >=20 >> I believe it is fine as an indicator of potential CA entities within +/-= 50%, >> but even that is simply the best estimate at this time. >=20 > No smiley? Implied by context... :-) /John From randy@psg.com Wed Mar 27 09:20:27 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8240021F9172 for ; Wed, 27 Mar 2013 09:20:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.448 X-Spam-Level: X-Spam-Status: No, score=-2.448 tagged_above=-999 required=5 tests=[AWL=0.151, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vOFw0y+32Vvg for ; Wed, 27 Mar 2013 09:20:27 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id 2112D21F9161 for ; Wed, 27 Mar 2013 09:20:27 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.80.1 (FreeBSD)) (envelope-from ) id 1UKt5N-0005eF-6W; Wed, 27 Mar 2013 16:20:25 +0000 Date: Thu, 28 Mar 2013 01:20:24 +0900 Message-ID: From: Randy Bush To: Arturo Servin In-Reply-To: <5152F8F9.6040505@lacnic.net> References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514CFC5F.3090401@ripe.net> <515064E6.7030508@bbn.com> <51517215.9010602@ripe.net> <5151C843.2040803@ripe.net> <8DA1853CE466B041B104C1CAEE00B3748FA49A81@CHAXCH01.corp.arin.net> <5152F74B.9020800@ripe.net> <5152F8F9.6040505@lacnic.net> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Cc: sidr@ietf.org Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2013 16:20:27 -0000 > I think we are around the bushes. excuse me!! > We want to know an estimate of the number of CAs in the future. have you looked at sriram's and sk's work. randy From aservin@lacnic.net Wed Mar 27 09:29:18 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 38EDF21F89B2 for ; Wed, 27 Mar 2013 09:29:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.45 X-Spam-Level: X-Spam-Status: No, score=-2.45 tagged_above=-999 required=5 tests=[AWL=0.150, BAYES_00=-2.599, NO_RELAYS=-0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9ZQWdLp3nKtS for ; Wed, 27 Mar 2013 09:29:17 -0700 (PDT) Received: from mail.lacnic.net.uy (mail.lacnic.net.uy [IPv6:2001:13c7:7001:4000::3]) by ietfa.amsl.com (Postfix) with ESMTP id 7AFC821F87CC for ; Wed, 27 Mar 2013 09:29:17 -0700 (PDT) Received: from 85-7-200.lacnic.net.uy (unknown [IPv6:2001:13c7:7001:5128:9d95:d038:6391:cda8]) by mail.lacnic.net.uy (Postfix) with ESMTP id D93D9308463; Wed, 27 Mar 2013 13:29:01 -0300 (UYT) Message-ID: <51531E52.4070303@lacnic.net> Date: Wed, 27 Mar 2013 13:29:06 -0300 From: Arturo Servin User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: Randy Bush References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514CFC5F.3090401@ripe.net> <515064E6.7030508@bbn.com> <51517215.9010602@ripe.net> <5151C843.2040803@ripe.net> <8DA1853CE466B041B104C1CAEE00B3748FA49A81@CHAXCH01.corp.arin.net> <5152F74B.9020800@ripe.net> <5152F8F9.6040505@lacnic.net> In-Reply-To: X-Enigmail-Version: 1.5.1 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-LACNIC.uy-MailScanner-Information: Please contact the ISP for more information X-LACNIC.uy-MailScanner: Found to be clean X-LACNIC.uy-MailScanner-SpamCheck: X-LACNIC.uy-MailScanner-From: aservin@lacnic.net Cc: sidr@ietf.org Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2013 16:29:18 -0000 On 3/27/13 1:20 PM, Randy Bush wrote: >> I think we are around the bushes. > > excuse me!! > >> We want to know an estimate of the number of CAs in the future. > > have you looked at sriram's and sk's work. > > randy > Yes, I assume http://tools.ietf.org/agenda/86/slides/slides-86-sidr-1.pdf slide 3. Which I think is a good estimate. -as From randy@psg.com Wed Mar 27 09:32:13 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C8AD321F91E0 for ; Wed, 27 Mar 2013 09:32:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.478 X-Spam-Level: X-Spam-Status: No, score=-2.478 tagged_above=-999 required=5 tests=[AWL=0.121, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NuG7pu7epoDA for ; Wed, 27 Mar 2013 09:32:13 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id 764C921F91B6 for ; Wed, 27 Mar 2013 09:32:13 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.80.1 (FreeBSD)) (envelope-from ) id 1UKtGn-0005gw-7d; Wed, 27 Mar 2013 16:32:13 +0000 Date: Thu, 28 Mar 2013 01:32:12 +0900 Message-ID: From: Randy Bush To: Arturo Servin In-Reply-To: <51531E52.4070303@lacnic.net> References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514CFC5F.3090401@ripe.net> <515064E6.7030508@bbn.com> <51517215.9010602@ripe.net> <5151C843.2040803@ripe.net> <8DA1853CE466B041B104C1CAEE00B3748FA49A81@CHAXCH01.corp.arin.net> <5152F74B.9020800@ripe.net> <5152F8F9.6040505@lacnic.net> <51531E52.4070303@lacnic.net> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Cc: sidr@ietf.org Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2013 16:32:13 -0000 > Yes, I assume > http://tools.ietf.org/agenda/86/slides/slides-86-sidr-1.pdf slide 3. > Which I think is a good estimate. of publication points. != repositories randy From aservin@lacnic.net Wed Mar 27 09:46:08 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7C7EF21F8920 for ; Wed, 27 Mar 2013 09:46:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.5 X-Spam-Level: X-Spam-Status: No, score=-2.5 tagged_above=-999 required=5 tests=[AWL=0.100, BAYES_00=-2.599, NO_RELAYS=-0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rso8O3G6+ACJ for ; Wed, 27 Mar 2013 09:46:08 -0700 (PDT) Received: from mail.lacnic.net.uy (mail.lacnic.net.uy [IPv6:2001:13c7:7001:4000::3]) by ietfa.amsl.com (Postfix) with ESMTP id A86E721F8881 for ; Wed, 27 Mar 2013 09:43:48 -0700 (PDT) Received: from 85-7-200.lacnic.net.uy (unknown [IPv6:2001:13c7:7001:5128:9d95:d038:6391:cda8]) by mail.lacnic.net.uy (Postfix) with ESMTP id 88187308453; Wed, 27 Mar 2013 13:43:34 -0300 (UYT) Message-ID: <515321BB.2070601@lacnic.net> Date: Wed, 27 Mar 2013 13:43:39 -0300 From: Arturo Servin User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: Randy Bush References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514CFC5F.3090401@ripe.net> <515064E6.7030508@bbn.com> <51517215.9010602@ripe.net> <5151C843.2040803@ripe.net> <8DA1853CE466B041B104C1CAEE00B3748FA49A81@CHAXCH01.corp.arin.net> <5152F74B.9020800@ripe.net> <5152F8F9.6040505@lacnic.net> <51531E52.4070303@lacnic.net> In-Reply-To: X-Enigmail-Version: 1.5.1 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-LACNIC.uy-MailScanner-Information: Please contact the ISP for more information X-LACNIC.uy-MailScanner: Found to be clean X-LACNIC.uy-MailScanner-SpamCheck: X-LACNIC.uy-MailScanner-From: aservin@lacnic.net Cc: sidr@ietf.org Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2013 16:46:08 -0000 OK, I will use publication points from now own to avoid confusions. -as On 3/27/13 1:32 PM, Randy Bush wrote: >> Yes, I assume >> http://tools.ietf.org/agenda/86/slides/slides-86-sidr-1.pdf slide 3. >> Which I think is a good estimate. > > of publication points. != repositories > > randy > From kotikalapudi.sriram@nist.gov Wed Mar 27 09:49:04 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9A00321F91D7 for ; Wed, 27 Mar 2013 09:49:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UnVCIO7pxKTs for ; Wed, 27 Mar 2013 09:49:04 -0700 (PDT) Received: from wsget1.nist.gov (wsget1.nist.gov [129.6.13.150]) by ietfa.amsl.com (Postfix) with ESMTP id 2C69721F91D9 for ; Wed, 27 Mar 2013 09:49:01 -0700 (PDT) Received: from WSXGHUB2.xchange.nist.gov (129.6.18.19) by wsget1.nist.gov (129.6.13.150) with Microsoft SMTP Server (TLS) id 14.3.123.3; Wed, 27 Mar 2013 12:48:41 -0400 Received: from MBCLUSTER.xchange.nist.gov ([fe80::d479:3188:aec0:cb66]) by WSXGHUB2.xchange.nist.gov ([129.6.18.19]) with mapi; Wed, 27 Mar 2013 12:48:58 -0400 From: "Sriram, Kotikalapudi" To: Randy Bush , Arturo Servin Date: Wed, 27 Mar 2013 12:48:56 -0400 Thread-Topic: [sidr] comments on the repository analysis I-D Thread-Index: Ac4rCKaaOTfV07e5TiOymK5yKI06jAAAHPYQ Message-ID: References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514CFC5F.3090401@ripe.net> <515064E6.7030508@bbn.com> <51517215.9010602@ripe.net> <5151C843.2040803@ripe.net> <8DA1853CE466B041B104C1CAEE00B3748FA49A81@CHAXCH01.corp.arin.net> <5152F74B.9020800@ripe.net> <5152F8F9.6040505@lacnic.net> <51531E52.4070303@lacnic.net> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Cc: "sidr@ietf.org" Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2013 16:49:04 -0000 >> Yes, I assume >> http://tools.ietf.org/agenda/86/slides/slides-86-sidr-1.pdf slide 3. >> Which I think is a good estimate. > >of publication points. != repositories Arturo, Please also see slide #15. We vary the # repositories over a wide range, and the justification is somewhat along the lines of what you also noted in your post: http://www.ietf.org/mail-archive/web/sidr/current/msg05888.html A lot of CA's/pub points may be there (~order #ASes), but following observations similar to your rationale, the # repositories (where the pub points are actually published) can be somewhat smaller (see slide 15). Sriram From randy@psg.com Wed Mar 27 10:24:25 2013 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A6C6821F91A2 for ; Wed, 27 Mar 2013 10:24:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.489 X-Spam-Level: X-Spam-Status: No, score=-2.489 tagged_above=-999 required=5 tests=[AWL=0.110, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MthkvL9fhnHp for ; Wed, 27 Mar 2013 10:24:24 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id 4488221F91F9 for ; Wed, 27 Mar 2013 10:24:20 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.80.1 (FreeBSD)) (envelope-from ) id 1UKu5D-0005vP-Jd; Wed, 27 Mar 2013 17:24:19 +0000 Date: Thu, 28 Mar 2013 02:24:18 +0900 Message-ID: From: Randy Bush To: Arturo Servin In-Reply-To: <515321BB.2070601@lacnic.net> References: <51423B3E.6030804@bbn.com> <514725B4.6050707@gmail.com> <514ADC58.5080803@ripe.net> <514CFC5F.3090401@ripe.net> <515064E6.7030508@bbn.com> <51517215.9010602@ripe.net> <5151C843.2040803@ripe.net> <8DA1853CE466B041B104C1CAEE00B3748FA49A81@CHAXCH01.corp.arin.net> <5152F74B.9020800@ripe.net> <5152F8F9.6040505@lacnic.net> <51531E52.4070303@lacnic.net> <515321BB.2070601@lacnic.net> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Cc: sidr@ietf.org Subject: Re: [sidr] comments on the repository analysis I-D X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2013 17:24:26 -0000 > Yes, I assume > http://tools.ietf.org/agenda/86/slides/slides-86-sidr-1.pdf slide 3. > Which I think is a good estimate. actually, i think the number of pub points will be closer to the number of entries in the rir's datamesses, as they will be issuing the certs based on their datamesses. randy