From nobody Sun Oct 5 23:04:03 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AFB131A1B3E for ; Sun, 5 Oct 2014 23:04:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3.647 X-Spam-Level: *** X-Spam-Status: No, score=3.647 tagged_above=-999 required=5 tests=[BAYES_50=0.8, FSL_HELO_BARE_IP_2=1, IP_NOT_FRIENDLY=0.334, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_RHS_DOB=1.514] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GHAPA7jI1s-a for ; Sun, 5 Oct 2014 23:04:00 -0700 (PDT) Received: from gateway15.websitewelcome.com (gateway15.websitewelcome.com [67.18.70.8]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E9B5E1A1B3C for ; Sun, 5 Oct 2014 23:03:59 -0700 (PDT) Received: by gateway15.websitewelcome.com (Postfix, from userid 5007) id 2276B8F5187FB; Mon, 6 Oct 2014 01:03:59 -0500 (CDT) Received: from gator3286.hostgator.com (gator3286.hostgator.com [198.57.247.250]) by gateway15.websitewelcome.com (Postfix) with ESMTP id 124FF8F51878B for ; Mon, 6 Oct 2014 01:03:59 -0500 (CDT) Received: from [173.73.121.234] (port=60427 helo=192.168.1.7) by gator3286.hostgator.com with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.82) (envelope-from ) id 1Xb1Oo-0002NA-1U; Mon, 06 Oct 2014 01:03:58 -0500 Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) From: Sean Turner In-Reply-To: <6244188E-416B-4A49-B28F-663B37D1DC7F@parsons.com> Date: Mon, 6 Oct 2014 02:03:55 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: References: <6244188E-416B-4A49-B28F-663B37D1DC7F@parsons.com> To: Sandra Murphy X-Mailer: Apple Mail (2.1878.6) X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - gator3286.hostgator.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - ieca.com X-BWhitelist: no X-Source-IP: 173.73.121.234 X-Exim-ID: 1Xb1Oo-0002NA-1U X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: (192.168.1.7) [173.73.121.234]:60427 X-Source-Auth: sean.turner@ieca.com X-Email-Count: 1 X-Source-Cap: ZG9tbWdyNDg7ZG9tbWdyNDg7Z2F0b3IzMjg2Lmhvc3RnYXRvci5jb20= Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/GxrMoNLgzNL6KpmaQThnW6WNJWc Cc: sidr wg list Subject: Re: [sidr] WGLC on draft-ietf-sidr-rfc6490-bis-01.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Oct 2014 06:04:02 -0000 I=92ve read this draft and support it progressing. One minor comment: It would be nice if there was a short summary of the differences between = this version and RFC 6490. Maybe a new section 1.2 titled differences = between this version and RFC 6490: This document obsoletes RFC 6490 by adding support for multiple URIs in = a TAL.=20 Then again maybe just that sentence in the intro would do the trick. spt On Sep 26, 2014, at 10:17, Sandra Murphy = wrote: > The authors of Resource Certificate PKI (RPKI) Trust Anchor Locator, = draft-ietf-sidr-rfc6490-bis-01.txt believe the draft is ready for a = WGLC. >=20 > This starts a two week working group last call, to end on 10 Oct 2014. >=20 > The draft is available at = http://tools.ietf.org/html/draft-ietf-sidr-rfc6490-bis-01. >=20 > Please do comment on the list, indicating whether you believe this = draft is ready for publication. Note that silence is sufficient. There = must be support from the wg indicating consensus for publication. >=20 > --Sandy, speaking as one of the wg co-chairs. > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr From nobody Tue Oct 7 19:31:28 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 951101A901F for ; Tue, 7 Oct 2014 19:31:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.567 X-Spam-Level: X-Spam-Status: No, score=-1.567 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, IP_NOT_FRIENDLY=0.334, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5DBwaVDyteTz for ; Tue, 7 Oct 2014 19:31:26 -0700 (PDT) Received: from gateway08.websitewelcome.com (gateway08.websitewelcome.com [69.56.216.18]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DB4EA1A00DB for ; Tue, 7 Oct 2014 19:31:25 -0700 (PDT) Received: by gateway08.websitewelcome.com (Postfix, from userid 5007) id 553B2BEA3D1FA; Tue, 7 Oct 2014 21:31:24 -0500 (CDT) Received: from gator3286.hostgator.com (gator3286.hostgator.com [198.57.247.250]) by gateway08.websitewelcome.com (Postfix) with ESMTP id 36C7DBEA3D1B1 for ; Tue, 7 Oct 2014 21:31:24 -0500 (CDT) Received: from [173.73.121.234] (port=55419 helo=[192.168.1.7]) by gator3286.hostgator.com with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.82) (envelope-from ) id 1Xbh2B-0004mp-Eu; Tue, 07 Oct 2014 21:31:23 -0500 Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) From: Sean Turner In-Reply-To: <4556FA63-A6FD-471B-93FD-51D748C94EE8@tislabs.com> Date: Tue, 7 Oct 2014 22:31:20 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: <8BFAD7DD-7CEA-4720-86BB-09407C6C543D@ieca.com> References: <20140813004442.10560.45299.idtracker@ietfa.amsl.com> <4556FA63-A6FD-471B-93FD-51D748C94EE8@tislabs.com> To: Sandra Murphy X-Mailer: Apple Mail (2.1878.6) X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - gator3286.hostgator.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - ieca.com X-BWhitelist: no X-Source-IP: 173.73.121.234 X-Exim-ID: 1Xbh2B-0004mp-Eu X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: ([192.168.1.7]) [173.73.121.234]:55419 X-Source-Auth: sean.turner@ieca.com X-Email-Count: 2 X-Source-Cap: ZG9tbWdyNDg7ZG9tbWdyNDg7Z2F0b3IzMjg2Lmhvc3RnYXRvci5jb20= Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/Ixv2KhExOlTrBh4w_21kWOPMurg Cc: sidr wg list Subject: Re: [sidr] I-D Action: draft-ietf-sidr-bgpsec-pki-profiles-08.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Oct 2014 02:31:27 -0000 On Aug 13, 2014, at 12:42, Sandra Murphy wrote: > speaking as regular ol' member >=20 > A question about wording. >=20 > I understand the wording change in 3.1.1 (used to be 3.1.1.1) that = results from the change from multiple ASs in a cert to a single AS in a = cert. >=20 > But there is also a wording change having to do with multiple routers = sharing the same key pair. >=20 > The wording went from: >=20 > If the same certificate is issued to = more > than one router (hence the private key is shared among these > routers), the choice of the router ID used in this name is at the > discretion of the Issuer. >=20 > to: >=20 > If more than one = certificate > for an AS is issued (i.e., more than one router gets a certificate > for the AS and hence the private key is shared among more than one > router), the choice of the router ID used in Subject name is at the > discretion of the Issuer. >=20 > I don't understand the new wording. If all routers in an AS have = different keys, then there would be multiple certificates issued for the = AS, but no sharing of keys and no confusion over the router ID to be = used in each router's cert. Right? >=20 > Apologies if I'm just not parsing the new sentence correctly. The = previous wording was fine with me. >=20 > [The certificate request format does not include the subject name = anyway, so it looks to me like the subject name is ALWAYS at the = discretion of the issuer. No?) Yep the issuer always gets to determine the subject name as per RFC 6487 = s4.5 so how about we just leave that bit out and make that sentence a = note: Note that more than one certificate can be issued to an AS (i.e., more than one router can get a certificate for the AS and hence the private key is shared among more than one router). I guess the follow on question is whether we also point out that a = router could support more than one AS but having key pairs for each AS: Also note that routers can support multiple ASs with separate keys pairs one for each AS. or something like that? spt > --Sandy, speaking as regular ol' member >=20 >=20 > On Aug 12, 2014, at 8:47 PM, Sean Turner wrote: >=20 >> This version incorporates the change discussed at IETF 90 - namely = include one and only one AS in the certificate. >>=20 >> The working version is also available at: >> https://github.com/seanturner/draft-ietf-sidr-bgpsec-pki-profiles >>=20 >> spt >>=20 >> On Aug 12, 2014, at 20:44, internet-drafts@ietf.org wrote: >>=20 >>>=20 >>> A New Internet-Draft is available from the on-line Internet-Drafts = directories. >>> This draft is a work item of the Secure Inter-Domain Routing Working = Group of the IETF. >>>=20 >>> Title : A Profile for BGPSEC Router Certificates, = Certificate Revocation Lists, and Certification Requests >>> Authors : Mark Reynolds >>> Sean Turner >>> Steve Kent >>> Filename : draft-ietf-sidr-bgpsec-pki-profiles-08.txt >>> Pages : 13 >>> Date : 2014-08-12 >>>=20 >>> Abstract: >>> This document defines a standard profile for X.509 certificates for >>> the purposes of supporting validation of Autonomous System (AS) = paths >>> in the Border Gateway Protocol (BGP), as part of an extension to = that >>> protocol known as BGPSEC. BGP is a critical component for the = proper >>> operation of the Internet as a whole. The BGPSEC protocol is under >>> development as a component to address the requirement to provide >>> security for the BGP protocol. The goal of BGPSEC is to design a >>> protocol for full AS path validation based on the use of strong >>> cryptographic primitives. The End-Entity (EE) certificates = specified >>> by this profile are issued under Resource Public Key Infrastructure >>> (RPKI) Certification Authority (CA) certificates, containing the AS >>> Identifier Delegation extension, to routers within the Autonomous >>> System (AS). The certificate asserts that the router(s) holding the >>> private key are authorized to send out secure route advertisements = on >>> behalf of the specified AS. This document also profiles the >>> Certificate Revocation List (CRL), profiles the format of >>> certification requests, and specifies Relying Party certificate path >>> validation procedures. The document extends the RPKI; therefore, >>> this documents updates the RPKI Resource Certificates Profile (RFC >>> 6487). >>>=20 >>>=20 >>> The IETF datatracker status page for this draft is: >>> = https://datatracker.ietf.org/doc/draft-ietf-sidr-bgpsec-pki-profiles/ >>>=20 >>> There's also a htmlized version available at: >>> http://tools.ietf.org/html/draft-ietf-sidr-bgpsec-pki-profiles-08 >>>=20 >>> A diff from the previous version is available at: >>> = http://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-sidr-bgpsec-pki-profiles-08 >>>=20 >>>=20 >>> Please note that it may take a couple of minutes from the time of = submission >>> until the htmlized version and diff are available at tools.ietf.org. >>>=20 >>> Internet-Drafts are also available by anonymous FTP at: >>> ftp://ftp.ietf.org/internet-drafts/ >>>=20 >>> _______________________________________________ >>> I-D-Announce mailing list >>> I-D-Announce@ietf.org >>> https://www.ietf.org/mailman/listinfo/i-d-announce >>> Internet-Draft directories: http://www.ietf.org/shadow.html >>> or ftp://ftp.ietf.org/ietf/1shadow-sites.txt >>=20 >> _______________________________________________ >> sidr mailing list >> sidr@ietf.org >> https://www.ietf.org/mailman/listinfo/sidr >=20 From nobody Tue Oct 7 23:48:15 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 765151A0055 for ; Tue, 7 Oct 2014 23:48:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.686 X-Spam-Level: X-Spam-Status: No, score=-2.686 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.786] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w1BWhOeUu6y2 for ; Tue, 7 Oct 2014 23:48:12 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 731E11A004D for ; Tue, 7 Oct 2014 23:48:12 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.82) (envelope-from ) id 1Xbl2g-0005pr-DG; Wed, 08 Oct 2014 06:48:10 +0000 Date: Wed, 08 Oct 2014 02:48:08 -0400 Message-ID: From: Randy Bush To: Sean Turner In-Reply-To: <8BFAD7DD-7CEA-4720-86BB-09407C6C543D@ieca.com> References: <20140813004442.10560.45299.idtracker@ietfa.amsl.com> <4556FA63-A6FD-471B-93FD-51D748C94EE8@tislabs.com> <8BFAD7DD-7CEA-4720-86BB-09407C6C543D@ieca.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/w0WLrH6Bzz6QuMQhdzb9w11S5YU Cc: sidr wg list , Sandra Murphy Subject: Re: [sidr] I-D Action: draft-ietf-sidr-bgpsec-pki-profiles-08.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Oct 2014 06:48:13 -0000 > Yep the issuer always gets to determine the subject name as per RFC > 6487 s4.5 so how about we just leave that bit out and make that > sentence a note: > > Note that more than one certificate can be issued to > an AS (i.e., more than one router can get a certificate > for the AS and hence the private key is shared among > more than one router). > > I guess the follow on question is whether we also point out that a > router could support more than one AS but having key pairs for each > AS: > > Also note that routers can support multiple ASs with > separate keys pairs one for each AS. > > or something like that? i think i understand it and it makes sense. though i would tersify it to Rrouters can support multiple ASs with separate keys pairs, one for each AS :) randy From nobody Wed Oct 8 00:38:34 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C4CA1A00B7 for ; Wed, 8 Oct 2014 00:38:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.738 X-Spam-Level: X-Spam-Status: No, score=-2.738 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, HELO_EQ_DE=0.35, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.786, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NPAoA1WfYgnX for ; Wed, 8 Oct 2014 00:38:26 -0700 (PDT) Received: from outpost1.zedat.fu-berlin.de (outpost1.zedat.fu-berlin.de [130.133.4.66]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3CDF21A0072 for ; Wed, 8 Oct 2014 00:38:26 -0700 (PDT) Received: from inpost2.zedat.fu-berlin.de ([130.133.4.69]) by outpost.zedat.fu-berlin.de (Exim 4.82) for sidr@ietf.org with esmtp (envelope-from ) id <1XblpI-003mPr-KG>; Wed, 08 Oct 2014 09:38:24 +0200 Received: from [141.22.28.145] (helo=mw-PC.cpt.haw-hamburg.de) by inpost2.zedat.fu-berlin.de (Exim 4.82) for sidr@ietf.org with esmtpsa (envelope-from ) id <1XblpI-002ch7-It>; Wed, 08 Oct 2014 09:38:24 +0200 Date: Wed, 8 Oct 2014 09:36:22 +0200 From: Matthias Waehlisch To: sidr wg list In-Reply-To: Message-ID: References: User-Agent: Alpine 2.00 (WNT 1167 2008-08-23) X-X-Sender: waehl@mail.zedat.fu-berlin.de MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Originating-IP: 141.22.28.145 Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/bgk2A-HCyr3u4WkYbqgAcHAOOyc Subject: Re: [sidr] Survey about RPKI/DNSSEC X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Oct 2014 07:38:28 -0000 Hi folks, we already received 140 replies. Many thanks! We hope to gather some more responses. If you didn't participate in the survey so far, please help us to better understand the deployment of RPKI and DNSSEC: http://eSurv.org?u=rpkidnssec The survey is anonymous and should not take more than 5 minutes to commplete. Thanks matthias On Fri, 19 Sep 2014, Matthias Waehlisch wrote: > Folks, > > we, a group of researchers, try to better understand the deployment of > RPKI and DNSSEC. It's not always easy to find technical reasons for what > we observe. To get more insights why you deploy or don't deploy RPKI or > DNSSEC, we would like to ask you to participate in the following brief > survey: > > http://eSurv.org?u=rpkidnssec > > We really appreciate your time. It should not take more than 5 minutes > to complete the survey. > > The survey is anonymous. The results are only used to improve research > on inter-networking. If there is interest, we will post the results to > the list. > > Fell free to contact me offlist in case of further questions or > comments. > > > Many thanks! > > matthias > (on behalf of the team) > > > [This email has also been sent to RIPE and NANOG folks.] > > > -- Matthias Waehlisch . Freie Universitaet Berlin, Inst. fuer Informatik, AG CST . Takustr. 9, D-14195 Berlin, Germany .. mailto:waehlisch@ieee.org .. http://www.inf.fu-berlin.de/~waehl :. Also: http://inet.cpt.haw-hamburg.de .. http://www.link-lab.net From nobody Wed Oct 8 06:50:25 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 80ACC1A03F9 for ; Wed, 8 Oct 2014 06:50:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.378 X-Spam-Level: X-Spam-Status: No, score=-1.378 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3M0uJh006p7A for ; Wed, 8 Oct 2014 06:50:21 -0700 (PDT) Received: from mail-yh0-x232.google.com (mail-yh0-x232.google.com [IPv6:2607:f8b0:4002:c01::232]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0152D1A1A8D for ; Wed, 8 Oct 2014 06:50:20 -0700 (PDT) Received: by mail-yh0-f50.google.com with SMTP id a41so3950428yho.37 for ; Wed, 08 Oct 2014 06:50:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20120113; h=mime-version:date:message-id:subject:from:to:content-type; bh=zHBE23C48pHwNBjRyOTI6c9GkzUrd3pZ2Ph+4Ausd98=; b=XkhHKwCFZhnfVdfIxehtvsgA4sfmGTBu2N8k86ULq5ZnfUYsP8oXdzf5jDF6zcMEuj bQAYQRr3bbBqQt9tNNTf9Y2dw1b1+lPE+Y+rmjCAP47s6b5Pjci5F9Y4QMKWuk6leEu2 EfE3c2dGUtzambaMngfAzmIlTEFiXAalc+XcUIRikHvb6OMSgB3jI4U6kaHZzmoxxa93 8/jkxyOuEtMPqn6xlKl7bRe6EaaOzokHRfC4BDFRZOgqWVYocXHtl6mkGWtxznk0mEzD VYErEIgpE3/1lXnmp2BNEDNBvdMmUue6mpw0f/CBDc0yYpN+VumAFVYN0AOQ9vx7rbrz r2yg== MIME-Version: 1.0 X-Received: by 10.236.102.74 with SMTP id c50mr3198937yhg.167.1412776220274; Wed, 08 Oct 2014 06:50:20 -0700 (PDT) Received: by 10.170.186.3 with HTTP; Wed, 8 Oct 2014 06:50:20 -0700 (PDT) Date: Wed, 8 Oct 2014 15:50:20 +0200 Message-ID: From: Andreas Reuter To: sidr@ietf.org Content-Type: text/plain; charset=UTF-8 Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/uXb7flH0gj_coN6O6hddcvxiUtY Subject: [sidr] RFC 6487 possible oversight X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Oct 2014 13:50:23 -0000 Hi, I came across a (possible) oversight in RFC 6487, Section 4.4 about the issuer field: > An issuer name MUST contain one instance of the CommonName attribute > and MAY contain one instance of the serialNumber attribute. If both > attributes are present, it is RECOMMENDED that they appear as a set. > The CommonName attribute MUST be encoded using the ASN.1 type > PrintableString [X.680]. This wording does not define the encoding of the serialNumber attribute. While mailing with Rob he told me that the serialNumber came later into the spec, and most likely the definition has been just forgotten. Can someone from the authors clarify? From nobody Wed Oct 8 08:30:40 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BB0B41A6EF4 for ; Wed, 8 Oct 2014 08:30:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.133 X-Spam-Level: * X-Spam-Status: No, score=1.133 tagged_above=-999 required=5 tests=[BAYES_50=0.8, IP_NOT_FRIENDLY=0.334, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2RCZkNTZ-5bL for ; Wed, 8 Oct 2014 08:30:36 -0700 (PDT) Received: from gateway07.websitewelcome.com (gateway07.websitewelcome.com [67.18.66.25]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E40961A1B91 for ; Wed, 8 Oct 2014 08:30:35 -0700 (PDT) Received: by gateway07.websitewelcome.com (Postfix, from userid 5007) id 9C259D40A2D4C; Wed, 8 Oct 2014 10:30:34 -0500 (CDT) Received: from gator3286.hostgator.com (gator3286.hostgator.com [198.57.247.250]) by gateway07.websitewelcome.com (Postfix) with ESMTP id 8CBCDD40A2D28 for ; Wed, 8 Oct 2014 10:30:34 -0500 (CDT) Received: from [173.73.121.234] (port=56145 helo=[192.168.1.7]) by gator3286.hostgator.com with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.82) (envelope-from ) id 1XbtCD-0003SO-PA; Wed, 08 Oct 2014 10:30:33 -0500 Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) From: Sean Turner In-Reply-To: Date: Wed, 8 Oct 2014 11:30:29 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: References: To: Andreas Reuter X-Mailer: Apple Mail (2.1878.6) X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - gator3286.hostgator.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - ieca.com X-BWhitelist: no X-Source-IP: 173.73.121.234 X-Exim-ID: 1XbtCD-0003SO-PA X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: ([192.168.1.7]) [173.73.121.234]:56145 X-Source-Auth: sean.turner@ieca.com X-Email-Count: 1 X-Source-Cap: ZG9tbWdyNDg7ZG9tbWdyNDg7Z2F0b3IzMjg2Lmhvc3RnYXRvci5jb20= Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/Dx3k7DrwJD_ZHqb7O0dqMWw3srY Cc: sidr@ietf.org Subject: Re: [sidr] RFC 6487 possible oversight X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Oct 2014 15:30:39 -0000 On Oct 08, 2014, at 09:50, Andreas Reuter = wrote: > Hi, >=20 > I came across a (possible) oversight in RFC 6487, Section 4.4 about > the issuer field: >=20 >> An issuer name MUST contain one instance of the CommonName = attribute >> and MAY contain one instance of the serialNumber attribute. If = both >> attributes are present, it is RECOMMENDED that they appear as a = set. >> The CommonName attribute MUST be encoded using the ASN.1 type >> PrintableString [X.680]. >=20 > This wording does not define the encoding of the serialNumber > attribute. >=20 > While mailing with Rob he told me that the serialNumber came later > into the spec, and most likely the definition has been just forgotten. > Can someone from the authors clarify? I think it=92s right as is. RFC 5280 has the definition for serial number: -- Naming attributes of type X520SerialNumber id-at-serialNumber AttributeType ::=3D { id-at 5 } X520SerialNumber ::=3D PrintableString (SIZE (1..ub-serial-number)) So there=92s no need to say it=92s printable string because it always is = printable string. When you specify a common name you need say which of = the permitted encodings you want because there=92s a choice of 5 string = types: -- Naming attributes of type X520CommonName id-at-commonName AttributeType ::=3D { id-at 3 } -- Naming attributes of type X520CommonName: -- X520CommonName ::=3D DirectoryName (SIZE (1..ub-common-name)) -- -- Expanded to avoid parameterized type: X520CommonName ::=3D CHOICE { teletexString TeletexString (SIZE (1..ub-common-name)), printableString PrintableString (SIZE (1..ub-common-name)), universalString UniversalString (SIZE (1..ub-common-name)), utf8String UTF8String (SIZE (1..ub-common-name)), bmpString BMPString (SIZE (1..ub-common-name)) } spt= From nobody Wed Oct 8 09:02:31 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1FFBC1A0301 for ; Wed, 8 Oct 2014 09:02:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.686 X-Spam-Level: X-Spam-Status: No, score=-2.686 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.786] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id i53vnWg7YyK0 for ; Wed, 8 Oct 2014 09:02:28 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F06351A8732 for ; Wed, 8 Oct 2014 09:01:56 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.82) (envelope-from ) id 1XbtgZ-0007FI-Lf; Wed, 08 Oct 2014 16:01:55 +0000 Date: Wed, 08 Oct 2014 12:01:55 -0400 Message-ID: From: Randy Bush To: Sean Turner In-Reply-To: References: User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/MeAMQZDrzHeDyoUJ5hSL-z7cOxE Cc: sidr wg list Subject: Re: [sidr] RFC 6487 possible oversight X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Oct 2014 16:02:29 -0000 > RFC 5280 has the definition for serial number: while i am an advocate for references as opposed to redundancy in rfcs, i gotta say chasing the refs in this corner of the universe makes me even crazier than usual. randy From nobody Wed Oct 8 17:22:03 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EE4CE1A8712 for ; Wed, 8 Oct 2014 17:22:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.687 X-Spam-Level: X-Spam-Status: No, score=-2.687 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.786, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S22nIKiIdnPQ for ; Wed, 8 Oct 2014 17:21:57 -0700 (PDT) Received: from out.west.pexch112.icann.org (pfe112-ca-2.pexch112.icann.org [64.78.40.10]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E35951A8718 for ; Wed, 8 Oct 2014 17:21:57 -0700 (PDT) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) with Microsoft SMTP Server (TLS) id 15.0.847.32; Wed, 8 Oct 2014 17:21:55 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.0847.030; Wed, 8 Oct 2014 17:21:55 -0700 From: Terry Manderson To: "sidr@ietf.org" Thread-Topic: A draft seeking guidance. Thread-Index: AQHP41cHP2+PD6jVzEuovxJBFW/zFw== Date: Thu, 9 Oct 2014 00:21:54 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.4.4.140807 x-originating-ip: [58.107.31.48] Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="B_3495694929_22742467" MIME-Version: 1.0 Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/ao6MangWCRxCFRxAa-iUsKLM28Q Subject: [sidr] A draft seeking guidance. X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Oct 2014 00:22:01 -0000 --B_3495694929_22742467 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit Hi All, As you are probably aware ICANN has been following the SIDR work fairly closely, based in the IAB guidance that a single authoritative trust anchor should exist - what we term as the Global Trust Anchor (GTA). In the process of looking at the implementation of this, the GTA, and the technical concerns relating to stability and resiliency, a few questions have bubbled to the surface over the past year. Instead of sitting on our hands and not communicating to the WG we thought it best to raise what we are thinking and seek a discussion. Thus we would very much like the WG guidance and advice on these questions. We have created a draft to raise these discussion points. http://tools.ietf.org/html/draft-vegoda-manderson-sidr-key-management-00 Are there simple answers? and if so, what are they? Have we mis-charatcerised some concerns? How? Are our concerns unfounded? and why? Are there more concerns that people see and which we haven't covered here? Cheers Terry and Leo --B_3495694929_22742467 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIITvAYJKoZIhvcNAQcCoIITrTCCE6kCAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3DQEHAaCC EYgwggcDMIIF66ADAgECAhAPz2lJUZsAlD35l4oJxf0FMA0GCSqGSIb3DQEBBQUAMGIxCzAJ BgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2Vy dC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0IEFzc3VyZWQgSUQgQ0EtMTAeFw0xMjAzMjcwMDAw MDBaFw0xNTAzMjcxMjAwMDBaMIGsMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5p YTEXMBUGA1UEBxMOTWFyaW5hIGRlbCBSZXkxPDA6BgNVBAoTM0ludGVybmV0IENvcnBvcmF0 aW9uIGZvciBBc3NpZ25lZCBOYW1lcyBhbmQgTnVtYmVyczEXMBUGA1UECxMORE5TIE9wZXJh dGlvbnMxGDAWBgNVBAMTD1RlcnJ5IE1hbmRlcnNvbjCCASIwDQYJKoZIhvcNAQEBBQADggEP ADCCAQoCggEBAKRhZ4W3U6MnfS2woYEFCIyN+g1MNILokbUKk+PTl5mmK3QtWQxTSOu2sdzN xHMy6p2RoT9BMGOamttFq2WswSru6/7JT1TflytGaPHfK5kMP/pI47hmcwUEm9Z169I5ar7z BTiEAQA06cGKtgJ8XiiLFUIHLVuRq3WGxjnFTHlAHXY6mdgDT/ntAnoEvvPVm4XqUnjJiZTS ojzyr1q2RqFvyXs2blOARumDqvLI33yLGcUuaEL+A+hgodzM/fL4kdoy964mXvmEerpm4d4f Y/JfbRUWxc0Eomu9nwGFNk6ijO41qk+OIboct2qeA+5PPclXJNNHYVfzT2dyWfGgxaMCAwEA AaOCA2gwggNkMB8GA1UdIwQYMBaAFBUAEisTmLKZB+0e36K+Vw0rZwLNMB0GA1UdDgQWBBSz wvR2YXpP9XjS9cknMX5g3LM2jTAkBgNVHREEHTAbgRl0ZXJyeS5tYW5kZXJzb25AaWNhbm4u b3JnMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDBAYIKwYBBQUHAwIwfQYD VR0fBHYwdDA4oDagNIYyaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0QXNzdXJl ZElEQ0EtMS5jcmwwOKA2oDSGMmh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEFz c3VyZWRJRENBLTEuY3JsMIIBxQYDVR0gBIIBvDCCAbgwggG0BgpghkgBhv1sBAECMIIBpDA6 BggrBgEFBQcCARYuaHR0cDovL3d3dy5kaWdpY2VydC5jb20vc3NsLWNwcy1yZXBvc2l0b3J5 Lmh0bTCCAWQGCCsGAQUFBwICMIIBVh6CAVIAQQBuAHkAIAB1AHMAZQAgAG8AZgAgAHQAaABp AHMAIABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAIABjAG8AbgBzAHQAaQB0AHUAdABlAHMAIABh AGMAYwBlAHAAdABhAG4AYwBlACAAbwBmACAAdABoAGUAIABEAGkAZwBpAEMAZQByAHQAIABD AFAALwBDAFAAUwAgAGEAbgBkACAAdABoAGUAIABSAGUAbAB5AGkAbgBnACAAUABhAHIAdAB5 ACAAQQBnAHIAZQBlAG0AZQBuAHQAIAB3AGgAaQBjAGgAIABsAGkAbQBpAHQAIABsAGkAYQBi AGkAbABpAHQAeQAgAGEAbgBkACAAYQByAGUAIABpAG4AYwBvAHIAcABvAHIAYQB0AGUAZAAg AGgAZQByAGUAaQBuACAAYgB5ACAAcgBlAGYAZQByAGUAbgBjAGUALjB3BggrBgEFBQcBAQRr MGkwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBBBggrBgEFBQcwAoY1 aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0QXNzdXJlZElEQ0EtMS5jcnQw DAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQUFAAOCAQEAYpwxK/KvdhbyQqrKp2ylMQpNzqVH ofo4hPILTnp/o+UyYVn6daWSilaV+XNBzE5Rm/f7ms2iA1zBzOvGv55pLH0n6lgIRTeuAGzf KIsPCwPvYQkkMAPXHzh9A44m19hvigTgOPNyjzcOTiHqwwCJSDTEZx17CEkrzQPq1vfG1Lvk +AWjEtxCsGmsuCHHaZjwQ8SsGI7W5cA1Y4RTcQf6S9eIpSsOwXIYdDgWq9Uhi/amW7ryW06Y GH7BHaitqgmm32MZuid3UzJUU6+Ljx7uGA9Fe6k1uPEHhaXTAoobPSpPdOgGmnxUCRQu2OI7 +I8vHiSe7DC/LmxEDC5kB+lUTjCCBsIwggWqoAMCAQICEAoE3yF0XU0rjOozcgUAUOkwDQYJ KoZIhvcNAQEFBQAwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcG A1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBS b290IENBMB4XDTA2MTExMDAwMDAwMFoXDTIxMTExMDAwMDAwMFowYjELMAkGA1UEBhMCVVMx FTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEhMB8G A1UEAxMYRGlnaUNlcnQgQXNzdXJlZCBJRCBDQS0xMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A MIIBCgKCAQEA6IItmfnKwkKVpYBzQHDSnlZUXKnE0kEGj8kz/E1FkVyBn+0snPgWWd+etSQV wpi5tHdJ3InECtqvy15r7a2wcTHrzzpADEZNk+yLejYIA6sMNP4YSYL+x8cxSIB8HqIPkg5Q ycaH6zY/2DDD/6b3+6LNb3Mj/qxWBZDwMiEWicZwiPkFl32jx0PdAug7Pe2xQaPtP77blUjE 7h6z8rwMK5nQxl0SQoHhg26Ccz8mSxSQrllmCsSNvtLOBq6thG9IhJtPQLnxTPKvmPv2zkBd XPao8S+v7Iki8msYZbHBc63X8djPHgp0XEK4aH631XcKJ1Z8D2KkPzIUYJX9BwSiCQIDAQAB o4IDbzCCA2swDgYDVR0PAQH/BAQDAgGGMDsGA1UdJQQ0MDIGCCsGAQUFBwMBBggrBgEFBQcD AgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCDCCAcYGA1UdIASCAb0wggG5MIIBtQYL YIZIAYb9bAEDAAQwggGkMDoGCCsGAQUFBwIBFi5odHRwOi8vd3d3LmRpZ2ljZXJ0LmNvbS9z c2wtY3BzLXJlcG9zaXRvcnkuaHRtMIIBZAYIKwYBBQUHAgIwggFWHoIBUgBBAG4AeQAgAHUA cwBlACAAbwBmACAAdABoAGkAcwAgAEMAZQByAHQAaQBmAGkAYwBhAHQAZQAgAGMAbwBuAHMA dABpAHQAdQB0AGUAcwAgAGEAYwBjAGUAcAB0AGEAbgBjAGUAIABvAGYAIAB0AGgAZQAgAEQA aQBnAGkAQwBlAHIAdAAgAEMAUAAvAEMAUABTACAAYQBuAGQAIAB0AGgAZQAgAFIAZQBsAHkA aQBuAGcAIABQAGEAcgB0AHkAIABBAGcAcgBlAGUAbQBlAG4AdAAgAHcAaABpAGMAaAAgAGwA aQBtAGkAdAAgAGwAaQBhAGIAaQBsAGkAdAB5ACAAYQBuAGQAIABhAHIAZQAgAGkAbgBjAG8A cgBwAG8AcgBhAHQAZQBkACAAaABlAHIAZQBpAG4AIABiAHkAIAByAGUAZgBlAHIAZQBuAGMA ZQAuMA8GA1UdEwEB/wQFMAMBAf8wfQYIKwYBBQUHAQEEcTBvMCQGCCsGAQUFBzABhhhodHRw Oi8vb2NzcC5kaWdpY2VydC5jb20wRwYIKwYBBQUHMAKGO2h0dHA6Ly93d3cuZGlnaWNlcnQu Y29tL0NBQ2VydHMvRGlnaUNlcnRBc3N1cmVkSURSb290Q0EuY3J0MIGBBgNVHR8EejB4MDqg OKA2hjRodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURSb290Q0Eu Y3JsMDqgOKA2hjRodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURS b290Q0EuY3JsMB0GA1UdDgQWBBQVABIrE5iymQftHt+ivlcNK2cCzTAfBgNVHSMEGDAWgBRF 66Kv9JLLgjEtUYunpyGd823IDzANBgkqhkiG9w0BAQUFAAOCAQEAhGFOQR64dgQqtbbvj/JV hbldVv4KmObkvWWKfUAp0/yxXUX9OrgqWzNLJFzNubTkc61hXXatdDOKZtUjr0wfcm5F2XVA u6I7z41JL8BBsOIpo1E4Q1CZFKwzBjViiX13qVIH5WwgV7aBum+8s8KU7XYCgNl8zoWoHOzH Q0pLsVfPcs7f9SU8yyJP/Z9S0TfLCLs4PuDVPm95Ca1bfDGzdzXD5GP5aAqYB+dGOHeE0j6X vAqgqKwlT0RukeHSWq9r7zAcjaNEQrMQiyP61+Y1dDesz+urWB/JiCP/NtQH6jRqR+qdlWye KU9T7eMrlSBOKs+WYHr4LIDwlVLOKZaBYjCCA7cwggKfoAMCAQICEAzn4OUX2Eb+j+Vg/Bvw MDkwDQYJKoZIhvcNAQEFBQAwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IElu YzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJl ZCBJRCBSb290IENBMB4XDTA2MTExMDAwMDAwMFoXDTMxMTExMDAwMDAwMFowZTELMAkGA1UE BhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNv bTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMIIBIjANBgkqhkiG9w0B AQEFAAOCAQ8AMIIBCgKCAQEArQ4VzuRDgFyxh/O3YPlxEqWu3CaUiKr0zvUgOShYYAz4gNqp FZUyYTy1sSiEiorcnwoMgxd6j5Csiud5U1wxhCr2D5gyNnbM3t08qKLvavsh8lJh358g1x/i sdn+GGTSEltf+VgYNbxHzaE2+Wt/1LA4PsEbw4wz2dgvGP4oD7Ong9bDbkTAYTWWFv5ZnIt2 bdfxoksNK/8LctqeYNCOkDXGeFWHIKHP5W0KyEl8MZgzbCLph9AyWqK6E4IR7TkXnZk6cqHm +qTZ1Rcxda6FfSKuPwFGhvYoecix2uRXF8R+HA6wtJKmVrO9spftqqfwt8WoP5UW0P+hlusI Xxh3TwIDAQABo2MwYTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4E FgQUReuir/SSy4IxLVGLp6chnfNtyA8wHwYDVR0jBBgwFoAUReuir/SSy4IxLVGLp6chnfNt yA8wDQYJKoZIhvcNAQEFBQADggEBAKIOvN/i7fDjcnN6ZJS/93Jm2DLkQnVirofr8tXZ3laz n8zOFCi5DZdgXBJMWOTTPYNJRViXNWkaqEfqVsZ5qxLYZ4GE338JPJTmuCYsIL09syiJ91// IuKXhB/pZe+H4N/BZ0mzXeuyCSrrJu14vn0/K/O3JjVtX4kBtklbnwEFm6s9JcHMtn/C8W+G xvpkaOuBLZTrQrf6jB7dYvG+UGe3bL3z8R9rDDYHFn83fKlbbXrxEkZgg9cnBL5Lzpe+w2cq aBHfgOcMM2a/Ew0UbvN/H2MQHvqNGyVtbI+lt2EBsdKjJqEQcZ2t4sP5w5lRtysHCM4u5lCy p/oKRS+i8PIxggH8MIIB+AIBATB2MGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2Vy dCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0IEFz c3VyZWQgSUQgQ0EtMQIQD89pSVGbAJQ9+ZeKCcX9BTAJBgUrDgMCGgUAoF0wIwYJKoZIhvcN AQkEMRYEFCxxhrabMcOGB9stUTBjmzsW7NGXMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEw HAYJKoZIhvcNAQkFMQ8XDTE0MTAwOTAwMjIwOVowDQYJKoZIhvcNAQEBBQAEggEAIeSdIUyo J3JgGcjuE0NnZGaaB2lekrdEalV9FztWsZDNj2vZ3nqnLBPiKpr85UCENhuWE2vaG0lJ6ytH jft1snfI+bp2JIZ2XJURtivBECpEkbiSQeT3RfDpPeZlwT0jZb7JZYROVKLddXBqs5ZwjU8Z zZIjMj40QNYWR7TN0A8T27aonBRlkXwN+jAaJ83GDQiAaNkJoewSuuWKQtcYifIv1D9GHwiG xWoAm8nbnXbxFEz1YxAkc1mkgQj4xc7+cYCTvjhlZoLGGCD5axIRGXKHkmkQ2w7PKSgma3dV mrWUG7WNVFRlm1Q+t7hPh0a35Agt/BgU0mnNHXNF66agbg== --B_3495694929_22742467-- From nobody Thu Oct 9 07:58:32 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5FB791ACF01 for ; Thu, 9 Oct 2014 07:58:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -15.287 X-Spam-Level: X-Spam-Status: No, score=-15.287 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.786, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GK892QzZqOSN for ; Thu, 9 Oct 2014 07:58:25 -0700 (PDT) Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E3A641A1B14 for ; Thu, 9 Oct 2014 07:58:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2462; q=dns/txt; s=iport; t=1412866706; x=1414076306; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=yhMJA6wOhtGkGjaZI1MlupwWqfwK3XoiZkoivX+X6a0=; b=lf6wKpyIoakURXVlzjffcI+GcSEgVUb4n8orsst67Gss5jNLMo9mviOL iQGL82UefE+FqxwT6JSDT+IsteS4239NX8JrAfY06LBjAktEBIEMlUHwp L0KA0MNTFdYe6sBx34jPFtlINJc8+JDgv80vUMNH5VyKP7r/KXL5e1Y1V o=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AicFAM2hNlStJV2Y/2dsb2JhbABggw5TWATLDAyHSwKBBxYBe4QEAQEDAQEBATc0CwULAgEIMQIDECcLJQIEDgWINggNwxwBF5ARMwcnAoMEgR4Fj1+CGoRChxCBapQng2NsZyEkHIECAQEB X-IronPort-AV: E=Sophos;i="5.04,685,1406592000"; d="scan'208";a="361724057" Received: from rcdn-core-1.cisco.com ([173.37.93.152]) by rcdn-iport-1.cisco.com with ESMTP; 09 Oct 2014 14:58:25 +0000 Received: from xhc-aln-x02.cisco.com (xhc-aln-x02.cisco.com [173.36.12.76]) by rcdn-core-1.cisco.com (8.14.5/8.14.5) with ESMTP id s99EwNkg030859 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Thu, 9 Oct 2014 14:58:23 GMT Received: from xmb-rcd-x02.cisco.com ([169.254.4.79]) by xhc-aln-x02.cisco.com ([173.36.12.76]) with mapi id 14.03.0195.001; Thu, 9 Oct 2014 09:58:23 -0500 From: "Roque Gagliano (rogaglia)" To: Terry Manderson Thread-Topic: [sidr] A draft seeking guidance. Thread-Index: AQHP49F4QoebNITr4ki0Sb8h6ujW9w== Date: Thu, 9 Oct 2014 14:58:22 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.148.51.51] Content-Type: text/plain; charset="us-ascii" Content-ID: <862C15699BC41540B18AE7DEDCEC0099@emea.cisco.com> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/9gwUOARQ7Z88Q60kWdzmPsPrQzk Cc: "sidr@ietf.org" Subject: Re: [sidr] A draft seeking guidance. X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Oct 2014 14:58:28 -0000 Hi Terry, Thanks for this effort. Overall I think there are good points that you raise. However, I am struggling with the relevance from a CA perspective of Sectio= n 7 (Communication from validators to objects signers regarding validation = status). Validation is a local process done from RPs. There are many reason= s why validation may fail and many of them good reasons. Are you expecting = a massive Big Brother system of all validator reporting results back to IAN= A?=20 BTW, I know RIPE has this option but I take it as something they want to ke= ep tracking during the boot-up process. In general I would assume that ever= y CA (like any other entity with a product) is interesting in testing its= products (signed objects) before making them public. Moreover, current key= -rollover/algorithm rollover mechanism assume an overlap period where OLD a= nd NEW products overlap in time to prevent any problem. All in all, what I would recommend you is to verify that the current key-ro= llover/algorithm roll-over documents are adequate for IANA considering that= IANA will test its signed objects adequately. Roque On 09 Oct 2014, at 02:21, Terry Manderson wrote= : > Hi All, >=20 > As you are probably aware ICANN has been following the SIDR work fairly > closely, based in the IAB guidance that a single authoritative trust > anchor should exist - what we term as the Global Trust Anchor (GTA). >=20 > In the process of looking at the implementation of this, the GTA, and the > technical concerns relating to stability and resiliency, a few questions > have bubbled to the surface over the past year. Instead of sitting on our > hands and not communicating to the WG we thought it best to raise what we > are thinking and seek a discussion. Thus we would very much like the WG > guidance and advice on these questions. >=20 > We have created a draft to raise these discussion points. >=20 > http://tools.ietf.org/html/draft-vegoda-manderson-sidr-key-management-00 >=20 > Are there simple answers? and if so, what are they? Have we > mis-charatcerised some concerns? How? Are our concerns unfounded? and why= ? > Are there more concerns that people see and which we haven't covered here= ? >=20 > Cheers > Terry and Leo > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr From nobody Thu Oct 9 14:44:47 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8B4B81A88D3 for ; Thu, 9 Oct 2014 14:44:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.486 X-Spam-Level: X-Spam-Status: No, score=-1.486 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, J_CHICKENPOX_21=0.6, J_CHICKENPOX_51=0.6, RP_MATCHES_RCVD=-0.786] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H4nW00YIPybD for ; Thu, 9 Oct 2014 14:44:45 -0700 (PDT) Received: from adrilankha.hactrn.net (adrilankha.hactrn.net [IPv6:2001:418:1::19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E52D11A889B for ; Thu, 9 Oct 2014 14:44:44 -0700 (PDT) Received: from minas-ithil.hactrn.net (unknown [207.158.132.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "nargothrond.hactrn.net", Issuer "Grunchweather Associates" (verified OK)) by adrilankha.hactrn.net (Postfix) with ESMTPS id A4E0C39824; Thu, 9 Oct 2014 21:44:44 +0000 (UTC) Received: from minas-ithil.hactrn.net (localhost [IPv6:::1]) by minas-ithil.hactrn.net (Postfix) with ESMTP id 038A8135807C; Thu, 9 Oct 2014 17:44:51 -0400 (EDT) Date: Thu, 09 Oct 2014 17:44:50 -0400 From: Rob Austein To: Sean Turner In-Reply-To: References: User-Agent: Wanderlust/2.15.5 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Message-Id: <20141009214451.038A8135807C@minas-ithil.hactrn.net> Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/SWRSrPjSxlkTyvSS2rfdxkm9vqo Cc: sidr@ietf.org Subject: Re: [sidr] RFC 6487 possible oversight X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Oct 2014 21:44:45 -0000 At Wed, 8 Oct 2014 11:30:29 -0400, Sean Turner wrote: >=20 > I think it?s right as is. >=20 > RFC 5280 has the definition for serial number: >=20 > X520SerialNumber ::=3D PrintableString (SIZE (1..ub-serial-number)) >=20 > So there?s no need to say it?s printable string because it always is prin= table string. My bad, I didn't think to check RFC 5280. I agree that the text in RFC 5280 nails it down to PrintableString and that there's no need for a change to RFC 6487. From nobody Sun Oct 12 17:32:39 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1739B1A6FA3 for ; Sun, 12 Oct 2014 17:32:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.788 X-Spam-Level: X-Spam-Status: No, score=-0.788 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, RP_MATCHES_RCVD=-0.786, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aWDFbrKc6HLE for ; Sun, 12 Oct 2014 17:32:35 -0700 (PDT) Received: from out.west.pexch112.icann.org (pfe112-ca-1.pexch112.icann.org [64.78.40.7]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BCAD01A6F62 for ; Sun, 12 Oct 2014 17:32:35 -0700 (PDT) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-2.pexch112.icann.org (64.78.40.23) with Microsoft SMTP Server (TLS) id 15.0.847.32; Sun, 12 Oct 2014 17:32:32 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.0847.030; Sun, 12 Oct 2014 17:32:33 -0700 From: Leo Vegoda To: "Roque Gagliano (rogaglia)" , Terry Manderson Thread-Topic: [sidr] A draft seeking guidance. Thread-Index: AQHP41cHP2+PD6jVzEuovxJBFW/zF5woUZoAgATdW4A= Date: Mon, 13 Oct 2014 00:32:32 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [172.250.16.206] Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=SHA1; boundary="----=_NextPart_000_0129_01CFE642.80262FD0" MIME-Version: 1.0 Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/K_yLyNYN3TVVyxLkYxktcjawGUc Cc: "sidr@ietf.org" Subject: Re: [sidr] A draft seeking guidance. X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Oct 2014 00:32:38 -0000 ------=_NextPart_000_0129_01CFE642.80262FD0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Hi Roque, Roque Gagliano (rogaglia) wrote: [...] > However, I am struggling with the relevance from a CA perspective of > Section 7 (Communication from validators to objects signers regarding > validation status). Validation is a local process done from RPs. There > are many reasons why validation may fail and many of them good > reasons. Are you expecting a massive Big Brother system of all validator > reporting results back to IANA? No, we weren't envisaging that there would be a central repository of all validation failure reports. I want to reiterate that we are seeking advice on whether it is important for certificate owners and object signers to know if validation fails because of something they have done. I was thinking that letting the resource owner know that its certificate or ROA failed validation and why could be helpful to the resource owner and help minimize routing failures based on validation failures. Regards, Leo ------=_NextPart_000_0129_01CFE642.80262FD0 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIRfzCCA7cw ggKfoAMCAQICEAzn4OUX2Eb+j+Vg/BvwMDkwDQYJKoZIhvcNAQEFBQAwZTELMAkGA1UEBhMCVVMx FTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UE AxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMB4XDTA2MTExMDAwMDAwMFoXDTMxMTExMDAw MDAwMFowZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBSb290IENBMIIBIjAN BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArQ4VzuRDgFyxh/O3YPlxEqWu3CaUiKr0zvUgOShY YAz4gNqpFZUyYTy1sSiEiorcnwoMgxd6j5Csiud5U1wxhCr2D5gyNnbM3t08qKLvavsh8lJh358g 1x/isdn+GGTSEltf+VgYNbxHzaE2+Wt/1LA4PsEbw4wz2dgvGP4oD7Ong9bDbkTAYTWWFv5ZnIt2 bdfxoksNK/8LctqeYNCOkDXGeFWHIKHP5W0KyEl8MZgzbCLph9AyWqK6E4IR7TkXnZk6cqHm+qTZ 1Rcxda6FfSKuPwFGhvYoecix2uRXF8R+HA6wtJKmVrO9spftqqfwt8WoP5UW0P+hlusIXxh3TwID AQABo2MwYTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUReuir/SS y4IxLVGLp6chnfNtyA8wHwYDVR0jBBgwFoAUReuir/SSy4IxLVGLp6chnfNtyA8wDQYJKoZIhvcN AQEFBQADggEBAKIOvN/i7fDjcnN6ZJS/93Jm2DLkQnVirofr8tXZ3lazn8zOFCi5DZdgXBJMWOTT PYNJRViXNWkaqEfqVsZ5qxLYZ4GE338JPJTmuCYsIL09syiJ91//IuKXhB/pZe+H4N/BZ0mzXeuy CSrrJu14vn0/K/O3JjVtX4kBtklbnwEFm6s9JcHMtn/C8W+GxvpkaOuBLZTrQrf6jB7dYvG+UGe3 bL3z8R9rDDYHFn83fKlbbXrxEkZgg9cnBL5Lzpe+w2cqaBHfgOcMM2a/Ew0UbvN/H2MQHvqNGyVt bI+lt2EBsdKjJqEQcZ2t4sP5w5lRtysHCM4u5lCyp/oKRS+i8PIwggbNMIIFtaADAgECAhAG/fkD lgOt6gAK6z8nu7obMA0GCSqGSIb3DQEBBQUAMGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdp Q2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAiBgNVBAMTG0RpZ2lDZXJ0IEFz c3VyZWQgSUQgUm9vdCBDQTAeFw0wNjExMTAwMDAwMDBaFw0yMTExMTAwMDAwMDBaMGIxCzAJBgNV BAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20x ITAfBgNVBAMTGERpZ2lDZXJ0IEFzc3VyZWQgSUQgQ0EtMTCCASIwDQYJKoZIhvcNAQEBBQADggEP ADCCAQoCggEBAOiCLZn5ysJClaWAc0Bw0p5WVFypxNJBBo/JM/xNRZFcgZ/tLJz4FlnfnrUkFcKY ubR3SdyJxArar8tea+2tsHEx6886QAxGTZPsi3o2CAOrDDT+GEmC/sfHMUiAfB6iD5IOUMnGh+s2 P9gww/+m9/uizW9zI/6sVgWQ8DIhFonGcIj5BZd9o8dD3QLoOz3tsUGj7T++25VIxO4es/K8DCuZ 0MZdEkKB4YNugnM/JksUkK5ZZgrEjb7SzgaurYRvSISbT0C58Uzyr5j79s5AXVz2qPEvr+yJIvJr GGWxwXOt1/HYzx4KdFxCuGh+t9V3CidWfA9ipD8yFGCV/QcEogkCAwEAAaOCA3owggN2MA4GA1Ud DwEB/wQEAwIBhjA7BgNVHSUENDAyBggrBgEFBQcDAQYIKwYBBQUHAwIGCCsGAQUFBwMDBggrBgEF BQcDBAYIKwYBBQUHAwgwggHSBgNVHSAEggHJMIIBxTCCAbQGCmCGSAGG/WwAAQQwggGkMDoGCCsG AQUFBwIBFi5odHRwOi8vd3d3LmRpZ2ljZXJ0LmNvbS9zc2wtY3BzLXJlcG9zaXRvcnkuaHRtMIIB ZAYIKwYBBQUHAgIwggFWHoIBUgBBAG4AeQAgAHUAcwBlACAAbwBmACAAdABoAGkAcwAgAEMAZQBy AHQAaQBmAGkAYwBhAHQAZQAgAGMAbwBuAHMAdABpAHQAdQB0AGUAcwAgAGEAYwBjAGUAcAB0AGEA bgBjAGUAIABvAGYAIAB0AGgAZQAgAEQAaQBnAGkAQwBlAHIAdAAgAEMAUAAvAEMAUABTACAAYQBu AGQAIAB0AGgAZQAgAFIAZQBsAHkAaQBuAGcAIABQAGEAcgB0AHkAIABBAGcAcgBlAGUAbQBlAG4A dAAgAHcAaABpAGMAaAAgAGwAaQBtAGkAdAAgAGwAaQBhAGIAaQBsAGkAdAB5ACAAYQBuAGQAIABh AHIAZQAgAGkAbgBjAG8AcgBwAG8AcgBhAHQAZQBkACAAaABlAHIAZQBpAG4AIABiAHkAIAByAGUA ZgBlAHIAZQBuAGMAZQAuMAsGCWCGSAGG/WwDFTASBgNVHRMBAf8ECDAGAQH/AgEAMHkGCCsGAQUF BwEBBG0wazAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEMGCCsGAQUFBzAC hjdodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURSb290Q0EuY3J0 MIGBBgNVHR8EejB4MDqgOKA2hjRodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1 cmVkSURSb290Q0EuY3JsMDqgOKA2hjRodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRB c3N1cmVkSURSb290Q0EuY3JsMB0GA1UdDgQWBBQVABIrE5iymQftHt+ivlcNK2cCzTAfBgNVHSME GDAWgBRF66Kv9JLLgjEtUYunpyGd823IDzANBgkqhkiG9w0BAQUFAAOCAQEARlA+ybcoJKc4HbZb Ka9Sz1LpMUerVlx71Q0LQbPv7HUfdDjyslxhopyVw1Dkgrkj0bo6hnKtOHisdV0XFzRyR4WUVtHr uzaEd8wkpfMEGVWp5+Pnq2LN+4stkMLA0rWUvV5PsQXSDj0aqRRbpoYxYqioM+SbOafE9c4deHaU JXPkKqvPnHZL7V/CSxbkS3BMAIke/MV5vEwSV/5f4R68Al2o/vsHOE8Nxl2RuQ9nRc3Wg+3nkg2N sWmMT/tZ4CMP0qquAHzunEIOz5HXJ7cW7g/DvXwKoO4sCFWFIrjrGBpN/CohrUkxg0eVd3HcsRtL SxwQnHcUwZ1PL1qVCCkQJjCCBu8wggXXoAMCAQICEAmikGzxxvIMBd9PYyGKsbkwDQYJKoZIhvcN AQEFBQAwYjELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3 LmRpZ2ljZXJ0LmNvbTEhMB8GA1UEAxMYRGlnaUNlcnQgQXNzdXJlZCBJRCBDQS0xMB4XDTEyMDQx OTAwMDAwMFoXDTE1MDQxOTEyMDAwMFowgZ0xCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9y bmlhMRcwFQYDVQQHEw5NYXJpbmEgZGVsIFJleTE8MDoGA1UEChMzSW50ZXJuZXQgQ29ycG9yYXRp b24gZm9yIEFzc2lnbmVkIE5hbWVzIGFuZCBOdW1iZXJzMQ0wCwYDVQQLEwRJQU5BMRMwEQYDVQQD EwpMZW8gVmVnb2RhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsIUmGgavivswQIL8 JZT5Wgt+ngArvy8YrEUqVehgVTeefuv8Xcnf5Fe4gXakjLAV99amHl7fQd0i+K6pwHsQSNi5ffqd z1xae39j7Apn8A64LatEuKlMhEKKGHp8z0KNQHp4U1zSTCrmda2Cp6orzKonYWw3hD6U4+uSTwVR Hsar6LLXWskzrsWKfLzgDuGXXorTj/CsIfd1RqmSa9q/gQ8gWFf/gkkV0a9uSpLVyLEeltCV7krf VJ01gCZbptxToKoqCHKR50YpmW9E66BlTeB33rL00gLfE2WrwiEm6t5f8NRelY82TMkQxxgR99p5 frIEx6XWhG0V4xs5TdMDEQIDAQABo4IDYzCCA18wHwYDVR0jBBgwFoAUFQASKxOYspkH7R7for5X DStnAs0wHQYDVR0OBBYEFE4+04DSX9o5Qv6xycNaafTyRJVZMB8GA1UdEQQYMBaBFGxlby52ZWdv ZGFAaWNhbm4ub3JnMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDBAYIKwYBBQUH AwIwfQYDVR0fBHYwdDA4oDagNIYyaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0QXNz dXJlZElEQ0EtMS5jcmwwOKA2oDSGMmh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEFz c3VyZWRJRENBLTEuY3JsMIIBxQYDVR0gBIIBvDCCAbgwggG0BgpghkgBhv1sBAECMIIBpDA6Bggr BgEFBQcCARYuaHR0cDovL3d3dy5kaWdpY2VydC5jb20vc3NsLWNwcy1yZXBvc2l0b3J5Lmh0bTCC AWQGCCsGAQUFBwICMIIBVh6CAVIAQQBuAHkAIAB1AHMAZQAgAG8AZgAgAHQAaABpAHMAIABDAGUA cgB0AGkAZgBpAGMAYQB0AGUAIABjAG8AbgBzAHQAaQB0AHUAdABlAHMAIABhAGMAYwBlAHAAdABh AG4AYwBlACAAbwBmACAAdABoAGUAIABEAGkAZwBpAEMAZQByAHQAIABDAFAALwBDAFAAUwAgAGEA bgBkACAAdABoAGUAIABSAGUAbAB5AGkAbgBnACAAUABhAHIAdAB5ACAAQQBnAHIAZQBlAG0AZQBu AHQAIAB3AGgAaQBjAGgAIABsAGkAbQBpAHQAIABsAGkAYQBiAGkAbABpAHQAeQAgAGEAbgBkACAA YQByAGUAIABpAG4AYwBvAHIAcABvAHIAYQB0AGUAZAAgAGgAZQByAGUAaQBuACAAYgB5ACAAcgBl AGYAZQByAGUAbgBjAGUALjB3BggrBgEFBQcBAQRrMGkwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3Nw LmRpZ2ljZXJ0LmNvbTBBBggrBgEFBQcwAoY1aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0Rp Z2lDZXJ0QXNzdXJlZElEQ0EtMS5jcnQwDAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQUFAAOCAQEA VN4mVoZkm08GF7JKGVvt2zFb/aFODAeOjG85lmeIM9HtarJeTrFJ6ww+Xtui3k6KW+36ZNEkymAI XmCwusEHEGCcTdJOHUkeS2euySQPZe7ztBD1e7UUmn1YOS0FbZZlLLkgDIsKtYbs637SVe7Oiyax L+JrHiWao8AsnJyl5MuYh9OnuYJG30MdnPAuUeLhzpG3PfqaMYimVDjgjW4rlhW6TuDOmEHB+VQX yy/izPxyibwR6Mn7VsaNJ35tkJBy+lhOG6QllfW2dqHg8R3/+a1eyyhKQMR2lz3EGmC5MtRGA0Ta 1tSgOaIAlvQfcmyyI6zZmi4ujjve0aPdaZQb8zGCA6YwggOiAgEBMHYwYjELMAkGA1UEBhMCVVMx FTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEhMB8GA1UE AxMYRGlnaUNlcnQgQXNzdXJlZCBJRCBDQS0xAhAJopBs8cbyDAXfT2MhirG5MAkGBSsOAwIaBQCg ggIFMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTE0MTAxMzAwMzIz MFowIwYJKoZIhvcNAQkEMRYEFHX1IP5J3anRnLH3L7gfHi4CtnkuMIGFBgkrBgEEAYI3EAQxeDB2 MGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdp Y2VydC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0IEFzc3VyZWQgSUQgQ0EtMQIQCaKQbPHG8gwF309j IYqxuTCBhwYLKoZIhvcNAQkQAgsxeKB2MGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2Vy dCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0IEFzc3Vy ZWQgSUQgQ0EtMQIQCaKQbPHG8gwF309jIYqxuTCBkwYJKoZIhvcNAQkPMYGFMIGCMAsGCWCGSAFl AwQBKjALBglghkgBZQMEARYwCgYIKoZIhvcNAwcwCwYJYIZIAWUDBAECMA4GCCqGSIb3DQMCAgIA gDANBggqhkiG9w0DAgIBQDAHBgUrDgMCGjALBglghkgBZQMEAgMwCwYJYIZIAWUDBAICMAsGCWCG SAFlAwQCATANBgkqhkiG9w0BAQEFAASCAQA0pMfyvKhGTC/1+0TeMljljr8ZDMNOlQpgvn4DMUpg 4x6ALVIrAcfOYv1Ois9o9W0iUIY4sAbWjtMLwV3aMMs6h2JhgjG6gKHoPzYpHQVDkf6eAXv3uzTg ZhQa71/vxiejEh3CUftUvRZfcN1SCSe8Yob/MbakxA3kQ5Nc6NmgjQOgiy3lXDNtHJSSyUxxG+pr LlQMMM9TZdmMwC3t3s65/zGOlba8mlgpfUhB8TNzNyjevsbWDwpzgFcoia6nfO6uL+o2Fbqx60eY A0839/OC7hCaEriESdHwu2i2nW24F1CpISozGkQ2iGteboLtNVCQmI4qD4V9Hjx5MxMbQ6IxAAAA AAAA ------=_NextPart_000_0129_01CFE642.80262FD0-- From nobody Sun Oct 12 18:10:56 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 023891A9141 for ; Sun, 12 Oct 2014 18:10:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.578 X-Spam-Level: X-Spam-Status: No, score=-0.578 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nKCHBO6FFy2V for ; Sun, 12 Oct 2014 18:10:52 -0700 (PDT) Received: from mail-ig0-f173.google.com (mail-ig0-f173.google.com [209.85.213.173]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DB1211A6F62 for ; Sun, 12 Oct 2014 18:10:51 -0700 (PDT) Received: by mail-ig0-f173.google.com with SMTP id h18so8742966igc.12 for ; Sun, 12 Oct 2014 18:10:51 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=seIc5AVQG23XhKAC+n26HD7gY1ecDx6UmvuxevmEb/E=; b=edi59bd017hqGqL0eQon9GE19CCDOjG0vDYk1myVQHuRkFS7HHy4//XFd28TyhnzDr xd2lUY+h0QGLECoLH1psCE+lK/qnluH48O6YNyYqYnHAfuUYNmKbKJKNP9ts/Mpb4SP7 XRJ1JXjV5NZfir1udQyFXcoUcqyR2yTRLlkg9CGkfMmAT6M4KE0yCdV1slKdqKVz0twH dXsgQKi7ZQOQFco/TazP7dDW7a/WYU6hC7ObcgHaGBd+z3RcVqnRT35XyqdLp7RgUs3M Pby7R0lKpDiM33FUwTsw7aH5b6dzAH3B7O3wDBCSqlGqiNhXWLkQKge2PksUk+cRt8t8 CoRg== X-Gm-Message-State: ALoCoQls02l42D2BonGh47Mszy8Yfpf/tBQqgUCsfZSzRThsQFtH+JOFa0/xfQnOi+2lFZrpfBfe MIME-Version: 1.0 X-Received: by 10.50.50.193 with SMTP id e1mr26725321igo.9.1413162651054; Sun, 12 Oct 2014 18:10:51 -0700 (PDT) Received: by 10.64.114.227 with HTTP; Sun, 12 Oct 2014 18:10:51 -0700 (PDT) X-Originating-IP: [2001:dc0:a000:4:7066:164f:b1a5:18f3] In-Reply-To: References: Date: Mon, 13 Oct 2014 11:10:51 +1000 Message-ID: From: George Michaelson To: Terry Manderson Content-Type: multipart/alternative; boundary=047d7bd74b66d3908d05054391b1 Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/Y3-cdWA2-eSyTU3OhwgGTT9vMGE Cc: "sidr@ietf.org" Subject: Re: [sidr] A draft seeking guidance. X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Oct 2014 01:10:54 -0000 --047d7bd74b66d3908d05054391b1 Content-Type: text/plain; charset=UTF-8 I think these are good questions to have raised and discussed in the public forum. -George On Thu, Oct 9, 2014 at 10:21 AM, Terry Manderson wrote: > Hi All, > > As you are probably aware ICANN has been following the SIDR work fairly > closely, based in the IAB guidance that a single authoritative trust > anchor should exist - what we term as the Global Trust Anchor (GTA). > > In the process of looking at the implementation of this, the GTA, and the > technical concerns relating to stability and resiliency, a few questions > have bubbled to the surface over the past year. Instead of sitting on our > hands and not communicating to the WG we thought it best to raise what we > are thinking and seek a discussion. Thus we would very much like the WG > guidance and advice on these questions. > > We have created a draft to raise these discussion points. > > http://tools.ietf.org/html/draft-vegoda-manderson-sidr-key-management-00 > > Are there simple answers? and if so, what are they? Have we > mis-charatcerised some concerns? How? Are our concerns unfounded? and why? > Are there more concerns that people see and which we haven't covered here? > > Cheers > Terry and Leo > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > > --047d7bd74b66d3908d05054391b1 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
I think these are good questions to have raised and discus= sed in the public forum.=C2=A0

-George

On Thu, Oct 9, 2014= at 10:21 AM, Terry Manderson <terry.manderson@icann.org> wrote:
Hi All,

As you are probably aware ICANN has been following the SIDR work fairly
closely, based in the IAB guidance that a single authoritative trust
anchor should exist - what we term as the Global Trust Anchor (GTA).

In the process of looking at the implementation of this, the GTA, and the technical concerns relating to stability and resiliency, a few questions have bubbled to the surface over the past year. Instead of sitting on our hands and not communicating to the WG we thought it best to raise what we are thinking and seek a discussion. Thus we would very much like the WG
guidance and advice on these questions.

We have created a draft to raise these discussion points.

http://tools.ietf.org/html/draft-vegoda-manders= on-sidr-key-management-00

Are there simple answers? and if so, what are they? Have we
mis-charatcerised some concerns? How? Are our concerns unfounded? and why?<= br> Are there more concerns that people see and which we haven't covered he= re?

Cheers
Terry and Leo

_______________________________________________
sidr mailing list
sidr@ietf.org
ht= tps://www.ietf.org/mailman/listinfo/sidr


--047d7bd74b66d3908d05054391b1-- From nobody Sun Oct 12 18:45:09 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AA5A91A916F for ; Sun, 12 Oct 2014 18:45:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.687 X-Spam-Level: X-Spam-Status: No, score=-2.687 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.786, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N5gwWckLbkxN for ; Sun, 12 Oct 2014 18:45:07 -0700 (PDT) Received: from walnut.tislabs.com (walnut.tislabs.com [192.94.214.200]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 412D81A3BA6 for ; Sun, 12 Oct 2014 18:45:07 -0700 (PDT) Received: from nova.tislabs.com (unknown [10.66.1.77]) by walnut.tislabs.com (Postfix) with ESMTP id 864F128B0041; Sun, 12 Oct 2014 21:45:06 -0400 (EDT) Received: from cloud.netsec (localhost.localdomain [127.0.0.1]) by nova.tislabs.com (Postfix) with ESMTP id 4CE8A1F8035; Sun, 12 Oct 2014 21:45:06 -0400 (EDT) Content-Type: multipart/signed; boundary="Apple-Mail=_9AF9ACB6-23AB-4B1D-9FB3-DDBD91B97924"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\)) From: Sandra Murphy In-Reply-To: Date: Sun, 12 Oct 2014 21:45:05 -0400 Message-Id: <97E27B08-52A1-4AD1-9565-D6B69FF9FE8F@tislabs.com> References: To: Leo Vegoda X-Mailer: Apple Mail (2.1510) Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/kue0nfUHYD0PYHNg0MivGody7vc Cc: "sidr@ietf.org" , Sandra Murphy Subject: Re: [sidr] A draft seeking guidance. X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Oct 2014 01:45:08 -0000 --Apple-Mail=_9AF9ACB6-23AB-4B1D-9FB3-DDBD91B97924 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On Oct 12, 2014, at 8:32 PM, Leo Vegoda wrote: > Hi Roque, >=20 > Roque Gagliano (rogaglia) wrote: >=20 > [...] >=20 >> However, I am struggling with the relevance from a CA perspective of=20= >> Section 7 (Communication from validators to objects signers regarding=20= >> validation status). Validation is a local process done from RPs. = There=20 >> are many reasons why validation may fail and many of them good=20 >> reasons. Are you expecting a massive Big Brother system of all = validator=20 >> reporting results back to IANA?=20 >=20 > No, we weren't envisaging that there would be a central repository of = all > validation failure reports. I want to reiterate that we are seeking = advice > on whether it is important for certificate owners and object signers = to know > if validation fails because of something they have done. Have you looked at the RPSTIR work? =20 http://sourceforge.net/projects/rpstir/ There's a large set of compliance tests in there. Is that what you were = looking for? --Sandy >=20 > I was thinking that letting the resource owner know that its = certificate or > ROA failed validation and why could be helpful to the resource owner = and > help minimize routing failures based on validation failures.=20 >=20 > Regards, >=20 > Leo > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr --Apple-Mail=_9AF9ACB6-23AB-4B1D-9FB3-DDBD91B97924 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJUOy6hAAoJEHplpQeet0IZ8ZEP/2t+zEfXDU9xlRy/FdoWohyU pTTk4B4prnOQf7d2qmIDuia7c/uTklL/uHNuZsrtz2MXqNLp/uxNli9kdCNXpORo 1YdpWonF8yBnmxx1vEFOOJrB90o2GIpNmOwHZ/tWeua+N/h2dxs7lQU3jyngIU4c 0VYQp7ewVvtiQi7xADbmNOcWBgdPuMN029CTAGrGscU4gVj2OFAa3AIIxt6+HvEZ x5t9rGjQYJC7ihWPnrujpdAbtgDSpoG8eQB7mr6CdayC+NpUXGDSghYI8oIoah/Y o53QNhGxLZFWGGdiCRokLbK5+AxIhafJxvMb4/wFnJAtQHFIC/2AiOowggXMJpIA hAvRyCzdNgV2DejgWKW1RoZy0seSn0DEKi++hUwdAKv1DpWblDtHGfRTpz5SvXmU si3wRdBp2eIyeXjcVly1cFb0VjNuDdcIfl9Zw6L2hu4gCfJZ5E0BdQSrtcFQ+GC/ 8CLEya9ZoaghLE6xRw/iIaoF3refPI+MjDNtZijwh0U8pPCUoTGXLBHB0X2PSiRB XUsMTBPy7l9omh+f/Iu4ZcV7f9ogCxvveqDkn8k6+1uWfuzabg08u3NeBcN6ZKru Iu2MCmwQ7RgmyblWPdeF8BtJ8M0mmclnDkt9Jq5ucDdNhWlchnRcZAS1e/WS28B9 W3BwVu6ar1wdwr8cTSYr =Qpbx -----END PGP SIGNATURE----- --Apple-Mail=_9AF9ACB6-23AB-4B1D-9FB3-DDBD91B97924-- From nobody Mon Oct 13 07:48:30 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CDE3E1A0196; Mon, 13 Oct 2014 07:48:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.399 X-Spam-Level: X-Spam-Status: No, score=-1.399 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, J_CHICKENPOX_21=0.6, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Yjy9_noapsEq; Mon, 13 Oct 2014 07:48:26 -0700 (PDT) Received: from mail-yk0-x22d.google.com (mail-yk0-x22d.google.com [IPv6:2607:f8b0:4002:c07::22d]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8AABF1A0172; Mon, 13 Oct 2014 07:48:26 -0700 (PDT) Received: by mail-yk0-f173.google.com with SMTP id 200so3507088ykr.18 for ; Mon, 13 Oct 2014 07:48:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; bh=UE1OQ2+0dTmFawg+59/QlN1NhTt9uil46tKzaSMkMy0=; b=ra9OkBcNmYTjkGH2zDl9pzgJvNonBzgsqipCenmwcGH5XPKYzUMDoMjdLE13Li6/T7 VeMcamduI0c+LefTqHaK5fZ81ERvmYgygYY0JMV9Z40hl/ksqMisHT3RIvyKlFyaBwwN +vlxOO4d91j2zEqN/dHYUrUYY6fFit0NLKDGWgARH/VarjWG9TNvUReY1kBt6QcvwojX z/FjJuT7gugxWZdHZZQ9NbCuUe6y3/j7tsoT4kbF04NZRw8PNI7ocTGpZCiXY4CDaZCF z+56wCsHG2jc8noyBJvVCtw17aHV1x+XYsGH94KZZs2gG7O/AD/WxS0b3wuEnvUjR/Ur XvSQ== MIME-Version: 1.0 X-Received: by 10.236.139.36 with SMTP id b24mr36768155yhj.77.1413211705625; Mon, 13 Oct 2014 07:48:25 -0700 (PDT) Received: by 10.170.113.134 with HTTP; Mon, 13 Oct 2014 07:48:25 -0700 (PDT) In-Reply-To: References: <4705B28C-7F64-4D05-8D3A-791B9A2D7B24@netapp.com> Date: Mon, 13 Oct 2014 10:48:25 -0400 Message-ID: From: Alia Atlas To: sidr@ietf.org, "idr@ietf. org" Content-Type: multipart/mixed; boundary=20cf3036375bb4ed5b05054efdaf Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/0W2eMWuRkrp14ptgMckkXo9O2nE Subject: [sidr] Fwd: [IRTF-Announce] Applied Networking Research Prize 2014 presentation s at IETF-91 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Oct 2014 14:48:29 -0000 --20cf3036375bb4ed5b05054efdaf Content-Type: multipart/alternative; boundary=20cf3036375bb4ed5705054efdad --20cf3036375bb4ed5705054efdad Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable ---------- Forwarded message ---------- From: Eggert, Lars Date: Mon, Oct 13, 2014 at 10:05 AM Subject: Fwd: [IRTF-Announce] Applied Networking Research Prize 2014 presentation s at IETF-91 To: "routing-discussion@ietf.org" Sharon's talk is likely of interest to BGP folks Begin forwarded message: > From: "Eggert, Lars" > Subject: [IRTF-Announce] Applied Networking Research Prize 2014 presentation s at IETF-91 > Date: October 13, 2014 at 16:00:55 GMT+2 > To: "irtf-announce@irtf.org" > Cc: "irtf-discuss@irtf.org" , "ietf@ietf.org Mailing List" > Reply-To: "anrp@irtf.org" > > ********************************************************************** > The call for ANRP nominations for the 2015 awards cycle is now > open! Read more about the ANRP at http://irtf.org/anrp. > > DEADLINE IS OCTOBER 31, 2014 > ********************************************************************** > > Hi, > > we are extremely pleased to report that for the 2014 award period > of the Applied Networking Research Prize (ANRP), 46 eligible > nominations were received. Each submission was reviewed by four > members of the selection committee according to a diverse set of > criteria, including scientific excellence and substance, timeliness, > relevance, and potential impact on the Internet. > > Based on this review, six submissions were awarded an Applied > Networking Research Prize for 2014. The final three prize winners > for 2014 will present their work at IETF-91 in Honolulu, HI, USA. > The ANRP awards for IETF-91 go to: > > *** Sharon Goldberg *** for discussing threats when BGP RPKI > authorities are faulty, misconfigured, compromised, or compelled > to misbehave: > > Danny Cooper, Ethan Heilman, Kyle Brogle, Leonid Reyzin and > Sharon Goldberg. On the Risk of Misbehaving RPKI Authorities. > Proc. ACM Workshop on Hot Topics in Networks (HotNets-XII), > College Park, MD, USA, November 2013. > > *** Tobias Flach *** for the design of novel loss recovery mechanisms > for TCP that minimize timeout-driven recovery: > > Tobias Flach, Nandita Dukkipati, Andreas Terzis, Barath > Raghavan, Neal Cardwell, Yuchung Cheng, Ankur Jain, Shuai Hao, > Ethan Katz-Bassett, Ramesh Govindan. Reducing Web Latency: the > Virtue of Gentle Aggression. Proc. ACM SIGCOMM, Hong Kong, China, > August 2013. > > *** Misbah Uddin *** for developing matching and ranking for > network search queries to make operational data available in > real-time to management applications: > > Misbah Uddin, Rolf Stadler and Alexander Clemm. Scalable > Matching and Ranking for Network Search. Proc. International > Conference on Network and Service Management (CNSM), Z=C3=BCrich, > Switzerland, October 2013. > > Sharon, Tobias and Misbah have been invited to present his findings in > the IRTF Open Meeting during IETF-91 in Honolulu, HI, USA. Join > them there! > > Please subscribe to the IRTF-Announce mailing list in order to receive > future calls for ANRP nominations and join ISOC to stay informed of > other networking research initiatives: > > http://irtf.org/mailman/listinfo/irtf-announce > http://isoc.org/join > > Regards, > > Lars Eggert, IRTF Chair http://irtf.org/anrp > Mat Ford, Internet Society http://isoc.org/research > > -- > > 2014 ANRP Selection Committee > > Mark Allman, ICIR > Marcelo Bagnulo, UC3M > Lou Berger, LabN > Olivier Bonaventure, UCL Louvain > Ross Callon, Juniper > KC Claffy, CAIDA > Lars Eggert, NetApp > Stephen Farrell, Trinity College Dublin > Olivier Festor, INRIA > Mat Ford, ISOC > Lisandro Granville, UFRGS > Volker Hilt, Bell Labs > Suresh Krishnan, Ericsson > Dan Massey, Colorado State > Al Morton, AT&T Laboratories > J=C3=B6rg Ott, Aalto University > Colin Perkins, University of Glasgow > Stefano Previdi, Cisco > J=C3=BCrgen Sch=C3=B6nw=C3=A4lder, Jacobs University Bremen > Joe Touch, USC/ISI > Rolf Winter, Hochschule Augsburg > Yang Richard Yang, Yale > Lixia Zhang, UCLA > _______________________________________________ routing-discussion mailing list routing-discussion@ietf.org https://www.ietf.org/mailman/listinfo/routing-discussion --20cf3036375bb4ed5705054efdad Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable

---------- Forwarded messag= e ----------
From: Eggert, Lars <lars@netapp.com><= /span>
Date: Mon, Oct 13, 2014 at 10:05 AM
Subject: Fwd: [IRTF-Announ= ce] Applied Networking Research Prize 2014 presentation s at IETF-91
To:= "routing-discussion@ie= tf.org" <routing= -discussion@ietf.org>


Sharon's talk is likely of inte= rest to BGP folks

Begin forwarded message:

> From: "Eggert, Lars" <= lars@netapp.com>
> Subject: [IRTF-Announce] Applied Networking Research Prize 2014 presen= tation=C2=A0 s at IETF-91
> Date: October 13, 2014 at 16:00:55 GMT+2
> To: "irtf-announce@irtf= .org" <irtf-announce@= irtf.org>
> Cc: "irtf-discuss@irtf.o= rg" <irtf-discuss@irtf= .org>, "ietf@ietf.org Mail= ing List" <ietf@ietf.org> > Reply-To: "anrp@irtf.org&quo= t; <anrp@irtf.org>
>
> ***********************= ***********************************************
> The call for ANRP nominations for the 2015 awards cycle is now
> open! Read more about the ANRP at http://irtf.org/anrp.
>
> DEADLINE IS OCTOBER 31, 2014
> **********************************************************************=
>
> Hi,
>
> we are extremely pleased to report that for the 2014 award period
> of the Applied Networking Research Prize (ANRP), 46 eligible
> nominations were received. Each submission was reviewed by four
> members of the selection committee according to a diverse set of
> criteria, including scientific excellence and substance, timeliness, > relevance, and potential impact on the Internet.
>
> Based on this review, six submissions were awarded an Applied
> Networking Research Prize for 2014. The final three prize winners
> for 2014 will present their work at IETF-91 in Honolulu, HI, USA.
> The ANRP awards for IETF-91 go to:
>
> *** Sharon Goldberg *** for discussing threats when BGP RPKI
> authorities are faulty, misconfigured, compromised, or compelled
> to misbehave:
>
>=C2=A0 =C2=A0 Danny Cooper, Ethan Heilman, Kyle Brogle, Leonid Reyzin a= nd
>=C2=A0 =C2=A0 Sharon Goldberg. On the Risk of Misbehaving RPKI Authorit= ies.
>=C2=A0 =C2=A0 Proc. ACM Workshop on Hot Topics in Networks (HotNets-XII= ),
>=C2=A0 =C2=A0 College Park, MD, USA, November 2013.
>
> *** Tobias Flach *** for the design of novel loss recovery mechanisms<= br> > for TCP that minimize timeout-driven recovery:
>
>=C2=A0 =C2=A0 Tobias Flach, Nandita Dukkipati, Andreas Terzis, Barath >=C2=A0 =C2=A0 Raghavan, Neal Cardwell, Yuchung Cheng, Ankur Jain, Shuai= Hao,
>=C2=A0 =C2=A0 Ethan Katz-Bassett, Ramesh Govindan. Reducing Web Latency= : the
>=C2=A0 =C2=A0 Virtue of Gentle Aggression. Proc. ACM SIGCOMM, Hong Kong= , China,
>=C2=A0 =C2=A0 August 2013.
>
> *** Misbah Uddin *** for developing matching and ranking for
> network search queries to make operational data available in
> real-time to management applications:
>
>=C2=A0 =C2=A0Misbah Uddin, Rolf Stadler and Alexander Clemm. Scalable >=C2=A0 =C2=A0Matching and Ranking for Network Search. Proc. Internation= al
>=C2=A0 =C2=A0Conference on Network and Service Management (CNSM), Z=C3= =BCrich,
>=C2=A0 =C2=A0Switzerland, October 2013.
>
> Sharon, Tobias and Misbah have been invited to present his findings in=
> the IRTF Open Meeting during IETF-91 in Honolulu, HI, USA. Join
> them there!
>
> Please subscribe to the IRTF-Announce mailing list in order to receive=
> future calls for ANRP nominations and join ISOC to stay informed of > other networking research initiatives:
>
> http://irtf.org/mailman/listinfo/irtf-announce
> http://isoc.org/joi= n
>
> Regards,
>
> Lars Eggert, IRTF Chair=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 http://irtf.org/anrp
> Mat Ford, Internet Society=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0http://isoc.org/research >
> --
>
> 2014 ANRP Selection Committee
>
> Mark Allman, ICIR
> Marcelo Bagnulo, UC3M
> Lou Berger, LabN
> Olivier Bonaventure, UCL Louvain
> Ross Callon, Juniper
> KC Claffy, CAIDA
> Lars Eggert, NetApp
> Stephen Farrell, Trinity College Dublin
> Olivier Festor, INRIA
> Mat Ford, ISOC
> Lisandro Granville, UFRGS
> Volker Hilt, Bell Labs
> Suresh Krishnan, Ericsson
> Dan Massey, Colorado State
> Al Morton, AT&T Laboratories
> J=C3=B6rg Ott, Aalto University
> Colin Perkins, University of Glasgow
> Stefano Previdi, Cisco
> J=C3=BCrgen Sch=C3=B6nw=C3=A4lder, Jacobs University Bremen
> Joe Touch, USC/ISI
> Rolf Winter, Hochschule Augsburg
> Yang Richard Yang, Yale
> Lixia Zhang, UCLA
>


_______________________________________________
routing-discussion mailing list
routing-discussion@ietf.org<= /a>
https://www.ietf.org/mailman/listinfo/routing-discussion

--20cf3036375bb4ed5705054efdad-- --20cf3036375bb4ed5b05054efdaf Content-Type: application/pgp-signature; name="signature.asc" Content-Disposition: attachment; filename="signature.asc" Content-Transfer-Encoding: base64 X-Attachment-Id: dff3cd17b4f79272_0.0.1 LS0tLS1CRUdJTiBQR1AgU0lHTkFUVVJFLS0tLS0NCg0KaVFDVkF3VUJWRHZjRnRaY25wUnZlbzF4 QVFMQVBRUUFzeFlZeTB6L3l1VHlKanV3Q3ZVbWZoOHVTMmtVQzVRaA0KWDNyWEowTWpxN2V6WWFu UEFYRVEvVFVneUtrajd1aUxkQTNtNE5GQm9SV3lodlJ3RWVGR0lkUEk5ZnM5V280OQ0KT01GZThI bDNRVE5lWW5STEN1RmRDVjI4MUx2OG5iV1MrN1VCaGdCdWx5UHhvZk9NcHlRdzVKQXl3NCt1Z0VY SQ0KQ0lQR0JHRWdNSms9DQo9NkhkVA0KLS0tLS1FTkQgUEdQIFNJR05BVFVSRS0tLS0tDQo= --20cf3036375bb4ed5b05054efdaf-- From nobody Mon Oct 13 14:57:35 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D22741A02ED for ; Mon, 13 Oct 2014 14:57:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -15.287 X-Spam-Level: X-Spam-Status: No, score=-15.287 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.786, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0m57YqkI5Wiz for ; Mon, 13 Oct 2014 14:57:33 -0700 (PDT) Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9AA1F1A02DF for ; Mon, 13 Oct 2014 14:57:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=410; q=dns/txt; s=iport; t=1413237452; x=1414447052; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=Fv4nPn9f/uGU2KQoaA+61QF9hNCRK7RlUaTxgDuRZYU=; b=WrpHS9Sfyj5M2yD+e3PVWuda2g+/DJFUnBBW0amHFDPJgUc4TuZVE7k+ XEuHgo3XSXyZ85LheLxDu/0hM5nPUzWIWu/AfKHAnpN3H9QJPjSd/uDiL qVTTaUWrbcGeuE947hEz+Lkf5YVwD0IrZufNETgcsor8xb13ApS1w4DMr 0=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AgkFAIBKPFStJA2I/2dsb2JhbABbgw5TXNMCAoEfFgF9hAMBAQMBOj8FCwIBCDYQMiUCBA6IOwjFGQEBAQEBAQEBAQEBAQEBAQEBAQEBARMEkBIzB4MtgR4BBJF5i1KWEYN3gXQkHIECAQEB X-IronPort-AV: E=Sophos;i="5.04,714,1406592000"; d="scan'208";a="362968431" Received: from alln-core-3.cisco.com ([173.36.13.136]) by rcdn-iport-6.cisco.com with ESMTP; 13 Oct 2014 21:57:32 +0000 Received: from xhc-rcd-x12.cisco.com (xhc-rcd-x12.cisco.com [173.37.183.86]) by alln-core-3.cisco.com (8.14.5/8.14.5) with ESMTP id s9DLvVA6001834 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Mon, 13 Oct 2014 21:57:32 GMT Received: from xmb-rcd-x02.cisco.com ([169.254.4.79]) by xhc-rcd-x12.cisco.com ([173.37.183.86]) with mapi id 14.03.0195.001; Mon, 13 Oct 2014 16:57:31 -0500 From: "Roque Gagliano (rogaglia)" To: Leo Vegoda Thread-Topic: [sidr] A draft seeking guidance. Thread-Index: AQHP49F4QoebNITr4ki0Sb8h6ujW9w== Date: Mon, 13 Oct 2014 21:57:30 +0000 Message-ID: <9FC4AB4B-8B31-44CC-B499-5B7AD5728FC6@cisco.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.61.100.125] Content-Type: text/plain; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/B5sMRbYpxhYV9v7jXe7PfkXHIS8 Cc: "sidr@ietf.org" Subject: Re: [sidr] A draft seeking guidance. X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Oct 2014 21:57:35 -0000 Hi Leo, > I was thinking that letting the resource owner know that its certificate = or > ROA failed validation and why could be helpful to the resource owner and > help minimize routing failures based on validation failures.=20 If I want to be contacted, I can issue a Ghostbuster RR: https://tools.ietf= .org/html/rfc6493 Maybe that is the requested advise? Roque > Regards, >=20 > Leo From nobody Mon Oct 13 15:24:07 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 28B081A0AF1 for ; Mon, 13 Oct 2014 15:24:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -15.287 X-Spam-Level: X-Spam-Status: No, score=-15.287 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.786, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id symfoeGEgih5 for ; Mon, 13 Oct 2014 15:24:00 -0700 (PDT) Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AD69E1A06E9 for ; Mon, 13 Oct 2014 15:24:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=3642; q=dns/txt; s=iport; t=1413239040; x=1414448640; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=ww5ZmHI1F2yU25nSA1uH0tJoLny9qWczNyYzF0XPgj0=; b=XDJOsLZ5AH8NWKa2IPtaiHv5iV46EfTIll1hceoly/oQp24LXVlOzOy4 nr2stujVCa3BcMVZ3jJrwsnBBPcVL6blbYoCFkVG+q6wYoNR6kBwKlCrE VoDvEXniTLFihmqOWiq/rHzRtJ1aDm+8lXGhzRNac9Ho4KFpT3305gtmr U=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: Ag4FABtQPFStJV2U/2dsb2JhbABbgw5TWATLLQyHSwKBHxYBfYQDAQEDAQEBAWsLBQsCAQhGJwslAgQOBYg2CA3FFQEBAQEBAQEBAQEBAQEBAQEBAQEBARePYxEBHTMHgy2BHgWReYRChxCBLjyQKYN+g3dsgQgHFwYcgQIBAQE X-IronPort-AV: E=Sophos;i="5.04,714,1406592000"; d="scan'208";a="362933904" Received: from rcdn-core-12.cisco.com ([173.37.93.148]) by rcdn-iport-7.cisco.com with ESMTP; 13 Oct 2014 22:24:00 +0000 Received: from xhc-rcd-x08.cisco.com (xhc-rcd-x08.cisco.com [173.37.183.82]) by rcdn-core-12.cisco.com (8.14.5/8.14.5) with ESMTP id s9DMNxT7026456 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Mon, 13 Oct 2014 22:24:00 GMT Received: from xmb-rcd-x02.cisco.com ([169.254.4.79]) by xhc-rcd-x08.cisco.com ([173.37.183.82]) with mapi id 14.03.0195.001; Mon, 13 Oct 2014 17:23:59 -0500 From: "Roque Gagliano (rogaglia)" To: Terry Manderson Thread-Topic: [sidr] A draft seeking guidance. Thread-Index: AQHP5zRiQoebNITr4ki0Sb8h6ujW9w== Date: Mon, 13 Oct 2014 22:23:58 +0000 Message-ID: <41BE087B-F047-45DB-8A1B-0C7FEC5BD5FC@cisco.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.61.100.125] Content-Type: text/plain; charset="Windows-1252" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/HAgr_R61bv1llQxFz8py1Jm6cAg Cc: "sidr@ietf.org" Subject: Re: [sidr] A draft seeking guidance. X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 13 Oct 2014 22:24:03 -0000 Terry, I have two other comments on this draft. 4.1. Algorithm based on jurisdiction (Roque) My (basic) understanding of the GHOST problem when tackled by the D= NSSEC people is that it end up been a no-problem. A lot of discussions, lot= of waisted time, support for GHOST was added to standards but finally, .RU= got signed using RSA just like the rest of the world. Do we have a summary= of the DNSSEC experience that we could use as reference?=20 4.2. Algorithm vulnerability (Roque) We have a procedure in RFC6916. Have you evaluate it? is there a p= roblem that needs to be fix? >From your text I cannot figure out if what you are looking for is an emerge= ncy algorithm rollover. This was discussed and agreed that algorithm roll-o= ver will be a long process and no emergency procedure is practically feasib= le. 5. Key Length (Roque) I would go for a shorter lifetime until 2030 and keep 2048bits. Th= e technology is ramping up and migrating to a longer key length at this tim= e would not be advisable IMHO. 6.1. Protocol support for key rollover events not requiring a change in cr= yptographic algorithm (Roque) I believe you are talking about two things: - Rollover communication from parent CA to subordinate CA using top-down p= rotocol (hosted environment is trivial): IMHO, out-of-band seams to be the right approach. I do not believe CAs wi= ll automate the roll-over request to its parent, so the use of an in band m= echanism will basically triggers a manual action (probably an email) which = is the same communication method used by out-of-band. =09 - TAL rollover. You do not mentioned explicitly but I guess that when you refer to =93com= municated to validators=94 you are referring to the TAL file. There is no magic on how to distribute a new TAL, just like your DNSSEC k= eys or a new root cert for your browser. What you normally want is to have = an independent trust anchor that signs that sets the authenticity of the co= ntent. In this case you need to make sure that it is hosted in a TLS secure= d site via a trusted certificate authority. Carlos Martinez had an idea about creating a signed object signed by the = old TA CA that points to the new TAL file. Seams like a good idea at first = view. Regards, Roque =09 On 09 Oct 2014, at 02:21, Terry Manderson wrote= : > Hi All, >=20 > As you are probably aware ICANN has been following the SIDR work fairly > closely, based in the IAB guidance that a single authoritative trust > anchor should exist - what we term as the Global Trust Anchor (GTA). >=20 > In the process of looking at the implementation of this, the GTA, and the > technical concerns relating to stability and resiliency, a few questions > have bubbled to the surface over the past year. Instead of sitting on our > hands and not communicating to the WG we thought it best to raise what we > are thinking and seek a discussion. Thus we would very much like the WG > guidance and advice on these questions. >=20 > We have created a draft to raise these discussion points. >=20 > http://tools.ietf.org/html/draft-vegoda-manderson-sidr-key-management-00 >=20 > Are there simple answers? and if so, what are they? Have we > mis-charatcerised some concerns? How? Are our concerns unfounded? and why= ? > Are there more concerns that people see and which we haven't covered here= ? >=20 > Cheers > Terry and Leo > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr From nobody Tue Oct 14 09:27:30 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D11D1A8A64; Tue, 14 Oct 2014 09:27:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.687 X-Spam-Level: X-Spam-Status: No, score=-2.687 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.786, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EiClvqh7StSB; Tue, 14 Oct 2014 09:27:24 -0700 (PDT) Received: from walnut.tislabs.com (walnut.tislabs.com [192.94.214.200]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B5B871A8A7A; Tue, 14 Oct 2014 09:27:21 -0700 (PDT) Received: from nova.tislabs.com (unknown [10.66.1.77]) by walnut.tislabs.com (Postfix) with ESMTP id 07B3E28B003D; Tue, 14 Oct 2014 12:27:21 -0400 (EDT) Received: from [127.0.0.1] (localhost.localdomain [127.0.0.1]) by nova.tislabs.com (Postfix) with ESMTP id DBC651F8035; Tue, 14 Oct 2014 12:27:20 -0400 (EDT) From: Sandra Murphy Content-Type: multipart/signed; boundary="Apple-Mail=_F8E4DCF9-F302-4F17-B3A1-E1B39D0CAFC8"; protocol="application/pgp-signature"; micalg=pgp-sha512 Date: Tue, 14 Oct 2014 12:27:20 -0400 Message-Id: <7D59AE05-E32A-43DA-929B-8E1877A67CC7@tislabs.com> To: "sidr@ietf.org list" , IESG Secretary , idr@ietf.org Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\)) X-Mailer: Apple Mail (2.1510) Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/BOD2WsszgmAMsVaetMOcovRIxao Cc: SIDR Chairs , Sandra Murphy Subject: [sidr] announcing virtual interim meeting Wed 29 Oct 2014 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Oct 2014 16:27:26 -0000 --Apple-Mail=_F8E4DCF9-F302-4F17-B3A1-E1B39D0CAFC8 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii At the upcoming IETF, sidr and idr will hold a joint session for the = purpose of discussing the bgpsec protocol. The idr and sidr chairs think that there would be benefit in having a = short virtual meeting before hand to get the idr folk who have not been = following sidr up to speed on the bgpsec protocol basics, so they can = contribute effectively in the joint meeting in Hawaii. There will be a sidr virtual meeting on Wed 29 Oct 2014 from 10am-12pm = EDT and all interested idr folk are invited to participate. (There = won't be much point if you don't!) The agenda is 1 hr overview and tutorial of bgpsec: - underpinings of what BGPSEC/SIDR is - why are we here? map of documents - origin validation today - path validation tomorrow - note particular points where bgpsec affects bgp, not so much the crypto but where bgp behaviour may change 1 hr of questions and answers. slides to be made available ahead of time =20 details of the conference technology (webex, google hangout, etc) will = be sent to the mailing list. --Sandy, speaking as one of the co-chairs --Apple-Mail=_F8E4DCF9-F302-4F17-B3A1-E1B39D0CAFC8 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJUPU7pAAoJEHplpQeet0IZoYsP/1f2u6Dz+1ADVTauFnFSK8qX /HOcdneM0ZiORZfAp8Os4zV8niup3jPKWcWND8vwM1ptaMEjjqJBd7isS8HgVcVw tCcRUdyCAfWkyRrKV+VBbua6BtzdS3ZF0iA6lGq6BNsz3BZeLBvSAI9dV9JwgXwn kWgitxC8gmqabspirmMna/nIuKiH/8uRj41uiHce9DFA5oIkLTVHa/WBQn1D8Kpr BZw4U2A2tsu6bbkUF8/xz+r/4vJhFdh6AbT0YaIhCqHkrrvyCf+MQ8ZGttt7bb8N 2xxlDku0ftWCLht+6F7/BvRsv4/G8Y0Umj/PGJpwoNcm3+ITE+37b09Lm8Benn4W TLml589xbgPKLEtST03mbgUY3SoxrwjStQSPAmLMMhtw8yFPPMr9Cdjv+c53PE/i XR27JhTa5cvSGAaYp1aTQdFH9S6xhEa8imhpeyjWvvIuzAkLTT9gWJUnqm62BCwF nOJYTD3rxp4XgcDhnt9UmL7FHhxxZNEefjkMck+cNVm6j8oreNdGqZHj7EhNc2SX r0Kuh+XIk5sWrcoE0ImwVyzI2P8bN32M68U1uz/NZHwmrA8AVrTyGR2rtsEzNimH geD/5TBrcHFP7KOc+0dpVC3BNeg1RfZfYQmZyEWCuxEK+gLECLYCqB/v5G3I4Zuk 2cvdGuBRh4SALGtpG4ue =teCv -----END PGP SIGNATURE----- --Apple-Mail=_F8E4DCF9-F302-4F17-B3A1-E1B39D0CAFC8-- From nobody Tue Oct 14 10:14:59 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 727781A9043; Tue, 14 Oct 2014 10:14:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id giNWUNpZNG7I; Tue, 14 Oct 2014 10:14:41 -0700 (PDT) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 44E101A902E; Tue, 14 Oct 2014 10:14:41 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IESG Secretary To: IETF Announcement List X-Test-IDTracker: no X-IETF-IDTracker: 5.6.4 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20141014171441.16068.57494.idtracker@ietfa.amsl.com> Date: Tue, 14 Oct 2014 10:14:41 -0700 Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/YW7RnG2tQMNW4wDLPDafA72UPvk Cc: sidr@ietf.org Subject: [sidr] SIDR WG Virtual Interim Meeting, 29 October 2014 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Reply-To: ietf@ietf.org List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Oct 2014 17:14:46 -0000 At the upcoming IETF, sidr and idr will hold a joint session for the purpose of discussing the bgpsec protocol. The idr and sidr chairs think that there would be benefit in having a short virtual meeting before hand to get the idr folk who have not been following sidr up to speed on the bgpsec protocol basics, so they can contribute effectively in the joint meeting in Hawaii. There will be a sidr virtual meeting on Wed 29 Oct 2014 from 10am-12pm EDT and all interested idr folk are invited to participate. (There won't be much point if you don't!) The agenda is 1 hr overview and tutorial of bgpsec: - underpinings of what BGPSEC/SIDR is - why are we here? map of documents - origin validation today - path validation tomorrow - note particular points where bgpsec affects bgp, not so much the crypto but where bgp behaviour may change 1 hr of questions and answers. slides to be made available ahead of time Details of the conference technology (webex, google hangout, etc) will be sent to the sidr mailing list. --Sandy, speaking as one of the co-chairs From nobody Mon Oct 20 11:50:00 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3899D1A9042 for ; Mon, 20 Oct 2014 11:49:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.911 X-Spam-Level: X-Spam-Status: No, score=-1.911 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MRggpwp8KWns for ; Mon, 20 Oct 2014 11:49:51 -0700 (PDT) Received: from walnut.tislabs.com (walnut.tislabs.com [192.94.214.200]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 119B51A904C for ; Mon, 20 Oct 2014 11:49:51 -0700 (PDT) Received: from nova.tislabs.com (unknown [10.66.1.77]) by walnut.tislabs.com (Postfix) with ESMTP id F0AF428B0043 for ; Mon, 20 Oct 2014 14:49:49 -0400 (EDT) Received: from [127.0.0.1] (localhost.localdomain [127.0.0.1]) by nova.tislabs.com (Postfix) with ESMTP id E64B41F8035; Mon, 20 Oct 2014 14:49:49 -0400 (EDT) From: Sandra Murphy Content-Type: multipart/signed; boundary="Apple-Mail=_B9F05128-77A9-4B8F-8C59-2E266225DD0D"; protocol="application/pgp-signature"; micalg=pgp-sha512 Date: Mon, 20 Oct 2014 14:49:49 -0400 Message-Id: <57D60314-8E3B-4D6C-ADFF-3546D79546C0@tislabs.com> To: "sidr@ietf.org list" Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\)) X-Mailer: Apple Mail (2.1510) Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/ZMt9BiPfXcE4HIbFeAZMaEtDfNg Cc: Sandra Murphy Subject: [sidr] request for agenda topics for IETF91 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Oct 2014 18:49:55 -0000 --Apple-Mail=_B9F05128-77A9-4B8F-8C59-2E266225DD0D Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Anyone who has a topic they wish to discuss at the IETF91 SIDR meeting, = please send an agenda request to the list and/or the chairs. To send to = the chairs, use the sidr-chairs@ietf.org alias. The draft agenda is due Mon 27 Oct 23:59 UTC, so please submit your = request by 1600 UTC to ensure the chairs have a chance to include it in = the draft agenda. Final agenda is due Mon 03 Mon 23:59 UTC. Note that the internet draft deadline is Mon 27 Oct 23:59 UTC. --Sandy --Apple-Mail=_B9F05128-77A9-4B8F-8C59-2E266225DD0D Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJURVlNAAoJEHplpQeet0IZ4lkP/3fUsWeSpbKhJgyIL2+ULsSu Ri6jXtI4U2NgN9qj5vSyWhQRklnIoFnvqePUtkJSNrj5Dxq2rV5FOq7rhTlgE47W SyB24pfp0FeN1cptkJVc32SStlEPOohnhPljFpfUS49ba2HLs+eR4w8r3mTUIzf2 P2TxAaD9MMgsLjA97qQ5nnW/cfg5cm4k4hT973qj/s3ogb+gN74VwWAi/+1TKr7M ERoWHNs4wfHC7G8fAj1aa7+HsYhTvsTLlqlaEeITF2eqRUU+8hJxPSk73oxVSMhl CqkBwNyzwIQEhC6sgfX7brkZorL8OVkL6njMbD4ubx46/KSaYorDwm3TiFcjTTQx 4fXgCgi5kf/5G0z0AlVTgf11ZzmOZqpThyt+/AvM2XIPPlgKV+ks8H/4jnoOpEmJ S4heFWv4nATQ2ru69a6JiRMBNp6VZftrn4jwODXxnfthCXMQi3rnn/I3gCxMSRzo /aSyO4jKIs07QLOEhZtImmiJ8zeblnsNLooGQEbd6SFw5WQtWadGsmQKZ26u21xr +4zlOJ4nHBdAm8Pdhx8yqVWziNYTCsveewbntufUyjzOei9dqdg4ba8tTl347P1S VcB2rNto1wSHNAuAJI7IW0M59saSUOOFvKl79xypq2CDVLwPVUha7FMpfiWEr3rd vqfEGOljCGeW9Ep3Jc8k =LFQY -----END PGP SIGNATURE----- --Apple-Mail=_B9F05128-77A9-4B8F-8C59-2E266225DD0D-- From nobody Tue Oct 21 08:05:57 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8C73F1A88CC for ; Mon, 20 Oct 2014 10:02:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZdSF7zNS_Skv for ; Mon, 20 Oct 2014 10:02:00 -0700 (PDT) Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1on0710.outbound.protection.outlook.com [IPv6:2a01:111:f400:fc10::710]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E7E821A8AF0 for ; Mon, 20 Oct 2014 09:49:36 -0700 (PDT) Received: from pvpatel-sslvpn-nc.jnpr.net (66.129.241.13) by CO2PR05MB729.namprd05.prod.outlook.com (10.141.228.12) with Microsoft SMTP Server (TLS) id 15.0.1054.13; Mon, 20 Oct 2014 16:49:11 +0000 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) From: John Scudder Date: Mon, 20 Oct 2014 12:50:21 -0400 Content-Transfer-Encoding: quoted-printable Message-ID: <72AE22AF-5107-42C2-BAD7-7F0FC779C021@juniper.net> To: "idr@ietf.org List" X-Mailer: Apple Mail (2.1878.6) X-Originating-IP: [66.129.241.13] X-ClientProxiedBy: BY2PR12CA0004.namprd12.prod.outlook.com (25.160.121.14) To CO2PR05MB729.namprd05.prod.outlook.com (10.141.228.12) X-Microsoft-Antispam: UriScan:; X-Microsoft-Antispam: BCL:0;PCL:0;RULEID:;SRVR:CO2PR05MB729; X-Exchange-Antispam-Report-Test: UriScan:; X-Forefront-PRVS: 03706074BC X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10019020)(6009001)(189002)(199003)(164054003)(105586002)(104166001)(77096002)(53416004)(21056001)(81156004)(106356001)(62966002)(42186005)(76482002)(120916001)(31966008)(97736003)(66066001)(97756001)(229853001)(23726002)(99396003)(64706001)(95666004)(50986999)(107046002)(80022003)(36756003)(110136001)(93916002)(47776003)(87286001)(86362001)(50466002)(20776003)(92566001)(92726001)(50226001)(4396001)(77156001)(40100003)(122386002)(85306004)(46102003)(46406003)(102836001)(85852003)(88136002)(83716003)(89996001)(69596002)(82746002)(19580395003)(87976001)(19580405001)(101416001)(33656002)(57306001)(104396001)(42262002); DIR:OUT; SFP:1102; SCL:1; SRVR:CO2PR05MB729; H:pvpatel-sslvpn-nc.jnpr.net; FPR:; MLV:sfv; PTR:InfoNoRecords; MX:1; A:1; LANG:en; X-OriginatorOrg: juniper.net Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/e-EQFJz9xA7C7tHtNfpQdnXncJc X-Mailman-Approved-At: Tue, 21 Oct 2014 08:05:45 -0700 Subject: [sidr] IETF-91 agenda topics X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Oct 2014 17:02:01 -0000 [bcc sidr@ietf.org] Folks, IDR will meet at IETF-91 on Thursday, November 13, from 1:00 to 3:00. = Please forward any IDR agenda items you might have to Sue and me. The = deadline is October 27 (this coming Monday) by 10:00 U.S. Eastern Time. = Priority will be given to those who get their requests in by the = deadline, though if agenda space permits it we will consider requests = gotten in before November 3 at 10:00 U.S. Eastern Time. We will also be holding a joint meeting with SIDR on November 9 from = 9:00 to 11:30. The topic of that session will be review of BGPSEC, so we = will schedule any BGPSEC-related items then (and any non-BGPSEC items in = our normal Thursday slot). This also seems like a good time to remind = you of our interim BGPSEC tutorial meeting on October 29. If you have previously presented on your topic at an IDR meeting, please = explain in your request what you hope to achieve with your presentation = this time. If you have requested to present the same work at multiple = WGs, please note this so that we can coordinate as needed. If you plan to make a presentation, please keep in mind the IDR = tradition, "no Internet Draft - no time slot". You should also plan to = send your slides to Sue and me no later than 24 hours prior to the = meeting, though again, earlier is better. If we don't have your slides = by the deadline, you may lose your slot. Finally, if you request an agenda slot, please do so by replying to this = message, making sure to include both Sue and me in the To: or Cc: and = don't change the subject line. Please include the name of the person who = will be presenting and give an estimate for how much time you think = you'll need (including Q/A). Thanks, --John & Sue From nobody Tue Oct 21 08:06:18 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 49D551ACD2F for ; Mon, 20 Oct 2014 12:48:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=unavailable Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id C5vVBDqwq0r7 for ; Mon, 20 Oct 2014 12:48:23 -0700 (PDT) Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1bon0735.outbound.protection.outlook.com [IPv6:2a01:111:f400:fc10::1:735]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EFFC41ACD35 for ; Mon, 20 Oct 2014 12:48:22 -0700 (PDT) Received: from DM2PR05MB733.namprd05.prod.outlook.com (10.141.178.18) by DM2PR05MB430.namprd05.prod.outlook.com (10.141.104.12) with Microsoft SMTP Server (TLS) id 15.0.1049.19; Mon, 20 Oct 2014 19:48:00 +0000 Received: from pvpatel-sslvpn-nc.jnpr.net (66.129.241.13) by DM2PR05MB733.namprd05.prod.outlook.com (10.141.178.18) with Microsoft SMTP Server (TLS) id 15.0.1054.13; Mon, 20 Oct 2014 19:47:54 +0000 MIME-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) Content-Type: text/plain; charset="us-ascii" From: "John G. Scudder" In-Reply-To: <72AE22AF-5107-42C2-BAD7-7F0FC779C021@juniper.net> Date: Mon, 20 Oct 2014 15:47:45 -0400 Content-Transfer-Encoding: quoted-printable Message-ID: References: <72AE22AF-5107-42C2-BAD7-7F0FC779C021@juniper.net> To: "idr@ietf.org List" X-Mailer: Apple Mail (2.1878.6) X-Originating-IP: [66.129.241.13] X-ClientProxiedBy: BN3PR09CA0015.namprd09.prod.outlook.com (25.160.111.153) To DM2PR05MB733.namprd05.prod.outlook.com (10.141.178.18) X-Microsoft-Antispam: UriScan:;UriScan:; X-Microsoft-Antispam: BCL:0;PCL:0;RULEID:;SRVR:DM2PR05MB733; X-Exchange-Antispam-Report-Test: UriScan:; X-Forefront-PRVS: 03706074BC X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10019020)(6009001)(199003)(164054003)(24454002)(189002)(377454003)(558084003)(107046002)(82746002)(19580405001)(85306004)(92726001)(19580395003)(69596002)(92566001)(85852003)(105586002)(50226001)(99396003)(86362001)(93916002)(95666004)(4396001)(66066001)(87976001)(64706001)(76482002)(20776003)(47776003)(88136002)(106356001)(81156004)(40100003)(57306001)(83716003)(87286001)(120916001)(102836001)(110136001)(33656002)(77096002)(104166001)(89996001)(122386002)(31966008)(53416004)(97736003)(101416001)(21056001)(42186005)(46102003)(80022003)(76176999)(97756001)(50466002)(50986999)(46406003)(77156001)(62966002)(23726002)(36756003)(104396001)(42262002); DIR:OUT; SFP:1102; SCL:1; SRVR:DM2PR05MB733; H:pvpatel-sslvpn-nc.jnpr.net; FPR:; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; X-Microsoft-Antispam: BCL:0;PCL:0;RULEID:;SRVR:DM2PR05MB430; X-OriginatorOrg: juniper.net Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/z3ScZq3ziwM_DBY_SA1VJF2fch4 X-Mailman-Approved-At: Tue, 21 Oct 2014 08:06:13 -0700 Subject: Re: [sidr] [Idr] IETF-91 agenda topics X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Oct 2014 19:48:24 -0000 On Oct 20, 2014, at 12:50 PM, John Scudder wrote: ... > We will also be holding a joint meeting with SIDR on November 9 from = 9:00 to 11:30.=20 ... Not sure how I came up with November 9. The correct date for the joint = meeting is Friday, November 14, 9:00 to 11:30. Thanks, --John From nobody Mon Oct 27 16:34:52 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CF7DD1A7033; Mon, 27 Oct 2014 16:34:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CW-q59DfKcr8; Mon, 27 Oct 2014 16:34:35 -0700 (PDT) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id DA0981A8034; Mon, 27 Oct 2014 16:34:33 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 5.7.1.p1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20141027233433.4836.23181.idtracker@ietfa.amsl.com> Date: Mon, 27 Oct 2014 16:34:33 -0700 Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/mhGhykmWMPC5zYMEcEUvxsr4sw4 Cc: sidr@ietf.org Subject: [sidr] I-D Action: draft-ietf-sidr-bgpsec-protocol-10.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Oct 2014 23:34:41 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Inter-Domain Routing Working Group of the IETF. Title : BGPSEC Protocol Specification Author : Matthew Lepinski Filename : draft-ietf-sidr-bgpsec-protocol-10.txt Pages : 34 Date : 2014-10-27 Abstract: This document describes BGPSEC, an extension to the Border Gateway Protocol (BGP) that provides security for the path of autonomous systems through which a BGP update message passes. BGPSEC is implemented via a new optional non-transitive BGP path attribute that carries a digital signature produced by each autonomous system that propagates the update message. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-sidr-bgpsec-protocol/ There's also a htmlized version available at: http://tools.ietf.org/html/draft-ietf-sidr-bgpsec-protocol-10 A diff from the previous version is available at: http://www.ietf.org/rfcdiff?url2=draft-ietf-sidr-bgpsec-protocol-10 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Oct 27 16:42:21 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BE2BF1A8740 for ; Mon, 27 Oct 2014 16:42:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SiWc_fsqOw8d for ; Mon, 27 Oct 2014 16:42:17 -0700 (PDT) Received: from mail-wi0-x229.google.com (mail-wi0-x229.google.com [IPv6:2a00:1450:400c:c05::229]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C2DF31A8748 for ; Mon, 27 Oct 2014 16:40:28 -0700 (PDT) Received: by mail-wi0-f169.google.com with SMTP id q5so7411834wiv.4 for ; Mon, 27 Oct 2014 16:40:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:date:message-id:subject:from:to:content-type; bh=mQJZamD+toBAecKIGCARiLBtigBqN0FdxntF2io7JMs=; b=hO7CbWtTSNezSQDXEPSyL9H7kYKiB5LTKqb4jnT9Jz7OO0wWwEacolSVNZkJz75a/d eF8kdV7/YUXnfyzLlRe/2Q5lTHUK0iG0KRzIWRiHeHXq+8C30+jTMHYduwOOhGYYWNaM oVY2Vl8Zs0AOfGL0BE/T5JrCMMiD/mXnLsTn0dihrfCCw4+8tjbyvP7E/XWWPl0+T0qJ lYBywt2sHCIoqBcc0FjEZIVTgxBY9WuMPayq4FuQUtPk4W6qDJF67sdPTRXDUsJa0swx cSzhXunE4gB9P3kcGWhjo5JTKmcvG+7Y/HrKzA49XqbHNENPh0FSlLtlhxcgTuwRWEHF 2OvA== MIME-Version: 1.0 X-Received: by 10.194.189.239 with SMTP id gl15mr25626006wjc.8.1414453227452; Mon, 27 Oct 2014 16:40:27 -0700 (PDT) Received: by 10.216.1.1 with HTTP; Mon, 27 Oct 2014 16:40:26 -0700 (PDT) Date: Mon, 27 Oct 2014 19:40:26 -0400 Message-ID: From: Matthew Lepinski To: "sidr@ietf.org" Content-Type: text/plain; charset=UTF-8 Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/JhAJSRGUCp1BpLfyvvJ3UDN3UzE Subject: [sidr] New version : draft-ietf-sidr-bgpsec-protocol-10 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Oct 2014 23:42:18 -0000 Just posted the -10 revision of the document. The only normative change was to decouple BGPsec validation from Origin Validation. (This is a normative change to the validation algorithm in Section 5.) This is based on working group discussions at IETF 90 and confirmed on the list in September. Additionally, there were some text changes made, including a reference to the AS-Migration document (and an accompanying text change regarding pCount=0). I have a couple of improvements to the security considerations text that I wasn't able to fold into this version of the document. Other than improving the security considerations, I am not aware of any open issues in this particular document. - Matt Lepinski From nobody Tue Oct 28 08:55:45 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 08D821A8AEF; Tue, 28 Oct 2014 08:55:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0H3ayGVSAd87; Tue, 28 Oct 2014 08:55:41 -0700 (PDT) Received: from na01-bl2-obe.outbound.protection.outlook.com (mail-bl2on0142.outbound.protection.outlook.com [65.55.169.142]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BAED71A8AF5; Tue, 28 Oct 2014 08:55:40 -0700 (PDT) Received: from DM2PR09MB0303.namprd09.prod.outlook.com (25.160.96.148) by DM2PR09MB0272.namprd09.prod.outlook.com (25.160.96.141) with Microsoft SMTP Server (TLS) id 15.1.6.9; Tue, 28 Oct 2014 15:55:39 +0000 Received: from DM2PR09MB0302.namprd09.prod.outlook.com (25.160.96.147) by DM2PR09MB0303.namprd09.prod.outlook.com (25.160.96.148) with Microsoft SMTP Server (TLS) id 15.1.6.9; Tue, 28 Oct 2014 15:55:38 +0000 Received: from DM2PR09MB0302.namprd09.prod.outlook.com ([25.160.96.147]) by DM2PR09MB0302.namprd09.prod.outlook.com ([25.160.96.147]) with mapi id 15.01.0006.000; Tue, 28 Oct 2014 15:55:38 +0000 From: "Sriram, Kotikalapudi" To: GROW WG , "idr@ietf.org" , "sidr@ietf.org" Thread-Topic: New Version Notification for draft-sriram-route-leak-problem-definition-00.txt Thread-Index: AQHP8jV3z2QVhp4Vq0eVP9ts7e6dW5xFo70r Date: Tue, 28 Oct 2014 15:55:37 +0000 Message-ID: <1414511737146.42356@nist.gov> References: <20141027222842.23964.59825.idtracker@ietfa.amsl.com> In-Reply-To: <20141027222842.23964.59825.idtracker@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [129.6.222.126] x-microsoft-antispam: BCL:0;PCL:0;RULEID:;SRVR:DM2PR09MB0303;UriScan:; x-exchange-antispam-report-test: UriScan:; x-forefront-prvs: 0378F1E47A x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(199003)(189002)(377454003)(377424004)(64706001)(85852003)(92566001)(97736003)(76482002)(2656002)(92726001)(2201001)(15202345003)(31966008)(77096002)(107046002)(107886001)(40100003)(87936001)(86362001)(85306004)(15975445006)(230783001)(2501002)(117636001)(99286002)(95666004)(4396001)(101416001)(50986999)(120916001)(54356999)(105586002)(561944003)(106356001)(76176999)(106116001)(80022003)(46102003)(20776003)(19580405001)(21056001)(122556002)(19580395003)(66066001)(36756003); DIR:OUT; SFP:1102; SCL:1; SRVR:DM2PR09MB0303; H:DM2PR09MB0302.namprd09.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Microsoft-Antispam: BCL:0;PCL:0;RULEID:;SRVR:DM2PR09MB0272; X-OriginatorOrg: nist.gov Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/tTtW2FLq465mWuWFLn54EUrk_rg Subject: [sidr] Fw: New Version Notification for draft-sriram-route-leak-problem-definition-00.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Oct 2014 15:55:44 -0000 Several people at the microphone at the GROW WG meeting in Toronto had sugg= ested that we split =0A= the earlier document draft-sriram-route-leak-protection-00 into two parts:= =0A= =0A= (1) route leaks definition, and =0A= =0A= (2) route leaks solution proposal.=0A= =0A= The first one is expected to be taken up in GROW, and =0A= the path for the second one was suggested to be IDR --> SIDR.=0A= Accordingly, we have split our earlier single draft into two, with substant= ial revisions.=0A= This (notification below) is the first of the two drafts that deals with ro= ute leaks definition. =0A= Your comments are welcome.=0A= =0A= Since several people already expressed interest at the GROW meeting in Toro= nto (see meeting minutes), =0A= =0A= http://www.ietf.org/proceedings/90/minutes/minutes-90-grow=0A= =0A= we would like to request the GROW chairs to post a request for WG adoption= =0A= of this problem definition draft. =0A= Also, I will be happy to present a brief update on this new version in Hono= lulu, =0A= if the GROW WG chairs can allocate some time in the agenda. =0A= Thank you.=0A= =0A= Sriram=0A= ________________________________________=0A= From: internet-drafts@ietf.org =0A= Sent: Monday, October 27, 2014 6:28 PM=0A= To: Danny McPherson; Montgomery, Douglas; Eric Osterweil; Sriram, Kotikalap= udi; =0A= Subject: New Version Notification for draft-sriram-route-leak-problem-defin= ition-00.txt=0A= =0A= A new version of I-D, draft-sriram-route-leak-problem-definition-00.txt=0A= has been successfully submitted by Kotikalapudi Sriram and posted to the=0A= IETF repository.=0A= =0A= Name: draft-sriram-route-leak-problem-definition=0A= Revision: 00=0A= Title: Problem Definition and Classification of BGP Route Leaks=0A= Document date: 2014-10-27=0A= Group: Individual Submission=0A= Pages: 9=0A= URL: http://www.ietf.org/internet-drafts/draft-sriram-route-leak= -problem-definition-00.txt=0A= Status: https://datatracker.ietf.org/doc/draft-sriram-route-leak-pr= oblem-definition/=0A= Htmlized: http://tools.ietf.org/html/draft-sriram-route-leak-problem-= definition-00=0A= =0A= =0A= Abstract:=0A= A systemic vulnerability of the Border Gateway Protocol routing=0A= system, known as 'route leaks', has received significant attention in=0A= recent years. Frequent incidents that result in significant=0A= disruptions to Internet routing are labeled "route leaks", but to=0A= date we have lacked a common definition of the term. In this=0A= document, we provide a working definition of route leaks, keeping in=0A= mind the real occurrences that have received significant attention.=0A= Further, we attempt to enumerate (though not exhaustively) different=0A= types of route leaks based on observed events on the Internet. We=0A= aim to provide a taxonomy that covers several forms of route leaks=0A= that have been observed and are of concern to Internet user community=0A= as well as the network operator community.=0A= =0A= =0A= From nobody Tue Oct 28 09:16:46 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BF2C11A909D; Tue, 28 Oct 2014 09:16:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nHPe9pDjy0qQ; Tue, 28 Oct 2014 09:16:31 -0700 (PDT) Received: from na01-bn1-obe.outbound.protection.outlook.com (mail-bn1bon0788.outbound.protection.outlook.com [IPv6:2a01:111:f400:fc10::1:788]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 004D91A8AEB; Tue, 28 Oct 2014 09:12:34 -0700 (PDT) Received: from DM2PR09MB0303.namprd09.prod.outlook.com (25.160.96.148) by DM2PR09MB0271.namprd09.prod.outlook.com (25.160.96.140) with Microsoft SMTP Server (TLS) id 15.1.6.9; Tue, 28 Oct 2014 16:12:12 +0000 Received: from DM2PR09MB0302.namprd09.prod.outlook.com (25.160.96.147) by DM2PR09MB0303.namprd09.prod.outlook.com (25.160.96.148) with Microsoft SMTP Server (TLS) id 15.1.6.9; Tue, 28 Oct 2014 16:12:10 +0000 Received: from DM2PR09MB0302.namprd09.prod.outlook.com ([25.160.96.147]) by DM2PR09MB0302.namprd09.prod.outlook.com ([25.160.96.147]) with mapi id 15.01.0006.000; Tue, 28 Oct 2014 16:12:10 +0000 From: "Sriram, Kotikalapudi" To: GROW WG , "idr@ietf.org" , "sidr@ietf.org" Thread-Topic: New Version Notification for draft-sriram-route-leak-detection-mitigation-00.txt Thread-Index: AQHP8sjie+MIpcLEZEaCeJbYTPJ6Mg== Date: Tue, 28 Oct 2014 16:12:10 +0000 Message-ID: <1414512729759.3402@nist.gov> References: <20141027222842.23964.59825.idtracker@ietfa.amsl.com>, <1414511737146.42356@nist.gov> In-Reply-To: <1414511737146.42356@nist.gov> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [129.6.222.126] x-microsoft-antispam: BCL:0;PCL:0;RULEID:;SRVR:DM2PR09MB0303;UriScan:; x-exchange-antispam-report-test: UriScan:; x-forefront-prvs: 0378F1E47A x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(199003)(189002)(377454003)(377424004)(64706001)(85852003)(92566001)(97736003)(76482002)(2201001)(92726001)(15202345003)(31966008)(77096002)(107046002)(107886001)(87936001)(40100003)(86362001)(85306004)(15975445006)(230783001)(2501002)(117636001)(99286002)(95666004)(4396001)(101416001)(50986999)(120916001)(54356999)(105586002)(561944003)(106356001)(76176999)(106116001)(2656002)(80022003)(46102003)(20776003)(19580405001)(21056001)(122556002)(66066001)(36756003)(19580395003); DIR:OUT; SFP:1102; SCL:1; SRVR:DM2PR09MB0303; H:DM2PR09MB0302.namprd09.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Microsoft-Antispam: BCL:0;PCL:0;RULEID:;SRVR:DM2PR09MB0271; X-OriginatorOrg: nist.gov Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/PkoROFszLgScAUuT4AqoguF-CPk Subject: [sidr] Fw: New Version Notification for draft-sriram-route-leak-detection-mitigation-00.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Oct 2014 16:16:42 -0000 Following up on my preceding email, this (notification below) is the second= part=0A= (after the 1 to 2 split) that documents the =93route leaks solution proposa= l=94.=0A= This work was presented at the GROW meeting in Toronto, and it was suggeste= d=0A= that the path of progress for this document (solution proposal) should be t= hrough IDR to SIDR. =0A= I will be happy to present this work in the IDR or the joint IDR-SIDR meeti= ng in Honolulu.=0A= The earlier comments on this work at the GROW meeting in Toronto can be fou= nd here: =0A= =0A= http://www.ietf.org/proceedings/90/minutes/minutes-90-grow =0A= =0A= Further comments, suggestions are welcome.=0A= =0A= Sriram =0A= =0A= ________________________________________=0A= From: internet-drafts@ietf.org =0A= Sent: Monday, October 27, 2014 7:01 PM=0A= To: Sriram, Kotikalapudi; Montgomery, Douglas; =0A= Subject: New Version Notification for draft-sriram-route-leak-detection-mit= igation-00.txt=0A= =0A= A new version of I-D, draft-sriram-route-leak-detection-mitigation-00.txt= =0A= has been successfully submitted by Kotikalapudi Sriram and posted to the=0A= IETF repository.=0A= =0A= Name: draft-sriram-route-leak-detection-mitigation=0A= Revision: 00=0A= Title: Methods for Detection and Mitigation of BGP Route Leaks=0A= Document date: 2014-10-27=0A= Group: Individual Submission=0A= Pages: 13=0A= URL: http://www.ietf.org/internet-drafts/draft-sriram-route-leak= -detection-mitigation-00.txt=0A= Status: https://datatracker.ietf.org/doc/draft-sriram-route-leak-de= tection-mitigation/=0A= Htmlized: http://tools.ietf.org/html/draft-sriram-route-leak-detectio= n-mitigation-00=0A= =0A= =0A= Abstract:=0A= In [I-D.ietf-sriram-route-leak-problem-definition], the authors have=0A= provided a definition of the route leak problem, and also enumerated=0A= several types of route leaks. In this document, we first examine=0A= which of those route-leak types are detected and mitigated by the=0A= existing BGPSEC protocol [I-D.ietf-sidr-bgpsec-protocol-09]. Where=0A= the current BGPSEC protocol doesn't offer a solution, this document=0A= suggests an enhancement that would extend the route-leak detection=0A= and mitigation capability of BGPSEC. The solution can be implemented=0A= in BGP without necessarily tying it to BGPSEC. Incorporating the=0A= solution in BGPSEC is one way of implementing it in a secure way. We=0A= do not claim to have provided a solution for all possible types of=0A= route leaks, but the solution covers several, especially considering=0A= some significant route-leak attacks or occurrences that have been=0A= observed in recent years. The document also includes a stopgap=0A= method for detection and mitigation of route leaks for the phase when=0A= BGPSEC (path validation) is not yet deployed but only origin=0A= validation is deployed.=0A= =0A= From nobody Tue Oct 28 13:25:35 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CF5661ACEAC; Tue, 28 Oct 2014 13:25:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.511 X-Spam-Level: X-Spam-Status: No, score=-0.511 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J9cThmGOT8Xu; Tue, 28 Oct 2014 13:25:28 -0700 (PDT) Received: from walnut.tislabs.com (walnut.tislabs.com [192.94.214.200]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 78B231ACF8D; Tue, 28 Oct 2014 13:21:02 -0700 (PDT) Received: from nova.tislabs.com (unknown [10.66.1.77]) by walnut.tislabs.com (Postfix) with ESMTP id A5AD528B0048; Tue, 28 Oct 2014 16:21:01 -0400 (EDT) Received: from [127.0.0.1] (localhost.localdomain [127.0.0.1]) by nova.tislabs.com (Postfix) with ESMTP id 70AA41F8035; Tue, 28 Oct 2014 16:21:01 -0400 (EDT) Content-Type: multipart/signed; boundary="Apple-Mail=_65F41EC8-43D5-4F06-BC6F-9A9AAE67FC0A"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\)) From: Sandra Murphy In-Reply-To: <7D59AE05-E32A-43DA-929B-8E1877A67CC7@tislabs.com> Date: Tue, 28 Oct 2014 16:21:00 -0400 Message-Id: References: <7D59AE05-E32A-43DA-929B-8E1877A67CC7@tislabs.com> To: Sandra Murphy X-Mailer: Apple Mail (2.1510) Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/wWNGbD4kEQ0O6z3EYoni3yAY0sA Cc: idr@ietf.org, SIDR Chairs , IESG Secretary , "sidr@ietf.org list" Subject: Re: [sidr] announcing virtual interim meeting Wed 29 Oct 2014 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Oct 2014 20:25:31 -0000 --Apple-Mail=_65F41EC8-43D5-4F06-BC6F-9A9AAE67FC0A Content-Type: multipart/mixed; boundary="Apple-Mail=_6650F659-B066-4F9A-93F7-D92A80F70A02" --Apple-Mail=_6650F659-B066-4F9A-93F7-D92A80F70A02 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii This is a reminder that there is a virtual interim meeting scheduled for = tomorrow, 10amEDT-12pmEDT. The slides have been uploaded to the meeting materials site: http://www.ietf.org/proceedings/interim/2014/10/29/sidr/proceedings.html The agenda is as below and is also posted to the meeting materials site: = http://www.ietf.org/proceedings/interim/2014/10/29/sidr/agenda/agenda-inte= rim-2014-sidr-1 We can use the sidr jabber room for the usual side commentary. There will be an audio telecon available: US Toll Free 1 888 598.1409 Participant passcode: 2085663 then # For those not in the US, there is an International direct number: +1 720 = 389.1159 There is also a long list of local access codes per country. See the = attached pdf. Note that the purpose of this virtual meeting is background tutorial for = the IDR folk who have not been following SIDR, so they have a basis to = comment productively in the joint SIDR/IDR meeting at IETF91. This is = not a SIDR meeting for the purpose of discussing SIDR issues or = suggestions or such. SIDR folk are welcome to participate if you wish, of course. --Sandy --Apple-Mail=_6650F659-B066-4F9A-93F7-D92A80F70A02 Content-Disposition: inline; filename=Interim.29Oct2014.The-local-dial-in.pdf Content-Type: application/pdf; x-unix-mode=0644; name="Interim.29Oct2014.The-local-dial-in.pdf" Content-Transfer-Encoding: base64 JVBERi0xLjMKJcTl8uXrp/Og0MTGCjQgMCBvYmoKPDwgL0xlbmd0aCA1IDAgUiAvRmlsdGVyIC9G bGF0ZURlY29kZSA+PgpzdHJlYW0KeAHNfcuyJMlx3T6/orTrNmouKrPeSwHigjJtIGszLmRakA2A gDQDgOiRZNTX6/jjuHtEPirr9vRwbMx6yvNGenj4K457ZFb96+G3h389jOPbdfJ/L/f72+16uF31 f3/7/eEfD38+/Oo3X8bD5y+H49t4fhzHx3Xp0/DlM3gd36bz4Sj/yYfH8e1ye2D87Xh7O0+Hzz8c fv3pcNG/83+ffjj86tOn8e14GA+f/nD474cPnz4O3+H2w4c/fhQ2hw+/l/+fDh8O8v/z4cP3Hw8Y gA9/kQvj4cPnf+r/wqG/+5Myw9gy5H8cPv2Xw99/0sW3Ao/Xx9vtMt43BB46gT989/Hw6X+usLtd 3qbj+AI3LP9PXN2fZVFYPtdC+n/79R/k/1DLP5t+hg9/624oSzZ9zRT3fznXF05iKh0+/B/nRd2T 9xdeIPO486+8wqE/+kqGD59jTTGIi/kx7seYdcOcx/vb6UZNDvsciXNwbT/SoSjpj4ePgzrSZ3oS dctbf+Ri/q3T7Y+8A8xd7EGCqfWnCIDrY3q73XcGwKLTmgW5lFAoBeUf/iByltD4m6ywOFHogHbk jX/lSoP1537IX4QXwo1z8Faqk/TMzZbi0xXPe+Oe+PAWil0I1An6PI336WCK3eMQEkdrgZp2QuI7 7eGmeUrS0EaeitxDI/1IjVLX/AO1wJDJ1JYjTGGhHiobzuLZkEwwZD2QJgTS5Xi7Ha57V7qV4Kbp 9Pa4XB/7ue1LcOazXYI7zBJcLD2SCF2T0dm7f+QfWiA1viNJDRtbT9j2d7RMSEcb8g9mqCES+0vZ Z9206cSX09v1utOLIyHQfZAULYWE/NCuOR8XQu3G0PDKvGeuj9inYjT5xDb0H7ss+4UjKFNIa5E0 fOjzcqQayso7mdljA+MfnOUwgxmxFrKKJdF5+IdQnd8yBDLpR8TSOTsHULzO5+ebOjVCTwejPS5x erwdp1ddgumKwhZHtQil9KvbJAeQEzVFDdKMX8KV6saqO1ln8sMHquhta+XT9eIbxO6V1w3CIOoW pL2OwHZbQTZhq1RI++E/7Nl4juPbuGGf17hd7re38f7Tsbudtr1nUbqn5cL9IpgI2wdkPfxwmI4T 0hbp74O+yFoO3x98OMk/Hv6gwKC5PI7Xt/v9ME7DK7XLAYaW7FmEGR83qYpMuOH7A2nO7sNJijBi 7lFY9ShwnMa3xwll1eXyeDud3SzHt+M4ng+fPh/Oo5ZM/j+rL6Bw8x5smL9BzAN2IUV8h/8hpOR/ P348nDU7oAJAElzPAeP1+naaUI3Z7I5B+zkHFGExZ42E91WISA/zWhGqmY4n/IE2hs3vKLhC7bC5 09SrjR8upGl08rHr9+vb9QyjH54bvQim4tylLk0XvJ/fbiGeiGM0p5+ONl5peMWm2acRGHW6YnVq dle8mP14nZndy8owAcz+X//yWe3+T9g0LloG4t/fmfWx0YCQv6wbXlLg+TaeWrfrDS/Vd8y6ifVu ALu3cWzZYTnHy3Mv/vAnuO0a+p7ux7f7eOo4bwuKLYnsNj305TwwIbKnyEI/IDjPiNlMBKTDJXw8 6fDQ5vo4nd+Okpeqiw7PeiqSTKbH5Q0KDhc9Hx+F/v5gdEYIx1d5VjOTDX40HooIOR6RQ3ckpn+Q XIT8g1xkbZrv8D9s7Z6lToN0XeSaDYDTYjCSmVzyW30AHBl/glHxr7g4/mej4+/DuqOfHqLcdhWb SXXY8vPT444tBArow3bJz/uw3fRzMdX5BDdoODd+PuO318+rX1mvbrqgWTcdBahdjo/7EX25+AS/ QmaT/Q5BjXz8g2yu4mVG6l6bTgdSBg/ug5b2Xr+fPoz7hz+0E+bmTwF6MODyGVYwCWzIEEuQPUG2 7GRhNO/pWUqkNvcMuR8Fj35/8jnIU3n4GLsHPBD5tzPlwiaidK6ee1zDw8eQB7OM0thoSPOenqfI AbR8n06X6bH4CSY3JhRMUhswcurLSU7RT2lTuFelLxX/iinI88UpBpnC/cqkCL+kUO4GTG4+mGSj BQg214ck1AZmiuf1bmI0mdLNSMskrQlp8mJiNyfv4XilHTe0+g1VcaVuDXLgaNK21Mf1fDteHliq f4JdHtf7dbpdZO8gNL4AvReAfVE6Aba0hM4E2APa30bKFLK3Ohe77AD7dAW0eDzu87RTBUnhQiQo RtKOifBDwmoXiTD7DEgyQSQf7qQ6yBKyzGtYdQ+/hYeeQlzOF6kktHkMlQGH3dZ2uXoe8Z+wo6Gj +i+6r6Fgtd3NIbjsU8NVtzNcwW61vk2NqESnEa23Kke7T80OF96f/p+4RgBo+gaBN33DaTqDjZ87 B/nYOAPi73aOgNchlMPvEMpoegfHK+1hla6w9GnBPYJJ7xwo3pdrs3COD6jgLqfLeRxR3CUg7R1w uo9v9+sNqVYd0Ou/Zt8/dFVfrcDa4NaYyjCXY7dYgQaNbGKdmpw+YV+SQprjSVsu8XoNgbFYuc0W 5aXQCQUdDzb6JUlRmcoqGtpckqJecleRuaThQpG5xHRPK8xIN0uCtmZLWjqupF4miHdeqZObw0qz 0qBHiZtVyI402ZkUSUuqEObJSP8eCaS5XlYtpD13D+11r0JeiM9eKkOJIZXXItxQWJtEfHrtQrqx ym5HEyanB+B9Sd+Q6zie5um7T6Aoo//uoun7rP/CB++HD6N+tn/trye9UkeOHwckfRtz079eyWE9 xZ/QdzueT9jgqqxNWGwh/OdhURUKuNornHSEiY8n3Rggw6KYYilBhgG2Yt0DY7CW50ux3giZi1Kh Bfu6l9G3WeGSXllULm+pJ6dM1Ks02jdy8mIC24z2ec9hhpohHKsyaLyBsYF5CRaJeaXfLCjNCjfE nJK2+ttFUN8dbOefZAKJW/YIBPJap5VgMmhOEWEeU8QQbSwLCxfDm7NBO4sYX8SMMXqPJHVp/lEs 6bZZM5BLi/GVB8eQx2N8A6KiriYnKQVHVw7lDoBiZlLqwmgIRRYtR1P3vLDIYgPqbnhKmFqhlVNo 3cUZYnQRUtxDy/fiKOEysnc1XpAu4yzcZRghPphkswbE/nw1mKA1oBjcyyLqxWkytfEtQGwNCh7Y 1aS9ypWTDh5uLqW7MsnuSV26GK5acqAuSdtSH8Bn6IRiqf4JWuUniw7pQY83KU1kpRYdRkeZdAaK G6NKIiUTZJFkV0uNdD/i8Z9ZV5pzhxRFMsjjRQ/lYU1EeUgfEaUC53y4k19bI+FJLZjo5RoJhxOo f75oI1COJrQPiH9REeH691ojoaOHSulJjXTGGRCaOEWMtkQCUl6FlZtZedUMRflhEMOgdlZBO9Cb aQen6QleIZGkY3iBZJezPnqXYxCgpkQG9FMio+kZHK/019ZHxSLQGIrnPfURWvt4TGc8XwogmFUS eEoOHUoAPJ1iYyvOc4rCLm228KmWR6YV2XY6LRl9fpyk0R/lUdCWQ95XHp2BbRhO+/14YSFtxnLD uohc0hAi+xLpixzuGaxZEBjPiiN4/zCzklVk5/vp7bK/NsJzkXgs7n1xWZYcClF7em3EKIicr/k7 eqWxeBtOMuKyXi6FkQTmHMDNMnYRTjZLh7AhEiGriFQgbASmjye9xyKzvlZC2Bo3K4WRNxgCzEph ZAWNlThWGE2aue9a+hz1sxVGNuauV+yzlVNWMOHerZLo+AZsil2/StmURE+aH7Z5F4V33mBgldHN aoGqdTpDw1QfdKN6JLalYFhX/Xp895Vo19FZX5RuPVXIrPNCaC7KA9rdr7r40kLi2mLzQ6aUgujF CH9X92MfuDUQF+CWmI7g1sOd4NZJs+f1dj+fxjPs6Z/gPvxkiE+OtzhBID7vfAfNKcTFAG3LFDFE bxHQaPCYQgbt98R4oX0rjjHkUeGvbESkg4fPkXIMMYY8kNYEYoccpMmj4ynqMhhO6J4lEXn0CTZg e8oB9c6qCCif16DyYOKCzoC71kRUcYy2KRzUbriNRE3jCek2LqW5jcYI9G9j24ihtCl3fpIk39QF NHm6hZuTPH04SVV0o3xwaI2j3ToYj7d0AFM4tHqJaijVJlrU+2XXsUcXyM4iY3Y+I4m1PzI644kM PRa2RQxOZy2Ejh4e1dJzYpROZ5IyRamG7HJXDi1srnaKpYJ07W0xK5SEOidE8vLHaKyS9PX29ohq 6OyUrXme0yMVygQ91JEJ9cAIwsTT4C+cF63VQnZStF3/TBdUptNBZ96GWfNO26swq1c7ArZ4grgz fCD0Ht6orhHZKWzP8Wp0z3AiUXP98LQCeiaU9vmLUIrlnRahjHbzE/ga+b7SmDzEF9wiVv4MO46H puP1+BhPx1MpWHp3i+Oh6m6vAKReZRnRpfyxiGCpcGCAUGFor0j0cLFONuGzGxx5pXC5v+FBN3tV p1/OagkvLpg5ID/FAXIjIZcznCm/258JiaNJNwuCnmaZYREa+YLO1/UF/bznQuH/keI9KElzvbLD oIcbQeoJmudCfr0rfxY6Jes2sYpMMXhKZeVPRCXhKqPS0e1Sjt7tZAFXu7jceShk9YtVN1b7WF1j FZDVPlYf2eeH1z5yKGR31froSQXkh0KrSf2nOBPy+B46XZNkfLjql+J7dziE6rcivA+IgY9rPo/w KiMgjjuTi2zkEB7N2oce/zTCl3b8KKXPGuMbLagooGs9t7nxzvHOLhhrqI0olpCOINbDnSjWSVs7 65ysePKToGQtZsi+Q6lBcoIa2PWxOwepgYIJMgMEO4OeoYgYY6ShLilcj32cAyuaSB4xuiyyuQUc DEeHDCTlDiCRGF05cIzJwLzpBXWQXIWOThhsin5SLwQTThHY/PD9YOVPLDLGFhE3z4Ci3qFQ6SnO wl2FceGuQnJlBW3N1hqPtiYkFLSgBWnGolVIRjsEbJVfbNWoNncoji+CQln6DHbuL3qeVpSnmuUd HE3aluodPMG4s96LRYUWMnhNN4+AzmchZZ16IiQvIZ+j6oFUTsoEpeqxy1714LnvCV2Vx8Ke2otR RMuqRyWI5+QoEGseHJGrQHBPKZFIyvO1ot7Vl/WXcqDwsKrnNOFxpQp1b0+hLtqJv7ajHrxjjQMf e2TOrtixD573liahtYt6CDxOeAdovIxYQpm7B42rW8pm/t2heQHMZg0DzFb4uOrDId0XPFvR+BID UiaRpjO0163soTPMt4S5T4ZIYquAse6eRLkgNb9Z0UPzczRpC4AX3SGYiEF8Q9x77DNeL8cjssBW 0XOF7I+LG/zVDTeVs/CpFj2mAtljOhU5TatxtaQble3GpF4n4IkSHGG+WPi8z4dLzkhNiMMgmhX3 m8NEShQyG0NcrY2eJzRysXFeJdCJd8RVkU5lMjDhcUVc5zmWJJ2WuM7pd9buAVVLXoFUi8+OLR2R GOy357/mxcJVD0rsEMTKAfvXiouuxNhxRGLZ76cPBgfUDIZe1aTTHcxQpN8XDKH61XDYOiJ5MRwc UsO0fKwqP8H1GvATSIkAgUjJgoNjQTmESfi89EnYu2NrU1RgksEF8jcaJYtPUMKghdR2Q+KsZOA4 yxh0/MQ8LRKTfGeYOjiQJofKUGOrvQMcFPIWXEbaObQMVQYdwcosjhECHXZJKCYwhuZkM0gNi/Ia FB0sXNOOorlKksYxBvsECor21V6eomhXY+CURgU8w/2kDRLKmlLnJ0mB9AzhSDuHY9CIZMnRpFXJ Ve/FSipiHCDwDhqVtHBo1MITBPqma1DHY40cW+/HPrPeDdKyRF/rPsuZREBp7C1CJpTG8aw+Wwil Cu4mKQIWKG2XHUrjdVqF0gvoaVsg+KWgYxeI2FlILJEkJfDBJM0tX8ROwsOgNM6845s49p8gOJQ2 EP3PCqgNSv/uI7r+8galPWu1vqXg2eg39EShWBHgW2MRU7/s9sUQpWPrCNkdwj2YDuEkFW64GW0s dxB6BPG0XTc8TY9YgCJFEG0iq3BFJDtGcJcgOgyRDCxSBIJDp98JRRwcrhrkJ9wN3QyrBoF/Cjj0 1UeQW4SSjNXr6AWDOBcb5+Dw/RZxjEKZvOnnFiFCSZlsD/06iwRCKTZBopp/GcPrTT945NB+dd6+ jccSbSAUz7sDtx6zEHceoyxD7Wn6weLSsZDXXLuGRtA+geO/nCAGaMsjdy5uDLF12S0xvHIwyMEV dltTtP0Yg95aclIW2d6Re1/IAIeU03O5BYk9hhcZOMJXQVcnh6B9FTo8ti5T9JMdPljEFNqb0hl0 QzXSJojBKaLA1tUHv0vTT/WSfmIM3E0YJe4nJFfkbxFWYzna2VNFNvzIkqNrHDZ6L1aqOs0Nn6PJ UYQ0tbjeA6G4JzhC4XiqkLQtctZOkVTo/TbD6wo60FUMhAKRhAyEcsLpFL5fjo84BCm9tUQofrl7 xGFhP+qbfW3LCY4mCEUlyGafC+QI5YSvvMN5Kp/3DtJW7AgF65xjFay4b7jJhIpQ5LsT0EK0ZsUK Qul3Jmn22Xuw+NoGPNFtb8Zam8+efcBXNG1hEzTEr5fHweZ+tdzdrAwXsOG65q2zZuDEVR/uCF/I HBLGdxAStOhe5Gmvz55x6LYCemL6ZH7SIgG5A4+AhEiORtQ9kSeVDPM7OAm6cYfFLvCCOwQTcYYX m33HacL3hVzOx81uH/q7l+ny3ORf9Yi3KwFJp1eS07eHxTTXS7pR2t4YIpM76pKX231p8aVP6QUn E5FLGpyW7c38gGmK0pBulrTkBxtPOpzwJQR4t3+5g9l34fE9PO96BnQjCuyZAgOpHgWR5y1JOxmB 6J3KoCMwkegAdf1695zD68nCQSplcpAqpOztRkYkegcz6KcWkXzUJ+o4mW6S5QsdTOta2mMN9qCD fZ7KQ97WtbTHu62bab1Lu779cMMNi8dXjjTiLWHodwa2aTwCu9cxaQYydU660fnuwGZhcFoN7X5L rE8DLAV0XpPQ9kWpkPl0d4Q2F8VQ5njSzaIytMvyNh1pR3B/9bOFMxAL4diZhXDIXYp3tMYPFEsM Rxhroc6xRmHtYLWv2jF+AmKtH0v+QVvcttOJcmOAy8fqJhlYLaN5gIgRFXKIqIAAZ0DexZDsbf3Y 4EDabokJlGz6sbEILUbIEZOSdg4tQ12FjmDhnv1YytCl1I6hOdms2oHyeQ12DBauqBk412rH9RKD XU0v9GOVQ/qJMTC7WWpH+jU/aXaAlHXpk0QiPUM4iqOIXcOQbpVg6aODViVXvYNDYxX2Y+MOd4Og hUOjlqh2QmeiQRuv5SMEPXM7s8MDpJa+2SXFRf9I9wlfA4lTfUbD4DS994CvMZFTy6h3SIqIpd6x yz9NRzZEYoWjImKZpCkDlIp0ERKaa87rnKx9FvKf8LCKB69hx1fhrlQ8C0eBXvFYTxb1zXf4/kUr dqwpu/1Y9wmP1+LxhpPOvQ2svjr3ztwBMVvcQbwaDyyE8sMn1T8EWGqqCm1zvBoDxqFDNNf9ue73 t/+sO1qEcnQbQhlNjyDarUKl+Zc+LbhEMBGHMKN8s/bfzChtjAZ+9SD1pGD6KIEf64c7C64lHUZp rs+bsn0lup05AnhQKke4jFMCFUrB8aTfFajKRF5Es2D5xu2BGVCBXWZAxfM1N6BIx9yB3Em5Azlp q98DVZCMtdnE5JwJPrYcTqGdWQ+T5vDYheImVlkoWIl7epYiZrvTgYfmAIqVOcH2ENkzWp7Kw/NG LAWuiHZsKMu3xpSD44u6YoyrI8LAe3FGl72LcxQeS1t9XkvQEgoz0OImkDNP23KdZYjQTLHhNlK8 Np6QbuMs3G0YJT6YpLmNg6wCt5o1tEYsRvcpaCAytfFDky+Y6AMYdMqkMYJH3Rh8I2i1Q/QSNnZd kgNHk7aleiNAdqlZr050qSfEJ/1Ng4AvSA7wQOmGUhPnUZpmDl+GE0mZosAXu9zBlx3t2iIcRIKi FI+oCNGvDZEIXyiDD3fyfceHwsPgCx52QF9aezOQau+XGP7aDo2tYWutWvzED46R+aUcG9+vO+JX Pq5XoJcyNcJk/ZxMf9qCz/tv9mtfVn2gDtc9nTjcwZ2Uuud4pRfQi417epzcO2brDwEkQihHK0pL +jQ6hdIOrzmpC7WEWfIanG7WGXLIVIzy7dBLv35BL34NohG9MEYjzmX9Bb3E+uHNgl5IM0jJx64/ Ry/PpLLNMqRy9KK0SOU0pSB6IW3Z6cUyI9GL2uUXgV4s3cY2pCTWz23InZTbkJO2+n3ohRMwFzO/ B80pqkFa9GJC5UaWLHDvNE/3jHcRs93sEr0ED25cLkaML0uNPKJVMHjARQW9mFwIYdLk0fFUOTjG eUQYeGVtNDZh8uD4Ikfu8kufEGsN0/husdjYueM6yxjdTLEPvTBuej8xIzJK3G1ImtvsRC+coTcI aTIleiGtym4MUAzWKZf30MBKe85ttRPohfZxXZIDR5O2pT551sbRyxnWzOYLMp/SiV6mu5whBXoh KVMU9GKXn6OXvqqT3Sr7QfA6QS8UKdCKi0SaMvhwJ78WveAZZD4b/wp6sU5LPW62B+KsHbPnxfoT vifwOmLTKRKsgZifqwVDE4Rv0ivct2kCiQdp2Sjtvitu0Vz/qVowKZSDlhDK6BTKQEwVKgHL0qcN EFOM8u1ATB8Wyy0Yrj/CXdYvcMFeQjMjSOGBwBAQQ30wVtvrz0HMM6k83aoVkKIIWiiV05SCIIa0 Jal3gxi1yy8CxFjWDRDDNO6bkxkN+VMPliK92ur3gRhOQNDCNB+0x0E3o0wRQ6QG1cfrsAkBtCQL p51FjHfaeNR7EsQED88JXGnskZUHx2gtnHui8oALE8QED46vPByU2LyyJ9qRA+UwGgU218LxhQc+ 7vklCldQgpicQ1swnCJEaKbYB2KMR7qNs3AjMkrcbUia2+wEMZyhNwhpMjWjD02+aBN/MZiLSYMF j7oxdCCGchC1OAsnyYG6JG1L3deCmW6S8CClnZqdjE4Qg11Kf7RBMc+ALz0xUqYoIMYuO4h598tk RCUuUoAWpfMECb08iBzPzDn5tSAGjyLy16wVxABWPPsuGDwz9xtAFvvhI/xrn/FTR2jB+NHR2qux 97fxdMejU2XWNeACbvgNbTyMEN+28LXdlyz07bVKByL0BPqjq53+TNMToJB2Vxja6+3LsTtaQr1Q DkRCKAcqIZTR9AV2a0hbCPgWCXvON8sN4FKNot24+beizp4VGW9Y//2BF54fW8/M4bsI9FcjquH3 g6Ns0Cx9whd8tmqQDadTk9O0HceT/iq14RkERtDMl1e/G+h9vizFz6xRVJpWzGqRGd1tSHO9huvm aY14z8Y53nt3Xgv85s5MvMdcS5rOy/FK+46w5MJ5bcmZ44EnuvPw608Ist2vydbvELWXZe0hM3mA bPDvy7HHy/g9OvIN0XaXPXBm17cfNcOX0uk3iVpAvIpKl9wgrtkThwa1TbUJtalqqj4dwsaTfl9A hOpXQ2KWP0rSeDEkHDMhJHjGmZ/gFw0MCsxEqEDM5PGhgwFnnLTV74HaLJkKkJDuh+DTDlh0M8oU MUQbJsLCYDOFNDrFivFFzPYeyXz2xEPwIC33qFg+R+XBMZTDYXDwIO332Bwpl66FY5wHMw55BE0e HO9ymcp3Qm1jGj2unANQO8Xqp7QpNqB2vJICq6pY6TYutRuRUeI+RvLpGgx26AN87mvF6FSMOwGZ 0uikVdlqMK4UPKoyvZyXhi/voVOQFh6NdrJsYQg41OYdHE3alrrxIIieHNtpJwIB73rISm3lRkeE iHDl5ZQgZYqE2n656xcuPPW83YKAoqRfSJEItZVGdDgdMtjwIG3Vc0y1uSEJDz3tnPDSC1JDvp7y EtT+NwXc8rCW/RKBou8B/yKD4r2Vf9Af0f2iPzqK1uKNqBxfVYMxhs3x1403WfDdc/hunwecqYi5 dTKqU+86GX3ZTJLVpElIO4kF8JaT0ZLFjA7D+Pig6Tvt9dnJ6ItPEPkhZQplIJPO46AzhHCQGfS7 vIdMfglGgSdLk5Drj5wg8Q2jOB3rdTAZdBjF+Pj1n6qpGFJ5E5FWcaQTUjjIDPp9ViHS+VmCZd+W Zak5tiwlYRVuWf7CHbcsJ231e5AOi4WSx70n0uf1bkaZIobILaWpyO2EKMaMGFuDuxpPVw25cJ1i Qfzi0nyT86X1PFUO5hEVPTdOKosbacjB8UVdMcZ5RBi4OoyGXJQD7q6bceGBfta+pqIJFkiH+uLu 7CxDhGaKDbfR3dnayyZmuo2zMCNGlJjbBGlus7OpyBl6gzgdTM1J9OVpxQONwVSsYjAX042RPOrG AO8XHq12UpfOwnQZHHx00LbUXU3F6Y5f2y5Ix+lw5+l2LY+lD0HKFAXp2KgO6ezoJJXmAOofgR13 bJQuUiAbpRPpUCQf7uRXNhUnvA0UTyFL6b0T6eD79gBW8BQX4IuBGLyaG5Bl9jMuaDq9nU6yyjLf rAXzc73jh9gEZAmFiwMBsqQPOE2Fi/fLeNLuBGwn+vUZZDm038Qw7wa1bQCDLEUohSxFKKMpBNEG aXP+97UTN43y8/bFYv0R3B4FpLlegyzzyLTrNNYcsjyzShuaAUE8NgOiUCqDMOEaHK9SelLLkmPp 01ZfLOwifbFvhe839p6ssj3Hcu8xMiBLOCn3HteO+eQuyBITOP5wOhOyZUeCpJhRpmhuSchSWCgc iXtifBGz3eGwe2kOyB3O6JIjkBNw1ho8VQ7mEa2SYwc0OaCs2AF93p6n8jAIYvegEqfbg7XutEZD LvLg+LKWvZDFBeM263PyUfSYIkRopthwm4QsziPdxlk4ZGEsu9uQNLfZB1lihjAgFeMGIlNCFtKN wfSeYjDycOXyHhpM6RayhBzEKM7CSXKgLknbUnc9zDXh9+rw6DmkBErDB6czQvA77/hJbD7Mhe8s M1KmKJDFLjtkkZ9kXvlJwL45I3mxf5grRCJkMRETslwRJHkOOjnpkOU43c74AT759dgJv5p0wi+V Awgdx8f1eF96J11wj3Vnrpf2WfR3YBZrtvgRKH4u7vBbLPDFdtGIr9cRnRymIlCbp7ea6EBbTzQg KwYuueJRiDvyms7nJOycJMAJz5plsJI0+zhKnrJ/L8ga+Mn421X+995OTxg9okH8UtKbpz86HmET aUrUXjfYVBzxXZ2eIpTDpBDKaHoiYRNpC8AXDR9MxA9Ll3DPb1Oe8a0ld4Tf+V7OU2YP2fO3Kc2z Ns6cUMnG6Tu+EkM9Wc6p+/DVa/pFdNbZ1rNrD0jZ7TotOX3xt1u4YNKN1hYDZwnWOMLFc658k6QN Frz+ugo2N5ck2aIVkUsaJorMJdIbOZ50syRoa+YSoreZnXxJeIIIgfqNv7jkiUmRLNDyi0CInUZ3 jWz5cb3EyaQ9OvkTLb59OH4u4dnj52dS6WFlSkW8TKmcZjgSP5NurLLb0aLlV/Pyyrlyn6HlFyrt zNh+hwVRej98qF9MUr+2pP425ahfbWJ32Xj7KzhEYTzzoNPdf6Xl6R7yeqRrWIguULuqQuXsqFM4 6QgTH0+6MUCGRTHFUliEAbZi3av9+VPPz2O9ETIXpUJjJ+Ki6Nv0KtIri8rlLcEPZSIvCE8a7Rs5 +fXvbZzvxRvwWoRrEHPAa+JSwmsPMg520la/ryoznFowp7fFegzazShTxBC5pVRlhL4E7MSMMb6I GWN0Wknq2kjOctshR/Kwqoy0ysEx5FFBfanKeA9hDGnlUe8pVRnXwqqM97DSI20q39dItsVJqErP jI2MqMrIss/vNsWG25SqzHik29BPLFUwStxtSDZrQPzPV6O7cK1NxG9ag5AmUzP60BQrrQHAg8p3 MUkHj4o7u6qMK6UunYWT5EBdkral7mskn/gkhldlRmdVJr+sWKoykjJFqcrscmkkAyaO720kUyRW ZRSJNGWAXqW8cPJrG8l4tOPkGAjesbuRjBeE0Ui2FrJ99oNz+wJqvGNjB+TrW6h86TS+5Q/NmCLC DFmu7jZihdUi6WUTiINLr5g2oDPTBqRpA45X2p1XJGqul3ds3uUXgXXpqw7vUyiD/ymUlQdVqAVE /GS/dGxcjLL/MdJnRumLxNmTlsAQsxeFwygR76IPwQv2sgEjQTOOYGnqg8FKzGzXS2/ZrfKqVJ5v +RyWQzO1ikjlNKUgiiFtWWpWpzyxSkAztcsvAsVY2o3tSEms3zEFnZTbkWrLjgv3fSMbd5dEMczz hBwxRTUIj7JtQzOhckNLFrbBkUXPUozUbnrg4SgmeHAD86XF+LJU5g27JzdFkyt7yyFHx1Pl8I2U POj2lMNoqItycHyRY2nfz2tAAA3TRDE5h4IaThGjmyn2oRjjkW7jLNxtGCXuNiQtaHb2ljlDbxDS ZEoUQ1qV3RigGKxTLu+hgZX2jaDVTiDCVJ7qkhw4mrQtdV9vGffgFFjc29zd6EQxoz8xAeXiQY6J pExRUIxdDhSzsHn23QIghXlXmcIUvKIv+JDm7I5fnPxa/AK0jfZ5fsHJzqayPez3V32jBq8F29ez AdH4E3xrb9cg0+DLqA9TmXUNskR/791v1/RaxxbhWrdmoEEWqr14oqqdNNUu3i8Qh7Q7QRyH23Ue h+9wghQnG3mDbL7mkg5WwiWd5vQEN6TN7Wfb4pOOhYOVXeYY7GWnaLc+AyvPWmZtEBSQoesvYa3m IM31crzSnjgUQSI8BMTYuAArL9lD3cObLbRHgSUmj8OUlMd2UdKNPYoVElBudpBWLdI37up34b5o Ed9vINzG+wmOBmO/gT5Y2EmDje6p+w299xWYQrjZJOHHHRbtk3LucGoAUXAZAqGEhcESCml0ilXG Fx71HvDwHSx4JI0nA0WsGJ88cozJ4RAieCSt99gcKZeuJccoDzo8eRTaeOR4lcscbt6eWIQpxjS2 1pwDW2uK1U9pU2zAlNKjA0t9kLKzmpOMEocpJJ+uwRJ33awbo5ti3EBkSqOTVmWrwbhS8KjKzPcT ItnTKSqPRjsJ+XThYOHNFt7B0aRtqazWsm6LT9q40vcTJtTpODqSldrKjY4IGdHuQUfDj8APQcoU CVP8ch6Br/2813ZRCUVJ94QiBTgREREdTo8Pf3DDhgdpq57tUtvFm/CwE/DjiORTTh53gpX/py8d 4Ek9AJTP+tme48Obu3gx4b/ZHwzL4KtPMMiaMNadsYf9cNtGKwZf6jdNZ+CaKuC3enJpw2cMSDhO odN4blKLSf4yOrzEcU3Q9Jr2epxXq9dgN32x6CfQCKGs9ZJCKR1+4ugm6Hf5DSFSNYq06PacV2OZ x/E6nsat42p8t7v+zsZTs68dYq2HmiU67Ue5EmRn6pTkNM7SNPypNNKN0nZDELPUCC/BNrR8trt1 XL2+pES5h9FE5JIGp8U5bYnMaFwS6WZJJWsEqhK9rRxXj7ebPOa+vKSf6xlc5DJFpx4HsSsoHS25 CEZHuUF7cPK42q/ncTWjs8fe61ZRR3Osy6ROrGt0tOQiGr0lF3Rjld2OFi05jU+3ywvH1XbYnK8+ 69teOLS2K/ZLHPaisx1d2wvQ9ivC9tnGxOvU6wk+j6urrE2Cd1z+eqRrWJgBTKECJay4CAWTZmTT AKQbA2RYFFMshQUNsBnrqwcIAVSkjp35F+ZrhcxFqdDYiLgoxjbHk15ZVC5PNDeL9ViURvsvotFr kC8qKCWxfkJhvs+ib7tM+FJ3/d0xW/2+42pOEPjQ21ZBcwovUcsUMURugeexuiFMDdrvifEND6uI QgwH18GDCCR4+PjKg2NUdMiBRIlkbQBcUAtp8uD4yoNjnEckV1eH0WjjkQfHFx5ZLS19gsM1TBP1 c61E/c4yRjdTbFRQivqrJ6TbOAtzm9gRrIIK0txmZ6PXFFGM7lO40YOpGX0IWiaJikjvKQYjD1Nu 3NPAThhUeLTaiWqU9jFdBgcfHbQtdVejd5TfTbIGgVZQTmcFhbPUBwuoQU5WhZIJSv2kV7N8wpOM f/t9v8/2LUdk4FmjN4RhrWTCZe10nURYPto6OvmVjV48eilPRGWjd9rzLUr/GbXR6fDBHhvOV7tx yZq+/+vj1jdZ6/NzqFzr3Ovt3m/cX7T2bSg//FE9I8sitz2rHyNV99pddC56OWqiXa4g26Q9SV6x fTgmgW+IY0CYvkAgTNqc3wvpss8HEF7cHB3bF1eAVIsF0azNeD5d8UIoHlb/GA3g2d4L4W6Py4a5 n4CkPnpSZbV2UBXIVuUqo0pIX0QHCB+qjHSjskQRRXlLeMJVdpkievZ7sFhcfw9bF5Kf+l/GHk3E XJLSsuv5EsMprSB0cmVBubQtH8AX2J2+MTp6tnjsEKiFIiIjv+tz/1kLcfE+vCxeI7JezkKoDcnh 85fOBEvGcBDOkAx86iFp9MB8HPiW/vc+cwRe1aAsva3TbU+C/jurguxrnepDu6fyWK49kFvrIvva KKt/th/UFW3gFwcthW84DDBWnNhFhtgMgFJ5uk6zRqBOaQPGMGsE0o3OSyRvp8HQ+WpUz9JfSXub i9JE5Y5kUZyLotBcVDi2wvKKOlL8hU+it1nqjSVJXH/jHscu+OowjfA1UBvhK3//TLGu5AC8rtOd G8Ge8/oHiycL7XoLenVM513woDmFqBfgtUwRQ4KFViQhZABgvyfGC+3gNcaQh1UkyYN08PA5Ug59 zxKvYIeuvMpJHgTR5NHxFPe3ewjOBUQjYs/kmWmU6485Ug7kxtm5EZTPa1n1hKAzaC6PZISKQwSb wpHrhttI1LCQ0XvSbVxKt7mEDPTvY8tWkNIufQL7xoRxVJhuQXMyKN2pyhQFMcJXo+Lhqvnzg4xj Di8cWr2w3iEDWE61KDdgjRxc7kfmmTVa8ppFhrgTcPfjHOdFqGeUzmoH35eIv8d5EUnxplLv2OX6 WMtrPX/4LtrSIQyrHRUG6yPN2X04ySazF0iTCRHr7dOg8NCTohHfEjaWzXRfsdM8iGvnPlb52OO4 OAOyb7ZabxTqQ7njCSWPCLCSh1fb56J89FyXX1xcqDbNGRCpc7dQj9eDoDBAOCS9wZMJNW4lzyAY Sr2D7mDXsSK9vvGAS++bRTAVx8ErnZPYNsSxiofTE74r7Tk3jb/0acEhgklY49/5YdywRoS3LL+E eywfvizomHRYo7nugHecqnc42u3NIQjYr4k5HKQwVwQocXMQ7XJ+jif9rvhUJvIyUY3Ppo3e/xbo 7sdb3vkukWXr2G4893K3cV1wu3HSlj6HJglXoF9l4a2kxCiezLkZMTF388kEMUR6UcJA0EO0pmK3 cpFidBExxjgHD3cTIaAHRYjRlUO9JTc8LgKeiBateTQ8uM8vugqOMRnC6YUsWxxXoaNzvzJFE4as bOwNz9hTfZXcUn2CGFsWKU8/nR/H6Yj4WH8OikKlpzgLNx3Dwl2F5MoKWnDVGo+25s4p27YhRzLl eKU9M7bKL7ZqVJvphOPJE4IiMxpyjJTgeCSUp/CEd3A0aVvqvnYsfuLOn9cy6G50AhRsgvAsByjD SFKmKADFLgdAwdcp1Cx4WK75ZVPqv9BBfnJP5QlMonRiFAoA/xRI4+TXdmShbjSqXu3IboAU+Vaq z1r34xseom2L0hXX5SkXXMJTLni+JZ5ywef9T7kgG+CXrxDxKvhGL+CneBP0WfPIG7G0XPizWK4k I1pOYgjKpumit99eJ7hJVxp+9ZsvwHF72kfeKUyJHM+4L1kvL52Z0IQSWvy8+GhUMBFX+ne2CIJD AYvHUuQHtwhprlfqUBlPmsHdXg+AQ5MMfz7sN4ljHJqEGMfo7/HT8w/p6oYIxDhVpCWgmdeWIGe0 Yn6OMNmzdzHrx97FjYN7l3so9y4nzSH3wRzbBGTr8oTuNUTQnEJ6MZCnTBFD5JY8gQ7gG7uf3xPj Gx51h4QYClyylGmyA/aVnqcsNcao6LmDUlnsm1D2GF/lUACT+qbPc480GnJxLRxfeCzBnLwGh2uY xgl06MshD6eI0c0UG26TJ9CxLfZ+YkZklLjbkDS32XcCHTP0BiFNpmb0TJ6NwXRlxWCdcoOHo1ml HTa12gn0mMpTyEMOHE3alupFVal2m0ILypOezAiwXE+gjQ7I87gjMI76/LLeMJQLMk3CnvjDE+DT l39FPjgRHE+RjEtF4EOpnI65eBjNC66+TIRLnxaSo0xrDZojlCTgh799gYdedvyqz9//C148wo/4 /PXHzedxxweex51wEqmzfOt9sdd0V2gTedAB6IZCJ1KhZj07AauUK/QACYv6l4JX5vUvi/30xvwE 0wR0CLkMr6gLqFxKFyn8jnLFAmAbs8y+FJUT0wMOu7/lcfitxgHC78UWWbFI6MCOnxyDuA4iwJWO ArWs2NFJuQIdQC68ug7fBp6Jv8yQy6FBLutOU8/FmDUCqVAwQy4xGfKIYZ1yRQRbCsu8thCg2aFZ Nc/W2diLHUzfhiDmeuVNeBbohdnXdyWmLN2GsEO4hsw196CXnIDQQmeQEHA0Q57djDJFDNGKVQCQ IREKaXSKFeOLmO09RC8UC2L0GYNzVB4cQzkcWYQcpP0e45ly6Vo4xnlENHg1HjR5cLzQsSPsbNeY YLHjUk5FLylWP6VZdQO9lJMktRrwUWc1I0ucGH4pF2yS2Trgpbym6dOQrvlGMTyVY0YqbN30vOIK a4xbTpXocw47eZdsD2bqvKJ9iFZTqVcXx1Bh3kMUWa5g2YIRtp9YgfYAYx7yxoGgFVm36iGuMGoG jMTPViaiETvwgmg4EU38YQ3R7Hp8A84IRBNy4Hsj8Rn7RFxhO6dKZjeFADyA3t7R1o+d8GjzTdZc Tp524hq8N41eDFANTpjQ4QHEwckT/t3zY8vyizh4p4WTr5w6rT7I/WLOnjmIOk15pMkgSvEQ91de CQ8uajdgUy1DF7G/pPMUyPNyt48AhpJIqjWQwysim15pZJODq1623EWXPi3trNYfopW+NSjdDmOC Fa5b8oU2fxktyE5+pWoC4QKIU66Elbq/VPCzgEyfCacFJkVBknH4wysinAGgIooDoHJFhFsyTl7D DzP2R8gBgGio7XCqzzzZlx68GE4be1lW4pGluZvFBb5GQNVI01wfqSkXoAfE6C4oFHwzsWdhaql+ KJyhbLRzygVROXcE3hh7YzCXPUKPs8qdvIseaanYoVHcKRGrv1oQV5hNqli8q+PV3Qle8FqcM1Re eqXhNcteusbuzowfrprx0/Dyu1q5ElYsfUImYWg662j5FLl9e0/GvCevWDTM3A2eQeyNqTrfCXdL NmbyEmV2Cy84qmkvIoLnt6nrYNxJgQTdNi/46cozt1Vn5+yrEw3J19dYLohmOvnC/YOz+KwgnYZT vwbTMVHiijk7T8+WZxMNWkbMZu9z70JYl1BPmBqMIhjjCoNR9EJbzJeqTm+QNu6MYIwrDMaWl4Z6 4b5PS13cZbS6L8LTPH4Xpm+h5oKWsDHQs+TXeW2yYBSTxZWcrGjJ78orfxyQ/izI485IDXGFqaHR kt8VvNz9n/hSH+YymbQsiytZRbUweaujfrcnp+ZG3FL9n/eE0Hqslppd+pT5jJwjn/EC9jBbRfGZ 5al++/8BAdmLKQplbmRzdHJlYW0KZW5kb2JqCjUgMCBvYmoKMTMwOTkKZW5kb2JqCjIgMCBvYmoK PDwgL1R5cGUgL1BhZ2UgL1BhcmVudCAzIDAgUiAvUmVzb3VyY2VzIDYgMCBSIC9Db250ZW50cyA0 IDAgUiAvTWVkaWFCb3ggWzAgMCA2MTIgNzkyXQo+PgplbmRvYmoKNiAwIG9iago8PCAvUHJvY1Nl dCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9Gb250IDw8IC9U VDEuMCA4IDAgUgovVFQyLjEgMTAgMCBSIC9UVDMuMCAxMSAwIFIgPj4gPj4KZW5kb2JqCjEyIDAg b2JqCjw8IC9MZW5ndGggMTMgMCBSIC9OIDMgL0FsdGVybmF0ZSAvRGV2aWNlUkdCIC9GaWx0ZXIg L0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4AZ2Wd1RT2RaHz703vdASIiAl9Bp6CSDSO0gVBFGJSYBQ AoaEJnZEBUYUESlWZFTAAUeHImNFFAuDgmLXCfIQUMbBUURF5d2MawnvrTXz3pr9x1nf2ee319ln 733XugBQ/IIEwnRYAYA0oVgU7uvBXBITy8T3AhgQAQ5YAcDhZmYER/hEAtT8vT2ZmahIxrP27i6A ZLvbLL9QJnPW/3+RIjdDJAYACkXVNjx+JhflApRTs8UZMv8EyvSVKTKGMTIWoQmirCLjxK9s9qfm K7vJmJcm5KEaWc4ZvDSejLtQ3pol4aOMBKFcmCXgZ6N8B2W9VEmaAOX3KNPT+JxMADAUmV/M5yah bIkyRRQZ7onyAgAIlMQ5vHIOi/k5aJ4AeKZn5IoEiUliphHXmGnl6Mhm+vGzU/liMSuUw03hiHhM z/S0DI4wF4Cvb5ZFASVZbZloke2tHO3tWdbmaPm/2d8eflP9Pch6+1XxJuzPnkGMnlnfbOysL70W APYkWpsds76VVQC0bQZA5eGsT+8gAPIFALTenPMehmxeksTiDCcLi+zsbHMBn2suK+g3+5+Cb8q/ hjn3mcvu+1Y7phc/gSNJFTNlReWmp6ZLRMzMDA6Xz2T99xD/48A5ac3Jwyycn8AX8YXoVVHolAmE iWi7hTyBWJAuZAqEf9Xhfxg2JwcZfp1rFGh1XwB9hTlQuEkHyG89AEMjAyRuP3oCfetbEDEKyL68 aK2Rr3OPMnr+5/ofC1yKbuFMQSJT5vYMj2RyJaIsGaPfhGzBAhKQB3SgCjSBLjACLGANHIAzcAPe IACEgEgQA5YDLkgCaUAEskE+2AAKQTHYAXaDanAA1IF60AROgjZwBlwEV8ANcAsMgEdACobBSzAB 3oFpCILwEBWiQaqQFqQPmULWEBtaCHlDQVA4FAPFQ4mQEJJA+dAmqBgqg6qhQ1A99CN0GroIXYP6 oAfQIDQG/QF9hBGYAtNhDdgAtoDZsDscCEfCy+BEeBWcBxfA2+FKuBY+DrfCF+Eb8AAshV/CkwhA yAgD0UZYCBvxREKQWCQBESFrkSKkAqlFmpAOpBu5jUiRceQDBoehYZgYFsYZ44dZjOFiVmHWYkow 1ZhjmFZMF+Y2ZhAzgfmCpWLVsaZYJ6w/dgk2EZuNLcRWYI9gW7CXsQPYYew7HA7HwBniHHB+uBhc Mm41rgS3D9eMu4Drww3hJvF4vCreFO+CD8Fz8GJ8Ib4Kfxx/Ht+PH8a/J5AJWgRrgg8hliAkbCRU EBoI5wj9hBHCNFGBqE90IoYQecRcYimxjthBvEkcJk6TFEmGJBdSJCmZtIFUSWoiXSY9Jr0hk8k6 ZEdyGFlAXk+uJJ8gXyUPkj9QlCgmFE9KHEVC2U45SrlAeUB5Q6VSDahu1FiqmLqdWk+9RH1KfS9H kzOX85fjya2Tq5FrleuXeyVPlNeXd5dfLp8nXyF/Sv6m/LgCUcFAwVOBo7BWoUbhtMI9hUlFmqKV YohimmKJYoPiNcVRJbySgZK3Ek+pQOmw0iWlIRpC06V50ri0TbQ62mXaMB1HN6T705PpxfQf6L30 CWUlZVvlKOUc5Rrls8pSBsIwYPgzUhmljJOMu4yP8zTmuc/jz9s2r2le/7wplfkqbip8lSKVZpUB lY+qTFVv1RTVnaptqk/UMGomamFq2Wr71S6rjc+nz3eez51fNP/k/IfqsLqJerj6avXD6j3qkxqa Gr4aGRpVGpc0xjUZmm6ayZrlmuc0x7RoWgu1BFrlWue1XjCVme7MVGYls4s5oa2u7act0T6k3as9 rWOos1hno06zzhNdki5bN0G3XLdTd0JPSy9YL1+vUe+hPlGfrZ+kv0e/W3/KwNAg2mCLQZvBqKGK ob9hnmGj4WMjqpGr0SqjWqM7xjhjtnGK8T7jWyawiZ1JkkmNyU1T2NTeVGC6z7TPDGvmaCY0qzW7 x6Kw3FlZrEbWoDnDPMh8o3mb+SsLPYtYi50W3RZfLO0sUy3rLB9ZKVkFWG206rD6w9rEmmtdY33H hmrjY7POpt3mta2pLd92v+19O5pdsN0Wu067z/YO9iL7JvsxBz2HeIe9DvfYdHYou4R91RHr6OG4 zvGM4wcneyex00mn351ZzinODc6jCwwX8BfULRhy0XHhuBxykS5kLoxfeHCh1FXbleNa6/rMTdeN 53bEbcTd2D3Z/bj7Kw9LD5FHi8eUp5PnGs8LXoiXr1eRV6+3kvdi72rvpz46Pok+jT4Tvna+q30v +GH9Av12+t3z1/Dn+tf7TwQ4BKwJ6AqkBEYEVgc+CzIJEgV1BMPBAcG7gh8v0l8kXNQWAkL8Q3aF PAk1DF0V+nMYLiw0rCbsebhVeH54dwQtYkVEQ8S7SI/I0shHi40WSxZ3RslHxUXVR01Fe0WXRUuX WCxZs+RGjFqMIKY9Fh8bFXskdnKp99LdS4fj7OIK4+4uM1yWs+zacrXlqcvPrpBfwVlxKh4bHx3f EP+JE8Kp5Uyu9F+5d+UE15O7h/uS58Yr543xXfhl/JEEl4SyhNFEl8RdiWNJrkkVSeMCT0G14HWy X/KB5KmUkJSjKTOp0anNaYS0+LTTQiVhirArXTM9J70vwzSjMEO6ymnV7lUTokDRkUwoc1lmu5iO /kz1SIwkmyWDWQuzarLeZ0dln8pRzBHm9OSa5G7LHcnzyft+NWY1d3Vnvnb+hvzBNe5rDq2F1q5c 27lOd13BuuH1vuuPbSBtSNnwy0bLjWUb326K3tRRoFGwvmBos+/mxkK5QlHhvS3OWw5sxWwVbO3d ZrOtatuXIl7R9WLL4oriTyXckuvfWX1X+d3M9oTtvaX2pft34HYId9zd6brzWJliWV7Z0K7gXa3l zPKi8re7V+y+VmFbcWAPaY9kj7QyqLK9Sq9qR9Wn6qTqgRqPmua96nu37Z3ax9vXv99tf9MBjQPF Bz4eFBy8f8j3UGutQW3FYdzhrMPP66Lqur9nf19/RO1I8ZHPR4VHpcfCj3XVO9TXN6g3lDbCjZLG seNxx2/94PVDexOr6VAzo7n4BDghOfHix/gf754MPNl5in2q6Sf9n/a20FqKWqHW3NaJtqQ2aXtM e9/pgNOdHc4dLT+b/3z0jPaZmrPKZ0vPkc4VnJs5n3d+8kLGhfGLiReHOld0Prq05NKdrrCu3suB l69e8blyqdu9+/xVl6tnrjldO32dfb3thv2N1h67npZf7H5p6bXvbb3pcLP9luOtjr4Ffef6Xfsv 3va6feWO/50bA4sG+u4uvnv/Xtw96X3e/dEHqQ9eP8x6OP1o/WPs46InCk8qnqo/rf3V+Ndmqb30 7KDXYM+ziGePhrhDL/+V+a9PwwXPqc8rRrRG6ketR8+M+YzderH0xfDLjJfT44W/Kf6295XRq59+ d/u9Z2LJxPBr0euZP0reqL45+tb2bedk6OTTd2nvpqeK3qu+P/aB/aH7Y/THkensT/hPlZ+NP3d8 CfzyeCZtZubf94Tz+wplbmRzdHJlYW0KZW5kb2JqCjEzIDAgb2JqCjI2MTIKZW5kb2JqCjcgMCBv YmoKWyAvSUNDQmFzZWQgMTIgMCBSIF0KZW5kb2JqCjE1IDAgb2JqCjw8IC9MZW5ndGggMTYgMCBS IC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4Ac19244kSY7du39FPFZhMLlxj8hXCavd HV2AAQpYQIIetK3ZGS26Rpru0WX/XofkOTSa39IjsrK60UB10NOCRuPNDunmHn/Z/X73l93h8HI9 8t/L/f5yu+5uV//fT3/Y/ePuz7u/+bc/H3Y//Lzbv7webtfz7TD3afj5h9398nK7726H15fzcfd1 d9wfX65gFvSPoq/348vrefcjhyf5p90/uzzBhZcPh+vL/b47XV/Ot9fX+/CISDuI9Lp/uRSRDq83 W2yINPy4E72/vRzuEInDRZpI+5fD+XV/eL3OfsIUf8Efjufd3v6zD8YDsmLh+1dMPvzwdfdvvuBP +/3rYfflh90Z+sN//N+Xr7u/+fLl8LLf4Y//vPsvu0//7n983p13n/78effbw+7Tj078N6eGT//9 8+6/7r78bve3X1xV/cSH4/Xltr+9cuJdTLww3eDTfdp93n35l2D3Xl8Ymn9AK8f9CYqT8eEM99fi HHCGoNP6HB80LCNv6K7v7teX6zm9Yfe2N4yFuptrNg+9n19uKaQJFbTsf9zHeKcp1MP+kEzMG8Io kGp/2L/tDZ/2r7fj5fB63l+LocYOd7xdXi77V9mdDjdn95PcrNq9mW3mk4V1LsCDxEw50lLQ19dL BBHHJ91FEZY+jaeZKEomt5fTecGVhxo5m5dkaSG5u8ha0pAic4nFO90Rku6WNJcYTG8TO4U3XZHg FpfUJYNY0uDB/t7ohJDM3m5SJKljpuavSEZnkylTNelc7zHGJ83oHPrrh+P5Zd+S9YbwHEsFR04p IJUl0KR/TDrDEx5nfxfdWWWzoxmTU0YPXc0C9HSbpOthmq5/c/IMffF/7/4vYvW++/Tqn2/+79H/ jTEH//z6eUCSP/vnvf979X/x3eUMf7rfXvbnEzY031rmwoISPh7pHhZVoUMzgBRMg7QwifFJdwZo YVFMMRcWMsAVm/NbgTHdttKvmy+VTxbrnZC5qBAaSV2LEizReNELi2rLM81NYj0X5dG+kpNz668J bDXapyDoeAFEOTr+wEZw3wONvBz5CcIhP1cQBIkyqrD+IDO0Y3CSsfrz/Xi6HF/BdvrJVOxIb2j7 Kjb/hFmAVbaJg06mRIZJ2yQdQIDvWWrp9uag8ztjAGE8+jRmaQ2pVmLB0kY2KcZJLpb6CoS7v9hS 66f7Fbtsw7jX++Hl9d4wLumGcc/QcYO4pGwCsyw0Dpx89atvA9xleRrATXkIaIOGcUVfgb4Mc0OJ cIWryFjydENum/SMbxsPB7jX2xGb+eMA96fPu+PuU2Da3acfPgP6fvoD8t6wjGyxsbxerruYcS7v 7frMPGyOppldaqxx5K/Xq3tAYAdHtqnydER3iYZsaXQB2CAH+UB3+U1YO5bIvTN9UmgmnZKALOiE tWl1jZ/1gpKsV71ATNwHyq45A2vHu+an/eFyOx1P5+NhC6ytRh8egbXLWoMdBy0gtCAM2GJDGPBy i9DReNFd7Dyqtcvry+uCG6+h2tUVJaoNCbWi4SqJtaL0zAC1JLv1wMGmWQFKm+xzxLTn2+J6ZiAt Cs7h9w83H5YXXyBthmVmd4alaC0eWQwIOJJwKTfr5RGene67dYdou0bLFEQeistEGiZSQR6KQyEP 0VsssoI8Rtl5Ds+Osqa1H4hnA9UGkg3EenHEGng2/hqoNj4Hko0rMf4NJLt/QUo9M6Ov4KMlJPuW NzjIYcproE+qlSkyNGgq0Z3qNwd3gr6l8J5kwpL/esCx4k4uY0PnGd5aU3p4qGBreM+WrLmixwL8 qZp1BcU68nIUS/z3dQJbY7Ha8oRiGfxhzuvtfj4BsMD14hOynD4ZTCYLb08ie0b7sgFO0eTpwwfm m8gg/VeMxRj3kiaLHM+EYGL237Ek7o2zJobo5NHzBI+h/w54IKsB/jUeosVjxNPl8DFYH9Wh/Kmy KGnxGPEMlU/KBShf16DyZJKTjBB6kJwiRwftWMoKnQ3FT24LMjJZkrQYsVIoXKyLGEnb5G6fsvSB ap2hTN7cQuZUUNKJyhRpLHHoFek9FjOeONBWhUOvF5Y9EinLHvuCbTrR6hG7MNNKY98gL7TkBQvU c86iZ7ienW5FD7AAGpXZ2BdpU5SyJy6/Xfcs32sodU+I8DXrHKdL3XM6ouLLsodUrHmKbxrmwZrH SAdWYdVzQvuzFT2H06RLNLOr/h3qG/R7UPlcd5++orV/QgHkl/78ecDnf11r+xxw++OCbtTVZl5A jURZ0/7IaithpvgZqx0BK+9wd4/iR3qX86Yr0Dtle5U5TsMu8oXu+jdq69MfLWV6g7r5J2maX0A+ SGaRB70heTSLRE9/eOsOz6f99fV039/uuKl0LNv/2N+OuBV3PJ5p9ScA0tiQVjPGNYfLsAhuhVxd CU1lUhE1dtx7+Gi1JLv42QyOOOHx+HK+LjjxWumzvJwoymM5LqGWM1wlP5fTvDJGi+4WNFf6zGIj LuiA/WBpQTO1z1PQSBGYJhwZE8nJixkm6MzxTNCitV617UUzKrOdH9dH5c+GXDGWKgCVckXiU0kV 7f1wQewihOB0wc4mm50s8WpJlQ/08qOKic591D7RlY8rUelEjz969lEN3b0yijFxPSqgqIbW66DX 08vZEoFy+4B7xY/0OJbDwqO86rRVQVSxDKIo4eB3RXkaYDHO36iBlhfkcV5l/DqMViBSfi2XEt35 1OY4zyU9EunDk7fVV9BsKYIc/GUNRCgoLMvwQs6zVq925lj7thKI7FWekH+SmsDCu6FAmyCH4E8O FKM2SQYkySBHB+07cYeXLZFH9SMOIpNDz9Fl8DGQizIQTouDSHEYcXQOGuMc0HL0m6NCzEmKg0aT DkWvlA1mx2QSQvLOBGUURYY5tpuAjoLMqDs97ZNBdgxO6zdPIQu6iuLCBw9XkW+uIHZcP93TQBdr Xfc3ID0ZUkxlbNHNVPJRWHukyqCbYPKGyqPXThY/cnvqkt9IW1YObzZeWP7YXdBS/TiZxc/l9fxy b8VPkrbMVvzwMoufw/HliDvPrw83FqEmMy4F0j0eI1vpkxLE4CTDuA/CXePht3wuuEd7vD5c/eBI E+6I/9PnHUqdqIGi+Pnx84Drf/28u6kcwl+X738fsKv7vfoQYw5Fru0uj5ZC0WK0Aqg0G1t3Fw6P E06yQvqmeQncIvJKqj0KniFp+QULIV6PG0HyixnEVQTxDqELV0QirqWnCvZKJC+LUgSietHvKoR+ FQaBlxoKZlgoMTBOSWq1nmvgyUmnQYILrxMDP28R4hXJRMgrmYJMGYhXRD9pEeGVapPZ+2aPHz2A Rw79kdAVvGK7BLehSLe5DSkbaxsK/9TYoCJPqT3bGrXtk7HH9mkhaI0nOzPA7pqye9KcgKPbBDnA O1fGwPBE2XC4qdFeObxyCASiFWYaiF5YtmKTA4cXDkQgyQEOaP2+XIRofMX2VQ0vHDSCq0jPDxkS bEgGH45FNg6tpTn3qeAVCVm3VQglMjjm/HWCLY5CmZqfBIOwsqKCPpVkOMoEbyEz6hrk7ywnOzNV JFZJlhwtOoBp1XuDKp1Od/qGrJS0CRlqyTWOdWat7hw/zlaxyEkbwNI/C6aIBrRpLygpXxOnkGw4 BY1qHMpWk/Yi8k9Dh1Pi8ginzOxHy9WaoVw4GnCKBCJOCTKPpqQEHJwCQWPZkMU6p4gFE4ybZsYj cAqSCXrRefZ6pks7Rgq49/l3gU2iVxv/4nTKJU6nrJy7vuBe5vGyu/ikK626xxPuDDRcVnnAckcl 0nnCEPhESx6pc6GPqnRDSf31CSoZ7QFyweaM7ZPHnqOSJhJhiLnpj0iQQUoEoRLR4flT6zePmPGD ZGJe8AsbBD4JVKLVZ2CHQURqtezMpYFs9W4QcolxU1TyoEUClaRMgiFhEXZRUgahEsn4nEUSlXyP INmy2cAkXrJptwkSQaLtxrWRu01QsfZNqIT8EpVkbs/dhRM4KglbdLeRUz6iksLAQYS+MuJnIsY3 2gozDUSRKlTSOHQMnUNXv+R+12SAQwKlOIeSWHzv4So0glqWq6tQTjrUwFpfIoWitYO3vbx9Qtgn i5yibaKJSsQxB1dLbnEU1Aj2leYnnd0UFXBr2+tELsg/i0rEP61GjQT4TJayM6eoqCQ5SOfkQFJC yQ1Em5ChllxjoJKmM1eoxkuFomORtTqeKUoRToZK7vCXgkqcbKjEHjhroIQU2OOYmM7LXvxqQpIZ MDIuju12RJ7bHKALN1DIITBCOURyZo5tcjQo0j4VUDKzBRmLgCK3vXWG3gNF8PRX3i/GI2Dxea1N AgyA+4e7i0/90fvfqtoblKD9mVdM7yVvUNPCHUXxFY74ZaGR6gBDPJ74liSBQ+SJAh4mmNVVgUNs DhMMlQ7uj4bTRUJriGPu04wLiMevwQpwR0MhXHsGclhBpKzAwWMr1MsJQR43A8GHRCH4cBKVJEmZ gYOLKHPKb9fmzJDQ43sYYsuOom0itxRPqPA6Qg/qQltKOGgk223QI/g16KGEnVtIsOynswlygFeJ xsCQwVD2oEAKlDCHNxG1icWU4KCAj7ozoUdy6Bi6DN03GvTIRcAPDXoYh5JCyNA5aARXIf8Wh6RD bEGPwqHBjLlPBXpomdw3nYRQImOC0XxhyS2OAsUbh+YnwY92Y1DQTboQmQCneeBB7mkz6oPAgxxl ZE2ATkEaNaQLBTK7IHdS/fo+7anvJ+igCXXPJtaauuNw6a58u1WXM5/8LmlAjuuNdyH9TtXFyQY5 LnbrLfsgpMw0BXL41YQcDxfj0INBDsqRGANiwUVEcmaOLXK0pDb3aSbRGYuAHDgifFXd68cfNp1R +9+CFjiphjNqBWDAe+oj7gc7IvB6Rgz6RHP3YcZn4PJ5nCcO/i93PMzYiRlobXmbkbat+w3kC/Wq wUXNFWD4ZQGMh82t/V5+J0QR9hbASEkCYBRJ5szcrs0YXBNWc88dHvkefSc4nwEMrj2jNtYuUmvn 4LJ2t0K9vAYwlh2inBFJUYQowiEEMGxu2z0IMIooTeVzn+bMkADjexhiy75B3Jr7hiVPLFb7Bp9o 0sZBMralLQBjCFjc8AWTc+4UmiBaG/AJ7Nd9b8O/0fBFMgg0oG+MGfrmXnenhi+CQ8KLxqHn6ByU IqzobPhCMsALDV44B/MQja6r0JjgIPcmhyT5DeELyRSKnmzRqCx1DU6WTDSFV+JcJeGFGObYIiLC ccPBeFjSv9M8hSzoKgwLekoXJJI1pZ6HGOIvjCGZRZOnLB1k19tIDlJ6p1bsQbGRy05FyNBLW+NE ba5TfkFKLN+3/kF7EGe5t3HxYzUtHIJuUOPAG3FQqrVCSPoiC9iIy0QbeuNNLa/4Ep6xSK3NUe65 SKREGTz5I/pcD8ZfSIVjstde2hstD85kP1iFqANnbnQ83UDHcdP7E/7+fzrqiBbHH/0zTkziPMi/ 96eER39NTDJ5EvGAw1O31zPUW8TYthk+AUnWbZAoQ34hEEIjyFXlFxov2uwAx8AjqnEzJ64HLnna MRIspFDR8EhnJVyhL2j4e1wjefSOseUR4dP+djjf8TKj9oKi8c2+4/UIi+O225LBeYfv8ScI40Za 4DNf/9e8TSXtUFknOLrdTdVKRXeR1FqG7ZOF6mRB7DnheO7jJ8pnclVLDHVBIaJtnGF/iRz0oOyU S6pO2RLB3KeVJaFgOB5/4UYkEpUhVGXGzPcWD9jnRWu9tmvbeNEMSh4c0nXC1BKV41txy6migtWU imjVaZOKtPyOcHUuKptzlU9zNkm4aoFDoywckh+XcfaAcByAj5fZ5BF3HOM7+TH4ejA+jsHHofr4 VhyYzwP2mc4nsYBHZOIBYY/uFc95PLq9aKx6zIPx2gel9AwNjhbdRffWfdIrDXvR0GUxvsdHErJo xm7wdnxXIdvjwRcJrUXJn1X5iO4W1TyoLG/VlzzC1zsB7344bYJoIZxOP0O4ilIT0BLOCc9yB9ZQ klg7WG0pfQg3C9Yj+oyjZ5FdWqmlzdWU20FcYxCVCQVMkiLF6IHpSsVT+Ypl8L63ITI5cHTQHab2 ScGBkFoyiBSHEUdfhY+BXLZua9354XiB8CTFYcQxnOyN0iGZaIoepgfFCXIsaTvHZE6x4Zng3AnG voFpUf95XJglwbmBdn+CMUseTDVZS+y10XJUVg/jNmPK2Io9uYZoV3Sn/GIrWynkku30HXmDaOPR aycbrfJKr4fajq/RlcNMh9VSETswFnSsafCeznIE82Lv7Qxg5Jo4Wzo/Zrs1SROylUC83Eqg43m/ Pz7ch4PPucVchHw2OESC4lQC7eMwhE6piQwXffDAkU0ZrVccCITI7W7vTBU0s6n+ffReaxWEE/J+ Wn7AE8P/2nVjzcHLC0cPJ1QJN8xz8bk/OAfL9OkESJy6Bncwz8apeNq/5aj0h/DqdACODxrGkUN0 19sDwu4QMzXxuCM4FiqwfAhhQgX0bUIFLRcQmneaQs0B3nZtbmskmi9GgVQb3/t5Pdxut/MdaGGl /tF7P8PuT2CksdZaZEdjPbQWWmlaSy2FFs+viHALbWot6S6QsPRpSC1r7Qwwsz8uuPK7HxOmiFrS kCLTMYp3ugqS7pYEbU2WtFLWYaOw7s/qW3njJcAB+z7wQeGMzsz4zNakc72sgZJmdOpBYV5vNdDW 8Bw5GpGrwjORqqRiDZSOx/GiO6tsdjRj4nC8BCjkevC9n/nWThRAUe5EiVP/rQVQvPdzSwF0A7DC KxdXk7pFwlIBtBzcte5UcIfOh4t0Shu0yAidJ93pfHMkSOer4T1+aD4fpW0bzdwn23w6IbOsS6G5 yHRnjRc4eXNRprlJ1yYX5QG+koa/xW24bcg2EFzWQE5iHyPQPfCxCgLb+pTGthIo+CF9sugRYEy6 e26D05lycwCfVAkc3BBo0EAPwSCHNxFzhDgQJVOEvP+THKIGqjJ038AiWKLkIkRjUugsYXWRQSMo Q2ZRtvmT5ip8OBbZOMyVDe0anCxZ5BRe9YTi84gEOebgOsEWR6FMzU+CQbhJRkkUQElGkEzKHuRd XbNIlGcYR3OUzgwkkyVHi+4qVV9jsVKISKPpG7JS0iZkqCXXyJs/qTNTaI6nCpOORW66+4MfJuh+ 74C04aEofXD/CicJddLkTHJ094eX86zJDMZdbiQa6oCToehJYVjkpDCiJQyHi4z1Pnvn54zX6mHy LHr21023fv4BD9f8Fm+CxZM29j4k/NSBvRY2CPvBA1x74wcP7GHk82UX839w5p04g4GYPF7sLo7C Jw3AvBF0yyMyf46vFvBDEFFAcZzOolR3eOSwaxHHS5z0B3b7iziBdKs4M/i27PRzW2GUPL8Kc8DB 0b3P9SvAPVhhDtFar5CuaAsINwf5xPW1QynL4VnwVpMnMG3aQ9BE8wuaiO4CtFih2WjOHglNPEA/ OEC27DjKuNpyIuEmNDF1xNOJjk2SjNVvAScDU3iCk0zpSsc5hbf5uik0xPGgP0/s21ZhEbRYaLxo E7Pf2yCGww2JlXgi59X4jkfXJMnNL5Wl3U/fKbnGtedywHFxjCXVIYcX1g16aHJwvHiGyrWlt829 fYLDdUztnoO/YT31RVIsNVp0TLHiNravEX3Ed9JtxIJQRVHCwSK7NRSA0q2hN6L5zdjIQYtpjB8y c7qyaTBJOTEQlZs8ON5peL/x6LWTutRKqUtx0GjRsVQ24rBUteTaJ9Ol92rPV/ya0tVRGQGK0w2w oD18TMAynEXaFKVXG5cTsMSrTOo+tfCbUUU4iATFGGyRSAlTKJJoycDhJB1DtQw49wlTjAs24+G9 2vMFPyfEJhOk2s/Blple7T80bPJbnJTFu00CtvBmpj+yNOrQorOBn/IBUCkzwuArPwT1gT0gAQx5 gXxRXkBaKrd4MGAjmm6gwym8LqCy2Q0MPUWLovQa0w/UiAu/sKwZ8EVCqNcoOtz/QfyaTJobTIyy 2Gu0SHj8p9OK8+f6Ax4EXFEcZHjTKKK13oAr09gUjIlxCVc2W6XIh8hJEEJXUVNIVhHdpIo91Wmm tbmgbNdmwtMntcZcBsvSO/G+Wz+FuT53H6Vt7T40knYfkuGT20BLpPEGWpTWtTlJ46MZbYocYmVm AS2NBfcvipXji5ja81IMzwFtjxPAkBg5vvJQHvFyt4EW5wln0J6YPDS+8uj2SdsD/e5y7rVBQy6t ReMLj7a5z32Cw3VMG2iRvrTRkmWO7qbYBlpCzOY2ZEEjKmroNiLDbQi8EI9TCGaRqd6Cs2ygJRVD ECOmMb7PF71Ri8EopgyWPOrGMAItWulEed5lEQfpUnQslYW1pZ5SQ+VLrQhaLier51qEBN1AyxnZ oIAWkTZFAS1x+W3QUgSZOfYrFEKREqQ4nTeYz5KBw0m+F7Sc8cbQd4MWHKu19gqRzB8+D0b9jIuA MmNA4/obAZqT1WnH3bkI02+da0eZHt06wxhL/pH4RA4iN6U15OayRowf0jryEPGJcW/imXUPSWiR QhG/pFBBN6Gi/eL00zsn2y/FKB/23q8aqu2IfAZt4hCuPyPfaKxPdK4fMWLtGtFplO76FM88ddjy rFyS+EVSsSkjKYR/REe+mtz0Le2YVTzjdvlVNGEiAefG5CSsoo2JTqqNiWSsfhue0QTap5Txk9YU BIxlihxiVWjBM41F4JnxBiDaxBQ+STE8J7TtTzlB38nxVQ7lEa+G2/boPKGs3B75nTFPlwPua00Y ySG311qChlziofFFjjkE0K4VPBOCZeOgzRF7MFmmCN0U2/BMiNnchizoNooSuo3IcJuNeEYzjA0i WkyFZ0S7smUwF6sYjGLKYPqODOY0c26vnaZLsiC8EQeNFh1LVVnbCrz2CeYinjmj4VDxTNANzwDA oTHCu0Z40TVJm6LgmbjcDsyh9YanKx79XWR4nTVhJJLwjEQSfby93A1icTjJ9+IZnE9Gt8nvHWGL 39yE+Wn1rtGwfLLcfib7dMRPz53LzD14qU2fAb/KXc9hPwpexscwDMbwmuP4aK5I9emT7h3wBvq0 zG9xYM0Yp+mzJlF3vR2Xe84dBF6aUAQrKVTQ8geNd5pCtRJ/7tPcNknwUoxi7rDtZ7IP5/3ttEdD beW0HG6BHC54S1+YfWUbfvxATe1ghVKQfZAGLfWnkkijQ+5BJKWJjtzxZAcLN7Xxc6TzR8sWO1jN Eec+uXMGKA0RtSRASi2BS2rOGeNFd0sqICk9wvQ27s5KL/vL8pLGJ4TwG/YfeFou82Kme8aBaK1X oFc0c3Welovr7bTc1ugctUp5yEnRKRCrbC06HY/jRXdWQYhN4eycVfJOYolPyPXgabl4aCh+RwOx mmfm4oRcfXQoxuzLr2Q/8quCy6n9jWcCx9m6qb7exHVVWueI9YJUKzoDhKoX3am+BUQxwqrq16J8 8fef5mK7XbMo74Rsi3Khkc21KHm1xoteWFRb3vqhOY/zlWz8/Zq8geIS3QoWCt0y6IVuScbqtxVF mkAVjmBj0poiiiIFtE2RQ6zLVYqixiKKIn0nxxcxewxt6dweH2qNEGGNxqPn6XIQj+RSWLA4DWdJ jM15xzydR/1Oe4Qoa/9Iq5BLPDS+rKUVQHOf4NXKzSFYAnnpS0CeLHN0N8W2oijEbG5DFnQbRQnd RmS4zcaiSDOkATmFaDENo/e1Qm+AVhSNlZs8KuAkluu103SZyvMCUxw0WnQsdVuT17rax9LkDTqL ohM84dSKoiRtilYU8fI3avJKJBVBEol0ygDRUEOJfGdRdMIzFXpWwFDw1jvT7OD+xEN0rURauzd9 f3m9nS4Qvc25XA7tshx6DnGN26a2wcYhugDRLG/kB/JGp7MckpZV9iRNR9C9aV5/uJc7FoqwNoUK ZC9PINJPIYhgk44AeA7ZrxplEdk/WqO+0WCHa1tvVpGQAU6jkM71BgweklZ0Eh7z+rSXu+t/WWLS YUYg1POWhC0pFbGYrELYklIQtgT9dJEqGJx2+eXvTUeezf3HSaxP+w+NpP2HZPjkNtiiCYQplNiT 1hQBW2QAmyKHWPeqwJbGIiCGvpPji5j9LtdgS/IY5wj8wW5NiafLoTHeRWu7oPMosEXf0a4p2nkQ hsS8tgvGvWnJETR2X8ouKCQ6VD69m9sATIEtIVhutW2O2Go5RYpQ1IVYXX742XJs5wnNbcgi3Caj JgYn2a0B8ThdjRUUtuKSL9KAnIJ0Mo3xfb7oDVAMJh5hjMYjDBz0CLaEAZouySIgYHIYZ7FY6qZe 7gmT45YspIyVk26w5eI/b61e7kmkTVFgS1z+Nr3cFEkwJUTMe9OnG56jMCRF2ELyvbAFhxUBgh7u 5f6VeCWeAFh/2Plwwqsnb6fdyef64MJRndpWMLdP7ukOV1LZ9NqgLa3QK2Vw83x0bycO0F8PuGJv lGEzf3yT840mRTRSi1AOV4pQQcsDBFdEh+NPu0KtU4SVL3TtOqMAt27r3h5f8aqn0x13AVbat3rY uZti7gjlu9q3jAvbZUZaIn29RNxIa6I7rZWGziat4ejR6fxR7dtTiKglDaTNO2OJzTsd53be2cSf +bTSvj3h9SCLS/q+7dsMBGV4pULRuf7Aud36kZ7VvuX1b9S+bVIFbiWd7bZM0MKts+G52dESt5YM jSrnwfZtPraMxm00a+P9T3F9+raneCNUvPkpRub7opbvz53ueIPGGWV+RPpcWHyLJm4ouDVxU+Eq HBTZMoDoLtJbl7OYYi4/pgHWYv3dTdyM9W4R2IlEN193sN75+kyEt+WtNnEj2j94L16BtSZch1QF axMPEtYq9DlYZJh0UzVEvNiwHpKGt6TG2G80o02hIf6VVg0lBBUwllgaLzp4eHXTxMAf0cRtPJze ZToZ83QeHBOiYyn4gFuVwaNVQ43HiKfzqN9pTdyUI5Lr0HhwPFj5w7DGY65+aNdgU2VoF9RCFfck gPycBHYlKZYaLTqmWHGbVg1RzHQbsaARFTV0G5HdGt6ohnKGsUFEi2kYfegiUzgyxGoGk5gyYPLA H9A+DB59NZRyTJTnqhUH6VJ0LHVTE/d0Odid2xYhQbdqCGdH4W1ZDYm0KUo1FJe/TRM3RVI1JJFE SwZ4ljVxSb63GsJLGoH2WzU0fSi6HjSxziper/g7q4VwChcv4P/tazwOnWdy/XnpwR6RXt4+D7hB ez8CGJ/K9AiV2WeN3v1GvreadCp45BJyTKdbgST9WzBYgeQ0Hdd8orvO4y3P/yYvC6T0U+HgFCpw cRMqcHEV6vG9kpMWo/zCZ3MzKDLWbf2GFaKxpSjw7QH936QVqOrnhp6m/dxx2brc+i/31ptUxMVu JZOKdFol+r+dVI9bJWGZ2+VXgWAi5eZW5CTWr62ITqqtiGTk520IRhMIXijHJ60pCBHLFDnEGloF wTQWgU6UX3N8x4NjvCmGbcJzQtvwtNk1Hj1PW2qOEQ+iCykrN0TOm+OrHPU7BcFoLREGkEs8NL7w aGhl7lNBMCFYIpg2R+y6ZKnI05Rh1W0IJr7T3IYs6TaKGrqNyJhg223ojMxELFIMkjYa7hmJYfQh 6c5g/p2GYLRSGUyCyWBOcyPotdN0mcpzXYqDRouOpW7r557wmwsVwQTdEAzavKcGYEjZBAW/+NVv 1MyVPAlXXL7WzMWJVsibzVyS74UvR9wYfhq+/K94wIhgBs8Zrd2BxsNEr+ZBZcYlxPLhb8gTApEL ELGkC5Cm0QVMRj7QXe77uQ+/zVSdRjmB2nZOIzREywk0XnQ4/pP9XLcIt8XN/dwT3lt3x4nc86Z+ bp1iDqa+r58bWrBdJkCdtCIaWAcv+7XQDpAnutNa6e00iDHX5RGTa0bOxI8Xb9q3OwtznzBbL6KW NJwkspaUrhkrKq7ZhJ/79PMPkx/V0JR4K6B+2WPORNMzek/8pMbyXQ0/GYLd10Eo4zLTO1OhaC2e w8vivY6ol0ed3McDUwhUIgmhGl0Qa7ocx4vuXKx02ppt5lwsEWuNm4VO7kx5ybf352Faf2//Dq+x iF5t7edG33Z6NDeuILaXi9B8e3+k9BVc/WR0d6oEFKDqpVrRGRocL7pT/eboTtXjdR7aGfv4Xnvq dS6q2zWL7ypkaUxLaC0qXTzweXHx5jkzn2bv1uSSHovwp85+bcOxgdcSxwq+Cccy3IVjSYY9Wf7A ntNCCPoVC28/IX1CcTimkDA1aU1h6gWKLVPkkGQxRr6k+Z0cbzRRrNCz1tkhXduIxoBD6LrJoZdc UvSGpqWsRNOSY8TT1BVjhNINTftxllRH0uLB8qfqY6boKW1QqDyZUGFsOkpOkZwiRwdN/LriNqXv L3QkI5MlSYsR6J9e00XM9AhLW5UFpbzEGZrXmImbW8ic5KnhZYreoMVYXKWMJQ49wDRT9XrJwkeW oBbt+7br0I5FAmSZ9d4LtGTt4v3B7tkqMgbSWfbYQg4qe9xPjTIBW9kTY0Zd25mddV0euJq1YSWP yh6nsUTSkidGi4pU8CDcNRb+SigcRcDPQsaDVNhU99tatnybwk94W6W9R6EUPcOX3+3+9osrCPil vrT/eMZJ/tsRcYgZ525yjjbv4T0PIY7VjSitRylZ80jfpsrmD5mSpGEWNyQ9SkuPNi5/myO36QEJ bd1DTSJH800ih7oiOxfYvLsHdl8zxyJ0t+U/8i6oMIcbYfndCbn4jGgunrRWa/kD71QQqXiMywzT aXP2qcO2TSTirfCYbM5KBiIZks/1IZyHvQaqWOTDOubb9hhPqYlMmGB9h2m5UlsMbRWuOIUjDaI0 YBLscXY9cAn5J0mO2tHKBDnE2lLaopA+Y0PIHYrfyNEdhwAuIUJiEIng+aCtcczRFmm29pxBGeCU dktZHETGnAlg5D/OQWOCQ3q9kWVb0yo02mhCq7Zxz30qcITLLBunz4D+YVtkzl/UtHq2toCR2Kia p5BFmE5BEp4iKhxlBYx4EQzBDbJmoiY2lBppGPGkpUU2M2mVDYwkh1CrvmL/h1VFGodeL1/9aWDc kxeD0Km+MEpVsciVQ5V+R97ByPF+tzuBAiMQwekGRm5X+zvvIu+OIm2KAkficuKRGSSy3HYwg0Id QCIpTCIPE6YgEc3O4SJjvU9jkdsdDtmwyH0TGPkPhj4Ou09/9ddS/p8g8Eqn81v3jfEDbrcrXklx tGnXAcn7bxuPtW57Ia856PbbwKn2dEP5AN1SehYicZrJoEKSGCdMsuH1GOjG6E6Bi0N4IZcU+khx Ao00cWK86M4NHsUjK9b4ZngkNF9skMuPO7PeektrZFBz+aK1XAES0QpJIZK4npBkgzmKZGaO6JM0 eQKMkG5gRPNrvNO5VTwYlQ2ONIP8snAkcqw2GWXcgCOpC20yNFV44iY4QvaCI+Kfewo5ak8rE+QQ KxcTjjgDaD/3KH4jR3ccHI5QBGGLFCHgSK5xzNEWaWNz48ptLjlol4s5BUeSo3PQmFiFnBx8repN UqvQaKPTx1a2cwusZKIp7AamZPSNFJJxghxLOiy5CbcGDzQUR7YiqTChq4iMCVZWUAAJpSy2lloC oOTuLGPXScJUWmmxlXhQtfqOTCvaBO20kwcFi/Jcs/qGRouOpa70SAoswa8yofVrK3Uodgy6wRL8 JjX+nrBEpE1RYElcXoMl44rddqT2YxNQicESCSNY4jS8T7Rm53CRsd4HE6DxiBaJHYR+HJbYs8iA Jf+E/8Xrso2y908ehk/WPwlq+ZaC/crh/npBgNj8C/jkm+2Ib1To0TBJ/adLunNYeyKyjxQe+GSw Hyx355A3CLfE9RV8MvYG2xCbN/AuXRGHeCTFCVrTa7zTmawe9Idkktb4sO1wJTIrPlE0ZHjb8rE8 0bl8uDJuJU6t0V2fxSfbfnqF+CTlIT4JWvikeYPwieR7KjwbPinhue1eLRLTagNrWjRt23Yivea2 4yTMoW2HD1Jp2yEZi9+CUAbuKiUXsyTM3Kwp/EbZEU+Q+SOPNkUOsa+0g2xlowoEou/k+I4Hx/i0 EIO4RNuKskDj0fN0OZgppCvDyOibhBxQVtKcd8zTedTvYGuSv0uOoKEu8dD4spa5hkm7VrBKWFH3 IFJfLPs1RYrQTbHiNr7D+m++UMzmNmRBt1GQ0G1EhtsQrSA7TnGL13Hcs52l+U1vENFiGkZvgdoZ TDxGypTBkkfdCphre+00XXKl1KU4aLToWKrK01aptU9YKrRl8Peq43ZEK0E3tHLGPpVoZTiKtCkK WonLiVae/DEBKMowi0RKjMLje6IlA4eTfK6HbDwCs+DAZXcUf2MvxfomaqX8KUAKfqjZsIp3WYYA MP7KbIzDtTX8coUwB9zwKbIgVsu5/LXTA6sZerGELoVz5x4JPOQf8lIaQ2lGxojxUwcRnxgnAPOk gySiSKEIW1KooJtQ0WZxmqE1c+6hnKxBYCw8uFyN8nE4Ztz1am2mimMUIRn4tn6sT3SuH+5tOEa0 olZ9lrieOCatMj6X/5ZUsXumVEQzTptUpCWF0IzoSFePgkudSwm7rJwfmh49+yg4E/k39yUnsX7t S3RS7UskY/Xb4IwmENZQwk9aU1SDxA34HGIFRoEzjUXsdGHElv9Fm5j97tfgTPIY5wjunh0PjenP 5QfUhrJyd+RSlGc6HnBrg0BSh9xecgSNXVk8NL5T+RQANFBQ4IwzbQ2DNoc3DDRFitBNsQ3OBI/m NmRBt1GU0G1EhttshDOaIQ0oxdBAYio4I9qNLoP5d2D0kTJF6zsymNMwqPHotZNwpinPdSkOGi06 lsoSz+vamVvihDPnPIQTQC7o5s54JKydyz+SsgkKmPGrxDL+jo2ZzXO93IaKDMhImAQuPHIkGsz9 ZDGHk3wvkMGhHx09hLL2+41Ahqjl/wV4YS/GHjG8WUtmsJYMmzAc+ZPfPvrjKqKxl7XjN1eOVaYO 0IyOsDz0Hu3xLjW2Sd8QSyAiD6Ffu5Es8ZCmT2j4yEW6y4FmJi6yrQXAwyTyEZ1XSYdFvN/Ow1E+ IugjOoLi0U2Tk7o5WoNu0ztY4M03PDm6Xzuxj+R4e73Q3Ctb8tKR3mULRis50FyowLafQHtSiWic m6oH9o+iO5UhNKbKW0F/dm740ZaiteBaqmqf2m+g0B4hoVY0pMRaUfpkKKD45Nwq2rXl8/pHnAFc Ws/My1dwQu2J8/rLi3dzIu05OGVAZtpnlhStxXN4WbzlbEFZv0wkC4c436c9qbeMwaacIjJhq8mD BCE63Y3jRXfuVUqKao5pcZEwdhyTp0338n8Tb8GOt2bnq1NwZP9Y3osdx/RvXqnGsX69O9tq13hN y7bD+pHIv31kd6oEPmDFINWKViSrghDdqX5zZKfql2J7rdp+O7a5JpfR8CPXJJlFp3sHZi/u3Rxn 5pNF0KRSzRU9Ft0fd1aflWdiW0E6YVuGurAtyTAnSyKYc1ocYfFi4f0ppE72rzRD0prC1Iv2RJki hySLKIEaC9L8To43mshWiDq+Yxk87uskD9HJo+eJpea95eSBTGflTfIQLR4jnqauQOFqvxjC9rP6 ySNp8RjxDJVPSiIoX9dKSSRB2YaUnCI5xWhKwtqVksg6HJ0nNLchS9rcYgT659guYiRtk7t9AvvO hHnyoLmFzKmgpFOVKdLALhIM3ivSXwVmxhOHHlWamnu9ZDEkz6QW7fu26dCORYLWppv7FJFhnV0c N65n9UlnKXTAzab7Ne9DJ2kitmKIl2s1NLOxrveHoCGrhiSPqh+nsUTSh9c4NxGjRYVfTpFay4hY 8DgPGoto6uLMYTmrf8A7rL/YoYrSUR0XIHi/yn9Elxb7Il41GW9XwWe8cBL//vx5uHgnN66vdXIR 5TAk/G356P43uxP9xtks3omW+uXAQWfdk/aPCmdIWv7AyofXF0qfTT/orVKmSRQ4vknktFyAw0k+ Vx1rymKOeFZ5eMsfPu1P1yMeVMbzimuVD25rXfZ2FL143JyfLVU+yxFUKp9QgcoEBE5EDKuEA96K ZwePpC+SXQRtxkZRmByQvQDR44DpeDmL/juXlto1z8Jex4TAWs6Q8kdZlw6o9ShfdQuaw9mz0IgL wjsSFxc0U/c8hYx0TLWtOT/VukfunymeZ8BJt/UjnUHmpBmQeukkr9fSZ6Zftexf2HXBiuCTW0Zi U4kU2DUdLoaL7Ayy2cMSq45icqbuGeNw5OjfXD0jZ+2SDynH9aiE4q9R98QjyfV1k/nd5TyeDykv 5nGK9nhYx+0cVzvDGu8Fx7uRzxnWIhXWVPpcWG+OAil9NbDHcTB8+Zd4Qi3d2DprE4+ywK4yZsmj wI4FtZ1FozcHtulsvNc7E3sI6OChvVKafr/7QA7WErwSyQm7MqQEXklGDE0LnVb8YO3OYghoibTZ g9MkNUEN6f4eEOULsEt+tm9EaZLbsPgXEXOMtdEtc0e1E+g0C5nGoedoi+y+Ag5IbhUui7Q5gQ1z dJVBY0KGTJ9GFsDMb6gwkkyh6DfKhI5nInSuUgCdE+TYIiIS9vIb9rPMgeb9O81TyCJcJRN+uEqS CyvoS7XeG8xZelOQTqYcHzQU35mKUqatKCbpxiO8IWnwwI3yqEO10ony7M5PfoOjk46lbrrzc7id Xl7bqdsgzan9PtABt5rwWBQP3Q5J2gSl2IlR5RjLef63UseNTei+HLaEf6LekUAqb1y+Vu1IIA4W +afBXnr6bL1zuOKRYeE1f+PH5U2AOy548FQQ7visH1TBz8zd9tipfLoPTrlvdW2jvJG2mTCcbPkj 7W1uj1M+Scv+/fV2SoX2f/ROU8BbeaTwrDnoj0iSUd3I4oK3osPnH/SAZGL2/4UNAo92uBrxmCEN EgYRqdVaDrHRotMg3fVyQuU5ixCX0CJCVhGSibskg3CJ6OcsklDrewTJlu1GaVbbTWRZ2ETbjfsn u2rKn7H2LbiE7P1oSeRc4TrlYGbAfjqbIAd4R0qbVQGKsXlJphweAgcH3964cSQw0UYiZNI4cHjh 0G1eCUzEQUBlnFi4JpcBLgsokzLI1aWGpGNSAhOJFIrehkvKFG379OAKMiYYzRcTbHEUKN44ND8J frSbooKoROSC/LOoRPwThFAjNLNYys6kvfNT87vt9tI5OZBMDjSqaBMy1JJrDEAiK5DSeKlQdCxy UvrY9s9yKFA62q+HK7yh4BEnGx7BXSD8mAnxyM7ym5O2/Rc8Epdr8/Wh0t66DdCIgRFKIzBCaUSi 93w2dMTBImO53IqwyOmmNFOQGQ9vvh4ueM10BSNY4bjbNlPZ/yccPcEbUgBDrrtPOFGLcydxBedN cAVd2YAnGINng/BXvFIF/6I3u1zHH/AS0f3x9bjrZBo3tLLu/S4/6C6TyKPlIHRZeYSQCWkPAr/v TSQT1x9rx7byvTYX6SKJT8x/rQILuCKfENIQ/ZSPiMnYQ/aHNz3k0x5pYX+6GDDf8FtA1eCzp3af 6tzgkdeAeKEF229GWiJtJxEssDRe9Lu0hpMCeBXqRzVlQ0QtaThIZC2xOWaoQHS3pLkaZq0tizvw i0vKsHzvD4tOOlaZtktbVmGZqT/CQKRWK9wq2lbvYYn0Z3g2rtem7MO3zRKGxkYi0Gphans9m4WK Q40W/aY51ptpHpksJLyQfOQ0Sn11pDqxA+6f6bPdS6vnVqITG//md5ezeXZlI7hXyp3Hgzs8Idqy Cu6xqkVnZLC6EN2pfuu22fqYi+E93izr677SlVtuL5+wTcs/XMh2HCXDW4uSQ2u86G5RLbzL8maw QFvUhgB/9ytDJtgWwh1xV+6OVgWE6wBrgltBO6HbCHeNDQprB6ttRVDwQ/ocNZ6SjvDtpzPl5gDv VBmDqFEkYNIhUwxHJytFHH3DMrh3Z7O2TlocOIGTHbrORSCbWUmTMogmB00QpK/CR6jBludQkoPy qNBOzzCcbFIEQfm6BjsmCypqgtm9COIEOZgientt4ijw5xlHsa80PwkGtJtHhZXO/kBig++wY5N1 7pNFojwj+Idd05Ays+JOo0W7kqveYedOiTqBkkLJ7JVDpxY1uOVLVKjWqLH1+9bvbOdZ26c82Qo9 WRF0xPnva1ZBA+ksgwBbb/gFy1YIlQu20FYK5R9qMTSzpa5LBUVZMSSpVP44DWuKRrPaZeJwkeGd 0yKoFUYzKdB4RDmEnyU9H8uWOlMOzRxGYTn0f3EQH1UOIC+qn//8Ge+4R1U0xJsk8e9sVbS8gx7w 24v4Oc0bXkloQgFLfuSPVL/hKubx1pOVVdJfzXdgFdLpAeY9/o1yRc4y/guGXPGOuefOAxPjN7kC 48tbBIjlHsL4op9yl2QycpaZymjsLJ9w/gRKxGmVtcLoijMjl+OFln8COy1HWC0mQwm2B4XSpBTS OLmCKs6DjCsuV6C4AitadLVPM3EmxeE0AR7hnymO3kBPy8sy7DAS0pqcsbAiNq8Ur+S3ypUFnyjL XV4akv7Bk+XM4povvBtFTaIVwpWbW1n4MLPn7uB0NvjLmvkNXUFEZ7QiOWJ70F+8atrjrb4WrjON rrGJxoIFale4JqCVYCyY0hOJ2p2mUM3D5j7NmSa7/DWRPlAwxXGVOJyCsMUxlvilVPt3+BTFUJRN UTBNj7fgW8uJ/oTmM35q48OiveoQ27x0Lh2TrkES3yhXnov21PsHxXsvZquXiuBcXHov9qX4Vrny XLxrcd8p4idwGIE1hcMB/xIPCw0KEDPKBIhJxu3sbZWTJhgj3qSNJwJ1NKOpOId4Gx3JmbWThEya YsX4BkeDR5RDKQZBdvIQnTw4nmI5D42RHEhwVj8lD9HiofGkwWME31sFJR7jhCv0H3kvkmtWHrCk Kqf2CXksmVDQCvnRrhRJsWJ0ry5zkfMrNvFSO826jfNobmNkGrFESjhOuWD6bDLPffJ92W41SrJi eEpOwxe2dJVypTOciwc+Y0MFXb41RaXGJ/Uaq0bH2YtR2SbIwoXjy5VYtm4nZVvH9rrxLSYEwt1B lK3bb7nmlaywcCfv0lVYulC2YXwLtZr+gL3i+nK3KsneRv/TH8avAV/vokJPqLBSjq+qqfJKVlk5 n247lQvvOwWDs9jo+QBcOlCC5vaHjbUWXuaC8gq/oYoGJU7AoLCKm07x+Y+fB5RgePoZ/66fjznj ztflftr1ksA7yoMHa3jU6l7soWiJx78XvOPxdt3drv6/JZsUH+m8RUVRcZfIO8UodGfZAN7Bb+kK soK5Zrn1lH+B96LIWveXZdn8LkJKAlcOYJ1XIElc0Xwum39LVyjbHGZr1+bQW1R4stJKMfQtzo4q fptt2idLZQgdA8PNSkoOvIJ180pZN79VrqSVgl/+hfci3EwzjZPlsPb6h8imCBdwWuKacHElJ0w8 VK5EdltvoUx/Ykx4SIaaK+9aBfTu3/9b2disxB3tVNraSg6HUnCOW6qBd/Ir0p6HEiJiEy5Kvi3L t64ZgUydajy3qVzbg75orBy9JPOId/xsTWGlb3ViT75pEet95srLr/S8Yr4Rr9E3wWu60fqVjtck e/kaR99M5FTkivjpePFbvVxzaKNdgw8oNKlQqw98p+/msq2/qFPfGU81cTd4xgR+J590t8YGf4O7 lSgLd9MFhKbpp7+YjW2NMi8NPkASbM3wK3mBz1695bbeE0++EjgvcKLhlnwlW7vgAvfLSvcvjOj+ ldN4DcapmW7uk+XeHj5Ze4fx0bTMK5PZq+Jjsol+Sqi3yZJRTpZXFIy7srDpUm2ysVDgFcFRefFK 0258qxpgm5ZGcYfJ+uixnTmuzEzfgOiClmAmac4eSRqtIyerrDlZWdlkrQYlx0Jlaii8tLUWXmPu dP9pQdW8qqQGeU6mBl1geTXMTN7rSCLpqjh1X0SSqYbUd9oytmhb+UycM5/pArJDJLjikfNT/f7/ AxEDB+UKZW5kc3RyZWFtCmVuZG9iagoxNiAwIG9iagoxNDg1MAplbmRvYmoKMTQgMCBvYmoKPDwg L1R5cGUgL1BhZ2UgL1BhcmVudCAzIDAgUiAvUmVzb3VyY2VzIDE3IDAgUiAvQ29udGVudHMgMTUg MCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9iagoxNyAwIG9iago8PCAvUHJvY1Nl dCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9Gb250IDw8IC9U VDEuMCA4IDAgUgovVFQzLjAgMTEgMCBSID4+ID4+CmVuZG9iagoxOSAwIG9iago8PCAvTGVuZ3Ro IDIwIDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAHNfcmuLMmR3T6/IpfvgdBl zsOyu9GbbkESW0/QQtCiWCySLdXQZJFoUF+vY3bsmJvHlJF561Y1CriVFs/D3NwG92PmHhF/2v5m +6ftfv92OcTf8+32dr1srxf/35+/2f7P7ffbX//Dj/vt1z9ud2/3y+m6O98Hv26Xw/W8+fHr7e38 dr1tr/v72+mw/W572B3eLmBG+lvRl9vh7X7afhvNk/zj9vcuD7nE5f3+8na7bY+Xt9P1fr9tnhFp C5Huu7dzEWl/v9pgKdLm263o3fVtf4NI0VykibR725/uu/39MvkLXfwJ/3A4bXf2n/0wHpAVA9/d 0fnm6++2f/8F/7TbHw7bL19vT3tvG//78t3211++7N922/32y++3/2v76b/88Hl72H768+ftZfvp 3z9v/xOIrz5vj9tPf/u8+d/bL/+0/ccvrqi+2/3h9nbenTBY73bLbmc726CzT9vP2y//h+ze6wkb 8w73BFP7YXeE2mR6uMLtXlwDrkA6bR/tScMu8oXu+vZ2ebuc0he2j31hKNTNHLP55+30dk0hTSjS sv5hx/ZOh1BPe0MyMV+gUSDVbr+DuR/4wqfD4bjfnS/HYqahsx0uh7fr/dz72pTRj/KwavSHEZ3S e3yYHQcqIn25nxk/0T7pLoAw7nEoTQRQMrm+HU8zfrypQbN6SHRNt2qIqCFtUuQYYnFNttes1Q1p ak6wmXBkJrrSBXPb7JC6eYBD2nikvzc0IWSEpol2wPx0yFn5O0xHJ5MpZ+mg2/jZPukIzU3wiev7 w+lt1+bpFbE5lOr8dk4pIJVNYkl/m3TGJjzO/l10Z5XVjmZMjvd7P2VadB6vo+jcjGfqX50+b0/b T1f/iyC9bT8d/Df/Hv333v/u/O/Z/14+b3AX/xV3zU/pxytMcxiINwxui4Tng9sjodOhdL5JnYYN WmSwfdKdzldHgnR+wVK8OhY2WqYWZ6wyqAzv4SBIb9KdDzGo1eFtnYzCOwflAR5L/tBSEwG+Yu0d Q57DGYDk4GjjvLvfdsAeb4f4BeEwJVfIA4kykLCIkczhs3GSNOnpdjie4Xe7t/Evm0Ec123aOorF PkEVQJQt2qCTaeDApK2TDhBsMAtjlunWYtJ5zxAwGI9+5rKZDLOrxMKUYWSTYjivcaj3/RWYFojs bfSrIdrLbf92vzVEG3RDtBegm4JoRVoXNnlD58DFF14ORLs/vB0w9dzH5h0JUoSD9qEYmDdFCgRL uiHa6EyINkmOerwMt6V5wr2tS0e0l+sBS3hFtPfRPLkdz5P/9TugWOBXoFhMfN+XKW8zjKT9AX1B RVt2NbP6T0TSa0vlsvUTfcr8Qq1ONxQre6u96LD/pr9OFCv7T6yUj4QKPJJCOSRrPhmQTEIITYnu PGD1Shn4xe0/Y5RZSPYsfuH4Ido4Emz2gTcCv2QAZFyHUURrvGy/6SLAJBIftgv88oRVinwulU+z TSril7SKlqEmFds7/XJukcuO7LJBpvmLLjsxYX/XrTNl2QkjadkJkj55ud5OR2SNu7fxL6jYVy4t 3FgxWF1oK4RodVENwoyyu8UWndFCFQtXsMj2Rcz+HksfLLOVWG1O4JJRFsPKQ/OIF0Jy8eNQoKxY DNN5cvGrPLoFMmF8qoNhALk0FrUvPKbW93YNKlcsOTiCwkZLKlfYYJmtuy4W0IqvsI5WMm4ET4JF kIqacBuRdJvAKIjHBbTS5os0YHQhWkxp9H6+6A1QDCYeodzkEQZ2OqK7107TZbAI1YqDWovmUKP+ ZlNPqcRl1UU4A8W7ilasmGfFLbnz+WKIMOpvm4tI66KgFV4eoJWJ1aoI4sVBFy5FgmIMrVCE71Rv CzrrbylDNA+RNhz1y2jlfLNCoxfCINUOWHkNWvlvX33/lQEWVN8AWOazs/0RE9XtcN5evJ8PBv3V 4K0Im3o2L8bUmYqWx7ribUoJj5Sx1V60jN9fH0GVzep6cC21yPoqrTShCF0khKCK6JfMn0zM+L+w UeDOBlU0/gxqC0gYRbTGK0giOo0SfHh9DFWetEpkvClVQBVZRVBFUihDFv2aVRKq/BzBsrDmmF92 y0hCFU3WWnNi1lTjIDn6MUBpoKVBFU7ehjN8IyQhaNLqIrBg6SKbWGZZoIrWg1y14p5s3/EgnEkx AqokD61SySPaVx5q4xluW/mcR4EqdKY2z4g2dQnOSA65veQgjRVXcsDdkU4nTZWPF/e24BeoQsFy eW19OFRRFylCGaoVUWYLKwWqkEdzm2ARbqMoCbcR2Y3hEVRRD2Mj00BiSqP3K7gm+uQxUKaMkTzq wjCAKuIhbBIjDVIcpEvRHGrkboYGRvksI8RKImd4foUqpBtUOR3t3xOqiLQuClTh5YQqEyBlKEIR C8JARQZSJIxKKhJGtHqP5kG+F6ScUBx6BaRgf9BKKn/461d/W0YpKLOiVLe9eEcfvSAOFd3XrhJd yOxyPqMLSpGm1V607N5fF0qpdt9wv/qROCylyPDCJzI86c1F3QtaiKanPwlPk4nZ/Rc2BzzZ8InG n5Ec5hCt8QqfiE5zBB9eT3zyvD0CmaQ8gUxkD9Xu1b+QiejX7JHI5OcIkIUlpiATTqW5xDiJ8NAS 49EDkqmztMPRr0Mm6kCwQXN30uoC/8dKXLvIJpZFFmTSWMQiFSyyfdAmpha2FMPngbaQaRFTv9m+ 8tDc4dlsQybOsyCT5KH2lQcc15CG5JDDayykIZfGovaFR0MhU78KMqFgiUxaH45M1EWK0HWx4DYF mZBHc5tgEW6jKAm3EUm3WVlEUQ9Dg4gWUxq9zZxu9M4AxWAD5SaPaO/0AJlIDkGRYBGkOEiXojnU dUWUEyB7OcR0Id2QCZL/Y0EmIq2Lgkx4OZEJt3zqvDhzrsrwSTtNA68zfCKREo+4iK2IIhmieZDv xSdHHDApB1fWFlG+IT756yI22aNogeMtF+/jo9fCYaHKoEnTsXmwFVCkZE1BThdoIiWrvWgZvr8u aJKGfzJVj22XJhQLJk0o0hJC2EI0Hf5FgPIfwShwZQMoGn8GtHk+jCJa4xVAEZ1GCT68ngDlVasE TEmpAqbIKiqgSArBFNGvWSVhys9hl4X1psAUzqu53mii1noT05PWmyA5+nUwRR0IQ2giT1pdYP7P 2O33eiiU1WAISxqLoIPFkKWJ2d8DHr4itVWtmyPKwQc6RshRVzE7QgBXNMhBubCeiJYcal/UlW08 GzYE4Ue2Mi8hDbnEY8CTKl9ZQJHCRmupwxR1kSIUMdcWUMijuU2wCLdRlITbiOzG8KiAoh7SgFJM OIGYCqaIdqN3BigGE49Qru6REzg9gCmSQ7oMFkGKg3QpmkNdV0A59GetL6QTppzv9az1JknrosGU uBwwRWetJ2DKMJ2eLKNIJMEUiSR63521vgT5XpiCQ+bASE/v9fzw7eftGWWU73+3CFQORxwAuuFM k3fz0UhlqObpIor0LAd0uiGVtHUgkqRl+/46kUqx/RCpPBKKpZQmFJFJE4q0jC+kIpo+/yJSqUZZ e7Z6h8PVu8tuf7kvna6+YmHZ4YDoQ7vPncCc15rlbb0WbIEZaCno3YlPTKi96E5rCMax/tDJ8IhV Mlk4fzl7lmeqnNuulSFRRA1pc5HIMcT0xpAm6W5IcPzRkExvM0M6AyPhSRV/3mLFKZgPOTKG1cEQ q+JAczvpRKw53ECsSUdw6nR1XA/EWqJz+GDOAz8LxJpSBWJNqYJWNAqxiu6MstrPErGWuRkWffJ0 9c0PDc6drua56ou34e+9n67mlbvund/FP95sFx+PlTDEp7wnTn4/H+K+Bx6qd1XaEZqBqkVnfER7 0Z3qWzwUI0zFQ6oe5+MfHbLe+INHg2co5v2pDkpB3g3C8jIOMr06/CnpmUG14VknoyDXoDzMP3gN XpcAEbElkhUEDCSr6AokK5KDX5cAqQNlJ4KIosVz0KN1oSYUChPxCPsyARILtRdNHmyTYkQClGIE VtY96kO084g2yaPiZ4MrQeueDs4gqXIe9R4kUZpVJQfpTUO/A57GY6o6267B3zqm7bBb68MTIImp 1qLZxYLblDot70m3EQsaMYOEbpNkNwaE/zidwxh6Izajq4swUDJl+z4v6A0AHgNlBt140MCkBwmQ RhoZj8QgmRxCl0lzqKvqtOe7n5+zkSK5umyDbgmQVYpzA/kclHVQ0h+/+jj7GRYQYYRSQISWkICk PJHtpDyir/GoQDQP8p3ZzxkHNFG8fD77YZH2L76V/Nc/fIVkqKyUGF99rnWPwhMegz1sa2+ImoWn WXNR2fzG9f3TPWqcyYvMLyfUicygw+BqPrB/d7nPgCaeyxjaH1NKsX8C2ZTIsTwdwNMy0nIAtRdN px/B3QdrIgvEtEgsiWszoAPW+D1qSLulBAjnZ/ZnnHHsepiy+Rw6mldaSYDwdIkVxRDFTHiCRhQH fbl6FEtnQXYqK4ioZQ1TMCJUhpHdp9Aenl9Zyn7mx+PASMxNXg1nc5b4MZp0Ss+Z66TUJJ/69ePX o+dlpJEznmu/zAxn4mkZPHf204ckpjSkPjkD5qweISlao4/mw5Cslwd5z/MxSTDdRBIuNZEKTlUM CqeK7hysRGIzzpSDJU71WblE5cRTpRNPS/2KT4byWVE+Parsx54b5RU+c8osh1f4m0+kkgPzIdxb 5nQMos7px9v1bXfCRuZHxXcYQPGtxEAKFq0Aiebviu9U/1yED5/kzVUKa5RN6e14dfvVDlpXEb/b DAYgMn3cNyZWR/hkbSPH80yM5wOzBnOeWHZXAdgAagKwidsEYCPgBWCDZDBF3oPZepwBIZjEQk/G CNVFGXuI8rw54GvpIpskC89hUsiEwHFPtjc64Gu2EQ+hC4khOnlEH02OTcDo1NUINmOiw5qXsmf7 xiOgt+B55j05Fk2pGn/2UXhMZApQvrIHqDyZxGBH4NzynhQzW7OLAK4LbmPLYucJzW1CyrC5xQz0 H23LstCknfoF9p0Jbdn1VLe5hcypqAynKl30ygeH3jhejjNjiUOPLs2ze72YqQZqc9Lut3WHG3hi x8gYn5PtCqvQEs5hnM849OVIyQexCbrlO0hXdxclPNuzSOuiZDy8HCkPXt0w93Kd5TIQlGQpj0RS iuM0Rikau2BHSBStg+KYn4S7xsIfRD6fAKbbyrr2UMpf41QKE54fsDRi7+df7BU7m0//6sTXn/Ee nk94A8/8mrk/GdY63bcuxBTmWlpgnpyPH+wCmmcj8UsTyI9pEsPPANYwkdyA7TdJyy3Eh+2YCckt nt4HTEwqVxXsdbqB+vAENSf5WiacPOAWYRGmQZuHL9nZXzH4232/x3ut2uuQRsVHPEd5u1wxERbP m8qD8k1OA1QxH0k1D3IdKG9AX4wcZUHNikwcRHex9GwehKz+NJc5zCZCP7EXI64tc9BEktNjOIxo jddm58NlwouDD9tF8vC6GwfSS6kieVBsCevJSNH8XW6cWM+8jI4Me07umExlDjVbYIZwKDsjR98Z 4X4Kd0bYnn+ZbzyzY/JBoVD1mPslCgUpvbkCEbbo10Ih1T4bDD/hlB5YCXbVS1var4aVHGkkVArc IaQUcSGoZGQg1ylY3a4Z+5KRGFJi1VS4ZgAq1Dj6M+V2dwhqIXTBFmu8rSNWIYwYwZsvgn/HIdrY LTbXcYkSB5FxR8cxBtndAg4I+wrORIrDgKOPwtsAPVEGTTAhQ5LiMOBIJxOETlA6DauziwSA0FOg w5xKhAelpo3tV6wD1ZqeBrYK0uMCagtX6cNkNAJ0qmsFVqsHmqJCThpSTGVs0a7oTvnFVjZSyCXb 6R6ZVrTx6M2R0LopD5pti4FaVw4Ps3poy2AS9if2/kgDvdZId2qS9irKAq1FmogFWvPy4Mj305Ur eJxBa5cgH5unfA1YS4JoLJLu+TK0xm49FleeorC1By+CegSi8NbK3/DlPkDWfG4elSpsLhiK5jGL IaDa72+oAOCVcWfvbwpGD1c4IKpXyxoLRR3CL8LoULecUPYPH5Z+LQ4MdIuWA/TX+6PfTzuAEG2K xN0DIy1sAlJLBLUW/ZILJJPiAKsh7iIifH70cGlDhDF6xXSMXqRGSzw4YZDgwnY/0bHvlCngoIv4 bRYCm0xcaEW/ZpEEJjUoP8om69YbzquJTJy0BYbDpTa03ATFsY/rfVPAhPwMWHDS1TQuWh103VkH aiD5tFo1BlytgoGaFxF5h5LlhkyCQ1b0kkPH0GWImSJlgAMaMkkZgjYOHsWEPlWG7o5W8RMHub5k 8OYb+iTPSrQlfOoXlnWxkJCBRZyEUEFGB2pcRFwHTEKm9JNgEG6iqAhYIpKOIgiS8vfAqrOcOUpn BpFiqdZBe3mhm98bJul02mYTtRZHE5JqyTEOdeZQT+2lQtEc5Kjah0HqGmG6ARIUEe9e0AwEYqSh bCdRtLP3GXvsoXGSfwR6bIAkLpfjDbcdXj48fnnycoUCjmaAJARSac/JBkhgCpMv2gbF8QYcwSjH wATjHcIDY8FK3+5iBc0GR/BuwCEcGSZngCP/ggfP8N7sH/1kA/+iwHd99EofnPPeHff77dl7DRD0 UfOtzN0M3345/A6YET4gFAKyzR1pdPN7gJKkTevmBP31dsYhnOClU97ygkQh7paYH4lRwu6CE1Nu gERjlRskD3OCgknXvD37drrfD9fDYXc+rCrsPTL53AmH5bjJEVho2JrS64jkCRs42L63yPbKXtIv xU4ywSuZFTlDH56t7DUXnPrlbllF1Ig2KXKMMB1R0miy6oY05QeTm6ChF6vCHlbmCni1/Qee8FYM 5OzOqTnINnpMZACySWdYdtfLOQeLywm4PO9k5TxuyhTQ1GZnW9GDVFxGge1dcZnAtEbNE5XK+s5s nllg5fHuNUpWLWsFs9YxWanklQenG4Aw7Wz3w+n8xdiummylylBsqL0FBlsn3QXC2nXRT6jYK8tP 97noHq6GqzciiidRyHZcPYXWoBTNcWKm8++Jub0Mb2Kxb4NaEd/j4+qLqecY6IzSHAinSiyE6yBp wleBN+FXRrvakoJBwWpdmkN+hl772lLSDN2+O/OYbODFKGNA+CsBk6ZMbL7hzKAnY+sdNoEzC0kO osUhmjvZ4eccBCYzS3OSg+jg0DP0UXgLiBWjyFk0SmxJB4eeISPnQZqQLLKLASonyQ6yMUlD0OvS nETEvaVIMSowA9NPBkEykn+6+popgJkhDRlmTpbhFkm7kqveYedOiTrSkHeEGyRtHDq1ZOE1QD+T Hrb3vNEfSu7uB4RYPk0FPXnmAkhxyTxnc7o63RKdCz7/0yqvJ5EmYkl0eDkrr4j8IbpdFgb6QYoT nWfRlTQGGDlP9h7NqzATM19BOBMzn/HwNOeEd63BvC3N2Y2/QDGshyLN+e+ouuK8ApId/MUjrPiL NAcVWJRKcbTh71CCRSGWjX5b/nn5xaaorB+PW4oEsPWRL5V+4B+ZvchB6NJpEzmtjKD2ouUh/XWV ZuvaEC8MW/aQxLIpjqP55q8O5zfpImpfxXnaR5JJ8ZAhnJ8+4ovgWFwbJ3Dmg/HDXx3Nxvhjfkhz iNZ4ozCb+khzBB+2y8Ls8/YISMX5IhFY2oNopdgj2ks+k+d5exgTh2A1Zj/KIiO04gsTP/uRaCUm XaGVnJO1DMV0qmUoSI5+DV7BjNy/ZyBn+Vx31IXXZdMA1kU2MRa+u+aAorAIOlhk+yJmv9wJs0gs 2w9xDJP9ZvvKQ200FDghUEsqK9bHxkPtK496DxYsObzgMOmygKl94ZFlzbLet2uwacc0H0RLfWnd DZbZuutiwW0sv+48oblNsAi3UZREY5F0m0AvALxjHIMOeiMmTG3KJWzNmYHtW6S643QGSADTeIRy JZicwGks2Maj144gTLIIXYqDWovmUB+cwQsMcznb1GgjZXGWdMMw56P9exRrNyeR1kXBMLxcMcyj J71hARUSoXeoxDCMhEnM4sI1DKPeo3mQr529Mx7EMDjqgHp0PoW2X4lhvnFgQqgyAVJm9o8PUPNh vz2VTmHt5YfRXt4+ni+/lO3j1Ho6YmhdtLQuNCI6fEDfiQnfmEIp8bq4eXHaQ0iIJXmkoxI5hU2W RC3qXgBDNL1+VJ+Fo+kaHG1YsE8mzQfmzfHej08Ox9/HQKKOGH9GdZhDtMar9k7HvGEh2V3fTqKU h/Zw9xDqkDysx4V9sj6XU4JqKpKvs0exwrI9EqXMBshSoWgRN1acRg3EcgPhVElpv9pyw2k1lxvN slpuAB1sfsTJIM5gdlKeY1+DUeDfniWWGTiyxlxbogNCFESHdWcd5JSdDIhIJKDQRNwy4EcO9Q6I EEtXchDNTnuGtabSBjFc3EQHh56hy+AttIQ2bCIZ5PYaRc+Qih6t5bCorsGOySIUNVo+raZifm2a zcah6PU1FXJofkIG4SaK0vCTPkgka5O6/YL8aWjjaI5iVvOJshxebHEYK3ntIg0bHDolZk1Fd6i1 aFNyp5YEJKkz16C3h/erbb1/bU3lbGfHFQzAG3GUPMaEGg42UnLrWKQJWNAILw+2jp/OGqEji+gQ SJDESAxR5AmbBwaPorFIuqXWnTbjtV8Ta5HxICLBYexTt2+4rqrCGgo+VId6yh/8L0so//YZ1Wd7 OgR/iVeAXZaeFNnjacsbivUux9S+1U84B0cpxdbCksW3Bxfh7LZBLL+ICUR+EaQcgRBlYwHufiLH 4HU4pl8fbScPwWoRZOLjQIkZwlWFS8JVg5QrqHXQr4HVZFKeerBtK2y6DU8VDMttny6Xw2F/vi7u JsfnmGnwhfMDcxtOQ4UhR4x3DBBoIkM7wJ08WGyZIZJLFQV9uNJqGq3oLppWI4nYe8UBIXzAnBXK IdBe2k6eH1IDq9sTRdSQNkE3sCpH1JBEd0OaKuaY3ubAKl7KhG9CTQ9poqT22nby/PgJDllSi7DM GZ8xIFKjFSQVnWGJKc8Kc7z+eDt5Xqa6CSiZAq8aaYtSkOl0AW9FP7SIdTGySMLV4ZS98qF5Pv7O rWFsCuNTzLzCjy1zs5h/6+MudYt5eSs5PsX8UYHd6RCoYKBj0QpkpQiiO52vDuzU+WxoLy1P/Toz /6g8Q7nsJUtoDUrOrEGJ7gbVQrsMb9GRVgT3z7OXHIAy8azQnAAtQx1Td6IkT0swznV5D/kJ6mGF j0qT0G7Ebd+dKTcb+A3GgFlMYxB0LMiOHRNKkkO9w2Zv1mGTg2hxqAy7vCcHgZnMqrLJQXRw6Bm6 DN5CFbWW94iD5lCfzbCg9AzpZKO8AcrXNThZsghFRd7TeiBqp4jZmOQTe8nCZr2lgvKowPQbftIH iWRtUrdfkD8NbSLJzmlImV0s1Vq0K7nqHRw6JWbeozvkBqKNQ6eWzHvCKKFQb1/ynno/ppth2cfA UVzDIKEn20vGo1R4SscGaXVYIFinsw57xF5R+3DDNkkTsWU+cflx5rMsErRkMS2RlOs4XXIfk9SS sWgukq75cu6zO7/tXthRZnbDHWU8zYPt4z96vhM7yr/3x+SZ/DBNwiPzOGn7YEcZrw674oTjyYUC 4vrQPeVlo2QKI0cJ15ZVwnnTM6J90vKU/vooFRqePXgkFJG9XEXIvglFpC/fEAwW/ZKvJJOhp+CN oDbpLRXTd4c9FvbjDunIwlPzen8y7f5CPjSvtZoPUQu2/Ay0RPqIwPKYjwEn3Wmt4IrF6kIyaR9G GelqKR+aH1LJh0JEDWmTIscQ0xsljaa1bkgNNLVfC/mQvQsXLxf54Hxofvw1H1IgaNkgnSWxNn7Y FplP0hGdviS164OMaFzA1jrSVpT8RalQ7wMqSakCn6dUQSscBWVFd1ZZ7WiJzzVrbvF595lDtkOk jsNBv2K+U4/a1gyIx25rG702zF4zVv91OTPSC5Rzbjcpu8kjZJurecw7RE1GXZUli5BqI4toAcJU KulO9SUMlmNcqj/iAwpAFYshMc4i0nfQ39izDJB1Qma+R6Fbjp1erfaro3wxx2acL8zGky8xWdwS GheFF04gmHAdjM3USABQmDewmxoHSZOuSY5UwBQchF9GQTNBrrqoAd5vC1EoY8HspbEIOlgMWZqY /T02nVuCJLGsvMWESRNJti9DzTYuOnhgyrMUScpKWnIMeLoc9R6g45xWQx2kC1pW+yJHSymmfsGm HdN2cEX6EsgPltm662LBbWwi7jyhuU2woNtk1LBxknSbSJVKgtdGY5Fp84pV0pxlMXp0EQZKppFm JO3K7gxQDCYeVG7e0yFORL/x6LWT+ZL8hLpMDtE6aQ71wY4AE6bj1b/HYiP1kQfdEibU9e4nbRVt jiKti5Iw8XJLmA44IXefWGeHlUfYobxEF4pBwpQiRcKUIonGbtnePr4XzYN8bUfAePhm0RFvndS7 8iEV9gTWbRbNJ0z2drF//sH3jJgw8aTLw1TpZsClSANnKFB8uNLX5zsW5+hZa7gNpgp43DJKc6Sf xhd8RMslLDb2p7GL8Po2XCczpddcJAGv3BZRjtkwfUQAWT6i9k5HcLW1f+oXZoFReZp7INUodJFV mdLxdDtej/jQ4YpMiV0srM1zKGoYWAY9+HlDB7AagEcOgj20lloKGvUYD3ZpTTQnlKhFYOjjqsSC 1nACRYHVuzK22JYypfkh1UyJImpIm6NE1hCbd3qK3U1gUwPJa6a3OUfAV9I+/Esz88NnShKJT8RB LgERnKJz+JjobF4RHfN3Jkq83hKltdE58LMAtlpUhM5J5+bRMf0u2ot+zc8SrddJ84lEie9EYyqE IMXmEX8zIWIqxDa8wpSK71PjNhOvr0uU6izSx8ODRGneIUqiRNW2RClVLVNkfITqRXeqfz5RWgry 2EudTJTWDUpB3g2iJEryaiVKomcG1Ya3nChZmC/MxT9bnhTAToCXJIYvwHuNF0H4HpIthf5eCA5+ VZ6UHSQKjDJ50urC86Sui2xit8DxxhDZ86S8J9sXMft7bDL3PCkBraCGhpbtKw/C7jYUzHiODFyu 3Plpcqh95VHvaXlSysFZddN4qH3h0fKJqV9YVDQ1ezafeVLpw7aTsots3XWxKk8KHs1tgkW4jYIk 8iSRdJt1eVL2MDSIaDGl0Xts2BsVRh8oU3TyCIM53edJKYcSoxhpkOIgXYrmUKNEYzB4VIuCuSJP OsIj25uXt0fSLU8C+MX6GkfqNkeR1kXJk3i55UmnlW9jKcJBJCjK8iSJpLxIIonGTjtEzjwpyPfm SXhPTnw5gxh4XZr0b+UcXZ6vy7Nzow9b2PvhrofTeXts3fWL5eh8luD1C1+2GJk9XYHg2Y/Opbrl t1K3aJncfB9H7YYuoPP9cT3zoLUuYEiLglZELx8Q3G1CMS+SDwjRi6brv4joi008Ux6nQaMs9b4/ XHF4Dnn7Qhakz83MGv0BQpq3Y80YXAW2UEXSI5WIRsGK54GZMATZKawAiFX5gh1GWa4i40zpl9/b g7v53pI0dzN8+YVZQCZ1AdtwJL6Prk1Eai0vfTieSWgUeSR2JLC5vlgWrwPC92YwCS5WJ8YV5PFk 3DRio8ckaAmNAkBzu9MGDVErQ9qZUaj2dfwmUX+9JUAKyyc3cgNVp1TcGaKUBbCmz0V70a9ZJRMg C8wwy0z+M5w2baOo5jlwQOQ/ej+0bQXVLSIesKvH5nicLr/SmTP6KHXOL216cC/4zlyFYz64mQ8T mVKRbUtFilXmoOgIvU8F9+r6Rqp9LrxHs2CZ/JozT/1yB+eIGN56w+QxJNZ45M7KfEQ/dCRT2qi8 kSPyAF85Y736WN06DEuslhhW0C0wLOIMR3h1LMrCzEmOPlIf2HOcBGH0HQzG/BkFcPUgWjy9+abr Qk0k4xj1MvURC7V3OhBsf49N474llIUa0Y1HzxND1asp4x7wCCSdQwk6eUQfok1dvEcIPbeIUg7N p7pHfYimykcn0aB8XYPKxUQKG+FzT33EUq2DDuC64Da2ZEU2w3vSbcQybO5RAgNE4z5oJG+TvP1C B50R23G6dAwZVEzVXrQruzNAM5iLCbmkXN0jJxBtPHrtaIsoxXDVtuVfrSsHTDzL5RdoC7vfRwTG 0RN77hAZiZCLcZmoRrKtKBOwpT28GlnP/jCx1i/LgS4s3/GO880sFCsfIVLPbCuKXjkuVydqm0I5 xsL3hA7Y/n/lASJu9+hVLLYP9J/jlJw9QMQHi/6vEqL5JXN/RAJ3uZ7hDuV5lV94NyiMkB4ZzkCH ltqZAnlx2XxD3sDL7t3HLROg/WF2X8rQbvELf5Sppj4pCTMduSVRfZPEUbzIzh9WL/REvfNWWNrI WES9s2OHaKOxew4D3zTUG2PPqKYVgtRg7f94l7vItAJ58HIA3lVmcKHaE2UBoSRKIN0wQ+AT9R3w RCRPRT8Zls7D3rwyb4glwPWkIWKZwZgXnmmO7CKXGc2uWmZoFq0yoGLRn0Ik7VrDJuTXsIn4c+7F 7B4dECkGZXbuFx1jQNTQGARNBgN+5FDvAIdYspKDaHGoDOvZ/tSRGd8KsslBdHDoGboM3kKLWMMk 4jBw/+yADI1DW7nzFyyqFb4gErLMVbT14IhETq2cMjpY/0yzAnbgGG43D4oEIxki09KXERUs4vLJ yukWYXRxHCzYruCqc9w/sAjVn/ezsUi7vzNAUx7VQ3Cn5mzaTUZTiU+7xigA/jDP2+eR/iC/1cdl DtgbKt/lSNLEKwiErVrhte5vbn79Dz9iO/fHUl5pYrRfEAgKARCRQFFnJSkgsjnYZicWvWgbFJ3x yRnPWBCI4A1D3Vc5Vh5O+Xd83O64/cSDJ3xBHH9//3mzhDtQPECtbnvwbh+lgR/8Og+EIqqp0rn9 P30CIDRIOYEQRtA+D5kX9Nez9lq9YLvKCwoAaSI5ACFpIpEMw0fdTV7R+QGmorFHwM1GeXkAkGqO tYXX3e2Mysn+ihhZqLzqpH61OI4DlnNHUTh6vjoD2IJYJQpzndha0qsoyIsOyEVr0e/SGc4EADBN lyqXTp/Ml5sch3UiakSbg0TWCJtfUgGiuyFh3hm5wWR5JjrFXvtu7lHsn+y55fnxewhgaoJaFQIC nj5TZ+0152JbA6x1Hb1HZXe91V49LCeyxHmZiI25nMZyIQRqJFZXkQpLotfJsJyyh3UwCkuVyxg1 zxdeebSER0hYeGUh9eyvwWZplcVWtqlX2DLvnZ/Ns/DaSfnTxDZdgWqP2B7oWWQGRuhddBcIq+fD VPxsdC9lAm1Jn/oFQytbcSFth565TUa3aPmz2ovuBtW8qQxv0ZtWxPf4LM1r6Q2Ei/QGwinRgXBM WYjdlN0IyRHDWuhjf0U1tCQxdrAaF1zbNWPfgG8BdpgNamHJOzBcnGHt/ZlyOygr3Bt1BatMeS6S IkV2kzQ5sI33afM3YYVECFJjHHCs6Y10ZP9HdiMliUwOA44ug98SkDizG3Eoc6qPe8jROLRUJn9B +eP0hjwF0FsPltykWoYdPvHocvBIT9Gow3QeFy3D6cNE0ja52y+LReQ2OJGfPdAUXvKmWsLYYqr2 ol3RnfJh7bCViwm5ROseeYNo49FrJ1WpkbLcmiucWlcOmGxKOWviwDW0ZdD2bF8DafVW0gg0jQw7 QH78PZqLNCFLwsPLLeE53SYW1GV5oCXLdlwehKnSHcqnfGeLxdoMlAmPSPrnCNi06XBqSbUumfGc 7FsfZUl9LuNh7fUv/gDz//Pa6zflIP63+kxhVmORG82voBgD8iGUyA4uFMDkhz6/vGyUzGT8mzFt 5pJV5LtyC7UXLTfpr2dGdLpFTbImxY8kCmybEhHd02+UEG3ST5QMvMtRxGTkJuOzKMMt70+70+mM A0YnbBWuSYlqF8/Apnmt1SSSWjA7UmvSimhsYPtpTg1YdBdeBVm0XGIKY0QGgXMCsx/SWUqK5odU kyKKqCFtDhJZQ5IrakiiuyGVeSKHtJQUYQ8ek9V0nveTJUXz469JkSbMXATi806iNV5bdiwtEh2h 6YCgXW9pUcZmLVXMiwSTgBXBU4oUSFaxKSSbXhftRXcmWe1lCc81Xz755DLzImY7zIt4hX95CIX/ yr/MhU6eNfHoyjMHUnJWf/bJ5UXVA1RQ9a7KkkRItVJ9Rke0F92pvkVDMcJUgKfql0L83QfyI6Rb ZuRClyxbLi0liJ4ZVBveFChwJr7x40G+cHboZzuRH0AvAa/jvJarILzsS4iRRQXFsa/LjMgPU2ig X+HIpKODjG7rzjrIBl4VNwaW52wSmJJ2UFe+JWkYr3FgZsQubRZnahQi6LCJbhkwdBm6O8Ah4HYO QjQ6NfSt5kUGtYhRaOYUh6R5CzvAIBuHlkNM/ULkJIvswpMh78EcGR6L3Cg4ZuPawZqDKCFT8xMy iLxIURF+IpKOMsqL+swuDW0cZecUWFYRS7UOuktgfYzFShRRRksOYSXRJiTVkmMc6sw1qPZSoWgO cnTIE4PUNRhJKc7J3j1pg2QuiG040JkR7VF68oPubC4yi//d5ZoRTWy/z5cYbYWHW1pGxP5bRiR5 lCFBTJcvmovkkCMjKvN44pupyc94MCPa4UCrEI5X/w+j9/QMq1443fmF765FQoRjKLYflF8EwjmU hZzngG9u7u5AJ97tB8+5MnkzfvsFtZs32x6Q9K4Zw+k2g8jwap+0Kb7sAsX15Zxn3hEq1G0SEb3L Ewh1fY8yPJU50qQrlNVv0RWEl6tFZraBxjnP4XA5X24neNCanKd28UzOM6+1mvNQC4jnyHmklaD3 mGr8GGcMOOmXAkhMcIYqw2c4pKWcZ35IxRFCRA1pkyJrSJqiJI3obkhTjrCQ8+zx7h2ExQfnPPPj rzmPAiGn+Ziig85QjJwn6QhN5Txx/UHOMy8STJI5T4oUOY9iU8A7vS6At+jOJGun6YZRh9P0xBts J6bpXzFjGezq5KPIPITP3R7mP/x985yHeRGP8a/KfK5vO5sJOLdPOVBI+NJub2Y+rtCS+UjBYYAW IzRA0p0BWkwUU2BNmN2M2y8F+lLms+hVGlQGejcIA4z0snTsyHySnhlUG97U4p9exVD/4FV4DaBV tSIRreM5jF+QNuJekDZIjn5N7rOJckhBe1HvHqK/QY/WRTaxW7yEzlxGoDNhcQ8gA1gog6r32Ixu +Y/EaumKppMhT5ejA8vgEfmMlJW05FD7oq5sE+/syJk11EEacomH+ig8pnKfdg1R1DG1UIWESHuk L5HBMlt3XSy4ja0QnSc0twkWNGJGCRsnSbeJTAjxP8qJuATXrMD8JgwYXQSdTOkkm6Q7g/k9xWDi QeXmPYFAScP7jUevnabLYEFdJodonTSHGjtEGGrdK8ozt8pkLrZRZCP1kWPiMrrlQ9i3dtqbb/Yi rYu2QxSX81T+RDI0LHC5WCmMZSa3bXSeyVAKE8lQ9h7NQxhPzhranfo1MckbD0+G9visDd5U49AH UuFtTeNkaIiBLRn6Y82GsA2EnIhXvrcdoM2Xf+KjisPFZX9EAnK4YbSlXxh8fD5KFajN+9/LhKWh ukPq3fwZsC8Vn74oL+BkkopXe9d8+GrNhmiR9x7HL+J4KpR+IAQsLxQCFk3HfzIrTibNDUbmmAX1 Nvg9avKH+Hu+4WHzy/aKD3rif3/+ZvozJnMxmYg2gjIDO8whWuNl+3FUig/bvftcftojgYnkCaDS 5PEiIt0l3GMqHNu1icBsQEUB8pFbpAsrji0I3SKiFSenaq04oQ41DpLeuAqoxNRdpuEoQw2n5UGP 1kU2sVsaUMnVINesECvbFzGzjXcLMQhUGo+YB9rq4OtiBqbLoTbiUdc5OEOAkLxnONc4j3oPViU5 vFJc0lhvNRa1L2OZWtrbNdi0Y5pAJceqxTVYZuuuiwW3aUAl42ZgtSAVNeE2Iuk264BK9pAGlGII XMrEbct7P1P0BkigMlKuBFN7p3ugknKMlGcYMKWQLsWRQ42KnU2K4HO6YinMXxaCfpRlfzkaRGgR QroBFZSe8e+ePABi70VaFwWo8PISUBmKUMSCMIYabOkOYRKYOJ3nWLL3aB7CvBeo4CsRqE0/DVTy EUIglO9ZvP0dkcrvUMA7bxK2GAVg88Nv+a9/wPsoF6q6d0wB58t+u69iLeGYeCXFijc4YOF88l0J gWNkl3RVs4vNPTE3ySuEY0TLS/rrUzgmvu4+9JLeZRNSyGcR4rBcuI2JY3RzUrWv4rQ1cuoXXHEI LJOJeckHp/fjQO1CNvFHjD/jPswhWuNVe9FpDsQPTi9EOE3imHX2iKqQ3EM4RnMI6WKPaF/lmbJC uzZlD2NiW80MkA+2yMKCVHAMJ97EMZrJtSAd+bE3LUhBcpZeh2PUgUCGZvqk1UUAxdJFNrGMs+CY xoKYA0bzDwlm+45HtDEetlgEjkkeMQ80Hj1PG6rmihxKYAynC45JHgOezqPeU3CM5GAAYDnWWNS+ jKVhlqlfcDhFEQVTkaAstlx7g2W27rpYcJuCYyhmc5tgEW6jKAm3EUm3WYlj1INwTComcIyY0ugt UjuDuVgNxySPUG7yqIvBAMdIjsAxYhGkOEiXojnUmmHPHsndn3F6vWxAB91wzLF+VWizF2ldFBzD y4lj8HHQ3W4/m2/Opf9QjKEZiSQ0Q7qhGckQzYN8L5rBizsQo0+jmb8SzvCdB3wC8W8Fp4xf/3ZA kfOII7/70uEowf+5jvUFTpHGNddI46KlceER0eEFev9beIdwymovcH/wIpDvu/EkZ7qBqixNKKIX CSGgIZre/2LVZckoP3PVRUbJ6PZIzUfQMhSJVsahKRRDvSRaWW0Vrwq10pwwSMwXwiyyimhZQZtE Tses1vDJ1K9FzCK7/PK1F06yufg4ifFp8QkjafEJkj65DrOoAwEKzepJqwtiFhnAusgmlnwWzNJY EF/onmxfxNSSl2IEZkkeWq7inmxfeaiNJ8FtCXQeBbOkHGpfeXTLZKu9SA6GBZZeyaH2hccUUmnX CmahYIlZWh+OWdTFMBJp1XWYhTya24SU4TaKmnAbkexgJWZRD0ODiBZTGr2fLzTRJ4+BMm0usYwx eYTBnB5gFvEQSImRBikO0qVoDnVd7QUvD8KDA632QrphFltiS+1FpHVRMAsvP8Ysw9x6sgIjkYRZ JJJoyQA9GsQJ8r2YBWeTwa1hFoz60fftsFX0PwBW8GFDABfuEeE3yjBXf30TfuNxooUyCw5f43Eh vPI0e14EL+/aLFrWvPm1bRZJ9fJhqV60VK/2TofPmjt01/PdTbPL5COh/DRcESrAip51QYRbIDWh 2L4KNbU4tmtTy2QgpmKUyTccaAfvIytfcHArkcgoGeY2fihddI4/2otWjAq88PoYvDxZjwvwklLF RpHTJlXQkkLgRTQnp4CUQKvjX1NWyYKL2+U/RMGFs22uQpq+tQqFk2oVCpKjXwde1IGQhab3pNUF wYti1brIJv3b9tuaE7m37sn2Rcx+rWsFlxRD61bck+0rD7XxzLeBFykr10LxUPvKo1svG3iRHAwD rMHiofaFRwMqU78KeKFgCV5aHw5e1IUiTzStug688J7mNiFluI2iJNxGJDtYCV7Uw9AgosWURt/k /OmO0xmgGGyg3OQR7Z0egBfJIbQSLIIUB+lSNIe6ruBy0DmcOOFCuoEXbN/zva+2z7TZi7QuCnjh 5QpeXq22SJ5EKnGoR7QEgIcacgnyvcgFR7t0ZBl4aodnVlchFxzsT7TyF8cvKLngCo644C++5AwU 83f++smKbn4b/2oY5x/9X7/j0wKEPbVpY7r59GOp44y2N1w9J3w6dV+GMgeF3v1Oi3pkymt5g+Q8 oJBsmdBHZ7zC42VLiyqDTk5PQCG2K3WcFc41XcRpEgXuSYlIN4mIg0Qzol4s4ixZ5Gcu4mj8OWPE +EVrvMQ743AXDmK7ioNWmGTgJAGCUiSBHokUdBOJa7TT4SRT0KddWwRBMsovX8HhrJ2rmZYBrWah Dq1mQdIh14EgdSCEomUiaXVBBdMgOqLLc48UylJcVmwai6CDxZClidnf00BQ8tD6lzx6ns5DbeKI rkAP5cJqFYBFsg9nHOehNsFDPi85SGMtlxxqHzRVHgAC08v4VwFBFCxBUOvDQZC6SBG6LtaBIPJo bhMswm0UNeE2IrsxIB4nx9AbsRhdigknEFO27yeL3gANBGnkMljyqEvCAARppEI9IUaQ4iBdiuZQ 11VwcA+OtdpI6e6kEwRd8bkv7CDZg5BQL2BQuWDdNCCU/xBQ6HiBiiemxuWsvWEbl6pAH5ch6Dve lXKgVLxBF16dHI0Lz/zu9lax4ttXfiI45JUXAJ5/dsBTCzx/KJAJZ2oAnACHFko+193b7XrAwQGX 8oPz2EdHORpyoQM1N95ZfSHCIN3CXMqxTrkiDxr+C/GOe9DEC4WGHmR4J65hGtImVDo25gGr8zjt cjktj/ET7Y54yhUG0Li2UBfY0X6iOpYH6X0U2H59UArcfII34+291/sFki48OnnD+4ouV5ybq310 J6ve90wVq1dShG1bUHm6YsriFVjois+K8QFpV1+5MqM+TLpS6RQ+YefwIjyHBMZeS10P45sPTP1q fpFianCbvJKDKx4aRi1XZgbXalG2czpzBAunU+8+my4OLr9q9OpHTxQNE5rwbV3MdlYZVISU5cMN GnQZc2DfcgVawDfQ8stG+S+Bi9dO/i10KVjiXJ9SVAzUmhR09UYi6XLFBGt+NvVryjxZIKyBZdP/ 8bp5ELxb+7oRH47kXwRwPlK585eD8aHJnT9GefArfOEmXyPDhyx5JTnMLwLHWzxY+XAReP7BymKE VCmAHNORvJJV2ho5NES78lpZIo/4l2ngqTRlwuUnfSwFzeHllRxeOjUmBg6vXXnn8MpE8NTwLOQQ DdNPlYyXygU4Xc7+gSHqXAmnncRC2eC0zwoNTjvJaXBdFqYOCsaMR+97zDno0brobin76GRJTOHa cBhrdM+SPJhVpRiOVBpoF2DHv/vQlLWJdh4N3biuOhBvqAJzaqIMXyb9hTYxx0ZG2do4jzLvujpI u1yUo7UvKh/nLS2XwdTWMYXCRqmCZ2EaWmldulhwG5shOk+obuMsaMQWKdG8XDB9Oo+WTIhLaRV8 7GBw5B/+5eFru2B8sKV9xQsn9idM+mNnTGGT74qONhzfoKPBsDJhSs7pe+3GzWgMFPmBCXsftp7M f4tfMAmd6Lkla51umpbaL5/qGSzJSF1t80oGWBuUQqxd8bkwgibvNHjlIZBXwCuuNBPqrriCQFqn oRaN8Dl0NYgU0s29WtdPaMgf++3HYBMQu6qjiitlVKNx2qgGd3ps+ucjC6+Ix6bbvKtxn9FQKWn0 04BrqE0DHqQkJzoO/YQhJI60pumku9EmlCKw7hmadBydLWKbwMl53BU20pe7wrRruvnN/wcG292O CmVuZHN0cmVhbQplbmRvYmoKMjAgMCBvYmoKMTQ0OTYKZW5kb2JqCjE4IDAgb2JqCjw8IC9UeXBl IC9QYWdlIC9QYXJlbnQgMyAwIFIgL1Jlc291cmNlcyAyMSAwIFIgL0NvbnRlbnRzIDE5IDAgUiAv TWVkaWFCb3gKWzAgMCA2MTIgNzkyXSA+PgplbmRvYmoKMjEgMCBvYmoKPDwgL1Byb2NTZXQgWyAv UERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0NzMSA3IDAgUiA+PiAvRm9udCA8PCAvVFQxLjAg OCAwIFIKL1RUMy4wIDExIDAgUiA+PiA+PgplbmRvYmoKMjMgMCBvYmoKPDwgL0xlbmd0aCAyNCAw IFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBzVrJjhxFEL3XVyS3biGVq6prvYK4 cLNo4IA4WIPNohlL9sABvp7YXmRkdU1vNhKy1K7Izop8GevL7PmQXqcPqW3rsbPPYZ7raUzTKP99 fJt+TO/Tq6+f2/TwnJp6GfupGZbV0zx201A9P6R5qKc5Te1S9116Sl3T1SMpU/kR8rgMdTunR5vu 4m/pneBRLTbctmM9z6nr6+6wLEt1C6REkJamHgKkdpl4swqpekyQm0kh2XSIDKmp235p2mXcfKIl PtAXXZ8a/scPrGNaaP7ULLR49fCUvjrSV01Luz4+pL6Vufbf8Sm9Oh7bukltOr5LP6Xd9+/3qUu7 3/dpSrs/92lIu7cy8su+ovEk49/tab59+0a+jTOf9+nndPw2fXMUi5b42mGuh6Ynq0R8Z1Hxosc/ VN3ZkLnZP11zIPsiRihm5iXHEDnIZA8Sm+8ygqYcn8d67D1o0se31dVxzEHTNTNHcA7kua8ngBRQ KiNMMB/yXWHjSlZB01BcXAiaXTvR/uelbSk3s6fWgdnNbT2P0+FOx19Mf9+BJBP7cmUmld13Nt/l wmzVVt5tZJsrmepDnzTX1rFcxQy7OpYpbLbLH0GLhVDKn4QNZX7n9e6JEr1nTF7/TPb9djK/ctlj WfXYeEu1r8kV8EVUVGEMleALqIZ6cBSEirPe5UeXEbwdlWf+XmQK9sIrtMhpNdzyCiuhgm2hRn6p rAYepovhTDXwy3afeql1c9pN8tzJZ0Of1e4gz7N8LvKp8/VzCOOUDi9XwsPc1ONMleK+SugGz6aX J++HhSmpIcL0MLXJHgA23+XC9FcnBEw/Uq/bTolq1XQ+ISW6gZpj1xC4bmiWuaE+6E8UF5Txsf1S a4+hp6JvVyaX6dDU/dwdho4px+mTlOrIMZhzHIoGb7KvYZzEZTZx0XOYt1D+ebknnqJyBrbuSayj zHXO/aGmQgvqoyJWrdaVQB29tBPxK2IH9ekT21LY1bgQFcrsilCJnNkVFfklsCuIvAS3btOiw8au 2u5FdnUeEhmK3OuQjE2pnNnVCAw2HaLu+rSe5BqzUVlYh7CrkcLlcAe7+iiM6i/hTL/Kpz6/EXb1 97l60R66epkoNHTtF7qN8blK+NwnpNZJEHBdN39I5AtzcuN7VCIelEm58cGQxPpW1zkgivGkzAkB sdFs1gGxBiXMKYASCmAy0zmVEQLo3hFUdv/W00ZIuBIOCHUKZdgZkn2LU9bMcb3/kK3sFApPogC+ f090dgoZHbLv3+ZDRpZCj44bBQheuRWV1N2MSimAyozKZKBAH4J8V6KKEqYARaJ+Hr+cHjOsD4Xu s9GHrP4+cRGkPqQi7R+iZY42LY9Z3f04zf2BTirEGE6eyPGiAi2C25C0JRT8LGOJ6BDlWMUrlXey oEI6m8Py+aaSYZbdjnRIDQCscJqyd3x+1GF1Q0/p3g3dWNYdMw7MjzoorLlMQgfCXmWkQehdmB90 bDX8PEYmL5SSwcoe66Kp9NnFEmfCRi40hL7YVnPYmAoLG2SJhQ1EDRsjLVQlz9EXX2HtEMhQqk6v vKiL0wsHBIcZTDjMddh8ka0RlNbJtnTjMZvxVTEbGnWr8fSRr4n8HELWossh1tFk+gI50xe+eXL6 Uo0QeYlAX3R4RV82utX6voq7FTF+uq/Kl0MOCfRFIfrlkGOgIGW2Y5Aq3fXd9GVq+cpJDqyEqmmb qw5GP9BVEF380BURferzPyAxMkK0Y/e4T2Pa0bXQy0eftieayGRzDDgoZ0LX/IynhAuhwVFOpdUd ASoDR0BGMOj80+CAHp13kcqcDw5nFQjYTF0ogDOVyaCU+ohsabVFYPLYGSoTnPLfUZn1/pnK5OQI FEQSNiR9E6mM79+oDGRkLPTo+GUqcwmVdk6UkUBdFJVRGaAAlYF8V9JmKiN+sRvdIlnSvUfqe6kM GYCOed6TRMxUBpmTe5LErO7+lMBkUpOpDBYAz1A5F2pfIjqkpDLySqAyWYVSGagISzjMsvNlKuM6 chfTdNSDv9UQw5HniK2KTkjGCrLqyPMzDqMmui53RrnU43XkmK2ydGTVkee7jq3mn8cClRGlmcrk NdB+RWWAEJa4jsqQSnonho2oMCqDLLGwgahhcyWVwQrBgbIEZCgFlYHMi6DQu46VMeEwvIP5Iq+o DHQYLVSRqafYEhpgS8i6VTtmh7NtcfQ2KjNO9RypjMo5QwbKjEBlIPISgcro8GUqsz54BnAUQWQo 4SYGCVQGkCADg0038VOpzDBxLtxMZegXLqIpSmLo1yu671VaQ8SFSMzTvjpDX+gmhn9OG8PSJXtZ FeTqljP/+tr/vOmddSAcrIrA9ghS2B7zRbagjRcxOu8ie7kEytiIg9KLlwxK5QxK50dQmalsPZ1h L8Ep/x17We9/+yJG95vLtshkdOS9758ygi9uICNJwV50/DJ7uYRKm6WjAlthLzEqk4EC7AWyVqcb jxyZvYhf/hfsRcuttyHUb7QhCVq6l9HjN2JWd38de8ECoBao7y5jieiQkr0oKGIexiyyCmUvgLVW yTDLdzJ7cR3rGoE1DJbowBw5EedzveLK7MVxYH7UYQ1U1w1pYKdssBfXgflBR2YqW0+BvSgwvzzA XtFxTSUyD0uqV69jL/pODhtTaWGDLLGwgcgLxCHiV+sXNAiGnn868rCDqADPhF24KdI171ggIhLG rPeH2ANiDJgw3RArxNMbJncYQ4QOGNFj1KwI+WRNozGFHYh9nFokLAJDnCrV5MFGFFQ1QuZFyneQ PLk2e0O13ft8lq2h+s6pLZzahYEW2RKyC9aQTCBgtnvMh1xY46Vb4eIldqulF5S4jJ0YqMIaxTtI 4QwM+YR31jqvig0oQWyc5KyQZsDGbMi8hI4BlhcBTDGFAOkaigA+iagQZaHOqM4bl1COK9dbpGr9 pzFkY/tVsT/kH80H+ZuuZP/pCZ94p/2y90X+S5vX/wIHZRfTCmVuZHN0cmVhbQplbmRvYmoKMjQg MCBvYmoKMjIyNQplbmRvYmoKMjIgMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCAzIDAgUiAv UmVzb3VyY2VzIDI1IDAgUiAvQ29udGVudHMgMjMgMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJd ID4+CmVuZG9iagoyNSAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFj ZSA8PCAvQ3MxIDcgMCBSID4+IC9Gb250IDw8IC9UVDEuMCA4IDAgUgovVFQyLjEgMTAgMCBSID4+ ID4+CmVuZG9iagozIDAgb2JqCjw8IC9UeXBlIC9QYWdlcyAvTWVkaWFCb3ggWzAgMCA2MTIgNzky XSAvQ291bnQgNCAvS2lkcyBbIDIgMCBSIDE0IDAgUiAxOCAwIFIKMjIgMCBSIF0gPj4KZW5kb2Jq CjI2IDAgb2JqCjw8IC9UeXBlIC9DYXRhbG9nIC9QYWdlcyAzIDAgUiA+PgplbmRvYmoKMTEgMCBv YmoKPDwgL1R5cGUgL0ZvbnQgL1N1YnR5cGUgL1RydWVUeXBlIC9CYXNlRm9udCAvR0xMSkFSK1Zl cmRhbmEtQm9sZCAvRm9udERlc2NyaXB0b3IKMjcgMCBSIC9FbmNvZGluZyAvTWFjUm9tYW5FbmNv ZGluZyAvRmlyc3RDaGFyIDMyIC9MYXN0Q2hhciAxMjEgL1dpZHRocyBbIDM0MgowIDAgMCAwIDAg MCAwIDAgMCAwIDAgMCA0ODAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAw IDAgNzI0CjAgMCAwIDAgMCA1NDYgMCAwIDYzNyAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAg MCAwIDAgMCAwIDAgNjY4IDAgNTg4IDY5OQo2NjQgMCAwIDAgMzQyIDAgMCAzNDIgMCA3MTIgNjg3 IDAgMCA0OTcgMCA0NTYgNzEyIDAgMCAwIDY1MSBdID4+CmVuZG9iagoyNyAwIG9iago8PCAvVHlw ZSAvRm9udERlc2NyaXB0b3IgL0ZvbnROYW1lIC9HTExKQVIrVmVyZGFuYS1Cb2xkIC9GbGFncyAz MiAvRm9udEJCb3gKWy01NTAgLTMwMyAxNzA3IDEwNzJdIC9JdGFsaWNBbmdsZSAwIC9Bc2NlbnQg MTAwNSAvRGVzY2VudCAtMjEwIC9DYXBIZWlnaHQKNzI3IC9TdGVtViAxODggL1hIZWlnaHQgNTQ4 IC9TdGVtSCAxNDEgL0F2Z1dpZHRoIDU2OCAvTWF4V2lkdGggMTc3NyAvRm9udEZpbGUyCjI4IDAg UiA+PgplbmRvYmoKMjggMCBvYmoKPDwgL0xlbmd0aCAyOSAwIFIgL0xlbmd0aDEgNjA2MCAvRmls dGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAGtOGl0VFWa93tLbanl1ZoKleS9yqusVaGSVFag qSdJBUJgCBDsqkC0QhIIkaVkcUG7EyUCFriBSEZkGvpI4zBn2hfQNkEU9JyZ0+1I27S2Ot1tdzvS 2jqGdonLEVKZ772qIHo83f1jbtW999vu9n3f/e69b+vmbb3ESAYJTaTuDV0JoiZjHKuXu2/ZKqgo YXoIgU/WJNZuSOOaKCHs2bXrb1+Txk3thOjf7evtQjk1XcGytg8JaRSqsfb1bdh6Wxo3urFesH5T d4ZvCiBetKHrtsz45PeICxu7NvSm5bOHsC5JbNqyNYPPwXpBYnNvRh5wPrR+pvuv+9J8pTTjlLGy kVuIlvQRllCEIxJZQQjFQjeuF1Q+y/J7vnfWe6NlzmfEo1Ob//v65V8qwH/MjHRffnRyv+kJ3X6U 1WMP6YT96rJSy3CMeuTfbHpC7SnDVCubpG//y3s+/r13rfzo1Dmp53UjVyv9N7yxz8qfx/wy5v/C /BLmX2B+AfO/HvLxj2F+9JDA//OhEv7QPg//8bCTPz6cwx8cLuMfGS7kDyAsDcMwils+gYf35fD7 9/n5h/Z5ebIPlIFW7cviai1n+DPBM3TwWSBj3BhlGQXyNAhfDnxJcV8IX0hf0AOfATchTFDCpbZL VPDD8IdLPqQrfpP4DXXqZAl/8pSVD54Kn4rLCTnxGvvniz7+HczBi8oAp17EhSgDTT2FwK8HZvIX MP9qQOBfGbDy5zCfxfzA81PPU5bnYOo5GHnSyieeBO4J4Qlqz70VfPLeIH/vQIjfPeTmd2HeOdTC 3zNk5XcMzeKHsJtNJ46ckE98dIKRjgK3SlglraI/xR7vHnDzdw0s5Aex/iGO+APMbQPxgcQAzVm8 vMtZxms1Xj7HXcYztJe328r4QLmlzG8uKbUUFZt9hZYC0Sx4Lfm82ZObZ3LnzDA5Xdkmm91hsnBW o9FkNuoNWUaNVmekGdZIgDJylkELJWkGNZRED9KUhYTJEjJAGAsJIijlbULkLHmFTBGdZ7aOt8zS 8XSDjif1Or4tBLKtlbS2z5PtgPXyeXLI3zqqI8vkKn+rrG9bGR0BuD+GVJnajeZpl5ndoxRWtsaO ldFRyFHY93gQVQRHYfCe++7zXIViMX+e3NO6PCon8mJylQI8mBcjfkxbtm7ZskUBviuN6JXRe5bN G3mfiYiRvi75fbFp5IP3FTgufyA2QabptX1gd9jpdHcIKP9rEvFvQ+YW/9Zpkau12gi3g8ZBDBgv LhB+urx2qzDdRFTwqbfV8q1pONUz9ZkC/38kZV+n9/Y/3htcoEr/cenvloQHYCcMQjvcChtgG6wD CbohhuUOxDaRn6qtjpH3QYAcMAOACFbQkstQCHlgB4YYEP8QpSZUycNqOQGzyKeUqi2yBylnyWvk IhknKTCT5/G3Fn8nyFESJVHIh2JogAXkEvaei7KPkhEyhjI/xza/I++Sj0AHHXALJOFhykTNpzpQ zg2NcC+1mLrM+IgWbqVssJY+DROgASf4yGnyMvktLU/9BY6QP9Hl1ClyG1lEXoVqkOhjdBnNUxeo Y4RIs9rr62prqkNVlRXBmeUBf1lpSXFRoU8s8Ap8fl6uZ0aOO9vldNhtVs5iNhmzDHqdVsMyNAUk ALIb/T5H6/d4vd5YeQaf8U1cpgu5T7wysX1DyPNNoZHcb+F538Lzr+L/JBOH3Cw2Nikdj5Dmd2Vi l8EhE2UUsC/GkTIzifT0i5F1ck5jTzyOLZpETpCbPwpmpqJOeCTL0Cg29hrKA2TEkIVgFkIomxiB 5rmgAlRzZNYIRXSm8oBswzBQGFFyvyztiSMgNuHSkWP/moNRd++1LILN0kIExVQIZE2jrFXHFdbJ UpdM9ggjgXPJvaMcWR33G3vEnq5VUZnuQqWOELow0teOGI6MOd4nyAyOqxYepAiRPiGJuCIWx1Js wlbfSUeyvjG6y3tODVi7IrLVL8/HlvO3X/TQyYh7naCgyeQuQT6yNHot16vIxGIxd3lASKphqKk8 EOmfh5p2B8sDigpgWjU98X5lLv1dyjwj/UJyT686173q3FTRSB8apuvvSSWTkR4x0tPVowyDvTfK UrtakfYORR1CBFXXFMuQMgLIYVROvCmGulYm1ros2ojciNjVhD6o+OlVSjxDQUJkmiko82yRpbgs dAsyWRYVsXG9UvTWk2R3veLH2A2UB1rbvm4ls4WcKCQ/IzLExfEPlRl/TenKUDSF3GdEYTaLzfFk slkUmpPxZNfo1OBqUeDE5EhrazIRieOobVEZkH56j0du3huTuXgfzELdKx7QvCwa9nituI402jaN EnQpdCx0YVwOagH/LZkKbUHao16hUSYrojEPKjKqwO0Ip2vFkdBx69HGGbUpOupVFosDKXAG9HoV 79wzKpHVaHd5cGk0jQtkteckkYJ+tEdc4Zyb5jhXKJzBac7V5nERjfOUeiVzyrqiq38L57JH+mbJ 4Pob7N40X7Y3RmkPpTg8QpSHViCDH3f6HDnbj3CJP4lm+ZUoc36ZjZ7zzIkJnBUjgGK95WLr0o6o EEle9YI0JbNSxQ/Q1cWuvmRmi8XR6TEUzBsRYffSEQl2L++IjnGECLvboycpoBrj82IjPuRFxwQM rSqVukpVZAQFI62KA56kdCrLMyYRMqjKMipBxbvxsqHS0kJIA9KNNw+VxqlyaKlyPC2BUGfwVv0G 2ci+RNYyN5A72BzyPBsl1zNPkyg7TDrYNhJFmSOYT7CnMP+QROmvyAn6GPEjfpStIfmEYEfKPZzg K0ODJw8hAunIUFTyt4rpO/a3yN+J0tdQGRVmr6H8bVCDbC0uU58RwxsKpizMRmJSYXxAEAu+GdLJ qlY83mFmk1eAxhP6caqQup36M22jZ9IJ+gV6imljDjCfohyeYUrnOASNleMZDcUQJQfPv3VeLSor vFavtRALQKmvBllyWakJAoq+NlIaeh1dhK1zJQ7eoDgSV94eVJBdwlKdwVCwkwTHKysA29PrJlnq MqUBAdutnXqH3cheIiGyc4z4p4ZOmbg652i6to5OvSit0BvrgnOx0OW580S6iCnVBfXBPFGMUTHm +4ZY7vW+bfR2vSVoD9s32QfsjN0+4yEjI5RXlMfLE+VMeXnRQ8RuLx+tITVLam6soYUfaJ6p5ibG O7nPq0h4HGemFpUVnX4/+P1sga+4iKqpttXV+kJVrmyXK9sqFhUVFxWJBRqtRuN0KLRQVW1dbW1d yKpRaPSNP0m919u7qb+3C/gTNxyUGjeUBnJX1NYNtizdN3d2y5I533ukpfneWZXtnpL6NfUtg3mr u7qg4PkRENZ2r3da7UFH6qB7niAEQrMbzuzce6a2Lljmy5vnTj2WE+CcLtTTHWiYd/A+mkUapAI9 s19DG+j9oMs6ahigWeoooYGmTUbeVGGSTAkT02m1NQQ7J6q4yYkqEpysCk/ipaYUrCGriFYUrSH6 nSvDExN038QE6OgXQJf68kpYsSN6O/MRjsMSUXJQNPMQ+kWcJNCuRMsMwNMa7vNxa9qaYbVHNCjz 0eVfwiB1kr1weQmanFw/9T/MM8wO9MQKskaab3GzgRx3C9uSG2NjuTex6yw35d5SuLk0UW6Cj3ne 7yqWTJa64mLxuJ8zHXe5KnioGAqergpWgaWEL6FKSrRDOc9W4sA4LlptsgqXFB7HJQX9yjLRrTqh xgxaMyjGyQc0TraKigVFNdVoKF9dTbVqPtGKRhUYJzrhspYTgdoGoztbaqrdVJZ3fVHN5qYjb27s 7YGSHw0/HHsp4G0AuAtCYE0dgsIPNE6z9boaMeBw2ANJ11ybO/s/H73jMXQuvaZzftgKFkvpcy9N MqjBKK7+ZuZuUkx2S2IFHdbPzqn0SHSEWaRbpF+U0+Rp5VfyN/F3CuYiwcjVOUanXlec3jw69SfJ iQRO0nN1FRxwXPZBIxf2gU95u/JI9PnyDhIXR3ycb8BH+4Kl4CuNl8KMHZpnSxSHtoY6g50h1af9 aaf2V1bg06aTLSgqngmKKuaichSHnglIQIdGhSmuPBfQlc1Afbr/047Y6nU3rLw0uOXF9pBztr90 9XUPHvrRvqYNvoJqV2jFWH5zS8sfDhy+2Dp/XlVJ6rytItuV98zhHz/BOx0BZ+p8SRDt3zH1NnMJ X1B2jJtzpZKFhoUzbuZooQxXSQtoahtxHzRzkP8I67I6qCFyusCzQ/esF5eQNm54XDGvMvXOUsWw YgFl/XruXrBeM3XmUmq488f95z9fvqDpxa7eu5qgLzVc1C7ef//mH1Zu3LZoAcwB4wNvLWld7vfC Hy4XUMWceeTwsQOFOE/FUleYncRJcslGabmP8htC1BxDI7WYXWxoNC/iOtiVhhWedZqb9HFHPHsr dbt+q3mrwwEf5+Yac47bOKLjdMt13botOlanY4aNLr3eNUTO5AfzIReGLM/mKevpxHWF8PmdjjTT /upV3VTVuigQK0e8WBaqC9MyV678XDf21ObX55Zsf3NH6qepYVgBpWADR+pRuj/Rt1MHfx3auyyY +mNlACrwGeaCSOp/U1dW3Lx5/a24riO4CXNR/0okr5S87L8QDacRNLSGUBZgDpMh9jABDiho08f1 CT2NXnNx8iLuqXAn7iWMEt463NWUDcftM6SG4E6m+wjgYQL4RiOUTe05T7JRSBjKdMTG2QSrdDSO 3aT7SLdH4XQ71oZ7wkXqJRGcducca8LJAGfSHbBzZosJ0AncFe64m+Kyhkxj2Wm9fa50Fh63NTTg Dvd6rdXTURhDmNdZW4uu7GRtqUfMVsfiSGXvbGW+8ZH1PztPlTftEgoLBPHKRab7zta2115Vrf0W W4TWzsK3u1eyOYf1nHeYdll2kDOFHtxCPgwwaCo0VFg5qNIWUUuoxVfh9NjXnABsUeq51O/x9xxE oACK4LpURBR9gtBRXb200Ftc4BViDZUxqhKN8wKE8S2aDXNT5yZ/67/9pu6dJaUFuWXFu9eu2lVa 7PNmtES/yazF73/1z4AxYcTzk1H2fraBq2MOWCxZFj1+EXAEHWDUDunH7KqWMBiTcDg86a8KKnEQ d7ZyTqkaSm92+k0he03B4luaFPXcKi+0V9hoo07ncE9yTPexNY0UDgN49H5A38Y+TjxkoRQwsB6W smQlsqgszqQ9nmWweDzZx2mXWUJJkmfJA52JGzLoNmlBixEnhJEYg48aexAMh8Yb8PDB2RQqe7eo xirWhNQJea3T8bkuRN826+4bfn3+4YehD5amnqQs5vlNuStt+QaL9cQvKdMEKvPsRGrz7KgolroN OO7RqbdZPX55cWFMKTVoZmgW2Vfa19sHtNvtWsrJ6i3WA6wL1HiSdqWsIZ3iScpBP5k+MdKelIkp OK9r5mP1svrUcM9Ptpz+BfRnOeyLIzMT1dB356Ilr1+gfjf56oqbCwsLCrx0Ls4kP9XDZuNMtOQ+ KaxjF7JROsauoVkksPg94N9gDPfWLoqmyOPan2kp7U4Nq8mitaybLqT9bD3dz95B4Z2F3arJokan /iiJekudxosFRdgaTURDaSws46EofVC/RE8pm5fS4MmnWjoY7lRXgTeVzl3cZOc5tdCd052DTj14 wWsHL3UM76+bJx9MbT+ZaoXtcB/1+lcAjzMr8aaGxlbS1Dbyahr6VmlDnMYbZBEJ4DfDJtJM5pMF +LVkCVlKluGX6O/jN5pVahtAP0VvwKTBSE/mL1q08Lpl/ut7N/d0bewqn7dpvfJh/f8AJmyJAwpl bmRzdHJlYW0KZW5kb2JqCjI5IDAgb2JqCjQzMDMKZW5kb2JqCjggMCBvYmoKPDwgL1R5cGUgL0Zv bnQgL1N1YnR5cGUgL1RydWVUeXBlIC9CYXNlRm9udCAvSldNSVRGK1ZlcmRhbmEgL0ZvbnREZXNj cmlwdG9yCjMwIDAgUiAvRW5jb2RpbmcgL01hY1JvbWFuRW5jb2RpbmcgL0ZpcnN0Q2hhciAzMiAv TGFzdENoYXIgMTIyIC9XaWR0aHMgWyAzNTIKMCAwIDAgMCAwIDAgMCAwIDAgMCA4MTggMzY0IDQ1 NCAzNjQgMCA2MzYgNjM2IDYzNiA2MzYgNjM2IDYzNiA2MzYgNjM2IDYzNgo2MzYgMCAwIDAgMCAw IDAgMCA2ODQgNjg2IDY5OCA3NzEgNjMyIDU3NSA3NzUgNzUxIDQyMSA0NTUgNjkzIDU1NyA4NDMg NzQ4Cjc4NyA2MDMgNzg3IDY5NSA2ODQgNjE2IDczMiA2ODQgMCAwIDAgNjg1IDAgMCAwIDAgMCAw IDYwMSA2MjMgNTIxIDYyMyA1OTYKMzUyIDYyMyA2MzMgMjc0IDAgNTkyIDI3NCA5NzMgNjMzIDYw NyA2MjMgMCA0MjcgNTIxIDM5NCA2MzMgNTkyIDgxOCA1OTIgNTkyCjUyNSBdID4+CmVuZG9iagoz MCAwIG9iago8PCAvVHlwZSAvRm9udERlc2NyaXB0b3IgL0ZvbnROYW1lIC9KV01JVEYrVmVyZGFu YSAvRmxhZ3MgMzIgL0ZvbnRCQm94IFstNTYwIC0zMDMgMTQ0NiAxMDUxXQovSXRhbGljQW5nbGUg MCAvQXNjZW50IDEwMDUgL0Rlc2NlbnQgLTIxMCAvQ2FwSGVpZ2h0IDcyNyAvU3RlbVYgOTcgL1hI ZWlnaHQKNTQ1IC9TdGVtSCA4NiAvQXZnV2lkdGggNTA4IC9NYXhXaWR0aCAxNTIxIC9Gb250Rmls ZTIgMzEgMCBSID4+CmVuZG9iagozMSAwIG9iago8PCAvTGVuZ3RoIDMyIDAgUiAvTGVuZ3RoMSAy MDMzMiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAGtfAlgVNW99znnLnPv7DOZmUxm SGYmk30SJiQzCYHAXLKQDQxbQgIMSSBgQJCwyvYMrbKIiqitS92XarWtxIAImlYUpWhrKy7tU+tO qVpBqtRSyEy+/zl3JsTWvu99732TzJ3/uduc8z+//37urFuzfgnSo22IQ8rilV29iL3kh+Hjt4s3 rPOqbX4OQviOpb2Xr1TbwhcIkWcuX7FpqdrWnkOo+mDPkq5utY2G4LOsB3aobRyCz6yeles2qm3p J/A5tGLV4sRx7Tpob1vZtTHx/eiP0PZe2bVyiXp+8zTa7l21lp4Hr8t+Bpv7e9csSZyP26A/Q2Od X97CDrONEboMRARtRBp0BRIQQWYURK1wphYfh/FidlwQPG/3eOo6TJV/Q26JXfn41TX5lHhp7ATv xR2xW3W3Sj3QlOEO6gvuK+nisxDSF8Lx1bpb2Z0SB9lH5DCaM3xEyRjILykzD3gHlIEZA70D2wbu H+gfeG3gwwHtkYGzA+QQnNL7VKqzzFODTa2eVtLc0tFCVs3B983ZN4fMnJ3Kz5rt4GfPsvONDbP4 qQ3lfF1DCV8P74ZwBV8ZKeEnRSbxkyM+vjqSzldFZvFT4K3AOxIu4UtKu/nScIgPh+bwoXAG/1ro w9DZEHdo+Mz+A9n1ZYeGP9x/wOyHzzOK4YBsKjvgquc37N+xH7p1dv9+dsYFZXi/nFW231bPX7cr he9d0buRmO7+4F6i3ONIK1PudrjLlNtTgbot1V22Y3uKx3Stabtpj+km017PtZ49npuCe7Zt37br ppv3bt+7c+8uk/J92VxmWuNZQ5TVsr7MtBJ7j2Pvr3Dk2JfHiPcl5SWCFmG0yLyIKF33dxHTfFxk s/CFtmw+YKvgC2wpfL7NzntsGbzPW817bZX8y65a3uWu492uSt5lK+HtcF4KdNdqc/EWePfasGKb Ul1mMhZ4kIgNR5s8+heaPNojTR4Z3sJgk4f/RZOHO9zkIc80efDBJg96uslz9IUCz5HnCjy/UFoH fZ5nDvs8Tx/0eV44+qLhuSPPGwZ/8Uv94Wee1R98+pDePLhtkCiHtx0mpoORg80H+w7ypoNBIFcB +dzB3x0cPihp5XJebyACTzhCMCIzBHwID+N+axNqmlPVn4Lhc3bVk3JJoKm/e1bV9htvTO+/rWlW W/+29PZDEpzT1o/78Z72fqlpdoJEAfpau27tWkb806afq+0Xa3u6+kV/zVraMNKG0V8DRL+J0iZ/ TQD322p7+m1A/ctN1iZfcEg9qH4Ro9H6f/o61qR9WQc9CgTEDNEmnBVO8Fv5KPceSB0a/vPwR/GN 8e54O/cD5AEJuQ09jg6jY+i3I0IziF5g9AY0gI6gX4/sp8T30A/QI+g36B305cj+O9C96Keof6RN ib2I7n0YPYaeQPvRM+go7NuFboa9P0ZUYyRfq9BOdBO6C92P3sDpiZ1HiQ2rPfgM6ckJvBbvQS5U iGrQArQWXY12QL+O42mwbxLsmwF714BmuQX2HkbHkzce9TkJNE0ULUdXoifhjOfZkQK4dg7qhr10 n/pajTaj69AD6FH0LFoF9E7o749G3SdJfo/4iA+tQ3+CK1/BPyTHYESPou2iDWkREk5QrvJRxls0 /BFC8e7hvyHELSLnyIPkZrSPLEfTFHvLnPKykuDYosKcbI8txWox6AGThd5+LrvWX+vv6tntre3x 7vbXdNYUFQL+amvcPl97UaEXdtd4+3Gnt7Z/6oYe5+5aekK/NdBPsmvpe3m/cn0nEP4an88HR1Iu HQEdd8OoQ95l/UpXP7re+2Thkd03HDKjRZ0Bfbe/u2tBWz/XBd/1JILO9ADi4YO+O3u8/TzcmG3c sCfRRXqspxO2/hq46jv3w265um2n74i73wqftf2WQH8d3Klu80k3t7vWucxLm7t37/T23z+zbfRR Hz2nvb3d+S02TPVP7dy9e6rfO3V35+6uQ8PbFvm9Zv/uJ5uadvfWdnr70QwQTtj/zPXu/qk3tPeb O3vwBOAeHcfUWW0Rt88CXfX56HivP6SgRdDo3zazTW170SL3AFKCgfZ+0kmPHEkesbfQI9uSR0Yu 7/QzXle3cW4CN26a7W+aOa/NW7u7MzFviT3j1Vl8kqCqJ/1418wnFbxr9ry2wyCY3l1z2gYIJtWd Ve1PZsGxtsNehBS2l9C9dCc9xUsbqAkDKgaIxM53H1bAaLOjPNvB2osPYcT2qSfBPowWHyLqPnPy PAL7eHWfwvYBs+k0kuo5baN7DT2nCAR7C7chryEk3oBeJ5+hW7kH0Z3wGRMc6DrBgR3w+QC8H4X3 dHg/C2/Yj34E783wXi1sRC5hKzou3IbWigXwaULH+TvRcTEEbQ4d5xai67iHUKFwPXqVXwf7fwnn DMHnNLSWf0P9FPbCvo1oB38GJO5dNMDuuQVdzf8W9fBD6DAfQMvgcwX/IloOfa2htGBGh0kJ2scP oufh81nNcXSY7uPfRcvpNdxydt2VXC6aDPufhPMmwRhb4bOS0nwItAiCwVNfBhwOJIJ2RMiL5if2 0L2jXwQ8Gx68HWAV+D0SeC1apIPrDMiITKNPBNqMLMiKUpAN2ZEDpSInSgP95kZjUDrKAF3iRT6U ifwoC2Unrsz51h1yUR7KRwUoAHqyCI0F7wqhYjQOlaBSFEJhaJWhcjQeVaAJaCKqBO03OXG9B+4+ B7Tq3egQnoDvIhHyNfc93sjv4z8XXhQXiO9oDkhjpSOyV75Wm6ft157Xtei+0JfpzxseNtYYT5nu NjdbCixXWQ3WZdafpTxhW2kbsj/paHK8lfq0c4Pz3bQ1ab9wfey+a0xNujb9uow+D+856LV6f+ab 6LvT9y4CG4yAOSIoSPiwPS0SHtF38NX3XmWbccU+i8+SDRsMZ13YJqCL9BMBQefideQWnuFjwNcK xc/9DPNzpJ9pTRqsUQy42KAYCPqpdhvGuED4qUbhMR+MVp6MwTsaRYysPDmuGPssfosv7LOUWnzC M7EPHol9QHyPgJKvpMT9xBf7AL7p1vgeEgEbxaGwkuPCBThAwqiC1KJ60oLaSTcYhJc4PSFcKw/6 n7gIIcFoaRCZz5UE4TuiMvankEj81C1P4PTYanIT7f2dZBwnk1NwT69iw1UmEH+T0IyahQ7UIcAA SbA0SDt6mnYy7OPk2F7SS8Y9Ra+NweYL1h/vQdKKJVSEDw1/qmhNJtISxBFMcDAaOI0icK3PbynF X3z5JZxN0HXDH/E3CV8Cx/xop5JZhit0If1E60RnKKMWN+hq9E3WJmdNht7eIBNfA6c1HRo+d1Cv Jy0mHwJ39AC9PxDnFLdOB5STHkL3ZpuyPdnEractt0+EE5UUeqZolmXY6um54h1Z5m/AQTkdiCY+ oXe0f1FsJj4vsZitPq8Vl5WFQzm5OTn+TFEjinabI9XhKC0p42+6GD8fP/f3C1jG+r/H/+FPS8vy b+pYuCUrM82R5dvUvXAr+Sy+Kn4d3op34xvxlnjf0FMz3/3RHR9eNv2yy5obz+y5+/XZl826DNiG HTBDlcLvQQp3KWFhqijqOSNXjyWTxWMhAvGYsMmkN7LBGA16vdhi9JIIt4rr5ThObzaTFnDdP1R0 dICcgw4Q2ueUdDpILoOygBMNBtiaDQYRtvQOXDDpqUVLTwcCFSXBaLA0iiKxkkhpkM4RBaAvXFJW XlZWDkDkK4fewWXxVyJ7s8eG+btw8R3cqV12W9r0KRdegNl/AEZws3AW9MJHyswZnk4PETjR4uDs lizLRGG8IWyMpEcyKjxNQr2h1tic3pzR4OngonxUmC+3WjrSFrqjYzrSOzKWc93iEssi+6qMXrLO 0ufqG9OXkQ2j+fQA7TTEH58qEUohk9lUJAXHFJsUk2hSGB4UPYzOZNI1phDiacSSh0g+h54yxaGn THHwlCEOypo0eoHDQe/kcHjvzTRlejIJMPJOn/kb4ATdMPactlYwlpwuhXZ0XDFscBRYAzxhsKCY 8EOrlIYXFB7038ffPGRe9sb8I3vuvG7+m0u0dadX/QnzgYLcZU1XnFzM+U7MO9D+zLt9665Rql73 T3jvFy23Vk3e2LDspTnAx0dBGrYCHyehQ8oenU4IunT2YL4uJ5hfWakL28ZlhoKNulpbdWZ1sBW3 C+26luBy3dLg8sqNug3BdeEtla7QhJoJZOIE4C8ushSRoqL8Ro88jpgMHgMxGCyNstbvK2dQKucp KMpFyoXyjLEOHzc2YwKEI5yLQQbOAZjcHzFFPBGi/9Fk86mo+VQgYEmtMJ8OBil/qDSDQohYK+hH MFZRASyKYodD5YU/Myc3XMqEReUWFSJ/GGTnkkCpzKMiRa+xOxy8sXhyY3XTrzdtPTvd1HLqisie wrFFpUVF2xrnTb3jqbH5gUWTO37fQXm68pHq+sZ9VxVvJa8Gvn/50scjU6sn+k+MbyzIL1w+c8ay DE/qI32by2a6XLaaySf8E/MKi3fN33rYaZRKQetMB7zuB99YC9bvQ8XHG2yGLEPIUGPoNYh60CFi i95QD3OpFzWyoQELNB4H0IgtgsBpOE6KaJu1BHSbx0Q0eh4gBfgkLUB8rYCcii28VysbxGYRgxI8 qego8LCWngLtCwco34E4o5TQczE2iR4xInJiDpVlkTBF5RylqNh0iaxbYkJuQZVThEatFaVMfiui oJkjMBXBQGWsxFpRASp6pznGHwngKPYzg4JLLaU+C+b3v3ckVk5OHHovvjj2HH4oHsUPneLqh9aQ +2OdVJM/CxjcDrwpQLcrk7SSSwpIk6SwZZKjSaqxzJPm5C+XNkv69HRXA1WySjaX7WvMFjOISesB nmiNjaLWm+ltTsfph4a/UMbSsaeDqMHWSAeezvRPus2HvOkyYgfQfYWmQk8hke8KqCizVFCQsQGe Dl5CWTAao8YripmsfSe+QCAtPrvPQmWSworfPq2q/lfXbP74MuOsPy6v2x4qLAoHQz9c0PbQRG5b bEpgnm/TwWkz2vDbPb+cMrWpNOuNUENeSWBj8/Tl3hyPU0+G98XX8Xx+qPyJhK16VDgNnk85+qEy XjQ4DBXZpeNKyxuyq8ZVl3fgVsMM7wzfEt/6cUYXl9+QnpKS2pjOmUgYDJerMGj1+5BVBmt15pLZ YthAbIbhwBeKifII3V1hqvBUkKBPBmwdpICQ7xgPVuo0k0GQQsofmGVqsawVwJUgqCrGGUTZkkPC IWt5WRblgd1PbRfSJDmi+U5r9mj8rbevPFDbGm2JtmHH4Ykz8rVjVk/8wzCyz3noio6bp7W1/7o8 MrZ3Usst0wmZUjH2isjNj+BPPol/VFM9G1ufP4ZLrlrdpzU8Z3LHv/5TadgfnvTMjdHNRV5bXoEj 33Pv0+HC/CcBWxC/8j8EbImoWSmRsZZk4XrcRNrIJhArcGW94LCAn8E1ChyRTJJH2kI4DhHCm+Bi xFP/AyBuraBYj1kqqCez03x65xEAOfZTn4T/YWzh78mrQ/3cRf6ri0Yhcx94M5uH3+fvFr4GHzYP lWPpMMoBgTUAU7Op5FIiK0n4k0QmEMoGeqwoELKXZoZyQ6U19imZNbm1pTPs89Pmued55mR2BNoL O8bNKZ1T3iktMi6yLkrr9HfmbjBusG4p3GFNF8ljOY8ESY5DG+S59DozCdcDELwoBaekoKDWkO9D jhxvQgjuUefc6zPQr2bW3GAo8Ym3w8RTAwRzfxImHmYeNpbS4GqqfyOnrakVUYiNlIz2wusKSX5h CRcO5gfLIGpv9Xf778wRXV4/l5NuoeexTTvghIpWANsALFnhUFl5OCcnHAK0MCsGWpgLUXdH9XVS y8pSGGRymfdDXZ+742+c/Cr+0d5rNq7Ftrc+wNqrN9/wg9M/3nb1AzNnZV9ftXiaZ+aGYG903spn brplH77v+WF04ejWlyeKyh1rfvLh73+85Gi5WNlPmq/o27i0flm+dUJK1Z7Y2gWrxjtyMsf9ZPnO /ttA1lYPf8L8Qipr1yoVEp/G5/OV2ZWB8Nhp2dMC1WPb+I7UqHOWuxdvyTZZ0ksabPkNNjE9oYHC FhmETXYx19BPBQiB3qGuocrlQp+LuYIunu513UaFKyFdTLaoaIFYUds2IlpEI/KXlI61XBSZrAHr EFM21hHRGvESwfDxN7XPmx8/czi0IEubvnzKexdt0Ye7Fvywqa0dF/7nikO1LQteUcYHV0T2Plqm FK2ouuz+qZjjqo7GX+hds1WnB4HC8mfji7NCkwavOYkzqqtnxy8+fNdgqCj3wEMdG4s89oI8ez7w ywWR50KQLA3YtBf3KzK1WeeZ1wTer0poGKSpyWkUazVElrUS2QnBiA0ukrXcTohHbIIgbhXXaggX 0irUGmkVqo+KtYq2V8tpZa3I4c0CFiSTHoNp5AQ9hIAVqArNg9TVOrgPulIPh7RCQCgTpgstwhJh i6ARunWg18GtAukFFKJItDJSUQHxQAA8TRwFOxU9cuSI+iGBLAM2UdTn53wcyHQKxsLCN26Jbb3l ZZKBpa3xi/EL+L54l3BiaCN5N5YN8g1ZNvjCE8gOnSnFBsUq6O36XH0LabX3pYlWS2EogxpwG4VB RoYmPSRxRSGN5LBbC2k4odpnk5ciAdpfKWPomE051Fume6lXqcm2I+ZqA6BOJbU39UoBUnAJM+lA nAQCvFPqpzLvEq0Om8JKmGQU2jRGyk+Yg6ED1CQC8Y4q5BqJmnpon2G3A+Jzdjsg/spuR4mDtBua FSEWqTDpjZWoYQs0QPerbgGgVdUJ0D7NfICkrQRnntnDhJuFVSMAcSbz8FUB99OTqGcrBObUzXn5 rthZfPihBxtnNa6Yd/sT8f1ZecEdi7/AKHplMJjbV1ZXfN2i+MtY/P4j4fEh/Mqqx8urxgsnnDmB nQuX/7BI8vya8GWNqW5DfFZKRkZH7EfzlmenmWK/d2flQikIo7XDfxKmQrWoAK1SWgVskEWbA7tl mz3bXmavts2X2rRtxvnm+XmdXJetl2ww9dpSHA5XyEoKCnJCohYyN+A0YOo3BAsjhasKBa9db6Oc 1Y+h/NT3BFSRBi5VMheCOqsUbtnMTQfN9x1m8lshXnmpMLW8vX7STa0Pxv++qHNFz6IObHh445e3 mLZ8tXv1U3W101uqpz7bc9OFlcYVzoLUFPf8rg6c/cIhnNndtXRCw18uX9gwvelPt93zcV1j3aJF IKMUpwOAUyNkUQYVf4W1wbqM9Bh4BwAyFQC5AWGTHWkpTpBIhwJA+jgJtnMH6LBgz+dJ1EEcw9C2 zmPyBD0KRF186v8fmGVcghlYHRokU5SB4LL4GIytDXShyPDCpzqSeg/CehU+A0/euvTiq/FdeN07 GLff8fjvNm9qO7b7mWdueqt91Sry51/HD86PAFYi5R3xF3+/72xtSe7Fawoq6j6luAAe8fcAj3Ro 79NyGIlmkYACO6JkMa9YxEKYcNowlngkQZJhrcFkwKJsw0y4wKdWhQuIhHBhJlzU2WZcA0IVLiA+ Y8JFCSZceIU+OdJAgAlXZZQCBywsSNNqFhMz15K6lz7+nqEA99bQXzkTfQsn+uM9/bE/JPrfB/2X 0V0D0FfadTvtOiEaHJY4jYS4Zh11ag4Nv6m42Px160w6TARMRVz4H03gh0k98UVCT2hHDSUAiuJc AMJa8JnYWKjShSHAMED++b6YieyMbTrGPS344gv6Y6XQeSafnwgPgnxmoVeUiRosi6IxXUwx+oxh YwOeYpxpXCIu0S02rjOuG2PKDCt+7PfrObM5NaQn6SFOu0HGmeZM2ew7NBxXUihyfSsQz5BtTiD7 mySyT/4LsmmIxNToRcVPuYLW55hylBzisstWerXMRFzW07Pknmw22EtAhYxOKcwZHTDMXmnQAg2W swLRBwPO5N6MfCU8841pVJqJLHRHWbkFXEjhwc3xD3Y+EX9/6eW9+AG8og/Ld1o9Gypq9626EH8P F2Ox87n6+Goy+8rxszs7u7D/KF6C75nU8BfnZS5Pfvy5+Jn4B/HncjLwyidUPAgTGZ4/HuDCEsWD g7kjklkikiRowe8VJJnYwOs7AsNmIn7hAOMU2CZmKwArp1RbgRicqRJQsti5VmaBIGgAJqUwVm0E kVAMMwycxNnAB3id3QoIVTKASEgGfCnMCrRVgQBCFRFG0PtRgsFJ+BfJUBUCbGMlKFIZqQQGr6a2 HDJ7FFSQL7KUChOPxdKOHSN/PkbejuUKJ2KHSD3w4zpw799i/Fii+GW+ROS0XAmWDCu1km6e1sYJ ZF4ip8WSdJD7eZ/hBAgVJ0DEmSwDceYgZQK3ckRyz5WYY/A+xbI2sRIKdF+41OIP++zQLfJW7MDR o2Ta0aN38A/cccfFDuhP4fBfyOfQHztardiWQ7KOWEvtnEajC3FySorVBrz+ODkbF5KIPZNErMoy OOcdqoth7qxsJgibiatSTalYXOKgMW1ChwYAjqpjCdyitvmSP8lSShR/5PMvXy6+v0yXvzGyYKXL bYq/RDC+5sU3LfrDxoyC3Lx107gl90LPXwVrsp5x8h9KX5rciheAPybnyePlRrlH3i3/p6wxYa2c gdMIZIflClwhh3UNuEGu1S3AS3Rr0CbJDOHWLnwckrP7QeFK8n6iAy/vWi2WSAKYoKq0WpPBC9l7 BfEz4GuvBHRhiWPoAYQxxQtQ+bfwGkHVCM6ot8Tg9dV3wItqq2+i0RI1umXYorkMcBKPHNkcc/JH IODbHIs6qZ+4eo3PhzUMcLgUC+vjw7H9PwDIvXE2djm5/d64BnzEv0OWuga6Te3KBuCWgNYfJBwP FgRm7VNFlRmkgRw9/7+zIp8nrIg4MtdgMSFMC1AtRBOqVCz4DUOzjpFPhRMXaA6f+gPfQJ/0uEGZ 36rF48l4oUy7inRyq4RObR/p5fqEXq2uRW7VztNx3dw6bj1MsZZwskgQ4ZmDzitUjHnmpoOC5Wv4 OTy8NDqZw+BZanUgUZBzUgzMCNlQRlKzKNOZHmYJUsRiIcQyVAiMEgDZyYDMkoBoo9Fk9BhnGMHd ZzqDZSsEiJxgFlM0ZnpH8FH/H/xaCgVwZ5MKRrPCMIppoFYuyQvocsg4JpUMjQwg1j0Q4pfzJNoO 5EA3j6PtEFVQjKxB0TWggiATQC0bxj7hm2PxRRviSw5jI6Tgt+EUgRu6nVt2IQbAOMpNSvgbAvgi SMYBRdFrPJqQplYzU9OlWa3RbBCxCRPRg+1iSKwRZ4tX4E6xD/eKOj3mRTIPQ7IOzLoEQREviZjA gM4zzQCEmhEE4oJqklMAbueSimRErX+s1KrGgPIVqcoc4g6gmW2jMwKKfSM4CIqOECZzoFsg6CAs bUtSwKQC9yHxqHIfiIR659nJ0FblDwhV/oBQ5Y8eYl3jV4zyFqAWMJr7MWhCtiHBf8rkNauhVgXB mcpiUPPj/xabfBiXkmsPC6ELvxFOXFT4I+Drrh3+SHgHMtmpUNf5pZLJIx64prOmolQxTZ9mnYvn CrM1Hbo2Q5ulI2V2qtlOazROOhiZDWmDvMlO3CE78YVkrRPGx/rqtIPWV4cKxCnGbCA+ThqEs0qI WYS1UADCND0ZyeYyGFAz7CbmOphYgcQE7IMQjx0x9ah1IFoISgDvNBPa0wA3CivssNpVh/fbMUOK GfIn1HMoLUFCxvyuxe0LLj5wT3x43ryuzgVtWPjR/cN18aGPPonHsPT++1gj5HTH3z90KP5e15Kl PYsXY+/hg9h3+aKeZbEunIknxl+Kvx9/F0KqcjCRTF/dBrg0Qz30j0rxBNuk9CZbU/oM4xzTEpMm LYQ0Zg3RaGRnSMvJksnn8RGLXVXTvVDmHeU6nFd0DF3JHOPZpJfxKZNCOPXzRLC6ymfyRXwkTWOT mVqH5KPKayASsJIZrKCtwgoIFVZAqLcD4k9squQV3ktCTf3pc4AleEVpHMEcUdUnSyRzWY6ahaiJ LEoymuBvq508/fX7jx3DP9jxTH1L9Ldl5cVbFr746MbbIAzlTYsfmzx9egw8iqLiisd3Tl+T5XHH fh4IFi+nGIxfJZwHDGZD5fklpY7ij3fy6RR/dqcjfYGu3dBuWQDom5s2N32d19ziWeJZn76uiM/O 9oU5XX4oQ5QZDu0kCCjMSBFR6docYIqa5M+xu5EsQn7XnYQiECoUgTir5FEouteWmkqxqdRTGinl Cr8NwgT8ShifTgP4oL5C1V2J+XTgFKR0qeWAfGfFaZqKov5CFKs5J7r9dvgKEDUTjVpsKeVGA/N8 5fpJT7whO4vs34Zm+/yuDwb57mvzVzvdX4yGafxWk+G5AZ77FkS7KHTjX8Z3N625Ok3L3fdPgFVj 2zsSeL2ozJZwOi6CAn5Feq2p3lafPg+3mtptq/Ay0qldorsar9dZqNNhRmaNK0SY9aJbsUWBojMR nCHmFlNYKz7OYocoD/zj80o6RbJhDBVeA9OQBlYVMRjMXrCnDMnMbqVxMtWcnA39TxwUNdsijAJw SQwCqEAUklYjEK5UMcyyL6AlqFfiBJ8EPBLqAl/KtiRyK0k4C3fEh+PG+GfH8AM7D9TPnP/gnq6i UGDDjM+OL7xhXFGAzIj1Cyf8RaV3XfXA2+X4IWVxZnpq7Le+ooKV1FrtgKwJgaisGJQHCiYMSlHS sowFQrmF6lAnk99UtnWwrV1P99tYcgF8Aw/yuyWbJ1/Kc2Z5soIVUpl5fErYU1bQKNWaG1JqPY25 NQVtAN8WT0vRFWlL3Us8SwOdwS2OXk+vd13BuqIdVr+sGM3lEt2AO2Jx5fHpos+XHWIpWMjQ+PLs LqZsXVQYYLYgz2qxI5+LVkBU1Q3EWcXEQph1JaaS3hIiLx+XLDQmakCJApAayKVW0FS3vc0yN6/H cnneJsuGvOssO/Jut9yZp422swItnSD6ShaJsmgRkh+pOkK4p6a6afCXdSnL7XAIZGbDjLdueyA+ vN24Gud9/9CrXYub9i069hyu/Poe8OONLfG/3Hzf852blC9mPfIT/Njcxycq9ZUTzy9cunvt4oUu m8tW8OuHnv2ysvDz+o5re6LLxxjz7IUDdNbgxZ8B2dCgtUoa5sMiVBBNskduljk0H0MiFsqBNrDH 3yhayiV+fjOkWCmYdXTOBIk6arTNzB0QXzFzx/bQ84EYhj3gjKlZwED0XCAWOEnVrBoCUTxCaeRM 7ItjsS+gJ74LHwg+WCCJ0QBY6XzoWTr6jeL2W/3OSdwkeRo3Tb4q5apUaYyBs8NEum2eUbHp+WRI +rliYb4L8wkTNQyaPU2nfUIwEvBcVP9lAySoPJCg4kw2/aHhP6rD0rNyPLQToa2e3Qfa37DRAaEa KiCgRgM3owSzLPorvjM/BZJIFWalGljR/BSthOWEwe9OLtqA3CY0hfy6mdN/e90Nr9XNrDvmyy28 ffkVtxXl+o6R1gf/OmPa1Mb6WZ8+xm0Z2rLphoopVVOqKm5dye0GXiUz7CK6QVlah+tBTfGCRpwr 7oDSrQ24KWj4ufwOnuNtHOEkXMMKW2vxViIigaznIK1PpFrUSFf6cjwkViYksuYiuhJqXRj+dVyA C3Mt3BJuCydy3RqaNafhELhgdDapLaAOCcuU0w0NgsDNheAHcuSxj+PnYx+/id/Ab0B8EYT3x0IG 9PtqiDIkmGMZtStlkIASpRQpRyqTpkqt0lJpgyRJ+yEM1Gg4wCX4mDS3JnHgWvBEXssyU8u0TCSh EzQoS8SvzCJRrXc66tx5BKJsWn2zg8stXdzA3Tx0Mz9raCnXf4hf1r//4i1gi3ugqpzOb0Q5kKFf prTrtbw/TWv38wFwesWWQrYtYtt248yMBYXLjJ3pq4q2aDfbetO3FGqJlDep2KJYiMXilZrH4DFj nBEvP26KBLGqCUrNltwwC4Qg1lETpYxgnjJVig76JcSF0nWQUQSZQswXpHooAWJWbk+EPtTrYTop saoGcMw6BqefU+yyDG014XIzJPc94UiYA8V7nnlVTANDqCW2jJXoV45162jwVU6/E9wPkGOdRMVD xxJYOqYUdcwX1YGqFFsoDVsmPLrto7L94JxSx5w6CIkXlKmodx4oSWT22FoMNdXFSsFwCKyRP5zI doPWgwxDVvl3rr3gLOwsKFvR8l76s2ktecHNs25/feWSpTjj4aKCvN5JjQe7tOWvLdmwT4lUPdv6 Wc3M7nVXLX74Ksska6rn+F199xQVeaV0ZY4z1Zyb/ZwpKzc49pYV8XRcLthSUrtaOrumAwYOAwb2 gqikIC+2KvkhEjZNtBd7a0itqcmueOdaL7f2SVvG6I2ymFpl4fU4QxG1OslG55TyhRKgAcCMuanl SGZjziY1ElRymO6BJRgwxVBNB4UJk5W8HIivlXyml/bCgp9IJjG6ZaZ1wFmAK6hvC/lEoGHrAnXz PovXgPhYzb6NqKgzbLLhwDeKjl6pF+mV0D7L+gnEl5CZgj27YEFRYr5AJbPZGnGE6ZRST5g5wyDX yVINaC0NzaHRgr1VrcRqLOqas73N1XWPL+3YU6vvH2weWHXsTy9ce+usn9TPWNtw95Ok/IYPpzU3 F0FxxBZ7c8rs+GvxU8d/Vzc+ti1rDKSKMFo2/Gfua/4qWLn5lDLN5G/2kwDONBY4spwTcNg4wRF2 NuBmbY2x2THF2Y5bjMvwEuNmvNaYYjbbInre53NFONnkZ1kHP1tyNbJs4f0ko99XxjL+3uhPZahO dcsM7zJIAzCYSYDMnAKZsQyihfOMU/L2zCSnTrPCDfBqdNkGfF+o2yQ0Oo24kgsbaJVaLTuUl3Jf L3ysY9Mr9Q0zcNHfOw9P17Y+Pff+w089XLEhmF9v104tKqmrr//jrdiKx5flnqiu/8Nrr7yd4bQH LYDNFYDN6gQ2iZJd6SoeM97b7KoaU+9tE3vEXrNsxcQiOKcYeSxlVAlai+3f6Bq2Qo+4MhVmHSlG /EzlMDOOzKNsZgHDKbP5gM0zShFVHAj8oRENc4uK08RCRrZyxu2WnFSRQCo5rgTo3SSGYYnlcIDP wGiJLe2itNgiwQTAdvsoJALwRmVYIIvLgEmNJ/VpKyBbpSoOfyaxUK3B1tJYSjkLTZUnGM5XD87s v/z4X2bW1jzV1baraXBw2sa6e/t33Tbj4fVTL8MhbNnz/mXTZmTn4pMXhsn3Ml1/fOVXv6ujke3y 4VN8J78V1hR70HElN4cPGIr5iYbKjGq+ydCUMc8ww7Hc0Jm60bA5w4grPR7TmEl2HtTop+oKLJ1O EzGBkPqYvvcxIKZRLgPfSUuaC0HFlkn/OaWGYfEmiGo9ENdyHqiwwCG6EAtWXbmtjI1WxjYrw6eV sc3KjlthtZzYYt0+EsQCk9QglmpimsWlazJYDMBSub4RH6PUDkD1qnkBq52VF0QN3zn08uSy0E2t a/48TttxbGX88/hxHDj38d+exrfedvt+PXFffue44uL5ha/mlUHgZAeMVsXPf13wgwcHrgXZrYEF yVYxA3j2K+VyF0OWiwVNkq3Ctl6ANTN8xI50xsmSRTDA0m5FJrJJNsLDaAwboKRg4DomcpQGE4Pp 8HQukwUZFYO53OigGDV6KZ6M7BrjiHYzgkzDXopQWJUCq0+tVNtB+yLlOV2NSu9lvC4tKcHAIDBL EDMxApwGVouJlMLiUtVtiIJtYsuSRLtdrUPBukAwUFSsOavW052zaSWeHd8/2Nd37NnIkgJhoZxy xQ059w5N4Z67N/tXb+klKrHxdr4acOSHaCioFE1KmVxQUjihuEZuSplWUFXYVDwfR4V5juV4hbDc sVXo9VoyBavPnqdk8JCWU2stlFDcdFCQ8Vc4w9gpdo1JxKIvq4Qx2UptB/XPGUGZSAlFRYgLiU6Q 22+Umf8N+Xb9q2yXeEoiJSTAoBdgsxJwO1l1DPJdcSWbzoWTKUsIcuGrnWwVL6VFRsN2+7hkWoVa E7pAKPn6tnvA6mABBlcm3tlQ7gI7M2p5JvgJ3xJ30KbfFvd4PH6u/bFZ2rHHuzuv9vszWu7aCNI/ dcozC7quaQB71PQ95a6Ba++c9eO++Mn4N2mpR6zhsfm5V9YsrakGD1Wz98S0uubcvOKh35OuzPTX jg2+EAFcw7NOfAdoXQcuVVI4u8O+3g6rlKWqFN6IsUH6Tg1LU6xsLbAaDYBXR0MjNgU0NWNhaW1+ lJql/hzLgFGuqh5CJuUnXPch+BDMQ7ighOhdEQN0Ini52elxdjqJ+VsyxHyEhAy5ICeh+ghAJBZg G5jwQFv1EYBQ4xkgIJ6j32Zgt4D2X5mzQAlmAg27UkcJEBMeWgtJTih8Us0DLkMlU9NMSVtGFvNB jKe6DA473zFodaYtbJr+k+mDg22Di5/6Jdk6fWdOQf60iUO/BOfg1YZZ74BHQNA+cAuugedV6LMO DykpuIYAe8oJJwqC1Cdj+Rbg0JBSyHjVybOBQcoKOMczTUJpWOrqgqcEAKm4s49FrSpDICZNMCRR M0gyBA6oDAGCTgsrBA2zuE7YJY0MN3pS9ZdOBk7RyCfCVgph0BIcjBNf8+ab+sFBwXn0QjY82gY4 eh5wtA9wpEMXlJo88p/4XZmTMSx6xunEYyjCQUMxZNDn6JaRzZg+FIFdrN51gNW7aLFL0EAIJekg O9VLF7HCwM8peQwbyOCFiheRODZ+jo2f42nHKQ1bF4xkZNAJT3Fk0CNjVeEAp7JwF0bNbgHtvzMU UIKhQLhupJgJk51AAS0jwdJHNREPa9JoFMgKYn9TC2IxVg2DpPxIMYzfdz6ubB4cJJ7TsX/gz9bF rxdtQy4SjA0Bt54Fll0F3OLQfyi5UFyU6MzdgtgAEz4dwyilQSZcfbBILDlGIBITi9n50FaHBkTC G8ZsaNA+f5CyCe/iL00rGxCbUhgCexDkqsFB6IqqCzSpoM8D+LjSxGVx+SlZKfk13pqcpws0B7Nx tid9jJRalZfJpwvYPEZSirCnqLhIKZpR1Fsk/PvOF1EVn0oRWsR8BeykqgIzbwz6+DmLIoA4p1hY IqaYAhyzJWCw9yumIIA4qwTYYJhbgLvM2boxJsYAcNfgAhNjGKVhtZjLzHhBv8fMvgfar6uBpjmH nm1mPh/sPc9uzwh6dyAuMjgAMaz4qFk1e1zsa2BRPlzoYl9DabHF5RqTnBQgElmUMexkaKvAA0Kd HUqo6meMln4TtGmQqxIKLMwGqstjVszbzJw5CAmk5EtFoDnZVBEJqYARu0OPMMUEdaFIJegmWH8O YSh7FgAmeERBwRJ/0FEjTaqv7KpnybZ2TeqgwZ7aOrP53maOV8npd1EFtm/xmvty1wxecWgf2Vq/ Iy9Q2DwpdVJGLEy2Nm7PCwSoUuOjWxtmdbZ0tnwAJdWEVQEkOXD+P1sVWGn2P7IqqaOsCswBGI+k CYmzWJDaEjrD/2RCYIaVPMpvdMmY0HlMmBQ2m99pTBgqwTRcsiJqpDliXv63xuT/ZkvUufmvbQlj O5gS6tN/xK8Gjuug3ndBcU00hswh20RHk7HGXGNrckimiMzbI5wWImO1QgqEWiEF4ivVjdS705iA UqOTjOhB1TDDDk4Ps9fvMHmBM+gKDOCqinNGXFAmURSjvWmmNE9aJG1VGm8FRQQeG5McugV/3i06 6EyK6uMVzPUSmdcPi8ziShqdQPqMGGxZcYYeA3q7c0SDMayPMsuUjzRygiAAcnGjCi8ja6hpSmV1 /NO/nI5/hlNP/wU7X3j89jsfe/yO235KxkJF5UVciS3wNyl+NP7l22+88fbrb/8BOHo43s3vBY7S XEmmkl1CKuwl3mrSYK/ytkKe5Gpp6xhtMk8iQJ5E1ukTeRJIjwBbmEVN5EkYdg8Nv5Z0ks6q6YxE vZkqOZY2+S6ufvNfJkxA2fz3EiaqNoK5VvFMCVUb/bcyJwkzeKmGyDTOv8mdjCiWf86dXFZXtb97 7o0Ng4NNzy5/5aMXdt808+EmSJ3c008qd310WePMnLx4ofCP9ZGW+O/iX7xyfGpFbGeW601Vn3Br wNGwwqpNGzKYwSMAbwCemeWrtSZBpitJRtYEJ8p+CNkUW6+N6DVMIWsYBjXMbaI0xBsuyH2obgMQ CZOayEYltTccOKNY6NzIsPwROM1UN82ZMNUNxD/U5MmulEv4HO0z0PwSqGO6Ao7ml9SQi/kICdXL rdEWNJfNfRDC996fto8rLOT2auXpk4b+zEd/PK9JgPXcsOBn+E/cHyBzW4pnK3NFIrvtJM2dIxdk lciVWVXytKyFQtQx29canFOySljh6PR2B5eU2DYLfZZ13k156wK78S7DdtfOvB/gH7l1yOjM5zO4 bZkAagrLzMycyWo8prDkEIRhkznZB8HlBWpwSUs+4xzdii357jDTEE4WszshCoOgiOlQCJi+eYqe 4oQrVcVCCaozITJ1I59TA5P0eVKtjIQLcAZT5raEfhlRKyqH4ZrzSi5TK3sSud6OcF9Y0DAlomEp Ww1YY5jOHSGWnL2UoqU2EpSDWpKhWmIkZQDOHHsSg07JP60BC4dyac2Cli1GEi/qAzyQdkl1pDrg P9XB/SH27tbfTdW2v9O99YacnBV53wvfuqViwvifX9H9ao22/reLL98TKFgY+l7gmro6XHXnixP9 b1Q3z2itysx0yk5j7u1X1m4uDpaP878cbmi+rNbvd+id2oyGRpjrycOfk5hwLzzpPaBU6QUXLKvn dGbNZINOK7jdqZAAbE7vSydGdEO6ZDAzaENSCqbBzHw+SoPL4tJK8MCzuRyi6/cVC1XgGpZYSMhC Et5wOAFvzRgKbw27B+z9q2oQNKmU85pdY0aBG/IKqkcShIc0weEAcEdKIbFAy+NqgjAMq/3gSTe2 vvVSTobEwv8x7qcDfX2D+Nr4VsnpmN48ttsBT6tZD/2azLoXT4k/d2+ca1scyMt2yxT1T4JFmwsy D4vSFZtOTNNs1nBEsMuCBXJ/WPru5N83zCrRqJWpXxaanlHSmQmTWEQ62ncAV5IZNeqCqrZMKWVW TQ1CmVOGblGD0H8fg0IeUF2gCETCCUwkBJN8hgOqhgfir6ralZjU0DbTJED8jWkSaefoGJT5CKNs XUK1MMULaz5ZBMryBt8usllK+bmDHU8s639x0Oxyt85q+HnT4NamGX94DdZfXtuyKVCYN20iVwU8 hgVYfB/wWEQ3KlNy+HyxjK8Qp/INopgvVAiKMFPohOdRXHAm74KSWh7K5cajcq4R1XHr8WYiJcpq AvzsBKYLqmGVuGwu18OvFCyH30vh0Y20rMZxKVBPW8/x3BiqcLjvQ1WNLvQ5F1VXNo2uqkFNDVGZ hBVkUFLj++KVv4hHfoPnYUDCxYf46NBObhP0Bn4pCroahd9O+OowkoC5VIfAMqSvLq20AaeB6p+d VB4MXDpXiAtIPpfN5whZUkAXwhMFKA8Kc3Eb3y7M1a0ki/huabncrb1Ctwn/B1nDr5O2yGu1m3UZ ejp8jUsURCSbIavHsp6w1UIIKelgmQOsjwcG0EdIg/BzFS5m6yHIAEDtMZqNEeMqI4egLx8y3QeE WnkHAtYEMkeHraAQr0kswQMjC0UmGnPDojogWKQZA8bQx3IgNgtQ5lD+pACLUsSy+HtPxD+Kf/Lz +DsvvopT78IZL1BWcdEhyq77uC76pvJUCXO9DXimgyfEb5B1bmzjbBq3nMvlairRRBziQnxIDGkm ypO00+DXRGq4Gr5GrNE0ydO1sM6Omye0aObJLbpVuJNbJnRqVslLdX4TQVKEFEvNRJH+g/QCqF1a nZYxiwX4nIsXeFhZr5Nkkd/Mr6esgnVxkN8jBgxM0/E8jfSPKLBQvVyETt5IHyegj0orhg4DrPCD J6KYpue/T4PyaAkrxgZKYImO+rgtfZyJMeg0fQqR/VP8QCBOmQQQKsX8ttPg2D3/Lj4Qn3EaT8SV f4w34J/HZ5MiUhyfhx+JvUO5Mwm8PSoJGqgtT+HZasMZYqfYK4oypxHSuFRhKm7g2tBcvAl+oUFD MSG4oNLcgKby8LsehBeInvRAmA5PFtDFX+qQqCQ0MlkQ0I2QD4aycwpfyy/h1wNfvi+Z4WcnoLhM VxxFwTgl8gq0ugz/UFmGocCPRKiSEFv38mvx6t/guXgeH72gwa/zuUMvcjCp8DwQ5KY/gb7LqFWZ YJcmwCr3Rq5WWsDNkTqlPq5X0kJteTKAlEiTR9WW9+g8uoiuQ7dK16cTyLWsxnzyu2rM9IH7RHGZ +2RoM7k+dg13eWwNue96LnzPjiGI+Ggui72Gp8EvL33XKwI7OfY7J/SXTb7rd03oL5nkoH/93ZLR v1qS/M0S+jtPtWgqqkP1qAE43ISmoctQM5qBZqJZaDZqAQ0xF7Whdijwz4ffgwIOAZ+s8KYvEfqB GudOb5gzNdC6ZE1315Vd/wf6pOAyCmVuZHN0cmVhbQplbmRvYmoKMzIgMCBvYmoKMTM3MjIKZW5k b2JqCjEwIDAgb2JqCjw8IC9UeXBlIC9Gb250IC9TdWJ0eXBlIC9UcnVlVHlwZSAvQmFzZUZvbnQg L09CQ1lLVStDYW1icmlhIC9Gb250RGVzY3JpcHRvcgozMyAwIFIgL1RvVW5pY29kZSAzNCAwIFIg L0ZpcnN0Q2hhciAzMyAvTGFzdENoYXIgMzMgL1dpZHRocyBbIDIyMCBdID4+CmVuZG9iagozNCAw IG9iago8PCAvTGVuZ3RoIDM1IDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAFd kM9qxCAQxu8+xRy3h0WTWyEIZctCDv1D0z6A0UlWaFQm5pC372jDFnrwA7+Z3/g58tI/98FnkO8U 7YAZJh8c4Ro3sggjzj6IpgXnbT5u1bOLSUIyPOxrxqUPU4SuEwDyg5E10w6nJxdHfCjeGzkkH2Y4 fV2G6gxbSt+4YMighNbgcOJxLya9mgVBVvTcO677vJ+Z+uv43BMCJ2Ki+Y1ko8M1GYtkwoyiU0p3 16sWGNy/0gGMk70ZEl3baG5Wj8DiWFrFYlQlj54yo/z1ns1uRByrLqQmLkl8wPvOUkzl5Xp+ANXu cWUKZW5kc3RyZWFtCmVuZG9iagozNSAwIG9iagoyMzMKZW5kb2JqCjMzIDAgb2JqCjw8IC9UeXBl IC9Gb250RGVzY3JpcHRvciAvRm9udE5hbWUgL09CQ1lLVStDYW1icmlhIC9GbGFncyA0IC9Gb250 QkJveCBbLTE0NzUgLTI0NjMgMjg2NyAzMTE3XQovSXRhbGljQW5nbGUgMCAvQXNjZW50IDk1MCAv RGVzY2VudCAtMjIyIC9DYXBIZWlnaHQgNjY3IC9TdGVtViAwIC9YSGVpZ2h0CjQ2NyAvQXZnV2lk dGggNjE1IC9NYXhXaWR0aCAyOTE5IC9Gb250RmlsZTIgMzYgMCBSID4+CmVuZG9iagozNiAwIG9i ago8PCAvTGVuZ3RoIDM3IDAgUiAvTGVuZ3RoMSAxMDQwNCAvRmlsdGVyIC9GbGF0ZURlY29kZSA+ PgpzdHJlYW0KeAHtWnt8VNW1XvucmbxmkkwCeQ6PMx4mPE4gTyADA5k8JUQwCUFnEi0TcqIBBRGC 9YXEagQngI/WKo9q2qv13rb3x0mwNVgf0SpFL/HZWrWtBsHWH0KJVqvxCrnf3nNOeFTvvX/c2796 ON9aa6+19mutvfeZc0LH+o1t5KBOkim/dU3LOhLX1A6w7NbrOpRoOfV6orgHr1h35Zpo2Z1J5Gy8 8uobroiWpz4Afry9rUWPlukr8DntUETLrBh8SvuaDrTDr6lXg8RdfU2raZ96N8oxa1quN/unP6Cs rG1Z0waOa9rtIMq69W2mnQWJUibTXCohH82j+eSnBbRQuI6RJCKGgkQDNJPupxhILsojjDi+GXVl WLnd/kVDrr3HWJHs/4zccaL2/j89sIALBxdM2PJp8fHa9I8zT6IYjxaiF+rF7jrtI8po+rT41MPp H4uWTKNg0n5S2OnH4jPZYqWffWkJI5bwhSV8bgl/s4RhSzhpCX+xhBOWcNwSPrKEP1nCB5Zw1BKO WML7lnDYEoYs4Q1LeN0SXrOEVyzhZUsYtIRDltBjCXdZwg5LiFjCVkvYYgl3WEKzJTRZQsgSgpbQ aAl1lnCRJdRawmJLmGMJ+ZaQZwkzLSHXEuItIdYS7IFRkblPBf1E0I8FHRb0pKAnBD0u6DFBPxD0 qKBHBD0s6LuCviPoW4K+IeigoIcEfUnQFwU9KOgBQZ8X9DlBBwR9RtCnBN0naK+gewV9RNCHBe0R dIeg2wXdJmi3oBFB7xS0S9DbBb0NNLBwsdIpSpsFvUXQTYKuFLRe0DpBFwlaLmgSp8llrbYymgzk AaXAxcAK4BpgM3AX8BCwF3gGeAVIpBXyMWylTvlTuhvoAQxgAHgVGAKGgTi0WoRWi9BqEVotQqtF aLUIrRah1SK0WoRWiygBYyiGdzG8i+FdDO9ieBfDu5hi0atK7wEnAZmSQScDpcAK4CGbGlDtw+8z 49TAKWng1Kunhk4Nn7JFmTww+uro0OjwqG1dWYLNi2EPgL4KDAHDNm/AaRt6evhpSZDkshSbBw17 +CkkBeGdDDoESOg2gZdtcY+x5ByWXOa2xYpyDOhmKUP47qHJ0h7KA0qBi4EVQAy9B3oSGJX2BJbJ 7w2lZ0z4zW9Bbro53X3TzVmvvQ75um+DrFkHcvU1IFetTXdftXbz+uyOjePTJly5GuSKVSBt7ePd be1d12ZnbUi/sSLLcwOQVVYg3Us7AYkmgOZySdop7ZJ2k1PaLu2Q7gKPSN3SNnKSW9pJ3QCmBPoQ 8Evg94BNegQ+j1Ki9BDq/hB8D+o+SImjH0o7+sarvv0QdnGhLFv6jrQJKdakW6WbyQ5+i3Qj2cA3 mfxG6VKh/7Z0peBXSpf22TWlX1rX51Z8T0nrYef+a6G3cf2l+wqKfPFlZdK1lAX8BHYo4bMKpXcg fQjI0u3SDYioJnWC8/qbwfk4bjL5DdIlwn69xJ96mnQdOLdvNPkGk19h+nWAc78NJr9GuqQvVpte Vocyozs4lS6XviWtQAjrpQZpGfhS6WKpDqF0SEuBekqQLqf5kEOQrwM2orwb5Z+Dvw2eIK1CjasQ 0Fa01AYeRksrwVeRX2oFwsDlQD2wFKiU/CJqFVIKEqVJAbO8EGU+6wVSCqJWXZYGPaNq0AOAJM2H PRZ2HziP0lzT3wP/WB7lor5x6b6ydCnPNMwy+UxwnsZcs6yZfAYq2rULy8pRZmQHfQSQMN0iqgV0 lDoAm1QuuUTXZeC8pVJwPvR5pr7E5HNMPtvkismLwXm9ApPnm/rpJp8muTCFSNlalBllg+6XCjHl DClTykJSHJJTSgSPk+KlBJGcOCTHgeBnYLRxSI4DyXEgORlIThySk4HkxMGuooYXyZiIliaDZ6Ol CeAqEjERyAYyAAcQR362jC3hM2NLTX4Ju4wnhS03+aXg3P4O+w3ONo29ZfIP2BCfITts8iH2kSif BOf+x9lHiHWgHyw+AZttgNn6CgpMAZumf3TgsV9PVnzwkPtyc31PMJn/OuqbfIG6n4v7BiZNUi3l xImWcsKEMaXbbSnHZ5tSp2OcKQXiEyBJjO0L1HVDYmiRS2UJUBJdTJO5inOMjPrqlouR0T5V5SOi xydO8gU+dLvFMP88xeu7pJ/FBcaxP75l1+a/WfumFDAcib5nB+wa5hGY+9C4cb7Anrx8355dTNu9 y67tusem/dtOm7bzXlkLvJBb4Lv3Hlnbes8D90jxrZmtv26VldbEZDQ+/NiFk72+/+hnCYEJ7IH7 mDb3Qfb9+yQt8/6cGb6M+5nrvtKA7+372JNsDsvF80Jj+X2DNq2f5fUd4mxm36AMlsuVT7KL2GLh s7hvs13bz5pZI/ZVclkWa8R0G0lid7CtIjlbwHmS7zT5VnaXqLgDnOvv2tdl10rLnKyHGHuZHRLG 18GxDdlr7FBfDM9sbF9hoY+zvRjD6MC+dyeJtAZS/pCZ7XvxJVl76aBNCxz0XMCjuO9gWobgBxBN Xj6Qns15QH1mZoGvrh5xqke8P8C0jh5B4ciMGb7BQ1hBh8orhf+hqVM5f/xQRrbvuWMMs47ve0d0 HCg65vX63jvGAs+7J/r29dq1XiQmMLBggW9gr017Y69d27sJx/U7qem+F55iyg7m2sH4ELrnlIim u6dqYiiF3Wh723a7tj1i0+6M2LUI4vjpSVn75KRd+7hT0oZ7bNpJhCZwvLDYFziO3ngzPfUNUV51 YZSX+EVzjh4k/r0e1oOa3O97WP/ggd90Ij63bmbaLRjVJnRxAnhrM9vc5Z28tYtpW4Db0cttwPQu X1dNl3xFF6vuYnO6WE4Xc89Ny5yTljY7LbU4LbkozVmYFl+QFpOfJuel0ay0kS+TlZH8ESlnatK0 qckztKRcLfkCNWmKmjxpcpIyOZnsLrvkX5Dk8Hf4d/rlZFeKMz7B4YyJjXPKNrsTDwhnjKxPXjeD Jc9gjuTaZJwU86lS7pB/Sr9PjnGQQ3Ykz6f58SG5Of46eTftjt+Z/DY59zMHcwZmJLvZxMTM2OzE NFdGYqptfGLeyDUjD430jLwy8upITOlIYGTviDEyNGKnfuboyxvJe4I5qJQ5ArNs/+kf8X/u/8yf 65/hn+bP8U/xX+BX/JP8bn+mP82f6k/2x/tj/LKf/HVFjcxIraXaxnJjHANfVm4UabX9stJgFGq1 Rnxdc7CXsR0haA1pK/Zzo2Hb2i+BpVY0NQf7WRY3d7n3Y3mTURvu2h7StImGXrssaHRODBmFXLh7 YohqjcJ6w62Wa193bejYKNTgGzqiDhu0DVGhd1pOlTGjqsXIrQpXapZW2NgGXFF/s5Zm8WhdQdGm VRoTLMUZbpo4Y0JLHbyxDt5hx9mtbvi6PlCDzrR1Tkm0aM3K9CFrwtGyaT3TwjfUOacHFEQ9xqmR aZQid+c79MbzJNY1lBtSxWW1ht5Qa0yqaw4b2Wp5rXEQpTl1zYZTLcd4eChxgXds2AjCITS9JFU0 9kqcxIA0NwfLWtlp0tmXwAjwBfA58DdgGDgJ/AU4ARwHPgL+BHwAHAWOAO8Dh4Eh4A3gdeA14BXg ZWAQOAT0AHcBO4AIsBXYAtwBNANNQAgIAo1AHXARUAssBuYA+UAeMBPIBeKBWMAeWKV/qn+if6wP 6yf1E/px/Zj+gX5UP6If1t/V39Hf0t/QB/VD+kv6i/pB/YD+vP6cPqA/oz+l79N79b36I/rDeo++ Q9+ub9O79Yh+p96l367fpnfqm/Vb9E36Sr1er9MX6eV6kn5+Yv5/yth6/4iL7NvxA4bsy/FNRhNf TMiWAdm85CejMl6vfkA0OmzpTzeckVG7lxLlBZTIW5HSRoelIXKN9pztYdU7w2X4REv8Ww+HjRfL aRNnuFqjDDz6rYn/hv/m67lvNn2j5WV6kX5Jtwn7k7SPfmZ6/ox+Tl30HD1J0a9kIfwgup16QBuh aaIaWk7folXwvpYepkfMWispTAX4R/j+lUARU/sSfUi/YF/Bb7epOcO+i17WUz962k2L0d5Cugez /R79lB6iWroDpTPXm0IcklpoNW2gR8lAXZ3ahXYJ3UqL6DKMrZouwZjWovcm2kuPURv10k7on6QG ejDmaYqTOnimRv8qzRv9K3Wj9velDrzf7ZA7qYNupgfpXcIrP911+rn/PntnBvaN0t30AGZxO+1A TpvkBXKdHB7L7TdWMg2PI17PIjbXIys/Rl4epLuZl3bRFtrEnPQDepIVnhOd/6m9r7M/TtvQ9rnX r2g/4vYI8rsDEduAvPwrRl93rhM+Z05jCVg3q6mJJdGXtOJ8+/9JeR3WwvVYcd9BP+sx8yC+mBbQ RvB2YKPVB34CL6StyPq/4FA8Cn053UJrmYfl0wHayjLpRvj/ANrv0RMsH74b6DE2jUawq5oxy7+7 cB5gX4rzALY4Yun0Mt+b8pfcVT5mnQe8xNcIm0IHic6cB0xliVhvj9NP0P+PaDdzM5k+o8N0muWx CcjcdHoNOIC4PUHPIn7H4ZFJv+PvHedf548FNbrtbeKcgOvfjwWrffvZY8G+eJT2YH9twhp6DHv9 WbqXfgG+DaUe7KD76d+xBn6MtdSJsY5d9iYqQgyu5FTEIIl+ZZ5PKMsDXD/62uggt0Ypl07vGJN/ i938e+znOpwV/7z+GYF/YASk2K+O2N+TauzJdjb6ke0nsbbTzewzDOAR7Pjvgt6Ef1d+/YDkU/KH 9r2jf7E/cbrcnmKfcvra0zfjWfY7epteoRfoCL1Bv6WX6M9yvvyCfFj+xBa2xdgH7T+in9tm0bfp ++e3altra7fV2x62Ndlm2adiB02gJThXL8WzKkwr6Sqca2S/O7bAdq/9ErsufyJ/aed/v7oa594d OJu+i5OMAk1t+opvXX5Zc1MouLyxYclFtYtrFl1YXVlRXhYoXbjAP3+er2TunNnFRYUF+XmzZuZq M6ZPm5rjnaJe4FEmT5o4wZ2dlZmRnjZ+XGqKKzkp0elIiI+LjbHbZHzwyGWZRmZFsGq1kVURxm/n StWlGM6lw0vyDEp1e9QUpSgvNNP0MuyaQeNqjfF1wV4KlISMGO18l6WG7HV94kHlJW6lyrB5cauL W3RjWkPQo7redI/ZQ2jWyK4IejxuQ/LiroEJ9+IWRTdcddDDIDQ1BtUFOfpH3y+Bkko8IdCGoDHJ KoZ4a9GpnDXI/TibBs4b5lIWcfU6syoqDRrfS873DUrjbsMl+D3hN6bhtdDrgiRaozyDjf/EYOMM lrYEUzq3C15tqORrYlClr1ar9FWIqB4+E9PhaEQ9SkSJNARTitwejxg03lzqg72OhAq1oi0Bs8Cr JRTUm+CAxsEVSMu6XuZcyIQgOavm9UoUl4jwpfLhVnGsNgLdYQhqJeIGy7gzFnxZ2Ha2iVAt6kRw ExITfRoxFUZsdBDKKiPQYlC30ps7ENnW76KVYc2pq3rLZUFDbsGgekn2VrU3GhNq65qgwiCAcLvC 010pCE+eUtWuRFDmvmFQtRJVz9Xr7W1hvkxYWK2ELb4iuMUz4MbreHBLlZGiGYmonnjjUbccqcpc pfBiJLJFMXrqg2dbPdwHiyBzZq4SqVLRGxqrWl3OM5Y3ljaxGmt0kZxAd4tidK5cjZjhbtlmrX9P xGU4/+ZBdpAf1OS7gweYQw+v5lNZjZo2MCXS3Samuk1MDetVqVpdycErYvXTctRuCla1q1WIp9kh AoL6svf8uh6PkaXxipFIFR9ii47R88jgzsIbMYYRLWBPuDWG8VQYgUbBqFHkAD0GWipDpsp0gMWG PBiBcGUoxCcVTYAR691in6UqEd5orNcYr7k8z8M2MDO3tiFYVclXJzyliuCCE5nuE5Br68bULBM+ kbwTPEjcskytrY+ugnYeH07CjdENjKiZmYer6S9aHcx0D0Z7uCxYrVaHI5FqVamOhCMt/aOdK1XF pUZ6nc7IuqqwIrY/g/6JbrdRvS1kuMLtbJ7IEO8ek5O91Xj7H1ffzFNVrbS3QIO7VPWUuD0pYz44 Rb7ebO45rH7sAb7nIq7jmL0Tp5NbqeZHDb7IlrgNVwnfshjQ8iD2RCu6qNIFwV7BhyHJzXeNHPJW rVpmBsvtQZdi8fAzsN7UohGPh++n7v4ArUTB6KwPRssKrXT3USBPQx7D3DJgWdKWc0unZRmrHlaR t0z+YUqsj29a3zjbx9Z2JEVNVXz8YMfocNfoxkAj5vhFiRGHiInUj6sIym6Ju0CS3DKXEjQ8HvxG hiYq8pjgxIy4VOVV1XBphr0iOOD2hxRXCg5LBp9FcOQr1fWq+iLj5yiNdxnMb7B0riecq4gezv2M EhjHFpJSFQmbC/DsacGVe+vtY1spOnjsXT43zN6lYuu6o2FISVX5DA/xBW89GLzVfF8hJSJQi0NG En/eGUnHBcF43RVBBScRdm69EJQqpZ0n21DCleJICLm53VL3jw6FK/kRGMQahIvbXOJY6NHQnrsU Z+b+bxd6Jxb6rdtC7fMwpsAMzECZjW550Csag+Z2E3kSmwB91fCpnGsfi6Llg4MN29lj5Ge/mImF mp0pdnV07445IwmNmM1YAs7uTNis5cFHYlTj+R89A8TIjAtFWcydmxedZ66xzDg+NrlvhB8eZOW9 Ktta3xtgW5c1BffjxUvZ2hjsk5hUES4P9U6BLbhfwY8gocV3u3A5V3IXhReolqG1PvxBjPu79weI OoXVJhSi3IoPvUIXdYKOUSu++gqdy/KToLNFdQGhw/MEQ6zKbMfxFlSRdN0I1AVvDrVHwiEebEqP LkCsbHUhGZK6sJdJMU4jQW0rNxxqOdeXcn1pVB/D9bFqOZY/NofSj60eCavY/jiAg+RmIb6E+SqX vEr/6ChO0EGcvB4jxnsZgAM2Xgspht27GH4XcoShvtDobG3h4+DLFHVjvTWtISNurEG41BjxaCHe bAEe1aIOHs+8UisWa4sqRKixOTpDRkjjnQZX8REpCn4PLVLnGTE50UHac3hHeaFIqlooHicxXiPB uwU10MdicRAKjRtFdMafR7hjnRh5qwqv1rCCDNiodRkWoy2H3wk8b9C04aluy8FDFUjARhZG/L8L vvEdiQlG/Cw0iJvLjlloEHdsCEHhkxelLaYD+nYZDowo56xQmhUQHZhq+Fhwb8HgueuzvJn6fmpQ rzeYiKjoKhZmI9Fb04IfC9H6DmhU/O6LVkZbcV6u4m08H9XG8pk7xQ/axv7RR9Ub+Caxrpm5qkGN Qb4wCX9noACFIucrjGYcnHHnaxOFOhKJS/z6CtF4xSWOcd6KUrUKa5UUPFMQxpicmpbuktTimfZK eprhjR5X9P+e4T/R4Y94TpQ9Yxqi6/CPv/Y/DXKHvZGmUS7lUzHVBrxpecXTpudS7kRHwaziXMes WY7cYtvsOTRdyy9KHTcuKTNzVoFMpYOFebhL//jmYGFKKsvw5eFyDboGU4pcg4WuPx4oyGezixdK cxfKs4tz1AuSpFh19pw5RYWTpLTxKCTJaWkZaepsluJJ4ZDmxqTPmJKR404uW6jkT8mKD/vvrKhu XTgheYo/V8lJi029m311KkZu+aqE/Tk93Ttj9tSsvCKfWtswfkrhpO9MmjWxqHp6zsIF1TM9uVOn TYhZ+8Mfnj5q2/WfV9g+//JnmKCIRyoiwK8Ywn/cu7i8IlS7XKtoWbNy/aqW/wL8hymrCmVuZHN0 cmVhbQplbmRvYmoKMzcgMCBvYmoKNTc0MgplbmRvYmoKMzggMCBvYmoKKEludGVyaW0uMjlPY3Qy MDE0LlRoZS1sb2NhbC1kaWFsLWluKQplbmRvYmoKMzkgMCBvYmoKKE1hYyBPUyBYIDEwLjguNSBR dWFydHogUERGQ29udGV4dCkKZW5kb2JqCjQwIDAgb2JqCihTYW5kcmEgTXVycGh5KQplbmRvYmoK NDEgMCBvYmoKKCkKZW5kb2JqCjQyIDAgb2JqCihXb3JkKQplbmRvYmoKNDMgMCBvYmoKKEQ6MjAx NDEwMjgyMDE2NTNaMDAnMDAnKQplbmRvYmoKNDQgMCBvYmoKKCkKZW5kb2JqCjQ1IDAgb2JqClsg KCkgXQplbmRvYmoKMSAwIG9iago8PCAvVGl0bGUgMzggMCBSIC9BdXRob3IgNDAgMCBSIC9TdWJq ZWN0IDQxIDAgUiAvUHJvZHVjZXIgMzkgMCBSIC9DcmVhdG9yCjQyIDAgUiAvQ3JlYXRpb25EYXRl IDQzIDAgUiAvTW9kRGF0ZSA0MyAwIFIgL0tleXdvcmRzIDQ0IDAgUiAvQUFQTDpLZXl3b3Jkcwo0 NSAwIFIgPj4KZW5kb2JqCnhyZWYKMCA0NgowMDAwMDAwMDAwIDY1NTM1IGYgCjAwMDAwNzUzNjYg MDAwMDAgbiAKMDAwMDAxMzIxNiAwMDAwMCBuIAowMDAwMDQ4NzQ2IDAwMDAwIG4gCjAwMDAwMDAw MjIgMDAwMDAgbiAKMDAwMDAxMzE5NSAwMDAwMCBuIAowMDAwMDEzMzIwIDAwMDAwIG4gCjAwMDAw MTYxODMgMDAwMDAgbiAKMDAwMDA1Mzk1OSAwMDAwMCBuIAowMDAwMDAwMDAwIDAwMDAwIG4gCjAw MDAwNjg1MTggMDAwMDAgbiAKMDAwMDA0ODkwMCAwMDAwMCBuIAowMDAwMDEzNDQ3IDAwMDAwIG4g CjAwMDAwMTYxNjIgMDAwMDAgbiAKMDAwMDAzMTE2NyAwMDAwMCBuIAowMDAwMDE2MjE5IDAwMDAw IG4gCjAwMDAwMzExNDUgMDAwMDAgbiAKMDAwMDAzMTI3NCAwMDAwMCBuIAowMDAwMDQ1OTgyIDAw MDAwIG4gCjAwMDAwMzEzODggMDAwMDAgbiAKMDAwMDA0NTk2MCAwMDAwMCBuIAowMDAwMDQ2MDg5 IDAwMDAwIG4gCjAwMDAwNDg1MjUgMDAwMDAgbiAKMDAwMDA0NjIwMyAwMDAwMCBuIAowMDAwMDQ4 NTA0IDAwMDAwIG4gCjAwMDAwNDg2MzIgMDAwMDAgbiAKMDAwMDA0ODg1MCAwMDAwMCBuIAowMDAw MDQ5Mjg5IDAwMDAwIG4gCjAwMDAwNDk1NDUgMDAwMDAgbiAKMDAwMDA1MzkzOCAwMDAwMCBuIAow MDAwMDU0NDM0IDAwMDAwIG4gCjAwMDAwNTQ2ODMgMDAwMDAgbiAKMDAwMDA2ODQ5NiAwMDAwMCBu IAowMDAwMDY5MDEwIDAwMDAwIG4gCjAwMDAwNjg2ODEgMDAwMDAgbiAKMDAwMDA2ODk5MCAwMDAw MCBuIAowMDAwMDY5MjQ4IDAwMDAwIG4gCjAwMDAwNzUwODEgMDAwMDAgbiAKMDAwMDA3NTEwMiAw MDAwMCBuIAowMDAwMDc1MTU2IDAwMDAwIG4gCjAwMDAwNzUyMDggMDAwMDAgbiAKMDAwMDA3NTI0 MCAwMDAwMCBuIAowMDAwMDc1MjU5IDAwMDAwIG4gCjAwMDAwNzUyODIgMDAwMDAgbiAKMDAwMDA3 NTMyNCAwMDAwMCBuIAowMDAwMDc1MzQzIDAwMDAwIG4gCnRyYWlsZXIKPDwgL1NpemUgNDYgL1Jv b3QgMjYgMCBSIC9JbmZvIDEgMCBSIC9JRCBbIDwwYTZmOGZiNDBjMDczZDBkNzNmYzY4ZjFhMjZk NDFlOD4KPDBhNmY4ZmI0MGMwNzNkMGQ3M2ZjNjhmMWEyNmQ0MWU4PiBdID4+CnN0YXJ0eHJlZgo3 NTU0MQolJUVPRgo= --Apple-Mail=_6650F659-B066-4F9A-93F7-D92A80F70A02 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On Oct 14, 2014, at 12:27 PM, Sandra Murphy wrote: > At the upcoming IETF, sidr and idr will hold a joint session for the = purpose of discussing the bgpsec protocol. >=20 > The idr and sidr chairs think that there would be benefit in having a = short virtual meeting before hand to get the idr folk who have not been = following sidr up to speed on the bgpsec protocol basics, so they can = contribute effectively in the joint meeting in Hawaii. >=20 > There will be a sidr virtual meeting on Wed 29 Oct 2014 from 10am-12pm = EDT and all interested idr folk are invited to participate. (There = won't be much point if you don't!) >=20 > The agenda is >=20 > 1 hr overview and tutorial of bgpsec: > - underpinings of what BGPSEC/SIDR is > - why are we here? map of documents > - origin validation today > - path validation tomorrow > - note particular points where bgpsec affects bgp, not so much the > crypto but where bgp behaviour may change >=20 > 1 hr of questions and answers. >=20 > slides to be made available ahead of time >=20 > details of the conference technology (webex, google hangout, etc) will = be sent to the mailing list. >=20 > --Sandy, speaking as one of the co-chairs --Apple-Mail=_6650F659-B066-4F9A-93F7-D92A80F70A02-- --Apple-Mail=_65F41EC8-43D5-4F06-BC6F-9A9AAE67FC0A Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJUT/qtAAoJEHplpQeet0IZNFwQAMbK0smjh/2Q4cYiWzaYS/SB hsHWieU0YWJbF3bZi89zvgsWQ5IrfglMPiviQBy7ix+EgGd5Y4GKkJrqrtLfWyfa CPAD4LxEOIS/vn9iV/YyevPwQ8VSOAJFIRxOdzHpvQV7EqR+0a6dgVNOx6izR1bk nsgc3NQxOjE4408+52ngRd5imYkxfQ5khfF5n0O2Ntn2cEJN/pxXZn9HnX0mJhWu AGKdvmzYAxxcu/TeZ5SgNKzRCJsa4dl1vA6k5PJ7Dss0loHWN5HCrK93x+eKT0t9 r/foLu1AU45DzYyuh149R77sUx58PTZpvsZI8b2VWrq8asC63Tne83TSv6lUI/Ua 4vvrLWIP6nJ1aXempDloilqWK++cCeilMj8O91CZ6aG14gNgLijL281HKyYXRU1g bb6MmoFT/tsL9+uZS2HeK45yCf+w7zMvF6K62CZgmaoCIBigmECK5kvvPBUe4eZI 0RaOvJC6I2HpjyJeQySUIYW//MKc8uqvJzQpftNSiC7psjU9puGBnR3WNslRrHsx 8Jyosh+iU3u0YDQMXmzkMEmTdd5JRVDpWqzts3zZW47cCG3ypxwx5bAgVWBffq8X o0cRjFXmGls2mo09OHLmiLTSvZW3pBWcoBjeWO9BNLPtyPvDbbI5LuHver+JCFqd bSLngj64Ruy2kkaWG2VV =WFbS -----END PGP SIGNATURE----- --Apple-Mail=_65F41EC8-43D5-4F06-BC6F-9A9AAE67FC0A-- From nobody Tue Oct 28 16:17:46 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 86A081A1B07 for ; Tue, 28 Oct 2014 16:17:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.001 X-Spam-Level: X-Spam-Status: No, score=-0.001 tagged_above=-999 required=5 tests=[BAYES_20=-0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ReQhp0yLuVuJ for ; Tue, 28 Oct 2014 16:17:41 -0700 (PDT) Received: from mho-02-ewr.mailhop.org (mho-02-ewr.mailhop.org [204.13.248.72]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D70A91A1B29 for ; Tue, 28 Oct 2014 16:17:38 -0700 (PDT) Received: from [200.73.76.67] (helo=[10.10.0.157]) by mho-02-ewr.mailhop.org with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1XjG1A-000Eem-EQ; Tue, 28 Oct 2014 23:17:36 +0000 X-Mail-Handler: Dyn Standard SMTP by Dyn X-Originating-IP: 200.73.76.67 X-Report-Abuse-To: abuse@dyndns.com (see http://www.dyndns.com/services/sendlabs/outbound_abuse.html for abuse reporting information) X-MHO-User: U2FsdGVkX18i2ALdtY/oY6QqJxHIG/hG Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 8.0 \(1990.1\)) From: John Curran In-Reply-To: <06ECFB67-7928-4860-8E1C-C661258E31DD@ripe.net> Date: Tue, 28 Oct 2014 20:17:31 -0300 Content-Transfer-Encoding: quoted-printable Message-Id: <8B92C382-8F04-4BC5-9419-E106119B8FA1@istaff.org> References: <20140702012717.18291.24295.idtracker@ietfa.amsl.com> <415BB336-1A6C-48DD-BD0F-BC9EB0C3506F@ripe.net> <53CFFF3C.2040406@bbn.com> <53D151F0.80808@bbn.com> <53D178A6.7060502@bbn.com> <65886423-144A-48B5-A0EF-D35D4A4FE890@ripe.net> <53DAA101.8020305@bbn.com> <53E11912.7050904@gmail.com> <53E1486B.1080604@bbn.com> <53E151C7.1090508@gmail.com> <53E24D68.8020705@bbn.com> <75B90A7B-ED14-4716-A12C-2EDB1AA7851D@arin.net> <06ECFB67-7928-4860-8E1C-C661258E31DD@ripe.net> To: Tim Bruijnzeels X-Mailer: Apple Mail (2.1990.1) Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/-8fXwNaHa0OoYQcnfl1D8-rF2t8 Cc: sidr wg list Subject: Re: [sidr] I-D Action: draft-ietf-sidr-rpki-validation-reconsidered-00.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Oct 2014 23:17:44 -0000 On Aug 11, 2014, at 11:58 AM, Tim Bruijnzeels wrote: > ... > The *one* thing I (and I believe we..) challenge is whether the an = overclaimed resource should invalidate a complete certificate, instead = of invalidating just the resources at hand, but allowing the remainder. > ... > The following two we may be able to mitigate technically, because we = are dealing with co-operating parties: > @1 There is a mis-timing in certificate shrinking in a transfer = between co-operating parties. > @2 There is a mis-timing in the parent publishing a cert with = extended resource, and issuing it to the child, and the child using = those resources in turn. >=20 > But this is the one that has me scared. It is not the issuing CA being = sloppy, it=92s a problem between them and *their* parent: > @1 The *grand*-parent shrinks the *parent* certificate without the = parent knowing about this, and some of these resources appear on the, = now overclaiming, child certificate. The grand-parent and parent are not = involved in an active transfer process. They may not agree that the = resource in question should be removed, or the grand-parent may have = shrunk these resources in error. >=20 > By rejecting the overclaiming child certificate completely I think we = are being too harsh, or pedantic even. We know better, so we are just = not going to trust this one. But.. there is a very real possibility that = we actually *do* know better than the issuing CA at this point. So, what = exactly is the problem with accepting the remaining resources? i.e. the = intersection between the parent certificate=92s resources and this = certificate. We know the context, this evaluation is very easy and = well-defined. If the CA really intended that the remaining resources = should not be tied to the certificate, they would have revoked. If the = grand-parent really intended that those resources should not be = certified anymore, they would have removed them as well. I'm certain there is a simple answer for this question, but it alludes = me at the present time... Given the risks of full resource list invalidation due to overclaiming, = why aren't distinct certificates used for distinct resources? If this is = not=20 practical in general, wouldn't it at least be prudent to "groom" = resources=20 that are going to be transferred into their own certificate so that the = rest=20 of the resources held by the original child are not put at validation = risk=20 (if a coordination error were to occur in subsequent transfer = processing) Thanks! /John From nobody Wed Oct 29 06:46:47 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 91CF11A00FD for ; Wed, 29 Oct 2014 06:46:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JtCq21aBILZq for ; Wed, 29 Oct 2014 06:46:43 -0700 (PDT) Received: from mail-vc0-x230.google.com (mail-vc0-x230.google.com [IPv6:2607:f8b0:400c:c03::230]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 931621A00E4 for ; Wed, 29 Oct 2014 06:46:43 -0700 (PDT) Received: by mail-vc0-f176.google.com with SMTP id hq11so1546327vcb.21 for ; Wed, 29 Oct 2014 06:46:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:date:message-id:subject :from:to:cc:content-type:content-transfer-encoding; bh=bsmqN95ksNqJjB+D2dE1sYBQvE2GeHejaMLFFnOH9WU=; b=pzm6L/PocmqtbzXgsCyoXgkXU2KpXei8Y20xUpnjsTdQ/Oe7E0HMKSNXf9ZHnpZSku 9D/TUGDmtE4IXxNHuuFBGzHrFUlH2QTdfxCQE0OmHdN9jNZqTPprvdww1awztTh7Wc02 7OVwFuQsCmLsv51zcXuz/pw51qZu0yTKKccGw3imGOWq5FrYkMcUHQauw1NeEyIsx9I9 jmDfY6Qbx3FFpv/dB4ORILpJ1T7xMWfQX23EtoP6PVY5SQsHCDQ3iL9dQWInf1g3DVul i7MFPc1qQ2icPHbGbbz14f50RakOjxoxTXNzGeEf1OEA1VUya72aKNjdl6YKI5BcW0i/ gI+A== MIME-Version: 1.0 X-Received: by 10.52.146.167 with SMTP id td7mr6378376vdb.39.1414590402748; Wed, 29 Oct 2014 06:46:42 -0700 (PDT) Sender: christopher.morrow@gmail.com Received: by 10.221.44.8 with HTTP; Wed, 29 Oct 2014 06:46:42 -0700 (PDT) In-Reply-To: References: <53FF40A8.5020100@ops-netman.net> <1dace22e606b4dc7ab1cdf1effa6fd5b@BN1PR09MB0274.namprd09.prod.outlook.com> Date: Wed, 29 Oct 2014 06:46:42 -0700 X-Google-Sender-Auth: Fcw6luribA7hJLGh_we5Xf6vV_k Message-ID: From: Christopher Morrow To: "George, Wes" Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/o-aRPDa813cgcs_6bn9Nw-9uVOw Cc: Chris Morrow , "sidr-chairs@tools.ietf.org" , "Sriram, Kotikalapudi" , "sidr-ads@tools.ietf.org" , "sidr@ietf.org" Subject: Re: [sidr] WGLC - draft-ietf-sidr-as-migration X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Oct 2014 13:46:45 -0000 Seeing some more folk comment on this, and seeing that the IDR pair documen= t: draft-ietf-idr-as-migration-03 is headed out to publication request as well, let's close this WGLC and move this document along as well. -chris On Tue, Sep 30, 2014 at 10:28 AM, George, Wes w= rote: > On 9/29/14, 9:18 PM, "Randy Bush" wrote: > > >>> 1. Figures 3 and 4 from the companion I-D draft-ietf-idr-as-migration >>> are referenced several times in this document. It would be easier >>> for the readers if those two figures are reproduced in this >>> document when they are first referenced. >> >>uh, having data in two places is a recipe for trouble. this is why we >>do references. i really don't like copy and paste between docs. but >>perhaps i am alone in this. > > WG] I agree, my preference is to leave the diagrams in the referenced > document, and assume that those reviewing can manage to have two parallel > windows open (one of the few places where IETF's self-imposed text-width > restrictions come in handy) or briefly commit the "high-quality" ASCII > diagrams to memory. > > Sriram, I'll incorporate the rest of your feedback into my next version, > which will likely be posted either at IETF LC or due to directorate revie= w. > > Thanks for giving it another look > > Wes > > > This E-mail and any of its attachments may contain Time Warner Cable prop= rietary information, which is privileged, confidential, or subject to copyr= ight belonging to Time Warner Cable. This E-mail is intended solely for the= use of the individual or entity to which it is addressed. If you are not t= he intended recipient of this E-mail, you are hereby notified that any diss= emination, distribution, copying, or action taken in relation to the conten= ts of and attachments to this E-mail is strictly prohibited and may be unla= wful. If you have received this E-mail in error, please notify the sender i= mmediately and permanently delete the original and any copy of this E-mail = and any printout. > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr From nobody Wed Oct 29 07:44:36 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EA84F1A0161 for ; Wed, 29 Oct 2014 07:44:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.75 X-Spam-Level: X-Spam-Status: No, score=-1.75 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id piQTp7HFkZvL for ; Wed, 29 Oct 2014 07:44:28 -0700 (PDT) Received: from mail-pd0-x232.google.com (mail-pd0-x232.google.com [IPv6:2607:f8b0:400e:c02::232]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2D14D1A0120 for ; Wed, 29 Oct 2014 07:44:28 -0700 (PDT) Received: by mail-pd0-f178.google.com with SMTP id fp1so3067343pdb.23 for ; Wed, 29 Oct 2014 07:44:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:date:from:reply-to:user-agent:mime-version:to:cc:subject :references:in-reply-to:content-type:content-transfer-encoding; bh=3H0vXV9cktacP5MMbvsv8br06oyq6+BpSaL7YL9XxoM=; b=MzhFsUgeDumsDeDLlu/Sx5JbVjyaoRFiatkgNeApVEfIdh//ZMSAeSuWWkg/2Oi2dG Wm9pRLach7Q1TxFIehURNFaXbKrmwTXkd1mGJzrj5kV4wtivUmZCG+UHCdyIhg67LiiJ 5oaIu7uKbEa1XNPLARv9xhPDPgzi+pEnl1yrNfBaYCfxqLTXpUs2mZRb8lus5DWspCTu poQiYkRScrrD/n2a0IDX4MK9ohckXX3RF38RBJ4VEAneE30D/6naOXhVT0JFeKArqaNo 9HUwDyFL/hA7ye3mr728h1N8APVZAOAGrfyYVWrQikkP8UmOedlNU2CmEISI9guwE854 4lCg== X-Received: by 10.66.157.161 with SMTP id wn1mr10887815pab.40.1414593867797; Wed, 29 Oct 2014 07:44:27 -0700 (PDT) Received: from albion.local ([2001:13c7:7003:0:6131:ae6b:3f82:ef4a]) by mx.google.com with ESMTPSA id xr10sm4596403pab.35.2014.10.29.07.44.24 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 29 Oct 2014 07:44:26 -0700 (PDT) Message-ID: <5450FD46.8030206@gmail.com> Date: Wed, 29 Oct 2014 11:44:22 -0300 From: "Carlos M. Martinez" User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:31.0) Gecko/20100101 Thunderbird/31.2.0 MIME-Version: 1.0 To: John Curran , Tim Bruijnzeels References: <20140702012717.18291.24295.idtracker@ietfa.amsl.com> <415BB336-1A6C-48DD-BD0F-BC9EB0C3506F@ripe.net> <53CFFF3C.2040406@bbn.com> <53D151F0.80808@bbn.com> <53D178A6.7060502@bbn.com> <65886423-144A-48B5-A0EF-D35D4A4FE890@ripe.net> <53DAA101.8020305@bbn.com> <53E11912.7050904@gmail.com> <53E1486B.1080604@bbn.com> <53E151C7.1090508@gmail.com> <53E24D68.8020705@bbn.com> <75B90A7B-ED14-4716-A12C-2EDB1AA7851D@arin.net> <06ECFB67-7928-4860-8E1C-C661258E31DD@ripe.net> <8B92C382-8F04-4BC5-9419-E106119B8FA1@istaff.org> In-Reply-To: <8B92C382-8F04-4BC5-9419-E106119B8FA1@istaff.org> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/nlrLOTegeWEXGkJ3QXGjaE3Qbrc Cc: sidr wg list Subject: Re: [sidr] I-D Action: draft-ietf-sidr-rpki-validation-reconsidered-00.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list Reply-To: carlos@lacnic.net List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Oct 2014 14:44:34 -0000 Hi, On 28/10/2014 20:17, John Curran wrote: > ... snip ... > > I'm certain there is a simple answer for this question, but it alludes me > at the present time... > > Given the risks of full resource list invalidation due to overclaiming, why > aren't distinct certificates used for distinct resources? If this is not > practical in general, wouldn't it at least be prudent to "groom" resources > that are going to be transferred into their own certificate so that the rest > of the resources held by the original child are not put at validation risk > (if a coordination error were to occur in subsequent transfer processing) I believe you are right, in fact, I'm pretty sure, and I discussed this with Mark a few weeks ago, that it's possible to get quite close to the proposed semantics of validation-reconsidered just by separating (grooming to use your term :-) ) resource sets accross different certs, according to specific criteria. This, to me, means that validation-reconsidered is actually is more like an optimization proposal to something that could already be done today iif we had HSMs able to support enough keys/certs. I'm convinced that there isn't here a radical departure from the original spirit of validation rules. > > Thanks! > /John > cheers! -Carlos > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From nobody Wed Oct 29 16:28:43 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BFE2A1A911B; Wed, 29 Oct 2014 16:28:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eK3lFd612m0E; Wed, 29 Oct 2014 16:28:38 -0700 (PDT) Received: from na01-by2-obe.outbound.protection.outlook.com (mail-by2on0117.outbound.protection.outlook.com [207.46.100.117]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 71F341A1B87; Wed, 29 Oct 2014 16:28:38 -0700 (PDT) Received: from DM2PR09MB0302.namprd09.prod.outlook.com (25.160.96.147) by DM2PR09MB0301.namprd09.prod.outlook.com (25.160.96.146) with Microsoft SMTP Server (TLS) id 15.1.6.9; Wed, 29 Oct 2014 23:28:37 +0000 Received: from DM2PR09MB0302.namprd09.prod.outlook.com ([25.160.96.147]) by DM2PR09MB0302.namprd09.prod.outlook.com ([25.160.96.147]) with mapi id 15.01.0006.000; Wed, 29 Oct 2014 23:28:37 +0000 From: "Sriram, Kotikalapudi" To: Sandra Murphy Thread-Topic: [sidr] announcing virtual interim meeting Wed 29 Oct 2014 Thread-Index: AQHP58vMHBItlA7480eiYUe0FBPMOpxGCcgAgAHCGUA= Date: Wed, 29 Oct 2014 23:28:36 +0000 Message-ID: References: <7D59AE05-E32A-43DA-929B-8E1877A67CC7@tislabs.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [129.6.140.100] x-microsoft-antispam: BCL:0;PCL:0;RULEID:;SRVR:DM2PR09MB0301; x-forefront-prvs: 03793408BA x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(6009001)(243025005)(199003)(189002)(15202345003)(87936001)(54356999)(40100003)(85852003)(92566001)(122556002)(19580395003)(74316001)(31966008)(50986999)(86362001)(80022003)(76176999)(99396003)(15975445006)(2656002)(66066001)(20776003)(120916001)(101416001)(64706001)(21056001)(108616004)(76576001)(33646002)(99286002)(46102003)(105586002)(107046002)(106116001)(95666004)(110136001)(85306004)(97736003)(77096002)(4396001)(106356001)(76482002)(24736002); DIR:OUT; SFP:1102; SCL:1; SRVR:DM2PR09MB0301; H:DM2PR09MB0302.namprd09.prod.outlook.com; FPR:; MLV:sfv; PTR:InfoNoRecords; A:1; MX:1; LANG:en; Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: nist.gov Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/wosZ6OBFojeAECSieQLXc6KJpwI Cc: "idr@ietf.org" , "sidr@ietf.org list" Subject: Re: [sidr] announcing virtual interim meeting Wed 29 Oct 2014 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Oct 2014 23:28:40 -0000 During Sandy's tutorial presentation today, the topics of RIB size and=20 CPU workload estimation for BGPSEC came up. I was asked to post links to past IETF presentations where work on these to= pics was presented.=20 "RIB Size Estimation for BGPSEC" https://www.ietf.org/proceedings/81/slides/sidr-2.pdf (SIDR meeting, IETF= -81)=20 http://www.nist.gov/itl/antd/upload/BGPSEC_RIB_Estimation.pdf (a few mor= e details here) (Note: The BGPSEC protocol I-D specifies ECDSA-P256 for signing updates.=20 However, RSA-2048 is included and compared in this study because=20 RSA-2048 was also considered for signing updates in the early phase of BGPS= EC design.) =20 "Estimating CPU Cost of BGPSEC on a Router" http://www.ietf.org/proceedings/83/slides/slides-83-sidr-7.pdf (SIDR mee= ting, IETF-83) http://ripe63.ripe.net/presentations/127-111102.ripe-crypto-cost.pdf =20 (slightly different version presented at RIPE-63) Some other topics also came up for discussion during the tutorial such as c= onsideration=20 for route servers (note: current BGPSEC supports transparent route servers = by setting pCount=3D0),=20 update packing (i.e. multiple NLRI in an update) - not supported in BGPSEC,= etc.=20 Design discussions related to these and many other topics (such as consider= ation=20 of peer groups, max PDU size, AS_SETs, etc.) are provided in the following = document: =20 "BGPSEC Design Choices and Summary of Supporting Discussions" http://tools.ietf.org/html/draft-sriram-bgpsec-design-choices-06 =20 (NOTE: This design choices document pertains only to the=20 individual 00-draft [I-D.lepinski-bgpsec-protocol-00] dated March 2011.=20 The BGPSEC protocol has obviously gone through many changes since then.=20 So please be careful to bear this in mind while looking at I-D.sriram-bgpse= c-design-choices.)=20 Sriram =20 From nobody Thu Oct 30 06:30:08 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 457651AD1FE for ; Thu, 30 Oct 2014 06:29:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.557 X-Spam-Level: X-Spam-Status: No, score=-1.557 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, IP_NOT_FRIENDLY=0.334, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_FSL_HELO_BARE_IP_2=0.01] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9a5kdQM62RtH for ; Thu, 30 Oct 2014 06:29:54 -0700 (PDT) Received: from gateway07.websitewelcome.com (gateway07.websitewelcome.com [69.41.242.21]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 73A441AD190 for ; Thu, 30 Oct 2014 06:29:53 -0700 (PDT) Received: by gateway07.websitewelcome.com (Postfix, from userid 5007) id C0D1216ED4532; Thu, 30 Oct 2014 08:29:52 -0500 (CDT) Received: from gator3286.hostgator.com (gator3286.hostgator.com [198.57.247.250]) by gateway07.websitewelcome.com (Postfix) with ESMTP id AFA9016ED450A for ; Thu, 30 Oct 2014 08:29:52 -0500 (CDT) Received: from [173.73.121.234] (port=52726 helo=192.168.1.7) by gator3286.hostgator.com with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.82) (envelope-from ) id 1XjpnT-0005CK-Ax for sidr@ietf.org; Thu, 30 Oct 2014 08:29:51 -0500 Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) From: Sean Turner In-Reply-To: Date: Thu, 30 Oct 2014 09:29:49 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: References: <20140813004442.10560.45299.idtracker@ietfa.amsl.com> <4556FA63-A6FD-471B-93FD-51D748C94EE8@tislabs.com> <8BFAD7DD-7CEA-4720-86BB-09407C6C543D@ieca.com> To: sidr wg list X-Mailer: Apple Mail (2.1878.6) X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - gator3286.hostgator.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - ieca.com X-BWhitelist: no X-Source-IP: 173.73.121.234 X-Exim-ID: 1XjpnT-0005CK-Ax X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: (192.168.1.7) [173.73.121.234]:52726 X-Source-Auth: sean.turner@ieca.com X-Email-Count: 3 X-Source-Cap: ZG9tbWdyNDg7ZG9tbWdyNDg7Z2F0b3IzMjg2Lmhvc3RnYXRvci5jb20= Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/1_TeX7HaAbG5YPJplJOVR_iUfV0 Subject: Re: [sidr] I-D Action: draft-ietf-sidr-bgpsec-pki-profiles-08.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Oct 2014 13:29:56 -0000 On Oct 08, 2014, at 02:48, Randy Bush wrote: >> Yep the issuer always gets to determine the subject name as per RFC >> 6487 s4.5 so how about we just leave that bit out and make that >> sentence a note: >>=20 >> Note that more than one certificate can be issued to >> an AS (i.e., more than one router can get a certificate >> for the AS and hence the private key is shared among >> more than one router). >>=20 >> I guess the follow on question is whether we also point out that a >> router could support more than one AS but having key pairs for each >> AS: >>=20 >> Also note that routers can support multiple ASs with >> separate keys pairs one for each AS. >>=20 >> or something like that? >=20 > i think i understand it and it makes sense. though i would tersify it > to >=20 > Rrouters can support multiple ASs with > separate keys pairs, one for each AS >=20 > :) >=20 > randy I let this one sit for a while and hearing no objections I went ahead = and made the changes in the version on github: = https://github.com/seanturner/draft-ietf-sidr-bgpsec-pki-profiles/blob/mas= ter/draft-ietf-sidr-bgpsec-pki-profiles-09.txt I=92ll submit it to the IETF once the submission window reopens. To the best of my knowledge this resolves the last remaining technical = issue. spt= From nobody Thu Oct 30 09:01:11 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 29D3B1AD531 for ; Thu, 30 Oct 2014 09:01:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.801 X-Spam-Level: X-Spam-Status: No, score=-101.801 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, SPF_PASS=-0.001, T_DKIM_INVALID=0.01, T_RP_MATCHES_RCVD=-0.01, USER_IN_WHITELIST=-100] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XCldPcG6PRO5 for ; Thu, 30 Oct 2014 09:00:57 -0700 (PDT) Received: from nx-mailgw.apnic.net (nx-mailgw.apnic.net [IPv6:2001:dd8:9:801::25]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A52EB1AD53A for ; Thu, 30 Oct 2014 08:59:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=apnic.net; s=c3po; h=received:received:content-type:mime-version:subject:from:in-reply-to:date:cc: content-transfer-encoding:message-id:references:to:x-mailer:return-path; bh=0hK8+pSC/lEf1PQ2zNk6S32tdxbr7NWEfDrXtOeX7pM=; b=UsxM/pziet4JOnO2goNKkpFOrxXgYcEt7uRhvYVkIjaf9+rjz55jyZp3v+J+LY+NJ1uMmaTLET3f4 iMeJgqx8qWUzLv8/5TcpKLCkWgKd+upqKYsTCFqtbgRWTLxIcEBlBzAlMbURDrXBPFcHHrtunE29F/ YQB0LgW7xlfEWuPM= Received: from NXMDA1.org.apnic.net (unknown [203.119.101.249]) by nx-mailgw.apnic.net (Halon Mail Gateway) with ESMTPS; Fri, 31 Oct 2014 02:01:45 +1000 (EST) Received: from [192.168.178.43] (203.119.101.249) by NXMDA1.org.apnic.net (203.119.107.11) with Microsoft SMTP Server (TLS) id 14.1.218.12; Fri, 31 Oct 2014 01:59:45 +1000 Content-Type: text/plain; charset="windows-1252" MIME-Version: 1.0 (Mac OS X Mail 8.0 \(1990.1\)) From: Geoff Huston In-Reply-To: <8B92C382-8F04-4BC5-9419-E106119B8FA1@istaff.org> Date: Fri, 31 Oct 2014 02:59:34 +1100 Content-Transfer-Encoding: quoted-printable Message-ID: References: <20140702012717.18291.24295.idtracker@ietfa.amsl.com> <415BB336-1A6C-48DD-BD0F-BC9EB0C3506F@ripe.net> <53CFFF3C.2040406@bbn.com> <53D151F0.80808@bbn.com> <53D178A6.7060502@bbn.com> <65886423-144A-48B5-A0EF-D35D4A4FE890@ripe.net> <53DAA101.8020305@bbn.com> <53E11912.7050904@gmail.com> <53E1486B.1080604@bbn.com> <53E151C7.1090508@gmail.com> <53E24D68.8020705@bbn.com> <75B90A7B-ED14-4716-A12C-2EDB1AA7851D@arin.net> <06ECFB67-7928-4860-8E1C-C661258E31DD@ripe.net> <8B92C382-8F04-4BC5-9419-E106119B8FA1@istaff.org> To: John Curran X-Mailer: Apple Mail (2.1990.1) Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/8UCLSpyuXad_ESKdjC8vFMvZnlg Cc: sidr wg list Subject: Re: [sidr] I-D Action: draft-ietf-sidr-rpki-validation-reconsidered-00.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Oct 2014 16:01:02 -0000 > On 29 Oct 2014, at 10:17 am, John Curran wrote: >=20 > On Aug 11, 2014, at 11:58 AM, Tim Bruijnzeels wrote: >> ... >> The *one* thing I (and I believe we..) challenge is whether the an = overclaimed resource should invalidate a complete certificate, instead = of invalidating just the resources at hand, but allowing the remainder. >> ... >> The following two we may be able to mitigate technically, because we = are dealing with co-operating parties: >> @1 There is a mis-timing in certificate shrinking in a transfer = between co-operating parties. >> @2 There is a mis-timing in the parent publishing a cert with = extended resource, and issuing it to the child, and the child using = those resources in turn. >>=20 >> But this is the one that has me scared. It is not the issuing CA = being sloppy, it=92s a problem between them and *their* parent: >> @1 The *grand*-parent shrinks the *parent* certificate without the = parent knowing about this, and some of these resources appear on the, = now overclaiming, child certificate. The grand-parent and parent are not = involved in an active transfer process. They may not agree that the = resource in question should be removed, or the grand-parent may have = shrunk these resources in error. >>=20 >> By rejecting the overclaiming child certificate completely I think we = are being too harsh, or pedantic even. We know better, so we are just = not going to trust this one. But.. there is a very real possibility that = we actually *do* know better than the issuing CA at this point. So, what = exactly is the problem with accepting the remaining resources? i.e. the = intersection between the parent certificate=92s resources and this = certificate. We know the context, this evaluation is very easy and = well-defined. If the CA really intended that the remaining resources = should not be tied to the certificate, they would have revoked. If the = grand-parent really intended that those resources should not be = certified anymore, they would have removed them as well. >=20 > I'm certain there is a simple answer for this question, but it alludes = me > at the present time... >=20 > Given the risks of full resource list invalidation due to = overclaiming, why > aren't distinct certificates used for distinct resources? If this is = not=20 > practical in general, wouldn't it at least be prudent to "groom" = resources=20 > that are going to be transferred into their own certificate so that = the rest=20 > of the resources held by the original child are not put at validation = risk=20 > (if a coordination error were to occur in subsequent transfer = processing) >=20 If I understand your note here, you are suggesting that the CA issues a = new cert for the to-be-transferred resource and revokes and reissues the = original "omnibus" cert to have all the resources minus the = to-be-transferred resource. Yes? But does not this exacerbate the very = problem about over-claiming subordinate certs? Any subordinate certs of = the shrunken "omnibus" cert that still include the to-be-transferred = resource are now completely invalid. I may not be following your = suggestion here, but I just can't see how this makes it "better". regards, Geoff =20 From nobody Thu Oct 30 11:38:49 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 526E51A1A65 for ; Thu, 30 Oct 2014 11:38:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LZ2YBAkNMHLJ for ; Thu, 30 Oct 2014 11:38:45 -0700 (PDT) Received: from kaka.ripe.net (kaka.ripe.net [IPv6:2001:67c:2e8:11::c100:1347]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 31CEE1A19EA for ; Thu, 30 Oct 2014 11:38:45 -0700 (PDT) Received: from nene.ripe.net ([193.0.23.10]) by kaka.ripe.net with esmtps (UNKNOWN:AES256-GCM-SHA384:256) (Exim 4.72) (envelope-from ) id 1XjucK-0004cp-Pd; Thu, 30 Oct 2014 19:38:42 +0100 Received: from s258-sslvpn-1.ripe.net ([193.0.20.231] helo=vpn-54.ripe.net) by nene.ripe.net with esmtps (TLSv1:AES128-SHA:128) (Exim 4.72) (envelope-from ) id 1XjucK-0001Bg-Lm; Thu, 30 Oct 2014 19:38:40 +0100 Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) Content-Type: text/plain; charset=windows-1252 From: Tim Bruijnzeels In-Reply-To: <8B92C382-8F04-4BC5-9419-E106119B8FA1@istaff.org> Date: Thu, 30 Oct 2014 19:38:39 +0100 Content-Transfer-Encoding: quoted-printable Message-Id: <34544385-27D4-4E7D-B465-53AAA2D9623B@ripe.net> References: <20140702012717.18291.24295.idtracker@ietfa.amsl.com> <415BB336-1A6C-48DD-BD0F-BC9EB0C3506F@ripe.net> <53CFFF3C.2040406@bbn.com> <53D151F0.80808@bbn.com> <53D178A6.7060502@bbn.com> <65886423-144A-48B5-A0EF-D35D4A4FE890@ripe.net> <53DAA101.8020305@bbn.com> <53E11912.7050904@gmail.com> <53E1486B.1080604@bbn.com> <53E151C7.1090508@gmail.com> <53E24D68.8020705@bbn.com> <75B90A7B-ED14-4716-A12C-2EDB1AA7851D@arin.net> <06ECFB67-7928-4860-8E1C-C661258E31DD@ripe.net> <8B92C382-8F04-4BC5-9419-E106119B8FA1@istaff.org> To: John Curran X-Mailer: Apple Mail (2.1878.6) X-RIPE-Spam-Level: --- X-RIPE-Spam-Report: Spam Total Points: -3.5 points pts rule name description ---- ---------------------- ------------------------------------ -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP -0.6 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] X-RIPE-Signature: 784d7acfe6559f2a0b602ec6519a07191dc18d289657afccf367d7679423edf2 Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/kakb5CfiF_qylDp0AI14uDZWh_I Cc: sidr wg list Subject: Re: [sidr] I-D Action: draft-ietf-sidr-rpki-validation-reconsidered-00.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Oct 2014 18:38:47 -0000 Hi John, all, Hoping to clarify my reasoning why I think this is validation approach = provides a significant quick win.. On 29 Oct 2014, at 00:17, John Curran wrote: > On Aug 11, 2014, at 11:58 AM, Tim Bruijnzeels wrote: >> ... >> The *one* thing I (and I believe we..) challenge is whether the an = overclaimed resource should invalidate a complete certificate, instead = of invalidating just the resources at hand, but allowing the remainder. >> ... >> The following two we may be able to mitigate technically, because we = are dealing with co-operating parties: >> @1 There is a mis-timing in certificate shrinking in a transfer = between co-operating parties. >> @2 There is a mis-timing in the parent publishing a cert with = extended resource, and issuing it to the child, and the child using = those resources in turn. >>=20 >> But this is the one that has me scared. It is not the issuing CA = being sloppy, it=92s a problem between them and *their* parent: >> @1 The *grand*-parent shrinks the *parent* certificate without the = parent knowing about this, and some of these resources appear on the, = now overclaiming, child certificate. The grand-parent and parent are not = involved in an active transfer process. They may not agree that the = resource in question should be removed, or the grand-parent may have = shrunk these resources in error. >>=20 >> By rejecting the overclaiming child certificate completely I think we = are being too harsh, or pedantic even. We know better, so we are just = not going to trust this one. But.. there is a very real possibility that = we actually *do* know better than the issuing CA at this point. So, what = exactly is the problem with accepting the remaining resources? i.e. the = intersection between the parent certificate=92s resources and this = certificate. We know the context, this evaluation is very easy and = well-defined. If the CA really intended that the remaining resources = should not be tied to the certificate, they would have revoked. If the = grand-parent really intended that those resources should not be = certified anymore, they would have removed them as well. >=20 > I'm certain there is a simple answer for this question, but it alludes = me > at the present time=85 I would very much like to learn the answer to that question though, = taken from above: >> So, what exactly is the problem with accepting the remaining = resources? I believe we are rejecting ROAs or router certificates under strict = rules for reasons that concern other objects. I just do not see a = scenario where an RP could be led to accept a ROA or router certificate = that *could* not be valid if strict rules are followed. The fix is = higher in the chain. By claiming fewer resources, not more. And the = exact same object would be considered valid. If someone can come up with a scenario where a truly over claiming ROA = or router certificate is considered valid under reconsidered rules, then = I agree that it=92s not option. As it stands in my understanding though, this is an easy quick fix to = limit the impact of problem of over claiming certificates to just = *those* objects that refer to the resources. So even if it then doesn=92t solve those other issues, I believe we will = have made a very significant improvement. Tim From nobody Fri Oct 31 14:06:23 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A39C11A1B57 for ; Fri, 31 Oct 2014 14:06:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.511 X-Spam-Level: X-Spam-Status: No, score=-0.511 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7d-jHRkiIUpG for ; Fri, 31 Oct 2014 14:06:19 -0700 (PDT) Received: from walnut.tislabs.com (walnut.tislabs.com [192.94.214.200]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E3CE21A1B51 for ; Fri, 31 Oct 2014 14:06:18 -0700 (PDT) Received: from nova.tislabs.com (unknown [10.66.1.77]) by walnut.tislabs.com (Postfix) with ESMTP id 1D6B728B0017; Fri, 31 Oct 2014 17:06:18 -0400 (EDT) Received: from [127.0.0.1] (localhost.localdomain [127.0.0.1]) by nova.tislabs.com (Postfix) with ESMTP id 026B01F804E; Fri, 31 Oct 2014 17:06:18 -0400 (EDT) Content-Type: multipart/signed; boundary="Apple-Mail=_F370D28B-C2DC-4767-B043-24E4B162FF1E"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\)) From: Sandra Murphy In-Reply-To: Date: Fri, 31 Oct 2014 17:06:17 -0400 Message-Id: <28D2F970-275F-4D29-A773-1A2D8A12353A@tislabs.com> References: <20140702012717.18291.24295.idtracker@ietfa.amsl.com> <415BB336-1A6C-48DD-BD0F-BC9EB0C3506F@ripe.net> <53CFFF3C.2040406@bbn.com> <53D151F0.80808@bbn.com> <53D178A6.7060502@bbn.com> <65886423-144A-48B5-A0EF-D35D4A4FE890@ripe.net> <53DAA101.8020305@bbn.com> <53E11912.7050904@gmail.com> <53E1486B.1080604@bbn.com> <53E151C7.1090508@gmail.com> <53E24D68.8020705@bbn.com> <75B90A7B-ED14-4716-A12C-2EDB1AA7851D@arin.net> <06ECFB67-7928-4860-8E1C-C661258E31DD@ripe.net> <8B92C382-8F04-4BC5-9419-E106119B8FA1@istaff.org> To: Geoff Huston X-Mailer: Apple Mail (2.1510) Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/Azb6l54MrZspTQgxosdlP30zTrc Cc: sidr wg list , Sandra Murphy Subject: Re: [sidr] I-D Action: draft-ietf-sidr-rpki-validation-reconsidered-00.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Oct 2014 21:06:21 -0000 --Apple-Mail=_F370D28B-C2DC-4767-B043-24E4B162FF1E Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 speaking as regular ol' member On Oct 30, 2014, at 11:59 AM, Geoff Huston wrote: >=20 >> On 29 Oct 2014, at 10:17 am, John Curran wrote: >>=20 >> On Aug 11, 2014, at 11:58 AM, Tim Bruijnzeels wrote: >>> =85 To be honest, I get a bit confused as to whether we are considering the = case of planned transfer actions, or some unanticipated reduction in a = certificate's resources. If we're talking about the planned case, then: >=20 > If I understand your note here, you are suggesting that the CA issues = a new cert for the to-be-transferred resource and revokes and reissues = the original "omnibus" cert to have all the resources minus the = to-be-transferred resource. Yes? Or, as another idea, leave the original certificate in place but also = issue two certificates, one for the retained space, one for the transfer = space. If I'm planning on transferring some of my resources, I could request my = parent do this. If I have sub allocated some of those to-be-transferred resources to = customers, then I'd be quite remiss if I were not mentioning this to my = customer who was just about to lose some of their resources. So maybe = I'd reissue certs to customers who had exclusively retained space under = the new cert with only retained space, same for the about to be = transferred space. The customers who have a mix of retained and = transferred space are in a pickle of my own making, and I should work = with them closely. Before I do the transfer. I think the RPKI structures work if I create the needed certs in the = fate-sharing part of my customer cone. (Maybe even a hint of = gr**dp*r*ting). I consider this similar to RIPE's instructions to their members to = retain their authority over their sub allocated space, carefully setting = the mtn-by, mtn-lower, mtn-route, etc.. Of course, that's from my = reading of the RIPE documentation, so I could be wrong about that. Working the process out for planned transfers would be valuable. --Sandy, speaking as a regular ol' member --Apple-Mail=_F370D28B-C2DC-4767-B043-24E4B162FF1E Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJUU/nJAAoJEHplpQeet0IZ2ygP/0OWvIEpJEJAFwpmZG4Z+C20 AOOdpAPn3FYCT0QTRGXnsWXgq+BMRyQp49zjJmLqJwwPA4MAOO9nnwEWCPrLdzhE 7ZNaXslMSNx7Yg0j+6MJTZ/hFq1l4e0+IZ4fPae3rpEYjiSvzScpi3SpF6ZtW6P6 o9Qg9Ga3WbdPy9JgZMwcLruAkT7tFEGZD4Irtv+AGcma48lIcPpbDhkFuqz86ZYn qldhnvTj9e+Gt83/DH7EDAdOfay1FJnRMEFNqzA29xWJlpMZm50cOtFMZpCbCFUD oAaL6O2DDyuNC2XGsCmowxsfURLAZiLaochMvVlPLOph0OSgtxXY55etnnVAjI+i YwuMJKdrzcoMMsM5LCbLmNUJLWgMJO4Kf9WEHG9k7F7BmBHfZAUz/i61pQ6uXdi5 YqLgfHRG8I7dzscGyXcuvmPwEiJtEEK0+DEOL4cqPTIkzbvJNQsmFCGf7J5L0NOw jQHPKyxfgs476oCArrhWkqd+2LDFgSju2IinWplHoS+W3SlHahVgCQxze/xlwpjA LY64FkMw9Gm+ObEMLYSinQhrdry/14PeC2FT9UhmPtRjZwDqGXwwy1E6NZbm8bPZ 8qDZLUu8+WOMIGPxNRd/DflzMEqLLKpRtW4k22bshIEXEPuObT+EaTJNijHk/TWr IRSx1h3xhh2sWELe3jb5 =gKXZ -----END PGP SIGNATURE----- --Apple-Mail=_F370D28B-C2DC-4767-B043-24E4B162FF1E-- From nobody Fri Oct 31 14:49:47 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C82D81A6F28 for ; Fri, 31 Oct 2014 14:49:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.911 X-Spam-Level: X-Spam-Status: No, score=-1.911 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nGqip9pkjhjk for ; Fri, 31 Oct 2014 14:49:44 -0700 (PDT) Received: from walnut.tislabs.com (walnut.tislabs.com [192.94.214.200]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CE4581A6F24 for ; Fri, 31 Oct 2014 14:49:43 -0700 (PDT) Received: from nova.tislabs.com (unknown [10.66.1.77]) by walnut.tislabs.com (Postfix) with ESMTP id 27AC128B0017; Fri, 31 Oct 2014 17:49:43 -0400 (EDT) Received: from [127.0.0.1] (localhost.localdomain [127.0.0.1]) by nova.tislabs.com (Postfix) with ESMTP id 1DA5B1F804E; Fri, 31 Oct 2014 17:49:43 -0400 (EDT) Content-Type: multipart/signed; boundary="Apple-Mail=_1576308D-E878-4A46-9FAC-3EDF2F09BFA0"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\)) From: Sandra Murphy In-Reply-To: <34544385-27D4-4E7D-B465-53AAA2D9623B@ripe.net> Date: Fri, 31 Oct 2014 17:49:42 -0400 Message-Id: References: <20140702012717.18291.24295.idtracker@ietfa.amsl.com> <415BB336-1A6C-48DD-BD0F-BC9EB0C3506F@ripe.net> <53CFFF3C.2040406@bbn.com> <53D151F0.80808@bbn.com> <53D178A6.7060502@bbn.com> <65886423-144A-48B5-A0EF-D35D4A4FE890@ripe.net> <53DAA101.8020305@bbn.com> <53E11912.7050904@gmail.com> <53E1486B.1080604@bbn.com> <53E151C7.1090508@gmail.com> <53E24D68.8020705@bbn.com> <75B90A7B-ED14-4716-A12C-2EDB1AA7851D@arin.net> <06ECFB67-7928-4860-8E1C-C661258E31DD@ripe.net> <8B92C382-8F04-4BC5-9419-E106119B8FA1@istaff.org> <34544385-27D4-4E7D-B465-53AAA2D9623B@ripe.net> To: Tim Bruijnzeels X-Mailer: Apple Mail (2.1510) Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/6A99rEvH7OjZWK6hL_txLIzhlF4 Cc: sidr wg list , Sandra Murphy Subject: Re: [sidr] I-D Action: draft-ietf-sidr-rpki-validation-reconsidered-00.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Oct 2014 21:49:45 -0000 --Apple-Mail=_1576308D-E878-4A46-9FAC-3EDF2F09BFA0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 speaking as regular ol' member. On Oct 30, 2014, at 2:38 PM, Tim Bruijnzeels wrote: > Hi John, all, >=20 > Hoping to clarify my reasoning why I think this is validation approach = provides a significant quick win.. >=20 >=20 > On 29 Oct 2014, at 00:17, John Curran wrote: >=20 >> On Aug 11, 2014, at 11:58 AM, Tim Bruijnzeels wrote: >>>=20 >>> @1 The *grand*-parent shrinks the *parent* certificate without the = parent knowing about this, and some of these resources appear on the, = now overclaiming, child certificate. The grand-parent and parent are not = involved in an active transfer process. They may not agree that the = resource in question should be removed, or the grand-parent may have = shrunk these resources in error. If the removed resources re improperly removed, accepting the remaining = resources does not help them. I don't think this is an error case that we are trying to work out, = here. If we are trying to address that, we have a whole lot more = solution space to explore. =20 >>>=20 >>> If the CA really intended that the remaining resources should not be = tied to the certificate, they would have revoked.=20 Ironically, and no one has mentioned this much, but the CP says if a = certificate's resources are reduced, the certificate with the original = set is revoked. =20 (Then a new certificate with the reduced set is issued with the same = key. I think that's weird. There are people who think it is weird that = I think it is weird. :-) ) I wonder sometimes if evaluating a ROA EE cert would find the new = reduced certificate in the cache first or the issuing original = certificate on the CRL first. --Sandy, speaking as regular ol' member --Apple-Mail=_1576308D-E878-4A46-9FAC-3EDF2F09BFA0 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJUVAP2AAoJEHplpQeet0IZwpUP/iO62UKP19SramW+uh+CzTeK IFMBIuJBZ+wRFbqeIFBcZHm51XjqB9D2R5VSIIWQ5qho3f2V9NLjMWjth9uRB7FG KX/48vh0X/EgZnENusneEgRw/Xz9fOVaRGR09PufXJaaDiYtQvvhPPxb6doy7+Xk Ps2/THOHBpQm4MPZHzrlGKT3PRMXv82r3QvfeIw3S3oMaVwt1mD7Ea2yul0cCAIP xd6yQG8KNAE/JNYVuvXrf2FACCckr7L4FJQUR1dqHhY7OnKgvsSHNzrgACnyoQkp QS5mnhy0C5mPTdIOvXpWpm6EUSzcMccFLyjEnQbYSU9fXF8/ujfRXP4+jPSXTdbQ fAYkrjYg2QRvuMQ9uUUcFlHNiKVg0ybrovNbT74c3QHWTqndCqVnCJ621+sl12Vx +6myx+4588s/3AMwM5GX+6qGOs60ixqVDHDqUIMUG+FpWdBY99s3i8IhEnbtok32 89l2Xz99pxIacMvHlGuM5ISQAxXgS/G6Y+/K+XQYYLO10LD/Y9IdqHvndQkBOqjo pVUKmdCLBiXjZBfRraXnwIYk7vBJHuxqQhfUaTCdnKzAlTFQg1tg/LionIFEkxCw B0yAZzsJtuHbhKAjA3I/6Mih2hVB0act73UkoUZNHbhTzbVIc/V9FBPL87J5Ol08 AQ4jCwJcSF52mKr3/YsB =WY3Y -----END PGP SIGNATURE----- --Apple-Mail=_1576308D-E878-4A46-9FAC-3EDF2F09BFA0-- From nobody Fri Oct 31 20:11:26 2014 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2D83F1A87AB for ; Fri, 31 Oct 2014 20:11:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.801 X-Spam-Level: X-Spam-Status: No, score=-101.801 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, SPF_PASS=-0.001, T_DKIM_INVALID=0.01, T_RP_MATCHES_RCVD=-0.01, USER_IN_WHITELIST=-100] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4xeskiw4Hf5L for ; Fri, 31 Oct 2014 20:11:22 -0700 (PDT) Received: from nx-mailgw.apnic.net (nx-mailgw.apnic.net [IPv6:2001:dd8:9:801::25]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EBB3C1A87AA for ; Fri, 31 Oct 2014 20:11:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=apnic.net; s=c3po; h=received:received:content-type:mime-version:subject:from:in-reply-to:date:cc: content-transfer-encoding:message-id:references:to:x-mailer:return-path; bh=MFFmMj3dn4xh0xECTxbHOy2a627ShAmB3RjiIvtcNes=; b=2msDXUQJRlCpbdn18nRI2KrYdraVwfxlLoPecpNN84KKlhApZN1z0R6j+jS/1n5c0DB1YcFBHARuT 86zcg3DE6o133F8n0xIMBWda5qTsOiivVeKjFhtwgufbQE/6vuExPptgl1byO4zQQp7wFB9hr82oWH urqFinlXMn2Hy3/Y= Received: from NXMDA1.org.apnic.net (unknown [203.119.101.249]) by nx-mailgw.apnic.net (Halon Mail Gateway) with ESMTPS; Sat, 1 Nov 2014 13:13:21 +1000 (EST) Received: from [192.168.179.64] (203.119.101.249) by NXMDA1.org.apnic.net (203.119.107.11) with Microsoft SMTP Server (TLS) id 14.1.218.12; Sat, 1 Nov 2014 13:11:16 +1000 Content-Type: text/plain; charset="windows-1252" MIME-Version: 1.0 (Mac OS X Mail 8.0 \(1990.1\)) From: Geoff Huston In-Reply-To: <28D2F970-275F-4D29-A773-1A2D8A12353A@tislabs.com> Date: Sat, 1 Nov 2014 14:11:04 +1100 Content-Transfer-Encoding: quoted-printable Message-ID: <7163F206-83D6-4790-8DCA-614261187708@apnic.net> References: <20140702012717.18291.24295.idtracker@ietfa.amsl.com> <415BB336-1A6C-48DD-BD0F-BC9EB0C3506F@ripe.net> <53CFFF3C.2040406@bbn.com> <53D151F0.80808@bbn.com> <53D178A6.7060502@bbn.com> <65886423-144A-48B5-A0EF-D35D4A4FE890@ripe.net> <53DAA101.8020305@bbn.com> <53E11912.7050904@gmail.com> <53E1486B.1080604@bbn.com> <53E151C7.1090508@gmail.com> <53E24D68.8020705@bbn.com> <75B90A7B-ED14-4716-A12C-2EDB1AA7851D@arin.net> <06ECFB67-7928-4860-8E1C-C661258E31DD@ripe.net> <8B92C382-8F04-4BC5-9419-E106119B8FA1@istaff.org> <28D2F970-275F-4D29-A773-1A2D8A12353A@tislabs.com> To: Sandra Murphy X-Mailer: Apple Mail (2.1990.1) Archived-At: http://mailarchive.ietf.org/arch/msg/sidr/3mhX8qrUqdUlVmRlYaFmlUv61uA Cc: sidr wg list Subject: Re: [sidr] I-D Action: draft-ietf-sidr-rpki-validation-reconsidered-00.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 01 Nov 2014 03:11:25 -0000 > On 1 Nov 2014, at 8:06 am, Sandra Murphy wrote: >=20 > speaking as regular ol' member >=20 > On Oct 30, 2014, at 11:59 AM, Geoff Huston wrote: >=20 >>=20 >>> On 29 Oct 2014, at 10:17 am, John Curran wrote: >>>=20 >>> On Aug 11, 2014, at 11:58 AM, Tim Bruijnzeels wrote: >>>> =85 >=20 > To be honest, I get a bit confused as to whether we are considering = the case of planned transfer actions, or some unanticipated reduction in = a certificate's resources. >=20 > If we're talking about the planned case, then: >>=20 >> If I understand your note here, you are suggesting that the CA issues = a new cert for the to-be-transferred resource and revokes and reissues = the original "omnibus" cert to have all the resources minus the = to-be-transferred resource. Yes? >=20 > Or, as another idea, leave the original certificate in place but also = issue two certificates, one for the retained space, one for the transfer = space. >=20 I'm sorry, but I don't understand how this ameliorates the issues in any = way. Now lets assume that the two new certificates are indeed "new" and = neither "overwrites the "original certificate (with all its subordinate = certs). If that's the case then the CA now has to issue new subordinate certs = using each of the new CA certificates - right? So will these subordinate = certificates overwrite the existing subordinate certificates, or are = they entirely new (new subject name, etc)? In the former case the = problem of subordinate certificate overclaiming is still a possibility = given that the CA cert used to issue these certificates is now missing = the to-be-transferred resource, and in the latter case then each of = these subordinate CAs has to in turn perform a full reissuance, which is = a huge amount of ripple down work all the way to the end leaf points in = the hierarchy. Or, to quote from the draft document itself which describes pretty much = exactly the case you are informally describing above: It is possible for the common registry to issue a certificate to the "sending" registry with the reduced resource set at any time, but it should not revoke the previously issued certificate, nor overwrite this previously issued certificate in its repository publication point without specific coordination. Only when the common registry is assured that the top down certificate issuance process to the receiving registry CA chain has been completed can the common registry commence the revocation of the original certificate for the sending registry, However, it should not so until it is assured that the immediate subordinate registry CA in the path to the sending registry has issued a certificate with a reduced resource set, and so on. This implies that on the sending side the certificate issuance and revocation is a "bottom up" process. If this process is not carefully followed, then the risk is that some or all or the subordinate certificates of this common registry CA will be unable to be validated until the entire process of certificate issuance and revocation has been completed. While this sequenced process is intended to preserve validity of certificates in the RPKI, it is a complex, fragile and operationally cumbersome process.. The underlying consideration here is that the operational coordination of these certificate issuance and revocation actions to effect a smooth resource transfer across registries is mandated by the nature of the particular choice of certificate validation process described in [RFC6487]. regards, Geoff