From nobody Wed Mar 2 07:37:41 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 576241A892A for ; Wed, 2 Mar 2016 07:37:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.384 X-Spam-Level: X-Spam-Status: No, score=-1.384 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.006, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hC-fjUrcqUDV for ; Wed, 2 Mar 2016 07:37:38 -0800 (PST) Received: from mail-io0-x230.google.com (mail-io0-x230.google.com [IPv6:2607:f8b0:4001:c06::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D593C1A88C9 for ; Wed, 2 Mar 2016 07:37:38 -0800 (PST) Received: by mail-io0-x230.google.com with SMTP id m184so21906493iof.1 for ; Wed, 02 Mar 2016 07:37:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc; bh=PJLqvBBjdCkoZFKuO0vMlwSaUQz/1VLC6GUa9qZGKkE=; b=akD13OUR6eVJEZYxpBYi335nivj1Y5Bm2IoO3rCt7/NlG8dc2BnrZNLyvRighQrViV BhAMi+4ylvxkwypve5SRRuEo2rXPG0V8E8KwjTVyE4mpBp38D/SfrQtN6n5y1hxOiUfe bU17xiGbjq00Pdyi0KT3XXG26QOIEn8m/gKMC74WfuxUFvG0yHzTh0wzBhxm7maoWmjB yCx6tmGKk9JXeCDV6eUg0EoVF2WfPqhmjI0fAtt02ybcnSy6qkAn6JGCi8pjmeKYwwD7 6f6HktbxGVFXos2AT8YDx2Ldpz4TYB//65PWEpqrRBHaaY1+drY6VWw74jxPRIKwwFSy abyA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc; bh=PJLqvBBjdCkoZFKuO0vMlwSaUQz/1VLC6GUa9qZGKkE=; b=K4RNUoRmNQDgWXWKxKg1FfdUJZsxWfi9G3iDfCkdYP5k+SItuHUZn0YFWYwFIpr4bU ZM+gTGpaRI2VUXTCZTMtfXo7DqSWVHYy287doU+fQCo/p3BvolVRpsqKGvE7qx7dhyAw px6i0Z0HGiTt81IbtAf6MVUiMp+fAFfZzJ8PcppBg2gZ7fqgL1vB65JN2nUDRCbj2+hm YfPVACDU6oUzoim9+IxV0dJewN58cxDVeuClsTmfMrE56nwGYyWYwoHN+e7ENn7yUVxr lxGq/tEvP+YTWlBEyM7jQuguVFR2eCT90hue6NNx4bgHo1CsU4yF5ecLK6Mk2FE4knyB ZOYA== X-Gm-Message-State: AG10YOQGCZUxVnaBbe4+5J0e/yPm6m54g9FmCxyEiQN3BVVfOkZkwFrTzqTlKDNq8MjJpR97GpkjtiCcMYcLK9iP MIME-Version: 1.0 X-Received: by 10.107.185.8 with SMTP id j8mr28702905iof.94.1456933057972; Wed, 02 Mar 2016 07:37:37 -0800 (PST) Received: by 10.64.246.138 with HTTP; Wed, 2 Mar 2016 07:37:37 -0800 (PST) In-Reply-To: <56d70399.8d41620a.19ae8.ffffeb3bSMTPIN_ADDED_MISSING@mx.google.com> References: <9A043F3CF02CD34C8E74AC1594475C73F4BDB8A8@uxcn10-5.UoA.auckland.ac.nz> <56d70399.8d41620a.19ae8.ffffeb3bSMTPIN_ADDED_MISSING@mx.google.com> Date: Wed, 2 Mar 2016 07:37:37 -0800 Message-ID: From: Wei Chuang To: Russ Housley Content-Type: multipart/alternative; boundary=94eb2c076a6a623336052d12a923 Archived-At: Cc: IETF SMIME Subject: Re: [smime] Message takeover attacks against S/MIME X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 02 Mar 2016 15:37:40 -0000 --94eb2c076a6a623336052d12a923 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit I'm sorry I'm late to this conversation, but I also wanted to volunteer to help update the S/MIME specification. Authenticated encryption would be very helpful in mitigating the attacks mentioned in the posted article. One additional suggestion is considering recent standardized crypto in RFC7539 for S/MIME. ChaCha20-Poly1305 provides more crypto algorithm diversity, and is potentially faster than AES based authenticated encryption (e.g. on mobile) . It may have other useful properties for S/MIME as well. -Wei On Fri, Jan 29, 2016 at 8:23 AM, Russ Housley wrote: > Peter: > > > Russ Housley writes: > > > >> Take a look at this article: http://cryptosource.de/posts/ > smime_mta_en.html > >> > >> Is there interest in updating the S/MIME specification to use > authenticated- > >> encryption? > > > > It looks like a pretty contrived attack, you need to be able to truncate > a > > message, both at the start and end, on a 16-byte boundary to turn a > signed > > message into a plain, unsigned one, and still have the client accept the > > result as a valid message. They found one client that does that, but > that > > sounds more like a buggy client than a major problem (none of the others > did > > it). > > > > In any case the fix should be pretty minimal, if anything is required at > all: > > If the SMIMECaps in the cert you're encrypting for indicates authEnc, use > > that. My code already does that and possibly other impementations do > too. > > CMS already supports Enveloped-Data and Authenticated-Enveloped-Data. > However, the S/MIME specification does not say how to use > Authenticated-Enveloped-Data. I think that is the work to be done. > > Russ > --94eb2c076a6a623336052d12a923 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit
I'm sorry I'm late to this conversation, but I also wanted to volunteer to help update the S/MIME specification.  Authenticated encryption would be very helpful in mitigating the attacks mentioned in the posted article.

One additional suggestion is considering recent standardized crypto in RFC7539 for S/MIME.  ChaCha20-Poly1305 provides more crypto algorithm diversity, and is potentially faster than AES based authenticated encryption (e.g. on mobile) .  It may have other useful properties for S/MIME as well.

-Wei

On Fri, Jan 29, 2016 at 8:23 AM, Russ Housley <housley@vigilsec.com> wrote:
Peter:

> Russ Housley <housley at vigilsec.com> writes:
>
>> Take a look at this article: http://cryptosource.de/posts/smime_mta_en.html
>>
>> Is there interest in updating the S/MIME specification to use authenticated-
>> encryption?
>
> It looks like a pretty contrived attack, you need to be able to truncate a
> message, both at the start and end, on a 16-byte boundary to turn a signed
> message into a plain, unsigned one, and still have the client accept the
> result as a valid message.  They found one client that does that, but that
> sounds more like a buggy client than a major problem (none of the others did
> it).
>
> In any case the fix should be pretty minimal, if anything is required at all:
> If the SMIMECaps in the cert you're encrypting for indicates authEnc, use
> that.  My code already does that and possibly other impementations do too.

CMS already supports Enveloped-Data and Authenticated-Enveloped-Data.  However, the S/MIME specification does not say how to use Authenticated-Enveloped-Data.  I think that is the work to be done.

Russ

--94eb2c076a6a623336052d12a923-- From nobody Mon Mar 7 22:58:50 2016 Return-Path: X-Original-To: smime@ietfc.amsl.com Delivered-To: smime@ietfc.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfc.amsl.com (Postfix) with ESMTP id 2AE5F1CDAC0 for ; Mon, 7 Mar 2016 22:58:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.9 X-Spam-Level: X-Spam-Status: No, score=-101.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.41]) by localhost (ietfc.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P387SrasMhCE for ; Mon, 7 Mar 2016 22:58:48 -0800 (PST) Received: from odin.smetech.net (x-bolt-wan.smeinc.net [209.135.219.146]) by ietfc.amsl.com (Postfix) with ESMTP id 35CA71CDBFF for ; Mon, 7 Mar 2016 22:58:48 -0800 (PST) Received: from localhost (ronin.smetech.net [209.135.209.5]) by odin.smetech.net (Postfix) with ESMTP id B175C9A400C for ; Tue, 8 Mar 2016 01:58:47 -0500 (EST) X-Virus-Scanned: amavisd-new at smetech.net Received: from odin.smetech.net ([209.135.209.4]) by localhost (ronin.smeinc.net [209.135.209.5]) (amavisd-new, port 10024) with ESMTP id 21vkhPZRxdXB for ; Tue, 8 Mar 2016 01:45:57 -0500 (EST) Received: from [172.16.1.184] (19.190.138.210.bf.2iij.net [210.138.190.19]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by odin.smetech.net (Postfix) with ESMTP id 0B0559A4003 for ; Tue, 8 Mar 2016 01:58:36 -0500 (EST) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Apple Message framework v1085) From: Russ Housley In-Reply-To: <56d70399.8d41620a.19ae8.ffffeb3bSMTPIN_ADDED_MISSING@mx.google.com> Date: Tue, 8 Mar 2016 01:58:34 -0500 Content-Transfer-Encoding: quoted-printable Message-Id: References: <9A043F3CF02CD34C8E74AC1594475C73F4BDB8A8@uxcn10-5.UoA.auckland.ac.nz> <56d70399.8d41620a.19ae8.ffffeb3bSMTPIN_ADDED_MISSING@mx.google.com> To: IETF SMIME X-Mailer: Apple Mail (2.1085) Archived-At: Subject: Re: [smime] Message takeover attacks against S/MIME X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Mar 2016 06:58:49 -0000 I am hearing interest in these topics (a combination of things on this = list and side conversations). (1) Specify the way to use authenticated encryption in S/MIME. Note = that it is already done for CMS. (2) Specify conventions for AES-CCM, AES-GCM, and ChaCha20 with Poly1305 = authenticated encryption algorithms. (3) Specify conventions for using Curve25519 and Curve448 for key = agreement. (4) Specify conventions for using the CFRG chosen curves for elliptic = curve digital signature. (5) Specify a way to use PGP public keys in addition to PKIX = certificates. Anything else? Is this enough to re-charter the S/MIME WG? Russ= From nobody Tue Mar 8 09:07:40 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0CC7B12D859 for ; Tue, 8 Mar 2016 09:07:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=isode.com Received: from mail.ietf.org ([127.0.0.1]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hHZgpAzgb7Tz for ; Tue, 8 Mar 2016 09:07:36 -0800 (PST) Received: from waldorf.isode.com (waldorf.isode.com [62.232.206.188]) by ietfa.amsl.com (Postfix) with ESMTP id E65B812D853 for ; Tue, 8 Mar 2016 09:07:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; t=1457456855; d=isode.com; s=selector; i=@isode.com; bh=iu5doPKT5qBCY3ryg6hAsKQoBDpdsTSICbLNpXq4AxM=; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version: In-Reply-To:References:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description; b=Ahrsr61GFVRmOU4bDMY3jg/YdB4C0tD8zf0Y52OWdXayWyCcSb4F2+4/YPCgKbBZyt+/64 rtMGcJkZ7NMb2C6jX1mu6SzOiEPDEc+EAwNfrL9hNVOuUfDLhQ5vkG7yxiznfOLeFciG74 +FsbqrNMifmSAZx3AUNFBheXvrpCtRo=; Received: from [192.168.0.5] (cpc5-nmal20-2-0-cust24.19-2.cable.virginm.net [92.234.84.25]) by waldorf.isode.com (submission channel) via TCP with ESMTPSA id ; Tue, 8 Mar 2016 17:07:34 +0000 To: Russ Housley , IETF SMIME References: <9A043F3CF02CD34C8E74AC1594475C73F4BDB8A8@uxcn10-5.UoA.auckland.ac.nz> <56d70399.8d41620a.19ae8.ffffeb3bSMTPIN_ADDED_MISSING@mx.google.com> From: Alexey Melnikov Message-ID: <56DF06D4.8040607@isode.com> Date: Tue, 8 Mar 2016 17:07:32 +0000 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0 In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [smime] Message takeover attacks against S/MIME X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Mar 2016 17:07:38 -0000 On 08/03/2016 06:58, Russ Housley wrote: > I am hearing interest in these topics (a combination of things on this list and side conversations). > > (1) Specify the way to use authenticated encryption in S/MIME. Note that it is already done for CMS. > > (2) Specify conventions for AES-CCM, AES-GCM, and ChaCha20 with Poly1305 authenticated encryption algorithms. > > (3) Specify conventions for using Curve25519 and Curve448 for key agreement. > > (4) Specify conventions for using the CFRG chosen curves for elliptic curve digital signature. > > (5) Specify a way to use PGP public keys in addition to PKIX certificates. > > Anything else? It would be good if "Domain-based signing and encryption using S/MIME" (draft-melnikov-smime-msa-to-mda-04) can also be included. > Is this enough to re-charter the S/MIME WG? I think so! From nobody Tue Mar 8 10:16:57 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2DA6212D962 for ; Tue, 8 Mar 2016 10:16:55 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.35 X-Spam-Level: X-Spam-Status: No, score=-2.35 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FREEMAIL_FORGED_FROMDOMAIN=0.249, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([127.0.0.1]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qamKWYljzBGF for ; Tue, 8 Mar 2016 10:16:52 -0800 (PST) Received: from mail-lb0-x234.google.com (mail-lb0-x234.google.com [IPv6:2a00:1450:4010:c04::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3ED5512D858 for ; Tue, 8 Mar 2016 10:16:52 -0800 (PST) Received: by mail-lb0-x234.google.com with SMTP id xr8so29026234lbb.1 for ; Tue, 08 Mar 2016 10:16:52 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:date:message-id:subject :from:to:cc; bh=g8Ue+CzPUpd5Ox2xdWXBnQGl4uVj0q9TRVqfLMtsd3M=; b=vplH6Y9oNVOv664HboohLYzaLSP+AdjFV6UudD+4zPJQ091k45jv1cUnKGTxUbmh/9 CG/OkVLTTtUKYED86JI0MfDeWLrvYkzBEmb3vJnpBn+KOYnkdw2y9o/Yi7dJeFFuhlOr u1km4Y6s8/36Koctdmz/gOOePlSVPRFj8MoEvNKCgcJKR+RB1drVC2OvAup+M1wr9N/V ylCwOV9jeMycEsxK6cBRsVc5CFhYCvGvMchaaFuPe5FVTVJOk5/j/mu6hjdeaAqwd6So Fhi9hhnnsUca9LSp0CxgSZYqTRaGrpIdI+S0rNltxql/VB55WxZvTPthPt11onicL6VB iG4Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:sender:in-reply-to:references:date :message-id:subject:from:to:cc; bh=g8Ue+CzPUpd5Ox2xdWXBnQGl4uVj0q9TRVqfLMtsd3M=; b=UKRIFW+TRK/YHQ7X1GNx2w6HfklIr3Tsgcyw2VO4C30GBFJPJTFNUTipzc0db4EDRt VwwVVMY3YObYj0ddlxWpHbmU9EyJ7vpNd7wxXZu8TyeLlziEQfoIJUpj10hbX4j+Y5Mz EsanI7U4V+x/m2dLfagw9YlZzt+CmT4ThN4hxbSd96Q5oNXCVx2hafdmRczoQI0R/1ua 2IsfWqz9dsc2A6zzoDH83tPwFnwqMUSkLhsNz7un3cp7Hz71vgP3Pp3oEVokRTgwIAoR NZ7nZENKmtXRasP2FF7gbwnBRcPUU5fxPK95TXbM3th5PPWqUjDc6D1yRHmxBP2AFqbW aS0Q== X-Gm-Message-State: AD7BkJIKZJnprQtB+xNte1cnYYADOq9/93JLC67rcCphWVFwsC7nntw4TpQ/wZmPfXGqXRb44x4bXXhxhVHXnQ== MIME-Version: 1.0 X-Received: by 10.25.213.196 with SMTP id m187mr10381304lfg.67.1457461009655; Tue, 08 Mar 2016 10:16:49 -0800 (PST) Sender: hallam@gmail.com Received: by 10.112.151.67 with HTTP; Tue, 8 Mar 2016 10:16:49 -0800 (PST) In-Reply-To: References: <9A043F3CF02CD34C8E74AC1594475C73F4BDB8A8@uxcn10-5.UoA.auckland.ac.nz> <56d70399.8d41620a.19ae8.ffffeb3bSMTPIN_ADDED_MISSING@mx.google.com> Date: Tue, 8 Mar 2016 13:16:49 -0500 X-Google-Sender-Auth: gLn56sRhgF-NDA-PuYtzg2Ygfk4 Message-ID: From: Phillip Hallam-Baker To: Russ Housley Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: IETF SMIME Subject: Re: [smime] Message takeover attacks against S/MIME X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Mar 2016 18:16:55 -0000 On Tue, Mar 8, 2016 at 1:58 AM, Russ Housley wrote: > I am hearing interest in these topics (a combination of things on this list and side conversations). > > (1) Specify the way to use authenticated encryption in S/MIME. Note that it is already done for CMS. > > (2) Specify conventions for AES-CCM, AES-GCM, and ChaCha20 with Poly1305 authenticated encryption algorithms. > > (3) Specify conventions for using Curve25519 and Curve448 for key agreement. > > (4) Specify conventions for using the CFRG chosen curves for elliptic curve digital signature. > > (5) Specify a way to use PGP public keys in addition to PKIX certificates. If we are going to do this, I would like to also look at automating enrollment for a CA issued certificate. The biggest barrier to S/MIME use today is not the cost of the cert. Comodo has tried giving them away for free for years. It is the difficulty of using them that is the problem. In my demonstration of the Mathematical Mesh, I show how to make configuring S/MIME with a self-signed certificate so easy that the user barely needs to be aware that it is happening. In principal configuring a CA issued cert only requires one additional piece of information, the DNS name of the CA to request the cert from (and potentially there would be payment issues). That said, I will note that items 1,2,3,4 are arguably already in scope for CURDLE. I am a big fan of doing (5). the point is to get people using end to end encryption, not use one particular approach. From nobody Tue Mar 8 15:26:34 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1652612DC1E for ; Tue, 8 Mar 2016 15:26:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.9 X-Spam-Level: X-Spam-Status: No, score=-101.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([127.0.0.1]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7lR56kuO09ya for ; Tue, 8 Mar 2016 15:26:30 -0800 (PST) Received: from odin.smetech.net (x-bolt-wan.smeinc.net [209.135.219.146]) by ietfa.amsl.com (Postfix) with ESMTP id 91ED312DBE7 for ; Tue, 8 Mar 2016 15:26:30 -0800 (PST) Received: from localhost (ronin.smetech.net [209.135.209.5]) by odin.smetech.net (Postfix) with ESMTP id 02B409A4008; Tue, 8 Mar 2016 18:26:30 -0500 (EST) X-Virus-Scanned: amavisd-new at smetech.net Received: from odin.smetech.net ([209.135.209.4]) by localhost (ronin.smeinc.net [209.135.209.5]) (amavisd-new, port 10024) with ESMTP id tCFhfCGEkN5z; Tue, 8 Mar 2016 18:13:36 -0500 (EST) Received: from [172.16.1.184] (19.190.138.210.bf.2iij.net [210.138.190.19]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by odin.smetech.net (Postfix) with ESMTP id B819B9A4001; Tue, 8 Mar 2016 18:26:17 -0500 (EST) Mime-Version: 1.0 (Apple Message framework v1085) Content-Type: text/plain; charset=us-ascii From: Russ Housley In-Reply-To: Date: Tue, 8 Mar 2016 18:26:14 -0500 Content-Transfer-Encoding: quoted-printable Message-Id: <379069FC-7E09-4654-B695-43627EE12EDD@vigilsec.com> References: <9A043F3CF02CD34C8E74AC1594475C73F4BDB8A8@uxcn10-5.UoA.auckland.ac.nz> <56d70399.8d41620a.19ae8.ffffeb3bSMTPIN_ADDED_MISSING@mx.google.com> To: Phillip Hallam-Baker X-Mailer: Apple Mail (2.1085) Archived-At: Cc: IETF SMIME Subject: Re: [smime] Message takeover attacks against S/MIME X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Mar 2016 23:26:32 -0000 Phillip: >> I am hearing interest in these topics (a combination of things on = this list and side conversations). >>=20 >> (1) Specify the way to use authenticated encryption in S/MIME. Note = that it is already done for CMS. >>=20 >> (2) Specify conventions for AES-CCM, AES-GCM, and ChaCha20 with = Poly1305 authenticated encryption algorithms. >>=20 >> (3) Specify conventions for using Curve25519 and Curve448 for key = agreement. >>=20 >> (4) Specify conventions for using the CFRG chosen curves for elliptic = curve digital signature. >>=20 >> (5) Specify a way to use PGP public keys in addition to PKIX = certificates. >=20 >=20 > If we are going to do this, I would like to also look at automating > enrollment for a CA issued certificate. I agree that getting and renewing the certificate is far too difficult. [snip] > That said, I will note that items 1,2,3,4 are arguably already in > scope for CURDLE. To use RFC 5083 and RFC 5084, we need to do quite a bit more than just = add algorithms to a registry. In my opinion, we would need to produce = S/MIME) Version 3.3. 5083 Cryptographic Message Syntax (CMS) Authenticated-Enveloped-Data Content Type. R. Housley. November 2007. (Format: TXT=3D22810 = bytes) (Updates RFC3852) (Status: PROPOSED STANDARD) (DOI: 10.17487/RFC5083)=20 5084 Using AES-CCM and AES-GCM Authenticated Encryption in the Cryptographic Message Syntax (CMS). R. Housley. November 2007. (Format: TXT=3D21821 bytes) (Status: PROPOSED STANDARD) (DOI: 10.17487/RFC5084) > I am a big fan of doing (5). the point is to get people using end to > end encryption, not use one particular approach. At least one person agrees. That is how it got on the list. Russ From nobody Tue Mar 8 18:50:43 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EA0BD12DDAA for ; Tue, 8 Mar 2016 18:50:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([127.0.0.1]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XQFMZMc6hDxM for ; Tue, 8 Mar 2016 18:50:41 -0800 (PST) Received: from mail-pa0-x22c.google.com (mail-pa0-x22c.google.com [IPv6:2607:f8b0:400e:c03::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C3AD412D7ED for ; Tue, 8 Mar 2016 18:50:40 -0800 (PST) Received: by mail-pa0-x22c.google.com with SMTP id fe3so11255934pab.1 for ; Tue, 08 Mar 2016 18:50:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=n8PYIhhVaG6uwrbuwCvqSSU0OCZZQcTE0dnbTmtPJQc=; b=Wd2yhLecrG7n2AekYnwcA8B/EGMhKJ3286zd48cWyvLfKmyLTUiETT5+4anY+ki2ZO FEnstX857kmufx4eiuNjSP4eX5y/AEQCctwzIqA+OhlNd1aEHRO04615NwSH6U18/NK5 EbgG8T17yjA7vUFfZCzWspm3iZ11ts4JWkOEs= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=n8PYIhhVaG6uwrbuwCvqSSU0OCZZQcTE0dnbTmtPJQc=; b=C6QDZs9/Vllsk09Mjb5pCHz0QWz2eNNXREI2daJCGFES1hJjVAwfht57CDx5r9mgzf 3iCOI5rZqB2FEnFsRMLxtxHMWyjLrsgOnZcF6ps/FNVKGJUR2xluAx3es2RoKjoC4R6R gtfgQJii7IRvjJiFBFGnO9MXLSW3hyFi6KU649iW+YqYb3E7ol1IKNSEqpy2wH2wRZw9 vfDmWja9ruX3FcVA3EyYTitWQzLH9i4Gi+CpB35XJeNng0yIg87UHgQaOh2JUrStdPta sbpw64tjv/rceo2u4eSBczTJydzSNdwi1P3XKRNsVGtaLwduoVeq/vrEyULKxyvAXw1o RbMw== X-Gm-Message-State: AD7BkJJ/exe+xLc7a8fM67Hrws9eRE/Ra5/v1LN8W9tmpV5kjqPJ3sV97DFYKzM1XKGW8A== X-Received: by 10.66.146.99 with SMTP id tb3mr870615pab.47.1457491840388; Tue, 08 Mar 2016 18:50:40 -0800 (PST) Received: from [172.16.2.62] (19.190.138.210.bf.2iij.net. [210.138.190.19]) by smtp.gmail.com with ESMTPSA id ud8sm7968686pac.11.2016.03.08.18.50.38 (version=TLSv1/SSLv3 cipher=OTHER); Tue, 08 Mar 2016 18:50:39 -0800 (PST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 9.2 \(3112\)) From: Sean Turner In-Reply-To: <379069FC-7E09-4654-B695-43627EE12EDD@vigilsec.com> Date: Wed, 9 Mar 2016 11:50:35 +0900 Content-Transfer-Encoding: quoted-printable Message-Id: References: <9A043F3CF02CD34C8E74AC1594475C73F4BDB8A8@uxcn10-5.UoA.auckland.ac.nz> <56d70399.8d41620a.19ae8.ffffeb3bSMTPIN_ADDED_MISSING@mx.google.com> <379069FC-7E09-4654-B695-43627EE12EDD@vigilsec.com> To: Russ Housley X-Mailer: Apple Mail (2.3112) Archived-At: Cc: Phillip Hallam-Baker , IETF SMIME Subject: Re: [smime] Message takeover attacks against S/MIME X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Mar 2016 02:50:42 -0000 On Mar 09, 2016, at 08:26, Russ Housley wrote: >=20 > In my opinion, we would need to produce S/MIME) Version 3.3. I was thinking the same thing, but I=E2=80=99d call it S/MIME 4.0. spt= From nobody Tue Mar 8 19:21:32 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 81BF312DDF0 for ; Tue, 8 Mar 2016 19:21:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([127.0.0.1]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EpdJeu4qPfXM for ; Tue, 8 Mar 2016 19:21:30 -0800 (PST) Received: from mail-wm0-x22d.google.com (mail-wm0-x22d.google.com [IPv6:2a00:1450:400c:c09::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3560212DDE9 for ; Tue, 8 Mar 2016 19:21:30 -0800 (PST) Received: by mail-wm0-x22d.google.com with SMTP id p65so174707364wmp.1 for ; Tue, 08 Mar 2016 19:21:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-transfer-encoding; bh=3rcgJfZVGYbrwvl2780kP+2VSHlUHw0O9CyFa1RWqdo=; b=gUZy+0UH3uD7TQzble5v1E3EKmqoWHnj5PVzplVMhubbZyUbOrrMznOqhieyt1f2t7 IB0YBw8GE07AokgS/izRLU7JwK/zH/nAk+p1NEsVVgX/EC9Ze0lg8DBjIsDz4yfM9Cvh LcyN/p3c4OcPqJ7XvAeEp+Vi1Kb5DC+JH+FiKY4rt1QC5ndm1I+tnuJyIeOiRdY9bmzP nLTG2O0gEKWXg1JqXFN4rE95pbRSFwpGwZn5Y5f35vD0ULJ1RyXK3MUTj1BVEQT6jKWQ HFngqzxNvKve/BbReUAlOf42k6LMvMwqE3Eg77dpCsgIZkN4Pi+Emu5VdvYP7yEhqSTG 648g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-transfer-encoding; bh=3rcgJfZVGYbrwvl2780kP+2VSHlUHw0O9CyFa1RWqdo=; b=kxRLxjpznTR4ydsoag8E44u8eOlHPdOhivd0L8YMPFg519at9a/kcKFVqKPcdzMYMU 1kKZ5q798EabJFY9vu+f0dOJHLDeYlLzCpuvvHCaLe/8foWguozU8Dbsplg3pTpEnHW1 JHkH+uKsiCSbV6OlaPt3tewZUeWfw4mBY9pMK4jeDwGUKynYf1b851+UaCxQSHWmNEZF OY2jtmzHogurtCoOlMPbANiDzxjhF8KH6148UFTgddQJ8hLLTPos/GM9bWCX8BV6IBlq w4XYb3kMCJVDxBkQbThh4pzArl4/y27PRQEx7IktVrJ20MdNslwNJolC2iftQaRqppnr FHbw== X-Gm-Message-State: AD7BkJLZ5+3FZebsXxur6iI5rZUkgyL+ms7OJNSXCiROcaKTLA3SwvmwDK8wjZlkxdsIiP05umLt3/S2/ExciQ== MIME-Version: 1.0 X-Received: by 10.28.177.134 with SMTP id a128mr24481901wmf.55.1457493688705; Tue, 08 Mar 2016 19:21:28 -0800 (PST) Received: by 10.194.71.170 with HTTP; Tue, 8 Mar 2016 19:21:28 -0800 (PST) In-Reply-To: References: <05a801d159ea$51ae6ce0$f50b46a0$@augustcellars.com> Date: Tue, 8 Mar 2016 19:21:28 -0800 Message-ID: From: Blake Ramsdell To: Sean Turner Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Archived-At: Cc: IETF SMIME Subject: Re: [smime] Message takeover attacks against S/MIME X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Mar 2016 03:21:31 -0000 On Mon, Feb 1, 2016 at 3:02 PM, Sean Turner wrote: > I=E2=80=99m willing to help too, but it would be really great if we could= identity some folks who work on [insert your favorite mail app with built-= in S/MIME support] to also be involved. I am also willing to help. And I agree that we need to do some outreach to get implementers engaged and participating. From nobody Tue Mar 8 20:53:42 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D638212DC75 for ; Tue, 8 Mar 2016 20:53:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.9 X-Spam-Level: X-Spam-Status: No, score=-101.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([127.0.0.1]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RET7bjF0B_nZ for ; Tue, 8 Mar 2016 20:53:39 -0800 (PST) Received: from odin.smetech.net (x-bolt-wan.smeinc.net [209.135.219.146]) by ietfa.amsl.com (Postfix) with ESMTP id B039512DB0C for ; Tue, 8 Mar 2016 20:53:39 -0800 (PST) Received: from localhost (ronin.smetech.net [209.135.209.5]) by odin.smetech.net (Postfix) with ESMTP id 12DD99A4003; Tue, 8 Mar 2016 23:53:39 -0500 (EST) X-Virus-Scanned: amavisd-new at smetech.net Received: from odin.smetech.net ([209.135.209.4]) by localhost (ronin.smeinc.net [209.135.209.5]) (amavisd-new, port 10024) with ESMTP id we8pd6PP0drM; Tue, 8 Mar 2016 23:40:55 -0500 (EST) Received: from [172.16.1.184] (19.190.138.210.bf.2iij.net [210.138.190.19]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by odin.smetech.net (Postfix) with ESMTP id 1AE259A4001; Tue, 8 Mar 2016 23:53:37 -0500 (EST) Mime-Version: 1.0 (Apple Message framework v1085) Content-Type: text/plain; charset=us-ascii From: Russ Housley In-Reply-To: <56DF06D4.8040607@isode.com> Date: Tue, 8 Mar 2016 23:53:33 -0500 Content-Transfer-Encoding: quoted-printable Message-Id: <6DCB6229-5921-4750-8E6D-C2ACE9C62EA6@vigilsec.com> References: <9A043F3CF02CD34C8E74AC1594475C73F4BDB8A8@uxcn10-5.UoA.auckland.ac.nz> <56d70399.8d41620a.19ae8.ffffeb3bSMTPIN_ADDED_MISSING@mx.google.com> <56DF06D4.8040607@isode.com> To: Alexey Melnikov X-Mailer: Apple Mail (2.1085) Archived-At: Cc: IETF SMIME Subject: Re: [smime] Message takeover attacks against S/MIME X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Mar 2016 04:53:41 -0000 Alexey: >> Anything else? >=20 > It would be good if "Domain-based signing and encryption using S/MIME" > (draft-melnikov-smime-msa-to-mda-04) can also be included. Can you summarize the things that you need that are not supported by RFC = 3183? 3183 Domain Security Services using S/MIME. T. Dean, W. Ottaway. October 2001. (Format: TXT=3D57129 bytes) (Status: EXPERIMENTAL) (DOI: 10.17487/RFC3183)=20 Russ= From nobody Thu Mar 10 11:12:51 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 91A0512DBFB for ; Thu, 10 Mar 2016 11:12:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RtWFlZkp7NCk for ; Thu, 10 Mar 2016 11:12:47 -0800 (PST) Received: from mail-io0-x233.google.com (mail-io0-x233.google.com [IPv6:2607:f8b0:4001:c06::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0A3ED12DBF8 for ; Thu, 10 Mar 2016 11:12:47 -0800 (PST) Received: by mail-io0-x233.google.com with SMTP id g203so117914232iof.2 for ; Thu, 10 Mar 2016 11:12:47 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc; bh=2g3VZ2owJ0fx2GmtjPN3WWJKlYA1wmwk3xxjoDNrCpw=; b=UjlNnWJkQPxAfwv/Ue9nSXX/spRGyPmmkgDmzxhDhTZUYhdFBbMVMy3W0aXO+V9u/6 m4C3qZAHUvqMfrOx6WDxYp29pAqrgR7UxMA5DF1oAoYxEv7X4QGXo7g2L6bxgMG6y5jd ESRBIwW4hgesKlKvh2A5RWJKO2vW2+BucbUXJvvFJtX7Hbs9OQa6ueb8ho+BQnPeazn2 BmKIRThWHve6Wk445cFAvR6DsIKtsaqG20uVEAZMbj+K7J5srKi8sDfZxpwVHXM08mQy I0ncl0h74EYP+zr635BkvElDNUSB7XbZ4Ag0HOlEr4T1VPv2W09RlW/QlbSrI9WR+4UJ YfQA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc; bh=2g3VZ2owJ0fx2GmtjPN3WWJKlYA1wmwk3xxjoDNrCpw=; b=e1SF4K9yYZUxf7duGBrxy0W8Z/FBzS1l7L/o5uZz2u6xf+o6rjFhc5US1DxUg9PxKc SSPMnPVYqbHMtDspmJ97UyyMO3gC41lyBTwnLYV8A90L1r+2QvIJTLX/B1Q+b8upbQD9 jxgs+fR2rdZb7dk0aHM0aHD74aRE8ZmZa46GHtd8W2zGLPMFu/oYAVII9f8xLcxOrhR2 3eLBL1tvcvzNh7RzTyg0Lz1jk9czVPk9bQct/UrvV3O7MBOgmSwDn/nN8vRKFCfTRSxJ b7mbJu4ZR+gF8CUZvSdFfwEQZJxlFm+Bnf1m7DkFIs7HzkLL9j6elwqBEWkI60OmKAHh 9stg== X-Gm-Message-State: AD7BkJKnEtmnh3kEsXqSPzzWDDXQyLMcgNi/p+oq5to6yDDRQQ4hQwQUT8EdgDsMsR0wbUpexcJo4zexoAtoq6EW MIME-Version: 1.0 X-Received: by 10.107.168.30 with SMTP id r30mr5227352ioe.141.1457637166304; Thu, 10 Mar 2016 11:12:46 -0800 (PST) Received: by 10.64.246.138 with HTTP; Thu, 10 Mar 2016 11:12:46 -0800 (PST) In-Reply-To: References: <9A043F3CF02CD34C8E74AC1594475C73F4BDB8A8@uxcn10-5.UoA.auckland.ac.nz> <56d70399.8d41620a.19ae8.ffffeb3bSMTPIN_ADDED_MISSING@mx.google.com> Date: Thu, 10 Mar 2016 11:12:46 -0800 Message-ID: From: Wei Chuang To: Russ Housley Content-Type: multipart/alternative; boundary=001a11427d6e82b741052db6997b Archived-At: Cc: IETF SMIME Subject: Re: [smime] Message takeover attacks against S/MIME X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2016 19:12:49 -0000 --001a11427d6e82b741052db6997b Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On Mon, Mar 7, 2016 at 10:58 PM, Russ Housley wrote: > I am hearing interest in these topics (a combination of things on this > list and side conversations). > > (1) Specify the way to use authenticated encryption in S/MIME. Note that > it is already done for CMS. > > (2) Specify conventions for AES-CCM, AES-GCM, and ChaCha20 with Poly1305 > authenticated encryption algorithms. > > (3) Specify conventions for using Curve25519 and Curve448 for key > agreement. > > (4) Specify conventions for using the CFRG chosen curves for elliptic > curve digital signature. > > (5) Specify a way to use PGP public keys in addition to PKIX certificates. > > Anything else? > While I'm afraid of scope creep as resolving the above would be very useful, could also mail header integrity and privacy be considered? Perhaps the WG scope be split into near and long term work to help prioritize. The above five items be categorize as near term and the mail header work considered longer term? -Wei (PS yes there is RFC7508 which is experimental, and does not keep private the sender and recipient. Still it is an improvement...) > > Is this enough to re-charter the S/MIME WG? > > Russ > _______________________________________________ > smime mailing list > smime@ietf.org > https://www.ietf.org/mailman/listinfo/smime > --001a11427d6e82b741052db6997b Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit


On Mon, Mar 7, 2016 at 10:58 PM, Russ Housley <housley@vigilsec.com> wrote:
I am hearing interest in these topics (a combination of things on this list and side conversations).

(1) Specify the way to use authenticated encryption in S/MIME.  Note that it is already done for CMS.

(2) Specify conventions for AES-CCM, AES-GCM, and ChaCha20 with Poly1305 authenticated encryption algorithms.

(3) Specify conventions for using Curve25519 and Curve448 for key agreement.

(4) Specify conventions for using the CFRG chosen curves for elliptic curve digital signature.

(5) Specify a way to use PGP public keys in addition to PKIX certificates.

Anything else?

While I'm afraid of scope creep as resolving the above would be very useful, could also mail header integrity and privacy be considered?  Perhaps the WG scope be split into near and long term work to help prioritize.  The above five items be categorize as near term and the mail header work considered longer term?

-Wei 

(PS yes there is RFC7508 which is experimental, and does not keep private the sender and recipient.  Still it is an improvement...)
 

Is this enough to re-charter the S/MIME WG?

Russ
_______________________________________________
smime mailing list
smime@ietf.org
https://www.ietf.org/mailman/listinfo/smime

--001a11427d6e82b741052db6997b-- From nobody Fri Mar 11 04:51:15 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1863212D6DB for ; Fri, 11 Mar 2016 04:51:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.002 X-Spam-Level: X-Spam-Status: No, score=-1.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, BIGNUM_EMAILS=1, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=isode.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fuHiEd-Aoji8 for ; Fri, 11 Mar 2016 04:51:12 -0800 (PST) Received: from waldorf.isode.com (waldorf.isode.com [62.232.206.188]) by ietfa.amsl.com (Postfix) with ESMTP id 3E72412D6D5 for ; Fri, 11 Mar 2016 04:51:12 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; t=1457700671; d=isode.com; s=selector; i=@isode.com; bh=IUgXzv85N79RAgSCR40Ms6X0FFhhRYLoOGFJQ7T3eCo=; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version: In-Reply-To:References:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description; b=lP/5mmlMDYaTky2mYPtNSXKEzqxuOPqJ+zFr2uGnI0UabGGLXH0YHcH2hjY/+UPTZgClM8 4TNYX7V3XbILUhUysrLkbuGrlH2NAaOpwT8KfAyC/81Ujz6s6nASmMeqSpnO2nb4N5XRVx xwyJMFW+eh154x+bicRZXhZkWFZC8sM=; Received: from [172.20.1.215] (dhcp-215.isode.net [172.20.1.215]) by waldorf.isode.com (submission channel) via TCP with ESMTPSA id ; Fri, 11 Mar 2016 12:51:11 +0000 To: Russ Housley References: <9A043F3CF02CD34C8E74AC1594475C73F4BDB8A8@uxcn10-5.UoA.auckland.ac.nz> <56d70399.8d41620a.19ae8.ffffeb3bSMTPIN_ADDED_MISSING@mx.google.com> <56DF06D4.8040607@isode.com> <6DCB6229-5921-4750-8E6D-C2ACE9C62EA6@vigilsec.com> From: Alexey Melnikov Message-ID: <56E2BF25.9030205@isode.com> Date: Fri, 11 Mar 2016 12:50:45 +0000 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.6.0 In-Reply-To: <6DCB6229-5921-4750-8E6D-C2ACE9C62EA6@vigilsec.com> MIME-Version: 1.0 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Cc: IETF SMIME Subject: Re: [smime] Message takeover attacks against S/MIME X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Mar 2016 12:51:13 -0000 Hi Russ, On 09/03/2016 04:53, Russ Housley wrote: > Alexey: > >>> Anything else? >> It would be good if "Domain-based signing and encryption using S/MIME" >> (draft-melnikov-smime-msa-to-mda-04) can also be included. > Can you summarize the things that you need that are not supported by RFC 3183? > > 3183 Domain Security Services using S/MIME. T. Dean, W. Ottaway. October > 2001. (Format: TXT=57129 bytes) (Status: EXPERIMENTAL) (DOI: > 10.17487/RFC3183) My draft is effectively a revision of RFC 3183: Changes from RFC 3183 Unlike RFC 3183, subject names of domain signing/encrypting X.509 certificates don't have to have a specific form. But Subject Alternative Names need to include URIs for domain being protected. A new signature type was added for the case when MSA signs/encrypts a message on behalf of a user with a user specific key. Incorporated erratum 3757 resolution. Updated references and some minor editorial corrections. From nobody Sat Mar 12 22:36:39 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9C47912D559 for ; Sat, 12 Mar 2016 22:36:37 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.602 X-Spam-Level: X-Spam-Status: No, score=-2.602 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id usXbzGvrQORz for ; Sat, 12 Mar 2016 22:36:36 -0800 (PST) Received: from mxout-08.mxes.net (mxout-08.mxes.net [216.86.168.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EEDD912D96E for ; Sat, 12 Mar 2016 22:36:33 -0800 (PST) Received: from [192.168.123.7] (unknown [75.83.2.34]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by smtp.mxes.net (Postfix) with ESMTPSA id EED25509B6 for ; Sun, 13 Mar 2016 01:36:32 -0500 (EST) To: smime@ietf.org References: <05a801d159ea$51ae6ce0$f50b46a0$@augustcellars.com> From: Sean Leonard Message-ID: <56E50AD3.1040302@seantek.com> Date: Sat, 12 Mar 2016 22:38:11 -0800 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.6.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [smime] Message takeover attacks against S/MIME X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 13 Mar 2016 06:36:37 -0000 On 3/8/2016 7:21 PM, Blake Ramsdell wrote: > On Mon, Feb 1, 2016 at 3:02 PM, Sean Turner wrote: >> I’m willing to help too, but it would be really great if we could identity some folks who work on [insert your favorite mail app with built-in S/MIME support] to also be involved. > I am also willing to help. > > And I agree that we need to do some outreach to get implementers > engaged and participating. I suppose as an implementer who has been engaged and participating, I should volunteer to help as well. So, count me in. If a new cryptographic mode is in-scope (which it is), I believe Version 3.3 is not enough. I am in the Version 3.5 camp, if not the 4.0 camp. Sean From nobody Sun Mar 13 09:38:50 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DCF8E12D661 for ; Sun, 13 Mar 2016 09:38:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FO0utH5iXLda for ; Sun, 13 Mar 2016 09:38:47 -0700 (PDT) Received: from mail-vk0-x233.google.com (mail-vk0-x233.google.com [IPv6:2607:f8b0:400c:c05::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0B07E12D668 for ; Sun, 13 Mar 2016 09:38:47 -0700 (PDT) Received: by mail-vk0-x233.google.com with SMTP id e185so184211151vkb.1 for ; Sun, 13 Mar 2016 09:38:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc; bh=xnj4GRzB2N1pN3/2UE+MbDXLMUrOvbx/IpKpMmfSbi4=; b=oCE4vDeXEPZY8dk6Px/4XS0l1iIybYa+H714CL5s4eBrbcT6Bd0zHCygp2AHuAPxVk kpo9xqKIoM8quYABT5tIk6PfD9pjD+bzR188xkoa8ka5wR1fSTVo6zqZ8dW1U2doHFpM JY4Dy1j+ZkJVYCW2eTy8XN8JOiPDRiJk5rWn7Fjl/4gXWHjnIkDDPVWCx8/k03T6a1sR Q33Qyc7skvjDt5rUxmK70QXPEhHtf+bwuJC3x0OO1vhzx6LJCoA/nFjJVUTUsZrJYoMW YYReCtfbIoLv5LcJlhGtd0JnKJUIhJB8GAzsJu716h++GZT5iLdBLMhikpI1EVTt4QGx VOYQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc; bh=xnj4GRzB2N1pN3/2UE+MbDXLMUrOvbx/IpKpMmfSbi4=; b=BmbD51EI5b0Y/C7yHZZcdGzqA9+ehq76LWt/zWdpaSVKSkqFCdMw1g+9BASybCAOco D+aqzD1X6++hxmFuCb2uEfskiYg6+D6FKnhgowCtAmJbuBc2UcpIgIebU7mSeWrRQ+Qm YW2W1MjW+lpqux3/7UA0cF45aK/DfHC+uEOAceBcdEB4j7iQo9eQiVzVsOgs+RMPP6vs e6Fguk3JfjfgI1p3je8XuXX9hRJCYMFNC5Wv9ZRm+EkzAmbLnuPVsqFH3kbfoH3CeS+t HJNNqUjl9VVADn2Hs+iglF9/48lmCYtZaeZ0dyHARX5hM2TS47wIjUR5rm8G47INgxis fUqw== X-Gm-Message-State: AD7BkJLHw/dhLYnaydesgYD4XnMYuXvuiEF411GXTuzyUbm5kilx9m+YcBBINH08H5ZWIxPei1QiCcIpfbiCIdmF MIME-Version: 1.0 X-Received: by 10.31.11.201 with SMTP id 192mr21088565vkl.135.1457887125880; Sun, 13 Mar 2016 09:38:45 -0700 (PDT) Received: by 10.159.36.179 with HTTP; Sun, 13 Mar 2016 09:38:45 -0700 (PDT) In-Reply-To: References: <9A043F3CF02CD34C8E74AC1594475C73F4BDB8A8@uxcn10-5.UoA.auckland.ac.nz> <56d70399.8d41620a.19ae8.ffffeb3bSMTPIN_ADDED_MISSING@mx.google.com> Date: Sun, 13 Mar 2016 09:38:45 -0700 Message-ID: From: Wei Chuang To: Russ Housley Content-Type: multipart/alternative; boundary=001a11455152432ff1052df0ccd8 Archived-At: Cc: IETF SMIME Subject: Re: [smime] Message takeover attacks against S/MIME X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 13 Mar 2016 16:38:50 -0000 --001a11455152432ff1052df0ccd8 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Some interesting usability consideration were raised on the PKIX list by Martin Rex in the thread "another attempt to canonicalize local parts" that could be addressed by a rechartered WG. He points out problems with - Incompletely specified cert chains preventing signature verification i.e. missing CA certs and no ability to fetch them. Fully specifying the chains would resolve this. - Reverifying old "archived" emails on his MUA not possible as the certs have expired. Fixing a verification time on delivery or other scheme is desirable. -Wei On Thu, Mar 10, 2016 at 11:12 AM, Wei Chuang wrote: > > > On Mon, Mar 7, 2016 at 10:58 PM, Russ Housley > wrote: > >> I am hearing interest in these topics (a combination of things on this >> list and side conversations). >> >> (1) Specify the way to use authenticated encryption in S/MIME. Note that >> it is already done for CMS. >> >> (2) Specify conventions for AES-CCM, AES-GCM, and ChaCha20 with Poly1305 >> authenticated encryption algorithms. >> >> (3) Specify conventions for using Curve25519 and Curve448 for key >> agreement. >> >> (4) Specify conventions for using the CFRG chosen curves for elliptic >> curve digital signature. >> >> (5) Specify a way to use PGP public keys in addition to PKIX certificates. >> >> Anything else? >> > > While I'm afraid of scope creep as resolving the above would be very > useful, could also mail header integrity and privacy be considered? > Perhaps the WG scope be split into near and long term work to help > prioritize. The above five items be categorize as near term and the mail > header work considered longer term? > > -Wei > > (PS yes there is RFC7508 which is experimental, and does not keep private > the sender and recipient. Still it is an improvement...) > > >> >> Is this enough to re-charter the S/MIME WG? >> >> Russ >> _______________________________________________ >> smime mailing list >> smime@ietf.org >> https://www.ietf.org/mailman/listinfo/smime >> > > --001a11455152432ff1052df0ccd8 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit
Some interesting usability consideration were raised on the PKIX list by Martin Rex in the thread "another attempt to canonicalize local parts" that could be addressed by a rechartered WG.  He points out problems with
- Incompletely specified cert chains preventing signature verification i.e. missing CA certs and no ability to fetch them.  Fully specifying the chains would resolve this.
- Reverifying old "archived" emails on his MUA not possible as the certs have expired.  Fixing a verification time on delivery or other scheme is desirable.

-Wei

On Thu, Mar 10, 2016 at 11:12 AM, Wei Chuang <weihaw@google.com> wrote:


On Mon, Mar 7, 2016 at 10:58 PM, Russ Housley <housley@vigilsec.com> wrote:
I am hearing interest in these topics (a combination of things on this list and side conversations).

(1) Specify the way to use authenticated encryption in S/MIME.  Note that it is already done for CMS.

(2) Specify conventions for AES-CCM, AES-GCM, and ChaCha20 with Poly1305 authenticated encryption algorithms.

(3) Specify conventions for using Curve25519 and Curve448 for key agreement.

(4) Specify conventions for using the CFRG chosen curves for elliptic curve digital signature.

(5) Specify a way to use PGP public keys in addition to PKIX certificates.

Anything else?

While I'm afraid of scope creep as resolving the above would be very useful, could also mail header integrity and privacy be considered?  Perhaps the WG scope be split into near and long term work to help prioritize.  The above five items be categorize as near term and the mail header work considered longer term?

-Wei 

(PS yes there is RFC7508 which is experimental, and does not keep private the sender and recipient.  Still it is an improvement...)
 

Is this enough to re-charter the S/MIME WG?

Russ
_______________________________________________
smime mailing list
smime@ietf.org
https://www.ietf.org/mailman/listinfo/smime


--001a11455152432ff1052df0ccd8-- From nobody Tue Mar 15 15:37:03 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9362412D86C for ; Tue, 15 Mar 2016 15:37:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iDZocG_UgvAh for ; Tue, 15 Mar 2016 15:36:59 -0700 (PDT) Received: from mail-vk0-x22e.google.com (mail-vk0-x22e.google.com [IPv6:2607:f8b0:400c:c05::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6612C12D78E for ; Tue, 15 Mar 2016 15:36:58 -0700 (PDT) Received: by mail-vk0-x22e.google.com with SMTP id e185so40141614vkb.1 for ; Tue, 15 Mar 2016 15:36:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc; bh=V4glbA9suePXPYcrMZP27DN+FurqlV0XoB5cGbDd/Ng=; b=DUu1nEXfhhYuV1Irax7mHMSxIg0e+CV2DB5jMaE76MYulpcO5SxIMkI1BvXWZYVXfM AECoji0mpnvf4AqCyCZndR8tdulYHPN275CGMiiqst9bIyO/JSPECCiufBpjInDzb6WF /KwByYJn2eU59+zcD3+Ev9YarEHFb/VaRRKJrQ/gsdopxomeum+paULDhCp2pbp8UK1W r/njcPrvKL0u/C1bUl7sjNkgu/quklRAyxVmjyzT0v0xUIygr1tOaeWSkBNrEo6oPUE9 ooJo5vKcV5rXOBRyeYVLtCn3CIqpyeXvNFEqHjwnwu1jvTXB+yGtYAUO+YkVH+bFfyp8 GgKQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc; bh=V4glbA9suePXPYcrMZP27DN+FurqlV0XoB5cGbDd/Ng=; b=m9pAPpdn65D9h3vjoA56w76aHQP74lSIg8kvpST91KxLddbD9ZTVWKDGvNlvh4l03x cJUKYZFmaT3Io7H1syK8K3FWxeOmokpPdvMVp+mTodJeYE1d3iZRhfOMcYJxhdqOHhQ/ rWE9Jk4eh+G4IGuRSYQRXryPjz77FeTt/yRawZnsrEovhX687OvgeNXx5ja3+dK2JApA ZJDoziKpindOB8CcdEoX85RoNJuNRzNRMiusSx9Iii/7irTy+an3DYLAuiuh4c03lFyv XBhBE6BcTL5eUtw+FKPOtywOOK3SIFlT1MIojUA9y+tG3uKTY1b29KjpExrqMVT0HOsh 2Chg== X-Gm-Message-State: AD7BkJIYNRbYgTesPKLJkfco5eGF6elU2Ik+/RKwvPDlNMW5DBLAkGoxIwfygG/xpUgeujvQ+2b32/BJqKaM+Hlj MIME-Version: 1.0 X-Received: by 10.31.58.193 with SMTP id h184mr572436vka.111.1458081417383; Tue, 15 Mar 2016 15:36:57 -0700 (PDT) Received: by 10.159.36.179 with HTTP; Tue, 15 Mar 2016 15:36:57 -0700 (PDT) In-Reply-To: References: Date: Tue, 15 Mar 2016 15:36:57 -0700 Message-ID: From: Wei Chuang To: John R Levine Content-Type: multipart/alternative; boundary=001a1143ff70f02fe0052e1e080a Archived-At: Cc: ietf-smtp , IETF SMIME Subject: Re: [smime] [ietf-smtp] why you shouldn't even try to canonicalize local parts X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 15 Mar 2016 22:37:01 -0000 --001a1143ff70f02fe0052e1e080a Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit [-PKIX, +SMIME] On Thu, Mar 10, 2016 at 2:01 PM, John R Levine wrote: > Its certainly true that the issuer of a cert using such a regex represented >> name matters greatly now. (I wondered about the same issue in another >> thread) A third party CA is going to have a much harder time >> understanding >> the local practices, and that represents a spoofing risk, though I suspect >> it might be possible to communicate local practices to prevent that. A >> workable scenario is that the certificate issuer is the email domain owner >> who understands intimately the email local practices. >> > > This is almost certainly a blind alley, and it'd help to back up and think > about what problem you're trying to solve. > > It seems to me that even though the same S/MIME certificate is used for > signing and encryption, the two applications are quite different. > > For signing, a random recipient having verified that the signature matches > the message body wants to check that an address in the certificate matches > the sender's address, typically the one on the From: line. In my > experience, even those of us with a zillion inbound addresses don't use all > that many addresses for outbound mail, so it's practical to enumerate them > all in certificates. Or if a sender does want to make an address on the > fly for which it does not yet have a certificate, if the CA is the sender's > domain owner, it should be straightforward invent to ask the CA at that > time for a certificate that matches the the address, and the CA can use > whatever local rules it wants to decide whether the desired address is one > that belongs to the requester and provide one or not. This is extra work, > but in the context of mail submission, it's not an unreasonable amount of > extra work. Another idea in the opposite direction: A local-part fix up might be to use RFC7508 encrypted headers to repair the FROM and SENDER email addresses to their canonical form. -Wei > > For encryption of inbound mail, it doesn't matter what address is in the > certificate; if the recipient can decode the message it's the right one, > otherwise it's not. So the sender can ask the domain's key oracle for a > certficate for the address, the key oracle applies local rules and provides > a certificate that might have the exact requested address, or might have > another address that goes to the same recipient. > > I'd think that something along these lines would not be particularly hard > to implement, and would require semantic changes neither to PKIX nor to > SMTP. > > R's, > John > --001a1143ff70f02fe0052e1e080a Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit
[-PKIX, +SMIME]

On Thu, Mar 10, 2016 at 2:01 PM, John R Levine <johnl@taugh.com> wrote:
Its certainly true that the issuer of a cert using such a regex represented
name matters greatly now.  (I wondered about the same issue in another
thread)  A third party CA is going to have a much harder time understanding
the local practices, and that represents a spoofing risk, though I suspect
it might be possible to communicate local practices to prevent that.  A
workable scenario is that the certificate issuer is the email domain owner
who understands intimately the email local practices.

This is almost certainly a blind alley, and it'd help to back up and think about what problem you're trying to solve.

It seems to me that even though the same S/MIME certificate is used for signing and encryption, the two applications are quite different.

For signing, a random recipient having verified that the signature matches the message body wants to check that an address in the certificate matches the sender's address, typically the one on the From: line.  In my experience, even those of us with a zillion inbound addresses don't use all that many addresses for outbound mail, so it's practical to enumerate them all in certificates.  Or if a sender does want to make an address on the fly for which it does not yet have a certificate, if the CA is the sender's domain owner, it should be straightforward invent to ask the CA at that time for a certificate that matches the the address, and the CA can use whatever local rules it wants to decide whether the desired address is one that belongs to the requester and provide one or not. This is extra work, but in the context of mail submission, it's not an unreasonable amount of extra work.

Another idea in the opposite direction:

A local-part fix up might be to use RFC7508 encrypted headers to repair the FROM and SENDER email addresses to their canonical form. 

-Wei

 

For encryption of inbound mail, it doesn't matter what address is in the certificate; if the recipient can decode the message it's the right one, otherwise it's not.  So the sender can ask the domain's key oracle for a certficate for the address, the key oracle applies local rules and provides a certificate that might have the exact requested address, or might have another address that goes to the same recipient.

I'd think that something along these lines would not be particularly hard to implement, and would require semantic changes neither to PKIX nor to SMTP.

R's,
John

--001a1143ff70f02fe0052e1e080a-- From nobody Tue Mar 15 17:06:11 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 253C012DE6D for ; Tue, 15 Mar 2016 16:28:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1536-bit key) header.d=iecc.com header.b=OSf8kEXj; dkim=pass (1536-bit key) header.d=taugh.com header.b=PP4GhU7r Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v8ApA7mW2Y7n for ; Tue, 15 Mar 2016 16:28:15 -0700 (PDT) Received: from miucha.iecc.com (abusenet-1-pt.tunnel.tserv4.nyc4.ipv6.he.net [IPv6:2001:470:1f06:1126::2]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 105BF12DE6E for ; Tue, 15 Mar 2016 16:28:12 -0700 (PDT) Received: (qmail 28107 invoked from network); 15 Mar 2016 23:28:12 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=6dca.56e89a8c.k1603; bh=GkXPkPaLyPPoBOV8+4ndV9hM4lmcSpJt0PR1kZBzRmc=; b=OSf8kEXjWH9W9rFoV8+8T7TOPTE7ukvvuL08azMumJw6TNaxGowMxLXFyIeorf7F/3KnSpt4iLtOLNej6DXPN60KBvYHSjWnVlozA6XvZ2WTShrqr/B7hstH8j5R4Fv1FFLaFfKMi0PUQy12TGEUWTqJRqVRuiBWlX4TfBVDLk6imHxOwzN02poEVuIja3mKJXQfyHP70PVEwqg8qsAO2bWGWT02RrzMfQDujOe5VhUQOaSohAPcp/Z8MiUfnjcQ DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=6dca.56e89a8c.k1603; bh=GkXPkPaLyPPoBOV8+4ndV9hM4lmcSpJt0PR1kZBzRmc=; b=PP4GhU7rbcvYopDQBizMSuPPCv4zkqIyDuNJhDEM8UwuJsm1yGB+cqb2FLImwE5yOiDvr9DX+hGwJFxEsDNcSDuythmHXQdO6xEGrssUnOGRuy3d0K3UGRd0wVS9Lm69xu7Bm6TLiZGR/TAD78re7A+1kTjT96r+4debf3inAjPBHM8WoYmbTf32SCysP+VJGD0183o8k/kZftid8HJpfcFGDwF6Mi7Xz74iScHLi2DenBFKbYNJXhUSicSh1snw Received: from localhost ([IPv6:2001:470:1f07:1126::78:696d:6170]) by imap.iecc.com ([IPv6:2001:470:1f07:1126::78:696d:6170]) with ESMTPS (TLS1.0/X.509/SHA1) via TCP6; 15 Mar 2016 23:28:12 -0000 Date: 15 Mar 2016 19:28:11 -0400 Message-ID: From: "John R Levine" To: "Wei Chuang" In-Reply-To: References: User-Agent: Alpine 2.11 (OSX 23 2013-08-11) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Archived-At: X-Mailman-Approved-At: Tue, 15 Mar 2016 17:06:11 -0700 Cc: ietf-smtp , IETF SMIME Subject: Re: [smime] [ietf-smtp] why you shouldn't even try to canonicalize local parts X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 15 Mar 2016 23:28:16 -0000 > Another idea in the opposite direction: > > A local-part fix up might be to use RFC7508 encrypted headers to repair the > FROM and SENDER email addresses to their canonical form. If you mean the canonicalization rules in section 4.3, they're borrowed from DKIM and only change white space. It also references RFC 5750 which says that Receiving agents MUST check that the address in the From or Sender header of a mail message matches an Internet mail address, if present, in the signer's certificate, if mail addresses are present in the certificate. but it doesn't say what "matches" means. R's, John From nobody Wed Mar 16 07:45:39 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A92F812D989 for ; Wed, 16 Mar 2016 07:45:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rHCXdICkxznD for ; Wed, 16 Mar 2016 07:45:35 -0700 (PDT) Received: from mail-vk0-x22d.google.com (mail-vk0-x22d.google.com [IPv6:2607:f8b0:400c:c05::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7591D12D97D for ; Wed, 16 Mar 2016 07:45:35 -0700 (PDT) Received: by mail-vk0-x22d.google.com with SMTP id e185so64379815vkb.1 for ; Wed, 16 Mar 2016 07:45:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc; bh=B/eU6o+TcdRJCY5rZYBtrvi9f8LnvD7UafaOWrxOP3U=; b=nXgnTkwx6Xc7HAf4xXOJ3N7vsel7FWBOJQBsY+2QL29E/D+L3qO16OpDkHryCpJRnr ThCN4lXaNmhqqzu0QCy50EheGKdzivZI5SkTT6QzEiQLKNYf1bHlP9j+e6C+Mg3hkibQ W8xO164ym5KdA9uwJYnRnnXvYc7bXCNRU/pG384mxEDFG77NNyG7Arf3Xxq/z3F+lZmM 6q93u/btwYFmP5o6suqkusHQo38B6ofX7jfvPpVMQWlGq8HhoJZfh6sBvtOrQ2Lo3z1D 9Kfq+ke9/dNL8+1WmQ+XMWjzYUVGONqzjjKXbZSBrKZP60cUFAnZkcsgj8m4mtWQO0gg j8Uw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc; bh=B/eU6o+TcdRJCY5rZYBtrvi9f8LnvD7UafaOWrxOP3U=; b=B8MtcLnFK6+hHtloyfi0Jg50JJN9Pble396vh2eTqR6nsoCkTAxifoYqQA1XyVQFZT zLzk75+tp3S/cm7VJTSiGXkrUNJ5g6hR6Ggbo+FGrE51Yu4/UoLdgdLOMTwRp+ddkwZ0 eU49s9AT0cDZVWJ68JrKa0Sd6Jjs9OAVoWSAHsJ2C97PDjT9Fupu/m1/yJMvqlgkWEim AKjPo6pzJ7eIjMEsMyoAp3oktwoLMDpUXYuEV0nLcCVMN8cZ35mHZ45IMtTPDQONtrC0 Sp83yUYszRZ98D0xpdgnz7k+nl7qUe58drgY3bto08oMedtNqi3S9FUAV8kOu2W9mFvC z9+w== X-Gm-Message-State: AD7BkJI1y4YAhpFm37XWLMA0qmtzgjIpYG0ob553iXE/z4Co4BEgwcHEmfxq+HPy+dP5klf3ffgbOXlDWlDWNnPM MIME-Version: 1.0 X-Received: by 10.31.137.11 with SMTP id l11mr4407977vkd.98.1458139534369; Wed, 16 Mar 2016 07:45:34 -0700 (PDT) Received: by 10.159.36.179 with HTTP; Wed, 16 Mar 2016 07:45:34 -0700 (PDT) In-Reply-To: References: Date: Wed, 16 Mar 2016 07:45:34 -0700 Message-ID: From: Wei Chuang To: John R Levine Content-Type: multipart/alternative; boundary=001a11441386faf881052e2b90c8 Archived-At: Cc: ietf-smtp , IETF SMIME Subject: Re: [smime] [ietf-smtp] why you shouldn't even try to canonicalize local parts X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Mar 2016 14:45:37 -0000 --001a11441386faf881052e2b90c8 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On Tue, Mar 15, 2016 at 4:28 PM, John R Levine wrote: > Another idea in the opposite direction: >> >> A local-part fix up might be to use RFC7508 encrypted headers to repair >> the >> FROM and SENDER email addresses to their canonical form. >> > > If you mean the canonicalization rules in section 4.3, they're borrowed > from DKIM and only change white space. Actually I meant using the encrypt and decrypt functionality of RFC7508 4.6.1 and 4.6.2 to replace the FROM and SENDER headers contents which are used for transport with the presented values to be verified and presented to the recipient. In those sections, the two headers when present are treated as status modified and replaced with new values. It also references RFC 5750 which says that > > Receiving agents MUST check that the address in the > From or Sender header of a mail message matches an Internet mail > address, if present, in the signer's certificate, if mail addresses > are present in the certificate. > > but it doesn't say what "matches" means. > It probably would be risky for the validator which often is remote from to the sender's domain and unfamiliar with their SMTP processing policies to fix anything up (excepting IDNA) during comparison without some sort of instruction from the sender. -Wei > R's, > John > > > _______________________________________________ > ietf-smtp mailing list > ietf-smtp@ietf.org > https://www.ietf.org/mailman/listinfo/ietf-smtp > --001a11441386faf881052e2b90c8 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit


On Tue, Mar 15, 2016 at 4:28 PM, John R Levine <johnl@taugh.com> wrote:
Another idea in the opposite direction:

A local-part fix up might be to use RFC7508 encrypted headers to repair the
FROM and SENDER email addresses to their canonical form.

 If you mean the canonicalization rules in section 4.3, they're borrowed from DKIM and only change white space. 

Actually I meant using the encrypt and decrypt functionality of RFC7508 4.6.1 and 4.6.2 to replace the FROM and SENDER headers contents which are used for transport with the presented values to be verified and presented to the recipient.  In those sections, the two headers when present are treated as status modified and replaced with new values.

It also references RFC 5750 which says that

      Receiving agents MUST check that the address in the
   From or Sender header of a mail message matches an Internet mail
   address, if present, in the signer's certificate, if mail addresses
   are present in the certificate.

but it doesn't say what "matches" means.

It probably would be risky for the validator which often is remote from to the sender's domain and unfamiliar with their SMTP processing policies to fix anything up (excepting IDNA) during comparison without some sort of instruction from the sender. 

-Wei


R's,
John


_______________________________________________
ietf-smtp mailing list
ietf-smtp@ietf.org
https://www.ietf.org/mailman/listinfo/ietf-smtp

--001a11441386faf881052e2b90c8-- From nobody Tue Mar 22 11:42:09 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9E3A612D7D8 for ; Tue, 22 Mar 2016 11:42:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eJHcJvpbrOS1 for ; Tue, 22 Mar 2016 11:42:03 -0700 (PDT) Received: from mail-vk0-x236.google.com (mail-vk0-x236.google.com [IPv6:2607:f8b0:400c:c05::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 846EB12D7A7 for ; Tue, 22 Mar 2016 11:42:03 -0700 (PDT) Received: by mail-vk0-x236.google.com with SMTP id k1so266517408vkb.0 for ; Tue, 22 Mar 2016 11:42:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:date:message-id:subject:from:to:cc; bh=swuUsH7pqJ7zZMBfgxLrdrcTk3ICOgqZsS7GI/sN9sk=; b=dHkvJXLMeqbmxHx0O+ru4VrepOKkdIz+I9GBXJv+mh2331dwLixN30wRptRT4Q/CHd Klqy0zAbmuz4dU1o97HqE1CKFeJgbRSCyRQM6XqAKYVKm1TYbGn0y+RQX9F1UsAHLWry mICOfteIhkaimRM/jRFG1dd2nEAIkz9PzNDHvfm2TIw2rqYbtu+8lsj4a5IjQkBwssGo nqhmslzPS/4voWXAPnJdQW9iY+LoAtYuiI7FnoX3UrksJvg5vv5Ah7+C4YHj5/BiQjxH JErX/PtGyCVuwQ7g4qkM16H10xPhgT3wiHvJW/dP9DWFX94kFVYY00oeFACuJqZ4Uoa7 22Lw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:date:message-id:subject:from:to:cc; bh=swuUsH7pqJ7zZMBfgxLrdrcTk3ICOgqZsS7GI/sN9sk=; b=VCf0xP/NB99Sro9t0rXNMp+UaskduwISdf41TBcq84ov1MrGEjGrvWhvPjdcD9pMvv RHOZ0K1angk6I28AgaRVMvYy7+datIDv+fXXEl/MmWhmd+WlJuCnauDwEpyiGGAIlc4z 59SUQuOkW9zDF5+eyCpoGrScKa/L+HjRfB0mvQN+xQHQrozuBveF1b0lL+vsXlExgASo ZO6hRPIBRGAlJ7QoJAUczAtnVY4sPr+0btgjiggMAWSIVmYM97yf09odh+17vggHAGNy JCm9Ssg3HORuhZmKlzxFYy70m+sZxgWQRyYfQ2a0/wAWlWHhajXqBLZxTovL4cfIoxcP emxA== X-Gm-Message-State: AD7BkJJQKI7yIm0sSm1oEzJ6/Pt5Isc5y5hKLJfwHBvEASS/P8I5Qkz+LBEyEPzo7HtCUBgeQi2zDg9VD2iO+JCE MIME-Version: 1.0 X-Received: by 10.159.39.169 with SMTP id b38mr4610275uab.69.1458672122373; Tue, 22 Mar 2016 11:42:02 -0700 (PDT) Received: by 10.159.36.179 with HTTP; Tue, 22 Mar 2016 11:42:02 -0700 (PDT) Date: Tue, 22 Mar 2016 11:42:02 -0700 Message-ID: From: Wei Chuang To: John Levine , Brian Haberman Content-Type: multipart/alternative; boundary=94eb2c123364b32639052ea791ca Archived-At: Cc: PKIX , IETF SMIME Subject: [smime] Key lookup service via draft-bhjl-x509-srv-00 X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Mar 2016 18:42:06 -0000 --94eb2c123364b32639052ea791ca Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit (was from: why you shouldn't even try to canonicalize local parts) On Sun, Mar 13, 2016 at 1:25 PM, John Levine wrote: > > > If you're going to do local signing, the reasonable way to publish the > signing cert is with DNSSEC as I suggest in draft-bhjl-x509-srv-00 > section 5. > I think this draft (draft-bhjl-x509-srv-00 ) very usefully defines a means to lookup certificates for S/MIME users, and wonder if we could discuss this. As far as I can tell it hasn't been discussed else where. I also don't know if there are other similar proposals, and if a comparison between this and other approaches has been done. This or some other key lookup service would be very helpful in enabling email message based encryption/authentication. The draft proposes a new DNS SRV record that defines a URL to lookup certificate (both PKIX and PGP) over HTTPS for email. As a key lookup service this proposal resolves the barrier of an initial key lookup i.e. given an email address for a person the sender has never corresponded with, can provide a means to get their certificate. Currently initial conversations must happen in cleartext until the certificates are exchanged. Also as the author points out, this service can also provides a means to potentially resolve potentially different email addresses for the same user i.e. resolving capitalization differences or addresses with subaddressing. The draft proposes using DNSSEC to authenticates and protects the integrity of the the SRV record. The draft is pretty complete but some of the description could be expanded. It doesn't define define behavior when the certificate is missing or invalid. Presumably some sort of HTTP error code? What should be the response when the key server is aware that the certificate has been revoked, and there is no replacement? The draft specifies that if multiple certificates are returned, that they are embedded in a mime/multipart format. It may be useful to always return in this format even for a single certificate. The multipart format likely was to allow for multiple entity certificates to be returned. In another discussion it was mentioned providing the full certificate chain to the trust anchor certificate would be very helpful for interoperability as not everyone may have access to the CA certificates. Providing further structure via content-description could allow for embedding full chains with multiple entity certificates. The set of related things outside the main scope of the draft. A tricky problem with key lookup has been privacy. The worry is that spammers or phishers would try to use such a key discovery service to find more victims. Understandably the authors may want to keep the scope narrow but ideas would certainly be welcome. Another worry is that the security of this proposal is based on DNSSEC which is only very slowly being deployed and many clients may not be able to interoperate with that. One purely PKIX based trust solution may be to adapt the mechanism that Margolis used in draft-margolis-smtp-sts-00 to mirror the SRV record on an HTTPS served page as an intermediate step. -Wei --94eb2c123364b32639052ea791ca Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit
(was from: why you shouldn't even try to canonicalize local parts)

On Sun, Mar 13, 2016 at 1:25 PM, John Levine <johnl@taugh.com> wrote:

If you're going to do local signing, the reasonable way to publish the
signing cert is with DNSSEC as I suggest in draft-bhjl-x509-srv-00
section 5.  

I think this draft (draft-bhjl-x509-srv-00) very usefully defines a means to lookup certificates for S/MIME users, and wonder if we could discuss this.  As far as I can tell it hasn't been discussed else where.  I also don't know if there are other similar proposals, and if a comparison between this and other approaches has been done.  This or some other key lookup service would be very helpful in enabling email message based encryption/authentication.

The draft proposes a new DNS SRV record that defines a URL to lookup certificate (both PKIX and PGP) over HTTPS for email.  As a key lookup service this proposal resolves the barrier of an initial key lookup i.e. given an email address for a person the sender has never corresponded with, can provide a means to get their certificate.  Currently initial conversations must happen in cleartext until the certificates are exchanged.  Also as the author points out, this service can also provides a means to potentially resolve potentially different email addresses for the same user i.e. resolving capitalization differences or addresses with subaddressing.  The draft proposes using DNSSEC to  authenticates and protects the integrity of the the SRV record.

The draft is pretty complete but some of the description could be expanded.  It doesn't define define behavior when the certificate is missing or invalid.  Presumably some sort of HTTP error code?  What should be the response when the key server is aware that the certificate has been revoked, and there is no replacement?  The draft specifies that if multiple certificates are returned, that they are embedded in a mime/multipart format.  It may be useful to always return in this format even for a single certificate.  The multipart format likely was to allow for multiple entity certificates to be returned.  In another discussion it was mentioned providing the full certificate chain to the trust anchor certificate would be very helpful for interoperability as not everyone may have access to the CA certificates.  Providing further structure via content-description could allow for embedding full chains with multiple entity certificates.

The set of related things outside the main scope of the draft.  A tricky problem with key lookup has been privacy.  The worry is that spammers or phishers would try to use such a key discovery service to find more victims.  Understandably the authors may want to keep the scope narrow but ideas would certainly be welcome.  Another worry is that the security of this proposal is based on DNSSEC which is only very slowly being deployed and many clients may not be able to interoperate with that.  One purely PKIX based trust solution may be to adapt the mechanism that Margolis used in draft-margolis-smtp-sts-00 to mirror the SRV record on an HTTPS served page as an intermediate step.

-Wei

--94eb2c123364b32639052ea791ca-- From nobody Tue Mar 22 13:38:26 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B50A112D61E for ; Tue, 22 Mar 2016 13:38:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1536-bit key) header.d=iecc.com header.b=PO9KTf5j; dkim=pass (1536-bit key) header.d=taugh.com header.b=ZCwAzWDw Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T28lOvPzCMsk for ; Tue, 22 Mar 2016 13:38:20 -0700 (PDT) Received: from miucha.iecc.com (abusenet-1-pt.tunnel.tserv4.nyc4.ipv6.he.net [IPv6:2001:470:1f06:1126::2]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3721312D787 for ; Tue, 22 Mar 2016 13:38:20 -0700 (PDT) Received: (qmail 76450 invoked from network); 22 Mar 2016 20:38:19 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=12aa0.56f1ad3b.k1603; bh=GAiwdftYb52fJW9yIpqJKWHFmI9ckRyJ4ZkUPLmlFVI=; b=PO9KTf5jwC9GLCX1h2ne3vNSq+VwhU2oYg0yYuSp+0GugSB/iVSwEb5ZK6A0MjN/I73LUSMg55xncATmyZppVFMiRtaEfNwGScRpCzqs0d32MqLAD/gy96SPhKszXk+RpBKKgVM9bY6sQfcczxhs82CuKt8W1JDy29UOIyzvRQhaLGFOyM5pZUNqOLBzHMS+XGtaL8sFD3Sc6ISo1qYsHGwYRfqiHcSKMGcKf/BB4EY6FDQGyWj+ozsIHvZEjI69 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=12aa0.56f1ad3b.k1603; bh=GAiwdftYb52fJW9yIpqJKWHFmI9ckRyJ4ZkUPLmlFVI=; b=ZCwAzWDw1RnksOlnidy3vovNC67uYcs9rA/8/9YCvs2R/sI8O0WudgsRC3XQ5Azi555k/wt/NTx/OufTSLPo8vMUl7TTXSdJbbS+ZZNPuv27vjmHkaa3+zIggWZzg9eOb9XbfNmdfAGsPmyS/BmkFRBI9T4XYvR9OM4c2MN162J7KI3gwvmVK0DwTm8Ugj2M4AdQmRMfXvg9G76JlxuuHK/wgVG/KjIt1yNgZ22T+OciVCrI79LPCxwp6vJusrpE Received: from localhost ([IPv6:2001:470:1f07:1126::78:696d:6170]) by imap.iecc.com ([IPv6:2001:470:1f07:1126::78:696d:6170]) with ESMTPS (TLS1.0/X.509/SHA1) via TCP6; 22 Mar 2016 20:38:18 -0000 Date: 22 Mar 2016 16:38:18 -0400 Message-ID: From: "John R Levine" To: "Wei Chuang" In-Reply-To: References: User-Agent: Alpine 2.11 (OSX 23 2013-08-11) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Archived-At: Cc: PKIX , Brian Haberman , IETF SMIME Subject: Re: [smime] Key lookup service via draft-bhjl-x509-srv-00 X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Mar 2016 20:38:23 -0000 > I think this draft (draft-bhjl-x509-srv-00 > ) very usefully defines > a means to lookup certificates for S/MIME users, and wonder if we could > discuss this. As far as I can tell it hasn't been discussed else where. We offered it to DANE, but it appears that DANE is rapidly winding down so PKIX seems as good a place as any. > I also don't know if there are other similar proposals, and if a comparison > between this and other approaches has been done. This or some other key > lookup service would be very helpful in enabling email message based > encryption/authentication. > The draft proposes a new DNS SRV record that defines a URL to lookup > certificate (both PKIX and PGP) over HTTPS for email. Actually, they're not new, all straight out of RFC 4387. This draft is mostly a profile of 4387, which offers multiple ways to do stuff, choosing one option from each set so it's easier to interoperate. > The draft is pretty complete but some of the description could be > expanded. It doesn't define define behavior when the certificate is > missing or invalid. Presumably some sort of HTTP error code? RFC 4387 says to use normal http error codes. If there's no such certificate that would be the familiar 404 code. I suppose we could say that but I'd prefer not to repeat material from other specs. > What should be the response when the key server is aware that the > certificate has been revoked, and there is no replacement? I'd think it's 404, no cert for you, or maybe 410 Gone. > The set of related things outside the main scope of the draft. A tricky > problem with key lookup has been privacy. The worry is that spammers or > phishers would try to use such a key discovery service to find more > victims. Having been in the mail business for decades, I'm not worried about it. Bad guys already have more addresses than they know what to do with, and there are easier ways to scrape addresses than guessing one address per URL. We've had PGP key servers forever and bad guys don't seem to find them attractive. > Another worry is that the security of this proposal is based on DNSSEC > which is only very slowly being deployed and many clients may not be > able to interoperate with that. Not really. The keys deliberately are *not* automatically authoritative so it's not a privacy crisis if someone inserts a fake server. Clients need to apply local policy to decide whether to trust them, just like you would for keys from traditional PGP key servers or anywhere else. The only thing that depends on DNSSEC for trust is the new option for a domain to publish a S/MIME signing key for its users' keys. Lacking DNSSEC, the traditional CA PKI is still there. R's, John From nobody Wed Mar 23 11:26:59 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 11BF912D64E for ; Wed, 23 Mar 2016 11:26:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.71 X-Spam-Level: X-Spam-Status: No, score=-2.71 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hEzEQLXkLB3E for ; Wed, 23 Mar 2016 11:26:53 -0700 (PDT) Received: from mail-vk0-x22f.google.com (mail-vk0-x22f.google.com [IPv6:2607:f8b0:400c:c05::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1918212D52B for ; Wed, 23 Mar 2016 11:26:53 -0700 (PDT) Received: by mail-vk0-x22f.google.com with SMTP id e6so30125688vkh.2 for ; Wed, 23 Mar 2016 11:26:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc; bh=Gwl9EFwT3E03WxkGZT81eSoby4KM3kw/KNtGPLr3GNQ=; b=eKR16OAb6T1UQm9PnGG/vKZNf0WMCeM5tWxjz72mItfMOpMy7SCs1iC2KTgo1jQ6x2 0fevI8evvOyhAOZ2rYZe5BrAo2tp6UmQFQx4eDRI0B3PGeFPjN4DlL7lUMlIHmsOE/XT vHm36XY4wOAUv77UUQLcWccE+LExYmZAmSx3dl5onhmA5JSMwmBlP1oDiiTTTqfyMrZf 60Sr6bCKSyT8jUAXf//hs7u3I0x4ObNXcSQiGNWORNyGYSe5wIsJ7e6p4PCY/cl9O0xa J5wU1cN0yNMuKxqMOUYHgCxZH1QBxc7rWGkGIXF2/SWpupIdjo2y1RZJPm4H45lIN0xB lS5g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc; bh=Gwl9EFwT3E03WxkGZT81eSoby4KM3kw/KNtGPLr3GNQ=; b=A4FhhOue30ZLzMoClVq6Mirmgdwx4FGALwN1xjtIg42NA/mQ4CYU5zBVFhrZhiluiR gzjKZ3iKqrpBvXmuSsKV8K94k0GELovSSVugV4wxOcpMPlZ/ChvwQVoQw9vGThBAVA2H JgTzDws9khQRu+Epj4far9CX40DTzPv90g13CWQgvxyzhCUYdJ0qL+yaGmZZ9vlO/2Vv BY6sdYHvvC5K/hD9184sMfpCChl+AuxWzTCRHdThRos1Uo5AU5vr8pSdsvrhTRqDY4lp cZoOmPqyKBdNunnlTyUSfPP2ljf4DU/dzyEaxIv83kx0eRtrX0c8bm4oLJuPkadldIXu GSfA== X-Gm-Message-State: AD7BkJKITPloOoQh5xU+ygmxX6oVZvkfAWw3C8r6iS7qM/2nMyB1jChk6pek/S/2tYpn2yYFzyA58RHg3FydFhot MIME-Version: 1.0 X-Received: by 10.159.38.85 with SMTP id 79mr2249518uag.45.1458757612105; Wed, 23 Mar 2016 11:26:52 -0700 (PDT) Received: by 10.159.36.179 with HTTP; Wed, 23 Mar 2016 11:26:52 -0700 (PDT) In-Reply-To: References: Date: Wed, 23 Mar 2016 11:26:52 -0700 Message-ID: From: Wei Chuang To: John R Levine Content-Type: multipart/alternative; boundary=001a113d1a8c48ba99052ebb79e5 Archived-At: Cc: PKIX , Brian Haberman , IETF SMIME Subject: Re: [smime] Key lookup service via draft-bhjl-x509-srv-00 X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Mar 2016 18:26:56 -0000 --001a113d1a8c48ba99052ebb79e5 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Thanks for the explanation. On Tue, Mar 22, 2016 at 1:38 PM, John R Levine wrote: > I think this draft (draft-bhjl-x509-srv-00 >> ) very usefully >> defines >> a means to lookup certificates for S/MIME users, and wonder if we could >> discuss this. As far as I can tell it hasn't been discussed else where. >> > > > > Another worry is that the security of this proposal is based on DNSSEC >> which is only very slowly being deployed and many clients may not be able >> to interoperate with that. >> > > Not really. The keys deliberately are *not* automatically authoritative > so it's not a privacy crisis if someone inserts a fake server. Clients > need to apply local policy to decide whether to trust them, just like you > would for keys from traditional PGP key servers or anywhere else. I think the benefits of an authoritative server out weighs the worries that you suggest. In the web world, its been very helpful to be certain what one should chain up via browser certificate pinning or HPKP. A whole host of malfeasance was found this way. Even in the limited use that S/MIME has today, in government and defense, its likely to be very useful. > The only thing that depends on DNSSEC for trust is the new option for a > domain to publish a S/MIME signing key for its users' keys. Lacking > DNSSEC, the traditional CA PKI is still there. > > There some risk in authenticating via email CA PKI. What use of S/MIME there is suggests a fair amount of domain private issued or self issued certificates and consequently S/MIME MUAs often make it easy to add these private trust anchors. Due to human factors that we've often read about, its would not be difficult to convince users to accept a fraudulent certificate and trust anchor, and thereby lessens the strength of email CA PKI and its ability to effectively distinguish a fake key server. -Wei > R's, > John > --001a113d1a8c48ba99052ebb79e5 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit
Thanks for the explanation. 

On Tue, Mar 22, 2016 at 1:38 PM, John R Levine <johnl@taugh.com> wrote:
I think this draft (draft-bhjl-x509-srv-00
<https://tools.ietf.org/html/draft-bhjl-x509-srv-00>) very usefully defines
a means to lookup certificates for S/MIME users, and wonder if we could
discuss this.  As far as I can tell it hasn't been discussed else where.



Another worry is that the security of this proposal is based on DNSSEC which is only very slowly being deployed and many clients may not be able to interoperate with that.

 Not really.  The keys deliberately are *not* automatically authoritative so it's not a privacy crisis if someone inserts a fake server.  Clients need to apply local policy to decide whether to trust them, just like you would for keys from traditional PGP key servers or anywhere else.

I think the benefits of an authoritative server out weighs the worries that you suggest.  In the web world, its been very helpful to be certain what one should chain up via browser certificate pinning or HPKP.  A whole host of malfeasance was found this way.  Even in the limited use that S/MIME has today, in government and defense, its likely to be very useful.


The only thing that depends on DNSSEC for trust is the new option for a domain to publish a S/MIME signing key for its users' keys.  Lacking DNSSEC, the traditional CA PKI is still there.


There some risk in authenticating via email CA PKI.   What use of S/MIME there is suggests a fair amount of domain private issued or self issued certificates and consequently S/MIME MUAs often make it easy to add these private trust anchors.  Due to human factors that we've often read about, its would not be difficult to convince users to accept a fraudulent certificate and trust anchor, and thereby lessens the strength of email CA PKI and its ability to effectively distinguish a fake key server.  

-Wei

 
R's,
John

--001a113d1a8c48ba99052ebb79e5-- From nobody Wed Mar 23 11:33:16 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 87AAF12D6BF for ; Wed, 23 Mar 2016 11:33:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1536-bit key) header.d=iecc.com header.b=ueqIpyNG; dkim=pass (1536-bit key) header.d=taugh.com header.b=NutPI1ad Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fNl5Wa_glMhV for ; Wed, 23 Mar 2016 11:33:14 -0700 (PDT) Received: from miucha.iecc.com (abusenet-1-pt.tunnel.tserv4.nyc4.ipv6.he.net [IPv6:2001:470:1f06:1126::2]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C16EB12D70D for ; Wed, 23 Mar 2016 11:33:13 -0700 (PDT) Received: (qmail 45846 invoked from network); 23 Mar 2016 18:33:12 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=b314.56f2e168.k1603; bh=/m8AjkAFqK36CmUEmnlwFRGMabbxNxm+wpqUtKbGxOk=; b=ueqIpyNGlIBUkqS7v/P4FmFquVVfjo4/MxbrFq3u1TF3XXhGgAKBy1cNuQ0TSk1hulth9G49TcPMi1hS9RzzoR284v+8FcGpXVqDwTWsGRbl31XP/D9wUszSKl9Yxd7FGszQZJHzLvKSagtShdq8mM6BJ0PBHBv25lOaWJxGxRPFZ++g2/4DtpYnVyMCAFwoKyH8dzhbrqDaDbNvSnQ6zi+d3wTCFFRSM7nkvx15vm+XAiaMG6S911OyindM9I6q DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=b314.56f2e168.k1603; bh=/m8AjkAFqK36CmUEmnlwFRGMabbxNxm+wpqUtKbGxOk=; b=NutPI1adN6aSs0QiYrdJoFmBz+qI88e7g2jT1mGyFjo/xba1psNYRBTfqPeNjvgQ0IJEDu2CaOhcGzhEBERfw+cwzJKooRIyQENvavNBEi6mh+eBx8FOB7YQjU5pQu7VM3DL/YAVNj3Qk59oA6N3uolAt+Rnw+CrkdDyyNrStgEHBX5lofomGby6cFVjnvFWeFQaOorcy4Kr9m3IXNEyDMeYT/adZDtmm/Y7J8mz6PBdb2SI0UTaNFtAI0Ubij5f Received: from localhost ([IPv6:2001:470:1f07:1126::78:696d:6170]) by imap.iecc.com ([IPv6:2001:470:1f07:1126::78:696d:6170]) with ESMTPS (TLS1.0/X.509/SHA1) via TCP6; 23 Mar 2016 18:33:12 -0000 Date: 23 Mar 2016 14:33:12 -0400 Message-ID: From: "John R Levine" To: "Wei Chuang" In-Reply-To: References: User-Agent: Alpine 2.11 (OSX 23 2013-08-11) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Archived-At: Cc: PKIX , Brian Haberman , IETF SMIME Subject: Re: [smime] Key lookup service via draft-bhjl-x509-srv-00 X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Mar 2016 18:33:15 -0000 > I think the benefits of an authoritative server out weighs the worries that > you suggest. In the web world, its been very helpful to be certain what > one should chain up via browser certificate pinning or HPKP. A whole host > of malfeasance was found this way. Even in the limited use that S/MIME has > today, in government and defense, its likely to be very useful. >> The only thing that depends on DNSSEC for trust is the new option for a >> domain to publish a S/MIME signing key for its users' keys. Lacking >> DNSSEC, the traditional CA PKI is still there. If the WG thinks the domain's key should be authoritative, that'd be fine with me. We didn't want to make any unilateral changes to the trust model without it being clear that it's a change and that there's consensus behind it. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY Please consider the environment before reading this e-mail. From nobody Wed Mar 23 13:00:25 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 55FF812D7DE; Wed, 23 Mar 2016 13:00:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.21 X-Spam-Level: X-Spam-Status: No, score=-4.21 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mitre.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bR0G2pKhr2u4; Wed, 23 Mar 2016 13:00:22 -0700 (PDT) Received: from smtpvmsrv1.mitre.org (smtpvmsrv1.mitre.org [192.52.194.136]) by ietfa.amsl.com (Postfix) with ESMTP id D81C612D891; Wed, 23 Mar 2016 13:00:12 -0700 (PDT) Received: from smtpvmsrv1.mitre.org (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with SMTP id 7F6436C0167; Wed, 23 Mar 2016 16:00:12 -0400 (EDT) Received: from imshyb02.MITRE.ORG (imshyb02.mitre.org [129.83.29.3]) by smtpvmsrv1.mitre.org (Postfix) with ESMTP id 6D2526C0BDE; Wed, 23 Mar 2016 16:00:12 -0400 (EDT) Received: from imshyb01.MITRE.ORG (129.83.29.2) by imshyb02.MITRE.ORG (129.83.29.3) with Microsoft SMTP Server (TLS) id 15.0.1130.7; Wed, 23 Mar 2016 16:00:12 -0400 Received: from gcc01-CY1-obe.outbound.protection.outlook.com (10.140.19.249) by imshyb01.MITRE.ORG (129.83.29.2) with Microsoft SMTP Server (TLS) id 15.0.1130.7 via Frontend Transport; Wed, 23 Mar 2016 16:00:11 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mitre.onmicrosoft.com; s=selector1-mitre-org; h=From:To:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=RF+nkEUgUxWl4mgs43bbcBXqlRKbgprngH3X7VlYv+U=; b=LoW227zfkz6J5siJkavIxMOvOnB9mWNk4aWSbffC1aAogL0Pn1+76X/Bu2uJDzHxzsP25EfSrGael2SzFQyf9y5JZ7au0gR02kTLRcYDtK9v1WgHdgaHrNYhH04W7VjTB4SsgRPbqa5Wvs2nLCutsC30iDw3xOY/Qjf1vgkDso0= Received: from BY1PR09MB0920.namprd09.prod.outlook.com (10.162.144.157) by BY1PR09MB0920.namprd09.prod.outlook.com (10.162.144.157) with Microsoft SMTP Server (TLS) id 15.1.434.16; Wed, 23 Mar 2016 20:00:10 +0000 Received: from BY1PR09MB0920.namprd09.prod.outlook.com ([10.162.144.157]) by BY1PR09MB0920.namprd09.prod.outlook.com ([10.162.144.157]) with mapi id 15.01.0434.019; Wed, 23 Mar 2016 20:00:10 +0000 From: "Miller, Timothy J." To: John R Levine , Wei Chuang Thread-Topic: [smime] Key lookup service via draft-bhjl-x509-srv-00 Thread-Index: AQHRhTGmh22EPby4TE+kk5RKeaJMBp9nWoUA///EeQA= Date: Wed, 23 Mar 2016 20:00:09 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/0.0.0.160212 authentication-results: taugh.com; dkim=none (message not signed) header.d=none;taugh.com; dmarc=none action=none header.from=mitre.org; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [192.80.55.87] x-ms-office365-filtering-correlation-id: 349701db-b6cb-4a67-7710-08d35355bd28 x-microsoft-exchange-diagnostics: 1; BY1PR09MB0920; 5:Tx98D8Cf7UnvyOjze0Iyoy0yFVyw9udYmtKJUWz90f9Og/6FwgouxD2Pro4VajokrZLNC3J/2zjnpEICl1BbWs2/NrftRQfWB+HsygpACn/L/tDZJc1N6v/GMlSiR+d5uXFWHpRGwYLu8rbELb3vIw==; 24:BzU1rdqP2Oq8+U8DXcSMq5S4gj6sme00iz/G4mZ81V0mdLFJo61jhok3FJ5r2DZ5x7YvYijlzO5+lDaUL2tgmUjls7InKNhm5WPmNCh4XAA= x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BY1PR09MB0920; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001); SRVR:BY1PR09MB0920; BCL:0; PCL:0; RULEID:; SRVR:BY1PR09MB0920; x-forefront-prvs: 08902E536D x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(6009001)(24454002)(377454003)(4001350100001)(5008740100001)(92566002)(3660700001)(230783001)(11100500001)(86362001)(189998001)(5002640100001)(2950100001)(5001770100001)(2900100001)(3280700002)(66066001)(33656002)(586003)(1220700001)(4326007)(76176999)(1096002)(36756003)(83716003)(54356999)(93886004)(10400500002)(2906002)(50986999)(19580395003)(19580405001)(87936001)(81166005)(3846002)(5004730100002)(99286002)(102836003)(82746002)(77096005)(83506001)(122556002)(6116002)(106116001); DIR:OUT; SFP:1101; SCL:1; SRVR:BY1PR09MB0920; H:BY1PR09MB0920.namprd09.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:23 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-ID: <875080D3697B75499D48BEF82AF3E95A@namprd09.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Mar 2016 20:00:09.8524 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: c620dc48-1d50-4952-8b39-df4d54d74d82 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY1PR09MB0920 X-OriginatorOrg: mitre.org Archived-At: Cc: PKIX , Brian Haberman , IETF SMIME Subject: Re: [smime] Key lookup service via draft-bhjl-x509-srv-00 X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Mar 2016 20:00:24 -0000 T24gMy8yMy8xNiwgMTozMyBQTSwgInNtaW1lIG9uIGJlaGFsZiBvZiBKb2huIFIgTGV2aW5lIiA8 c21pbWUtYm91bmNlc0BpZXRmLm9yZyBvbiBiZWhhbGYgb2Ygam9obmxAdGF1Z2guY29tPiB3cm90 ZToNCg0KDQoNCj5JZiB0aGUgV0cgdGhpbmtzIHRoZSBkb21haW4ncyBrZXkgc2hvdWxkIGJlIGF1 dGhvcml0YXRpdmUsIHRoYXQnZCBiZSBmaW5lDQo+d2l0aCBtZS4gIFdlIGRpZG4ndCB3YW50IHRv IG1ha2UgYW55IHVuaWxhdGVyYWwgY2hhbmdlcyB0byB0aGUgdHJ1c3QgbW9kZWwgDQo+d2l0aG91 dCBpdCBiZWluZyBjbGVhciB0aGF0IGl0J3MgYSBjaGFuZ2UgYW5kIHRoYXQgdGhlcmUncyBjb25z ZW5zdXMgDQo+YmVoaW5kIGl0Lg0KDQpTbyBhbiBhdXRob3JpdGF0aXZlIHNlcnZpY2UgbWFrZXMg c2Vuc2UgaW4gYW4gRW50ZXJwcmlzZSBjb250ZXh0LCBidXQgbm90IGluIGEgY29uc3VtZXIgY29u dGV4dC4gIEhvdyBkbyB5b3UgcHJlc2VydmUgY29uc3VtZXIgY2hvaWNlIGlmIFlhaG9vISBvd25z IHRoZWlyIGVtYWlsIHNlcnZpY2UsIGJ1dCB0aGV5IHdhbnQgdG8gY2VydGlmeSBrZXlzIGVsc2V3 aGVyZT8NCg0KLS0gVA0KDQo= From nobody Wed Mar 23 13:28:47 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F2C0812D8BE for ; Wed, 23 Mar 2016 13:28:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1536-bit key) header.d=iecc.com header.b=AFExgYKy; dkim=pass (1536-bit key) header.d=taugh.com header.b=Xgj86FDv Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1WJrPlluUcw1 for ; Wed, 23 Mar 2016 13:28:43 -0700 (PDT) Received: from miucha.iecc.com (abusenet-1-pt.tunnel.tserv4.nyc4.ipv6.he.net [IPv6:2001:470:1f06:1126::2]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 30D0C12D8A9 for ; Wed, 23 Mar 2016 13:28:43 -0700 (PDT) Received: (qmail 64082 invoked from network); 23 Mar 2016 20:28:42 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=fa51.56f2fc7a.k1603; bh=8+a3VhvfSOIHNXI5Qe3ZWksbLUmtJHhD/II1u0zAm7g=; b=AFExgYKydDt7CTXpCsYar6EL0ajqjOdyK11bprBzmYnJ/DpIYGU7liIVp7Z4KAucPm1fcN21/trA0T6rc/ZUDZTTKpW5baZ559hYrB4yCd5VVXkVdFZd181/rPUlmtO6vGV1H0ZmyEFu/iuNXEMHEDG2SXGqShgvpXtaIvIapRKhILzSZvuSKif6ICBnWiz3CuAMtsOCeKy/4p+pLt2PKcoAellsdjdoWCC3iX/UlmtCrhg7QOTTb69iodkoMHkU DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=fa51.56f2fc7a.k1603; bh=8+a3VhvfSOIHNXI5Qe3ZWksbLUmtJHhD/II1u0zAm7g=; b=Xgj86FDvRVgORgyLq2mDzBi/CmZdZ9K+X11Y8Zzbk6lrld4CJEMpBk6qP3InFA6ddzJ5AxJ3oATZqDx72NE0Sgrsd3ksEecyxOno5KWr922RaY0jVHhQIQ0dYOxMyr/4kp/uD/BE7lF0haTS/GED7inc4aia7A4axQAId/DCKQKwD8qWhjyJb/eO9ZhMZoPhX5BeVklg9UkXLwn3IO+/samh9DKtGwVwPVFA6Cp3VoW/U6Ezt35jfmLGrOapNbdW Received: from localhost ([IPv6:2001:470:1f07:1126::78:696d:6170]) by imap.iecc.com ([IPv6:2001:470:1f07:1126::78:696d:6170]) with ESMTPS (TLS1.0/X.509/SHA1) via TCP6; 23 Mar 2016 20:28:42 -0000 Date: 23 Mar 2016 16:28:41 -0400 Message-ID: From: "John R Levine" To: "Miller, Timothy J." In-Reply-To: References: User-Agent: Alpine 2.11 (OSX 23 2013-08-11) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Archived-At: Cc: PKIX , Brian Haberman , IETF SMIME Subject: Re: [smime] Key lookup service via draft-bhjl-x509-srv-00 X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Mar 2016 20:28:46 -0000 > So an authoritative service makes sense in an Enterprise context, but not in a consumer context. How do you preserve consumer choice if Yahoo! owns their email service, but they want to certify keys elsewhere? Welcome to the key semantics undrainable swamp of despair. If the domain says "I'm authoritative for all my users" and one of the users says "no you're not", there's no mechanical way to resolve that. You can punt to the user, which is known not to work ("Accept domain self-signed key for igor@example.org gargle jargon blurch OK!") or else you can appeal to a credible third party. Except the third parties are CAs and they're not as credible as we might wish. This is why the draft tip-toes around the edge of the swamp, for fear of falling in. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY Please consider the environment before reading this e-mail. From nobody Wed Mar 23 14:29:18 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BFF1C12D962 for ; Wed, 23 Mar 2016 14:29:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.71 X-Spam-Level: X-Spam-Status: No, score=-2.71 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uek969h1qaTU for ; Wed, 23 Mar 2016 14:29:15 -0700 (PDT) Received: from mail-vk0-x235.google.com (mail-vk0-x235.google.com [IPv6:2607:f8b0:400c:c05::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 145F512D947 for ; Wed, 23 Mar 2016 14:29:14 -0700 (PDT) Received: by mail-vk0-x235.google.com with SMTP id e6so35772948vkh.2 for ; Wed, 23 Mar 2016 14:29:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc; bh=JPgaUBP5T3a/0tyEEV2nmggFStDKjlRUrG0f3VoF1RY=; b=Rqjt/2gspOALVb0n9eZ/8GS9EOEZyrkQzVwmOGt/zuWn29boWUZ9FsnibZvkXbhIo1 SgrF/sjKQdO/QYBkGIwOJ6FhD1RCx071JmirVkmXMuKp3hvHffpZbpQKCVOBLIPJTcJU uh5p8Sp2vOLFmKHGUiAMkLgHFznMQnSNA7wpTNOn74y0ZOFOzNi+oMP+j6E4sHHcoX+2 rFdcEB9cbdDSmsYjKLD+2SQZR7F2Yc/ab/+75CcL/s6CckoxwiLOl4CcjNCBy1ewz1cQ SoeXg+6IDnRMo+0MtIfG8sGa1LmrYr4D3HaARYxRqlL+ZJmy46NL69SX3VNIdU1vul4+ KG/g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc; bh=JPgaUBP5T3a/0tyEEV2nmggFStDKjlRUrG0f3VoF1RY=; b=GCLzdhpysZGWIM33krsFRMHZamhfWV9jXtScfd030Pq2SzdsfhkhehwWZbCRM6MVQT vDRG6tHh8zrY+30z5vfmMEj+nR9tlvIQhCof5fgVJG8aTIR/ZBc2XEzuS1TzUhxpU2oB Uhukdbepd/zveq4mndQoROELWj6LZPUIJ2s4w8TH4ZH86TUwrd2qM411Ftt/G/Gx+euD YoRvdyGDeopkmlFxEWL+fN7j3+pWQaW81Qj/L8Yfs6eFNtqAhK5zUDuBRtYAVWeOokGb qnoqlrC0HAuGx0wvc1eBf4/aTomlWs6zcE1V8VMfjMRyK9oZgK26kvpO5pNUeNCvllIc Xnmw== X-Gm-Message-State: AD7BkJK4ezjKyJ83gnQNI3yizN9+hS5h3jFJ0YVlCwPG4/kQ9S5p6S042MGOGmBm6dhFxCy0jNfw9lw0BhE7nJG8 MIME-Version: 1.0 X-Received: by 10.159.40.168 with SMTP id d37mr2583289uad.83.1458768552896; Wed, 23 Mar 2016 14:29:12 -0700 (PDT) Received: by 10.159.36.179 with HTTP; Wed, 23 Mar 2016 14:29:12 -0700 (PDT) In-Reply-To: References: Date: Wed, 23 Mar 2016 14:29:12 -0700 Message-ID: From: Wei Chuang To: "Miller, Timothy J." Content-Type: multipart/alternative; boundary=94eb2c1238426811c6052ebe051c Archived-At: Cc: PKIX , Brian Haberman , IETF SMIME Subject: Re: [smime] Key lookup service via draft-bhjl-x509-srv-00 X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Mar 2016 21:29:17 -0000 --94eb2c1238426811c6052ebe051c Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On Wed, Mar 23, 2016 at 1:00 PM, Miller, Timothy J. wrote: > On 3/23/16, 1:33 PM, "smime on behalf of John R Levine" < > smime-bounces@ietf.org on behalf of johnl@taugh.com> wrote: > > > > >If the WG thinks the domain's key should be authoritative, that'd be fine > >with me. We didn't want to make any unilateral changes to the trust model > >without it being clear that it's a change and that there's consensus > >behind it. > > So an authoritative service makes sense in an Enterprise context, but not > in a consumer context. How do you preserve consumer choice if Yahoo! owns > their email service, but they want to certify keys elsewhere? > Could Yahoo! (in this example) not provide a means for their users to update the key lookup service? As the user is authenticated through their UI, he or she could upload the keys they want in a secure way. (A realistic deployment caveat might be that Yahoo! puts some restrictions on e.g. Yahoo! might not support self-signed, weak key sizes etc). One might argue Yahoo! wouldn't want to provide a key service, but then that's fine. Without the SRV RR, things should be defined to fall back to the current state of things. -Wei > > -- T > > --94eb2c1238426811c6052ebe051c Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit


On Wed, Mar 23, 2016 at 1:00 PM, Miller, Timothy J. <tmiller@mitre.org> wrote:
On 3/23/16, 1:33 PM, "smime on behalf of John R Levine" <smime-bounces@ietf.org on behalf of johnl@taugh.com> wrote:



>If the WG thinks the domain's key should be authoritative, that'd be fine
>with me.  We didn't want to make any unilateral changes to the trust model
>without it being clear that it's a change and that there's consensus
>behind it.

So an authoritative service makes sense in an Enterprise context, but not in a consumer context.  How do you preserve consumer choice if Yahoo! owns their email service, but they want to certify keys elsewhere?

Could Yahoo! (in this example) not provide a means for their users to update the key lookup service?  As the user is authenticated through their UI, he or she could upload the keys they want in a secure way.   (A realistic deployment caveat might be that Yahoo! puts some restrictions on e.g. Yahoo! might not support self-signed, weak key sizes etc).  One might argue Yahoo! wouldn't want to provide a key service, but then that's fine.  Without the SRV RR, things should be defined to fall back to the current state of things.

-Wei
 

-- T


--94eb2c1238426811c6052ebe051c-- From nobody Wed Mar 23 15:23:45 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D768D12D66D for ; Wed, 23 Mar 2016 15:23:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1536-bit key) header.d=iecc.com header.b=XNe/cX2j; dkim=pass (1536-bit key) header.d=taugh.com header.b=bRXZYpHg Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SXtacpIfSHya for ; Wed, 23 Mar 2016 15:23:40 -0700 (PDT) Received: from miucha.iecc.com (abusenet-1-pt.tunnel.tserv4.nyc4.ipv6.he.net [IPv6:2001:470:1f06:1126::2]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F395812D9DF for ; Wed, 23 Mar 2016 15:23:37 -0700 (PDT) Received: (qmail 82318 invoked from network); 23 Mar 2016 22:23:37 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=1418d.56f31769.k1603; bh=2knxWxUmd7H259Xto2PCOJARRS7nsrwc4A57t0d7zW4=; b=XNe/cX2jCXjuhzFcZKR3Qes9TrYaUzdfs62dTBbWcSSVQHywHgc5xhLsXdhv3cdTQAYkqXAJAuK9nwlcApdT0tbmv3cbNi9N2uebetNdxvYm9ZD7bFzjSxcvAlgzEls/rg5k2UTWsgtf16rmDWxU3xuzqAqbKmXP6XG/kAdxv5bOxNWwACZtzotgfBp4445JSbSsZSJ0xNHt7Ho9dZFfkNQnL6YxmPHM13Fg7EyV3EUuPJT7A78uPteeTHu63ZKw DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=1418d.56f31769.k1603; bh=2knxWxUmd7H259Xto2PCOJARRS7nsrwc4A57t0d7zW4=; b=bRXZYpHg0WiviwHubf6M5JTqUMReDsv4C9d8x7+iGJZqttjPZrMUJeQRNXWi5q4AGx3K/0QkpJrpY9d2VuD2Y6gEPngH0X/OKjxE2PThUf6bjLnAlW8+g5nANnLGq6er3L/g0ChiZRioELGLMVlTFTAj7Wa7GQNXp8dw6MxaZbvIM7AMIrZJOSPh3syxaRKLBhrtQp6xP+Dt3vBT8+47m+3/yNsdi/uZSJh+zCttEowcvPKAdb9tA9OLPW5hpeos Received: from localhost ([IPv6:2001:470:1f07:1126::78:696d:6170]) by imap.iecc.com ([IPv6:2001:470:1f07:1126::78:696d:6170]) with ESMTPS (TLS1.0/X.509/SHA1) via TCP6; 23 Mar 2016 22:23:37 -0000 Date: 23 Mar 2016 18:23:36 -0400 Message-ID: From: "John R Levine" To: "Wei Chuang" In-Reply-To: References: User-Agent: Alpine 2.11 (OSX 23 2013-08-11) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Archived-At: Cc: PKIX , IETF SMIME Subject: Re: [smime] Key lookup service via draft-bhjl-x509-srv-00 X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Mar 2016 22:23:42 -0000 > Could Yahoo! (in this example) not provide a means for their users to > update the key lookup service? As the user is authenticated through their > UI, he or she could upload the keys they want in a secure way. Sure, and then Yahoo would serve the keys the users provide. R's, John PS: Except for the MITM keys intalled by government order or rogue employees. From nobody Wed Mar 23 16:00:56 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9754B12DA2E for ; Wed, 23 Mar 2016 16:00:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.71 X-Spam-Level: X-Spam-Status: No, score=-2.71 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oF2Z-9dVuIHN for ; Wed, 23 Mar 2016 16:00:52 -0700 (PDT) Received: from mail-vk0-x22d.google.com (mail-vk0-x22d.google.com [IPv6:2607:f8b0:400c:c05::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6392012DA26 for ; Wed, 23 Mar 2016 16:00:47 -0700 (PDT) Received: by mail-vk0-x22d.google.com with SMTP id z68so37947141vkg.3 for ; Wed, 23 Mar 2016 16:00:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc; bh=7S5A8WE7CHNX9kMTl7UQj0ny0BHT1+S95kfS1TcHTLw=; b=FysO6bQS54gNIuwYqqwPmgOg/3nk+MY1ldjtvrVg1J7KOq4Qg7GT56sxq3DZ7qpjdm 19Z30azx6hoy981s80sBC9UT8bXZDLiSTypkRey6odWZD8OWFb3brpElP04q/yxlgxIX mPEpzLRM+deulCBTNDODa/AvTcgVSQQw9bF8FLz8e8WKJgiU9famB4BaoqyR/DNnferP PrXfmUJC8sjSrZUUlA9Sy41bRE7yOnOMAZl2JIrfSsM7Y9HAYG+I5jPirYRQ+T1t7DB7 nUnmfaR23jiBoWVFTh2N0pZl5ynbN445Rji4LO7nZhnnte0f2pJPYjAZFo5R8IozP/AM uwNA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc; bh=7S5A8WE7CHNX9kMTl7UQj0ny0BHT1+S95kfS1TcHTLw=; b=LaP5G8PUxYO4/uHuHf6LugglEUKNLpCg4zMEm6oizcLuy3aAHHk2jqlofwHw0CBINS 52x0DfCO7+rMMmTaQj+pMuXsZ2949aAnsRWgTeCnrLo35egsaOP9yAnJTs3P/zpzgY+S sYIiBw57cAoCP0MmicGBvqmDDJrhrZJ7dyHh145H3A5Q0JRoDhrvEg6iqMRpT810Pi5S 1eNd6WohNsir5hdAvt8V9kIU8aGBzllZ6YZHt/p/VwBuxCuUKCucxPS0u68lHHmRzubH N13+emhGte4DevqGfDgodIR3wJHDEbMMeY8NA8NZDrGhbCSq4a78mccl38LQzjBmFVHX 5Fsg== X-Gm-Message-State: AD7BkJKy4uO/+KluttobnwfNfZGhL2I3B/jkpuX3fs1ZlLkUb0+RO0z+KJlhhs+cTzU0eBVAbJ2DF91qKWqjMXq4 MIME-Version: 1.0 X-Received: by 10.176.1.240 with SMTP id 103mr2636989ual.54.1458774046335; Wed, 23 Mar 2016 16:00:46 -0700 (PDT) Received: by 10.159.36.179 with HTTP; Wed, 23 Mar 2016 16:00:46 -0700 (PDT) In-Reply-To: References: Date: Wed, 23 Mar 2016 16:00:46 -0700 Message-ID: From: Wei Chuang To: John R Levine Content-Type: multipart/alternative; boundary=001a113cfa50d7385f052ebf4cd5 Archived-At: Cc: PKIX , IETF SMIME Subject: Re: [smime] Key lookup service via draft-bhjl-x509-srv-00 X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Mar 2016 23:00:54 -0000 --001a113cfa50d7385f052ebf4cd5 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On Wed, Mar 23, 2016 at 3:23 PM, John R Levine wrote: > Could Yahoo! (in this example) not provide a means for their users to >> update the key lookup service? As the user is authenticated through their >> UI, he or she could upload the keys they want in a secure way. >> > > Sure, and then Yahoo would serve the keys the users provide. > > R's, > John > > PS: Except for the MITM keys intalled by government order or rogue > employees. > If this is part of the threat model, Coniks has some ideas about auditing key services against what they term equivocation or presenting different keys to different users. The other aspect albeit in the far future one could try to replicate what has been done with WebPKI which in my opinion has been effective against those threats, and create a broad trusted anchor eco-system with strong enforcement. -Wei --001a113cfa50d7385f052ebf4cd5 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit


On Wed, Mar 23, 2016 at 3:23 PM, John R Levine <johnl@taugh.com> wrote:
Could Yahoo! (in this example) not provide a means for their users to
update the key lookup service?  As the user is authenticated through their
UI, he or she could upload the keys they want in a secure way.

 Sure, and then Yahoo would serve the keys the users provide.

R's,
John

PS: Except for the MITM keys intalled by government order or rogue employees.

If this is part of the threat model, Coniks has some ideas about auditing key services against what they term equivocation or presenting different keys to different users. The other aspect albeit in the far future one could try to replicate what has been done with WebPKI which in my opinion has been effective against those threats, and create a broad trusted anchor eco-system with strong enforcement.

-Wei
 

--001a113cfa50d7385f052ebf4cd5-- From nobody Thu Mar 24 05:25:39 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BEF4A12DAC6; Thu, 24 Mar 2016 05:25:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.21 X-Spam-Level: X-Spam-Status: No, score=-4.21 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mitre.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id daMuD_4b6Fje; Thu, 24 Mar 2016 05:25:36 -0700 (PDT) Received: from smtpvmsrv1.mitre.org (smtpvmsrv1.mitre.org [192.52.194.136]) by ietfa.amsl.com (Postfix) with ESMTP id B532012DAEF; Thu, 24 Mar 2016 05:25:36 -0700 (PDT) Received: from smtpvmsrv1.mitre.org (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with SMTP id 55FBC6C033A; Thu, 24 Mar 2016 08:25:36 -0400 (EDT) Received: from imshyb01.MITRE.ORG (imshyb01.mitre.org [129.83.29.2]) by smtpvmsrv1.mitre.org (Postfix) with ESMTP id 455C96C032D; Thu, 24 Mar 2016 08:25:36 -0400 (EDT) Received: from imshyb01.MITRE.ORG (129.83.29.2) by imshyb01.MITRE.ORG (129.83.29.2) with Microsoft SMTP Server (TLS) id 15.0.1130.7; Thu, 24 Mar 2016 08:25:36 -0400 Received: from gcc01-CY1-obe.outbound.protection.outlook.com (10.140.19.249) by imshyb01.MITRE.ORG (129.83.29.2) with Microsoft SMTP Server (TLS) id 15.0.1130.7 via Frontend Transport; Thu, 24 Mar 2016 08:25:35 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mitre.onmicrosoft.com; s=selector1-mitre-org; h=From:To:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=CjQiOcYgQw+KNGAsD7Xu4kmDNai7n561nUNO+66ANO8=; b=Sz4Pl9CLOMbwqRhw0OASTwMVMfUYp90brluKRW6PojQvBoB5RmZxeP7uV2MAp1CwBkhYa8+3bgVZvZuxU+VBOneEqXuy2a7/ZjK7W0D/yHPTLF/Y4UN22m7ca08SSWgMriJOqDIHY7a2IN5BBnRmhMcb3pyB3qZJDwtgkaAiiFE= Received: from BY1PR09MB0920.namprd09.prod.outlook.com (10.162.144.157) by BY1PR09MB0918.namprd09.prod.outlook.com (10.162.144.155) with Microsoft SMTP Server (TLS) id 15.1.434.16; Thu, 24 Mar 2016 12:25:34 +0000 Received: from BY1PR09MB0920.namprd09.prod.outlook.com ([10.162.144.157]) by BY1PR09MB0920.namprd09.prod.outlook.com ([10.162.144.157]) with mapi id 15.01.0434.019; Thu, 24 Mar 2016 12:25:35 +0000 From: "Miller, Timothy J." To: Wei Chuang Thread-Topic: [smime] Key lookup service via draft-bhjl-x509-srv-00 Thread-Index: AQHRhTGmh22EPby4TE+kk5RKeaJMBp9nWoUA///EeQCAAGy0AIAA+HcQ Date: Thu, 24 Mar 2016 12:25:34 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: google.com; dkim=none (message not signed) header.d=none;google.com; dmarc=none action=none header.from=mitre.org; x-originating-ip: [192.160.51.86] x-ms-office365-filtering-correlation-id: 682c42ce-04f9-4f6f-9998-08d353df6670 x-microsoft-exchange-diagnostics: 1; BY1PR09MB0918; 5:eIhCv3RAmHuhTuulhC0nGo0Z+UPm50+5gyWCKDH64jLe5Fr9D1q2YPR/UB7xLCyS02g3WcLqUP++ea/gZr9iPty5+4n7Z6p/Vj9uKGYCizPDHC4OHtwMQgQLhhRM83a0gesHSmpMrEW4X+5B4slmgQ==; 24:hLIVHDwtgiKMpbkWiiQLgRfAzsEBIamWMrxe5MkyX1r681dDfLhMlX5VjWCqDA6SVz8ncMTdWSeFm9O3xnysZW40//+7m38uFpgCycQoeDo= x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BY1PR09MB0918; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046); SRVR:BY1PR09MB0918; BCL:0; PCL:0; RULEID:; SRVR:BY1PR09MB0918; x-forefront-prvs: 0891BC3F3D x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(6009001)(3280700002)(106116001)(99286002)(81166005)(5008740100001)(10400500002)(2900100001)(2950100001)(54356999)(3846002)(189998001)(3660700001)(110136002)(586003)(77096005)(33656002)(76576001)(5002640100001)(4326007)(86362001)(102836003)(6116002)(87936001)(92566002)(66066001)(5004730100002)(93886004)(1096002)(5003600100002)(2906002)(1220700001)(74316001)(76176999)(122556002)(230783001)(50986999); DIR:OUT; SFP:1101; SCL:1; SRVR:BY1PR09MB0918; H:BY1PR09MB0920.namprd09.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:23 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Mar 2016 12:25:34.9277 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: c620dc48-1d50-4952-8b39-df4d54d74d82 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY1PR09MB0918 X-OriginatorOrg: mitre.org Archived-At: Cc: PKIX , Brian Haberman , IETF SMIME Subject: Re: [smime] Key lookup service via draft-bhjl-x509-srv-00 X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Mar 2016 12:25:39 -0000 PiBDb3VsZCBZYWhvbyEgKGluIHRoaXMgZXhhbXBsZSkgbm90IHByb3ZpZGUgYSBtZWFucyBmb3Ig dGhlaXIgdXNlcnMgdG8gdXBkYXRlDQo+IHRoZSBrZXkgbG9va3VwIHNlcnZpY2U/ICBBcyB0aGUg dXNlciBpcyBhdXRoZW50aWNhdGVkIHRocm91Z2ggdGhlaXIgVUksIGhlIG9yDQo+IHNoZSBjb3Vs ZCB1cGxvYWQgdGhlIGtleXMgdGhleSB3YW50IGluIGEgc2VjdXJlIHdheS4gICAoQSByZWFsaXN0 aWMNCj4gZGVwbG95bWVudCBjYXZlYXQgbWlnaHQgYmUgdGhhdCBZYWhvbyEgcHV0cyBzb21lIHJl c3RyaWN0aW9ucyBvbiBlLmcuDQo+IFlhaG9vISBtaWdodCBub3Qgc3VwcG9ydCBzZWxmLXNpZ25l ZCwgd2VhayBrZXkgc2l6ZXMgZXRjKS4gIE9uZSBtaWdodCBhcmd1ZQ0KPiBZYWhvbyEgd291bGRu J3Qgd2FudCB0byBwcm92aWRlIGEga2V5IHNlcnZpY2UsIGJ1dCB0aGVuIHRoYXQncyBmaW5lLiAg V2l0aG91dA0KPiB0aGUgU1JWIFJSLCB0aGluZ3Mgc2hvdWxkIGJlIGRlZmluZWQgdG8gZmFsbCBi YWNrIHRvIHRoZSBjdXJyZW50IHN0YXRlIG9mDQo+IHRoaW5ncy4NCg0KRmlyc3QsIGNvbnNpZGVy IGEgdXNlciBmb3J3YXJkaW5nIG1haWwgZnJvbSBZYWhvbyEgdG8gc29tZSBvdGhlciBzZXJ2aWNl LCBvciB1c2luZyBhIHNpbmdsZSBjbGllbnQgdG8gYWNjZXNzIG11bHRpcGxlIG1haWxib3hlcyBi dXQgcmVwbHlpbmcgZnJvbSBhIHNpbmdsZSBhZGRyZXNzLiAgV2hvIGF0dGVzdHMgdG8gd2hhdCBp biB0aGVzZSBjYXNlcz8NCg0KU2Vjb25kLCBieSBhZGRpbmcgcHJvdmlkZXItc2lkZSBpbmZyYXN0 cnVjdHVyZSB5b3UncmUgaW5jcmVhc2luZyB0aGUgY29zdCBvZiBwcm92aWRpbmcgdGhlIG1haWwg c2VydmljZSB3aXRoIG5vIGRpcmVjdCBiZW5lZml0IHRvIHRoZSBtYWlsIHByb3ZpZGVyIGhpbXNl bGYuICBUaGVyZSdzIGFuIGluZGlyZWN0IGJlbmVmaXQgaW4gd2hpY2ggeW91J3JlIG1ha2luZyB0 aGUgc2VydmljZSBzbGlnaHRseSBtb3JlIGF0dHJhY3RpdmUgdG8gYSBjZXJ0YWluIG5pY2hlIG9m IHVzZXJzLCBidXQgdGhhdCdzIHByb2JhYmx5IG5vdCBldmVuIG1lYXN1cmFibGUgYXMgdGhhdCBu aWNoZSBpcyBleGNlZWRpbmdseSBzbWFsbC4gIElPVywgdGhlcmUncyBubyBpbmNlbnRpdmUuDQoN Ck15IGFkdmljZSBpcyB0byBrZWVwIGl0IGFzIHNpbXBsZSBhcyBwb3NzaWJsZS4gIE1VQXMgaW50 ZXJhY3QgZGlyZWN0bHkgd2l0aCB1c2Vycywgc28gaXQgc2hvdWxkIGJlIE1VQXMgdGhhdCBwcm92 aWRlIGFzc3VyYW5jZSwgbm90IG1haWwgcHJvdmlkZXJzLiAgVGhpcyByZWxpZXZlcyB0aGUgcHJv dmlkZXIgZnJvbSBoYXZpbmcgdG8gd29ycnkgYWJvdXQgaXQsIGFuZCB1c2VycyBjYW4gb3B0IGlu IG9yIG91dCBhdCB3aWxsIHVzaW5nIGFueSBtYWlsIHByb3ZpZGVyIG9yIGtleSBpbmZyYXN0cnVj dHVyZSB0aGV5IGNob29zZSAodXAgdG8gYW5kIGluY2x1ZGluZyByb2xsLXlvdXItb3duKS4NCg0K LS0gVA0KDQoNCg== From nobody Thu Mar 24 06:35:34 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9D88012DB2B for ; Thu, 24 Mar 2016 06:35:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01, T_RP_MATCHES_RCVD=-0.01] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8iRuCAZIINjA for ; Thu, 24 Mar 2016 06:35:28 -0700 (PDT) Received: from mail-vk0-x235.google.com (mail-vk0-x235.google.com [IPv6:2607:f8b0:400c:c05::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4CFE112DB11 for ; Thu, 24 Mar 2016 06:34:51 -0700 (PDT) Received: by mail-vk0-x235.google.com with SMTP id z68so58083876vkg.3 for ; Thu, 24 Mar 2016 06:34:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc; bh=rygVlTyFGKAw6vPPvYLTLAfit4NcoIwhTFIyBsFMmE0=; b=UjqaX4JomKtNn8MrxYqmoh7Bhi1DqqyOsWSRC+aE4x9rSueQeve3P8BWvIVLCV7oA7 X0HRY/mcHBo7Hhem+/aUJThCj2T0A+1L0TvwW26Yxm3QZ+jg1Wq6C0KBHYyzy2LAT8sC y3C3SpjYB7jf9lFGJmFTlTvLAjR/CCLdwtr68LZ968NNs5VL3xAFxoQZoS3e4kajMtWe QMuNHR5MPgUS9hSMjuswgKEbeypcnuA3UIGUoFZ9QsvsJ6mpmursTnbuFEDsRDIfvFck JtFOe7juXzsJYuRmq11Av0xFRCJ7SY0VNbOQCXj9Q4CCpbcNZbjDi0ibsLHPnPDheMWM MSLg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc; bh=rygVlTyFGKAw6vPPvYLTLAfit4NcoIwhTFIyBsFMmE0=; b=ELXIX8ErXbTep3iQLDFvEEeuKE03e/aj5ifzOKYtVbPrwOwFNbUCNGQmbtV4kdmNoz jLOzhcMjp5+lUI26uVR9UINUi2vTb0MAikBvROgr3o+lOPgQBnch7sPF17Yw9e2eofx0 ecbOHZS8o4rQ/yj70y8a6vkehCmNtonwzdB9r8JQLHhhwVUWexqu31U2V32SsbcvIrwR FyGSO4EnJYaKFOTXTsT1hgUuKe3ZBji/n+XWGdzpM35oIZAUHen2SYKBzWKIucjs+I2K LO5+17PdxFNbnsHwesLu0zWhQZduHVrxN17vA3j7aYP8AXO33Z3R3ypQxp2IPpdsPo9h i4mg== X-Gm-Message-State: AD7BkJKZq8zoER2cVY7AjseB8Zeg2tdRb/OLcoEPA2gvJDwSIFeVnVc4QU45FhiURVCbtbwu+wnJyfGS/PwNzpPw MIME-Version: 1.0 X-Received: by 10.31.11.201 with SMTP id 192mr4401098vkl.135.1458826490176; Thu, 24 Mar 2016 06:34:50 -0700 (PDT) Received: by 10.159.36.179 with HTTP; Thu, 24 Mar 2016 06:34:50 -0700 (PDT) In-Reply-To: References: Date: Thu, 24 Mar 2016 06:34:50 -0700 Message-ID: From: Wei Chuang To: "Miller, Timothy J." Content-Type: multipart/alternative; boundary=001a11455152bce127052ecb82b6 Archived-At: Cc: PKIX , Brian Haberman , IETF SMIME Subject: Re: [smime] Key lookup service via draft-bhjl-x509-srv-00 X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Mar 2016 13:35:33 -0000 --001a11455152bce127052ecb82b6 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On Thu, Mar 24, 2016 at 5:25 AM, Miller, Timothy J. wrote: > > Could Yahoo! (in this example) not provide a means for their users to > update > > the key lookup service? As the user is authenticated through their UI, > he or > > she could upload the keys they want in a secure way. (A realistic > > deployment caveat might be that Yahoo! puts some restrictions on e.g. > > Yahoo! might not support self-signed, weak key sizes etc). One might > argue > > Yahoo! wouldn't want to provide a key service, but then that's fine. > Without > > the SRV RR, things should be defined to fall back to the current state of > > things. > > First, consider a user forwarding mail from Yahoo! to some other service, > or using a single client to access multiple mailboxes but replying from a > single address. Who attests to what in these cases? > I don't believe a key service complicates these scenarios, rather as you say the underlying PKI 'who' question does. > > Second, by adding provider-side infrastructure you're increasing the cost > of providing the mail service with no direct benefit to the mail provider > himself. There's an indirect benefit in which you're making the service > slightly more attractive to a certain niche of users, but that's probably > not even measurable as that niche is exceedingly small. IOW, there's no > incentive. > Providing a key service would be up to the provider. Some might choose not to, and thereby solely use MUA based distribution. Where a key service is provided, I would think there could be these benefits: * Keep private the initial conversation * Certificate renewal upon expiry or similarly when revoked * Describe the allowed trust anchor (for verification which shouldn't be all the time) * Potentially handle email address name variants e.g. subaddressing, capitalization -Wei > > My advice is to keep it as simple as possible. MUAs interact directly > with users, so it should be MUAs that provide assurance, not mail > providers. This relieves the provider from having to worry about it, and > users can opt in or out at will using any mail provider or key > infrastructure they choose (up to and including roll-your-own). > > -- T > > > --001a11455152bce127052ecb82b6 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit


On Thu, Mar 24, 2016 at 5:25 AM, Miller, Timothy J. <tmiller@mitre.org> wrote:
> Could Yahoo! (in this example) not provide a means for their users to update
> the key lookup service?  As the user is authenticated through their UI, he or
> she could upload the keys they want in a secure way.   (A realistic
> deployment caveat might be that Yahoo! puts some restrictions on e.g.
> Yahoo! might not support self-signed, weak key sizes etc).  One might argue
> Yahoo! wouldn't want to provide a key service, but then that's fine.  Without
> the SRV RR, things should be defined to fall back to the current state of
> things.

First, consider a user forwarding mail from Yahoo! to some other service, or using a single client to access multiple mailboxes but replying from a single address.  Who attests to what in these cases?

I don't believe a key service complicates these scenarios, rather as you say the underlying PKI 'who' question does.
 

Second, by adding provider-side infrastructure you're increasing the cost of providing the mail service with no direct benefit to the mail provider himself.  There's an indirect benefit in which you're making the service slightly more attractive to a certain niche of users, but that's probably not even measurable as that niche is exceedingly small.  IOW, there's no incentive.

Providing a key service would be up to the provider.  Some might choose not to, and thereby solely use MUA based distribution.

Where a key service is provided, I would think there could be these benefits:
* Keep private the initial conversation
* Certificate renewal upon expiry or similarly when revoked
* Describe the allowed trust anchor (for verification which shouldn't be all the time)
* Potentially handle email address name variants e.g. subaddressing, capitalization

-Wei
 

My advice is to keep it as simple as possible.  MUAs interact directly with users, so it should be MUAs that provide assurance, not mail providers.  This relieves the provider from having to worry about it, and users can opt in or out at will using any mail provider or key infrastructure they choose (up to and including roll-your-own).

-- T



--001a11455152bce127052ecb82b6-- From nobody Thu Mar 24 07:02:20 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7DD3412D8B2; Thu, 24 Mar 2016 07:02:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, T_FILL_THIS_FORM_SHORT=0.01, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mitre.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7u-YVmpX1ru0; Thu, 24 Mar 2016 07:02:16 -0700 (PDT) Received: from smtpvmsrv1.mitre.org (smtpvmsrv1.mitre.org [192.52.194.136]) by ietfa.amsl.com (Postfix) with ESMTP id E6C5512DBDE; Thu, 24 Mar 2016 06:58:08 -0700 (PDT) Received: from smtpvmsrv1.mitre.org (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with SMTP id 3E1806C0C17; Thu, 24 Mar 2016 09:58:08 -0400 (EDT) Received: from imshyb02.MITRE.ORG (imshyb02.mitre.org [129.83.29.3]) by smtpvmsrv1.mitre.org (Postfix) with ESMTP id 2D2016C084F; Thu, 24 Mar 2016 09:58:08 -0400 (EDT) Received: from imshyb01.MITRE.ORG (129.83.29.2) by imshyb02.MITRE.ORG (129.83.29.3) with Microsoft SMTP Server (TLS) id 15.0.1130.7; Thu, 24 Mar 2016 09:58:07 -0400 Received: from gcc01-dm2-obe.outbound.protection.outlook.com (10.140.19.249) by imshyb01.MITRE.ORG (129.83.29.2) with Microsoft SMTP Server (TLS) id 15.0.1130.7 via Frontend Transport; Thu, 24 Mar 2016 09:58:07 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mitre.onmicrosoft.com; s=selector1-mitre-org; h=From:To:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=eQGLbxBW160eomvRiGQjPHpUbCwvsA55K5saHp4/Ypw=; b=eELGGgGkLJPVSo7ET7jcBYH5s17QssxXSt1IGMljQRXFYU/FGHRKTeCLZZjDZTTCGCeOtplgjPNz19srR/Pd4fZ2mFRdyaCn9r8X5yWeiAiP89BZJCSIxSd6GkAGvKJFJQtWNqzjMgaxFtEk7GtoDABB4Wkw9T0w1TgRBMAG7bw= Received: from BY1PR09MB0920.namprd09.prod.outlook.com (10.162.144.157) by BY1PR09MB0917.namprd09.prod.outlook.com (10.162.144.154) with Microsoft SMTP Server (TLS) id 15.1.434.16; Thu, 24 Mar 2016 13:58:06 +0000 Received: from BY1PR09MB0920.namprd09.prod.outlook.com ([10.162.144.157]) by BY1PR09MB0920.namprd09.prod.outlook.com ([10.162.144.157]) with mapi id 15.01.0434.019; Thu, 24 Mar 2016 13:58:06 +0000 From: "Miller, Timothy J." To: Wei Chuang Thread-Topic: [smime] Key lookup service via draft-bhjl-x509-srv-00 Thread-Index: AQHRhTGmh22EPby4TE+kk5RKeaJMBp9nWoUA///EeQCAAGy0AIAA+HcQgAAVVACAAAJ1AA== Date: Thu, 24 Mar 2016 13:58:06 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: google.com; dkim=none (message not signed) header.d=none;google.com; dmarc=none action=none header.from=mitre.org; x-originating-ip: [192.160.51.86] x-ms-office365-filtering-correlation-id: b88d9a24-43c0-4ae8-838a-08d353ec5397 x-microsoft-exchange-diagnostics: 1; BY1PR09MB0917; 5:iIo3kI5fjoWnC6qvPQ3+gd/OtASjLtKZcw6H3upZgW/7RCJEeZxX+IZAdXts2niVz4pWLVxXF9q9y0/5raqdP7Kb7es9YE55kfv1Va3QaK7cgG6Bgk3PDKbr6qGDHu9OKcHA4fLUx7zVwBYI1RFy5A==; 24:9ugFXLsHooW5On9L1zmjSw9cw8zrBA+pX1My+MttBiXCOtiMJnTEy6KBwFpGuD9F+2W23DlVb8GAhsP13XM6u+lTAoEY9RroykBue+SrCi0= x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BY1PR09MB0917; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046); SRVR:BY1PR09MB0917; BCL:0; PCL:0; RULEID:; SRVR:BY1PR09MB0917; x-forefront-prvs: 0891BC3F3D x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(6009001)(102836003)(1096002)(3846002)(74316001)(5004730100002)(110136002)(6116002)(1220700001)(76176999)(81166005)(33656002)(5003600100002)(586003)(92566002)(87936001)(189998001)(54356999)(3660700001)(4326007)(50986999)(2906002)(5008740100001)(5002640100001)(2950100001)(3280700002)(106116001)(11100500001)(66066001)(2900100001)(76576001)(230783001)(10400500002)(122556002)(99286002)(77096005)(86362001)(93886004); DIR:OUT; SFP:1101; SCL:1; SRVR:BY1PR09MB0917; H:BY1PR09MB0920.namprd09.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:23 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Mar 2016 13:58:06.8103 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: c620dc48-1d50-4952-8b39-df4d54d74d82 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY1PR09MB0917 X-OriginatorOrg: mitre.org Archived-At: Cc: PKIX , Brian Haberman , IETF SMIME Subject: Re: [smime] Key lookup service via draft-bhjl-x509-srv-00 X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Mar 2016 14:02:18 -0000 PiAqIEtlZXAgcHJpdmF0ZSB0aGUgaW5pdGlhbCBjb252ZXJzYXRpb24NCg0KUGV0ZXIncyAoSSB0 aGluayBpdCdzIGhpcywgYXQgbGVhc3QgaGUncyB0aGUgZmlyc3QgcGVyc29uIEkgaGVhcmQgaXQg ZnJvbSkgR0VUU01JTUUgY29uY2VwdCBhY2hpZXZlcyB0aGUgc2FtZSByZXN1bHQuICANCg0KUGVy c29uYWxseSBJIHByZWZlciBrZWVwaW5nIGRpc2NvdmVyeSBhcyBhIG1ldGFwcm90b2NvbCBzbyBv bmx5IHRoZSBNVUEgbmVlZHMgdG8gaW1wbGVtZW50IGl0IGluZGVwZW5kZW50IG9mIE1UQXMsIHJl Y29nbml6aW5nIHRoYXQgdGhpcyB0cmFkZXMgb2ZmIGFnYWluc3QgdXNlciBjb252ZW5pZW5jZSB3 aGVuIHRoZSByZWNlaXZlciBpcyBpbnRlcm1pdHRlbnRseSBjb25uZWN0ZWQuICANCg0KVGhlIHBs dXMgaXMgdGhhdCB0aGUgTVVBICphbHdheXMqIGhhcyB0aGUgY3VycmVudCBrZXksIHdoZXJlYXMg YWxsIHJlcG9zaXRvcmllcyBnZXQgb3V0IG9mIGRhdGUgcXVpY2tseS4gIFdlIGhhdmUgZXh0ZW5z aXZlIGV4cGVyaWVuY2Ugd2l0aCB0aGlzIGluIHRoZSBEb0QtLWV4cGlyZWQgdXNlclNNSU1FQ2Vy dGlmaWNhdGUgYXR0cmlidXRlcyBpbiB0aGUgRXhjaGFuZ2UgR0FMIChlZmZlY3RpdmVseSBhbiBM REFQIGRpcmVjdG9yeSkgYXJlIGEgY29uc3RhbnQgcHJvYmxlbS4gIEtlZXBpbmcgdXNlckNlcnRp ZmljYXRlIGF0dHJpYnV0ZXMgc3luYydkIHdpdGggdGhlIENBIHB1YmxpY2F0aW9uIGRpcmVjdG9y eSBpcyBhbHNvIGEgcm95YWwgUElUQS4NCg0KUmVkdWNlIHRoZSBtb3ZpbmcgcGFydHMgYW5kIHRo ZSBzeXN0ZW0gd2lsbCBiZSBtb3JlIHJvYnVzdC4gIERpcmVjdCBjbGllbnQtdG8tY2xpZW50IGtl eSBkaXNjb3Zlcnkgd2lsbCBiZSBtb3JlIGFjY3VyYXRlLCBtb3JlIGVhc2lseSBkZXBsb3llZCwg YW5kIGNhbiBiZSBzZW1pIG9yIGZ1bGx5IGF1dG9tYXRlZC4NCg0KPiAqIENlcnRpZmljYXRlIHJl bmV3YWwgdXBvbiBleHBpcnkgb3Igc2ltaWxhcmx5IHdoZW4gcmV2b2tlZA0KDQpOby4gIFJlbmV3 YWwgaXMgc2VjdXJpdHkgc2Vuc2l0aXZlLCBzbyBhdXRvbWF0aW9uIGlzIHJlYWxseSBub3QgYSBn cmVhdCBpZGVhLiAgSW4gY2VydGFpbiBuaWNoZXMtLWUuZy4sIG5vbi1wZXJzb24gYXV0b3JlbmV3 YWwgd2l0aGluIGFuIGVudGVycHJpc2UgYXV0aGVudGljYXRpb24gZG9tYWluIGxpa2UgQWN0aXZl IERpcmVjdG9yeS0taXQncyBhY2NlcHRhYmxlLCBidXQgZm9yIHBlcnNvbnMgSSB3b3VsZCByZWNv bW1lbmQgYWdhaW5zdCBpdC4NCg0KUmV2b2NhdGlvbi0taW4gdGhlIGNvbW1lcmNpYWwgd29ybGQg YW5kIGNvbnN1bWVyIFBLSSB1c2UgY2FzZSwgYW55d2F5LS1pcyByYXJlIGVub3VnaCB0byBqdXN0 IGlnbm9yZS4gIEtleSBjb250aW51aXR5IGlzIGEgc2FmZXIgYXBwcm9hY2guDQoNCj4gKiBEZXNj cmliZSB0aGUgYWxsb3dlZCB0cnVzdCBhbmNob3IgKGZvciB2ZXJpZmljYXRpb24gd2hpY2ggc2hv dWxkbid0IGJlIGFsbA0KPiB0aGUgdGltZSkNCg0KV2h5IGRvZXMgdGhlICpjZXJ0IHJlcG9zaXRv cnkqIGdldCB0byBzYXkgd2hvIG15IENBIGlzPw0KDQo+ICogUG90ZW50aWFsbHkgaGFuZGxlIGVt YWlsIGFkZHJlc3MgbmFtZSB2YXJpYW50cyBlLmcuIHN1YmFkZHJlc3NpbmcsDQo+IGNhcGl0YWxp emF0aW9uDQoNClRvbyBoYXJkIGEgcHJvYmxlbSB0byBhZGRyZXNzIGV4dGVybmFsIHRvIHRoZSBt YWlsIHN5c3RlbSwgYXMgd2UndmUgc2Vlbi4gIA0KDQpPVE9ILCBkaXJlY3QgY2xpZW50LXRvLWNs aWVudCBkaXNjb3ZlcnkgZG9lc24ndCBoYXZlIHRoaXMgcHJvYmxlbSAqYXQgYWxsKi4NCg0KLS0g VA0K From nobody Thu Mar 24 08:28:52 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B528B12DB82 for ; Thu, 24 Mar 2016 08:28:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1536-bit key) header.d=iecc.com header.b=j9UN9TsX; dkim=pass (1536-bit key) header.d=taugh.com header.b=jhXGBMPP Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dxfn0glmsnKV for ; Thu, 24 Mar 2016 08:28:49 -0700 (PDT) Received: from miucha.iecc.com (abusenet-1-pt.tunnel.tserv4.nyc4.ipv6.he.net [IPv6:2001:470:1f06:1126::2]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F3FA212DC53 for ; Thu, 24 Mar 2016 08:12:16 -0700 (PDT) Received: (qmail 25176 invoked from network); 24 Mar 2016 15:12:16 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=6257.56f403d0.k1603; bh=qcxin0qj5Pfl49Stzu01VtmYwEDUKKIcpXvXQWOwz1A=; b=j9UN9TsX/TH95qWx1fSE5ghg6FvVqVDU84x7DNoHdkT13JsQbeL3JXDwQMRX+eF6AX5B+WxNWX5kEBytRWY87aH1LRQK/BylI2F54wXQxorrp9TNQx4TN5MCOrYQAleeCWkjRyopzuppNgodfDk0J/PMs8qZct9R7DudNBmJjnxzSGy+cc44ihC+YgQcyHkEJKujfL3C3HqzLLtBoXeT52VFNP6aRFPZwtbmR1Fmqygdj8aa+hFmCcoOZR8AAtXx DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=6257.56f403d0.k1603; bh=qcxin0qj5Pfl49Stzu01VtmYwEDUKKIcpXvXQWOwz1A=; b=jhXGBMPPZ60iEMZxvCyuy28rZKBhQGROt20jIxOvDGGyXGKA7O4rQ1vlbvAXXdn115oJb1uUgMmUexQz/fiuA4Bz1rhhOn7LdrMBpEaWOwk5mdG/k4SkXnfTYopRu4jygrtXdX2PpJjCsk2PKCOd9oQ7Gc97fTi0jqxju5DnuF+9Wi5PM4gF6Rdt03dr/jddIBnwMNthwXPPdxqOVC3g57RHw2waeinvMZZoiBmA9ZZ/ITbDO5yk02SJ8ZwRHJkT Received: from localhost ([IPv6:2001:470:1f07:1126::78:696d:6170]) by imap.iecc.com ([IPv6:2001:470:1f07:1126::78:696d:6170]) with ESMTPS (TLS1.0/X.509/SHA1) via TCP6; 24 Mar 2016 15:12:15 -0000 Date: 24 Mar 2016 11:12:15 -0400 Message-ID: From: "John R Levine" To: "Miller, Timothy J." In-Reply-To: References: User-Agent: Alpine 2.11 (OSX 23 2013-08-11) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Archived-At: Cc: PKIX , IETF SMIME Subject: Re: [smime] Key lookup service via draft-bhjl-x509-srv-00 X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Mar 2016 15:28:50 -0000 > My advice is to keep it as simple as possible. MUAs interact directly with users, so it should be MUAs that provide assurance, not mail providers. This relieves the provider from having to worry about it, and users can opt in or out at will using any mail provider or key infrastructure they choose (up to and including roll-your-own). I wouldn't disagree, but I would also point out that there are a lot of people who are eager to add a per-domain key lookup to their mail service. There are proposals in DANE to publish PGP and S/MIME keys directly in the DNS which are a bad idea for various reasons, but I don't see any reason that a domain operator shouldn't be able to offer a key server if it wants. Scott Rose at NIST and Richard Lau at ICANN have expressed interest in the DANE versions, so I'd like to give them an option that could work. My main concern would be to keep it crystal clear that the key server semantics are "foo.com asserts this is the key for bob@foo.com" rather than "this is the key for bob@foo.com". Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY Please consider the environment before reading this e-mail. From nobody Thu Mar 24 10:35:57 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B2C3E12D709; Thu, 24 Mar 2016 10:35:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.21 X-Spam-Level: X-Spam-Status: No, score=-4.21 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mitre.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9oJC6goEPCcj; Thu, 24 Mar 2016 10:35:43 -0700 (PDT) Received: from smtpvmsrv1.mitre.org (smtpvmsrv1.mitre.org [192.52.194.136]) by ietfa.amsl.com (Postfix) with ESMTP id B6CDD12D768; Thu, 24 Mar 2016 10:35:29 -0700 (PDT) Received: from smtpvmsrv1.mitre.org (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with SMTP id 460506C0401; Thu, 24 Mar 2016 13:35:29 -0400 (EDT) Received: from imshyb01.MITRE.ORG (imshyb01.mitre.org [129.83.29.2]) by smtpvmsrv1.mitre.org (Postfix) with ESMTP id 33F016C039A; Thu, 24 Mar 2016 13:35:29 -0400 (EDT) Received: from imshyb02.MITRE.ORG (129.83.29.3) by imshyb01.MITRE.ORG (129.83.29.2) with Microsoft SMTP Server (TLS) id 15.0.1130.7; Thu, 24 Mar 2016 13:35:28 -0400 Received: from gcc01-CY1-obe.outbound.protection.outlook.com (10.140.19.249) by imshyb02.MITRE.ORG (129.83.29.3) with Microsoft SMTP Server (TLS) id 15.0.1130.7 via Frontend Transport; Thu, 24 Mar 2016 13:35:28 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mitre.onmicrosoft.com; s=selector1-mitre-org; h=From:To:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=PHO58UZrLAuaCeqojZo37jdSVgfaIlZobT1p1OZX68o=; b=WrhLSXUFpBUqfniUeAUb2zvFKoQTlWd7DsietUWzlRQWiCHj6wNX6fx4GhW2g5NfDnf1wNlIX/+XlouPZrmlROj/s3CaJmgIBJT7hsJTiwEOdUZvjnFgEf0Xn33QthIIgECLJ5IsHRW+wsE6m10HDVIROp/cU0lQFcz5E0CrGQo= Received: from BY1PR09MB0920.namprd09.prod.outlook.com (10.162.144.157) by BY1PR09MB0918.namprd09.prod.outlook.com (10.162.144.155) with Microsoft SMTP Server (TLS) id 15.1.434.16; Thu, 24 Mar 2016 17:35:22 +0000 Received: from BY1PR09MB0920.namprd09.prod.outlook.com ([10.162.144.157]) by BY1PR09MB0920.namprd09.prod.outlook.com ([10.162.144.157]) with mapi id 15.01.0434.019; Thu, 24 Mar 2016 17:35:22 +0000 From: "Miller, Timothy J." To: John R Levine Thread-Topic: [smime] Key lookup service via draft-bhjl-x509-srv-00 Thread-Index: AQHRhTGmh22EPby4TE+kk5RKeaJMBp9nWoUA///EeQCAAGy0AIAA+HcQgAAwjICAACNwUA== Date: Thu, 24 Mar 2016 17:35:21 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: taugh.com; dkim=none (message not signed) header.d=none;taugh.com; dmarc=none action=none header.from=mitre.org; x-originating-ip: [192.160.51.86] x-ms-office365-filtering-correlation-id: ccc60deb-e382-4f08-d099-08d3540aad26 x-microsoft-exchange-diagnostics: 1; BY1PR09MB0918; 5:+dPkSbb9X0JoBG9J+ly2Apl+G80c/x1jVLSp2GgJDC5xYT6Zp72FGskRVgpG/P+3gkkXcnjuF9DIxnELWDvA8eDdnyfZXc0G0iB1VHRgIGxKsWeoh/XldaR3lHlW4OvDwJo2mqRpGQRoDZB6zL5Kig==; 24:hQopPAsxwMr+rUVXoE8yizRvGWOH1EceEq/OVkObo+AjfgTMAxUiSGCfM0iH8Z/woeIMytNZkzKPxFN4Mt0fNZfogORW9senFaNpccW/1hA= x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BY1PR09MB0918; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001); SRVR:BY1PR09MB0918; BCL:0; PCL:0; RULEID:; SRVR:BY1PR09MB0918; x-forefront-prvs: 0891BC3F3D x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(6009001)(66066001)(87936001)(93886004)(1096002)(5004730100002)(92566002)(230783001)(6116002)(4326007)(19580405001)(86362001)(102836003)(122556002)(76176999)(11100500001)(50986999)(1220700001)(2906002)(5003600100002)(74316001)(19580395003)(10400500002)(2900100001)(54356999)(3846002)(2950100001)(106116001)(3280700002)(5008740100001)(99286002)(586003)(33656002)(77096005)(110136002)(5002640100001)(76576001)(3660700001)(189998001); DIR:OUT; SFP:1101; SCL:1; SRVR:BY1PR09MB0918; H:BY1PR09MB0920.namprd09.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:23 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Mar 2016 17:35:21.8905 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: c620dc48-1d50-4952-8b39-df4d54d74d82 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY1PR09MB0918 X-OriginatorOrg: mitre.org Archived-At: Cc: PKIX , IETF SMIME Subject: Re: [smime] Key lookup service via draft-bhjl-x509-srv-00 X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Mar 2016 17:35:53 -0000 > I wouldn't disagree, but I would also point out that there are a lot of p= eople > who are eager to add a per-domain key lookup to their mail service. > There are proposals in DANE to publish PGP and S/MIME keys directly in th= e > DNS which are a bad idea for various reasons, but I don't see any reason = that > a domain operator shouldn't be able to offer a key server if it wants. S= cott > Rose at NIST and Richard Lau at ICANN have expressed interest in the DANE > versions, so I'd like to give them an option that could work. DANE's purpose is to allow me to clearly associate a trust anchor to a doma= in name, which is critical to resolve the "How do I signal which CA is auth= oritative?" problem in TLS/SSL, but I'm not sure that ports over to S/MIME.= In TLS the association between DNS name and a CA is virtually always 1:1 = (domain name owner and the service owner are the same organization), but in= S/MIME it's 1:many (the domain name owner and email users are not always t= he same organization; e.g., yahoo.com, gmail.com, hotmail.com, &etc.). Providing an option sounds good on paper, but in practice not so much. Opt= ions add complexity and ambiguity, and that leads to violated expectations,= which is counter to the goal of having something that "just works" such th= at it can be taken up without penalty. Simplicity serves that goal far bet= ter. > My main concern would be to keep it crystal clear that the key server > semantics are "foo.com asserts this is the key for bob@foo.com" rather th= an > "this is the key for bob@foo.com". A certificate repository is, at best, relaying *stale* information it got f= rom somewhere else. Only the MUA actually knows what keys are held by the = user at any given moment. So why have a middleman? Convenience? Convenie= nt access to the MUA's knowledge can be had without a central repository. = Why else? =20 -- T From nobody Thu Mar 24 11:31:07 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1989112D0B6 for ; Thu, 24 Mar 2016 11:31:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1536-bit key) header.d=iecc.com header.b=g9y0PEmU; dkim=pass (1536-bit key) header.d=taugh.com header.b=fj6WC2xu Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YzThoy-wXNFX for ; Thu, 24 Mar 2016 11:31:03 -0700 (PDT) Received: from miucha.iecc.com (abusenet-1-pt.tunnel.tserv4.nyc4.ipv6.he.net [IPv6:2001:470:1f06:1126::2]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 05B9712D0C1 for ; Thu, 24 Mar 2016 11:23:09 -0700 (PDT) Received: (qmail 50116 invoked from network); 24 Mar 2016 18:23:09 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=c3c3.56f4308d.k1603; bh=gAyW6yt5zPx39xQoN9BY5R1LVQQZ3r0UkT6xUzOeoWQ=; b=g9y0PEmUatS1ZQ0QkFKcodVa+krDDIxVXvgmRyg9XlEEgAukfKybL027bMV6yFkPFGkAUGgDA4gLGXCA0OeUJzSp0BD7mCFQs/1Z6u6Vk58sNkA5dx9O+LvhNSDftLQjnjJDQhM/sPwrPo/BKhxMxWRov21Hz8KFXZfYIMdNx4hgene1ccFjNHj0ozk93xX8cHTYYscM8jIUqVEK8jP8x3jyd76hkkRA/fcI99cpM1lKnOO8px6Rmh1vN5OO3OEQ DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=c3c3.56f4308d.k1603; bh=gAyW6yt5zPx39xQoN9BY5R1LVQQZ3r0UkT6xUzOeoWQ=; b=fj6WC2xuK115X0bURkwweXuTfnFA2PZmctw/HNrv4k1Zbaow8xGl2OCz5aEKRG+bD/RVWpKa8F96q9usfkSY1porr7MKT2N0dzty8x2iOQ2VPFNplxBg5FLSWAaXLbuLTwoC7ROp9YZo8rjYU2kfJh9a3f+XCqQfEz/lyxVRJffAVxm9jljPnYxRlUEf8keurXN6UJmXhmF+jPqP7osujJ5p+rsn0ka7z1KtIAaWcl/Cu8OD3MxRu94WbpXerSUM Received: from localhost ([IPv6:2001:470:1f07:1126::78:696d:6170]) by imap.iecc.com ([IPv6:2001:470:1f07:1126::78:696d:6170]) with ESMTPS (TLS1.0/X.509/SHA1) via TCP6; 24 Mar 2016 18:23:08 -0000 Date: 24 Mar 2016 14:23:08 -0400 Message-ID: From: "John R Levine" To: "Miller, Timothy J." In-Reply-To: References: User-Agent: Alpine 2.11 (OSX 23 2013-08-11) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; format=flowed; charset=US-ASCII Archived-At: Cc: PKIX , IETF SMIME Subject: Re: [smime] Key lookup service via draft-bhjl-x509-srv-00 X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Mar 2016 18:31:06 -0000 > A certificate repository is, at best, relaying *stale* information it > got from somewhere else. Only the MUA actually knows what keys are held > by the user at any given moment. So why have a middleman? > Convenience? Convenient access to the MUA's knowledge can be had > without a central repository. Why else? I'm sorry, this makes no sense. How is my MUA supposed to know about the key of someone from whom I have not yet received a message? Based on the arguments I've seen, the main point of a key lookup service is to enable opportunistic encryption on the first message. Also, your assertion that the cert repository is likely to be stale makes a bunch of assumptions that were reasonable in the 1990s but not now. For example, vast numbers of people primarily use web mail, so the MTA and MUA are the same, they're both attached to the web server, so the repository sees the same certs the users do. (We know why this model has all sorts of security problems, but half a billion web mail users aren't going away.) And in domains that are authorities for their users, e.g., businesses that provide accounts to their employees, the domain's repository is accurate by definition, and there's an argument that repository checks can detect some kinds of mail forgery. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY Please consider the environment before reading this e-mail. From nobody Thu Mar 24 12:59:22 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 839B612D826; Thu, 24 Mar 2016 12:59:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.21 X-Spam-Level: X-Spam-Status: No, score=-4.21 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mitre.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y11x8ZfXr41J; Thu, 24 Mar 2016 12:59:16 -0700 (PDT) Received: from smtpvmsrv1.mitre.org (smtpvmsrv1.mitre.org [192.52.194.136]) by ietfa.amsl.com (Postfix) with ESMTP id 67C9312D807; Thu, 24 Mar 2016 12:59:16 -0700 (PDT) Received: from smtpvmsrv1.mitre.org (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with SMTP id 0A39CABC0A7; Thu, 24 Mar 2016 15:59:16 -0400 (EDT) Received: from imshyb02.MITRE.ORG (imshyb02.mitre.org [129.83.29.3]) by smtpvmsrv1.mitre.org (Postfix) with ESMTP id EC2556C075C; Thu, 24 Mar 2016 15:59:15 -0400 (EDT) Received: from imshyb01.MITRE.ORG (129.83.29.2) by imshyb02.MITRE.ORG (129.83.29.3) with Microsoft SMTP Server (TLS) id 15.0.1130.7; Thu, 24 Mar 2016 15:59:15 -0400 Received: from gcc01-dm2-obe.outbound.protection.outlook.com (10.140.19.249) by imshyb01.MITRE.ORG (129.83.29.2) with Microsoft SMTP Server (TLS) id 15.0.1130.7 via Frontend Transport; Thu, 24 Mar 2016 15:59:15 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mitre.onmicrosoft.com; s=selector1-mitre-org; h=From:To:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=VyBvTWWEOe8vpWzFUe7gIstWAbLrIx96Hyb1xvpzX2M=; b=wWY+U38J0UATIZl4cX6bDdpzj3LJPelgwQ0yz5DhRvAH/Hkt3NRt3SmhFDREpjgmJC8Ft4WQO7jI69jjg64IE6Pv1XM44apD68HvLLZvckRyreDpbpMGIAi46RViYAgPkIbkRnt/KhasAMLtbvxaiEfSmDhvyn5W6M192MqrzBI= Received: from BY1PR09MB0920.namprd09.prod.outlook.com (10.162.144.157) by BY1PR09MB0919.namprd09.prod.outlook.com (10.162.144.156) with Microsoft SMTP Server (TLS) id 15.1.434.16; Thu, 24 Mar 2016 19:59:14 +0000 Received: from BY1PR09MB0920.namprd09.prod.outlook.com ([10.162.144.157]) by BY1PR09MB0920.namprd09.prod.outlook.com ([10.162.144.157]) with mapi id 15.01.0434.019; Thu, 24 Mar 2016 19:59:14 +0000 From: "Miller, Timothy J." To: John R Levine Thread-Topic: [smime] Key lookup service via draft-bhjl-x509-srv-00 Thread-Index: AQHRhTGmh22EPby4TE+kk5RKeaJMBp9nWoUA///EeQCAAGy0AIAA+HcQgAAwjICAACNwUIAAEeUAgAARZVA= Date: Thu, 24 Mar 2016 19:59:14 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: taugh.com; dkim=none (message not signed) header.d=none;taugh.com; dmarc=none action=none header.from=mitre.org; x-originating-ip: [192.160.51.86] x-ms-office365-filtering-correlation-id: 08e0c529-f3c0-4149-52cc-08d3541ec692 x-microsoft-exchange-diagnostics: 1; BY1PR09MB0919; 5:UaT0XRrRhUGaPgBbiovsHWhuOr/CekTNYkQYo+0DHrARCQcmW3JP7Qu828WC6ua5BUL8QzIXVrU3FPriAyc1WTUOLru23rRMM8C6Y1Tlw8tVJqJDHtIr6QBsV/KXum7g/6BPLFzrLsovPcenAWQuTg==; 24:vXH5USexZVPqkvcVAGXOBCvSF5pXf6ImOQSbOKeq2xZJYOwwQvUaYHEnczSEiwaxzDKx7z0+isIAwxzOdbXlztn8EaULrsdgKZeDRU3+fzI= x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BY1PR09MB0919; x-microsoft-antispam-prvs: x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001); SRVR:BY1PR09MB0919; BCL:0; PCL:0; RULEID:; SRVR:BY1PR09MB0919; x-forefront-prvs: 0891BC3F3D x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(6009001)(3660700001)(122556002)(74316001)(86362001)(5004730100002)(5002640100001)(3280700002)(2906002)(11100500001)(4326007)(345774005)(5003600100002)(99286002)(2950100001)(106116001)(1096002)(5008740100001)(93886004)(2900100001)(5890100001)(92566002)(33656002)(586003)(1220700001)(76176999)(77096005)(3846002)(102836003)(54356999)(87936001)(50986999)(10400500002)(6116002)(110136002)(76576001)(66066001)(230783001)(189998001); DIR:OUT; SFP:1101; SCL:1; SRVR:BY1PR09MB0919; H:BY1PR09MB0920.namprd09.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; spamdiagnosticoutput: 1:23 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Mar 2016 19:59:14.5352 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: c620dc48-1d50-4952-8b39-df4d54d74d82 X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY1PR09MB0919 X-OriginatorOrg: mitre.org Archived-At: Cc: PKIX , IETF SMIME Subject: Re: [smime] Key lookup service via draft-bhjl-x509-srv-00 X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Mar 2016 19:59:18 -0000 > I'm sorry, this makes no sense. How is my MUA supposed to know about the > key of someone from whom I have not yet received a message? Based on > the arguments I've seen, the main point of a key lookup service is to ena= ble > opportunistic encryption on the first message. My MUA knows my key. Your MUA knows your key. All that's missing is a way= to have my MUA talk to yours. =20 Practically speaking, S/MIME MUAs already do this using the quintessential = exchange of signed messages and automatic collection of certs when caching = contact data. However, this was never formalized into something that MUAs = could actively provide; rather, it was left as a passive function. GETSMIM= E was an attempt to make this active.=20 > Also, your assertion that the cert repository is likely to be stale makes= a > bunch of assumptions that were reasonable in the 1990s but not now. > For example, vast numbers of people primarily use web mail, so the MTA an= d > MUA are the same, they're both attached to the web server, so the > repository sees the same certs the users do.=20 I'm hesitant to enable something as incredibly...na=EFve...as would give a = convenient private key store for {insert your favorite Evil Agency here} to= target to further their surveillance goals. I take BCP 188 seriously, and= the best way to address that threat model is to preserve the end-to-end gu= arantees of S/MIME. You want S/MIME in webmail? We need Web Crypto implem= ented in browsers. Once you have Web Crypto, the private key store and the service provider ar= e separate again, and the repository goes stale. Also, since webmail service providers all allow fat clients (mobile mail ap= ps are fat clients using a web API and are not fundamentally different from= using a traditional mail client over POP3/IMAP4), in many (most?) use case= s the client's key store is still separate from the provider, so the provid= er's repository still can and will go stale. > And in domains that are authorities for their users, e.g., businesses tha= t > provide accounts to their employees, the domain's repository is accurate = by > definition,=20 Bzzt. Incorrect, but thank you for playing. :) Building and maintaining an enterprise PKI directory is actually very compl= ex, not fully automatable, and is a right royal PITA. For example, Outlook= wants userSMIMECertificate and will ignore userCertificate in most cases, = because userSMIMECertificate is a PKCS#7 object and contains the user's enc= ryption capabilities. However, you can't automatically generate the PKCS#7= object since it's signed and requires a user action. So even if you have = your CA publishing directly to AD, it's publishing userCert, and you have t= o *train your users* to drill down into Trust Center (3 to 4 clicks), re-se= t the S/MIME profile, and Publish to GAL *every time they get a new cert*. Good luck with that. :) > and there's an argument that repository checks can detect some > kinds of mail forgery. An MUA using key continuity concepts can do this too. -- T From nobody Thu Mar 24 14:13:17 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B2D4912D718 for ; Thu, 24 Mar 2016 14:13:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1536-bit key) header.d=iecc.com header.b=WV8O8RO/; dkim=pass (1536-bit key) header.d=taugh.com header.b=oWdO4FZH Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vD8rj0j5Hhsz for ; Thu, 24 Mar 2016 14:13:14 -0700 (PDT) Received: from miucha.iecc.com (abusenet-1-pt.tunnel.tserv4.nyc4.ipv6.he.net [IPv6:2001:470:1f06:1126::2]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 490DD12D81F for ; Thu, 24 Mar 2016 14:12:45 -0700 (PDT) Received: (qmail 72173 invoked from network); 24 Mar 2016 21:12:43 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=119ec.56f4584b.k1603; bh=wbZSHPupzKRwsLt6+PKndZVP+NHsPuKHA+clncM6hRw=; b=WV8O8RO/t3ytbWK/0zg35m3frLRISO+zOqc22qsy6n87PzghAJ1rirSlQ8tMVov6Sz9Bh5clCOGCmoBVk99MJ4/WUowSbL4e5/aGVIlINMbIFf3E7+LZBLskHLvQz3KE7V8XLR7i3s4DzGK5lEUvp9abzcnXt6Pfb5zFQa8+AM5Yr4b0+WnVNR4Em9B5ErXx8Pqldt1bG6Yuvo0r562u3pfCr32eJVS2Dbxx4xRmGmz/nPWHYyWkyhGMFgVXXOZs DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=119ec.56f4584b.k1603; bh=wbZSHPupzKRwsLt6+PKndZVP+NHsPuKHA+clncM6hRw=; b=oWdO4FZHlbapOqkzdE3G8VXuZFtdvUgbXKb8g1VxkqtCCxSAQuJncTz+LBTZa7jTPeKKfqUMWFlnSkXbQGt6xvKIK9H29uisAws0C1+HZyANbARwdIeSzTIMoYGjy9khvzE+FAXgKmwePmHSBIUGGALluyh2LOdH8UxdnExVHlNRbHrRufOSgNCG6hm96vj6Jq1lydW6mAAR/YSE7tRq5yKQLEE93ARpCpiGz2S4BRCvLAk02OMrWnqyXZ5dh2pW Received: from localhost ([IPv6:2001:470:1f07:1126::78:696d:6170]) by imap.iecc.com ([IPv6:2001:470:1f07:1126::78:696d:6170]) with ESMTPS (TLS1.0/X.509/SHA1) via TCP6; 24 Mar 2016 21:12:43 -0000 Date: 24 Mar 2016 17:12:43 -0400 Message-ID: From: "John R Levine" To: "Miller, Timothy J." In-Reply-To: References: User-Agent: Alpine 2.11 (OSX 23 2013-08-11) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Archived-At: Cc: PKIX , IETF SMIME Subject: Re: [smime] Key lookup service via draft-bhjl-x509-srv-00 X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Mar 2016 21:13:15 -0000 >> I'm sorry, this makes no sense. How is my MUA supposed to know about the >> key of someone from whom I have not yet received a message? Based on >> the arguments I've seen, the main point of a key lookup service is to enable >> opportunistic encryption on the first message. > > My MUA knows my key. Your MUA knows your key. All that's missing is a way to have my MUA talk to yours. Right. When you come up with a way for my MUA to fetch a key from your MUA when you have never sent me a message, let us know. In the meantime, I think you need a better argument against per-domain key stores than "I don't trust them." The people from DANE are determined to use per-domain stores, so it'd be a lot more useful to figure out how to minimize the suckage than to yet again stick our fingers in our ears and pretend we don't hear them. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY Please consider the environment before reading this e-mail. From nobody Sat Mar 26 06:57:23 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7110612D602 for ; Sat, 26 Mar 2016 06:57:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.71 X-Spam-Level: X-Spam-Status: No, score=-2.71 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S4_8X1XYb9oF for ; Sat, 26 Mar 2016 06:57:18 -0700 (PDT) Received: from mail-vk0-x22e.google.com (mail-vk0-x22e.google.com [IPv6:2607:f8b0:400c:c05::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E1C6E12D605 for ; Sat, 26 Mar 2016 06:57:16 -0700 (PDT) Received: by mail-vk0-x22e.google.com with SMTP id z68so115169493vkg.3 for ; Sat, 26 Mar 2016 06:57:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc; bh=hKyFXHRFGzJL7NVNcQ+KdUkLxsaynV1k8uwYoAPFKe0=; b=ErERPklBGUP1Lt/WF8cKT4/o0sQtgPsev/FAjWbpzGqYXOjRUAVERRFqlKP4G6zktz tx1xcoNzzS+EALlFcp3PobBKvsC0XmLGtgsVVOA+O7ljC1hxKD4u94P65dWCdaPUPvwI 80u4ZC5zwTMOcfk2ZVHACtmh51oVGam9Pw+sWbta+17oHejQ2Qw+VR7SNQPiJBXIN7oe 7WcZq2VfwA61qXtXj67d6ks9+Isu2OOYhhSd8y/jIRky9X7ID3wl0qBOsxUEkYUar/4w xE3jW+meULFyBFReoPqfi/XX3eWo7rS7A03fYlwuueWWejRG4QnfR2pio9R9nduSjkzc uOOA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc; bh=hKyFXHRFGzJL7NVNcQ+KdUkLxsaynV1k8uwYoAPFKe0=; b=T9RWceXQAIY/fI5Lxm4D43cJwwcvaxJFw3CpiDgK5BMhZcJ35R7TeNql4kaZ7SZ56H YzKkZ1l/HSCHBD9hVCDfzH3yYRDHwB+BH5kI4/fQTGlaW2xjaxAaUDSgeSfXNI15N06l 46hbHa0Rewxhb3psvFigavfNaBq0zyO4eidKGBkncvOcSK38lpI3O6pbAlzBCosQPkdy u9TkcTVXG5CwPgJDa+UjT0FCaqzzlb1x9oZ50y6pT4hNEsa5AHDWF1TbgiTgVNsnx6xt Qgw0jvkweLBpOa4jee3He3xzehn7AVPj6811RcQcXLgEad452mQeewEm/TpIIGG/+Uxm bV4w== X-Gm-Message-State: AD7BkJLViAkRhFUnBcl2+o7rcO/UzUYO/kIEPlyRodqXp1LRL/BmPrRl9Qx+PtLQFJWvcHpzXh/fz3FttJAON1f6 MIME-Version: 1.0 X-Received: by 10.31.149.78 with SMTP id x75mr9667802vkd.103.1459000635824; Sat, 26 Mar 2016 06:57:15 -0700 (PDT) Received: by 10.176.2.42 with HTTP; Sat, 26 Mar 2016 06:57:15 -0700 (PDT) In-Reply-To: References: <9A043F3CF02CD34C8E74AC1594475C73F4BDB8A8@uxcn10-5.UoA.auckland.ac.nz> <56d70399.8d41620a.19ae8.ffffeb3bSMTPIN_ADDED_MISSING@mx.google.com> Date: Sat, 26 Mar 2016 06:57:15 -0700 Message-ID: From: Wei Chuang To: Russ Housley Content-Type: multipart/alternative; boundary=001a11426748a0a757052ef40e72 Archived-At: Cc: IETF SMIME Subject: Re: [smime] Message takeover attacks against S/MIME X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 26 Mar 2016 13:57:22 -0000 --001a11426748a0a757052ef40e72 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Some more work item suggestions (I'm posting on behalf of someone who wishes to avoid the rough and tumble of discussion on the mailing list though reads it): * Making ECC an official part of S/MIME, RFC5753 is only informational. * Authenticated encryption. * A better mechanism than sign-encrypt-sign to get both authentication and confidentiality (or at least a non-strippable way of doing it) * Dropping obsolete ciphers and hashes from the spec: drop SHA-1, MD5, etc. * A modernized RFC 4134 (practical examples of S/MIME messages, it could avoid the fiasco of 3rd party forgetting ASN-1 tags in their messages). -Wei On Sun, Mar 13, 2016 at 9:38 AM, Wei Chuang wrote: > Some interesting usability consideration were raised on the PKIX list by > Martin Rex in the thread "another attempt to canonicalize local parts" that > could be addressed by a rechartered WG. He points out problems with > - Incompletely specified cert chains preventing signature verification > i.e. missing CA certs and no ability to fetch them. Fully specifying the > chains would resolve this. > - Reverifying old "archived" emails on his MUA not possible as the certs > have expired. Fixing a verification time on delivery or other scheme is > desirable. > > -Wei > > On Thu, Mar 10, 2016 at 11:12 AM, Wei Chuang wrote: > >> >> >> On Mon, Mar 7, 2016 at 10:58 PM, Russ Housley >> wrote: >> >>> I am hearing interest in these topics (a combination of things on this >>> list and side conversations). >>> >>> (1) Specify the way to use authenticated encryption in S/MIME. Note >>> that it is already done for CMS. >>> >>> (2) Specify conventions for AES-CCM, AES-GCM, and ChaCha20 with Poly1305 >>> authenticated encryption algorithms. >>> >>> (3) Specify conventions for using Curve25519 and Curve448 for key >>> agreement. >>> >>> (4) Specify conventions for using the CFRG chosen curves for elliptic >>> curve digital signature. >>> >>> (5) Specify a way to use PGP public keys in addition to PKIX >>> certificates. >>> >>> Anything else? >>> >> >> While I'm afraid of scope creep as resolving the above would be very >> useful, could also mail header integrity and privacy be considered? >> Perhaps the WG scope be split into near and long term work to help >> prioritize. The above five items be categorize as near term and the mail >> header work considered longer term? >> >> -Wei >> >> (PS yes there is RFC7508 which is experimental, and does not keep private >> the sender and recipient. Still it is an improvement...) >> >> >>> >>> Is this enough to re-charter the S/MIME WG? >>> >>> Russ >>> _______________________________________________ >>> smime mailing list >>> smime@ietf.org >>> https://www.ietf.org/mailman/listinfo/smime >>> >> >> > --001a11426748a0a757052ef40e72 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit
Some more work item suggestions (I'm posting on behalf of someone who wishes to avoid the rough and tumble of discussion on the mailing list though reads it):
* Making ECC an official part of S/MIME, RFC5753 is only informational. 
* Authenticated encryption. 
* A better mechanism than sign-encrypt-sign to get both authentication and confidentiality (or at least a non-strippable way of doing it)
* Dropping obsolete ciphers and hashes from the spec: drop SHA-1, MD5, etc.
* A modernized RFC 4134 (practical examples of S/MIME messages, it could avoid the fiasco of 3rd party forgetting ASN-1 tags in their messages).

-Wei


On Sun, Mar 13, 2016 at 9:38 AM, Wei Chuang <weihaw@google.com> wrote:
Some interesting usability consideration were raised on the PKIX list by Martin Rex in the thread "another attempt to canonicalize local parts" that could be addressed by a rechartered WG.  He points out problems with
- Incompletely specified cert chains preventing signature verification i.e. missing CA certs and no ability to fetch them.  Fully specifying the chains would resolve this.
- Reverifying old "archived" emails on his MUA not possible as the certs have expired.  Fixing a verification time on delivery or other scheme is desirable.

-Wei

On Thu, Mar 10, 2016 at 11:12 AM, Wei Chuang <weihaw@google.com> wrote:


On Mon, Mar 7, 2016 at 10:58 PM, Russ Housley <housley@vigilsec.com> wrote:
I am hearing interest in these topics (a combination of things on this list and side conversations).

(1) Specify the way to use authenticated encryption in S/MIME.  Note that it is already done for CMS.

(2) Specify conventions for AES-CCM, AES-GCM, and ChaCha20 with Poly1305 authenticated encryption algorithms.

(3) Specify conventions for using Curve25519 and Curve448 for key agreement.

(4) Specify conventions for using the CFRG chosen curves for elliptic curve digital signature.

(5) Specify a way to use PGP public keys in addition to PKIX certificates.

Anything else?

While I'm afraid of scope creep as resolving the above would be very useful, could also mail header integrity and privacy be considered?  Perhaps the WG scope be split into near and long term work to help prioritize.  The above five items be categorize as near term and the mail header work considered longer term?

-Wei 

(PS yes there is RFC7508 which is experimental, and does not keep private the sender and recipient.  Still it is an improvement...)
 

Is this enough to re-charter the S/MIME WG?

Russ
_______________________________________________
smime mailing list
smime@ietf.org
https://www.ietf.org/mailman/listinfo/smime



--001a11426748a0a757052ef40e72-- From nobody Mon Mar 28 06:10:39 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0FA9612D922 for ; Mon, 28 Mar 2016 06:10:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cOxDX4fG76-Y for ; Mon, 28 Mar 2016 06:10:35 -0700 (PDT) Received: from mail-qg0-x236.google.com (mail-qg0-x236.google.com [IPv6:2607:f8b0:400d:c04::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 98EC012D91D for ; Mon, 28 Mar 2016 06:10:35 -0700 (PDT) Received: by mail-qg0-x236.google.com with SMTP id c67so74097751qgc.1 for ; Mon, 28 Mar 2016 06:10:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=jasyjzxjRkJqy7hJCmKwwSgDrA6w7tLugOeyvXaS6P4=; b=SG7TyHLxUJqWbj0eQrG+jIGe+VDjkiFFLAeCwB3nmkN3Mc8eADIQg6qSu/xCCyF/Yi i3zB7/pRK764W/3zE/xNXw119jNR6voW/u3OKicDCy9F2bdogRe1UZpOwWiKWp1VkYG2 VeSJufh8mVOD6dzu/gSW/+u+YtFx7gK8xA4NQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=jasyjzxjRkJqy7hJCmKwwSgDrA6w7tLugOeyvXaS6P4=; b=jr1Wy4Np59fNAYojm9MvyPQ8nBJu+zEr9T/n/CLXPdQRQ87xGgDYLNpi99ryMAx2ZC o8kzeusE92hpCTEkkzTSe1/UfiLZGdFpV+dBppFsvZH5PjNwNbxDEz9iIDWiCKLvD8ci 40PONccaxARkUUxThXYUvVbnFAFxP8BVaQueBSABbn+M7Ebx7LGJPcwwwDvkwvhyr9vf H4M8szch/GcupBWkgxDhVMUdq11H3zP1Os7YbuKttsLa06kZNOBFGcj6Uw2gx8DVKylt /zXRhMwFMomgMURR58zytS3VdFu+G9qZZDzCk9xO/6gqhBWiV0OPCe3DgEp1d9Io5Ogl Bo7g== X-Gm-Message-State: AD7BkJJyNz9b56wJkkGp97chl1jLwwmXhceh/X9iCb2QpSOKEFYMzk+xoAvNxEX+xK+EBA== X-Received: by 10.140.142.199 with SMTP id 190mr12340745qho.77.1459170634706; Mon, 28 Mar 2016 06:10:34 -0700 (PDT) Received: from [172.16.0.112] ([96.231.217.211]) by smtp.gmail.com with ESMTPSA id y200sm11800317qka.48.2016.03.28.06.10.33 (version=TLSv1/SSLv3 cipher=OTHER); Mon, 28 Mar 2016 06:10:33 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) From: Sean Turner In-Reply-To: Date: Mon, 28 Mar 2016 09:10:32 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: References: <9A043F3CF02CD34C8E74AC1594475C73F4BDB8A8@uxcn10-5.UoA.auckland.ac.nz> <56d70399.8d41620a.19ae8.ffffeb3bSMTPIN_ADDED_MISSING@mx.google.com> To: Wei Chuang X-Mailer: Apple Mail (2.3124) Archived-At: Cc: IETF SMIME Subject: Re: [smime] Message takeover attacks against S/MIME X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 Mar 2016 13:10:38 -0000 If the patient is on the table, then all of these look like items we=E2=80= =99d need to address. spt > On Mar 26, 2016, at 09:57, Wei Chuang wrote: >=20 > Some more work item suggestions (I'm posting on behalf of someone who = wishes to avoid the rough and tumble of discussion on the mailing list = though reads it): > * Making ECC an official part of S/MIME, RFC5753 is only = informational.=20 > * Authenticated encryption.=20 > * A better mechanism than sign-encrypt-sign to get both authentication = and confidentiality (or at least a non-strippable way of doing it) > * Dropping obsolete ciphers and hashes from the spec: drop SHA-1, MD5, = etc. > * A modernized RFC 4134 (practical examples of S/MIME messages, it = could avoid the fiasco of 3rd party forgetting ASN-1 tags in their = messages). >=20 > -Wei >=20 >=20 > On Sun, Mar 13, 2016 at 9:38 AM, Wei Chuang wrote: > Some interesting usability consideration were raised on the PKIX list = by Martin Rex in the thread "another attempt to canonicalize local = parts" that could be addressed by a rechartered WG. He points out = problems with > - Incompletely specified cert chains preventing signature verification = i.e. missing CA certs and no ability to fetch them. Fully specifying = the chains would resolve this. > - Reverifying old "archived" emails on his MUA not possible as the = certs have expired. Fixing a verification time on delivery or other = scheme is desirable. >=20 > -Wei >=20 > On Thu, Mar 10, 2016 at 11:12 AM, Wei Chuang = wrote: >=20 >=20 > On Mon, Mar 7, 2016 at 10:58 PM, Russ Housley = wrote: > I am hearing interest in these topics (a combination of things on this = list and side conversations). >=20 > (1) Specify the way to use authenticated encryption in S/MIME. Note = that it is already done for CMS. >=20 > (2) Specify conventions for AES-CCM, AES-GCM, and ChaCha20 with = Poly1305 authenticated encryption algorithms. >=20 > (3) Specify conventions for using Curve25519 and Curve448 for key = agreement. >=20 > (4) Specify conventions for using the CFRG chosen curves for elliptic = curve digital signature. >=20 > (5) Specify a way to use PGP public keys in addition to PKIX = certificates. >=20 > Anything else? >=20 > While I'm afraid of scope creep as resolving the above would be very = useful, could also mail header integrity and privacy be considered? = Perhaps the WG scope be split into near and long term work to help = prioritize. The above five items be categorize as near term and the = mail header work considered longer term? >=20 > -Wei=20 >=20 > (PS yes there is RFC7508 which is experimental, and does not keep = private the sender and recipient. Still it is an improvement...) > =20 >=20 > Is this enough to re-charter the S/MIME WG? >=20 > Russ > _______________________________________________ > smime mailing list > smime@ietf.org > https://www.ietf.org/mailman/listinfo/smime >=20 >=20 >=20 > _______________________________________________ > smime mailing list > smime@ietf.org > https://www.ietf.org/mailman/listinfo/smime From nobody Mon Mar 28 09:49:04 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9548712DB72 for ; Mon, 28 Mar 2016 09:49:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AbrvRSdEGhCa for ; Mon, 28 Mar 2016 09:49:01 -0700 (PDT) Received: from smtp1.pacifier.net (smtp1.pacifier.net [64.255.237.171]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6AF3012DA42 for ; Mon, 28 Mar 2016 09:49:01 -0700 (PDT) Received: from hebrews (c-24-21-96-37.hsd1.or.comcast.net [24.21.96.37]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) (Authenticated sender: jimsch@nwlink.com) by smtp1.pacifier.net (Postfix) with ESMTPSA id B6A4D2CA1A; Mon, 28 Mar 2016 09:49:00 -0700 (PDT) From: "Jim Schaad" To: "'Sean Turner'" , "'Wei Chuang'" References: <9A043F3CF02CD34C8E74AC1594475C73F4BDB8A8@uxcn10-5.UoA.auckland.ac.nz> <56d70399.8d41620a.19ae8.ffffeb3bSMTPIN_ADDED_MISSING@mx.google.com> In-Reply-To: Date: Mon, 28 Mar 2016 09:49:00 -0700 Message-ID: <020501d18911$ba97b990$2fc72cb0$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQKtp9I9legZyi+Zwpzy1sVu6LFd5gJhbkylAaGHSNUBTUFJrAIcfrLXAdLx7RwCZQ044gF71B95nU3O2EA= Content-Language: en-us Archived-At: Cc: 'IETF SMIME' Subject: Re: [smime] Message takeover attacks against S/MIME X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 Mar 2016 16:49:03 -0000 I am open to suggestions, but until somebody gives be a better answer I = do not know how to do the following: > > * A better mechanism than sign-encrypt-sign to get both = authentication and > confidentiality (or at least a non-strippable way of doing it) Using and AEAD algorithm only solves part of the problem as one can do = an encrypt-sign but the outer integrity cannot be validated by a third = party. This is also set to be able for third parties to add the outer = signature layer and that has been used in several specifications so it = is not clear to me that this is one issue that needs to be fixed. I do to totally agree that we need to start moving to AEAD algorithms = however. jim > -----Original Message----- > From: smime [mailto:smime-bounces@ietf.org] On Behalf Of Sean Turner > Sent: Monday, March 28, 2016 6:11 AM > To: Wei Chuang > Cc: IETF SMIME > Subject: Re: [smime] Message takeover attacks against S/MIME >=20 > If the patient is on the table, then all of these look like items = we=E2=80=99d need to > address. >=20 > spt >=20 > > On Mar 26, 2016, at 09:57, Wei Chuang wrote: > > > > Some more work item suggestions (I'm posting on behalf of someone = who > wishes to avoid the rough and tumble of discussion on the mailing list = though > reads it): > > * Making ECC an official part of S/MIME, RFC5753 is only = informational. > > * Authenticated encryption. > > * A better mechanism than sign-encrypt-sign to get both = authentication and > confidentiality (or at least a non-strippable way of doing it) > > * Dropping obsolete ciphers and hashes from the spec: drop SHA-1, = MD5, etc. > > * A modernized RFC 4134 (practical examples of S/MIME messages, it = could > avoid the fiasco of 3rd party forgetting ASN-1 tags in their = messages). > > > > -Wei > > > > > > On Sun, Mar 13, 2016 at 9:38 AM, Wei Chuang = wrote: > > Some interesting usability consideration were raised on the PKIX = list by Martin > Rex in the thread "another attempt to canonicalize local parts" that = could be > addressed by a rechartered WG. He points out problems with > > - Incompletely specified cert chains preventing signature = verification i.e. > missing CA certs and no ability to fetch them. Fully specifying the = chains would > resolve this. > > - Reverifying old "archived" emails on his MUA not possible as the = certs have > expired. Fixing a verification time on delivery or other scheme is = desirable. > > > > -Wei > > > > On Thu, Mar 10, 2016 at 11:12 AM, Wei Chuang > wrote: > > > > > > On Mon, Mar 7, 2016 at 10:58 PM, Russ Housley > wrote: > > I am hearing interest in these topics (a combination of things on = this list and > side conversations). > > > > (1) Specify the way to use authenticated encryption in S/MIME. Note = that it is > already done for CMS. > > > > (2) Specify conventions for AES-CCM, AES-GCM, and ChaCha20 with = Poly1305 > authenticated encryption algorithms. > > > > (3) Specify conventions for using Curve25519 and Curve448 for key = agreement. > > > > (4) Specify conventions for using the CFRG chosen curves for = elliptic curve > digital signature. > > > > (5) Specify a way to use PGP public keys in addition to PKIX = certificates. > > > > Anything else? > > > > While I'm afraid of scope creep as resolving the above would be very = useful, > could also mail header integrity and privacy be considered? Perhaps = the WG > scope be split into near and long term work to help prioritize. The = above five > items be categorize as near term and the mail header work considered = longer > term? > > > > -Wei > > > > (PS yes there is RFC7508 which is experimental, and does not keep = private the > sender and recipient. Still it is an improvement...) > > > > > > Is this enough to re-charter the S/MIME WG? > > > > Russ > > _______________________________________________ > > smime mailing list > > smime@ietf.org > > https://www.ietf.org/mailman/listinfo/smime > > > > > > > > _______________________________________________ > > smime mailing list > > smime@ietf.org > > https://www.ietf.org/mailman/listinfo/smime >=20 > _______________________________________________ > smime mailing list > smime@ietf.org > https://www.ietf.org/mailman/listinfo/smime From nobody Tue Mar 29 01:25:48 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5665612D564 for ; Tue, 29 Mar 2016 01:25:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.85 X-Spam-Level: X-Spam-Status: No, score=-1.85 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RCVD_IN_SORBS_WEB=0.77] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cxe-C4YwEKOg for ; Tue, 29 Mar 2016 01:25:42 -0700 (PDT) Received: from mail04.dandomain.dk (mail04.dandomain.dk [194.150.112.204]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C498312D562 for ; Tue, 29 Mar 2016 01:25:41 -0700 (PDT) Received: from Morten ([62.44.134.186]) by mail04.dandomain.dk (DanDomain Mailserver) with ASMTP id 4201603291025357965 for ; Tue, 29 Mar 2016 10:25:35 +0200 From: "Erik Andersen" To: "'IETF SMIME'" References: <9A043F3CF02CD34C8E74AC1594475C73F4BDB8A8@uxcn10-5.UoA.auckland.ac.nz> <56d70399.8d41620a.19ae8.ffffeb3bSMTPIN_ADDED_MISSING@mx.google.com> <020501d18911$ba97b990$2fc72cb0$@augustcellars.com> In-Reply-To: <020501d18911$ba97b990$2fc72cb0$@augustcellars.com> Date: Tue, 29 Mar 2016 10:25:33 +0200 Message-ID: <000701d18994$923ad7b0$b6b08710$@x500.eu> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Outlook 15.0 Thread-Index: AQKtp9I9legZyi+Zwpzy1sVu6LFd5gJhbkylAaGHSNUBTUFJrAIcfrLXAdLx7RwCZQ044gF71B95AmMnGsSdO7uU8A== Content-Language: en-gb Archived-At: Subject: Re: [smime] Message takeover attacks against S/MIME X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 Mar 2016 08:25:47 -0000 Does any of proposed action for S/MIME affect CMS? Erik -----Oprindelig meddelelse----- Fra: smime [mailto:smime-bounces@ietf.org] P=C3=A5 vegne af Jim Schaad Sendt: 28 March 2016 18:49 Til: 'Sean Turner' ; 'Wei Chuang' Cc: 'IETF SMIME' Emne: Re: [smime] Message takeover attacks against S/MIME I am open to suggestions, but until somebody gives be a better answer I = do not know how to do the following: > > * A better mechanism than sign-encrypt-sign to get both=20 > > authentication and > confidentiality (or at least a non-strippable way of doing it) Using and AEAD algorithm only solves part of the problem as one can do = an encrypt-sign but the outer integrity cannot be validated by a third = party. This is also set to be able for third parties to add the outer = signature layer and that has been used in several specifications so it = is not clear to me that this is one issue that needs to be fixed. I do to totally agree that we need to start moving to AEAD algorithms = however. jim > -----Original Message----- > From: smime [mailto:smime-bounces@ietf.org] On Behalf Of Sean Turner > Sent: Monday, March 28, 2016 6:11 AM > To: Wei Chuang > Cc: IETF SMIME > Subject: Re: [smime] Message takeover attacks against S/MIME >=20 > If the patient is on the table, then all of these look like items = we=E2=80=99d=20 > need to address. >=20 > spt >=20 > > On Mar 26, 2016, at 09:57, Wei Chuang wrote: > > > > Some more work item suggestions (I'm posting on behalf of someone=20 > > who > wishes to avoid the rough and tumble of discussion on the mailing list = > though reads it): > > * Making ECC an official part of S/MIME, RFC5753 is only = informational. > > * Authenticated encryption. > > * A better mechanism than sign-encrypt-sign to get both=20 > > authentication and > confidentiality (or at least a non-strippable way of doing it) > > * Dropping obsolete ciphers and hashes from the spec: drop SHA-1, = MD5, etc. > > * A modernized RFC 4134 (practical examples of S/MIME messages, it=20 > > could > avoid the fiasco of 3rd party forgetting ASN-1 tags in their = messages). > > > > -Wei > > > > > > On Sun, Mar 13, 2016 at 9:38 AM, Wei Chuang = wrote: > > Some interesting usability consideration were raised on the PKIX=20 > > list by Martin > Rex in the thread "another attempt to canonicalize local parts" that=20 > could be addressed by a rechartered WG. He points out problems with > > - Incompletely specified cert chains preventing signature = verification i.e. > missing CA certs and no ability to fetch them. Fully specifying the=20 > chains would resolve this. > > - Reverifying old "archived" emails on his MUA not possible as the=20 > > certs have > expired. Fixing a verification time on delivery or other scheme is = desirable. > > > > -Wei > > > > On Thu, Mar 10, 2016 at 11:12 AM, Wei Chuang > wrote: > > > > > > On Mon, Mar 7, 2016 at 10:58 PM, Russ Housley > wrote: > > I am hearing interest in these topics (a combination of things on=20 > > this list and > side conversations). > > > > (1) Specify the way to use authenticated encryption in S/MIME. Note = > > that it is > already done for CMS. > > > > (2) Specify conventions for AES-CCM, AES-GCM, and ChaCha20 with=20 > > Poly1305 > authenticated encryption algorithms. > > > > (3) Specify conventions for using Curve25519 and Curve448 for key = agreement. > > > > (4) Specify conventions for using the CFRG chosen curves for=20 > > elliptic curve > digital signature. > > > > (5) Specify a way to use PGP public keys in addition to PKIX = certificates. > > > > Anything else? > > > > While I'm afraid of scope creep as resolving the above would be very = > > useful, > could also mail header integrity and privacy be considered? Perhaps=20 > the WG scope be split into near and long term work to help prioritize. = =20 > The above five items be categorize as near term and the mail header=20 > work considered longer term? > > > > -Wei > > > > (PS yes there is RFC7508 which is experimental, and does not keep=20 > > private the > sender and recipient. Still it is an improvement...) > > > > > > Is this enough to re-charter the S/MIME WG? > > > > Russ > > _______________________________________________ > > smime mailing list > > smime@ietf.org > > https://www.ietf.org/mailman/listinfo/smime > > > > > > > > _______________________________________________ > > smime mailing list > > smime@ietf.org > > https://www.ietf.org/mailman/listinfo/smime >=20 > _______________________________________________ > smime mailing list > smime@ietf.org > https://www.ietf.org/mailman/listinfo/smime _______________________________________________ smime mailing list smime@ietf.org https://www.ietf.org/mailman/listinfo/smime From nobody Tue Mar 29 07:50:31 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1A8E512D8C4 for ; Tue, 29 Mar 2016 07:50:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.71 X-Spam-Level: X-Spam-Status: No, score=-2.71 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vqW5dkr-bgoa for ; Tue, 29 Mar 2016 07:50:25 -0700 (PDT) Received: from mail-vk0-x234.google.com (mail-vk0-x234.google.com [IPv6:2607:f8b0:400c:c05::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DFAA012D8CE for ; Tue, 29 Mar 2016 07:50:23 -0700 (PDT) Received: by mail-vk0-x234.google.com with SMTP id e185so21069140vkb.1 for ; Tue, 29 Mar 2016 07:50:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc; bh=0yCR4V/DzYCpEZTzRjhpbzGvsmOTYqRZL5PVM7R74Bw=; b=ltkpdH8paLR4CweLEjgXaKnVycrOWRHId5XFYADDHulHBY8oA8Ydmmc4WSeUQ36fQE 49DObRBY0dnp8XuusgLD2ilvhLbe58b7IShcZFt3cunl7fZUu/RLC5HynCSoWsPQNmXC i1oNtHnkx6eypLEtZawW0Zw/hbGAEXWraNbeWD0lENYHn/YWIEqOYYBTiSIkLGSOPUFI 5pyQd4enkUqV/3NGzj0SNuCG4Av7oSBjMGyRf5VBsZH21kcsOSEg1pjIEoCJbOOHmBXt tRKo1MQp+97RwcKAdGRdMwA1ayVnDZaqy9sgg2BbVncrH9dEnHChoOZcQsYb0f9eOESb wnUQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc; bh=0yCR4V/DzYCpEZTzRjhpbzGvsmOTYqRZL5PVM7R74Bw=; b=BUZysM/5iKI1PlgIlaufohNeCBXAJcOzR2R0LWLy2MdtJFFZSIxvgLLO+QMCUjVMrp yGOSSoePlhlxuX3XIWAF40rnBHlpKoebp+xMjvVNCiaExv++66WvuFRAdggNxfFP6NDy nvEI4UlLuXPlCmJbPbTYCqy1Kna666UtsqzMWRqWebEPC5ymmwNvKBDtPOYbCtV3DD2T FqLZ1XMMJt2Jed/GTixPFMVGg0gY6NqoAP2Ax/4zW0fQas2uEvn3czhLrTJ0elvDbUvO n0lx6MTPRkFNLHb6/dOmW8FEmhrxxOj2yGrGMwlsW2UTjwNOD23INjo66foZlImXiWd5 MXlQ== X-Gm-Message-State: AD7BkJIinflRB9Ma61ER8ytGJ+vSe5pjoowCFkKCEomHy4XqYyxPvOc5qP2VAvrDc6dZojkLVuKJSucWAbVTlPkj MIME-Version: 1.0 X-Received: by 10.159.39.196 with SMTP id b62mr1372325uab.69.1459263022732; Tue, 29 Mar 2016 07:50:22 -0700 (PDT) Received: by 10.176.3.211 with HTTP; Tue, 29 Mar 2016 07:50:22 -0700 (PDT) In-Reply-To: <020501d18911$ba97b990$2fc72cb0$@augustcellars.com> References: <9A043F3CF02CD34C8E74AC1594475C73F4BDB8A8@uxcn10-5.UoA.auckland.ac.nz> <56d70399.8d41620a.19ae8.ffffeb3bSMTPIN_ADDED_MISSING@mx.google.com> <020501d18911$ba97b990$2fc72cb0$@augustcellars.com> Date: Tue, 29 Mar 2016 07:50:22 -0700 Message-ID: From: Wei Chuang To: Jim Schaad Content-Type: multipart/alternative; boundary=94eb2c1233441bd306052f3126d7 Archived-At: Cc: IETF SMIME Subject: Re: [smime] Message takeover attacks against S/MIME X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 Mar 2016 14:50:29 -0000 --94eb2c1233441bd306052f3126d7 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On Mon, Mar 28, 2016 at 9:49 AM, Jim Schaad wrote: > I am open to suggestions, but until somebody gives be a better answer I do > not know how to do the following: > > > > * A better mechanism than sign-encrypt-sign to get both authentication > and > > confidentiality (or at least a non-strippable way of doing it) > > Using and AEAD algorithm only solves part of the problem as one can do an > encrypt-sign but the outer integrity cannot be validated by a third party. > This is also set to be able for third parties to add the outer signature > layer and that has been used in several specifications so it is not clear > to me that this is one issue that needs to be fixed. > > I do to totally agree that we need to start moving to AEAD algorithms > however. > (Caveat: I'm not familiar with these techniques, and am posting in part to learn if this is a good idea.) Have folks here considered authenticated key exchange to generate per message symmetric key for AEAD? Making the exchange asynchronous appears to be possible as was done in TextSecure. There more description in the SoK paper (link ) around 13-16. Criticism of TextSecure suggest though, the pre-keying could cause problems for email applications. -Wei > > jim > > > -----Original Message----- > > From: smime [mailto:smime-bounces@ietf.org] On Behalf Of Sean Turner > > Sent: Monday, March 28, 2016 6:11 AM > > To: Wei Chuang > > Cc: IETF SMIME > > Subject: Re: [smime] Message takeover attacks against S/MIME > > > > If the patient is on the table, then all of these look like items we’d > need to > > address. > > > > spt > > > > > On Mar 26, 2016, at 09:57, Wei Chuang wrote: > > > > > > Some more work item suggestions (I'm posting on behalf of someone who > > wishes to avoid the rough and tumble of discussion on the mailing list > though > > reads it): > > > * Making ECC an official part of S/MIME, RFC5753 is only informational. > > > * Authenticated encryption. > > > * A better mechanism than sign-encrypt-sign to get both authentication > and > > confidentiality (or at least a non-strippable way of doing it) > > > * Dropping obsolete ciphers and hashes from the spec: drop SHA-1, MD5, > etc. > > > * A modernized RFC 4134 (practical examples of S/MIME messages, it > could > > avoid the fiasco of 3rd party forgetting ASN-1 tags in their messages). > > > > > > -Wei > > > > > > > > > On Sun, Mar 13, 2016 at 9:38 AM, Wei Chuang wrote: > > > Some interesting usability consideration were raised on the PKIX list > by Martin > > Rex in the thread "another attempt to canonicalize local parts" that > could be > > addressed by a rechartered WG. He points out problems with > > > - Incompletely specified cert chains preventing signature verification > i.e. > > missing CA certs and no ability to fetch them. Fully specifying the > chains would > > resolve this. > > > - Reverifying old "archived" emails on his MUA not possible as the > certs have > > expired. Fixing a verification time on delivery or other scheme is > desirable. > > > > > > -Wei > > > > > > On Thu, Mar 10, 2016 at 11:12 AM, Wei Chuang > > wrote: > > > > > > > > > On Mon, Mar 7, 2016 at 10:58 PM, Russ Housley > > wrote: > > > I am hearing interest in these topics (a combination of things on this > list and > > side conversations). > > > > > > (1) Specify the way to use authenticated encryption in S/MIME. Note > that it is > > already done for CMS. > > > > > > (2) Specify conventions for AES-CCM, AES-GCM, and ChaCha20 with > Poly1305 > > authenticated encryption algorithms. > > > > > > (3) Specify conventions for using Curve25519 and Curve448 for key > agreement. > > > > > > (4) Specify conventions for using the CFRG chosen curves for elliptic > curve > > digital signature. > > > > > > (5) Specify a way to use PGP public keys in addition to PKIX > certificates. > > > > > > Anything else? > > > > > > While I'm afraid of scope creep as resolving the above would be very > useful, > > could also mail header integrity and privacy be considered? Perhaps the > WG > > scope be split into near and long term work to help prioritize. The > above five > > items be categorize as near term and the mail header work considered > longer > > term? > > > > > > -Wei > > > > > > (PS yes there is RFC7508 which is experimental, and does not keep > private the > > sender and recipient. Still it is an improvement...) > > > > > > > > > Is this enough to re-charter the S/MIME WG? > > > > > > Russ > > > _______________________________________________ > > > smime mailing list > > > smime@ietf.org > > > https://www.ietf.org/mailman/listinfo/smime > > > > > > > > > > > > _______________________________________________ > > > smime mailing list > > > smime@ietf.org > > > https://www.ietf.org/mailman/listinfo/smime > > > > _______________________________________________ > > smime mailing list > > smime@ietf.org > > https://www.ietf.org/mailman/listinfo/smime > > --94eb2c1233441bd306052f3126d7 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit


On Mon, Mar 28, 2016 at 9:49 AM, Jim Schaad <ietf@augustcellars.com> wrote:
I am open to suggestions, but until somebody gives be a better answer I do not know how to do the following:

> > * A better mechanism than sign-encrypt-sign to get both authentication and
> confidentiality (or at least a non-strippable way of doing it)

Using and AEAD algorithm only solves part of the problem as one can do an encrypt-sign but the outer integrity cannot be validated by a third party.  This is also set to be able for third parties to add the outer signature layer and that has been used in several specifications so it is not clear to me that this is one issue that needs to be fixed.

I do to totally agree that we need to start moving to AEAD algorithms however.

(Caveat: I'm not familiar with these techniques, and am posting in part to learn if this is a good idea.)

Have folks here considered authenticated key exchange to generate per message symmetric key for AEAD?  Making the exchange asynchronous appears to be possible as was done in TextSecure.  There more description in the SoK paper (link) around 13-16.  Criticism of TextSecure suggest though, the pre-keying could cause problems for email applications.

-Wei
 

jim

> -----Original Message-----
> From: smime [mailto:smime-bounces@ietf.org] On Behalf Of Sean Turner
> Sent: Monday, March 28, 2016 6:11 AM
> To: Wei Chuang <weihaw@google.com>
> Cc: IETF SMIME <smime@ietf.org>
> Subject: Re: [smime] Message takeover attacks against S/MIME
>
> If the patient is on the table, then all of these look like items we’d need to
> address.
>
> spt
>
> > On Mar 26, 2016, at 09:57, Wei Chuang <weihaw@google.com> wrote:
> >
> > Some more work item suggestions (I'm posting on behalf of someone who
> wishes to avoid the rough and tumble of discussion on the mailing list though
> reads it):
> > * Making ECC an official part of S/MIME, RFC5753 is only informational.
> > * Authenticated encryption.
> > * A better mechanism than sign-encrypt-sign to get both authentication and
> confidentiality (or at least a non-strippable way of doing it)
> > * Dropping obsolete ciphers and hashes from the spec: drop SHA-1, MD5, etc.
> > * A modernized RFC 4134 (practical examples of S/MIME messages, it could
> avoid the fiasco of 3rd party forgetting ASN-1 tags in their messages).
> >
> > -Wei
> >
> >
> > On Sun, Mar 13, 2016 at 9:38 AM, Wei Chuang <weihaw@google.com> wrote:
> > Some interesting usability consideration were raised on the PKIX list by Martin
> Rex in the thread "another attempt to canonicalize local parts" that could be
> addressed by a rechartered WG.  He points out problems with
> > - Incompletely specified cert chains preventing signature verification i.e.
> missing CA certs and no ability to fetch them.  Fully specifying the chains would
> resolve this.
> > - Reverifying old "archived" emails on his MUA not possible as the certs have
> expired.  Fixing a verification time on delivery or other scheme is desirable.
> >
> > -Wei
> >
> > On Thu, Mar 10, 2016 at 11:12 AM, Wei Chuang <weihaw@google.com>
> wrote:
> >
> >
> > On Mon, Mar 7, 2016 at 10:58 PM, Russ Housley <housley@vigilsec.com>
> wrote:
> > I am hearing interest in these topics (a combination of things on this list and
> side conversations).
> >
> > (1) Specify the way to use authenticated encryption in S/MIME.  Note that it is
> already done for CMS.
> >
> > (2) Specify conventions for AES-CCM, AES-GCM, and ChaCha20 with Poly1305
> authenticated encryption algorithms.
> >
> > (3) Specify conventions for using Curve25519 and Curve448 for key agreement.
> >
> > (4) Specify conventions for using the CFRG chosen curves for elliptic curve
> digital signature.
> >
> > (5) Specify a way to use PGP public keys in addition to PKIX certificates.
> >
> > Anything else?
> >
> > While I'm afraid of scope creep as resolving the above would be very useful,
> could also mail header integrity and privacy be considered?  Perhaps the WG
> scope be split into near and long term work to help prioritize.  The above five
> items be categorize as near term and the mail header work considered longer
> term?
> >
> > -Wei
> >
> > (PS yes there is RFC7508 which is experimental, and does not keep private the
> sender and recipient.  Still it is an improvement...)
> >
> >
> > Is this enough to re-charter the S/MIME WG?
> >
> > Russ
> > _______________________________________________
> > smime mailing list
> > smime@ietf.org
> > https://www.ietf.org/mailman/listinfo/smime
> >
> >
> >
> > _______________________________________________
> > smime mailing list
> > smime@ietf.org
> > https://www.ietf.org/mailman/listinfo/smime
>
> _______________________________________________
> smime mailing list
> smime@ietf.org
> https://www.ietf.org/mailman/listinfo/smime


--94eb2c1233441bd306052f3126d7-- From nobody Tue Mar 29 11:49:15 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5584712E198 for ; Tue, 29 Mar 2016 11:49:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.9 X-Spam-Level: X-Spam-Status: No, score=-101.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cM-632IsjyEs for ; Tue, 29 Mar 2016 11:49:10 -0700 (PDT) Received: from odin.smetech.net (x-bolt-wan.smeinc.net [209.135.219.146]) by ietfa.amsl.com (Postfix) with ESMTP id 3688E12E1DD for ; Tue, 29 Mar 2016 11:15:48 -0700 (PDT) Received: from localhost (ronin.smetech.net [209.135.209.5]) by odin.smetech.net (Postfix) with ESMTP id E4236F24064; Tue, 29 Mar 2016 13:53:46 -0400 (EDT) X-Virus-Scanned: amavisd-new at smetech.net Received: from odin.smetech.net ([209.135.209.4]) by localhost (ronin.smeinc.net [209.135.209.5]) (amavisd-new, port 10024) with ESMTP id fJ5QLMXBevmm; Tue, 29 Mar 2016 13:39:43 -0400 (EDT) Received: from [192.168.2.100] (pool-108-51-128-219.washdc.fios.verizon.net [108.51.128.219]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by odin.smetech.net (Postfix) with ESMTP id 01DFAF24062; Tue, 29 Mar 2016 13:53:45 -0400 (EDT) Content-Type: text/plain; charset=windows-1252 Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) From: Russ Housley In-Reply-To: <000701d18994$923ad7b0$b6b08710$@x500.eu> Date: Tue, 29 Mar 2016 13:39:23 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: <6B4EFF8B-9BF8-41C9-8DEE-D83A0E805ED9@vigilsec.com> References: <9A043F3CF02CD34C8E74AC1594475C73F4BDB8A8@uxcn10-5.UoA.auckland.ac.nz> <56d70399.8d41620a.19ae8.ffffeb3bSMTPIN_ADDED_MISSING@mx.google.com> <020501d18911$ba97b990$2fc72cb0$@augustcellars.com> <000701d18994$923ad7b0$b6b08710$@x500.eu> To: Erik Andersen X-Mailer: Apple Mail (2.1878.6) Archived-At: Cc: IETF SMIME Subject: Re: [smime] Message takeover attacks against S/MIME X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 29 Mar 2016 18:49:13 -0000 Erik: CMS already has a content type that supports AEAD algorithms. There = will probably need to be some documents that specify the conventions for = using new AEAD algorithms, but I do not anticipate any changes to CMS = itself. Russ On Mar 29, 2016, at 4:25 AM, Erik Andersen wrote: > Does any of proposed action for S/MIME affect CMS? >=20 > Erik >=20 > -----Oprindelig meddelelse----- > Fra: smime [mailto:smime-bounces@ietf.org] P=E5 vegne af Jim Schaad > Sendt: 28 March 2016 18:49 > Til: 'Sean Turner' ; 'Wei Chuang' > Cc: 'IETF SMIME' > Emne: Re: [smime] Message takeover attacks against S/MIME >=20 > I am open to suggestions, but until somebody gives be a better answer = I do not know how to do the following: >=20 >>> * A better mechanism than sign-encrypt-sign to get both=20 >>> authentication and >> confidentiality (or at least a non-strippable way of doing it) >=20 > Using and AEAD algorithm only solves part of the problem as one can do = an encrypt-sign but the outer integrity cannot be validated by a third = party. This is also set to be able for third parties to add the outer = signature layer and that has been used in several specifications so it = is not clear to me that this is one issue that needs to be fixed. >=20 > I do to totally agree that we need to start moving to AEAD algorithms = however. >=20 > jim >=20 >> -----Original Message----- >> From: smime [mailto:smime-bounces@ietf.org] On Behalf Of Sean Turner >> Sent: Monday, March 28, 2016 6:11 AM >> To: Wei Chuang >> Cc: IETF SMIME >> Subject: Re: [smime] Message takeover attacks against S/MIME >>=20 >> If the patient is on the table, then all of these look like items = we=92d=20 >> need to address. >>=20 >> spt >>=20 >>> On Mar 26, 2016, at 09:57, Wei Chuang wrote: >>>=20 >>> Some more work item suggestions (I'm posting on behalf of someone=20 >>> who >> wishes to avoid the rough and tumble of discussion on the mailing = list=20 >> though reads it): >>> * Making ECC an official part of S/MIME, RFC5753 is only = informational. >>> * Authenticated encryption. >>> * A better mechanism than sign-encrypt-sign to get both=20 >>> authentication and >> confidentiality (or at least a non-strippable way of doing it) >>> * Dropping obsolete ciphers and hashes from the spec: drop SHA-1, = MD5, etc. >>> * A modernized RFC 4134 (practical examples of S/MIME messages, it=20= >>> could >> avoid the fiasco of 3rd party forgetting ASN-1 tags in their = messages). >>>=20 >>> -Wei >>>=20 >>>=20 >>> On Sun, Mar 13, 2016 at 9:38 AM, Wei Chuang = wrote: >>> Some interesting usability consideration were raised on the PKIX=20 >>> list by Martin >> Rex in the thread "another attempt to canonicalize local parts" that=20= >> could be addressed by a rechartered WG. He points out problems with >>> - Incompletely specified cert chains preventing signature = verification i.e. >> missing CA certs and no ability to fetch them. Fully specifying the=20= >> chains would resolve this. >>> - Reverifying old "archived" emails on his MUA not possible as the=20= >>> certs have >> expired. Fixing a verification time on delivery or other scheme is = desirable. >>>=20 >>> -Wei >>>=20 >>> On Thu, Mar 10, 2016 at 11:12 AM, Wei Chuang >> wrote: >>>=20 >>>=20 >>> On Mon, Mar 7, 2016 at 10:58 PM, Russ Housley >> wrote: >>> I am hearing interest in these topics (a combination of things on=20 >>> this list and >> side conversations). >>>=20 >>> (1) Specify the way to use authenticated encryption in S/MIME. Note=20= >>> that it is >> already done for CMS. >>>=20 >>> (2) Specify conventions for AES-CCM, AES-GCM, and ChaCha20 with=20 >>> Poly1305 >> authenticated encryption algorithms. >>>=20 >>> (3) Specify conventions for using Curve25519 and Curve448 for key = agreement. >>>=20 >>> (4) Specify conventions for using the CFRG chosen curves for=20 >>> elliptic curve >> digital signature. >>>=20 >>> (5) Specify a way to use PGP public keys in addition to PKIX = certificates. >>>=20 >>> Anything else? >>>=20 >>> While I'm afraid of scope creep as resolving the above would be very=20= >>> useful, >> could also mail header integrity and privacy be considered? Perhaps=20= >> the WG scope be split into near and long term work to help = prioritize. =20 >> The above five items be categorize as near term and the mail header=20= >> work considered longer term? >>>=20 >>> -Wei >>>=20 >>> (PS yes there is RFC7508 which is experimental, and does not keep=20 >>> private the >> sender and recipient. Still it is an improvement...) >>>=20 >>>=20 >>> Is this enough to re-charter the S/MIME WG? >>>=20 >>> Russ >>> _______________________________________________ >>> smime mailing list >>> smime@ietf.org >>> https://www.ietf.org/mailman/listinfo/smime >>>=20 >>>=20 >>>=20 >>> _______________________________________________ >>> smime mailing list >>> smime@ietf.org >>> https://www.ietf.org/mailman/listinfo/smime >>=20 >> _______________________________________________ >> smime mailing list >> smime@ietf.org >> https://www.ietf.org/mailman/listinfo/smime >=20 > _______________________________________________ > smime mailing list > smime@ietf.org > https://www.ietf.org/mailman/listinfo/smime >=20 > _______________________________________________ > smime mailing list > smime@ietf.org > https://www.ietf.org/mailman/listinfo/smime From nobody Tue Mar 29 17:13:57 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CDD7F12DA45 for ; Tue, 29 Mar 2016 17:13:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Qfruq39yK_cF for ; Tue, 29 Mar 2016 17:13:53 -0700 (PDT) Received: from smtp3.pacifier.net (smtp3.pacifier.net [64.255.237.177]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 79EE112D120 for ; Tue, 29 Mar 2016 17:13:53 -0700 (PDT) Received: from hebrews (unknown [65.124.92.30]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) (Authenticated sender: jimsch@nwlink.com) by smtp3.pacifier.net (Postfix) with ESMTPSA id 98FB138EFE; Tue, 29 Mar 2016 17:13:52 -0700 (PDT) From: "Jim Schaad" To: "'Russ Housley'" , "'Erik Andersen'" References: <9A043F3CF02CD34C8E74AC1594475C73F4BDB8A8@uxcn10-5.UoA.auckland.ac.nz> <56d70399.8d41620a.19ae8.ffffeb3bSMTPIN_ADDED_MISSING@mx.google.com> <020501d18911$ba97b990$2fc72cb0$@augustcellars.com> <000701d18994$923ad7b0$b6b08710$@x500.eu> <6B4EFF8B-9BF8-41C9-8DEE-D83A0E805ED9@vigilsec.com> In-Reply-To: <6B4EFF8B-9BF8-41C9-8DEE-D83A0E805ED9@vigilsec.com> Date: Tue, 29 Mar 2016 17:13:51 -0700 Message-ID: <055d01d18a19$0ad4d1b0$207e7510$@augustcellars.com> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQKtp9I9legZyi+Zwpzy1sVu6LFd5gJhbkylAaGHSNUBTUFJrAIcfrLXAdLx7RwCZQ044gF71B95AmMnGsQBpsUt0AIMvxnanR8ok6A= Content-Language: en-us Archived-At: Cc: 'IETF SMIME' Subject: Re: [smime] Message takeover attacks against S/MIME X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Mar 2016 00:13:56 -0000 The one change that might hit CMS is the ability to use PGP keys. It depends on if we want to do this just for encryption or for both = encryption and signing. Jim > -----Original Message----- > From: smime [mailto:smime-bounces@ietf.org] On Behalf Of Russ Housley > Sent: Tuesday, March 29, 2016 10:39 AM > To: Erik Andersen > Cc: IETF SMIME > Subject: Re: [smime] Message takeover attacks against S/MIME >=20 > Erik: >=20 > CMS already has a content type that supports AEAD algorithms. There = will > probably need to be some documents that specify the conventions for = using new > AEAD algorithms, but I do not anticipate any changes to CMS itself. >=20 > Russ >=20 >=20 > On Mar 29, 2016, at 4:25 AM, Erik Andersen wrote: >=20 > > Does any of proposed action for S/MIME affect CMS? > > > > Erik > > > > -----Oprindelig meddelelse----- > > Fra: smime [mailto:smime-bounces@ietf.org] P=E5 vegne af Jim Schaad > > Sendt: 28 March 2016 18:49 > > Til: 'Sean Turner' ; 'Wei Chuang' = > > Cc: 'IETF SMIME' > > Emne: Re: [smime] Message takeover attacks against S/MIME > > > > I am open to suggestions, but until somebody gives be a better = answer I do not > know how to do the following: > > > >>> * A better mechanism than sign-encrypt-sign to get both > >>> authentication and > >> confidentiality (or at least a non-strippable way of doing it) > > > > Using and AEAD algorithm only solves part of the problem as one can = do an > encrypt-sign but the outer integrity cannot be validated by a third = party. This is > also set to be able for third parties to add the outer signature layer = and that has > been used in several specifications so it is not clear to me that this = is one issue > that needs to be fixed. > > > > I do to totally agree that we need to start moving to AEAD = algorithms > however. > > > > jim > > > >> -----Original Message----- > >> From: smime [mailto:smime-bounces@ietf.org] On Behalf Of Sean = Turner > >> Sent: Monday, March 28, 2016 6:11 AM > >> To: Wei Chuang > >> Cc: IETF SMIME > >> Subject: Re: [smime] Message takeover attacks against S/MIME > >> > >> If the patient is on the table, then all of these look like items > >> we=92d need to address. > >> > >> spt > >> > >>> On Mar 26, 2016, at 09:57, Wei Chuang wrote: > >>> > >>> Some more work item suggestions (I'm posting on behalf of someone > >>> who > >> wishes to avoid the rough and tumble of discussion on the mailing > >> list though reads it): > >>> * Making ECC an official part of S/MIME, RFC5753 is only informational. > >>> * Authenticated encryption. > >>> * A better mechanism than sign-encrypt-sign to get both > >>> authentication and > >> confidentiality (or at least a non-strippable way of doing it) > >>> * Dropping obsolete ciphers and hashes from the spec: drop SHA-1, = MD5, > etc. > >>> * A modernized RFC 4134 (practical examples of S/MIME messages, it > >>> could > >> avoid the fiasco of 3rd party forgetting ASN-1 tags in their = messages). > >>> > >>> -Wei > >>> > >>> > >>> On Sun, Mar 13, 2016 at 9:38 AM, Wei Chuang > wrote: > >>> Some interesting usability consideration were raised on the PKIX > >>> list by Martin > >> Rex in the thread "another attempt to canonicalize local parts" = that > >> could be addressed by a rechartered WG. He points out problems = with > >>> - Incompletely specified cert chains preventing signature = verification i.e. > >> missing CA certs and no ability to fetch them. Fully specifying = the > >> chains would resolve this. > >>> - Reverifying old "archived" emails on his MUA not possible as the > >>> certs have > >> expired. Fixing a verification time on delivery or other scheme is desirable. > >>> > >>> -Wei > >>> > >>> On Thu, Mar 10, 2016 at 11:12 AM, Wei Chuang > >> wrote: > >>> > >>> > >>> On Mon, Mar 7, 2016 at 10:58 PM, Russ Housley = > >> wrote: > >>> I am hearing interest in these topics (a combination of things on > >>> this list and > >> side conversations). > >>> > >>> (1) Specify the way to use authenticated encryption in S/MIME. = Note > >>> that it is > >> already done for CMS. > >>> > >>> (2) Specify conventions for AES-CCM, AES-GCM, and ChaCha20 with > >>> Poly1305 > >> authenticated encryption algorithms. > >>> > >>> (3) Specify conventions for using Curve25519 and Curve448 for key > agreement. > >>> > >>> (4) Specify conventions for using the CFRG chosen curves for > >>> elliptic curve > >> digital signature. > >>> > >>> (5) Specify a way to use PGP public keys in addition to PKIX certificates. > >>> > >>> Anything else? > >>> > >>> While I'm afraid of scope creep as resolving the above would be = very > >>> useful, > >> could also mail header integrity and privacy be considered? = Perhaps > >> the WG scope be split into near and long term work to help = prioritize. > >> The above five items be categorize as near term and the mail header > >> work considered longer term? > >>> > >>> -Wei > >>> > >>> (PS yes there is RFC7508 which is experimental, and does not keep > >>> private the > >> sender and recipient. Still it is an improvement...) > >>> > >>> > >>> Is this enough to re-charter the S/MIME WG? > >>> > >>> Russ > >>> _______________________________________________ > >>> smime mailing list > >>> smime@ietf.org > >>> https://www.ietf.org/mailman/listinfo/smime > >>> > >>> > >>> > >>> _______________________________________________ > >>> smime mailing list > >>> smime@ietf.org > >>> https://www.ietf.org/mailman/listinfo/smime > >> > >> _______________________________________________ > >> smime mailing list > >> smime@ietf.org > >> https://www.ietf.org/mailman/listinfo/smime > > > > _______________________________________________ > > smime mailing list > > smime@ietf.org > > https://www.ietf.org/mailman/listinfo/smime > > > > _______________________________________________ > > smime mailing list > > smime@ietf.org > > https://www.ietf.org/mailman/listinfo/smime >=20 > _______________________________________________ > smime mailing list > smime@ietf.org > https://www.ietf.org/mailman/listinfo/smime From nobody Wed Mar 30 04:23:18 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D07EB12D623 for ; Wed, 30 Mar 2016 04:23:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.21 X-Spam-Level: X-Spam-Status: No, score=-4.21 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_MED=-2.3, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=auckland.ac.nz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8fbuKMStco9D for ; Wed, 30 Mar 2016 04:23:15 -0700 (PDT) Received: from mx4.auckland.ac.nz (mx4.auckland.ac.nz [130.216.125.248]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A37CE12D613 for ; Wed, 30 Mar 2016 04:23:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=mail; t=1459336993; x=1490872993; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=gcs8ikneNqa5UbVXHa9mi8XHV8yzRWHXFCkb8yUZ8iQ=; b=iqK2ntwwsKZHUj/cX6BuOKcQf3CX77QOhEAExRBSJmF3csPfHVolbwyx JDmePshW6o/sETnpHHocvFKePA/ZSDUQYODy5NCnX+Q93JbhwcaSOIz4U 6pqyUHAzWPomWxOy00BRzlufs3J6FL72UoWocKVZzxC04GNa9Rric9YgJ HCVXQA+u1tLoaAAAdvb7vbxSj0CXMbiWlclY9wbnMAZI9156ejLbyXg8k MkuuJZhXWgzDCMyb1PojVlZZd0D+XMtzkMWjgazoeUP62GgrahQGged9y AdcUX1wqxg8HBu7rsLicTXpkF6HF2j4VXOtLFMEK1jnyp5JMZuohzZeIi g==; X-IronPort-AV: E=Sophos;i="5.24,415,1454929200"; d="scan'208";a="77112779" X-Ironport-HAT: MAIL-SERVERS - $RELAYED X-Ironport-Source: 130.216.4.125 - Outgoing - Outgoing Received: from uxchange10-fe3.uoa.auckland.ac.nz ([130.216.4.125]) by mx4-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 31 Mar 2016 00:23:11 +1300 Received: from UXCN10-TDC05.UoA.auckland.ac.nz ([169.254.9.241]) by uxchange10-fe3.UoA.auckland.ac.nz ([169.254.143.234]) with mapi id 14.03.0266.001; Thu, 31 Mar 2016 00:23:09 +1300 From: Peter Gutmann To: Jim Schaad , 'Russ Housley' , 'Erik Andersen' Thread-Topic: [smime] Message takeover attacks against S/MIME Thread-Index: AQHReQf7JMy3QB0AekazgnXWRUYJpJ9SNaoAgASL9oCAFEEwgIADF5wAgAA9CgCAAQWrgIAAmr2AgABuN4CAAZTU0g== Date: Wed, 30 Mar 2016 11:23:08 +0000 Message-ID: <9A043F3CF02CD34C8E74AC1594475C73F4C3497C@uxcn10-tdc05.UoA.auckland.ac.nz> References: <9A043F3CF02CD34C8E74AC1594475C73F4BDB8A8@uxcn10-5.UoA.auckland.ac.nz> <56d70399.8d41620a.19ae8.ffffeb3bSMTPIN_ADDED_MISSING@mx.google.com> <020501d18911$ba97b990$2fc72cb0$@augustcellars.com> <000701d18994$923ad7b0$b6b08710$@x500.eu> <6B4EFF8B-9BF8-41C9-8DEE-D83A0E805ED9@vigilsec.com>, <055d01d18a19$0ad4d1b0$207e7510$@augustcellars.com> In-Reply-To: <055d01d18a19$0ad4d1b0$207e7510$@augustcellars.com> Accept-Language: en-NZ, en-GB, en-US Content-Language: en-NZ X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.6.2.2] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Cc: 'IETF SMIME' Subject: Re: [smime] Message takeover attacks against S/MIME X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Mar 2016 11:23:17 -0000 Jim Schaad writes:=0A= =0A= >The one change that might hit CMS is the ability to use PGP keys. It depe= nds=0A= >on if we want to do this just for encryption or for both encryption and=0A= >signing.=0A= =0A= What would prevent you from using them right now? I've been using (or at= =0A= least suppoting the use of) PGP keys for CMS for years, you just use the ke= y=0A= ID instead of the (absent) issuerAndSerialNumber.=0A= =0A= The reason for the "supporting the use of" is that I don't think anyone=0A= actually cares about using PGP keys for CMS/SMIME. Is there any actual dem= and=0A= for it?=0A= =0A= Peter.= From nobody Thu Mar 31 12:03:32 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AB29312D0C8 for ; Thu, 31 Mar 2016 12:03:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V1TV5lOdLUT8 for ; Thu, 31 Mar 2016 12:03:27 -0700 (PDT) Received: from sc9-admin2.yaanatech.net (63-128-177-42-static.dzbja.com [63.128.177.42]) by ietfa.amsl.com (Postfix) with ESMTP id 7CC7012D73A for ; Thu, 31 Mar 2016 12:03:18 -0700 (PDT) Received: from extmail1.yaanatech.com (extmail1.yaanatech.com [63.128.177.51]) by sc9-admin2.yaanatech.net (Postfix) with ESMTP id 6DC0C1A7; Thu, 31 Mar 2016 19:03:18 +0000 (UTC) Received: from [192.168.1.51] (pool-173-67-205-17.clppva.fios.verizon.net [173.67.205.17]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by extmail1.yaanatech.com (Postfix) with ESMTP id 152205808E; Thu, 31 Mar 2016 19:00:01 +0000 (UTC) References: <9A043F3CF02CD34C8E74AC1594475C73F4BDB8A8@uxcn10-5.UoA.auckland.ac.nz> <56d70399.8d41620a.19ae8.ffffeb3bSMTPIN_ADDED_MISSING@mx.google.com> <020501d18911$ba97b990$2fc72cb0$@augustcellars.com> <000701d18994$923ad7b0$b6b08710$@x500.eu> To: Erik Andersen , 'IETF SMIME' From: Tony Rutkowski Organization: Yaana Technologies Message-ID: <56FD7471.1030208@yaanatech.com> Date: Thu, 31 Mar 2016 15:03:13 -0400 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.7.0 MIME-Version: 1.0 In-Reply-To: <000701d18994$923ad7b0$b6b08710$@x500.eu> Content-Type: multipart/mixed; boundary="------------060401050604000809000205" Archived-At: Subject: Re: [smime] Message takeover attacks against S/MIME X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: tony@yaanatech.com List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 31 Mar 2016 19:03:31 -0000 This is a multi-part message in MIME format. --------------060401050604000809000205 Content-Type: multipart/alternative; boundary="------------060307070503070404060709" --------------060307070503070404060709 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Are we discussing the IETF's CMS or the ITU-T's just adopted version as X.894? --tony On 2016-03-29 4:25 AM, Erik Andersen wrote: > Does any of proposed action for S/MIME affect CMS? > > Erik > > -----Oprindelig meddelelse----- > Fra: smime [mailto:smime-bounces@ietf.org] På vegne af Jim Schaad > Sendt: 28 March 2016 18:49 > Til: 'Sean Turner' ; 'Wei Chuang' > Cc: 'IETF SMIME' > Emne: Re: [smime] Message takeover attacks against S/MIME > > I am open to suggestions, but until somebody gives be a better answer I do not know how to do the following: > >>> * A better mechanism than sign-encrypt-sign to get both >>> authentication and >> confidentiality (or at least a non-strippable way of doing it) > Using and AEAD algorithm only solves part of the problem as one can do an encrypt-sign but the outer integrity cannot be validated by a third party. This is also set to be able for third parties to add the outer signature layer and that has been used in several specifications so it is not clear to me that this is one issue that needs to be fixed. > > I do to totally agree that we need to start moving to AEAD algorithms however. > > jim > >> -----Original Message----- >> From: smime [mailto:smime-bounces@ietf.org] On Behalf Of Sean Turner >> Sent: Monday, March 28, 2016 6:11 AM >> To: Wei Chuang >> Cc: IETF SMIME >> Subject: Re: [smime] Message takeover attacks against S/MIME >> >> If the patient is on the table, then all of these look like items we’d >> need to address. >> >> spt >> >>> On Mar 26, 2016, at 09:57, Wei Chuang wrote: >>> >>> Some more work item suggestions (I'm posting on behalf of someone >>> who >> wishes to avoid the rough and tumble of discussion on the mailing list >> though reads it): >>> * Making ECC an official part of S/MIME, RFC5753 is only informational. >>> * Authenticated encryption. >>> * A better mechanism than sign-encrypt-sign to get both >>> authentication and >> confidentiality (or at least a non-strippable way of doing it) >>> * Dropping obsolete ciphers and hashes from the spec: drop SHA-1, MD5, etc. >>> * A modernized RFC 4134 (practical examples of S/MIME messages, it >>> could >> avoid the fiasco of 3rd party forgetting ASN-1 tags in their messages). >>> -Wei >>> >>> >>> On Sun, Mar 13, 2016 at 9:38 AM, Wei Chuang wrote: >>> Some interesting usability consideration were raised on the PKIX >>> list by Martin >> Rex in the thread "another attempt to canonicalize local parts" that >> could be addressed by a rechartered WG. He points out problems with >>> - Incompletely specified cert chains preventing signature verification i.e. >> missing CA certs and no ability to fetch them. Fully specifying the >> chains would resolve this. >>> - Reverifying old "archived" emails on his MUA not possible as the >>> certs have >> expired. Fixing a verification time on delivery or other scheme is desirable. >>> -Wei >>> >>> On Thu, Mar 10, 2016 at 11:12 AM, Wei Chuang >> wrote: >>> >>> On Mon, Mar 7, 2016 at 10:58 PM, Russ Housley >> wrote: >>> I am hearing interest in these topics (a combination of things on >>> this list and >> side conversations). >>> (1) Specify the way to use authenticated encryption in S/MIME. Note >>> that it is >> already done for CMS. >>> (2) Specify conventions for AES-CCM, AES-GCM, and ChaCha20 with >>> Poly1305 >> authenticated encryption algorithms. >>> (3) Specify conventions for using Curve25519 and Curve448 for key agreement. >>> >>> (4) Specify conventions for using the CFRG chosen curves for >>> elliptic curve >> digital signature. >>> (5) Specify a way to use PGP public keys in addition to PKIX certificates. >>> >>> Anything else? >>> >>> While I'm afraid of scope creep as resolving the above would be very >>> useful, >> could also mail header integrity and privacy be considered? Perhaps >> the WG scope be split into near and long term work to help prioritize. >> The above five items be categorize as near term and the mail header >> work considered longer term? >>> -Wei >>> >>> (PS yes there is RFC7508 which is experimental, and does not keep >>> private the >> sender and recipient. Still it is an improvement...) >>> >>> Is this enough to re-charter the S/MIME WG? >>> >>> Russ >>> _______________________________________________ >>> smime mailing list >>> smime@ietf.org >>> https://www.ietf.org/mailman/listinfo/smime >>> >>> >>> >>> _______________________________________________ >>> smime mailing list >>> smime@ietf.org >>> https://www.ietf.org/mailman/listinfo/smime >> _______________________________________________ >> smime mailing list >> smime@ietf.org >> https://www.ietf.org/mailman/listinfo/smime > _______________________________________________ > smime mailing list > smime@ietf.org > https://www.ietf.org/mailman/listinfo/smime > > _______________________________________________ > smime mailing list > smime@ietf.org > https://www.ietf.org/mailman/listinfo/smime -- ________________________________ ** *Anthony Michael Rutkowski* EVP, Industry Standards & Regulatory Affairs tony@yaanatech.com +1 703 999 8270 ________________________________ ** *Yaana Technologies LLC * 542 Gibraltar Drive Milpitas CA 95035 USA --------------060307070503070404060709 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit Are we discussing the IETF's CMS or
the ITU-T's just adopted version as
X.894?
--tony

On 2016-03-29 4:25 AM, Erik Andersen wrote:
Does any of proposed action for S/MIME affect CMS?

Erik

-----Oprindelig meddelelse-----
Fra: smime [mailto:smime-bounces@ietf.org] På vegne af Jim Schaad
Sendt: 28 March 2016 18:49
Til: 'Sean Turner' <sean@sn3rd.com>; 'Wei Chuang' <weihaw@google.com>
Cc: 'IETF SMIME' <smime@ietf.org>
Emne: Re: [smime] Message takeover attacks against S/MIME

I am open to suggestions, but until somebody gives be a better answer I do not know how to do the following:


* A better mechanism than sign-encrypt-sign to get both 
authentication and

confidentiality (or at least a non-strippable way of doing it)

Using and AEAD algorithm only solves part of the problem as one can do an encrypt-sign but the outer integrity cannot be validated by a third party.  This is also set to be able for third parties to add the outer signature layer and that has been used in several specifications so it is not clear to me that this is one issue that needs to be fixed.

I do to totally agree that we need to start moving to AEAD algorithms however.

jim


-----Original Message-----
From: smime [mailto:smime-bounces@ietf.org] On Behalf Of Sean Turner
Sent: Monday, March 28, 2016 6:11 AM
To: Wei Chuang <weihaw@google.com>
Cc: IETF SMIME <smime@ietf.org>
Subject: Re: [smime] Message takeover attacks against S/MIME

If the patient is on the table, then all of these look like items we’d 
need to address.

spt


On Mar 26, 2016, at 09:57, Wei Chuang <weihaw@google.com> wrote:

Some more work item suggestions (I'm posting on behalf of someone 
who

wishes to avoid the rough and tumble of discussion on the mailing list 
though reads it):

* Making ECC an official part of S/MIME, RFC5753 is only informational.
* Authenticated encryption.
* A better mechanism than sign-encrypt-sign to get both 
authentication and

confidentiality (or at least a non-strippable way of doing it)

* Dropping obsolete ciphers and hashes from the spec: drop SHA-1, MD5, etc.
* A modernized RFC 4134 (practical examples of S/MIME messages, it 
could

avoid the fiasco of 3rd party forgetting ASN-1 tags in their messages).

-Wei


On Sun, Mar 13, 2016 at 9:38 AM, Wei Chuang <weihaw@google.com> wrote:
Some interesting usability consideration were raised on the PKIX 
list by Martin

Rex in the thread "another attempt to canonicalize local parts" that 
could be addressed by a rechartered WG.  He points out problems with

- Incompletely specified cert chains preventing signature verification i.e.

missing CA certs and no ability to fetch them.  Fully specifying the 
chains would resolve this.

- Reverifying old "archived" emails on his MUA not possible as the 
certs have

expired.  Fixing a verification time on delivery or other scheme is desirable.

-Wei

On Thu, Mar 10, 2016 at 11:12 AM, Wei Chuang <weihaw@google.com>

wrote:


On Mon, Mar 7, 2016 at 10:58 PM, Russ Housley <housley@vigilsec.com>

wrote:

I am hearing interest in these topics (a combination of things on 
this list and

side conversations).

(1) Specify the way to use authenticated encryption in S/MIME.  Note 
that it is

already done for CMS.

(2) Specify conventions for AES-CCM, AES-GCM, and ChaCha20 with 
Poly1305

authenticated encryption algorithms.

(3) Specify conventions for using Curve25519 and Curve448 for key agreement.

(4) Specify conventions for using the CFRG chosen curves for 
elliptic curve

digital signature.

(5) Specify a way to use PGP public keys in addition to PKIX certificates.

Anything else?

While I'm afraid of scope creep as resolving the above would be very 
useful,

could also mail header integrity and privacy be considered?  Perhaps 
the WG scope be split into near and long term work to help prioritize.  
The above five items be categorize as near term and the mail header 
work considered longer term?

-Wei

(PS yes there is RFC7508 which is experimental, and does not keep 
private the

sender and recipient.  Still it is an improvement...)


Is this enough to re-charter the S/MIME WG?

Russ
_______________________________________________
smime mailing list
smime@ietf.org
https://www.ietf.org/mailman/listinfo/smime



_______________________________________________
smime mailing list
smime@ietf.org
https://www.ietf.org/mailman/listinfo/smime

_______________________________________________
smime mailing list
smime@ietf.org
https://www.ietf.org/mailman/listinfo/smime

_______________________________________________
smime mailing list
smime@ietf.org
https://www.ietf.org/mailman/listinfo/smime

_______________________________________________
smime mailing list
smime@ietf.org
https://www.ietf.org/mailman/listinfo/smime

--

________________________________

Anthony Michael Rutkowski

EVP, Industry Standards & Regulatory Affairs

tony@yaanatech.com

+1 703 999 8270

________________________________

Yaana Technologies LLC

542 Gibraltar Drive

Milpitas CA 95035 USA

--------------060307070503070404060709-- --------------060401050604000809000205 Content-Type: application/msword; name="T13-SG17-160314-TD-PLEN-2558!R1!MSW-E.doc" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="T13-SG17-160314-TD-PLEN-2558!R1!MSW-E.doc" 0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAAAFAAAAVwIAAAAA AAAAEAAAWgIAAAEAAAD+////AAAAAFICAABTAgAAVAIAAFUCAABWAgAA//////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ///////////////////////////////////spcEAX+AJBAAA+BK/AAAAAAAAMAAAAAAACAAA 8YsBAA4AYmpiatpD2kMAAAAAAAAAAAAAAAAAAAAAAAAJBBYAPjIDALgpRFy4KURcZIEBAAAA AACMAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//w8AAAAAAAAAAAD//w8AAAAAAAAAAAD//w8A AAAAAAAAAAAAAAAAAAAAALcAAAAAAFQrAAAAAAAAVCsAAMw4AAAAAAAAzDgAAAAAAADMOAAA AAAAAMw4AAAAAAAAzDgAABQAAAAAAAAAAAAAAP////8AAAAA4DgAAAAAAADgOAAAAAAAAOA4 AAA4AAAAGDkAAKQDAAC8PAAA/AIAAOA4AAAAAAAA8y8BAHQDAAC4PwAAngIAAFZCAAA6AAAA kEIAAAAAAACQQgAAAAAAAJBCAAAAAAAA2EMAAMgCAACgRgAA9AAAAJRHAAB8AAAAQi8BAAIA AABELwEAAAAAAEQvAQAAAAAARC8BAAAAAABELwEAAAAAAEQvAQAAAAAARC8BACQAAABnMwEA tgIAAB02AQBGAQAAaC8BABUAAAAAAAAAAAAAAAAAAAAAAAAAzDgAAAAAAAAQSAAAAAAAAAAA AAAAAAAAAAAAAAAAAADYQwAAAAAAANhDAAAAAAAAEEgAAAAAAAAQSAAAAAAAAGgvAQAAAAAA AAAAAAAAAADMOAAAAAAAAMw4AAAAAAAAkEIAAAAAAAAAAAAAAAAAAJBCAABIAQAAfS8BADoA AAAStgAAAAAAABK2AAAAAAAAErYAAAAAAAAQSAAAQD8AAMw4AAAAAAAAkEIAAAAAAADMOAAA AAAAAJBCAAAAAAAAQi8BAAAAAAAAAAAAAAAAABK2AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEEgAAAAAAABCLwEAAAAAAAAAAAAAAAAA ErYAAAAAAAAStgAAtgQAALweAQBgAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvCgBAAAAAACQQgAA AAAAAP////8AAAAA0AVfZlSD0QEAAAAAAAAAAP////8AAAAAUIcAAN4WAAAcIgEAXAAAAAAA AAAAAAAALi8BABQAAAC3LwEAPAAAAPMvAQAAAAAAeCIBAEQGAABjNwEAAAAAAC6eAAD8BAAA YzcBALgAAAC8KAEANgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADyKAEAOAAAAGM3AQAAAAAAAAAAAAAAAADMOAAA AAAAACopAQAEBgAAEEgAAAAAAAAQSAAAAAAAABK2AAAAAAAAEEgAAAAAAAAQSAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEEgAAAAAAAAQSAAAAAAAABBIAAAAAAAA aC8BAAAAAABoLwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKqMAAOgS AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBIAAAAAAAAEEgAAAAAAAAQSAAA AAAAAPMvAQAAAAAAEEgAAAAAAAAQSAAAAAAAABBIAAAAAAAAEEgAAAAAAAAAAAAAAAAAAP// //8AAAAA/////wAAAAD/////AAAAAAAAAAAAAAAA/////wAAAAD/////AAAAAP////8AAAAA /////wAAAAD/////AAAAAP////8AAAAA/////wAAAAD/////AAAAAP////8AAAAA/////wAA AAD/////AAAAAP////8AAAAA/////wAAAAD/////AAAAAGM3AQAAAAAAEEgAAAAAAAAQSAAA AAAAABBIAAAAAAAAEEgAAAAAAAAQSAAAAAAAABBIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQSAAAAAAAABBIAAAAAAAA EEgAAAAAAABUKwAAPgwAAJI3AAA6AQAABQASAQAACQQECAEEAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAElOVEVSTkFUSU9OQUwgVEVMRUNPTU1VTklDQVRJT04g VU5JT04HU1RVRFkgR1JPVVAgMTcHB1RFTEVDT01NVU5JQ0FUSU9OC1NUQU5EQVJESVpBVElP TiBTRUNUT1INU1RVRFkgUEVSSU9EIDIwMTMtMjAxNgdURCAyNTU4IFJldi4xIAcHB0VuZ2xp c2ggb25seQ1PcmlnaW5hbDogRW5nbGlzaAcHUXVlc3Rpb24ocyk6BzExLzE3B0dlbmV2YSwg MTQtMjMgTWFyY2ggMjAxNgcHVEQNKFJlZi46IFREIDI0NzkgUmV2LjEpBwdTb3VyY2U6B0Vk aXRvcgcHVGl0bGU6B1guY21zIHRleHQgZm9yIENvbnNlbnQHBw1JTlRFUk5BVElPTkFMIFNU QU5EQVJEIDxOYnI+DUlUVS1UIFJFQ09NTUVOREFUSU9OIDxOYnI+DQ1HZW5lcmljIGFwcGxp Y2F0aW9ucyBvZiBBU04uMQ1DcnlwdG9ncmFwaGljIE1lc3NhZ2UgU3ludGF4DVN1bW1hcnkg DVRoaXMgUmVjb21tZW5kYXRpb24gfCBJbnRlcm5hdGlvbmFsIFN0YW5kYXJkIGRlZmluZXMg ZGF0YSBpbnRlZ3JpdHksIGNvbmZpZGVudGlhbGl0eSwgb3JpZ2luIGF1dGhlbnRpY2l0eSwg YW5kIG5vbi1yZXB1ZGlhdGlvbiBzZXJ2aWNlcyBuZWVkZWQgZm9yIHJlbGlhYmxlIGluZm9y bWF0aW9uIGV4Y2hhbmdlIGFuZCBmb3Igc3Ryb25nIGF1dGhlbnRpY2F0aW9uLiBJdCBhbHNv IGJyaW5ncyB0b2dldGhlciBhIHNldCBvZiBjcnlwdG9ncmFwaGljIGtleSBtYW5hZ2VtZW50 IHRlY2huaXF1ZXMgdG8gc3VwcG9ydCBmbGV4aWJsZSBrZXkgZXN0YWJsaXNobWVudCBtZWNo YW5pc21zLCBzdWNoIGFzIGNvbnN0cnVjdGl2ZSBrZXkgbWFuYWdlbWVudCwga2V5IGFncmVl bWVudCwga2V5IGV4Y2hhbmdlLCBhbmQgcGFzc3dvcmQtYmFzZWQgZW5jcnlwdGlvbi4gVGhl c2UgdGVjaG5pcXVlcyBjYW4gYmUgdXNlZCB0byBwcmV2ZW50IGZyYXVkLCBhbmQgdG8gcHJv dGVjdCBwZXJzb25hbGx5IGlkZW50aWZpYWJsZSBhbmQgb3RoZXIgc2Vuc2l0aXZlIGluZm9y bWF0aW9uIGZyb20gdGhlIHRocmVhdHMgb3V0bGluZWQgYWJvdmUuIFRoaXMgUmVjb21tZW5k YXRpb24gfCBJbnRlcm5hdGlvbmFsIFN0YW5kYXJkIHdpbGwgc3VwcG9ydCBkaWdpdGFsIHNp Z25hdHVyZSwgZW5jcnlwdGlvbiwgYW5kIHNpZ25jcnlwdGlvbiB0ZWNobmlxdWVzIGJhc2Vk IG9uIHRoZSBwdWJsaWMta2V5IHRlY2hub2xvZ3kgZGVmaW5lZCBpbiB0aGUgSVRVLVQgWC41 MDAgc2VyaWVzIHwgSVNPL0lFQyA5NTk0IG11bHRpcGFydCBzdGFuZGFyZC4gQWxsIHRoZSBz dGFuZGFyZGl6ZWQgZW5jb2RpbmcgcnVsZXMgZm9yIEFTTi4xIGFyZSBzdXBwb3J0ZWQuDUtl eXdvcmRzDUF1dGhlbnRpY2F0ZWREYXRhLA1DcnlwdG9ncmFwaGljIE1lc3NhZ2UgU3ludGF4 LCANRGlnZXN0ZWREYXRhLA1FbmNyeXB0ZWREYXRhLA1FbnZlbG9wZWREYXRhLA1TaWduY3J5 cHRlZERhdGEsDVNpZ25lZERhdGENDVNjb3BlDVRoaXMgUmVjb21tZW5kYXRpb24gfCBJbnRl cm5hdGlvbmFsIFN0YW5kYXJkIGVuaGFuY2VzIHRoZSBleGlzdGluZyBjcnlwdG9ncmFwaGlj IG1lc3NhZ2Ugc3ludGF4IHByb3RvY29sIGJ5IGFkZGluZyBzaWduY3J5dGlvbiB0ZWNobmlx dWVzIGFuZCBwcm92aWRpbmcgYSBuZXcgQVNOLjEgbW9kdWxlIHdoaWNoIGNvbmZvcm1zIHRv IHRoZSBsYXN0IGVkaXRpb24gb2YgdGhlIEFTTi4xIHN0YW5kYXJkIHdoaWNoIGNhbiBiZSB1 c2VkIHdpdGggYWxsIHN0YW5kYXJkaXplZCBlbmNvZGluZyBydWxlcyBvZiBBU04uMS4NTm9y bWF0aXZlIHJlZmVyZW5jZXMNVGhlIGZvbGxvd2luZyBSZWNvbW1lbmRhdGlvbnMgYW5kIElu dGVybmF0aW9uYWwgU3RhbmRhcmRzIGNvbnRhaW4gcHJvdmlzaW9ucyB3aGljaCwgdGhyb3Vn aCByZWZlcmVuY2UgaW4gdGhpcyB0ZXh0LCBjb25zdGl0dXRlIHByb3Zpc2lvbnMgb2YgdGhp cyBSZWNvbW1lbmRhdGlvbiB8IEludGVybmF0aW9uYWwgU3RhbmRhcmQuIEF0IHRoZSB0aW1l IG9mIHB1YmxpY2F0aW9uLCB0aGUgZWRpdGlvbnMgaW5kaWNhdGVkIHdlcmUgdmFsaWQuIEFs bCBSZWNvbW1lbmRhdGlvbnMgYW5kIFN0YW5kYXJkcyBhcmUgc3ViamVjdCB0byByZXZpc2lv biwgYW5kIHBhcnRpZXMgdG8gYWdyZWVtZW50cyBiYXNlZCBvbiB0aGlzIFJlY29tbWVuZGF0 aW9uIHwgSW50ZXJuYXRpb25hbCBTdGFuZGFyZCBhcmUgZW5jb3VyYWdlZCB0byBpbnZlc3Rp Z2F0ZSB0aGUgcG9zc2liaWxpdHkgb2YgYXBwbHlpbmcgdGhlIG1vc3QgcmVjZW50IGVkaXRp b24gb2YgdGhlIFJlY29tbWVuZGF0aW9ucyBhbmQgU3RhbmRhcmRzIGxpc3RlZCBiZWxvdy4g TWVtYmVycyBvZiBJRUMgYW5kIElTTyBtYWludGFpbiByZWdpc3RlcnMgb2YgY3VycmVudGx5 IHZhbGlkIEludGVybmF0aW9uYWwgU3RhbmRhcmRzLiBUaGUgVGVsZWNvbW11bmljYXRpb24g U3RhbmRhcmRpemF0aW9uIEJ1cmVhdSBvZiB0aGUgSVRVIG1haW50YWlucyBhIGxpc3Qgb2Yg Y3VycmVudGx5IHZhbGlkIElUVS1UIFJlY29tbWVuZGF0aW9ucy4NSWRlbnRpY2FsIFJlY29t bWVuZGF0aW9ucyB8IEludGVybmF0aW9uYWwgU3RhbmRhcmRzDVJlY29tbWVuZGF0aW9uIElU VS1UIFguNTA5ICgyMDEyKSB8IElTTy9JRUMgOTU5NC04OjIwMTQsIEluZm9ybWF0aW9uIHRl Y2hub2xvZ3kgliBPcGVuIHN5c3RlbXMgaW50ZXJjb25uZWN0aW9uIJYgVGhlIERpcmVjdG9y eTogUHVibGljLWtleSBhbmQgYXR0cmlidXRlIGNlcnRpZmljYXRlIGZyYW1ld29ya3MuDVJl Y29tbWVuZGF0aW9uIElUVS1UIFguNjgwICgyMDE1KSB8IElTTy9JRUMgODgyNC0xOjIwMTUs oEluZm9ybWF0aW9uIHRlY2hub2xvZ3kgliBBYnN0cmFjdCBTeW50YXggTm90YXRpb24gT25l IChBU04uMSk6IFNwZWNpZmljYXRpb24gb2YgYmFzaWMgbm90YXRpb24uDZYJUmVjb21tZW5k YXRpb24gSVRVLVQgWC42ODEgKDIwMTUpIHwgSVNPL0lFQyA4ODI0LTI6MjAxNSygSW5mb3Jt YXRpb24gdGVjaG5vbG9neSCWIEFic3RyYWN0IFN5bnRheCBOb3RhdGlvbiBPbmUgKEFTTi4x KTogSW5mb3JtYXRpb24gb2JqZWN0IHNwZWNpZmljYXRpb24uDZYJUmVjb21tZW5kYXRpb24g SVRVLVQgWC42ODIgKDIwMTUpIHwgSVNPL0lFQyA4ODI0LTM6MjAxNSygSW5mb3JtYXRpb24g dGVjaG5vbG9neSCWIEFic3RyYWN0IFN5bnRheCBOb3RhdGlvbiBPbmUgKEFTTi4xKTogQ29u c3RyYWludCBzcGVjaWZpY2F0aW9uLg2WCVJlY29tbWVuZGF0aW9uIElUVS1UIFguNjgzICgy MDE1KSB8IElTTy9JRUMgODgyNC00OjIwMTUsoEluZm9ybWF0aW9uIHRlY2hub2xvZ3kgliBB YnN0cmFjdCBTeW50YXggTm90YXRpb24gT25lIChBU04uMSk6IFBhcmFtZXRlcml6YXRpb24g b2YgQVNOLjEgc3BlY2lmaWNhdGlvbnMuDVJlY29tbWVuZGF0aW9uIElUVS1UIFguNjkwICgy MDE1KSB8IElTTy9JRUMgODgyNS0xOjIwMTUsIEluZm9ybWF0aW9uIHRlY2hub2xvZ3kgliBB U04uMSBlbmNvZGluZyBydWxlczogU3BlY2lmaWNhdGlvbiBvZiBCYXNpYyBFbmNvZGluZyBS dWxlcyAoQkVSKSwgQ2Fub25pY2FsIEVuY29kaW5nIFJ1bGVzIChDRVIpIGFuZCBEaXN0aW5n dWlzaGVkIEVuY29kaW5nIFJ1bGVzIChERVIpLg1SZWNvbW1lbmRhdGlvbiBJVFUtVCBYLjY5 MSAoMjAxNSkgfCBJU08vSUVDIDg4MjUtMjoyMDE1LCBJbmZvcm1hdGlvbiB0ZWNobm9sb2d5 IJYgQVNOLjEgZW5jb2RpbmcgcnVsZXM6IFNwZWNpZmljYXRpb24gb2YgUGFja2VkIEVuY29k aW5nIFJ1bGVzIChQRVIpLg1SZWNvbW1lbmRhdGlvbiBJVFUtVCBYLjY5MyAoMjAxNSkgfCBJ U08vSUVDIDg4MjUtNDoyMDE1LCBJbmZvcm1hdGlvbiB0ZWNobm9sb2d5IJYgQVNOLjEgZW5j b2RpbmcgcnVsZXM6IFhNTCBFbmNvZGluZyBSdWxlcyAoWEVSKS4NUmVjb21tZW5kYXRpb24g SVRVLVQgWC42OTYgKDIwMTUpIHwgSVNPL0lFQyA4ODI1LTc6MjAxNSwgSW5mb3JtYXRpb24g dGVjaG5vbG9neSCWIFNwZWNpZmljYXRpb24gb2YgT2N0ZXQgRW5jb2RpbmcgUnVsZXMgKE9F UikuDUlTTy9JRUMgMjkxNTA6MjAxMSwgSW5mb3JtYXRpb24gdGVjaG5vbG9neSCWIFNlY3Vy aXR5IHRlY2huaXF1ZXMgliAgU2lnbmNyeXB0aW9uDUFkZGl0aW9uYWwgUmVmZXJlbmNlcw1E ZWZpbml0aW9ucw1Gb3IgdGhlIHB1cnBvc2VzIG9mIHRoaXMgUmVjb21tZW5kYXRpb24gfCBJ bnRlcm5hdGlvbmFsIFN0YW5kYXJkLCB0aGUgZm9sbG93aW5nIGRlZmluaXRpb25zIGFwcGx5 Og1UaGUgZm9sbG93aW5nIHRlcm1zIGFyZSBkZWZpbmVkIGluIFJlYy4gSVRVLVQgWC41MDkg fCBJU08vSUVDIDk1OTQtODoNYXR0cmlidXRlIGNlcnRpZmlmY2F0ZQ1jZXJ0aWZpY2F0ZQ1j ZXJ0aWZpY2F0ZSByZXZvY2F0aW9uIGxpc3QNVGhlIGZvbGxvd2luZyB0ZXJtIGlzIGRlZmlu ZWQgaW4gSVNPL0lFQyAyOTE1MDoyMDExDQkJc2lnbmNyeXB0aW9uDUFiYnJldmlhdGlvbnMN Rm9yIHRoZSBwdXJwb3NlcyBvZiB0aGlzIFJlY29tbWVuZGF0aW9uIHwgSW50ZXJuYXRpb25h bCBTdGFuZGFyZCwgdGhlIGZvbGxvd2luZyBhYmJyZXZpYXRpb25zIGFwcGx5Og0JQ01TCUNy eXB0b2dyYXBoaWMgTWVzc2FnZSBTeW50YXgNCUNSTAkJQ2VydGlmaWNhdGUgUmV2b2NhdGlv biBMaXN0DUNvbnZlbnRpb25zDUNyeXB0b2dyYXBoaWMgTWVzc2FnZSBTeW50YXgNVGhlIENN UyBjb250ZW50IHR5cGVzDUNNUyBkZWZpbmVzIHRoZSBmb2xsb3dpbmcgY29udGVudCB0eXBl czoNZGF0YTogdXNlZCB0byB0cmFuc2ZlciBkYXRhIGRlZmluZWQgc3RyaW5nIG9mIG9jdGV0 czsNc2lnbmVkIGRhdGE6IHVzZWQgdG8gdHJhbnNmZXIgZGF0YSB3aXRoIHplcm8gb3IgbW9y ZSBzaWduYXR1cmVzOw1lbnZlbG9wZWQgZGF0YTogdXNlZCB0byB0cmFuc2ZlciBlbmNyeXB0 ZWQgZGF0YSB3aXRoIG9uZSBvciBtb3JlIGNvbnRlbnQtZW5jcnlwdGlvbiBrZXlzOw1kaWdl c3RlZCBkYXRhOiB1c2VkIHRvIHRyYW5zZmVyIGRhdGEgd2l0aCBhIG1lc3NhZ2UgZGlnZXN0 Ow1lbmNyeXB0ZWQgZGF0YTogdXNlZCB0byB0cmFuc2ZlciBlbmNyeXB0ZWQgZGF0YTsNYXV0 aGVudGljYXRlZCBkYXRhOiB1c2VkIHRvIHRyYW5zZmVyIGRhdGEgd2l0aCBhIG1lc3NhZ2Ug YXV0aGVudGljYXRpb24gY29kZSBhbmQgb25lIG9yIG1vcmUgZW5jcnlwdGVkIGF1dGhlbnRp Y2F0aW9uIGtleXM7DXNpZ25jcnlwdGVkIGRhdGE6IHVzZWQgdG8gdHJhbnNmZXIgc2lnbmVk IGFuZCBlbmNyeXB0ZWQgZGF0YSB1c2luZyBzaWduY3J5cHRpb24gdGVjaG5pcXVlLg1FYWNo IG9mIHRoZXNlIGNvbnRlbnQgdHlwZXMgaXMgdW5pcXVlbHkgaWRlbnRpZmllZCBieSBhbiBv YmplY3QgaWRlbnRpZmllcjoNZm9yIGRhdGE6IA0JCWlkLWRhdGEgT0JKRUNUIElERU5USUZJ RVIgOjo9IHtpc28oMSkgbWVtYmVyLWJvZHkoMikgdXMoODQwKQ1yc2Fkc2koMTEzNTQ5KXBr Y3MoMSkgcGtjczcoNykgMX0NZm9yIHNpZ25lZCBkYXRhOg0JCWlkLXNpZ25lZERhdGEgT0JK RUNUIElERU5USUZJRVIgOjo9IHtpc28oMSkgbWVtYmVyLWJvZHkoMikNdXMoODQwKXJzYWRz aSgxMTM1NDkpIHBrY3MoMSkgcGtjczcoNykgMn0NZm9yIGVudmVsb3BlZCBkYXRhOg0JCWlk LWVudmVsb3BlZERhdGEgT0JKRUNUIElERU5USUZJRVIgOjo9IHtpc28oMSkgbWVtYmVyLWJv ZHkoMikgdXMoODQwKQ1yc2Fkc2koMTEzNTQ5KSBwa2NzKDEpIHBrY3M3KDcpIDN9DWZvciBk aWdlc3RlZCBkYXRhOg0JCWlkLWRpZ2VzdGVkRGF0YSBPQkpFQ1QgSURFTlRJRklFUiA6Oj0g e2lzbygxKSBtZW1iZXItYm9keSgyKSB1cyg4NDApCQkNcnNhZHNpKDExMzU0OSkgcGtjcygx KSBwa2NzNyg3KSA1fQ1mb3IgZW5jcnlwdGVkIGRhdGE6DQkJaWQtZW5jcnlwdGVkRGF0YSBP QkpFQ1QgSURFTlRJRklFUiA6Oj0ge2lzbygxKSBtZW1iZXItYm9keSgyKSB1cyg4NDApDXJz YWRzaSgxMTM1NDkpIHBrY3MoMSkgcGtjczcoNykgNn0NZm9yIGF1dGhlbnRpY2F0ZWQgZGF0 YToNCQlpZC1jdC1hdXRoRGF0YSBPQkpFQ1QgSURFTlRJRklFUiA6Oj0ge2lzbygxKSBtZW1i ZXItYm9keSgyKSB1cyg4NDApCQ1yc2Fkc2koMTEzNTQ5KSBwa2NzKDEpIHBrY3MtOSg5KSBz bWltZSgxNikgY3QoMSkgMn0NZm9yIHNpZ25jcnlwdGVkIGRhdGE6DQkJaWQtc2lnbmNyeXB0 ZWREYXRhIE9CSkVDVCBJREVOVElGSUVSIDo6PSB7aXR1LXQgcmVjb21tZW5kYXRpb24oMCkg eCgyNCkNY21zKDg5NCkgc2lnbmNyeXB0aW9uKDEpIGRhdGEoMCl9DURhdGEgdHJhbnNmZXJy ZWQgd2l0aCBDcnlwdG9ncmFwaGljIE1lc3NhZ2UgU3ludGF4IHVzZSB0aGUgZm9sbG93aW5n IEFTTi4xIHR5cGU6DUNvbnRlbnRJbmZvIDo6PSBTRVFVRU5DRSB7DWNvbnRlbnRUeXBlCUNP TlRFTlQtVFlQRS4maWQoe0NvbnRlbnRTZXR9KSwNY29udGVudAlbMF0gRVhQTElDSVQgQ09O VEVOVC1UWVBFLiZUeXBlKHtDb250ZW50U2V0fXtAY29udGVudFR5cGV9KX0NVGhlIENPTlRF TlQtVFlQRSBpbmZvcm1hdGlvbiBvYmplY3QgY2xhc3MgaXMgZGVmaW5lZCBhcyBUWVBFLUlE RU5USUZJRVIgYW5kIGlzIHVzZWQgdG8gYXNzaWduIG9uZSBvZiB0aGUgcHJldmlvdXMgb2Jq ZWN0IGlkZW50aWZpZXJzIHRvIHRoZSBjb3JyZXNwb25kaW5nIEFTTi4xIHR5cGUuDUNPTlRF TlQtVFlQRSA6Oj0gVFlQRS1JREVOVElGSUVSDUNvbnRlbnRUeXBlIDo6PSBDT05URU5ULVRZ UEUuJmlkDUNvbnRlbnRTZXQgQ09OVEVOVC1UWVBFIDo6PSB7DS0tIERlZmluZSB0aGUgc2V0 IG9mIGNvbnRlbnQgdHlwZXMgdG8gYmUgcmVjb2duaXplZA1jdC1EYXRhIHwNY3QtU2lnbmVk RGF0YSB8DWN0LUVudmVsb3BlZERhdGEgIHwNY3QtRGlnZXN0ZWREYXRhIHwNY3QtRW5jcnlw dGVkRGF0YSB8DWN0LUF1dGhlbnRpY2F0ZWREYXRhIHwNY3QtU2lnbmNyeXB0ZWREYXRhLA0u Li59DWN0LURhdGEJCQkJCQkJQ09OVEVOVC1UWVBFIDo6PSB7T0NURVQgU1RSSU5HIElERU5U SUZJRUQgQlkgaWQtZGF0YX0NCQkJLS0gc2VlIGNsYXVzZSA3DWN0LVNpZ25lZERhdGEgCQkJ CUNPTlRFTlQtVFlQRSA6Oj0ge1NpZ25lZERhdGEgSURFTlRJRklFRCBCWSBpZC1zaWduZWRE YXRhfQ0JCQktLSBzZWUgY2xhdXNlIDgNY3QtRW52ZWxvcGVkRGF0YQkJQ09OVEVOVC1UWVBF IDo6PSB7RW52ZWxvcGVkRGF0YSBJREVOVElGSUVEIEJZIA0JCQlpZC1lbnZlbG9wZWREYXRh fQkJLS0gc2VlIGNsYXVzZSA5DWN0LURpZ2VzdGVkRGF0YQkJCUNPTlRFTlQtVFlQRSA6Oj0g e0RpZ2VzdGVkRGF0YSBJREVOVElGSUVEIEJZIA0JCQlpZC1kaWdlc3RlZERhdGF9CQktLSBz ZWUgY2xhdXNlIDEwDWN0LUVuY3J5cHRlZERhdGEJCUNPTlRFTlQtVFlQRSA6Oj0ge0VuY3J5 cHRlZERhdGEgSURFTlRJRklFRCBCWQ0JCQlpZC1lbmNyeXB0ZWREYXRhfQkJLS0gc2VlIGNs YXVzZSAxMQ1jdC1BdXRoZW50aWNhdGVkRGF0YQlDT05URU5ULVRZUEUgOjo9IHtBdXRoZW50 aWNhdGVkRGF0YSBJREVOVElGSUVEIEJZDQkJCWlkLWN0LWF1dGhEYXRhfQkJLS0gc2VlIGNs YXVzZSAxMg1jdC1TaWduY3J5cHRlZERhdGEJCUNPTlRFTlQtVFlQRSA6Oj0ge1NpZ25jcnlw dGVkRGF0YSBJREVOVElGSUVEIEJZDQkJCWlkLXNpZ25jcnlwdGVkRGF0YX0JCS0tIHNlZSBj bGF1c2UgMTMNVmVyc2lvbiBudW1iZXJzDVRoZSBmb2xsb3dpbmcgQVNOLjEgdHlwZXM6DVNp Z25lZERhdGEsDVNpZ25lckluZm8sDUVudmVsb3BlZERhdGEsDUtleVRyYW5zUmVjaXBpZW50 SW5mbywNS2V5QWdyZWVSZWNpcGllbnRJbmZvLA1LRUtSZWNpcGllbnRJbmZvLA1QYXNzd29y ZFJlY2lwaWVudEluZm8sDURpZ2VzdGVkRGF0YSwNRW5jcnlwdGVkRGF0YSwNQXV0aGVudGlj YXRlZERhdGEsDVNpZ25jcnlwdGVkRGF0YSwNU2lnbmNyeXB0ZXJJbmZvDWNvbnRhaW4gYSB2 ZXJzaW9uIG51bWJlciB3aGljaCBpcyBhc3NvY2lhdGVkIHRvIHNvbWUgZmVhdHVyZXMgb2Yg dGhlIHByb3RvY29sLiBUbyBlbnN1cmUgbWF4aW11bSBpbnRlcm9wZXJhYmlsaXR5IGJldHdl ZW4gdmFyaW91cyBDTVMgaW1wbGVtZW50YXRpb25zLCBpdCBpcyByZWNvbW1lbmRlZCB0byB1 c2UgdG8gbG93ZXN0IHZlcnNpb24gbnVtYmVyIHdoaWNoIHN1cHBvcnRzIHRoZSByZXF1aXJl ZCBmZWF0dXJlcy4gU2V2ZW4gdmVyc2lvbnMgYXJlIGFjdHVhbGx5IGRlZmluZWQgYnkgdGhl IGZvbGxvd2luZyBBU04uMSB0eXBlOg1DTVNWZXJzaW9uIDo6PSBJTlRFR0VSIHt2MCgwKSwg djEoMSksIHYyKDIpLCB2MygzKSwgdjQoNCksIHY1KDUpLCB2Nig2KX0oMC4uTUFYKQ1OT1RF IJYgVGhlICgwLi5NQVgpIGNvbnN0cmFpbnQgcHJvdmlkZXMgYSBtb3JlIGVmZmljaWVudCBQ RVIgZW5jb2Rpbmcgb2YgQ01TVmVyc2lvbi4NRGF0YQ1UaGUgZGF0YSBjb250ZW50IHR5cGUg aXMgdXNlZCB0byB0cmFuc2ZlciBhcmJpdHJhcnkgb2N0ZXQgc3RyaW5ncyB3aGljaCBhcmUg aW50ZXJwcmV0ZWQgYnkgYXBwbGljYXRpb25zLiBUaGUgY3QtRGF0YSBjb250ZW50IHR5cGUg aXMgZGVmaW5lZCBhcyBmb2xsb3dzOg1jdC1EYXRhCQlDT05URU5ULVRZUEUgOjo9IHtPQ1RF VCBTVFJJTkcgSURFTlRJRklFRCBCWSBpZC1kYXRhfQ1UaGUgZGF0YSBjb250ZW50IHR5cGUg aXMgZ2VuZXJhbGx5IHVzZWQgdG8gZW5jYXBzdWxhdGUgdGhlIHVzZXIgZGF0YSBpbiBvdGhl ciBjb250ZW50IHR5cGVzIChzaWduZWQgZGF0YSwgZW52ZWxvcGVkIGRhdGEsIGV0YykuDVNp Z25lZCBEYXRhDVRoZSBzaWduZWQgZGF0YSBjb250ZW50IHR5cGUgaXMgdXNlZCB0byB0cmFu c21pdCBhbnkgdHlwZSBvZiBkYXRhIHdpdGggemVybyBvciBtb3JlIHNpZ25hdHVyZXMuIEZv ciBlYWNoIHNpZ25lcjoNYSBoYXNoZWQgdmFsdWUgaXMgY29tcHV0ZWQgb24gdGhlIHVzZXIg ZGF0YSBhbmQgcG9zc2libHkgb24gb3RoZXIgaW5mb3JtYXRpb24gKGF0dHJpYnV0ZXMgZGVz Y3JpYmVkIGluIBMgUkVGIF9SZWYzOTU1OTMxMjYgXHIgXGggARQxNBUpIHVzaW5nIGEgc2ln bmVyIHNwZWNpZmljIGFsZ29yaXRobTsNdGhlIGhhc2hlZCB2YWx1ZSBpcyBzaWduZWQgdXNp bmcgdGhlIHNpZ25lcpJzIHByaXZhdGUga2V5IHRvIHByb2R1Y2UgdGhlIHNpZ25hdHVyZTsN CU5PVEUgliBUaGUgc2lnbmF0dXJlIGdlbmVyYXRpb24gcHJvY2VzcyBpcyBhbGdvcml0aG0g c3BlY2lmaWMgYW5kIG91dHNpZGUgdGhlIHNjb3BlIG9mIHRoaXMgUmVjb21tZW5kYXRpb24g fCBJbnRlcm5hdGlvbmFsIFN0YW5kYXJkLg10aGUgc2lnbmF0dXJlIGFuZCBvdGhlciBzaWdu ZXIgc3BlY2lmaWMgaW5mb3JtYXRpb24gYXJlIGdhdGhlcmVkIGluIGEgc3RydWN0dXJlIGRl ZmluZWQgYnkgdGhlIFNpZ25lckluZm8gQVNOLjEgdHlwZS4NVGhlIFNpZ25lZERhdGEgdHlw ZQ1UaGUgU2lnbmVkRGF0YSBBU04uMSB0eXBlIGlzIGRlZmluZWQgYXMgZm9sbG93czoNU2ln bmVkRGF0YSA6Oj0gU0VRVUVOQ0UgIHsNdmVyc2lvbgkJCUNNU1ZlcnNpb24sDWRpZ2VzdEFs Z29yaXRobXMgCQlTRVQgT0YgRGlnZXN0QWxnb3JpdGhtSWRlbnRpZmllciwNZW5jYXBDb250 ZW50SW5mbwkJRW5jYXBzdWxhdGVkQ29udGVudEluZm8sDWNlcnRpZmljYXRlcwkJWzBdCVtY RVI6QkFTRTY0XSBPQ1RFVCBTVFJJTkcgDQkJCQkJCShDT05UQUlOSU5HIENlcnRpZmljYXRl U2V0KSBPUFRJT05BTCwNY3JscwkJCQlbMV0JW1hFUjpCQVNFNjQpIE9DVEVUIFNUUklORw0J CQkJCQkoQ09OVEFJTklORyBSZXZvY2F0aW9uSW5mb0Nob2ljZXMpDQkJCQkJCU9QVElPTkFM LA1zaWduZXJJbmZvcwkJCVNpZ25lckluZm9zIA19DVRoaXMgc2VxdWVuY2UgdHlwZSBjb250 YWlucyB0aGUgZm9sbG93aW5nIGNvbXBvbmVudHM6DWEpCXZlcnNpb24gc3BlY2lmaWVzIHRo ZSB2ZXJzaW9uIG9mIHRoZSBTaWduZWREYXRhIGNvbnRlbnQgYW5kIHNob3VsZCBiZSBkZWZp bmVkIGJ5IGFwcGx5aW5nIHN1Y2Nlc3NpdmVseSB0aGUgZm9sbG93aW5nIHJ1bGVzOg2WCWlm IGNlcnRpZmljYXRlcyBpcyBwcmVzZW50IGFuZCBhdCBsZWFzdCBvbmUgY2VydGlmaWNhdGUg dXNlcyB0aGUgb3RoZXIgYWx0ZXJuYXRpdmUgb2YgQ2VydGlmaWNhdGVDaG9pY2UsIHRoZSB2 ZXJzaW9uIHNoYWxsIGJlIHY1Ow2WCWlmIGNybHMgaXMgcHJlc2VudCBhbmQgYXQgbGVhc3Qg b25lIGNlcnRpZmljYXRlIHJldm9jYXRpb24gbGlzdCB1c2VzIHRoZSBvdGhlciBhbHRlcm5h dGl2ZSBvZiBSZXZvY2F0aW9uSW5mb0Nob2ljZSwgdGhlIHZlcnNpb24gc2hhbGwgYmUgdjU7 DZYJaWYgY2VydGlmaWNhdGVzIGlzIHByZXNlbnQgYW5kIGF0IGxlYXN0IG9uZSBjZXJ0aWZp Y2F0ZSB1c2VzIHRoZSB2MkF0dHJDZXJ0IGFsdGVybmF0aXZlIG9mIENlcnRpZmljYXRlQ2hv aWNlLCB0aGUgdmVyc2lvbiBzaGFsbCBiZSB2NDsNlglpZiBhdCBsZWFzdCBvbmUgU2lnbmVy SW5mbyAoc2VlIDguMykgY29udGVudCB1c2VzIHZlcnNpb24gdjMsIHRoZSB2ZXJzaW9uIHNo YWxsIGJlIHYzOw2WCWlmIGVuY2FwQ29udGVudEluZm8gKHNlZSA4LjIpIHVzZXMgYW4gZUNv bnRlbnRUeXBlIG90aGVyIHRoYW4gaWQtZGF0YSwgdGhlIHZlcnNpb24gc2hhbGwgYmUgdjM7 DZYJaW4gYWxsIG90aGVyIGNhc2VzLCB0aGUgdmVyc2lvbiBzaGFsbCBiZSB2MS4NYikJZGln ZXN0QWxnb3JpdGhtcyBpcyBhIGxpc3Qgb2YgZGlnZXN0IGFsZ29yaXRobSBpZGVudGlmaWVy cywgZWFjaCBvZiB0aGVtIGlzIGRlZmluZWQgYnkgdGhlIGlkZW50aWZpY2F0aW9uIG9mIHRo ZSBhbGdvcml0aG0gYW5kIGFzc29jaWF0ZWQgcGFyYW1ldGVycy4gVGhpcyBsaXN0IHNob3Vs ZCBjb250YWluIGFsbCB0aGUgZGlnZXN0IGFsZ29yaXRobXMgdXNlZCBieSB0aGUgc2lnbmVy cyB0byBmYWNpbGl0YXRlIG9uZS1wYXNzIHNpZ25hdHVyZSB2ZXJpZmljYXRpb24uDWMpCWVu Y2FwQ29udGVudEluZm8gKHNlZSATIFJFRiBfUmVmMzk1NTkzMDE4IFxyIFxoIAEUOC4yFSkg aXMgdGhlIHNpZ25lZCBjb250ZW50IGRlZmluZWQgYnkgYSB0eXBlIGlkZW50aWZpZXIgYW5k IGEgY29udGVudC4NZCkJY2VydGlmaWNhdGVzIGlzIGEgY29sbGVjdGlvbiBvZiBwdWJsaWMg a2V5IGFuZC9vciBhdHRyaWJ1dGUgY2VydGlmaWNhdGVzIHRvIGZhY2lsaXRhdGUgdGhlIHZh bGlkYXRpb24gb2YgdGhlIHB1YmxpYyBrZXlzIG9mIHRoZSBzaWduZXJzLiBUaGlzIGNvbGxl Y3Rpb24gbWF5IGNvbnRhaW4gbW9yZSBjZXJ0aWZpY2F0ZXMgdGhhbiBuZWNlc3Nhcnkgb3Ig ZmV3ZXIgYW5kLCBpbiB0aGUgbGF0dGVyIGNhc2UsIHJlY2lwaWVudHMgaGF2ZSB0byB1c2Ug b3RoZXIgbWVhbnMgdG8gZ2V0IG90aGVyIGNlcnRpZmljYXRlcy4gVGhlIEFTTi4xIHR5cGUg Q2VydGlmaWNhdGVTZXQgaXMgYSBjb2xsZWN0aW9uIG9mIHRocmVlIGtpbmRzIG9mIGNlcnRp ZmljYXRlcy4NCQlDZXJ0aWZpY2F0ZVNldCA6Oj0gU0VRVUVOQ0UgT0YgQ2VydGlmaWNhdGVD aG9pY2UNQ2VydGlmaWNhdGVDaG9pY2UgOjo9IENIT0lDRSB7DWNlcnRpZmljYXRlIAkJQ2Vy dGlmaWNhdGUsDS4uLiwNW1s0OiB2MkF0dHJDZXJ0IAlbMl0gSU1QTElDSVQgQXR0cmlidXRl Q2VydGlmaWNhdGVWMl1dLA1bWzU6IG90aGVyICAgICAgCVszXSBJTVBMSUNJVCBPdGhlckNl cnRpZmljYXRlRm9ybWF0XV0gDX0NCVRoZSBBU04xLjEgdHlwZSBDZXJ0aWZpY2F0ZUNob2lj ZSBoYXMgdGhlIGZvbGxvd2luZyBhbHRlcm5hdGl2ZXM6DWNlcnRpZmljYXRlOiB0aGlzIHR5 cGUgaXMgYSBwdWJsaWMga2V5IGNlcnRpZmljYXRlIGFzIGRlZmluZWQgaW4gUmVjLiBJVFUt VCBYLjUwOSAoMjAxMikgfCBJU08vSUVDIDk1OTQtODoyMDE0Ow12MkF0dHJDZXJ0OiB0aGlz IGFsdGVybmF0aXZlIHVzZXMgdGhlIEF0dHJpYnV0ZUNlcnRpZmljYXRlIGFzIGRlZmluZWQg aW4gUmVjLiBJVFUtVCBYLjUwOSB8IElTTy9JRUMgOTU5NC04Og1BdHRyaWJ1dGVDZXJ0aWZp Y2F0ZVYyIDo6PSBBdHRyaWJ1dGVDZXJ0aWZpY2F0ZQ1vdGhlcjogdGhpcyBhbHRlcm5hdGl2 ZSBpcyB1c2VkIHRvIGRlZmluZSBzcGVjaWZpYyBmb3JtYXRzIG9mIGNlcnRpZmljYXRlLiBF YWNoIGZvcm1hdCBpcyBkZWZpbmVkIGJ5IGFuIEFTTi4xIHR5cGUgYXNzb2NpYXRlZCB0byBh biBvYmplY3QgaWRlbnRpZmllciBpbiBhbiBpbmZvcm1hdGlvbiBvYmplY3Qgb2YgT1RIRVIt Q0VSVC1GTVQgb2JqZWN0IGNsYXNzIGRlZmluZWQgYXM6DU9USEVSLUNFUlQtRk1UCTo6PSBU WVBFLUlERU5USUZJRVINT3RoZXJDZXJ0aWZpY2F0ZUZvcm1hdCA6Oj0gU0VRVUVOQ0Ugew0J CQlvdGhlckNlcnRGb3JtYXQJT1RIRVItQ0VSVC1GTVQuJmlkDQkJCQkoe1N1cHBvcnRlZENl cnRGb3JtYXRzfSksDQkJCW90aGVyQ2VydAkJT1RIRVItQ0VSVC1GTVQuJlR5cGUNCQkJCSh7 U3VwcG9ydGVkQ2VydEZvcm1hdHN9e0BvdGhlckNlcnRGb3JtYXR9KQ0JCQl9DVN1cHBvcnRl ZENlcnRGb3JtYXRzIE9USEVSLUNFUlQtRk1UIDo6PSB7IC4uLiB9DWUpCWNybHMgaXMgYSBj b2xsZWN0aW9uIG9mIHB1YmxpYyBrZXkgb3IgYXR0cmlidXRlIGNlcnRpZmljYXRlIHJldm9j YXRpb24gbGlzdHMgdG8gZmFjaWxpdGF0ZSB0aGUgdmFsaWRhdGlvbiBvZiB0aGUgcHVibGlj IGtleXMgb2YgdGhlIHNpZ25lcnMuIEFzIGZvciB0aGUgY2VydGlmaWNhdGVzIGNvbXBvbmVu dCwgdGhpcyBjb2xsZWN0aW9uIG1heSBjb250YWluIG1vcmUgY2VydGlmaWNhdGUgcmV2b2Nh dGlvbiBsaXN0cyB0aGFuIG5lY2Vzc2FyeSBvciBmZXdlciBhbmQsIGluIHRoZSBsYXR0ZXIg Y2FzZSwgcmVjaXBpZW50cyBoYXZlIHRvIHVzZSBvdGhlciBtZWFucyB0byBnZXQgb3RoZXIg Y2VydGlmaWNhdGUgcmV2b2NhdGlvbiBsaXN0cy4gVGhlIEFTTi4xIHR5cGUgUmV2b2NhdGlv bkluZm9DaG9pY2VzIGlzIGEgY29sbGVjdGlvbiBvZiB0d28ga2luZHMgb2YgcmV2b2NhdGlv biBpbmZvcm1hdGlvbjogDVJldm9jYXRpb25JbmZvQ2hvaWNlcyA6Oj0gU0VRVUVOQ0UgT0Yg UmV2b2NhdGlvbkluZm9DaG9pY2UNUmV2b2NhdGlvbkluZm9DaG9pY2UgOjo9IENIT0lDRSB7 DQkJCWNybAkJCUNlcnRpZmljYXRlTGlzdCwNCQkJLi4uLA0JCQlbWzU6IG90aGVyIFsxXQlJ TVBMSUNJVCBPdGhlclJldm9jYXRpb25JbmZvRm9ybWF0IF1dIA0JCQl9DQljcmw6IHRoaXMg YWx0ZXJuYXRpdmUgdXNlcyB0aGUgQ2VydGlmaWNhdGVMaXN0IGFzIGRlZmluZWQgaW4gUmVj LiBJVFUtVCBYLjUwOSB8IElTTy9JRUMgOTU5NC04DQlvdGhlcjogdGhpcyBhbHRlcm5hdGl2 ZSBpcyB1c2VkIHRvIGRlZmluZSBzcGVjaWZpYyBmb3JtYXRzIG9mIHJldm9jYXRpb24gaW5m b3JtYXRpb247IGVhY2ggZm9ybWF0IGlzIGRlZmluZWQgYnkgYW4gQVNOLjEgdHlwZSBhc3Nv Y2lhdGVkIHRvIGFuIG9iamVjdCBpZGVudGlmaWVyIHVzaW5nIGFuIGluZm9ybWF0aW9uIG9i amVjdCBvZiAgT1RIRVItUkVWT0stSU5GTyBvYmplY3QgY2xhc3MgZGVmaW5lZCBhczoNT1RI RVItUkVWT0stSU5GTyA6Oj0gVFlQRS1JREVOVElGSUVSDU90aGVyUmV2b2NhdGlvbkluZm9G b3JtYXQgOjo9IFNFUVVFTkNFIHsNCQkJb3RoZXJSZXZJbmZvRm9ybWF0CU9USEVSLVJFVk9L LUlORk8uJmlkDQkJCQkJKHtTdXBwb3J0ZWRPdGhlclJldm9rSW5mb30pLA0JCQlvdGhlclJl dkluZm8JCU9USEVSLVJFVk9LLUlORk8uJlR5cGUNCQkJCQkoe1N1cHBvcnRlZE90aGVyUmV2 b2tJbmZvfXtAb3RoZXJSZXZJbmZvRm9ybWF0fSkNCQkJfQ1TdXBwb3J0ZWRPdGhlclJldm9r SW5mbyBPVEhFUi1SRVZPSy1JTkZPIDo6PSB7IC4uLiB9DWYpCXNpZ25lckluZm9zIChzZWUg EyBSRUYgX1JlZjM5NTU5NDE1OCBcciBcaCABFDguMxUpIGNvbnRlbnRzIHRoZSBzaWduYXR1 cmUgb2YgdGhlIHNpZ25lcnMuIFVzdWFsbHksIHRoZSB2YWxpZGF0aW9uIG9mIG9uZSBzaWdu YXR1cmUgaXMgc3VmZmljaWVudCB0byB2YWxpZGF0ZSB0aGUgbWVzc2FnZSwgYnV0LCBpbiBz b21lIGVudmlyb25tZW50cywgb3RoZXIgcnVsZXMgbWF5IGJlIGRlZmluZWQuDQ1UaGUgRW5j YXBzdWxhdGVkQ29udGVudEluZm8gdHlwZQ1UaGUgRW5jYXBzdWxhdGVkQ29udGVudEluZm8g dHlwZSBpcyBkZWZpbmVkIGFzIGZvbGxvd3M6DUVuY2Fwc3VsYXRlZENvbnRlbnRJbmZvIDo6 PSBTRVFVRU5DRSB7DWVDb250ZW50VHlwZQlDT05URU5ULVRZUEUuJmlkKHtDb250ZW50U2V0 fSksDWVDb250ZW50CQlbMF0gRVhQTElDSVQgT0NURVQgU1RSSU5HDQkJCQkoQ09OVEFJTklO RyBDT05URU5ULVRZUEUuJlR5cGUNCQkJCSh7Q29udGVudFNldH17QGVDb250ZW50VHlwZX0p KSBPUFRJT05BTA0JCQl9DVRoZSBTaWduZXJJbmZvcyB0eXBlDVRoZSBTaWduZXJJbmZvcyB0 eXBlIGlzIHRoZSBjb2xsZWN0aW9uIGFsbCBzaWduZXIgc3BlY2lmaWMgaW5mb3JtYXRpb246 DVNpZ25lckluZm9zIDo6PSBTRVQgT0YgU2lnbmVySW5mbw1FYWNoIFNpZ25lckluZm8gc3Ry dWN0dXJlIGNvbnRhaW5zIGluZm9ybWF0aW9uIG5lZWRlZCB0byBpZGVudGlmeSB0aGUgc2ln bmVyLCBhIGxpc3Qgb2YgYXR0cmlidXRlcywgdGhlIGFsZ29yaXRobSBpZGVudGlmaWVycyB1 c2VkIGJ5IHRoZSBkaWdlc3QsIHRoZSBzaWduYXR1cmUgYWxnb3JpdGhtIGFuZCB0aGUgc2ln bmF0dXJlIHdoaWNoIGlzIGNvbXB1dGVkIGZyb20gdGhlIGNvbnRlbnQgcHJlc2VudCBpbiBF bmNhcHN1bGF0ZWRDb250ZW50SW5mbyBhbmQgc29tZSBvciBhbGwgb2YgdGhlIGF0dHJpYnV0 ZXMuDVRoZSBTaWduZXJJbmZvIHR5cGUgaXMgZGVmaW5lZCBhcyBmb2xsb3dzOg1TaWduZXJJ bmZvIDo6PSBTRVFVRU5DRSB7DXZlcnNpb24JCUNNU1ZlcnNpb24sDXNpZAkJCQlTaWduZXJJ ZGVudGlmaWVyLA1kaWdlc3RBbGdvcml0aG0JRGlnZXN0QWxnb3JpdGhtSWRlbnRpZmllciwN c2lnbmVkQXR0cnMJCVswXQlJTVBMSUNJVCBTaWduZWRBdHRyaWJ1dGVzIE9QVElPTkFMLA1z aWduYXR1cmVBbGdvcml0aG0JU2lnbmF0dXJlQWxnb3JpdGhtSWRlbnRpZmllciwNc2lnbmF0 dXJlCQlTaWduYXR1cmVWYWx1ZSwNdW5zaWduZWRBdHRycwlbMV0JSU1QTElDSVQgQXR0cmli dXRlc3t7VW5zaWduZWRBdHRyaWJ1dGVzfX0NCQkJCU9QVElPTkFMDX0NYSkJdmVyc2lvbiBz cGVjaWZpZXMgdGhlIHZlcnNpb24gb2YgU2lnbmVySW5mbyBjb250ZW50IGFuZCBzaG91bGQg YmUgZGVmaW5lZCBieSBhcHBseWluZyBzdWNjZXNzaXZlbHkgdGhlIGZvbGxvd2luZyBydWxl czoNlglpZiBzaWQgdXNlcyB0aGUgaXNzdWVyQW5kU2VyaWFsTnVtYmVyIGFsdGVybmF0aXZl IG9mIFNpZ25lcklkZW50aWZpZXIgKHNlZSATIFJFRiBfUmVmMzk1NTk0NDc4IFxyIFxoIAEU OC4zLjEVKSwgdGhlIHZlcnNpb24gc2hhbGwgYmUgdjE7DZYJaWYgc2lkIHVzZXMgdGhlIHN1 YmplY3RLZXlJZGVudGlmaWVyIGFsdGVybmF0aXZlIG9mIFNpZ25lcklkZW50aWZpZXIgKHNl ZSATIFJFRiBfUmVmMzk1NTk0NDc4IFxyIFxoIAEUOC4zLjEVKSwgdGhlIHZlcnNpb24gc2hh bGwgYmUgdjMuDWIpCXNpZCBpZGVudGlmaWVzIHRoZSBzaWduZXKScyBjZXJ0aWZpY2F0ZSAo c2VlIBMgUkVGIF9SZWYzOTU1OTQ0NzggXHIgXGggARQ4LjMuMRUpDWMpCWRpZ2VzdEFsZ29y aXRobSBpZGVudGlmaWVzIHRoZSBkaWdlc3QgYWxnb3JpdGhtIGFuZCB0aGUgYXNzb2NpYXRl ZCBwYXJhbWV0ZXJzLCBpZiBhbnksIHVzZWQgYnkgdGhlIHNpZ25lciB0byBjb21wdXRlIHRo ZSBoYXNoIG9mIHRoZSBjb250ZW50IG9mIHRoZSBtZXNzYWdlIG9yIHRoZSBjb250ZW50IG9m IHRoZSBtZXNzYWdlIHdpdGggdGhlIHNpZ25lZCBhdHRyaWJ1dGVzIChzZWUgIBMgUkVGIF9S ZWYzOTU1OTMxMjYgXHIgXGggARQxNBUpLg0JVGhlIGRpZ2VzdCBhbGdvcml0aG1zIGFyZSBk ZWZpbmVkIGFzIG9iamVjdHMgb2YgRElHRVNULUFMR09SSVRITSBpbmZvcm1hdGlvbiBvYmpl Y3QgY2xhc3MuDURJR0VTVC1BTEdPUklUSE0gOjo9IENMQVNTIHsNCSZpZAkJT0JKRUNUIElE RU5USUZJRVIgVU5JUVVFLA0JJlBhcmFtcwkJT1BUSU9OQUwsDQkmcGFyYW1QcmVzZW5jZQlQ YXJhbU9wdGlvbnMgREVGQVVMVCBhYnNlbnQNCX0gDVdJVEggU1lOVEFYIHsNCUlERU5USUZJ RVIJJmlkDQlbUEFSQU1TCQlbVFlQRSAmUGFyYW1zXSBBUkUgJnBhcmFtUHJlc2VuY2UgXQ0J fQ1EaWdlc3RBbGdvcml0aG1JZGVudGlmaWVyIDo6PSBBbGdvcml0aG1JZGVudGlmaWVyDQkJ CXtESUdFU1QtQUxHT1JJVEhNLCB7RGlnZXN0QWxnb3JpdGhtU2V0fX0NUGFyYW1PcHRpb25z CTo6PSBFTlVNRVJBVEVEIHsNCXJlcXVpcmVkCSwJCS0tIFBhcmFtZXRlcnMgc2hhbGwgYmUg ZW5jb2RlZCBpbiBzdHJ1Y3R1cmUNCXByZWZlcnJlZFByZXNlbnQsCS0tIFBhcmFtZXRlcnMg c2hvdWxkIGJlIGVuY29kZWQgaW4gc3RydWN0dXJlDQlwcmVmZXJyZWRBYnNlbnQsCS0tIFBh cmFtZXRlcnMgc2hvdWxkIG5vdCBiZSBlbmNvZGVkIGluIHN0cnVjdHVyZQ0JYWJzZW50LAkJ CS0tIFBhcmFtZXRlcnMgc2hhbGwgbm90IGJlIGVuY29kZWQgaW4gc3RydWN0dXJlDQlpbmhl cml0YWJsZSwJCS0tIFBhcmFtZXRlcnMgYXJlIGluaGVyaXRlZCBpZiBub3QgcHJlc2VudA0J b3B0aW9uYWwsCQktLSBQYXJhbWV0ZXJzIG1heSBiZSBlbmNvZGVkIGluIHRoZSBzdHJ1Y3R1 cmUNCS4uLg0JfQ1BbGdvcml0aG1JZGVudGlmaWVye0FMR09SSVRITS1UWVBFLCBBTEdPUklU SE0tVFlQRTpBbGdvcml0aG1TZXR9IDo6PSANCVNFUVVFTkNFIHsNCQkJYWxnb3JpdGhtCQlB TEdPUklUSE0tVFlQRS4maWQoe0FsZ29yaXRobVNldH0pLA0JCQlwYXJhbWV0ZXJzCQlBTEdP UklUSE0tVFlQRS4mUGFyYW1zDQkJCQkJCSh7QWxnb3JpdGhtU2V0fXtAYWxnb3JpdGhtfSkg T1BUSU9OQUwgDQkJCX0NRGlnZXN0QWxnb3JpdGhtU2V0IAlESUdFU1QtQUxHT1JJVEhNIDo6 PSB7TWVzc2FnZURpZ2VzdEFsZ3MsIC4uLiB9DVRoZSBmb2xsb3dpbmcgYWxnb3JpdGhtcyBh cmUgY3VycmVudGx5IGRlZmluZWQ6DU1lc3NhZ2VEaWdlc3RBbGdzIAlESUdFU1QtQUxHT1JJ VEhNIDo6PSB7DW1kYS1zaGEyNTYgfCANbWRhLXNoYTM4NCB8IA1tZGEtc2hhNTEyIHwNbWRh LXNoYTIyNCB8DW1kYS1zaGE1MTItMjI0IHwNbWRhLXNoYTUxMi0yNTZ9DW1kYS1zaGEyNTYg CURJR0VTVC1BTEdPUklUSE0gOjo9IHsNCUlERU5USUZJRVIJaWQtc2hhMjU2DQlQQVJBTVMJ CVRZUEUgTlVMTCBBUkUgcHJlZmVycmVkQWJzZW50DQl9DWlkLXNoYTI1NiAJT0JKRUNUIElE RU5USUZJRVIgOjo9IHsNe2pvaW50LWlzby1pdHUtdCgyKSBjb3VudHJ5KDE2KSB1cyg4NDAp IG9yZ2FuaXphdGlvbigxKSBnb3YoMTAxKSBjc29yKDMpIG5pc3RBbGdvcml0aG0oNCkgaGFz aEFsZ3MoMikgc2hhMjU2KDEpfQ0NbWRhLXNoYTM4NCAJRElHRVNULUFMR09SSVRITSA6Oj0g ew0JSURFTlRJRklFUglpZC1zaGEzODQNCVBBUkFNUwkJVFlQRSBOVUxMIEFSRSBwcmVmZXJy ZWRBYnNlbnQNCX0NaWQtc2hhMzg0IAlPQkpFQ1QgSURFTlRJRklFUiA6Oj0gew17am9pbnQt aXNvLWl0dS10KDIpIGNvdW50cnkoMTYpIHVzKDg0MCkgb3JnYW5pemF0aW9uKDEpIGdvdigx MDEpDWNzb3IoMykgbmlzdEFsZ29yaXRobSg0KSBoYXNoQWxncygyKSBzaGEzODQoMil9DW1k YS1zaGE1MTIgCURJR0VTVC1BTEdPUklUSE0gOjo9IHsNCUlERU5USUZJRVIJaWQtc2hhNTEy DQlQQVJBTVMJCVRZUEUgTlVMTCBBUkUgcHJlZmVycmVkQWJzZW50DQl9DWlkLXNoYTUxMiAJ T0JKRUNUIElERU5USUZJRVIgOjo9IHsNe2pvaW50LWlzby1pdHUtdCgyKSBjb3VudHJ5KDE2 KSB1cyg4NDApIG9yZ2FuaXphdGlvbigxKSBnb3YoMTAxKSANY3NvcigzKSBuaXN0QWxnb3Jp dGhtKDQpIGhhc2hBbGdzKDIpIHNoYTUxMigzKX0NbWRhLXNoYTIyNCAJRElHRVNULUFMR09S SVRITSA6Oj0gew0JSURFTlRJRklFUglpZC1zaGEyMjQNCVBBUkFNUwkJVFlQRSBOVUxMIEFS RSBwcmVmZXJyZWRBYnNlbnQNCX0NaWQtc2hhMjI0IAlPQkpFQ1QgSURFTlRJRklFUiA6Oj0g ew17am9pbnQtaXNvLWl0dS10KDIpIGNvdW50cnkoMTYpIHVzKDg0MCkgb3JnYW5pemF0aW9u KDEpIGdvdigxMDEpDWNzb3IoMykgbmlzdEFsZ29yaXRobSg0KSBoYXNoQWxncygyKSBzaGEy MjQoNCl9DQ1tZGEtc2hhNTEyLTIyNCBESUdFU1QtQUxHT1JJVEhNIDo6PSB7DQlJREVOVElG SUVSCWlkLXNoYTUxMi0yMjQNCVBBUkFNUwkJVFlQRSBOVUxMIEFSRSBwcmVmZXJyZWRBYnNl bnQNCX0NaWQtc2hhNTEyLTIyNCAJT0JKRUNUIElERU5USUZJRVIgOjo9IHsNe2pvaW50LWlz by1pdHUtdCgyKSBjb3VudHJ5KDE2KSB1cyg4NDApIG9yZ2FuaXphdGlvbigxKSBnb3YoMTAx KQ1jc29yKDMpIG5pc3RBbGdvcml0aG0oNCkgaGFzaEFsZ3MoMikgc2hhNTEyLTIyNCg1KX0N DW1kYS1zaGE1MTItMjU2IAlESUdFU1QtQUxHT1JJVEhNIDo6PSB7DQlJREVOVElGSUVSCWlk LXNoYTUxMi0yNTYNCVBBUkFNUwkJVFlQRSBOVUxMIEFSRSBwcmVmZXJyZWRBYnNlbnQNCX0N aWQtc2hhNTEyLTI1NiAJT0JKRUNUIElERU5USUZJRVIgOjo9IHsNe2pvaW50LWlzby1pdHUt dCgyKSBjb3VudHJ5KDE2KSB1cyg4NDApIG9yZ2FuaXphdGlvbigxKSBnb3YoMTAxKQ1jc29y KDMpIG5pc3RBbGdvcml0aG0oNCkgaGFzaEFsZ3MoMikgc2hhNTEyLTI1Nig2KX0NDQ1kKQlz aWduZWRBdHRycyBpcyBhIGNvbGxlY3Rpb24gb2YgYXR0cmlidXRlcyB0aGF0IGFyZSBzaWdu ZWQuIFRoaXMgY29tcG9uZW50IGlzIG9wdGlvbmFsIHdoZW4gdGhlIGVDb250ZW50VHlwZSBv ZiBFbmNhcHN1bGF0ZWRDb250ZW50SW5mbyBpcyBpZC1kYXRhIGFuZCBtYW5kYXRvcnkgaW4g b3RoZXIgc2l0dWF0aW9ucy4gV2hlbiBzaWduZWRBdHRycyBpcyBwcmVzZW50LCBpdCBzaGFs bCBjb250ZW50IGF0IGxlYXN0IHRoZSB0d28gZm9sbG93aW5nIGF0dHJpYnV0ZXM6DZYJYWEt Y29udGVudFR5cGUgKHNlZSATIFJFRiBfUmVmMzk1NTk3MTc2IFxyIFxoIAEUMTQuMRUpIHdo aWNoIGlzIGVxdWFsIHRvIGVDb250ZW50VHlwZSB2YWx1ZSBvZiBFbmNhcHN1bGF0ZWRDb250 ZW50SW5mbzsNYWEtbWVzc2FnZURpZ2VzdCAoc2VlIBMgUkVGIF9SZWYzOTU1OTcyNjQgXHIg XGggARQxNC4yFSkgd2hpY2ggY29udGVudHMgdGhlIGRpZ2VzdCBvZiB0aGUgY29udGVudC4N CVRoZSBhdHRyaWJ1dGVzIHNoYWxsIGJlIGVuY29kZWQgdXNpbmcgdGhlIERFUiBlbmNvZGlu ZyBydWxlcyBhcyBkZWZpbmVkIGluIFJlYy4gSVRVLVQgWC42OTAgfCBJU08vSUVDIDg4MjUt MS4NU2lnbmVkQXR0cmlidXRlcyA6Oj0gQXR0cmlidXRlcyB7eyBTaWduZWRBdHRyaWJ1dGVz U2V0IH19DUF0dHJpYnV0ZXMgeyBBVFRSSUJVVEU6QXR0ckxpc3QgfSA6Oj0gU0VUIFNJWkUg KDEuLk1BWCkgT0YgQXR0cmlidXRlIA0JCXt7IEF0dHJMaXN0IH19DUF0dHJpYnV0ZXsgQVRU UklCVVRFOkF0dHJMaXN0IH0gOjo9IFNFUVVFTkNFIHsNCWF0dHJUeXBlCQlBVFRSSUJVVEUu JmlkKHtBdHRyTGlzdH0pLA0JYXR0clZhbHVlcwlTRVQgT0YgQVRUUklCVVRFLiZUeXBlKHtB dHRyTGlzdH17QGF0dHJUeXBlfSl9DQkJVGhlIFNpZ25lZEF0dHJpYnV0ZXNTZXQgaXMgZGVm aW5lZCBhcyBmb2xsb3dzOg1TaWduZWRBdHRyaWJ1dGVzU2V0IEFUVFJJQlVURSA6Oj0NCXsg YWEtc2lnbmluZ1RpbWUgfCBhYS1tZXNzYWdlRGlnZXN0IHwgYWEtY29udGVudFR5cGUsIC4u LiB9DQllKQlzaWduYXR1cmVBbGdvcml0aG0gaWRlbnRpZmllcyB0aGUgYWxnb3JpdGhtIHVz ZWQgZm9yIHNpZ25hdHVyZSBhbmQgdGhlIHBhcmFtZXRlciAoaWYgbmVlZGVkKQ1TaWduYXR1 cmVBbGdvcml0aG1JZGVudGlmaWVyIDo6PSBBbGdvcml0aG1JZGVudGlmaWVyDQl7U0lHTkFU VVJFLUFMR09SSVRITSwge1NpZ25hdHVyZUFsZ29yaXRobVNldH19DQkJVGhlIHNpZ25hdHVy ZSBhbGdvcml0aG1zIGFyZSBkZWZpbmVkIGFzIG9iamVjdHMgb2YgU0lHTkFUVVJFLUFMR09S SVRITSBpbmZvcm1hdGlvbiBvYmplY3QgY2xhc3MuDVNJR05BVFVSRS1BTEdPUklUSE0gOjo9 IENMQVNTIHsNCSZpZAkJT0JKRUNUIElERU5USUZJRVIgVU5JUVVFLA0JJlZhbHVlCQlPUFRJ T05BTCwNCSZQYXJhbXMJCU9QVElPTkFMLA0JJnBhcmFtUHJlc2VuY2UJUGFyYW1PcHRpb25z IERFRkFVTFQgYWJzZW50LA0JJkhhc2hTZXQJCURJR0VTVC1BTEdPUklUSE0gT1BUSU9OQUws DQkmUHVibGljS2V5U2V0CVBVQkxJQy1LRVkgT1BUSU9OQUwsDQkmc21pbWVDYXBzCVNNSU1F LUNBUFMgT1BUSU9OQUwNCX0gDVdJVEggU1lOVEFYIHsNCUlERU5USUZJRVIJJmlkDQlbVkFM VUUJCSZWYWx1ZV0NCVtQQVJBTVMJCVtUWVBFICZQYXJhbXNdIEFSRSAmcGFyYW1QcmVzZW5j ZSBdDQlbSEFTSEVTCQkmSGFzaFNldF0NCVtQVUJMSUMtS0VZUwkmUHVibGljS2V5U2V0XQ0J W1NNSU1FLUNBUFMJJnNtaW1lQ2Fwc10NCX0NU2lnbmF0dXJlQWxnb3JpdGhtU2V0IFNJR05B VFVSRS1BTEdPUklUSE0gOjo9IHsgU2lnbmF0dXJlQWxncywgLi4uIH0NU2lnbmF0dXJlQWxn cyBTSUdOQVRVUkUtQUxHT1JJVEhNIDo6PSB7DQkuLi4gfQ1TTUlNRS1DQVBTIDo6PSBDTEFT UyB7DQkmaWQJCU9CSkVDVCBJREVOVElGSUVSIFVOSVFVRSwNCSZUeXBlCQlPUFRJT05BTA0J fQ1XSVRIIFNZTlRBWCB7IA0JW1RZUEUgCQkmVHlwZV0gDQlJREVOVElGSUVEIEJZIAkmaWQg fQ0JCQlQVUJMSUMtS0VZIDo6PSBDTEFTUyB7DQkmaWQJCU9CSkVDVCBJREVOVElGSUVSIFVO SVFVRSwNCSZLZXlWYWx1ZQlPUFRJT05BTCwNCSZQYXJhbXMJCU9QVElPTkFMLA0JJnBhcmFt UHJlc2VuY2UJUGFyYW1PcHRpb25zIERFRkFVTFQgYWJzZW50LA0JJmtleVVzYWdlCUtleVVz YWdlIE9QVElPTkFMLA0JJlByaXZhdGVLZXkJT1BUSU9OQUwNCX0gDQkJV0lUSCBTWU5UQVgg ew0JSURFTlRJRklFUgkJJmlkDQlbS0VZCQkJJktleVZhbHVlXQ0JW1BBUkFNUwkJCVtUWVBF ICZQYXJhbXNdIEFSRSAmcGFyYW1QcmVzZW5jZV0NCVtDRVJULUtFWS1VU0FHRQkma2V5VXNh Z2VdDQlbUFJJVkFURS1LRVkJCSZQcml2YXRlS2V5XQ0JfQ0JCQlway1kc2EgUFVCTElDLUtF WSA6Oj0gew0JSURFTlRJRklFUiAJaWQtZHNhDQlLRVkgCQlEU0FQdWJsaWNLZXkNCVBBUkFN UyAJCVRZUEUgRFNBLVBhcmFtcyBBUkUgaW5oZXJpdGFibGUNCS0tIFByaXZhdGUga2V5IGZv cm1hdCBub3QgaW4gdGhpcyBtb2R1bGUgLS0NCUNFUlQtS0VZLVVTQUdFIHsgZGlnaXRhbFNp Z25hdHVyZSwgY29udGVudENvbW1pdG1lbnQsIA0JCQkJCWtleUNlcnRTaWduLCBjUkxTaWdu IH0NCX0NCQkJaWQtZHNhIE9CSkVDVCBJREVOVElGSUVSIDo6PSB7DQlpc28oMSkgbWVtYmVy LWJvZHkoMikgdXMoODQwKSB4OS01NygxMDA0MCkgeDlhbGdvcml0aG0oNCkgMSB9DQkJCURT QS1QYXJhbXMgOjo9IFNFUVVFTkNFIHsNCXAJCUlOVEVHRVIsDQlxCQlJTlRFR0VSLA0JZwkJ SU5URUdFUg0JfQ0JCQlEU0FQdWJsaWNLZXkgOjo9IElOVEVHRVIgLS0gIHB1YmxpYyBrZXks IHkJDQlmKQlzaWduYXR1cmUgY29udGFpbnMgdGhlIHNpZ25hdHVyZSBhcyBhbiBvY3RldCBz dHJpbmcgdmFsdWUNCQkJU2lnbmF0dXJlVmFsdWUgOjo9IE9DVEVUIFNUUklORw0JZykJdW5z aWduZWRBdHRycyBjb250YWlucyB0aGUgdW5zaWduZWQgYXR0cmlidXRlcyBpZiBhbnkNVW5z aWduZWRBdHRyaWJ1dGVzIEFUVFJJQlVURSA6Oj0geyBhYS1jb3VudGVyc2lnbmF0dXJlLCAu Li4gfQ1hYS1jb3VudGVyc2lnbmF0dXJlIEFUVFJJQlVURSA6Oj0NCXsgVFlQRSBDb3VudGVy c2lnbmF0dXJlIElERU5USUZJRUQgQlkgaWQtY291bnRlcnNpZ25hdHVyZSB9DUNvdW50ZXJz aWduYXR1cmUgOjo9IFNpZ25lckluZm8NaWQtY291bnRlcnNpZ25hdHVyZSBPQkpFQ1QgSURF TlRJRklFUiA6Oj0gDQl7IGlzbygxKSBtZW1iZXItYm9keSgyKSB1cyg4NDApIHJzYWRzaSgx MTM1NDkpIHBrY3MoMSkgcGtjczkoOSkgNiB9DVNpZ25lciBpZGVudGlmaWNhdGlvbg1UaGUg c2lnbmVyIGlkZW50aWZpY2F0aW9uIGNvbnRhaW5zIGluZm9ybWF0aW9uIHRvIGlkZW50aWZ5 IGEgY2VydGlmaWNhdGUgYnkgaXRzIGlzc3VlciBhbmQgaXRzIHNlcmlhbCBudW1iZXIgb3Is IHNpbmNlIHZlcnNpb24gMywgYnkgYSBrZXkgaWRlbnRpZmllci4NU2lnbmVySWRlbnRpZmll ciA6Oj0gQ0hPSUNFIHsNaXNzdWVyQW5kU2VyaWFsTnVtYmVyIAkJSXNzdWVyQW5kU2VyaWFs TnVtYmVyLA0uLi4sDVtbMzogc3ViamVjdEtleUlkZW50aWZpZXIgCVswXSBTdWJqZWN0S2V5 SWRlbnRpZmllciBdXSANfQ1TaWduZWQgYW5kIHVuc2lnbmVkIGF0dHJpYnV0ZXMNQW4gYXR0 cmlidXRlIGlzIGRlZmluZWQgYnkgYW4gb2JqZWN0IGlkZW50aWZpZXIgYW5kIGEgdmFsdWUg KHNlZSATIFJFRiBfUmVmMzk1NTkzMTI2IFxyIFxoIAEUMTQVKS4NU29tZSBvZiBhdHRyaWJ1 dGVzLCBpZiBwcmVzZW50LCBoYXZlIHRvIGJlIHNpZ25lZC4gVGhlIHNpZ25lZCBhdHRyaWJ1 dGVzLCBpZiBwcmVzZW50LCBzaGFsbCBjb250YWluIGF0IGxlYXN0IHRoZSBtZXNzYWdlLWRp Z2VzdCAoc2VlIBMgUkVGIF9SZWYzOTU1OTcyNjQgXHIgXGggARQxNC4yFSkgYW5kIHRoZSBj b250ZW50LXR5cGUgKHNlZSATIFJFRiBfUmVmMzk1NTk3MTc2IFxyIFxoIAEUMTQuMRUpIGF0 dHJpYnV0ZXMuDU90aGVyIGF0dHJpYnV0ZXMgY2FuIGJlIHByZXNlbnQgYnV0IHRoZXkgaGF2 ZSBub3QgdG8gYmUgc2lnbmVkLg1VbnNpZ25lZEF0dHJpYnV0ZXMgQVRUUklCVVRFIDo6PSB7 IGFhLWNvdW50ZXJzaWduYXR1cmUsIC4uLiB9DVNpZ25hdHVyZSBwcm9jZXNzDU1lc3NhZ2Ug ZGlnZXN0IGdlbmVyYXRpb24gcHJvY2Vzc3MNVGhlIG1lc3NhZ2UgZGlnZXN0IGlzIGNvbXB1 dGVkIG9uIHRoZSBjb250ZW50IGJlaW5nIHNpZ25lZCBvciBvbiBhIG1lc3NhZ2UgZGlnZXN0 IG9mIHRoaXMgY29udGVudCBkZXBlbmRpbmcgb24gdGhlIHByZXNlbmNlIG9mIHNpZ25lZCBh dHRyaWJ1dGVzLg1JZiB0aGVyZSBpcyBubyBzaWduZWQgYXR0cmlidXRlcywgdGhlIG1lc3Nh Z2UgZGlnZXN0IGlzIGNvbXB1dGVkIG9uIHRoZSBlQ29udGVudCBjb21wb25lbnQgb2YgdGhl IGVuY2FwQ29udGVudEluZm8gY29tcG9uZW50LiBUaGUgZUNvbnRlbnQgY29tcG9uZW50IGlz IGFuIG9jdGV0IHN0cmluZyBhbmQgb25seSB0aGUgY29udGVudCBwYXJ0IG9mIHRoaXMgb2N0 ZXQgc3RyaW5nIGVuY29kaW5nIGlzIHVzZWQgKHRoZSB0YWcgYW5kIGxlbmd0aCBmaWVsZHMg YXJlIG9taXR0ZWQpLg1JZiB0aGVyZSBhcmUgc2lnbmVkIGF0dHJpYnV0ZXMsIHRoZSBjb250 ZW50LXR5cGUgYW5kIG1lc3NhZ2UtZGlnZXN0IGF0dHJpYnV0ZXMgYXJlIHByZXNlbnQgYW5k IHRoZSBtZXNzYWdlIGRpZ2VzdCBpcyBjb21wdXRlZCBvbiB0aGUgREVSIGVuY29kaW5nIG9m IHRoZSBzaWduZWRBdHRycyBjb21wb25lbnQuIA1UaGUgbWVzc2FnZS1kaWdlc3QgYXR0cmli dXRlIGlzIGNvbXB1dGVkIG9uIHRoZSBjb250ZW50IGJlaW5nIHNpZ25lZCB3aGljaCBpcyBy ZXByZXNlbnRlZCBieSB0aGUgZUNvbnRlbnQgY29tcG9uZW50IG9mIHRoZSBlbmNhcENvbnRl bnRJbmZvIGNvbXBvbmVudC4gT25seSB0aGUgY29udGVudCBwYXJ0IG9mIHRoaXMgb2N0ZXQg c3RyaW5nIGVuY29kaW5nIGlzIHVzZWQgKHRoZSB0YWcgYW5kIGxlbmd0aCBmaWVsZHMgYXJl IG9taXR0ZWQpLg1BIHNwZWNpZmljIERFUiBlbmNvZGluZyBvZiB0aGUgc2lnbmVkQXR0cnMg Y29tcG9uZW50IGlzIGRvbmUgdG8gY29tcHV0ZSB0aGUgbWVzc2FnZSBkaWdlc3QgOiBmb3Ig dGhpcyBlbmNvZGluZywgdGhlIElNUExJQ0lUIFswXSB0YWcgc2hhbGwgYmUgcmVwbGFjZWQg d2l0aCBFWFBMSUNJVCBTRVQgT0YgdGFnIGFuZCB0aGUgdGFnIGFuZCBsZW5ndGggZmllbGRz IGZvbGxvd2VkIGJ5IHRoZSBjb250ZW50IG9mIHRoZSBERVIgZW5jb2RpbmcgYXJlIHVzZWQg YnkgdGhlIG1lc3NhZ2UgZGlnZXN0IGNvbXB1dGF0aW9uIHByb2Nlc3MuDVNpZ25hdHVyZSBn ZW5lcmF0aW9uIHByb2Nlc3MNVGhlIHNpZ25hdHVyZSBpcyBjb21wdXRlZCBieSBlbmNyeXB0 aW9uLCB1c2luZyB0aGUgc2lnbmVyknMgcHJpdmF0ZSBrZXksIG9mIHRoZSByZXN1bHQgb2Yg dGhlIG1lc3NhZ2UgZGlnZXN0IGNhbGN1bGF0aW9uICh3aGljaCBjYW4gY29udGFpbiBzaWdu ZWQgYXR0cmlidXRlcykuIFRoZSBhbGdvcml0aG0gaXMgZGVmaW5lZCBieSBhbiBvYmplY3Qg aWRlbnRpZmllciBhbmQsIHBvc3NpYmx5LCBzb21lIHBhcmFtZXRlcnMuIFRoZSBzaWduYXR1 cmUgaXMgZW5jb2RlZCBhcyBhbiBvY3RldCBzdHJpbmcgYW5kIGNhcnJpZWQgaW4gdGhlIHNp Z25hdHVyZSBjb21wb25lbnQuDVNpZ25hdHVyZSB2ZXJpZmljYXRpb24gcHJvY2Vzcw1UaGUg c2lnbmF0dXJlIHZlcmlmaWNhdGlvbiBwcm9jZXNzIG5lZWRzIHRoZSBzaWduZXKScyBwdWJs aWMga2V5IHdoaWNoIGNhbiBiZSBvYnRhaW5lZCBieSB2YXJpb3VzIG1lYW5zIGJ1dCB0aGUg cHJlZmVycmVkIG1ldGhvZCBpcyB1c2luZyBhIHB1YmxpYyBrZXkgY2VydGlmaWNhdGUuIFRo ZSByZXN1bHQgb2YgdGhlIG1lc3NhZ2UgZGlnZXN0IGNhbGN1bGF0aW9uICh3aGljaCBjYW4g Y29udGFpbiBzaWduZWQgYXR0cmlidXRlcykgc2hhbGwgYmUgZXF1YWwgdG8gdGhlIHJlc3Vs dCBjb21wdXRlZCBieSB0aGUgc2lnbmVyIGFuZCBvYnRhaW5lZCBieSBkZWNyeXB0aW9uIG9m IHRoZSBzaWduYXR1cmUgd2l0aCB0aGUgc2lnbmVyknMgcHVibGljIGtleS4gSWYgdGhlIHNp Z25lckluZm8gaW5jbHVkZXMgc2lnbmVkIGF0dHJpYnV0ZXMsIHRoZSBjb250ZW50LXR5cGUs IHByZXNlbnQgaW4gdGhlIHNpZ25lZCBhdHRyaWJ1dGVzLCBzaGFsbCBiZSBlcXVhbCB0byB0 aGUgZUNvbnRlbnRUeXBlIG9mIEVuY2Fwc3VsYXRlZENvbnRlbnRJbmZvLg1FbnZlbG9wZWQg ZGF0YQ1UaGUgZW52ZWxvcGVkLWRhdGEgY29udGVudCB0eXBlIHJlcHJlc2VudHMgYW4gZW5j cnlwdGVkIGNvbnRlbnQgb2YgYW55IHR5cGUgYW5kIHRoZSBlbmNyeXB0ZWQgY29udGVudC1l bmNyeXB0aW9uIGtleXMgZm9yIG9uZSBvciBtb3JlIHJlY2lwaWVudHMuIFRoZSBjb21iaW5h dGlvbiBvZiB0aGUgZW5jcnlwdGVkIGNvbnRlbnQgYW5kIHRoZSBlbmNyeXB0ZWQgY29udGVu dC1lbmNyeXB0aW9uIGtleSByZWxhdGVkIHRvIG9uZSByZWNpcGllbnQgaXMgdGhlIGRpZ2l0 YWwgZW52ZWxvcGUgb2YgdGhhdCByZWNpcGllbnQuDVRoZSBjb25zdHJ1Y3Rpb24gb2YgYW4g ZW52ZWxvcGVkLWRhdGEgbmVlZHMgdGhlIGZvbGxvd2luZyBzdGVwczoNYSBjb250ZW50LWVu Y3J5cHRpb24ga2V5IGZvciB0aGUgY29udGVudC1lbmNyeXB0aW9uIGFsZ29yaXRobSBpcyBn ZW5lcmF0ZWQgdXNpbmcgYSByYW5kb20gZnVuY3Rpb247DWZvciBlYWNoIHJlY2lwaWVudCwg dGhlIGNvbnRlbnQtZW5jcnlwdGlvbiBrZXkgaXMgZW5jcnlwdGVkIGFjY29yZGluZyB0byB0 aGUga2V5IG1hbmFnZW1lbnQgYWxnb3JpdGhtIGZvciB0aGUgcmVjaXBpZW50LiBGb3VyIHRl Y2huaXF1ZXMgYXJlIGdlbmVyYWxseSBzdXBwb3J0ZWQ6DWtleSB0cmFuc3BvcnQ6IHRoZSBj b250ZW50LWVuY3J5cHRpb24ga2V5IGlzIGVuY3J5cHRlZCB3aXRoIHRoZSByZWNpcGllbnSS cyBwdWJsaWMta2V5Ow1rZXkgYWdyZWVtZW50OiB0aGUgcmVjaXBpZW50knMgcHVibGljIGtl eSBhbmQgdGhlIHNlbmRlcpJzIHByaXZhdGUga2V5IGFyZSBjb21iaW5lZCB0byBnZW5lcmF0 ZSBhIHBhaXJ3aXNlIHN5bW1ldHJpYyBrZXkgdXNlZCB0byBlbmNyeXB0IHRoZSBjb250ZW50 LWVuY3J5cHRpb24ga2V5Ow1zeW1tZXRyaWMga2V5LWVuY3J5cHRpb24ga2V5czogdGhlIGNv bnRlbnQtZW5jcnlwdGlvbiBrZXkgaXMgZW5jcnlwdGVkIHdpdGggYSBwcmV2aW91c2x5IGRp c3RyaWJ1dGVkIHN5bW1ldHJpYy1rZXk7DXBhc3N3b3JkczogdGhlIGNvbnRlbnQtZW5jcnlw dGlvbiBrZXkgaXMgZW5jcnlwdGVkIHVzaW5nIGEga2V5IGRlcml2ZWQgZnJvbSBhIHNoYXJl ZCBzZWNyZXQgdmFsdWUuDWZvciBlYWNoIHJlY2lwaWVudCwgdGhlIGVuY3J5cHRlZCBjb250 ZW50LWVuY3J5cHRpb24ga2V5IGFuZCByZWNpcGllbnQgc3BlY2lmaWMgaW5mb3JtYXRpb24g YXJlIGNvbGxlY3RlZCBpbnRvIGEgUmVjaXBpZW50SW5mbyB2YWx1ZSAoc2VlIBMgUkVGIF9S ZWYzOTU2MDY5NjUgXHIgXGggARQ5LjIVKTsNdGhlIGNvbnRlbnQgaXMgcGFkZGVkIHRvIGEg bXVsdGlwbGUgb2YgYmxvY2sgc2l6ZSBhY2NvcmRpbmcgdG8gdGhlIGVuY3J5cHRpb24gYWxn b3JpdGhtLCBpZiBuZWVkZWQsIGFuZCB0aGVuIGlzIGVuY3J5cHRlZCB3aXRoIHRoZSBrZXkg ZW5jcnlwdGlvbiBrZXkgYXMgZGVmaW5lZCBpbiBiKTsNdGhlIFJlY2lwaWVudEluZm8gdmFs dWVzIGZvciBhbGwgdGhlIHJlY2lwaWVudHMgYXJlIGdhdGhlcmVkIGFuZCBmb3JtLCB3aXRo IHRoZSBlbmNyeXB0ZWQgY29udGVudCwgdGhlIEVudmVsb3BlZERhdGEgdmFsdWUgKHNlZSAT IFJFRiBfUmVmMzk1NjA2OTY1IFxyIFxoIAEUOS4yFSkuDVVwb24gcmVjZWl2aW5nIHRoZSBF bnZlbG9wZWREYXRhLCBlYWNoIHJlY2lwaWVudCBkZWNyeXB0IG9uZSBvZiB0aGUgZW5jcnlw dGVkIGNvbnRlbnQtZW5jcnlwdGlvbiB0byBnZXQgdGhlIGVuY3J5cHRpb24ga2V5IHRoZW4g ZGVjcnlwdCB0aGUgY29udGVudC4NVGhlIEVudmVsb3BlZERhdGEgdHlwZQ1FbnZlbG9wZWRE YXRhIDo6PSBTRVFVRU5DRSB7DXZlcnNpb24gCQkJQ01TVmVyc2lvbiwNb3JpZ2luYXRvcklu Zm8gCQlbMF0gSU1QTElDSVQgT3JpZ2luYXRvckluZm8gT1BUSU9OQUwsDXJlY2lwaWVudElu Zm9zIAkJUmVjaXBpZW50SW5mb3MsDWVuY3J5cHRlZENvbnRlbnRJbmZvIAlFbmNyeXB0ZWRD b250ZW50SW5mbywNLi4uLA1bWzI6IHVucHJvdGVjdGVkQXR0cnMgCVsxXSBJTVBMSUNJVCBB dHRyaWJ1dGVzDQkJe3sgVW5wcm90ZWN0ZWRBdHRyaWJ1dGVzIH19IE9QVElPTkFMIF1dIA19 DXZlcnNpb24gc3BlY2lmaWVzIHRoZSB2ZXJzaW9uIG9mIHRoZSBFbnZlbG9wZWREYXRhIGNv bnRlbnQgYW5kIHNob3VsZCBiZSBkZWZpbmVkIGJ5IGFwcGx5aW5nIHN1Y2Nlc3NpdmVseSB0 aGUgZm9sbG93aW5nIHJ1bGVzOg1pZiBvcmlnaW5hdG9ySW5mbyBpcyBwcmVzZW50LCAgYW5k IGF0IGxlYXN0IG9uZSBjZXJ0aWZpY2F0ZSB1c2VzIHRoZSBvdGhlciBhbHRlcm5hdGl2ZSwg dGhlIHZlcnNpb24gc2hhbGwgYmUgdjQ7DWlmIG9yaWdpbmF0b3JJbmZvIGlzIHByZXNlbnQg YW5kIGF0IGxlYXN0IG9uZSBjZXJ0aWZpY2F0ZSByZXZvY2F0aW9uIGxpc3QgdXNlcyB0aGUg b3RoZXIgYWx0ZXJuYXRpdmUsIHRoZSB2ZXJzaW9uIHNoYWxsIGJlIHY0Ow1pZiBvcmlnaW5h dG9ySW5mbyBpcyBwcmVzZW50IGFuZCBhdCBsZWFzdCBvbmUgY2VydGlmaWNhdGUgb2YgdmVy c2lvbiAyIGlzIHByZXNlbnQsIHRoZSB2ZXJzaW9uIHNoYWxsIGJlIHYzOw1pZiBvcmlnaW5h dG9ySW5mbyBpcyBwcmVzZW50IGFuZCBhdCBsZWFzdCBvbmUgUmVjaXBpZW50SW5mbyBzdHJ1 Y3R1cmUgdXNlcyB0aGUgcHdyaSBvciB0aGUgb3JpIGFsdGVybmF0aXZlLCB0aGUgdmVyc2lv biBzaGFsbCBiZSB2MzsNaWYgb3JpZ2luYXRvckluZm8gaXMgYWJzZW50IGFuZCB1bnByb3Rl Y3RlZEF0dHJzIGlzIGFic2VudCBhbmQgYWxsIFJlY2lwaWVudEluZm8gc3RydWN0dXJlcyB1 c2UgdmVyc2lvbiB2MCwgdGhlIHZlcnNpb24gc2hhbGwgYmUgdjA7DWluIGFsbCBvdGhlciBj YXNlcyB0aGUgdmVyc2lvbiBzaGFsbCBiZSB2Mi4Nb3JpZ2luYXRvckluZm8sIGlmIHByZXNl bnQsIHByb3ZpZGVzIGluZm9ybWF0aW9uIGFib3V0IHRoZSBvcmlnaW5hdG9yLiBUaGlzIGNv bXBvbmVudCBpcyBvbmx5IHByZXNlbnQgaWYga2V5IG1hbmFnZW1lbnQgYWxnb3JpdGhtIChz ZWUgEyBSRUYgX1JlZjM5NTYwNjk2NSBcciBcaCABFDkuMhUpIG5lZWRzIGNlcnRpZmljYXRl cyBvciBjZXJ0aWZpY2F0ZSByZXZvY2F0aW9uIGxpc3RzLg1PcmlnaW5hdG9ySW5mbyA6Oj0g U0VRVUVOQ0Ugew1jZXJ0cyAJWzBdIFtYRVI6QkFTRTY0XSBPQ1RFVCBTVFJJTkcNCQkoQ09O VEFJTklORyBDZXJ0aWZpY2F0ZVNldCkgT1BUSU9OQUwsDWNybHMgCVsxXSBbWEVSOkJBU0U2 NF0gT0NURVQgU1RSSU5HDQkJKENPTlRBSU5JTkcgUmV2b2NhdGlvbkluZm9DaG9pY2VzKSBP UFRJT05BTCANfQ0JY2VydHMgaXMgYSBjb2xsZWN0aW9uIG9mIHB1YmxpYyBrZXkgYW5kL29y IGF0dHJpYnV0ZSBjZXJ0aWZpY2F0ZXMgYXNzb2NpYXRlZCB0byBrZXkgbWFuYWdlbWVudCBh bGdvcml0aG1zLiBUaGUgY29sbGVjdGlvbiBtYXkgY29udGFpbiBtb3JlIGNlcnRpZmljYXRl cyB0aGFuIG5lY2Vzc2FyeSBvciBmZXdlciBhbmQsIGluIHRoZSBsYXR0ZXIgY2FzZSwgcmVj aXBpZW50cyBoYXZlIHRvIHVzZSBvdGhlciBtZWFucyB0byBnZXQgb3RoZXIgY2VydGlmaWNh dGVzLiBUaGUgQ2VydGlmaWNhdGVTZXQgQVNOLjEgdHlwZSBpcyBkZWZpbmVkIGluIGNsYXVz ZSATIFJFRiBfUmVmMzk1NjA4NDUxIFxyIFxoIAEUOC4xFSAuDQljcmxzIGlzIGEgY29sbGVj dGlvbiBvZiBwdWJsaWMga2V5IG9yIGF0dHJpYnV0ZSBjZXJ0aWZpY2F0ZSByZXZvY2F0aW9u IGxpc3RzIG5lZWRlZCB0byB2YWxpZGF0ZSB0aGUgY2VydGlmaWNhdGVzIGFzc29jaWF0ZWQg dG8ga2V5IG1hbmFnZW1lbnQgYWxnb3JpdGhtcy4gQXMgZm9yIGNlcnRpZmljYXRlcywgdGhp cyBjb2xsZWN0aW9uIG1heSBjb250YWluIG1vcmUgY2VydGlmaWNhdGUgcmV2b2NhdGlvbiBs aXN0cyB0aGFuIG5lY2Vzc2FyeSBvciBmZXdlciBhbmQsIGluIHRoZSBsYXR0ZXIgY2FzZSwg cmVjaXBpZW50cyBoYXZlIHRvIHVzZSBvdGhlciBtZWFucyB0byBnZXQgb3RoZXIgY2VydGlm aWNhdGUgcmV2b2NhdGlvbiBsaXN0cy4gVGhlIFJldm9jYXRpb25JbmZvQ2hvaWNlcyBBU04u MSB0eXBlIGlzIGRlZmluZWQgaW4gY2xhdXNlIBMgUkVGIF9SZWYzOTU2MDg0NTEgXHIgXGgg ARQ4LjEVIC4NcmVjaXBpZW50SW5mb3MgaXMgYSBjb2xsZWN0aW9uIG9mIHBlci1yZWNpcGll bnQgaW5mb3JtYXRpb24gKHNlZSATIFJFRiBfUmVmMzk1NjA2OTY1IFxyIFxoIAEUOS4yFSku DVJlY2lwaWVudEluZm9zIDo6PSBTRVQgU0laRSAoMS4uTUFYKSBPRiBSZWNpcGllbnRJbmZv DWVuY3J5cHRlZENvbnRlbnRJbmZvIGNvbnRhaW5zIHRoZSBlbmNyeXB0ZWQgZGF0YSBhbmQg dGhlIGFsZ29yaXRobSB1c2VkIGZvciBlbmNyeXB0aW9uLg1FbmNyeXB0ZWRDb250ZW50SW5m byA6Oj0gU0VRVUVOQ0Ugew0JY29udGVudFR5cGUJCUNPTlRFTlQtVFlQRS4maWQoe0NvbnRl bnRTZXR9KSwNCWNvbnRlbnRFbmNyeXB0aW9uQWxnb3JpdGhtDQkJCQlDb250ZW50RW5jcnlw dGlvbkFsZ29yaXRobUlkZW50aWZpZXIsDQllbmNyeXB0ZWRDb250ZW50ICAgCVswXSBJTVBM SUNJVCBFTkNSWVBURUQge0NPTlRFTlQtVFlQRS4mVHlwZQ0JCQkJKHtDb250ZW50U2V0fXtA Y29udGVudFR5cGV9KX0gT1BUSU9OQUwgDQl9DUNvbnRlbnRFbmNyeXB0aW9uQWxnb3JpdGht SWRlbnRpZmllciA6Oj0gQWxnb3JpdGhtSWRlbnRpZmllcg0Je0NPTlRFTlQtRU5DUllQVElP Tiwge0NvbnRlbnRFbmNyeXB0aW9uQWxnb3JpdGhtU2V0fX0NVGhlIHN1cHBvcnRlZCBlbmNy eXB0aW9uIGFsZ29yaXRobXMgYXJlIGRlZmluZWQgYnkgQ29udGVudEVuY3J5cHRpb25BbGdz IG9iamVjdCBzZXQgd2hpY2ggY2FuIGJlIGNvbXBsZXRlZCBieSBvdGhlciBhbGdvcml0aG1z Lg1UaGVzZSBhbGdvcml0aG1zIGFyZSBkZWZpbmVkIGFzIG9iamVjdHMgb2YgdGhlIENPTlRF TlQtRU5DUllQVElPTiBpbmZvcm1hdGlvbiBvYmplY3QgY2xhc3MuDUNPTlRFTlQtRU5DUllQ VElPTiA6Oj0gQ0xBU1Mgew0JCSZpZAkJCU9CSkVDVCBJREVOVElGSUVSIFVOSVFVRSwNCQkm UGFyYW1zCQlPUFRJT05BTCwNCQkmcGFyYW1QcmVzZW5jZQlQYXJhbU9wdGlvbnMgREVGQVVM VCBhYnNlbnQsDQkJJnNtaW1lQ2FwcwkJU01JTUUtQ0FQUyBPUFRJT05BTA0JCX0NV0lUSCBT WU5UQVggew0JCUlERU5USUZJRVIJCSZpZA0JCVtQQVJBTVMJCVtUWVBFICZQYXJhbXNdIEFS RSAmcGFyYW1QcmVzZW5jZV0NCQlbU01JTUUtQ0FQUwkJJnNtaW1lQ2Fwc10NCQl9DQlDb250 ZW50RW5jcnlwdGlvbkFsZ29yaXRobVNldCBDT05URU5ULUVOQ1JZUFRJT04gOjo9DQkJeyBD b250ZW50RW5jcnlwdGlvbkFsZ3MsIC4uLiB9DQkJQ29udGVudEVuY3J5cHRpb25BbGdzIENP TlRFTlQtRU5DUllQVElPTiA6Oj0gew0JCWNlYS1hZXMxMjgtQ0NNIHwgDQkJY2VhLWFlczE5 Mi1DQ00gfCANCQljZWEtYWVzMjU2LUNDTSB8DQkJY2VhLWFlczEyOC1HQ00gfCANCQljZWEt YWVzMTkyLUdDTSB8IA0JCWNlYS1hZXMyNTYtR0NNLCANCQkuLi4gfQ0JCWNlYS1hZXMxMjgt Q0NNIENPTlRFTlQtRU5DUllQVElPTiA6Oj0gew0JCUlERU5USUZJRVIgaWQtYWVzMTI4LUND TQ0JCVBBUkFNUyBUWVBFIENDTVBhcmFtZXRlcnMgQVJFIHJlcXVpcmVkDQkJU01JTUUtQ0FQ UyB7IElERU5USUZJRUQgQlkgaWQtYWVzMTI4LUNDTSB9DQkJfQ0JCWFlcyBPQkpFQ1QgSURF TlRJRklFUiA6Oj0NCQl7IGpvaW50LWlzby1pdHUtdCgyKSBjb3VudHJ5KDE2KSB1cyg4NDAp IG9yZ2FuaXphdGlvbigxKSANCQlnb3YoMTAxKSBjc29yKDMpIG5pc3RBbGdvcml0aG1zKDQp ICAxIH0NCQlpZC1hZXMxMjgtQ0NNIE9CSkVDVCBJREVOVElGSUVSIDo6PSB7IGFlcyA3IH0N CQljZWEtYWVzMTkyLUNDTSBDT05URU5ULUVOQ1JZUFRJT04gOjo9IHsNIAkJSURFTlRJRklF UiBpZC1hZXMxOTItQ0NNDSAJCVBBUkFNUyBUWVBFIENDTVBhcmFtZXRlcnMgQVJFIHJlcXVp cmVkDSAJCVNNSU1FLUNBUFMgeyBJREVOVElGSUVEIEJZIGlkLWFlczE5Mi1DQ00gfQ0gCQl9 DQkJaWQtYWVzMTkyLUNDTSBPQkpFQ1QgSURFTlRJRklFUiA6Oj0geyBhZXMgMjcgfQ0JCWNl YS1hZXMyNTYtQ0NNIENPTlRFTlQtRU5DUllQVElPTiA6Oj0gew0JCUlERU5USUZJRVIgaWQt YWVzMjU2LUNDTQ0JCVBBUkFNUyBUWVBFIENDTVBhcmFtZXRlcnMgQVJFIHJlcXVpcmVkDQkJ U01JTUUtQ0FQUyB7IElERU5USUZJRUQgQlkgaWQtYWVzMjU2LUNDTSB9DQkJfQ0JCWlkLWFl czI1Ni1DQ00gT0JKRUNUIElERU5USUZJRVIgOjo9IHsgYWVzIDQ3IH0NCQljZWEtYWVzMTI4 LUdDTSBDT05URU5ULUVOQ1JZUFRJT04gOjo9IHsNCQlJREVOVElGSUVSIGlkLWFlczEyOC1H Q00NCQlQQVJBTVMgVFlQRSBHQ01QYXJhbWV0ZXJzIEFSRSByZXF1aXJlZA0JCVNNSU1FLUNB UFMgeyBJREVOVElGSUVEIEJZIGlkLWFlczEyOC1HQ00gfQ0JCX0NCQlpZC1hZXMxMjgtR0NN IE9CSkVDVCBJREVOVElGSUVSIDo6PSB7IGFlcyA2IH0NCQljZWEtYWVzMTkyLUdDTSBDT05U RU5ULUVOQ1JZUFRJT04gOjo9IHsNCQlJREVOVElGSUVSIGlkLWFlczE5Mi1HQ00NCQlQQVJB TVMgVFlQRSBHQ01QYXJhbWV0ZXJzIEFSRSByZXF1aXJlZA0JCVNNSU1FLUNBUFMgeyBJREVO VElGSUVEIEJZIGlkLWFlczE5Mi1HQ00gfQ0JCX0NCQlpZC1hZXMxOTItR0NNIE9CSkVDVCBJ REVOVElGSUVSIDo6PSB7IGFlcyAyNiB9DQkJY2VhLWFlczI1Ni1HQ00gQ09OVEVOVC1FTkNS WVBUSU9OIDo6PSB7DQkJSURFTlRJRklFUiBpZC1hZXMyNTYtR0NNDQkJUEFSQU1TIFRZUEUg R0NNUGFyYW1ldGVycyBBUkUgcmVxdWlyZWQNCQlTTUlNRS1DQVBTIHsgSURFTlRJRklFRCBC WSBpZC1hZXMyNTYtR0NNIH0NCQl9DQkJaWQtYWVzMjU2LUdDTSBPQkpFQ1QgSURFTlRJRklF UiA6Oj0geyBhZXMgNDYgfQ0JCUNDTVBhcmFtZXRlcnMgOjo9IFNFUVVFTkNFIHsNCQlhZXMt bm9uY2UgICAgICAgICBPQ1RFVCBTVFJJTkcgKFNJWkUoNy4uMTMpKSwNCQlhZXMtSUNWbGVu ICAgICAgICBBRVMtQ0NNLUlDVmxlbiBERUZBVUxUIDEyIH0NCQlBRVMtQ0NNLUlDVmxlbiA6 Oj0gSU5URUdFUiAoNCB8IDYgfCA4IHwgMTAgfCAxMiB8IDE0IHwgMTYpDQkJR0NNUGFyYW1l dGVycyA6Oj0gU0VRVUVOQ0Ugew0JCWFlcy1ub25jZSAgICAgICAgT0NURVQgU1RSSU5HLCAt LSByZWNvbW1lbmRlZCBzaXplIGlzIDEyIG9jdGV0cw0JCWFlcy1JQ1ZsZW4gICAgICAgQUVT LUdDTS1JQ1ZsZW4gREVGQVVMVCAxMiB9DQkJQUVTLUdDTS1JQ1ZsZW4gOjo9IElOVEVHRVIg KDEyIHwgMTMgfCAxNCB8IDE1IHwgMTYpDUVOQ1JZUFRFRCB7VG9CZUVuY3J5cHRlZH0gOjo9 IE9DVEVUIFNUUklORyAoIENPTlNUUkFJTkVEIEJZDQkJeyBUb0JlRW5jcnlwdGVkIH0gKQ0J ZSkJdW5wcm90ZWN0ZWRBdHRyaWJ1dGVzIGNvbnRhaW5zIHRoZSB1bnByb3RlY3RlZCBhdHRy aWJ1dGVzIGlmIGFueQkJDVVucHJvdGVjdGVkQXR0cmlidXRlcyBBVFRSSUJVVEUgOjo9ICB7 IC4uLiB9DVRoZSBSZWNpcGllbnRJbmZvIHR5cGUNVGhlIFJlY2lwaWVudEluZm8gdHlwZSBo YXMgZm91ciBhbHRlcm5hdGl2ZXMgYXNzb2NpYXRlZCB0byB0aGUgdGVjaG5pcXVlcyBkZXNj cmliZWQgaW4gY2xhdXNlcyATIFJFRiBfUmVmMzk1NjA5OTA3IFxyIFxoIAEUOS4yLjEVLCAT IFJFRiBfUmVmMzk1NjA5OTMxIFxyIFxoIAEUOS4yLjIVLCATIFJFRiBfUmVmMzk1NjA5OTU2 IFxyIFxoIAEUOS4yLjMVIGFuZCATIFJFRiBfUmVmMzk1NjA5OTc4IFxyIFxoIAEUOS4yLjQV LiBBbiBpbXBsZW1lbnRhdGlvbiBzaGFsbCBzdXBwb3J0IGF0IGxlYXN0IHRoZSBrZXkgdHJh bnNwb3J0IChzZWUgEyBSRUYgX1JlZjM5NTYwOTkwNyBcciBcaCABFDkuMi4xFSksIGtleSBh Z3JlZW1lbnQgKHNlZSATIFJFRiBfUmVmMzk1NjA5OTMxIFxyIFxoIAEUOS4yLjIVKSBhbmQg cHJldmlvdXNseSBkaXN0cmlidXRlZCBzeW1tZXRyaWMga2V5IGVuY3J5cHRpb24ga2V5cyAo c2VlIBMgUkVGIF9SZWYzOTU2MDk5NTYgXHIgXGggARQ5LjIuMxUpIHRlY2huaXF1ZXMuDVJl Y2lwaWVudEluZm8gOjo9IENIT0lDRSB7DWt0cmkgICAgICAgICAgIEtleVRyYW5zUmVjaXBp ZW50SW5mbywNLi4uLA1bWzM6IGthcmkgIFsxXSBLZXlBZ3JlZVJlY2lwaWVudEluZm8gXV0s DVtbNDoga2VrcmkgWzJdIEtFS1JlY2lwaWVudEluZm9dXSwNW1s1OiBwd3JpICBbM10gUGFz c3dvcmRSZWNpcGllbnRJbmZvLA0JCW9yaSAgIFs0XSBPdGhlclJlY2lwaWVudEluZm8gXV0g DX0NVGhlIEtleVRyYW5zUmVjaXBpZW50SW5mbyB0eXBlDVRoaXMgdHlwZSBpcyB1c2VkIGJ5 IHRoZSBrZXkgdHJhbnNwb3J0IHRlY2huaXF1ZSB0byB0cmFuc2ZlciBrZXkgZW5jcnlwdGlv biBrZXlzIHRvIHRoZSB2YXJpb3VzIHJlY2lwaWVudHMuDUtleVRyYW5zUmVjaXBpZW50SW5m byA6Oj0gU0VRVUVOQ0Ugew12ZXJzaW9uIAkJCUNNU1ZlcnNpb24sICAtLSBhbHdheXMgc2V0 IHRvIDAgb3IgMg1yaWQgCQkJCVJlY2lwaWVudElkZW50aWZpZXIsDWtleUVuY3J5cHRpb25B bGdvcml0aG0gCUFsZ29yaXRobUlkZW50aWZpZXINCQl7S0VZLVRSQU5TUE9SVCwge0tleVRy YW5zcG9ydEFsZ29yaXRobVNldH19LA1lbmNyeXB0ZWRLZXkgCQlFbmNyeXB0ZWRLZXkgDX0N VGhlIGFsZ29yaXRobXMgYXJlIGRlZmluZWQgYXMgb2JqZWN0cyBvZiBLRVktVFJBTlNQT1JU IGluZm9ybWF0aW9uIG9iamVjdCBjbGFzcy4NS0VZLVRSQU5TUE9SVCA6Oj0gQ0xBU1Mgew0m aWQJCQkJT0JKRUNUIElERU5USUZJRVIgVU5JUVVFLA0mUGFyYW1zCQkJT1BUSU9OQUwsDSZw YXJhbVByZXNlbmNlCQlQYXJhbU9wdGlvbnMgREVGQVVMVCBhYnNlbnQsDSZQdWJsaWNLZXlT ZXQJCVBVQkxJQy1LRVkgT1BUSU9OQUwsDSZzbWltZUNhcHMJCQlTTUlNRS1DQVBTIE9QVElP TkFMDX0gDVdJVEggU1lOVEFYIHsNSURFTlRJRklFUiAmaWQNW1BBUkFNUwkJCVtUWVBFICZQ YXJhbXNdIEFSRSAmcGFyYW1QcmVzZW5jZV0NW1BVQkxJQy1LRVlTCQkmUHVibGljS2V5U2V0 XQ1bU01JTUUtQ0FQUwkJCSZzbWltZUNhcHNdDX0NS2V5VHJhbnNwb3J0QWxnb3JpdGhtU2V0 IEtFWS1UUkFOU1BPUlQgOjo9IHsgS2V5VHJhbnNwb3J0QWxncywgLi4uIH0NS2V5VHJhbnNw b3J0QWxncyBLRVktVFJBTlNQT1JUIDo6PSB7IGt0LXJzYSwgLi4uIH0NVGhlIEtleVRyYW5z cG9ydEFsZ3MgY29udGFpbnMgdGhlIGZvbGxvd2luZyBhbGdvcml0aG06DWt0LXJzYQlLRVkt VFJBTlNQT1JUIDo6PSB7DUlERU5USUZJRVIJCXJzYUVuY3J5cHRpb24NUEFSQU1TCQlUWVBF IE5VTEwgQVJFIHJlcXVpcmVkDVBVQkxJQy1LRVlTCQl7IHBrLXJzYSB9DVNNSU1FLUNBUFMJ CXtJREVOVElGSUVEIEJZIHJzYUVuY3J5cHRpb259DX0NcnNhRW5jcnlwdGlvbiBPQkpFQ1Qg SURFTlRJRklFUiA6Oj0gew1pc28oMSkgbWVtYmVyLWJvZHkoMikgdXMoODQwKSByc2Fkc2ko MTEzNTQ5KSBwa2NzKDEpIHBrY3MtMSgxKSAxIH0NcGstcnNhIFBVQkxJQy1LRVkgOjo9IHsN SURFTlRJRklFUgkJcnNhRW5jcnlwdGlvbg1LRVkJCQlSU0FQdWJsaWNLZXkNUEFSQU1TCQlU WVBFIE5VTEwgQVJFIGFic2VudA0tLSBQcml2YXRlIGtleSBmb3JtYXQgbm90IGluIHRoaXMg bW9kdWxlIC0tDUNFUlQtS0VZLVVTQUdFCXtkaWdpdGFsU2lnbmF0dXJlLCBjb250ZW50Q29t bWl0bWVudCwNCQkJa2V5RW5jaXBoZXJtZW50LCBkYXRhRW5jaXBoZXJtZW50LCBrZXlDZXJ0 U2lnbiwgY1JMU2lnbn0NfQ1SU0FQdWJsaWNLZXkgOjo9IFNFUVVFTkNFIHsNbW9kdWx1cwkJ SU5URUdFUiwJLS0gbg1wdWJsaWNFeHBvbmVudAlJTlRFR0VSCS0tIGUNfQ1SZWNpcGllbnRJ ZGVudGlmaWVyIDo6PSBDSE9JQ0Ugew1pc3N1ZXJBbmRTZXJpYWxOdW1iZXIgSXNzdWVyQW5k U2VyaWFsTnVtYmVyLA0uLi4sDVtbMjogc3ViamVjdEtleUlkZW50aWZpZXIgWzBdIFN1Ympl Y3RLZXlJZGVudGlmaWVyIF1dIA19DUVuY3J5cHRlZEtleSA6Oj0gT0NURVQgU1RSSU5HDXZl cnNpb24gaXMgdGhlIHZlcnNpb24gbnVtYmVyLiBJdCB0aGUgcmlkIGNvbXBvbmVudCB1c2Vz IHRoZSBpc3N1ZXJBbmRTZXJpYWxOdW1iZXIgYWx0ZXJuYXRpdmUgb2YgUmVjaXBpZW50SWRl bnRpZmllciwgdGhlIHZlcnNpb24gc2hhbGwgYmUgdjAuIElmIHRoZSByaWQgY29tcG9uZW50 IHVzZXMgdGhlIHN1YmplY3RLZXlJZGVudGlmaWVyIGFsdGVybmF0aXZlIG9mIFJlY2lwaWVu dElkZW50aWZpZXIsIHRoZSB2ZXJzaW9uIHNoYWxsIGJlIHYyLg1yaWQgaWRlbnRpZmllcyB0 aGUgY2VydGlmaWNhdGUgY29udGFpbmluZyB0aGUgcmVjaXBpZW50knMgcHVibGljIGtleS4g VGhlIGlkZW50aWZpY2F0aW9uIGNhbiB1c2UgZWl0aGVyIHRoZSBpc3N1ZXKScyBkaXN0aW5n dWlzaGVkIG5hbWUgYW5kIHRoZSBpc3N1ZXIgbnVtYmVyIG9yIGEgc3ViamVjdCBrZXkgaWRl bnRpZmllci4gSWYgdGhlIGNlcnRpZmljYXRlIGlzIGFuIFguNTA5IGNlcnRpZmljYXRlIGNv bnRhaW5pbmcgYSBrZXlVc2FnZSBleHRlbnNpb24gKHNlZSBSZWMuIElUVS1UIFguNTA5IHwg SVNPL0lFQyA5NTk0LTgpLCB0aGUga2V5RW5jaXBoZXJtZW50IGJpdCBzaGFsbCBiZSBzZXQu IElmIHRoZSBjZXJ0aWZpY2F0ZSBpcyBhbiBYLjUwOSBjZXJ0aWZpY2F0ZSBhbmQgc3ViamVj dEtleUlkZW50aWZpZXIgYWx0ZXJuYXRpdmUgaXMgdXNlZCB0aGlzIHN1YmplY3Qga2V5IGlk ZW50aWZpZXIgc2hhbGwgbWF0Y2ggdGhlIHN1YmplY3RLZXlJZGVudGlmaWVyIGV4dGVuc2lv biB2YWx1ZSBvZiB0aGUgY2VydGlmaWNhdGUuIEZvciBvdGhlciBjZXJ0aWZpY2F0ZSBmb3Jt YXRzLCB0aGUgc3BlY2lmaWNhdGlvbiBvZiB0aGUgY2VydGlmaWNhdGUgZm9ybWF0IG11c3Qg Y29udGFpbiBydWxlcyBmb3IgbWF0Y2hpbmcgdGhlIGtleSBpZGVudGlmaWVyIHRvIGEgZmll bGQgb2YgdGhlIGFwcHJvcHJpYXRlIGNlcnRpZmljYXRlIGZpZWxkLiBBIHJlY2lwaWVudCBz aGFsbCBzdXBwb3J0IGJvdGggYWx0ZXJuYXRpdmVzIG9mIFJlY2lwaWVudElkZW50aWZpZXIu IEEgc2VuZGVyIHNoYWxsIHN1cHBvcnQgYXQgbGVhc3Qgb25lIG9mIHRoZW0uDWtleUVuY3J5 cHRpb25BbGdvcml0aG0gaWRlbnRpZmllcyB0aGUga2V5LWVuY3J5cHRpb24gYWxnb3JpdGht IGFuZCBpdHMgcGFyYW1ldGVycyAoaWYgYW55KSB1c2VkIHRvIGVuY3J5cHQgdGhlIGVuY3J5 cHRpb24ta2V5IG9mIHRoZSByZWNpcGllbnQuIFRoZSBlbmNyeXB0aW9uIHByb2Nlc3MgaXMg ZGVzY3JpYmVkIGluICgTIFJFRiBfUmVmMzk1NjEzMjExIFxyIFxoIAEgXCogTUVSR0VGT1JN QVQgFDkuMxUpLg1lbmNyeXB0ZWRLZXkgaXMgYW4gb2N0ZXQgc3RyaW5nIGNvbnRhaW5pbmcg dGhlIGVuY3J5cHRlZCBrZXkuDQ1UaGUgS2V5QWdyZWVSZWNpcGllbnRJbmZvIHR5cGUNVGhp cyB0eXBlIGlzIHVzZWQgYnkgdGhlIGtleSBhZ3JlZW1lbnQgdGVjaG5pcXVlLiBBIEtleUFn cmVlUmVjaXBpZW50SW5mbyBpbnN0YW5jZSB0cmFuc2ZlcnMgdGhlIGNvbnRlbnQgZW5jcnlw dGlvbiBrZXkgdG8gdGhlIHJlY2lwaWVudHMgdXNpbmcgdGhlIHNhbWUgYWxnb3JpdGhtIGFu ZCBkb21haW4gcGFyYW1ldGVycy4NS2V5QWdyZWVSZWNpcGllbnRJbmZvIDo6PSBTRVFVRU5D RSB7DXZlcnNpb24gCQkJQ01TVmVyc2lvbiwgIC0tIGFsd2F5cyBzZXQgdG8gMw1vcmlnaW5h dG9yIAkJCVswXSBFWFBMSUNJVCBPcmlnaW5hdG9ySWRlbnRpZmllck9yS2V5LA11a20gCQkJ CQlbMV0gRVhQTElDSVQgVXNlcktleWluZ01hdGVyaWFsIE9QVElPTkFMLA1rZXlFbmNyeXB0 aW9uQWxnb3JpdGhtIAlBbGdvcml0aG1JZGVudGlmaWVyDQkJCQl7S0VZLUFHUkVFLCB7S2V5 QWdyZWVtZW50QWxnb3JpdGhtU2V0fX0sDXJlY2lwaWVudEVuY3J5cHRlZEtleXMgCVJlY2lw aWVudEVuY3J5cHRlZEtleXMgDX0NVGhlIGFsZ29yaXRobXMgYXJlIGRlZmluZWQgYXMgb2Jq ZWN0IG9mIEtFWS1BR1JFRSBpbmZvcm1hdGlvbiBvYmplY3QgY2xhc3MuDUtFWS1BR1JFRSA6 Oj0gQ0xBU1Mgew0maWQJCQlPQkpFQ1QgSURFTlRJRklFUiBVTklRVUUsDSZQYXJhbXMJCU9Q VElPTkFMLA0mcGFyYW1QcmVzZW5jZQlQYXJhbU9wdGlvbnMgREVGQVVMVCBhYnNlbnQsDSZQ dWJsaWNLZXlTZXQJUFVCTElDLUtFWSBPUFRJT05BTCwNJlVrbQkJCU9QVElPTkFMLA0mdWtt UHJlc2VuY2UJUGFyYW1PcHRpb25zIERFRkFVTFQgYWJzZW50LA0mc21pbWVDYXBzCQlTTUlN RS1DQVBTIE9QVElPTkFMDX0gDVdJVEggU1lOVEFYIHsNSURFTlRJRklFUiAJCSZpZA1bUEFS QU1TIAkJW1RZUEUgJlBhcmFtc10gQVJFICZwYXJhbVByZXNlbmNlXQ1bUFVCTElDLUtFWVMJ JlB1YmxpY0tleVNldF0NW1VLTSBbVFlQRSAmVWttXSBBUkUgJnVrbVByZXNlbmNlXQ1bU01J TUUtQ0FQUyAmc21pbWVDYXBzXQ19DUtleUFncmVlbWVudEFsZ29yaXRobVNldCBLRVktQUdS RUUgOjo9IHsgS2V5QWdyZWVtZW50QWxncywgLi4uIH0NQ3VycmVudGx5IHR3byBhbGdvcml0 aG1zIGFyZSBkZWZpbmVkIGthYS1lc2RoIGFuZCBrYWEtc3NkaC4NS2V5QWdyZWVtZW50QWxn cyBLRVktQUdSRUUgOjo9IHsga2FhLWVzZGggfCBrYWEtc3NkaCwgLi4ufQ1rYWEtZXNkaCAJ S0VZLUFHUkVFIDo6PSB7DUlERU5USUZJRVIgCQlpZC1hbGctRVNESA1QQVJBTVMgCQlUWVBF IEtleVdyYXBBbGdvcml0aG0gQVJFIHJlcXVpcmVkDVBVQkxJQy1LRVlTIAl7IHBrLWRoIH0N LS0gVUtNIGlzIG5vdCBBU04uMSBlbmNvZGVkDVVLTSAJCQlBUkUgb3B0aW9uYWwNU01JTUUt Q0FQUyAJCXtUWVBFIEtleVdyYXBBbGdvcml0aG0gSURFTlRJRklFRCBCWSBpZC1hbGctRVNE SH0NfQ1LZXlXcmFwQWxnb3JpdGhtIDo6PSBBbGdvcml0aG1JZGVudGlmaWVyIHtLRVktV1JB UCwge0tleVdyYXBBbGdzIH19DUtFWS1XUkFQIDo6PSBDTEFTUyB7DSZpZAkJCU9CSkVDVCBJ REVOVElGSUVSIFVOSVFVRSwNJlBhcmFtcwkJT1BUSU9OQUwsDSZwYXJhbVByZXNlbmNlCVBh cmFtT3B0aW9ucyBERUZBVUxUIGFic2VudCwNJnNtaW1lQ2FwcwkJU01JTUUtQ0FQUyBPUFRJ T05BTA19IA1XSVRIIFNZTlRBWCB7DUlERU5USUZJRVIgCQkmaWQNW1BBUkFNUyAJCVtUWVBF ICZQYXJhbXNdIEFSRSAmcGFyYW1QcmVzZW5jZV0NW1NNSU1FLUNBUFMgCSZzbWltZUNhcHNd DX0NaWQtYWxnLUVTREggT0JKRUNUIElERU5USUZJRVIgOjo9IHsgaXNvKDEpIG1lbWJlci1i b2R5KDIpIHVzKDg0MCkNcnNhZHNpKDExMzU0OSkgcGtjcygxKSBwa2NzLTkoOSkgc21pbWUo MTYpIGFsZygzKSA1IH0Na2FhLXNzZGggS0VZLUFHUkVFIDo6PSB7DUlERU5USUZJRVIgCQlp ZC1hbGctU1NESA1QQVJBTVMgCQlUWVBFIEtleVdyYXBBbGdvcml0aG0gQVJFIHJlcXVpcmVk DVBVQkxJQy1LRVlTIAl7cGstZGh9DS0tIFVLTSBpcyBub3QgQVNOLjEgZW5jb2RlZA1VS00g CQkJQVJFIG9wdGlvbmFsDVNNSU1FLUNBUFMgCQl7VFlQRSBLZXlXcmFwQWxnb3JpdGhtIElE RU5USUZJRUQgQlkgaWQtYWxnLVNTREh9DX0NaWQtYWxnLVNTREggT0JKRUNUIElERU5USUZJ RVIgOjo9IHsgaXNvKDEpIG1lbWJlci1ib2R5KDIpIHVzKDg0MCkNcnNhZHNpKDExMzU0OSkg cGtjcygxKSBwa2NzLTkoOSkgc21pbWUoMTYpIGFsZygzKSAxMCB9DU9yaWdpbmF0b3JJZGVu dGlmaWVyT3JLZXkgOjo9IENIT0lDRSB7DWlzc3VlckFuZFNlcmlhbE51bWJlciBJc3N1ZXJB bmRTZXJpYWxOdW1iZXIsDXN1YmplY3RLZXlJZGVudGlmaWVyIFswXSBTdWJqZWN0S2V5SWRl bnRpZmllciwNb3JpZ2luYXRvcktleSBbMV0gT3JpZ2luYXRvclB1YmxpY0tleSANfQ1Pcmln aW5hdG9yUHVibGljS2V5IDo6PSBTRVFVRU5DRSB7DWFsZ29yaXRobSBBbGdvcml0aG1JZGVu dGlmaWVyIHtQVUJMSUMtS0VZLCB7T3JpZ2luYXRvcktleVNldH19LA1wdWJsaWNLZXkgQklU IFNUUklORyANfQ1PcmlnaW5hdG9yS2V5U2V0IFBVQkxJQy1LRVkgOjo9IHsgS2V5QWdyZWVQ dWJsaWNLZXlzLCAuLi4gfQ1LZXlBZ3JlZVB1YmxpY0tleXMgUFVCTElDLUtFWSA6Oj0geyBw ay1kaCwgLi4ufQ1way1kaCBQVUJMSUMtS0VZIDo6PSB7DUlERU5USUZJRVIJCWRocHVibGlj bnVtYmVyDUtFWQkJCURIUHVibGljS2V5DVBBUkFNUwkJVFlQRSBEb21haW5QYXJhbWV0ZXJz IEFSRSBpbmhlcml0YWJsZQ0tLSBQcml2YXRlIGtleSBmb3JtYXQgbm90IGluIHRoaXMgbW9k dWxlIC0tDUNFUlQtS0VZLVVTQUdFCXtrZXlBZ3JlZW1lbnQsIGVuY2lwaGVyT25seSwgZGVj aXBoZXJPbmx5IH0NfQ1kaHB1YmxpY251bWJlciBPQkpFQ1QgSURFTlRJRklFUiA6Oj0gew1p c28oMSkgbWVtYmVyLWJvZHkoMikgdXMoODQwKSBhbnNpLXg5NDIoMTAwNDYpIG51bWJlci10 eXBlKDIpIDEgfQ1ESFB1YmxpY0tleSA6Oj0gSU5URUdFUiAgLS0gcHVibGljIGtleSwgeSA9 IGdeeCBtb2QgcA1Eb21haW5QYXJhbWV0ZXJzIDo6PSBTRVFVRU5DRSB7DXAJCQlJTlRFR0VS LAkJLS0gb2RkIHByaW1lLCBwPWpxICsxDWcJCQlJTlRFR0VSLAkJLS0gZ2VuZXJhdG9yLCBn DXEJCQlJTlRFR0VSLAkJLS0gZmFjdG9yIG9mIHAtMQ1qCQkJSU5URUdFUiBPUFRJT05BTCwJ LS0gc3ViZ3JvdXAgZmFjdG9yLCBqPj0gMg12YWxpZGF0aW9uUGFyYW1zCVZhbGlkYXRpb25Q YXJhbXMgT1BUSU9OQUwNfQ1WYWxpZGF0aW9uUGFyYW1zIDo6PSBTRVFVRU5DRSB7DVNlZWQJ CQlCSVQgU1RSSU5HLA1wZ2VuQ291bnRlcgkJSU5URUdFUg19DVVzZXJLZXlpbmdNYXRlcmlh bCA6Oj0gT0NURVQgU1RSSU5HDVJlY2lwaWVudEVuY3J5cHRlZEtleXMgOjo9IFNFUVVFTkNF IE9GIFJlY2lwaWVudEVuY3J5cHRlZEtleQ0NUmVjaXBpZW50RW5jcnlwdGVkS2V5IDo6PSBT RVFVRU5DRSB7DXJpZCAJCQlLZXlBZ3JlZVJlY2lwaWVudElkZW50aWZpZXIsDWVuY3J5cHRl ZEtleSAJRW5jcnlwdGVkS2V5IA19DUtleUFncmVlUmVjaXBpZW50SWRlbnRpZmllciA6Oj0g Q0hPSUNFIHsNaXNzdWVyQW5kU2VyaWFsTnVtYmVyIElzc3VlckFuZFNlcmlhbE51bWJlciwN cktleUlkIFswXSBJTVBMSUNJVCBSZWNpcGllbnRLZXlJZGVudGlmaWVyIA19DVJlY2lwaWVu dEtleUlkZW50aWZpZXIgOjo9IFNFUVVFTkNFIHsNc3ViamVjdEtleUlkZW50aWZpZXIgU3Vi amVjdEtleUlkZW50aWZpZXIsDWRhdGUgR2VuZXJhbGl6ZWRUaW1lIE9QVElPTkFMLA1vdGhl ciBPdGhlcktleUF0dHJpYnV0ZSBPUFRJT05BTCANfQ1TdWJqZWN0S2V5SWRlbnRpZmllciA6 Oj0gT0NURVQgU1RSSU5HDUtFWS1BVFRSSUJVVEUgOjo9IFRZUEUtSURFTlRJRklFUg1PdGhl cktleUF0dHJpYnV0ZSA6Oj0gU0VRVUVOQ0Ugew1rZXlBdHRySWQgIEtFWS1BVFRSSUJVVEUu JmlkKHtTdXBwb3J0ZWRLZXlBdHRyaWJ1dGVzfSksDWtleUF0dHIgICAgS0VZLUFUVFJJQlVU RS4mVHlwZSh7U3VwcG9ydGVkS2V5QXR0cmlidXRlc317QGtleUF0dHJJZH0pDX0NU3VwcG9y dGVkS2V5QXR0cmlidXRlcyBLRVktQVRUUklCVVRFIDo6PSB7IC4uLiB9DXZlcnNpb24gbnVt YmVyIHNoYWxsIGJlIGVxdWFsIHRvIHYzLg1vcmlnaW5hdG9yIGlkZW50aWZpZXMgdGhlIHB1 YmxpYyBrZXkgb2YgdGhlIHNlbmRlci4gVGhpcyBrZXkgY2FuIGJlIHNwZWNpZmllZCBieSBv bmUgb2YgdGhlIHRocmVlIGZvbGxvd2luZyBtZXRob2RzOg1pc3N1ZXJBbmRTZXJpYWxOdW1i ZXI6IHRoZSBjZXJ0aWZpY2F0ZSBjb250YWluaW5nIHRoZSBwdWJsaWMga2V5IGlzIGlkZW50 aWZpZWQgYnkgaXRzIGlzc3VlciBhbmQgaXRzIHNlcmlhbE51bWJlcjsNc3ViamVjdEtleUlk ZW50aWZpZXI6ICB0aGUgY2VydGlmaWNhdGUgY29udGFpbmluZyB0aGUgcHVibGljIGtleSBp cyBpZGVudGlmaWVkIGJ5IGEga2V5IGlkZW50aWZpZXIuICBGb3IgYW4gWC41MDkgY2VydGlm aWNhdGUsIHRoZSBrZXkgaWRlbnRpZmllciBzaGFsbCBtYXRjaCB0aGUgc3ViamVjdEtleUlk ZW50aWZpZXIgZXh0ZW5zaW9uIHZhbHVlIG9mIHRoZSBjZXJ0aWZpY2F0ZS4gRm9yIG90aGVy IGNlcnRpZmljYXRlIGZvcm1hdHMsIHRoZSBzcGVjaWZpY2F0aW9uIG9mIHRoZSBjZXJ0aWZp Y2F0ZSBmb3JtYXQgbXVzdCBjb250YWluIHJ1bGVzIGZvciBtYXRjaGluZyB0aGUga2V5IGlk ZW50aWZpZXIgdG8gYSBmaWVsZCBvZiB0aGUgYXBwcm9wcmlhdGUgY2VydGlmaWNhdGUgZmll bGQuDW9yaWdpbmF0b3JLZXk6IHRoZSBwdWJsaWMta2V5IGlzIGRlZmluZWQgYnkgdGhlIGFs Z29yaXRobSB3aXRoIGl0cyBwYXJhbWV0ZXJzIGlmIGFueSBhbmQgdGhlIHZhbHVlIGFzIGEg Yml0IHN0cmluZy4NCQlBbiBpbXBsZW1lbnRhdGlvbiBzaGFsbCBzdXBwb3J0IHRoZXNlIHRo cmVlIGFsdGVybmF0aXZlcy4NdWttICh1c2VyIGtleWluZyBtYXRlcmlhbCkgaXMgYW4gb3B0 aW9uYWwgb2N0ZXQgc3RyaW5nIHdoaWNoIGVuc3VyZSB0aGF0IGEgZGlmZmVyZW50IGtleSBp cyBnZW5lcmF0ZWQgZWFjaCB0aW1lIHRoZSBzYW1lIHR3byBwYXJ0aWVzIGdlbmVyYXRlIGFu IGVuY3J5cHRpb24ga2V5LiBJbXBsZW1lbnRhdGlvbnMgbXVzdCBhY2NlcHQgdGhlIHVrbSBj b21wb25lbnQgZXZlbiB0aGV5IGRvIG5vdCBzdXBwb3J0IGtleSBhZ3JlZW1lbnQgYWxnb3Jp dGhtcy4Na2V5RW5jcnlwdGlvbkFsZ29yaXRobSBpZGVudGlmaWVzIHRoZSBrZXkgZW5jcnlw dGlvbiBhbGdvcml0aG0gYW5kIGl0cyBwYXJhbWV0ZXJzIChpZiBhbnkpLiBUaGUga2V5IGVu Y3J5cHRpb24gcHJvY2VzcyBpcyBkZXNjcmliZWQgaW4gY2xhdXNlIBMgUkVGIF9SZWYzOTU2 MTU1MzEgXHIgXGggARQ5LjQVLg1yZWNpcGllbnRFbmNyeXB0ZWRLZXlzIGNvbnRhaW5zIHBl ciByZWNpcGllbnQgdGhlIGlkZW50aWZpY2F0aW9uIG9mIHRoZSByZWNpcGllbnSScyBjZXJ0 aWZpY2F0ZSAocmlkIGNvbXBvbmVudCkgYW5kIHRoZSBlbmNyeXB0ZWQga2V5IChlbmNyeXB0 ZWRLZXkgY29tcG9uZW50KS4gQSByZWNpcGllbnQgaXMgaWRlbnRpZmllZCBieSBvbmUgb2Yg dGhlIHR3byBmb2xsb3dpbmcgbWV0aG9kczoNaXNzdWVyQW5kU2VyaWFsTnVtYmVyOiB0aGUg Y2VydGlmaWNhdGUgY29udGFpbmluZyB0aGUgYWdyZWVtZW50IHB1YmxpYyBrZXkgaXMgaWRl bnRpZmllZCBieSBpdHMgaXNzdWVyIGl0cyBzZXJpYWwgbnVtYmVyLiBJZiB0aGUgY2VydGlm aWNhdGUgaXMgYSB2ZXJzaW9uIDMgWC41MDkgY2VydGlmaWNhdGUgY29udGFpbmluZyBhIGtl eSB1c2FnZSBleHRlbnNpb24sIHRoZSBrZXlBZ3JlZW1lbnQgYml0IHNoYWxsIGJlIHNldC4N cktleUlkOiB0aGUgY2VydGlmaWNhdGUgY29udGFpbmluZyB0aGUgcHVibGljIGtleSBpcyBp ZGVudGlmaWVkIGJ5IGEga2V5IGlkZW50aWZpZXIgKHN1YmplY3RLZXlJZGVudGlmaWVyIGNv bXBvbmVudCkuICBGb3IgYW4gWC41MDkgY2VydGlmaWNhdGUsIHRoZSBrZXkgaWRlbnRpZmll ciBzaGFsbCBtYXRjaCB0aGUgc3ViamVjdEtleUlkZW50aWZpZXIgZXh0ZW5zaW9uIHZhbHVl IG9mIHRoZSBjZXJ0aWZpY2F0ZS4gRm9yIG90aGVyIGNlcnRpZmljYXRlIGZvcm1hdHMsIHRo ZSBzcGVjaWZpY2F0aW9uIG9mIHRoZSBjZXJ0aWZpY2F0ZSBmb3JtYXQgbXVzdCBjb250YWlu IHJ1bGVzIGZvciBtYXRjaGluZyB0aGUga2V5IGlkZW50aWZpZXIgdG8gYSBmaWVsZCBvZiB0 aGUgYXBwcm9wcmlhdGUgY2VydGlmaWNhdGUgZmllbGQuIFRoZSBkYXRlIG9wdGlvbmFsIGNv bXBvbmVudCBpcyB1c2VkIHRvIHNwZWNpZnkgd2hpY2ggb2YgdGhlIHByZXZpb3VzbHkgZGlz dHJpYnV0ZWQgdXNlciBrZXlpbmcgbWF0ZXJpYWwgb2YgdGhlIHJlY2lwaWVudCB3YXMgdXNl ZCBieSB0aGUgc2VuZGVyIHRvIGdlbmVyYXRlIHRoZSBrZXkuIFRoaXMgZmllbGQgY2FuIGJl IGNvbXBsZXRlZCBieSB0aGUgb3B0aW9uYWwgb3RoZXIgY29tcG9uZW50IHdoaWNoIGNhbiBj b250YWluIGFueSBraW5kIG9mIHZhbHVlLg1UaGUgS0VLUmVjaXBpZW50SW5mbyB0eXBlDVRo ZSBLRUtSZWNpcGllbnRJbmZvIHR5cGUgaXMgdXNlZCBieSB0aGUgcHJldmlvdXNseSBkaXN0 cmlidXRlZCBzeW1tZXRyaWMga2V5IHRlY2huaXF1ZS4gQW4gaW5zdGFuY2Ugb2YgdGhpcyB0 eXBlIHRyYW5zZmVyIHRoZSBjb250ZW50IGVuY3J5cHRpb24ga2V5IHRvIHRoZSByZWNpcGll bnRzIHdobyBoYXZlIHRoZSBwcmV2aW91c2x5IGRpc3RyaWJ1dGVkIHN5bW1ldHJpYyBrZXku DUtFS1JlY2lwaWVudEluZm8gOjo9IFNFUVVFTkNFIHsNdmVyc2lvbiBDTVNWZXJzaW9uLCAg LS0gYWx3YXlzIHNldCB0byA0DWtla2lkIEtFS0lkZW50aWZpZXIsDWtleUVuY3J5cHRpb25B bGdvcml0aG0gS2V5RW5jcnlwdGlvbkFsZ29yaXRobUlkZW50aWZpZXIsDWVuY3J5cHRlZEtl eSBFbmNyeXB0ZWRLZXkgDX0NS0VLSWRlbnRpZmllciA6Oj0gU0VRVUVOQ0Ugew1rZXlJZGVu dGlmaWVyIE9DVEVUIFNUUklORywNZGF0ZSBHZW5lcmFsaXplZFRpbWUgT1BUSU9OQUwsDW90 aGVyIE90aGVyS2V5QXR0cmlidXRlIE9QVElPTkFMIA19DUtleUVuY3J5cHRpb25BbGdvcml0 aG1JZGVudGlmaWVyIDo6PSBBbGdvcml0aG1JZGVudGlmaWVyDXtLRVktV1JBUCwge0tleUVu Y3J5cHRpb25BbGdvcml0aG1TZXR9fQ1LZXlFbmNyeXB0aW9uQWxnb3JpdGhtU2V0IEtFWS1X UkFQIDo6PSB7IEtleVdyYXBBbGdzLCAuLi4gfQ1LZXlXcmFwQWxncyBLRVktV1JBUCA6Oj0g eyBrd2EtM0RFU1dyYXAgfCBrd2EtUkMyV3JhcCwgLi4uIH0Na3dhLTNERVNXcmFwIEtFWS1X UkFQIDo6PSB7DUlERU5USUZJRVIJCWlkLWFsZy1DTVMzREVTd3JhcA1QQVJBTVMgCQlUWVBF IE5VTEwgQVJFIHJlcXVpcmVkDVNNSU1FLUNBUFMJCXtJREVOVElGSUVEIEJZIGlkLWFsZy1D TVMzREVTd3JhcH0NfQ1pZC1hbGctQ01TM0RFU3dyYXAgT0JKRUNUIElERU5USUZJRVIgOjo9 IHsgaXNvKDEpIG1lbWJlci1ib2R5KDIpDXVzKDg0MCkgcnNhZHNpKDExMzU0OSkgcGtjcygx KSBwa2NzLTkoOSkgc21pbWUoMTYpIGFsZygzKSA2IH0Na3dhLVJDMldyYXAgS0VZLVdSQVAg Ojo9IHsNSURFTlRJRklFUiAJCWlkLWFsZy1DTVNSQzJ3cmFwDVBBUkFNUyAJCVRZUEUgUkMy d3JhcFBhcmFtZXRlciBBUkUgcmVxdWlyZWQNU01JTUUtQ0FQUyAJCXsgSURFTlRJRklFRCBC WSBpZC1hbGctQ01TUkMyd3JhcCB9DX0NaWQtYWxnLUNNU1JDMndyYXAgT0JKRUNUIElERU5U SUZJRVIgOjo9IHsgaXNvKDEpIG1lbWJlci1ib2R5KDIpDXVzKDg0MCkgcnNhZHNpKDExMzU0 OSkgcGtjcygxKSBwa2NzLTkoOSkgc21pbWUoMTYpIGFsZygzKSA3IH0NUkMyd3JhcFBhcmFt ZXRlciA6Oj0gUkMyUGFyYW1ldGVyVmVyc2lvbg1SQzJQYXJhbWV0ZXJWZXJzaW9uIDo6PSBJ TlRFR0VSDXZlcnNpb24gbnVtYmVyIHNoYWxsIGJlIGVxdWFsIHRvIHY0Ow1rZWtpZCBpZGVu dGlmaWVzIHRoZSBwcmV2aW91c2x5IGRpc3RyaWJ1dGVkIHN5bW1ldHJpYyBrZXkgdG8gdGhl IHNlbmRlciBhbmQgb25lIG9yIG1vcmUgcmVjaXBpZW50cyBieSB0aGUgY29tcG9uZW50cyBv ZiB0aGUgS0VLSWRlbnRpZmllciB0eXBlOiBhbiBvY3RldCBzdHJpbmcgKGtleUlkZW50aWZp ZXIgY29tcG9uZW50KSBvcHRpb25hbGx5IGNvbXBsZXRlZCBieSB0aGUgZGF0ZSAoZGF0ZSBj b21wb25lbnQpIGFuZCBhbm90aGVyIGluZm9ybWF0aW9uIChvdGhlciBjb21wb25lbnQpIHRv IGlkZW50aWZ5IGEgdW5pcXVlIGtleSBhbW9uZyB0aGUgcHJldmlvdXNseSBkaXN0cmlidXRl ZCBrZXlzLiBUaGUgb3RoZXIgY29tcG9uZW50IGNhbiBjb250YWluIGFueSBraW5kIG9mIHZh bHVlLg1UaGUgUGFzc3dvcmRSZWNpcGllbnRJbmZvIHR5cGUNVGhlIFBhc3N3b3JkUmVjaXBp ZW50SW5mbyBpcyB1c2VkIHdoZW4gdGhlIHNlbmRlciBhbmQgdGhlIHJlY2lwaWVudCBzaGFy ZSBhIHBhc3N3b3JkIChzaGFyZWQgc2VjcmV0KS4gQW4gaW5zdGFuY2Ugb2YgUGFzc3dvcmRS ZWNpcGllbnRJbmZvIHRyYW5zZmVyIHRoZSBjb250ZW50IGVuY3J5cHRpb24ga2V5IHRvIHRo ZSByZWNpcGllbnRzIHdobyBrbm93IHRoZSBwYXNzd29yZC4NUGFzc3dvcmRSZWNpcGllbnRJ bmZvIDo6PSBTRVFVRU5DRSB7DXZlcnNpb24gQ01TVmVyc2lvbiwgICAtLSBhbHdheXMgc2V0 IHRvIDANa2V5RGVyaXZhdGlvbkFsZ29yaXRobSBbMF0gS2V5RGVyaXZhdGlvbkFsZ29yaXRo bUlkZW50aWZpZXINT1BUSU9OQUwsDWtleUVuY3J5cHRpb25BbGdvcml0aG0gS2V5RW5jcnlw dGlvbkFsZ29yaXRobUlkZW50aWZpZXIsDWVuY3J5cHRlZEtleSBFbmNyeXB0ZWRLZXkgDX0N S2V5RGVyaXZhdGlvbkFsZ29yaXRobUlkZW50aWZpZXIgOjo9IEFsZ29yaXRobUlkZW50aWZp ZXINe0tFWS1ERVJJVkFUSU9OLCB7S2V5RGVyaXZhdGlvbkFsZ3MsIC4uLn19DUtleURlcml2 YXRpb25BbGdzIEtFWS1ERVJJVkFUSU9OIDo6PSB7IGtkYS1QQktERjIsIC4uLiB9DWtkYS1Q QktERjIgS0VZLURFUklWQVRJT04gOjo9IHsNSURFTlRJRklFUiAJaWQtUEJLREYyDVBBUkFN UyAJVFlQRSBQQktERjItcGFyYW1zIEFSRSByZXF1aXJlZA0tLSBObyBTL01JTUUgY2FwcyBk ZWZpbmVkDX0NaWQtUEJLREYyIE9CSkVDVCBJREVOVElGSUVSIDo6PSB7IGlzbygxKSBtZW1i ZXItYm9keSgyKSB1cyg4NDApDXJzYWRzaSgxMTM1NDkpIHBrY3MoMSkgcGtjcy01KDUpIDEy IH0NUEJLREYyLXBhcmFtcyA6Oj0gU0VRVUVOQ0Ugew1zYWx0CQlDSE9JQ0Ugew0JCXNwZWNp ZmllZAkJT0NURVQgU1RSSU5HLA0JCW90aGVyU291cmNlCQlQQktERjItU2FsdFNvdXJjZXNB bGdvcml0aG1JZGVudGlmaWVyIH0sDWl0ZXJhdGlvbkNvdW50CUlOVEVHRVIgKDEuLk1BWCks DWtleUxlbmd0aAkJSU5URUdFUiAoMS4uTUFYKSBPUFRJT05BTCwNcHJmCQkJUEJLREYyLVBS RnNBbGdvcml0aG1JZGVudGlmaWVyIERFRkFVTFQgZGVmYXVsdFBCS0RGMg19DUFMR09SSVRI TSA6Oj0gQ0xBU1Mgew0maWQgCQkJT0JKRUNUIElERU5USUZJRVIgVU5JUVVFLA0mUGFyYW1z CQlPUFRJT05BTCwNJnBhcmFtUHJlc2VuY2UJUGFyYW1PcHRpb25zIERFRkFVTFQgYWJzZW50 LA0mc21pbWVDYXBzCQlTTUlNRS1DQVBTIE9QVElPTkFMDX0gDVdJVEggU1lOVEFYIHsNSURF TlRJRklFUgkJJmlkDVtQQVJBTVMJCVtUWVBFICZQYXJhbXNdIEFSRSAmcGFyYW1QcmVzZW5j ZV0NW1NNSU1FLUNBUFMJCSZzbWltZUNhcHNdDX0NUEJLREYyLVNhbHRTb3VyY2VzQWxnb3Jp dGhtSWRlbnRpZmllciA6Oj0NQWxnb3JpdGhtSWRlbnRpZmllciB7QUxHT1JJVEhNLCB7UEJL REYyLVNhbHRTb3VyY2VzfX0NUEJLREYyLVNhbHRTb3VyY2VzIEFMR09SSVRITSA6Oj0geyAu Li4gfQ1QQktERjItUFJGc0FsZ29yaXRobUlkZW50aWZpZXIgOjo9IEFsZ29yaXRobUlkZW50 aWZpZXJ7IEFMR09SSVRITSx7UEJLREYyLVBSRnN9IH0NUEJLREYyLVBSRnMgQUxHT1JJVEhN IDo6PSB7Li4uIH0NQUxHT1JJVEhNIDo6PSBDTEFTUyB7DSZpZCAJCQlPQkpFQ1QgSURFTlRJ RklFUiBVTklRVUUsDSZQYXJhbXMJCU9QVElPTkFMLA0mcGFyYW1QcmVzZW5jZQlQYXJhbU9w dGlvbnMgREVGQVVMVCBhYnNlbnQsDSZzbWltZUNhcHMJCVNNSU1FLUNBUFMgT1BUSU9OQUwN fSANV0lUSCBTWU5UQVggew1JREVOVElGSUVSCQkmaWQNW1BBUkFNUwkJW1RZUEUgJlBhcmFt c10gQVJFICZwYXJhbVByZXNlbmNlXQ1bU01JTUUtQ0FQUwkJJnNtaW1lQ2Fwc10NfQ1LRVkt REVSSVZBVElPTiA6Oj0gQ0xBU1Mgew0maWQJCQlPQkpFQ1QgSURFTlRJRklFUiBVTklRVUUs DSZQYXJhbXMJCU9QVElPTkFMLA0mcGFyYW1QcmVzZW5jZQlQYXJhbU9wdGlvbnMgREVGQVVM VCBhYnNlbnQsDSZzbWltZUNhcHMJCVNNSU1FLUNBUFMgT1BUSU9OQUwNfSANV0lUSCBTWU5U QVggew1JREVOVElGSUVSIAkJJmlkDVtQQVJBTVMgCQlbVFlQRSAmUGFyYW1zXSBBUkUgJnBh cmFtUHJlc2VuY2VdDVtTTUlNRS1DQVBTIAkmc21pbWVDYXBzXQ19DXZlcnNpb24gbnVtYmVy IHNoYWxsIGJlIGVxdWFsIHRvIHYwOw1rZXlEZXJpdmF0aW9uQWxnb3JpdGhtIGlkZW50aWZp ZXMgdGhlIGtleSBkZXJpdmF0aW9uIGFsZ29yaXRobSBhbmQgaXRzIHBhcmFtZXRlcnMgaWYg YW55LiBUaGlzIGNvbXBvbmVudCBjYW4gYmUgYWJzZW50IGlmIHRoZSBhbGdvcml0aG0gaXMg c3VwcGxpZWQgYnkgYW4gZXh0ZXJuYWwgc291cmNlIGxpa2UgaGFyZHdhcmUgZGV2aWNlcyAo dG9rZW4sIGV0Yyk7DWtleUVuY3J5cHRpb25BbGdvcml0aG0gaWRlbnRpZmllcyB0aGUgZW5j cnlwdGlvbiBhbGdvcml0aG0gYW5kIGl0cyBwYXJhbWV0ZXJzIGlmIGFueSB1c2VkIHRvIGVu Y3J5cHQgdGhlIGVuY3J5cHRpb24ga2V5Ow1lbmNyeXB0ZWRLZXkgY29udGFpbnMgdGhlIGVu Y3J5cHRlZCBlbmNyeXB0aW9uIGtleS4NVGhlIE90aGVyUmVjaXBpZW50SW5mbyB0eXBlDVRo ZSBPdGhlclJlY2lwaWVudEluZm8gdHlwZSBpcyB1c2VkIGZvciBhZGRpdGlvbmFsIGtleSBt YW5hZ2VtZW50IHRlY2huaXF1ZXMuIEFuIGluc3RhbmNlIG9mIE90aGVyUmVjaXBpZW50SW5m byBjb250YWlucyBhbiBvYmplY3QgaWRlbnRpZmllciB2YWx1ZSAob3JpVHlwZSBjb21wb25l bnQpIGlkZW50aWZ5aW5nIHRoZSB0ZWNobmlxdWUgYW5kIGEgdmFsdWUgKG9yaVZhbHVlIGNv bXBvbmVudCkuDU9USEVSLVJFQ0lQSUVOVCA6Oj0gVFlQRS1JREVOVElGSUVSDU90aGVyUmVj aXBpZW50SW5mbyA6Oj0gU0VRVUVOQ0Ugew1vcmlUeXBlICAgIE9USEVSLVJFQ0lQSUVOVC4m aWQoe1N1cHBvcnRlZE90aGVyUmVjaXBJbmZvfSksDW9yaVZhbHVlICAgT1RIRVItUkVDSVBJ RU5ULiZUeXBlKHtTdXBwb3J0ZWRPdGhlclJlY2lwSW5mb317QG9yaVR5cGV9KQ19DVN1cHBv cnRlZE90aGVyUmVjaXBJbmZvIE9USEVSLVJFQ0lQSUVOVCA6Oj0geyAuLi4gfQ1Db250ZW50 LWVuY3J5cHRpb24gcHJvY2Vzcw1UaGUgY29udGVudCBlbmNyeXB0aW9uIGtleSBpcyByYW5k b21seSBnZW5lcmF0ZWQgYnkgdGhlIHNlbmRlci4gSWYgdGhlIGVuY3J5cHRpb24gYWxnb3Jp dGhtIGFzc3VtZXMgdGhhdCB0aGUgZGF0YSB0byBiZSBlbmNyeXB0ZWQgaXMgYSBtdWx0aXBs ZSBvZiBzb21lIG51bWJlciAoc2F5IGspIG9mIG9jdGV0cywgdGhlIGNvbnRlbnQgc2hhbGwg YmUgcGFkZGVkIHRvIGEgbXVsdGlwbGUgb2YgayBvY3RldHMuIFRoZSBudW1iZXIgb2YgcGFk ZGluZyBvY3RldHMgaXMgYmV0d2VlbiAxICh3aGVuIHRoZSBsZW5ndGggb2YgdGhlIGNvbnRl bnQgaXMgYSBtdWx0aXBsZSBvZiBrIG1pbnVzIDEpIGFuZCBrICh3aGVuIHRoZSBsZW5ndGgg b2YgdGhlIGNvbnRlbnQgaXMgYSBtdWx0aXBsZSBvZiBrKS4gVGhlIGNvbnRlbnQgb2YgcGFk ZGluZyBvY3RldHMgc2hhbGwgYmUgZXF1YWwgdG8gdGhlIG51bWJlciBvZiBwYWRkaW5nIG9j dGV0cy4gVGhpcyBydWxlIGlzIGF2YWlsYWJsZSBmb3IgYWxnb3JpdGhtcyBmb3Igd2hpY2gg ayBpcyBsZXNzIHRoYW4gMjU2LiBUaGUgb3V0cHV0IG9mIHRoZSBjb250ZW50LWVuY3J5cHRp b24gcHJvY2VzcyBpcyBhbiBvY3RldCBzdHJpbmcgc3RvcmVkIGluIHRoZSBlbmNyeXB0ZWRD b250ZW50IGNvbXBvbmVudCBvZiB0aGUgRW5jcnlwdGVkQ29udGVudEluZm8gdHlwZS4NS2V5 LWVuY3J5cHRpb24gcHJvY2Vzcw1UaGUga2V5LWVuY3J5cHRpb24gcHJvY2VzcyBlbmNyeXB0 cyB0aGUgdmFsdWUgb2YgdGhlIGVuY3J5cHRpb24ga2V5LiBUaGUgcmVzdWx0IGlzIGFuIG9j dGV0IHN0cmluZyBzdG9yZWQgaW4gdGhlIGVuY3J5cHRlZCBjb21wb25lbnQgb2YgS2V5VHJh bnNSZWNpcGllbnRJbmZvLCBSZWNpcGllbnRFbmNyeXB0ZWRLZXksIEtFS1JlY2lwaWVudElu Zm8sIFBhc3N3b3JkUmVjaXBpZW50SW5mbyBvciBvdGhlciBBU04uMSB0eXBlIGRlZmluZWQg YnkgYW4gaW5mb3JtYXRpb24gb2JqZWN0IG9mIE9USEVSLVJFQ0lQSUVOVCBpbmZvcm1hdGlv biBvYmplY3QgY2xhc3MuDURpZ2VzdGVkIGRhdGENRGlnZXN0ZWQgZGF0YSBpcyB1c2VkIHRv IGFzc29jaWF0ZSBhIG1lc3NhZ2UgZGlnZXN0IHRvIGEgY29udGVudC4NVGhlIERpZ2VzdGVk RGF0YSB0eXBlDURpZ2VzdGVkRGF0YSA6Oj0gU0VRVUVOQ0Ugew12ZXJzaW9uIAkJQ01TVmVy c2lvbiwNZGlnZXN0QWxnb3JpdGhtIAlEaWdlc3RBbGdvcml0aG1JZGVudGlmaWVyLA1lbmNh cENvbnRlbnRJbmZvIAlFbmNhcHN1bGF0ZWRDb250ZW50SW5mbywNZGlnZXN0IAkJRGlnZXN0 LCAuLi4gDX0NRGlnZXN0IDo6PSBPQ1RFVCBTVFJJTkcNdmVyc2lvbiBpcyB0aGUgbnVtYmVy IHZlcnNpb24gd2hpY2ggc2hhbGwgYmUgZXF1YWwgdG8gdjAgaWYgY29udGVudCB0eXBlIGlz IGlkLWRhdGEgYW5kIGVxdWFsIHRvIHYyIGluIGFsbCBvdGhlciBjYXNlcy4NZGlnZXN0QWxn b3JpdGhtIGlkZW50aWZpZXMgdGhlIG1lc3NhZ2UgZGlnZXN0IGFsZ29yaXRobSBhbmQgaXRz IHBhcmFtZXRlcnMgaWYgYW55LiBUaGUgY29tcHV0YXRpb24gb2YgdGhlIG1lc3NhZ2UgZGln ZXN0IGlzIHRoZSBzYW1lIGFzIFNpZ25lZERhdGEgKHNlZSBjbGF1c2UgEyBSRUYgX1JlZjM5 NTYxNjIyOSBcciBcaCABFDgVKQ1lbmNhcENvbnRlbnRJbmZvIGlkZW50aWZpZXMgdGhlIGNv bnRlbnRUeXBlIGFuZCB0aGUgY29udGV4dCAoc2VlIGNsYXVzZSATIFJFRiBfUmVmMzk1NTkz MDE4IFxyIFxoIAEUOC4yFSkNZGlnZXN0IGlzIGFuIG9jdGV0IHN0cmluZyBjb250YWluaW5n IHRoZSBkaWdlc3Qgb2YgdGhlIG1lc3NhZ2UuDUVuY3J5cHRlZCBkYXRhDUVuY3J5cHRlZCBk YXRhIGlzIHVzZWQgdG8gdHJhbnNmZXIgYW4gZW5jcnlwdGVkIGNvbnRlbnQgd2hlbiB0aGUg Y29udGVudCBlbmNyeXB0aW9uIGtleSBpcyBwcm92aWRlZCBieSBtZWFucyBub3QgZGVmaW5l ZCBieSB0aGlzIFJlY29tbWVuZGF0aW9uIHwgSW50ZXJuYXRpb25hbCBTdGFuZGFyZC4gVGhp cyBtZXRob2QgY2FuIGJlIHVzZWQgZm9yIGxvY2FsIHN0b3JhZ2Ugd2hlbiB0aGUgZW5jcnlw dGlvbiBrZXkgaXMgZGVyaXZlZCBmcm9tIGEgcGFzc3dvcmQuDVRoZSBFbmNyeXB0ZWREYXRh IHR5cGUNRW5jcnlwdGVkRGF0YSA6Oj0gU0VRVUVOQ0Ugew12ZXJzaW9uIAkJCUNNU1ZlcnNp b24sDWVuY3J5cHRlZENvbnRlbnRJbmZvIAlFbmNyeXB0ZWRDb250ZW50SW5mbywNLi4uLA1b WzI6IHVucHJvdGVjdGVkQXR0cnMgCVsxXSBJTVBMSUNJVCBBdHRyaWJ1dGVzDXt7VW5wcm90 ZWN0ZWRBdHRyaWJ1dGVzfX0gT1BUSU9OQUwgXV0gDX0NdmVyc2lvbiBpcyB0aGUgdmVyc2lv biBudW1iZXIgd2hpY2ggc2hhbGwgYmUgZXF1YWwgdG8gdjAgaXMgdGhlIHVucHJvdGVjdGVk QXR0cnMgY29tcG9uZW50IGlzIGFic2VudCBhbmQgdjIgaWYgdW5wcm90ZWN0ZWRBdHRycyBj b21wb25lbnQgaXMgcHJlc2VudDsNZW5jcnlwdGVkQ29udGVudEluZm8gaXMgdGhlIGVuY3J5 cHRlZCBjb250ZW50IGFzIGRlZmluZWQgaW4gRW52ZWxvcGVkRGF0YSAoc2VlICBjbGF1c2Ug EyBSRUYgX1JlZjM5NTYxNjY1NiBcciBcaCABFDkVKS4NdW5wcm90ZWN0ZWRBdHRycyBpcyBh IG9wdGlvbmFsIGNvbGxlY3Rpb24gb2YgYXR0cmlidXRlcyB3aGljaCBhcmUgbm90IGVuY3J5 cHRlZC4NQXV0aGVudGljYXRlZCBkYXRhDUF1dGhlbnRpY2F0ZWQgZGF0YSBpcyB1c2VkIHRv IGFzc29jaWF0ZSBhIG1lc3NhZ2UgYXV0aGVudGljYXRpb24gY29kZSAoTUFDKSB0byBhbiBl bmNyeXB0ZWQgY29udGVudCB0cmFuc21pdCB0byBvbmUgb3IgbW9yZQ1UaGUgQXV0aGVudGlj YXRlZERhdGEgdHlwZQ1BdXRoZW50aWNhdGVkRGF0YSA6Oj0gU0VRVUVOQ0Ugew12ZXJzaW9u IAkJQ01TVmVyc2lvbiwNb3JpZ2luYXRvckluZm8gCVswXSBJTVBMSUNJVCBPcmlnaW5hdG9y SW5mbyBPUFRJT05BTCwNcmVjaXBpZW50SW5mb3MgCVJlY2lwaWVudEluZm9zLA1tYWNBbGdv cml0aG0gCU1lc3NhZ2VBdXRoZW50aWNhdGlvbkNvZGVBbGdvcml0aG0sDWRpZ2VzdEFsZ29y aXRobSAJWzFdIERpZ2VzdEFsZ29yaXRobUlkZW50aWZpZXIgT1BUSU9OQUwsDWVuY2FwQ29u dGVudEluZm8gCUVuY2Fwc3VsYXRlZENvbnRlbnRJbmZvLA1hdXRoQXR0cnMgCQlbMl0gSU1Q TElDSVQgQXV0aEF0dHJpYnV0ZXMgT1BUSU9OQUwsDW1hYyAJCQlNZXNzYWdlQXV0aGVudGlj YXRpb25Db2RlLA11bmF1dGhBdHRycyAJWzNdIElNUExJQ0lUIFVuYXV0aEF0dHJpYnV0ZXMg T1BUSU9OQUwgDX0NQXV0aEF0dHJpYnV0ZXMgOjo9IFNFVCBTSVpFICgxLi5NQVgpIE9GIEF0 dHJpYnV0ZQ17e0F1dGhBdHRyaWJ1dGVTZXR9fQ1BdXRoQXR0cmlidXRlU2V0IEFUVFJJQlVU RSA6Oj0geyBhYS1jb250ZW50VHlwZSB8IGFhLW1lc3NhZ2VEaWdlc3QNfCBhYS1zaWduaW5n VGltZSwgLi4ufQ1NZXNzYWdlQXV0aGVudGljYXRpb25Db2RlIDo6PSBPQ1RFVCBTVFJJTkcN VW5hdXRoQXR0cmlidXRlcyA6Oj0gU0VUIFNJWkUgKDEuLk1BWCkgT0YgQXR0cmlidXRlDXt7 VW5hdXRoQXR0cmlidXRlU2V0fX0NVW5hdXRoQXR0cmlidXRlU2V0IEFUVFJJQlVURSA6Oj0g ey4uLn0NTWVzc2FnZUF1dGhlbnRpY2F0aW9uQ29kZUFsZ29yaXRobSA6Oj0gQWxnb3JpdGht SWRlbnRpZmllcg0JCQl7TUFDLUFMR09SSVRITSwge01lc3NhZ2VBdXRoZW50aWNhdGlvbkNv ZGVBbGdvcml0aG1TZXR9fQ1NZXNzYWdlQXV0aGVudGljYXRpb25Db2RlQWxnb3JpdGhtU2V0 IE1BQy1BTEdPUklUSE0gOjo9DXsgTWVzc2FnZUF1dGhBbGdzLCAuLi4gfQ1UaGUgYWxnb3Jp dGhtIGFyZSBkZWZpbmVkIGFzIG9iamVjdHMgb2YgdGhlIE1BQy1BTEdPUklUSE0gaW5mb3Jt YXRpb24gb2JqZWN0IGNsYXNzLg1NQUMtQUxHT1JJVEhNIDo6PSBDTEFTUyB7DSZpZCAgICAg ICAgICAgICAgICAgT0JKRUNUIElERU5USUZJRVIgVU5JUVVFLA0mUGFyYW1zICAgICAgICAg ICAgIE9QVElPTkFMLA0mcGFyYW1QcmVzZW5jZSAgICAgIFBhcmFtT3B0aW9ucyBERUZBVUxU IGFic2VudCwNJmtleWVkICAgICAgICAgICAgICBCT09MRUFOLA0mc21pbWVDYXBzICAgICAg ICAgIFNNSU1FLUNBUFMgT1BUSU9OQUwNfSANV0lUSCBTWU5UQVggew1JREVOVElGSUVSICZp ZA1bUEFSQU1TIFtUWVBFICZQYXJhbXNdIEFSRSAmcGFyYW1QcmVzZW5jZV0NSVMtS0VZRUQt TUFDICZrZXllZA1bU01JTUUtQ0FQUyAmc21pbWVDYXBzXQ19DU1lc3NhZ2VBdXRoQWxncyBN QUMtQUxHT1JJVEhNIDo6PSB7IA1tYWNhLWhNQUMtU0hBMjI0IHwNbWFjYS1oTUFDLVNIQTI1 NiB8DW1hY2EtaE1BQy1TSEEzODQgfA1tYWNhLWhNQUMtU0hBNTEyLA0uLi4gfQ1tYWNhLWhN QUMtU0hBMjI0IE1BQy1BTEdPUklUSE0gOjo9IHsNSURFTlRJRklFUiBoTUFDLVNIQTIyNA1Q QVJBTVMgVFlQRSBOVUxMIEFSRSBwcmVmZXJyZWRBYnNlbnQNSVMtS0VZRUQtTUFDIFRSVUUN U01JTUUtQ0FQUyB7SURFTlRJRklFRCBCWSBoTUFDLVNIQTIyNH0NfQ1oTUFDLVNIQTIyNCAJ CQlPQkpFQ1QgSURFTlRJRklFUiA6Oj0geyANe2lzbygxKSBtZW1iZXItYm9keSgyKSB1cyg4 NDApIHJzYWRzaSgxMTM1NDkpIGRpZ2VzdEFsZ29yaXRobSgyKSANaG1hY1dpdGhTSEEyMjQo OCl9DW1hY2EtaE1BQy1TSEEyNTYgCU1BQy1BTEdPUklUSE0gOjo9IHsNSURFTlRJRklFUiBo TUFDLVNIQTI1Ng1QQVJBTVMgVFlQRSBOVUxMIEFSRSBwcmVmZXJyZWRBYnNlbnQNSVMtS0VZ RUQtTUFDIFRSVUUNU01JTUUtQ0FQUyB7SURFTlRJRklFRCBCWSBoTUFDLVNIQTI1Nn0NfQ1o TUFDLVNIQTI1NiAJCQlPQkpFQ1QgSURFTlRJRklFUiA6Oj0gew17aXNvKDEpIG1lbWJlci1i b2R5KDIpIHVzKDg0MCkgcnNhZHNpKDExMzU0OSkgZGlnZXN0QWxnb3JpdGhtKDIpIA1obWFj V2l0aFNIQTI1Nig5KX0NbWFjYS1oTUFDLVNIQTM4NAkgTUFDLUFMR09SSVRITSA6Oj0gew1J REVOVElGSUVSIGhNQUMtU0hBMzg0DVBBUkFNUyBUWVBFIE5VTEwgQVJFIHByZWZlcnJlZEFi c2VudA1JUy1LRVlFRC1NQUMgVFJVRQ1TTUlNRS1DQVBTIHtJREVOVElGSUVEIEJZIGhNQUMt U0hBMzg0fQ19DWhNQUMtU0hBMzg0IAkJCU9CSkVDVCBJREVOVElGSUVSIDo6PSB7IA17aXNv KDEpIG1lbWJlci1ib2R5KDIpIHVzKDg0MCkgcnNhZHNpKDExMzU0OSkgZGlnZXN0QWxnb3Jp dGhtKDIpDWhtYWNXaXRoU0hBMzg0KDEwKX0NbWFjYS1oTUFDLVNIQTUxMiAJTUFDLUFMR09S SVRITSA6Oj0gew1JREVOVElGSUVSIGhNQUMtU0hBNTEyDVBBUkFNUyBUWVBFIE5VTEwgQVJF IHByZWZlcnJlZEFic2VudA1JUy1LRVlFRC1NQUMgVFJVRQ1TTUlNRS1DQVBTIHtJREVOVElG SUVEIEJZIGhNQUMtU0hBNTEyfQ19DWhNQUMtU0hBNTEyIAkJCU9CSkVDVCBJREVOVElGSUVS IDo6PSB7DXtpc28oMSkgbWVtYmVyLWJvZHkoMikgdXMoODQwKSByc2Fkc2koMTEzNTQ5KSBk aWdlc3RBbGdvcml0aG0oMikNaG1hY1dpdGhTSEE1MTIoMTEpfQ1NZXNzYWdlQXV0aGVudGlj YXRpb25Db2RlIDo6PSBPQ1RFVCBTVFJJTkcNdmVyc2lvbiBzcGVjaWZpZXMgdGhlIHZlcnNp b24gb2YgQXV0aGVudGljYXRlZERhdGEgYW5kIHNoYWxsIGJlIGRlZmluZWQgYnkgYXBwbHlp bmcgc3VjY2Vzc2l2ZWx5IHRoZSBmb2xsb3dpbmcgcnVsZXM6DWlmIG9yaWdpbmF0b3JJbmZv IGNvbXBvbmVudCBpcyBwcmVzZW50IGFuZCBhdCBsZWFzdCBvbmUgY2VydGlmaWNhdGUgdXNl cyB0aGUgb3RoZXIgYWx0ZXJuYXRpdmUsIHRoZSB2ZXJzaW9uIHNoYWxsIGJlIHYzOw1pZiBv cmlnaW5hdG9ySW5mbyBjb21wb25lbnQgaXMgcHJlc2VudCBhbmQgYXQgbGVhc3Qgb25lIGNl cnRpZmljYXRlIHJldm9jYXRpb24gbGlzdCB1c2VzIHRoZSBvdGhlciBhbHRlcm5hdGl2ZSwg dGhlIHZlcnNpb24gc2hhbGwgYmUgdjM7DWlmIG9yaWdpbmF0b3JJbmZvIGNvbXBvbmVudCBp cyBwcmVzZW50IGFuZCBhdCBsZWFzdCBvbmUgY2VydGlmaWNhdGUgaXMgYW4gYXR0cmlidXRl IGNlcnRpZmljYXRlIG9mIHZlcnNpb24gMiwgdGhlIHZlcnNpb24gc2hhbGwgYmUgdjE7DWlu IGFsbCBvdGhlciBjYXNlcywgdGhlIHZlcnNpb24gc2hhbGwgYmUgdjAuDW9yaWdpbmF0b3JJ bmZvIHByb3ZpZGVzIGluZm9ybWF0aW9uIGFib3V0IG9yaWdpbmF0b3IgYW5kIGl0IHNoYWxs IGJlIHByZXNlbnQgb25seSBpZiBpdCBpcyBuZWVkZWQgYnkga2V5IG1hbmFnZW1lbnQgYWxn b3JpdGhtLiBUaGlzIGluZm9ybWF0aW9uIG1heSBjb250ZW50IHB1YmxpYyBrZXkgYW5kL29y IGF0dHJpYnV0ZSBjZXJ0aWZpY2F0ZXMgYW5kIGNlcnRpZmljYXRlIHJldm9jYXRpb24gbGlz dHMuDXJlY2lwaWVudEluZm9zIHByb3ZpZGUgaW5mb3JtYXRpb24gZm9yIHJlY2lwaWVudHMg KHNlZSBjbGF1c2UgEyBSRUYgX1JlZjM5NTYxOTYzNCBcciBcaCABFDkuMRUpOyB0aGlzIGNv bGxlY3Rpb24gY2Fubm90IGJlIGVtcHR5Lg1tYWNBbGdvcml0aG0gaWRlbnRpZmllcyBhIG1l c3NhZ2UgYXV0aGVudGljYXRpb24gY29kZSBhbGdvcml0aG0gYW5kIGl0cyBwYXJhbWV0ZXJz LCBpZiBhbnkuDWRpZ2VzdEFsZ29yaXRobSBpZGVudGlmaWVzIHRoZSBtZXNzYWdlIGRpZ2Vz dCBhbGdvcml0aG0gYW5kIGl0cyBwYXJhbWV0ZXJzIGlmIGFueS4gVGhpcyBhbGdvcml0aG0g aXMgdXNlZCB0byBjb21wdXRlIHRoZSBkaWdlc3Qgb2YgdGhlIGNvbnRlbnQgaWYgYXV0aGVu dGljYXRlZCBhdHRyaWJ1dGVzIGFyZSBwcmVzZW50LiBUaGlzIGNvbXBvbmVudCBzaGFsbCBi ZSBwcmVzZW50IGlmIGF1dGhBdHRycyBjb21wb25lbnQgaXMgcHJlc2VudC4NZW5jYXBDb250 ZW50SW5mbyBpcyB0aGUgYXV0aGVudGljYXRlZCBjb250ZW50IGFzIGRlZmluZWQgaW4gY2xh dXNlIBMgUkVGIF9SZWYzOTU1OTMwMTggXHIgXGggARQ4LjIVLg1hdXRoQXR0cnMgaXMgYSBj b2xsZWN0aW9uIG9mIGF1dGhlbnRpY2F0ZWQgYXR0cmlidXRlcy4gVGhpcyBjb21wb25lbnQg c2hhbGwgYmUgcHJlc2VudCBpZiB0aGUgY29udGVudCB0eXBlIG9mIHRoZSBFbmNhcHN1bGF0 ZWRDb250ZW50SW5mbyBpcyBub3QgaWQtZGF0YS4gVGhpcyBjb21wb25lbnQgc2hhbGwgYmUg ZW5jb2RlZCB1c2luZyBERVIgZW5jb2RpbmcgcnVsZXMgYXMgZGVmaW5lZCBpbiBSZWMuIElU VS1UIFguNjkwIHwgSVNPL0lFQyA4ODI1LTEuDWV2ZW4gaWYgdGhlIG90aGVyIHBhcnRzIG9m IHRoZSB0eXBlIGFyZSBlbmNvZGVkIGluIEJFUi4gSWYgdGhpcyBjb21wb25lbnQgaXMgcHJl c2VudCwgaXQgc2hhbGwgY29udGVudCBhdCBsZWFzdCB0aGUgY29udGVudC10eXBlIGF0dHJp YnV0ZSAoc2VlIGNsYXVzZSATIFJFRiBfUmVmMzk1NTk3MTc2IFxyIFxoIAEUMTQuMRUpIGFu ZCB0aGUgbWVzc2FnZS1kaWdlc3QgYXR0cmlidXRlIChzZWUgY2xhdXNlIBMgUkVGIF9SZWYz OTU1OTcyNjQgXHIgXGggARQxNC4yFSkuDW1hYyBjb250YWlucyB0aGUgbWVzc2FnZSBhdXRo ZW50aWNhdGlvbiBjb2RlLg11bmF1dGhBdHRycyBpcyBhIGNvbGxlY3Rpb24gb2YgYXR0cmli dXRlcyB3aGljaCBhcmUgbm90IGF1dGhlbnRpY2F0ZWQuDU1BQyBnZW5lcmF0aW9uIHByb2Nl c3MNVGhlIG1lc3NhZ2UgYXV0aGVudGljYXRpb24gY29kZSBpbnB1dCBkYXRhIGlzIGNvbXB1 dGVkIG9uIHRoZSBjb250ZW50IGJlaW5nIGF1dGhlbnRpY2F0ZWQgb3Igb24gYSBtZXNzYWdl IGRpZ2VzdCBvZiB0aGlzIGNvbnRlbnQgZGVwZW5kaW5nIG9uIHRoZSBwcmVzZW5jZSBvZiBh dXRoZW50aWNhdGVkIGF0dHJpYnV0ZXMuDUlmIHRoZXJlIGlzIG5vIGF1dGhlbnRpY2F0ZWQg YXR0cmlidXRlcywgdGhlIG1lc3NhZ2UgYXV0aGVudGljYXRpb24gY29kZSBpcyBjb21wdXRl ZCBvbiB0aGUgZUNvbnRlbnQgY29tcG9uZW50IG9mIHRoZSBlbmNhcENvbnRlbnRJbmZvIGNv bXBvbmVudC4gVGhlIGVDb250ZW50IGNvbXBvbmVudCBpcyBhbiBvY3RldCBzdHJpbmcgYW5k IG9ubHkgdGhlIGNvbnRlbnQgcGFydCBvZiB0aGlzIG9jdGV0IHN0cmluZyBlbmNvZGluZyBp cyB1c2VkICh0aGUgdGFnIGFuZCBsZW5ndGggZmllbGRzIGFyZSBvbWl0dGVkKS4NSWYgdGhl cmUgYXJlIGF1dGhlbnRpY2F0ZWQgYXR0cmlidXRlcywgdGhlIGNvbnRlbnQtdHlwZSBhbmQg bWVzc2FnZS1kaWdlc3QgYXR0cmlidXRlcyBhcmUgcHJlc2VudCBhbmQgdGhlIG1lc3NhZ2Ug YXV0aGVudGljYXRpb24gY29kZSBpcyBjb21wdXRlZCBvbiB0aGUgREVSIGVuY29kaW5nIG9m IHRoZSBhdXRoQXR0cnMgY29tcG9uZW50LiANVGhlIG1lc3NhZ2UtZGlnZXN0IGF0dHJpYnV0 ZSBpcyBjb21wdXRlZCBvbiB0aGUgY29udGVudCBiZWluZyBhdXRoZW50aWNhdGVkIHdoaWNo IGlzIHJlcHJlc2VudGVkIGJ5IHRoZSBlQ29udGVudCBjb21wb25lbnQgb2YgdGhlIGVuY2Fw Q29udGVudEluZm8gY29tcG9uZW50LiBPbmx5IHRoZSBjb250ZW50IHBhcnQgb2YgdGhpcyBv Y3RldCBzdHJpbmcgZW5jb2RpbmcgaXMgdXNlZCAodGhlIHRhZyBhbmQgbGVuZ3RoIGZpZWxk cyBhcmUgb21pdHRlZCkuDUEgc3BlY2lmaWMgREVSIGVuY29kaW5nIG9mIHRoZSBhdXRoQXR0 cnMgY29tcG9uZW50IGlzIGRvbmUgdG8gY29tcHV0ZSB0aGUgbWVzc2FnZSBkaWdlc3QgOiBm b3IgdGhpcyBlbmNvZGluZywgdGhlIElNUExJQ0lUIFsyXSB0YWcgc2hhbGwgYmUgcmVwbGFj ZWQgd2l0aCBFWFBMSUNJVCBTRVQgT0YgdGFnIGFuZCB0aGUgdGFnIGFuZCBsZW5ndGggZmll bGRzIGZvbGxvd2VkIGJ5IHRoZSBjb250ZW50IG9mIHRoZSBERVIgZW5jb2RpbmcgYXJlIHVz ZWQgYnkgdGhlIG1lc3NhZ2UgZGlnZXN0IGNvbXB1dGF0aW9uIHByb2Nlc3MuDVRoZSBtZXNz YWdlIGF1dGhlbnRpY2F0aW9uIGNvZGUgaW5wdXQgZGF0YSBhbmQgYXV0aGVudGljYXRpb24g a2V5IGNvbnRhaW5lZCBpbiBhIFJlY2lwaWVudEluZm8gdmFsdWUgYXJlIGNvbWJpbmVkIGJ5 IHRoZSBtZXNzYWdlIGF1dGhlbnRpY2F0aW9uIGNvZGUgYWxnb3JpdGhtIHRvIGdlbmVyYXRl IGFuIG9jdGV0IHN0cmluZyB0cmFuc21pdHRlZCBpbiB0aGUgbWFjIGNvbXBvbmVudCBvZiB0 aGUgQXV0aGVudGljYXRlZERhdGEgdmFsdWUuDU1BQyB2ZXJpZmljYXRpb24gcHJvY2Vzcw1U aGUgaW5wdXQgb2YgdGhlIG1lc3NhZ2UgYXV0aGVudGljYXRpb24gY29kZSB2ZXJpZmljYXRp b24gcHJvY2VzcyBpcyBjb21wdXRlZCBmcm9tIHRoZSBjb250ZW50IGJlaW5nIGF1dGhlbnRp Y2F0ZWQgb3IgZnJvbSBhIGRpZ2VzdCBvZiB0aGUgY29udGVudCBkZXBlbmRpbmcgb24gdGhl IHByZXNlbmNlIG9mIGF1dGhlbnRpY2F0ZWQgYXR0cmlidXRlcy4gVGhpcyBkYXRhIGFuZCB0 aGUgYXV0aGVudGljYXRpb24ga2V5IGNvbnRhaW5lZCBpbiB0aGUgUmVjaXBpZW50SW5mbyB2 YWx1ZSB1c2VkIGJ5IGEgcmVjaXBpZW50IGFyZSBjb21iaW5lZCBieSB0aGUgbWVzc2FnZSBh dXRoZW50aWNhdGlvbiBjb2RlIGFsZ29yaXRobSBzaGFsbCBwcm9kdWNlIHRoZSBzYW1lIHJl c3VsdCBhcyB0aGUgbWFjIGNvbXBvbmVudCBvZiB0aGUgQXV0aGVudGljYXRlZERhdGEgdmFs dWUuDUJlc2lkZXMsIGlmIHRoZSBhdXRoQXR0cnMgY29tcG9uZW50IGlzIHByZXNlbnQsIHRo ZSB0d28gZm9sbG93aW5nIGNvbmRpdGlvbnMgc2hhbGwgYmUgc2F0aXNmaWVkOg10aGUgY29u dGVudCBtZXNzYWdlIGRpZ2VzdCBjb21wdXRlZCBieSB0aGUgcmVjaXBpZW50IHNoYWxsIGJl IHNhbWUgYXMgdGhlIHZhbHVlIG9mIHRoZSBtZXNzYWdlIGRpZ2VzdCBhdHRyaWJ1dGUgY29u dGFpbmVkIGluIHRoZSBhdXRoQXR0cnMgY29tcG9uZW50Lg1UaGUgZUNvbnRlbnRUeXBlIG9m IHRoZSBlbmNhcENvbnRlbnRJbmZvIHNoYWxsIGJlIHRoZSBzYW1lIGFzIHRoZSB2YWx1ZSBv ZiB0aGUgY29udGVudC10eXBlIGF0dHJpYnV0ZSBjb250YWluZWQgaW4gdGhlIGF1dGhBdHRy cyBjb21wb25lbnQuDVNpZ25jcnlwdGVkIGRhdGENVGhlIHNpZ25jcnlwdGVkIGlzIHVzZWQg YnkgdGhlIHNpZ25jcnlwdGlvbiB0ZWNobmlxdWUgZGVmaW5lZCBpbiBJU08vSUVDIDI5MTUw LiBUaGUgc2lnbmNyeXB0aW9uIHRlY2huaXF1ZSBzaWducyBhbmQgZW5jcnlwdHMgc2ltdWx0 YW5lb3VzbHkgdGhlIGRhdGEgdG8gYWNoaWV2ZSBvcmlnaW4gYXV0aGVudGljYXRpb24sIGRh dGEgaW50ZWdyaXR5IGFuZCBjb25maWRlbnRpYWxpdHkuIFNpZ25jcnlwdGlvbiBjYW4gYmUg dXNlZCBpbiBDTVMgaW4gdGhyZWUgZGlmZmVyZW50IG1vZGVzOg1zaWduY3J5cHRlZC1jb250 ZW50OiB0aGUgZGF0YSBjb250ZW50IGlzIHNpZ25jcnlwdGVkOw1zaWduY3J5cHRlZC1hdHRy aWJ1dGVzOiB0aGUgZGF0YSBjb250ZW50IGFuZCB0aGUgc2lnbmVkIGF0dHJpYnV0ZXMgYXJl IHNpZ25jcnlwdGVkOw1zaWduY3J5cHRlZC1jb21wb25lbnQ6IHRoaXMgbW9kZSBpcyBhcHBs aWNhYmxlIHdoZW4gdGhlIGRhdGEgY29udGVudCBpcyBhbiBYTUwgdmFsdWUgYW5kIGlzIHVz ZWQgdG8gc2lnbmNyeXB0IG9ubHkgc29tZSBjb21wb25lbnRzIG9mIHRoZSBjb250ZW50IGFu ZCBzaWduZWQgYXR0cmlidXRlcy4NVGhlIFNpZ25jcnlwdGVkRGF0YSB0eXBlDVNpZ25jcnlw dGVkRGF0YQk6Oj0gU0VRVUVOQ0Ugew12ZXJzaW9uCQlDTVNWZXJzaW9uLA1kaWdlc3RBbGdv cml0aG1zCVNFVCBPRiBEaWdlc3RBbGdvcml0aG1JZGVudGlmaWVyLA1lbmNhcENvbnRlbnRJ bmZvCUVuY2Fwc3VsYXRlZENvbnRlbnRJbmZvLA1jZXJ0aWZpY2F0ZXMJWzBdIFtYRVI6QkFT RTY0XSBPQ1RFVCBTVFJJTkcNCQkJCShDT05UQUlOSU5HIENlcnRpZmljYXRlU2V0KSBPUFRJ T05BTCwNY3JscwkJCVsxXSBbWEVSOkJBU0U2NF0gT0NURVQgU1RSSU5HDQkJCQkoQ09OVEFJ TklORyBSZXZvY2F0aW9uSW5mb0Nob2ljZXMpCU9QVElPTkFMLA1zaWduY3J5cHRlckluZm9z CVNpZ25jcnlwdGVySW5mb3MNfQ1TaWduY3J5cHRlckluZm9zCTo6PSBTRVQgU0laRSgwLi5N QVgpIE9GIFNpZ25jcnlwdGVySW5mbw12ZXJzaW9uIGlzIHZlcnNpb24gbnVtYmVyIHdoaWNo IHNoYWxsIGJlIGVxdWFsIHRvIHY2Lg1kaWdlc3RBbGdvcml0aG1zIGlzIGEgbGlzdCBvZiBk aWdlc3QgYWxnb3JpdGhtIGlkZW50aWZpZXJzLCBlYWNoIG9mIHRoZW0gaXMgZGVmaW5lZCBi eSB0aGUgaWRlbnRpZmljYXRpb24gb2YgdGhlIGFsZ29yaXRobSBhbmQgYXNzb2NpYXRlZCBw YXJhbWV0ZXJzLiBUaGlzIGxpc3Qgc2hhbGwgY29udGFpbiBhbGwgdGhlIGRpZ2VzdCBhbGdv cml0aG1zIHVzZWQgYnkgdGhlIHNpZ25jcnlwdGVycyB0byBmYWNpbGl0YXRlIG9uZS1wYXNz IHNpZ25hdHVyZSB2ZXJpZmljYXRpb24uDWVuY2FwQ29udGVudEluZm8gaXMgc2lnbmVkIGNv bnRlbnQgZGVmaW5lZCBieSBhIHR5cGUgaWRlbnRpZmllciBhbmQgdGhlIGNvbnRlbnQuDWNl cnRpZmljYXRlcyBpcyBhIGNvbGxlY3Rpb24gb2YgcHVibGljIGtleSBhbmQvb3IgYXR0cmli dXRlIGNlcnRpZmljYXRlcyB0byBmYWNpbGl0YXRlIHRoZSB2YWxpZGF0aW9uIG9mIHRoZSBw dWJsaWMga2V5cyBvZiB0aGUgc2lnbmNyeXB0ZXJzLiBUaGlzIGNvbGxlY3Rpb24gbWF5IGNv bnRhaW4gbW9yZSBjZXJ0aWZpY2F0ZXMgdGhhbiBuZWNlc3Nhcnkgb3IgZmV3ZXIgYW5kLCBp biB0aGUgbGF0dGVyIGNhc2UsIHJlY2lwaWVudHMgaGF2ZSB0byB1c2Ugb3RoZXIgbWVhbnMg dG8gZ2V0IG90aGVyIGNlcnRpZmljYXRlcy4NY3JscyBpcyBhIGNvbGxlY3Rpb24gb2YgcHVi bGljIGtleSBhbmQvb3IgYXR0cmlidXRlIGNlcnRpZmljYXRlIHJldm9jYXRpb24gbGlzdHMg dG8gZmFjaWxpdGF0ZSB0aGUgdmFsaWRhdGlvbiBvZiB0aGUgY2VydGlmaWNhdGVzIG9mIHRo ZSBzaWduY3J5cHRlcnMuIEFzIGZvciBjZXJ0aWZpY2F0ZXMsIHRoaXMgY29sbGVjdGlvbiBt YXkgY29udGFpbiBtb3JlIGNlcnRpZmljYXRlIHJldm9jYXRpb24gbGlzdHMgdGhhbiBuZWNl c3Nhcnkgb3IgZmV3ZXIgYW5kLCBpbiB0aGUgbGF0dGVyIGNhc2UsIHJlY2lwaWVudHMgaGF2 ZSB0byB1c2Ugb3RoZXIgbWVhbnMgdG8gZ2V0IG90aGVyIGNlcnRpZmljYXRlIHJldm9jYXRp b24gbGlzdHMuDXNpZ25jcnlwdGVySW5mb3MgaXMgYSBjb2xsZWN0aW9uIG9mIGFsbCBzaWdu Y3J5cHRlciBzcGVjaWZpYyBpbmZvcm1hdGlvbi4NVGhlIFNpZ25jcnlwdGVySW5mbyB0eXBl DVNpZ25jcnlwdGVySW5mbwk6Oj0gU0VRVUVOQ0Ugew12ZXJzaW9uCQlDTVNWZXJzaW9uLA1z aWRzCQkJU2lnbmNyeXB0ZXJJRHMsDWRpZ2VzdEFsZ29yaXRobQlbMF0gRGlnZXN0QWxnb3Jp dGhtSWRlbnRpZmllciBPUFRJT05BTCwNc2lnbmVkQXR0cnMJCVsxXSBTaWduZWRBdHRyaWJ1 dGVzIE9QVElPTkFMLA1zaWduYXR1cmVBbGdvcml0aG0JU2lnbmF0dXJlQWxnb3JpdGhtSWRl bnRpZmllciwNc2lnbmF0dXJlCQlTaWduYXR1cmVWYWx1ZSwNdW5zaWduZWRBdHRycwlbMl0g QXR0cmlidXRlc3t7VW5zaWduZWRBdHRyaWJ1dGVzfX0gT1BUSU9OQUwNfQ1TaWduY3J5cHRl cklEcwk6Oj0gU0VRVUVOQ0Ugew1zZW5kZXIJS2V5UGFpcklkZW50aWZpZXIsDXJlY2lwaWVu dAlLZXlQYWlySWRlbnRpZmllcg19DUtleVBhaXJJZGVudGlmaWVyCTo6PSBDSE9JQ0Ugew1p c3N1ZXJBbmRTZXJpYWxOdW1iZXIJSXNzdWVyQW5kU2VyaWFsTnVtYmVyLA1zdWJqZWN0S2V5 SWRlbnRpZmllcglbMF0gU3ViamVjdEtleUlkZW50aWZpZXIsDWNlcnRIYXNoCQkJWzFdIENl cnRIYXNoDX0NQ2VydEhhc2ggOjo9IEhBU0h7Q2VydGlmaWNhdGV9DXZlcnNpb24gaXMgdGhl IHZlcnNpb24gbnVtYmVyIHdoaWNoIHNoYWxsIGJlIGVxdWFsIHRvIHY2Lg1zaWRzIGlkZW50 aWZpZXMgdGhlIGtleXMuIEluIHNpZ25jcnlwdGlvbjoNdGhlIHNlbmRlciBuZWVkcyBoaXMg cHVibGljIGFuZCBwcml2YXRlIGtleXMgYW5kIHRoZSBwdWJsaWMga2V5IG9mIHRoZSByZWNp cGllbnQ7DXRoZSByZWNpcGllbnQgbmVlZHMgaGlzIHB1YmxpYyBhbmQgcHJpdmF0ZSBrZXlz IGFuZCB0aGUgcHVibGljIGtleSBvZiB0aGUgc2VuZGVyLg1TbyB0aGUgc2lkcyBjb21wb25l bnQgaWRlbnRpZmllcyB0d28ga2V5IHBhaXJzLiBFYWNoIGtleSBwYWlyIGNhbiBiZSBkZWZp bmVkIGJ5Og1pc3N1ZXJBbmRTZXJpYWxOdW1iZXI6IHRoZSBjZXJ0aWZpY2F0ZSBjb250YWlu aW5nIHRoZSBwdWJsaWMga2V5IGlzIGlkZW50aWZpZWQgYnkgaXRzIGlzc3VlciBhbmQgaXRz IHNlcmlhbCBudW1iZXIuIElmIHRoZSBjZXJ0aWZpY2F0ZSBpcyBhbiBYLjUwOSBjZXJ0aWZp Y2F0ZSBvZiB2ZXJzaW9uIDMgY29udGFpbmluZyBhIGtleVVzYWdlIGV4dGVuc2lvbiwgZGln aXRhbFNpZ25hdHVyZSBhbmQgZGF0YUVuY2lwaGVybWVudCBzaGFsbCBiZSBzZXQuDXN1Ympl Y3RLZXlJZGVudGlmaWVyOiBmb3IgYW4gWC41MDkgY2VydGlmaWNhdGUsIHRoZSBzdWJqZWN0 S2V5SWRlbnRpZmllciBzaGFsbCBtYXRjaCB0aGUgc3ViamVjdEtleUlkZW50aWZpZXIgZXh0 ZW5zaW9uIHZhbHVlIChzZWUpIG9mIHRoZSBjZXJ0aWZpY2F0ZS4gRm9yIG90aGVyIGNlcnRp ZmljYXRlIGZvcm1hdHMsIHRoZSBzcGVjaWZpY2F0aW9uIG9mIHRoZSBjZXJ0aWZpY2F0ZSBm b3JtYXQgbXVzdCBjb250YWluIHJ1bGVzIGZvciBtYXRjaGluZyB0aGUga2V5IGlkZW50aWZp ZXIgdG8gdGhlIGFwcHJvcHJpYXRlIGNlcnRpZmljYXRlIGZpZWxkLg1jZXJ0SGFzaDogdGhl IHJlc3VsdCBvZiB0aGUgaGFzaGluZyBvZiB0aGUgY2VydGlmaWNhdGUuDWRpZ2VzdEFsZ29y aXRobSBpZGVudGlmaWVzIHRoZSBkaWdlc3QgYWxnb3JpdGhtIGFuZCB0aGUgYXNzb2NpYXRl ZCBwYXJhbWV0ZXJzIGlmIGFueSB1c2VkIGJ5IHRoZSBzaWduY3J5cHRlciB0byBjb21wdXRl IHRoZSBoYXNoIG9mIHRoZSBjb250ZW50IG9mIHRoZSBtZXNzYWdlIG9yIHRoZSBjb250ZW50 IG9mIHRoZSBtZXNzYWdlIHdpdGggc2lnbmVkIGF0dHJpYnV0ZXMuDXNpZ25lZEF0dHJzIGlz IGEgY29sbGVjdGlvbiBvZiBhdHRyaWJ1dGVzIHRoYXQgYXJlIHNpZ25lZC4gVGhpcyBjb21w b25lbnQgaXMgb3B0aW9uYWwgd2hlbiB0aGUgZUNvbnRlbnRUeXBlIG9mIHRoZSBFbmNhcHN1 bGF0ZWRDb250ZW50SW5mbyBpcyBpZC1kYXRhIGFuZCBtYW5kYXRvcnkgaW4gb3RoZXIgc2l0 dWF0aW9ucy4gV2hlbiBzaWduZWRBdHRycyBpcyBwcmVzZW50LCBpdCBzaGFsbCBjb250ZW50 IGF0IGxlYXN0IGNvbnRlbnQtdHlwZSAoc2VlIGNsYXVzZSATIFJFRiBfUmVmMzk1NTk3MTc2 IFxyIFxoIAEUMTQuMRUpIGFuZCB0aGUgbWVzc2FnZS1kaWdlc3QgKHNlZSBjbGF1c2UgEyBS RUYgX1JlZjM5NTU5NzI2NCBcciBcaCABFDE0LjIVKSBhdHRyaWJ1dGVzLiBUaGVzZSBhdHRy aWJ1dGVzIHNoYWxsIGJlIGVuY29kZWQgdXNpbmcgREVSIGVuY29kaW5nIHJ1bGVzIGFzIGRl ZmluZWQgaW4gUmVjLiBJVFUtVCBYLjY5MCB8IElTTy9JRUMgODgyNS0xLg0uDXNpZ25hdHVy ZUFsZ29yaXRobSBpZGVudGlmaWVzIHRoZSBhbGdvcml0aG0gdXNlZCBmb3Igc2lnbmF0dXJl IGFuZCBpdHMgcGFyYW1ldGVycyBpZiBhbnkuDXNpZ25hdHVyZVZhbHVlIGNvbnRhaW5zIHRo ZSBzaWduYXR1cmUgYXMgYSBiaXQgc3RyaW5nIHZhbHVlLg11bnNpZ25lZEF0dHJzIGlzIGEg Y29sbGVjdGlvbiBvZiB1bnNpZ25lZCBhdHRyaWJ1dGVzLg1UaGUgc2lnbmNyeXB0aW9uIHBy b2Nlc3MNVGhlIHNpZ25jcnlwdGVkLWNvbnRlbnQgbW9kZQ1Gb3IgZWFjaCByZWNpcGllbnQs IHRoZSBzZW5kZXIgdXNlcyB0aGUgYWxnb3JpdGhtIGlkZW50aWZpZXMgYnkgdGhlIHNpZ25h dHVyZUFsZ29yaXRobSBjb21wb25lbnQgb2YgU2lnbmNyeXB0ZXJJbmZvIGFuZCBoaXMgcHJp dmF0ZSBhbmQgcHVibGljIGtleXMgYXMgd2VsbCBhcyB0aGUgcHVibGljIGtleSBvZiB0aGUg cmVjaXBpZW50IHRvIGVuY3J5cHQgYW5kIHNpZ24gdGhlIGNvbnRlbnQgYW5kIHBsYWNlcyB0 aGUgcmVzdWx0IGluIHRoZSBzaWduYXR1cmUgY29tcG9uZW50IG9mIFNpZ25jcnlwdGVySW5m by4gVGhlIHVuY3J5cHRlZCBjb250ZW50IGlzIG5vdCBpbmNsdWRlZCBpbiB0aGUgZW5jYXBD b250ZW50SW5mbyBjb21wb25lbnQuDVRoZSByZWNpcGllbnQgdXNlcyB0aGUgYWxnb3JpdGht IGlkZW50aWZpZWQgYnkgdGhlIHNpZ25hdHVyZUFsZ29yaXRobSBjb21wb25lbnQgb2YgU2ln bmNyeXB0ZXJJbmZvIGFuZCBoaXMgcHJpdmF0ZSBhbmQgcHVibGljIGtleXMgYXMgd2VsbCBh cyB0aGUgcHVibGljIGtleSBvZiB0aGUgc2VuZGVyIHRvIHZlcmlmeSB0aGUgc2lnbmF0dXJl IGFuZCByZWNvdmVyIHRoZSBvcmlnaW5hbCBtZXNzYWdlIGNvbnRlbnQgZnJvbSB0aGUgc2ln bmF0dXJlIGNvbXBvbmVudCBvZiBTaWduY3J5cHRlckluZm8uDVRoZSBzaWduY3J5cHRlZC1h dHRyaWJ1dGVzIG1vZGUNRm9yIGVhY2ggcmVjaXBpZW50LCB0aGUgc2VuZGVyIGNvbmNhdGVu YXRlcyB0aGUgY29tcGxldGUgZW5jb2Rpbmcgb2YgdGhlIHNpZ25BdHRycyBjb21wb25lbnQg b2YgU2lnbmNyeXB0ZXJJbmZvIHRvIGEgY29tcGxldGUgZW5jb2Rpbmcgb2YgdGhlIGNvbnRl bnQgYW5kIHRoZW4gdXNlcyB0aGUgYWxnb3JpdGhtIGlkZW50aWZpZWQgYnkgdGhlIHNpZ25h dHVyZUFsZ29yaXRobSBjb21wb25lbnQgb2YgU2lnbmNyeXB0ZXJJbmZvIGFuZCBoaXMgcHJp dmF0ZSBhbmQgcHVibGljIGtleXMgYXMgd2VsbCBhcyB0aGUgcHVibGljIGtleSBvZiB0aGUg cmVjaXBpZW50IHRvIGVuY3J5cHQgYW5kIHNpZ24gdGhpcyBvY3RldCBzdHJpbmcgYW5kIHRo ZW4gcGxhY2VzIHRoZSByZXN1bHQgaW4gdGhlIHNpZ25hdHVyZSBjb21wb25lbnQgb2YgU2ln bmNyeXB0ZXJJbmZvLiBUaGUgdW5jcnlwdGVkIGNvbnRlbnQgaXMgbm90IGluY2x1ZGVkIGlu IHRoZSBlbmNhcENvbnRlbnRJbmZvIGFuZCB0aGUgc2lnbkF0dHJzIGlzIG5vdCBpbmNsdWRl ZCBpbiB0aGUgU2lnbmNyeXB0ZXJJbmZvLg1UaGUgcmVjaXBpZW50IHVzZXMgdGhlIGFsZ29y aXRobSBpZGVudGlmaWVkIGJ5IHRoZSBzaWduYXR1cmVBbGdvcml0aG0gY29tcG9uZW50IG9m IFNpZ25jcnlwdGVySW5mbyBhbmQgaGlzIHByaXZhdGUgYW5kIHB1YmxpYyBrZXlzIGFzIHdl bGwgYXMgdGhlIHB1YmxpYyBrZXkgb2YgdGhlIHNlbmRlciB0byB2ZXJpZnkgdGhlIHNpZ25h dHVyZSBhbmQgcmVjb3ZlciB0aGUgb3JpZ2luYWwgbWVzc2FnZSBjb250ZW50IGFuZCB0aGUg c2lnbmVkIGF0dHJpYnV0ZXMgZnJvbSB0aGUgc2lnbmF0dXJlIGNvbXBvbmVudCBvZiBTaWdu Y3J5cHRlckluZm8uDVRoZSBzaWduY3J5cHRlZC1jb21wb25lbnRzIG1vZGUNVGhpcyBtb2Rl IGlzIHVzZWQgZm9yIFhNTCBjb250ZW50IHRvIHNpZ25jcnlwdCBzb21lIGNvbXBvbmVudHMg b2YgdGhlIGNvbnRlbnQuIFRoZXNlIGNvbXBvbmVudHMgYXJlIGlkZW50aWZpZWQgYnkgYSBz cGVjaWZpYyBzaWduY3J5cHRlZFBhcnRzIGF0dHJpYnV0ZS4gVGhpcyBhdHRyaWJ1dGUgaXMg YSB2YWx1ZSBvZiBTaWduY3J5cHRlZFBhcnRzIEFTTi4xIHR5cGUgd2hpY2ggY29udGFpbiBh biBvcGVuVHlwZSB2YWx1ZSAoY29tcG9uZW50IHBhcnRzIG9mIHRoZSBTaWduY3J5cHRlZCBw YXJhbWV0ZXJpemVkIHR5cGUpIGlkZW50aWZpZWQgYnkgYW4gb2JqZWN0IGlkZW50aWZpZXIg dmFsdWUgKGNvbXBvbmVudCBuYW1lIG9mIHRoZSBTaWduY3J5cHRlZCBwYXJhbWV0ZXJpemVk IHR5cGUpLiAgVGhlIHR5cGVzIHVzZWQgaW4gU2lnbmNyeXB0ZWRQYXJ0cyBhcmUgZGVmaW5l ZCB1c2luZyBpbmZvcm1hdGlvbiBvYmplY3RzIG9mIHRoZSBTSUdOQ1JZUFRFRCBpbmZvcm1h dGlvbiBvYmplY3QgY2xhc3MuIEluIHRoaXMgdmVyc2lvbiBvZiBSZWNvbW1lbmRhdGlvbiB8 IEludGVybmF0aW9uYWwgU3RhbmRhcmQsIG9ubHkgb25lIGluZm9ybWF0aW9uIG9iamVjdCwg eFBhdGhNYW5pZmVzdCBpcyBkZWZpbmVkIGluIHRoZSBNYW5pZmVzdCBpbmZvcm1hdGlvbiBv YmplY3Qgc2V0LiBUaGlzIG9iamVjdCBkZWZpbmVzIHRoZSBYUGF0aFNldCB0eXBlIHdoaWNo IGlzIGEgc2VxdWVuY2Ugb2YgWFBhdGggdHlwZSB3aGljaCBpcyBhbiBVVEY4U3RyaW5nIGlk ZW50aWZ5aW5nIGEgY29tcG9uZW50IG9mIHRoZSBjb250ZW50Lg1TSUdOQ1JZUFRFRCA6Oj0g Q0xBU1Mgew0maWQJT0JKRUNUIElERU5USUZJRVIgVU5JUVVFLA0mVHlwZQlPUFRJT05BTH0N V0lUSCBTWU5UQVgge09JRCAmaWQgW1BBUk1TICZUeXBlXX0NU2lnbmNyeXB0ZWR7U0lHTkNS WVBURUQ6SU9TZXR9IDo6PSBTRVFVRU5DRSB7DW5hbWUJU0lHTkNSWVBURUQuJmlkKHtJT1Nl dH0pLA1wYXJ0cwlTSUdOQ1JZUFRFRC4mVHlwZSh7SU9TZXR9e0BuYW1lfSkgT1BUSU9OQUwN fQ1TaWduY3J5cHRlZFBhcnRzCTo6PSBTaWduY3J5cHRlZHt7TWFuaWZlc3R9fQ1NYW5pZmVz dAlTSUdOQ1JZUFRFRCA6Oj0gew14UGF0aE1hbmlmZXN0LC4uLn0NeFBhdGhNYW5pZmVzdAlT SUdOQ1JZUFRFRKA6Oj0gew1PSUQgaWQtY21zLVhQYXRoIFBBUk1TIFhQYXRoU2V0IH0NaWQt Y21zLVhQYXRoCU9CSkVDVCBJREVOVElGSUVSIDo6PSB7aXR1LXQgcmVjb21tZW5kYXRpb24o MCkgeCgyNCkgY21zKDg5NCkgDXNpZ25jcnlwdGlvbigxKSBtYW5pZmVzdCgyKSB4UGF0aCgw fQ1YUGF0aFNldKA6Oj0gU0VRVUVOQ0UgU0laRSgxLi5NQVgpIE9GIFhQYXRoDVhQYXRoIDo6 PSBVVEY4U3RyaW5nIChDT05TVFJBSU5FRCBCWSB7IC0tIFhNTCBQYXRoIExhbmd1YWdlIDIu MCAtLSB9KQ1JbiB0aGlzIG1vZGUsIHRoZSBzaWduQXR0cnMgY29tcG9uZW50IG9mIFNpZ25l ckNyeXB0ZXJJbmZvIHNoYWxsIGNvbnRhaW4gYXQgbGVhc3QgdGhlIHRocmVlIGZvbGxvd2lu ZyBhdHRyaWJ1dGVzOg1jb250ZW50VHlwZQ1tZXNzYWdlRGlnZXN0DXNpZ25jcnlwdGVkUGFy dHMNVGhlIHNlbmRlciBzaWduY3J5cHRzIGVhY2ggY29tcG9uZW50IGlkZW50aWZpZWQgYnkg dGhlIHNpZ25jcnlwdGVkUGFydHMgYXR0cmlidXRlIChzZWUgEyBSRUYgX1JlZjM5NTY4NDkz NSBcciBcaCABFDE0LjUVKSBhbmQgcmVwbGFjZSBpbiB0aGUgbWVzc2FnZSBjb250ZW50LCB0 aGUgc3RyaW5nIGJldHdlZW4gWE1MIHRhZ3MgYnkgdGhlIHNpZ25jcnlwdGlvbiByZXN1bHQg ZW5jb2RlZCBpbiBiYXNlNjQuDVRoZSBtb2RpZmllZCBjb250ZW50IGFuZCB0aGUgc2lnbmVk IGF0dHJpYnV0ZXMgYXJlIHRoZW4gc2lnbmVkIHVzaW5nIHRoZSBzYW1lIHByb2NlZHVyZSBh cyBzaWduZWQgZGF0YSAoc2VlKSBhbmQgdGhlIHJlc3VsdCBpcyBwbGFjZWQgaW4gdGhlIHNp Z25hdHVyZSBjb21wb25lbnQgb2YgdGhlIFNpZ25jcnlwdGVySW5mby4NVGhlIHJlY2lwaWVu dCB2ZXJpZmllcyB0aGUgc2lnbmF0dXJlLCB0aGVuIHJlY292ZXJzIHRoZSBvcmlnaW5hbCBz aWduY3J5cHRlZCBjb21wb25lbnRzIGlkZW50aWZpZWQgYnkgdGhlIHNpZ25jcnlwdGVkUGFy dHMgYXR0cmlidXRlIGFuZCByZXBsYWNlcyB0aGUgZW5jcnlwdGVkIGNvbnRlbnQgb2Ygc2ln bmNyeXB0ZWQgY29tcG9uZW50cyB3aXRoIHRoZSBvcmlnaW5hbCBjb250ZW50Lg1BdHRyaWJ1 dGVzDUF0dHJpYnV0ZXMgYXJlIGRlZmluZWQgYXMgb2JqZXRzIG9mIEFUUlJJQlVURSBpbmZv cm1hdGlvbiBvYmplY3QgY2xhc3MuIEVhY2ggYXR0cmlidXRlIGlzIGRlZmluZWQgYnk6DWFu IHVuaXF1ZSBvYmplY3QgaWRlbnRpZmllciB2YWx1ZSAoJmlkIGZpZWxkKTsNdGhlIEFTTi4x IHR5cGUgb2YgdGhlIGF0dHJpYnV0ZSB2YWx1ZXMgKCZUeXBlIGZpZWxkKTsNdGhlIHJ1bGUg dXNlZCB0byBjb21wYXJlIHZhbHVlcyBvZiB0aGUgYXR0cmlidXRlICgmZXF1YWxpdHktbWF0 Y2ggZmllbGQpOiB0aGlzIHJ1bGUgaXMgZGVmaW5lZCBhcyBhbiBvYmplY3Qgb2YgTUFUQ0hJ TkctUlVMRSBpbmZvcm1hdGlvbiBvYmplY3QgY2xhc3M7DXRoZSBtaW5pbXVtIHZhbHVlcyBv ZiB0aGlzIGF0dHJpYnV0ZSB3aGVuIHRoaXMgYXR0cmlidXRlIGlzIHByZXNlbnQgKCZtaW5D b3VudCBmaWVsZCk6IHRoZSBkZWZhdWx0IHZhbHVzIGlzIDEsDXRoZSBtYXhpbXVtIHZhbHVl cyBvZiB0aGlzIGF0dHJpYnV0ZXMgd2hlbiB0aGlzIGF0dHJpYnV0ZSBpcyBwcmVzZW50IChv cHRpb25hbCAmbWF4Q291bnQgZmllZCkuDUFUVFJJQlVURSA6Oj0gQ0xBU1Mgew0maWQJCQkJ T0JKRUNUIElERU5USUZJRVIgVU5JUVVFLA0mVHlwZQkJCQlPUFRJT05BTCwNJmVxdWFsaXR5 LW1hdGNoCQlNQVRDSElORy1SVUxFIE9QVElPTkFMLA0mbWluQ291bnQJCQlJTlRFR0VSIERF RkFVTFQgMSwNJm1heENvdW50CQkJSU5URUdFUiBPUFRJT05BTCB9DVdJVEggU1lOVEFYIHsN W1RZUEUgJlR5cGVdDVtFUVVBTElUWSBNQVRDSElORyBSVUxFICZlcXVhbGl0eS1tYXRjaF0N W0NPVU5UUyBbTUlOICZtaW5Db3VudF0gW01BWCAmbWF4Q291bnRdXQ1JREVOVElGSUVEIEJZ ICZpZH0NQSBtYXRjaGluZyBpcyBkZWZpbmVkIGJ5Og1tYXRjaGluZyBydWxlcyBwcm92aWRp bmcgY2hhcmFjdGVyaXN0aWNzIGZvciB0aGUgbmV3IG1hdGNoaW5nIHJ1bGUgKCZQYXJlbnRN YXRjaGluZ1J1bGVzKTogdGhpcyBmaWVsZCBjYW4gYmUgdXNlZCBmb3IgZXhhbXBsZSB0byBk ZWZpbmUgbWF0Y2hpbmcgYWxnb3JpdGhtOyBpdCBpcyBzaGFsbCBiZSBvbWl0dGVkIHRvIGRl ZmluZSBhIGJhc2ljIG1hdGNoaW5nIHJ1bGU7DWFuIEFTTi4xIHR5cGUgKCZBc3NlcnRpb25U eXBlIGZpZWxkKSB3aGljaCBkZWZpbmVkIHRoZSBzeW50YXggdG8gdXNlIHdoaWNoIHRoaXMg bWF0Y2hpbmcgcnVsZS4gV2hlbiB0aGlzIGZpZWxkIGlzIGFic2VudCwgdGhlIHN5bnRheCBp cyBkZWZpbmVkIGJ5IHRoZSBhdHRyaWJ1dGUgdHlwZTsgd2hlbiB0aGlzIGZpZWxkIGlzIHBy ZXNlbnQsIGl0IHNoYWxsIGJlIGNvbXBhdGlibGUgd2hpY2ggJkFzc2VydGlvblR5cGUgZmll bGRzIG9mIHBvc3NpYmxlIHBhcmVudCBtYXRjaGluZyBydWxlcyAoZm9yIGV4YW1wbGUgaXQg Y2FuIGJlIGEgcmVzdHJpY3Rpb24gb2YgJkFzc2VydGlvblR5cGUgb2YgcGFyZW50IG1hdGNo aW5nIHJ1bGVzKTsNYW4gdW5pcXVlIG9iamVjdCBpZGVudGlmaWVyICgmaWQgZmllbGQpLg1N QVRDSElORy1SVUxFIDo6PSBDTEFTUyB7DSZQYXJlbnRNYXRjaGluZ1J1bGVzCU1BVENISU5H LVJVTEUgT1BUSU9OQUwsDSZBc3NlcnRpb25UeXBlCQlPUFRJT05BTCwNJmlkCQkJCU9CSkVD VCBJREVOVElGSUVSIFVOSVFVRX0NV0lUSCBTWU5UQVggew1bUEFSRU5UICZQYXJlbnRNYXRj aGluZ1J1bGVzXQ1bU1lOVEFYICZBc3NlcnRpb25UeXBlXQ1JRCAmaWR9DWNvbnRlbnRUeXBl IGF0dHJpYnV0ZQ0NVGhlIGNvbnRlbnRUeXBlIGF0dHJpYnV0ZSBpcyB1c2VkIHRvIHRyYW5z bWl0IHRoZSBjb250ZW50VHlwZSBvZiBhIENNUyBDb250ZW50SW5mbyB2YWx1ZS4NYWEtY29u dGVudFR5cGUgQVRUUklCVVRFIDo6PQ17IFRZUEUgQ29udGVudFR5cGUgSURFTlRJRklFRCBC WSBpZC1jb250ZW50VHlwZSB9DWlkLWNvbnRlbnRUeXBlIE9CSkVDVCBJREVOVElGSUVSIDo6 PSB7IGlzbygxKSBtZW1iZXItYm9keSgyKQ11cyg4NDApIHJzYWRzaSgxMTM1NDkpIHBrY3Mo MSkgcGtjczkoOSkgMyB9DW1lc3NhZ2VEaWdlc3QgYXR0cmlidXRlDVRoZSBtZXNzYWdlRGln ZXN0IGF0dHJpYnV0ZSBpcyB1c2VkIHRvIHRyYW5zbWl0IHRoZSBtZXNzYWdlRGlnZXN0IG9m IGEgQ01TIE1lc3NhZ2UuIEZvciBTaWduZWREYXRhLCB0aGlzIGF0dHJpYnV0ZSBzaGFsbCBi ZSBwcmVzZW50IGlmIHRoZXJlIGFyZSBzaWduZWQgYXR0cmlidXRlcyBhbmQgaXMgY29tcHV0 ZWQgd2l0aCBzaWduZXKScyBtZXNzYWdlIGRpZ2VzdCBhbGdvcml0aG0uIEZvciBBdXRoZW50 aWNhdGVkRGF0YSwgdGhpcyBhdHRyaWJ1dGUgc2hhbGwgYmUgcHJlc2VudCBpZiB0aGVyZSBh cmUgYXV0aGVudGljYXRlZCBhdHRyaWJ1dGVzIGFuZCBpcyBjb21wdXRlZCB3aXRoIHRoZSBv cmlnaW5hdG9yknMgbWVzc2FnZSBkaWdlc3QgYWxnb3JpdGhtLiBUaGUgbWVzc2FnZSBkaWdl c3QgaXMgdGhlIG9jdGV0IHN0cmluZyB3aGljaCBpcyB0aGUgcmVzdWx0IG9mIHRoZSBoYXNo IGFsZ29yaXRobS4gVGhlIG1lc3NhZ2UtZGlnZXN0IGF0dHJpYnV0ZSBpcyBjb21wdXRlZCBv biB0aGUgY29udGVudCB3aGljaCBpcyByZXByZXNlbnRlZCBieSB0aGUgZUNvbnRlbnQgY29t cG9uZW50IG9mIHRoZSBlbmNhcENvbnRlbnRJbmZvIGNvbXBvbmVudC4gT25seSB0aGUgY29u dGVudCBwYXJ0IG9mIHRoaXMgb2N0ZXQgc3RyaW5nIGVuY29kaW5nIGlzIHVzZWQgKHRoZSB0 YWcgYW5kIGxlbmd0aCBmaWVsZHMgYXJlIG9taXR0ZWQpLg1hYS1tZXNzYWdlRGlnZXN0IEFU VFJJQlVURSA6Oj0NeyBUWVBFIE1lc3NhZ2VEaWdlc3QgSURFTlRJRklFRCBCWSBpZC1tZXNz YWdlRGlnZXN0fQ1NZXNzYWdlRGlnZXN0IDo6PSBPQ1RFVCBTVFJJTkcNDWlkLW1lc3NhZ2VE aWdlc3QgT0JKRUNUIElERU5USUZJRVIgOjo9IHsgaXNvKDEpIG1lbWJlci1ib2R5KDIpDXVz KDg0MCkgcnNhZHNpKDExMzU0OSkgcGtjcygxKSBwa2NzOSg5KSA0IH0Nc2lnbmluZ1RpbWUg YXR0cmlidXRlDVRoZSBzaWduaW5nVGltZSBhdHRyaWJ1dGUgaXMgdXNlZCB0byB0cmFuc21p dCB0aGUgdGltZSBvZiBzaWduYXR1cmUuV2hlbiB0aGUgdXRjVGltZSBhbHRlcm5hdGl2ZSBv ZiBUaW1lIGlzIHVzZWQsIHRoZSB5ZWFyIGZpZWxkIHNoYWxsIGJlIGludGVycHJldGVkIGFz IGZvbGxvd3M6DWlmIGl0IGlzIGdyZWF0ZXIgdGhhbiBvciBlcXVhbCA1MCwgMTkwMCBzaGFs bCBiZSBhZGRlZDsNaWYgaXMgaXMgbGVzcyB0aGFuIDUwLCAyMDAwIHNoYWxsIGJlIGFkZGVk Lg1hYS1zaWduaW5nVGltZSBBVFRSSUJVVEUgOjo9DXsgVFlQRSBTaWduaW5nVGltZSBJREVO VElGSUVEIEJZIGlkLXNpZ25pbmdUaW1lIH0NU2lnbmluZ1RpbWUgIDo6PSBUaW1lDVRpbWUg Ojo9IENIT0lDRSB7DXV0Y1RpbWUgVVRDVGltZSwNZ2VuZXJhbFRpbWUgR2VuZXJhbGl6ZWRU aW1lIH0NDWlkLXNpZ25pbmdUaW1lIE9CSkVDVCBJREVOVElGSUVSIDo6PSB7IGlzbygxKSBt ZW1iZXItYm9keSgyKQ11cyg4NDApIHJzYWRzaSgxMTM1NDkpIHBrY3MoMSkgcGtjczkoOSkg NSB9DWNvdW50ZXJTaWduYXR1cmUgYXR0cmlidXRlDVRoZSBjb3VudGVyc2lnbmF0dXJlIGNh biBiZSB1c2VkIHRvIHNwZWNpZnkgb25lIG9yIG1vcmUgc2lnbmF0dXJlcyBvZiB0aGUgc2ln bmF0dXJlIGNvbXBvbmVudCBvZiBhIFNpZ25lckluZm8gdmFsdWUgKG9ubHkgdGhlIGNvbnRl bnQgcGFydCwgb2N0ZXQgc3RyaW5nLCBvZiB0aGUgc2lnbmF0dXJlIGlzIHVzZWQsIHRoZSB0 YWcgYW5kIGxlbmd0aCBhcmUgbm90IHVzZWQpLiBUaGlzIGF0dHJpYnV0ZSBzaGFsbCBvbmx5 IGJlIHVzZWQgYXMgYW4gdW5zaWduZWQgYXR0cmlidXRlLg1hYS1jb3VudGVyc2lnbmF0dXJl IEFUVFJJQlVURSA6Oj0NeyBUWVBFIENvdW50ZXJzaWduYXR1cmUgSURFTlRJRklFRCBCWSBp ZC1jb3VudGVyc2lnbmF0dXJlIH0NQ291bnRlcnNpZ25hdHVyZSA6Oj0gU2lnbmVySW5mbw1p ZC1jb3VudGVyc2lnbmF0dXJlIE9CSkVDVCBJREVOVElGSUVSIDo6PSB7IGlzbygxKSBtZW1i ZXItYm9keSgyKQ11cyg4NDApIHJzYWRzaSgxMTM1NDkpIHBrY3MoMSkgcGtjczkoOSkgNiB9 DXNpZ25jcnlwdGVkUGFydHMgYXR0cmlidXRlDVRoZSBzaWduY3J5cHRlZFBhcnRzIGF0dHJp YnV0ZSBpcyB1c2VkIHRvIGlkZW50aWZ5IHRoZSBzaWduY3J5cHRlZCBwYXJ0cyBvZiBhIHNp Z25jcnlwdGVkIG1lc3NhZ2UuDWFhLXNpZ25jcnlwdGVkUGFydHMJQVRUUklCVVRFIDo6PSAN eyBUWVBFIFNpZ25jcnlwdGVkUGFydHMgSURFTlRJRklFRCBCWSBpZC1zaWduY3J5cHRlZFBh cnRzfQ1pZC1zaWduY3J5cHRlZFBhcnRzCU9CSkVDVCBJREVOVElGSUVSIDo6PSB7aXR1LXQg cmVjb21tZW5kYXRpb25zKDApIHgoMjQpIGNtcyg4OTQpIA1zaWduY3J5cHRpb24oMSkgYXR0 cmlidXRlcygxKSBzaWduY3J5cHRlZFBhcnRzKDB9DQ0NQW5uZXggQQsLQVNOLjEgbW9kdWxl DShUaGlzIGFubmV4IGZvcm1zIGFuIGludGVncmFsIHBhcnQgb2YgdGhpcyBSZWNvbW1lbmRh dGlvbiB8IEludGVybmF0aW9uYWwgU3RhbmRhcmQuKQ0NQ01TIHtpdHUtdCByZWNvbW1lbmRh dGlvbigwKSB4KDI0KSBjbXMoODk0KSBtb2R1bGUoMCkgdmVyc2lvbjEoMSl9DSIvSVRVLVQv UmVjb21tZW5kYXRpb24vWC9DTVMvTW9kdWxlL1ZlcnNpb24xIg1ERUZJTklUSU9OUyA6Oj0N QkVHSU4NSU1QT1JUUyBhdHRyaWJ1dGVDZXJ0aWZpY2F0ZURlZmluaXRpb25zLCBhdXRoZW50 aWNhdGlvbkZyYW1ld29yaywNY2VydGlmaWNhdGVFeHRlbnNpb25zLCBlbmhhbmNlZFNlY3Vy aXR5LGluZm9ybWF0aW9uRnJhbWV3b3JrLCBzZWxlY3RlZEF0dHJpYnV0ZVR5cGVzDQlGUk9N IFVzZWZ1bERlZmluaXRpb25zIHtqb2ludC1pc28taXR1LXQgZHMoNSkgbW9kdWxlKDEpDXVz ZWZ1bERlZmluaXRpb25zKDApIDd9DUF0dHJpYnV0ZUNlcnRpZmljYXRlLCBBdHRDZXJ0VmFs aWRpdHlQZXJpb2QsIElzc3VlclNlcmlhbA0JRlJPTSBBdHRyaWJ1dGVDZXJ0aWZpY2F0ZURl ZmluaXRpb25zIGF0dHJpYnV0ZUNlcnRpZmljYXRlRGVmaW5pdGlvbnMNQ2VydGlmaWNhdGUs IENlcnRpZmljYXRlTGlzdCwgQ2VydGlmaWNhdGVTZXJpYWxOdW1iZXIsIEVYVEVOU0lPTiwN U0lHTkVEe30sIEhBU0h7fQ0JRlJPTSBBdXRoZW50aWNhdGlvbkZyYW1ld29yayBhdXRoZW50 aWNhdGlvbkZyYW1ld29yaw1HZW5lcmFsTmFtZXMsS2V5VXNhZ2UNCUZST00gQ2VydGlmaWNh dGVFeHRlbnNpb25zIGNlcnRpZmljYXRlRXh0ZW5zaW9ucw1Jc3N1ZXJBbmRTZXJpYWxOdW1i ZXINCUZST00gRW5oYW5jZWRTZWN1cml0eSBlbmhhbmNlZFNlY3VyaXR5DVVuaXF1ZUlkZW50 aWZpZXINCUZST00gU2VsZWN0ZWRBdHRyaWJ1dGVUeXBlcyBzZWxlY3RlZEF0dHJpYnV0ZVR5 cGVzOw1pZC1kYXRhIAkJCQkJT0JKRUNUIElERU5USUZJRVIgOjo9IHtpc28oMSkgbWVtYmVy LWJvZHkoMikgdXMoODQwKQ0JcnNhZHNpKDExMzU0OSlwa2NzKDEpIHBrY3M3KDcpIDF9DWlk LXNpZ25lZERhdGEgCQlPQkpFQ1QgSURFTlRJRklFUiA6Oj0ge2lzbygxKSBtZW1iZXItYm9k eSgyKQ11cyg4NDApcnNhZHNpKDExMzU0OSkgcGtjcygxKSBwa2NzNyg3KSAyfQ1pZC1lbnZl bG9wZWREYXRhIAlPQkpFQ1QgSURFTlRJRklFUiA6Oj0ge2lzbygxKSBtZW1iZXItYm9keSgy KSB1cyg4NDApDXJzYWRzaSgxMTM1NDkpIHBrY3MoMSkgcGtjczcoNykgM30NaWQtZGlnZXN0 ZWREYXRhIAlPQkpFQ1QgSURFTlRJRklFUiA6Oj0ge2lzbygxKSBtZW1iZXItYm9keSgyKSB1 cyg4NDApCQkNcnNhZHNpKDExMzU0OSkgcGtjcygxKSBwa2NzNyg3KSA1fQ1pZC1lbmNyeXB0 ZWREYXRhIAlPQkpFQ1QgSURFTlRJRklFUiA6Oj0ge2lzbygxKSBtZW1iZXItYm9keSgyKSB1 cyg4NDApDXJzYWRzaSgxMTM1NDkpIHBrY3MoMSkgcGtjczcoNykgNn0NaWQtY3QtYXV0aERh dGEgCQlPQkpFQ1QgSURFTlRJRklFUiA6Oj0ge2lzbygxKSBtZW1iZXItYm9keSgyKSB1cyg4 NDApCQ1yc2Fkc2koMTEzNTQ5KSBwa2NzKDEpIHBrY3MtOSg5KSBzbWltZSgxNikgY3QoMSkg Mn0NaWQtc2lnbmNyeXB0ZWREYXRhIAlPQkpFQ1QgSURFTlRJRklFUiA6Oj0ge2l0dS10IHJl Y29tbWVuZGF0aW9uKDApIHgoMjQpDWNtcyg4OTQpIHNpZ25jcnlwdGlvbigxKSBkYXRhKDAp fQ1Db250ZW50SW5mbyA6Oj0gU0VRVUVOQ0Ugew1jb250ZW50VHlwZQkJQ09OVEVOVC1UWVBF LiZpZCh7Q29udGVudFNldH0pLA1jb250ZW50CQlbMF0gRVhQTElDSVQgQ09OVEVOVC1UWVBF LiZUeXBlDQkJCQkJKHtDb250ZW50U2V0fXtAY29udGVudFR5cGV9KQ19DUNPTlRFTlQtVFlQ RSA6Oj0gVFlQRS1JREVOVElGSUVSDUNvbnRlbnRUeXBlIDo6PSBDT05URU5ULVRZUEUuJmlk DUNvbnRlbnRTZXQgQ09OVEVOVC1UWVBFIDo6PSB7DWN0LURhdGEgfA1jdC1TaWduZWREYXRh IHwNY3QtRW52ZWxvcGVkRGF0YSAgfA1jdC1EaWdlc3RlZERhdGEgfA1jdC1FbmNyeXB0ZWRE YXRhIHwNY3QtQXV0aGVudGljYXRlZERhdGEgfA1jdC1TaWduY3J5cHRlZERhdGEsDS4uLn0N Y3QtRGF0YQkJCQkJCUNPTlRFTlQtVFlQRSA6Oj0ge09DVEVUIFNUUklORyBJREVOVElGSUVE IEJZIGlkLWRhdGF9DWN0LVNpZ25lZERhdGEgCQkJQ09OVEVOVC1UWVBFIDo6PSB7U2lnbmVk RGF0YSBJREVOVElGSUVEIEJZIGlkLXNpZ25lZERhdGF9DWN0LUVudmVsb3BlZERhdGEJQ09O VEVOVC1UWVBFIDo6PSB7RW52ZWxvcGVkRGF0YSBJREVOVElGSUVEIEJZIGlkLWVudmVsb3Bl ZERhdGF9DWN0LURpZ2VzdGVkRGF0YQkJQ09OVEVOVC1UWVBFIDo6PSB7RGlnZXN0ZWREYXRh IElERU5USUZJRUQgQlkgaWQtZGlnZXN0ZWREYXRhfQkNY3QtRW5jcnlwdGVkRGF0YQlDT05U RU5ULVRZUEUgOjo9IHtFbmNyeXB0ZWREYXRhIElERU5USUZJRUQgQlkgaWQtZW5jcnlwdGVk RGF0YX0JDWN0LUF1dGhlbnRpY2F0ZWREYXRhCUNPTlRFTlQtVFlQRSA6Oj0ge0F1dGhlbnRp Y2F0ZWREYXRhIElERU5USUZJRUQgQlkgaWQtY3QtYXV0aERhdGF9CQ1jdC1TaWduY3J5cHRl ZERhdGEJQ09OVEVOVC1UWVBFIDo6PSB7U2lnbmNyeXB0ZWREYXRhIElERU5USUZJRUQgQlkg aWQtc2lnbmNyeXB0ZWREYXRhfQkNQ01TVmVyc2lvbiA6Oj0gSU5URUdFUiB7djAoMCksIHYx KDEpLCB2MigyKSwgdjMoMyksIHY0KDQpLCB2NSg1KSwgdjYoNil9KDAuLk1BWCkNU2lnbmVk RGF0YSA6Oj0gU0VRVUVOQ0UgIHsNdmVyc2lvbgkJQ01TVmVyc2lvbiwNZGlnZXN0QWxnb3Jp dGhtcyAJU0VUIE9GIERpZ2VzdEFsZ29yaXRobUlkZW50aWZpZXIsDWVuY2FwQ29udGVudElu Zm8JRW5jYXBzdWxhdGVkQ29udGVudEluZm8sDWNlcnRpZmljYXRlcwlbMF0JW1hFUjpCQVNF NjRdIE9DVEVUIFNUUklORw0JCQkJCShDT05UQUlOSU5HIENlcnRpZmljYXRlU2V0KSBPUFRJ T05BTCwNY3JscwkJCVsxXQlbWEVSOkJBU0U2NF0gT0NURVQgU1RSSU5HDQkJCQkJKENPTlRB SU5JTkcgUmV2b2NhdGlvbkluZm9DaG9pY2VzKSBPUFRJT05BTCwNc2lnbmVySW5mb3MJCVNp Z25lckluZm9zIA19DUNlcnRpZmljYXRlU2V0IDo6PSBTRVFVRU5DRSBPRiBDZXJ0aWZpY2F0 ZUNob2ljZQ1DZXJ0aWZpY2F0ZUNob2ljZSA6Oj0gQ0hPSUNFIHsNY2VydGlmaWNhdGUgCQlD ZXJ0aWZpY2F0ZSwNLi4uLA1bWzQ6IHYyQXR0ckNlcnQgCQlbMl0gSU1QTElDSVQgQXR0cmli dXRlQ2VydGlmaWNhdGVWMl1dLA1bWzU6IG90aGVyICAgICAgCQlbM10gSU1QTElDSVQgT3Ro ZXJDZXJ0aWZpY2F0ZUZvcm1hdF1dIA19DUF0dHJpYnV0ZUNlcnRpZmljYXRlVjIgOjo9IEF0 dHJpYnV0ZUNlcnRpZmljYXRlDU9USEVSLUNFUlQtRk1UCTo6PSBUWVBFLUlERU5USUZJRVIN T3RoZXJDZXJ0aWZpY2F0ZUZvcm1hdCA6Oj0gU0VRVUVOQ0Ugew1vdGhlckNlcnRGb3JtYXQJ T1RIRVItQ0VSVC1GTVQuJmlkKHtTdXBwb3J0ZWRDZXJ0Rm9ybWF0c30pLA1vdGhlckNlcnQJ CU9USEVSLUNFUlQtRk1ULiZUeXBlDQkoe1N1cHBvcnRlZENlcnRGb3JtYXRzfXtAb3RoZXJD ZXJ0Rm9ybWF0fSl9DVN1cHBvcnRlZENlcnRGb3JtYXRzIE9USEVSLUNFUlQtRk1UIDo6PSB7 IC4uLiB9DVJldm9jYXRpb25JbmZvQ2hvaWNlcyA6Oj0gU0VRVUVOQ0UgT0YgUmV2b2NhdGlv bkluZm9DaG9pY2UNUmV2b2NhdGlvbkluZm9DaG9pY2UgOjo9IENIT0lDRSB7DWNybAkJCQlD ZXJ0aWZpY2F0ZUxpc3QsDS4uLiwNW1s1OiBvdGhlciAJWzFdCUlNUExJQ0lUIE90aGVyUmV2 b2NhdGlvbkluZm9Gb3JtYXQgXV0gDX0NT1RIRVItUkVWT0stSU5GTyA6Oj0gVFlQRS1JREVO VElGSUVSDU90aGVyUmV2b2NhdGlvbkluZm9Gb3JtYXQgOjo9IFNFUVVFTkNFIHsNb3RoZXJS ZXZJbmZvRm9ybWF0CU9USEVSLVJFVk9LLUlORk8uJmlkKHtTdXBwb3J0ZWRPdGhlclJldm9r SW5mb30pLA1vdGhlclJldkluZm8JT1RIRVItUkVWT0stSU5GTy4mVHlwZQ0JKHtTdXBwb3J0 ZWRPdGhlclJldm9rSW5mb317QG90aGVyUmV2SW5mb0Zvcm1hdH0pDX0NU3VwcG9ydGVkT3Ro ZXJSZXZva0luZm8gT1RIRVItUkVWT0stSU5GTyA6Oj0geyAuLi4gfQ1FbmNhcHN1bGF0ZWRD b250ZW50SW5mbyA6Oj0gU0VRVUVOQ0Ugew1lQ29udGVudFR5cGUJQ09OVEVOVC1UWVBFLiZp ZCh7Q29udGVudFNldH0pLA1lQ29udGVudAkJWzBdIEVYUExJQ0lUIE9DVEVUIFNUUklORw0J CQkJCShDT05UQUlOSU5HIENPTlRFTlQtVFlQRS4mVHlwZQ0JCQkJCSh7Q29udGVudFNldH17 QGVDb250ZW50VHlwZX0pKSBPUFRJT05BTA19DVNpZ25lckluZm9zIDo6PSBTRVQgT0YgU2ln bmVySW5mbw1TaWduZXJJbmZvIDo6PSBTRVFVRU5DRSB7DXZlcnNpb24JCUNNU1ZlcnNpb24s DXNpZAkJCQlTaWduZXJJZGVudGlmaWVyLA1kaWdlc3RBbGdvcml0aG0JRGlnZXN0QWxnb3Jp dGhtSWRlbnRpZmllciwNc2lnbmVkQXR0cnMJCVswXQlJTVBMSUNJVCBTaWduZWRBdHRyaWJ1 dGVzIE9QVElPTkFMLA1zaWduYXR1cmVBbGdvcml0aG0JU2lnbmF0dXJlQWxnb3JpdGhtSWRl bnRpZmllciwNc2lnbmF0dXJlCQlTaWduYXR1cmVWYWx1ZSwNdW5zaWduZWRBdHRycwlbMV0J SU1QTElDSVQgQXR0cmlidXRlc3t7VW5zaWduZWRBdHRyaWJ1dGVzfX0NCQkJCU9QVElPTkFM DX0NRElHRVNULUFMR09SSVRITSA6Oj0gQ0xBU1Mgew0maWQJCQkJT0JKRUNUIElERU5USUZJ RVIgVU5JUVVFLA0mUGFyYW1zCQlPUFRJT05BTCwNJnBhcmFtUHJlc2VuY2UJUGFyYW1PcHRp b25zIERFRkFVTFQgYWJzZW50DX0gDVdJVEggU1lOVEFYIHsNSURFTlRJRklFUgkJJmlkDVtQ QVJBTVMJCVtUWVBFICZQYXJhbXNdIEFSRSAmcGFyYW1QcmVzZW5jZSBdDX0NUGFyYW1PcHRp b25zCTo6PSBFTlVNRVJBVEVEIHsNcmVxdWlyZWQsCQktLSBQYXJhbWV0ZXJzIHNoYWxsIGJl IGVuY29kZWQgaW4gc3RydWN0dXJlDXByZWZlcnJlZFByZXNlbnQsCS0tIFBhcmFtZXRlcnMg c2hvdWxkIGJlIGVuY29kZWQgaW4gc3RydWN0dXJlDXByZWZlcnJlZEFic2VudCwJLS0gUGFy YW1ldGVycyBzaG91bGQgbm90IGJlIGVuY29kZWQgaW4gc3RydWN0dXJlDWFic2VudCwJCS0t IFBhcmFtZXRlcnMgc2hhbGwgbm90IGJlIGVuY29kZWQgaW4gc3RydWN0dXJlDWluaGVyaXRh YmxlLAktLSBQYXJhbWV0ZXJzIGFyZSBpbmhlcml0ZWQgaWYgbm90IHByZXNlbnQNb3B0aW9u YWwsCQktLSBQYXJhbWV0ZXJzIG1heSBiZSBlbmNvZGVkIGluIHRoZSBzdHJ1Y3R1cmUNLi4u DX0NQWxnb3JpdGhtSWRlbnRpZmllcntBTEdPUklUSE0tVFlQRSxBTEdPUklUSE0tVFlQRTpB bGdvcml0aG1TZXR9IDo6PSBTRVFVRU5DRSB7DWFsZ29yaXRobQkJQUxHT1JJVEhNLVRZUEUu JmlkKHtBbGdvcml0aG1TZXR9KSwNcGFyYW1ldGVycwkJQUxHT1JJVEhNLVRZUEUuJlBhcmFt cw0JCQkJCSh7QWxnb3JpdGhtU2V0fXtAYWxnb3JpdGhtfSkgT1BUSU9OQUwgfQ1EaWdlc3RB bGdvcml0aG1JZGVudGlmaWVyIDo6PSBBbGdvcml0aG1JZGVudGlmaWVyDXtESUdFU1QtQUxH T1JJVEhNLCB7RGlnZXN0QWxnb3JpdGhtU2V0fX0NRGlnZXN0QWxnb3JpdGhtU2V0IAlESUdF U1QtQUxHT1JJVEhNIDo6PSB7TWVzc2FnZURpZ2VzdEFsZ3MsIC4uLiB9DU1lc3NhZ2VEaWdl c3RBbGdzIAlESUdFU1QtQUxHT1JJVEhNIDo6PSB7DW1kYS1zaGEyNTYgfA1tZGEtc2hhMzg0 IHwNbWRhLXNoYTUxMiB8DW1kYS1zaGEyMjQgfA1tZGEtc2hhNTEyLTIyNCB8DW1kYS1zaGE1 MTItMjU2fQ1tZGEtc2hhMjU2IAkJRElHRVNULUFMR09SSVRITSA6Oj0gew0JCQlJREVOVElG SUVSCQlpZC1zaGEyNTYNUEFSQU1TCQlUWVBFIE5VTEwgQVJFIHByZWZlcnJlZEFic2VudA19 DWlkLXNoYTI1NiAJCQlPQkpFQ1QgSURFTlRJRklFUiA6Oj0gew1qb2ludC1pc28taXR1LXQo MikgY291bnRyeSgxNikgdXMoODQwKSBvcmdhbml6YXRpb24oMSkgZ292KDEwMSkgY3Nvcigz KSBuaXN0QWxnb3JpdGhtKDQpIGhhc2hBbGdzKDUpIHNoYTI1NigxKX0NbWRhLXNoYTM4NCAJ CURJR0VTVC1BTEdPUklUSE0gOjo9IHsNSURFTlRJRklFUgkJaWQtc2hhMzg0DVBBUkFNUwkJ VFlQRSBOVUxMIEFSRSBwcmVmZXJyZWRBYnNlbnQNfQ1pZC1zaGEzODQgCQkJT0JKRUNUIElE RU5USUZJRVIgOjo9IHsNam9pbnQtaXNvLWl0dS10KDIpIGNvdW50cnkoMTYpIHVzKDg0MCkg b3JnYW5pemF0aW9uKDEpIGdvdigxMDEpIGNzb3IoMykgbmlzdEFsZ29yaXRobSg0KSBoYXNo QWxncyg1KSBzaGEzODQoMil9DW1kYS1zaGE1MTIgCQlESUdFU1QtQUxHT1JJVEhNIDo6PSB7 DUlERU5USUZJRVIJCWlkLXNoYTUxMg1QQVJBTVMJCVRZUEUgTlVMTCBBUkUgcHJlZmVycmVk QWJzZW50DX0NaWQtc2hhNTEyIAkJCU9CSkVDVCBJREVOVElGSUVSIDo6PSB7DWpvaW50LWlz by1pdHUtdCgyKSBjb3VudHJ5KDE2KSB1cyg4NDApIG9yZ2FuaXphdGlvbigxKSBnb3YoMTAx KSBjc29yKDMpIG5pc3RBbGdvcml0aG0oNCkgaGFzaEFsZ3MoNSkgc2hhNTEyKDMpfQ1tZGEt c2hhMjI0IAkJRElHRVNULUFMR09SSVRITSA6Oj0gew1JREVOVElGSUVSCQlpZC1zaGEyMjQN UEFSQU1TCQlUWVBFIE5VTEwgQVJFIHByZWZlcnJlZEFic2VudA19DWlkLXNoYTIyNCAJCQlP QkpFQ1QgSURFTlRJRklFUiA6Oj0gew1qb2ludC1pc28taXR1LXQoMikgY291bnRyeSgxNikg dXMoODQwKSBvcmdhbml6YXRpb24oMSkgZ292KDEwMSkgY3NvcigzKSBuaXN0QWxnb3JpdGht KDQpIGhhc2hBbGdzKDUpIHNoYTIyNCg0KX0NbWRhLXNoYTUxMi0yMjQgRElHRVNULUFMR09S SVRITSA6Oj0gew1JREVOVElGSUVSCQlpZC1zaGE1MTItMjI0DVBBUkFNUwkJVFlQRSBOVUxM IEFSRSBwcmVmZXJyZWRBYnNlbnQNfQ1pZC1zaGE1MTItMjI0IE9CSkVDVCBJREVOVElGSUVS IDo6PSB7DWpvaW50LWlzby1pdHUtdCgyKSBjb3VudHJ5KDE2KSB1cyg4NDApIG9yZ2FuaXph dGlvbigxKSBnb3YoMTAxKSBjc29yKDMpIG5pc3RBbGdvcml0aG0oNCkgaGFzaEFsZ3MoNSkg c2hhNTEyLTIyNCg1KX0NbWRhLXNoYTUxMi0yNTYgRElHRVNULUFMR09SSVRITSA6Oj0gew1J REVOVElGSUVSCQlpZC1zaGE1MTItMjU2DVBBUkFNUwkJVFlQRSBOVUxMIEFSRSBwcmVmZXJy ZWRBYnNlbnQNfQ1pZC1zaGE1MTItMjU2IE9CSkVDVCBJREVOVElGSUVSIDo6PSB7DWpvaW50 LWlzby1pdHUtdCgyKSBjb3VudHJ5KDE2KSB1cyg4NDApIG9yZ2FuaXphdGlvbigxKSBnb3Yo MTAxKSBjc29yKDMpIG5pc3RBbGdvcml0aG0oNCkgaGFzaEFsZ3MoNSkgc2hhNTEyLTI1Nig2 KX0NU2lnbmVkQXR0cmlidXRlcyA6Oj0gQXR0cmlidXRlcyB7eyBTaWduZWRBdHRyaWJ1dGVz U2V0IH19DUF0dHJpYnV0ZXMgeyBBVFRSSUJVVEU6QXR0ckxpc3QgfSA6Oj0gU0VUIFNJWkUg KDEuLk1BWCkgT0YgQXR0cmlidXRlIHt7IEF0dHJMaXN0IH19DUF0dHJpYnV0ZXsgQVRUUklC VVRFOkF0dHJMaXN0IH0gOjo9IFNFUVVFTkNFIHsNYXR0clR5cGUJQVRUUklCVVRFLiZpZCh7 QXR0ckxpc3R9KSwNYXR0clZhbHVlcwlTRVQgT0YgQVRUUklCVVRFLiZUeXBlKHtBdHRyTGlz dH17QGF0dHJUeXBlfSkgIA19DVNpZ25lZEF0dHJpYnV0ZXNTZXQgCUFUVFJJQlVURSA6Oj0N CQkJeyBhYS1zaWduaW5nVGltZSB8IGFhLW1lc3NhZ2VEaWdlc3QgfCBhYS1jb250ZW50VHlw ZSwgLi4uIH0NVW5zaWduZWRBdHRyaWJ1dGVzIAlBVFRSSUJVVEUgOjo9IHsgYWEtY291bnRl cnNpZ25hdHVyZSwgLi4uIH0NYWEtY291bnRlcnNpZ25hdHVyZSAJQVRUUklCVVRFIDo6PQ17 IFRZUEUgQ291bnRlcnNpZ25hdHVyZSBJREVOVElGSUVEIEJZIGlkLWNvdW50ZXJzaWduYXR1 cmUgfQ1Db3VudGVyc2lnbmF0dXJlIDo6PSBTaWduZXJJbmZvDWlkLWNvdW50ZXJzaWduYXR1 cmUgT0JKRUNUIElERU5USUZJRVIgOjo9IA17IGlzbygxKSBtZW1iZXItYm9keSgyKSB1cyg4 NDApIHJzYWRzaSgxMTM1NDkpIHBrY3MoMSkgcGtjczkoOSkgNiB9DVNpZ25hdHVyZUFsZ29y aXRobUlkZW50aWZpZXIgOjo9IEFsZ29yaXRobUlkZW50aWZpZXINe1NJR05BVFVSRS1BTEdP UklUSE0sIHtTaWduYXR1cmVBbGdvcml0aG1TZXR9fQ1TSUdOQVRVUkUtQUxHT1JJVEhNIDo6 PSBDTEFTUyB7DSZpZAkJCQlPQkpFQ1QgSURFTlRJRklFUiBVTklRVUUsDSZWYWx1ZQkJT1BU SU9OQUwsDSZQYXJhbXMJCU9QVElPTkFMLA0mcGFyYW1QcmVzZW5jZQlQYXJhbU9wdGlvbnMg REVGQVVMVCBhYnNlbnQsDSZIYXNoU2V0CQlESUdFU1QtQUxHT1JJVEhNIE9QVElPTkFMLA0m UHVibGljS2V5U2V0CVBVQkxJQy1LRVkgT1BUSU9OQUwsDSZzbWltZUNhcHMJCVNNSU1FLUNB UFMgT1BUSU9OQUwNfSANV0lUSCBTWU5UQVggew1JREVOVElGSUVSIAkJJmlkDVtWQUxVRSAJ CSZWYWx1ZV0NW1BBUkFNUyAJCVtUWVBFICZQYXJhbXNdIEFSRSAmcGFyYW1QcmVzZW5jZSBd DVtIQVNIRVMgCQkmSGFzaFNldF0NW1BVQkxJQy1LRVlTIAkmUHVibGljS2V5U2V0XQ1bU01J TUUtQ0FQUyAJJnNtaW1lQ2Fwc10NfQ1TaWduYXR1cmVBbGdvcml0aG1TZXQgU0lHTkFUVVJF LUFMR09SSVRITSA6Oj0geyAuLi4gfQ1TTUlNRS1DQVBTIDo6PSBDTEFTUyB7DSZpZAkJCU9C SkVDVCBJREVOVElGSUVSIFVOSVFVRSwNJlR5cGUJCU9QVElPTkFMDX0NV0lUSCBTWU5UQVgg ew1bVFlQRSAmVHlwZV0gSURFTlRJRklFRCBCWSAmaWQgDX0NUFVCTElDLUtFWSA6Oj0gQ0xB U1Mgew0maWQJCQkJT0JKRUNUIElERU5USUZJRVIgVU5JUVVFLA0mS2V5VmFsdWUJCU9QVElP TkFMLA0mUGFyYW1zCQlPUFRJT05BTCwNJnBhcmFtUHJlc2VuY2UJUGFyYW1PcHRpb25zIERF RkFVTFQgYWJzZW50LA0ma2V5VXNhZ2UJCUtleVVzYWdlIE9QVElPTkFMLA0mUHJpdmF0ZUtl eQkJT1BUSU9OQUwNfSANV0lUSCBTWU5UQVggew1JREVOVElGSUVSCQkmaWQNW0tFWQkJCSZL ZXlWYWx1ZV0NW1BBUkFNUwkJW1RZUEUgJlBhcmFtc10gQVJFICZwYXJhbVByZXNlbmNlXQ1b Q0VSVC1LRVktVVNBR0UJJmtleVVzYWdlXQ1bUFJJVkFURS1LRVkJJlByaXZhdGVLZXldDX0N cGstZHNhIFBVQkxJQy1LRVkgOjo9IHsNSURFTlRJRklFUiAJCWlkLWRzYQ1LRVkgCQkJRFNB UHVibGljS2V5DVBBUkFNUyAJCVRZUEUgRFNBLVBhcmFtcyBBUkUgaW5oZXJpdGFibGUNQ0VS VC1LRVktVVNBR0UgCXsgZGlnaXRhbFNpZ25hdHVyZSwgY29udGVudENvbW1pdG1lbnQsIGtl eUNlcnRTaWduLCBjUkxTaWduIH0NfQ1pZC1kc2EgT0JKRUNUIElERU5USUZJRVIgOjo9IHsN aXNvKDEpIG1lbWJlci1ib2R5KDIpIHVzKDg0MCkgeDktNTcoMTAwNDApIHg5YWxnb3JpdGht KDQpIDEgfQ1EU0EtUGFyYW1zIDo6PSBTRVFVRU5DRSB7DXAJCUlOVEVHRVIsDXEJCUlOVEVH RVIsDWcJCUlOVEVHRVINfQ1EU0FQdWJsaWNLZXkgOjo9IElOVEVHRVIgLS0gIHB1YmxpYyBr ZXksIHkNU2lnbmF0dXJlVmFsdWUgOjo9IE9DVEVUIFNUUklORw1TaWduZXJJZGVudGlmaWVy IDo6PSBDSE9JQ0Ugew1pc3N1ZXJBbmRTZXJpYWxOdW1iZXIgSXNzdWVyQW5kU2VyaWFsTnVt YmVyLA0uLi4sDVtbMzogc3ViamVjdEtleUlkZW50aWZpZXIgWzBdIFN1YmplY3RLZXlJZGVu dGlmaWVyIF1dIH0NRW52ZWxvcGVkRGF0YSA6Oj0gU0VRVUVOQ0Ugew12ZXJzaW9uIAkJCUNN U1ZlcnNpb24sDW9yaWdpbmF0b3JJbmZvIAkJWzBdIElNUExJQ0lUIE9yaWdpbmF0b3JJbmZv IE9QVElPTkFMLA1yZWNpcGllbnRJbmZvcyAJCVJlY2lwaWVudEluZm9zLA1lbmNyeXB0ZWRD b250ZW50SW5mbyAJRW5jcnlwdGVkQ29udGVudEluZm8sDS4uLiwNW1syOiB1bnByb3RlY3Rl ZEF0dHJzIAlbMV0gSU1QTElDSVQgQXR0cmlidXRlcw17eyBVbnByb3RlY3RlZEF0dHJpYnV0 ZXMgfX0gT1BUSU9OQUwgXV0gDX0NT3JpZ2luYXRvckluZm8gOjo9IFNFUVVFTkNFIHsNY2Vy dHMgCVswXSBbWEVSOkJBU0U2NF0gT0NURVQgU1RSSU5HIA0JCQkoQ09OVEFJTklORyBDZXJ0 aWZpY2F0ZVNldCkgT1BUSU9OQUwsDWNybHMgCQlbMV0gW1hFUjpCQVNFNjRdIE9DVEVUIFNU UklORyANCQkJKENPTlRBSU5JTkcgUmV2b2NhdGlvbkluZm9DaG9pY2VzKSBPUFRJT05BTCAN fQ1SZWNpcGllbnRJbmZvcyA6Oj0gU0VUIFNJWkUgKDEuLk1BWCkgT0YgUmVjaXBpZW50SW5m bw1FbmNyeXB0ZWRDb250ZW50SW5mbyA6Oj0gU0VRVUVOQ0Ugew1jb250ZW50VHlwZSAgICAg ICAgCQlDT05URU5ULVRZUEUuJmlkKHtDb250ZW50U2V0fSksDWNvbnRlbnRFbmNyeXB0aW9u QWxnb3JpdGhtCUNvbnRlbnRFbmNyeXB0aW9uQWxnb3JpdGhtSWRlbnRpZmllciwNZW5jcnlw dGVkQ29udGVudCAgIAkJWzBdIElNUExJQ0lUIEVOQ1JZUFRFRCANCQl7Q09OVEVOVC1UWVBF LiZUeXBlKHtDb250ZW50U2V0fXtAY29udGVudFR5cGV9KX0gT1BUSU9OQUwgDX0NQ29udGVu dEVuY3J5cHRpb25BbGdvcml0aG1JZGVudGlmaWVyIDo6PSBBbGdvcml0aG1JZGVudGlmaWVy DXtDT05URU5ULUVOQ1JZUFRJT04sIHtDb250ZW50RW5jcnlwdGlvbkFsZ29yaXRobVNldH19 DUNvbnRlbnRFbmNyeXB0aW9uQWxnb3JpdGhtU2V0IENPTlRFTlQtRU5DUllQVElPTiA6Oj0N eyBDb250ZW50RW5jcnlwdGlvbkFsZ3MsIC4uLiB9DUNvbnRlbnRFbmNyeXB0aW9uQWxncyBD T05URU5ULUVOQ1JZUFRJT04gOjo9IHsNY2VhLWFlczEyOC1DQ00gfCBjZWEtYWVzMTkyLUND TSB8IGNlYS1hZXMyNTYtQ0NNIHwNY2VhLWFlczEyOC1HQ00gfCBjZWEtYWVzMTkyLUdDTSB8 IGNlYS1hZXMyNTYtR0NNLCAuLi59DWNlYS1hZXMxMjgtQ0NNIAlDT05URU5ULUVOQ1JZUFRJ T04gOjo9IHsNSURFTlRJRklFUiAJCWlkLWFlczEyOC1DQ00NUEFSQU1TIFRZUEUgCUNDTVBh cmFtZXRlcnMgQVJFIHJlcXVpcmVkDVNNSU1FLUNBUFMgCQl7IElERU5USUZJRUQgQlkgaWQt YWVzMTI4LUNDTSB9DX0NYWVzIAkJCQkJCU9CSkVDVCBJREVOVElGSUVSIDo6PQ17IGpvaW50 LWlzby1pdHUtdCgyKSBjb3VudHJ5KDE2KSB1cyg4NDApIG9yZ2FuaXphdGlvbigxKSBnb3Yo MTAxKQ0JY3NvcigzKSBuaXN0QWxnb3JpdGhtcyg0KSAgMSB9DWlkLWFlczEyOC1DQ00gCQlP QkpFQ1QgSURFTlRJRklFUiA6Oj0geyBhZXMgNyB9DWNlYS1hZXMxOTItQ0NNIAlDT05URU5U LUVOQ1JZUFRJT04gOjo9IHsNSURFTlRJRklFUiAJCWlkLWFlczE5Mi1DQ00NUEFSQU1TIFRZ UEUgCUNDTVBhcmFtZXRlcnMgQVJFIHJlcXVpcmVkDVNNSU1FLUNBUFMgCQl7IElERU5USUZJ RUQgQlkgaWQtYWVzMTkyLUNDTSB9DX0NaWQtYWVzMTkyLUNDTSAJCU9CSkVDVCBJREVOVElG SUVSIDo6PSB7IGFlcyAyNyB9DWNlYS1hZXMyNTYtQ0NNIAlDT05URU5ULUVOQ1JZUFRJT04g Ojo9IHsNSURFTlRJRklFUiAJCWlkLWFlczI1Ni1DQ00NUEFSQU1TIFRZUEUgCUNDTVBhcmFt ZXRlcnMgQVJFIHJlcXVpcmVkDVNNSU1FLUNBUFMgCQl7IElERU5USUZJRUQgQlkgaWQtYWVz MjU2LUNDTSB9DX0NaWQtYWVzMjU2LUNDTSAJCU9CSkVDVCBJREVOVElGSUVSIDo6PSB7IGFl cyA0NyB9DWNlYS1hZXMxMjgtR0NNIAlDT05URU5ULUVOQ1JZUFRJT04gOjo9IHsNSURFTlRJ RklFUiAJCWlkLWFlczEyOC1HQ00NUEFSQU1TIFRZUEUgCUdDTVBhcmFtZXRlcnMgQVJFIHJl cXVpcmVkDVNNSU1FLUNBUFMgCQl7IElERU5USUZJRUQgQlkgaWQtYWVzMTI4LUdDTSB9DX0N aWQtYWVzMTI4LUdDTSAJT0JKRUNUIElERU5USUZJRVIgOjo9IHsgYWVzIDYgfQ1jZWEtYWVz MTkyLUdDTSAJQ09OVEVOVC1FTkNSWVBUSU9OIDo6PSB7DUlERU5USUZJRVIgCQlpZC1hZXMx OTItR0NNDVBBUkFNUyBUWVBFIAlHQ01QYXJhbWV0ZXJzIEFSRSByZXF1aXJlZA1TTUlNRS1D QVBTIAkJeyBJREVOVElGSUVEIEJZIGlkLWFlczE5Mi1HQ00gfQ19DWlkLWFlczE5Mi1HQ00g CU9CSkVDVCBJREVOVElGSUVSIDo6PSB7IGFlcyAyNiB9DWNlYS1hZXMyNTYtR0NNIAlDT05U RU5ULUVOQ1JZUFRJT04gOjo9IHsNSURFTlRJRklFUiAJCWlkLWFlczI1Ni1HQ00NUEFSQU1T IFRZUEUgCUdDTVBhcmFtZXRlcnMgQVJFIHJlcXVpcmVkDVNNSU1FLUNBUFMgCQl7IElERU5U SUZJRUQgQlkgaWQtYWVzMjU2LUdDTSB9DX0NaWQtYWVzMjU2LUdDTSAJT0JKRUNUIElERU5U SUZJRVIgOjo9IHsgYWVzIDQ2IH0NQ0NNUGFyYW1ldGVycyA6Oj0gU0VRVUVOQ0Ugew1hZXMt bm9uY2UJCU9DVEVUIFNUUklORyAoU0laRSg3Li4xMykpLA1hZXMtSUNWbGVuCQlBRVMtQ0NN LUlDVmxlbiBERUZBVUxUIDEyIH0NQUVTLUNDTS1JQ1ZsZW4gOjo9IElOVEVHRVIgKDQgfCA2 IHwgOCB8IDEwIHwgMTIgfCAxNCB8IDE2KQ1HQ01QYXJhbWV0ZXJzIDo6PSBTRVFVRU5DRSB7 DWFlcy1ub25jZQkJT0NURVQgU1RSSU5HLCAtLSByZWNvbW1lbmRlZCBzaXplIGlzIDEyIG9j dGV0cw1hZXMtSUNWbGUJCUFFUy1HQ00tSUNWbGVuIERFRkFVTFQgMTIgfQ1BRVMtR0NNLUlD VmxlbiA6Oj0gSU5URUdFUiAoMTIgfCAxMyB8IDE0IHwgMTUgfCAxNikNQ09OVEVOVC1FTkNS WVBUSU9OIDo6PSBDTEFTUyB7DSZpZAkJCQlPQkpFQ1QgSURFTlRJRklFUiBVTklRVUUsDSZQ YXJhbXMJCU9QVElPTkFMLA0mcGFyYW1QcmVzZW5jZQlQYXJhbU9wdGlvbnMgREVGQVVMVCBh YnNlbnQsDSZzbWltZUNhcHMJCVNNSU1FLUNBUFMgT1BUSU9OQUwNfQ1XSVRIIFNZTlRBWCB7 DUlERU5USUZJRVIgCQkmaWQNW1BBUkFNUyAJCVtUWVBFICZQYXJhbXNdIEFSRSAmcGFyYW1Q cmVzZW5jZV0NW1NNSU1FLUNBUFMgCSZzbWltZUNhcHNdDX0NRU5DUllQVEVEIHtUb0JlRW5j cnlwdGVkfSA6Oj0gT0NURVQgU1RSSU5HICggQ09OU1RSQUlORUQgQlkgeyBUb0JlRW5jcnlw dGVkIH0gKQ1VbnByb3RlY3RlZEF0dHJpYnV0ZXMgQVRUUklCVVRFIDo6PSAgeyAuLi4gfQ1S ZWNpcGllbnRJbmZvIDo6PSBDSE9JQ0Ugew1rdHJpCQlLZXlUcmFuc1JlY2lwaWVudEluZm8s DS4uLiwNW1szOiBrYXJpICAJWzFdIEtleUFncmVlUmVjaXBpZW50SW5mbyBdXSwNW1s0OiBr ZWtyaSAJWzJdIEtFS1JlY2lwaWVudEluZm9dXSwNW1s1OiBwd3JpICAJWzNdIFBhc3N3b3Jk UmVjaXBpZW50SW5mbywNb3JpICAgCVs0XSBPdGhlclJlY2lwaWVudEluZm8gXV0gDX0NS2V5 VHJhbnNSZWNpcGllbnRJbmZvIDo6PSBTRVFVRU5DRSB7DXZlcnNpb24gCQkJQ01TVmVyc2lv biwgIC0tIGFsd2F5cyBzZXQgdG8gMCBvciAyDXJpZCAJCQkJUmVjaXBpZW50SWRlbnRpZmll ciwNa2V5RW5jcnlwdGlvbkFsZ29yaXRobSAJQWxnb3JpdGhtSWRlbnRpZmllcg0Je0tFWS1U UkFOU1BPUlQsIHtLZXlUcmFuc3BvcnRBbGdvcml0aG1TZXR9fSwNZW5jcnlwdGVkS2V5IAkJ RW5jcnlwdGVkS2V5IA19DUtFWS1UUkFOU1BPUlQgOjo9IENMQVNTIHsNJmlkCQkJCU9CSkVD VCBJREVOVElGSUVSIFVOSVFVRSwNJlBhcmFtcwkJT1BUSU9OQUwsDSZwYXJhbVByZXNlbmNl CVBhcmFtT3B0aW9ucyBERUZBVUxUIGFic2VudCwNJlB1YmxpY0tleVNldAlQVUJMSUMtS0VZ IE9QVElPTkFMLA0mc21pbWVDYXBzCQlTTUlNRS1DQVBTIE9QVElPTkFMDX0gDVdJVEggU1lO VEFYIHsNSURFTlRJRklFUiAJCSZpZA1bUEFSQU1TIAkJW1RZUEUgJlBhcmFtc10gQVJFICZw YXJhbVByZXNlbmNlXQ1bUFVCTElDLUtFWVMgCSZQdWJsaWNLZXlTZXRdDVtTTUlNRS1DQVBT IAkmc21pbWVDYXBzXQ19DUtleVRyYW5zcG9ydEFsZ29yaXRobVNldCBLRVktVFJBTlNQT1JU IDo6PSB7IEtleVRyYW5zcG9ydEFsZ3MsIC4uLiB9DUtleVRyYW5zcG9ydEFsZ3MgS0VZLVRS QU5TUE9SVCA6Oj0geyBrdC1yc2EsIC4uLiB9DWt0LXJzYSAJS0VZLVRSQU5TUE9SVCA6Oj0g ew1JREVOVElGSUVSIAlyc2FFbmNyeXB0aW9uDVBBUkFNUyBUWVBFIE5VTEwgQVJFIHJlcXVp cmVkDVBVQkxJQy1LRVlTIHsgcGstcnNhIH0NU01JTUUtQ0FQUyAJe0lERU5USUZJRUQgQlkg cnNhRW5jcnlwdGlvbn0NfQ1yc2FFbmNyeXB0aW9uIE9CSkVDVCBJREVOVElGSUVSIDo6PSB7 DWlzbygxKSBtZW1iZXItYm9keSgyKSB1cyg4NDApIHJzYWRzaSgxMTM1NDkpIHBrY3MoMSkg cGtjcy0xKDEpIDEgfQ1way1yc2EgUFVCTElDLUtFWSA6Oj0gew1JREVOVElGSUVSIAlyc2FF bmNyeXB0aW9uDUtFWSAJCVJTQVB1YmxpY0tleQ1QQVJBTVMgVFlQRSBOVUxMIEFSRSBhYnNl bnQNLS0gUHJpdmF0ZSBrZXkgZm9ybWF0IG5vdCBpbiB0aGlzIG1vZHVsZSAtLQ1DRVJULUtF WS1VU0FHRSB7ZGlnaXRhbFNpZ25hdHVyZSwgY29udGVudENvbW1pdG1lbnQsDWtleUVuY2lw aGVybWVudCwgZGF0YUVuY2lwaGVybWVudCwga2V5Q2VydFNpZ24sIGNSTFNpZ259DX0NUlNB UHVibGljS2V5IDo6PSBTRVFVRU5DRSB7DW1vZHVsdXMJCUlOVEVHRVIsIC0tIG4NcHVibGlj RXhwb25lbnQJSU5URUdFUiAgLS0gZQ19DVJlY2lwaWVudElkZW50aWZpZXIgOjo9IENIT0lD RSB7DWlzc3VlckFuZFNlcmlhbE51bWJlciAJCUlzc3VlckFuZFNlcmlhbE51bWJlciwNLi4u LA1bWzI6IHN1YmplY3RLZXlJZGVudGlmaWVyIAlbMF0gU3ViamVjdEtleUlkZW50aWZpZXIg XV0gDX0NRW5jcnlwdGVkS2V5IDo6PSBPQ1RFVCBTVFJJTkcNS2V5QWdyZWVSZWNpcGllbnRJ bmZvIDo6PSBTRVFVRU5DRSB7DXZlcnNpb24gCQkJQ01TVmVyc2lvbiwgIC0tIGFsd2F5cyBz ZXQgdG8gMw1vcmlnaW5hdG9yIAkJCVswXSBFWFBMSUNJVCBPcmlnaW5hdG9ySWRlbnRpZmll ck9yS2V5LA11a20gCQkJCVsxXSBFWFBMSUNJVCBVc2VyS2V5aW5nTWF0ZXJpYWwgT1BUSU9O QUwsDWtleUVuY3J5cHRpb25BbGdvcml0aG0gCUFsZ29yaXRobUlkZW50aWZpZXINCXtLRVkt QUdSRUUsIHtLZXlBZ3JlZW1lbnRBbGdvcml0aG1TZXR9fSwNcmVjaXBpZW50RW5jcnlwdGVk S2V5cyAJUmVjaXBpZW50RW5jcnlwdGVkS2V5cyANfQ1LRVktQUdSRUUgOjo9IENMQVNTIHsN JmlkICAgICAgICAgICAgIE9CSkVDVCBJREVOVElGSUVSIFVOSVFVRSwNJlBhcmFtcyAgICAg ICAgIE9QVElPTkFMLA0mcGFyYW1QcmVzZW5jZSAgUGFyYW1PcHRpb25zIERFRkFVTFQgYWJz ZW50LA0mUHVibGljS2V5U2V0ICAgUFVCTElDLUtFWSBPUFRJT05BTCwNJlVrbSAgICAgICAg ICAgIE9QVElPTkFMLA0mdWttUHJlc2VuY2UgICAgUGFyYW1PcHRpb25zIERFRkFVTFQgYWJz ZW50LA0mc21pbWVDYXBzICAgICAgU01JTUUtQ0FQUyBPUFRJT05BTA19DVdJVEggU1lOVEFY IHsNSURFTlRJRklFUiAJCSZpZA1bUEFSQU1TIAkJW1RZUEUgJlBhcmFtc10gQVJFICZwYXJh bVByZXNlbmNlXQ1bUFVCTElDLUtFWVMgCSZQdWJsaWNLZXlTZXRdDVtVS00gCQkJW1RZUEUg JlVrbV0gQVJFICZ1a21QcmVzZW5jZV0NW1NNSU1FLUNBUFMgCSZzbWltZUNhcHNdDX0NS2V5 QWdyZWVtZW50QWxnb3JpdGhtU2V0IEtFWS1BR1JFRSA6Oj0geyBLZXlBZ3JlZW1lbnRBbGdz LCAuLi4gfQ1LZXlBZ3JlZW1lbnRBbGdzIEtFWS1BR1JFRSA6Oj0geyBrYWEtZXNkaCB8IGth YS1zc2RoLCAuLi59DWthYS1lc2RoIEtFWS1BR1JFRSA6Oj0gew1JREVOVElGSUVSIAkJaWQt YWxnLUVTREgNUEFSQU1TIFRZUEUgCUtleVdyYXBBbGdvcml0aG0gQVJFIHJlcXVpcmVkDVBV QkxJQy1LRVlTIAl7IHBrLWRoIH0NLS0gVUtNIGlzIG5vdCBBU04uMSBlbmNvZGVkDVVLTSBB UkUgb3B0aW9uYWwNU01JTUUtQ0FQUyAJCXtUWVBFIEtleVdyYXBBbGdvcml0aG0gSURFTlRJ RklFRCBCWSBpZC1hbGctRVNESH0NfQ1LZXlXcmFwQWxnb3JpdGhtIDo6PSBBbGdvcml0aG1J ZGVudGlmaWVyIHtLRVktV1JBUCwge0tleVdyYXBBbGdzIH19DUtFWS1XUkFQIDo6PSBDTEFT UyB7DSZpZCAgICAgICAgICAgICAgICBPQkpFQ1QgSURFTlRJRklFUiBVTklRVUUsDSZQYXJh bXMgICAgICAgICAgICBPUFRJT05BTCwNJnBhcmFtUHJlc2VuY2UgICAgIFBhcmFtT3B0aW9u cyBERUZBVUxUIGFic2VudCwNJnNtaW1lQ2FwcyAgICAgICAgIFNNSU1FLUNBUFMgT1BUSU9O QUwNfQ1XSVRIIFNZTlRBWCB7DUlERU5USUZJRVIgCSZpZA1bUEFSQU1TIAlbVFlQRSAmUGFy YW1zXSBBUkUgJnBhcmFtUHJlc2VuY2VdDVtTTUlNRS1DQVBTICZzbWltZUNhcHNdDX0NaWQt YWxnLUVTREggT0JKRUNUIElERU5USUZJRVIgOjo9IHsgaXNvKDEpIG1lbWJlci1ib2R5KDIp IHVzKDg0MCkNcnNhZHNpKDExMzU0OSkgcGtjcygxKSBwa2NzLTkoOSkgc21pbWUoMTYpIGFs ZygzKSA1IH0Na2FhLXNzZGggS0VZLUFHUkVFIDo6PSB7DUlERU5USUZJRVIgCQlpZC1hbGct U1NESA1QQVJBTVMgVFlQRSAJS2V5V3JhcEFsZ29yaXRobSBBUkUgcmVxdWlyZWQNUFVCTElD LUtFWVMgCXtway1kaH0NLS0gVUtNIGlzIG5vdCBBU04uMSBlbmNvZGVkDVVLTSBBUkUgb3B0 aW9uYWwNU01JTUUtQ0FQUyAJCXtUWVBFIEtleVdyYXBBbGdvcml0aG0gSURFTlRJRklFRCBC WSBpZC1hbGctU1NESH0NfQ1pZC1hbGctU1NESCBPQkpFQ1QgSURFTlRJRklFUiA6Oj0geyBp c28oMSkgbWVtYmVyLWJvZHkoMikgdXMoODQwKQ1yc2Fkc2koMTEzNTQ5KSBwa2NzKDEpIHBr Y3MtOSg5KSBzbWltZSgxNikgYWxnKDMpIDEwIH0NT3JpZ2luYXRvcklkZW50aWZpZXJPcktl eSA6Oj0gQ0hPSUNFIHsNaXNzdWVyQW5kU2VyaWFsTnVtYmVyIAlJc3N1ZXJBbmRTZXJpYWxO dW1iZXIsDXN1YmplY3RLZXlJZGVudGlmaWVyIAlbMF0gU3ViamVjdEtleUlkZW50aWZpZXIs DW9yaWdpbmF0b3JLZXkgCQlbMV0gT3JpZ2luYXRvclB1YmxpY0tleSANfQ1PcmlnaW5hdG9y UHVibGljS2V5IDo6PSBTRVFVRU5DRSB7DWFsZ29yaXRobSAJCUFsZ29yaXRobUlkZW50aWZp ZXIgDQl7UFVCTElDLUtFWSwge09yaWdpbmF0b3JLZXlTZXR9fSwNcHVibGljS2V5IEJJVCBT VFJJTkcgfQ1PcmlnaW5hdG9yS2V5U2V0IAlQVUJMSUMtS0VZIDo6PSB7IEtleUFncmVlUHVi bGljS2V5cywgLi4ufQ1LZXlBZ3JlZVB1YmxpY0tleXMgUFVCTElDLUtFWSA6Oj0geyBway1k aCwgLi4ufQ1way1kaCBQVUJMSUMtS0VZIDo6PSB7DUlERU5USUZJRVIgCQlkaHB1YmxpY251 bWJlcg1LRVkgCQkJREhQdWJsaWNLZXkNUEFSQU1TIFRZUEUgCURvbWFpblBhcmFtZXRlcnMg QVJFIGluaGVyaXRhYmxlDS0tIFByaXZhdGUga2V5IGZvcm1hdCBub3QgaW4gdGhpcyBtb2R1 bGUgLS0NQ0VSVC1LRVktVVNBR0UgCXtrZXlBZ3JlZW1lbnQsIGVuY2lwaGVyT25seSwgZGVj aXBoZXJPbmx5IH0NfQ1kaHB1YmxpY251bWJlciBPQkpFQ1QgSURFTlRJRklFUiA6Oj0gew1p c28oMSkgbWVtYmVyLWJvZHkoMikgdXMoODQwKSBhbnNpLXg5NDIoMTAwNDYpIG51bWJlci10 eXBlKDIpIDEgfQ1ESFB1YmxpY0tleSA6Oj0gSU5URUdFUiAgLS0gcHVibGljIGtleSwgeSA9 IGdeeCBtb2QgcA1Eb21haW5QYXJhbWV0ZXJzIDo6PSBTRVFVRU5DRSB7DXAJCQkJSU5URUdF UiwJCS0tIG9kZCBwcmltZSwgcD1qcSArMQ1nCQkJCUlOVEVHRVIsCQktLSBnZW5lcmF0b3Is IGcNcQkJCQlJTlRFR0VSLAkJLS0gZmFjdG9yIG9mIHAtMQ1qCQkJCUlOVEVHRVIgT1BUSU9O QUwsCS0tIHN1Ymdyb3VwIGZhY3Rvciwgaj49IDINdmFsaWRhdGlvblBhcmFtcyAJVmFsaWRh dGlvblBhcmFtcyBPUFRJT05BTA19DVZhbGlkYXRpb25QYXJhbXMgOjo9IFNFUVVFTkNFIHsN c2VlZAkJQklUIFNUUklORywNcGdlbkNvdW50ZXIJSU5URUdFUg19DVVzZXJLZXlpbmdNYXRl cmlhbCA6Oj0gT0NURVQgU1RSSU5HDVJlY2lwaWVudEVuY3J5cHRlZEtleXMgOjo9IFNFUVVF TkNFIE9GIFJlY2lwaWVudEVuY3J5cHRlZEtleQ1SZWNpcGllbnRFbmNyeXB0ZWRLZXkgOjo9 IFNFUVVFTkNFIHsNcmlkIAkJCUtleUFncmVlUmVjaXBpZW50SWRlbnRpZmllciwNZW5jcnlw dGVkS2V5IAlFbmNyeXB0ZWRLZXkNfQ1LZXlBZ3JlZVJlY2lwaWVudElkZW50aWZpZXIgOjo9 IENIT0lDRSB7DWlzc3VlckFuZFNlcmlhbE51bWJlciAJSXNzdWVyQW5kU2VyaWFsTnVtYmVy LA1yS2V5SWQgCQkJWzBdIElNUExJQ0lUIFJlY2lwaWVudEtleUlkZW50aWZpZXIgDX0NUmVj aXBpZW50S2V5SWRlbnRpZmllciA6Oj0gU0VRVUVOQ0Ugew1zdWJqZWN0S2V5SWRlbnRpZmll ciAJU3ViamVjdEtleUlkZW50aWZpZXIsDWRhdGUgCQkJCUdlbmVyYWxpemVkVGltZSBPUFRJ T05BTCwNb3RoZXIgCQkJT3RoZXJLZXlBdHRyaWJ1dGUgT1BUSU9OQUwgDX0NU3ViamVjdEtl eUlkZW50aWZpZXIgOjo9IE9DVEVUIFNUUklORw1LRVktQVRUUklCVVRFIDo6PSBUWVBFLUlE RU5USUZJRVINT3RoZXJLZXlBdHRyaWJ1dGUgOjo9IFNFUVVFTkNFIHsNa2V5QXR0cklkICBL RVktQVRUUklCVVRFLiZpZCh7U3VwcG9ydGVkS2V5QXR0cmlidXRlc30pLA1rZXlBdHRyICAg IEtFWS1BVFRSSUJVVEUuJlR5cGUoe1N1cHBvcnRlZEtleUF0dHJpYnV0ZXN9e0BrZXlBdHRy SWR9KQ19DVN1cHBvcnRlZEtleUF0dHJpYnV0ZXMgS0VZLUFUVFJJQlVURSA6Oj0geyAuLi4g fQ1LRUtSZWNpcGllbnRJbmZvIDo6PSBTRVFVRU5DRSB7DXZlcnNpb24gCQkJQ01TVmVyc2lv biwgIC0tIGFsd2F5cyBzZXQgdG8gNA1rZWtpZCAJCQlLRUtJZGVudGlmaWVyLA1rZXlFbmNy eXB0aW9uQWxnb3JpdGhtIAlLZXlFbmNyeXB0aW9uQWxnb3JpdGhtSWRlbnRpZmllciwNZW5j cnlwdGVkS2V5CSAJRW5jcnlwdGVkS2V5IA19DUtFS0lkZW50aWZpZXIgOjo9IFNFUVVFTkNF IHsNa2V5SWRlbnRpZmllciAJT0NURVQgU1RSSU5HLA1kYXRlIAkJCUdlbmVyYWxpemVkVGlt ZSBPUFRJT05BTCwNb3RoZXIgCQlPdGhlcktleUF0dHJpYnV0ZSBPUFRJT05BTCANfQ1LZXlF bmNyeXB0aW9uQWxnb3JpdGhtSWRlbnRpZmllciA6Oj0gQWxnb3JpdGhtSWRlbnRpZmllcg17 S0VZLVdSQVAsIHtLZXlFbmNyeXB0aW9uQWxnb3JpdGhtU2V0fX0NS2V5RW5jcnlwdGlvbkFs Z29yaXRobVNldCBLRVktV1JBUCA6Oj0geyBLZXlXcmFwQWxncywgLi4uIH0NS2V5V3JhcEFs Z3MgS0VZLVdSQVAgOjo9IHsga3dhLTNERVNXcmFwIHwga3dhLVJDMldyYXAsIC4uLiB9DWt3 YS0zREVTV3JhcCBLRVktV1JBUCA6Oj0gew1JREVOVElGSUVSIAlpZC1hbGctQ01TM0RFU3dy YXANUEFSQU1TIAlUWVBFIE5VTEwgQVJFIHJlcXVpcmVkDVNNSU1FLUNBUFMgCXtJREVOVElG SUVEIEJZIGlkLWFsZy1DTVMzREVTd3JhcH0NfQ1pZC1hbGctQ01TM0RFU3dyYXAgT0JKRUNU IElERU5USUZJRVIgOjo9IHsgaXNvKDEpIG1lbWJlci1ib2R5KDIpDXVzKDg0MCkgcnNhZHNp KDExMzU0OSkgcGtjcygxKSBwa2NzLTkoOSkgc21pbWUoMTYpIGFsZygzKSA2IH0Na3dhLVJD MldyYXAgS0VZLVdSQVAgOjo9IHsNSURFTlRJRklFUiAJaWQtYWxnLUNNU1JDMndyYXANUEFS QU1TIAlUWVBFIFJDMndyYXBQYXJhbWV0ZXIgQVJFIHJlcXVpcmVkDVNNSU1FLUNBUFMgCXsg SURFTlRJRklFRCBCWSBpZC1hbGctQ01TUkMyd3JhcCB9DX0NaWQtYWxnLUNNU1JDMndyYXAg T0JKRUNUIElERU5USUZJRVIgOjo9IHsgaXNvKDEpIG1lbWJlci1ib2R5KDIpDXVzKDg0MCkg cnNhZHNpKDExMzU0OSkgcGtjcygxKSBwa2NzLTkoOSkgc21pbWUoMTYpIGFsZygzKSA3IH0N UkMyd3JhcFBhcmFtZXRlciA6Oj0gUkMyUGFyYW1ldGVyVmVyc2lvbg1SQzJQYXJhbWV0ZXJW ZXJzaW9uIDo6PSBJTlRFR0VSDVBhc3N3b3JkUmVjaXBpZW50SW5mbyA6Oj0gU0VRVUVOQ0Ug ew12ZXJzaW9uIAkJCUNNU1ZlcnNpb24sICAgLS0gYWx3YXlzIHNldCB0byAwDWtleURlcml2 YXRpb25BbGdvcml0aG0gCVswXSBLZXlEZXJpdmF0aW9uQWxnb3JpdGhtSWRlbnRpZmllciBP UFRJT05BTCwNa2V5RW5jcnlwdGlvbkFsZ29yaXRobSAJS2V5RW5jcnlwdGlvbkFsZ29yaXRo bUlkZW50aWZpZXIsDWVuY3J5cHRlZEtleSAJCUVuY3J5cHRlZEtleSANfQ1LZXlEZXJpdmF0 aW9uQWxnb3JpdGhtSWRlbnRpZmllciA6Oj0gQWxnb3JpdGhtSWRlbnRpZmllcg17S0VZLURF UklWQVRJT04sIHtLZXlEZXJpdmF0aW9uQWxncywgLi4ufX0NS2V5RGVyaXZhdGlvbkFsZ3Mg S0VZLURFUklWQVRJT04gOjo9IHsga2RhLVBCS0RGMiwgLi4uIH0Na2RhLVBCS0RGMiBLRVkt REVSSVZBVElPTiA6Oj0gew1JREVOVElGSUVSIAlpZC1QQktERjINUEFSQU1TIAlUWVBFIFBC S0RGMi1wYXJhbXMgQVJFIHJlcXVpcmVkDS0tIE5vIFMvTUlNRSBjYXBzIGRlZmluZWQNfQ1p ZC1QQktERjIgT0JKRUNUIElERU5USUZJRVIgOjo9IHsgaXNvKDEpIG1lbWJlci1ib2R5KDIp IHVzKDg0MCkNcnNhZHNpKDExMzU0OSkgcGtjcygxKSBwa2NzLTUoNSkgMTIgfQ1QQktERjIt cGFyYW1zIDo6PSBTRVFVRU5DRSB7DXNhbHQgCQlDSE9JQ0Ugew0JCXNwZWNpZmllZCAJT0NU RVQgU1RSSU5HLA0JCW90aGVyU291cmNlIAlQQktERjItU2FsdFNvdXJjZXNBbGdvcml0aG1J ZGVudGlmaWVyIH0sDWl0ZXJhdGlvbkNvdW50IAlJTlRFR0VSICgxLi5NQVgpLA1rZXlMZW5n dGggCQlJTlRFR0VSICgxLi5NQVgpIE9QVElPTkFMLA1wcmYgCQkJUEJLREYyLVBSRnNBbGdv cml0aG1JZGVudGlmaWVyIA19DVBCS0RGMi1TYWx0U291cmNlc0FsZ29yaXRobUlkZW50aWZp ZXIgOjo9DUFsZ29yaXRobUlkZW50aWZpZXIge0FMR09SSVRITSwge1BCS0RGMi1TYWx0U291 cmNlc319DVBCS0RGMi1TYWx0U291cmNlcyBBTEdPUklUSE0gOjo9IHsgLi4uIH0NQUxHT1JJ VEhNIDo6PSBDTEFTUyB7DSZpZCAJCQlPQkpFQ1QgICBJREVOVElGSUVSIFVOSVFVRSwNJlBh cmFtcyAgICAgIAlPUFRJT05BTCwNJnBhcmFtUHJlc2VuY2UgCVBhcmFtT3B0aW9ucyBERUZB VUxUIGFic2VudCwNJnNtaW1lQ2FwcyAgIAlTTUlNRS1DQVBTIE9QVElPTkFMDX0gDVdJVEgg U1lOVEFYIHsNSURFTlRJRklFUiAJJmlkDVtQQVJBTVMgCVtUWVBFICZQYXJhbXNdIEFSRSAm cGFyYW1QcmVzZW5jZV0NW1NNSU1FLUNBUFMgJnNtaW1lQ2Fwc10NfQ1QQktERjItUFJGc0Fs Z29yaXRobUlkZW50aWZpZXIgIDo6PSBBbGdvcml0aG1JZGVudGlmaWVyIHtBTEdPUklUSE0s e1BCS0RGMi1QUkZzfX0NUEJLREYyLVBSRnMgQUxHT1JJVEhNIDo6PSB7Li4ufQ1LRVktREVS SVZBVElPTiA6Oj0gQ0xBU1Mgew0maWQgICAgICAgICAgICAgICAgT0JKRUNUIElERU5USUZJ RVIgVU5JUVVFLA0mUGFyYW1zICAgICAgICAgICAgT1BUSU9OQUwsDSZwYXJhbVByZXNlbmNl ICAgICBQYXJhbU9wdGlvbnMgREVGQVVMVCBhYnNlbnQsDSZzbWltZUNhcHMgICAgICAgICBT TUlNRS1DQVBTIE9QVElPTkFMDX0NV0lUSCBTWU5UQVggew1JREVOVElGSUVSIAkJJmlkDVtQ QVJBTVMgCQlbVFlQRSAmUGFyYW1zXSBBUkUgJnBhcmFtUHJlc2VuY2VdDVtTTUlNRS1DQVBT IAkmc21pbWVDYXBzXQ19DU9USEVSLVJFQ0lQSUVOVCA6Oj0gVFlQRS1JREVOVElGSUVSDU90 aGVyUmVjaXBpZW50SW5mbyA6Oj0gU0VRVUVOQ0Ugew1vcmlUeXBlICAgIAlPVEhFUi1SRUNJ UElFTlQuJmlkKHtTdXBwb3J0ZWRPdGhlclJlY2lwSW5mb30pLA1vcmlWYWx1ZSAgIAlPVEhF Ui1SRUNJUElFTlQuJlR5cGUoe1N1cHBvcnRlZE90aGVyUmVjaXBJbmZvfXtAb3JpVHlwZX0p DX0NU3VwcG9ydGVkT3RoZXJSZWNpcEluZm8gT1RIRVItUkVDSVBJRU5UIDo6PSB7IC4uLiB9 DURpZ2VzdGVkRGF0YSA6Oj0gU0VRVUVOQ0Ugew12ZXJzaW9uIAkJQ01TVmVyc2lvbiwNZGln ZXN0QWxnb3JpdGhtIAlEaWdlc3RBbGdvcml0aG1JZGVudGlmaWVyLA1lbmNhcENvbnRlbnRJ bmZvIAlFbmNhcHN1bGF0ZWRDb250ZW50SW5mbywNZGlnZXN0IAkJRGlnZXN0LCAuLi4gDX0N RGlnZXN0IDo6PSBPQ1RFVCBTVFJJTkcNRW5jcnlwdGVkRGF0YSA6Oj0gU0VRVUVOQ0Ugew12 ZXJzaW9uCQkJQ01TVmVyc2lvbiwNZW5jcnlwdGVkQ29udGVudEluZm8gCUVuY3J5cHRlZENv bnRlbnRJbmZvLA0uLi4sDVtbMjogdW5wcm90ZWN0ZWRBdHRycyAJWzFdIElNUExJQ0lUIEF0 dHJpYnV0ZXMNe3tVbnByb3RlY3RlZEF0dHJpYnV0ZXN9fSBPUFRJT05BTCBdXSANfQ1BdXRo ZW50aWNhdGVkRGF0YSA6Oj0gU0VRVUVOQ0Ugew12ZXJzaW9uIAkJQ01TVmVyc2lvbiwNb3Jp Z2luYXRvckluZm8gCVswXSBJTVBMSUNJVCBPcmlnaW5hdG9ySW5mbyBPUFRJT05BTCwNcmVj aXBpZW50SW5mb3MgCVJlY2lwaWVudEluZm9zLA1tYWNBbGdvcml0aG0gCU1lc3NhZ2VBdXRo ZW50aWNhdGlvbkNvZGVBbGdvcml0aG0sDWRpZ2VzdEFsZ29yaXRobQlbMV0gRGlnZXN0QWxn b3JpdGhtSWRlbnRpZmllciBPUFRJT05BTCwNZW5jYXBDb250ZW50SW5mbwlFbmNhcHN1bGF0 ZWRDb250ZW50SW5mbywNYXV0aEF0dHJzIAkJWzJdIElNUExJQ0lUIEF1dGhBdHRyaWJ1dGVz IE9QVElPTkFMLA1tYWMgCQkJTWVzc2FnZUF1dGhlbnRpY2F0aW9uQ29kZSwNdW5hdXRoQXR0 cnMgCVszXSBJTVBMSUNJVCBVbmF1dGhBdHRyaWJ1dGVzIE9QVElPTkFMIA19DUF1dGhBdHRy aWJ1dGVzIDo6PSBTRVQgU0laRSAoMS4uTUFYKSBPRiBBdHRyaWJ1dGV7e0F1dGhBdHRyaWJ1 dGVTZXR9fQ1BdXRoQXR0cmlidXRlU2V0IEFUVFJJQlVURSA6Oj0gDXsgYWEtY29udGVudFR5 cGUgfCBhYS1tZXNzYWdlRGlnZXN0IHwgYWEtc2lnbmluZ1RpbWUsIC4uLn0NTWVzc2FnZUF1 dGhlbnRpY2F0aW9uQ29kZSA6Oj0gT0NURVQgU1RSSU5HDVVuYXV0aEF0dHJpYnV0ZXMgOjo9 IFNFVCBTSVpFICgxLi5NQVgpIE9GIEF0dHJpYnV0ZXt7VW5hdXRoQXR0cmlidXRlU2V0fX0N VW5hdXRoQXR0cmlidXRlU2V0IEFUVFJJQlVURSA6Oj0gey4uLn0NTWVzc2FnZUF1dGhlbnRp Y2F0aW9uQ29kZUFsZ29yaXRobSA6Oj0gQWxnb3JpdGhtSWRlbnRpZmllcg17TUFDLUFMR09S SVRITSwge01lc3NhZ2VBdXRoZW50aWNhdGlvbkNvZGVBbGdvcml0aG1TZXR9fQ1NZXNzYWdl QXV0aGVudGljYXRpb25Db2RlQWxnb3JpdGhtU2V0IE1BQy1BTEdPUklUSE0gOjo9IHsgTWVz c2FnZUF1dGhBbGdzLCAuLi4gfQ1NZXNzYWdlQXV0aEFsZ3MJTUFDLUFMR09SSVRITSA6Oj0g ew1tYWNhLWhNQUMtU0hBMjI0IHwgDW1hY2EtaE1BQy1TSEEyNTYgfCANbWFjYS1oTUFDLVNI QTM4NHwNbWFjYS1oTUFDLVNIQTUxMiwuLi59DW1hY2EtaE1BQy1TSEEyMjQgTUFDLUFMR09S SVRITSA6Oj0gew1JREVOVElGSUVSIAkJaE1BQy1TSEEyMjQNUEFSQU1TIAkJVFlQRSBOVUxM IEFSRSBwcmVmZXJyZWRBYnNlbnQNSVMtS0VZRUQtTUFDIAlUUlVFDVNNSU1FLUNBUFMgCQl7 SURFTlRJRklFRCBCWSBoTUFDLVNIQTIyNH0NfQ1oTUFDLVNIQTIyNAkJT0JKRUNUIElERU5U SUZJRVIgOjo9IHsNaXNvKDEpIG1lbWJlci1ib2R5KDIpIHVzKDg0MCkgcnNhZHNpKDExMzU0 OSkgZGlnZXN0QWxnb3JpdGhtKDIpIGhtYWNXaXRoU0hBMjI0KDgpfQ1tYWNhLWhNQUMtU0hB MjU2IE1BQy1BTEdPUklUSE0gOjo9IHsNSURFTlRJRklFUiAJCWhNQUMtU0hBMjU2DVBBUkFN UyAJCVRZUEUgTlVMTCBBUkUgcHJlZmVycmVkQWJzZW50DUlTLUtFWUVELU1BQyAJVFJVRQ1T TUlNRS1DQVBTIAkJe0lERU5USUZJRUQgQlkgaE1BQy1TSEEyNTZ9DX0NaE1BQy1TSEEyNTYJ CU9CSkVDVCBJREVOVElGSUVSIDo6PSB7DWlzbygxKSBtZW1iZXItYm9keSgyKSB1cyg4NDAp IHJzYWRzaSgxMTM1NDkpIGRpZ2VzdEFsZ29yaXRobSgyKSBobWFjV2l0aFNIQTI1Nig5KX0N bWFjYS1oTUFDLVNIQTM4NCBNQUMtQUxHT1JJVEhNIDo6PSB7DUlERU5USUZJRVIgCQloTUFD LVNIQTM4NA1QQVJBTVMgCQlUWVBFIE5VTEwgQVJFIHByZWZlcnJlZEFic2VudA1JUy1LRVlF RC1NQUMgCVRSVUUNU01JTUUtQ0FQUyAJCXtJREVOVElGSUVEIEJZIGhNQUMtU0hBMzg0fQ19 DWhNQUMtU0hBMzg0CQlPQkpFQ1QgSURFTlRJRklFUiA6Oj0gew1pc28oMSkgbWVtYmVyLWJv ZHkoMikgdXMoODQwKSByc2Fkc2koMTEzNTQ5KSBkaWdlc3RBbGdvcml0aG0oMikgaG1hY1dp dGhTSEEzODQoMTApfQ1tYWNhLWhNQUMtU0hBNTEyIE1BQy1BTEdPUklUSE0gOjo9IHsNSURF TlRJRklFUiAJCWhNQUMtU0hBNTEyDVBBUkFNUyAJCVRZUEUgTlVMTCBBUkUgcHJlZmVycmVk QWJzZW50DUlTLUtFWUVELU1BQyAJVFJVRQ1TTUlNRS1DQVBTIAkJe0lERU5USUZJRUQgQlkg aE1BQy1TSEE1MTJ9DX0NaE1BQy1TSEE1MTIJCU9CSkVDVCBJREVOVElGSUVSIDo6PSB7DWlz bygxKSBtZW1iZXItYm9keSgyKSB1cyg4NDApIHJzYWRzaSgxMTM1NDkpIGRpZ2VzdEFsZ29y aXRobSgyKSBobWFjV2l0aFNIQTUxMigxMSl9DU1BQy1BTEdPUklUSE0gOjo9IENMQVNTIHsN JmlkCQkJCU9CSkVDVCBJREVOVElGSUVSIFVOSVFVRSwNJlBhcmFtcwkJT1BUSU9OQUwsDSZw YXJhbVByZXNlbmNlCVBhcmFtT3B0aW9ucyBERUZBVUxUIGFic2VudCwNJmtleWVkCQlCT09M RUFOLA0mc21pbWVDYXBzCQlTTUlNRS1DQVBTIE9QVElPTkFMDX0NV0lUSCBTWU5UQVggew1J REVOVElGSUVSIAkJJmlkDVtQQVJBTVMgCQlbVFlQRSAmUGFyYW1zXSBBUkUgJnBhcmFtUHJl c2VuY2VdDUlTLUtFWUVELU1BQyAJJmtleWVkDVtTTUlNRS1DQVBTIAkmc21pbWVDYXBzXQ19 DVNpZ25jcnlwdGVkRGF0YQk6Oj0gU0VRVUVOQ0Ugew12ZXJzaW9uCQlDTVNWZXJzaW9uLA1k aWdlc3RBbGdvcml0aG1zCVNFVCBPRiBEaWdlc3RBbGdvcml0aG1JZGVudGlmaWVyLA1lbmNh cENvbnRlbnRJbmZvCUVuY2Fwc3VsYXRlZENvbnRlbnRJbmZvLA1jZXJ0aWZpY2F0ZXMJWzBd IENlcnRpZmljYXRlU2V0IE9QVElPTkFMLA1jcmxzCQkJWzFdIFJldm9jYXRpb25JbmZvQ2hv aWNlcwlPUFRJT05BTCwNc2lnbmNyeXB0ZXJJbmZvcwlTaWduY3J5cHRlckluZm9zDX0NU2ln bmNyeXB0ZXJJbmZvcwk6Oj0gU0VUIFNJWkUoMC4uTUFYKSBPRiBTaWduY3J5cHRlckluZm8N U2lnbmNyeXB0ZXJJbmZvCTo6PSBTRVFVRU5DRSB7DXZlcnNpb24JCUNNU1ZlcnNpb24sDXNp ZHMJCQlTaWduY3J5cHRlcklEcywNZGlnZXN0QWxnb3JpdGhtCVswXSBEaWdlc3RBbGdvcml0 aG1JZGVudGlmaWVyIE9QVElPTkFMLA1zaWduZWRBdHRycwkJWzFdIFNpZ25lZEF0dHJpYnV0 ZXMgT1BUSU9OQUwsDXNpZ25hdHVyZUFsZ29yaXRobQlTaWduYXR1cmVBbGdvcml0aG1JZGVu dGlmaWVyLA1zaWduYXR1cmUJCVNpZ25hdHVyZVZhbHVlLA11bnNpZ25lZEF0dHJzCVsyXSBB dHRyaWJ1dGVze3tVbnNpZ25lZEF0dHJpYnV0ZXN9fSBPUFRJT05BTA19DVNpZ25jcnlwdGVy SURzCTo6PSBTRVFVRU5DRSB7DXNlbmRlcglLZXlQYWlySWRlbnRpZmllciwNcmVjaXBpZW50 CUtleVBhaXJJZGVudGlmaWVyDX0NS2V5UGFpcklkZW50aWZpZXIJOjo9IENIT0lDRSB7DWlz c3VlckFuZFNlcmlhbE51bWJlcglJc3N1ZXJBbmRTZXJpYWxOdW1iZXIsDXN1YmplY3RLZXlJ ZGVudGlmaWVyCVswXSBTdWJqZWN0S2V5SWRlbnRpZmllciwNY2VydEhhc2gJCQlbMV0gQ2Vy dEhhc2gNfQ1DZXJ0SGFzaCA6Oj0gSEFTSHtDZXJ0aWZpY2F0ZX0NU0lHTkNSWVBURUQgOjo9 IENMQVNTIHsNJmlkCQkJT0JKRUNUIElERU5USUZJRVIgVU5JUVVFLA0mVHlwZQkJT1BUSU9O QUwNfQ1XSVRIIFNZTlRBWCB7T0lEICZpZCBbUEFSTVMgJlR5cGVdfQ1TaWduY3J5cHRlZHtT SUdOQ1JZUFRFRDpJT1NldH0gOjo9IFNFUVVFTkNFIHsNbmFtZQkJU0lHTkNSWVBURUQuJmlk KHtJT1NldH0pLA1wYXJ0cwkJU0lHTkNSWVBURUQuJlR5cGUoe0lPU2V0fXtAbmFtZX0pIE9Q VElPTkFMDX0NU2lnbmNyeXB0ZWRQYXJ0cwk6Oj0gU2lnbmNyeXB0ZWR7e01hbmlmZXN0fX0N TWFuaWZlc3QJCVNJR05DUllQVEVEIDo6PSB7eFBhdGhNYW5pZmVzdCwuLi59DXhQYXRoTWFu aWZlc3QJU0lHTkNSWVBURUQgOjo9IHtPSUQgaWQtY21zLVhQYXRoIFBBUk1TIFhQYXRoU2V0 IH0NaWQtY21zLVhQYXRoCU9CSkVDVCBJREVOVElGSUVSIDo6PSB7aXR1LXQgcmVjb21tZW5k YXRpb24oMCkgeCgyNCkgY21zKDg5NCkNCXNpZ25jcnlwdGlvbigxKSBtYW5pZmVzdCgyKSB4 UGF0aCgwKX0NWFBhdGhTZXQgOjo9IFNFUVVFTkNFIFNJWkUoMS4uTUFYKSBPRiBYUGF0aA1Y UGF0aCA6Oj0gVVRGOFN0cmluZyAoQ09OU1RSQUlORUQgQlkgeyAtLSBYTUwgUGF0aCBMYW5n dWFnZSAyLjAgLS0gfSkNQVRUUklCVVRFIDo6PSBDTEFTUyB7DSZpZAkJCQlPQkpFQ1QgSURF TlRJRklFUiBVTklRVUUsDSZUeXBlCQkJT1BUSU9OQUwsDSZlcXVhbGl0eS1tYXRjaAlNQVRD SElORy1SVUxFIE9QVElPTkFMLA0mbWluQ291bnQJCUlOVEVHRVIgREVGQVVMVCAxLA0mbWF4 Q291bnQJCUlOVEVHRVIgT1BUSU9OQUwgDX0NV0lUSCBTWU5UQVggew1bVFlQRSAJCQkmVHlw ZV0NW0VRVUFMSVRZIE1BVENISU5HIFJVTEUgCSZlcXVhbGl0eS1tYXRjaF0NW0NPVU5UUyBb TUlOICZtaW5Db3VudF0gW01BWCAmbWF4Q291bnRdXQ1JREVOVElGSUVEIEJZIAkJJmlkDX0N TUFUQ0hJTkctUlVMRSA6Oj0gQ0xBU1Mgew0mUGFyZW50TWF0Y2hpbmdSdWxlcwlNQVRDSElO Ry1SVUxFIE9QVElPTkFMLA0mQXNzZXJ0aW9uVHlwZQkJT1BUSU9OQUwsDSZ1bmlxdWVNYXRj aEluZGljYXRvcglBVFRSSUJVVEUgT1BUSU9OQUwsDSZpZAkJCQkJT0JKRUNUIElERU5USUZJ RVIgVU5JUVVFDX0NV0lUSCBTWU5UQVggew1bUEFSRU5UIAkJCSZQYXJlbnRNYXRjaGluZ1J1 bGVzXQ1bU1lOVEFYIAkJCSZBc3NlcnRpb25UeXBlXQ1bVU5JUVVFLU1BVENILUlORElDQVRP UiAJJnVuaXF1ZU1hdGNoSW5kaWNhdG9yXQ1JRCAJCQkJCSZpZA19DU1lc3NhZ2VEaWdlc3Qg Ojo9IE9DVEVUIFNUUklORw1TaWduaW5nVGltZSAgOjo9IFRpbWUNVGltZSA6Oj0gQ0hPSUNF IHsNdXRjVGltZSAJVVRDVGltZSwNZ2VuZXJhbFRpbWUgR2VuZXJhbGl6ZWRUaW1lIA19DWFh LWNvbnRlbnRUeXBlIAkJCUFUVFJJQlVURSA6Oj0NeyBUWVBFIENvbnRlbnRUeXBlIElERU5U SUZJRUQgQlkgaWQtY29udGVudFR5cGUgfQ1pZC1jb250ZW50VHlwZSAJCQlPQkpFQ1QgSURF TlRJRklFUiA6Oj0gDXsgaXNvKDEpIG1lbWJlci1ib2R5KDIpIHVzKDg0MCkgcnNhZHNpKDEx MzU0OSkgcGtjcygxKSBwa2NzOSg5KSAzIH0NYWEtbWVzc2FnZURpZ2VzdCAJCUFUVFJJQlVU RSA6Oj0NeyBUWVBFIE1lc3NhZ2VEaWdlc3QgSURFTlRJRklFRCBCWSBpZC1tZXNzYWdlRGln ZXN0fQ1pZC1tZXNzYWdlRGlnZXN0IAkJT0JKRUNUIElERU5USUZJRVIgOjo9IA17IGlzbygx KSBtZW1iZXItYm9keSgyKSB1cyg4NDApIHJzYWRzaSgxMTM1NDkpIHBrY3MoMSkgcGtjczko OSkgNCB9DWFhLXNpZ25pbmdUaW1lIAkJCUFUVFJJQlVURSA6Oj0NeyBUWVBFIFNpZ25pbmdU aW1lIElERU5USUZJRUQgQlkgaWQtc2lnbmluZ1RpbWUgfQ1pZC1zaWduaW5nVGltZSAJCQlP QkpFQ1QgSURFTlRJRklFUiA6Oj0gDXsgaXNvKDEpIG1lbWJlci1ib2R5KDIpIHVzKDg0MCkg cnNhZHNpKDExMzU0OSkgcGtjcygxKSBwa2NzOSg5KSA1IH0NYWEtc2lnbmNyeXB0ZWRQYXJ0 cwlBVFRSSUJVVEUgOjo9IA17IFRZUEUgU2lnbmNyeXB0ZWRQYXJ0cyBJREVOVElGSUVEIEJZ IGlkLXNpZ25jcnlwdGVkUGFydHN9DWlkLXNpZ25jcnlwdGVkUGFydHMJT0JKRUNUIElERU5U SUZJRVIgOjo9IHtpdHUtdCByZWNvbW1lbmRhdGlvbigwKSB4KDI0KSANY21zKDg5NCkgc2ln bmNyeXB0aW9uKDEpIGF0dHJpYnV0ZXMoMSkgc2lnbmNyeXB0ZWRQYXJ0cygwKX0NRU5EDQ0N DQ0NDQ1Bbm5leCBCCwtPYmplY3QgaWRlbnRpZmllcnMgZGVmaW5lZCBpbiB0aGlzIFJlY29t bWVuZGF0aW9uIHwgSW50ZXJuYXRpb25hbCBTdGFuZGFyZA0oVGhpcyBhbm5leCBmb3JtcyBh biBpbnRlZ3JhbCBwYXJ0IG9mIHRoaXMgUmVjb21tZW5kYXRpb24gfCBJbnRlcm5hdGlvbmFs IFN0YW5kYXJkLikLDQ1UaGlzIHJlY29tbWVhbmRhdGlvbiB8IEludGVybmF0aW9uYWwgU3Rh bmRhcmQgZGVmaW5lcyB0aGUgZm9sbG93aW5nIG9iamVjdCBpZGVudGlmaWVyczoNb2JqZWN0 IGlkZW50aWZpZXIgYXNzb2NpYXRlZCB0byB0aGUgQVNOLjEgbW9kdWxlOg0Je2l0dS10IHJl Y29tbWVuZGF0aW9uKDApIHgoMjQpIGNtcyg4OTQpIG1vZHVsZSgwKSB2ZXJzaW9uMSgxKX0N CZMvSVRVLVQvUmVjb21tZW5kYXRpb24vWC9DTVMvTW9kdWxlL1ZlcnNpb24xIg1vYmplY3Qg aWRlbnRpZmllciBhc3NvY2lhdGVkIHRvIHRoZSBzaWduY3J5cHRlZERhdGE6DQl7aXR1LXQg cmVjb21tZW5kYXRpb24oMCkgeCgyNCljbXMoODk0KSBzaWduY3J5cHRpb24oMSkgZGF0YSgw KX0NCSIvSVRVLVQvUmVjb21tZWFuZGF0aW9uL1gvQ01TL1NpZ25jcnlwdGlvbi9EYXRhIg1v YmplY3QgaWRlbnRpZmllciBhc3NvY2lhdGVkIHRvIHRoZSBzaWduY3J5cHRlZFBhcnRzIGF0 dHJpYnV0ZToNCXtpdHUtdCByZWNvbW1lbmRhdGlvbigwKSB4KDI0KSBjbXMoODk0KSBzaWdu Y3J5cHRpb24oMSkgYXR0cmlidXRlcygxKQ0gc2lnbmNyeXB0ZWRQYXJ0cygwfQ0JIklUVS1U L1JlY29tbWFlbmRhdGlvbi9YL0NNUy9TaWduY3J5cHRpb24vQXR0cmlidXRlcy9TaWduY0Ny eXB0ZWRQYXJ0cyINb2JqZWN0IGlkZW50aWZpZXIgYXNzb2NpYXRlZCB0byB0aGUgeFBhdGhN YW5pZmVzdDoNCXtpdHUtdCByZWNvbW1lbmRhdGlvbigwKSB4KDI0KSBjbXMoODk0KSBzaWdu Y3J5cHRpb24oMSkgbWFuaWZlc3QoMikgeFBhdGgoMH0NCSJJVFUtVC9SZWNvbW1lYW5kYXRp b24vWC9DTVMvU2lnbmNyeXB0aW9uL01hbmlmZXN0L3hQYXRoIg0NDUFubmV4IEMNQmlibGlv Z3JhcGh5DShUaGlzIGFubmV4IGRvZXMgbm90IGZvcm0gYW4gaW50ZWdyYWwgcGFydCBvZiB0 aGlzIFJlY29tbWVuZGF0aW9uIHwgSW50ZXJuYXRpb25hbCBTdGFuZGFyZC4pDQ1bSUVURiBS RkMgNTkxMSAoMjAxMCldLE5ldyBBU04uMSBNb2R1bGVzIGZvciBDcnlwdG9ncmFwaGljIE1l c3NhZ2UgU3ludGF4IChDTVMpIGFuZCBTL01JTUUuDVtJRVRGIFJGQyA1OTEyICgyMDEwKV0g IE5ldyBBU04uMSBNb2R1bGVzIGZvciB0aGUgUHVibGljIEtleSBJbmZyYXN0cnVjdHVyZSBV c2luZyBYLjUwOSAoUEtJWCkNW0lFVEYgUkZDIDYyNjggKDIwMTEpXSBBZGRpdGlvbmFsIE5l dyBBU04uMSBNb2R1bGVzIGZvciB0aGUgQ3J5cHRvZ3JhcGhpYyBNZXNzYWdlIFN5bnRheCAo Q01TKSBhbmQgdGhlIFB1YmxpYyBLZXkgSW5mcmFzdHJ1Y3R1cmUgVXNpbmcgWC41MDkgKFBL SVgpDQ0NX19fX19fX19fX19fX19fX18NX19fX19fX19fX19fX19fX19fX18NDQQNDQMNDQQN DS0gEyBQQUdFICBcKiBNRVJHRUZPUk1BVCAUNDUVIC0NEyBTVFlMRVJFRiAgRG9jbnVtYmVy ICAUVEQgMjU1OCBSZXYuMRUNDUNvbnRhY3Q6B0plYW4tUGF1bCBMZW1haXJlDQdUZWw6KzMz NjE4NDczNzU2DUZheDoNRW1haWw6IBMgSFlQRVJMSU5LICJtYWlsdG86amVhbi1wYXVsLmxl bWFpcmVAdW5pdi1wYXJpcy1kaWRlcm90LmZyIiAUamVhbi1wYXVsLmxlbWFpcmVAdW5pdi1w YXJpcy1kaWRlcm90LmZyFSAHB0F0dGVudGlvbjogVGhpcyBpcyBub3QgYSBwdWJsaWNhdGlv biBtYWRlIGF2YWlsYWJsZSB0byB0aGUgcHVibGljLCBidXQgYW4gaW50ZXJuYWwgSVRVLVQg RG9jdW1lbnQgaW50ZW5kZWQgb25seSBmb3IgdXNlIGJ5IHRoZSBNZW1iZXIgU3RhdGVzIG9m IElUVSwgYnkgSVRVLVQgU2VjdG9yIE1lbWJlcnMgYW5kIEFzc29jaWF0ZXMsIGFuZCB0aGVp ciByZXNwZWN0aXZlIHN0YWZmIGFuZCBjb2xsYWJvcmF0b3JzIGluIHRoZWlyIElUVSByZWxh dGVkIHdvcmsuIEl0IHNoYWxsIG5vdCBiZSBtYWRlIGF2YWlsYWJsZSB0bywgYW5kIHVzZWQg YnksIGFueSBvdGhlciBwZXJzb25zIG9yIGVudGl0aWVzIHdpdGhvdXQgdGhlIHByaW9yIHdy aXR0ZW4gY29uc2VudCBvZiBJVFUtVC4HBw0NDQ0AAAAAAAAAAAAAAAAAAAAACAAAJggAADQI AAA1CAAANggAAF8IAABsCAAAdQgAAHYIAAB9CAAAgwgAAIQIAACGCAAAhwgAAKUIAACmCAAA pwgAALQIAADUCAAA7QgAAO4IAAD2CAAA/ggAAAQJAAAdCQAAHgkAAFYJAABXCQAAdQkAAJIJ AACZCQAAmgkAAJsJAAD57+L51vnSytLC0vnWua35oZihmKGYoZiNhXpsYVtVWwAAAAAAAAoW aExdsQBQSgMAAAoWaERouwBQSgMAABQVaB4ufAAWaF8ItQBtSAkEc0gJBAAbAQiBBEgBAAVo FJNDpxZofBhQAG1ICQRzSAkEFBVoHCZqABZoHCZqAG1IDARzSAwEAA4WaERouwBtSAwEc0gM BAAUFWgeLnwAFmhEaLsAbUgJCHNICQgAEBVocmH0ABZocmH0AENKGAAAFhVocmH0ABZocmH0 ADUIgUNKGABcCIEAFhVocmH0ABZocmH0ADUIgUNKHABcCIEAEBZocmH0ADUIgUNKHABcCIEA DhZobV70AG1IDARzSAwEAA8VaHJh9AAWaHJh9AA6CIEGFmhyYfQAABYVaHJh9AAWaHJh9AA1 CIFDShoAXAiBABkVaHJh9AAWaHJh9AA1CIE6CIFDSiAAXAiBExZocmH0ADUIgToIgUNKIABc CIEMFWhyYfQAFmhyYfQAIAAIAAAmCAAANQgAADYIAABfCAAAdggAAIUIAAD0AAAAAAAAAAAA AAAA5gAAAAAAAAAAAAAAAJYAAAAAAAAAAAAAAAD0AAAAAAAAAAAAAAAA9AAAAAAAAAAAAAAA AI0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmFABYkAUlmAQAAAGdkcmH0AABPAABrZAAA AAAWJAEXJAFJZgEAAAACljkAAzQBCNYwAALH/8ASiiYABvkSAAAAAAAAAAAAAAAAAAAAAAAG yhMAAAAAAAAAAAAAAAAAAAAAFPYDwyYX9gMAABrWCAAAAP8AAAD/G9YIAAAA/wAAAP8c1ggA AAD/AAAA/x3WCAAAAP8AAAD/NNYGAAEFAwAANNYGAAEKAzkAYfYDAABmNAEOAAADJAITpHgA FiQBSWYBAAAAYSQCZ2RyYfQACwAAE6R4ABYkAUlmAQAAAGdkcmH0AAAGhQgAAIYIAACHCAAA lAgAAKYIAACnCAAAtAgAALoIAACtAAAAAAAAAAAAAAAAogAAAAAAAAAAAAAAAJQAAAAAAAAA AAAAAACUAAAAAAAAAAAAAAAAQgAAAAAAAAAAAAAAAKIAAAAAAAAAAAAAAACiAAAAAAAAAAAA AAAAAAAAAAAAAAAAAFEAAGtktwAAABYkARckAUlmAQAAAAKWOQADNAEHlGMBCNYwAALH/8AS iiYgBvkSAAAAAAAAAAAMAQAAAAAAAAAGyhMAAAAAAAAAAAwBAAAAAAAAFPYDwyYX9gMAABrW CAAAAP8AAAD/G9YIAAAA/wAAAP8c1ggAAAD/AAAA/x3WCAAAAP8AAAD/NNYGAAEFAwAANNYG AAEKAzkAYfYDAABmNAEOAAADJAITpHgAFiQBSWYBAAAAYSQCZ2RyYfQACwAAE6R4ABYkAUlm AQAAAGdkcmH0AABRAABrZFAAAAAWJAEXJAFJZgEAAAACljkAAzQBB5TNAQjWMAACx//AEoom YAb5EgAAAAAAAAAA/////wAAAAAABsoTAAAAAAAAAAD/////AAAAABT2A8MmF/YDAAAa1ggA AAD/AAAA/xvWCAAAAP8AAAD/HNYI//////////8d1ggAAAD/AAAA/zTWBgABBQMAADTWBgAB CgM5AGH2AwAAZjQBAAe6CAAA0wgAANQIAADXCAAA7QgAAO4IAADxAAAAAAAAAAAAAAAAjAAA AAAAAAAAAAAAAH4AAAAAAAAAAAAAAAB+AAAAAAAAAAAAAAAAPwAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPgAAa2SAAQAAFiQBFyQBSWYBAAAA ApY5AAM0AQeUZQEI1hoAAcf/iiYABsMmAAAAAAAAAAAAAAAAAAAAABT2A8MmF/YDAAAa1gQA AAD/G9YEAAAA/xzWBAAAAP8d1gQAAAD/NNYGAAEFAwAANNYGAAEKAzkAYfYDAABmNAEOAAAD JAETpHgAFiQBSWYBAAAAYSQBZ2RyYfQAAGQAAGtkHgEAABYkARckAUlmAQAAAAKWOQADNAEH lGUBCNZGAAPH/xgGwBKKJgAGUQYAAAAAAAAAAAAAAAAAAAAAAAaoDAAAAAAAAAAAAAAAAAAA AAAABsoTAAAAAAAAAAAAAAAAAAAAABT2A8MmF/YDAAAa1gwAAAD/AAAA/wAAAP8b1gwAAAD/ AAAA/wAAAP8c1gwAAAD/AAAA/wAAAP8d1gwAAAD/AAAA/wAAAP801gYAAQUDAAA01gYAAQoD OQBh9gMAAGY0AQ4AAAMkAhOkeAAWJAFJZgEAAABhJAJnZHJh9AAABe4IAAD2CAAA/QgAAP4I AAAFCQAAHAkAAB0JAAAeCQAA9AAAAAAAAAAAAAAAAPQAAAAAAAAAAAAAAACiAAAAAAAAAAAA AAAAlQAAAAAAAAAAAAAAAJUAAAAAAAAAAAAAAABDAAAAAAAAAAAAAAAAPgAAAAAAAAAAAAAA AAAABHAAZ2REaLsAAFEAAGtkGgIAABYkARckAUlmAQAAAAKWOQADNAEHlGUBCNYwAALH/xgG iiYABlEGAAAAAAAAAAAMAQAAAAAAAAAGciAAAAAAAAAAAAwBAAAAAAAAFPYDwyYX9gMAABrW CAAAAP8AAAD/G9YIAAAA/wAAAP8c1ggAAAD/AAAA/x3WCAAAAP8AAAD/NNYGAAEFAwAANNYG AAEKAzkAYfYDAABmNAENAAATpHgAFKR4ABYkAUlmAQAAAGdkcmH0AABRAABrZMYBAAAWJAEX JAFJZgEAAAACljkAAzQBB5RlAQjWMAACx/8YBoomAAZRBgAAAAAAAAAAAAAAAAAAAAAABnIg AAAAAAAAAAAAAAAAAAAAABT2A8MmF/YDAAAa1ggAAAD/AAAA/xvWCAAAAP8AAAD/HNYIAAAA /wAAAP8d1ggAAAD/AAAA/zTWBgABBQMAADTWBgABCgM5AGH2AwAAZjQBCwAAE6R4ABYkAUlm AQAAAGdkcmH0AAAHHgkAADsJAABWCQAAVwkAAHUJAACSCQAAmwkAAPgMAAABDQAAFA0AADMN AABBDQAAUA0AAF8NAABwDQAAew0AAHwNAACCDQAApw4AALwOAACPEQAAwxEAAHQSAAD6AAAA AAAAAAAAAAAA+gAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAADwAAAAAAAAAAAAAAAA8AAAAAAA AAAAAAAAAOsAAAAAAAAAAAAAAADmAAAAAAAAAAAAAAAA6wAAAAAAAAAAAAAAAOEAAAAAAAAA AAAAAADhAAAAAAAAAAAAAAAA4QAAAAAAAAAAAAAAAOEAAAAAAAAAAAAAAADhAAAAAAAAAAAA AAAA4QAAAAAAAAAAAAAAAOEAAAAAAAAAAAAAAADhAAAAAAAAAAAAAAAA3AAAAAAAAAAAAAAA AOYAAAAAAAAAAAAAAADcAAAAAAAAAAAAAAAA5gAAAAAAAAAAAAAAANcAAAAAAAAAAAAAAADF AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABIuAAomAAtGAQAPhKcEEYRz/hOkVgBehKcE YIRz/mdkakFkAAAEAgBnZPxORAAABAEAZ2REaLsAAAQAAGdkRGi7AAAEAABnZExdsQAABD0A Z2REaLsAAARKAGdkXwi1AAAERwBnZB4ufAAABEYAZ2REaLsAABabCQAAnQkAAJ8JAACuCQAA xwkAAPILAAALDAAA+AwAAAANAAABDQAAMg0AADMNAABfDQAAZA0AAHANAAB2DQAAfA0AAIIN AACVDQAArg0AAKcOAAC7DgAAvA4AAI8RAADDEQAA+hEAAPwRAAAIEgAACRIAABoSAAAbEgAA IhIAACMSAABKEgAASxIAAFISAABTEgAAXBIAAF0SAABoEgAAaRIAAHISAABzEgAAdBIAAIMS AACJEgAAkhIAAJQSAACpEgAAqxIAAK0SAAD17fXl9eX13NbQ1tDK0MTQ1r25vbXWtbGtppyV nJWclZyVnJWclZyVnKatjq2Oio6GjgAAAAAAAAAAAAAAAAAABhZonwryAAAGFmimPWwAAAwV aPxORAAWaPxORAAADBZoIGl3ADYIgV0IgQASFWioS8oAFmggaXcANgiBXQiBAAwVaKhLygAW aCBpdwAABhZoIGl3AAAGFmj8TkQAAAYWaERouwAABhZoTF2xAAAMFWhMXbEAFmhMXbEAAAoW aAJPEgBQSgMAAAoWaHxpXwBQSgMAAAoWaDZUxQBQSgMAAAoWaERouwBQSgMAABAVaDZUxQAW aERouwBQSgMAAA4WaExdsQBtSAkEc0gJBAAOFmhBGSUAbUgJBHNICQQAFBVoTF2xABZoTF2x AG1ICQRzSAkEMq0SAAAMEwAADRMAAA8TAAAeEwAAJBMAAC0TAAAvEwAARBMAAEYTAABIEwAA qBMAAKkTAACrEwAAuhMAAMATAADJEwAAyxMAAOATAADiEwAA5BMAADwUAAA9FAAAPxQAAE4U AABUFAAAXRQAAF8UAAB0FAAAdhQAAHgUAADgFAAA4RQAAP8UAAABFQAAExUAABQVAAAWFQAA GBUAABoVAAC6FQAAvBUAAL0VAADbFQAA3RUAAO8VAADwFQAA8hUAAPQVAAD2FQAAURYAAHEW AABzFgAAhBYAAIYWAACIFgAAihYAAIwWAADUFgAA1RYAAAgXAAAMFwAADhcAAFMXAAD27+vv 6+/n7+Pv9u/r7+vv5+/j7/bv6+/r7+fv4+/23NXn1evV49XL1evV59Xr1ePVy9Xn1evV49XL xLmuuaAAGhVoHi58ABZopj1sADYIgV0IgW1ICQRzSAkEABQVaB4ufAAWaJ8K8gBtSAkEc0gJ BAAUFWgeLnwAFmimPWwAbUgJBHNICQQADBVoHi58ABZo/E5EAAASFWioS8oAFmggaXcANgiB XQiBAAwVaKhLygAWaCBpdwAADBZo/E5EADYIgV0IgQAGFmifCvIAAAYWaKY9bAAABhZoIGl3 AAAMFWj8TkQAFmj8TkQAABIVaPxORAAWaPxORAA2CIFdCIE/dBIAAA0TAACpEwAAPRQAAOEU AAC9FQAAUxYAANUWAABUFwAApRcAALsXAADHFwAAKhgAAHAYAACHGAAAkxgAAK8YAADoAAAA AAAAAAAAAAAA1AAAAAAAAAAAAAAAANQAAAAAAAAAAAAAAADUAAAAAAAAAAAAAAAAwgAAAAAA AAAAAAAAAMIAAAAAAAAAAAAAAADCAAAAAAAAAAAAAAAAsAAAAAAAAAAAAAAAAMIAAAAAAAAA AAAAAACrAAAAAAAAAAAAAAAApgAAAAAAAAAAAAAAAKEAAAAAAAAAAAAAAAChAAAAAAAAAAAA AAAAkQAAAAAAAAAAAAAAAJEAAAAAAAAAAAAAAACRAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAQAAAKJgALRioAD4QaAxGEjQFehBoDYISNAWdkHi58AAAEAABnZERouwAABAEAZ2REaLsA AAQCAGdk/E5EABIuAAomAAtGAgAPhKcEEYRz/hOkVgBehKcEYIRz/mdkpj1sABIuAAomAAtG AgAPhKcEEYRz/hOkVgBehKcEYIRz/mdkakFkAAATAAADJAMPhKcEEYRz/hOkVgA5RAQAXoSn BGCEc/5hJANnZPxORAAXAAADJAMKJgALRgEAD4SnBBGEc/4TpFYAOUQEAF6EpwRghHP+YSQD Z2RqQWQAABBTFwAAVBcAAGgXAAB9FwAAnRcAAKQXAAClFwAAuxcAAMYXAADHFwAAKhgAAE0Y AABSGAAAbhgAAG8YAABwGAAArxgAAN4YAADxGAAA8hgAAAAZAABlGQAAqBkAALUZAADRGQAA 0hkAAOcZAADoGQAAERoAAPXp29DbxcG7rqqmopePh498dHy7qm67aLtgWE0AAAAAAAAAAAAA FBVo9BfuABZo9BfuAG1ICQRzSAkEAA4WaAoiYABtSAkEc0gJBAAOFmgiV3AAbUgJBHNICQQA ChZoIldwAFBKAwAAChZoHF/CAFBKAwAADhZoTxXUAG1ICQRzSAkEABQVaB4ufAAWaE8V1ABt SAkEc0gJBAAOFmitB0cAbUgMBHNIDAQADhZoHF/CAG1IDARzSAwEABQVaB4ufAAWaBxfwgBt SAwEc0gMBAAGFmgcX8IAAAYWaK0HRwAABhZoRGi7AAAYFWggaXcAFmhEaLsAUEoDAG1ICQRz SAkEAAoWaERouwBQSgMAAAYWaPxORAAAFBVoHi58ABZo3TwnAG1ICQRzSAkEABQWaHxpXwA2 CIFdCIFtSAkEc0gJBAAaFWgeLnwAFmhNbLkANgiBXQiBbUgJBHNICQQAFxVoHi58ABZo3Twn AF0IgW1ICQRzSAkEFBVoHi58ABZopj1sAG1ICQRzSAkEHK8YAADjGAAA8hgAAAAZAABlGQAA hxkAAKkZAAC1GQAA0hkAAOgZAAARGgAARxoAAIgaAADiGgAAHhsAAE8bAADLGwAAJhwAAHIc AAB9HAAAvBwAAN4cAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAADw AAAAAAAAAAAAAAAA8AAAAAAAAAAAAAAAAPAAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA9QAA AAAAAAAAAAAAAOsAAAAAAAAAAAAAAADmAAAAAAAAAAAAAAAA1gAAAAAAAAAAAAAAANYAAAAA AAAAAAAAAADWAAAAAAAAAAAAAAAA1gAAAAAAAAAAAAAAANYAAAAAAAAAAAAAAADWAAAAAAAA AAAAAAAA1gAAAAAAAAAAAAAAAOYAAAAAAAAAAAAAAADGAAAAAAAAAAAAAAAAwQAAAAAAAAAA AAAAALwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABH4AZ2RGP/YAAAQhAGdkHi58ABAc AAomAAtGBQAPhKcEEYRz/l6EpwRghHP+Z2RqQWQAEBwACiYAC0YEAA+EpwQRhHP+XoSnBGCE c/5nZGpBZAAABAAAZ2T0F+4AAAQCAGdkIldwAAAEAABnZERouwAABAEAZ2REaLsAAAQAAGdk Hi58AAAVERoAACYcAABEHAAAchwAAH0cAAB/HAAAuxwAALwcAADRHAAA0hwAANscAADdHAAA 3hwAAO8cAADwHAAA8RwAACsdAAAsHQAAQR0AAEIdAABWHQAAah0AAGwdAACxHQAAsh0AANUd AADoHQAA6h0AADEeAABUHgAAaB4AAGoeAACwHgAA0x4AAOseAADtHgAAMh8AAGYfAAB8HwAA fh8AAMYfAADgHwAA5B8AAOUfAADnHwAA6B8AADkgAABUIAAA+fHm39jRysbCxrvf5sK3u7e7 t7vmraCtu+atoLvmraC75q2gu+atk4yFjIW75ngAGBVo9BfuABZo9BfuAG1IAARuSAAEc0gM BAAMFWi1ESgAFmj0F+4AAAwVaLURKAAWaN8tywAAGBVotREoABZo9BfuAG1IAARuSAAEc0gJ BAAYFWj0F+4AFmj0F+4AbUgABG5IAARzSAkEABIWaNoILwBtSAAEbkgABHNICQQABhZoRj/2 AAAMFWj0F+4AFmj0F+4AAAYWaJw4DwAABhZomwIDAAAMFWgeLnwAFmicOA8AAAwVaB4ufAAW aPQX7gAADBVoHi58ABZoRj/2AAAMFWicOA8AFmj0F+4AABQVaPQX7gAWaPQX7gBtSAkEc0gJ BAAOFmi1ESgAbUgJBHNICQQADBVomwIDABZo9BfuAC/eHAAA7xwAACwdAABWHQAAah0AALId AADVHQAA6B0AADEeAABUHgAAaB4AALAeAADTHgAA6x4AADIfAABmHwAAfB8AAMYfAADoHwAA OSAAAFQgAACAIAAAxSAAAGshAADvAAAAAAAAAAAAAAAA6gAAAAAAAAAAAAAAAOUAAAAAAAAA AAAAAADvAAAAAAAAAAAAAAAA4AAAAAAAAAAAAAAAANsAAAAAAAAAAAAAAADvAAAAAAAAAAAA AAAA4AAAAAAAAAAAAAAAANsAAAAAAAAAAAAAAADvAAAAAAAAAAAAAAAA4AAAAAAAAAAAAAAA ANsAAAAAAAAAAAAAAADvAAAAAAAAAAAAAAAA4AAAAAAAAAAAAAAAANsAAAAAAAAAAAAAAADv AAAAAAAAAAAAAAAA4AAAAAAAAAAAAAAAANsAAAAAAAAAAAAAAADWAAAAAAAAAAAAAAAA0QAA AAAAAAAAAAAAAMwAAAAAAAAAAAAAAADMAAAAAAAAAAAAAAAA1gAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAABH4AZ2QXHQQAAAQhAGdkFx0EAAAEAABnZPQX7gAABH4AZ2TaCC8AAAQhAGdk 2ggvAAAEfgBnZEY/9gAABCEAZ2RGP/YAEBwACiYAC0YFAA+EpwQRhHP+XoSnBGCEc/5nZGpB ZAAAF1QgAADFIAAAySAAANUgAAD9IAAADCEAACYhAAApIQAAayEAAIwhAACtIQAAyyEAAIIi AACKIgAAiyIAAIwiAACNIgAAkCIAALwiAAC9IgAAxSIAAMYiAADHIgAAySIAANkiAADoIgAA 6SIAAOoiAADrIgAAFSMAABYjAAAkIwAAJSMAACYjAAAoIwAANyMAADgjAABJIwAASiMAAHkj AAD17eTZ5NnR2cS0p6CnloyCeKeWp4x0cKCnjIJ4p5agbHRwoGWMgqcAAAAMFWgXHQQAFmj0 F+4AAAYWaMpiigAABhZoZAibAAAGFmgXHQQAABIWaNQYeQBtSAAEbkgABHNICQQAEhZoymKK AG1IAARuSAAEc0gJBAASFmhkCJsAbUgABG5IAARzSAkEABIWaBcdBABtSAAEbkgABHNICQQA DBVo9BfuABZo9BfuAAAYFWj0F+4AFmj0F+4AbUgABG5IAARzSAkEAB8VaB4ufAAWaPQX7gAw SnkANQiBbUgABG5IAARzSAwEGBVo9BfuABZo9BfuAG1IAARuSAAEc0gMBAAOFmi1ESgAbUgJ BHNICQQAFBVo9BfuABZo9BfuAG1ICQRzSAkEABAVaBcdBAAWaPQX7gAwSn0AAA4WaBcdBABt SAkEc0gJBAAUFWgeLnwAFmj0F+4AbUgMBHNIDAQnayEAAIwhAACtIQAAyyEAAP8hAAAJIgAA GSIAAC0iAAA/IgAAUiIAAGkiAAB9IgAAgiIAAMYiAADZIgAAJSMAADgjAAB5IwAAnyMAAN8j AAAFJAAARSQAAGwkAACzJAAA2CQAABwlAAD6AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPoA AAAAAAAAAAAAAADwAAAAAAAAAAAAAAAA8AAAAAAAAAAAAAAAAPAAAAAAAAAAAAAAAADwAAAA AAAAAAAAAAAA8AAAAAAAAAAAAAAAAPAAAAAAAAAAAAAAAADwAAAAAAAAAAAAAAAA8AAAAAAA AAAAAAAAAPAAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA8AAAAAAAAAAAAAAAAPoAAAAAAAAA AAAAAADwAAAAAAAAAAAAAAAA6wAAAAAAAAAAAAAAAOYAAAAAAAAAAAAAAADrAAAAAAAAAAAA AAAA5gAAAAAAAAAAAAAAAOEAAAAAAAAAAAAAAADcAAAAAAAAAAAAAAAA4QAAAAAAAAAAAAAA ANwAAAAAAAAAAAAAAADhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABH4AZ2RLCkIAAAQhAGdk SwpCAAAEfgBnZGQImwAABCEAZ2RkCJsAAAR+AGdkFx0EAAAEIQBnZB4ufAAABCEAZ2QXHQQA ABl5IwAAeyMAAHwjAACfIwAAsCMAALEjAADfIwAABSQAABYkAAAXJAAARSQAAGwkAACzJAAA 2CQAABwlAAAzJQAANCUAAEUlAABVJQAAcCUAAHolAAB8JQAAhiUAAIglAACVJQAAlyUAAKwl AACuJQAAwyUAAMUlAADVJQAA1yUAAD8mAAARJwAAMycAAEgnAABoJwAAbycAAK8nAACwJwAA sScAALYnAADAJwAAyycAANMnAAAIKAAAEygAABUoAAD59fnr4dT5yuHU+dT51PnG+b6zqrOq s6qzqrOqs6qzqrOis5qzjYN5g42zqrOqswAAABIWaLN2UQBtSAAEbkgABHNICQQAEhZoD19v AG1IAARuSAAEc0gJBAAYFWhZCuAAFmhZCuAAbUgABG5IAARzSAkEAA4WaMpiigBtSAkEc0gJ BAAOFmizdlEAbUgJBHNICQQAEBVoWQrgABZoWQrgADBKfQAAFBVoWQrgABZoWQrgAG1ICQRz SAkEAA4WaCJXcABtSAkEc0gJBAAGFmi1ESgAABIWaEsKQgBtSAAEbkgABHNICQQAGBVo9Bfu ABZo9BfuAG1IAARuSAAEc0gJBAASFmjKYooAbUgABG5IAARzSAkEABIWaGQImwBtSAAEbkgA BHNICQQABhZoZAibAAAMFWj0F+4AFmj0F+4ALxwlAABFJQAAVSUAAHAlAAB8JQAAiCUAAJcl AACuJQAAxSUAANclAADuJQAA/CUAAAsmAAAeJgAALyYAAD8mAABvJwAAwCcAABUoAAAaKAAA sygAAPIoAAByKQAAfikAAPoAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA8AAAAAAAAAAAAAAA AOAAAAAAAAAAAAAAAADgAAAAAAAAAAAAAAAA4AAAAAAAAAAAAAAAAOAAAAAAAAAAAAAAAADg AAAAAAAAAAAAAAAA4AAAAAAAAAAAAAAAAOAAAAAAAAAAAAAAAADgAAAAAAAAAAAAAAAA4AAA AAAAAAAAAAAAAOAAAAAAAAAAAAAAAADgAAAAAAAAAAAAAAAA4AAAAAAAAAAAAAAAAPAAAAAA AAAAAAAAAADbAAAAAAAAAAAAAAAA1gAAAAAAAAAAAAAAANEAAAAAAAAAAAAAAADMAAAAAAAA AAAAAAAAxwAAAAAAAAAAAAAAAMwAAAAAAAAAAAAAAADRAAAAAAAAAAAAAAAAAAAAAAQhAGdk ymKKAAAEAABnZMpiigAABAEAZ2QiV3AAAAQbAGdkWQrgAAAEIQBnZFkK4AAQHAAKJgALRgYA D4SnBBGEc/5ehKcEYIRz/mdkakFkAAAEAABnZFkK4AAABAIAZ2QiV3AAAAR+AGdkSwpCAAAX FSgAABooAABZKAAAdSgAALMoAADDKAAAyCgAAPIoAABxKQAAcikAAH4pAABJKgAAVSoAAFYq AABXKgAAcCoAAHEqAAByKgAAdCoAAHUqAACuKgAAsioAAO4qAADvKgAA+SoAAHMrAAB0KwAA 0ysAAN0rAADpKwAA6isAAO4rAAD4KwAA/isAAAIsAAAMLAAA0iwAANMsAAD49PD06eXp9N74 9Nfwz/DEz8DP9Lz0tKeap/SR9IqDb4PpY+lfAAYWaEseJgAAFxVoymKKABZoymKKADUIgW1I CQRzSAkEJxVoAxWGABZoIldwADBKfQA1CIFDShYAT0oAAFFKAABtSAkIc0gJCAwVaAMVhgAW aCJXcAAADBVoOC7GABZoymKKAAAQFWjKYooAFmjKYooAMEp9AAAYFWgeLnwAFmiNZOIAQ0oU AG1ICQRzSAkEABgVaB4ufAAWaOsypQBDShQAbUgJBHNICQQADhZo6zKlAG1ICQRzSAkEAAYW aOsypQAABhZoL0bkAAAVAgiBA2p8AgAABggBFmi1ESgAVQgBDwNqAAAAABZotREoAFUIAQwV aGY2LwAWaMpiigAADBVo8UPgABZoymKKAAAGFmhMZWcAAAwVaMpiigAWaMpiigAABhZotREo AAAGFmjKYooAAA4WaCJXcABtSAkEc0gJBCV+KQAA7ykAAJoqAADuKgAAdCsAAOorAAD+KwAA LywAAEosAABgLAAAlSwAAMAsAADtLAAAGS0AAD8tAABoLQAAeC0AAJMtAACVLQAAyy0AAEou AAD6AAAAAAAAAAAAAAAA6gAAAAAAAAAAAAAAAOoAAAAAAAAAAAAAAADdAAAAAAAAAAAAAAAA ywAAAAAAAAAAAAAAAMYAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAAwQAAAAAAAAAAAAAAALwA AAAAAAAAAAAAAAC8AAAAAAAAAAAAAAAAvAAAAAAAAAAAAAAAALwAAAAAAAAAAAAAAAC8AAAA AAAAAAAAAAAAvAAAAAAAAAAAAAAAALwAAAAAAAAAAAAAAAC8AAAAAAAAAAAAAAAAvAAAAAAA AAAAAAAAALwAAAAAAAAAAAAAAAC3AAAAAAAAAAAAAAAAsgAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAEHABnZMpiigAABAAAZ2T+IjAAAAR+AGdkymKKAAAEIQBnZMpiigAABAIAZ2QDFYYA EgAACiYAC0YHAA+EpwQRhHP+E6RWAF6EpwRghHP+Z2RqQWQAAAwbAA+EGgMRhOb8XoQaA2CE 5vxnZB4ufAAQHAAKJgALRggAD4SnBBGEc/5ehKcEYIRz/mdkakFkAAAEAABnZMpiigAAFNMs AADXLAAA/ywAAA0tAAAOLQAAJS0AACYtAAAqLQAAKy0AACwtAABRLQAAZi0AAG4tAACSLQAA ky0AAJQtAACVLQAAyi0AAMstAADOLQAA1S0AAPMtAAD9LQAASi4AAEsuAABMLgAATy4AAFsu AACNLgAAki4AAJ4uAACiLgAAsy4AAMouAADMLgAAzi4AAM8uAADQLgAA0y4AANcuAAAZLwAA Hi8AACovAAAuLwAAQi8AAFkvAABbLwAAXS8AAF4vAABfLwAAYi8AAG4vAACXLwAAoC8AAPz4 8fjx+Pz4/Pjx+PHt8enl3tO98bTxsKmimaKZouWQopmijKmimaKZouWQopmijKmimaKwAAAA AAAAAAAAAAAGFmjWF98AABAVaP4iMAAWaP4iMAAwSn0AABAVaP4iMAAWaMpiigAwSn0AAAwV aP4iMAAWaMpiigAADBVo/iIwABZo/iIwAAAGFmgSHfAAABAVaNYX3wAWaMpiigAwSn0AACsV aLURKAAWaMpiigA1CIFDShIAT0oEAFFKBABeSgQAYUoSAG1ICQRzSAkEFBVoymKKABZoymKK AG1ICQRzSAkEAAwVaMpiigAWaP4iMAAABhZo/iIwAAAGFmjKYooAAAYWaBBWtwAADBVoymKK ABZoymKKAAAGFmhLHiYAAAYWaDg6/wA1Si4AAM4uAABdLwAA5i8AAD8wAAChMAAA0DAAAN8x AABcMgAA0zMAAAY0AAAlNAAAQDQAAEU0AAB9NAAAtTQAALc0AAD6NAAAajUAANY1AAAGNgAA 4DYAAAM3AAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAA AAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA9QAAAAAAAAAA AAAAAPUAAAAAAAAAAAAAAADwAAAAAAAAAAAAAAAA6wAAAAAAAAAAAAAAAOIAAAAAAAAAAAAA AADiAAAAAAAAAAAAAAAA4gAAAAAAAAAAAAAAAOIAAAAAAAAAAAAAAADiAAAAAAAAAAAAAAAA 3QAAAAAAAAAAAAAAANUAAAAAAAAAAAAAAADNAAAAAAAAAAAAAAAAyAAAAAAAAAAAAAAAAMAA AAAAAAAAAAAAAADIAAAAAAAAAAAAAAAAAAAAAAAACAAACiYAC0YLAGdkakFkAAAEgQBnZE4Q JwAIAAAKJgALRgoAZ2RqQWQACB0ACiYAC0YMAGdkakFkAAAEHABnZBId8AAACH4AD4RwCF6E cAhnZNYX3wAABB0AZ2TWF98AAAQAAGdkymKKAAAEHABnZE4QJwAABB0AZ2T+IjAAABagLwAA qi8AALovAADLLwAA4i8AAOQvAADmLwAA5y8AAOgvAAD4LwAAAjAAACIwAAAkMAAAOzAAAD0w AAA/MAAAQDAAAEEwAABEMAAAVDAAAGcwAABzMAAAfzAAAIYwAACdMAAAnzAAAKEwAACiMAAA ozAAAMwwAADOMAAA0DAAANMwAADjMAAA4jEAAPIxAAD4MQAA+TEAABIyAAATMgAAFDIAABcy AAAYMgAANDIAAFIyAABfMgAAazIAAJQzAACiMwAAtjMAALszAADTMwAA9/P37OPs39jsz+zP 7M/s39jsxuzP7M/sz+zf2OzP7L+2v7ayqrKfqpuqv7K/tr+2v5e/AAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYWaEseJgAABhZoL0bkAAAVAgiBA2r5AgAA BggBFmi1ESgAVQgBDwNqAAAAABZotREoAFUIAQYWaLURKAAAEBVoThAnABZoymKKADBKfQAA DBVoThAnABZoymKKAAAQFWjWF98AFmjKYooAMEp9AAAQFWgSHfAAFmjKYooAMEp9AAAMFWj+ IjAAFmj+IjAAAAYWaNYX3wAAEBVo/iIwABZoymKKADBKfQAADBVo/iIwABZoymKKAAAGFmgS HfAAABAVaBId8AAWaBId8AAwSn0AM9MzAADVMwAA4TMAAOozAADwMwAABTQAAAY0AAAXNAAA JTQAADE0AAAzNAAAVTQAAFY0AACNNAAAjjQAALQ0AAC1NAAAtzQAALg0AADINAAA2TQAAPo0 AAAFNQAAOjUAADs1AABpNQAAajUAAHQ1AADo0LijuNCakYqGioaKhoqCinpvkW9mX1iGX0YA IxVowQwvABZoymKKADUIgU9KBABRSgQAXkoEAG1ICQRzSAkEDBVoEh3wABZoEh3wAAAMFWgS HfAAFmjKYooAABAVaBId8AAWaMpiigAwSn0AABQVaMpiigAWaMpiigBtSAkEc0gJBAAOFmgS HfAAbUgJBHNICQQABhZoEFa3AAAGFmgSHfAAAAwVaMpiigAWaMpiigAAEBVo1hffABZoymKK ADBKfQAAEBVo1hffABZo/iIwADBKfQAAKBZoSx4mADUIgUNKEgBPSgQAUUoEAFwIgV5KBABh ShIAbUgJBHNICQQALhVowQwvABZo/iIwADUIgUNKEgBPSgQAUUoEAFwIgV5KBABhShIAbUgJ BHNICQQALhVowQwvABZoymKKADUIgUNKEgBPSgQAUUoEAFwIgV5KBABhShIAbUgJBHNICQQA LhVowQwvABZoEh3wADUIgUNKEgBPSgQAUUoEAFwIgV5KBABhShIAbUgJBHNICQQbdDUAAJA1 AACkNQAApzUAALM1AAC4NQAA1jUAANc1AADfNQAABjYAAAs2AAAgNgAAJTYAAFE2AABrNgAA uDYAAMY2AADHNgAA1DYAAOA2AAApNwAALDcAAE43AABTNwAAbTcAAHA3AACTNwAAlDcAAL43 AADCNwAAxDcAAO03AAD13/XX9czCtaiQ9Yj11/WQ9Yj1tYR9hH2EfYR2cnZlAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgVaE4QJwAWaMpiigBtSAAEbkgA BHNICQQABhZoEFa3AAAMFWhOECcAFmjKYooAAAwVaMpiigAWaMpiigAABhZoThAnAAAOFmhO ECcAbUgJBHNICQQALhVosW7GABZoymKKADUIgUNKEgBPSgQAUUoEAFwIgV5KBABhShIAbUgJ BHNICQQAGBVoymKKABZoymKKAG1IAARuSAAEc0gMBAAYFWjKYooAFmjKYooAbUgABG5IAARz SAkEABIWaE4QJwBtSAAEbkgABHNICQQAFBVoFw9UABZoymKKAG1ICQRzSAkEAA4WaBcPVABt SAkEc0gJBAArFWjBDC8AFmjKYooANQiBQ0oSAE9KBABRSgQAXkoEAGFKEgBtSAkEc0gJBBQV aMpiigAWaMpiigBtSAkEc0gJBB8DNwAAKTcAAE83AABtNwAAkDcAAL83AADENwAA9DcAAMI5 AAD9OQAAHzoAADk6AABBOgAAejoAAH86AADfOgAAyzsAAPA7AAAZPAAARDwAAGY8AACOPAAA xDwAAMk8AAD+PAAA+gAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA9QAA AAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPAAAAAA AAAAAAAAAADjAAAAAAAAAAAAAAAA4wAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD1AAAAAAAA AAAAAAAA9QAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAADwAAAAAAAAAAAAAAAA8AAAAAAAAAAA AAAAANYAAAAAAAAAAAAAAADWAAAAAAAAAAAAAAAA0QAAAAAAAAAAAAAAANEAAAAAAAAAAAAA AADRAAAAAAAAAAAAAAAA0QAAAAAAAAAAAAAAANEAAAAAAAAAAAAAAADWAAAAAAAAAAAAAAAA AAAAAAAAAAR+AGdk9nD7AAAMIQAPhDQGEYRz/l6ENAZghHP+Z2T2cPsAAAwhAA+ENAYRhHP+ XoQ0BmCEc/5nZE4QJwAABBwAZ2ROECcAAAR+AGdkThAnAAAEgQBnZE4QJwAAGO03AADuNwAA 8TcAAPI3AAD0NwAA9zcAAPs3AACbOAAApTgAAHM5AACIOQAA3TkAAOM5AADkOQAAHzoAACI6 AAA5OgAAPDoAAEE6AABEOgAAdToAAHY6AAB5OgAAfToAAH86AACAOgAAgzoAAJ86AACuOgAA 3zoAAOA6AADlOgAAoTsAALE7AAC+OwAAGTwAABw8AABIPAAASTwAAGY8AABpPAAAwzwAAMc8 AAD3PAAA+DwAAPs8AAD8PAAA/jwAAAE9AAAMPQAAEj0AAOnc6dzVzNXI1czVxMDVvNW81bzV rNWo1bzM1czVvMzVn5vVm9Wb1ZvVqNWL1YvVhJ+AAAAGFmgXD1QAAAwVaPZw+wAWaMpiigAA HwAIgRVoThAnABZoymKKABdo6RZpAGNIAQBkaOCSQ6cGFmj2cPsAABAVaPZw+wAWaMpiigAw Sn0AAAYWaBBWtwAAHwAIgRVoThAnABZoymKKABdo6RZpAGNIAQBkaNqSQ6cGFmhOECcAAAYW aNQYeQAABhZoFAH+AAAGFmhnHBUAABAVaE4QJwAWaMpiigAwSn0AAAwVaE4QJwAWaMpiigAA GBVoThAnABZoymKKAG1IAARuSAAEc0gJBAArAAiBFWhOECcAFmjKYooAF2jpFmkAY0gBAGRo 4JJDp21IAARuSAAEc0gJBAAyEj0AABM9AAAsPQAALT0AAC49AAAxPQAAMj0AADs9AAA8PQAA 4j0AAOM9AADnPQAA/j0AAAQ+AAAIPgAAHz4AADw+AABjPgAAtz4AALg+AADaPgAA2z4AAAI/ AAAGPwAACD8AAAw/AAAXPwAAHT8AACE/AAAsPwAAZT8AAIc/AACMPwAAlj8AALc/AADWPwAA 2j8AAPk/AAD8PwAAMEAAAHFAAACIQAAAsEAAALpAAADXQAAA9/Po9+T33dnd0su3y6yjrJaP i4+Lj4ePy7fLrKOslqyjrH+sd6x/rKOso6wAAAAAAAAAAAAAAAAAAA4WaE0cEABtSAkEc0gJ BAAOFmgXD1QAbUgJBHNICQQABhZoEFa3AAAGFmhNHBAAAAwVaE0cEAAWaE0cEAAAGBVoTRwQ ABZoTRwQAG1IAARuSAAEc0gJBAAQFWhNHBAAFmhNHBAAMEp9AAAUFWhNHBAAFmhNHBAAbUgJ BHNICQQAJxVoAxWGABZoIldwADBKfQA1CIFDShYAT0oAAFFKAABtSAkIc0gJCAwVaAMVhgAW aCJXcAAADBVoymKKABZoymKKAAAGFmixbsYAAAwVaPZw+wAWaMpiigAABhZoL0bkAAAVAgiB A2p2AwAABggBFmgXD1QAVQgBBhZoFw9UAAAPA2oAAAAAFmgXD1QAVQgBACz+PAAA4j0AAOM9 AAAEPgAAPD4AAGM+AACQPgAAtD4AANc+AAADPwAACD8AAB0/AABlPwAAhz8AAKxAAADXQAAA 8UAAAAZBAAAfQQAASkEAAH9BAACwQQAAy0EAAAdCAAAUQgAAFkIAAPoAAAAAAAAAAAAAAAD1 AAAAAAAAAAAAAAAA8AAAAAAAAAAAAAAAAOsAAAAAAAAAAAAAAADmAAAAAAAAAAAAAAAA4QAA AAAAAAAAAAAAAOEAAAAAAAAAAAAAAADhAAAAAAAAAAAAAAAA4QAAAAAAAAAAAAAAANgAAAAA AAAAAAAAAADwAAAAAAAAAAAAAAAA6wAAAAAAAAAAAAAAAOYAAAAAAAAAAAAAAADrAAAAAAAA AAAAAAAA6wAAAAAAAAAAAAAAAOYAAAAAAAAAAAAAAADhAAAAAAAAAAAAAAAA4QAAAAAAAAAA AAAAAOEAAAAAAAAAAAAAAADhAAAAAAAAAAAAAAAA4QAAAAAAAAAAAAAAAOEAAAAAAAAAAAAA AADhAAAAAAAAAAAAAAAA4QAAAAAAAAAAAAAAAOEAAAAAAAAAAAAAAAAAAAAACH4AD4QAAF6E AABnZBBWtwAABH4AZ2RNHBAAAAQhAGdkTRwQAAAEAABnZE0cEAAABAIAZ2QDFYYAAAQAAGdk ymKKAAAEHABnZPZw+wAAGddAAADxQAAAH0EAAH9BAACwQQAAC0IAABNCAAAUQgAAFkIAABlC AAAgQgAAOkIAAERCAACRQgAAk0IAAJZCAACZQgAAo0IAALhCAADIQgAA2EIAAN5CAADfQgAA +EIAAPlCAAD6QgAA/0IAAABDAAAYQwAAGUMAABpDAAAcQwAAHkMAACFDAAAkQwAALkMAAEJD AABSQwAAYkMAAGhDAADz6N3o3dbS1se+x77Htsetx63HraWZpYqZgpnHea3Htsetx63HrXEA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOFmjcVS4AbUgJBHNICQQAEBVoLXx4ABZoLXx4 ADBKfQAADhZoL0bkAG1ICQRzSAkEAB0CCIEDavMDAAAGCAEWaK84fwBVCAFtSAkEc0gJBBcD agAAAAAWaK84fwBVCAFtSAkEc0gJBA4WaK84fwBtSAkEc0gJBAAQFWgtfHgAFmhNHBAAMEp9 AAAOFmhNHBAAbUgJBHNICQQAEBVoTRwQABZoTRwQADBKfQAAFBVoTRwQABZoTRwQAG1ICQRz SAkEAAYWaBBWtwAADBVoTRwQABZoTRwQAAAUFWhNHBAAFmhNHBAAbUgMBHNIDAQAFBVoHi58 ABZoTRwQAG1IDARzSAwEABgVaE0cEAAWaE0cEABtSAAEbkgABHNIDAQnFkIAAJFCAAAcQwAA pkMAAPpDAAD6RAAAVkUAAHNFAACTRQAAp0UAANNFAADXRQAA5UUAAPVFAAAjRgAAJkYAAFhG AACERgAAokYAANtGAAD6AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAADw AAAAAAAAAAAAAAAA8AAAAAAAAAAAAAAAAPAAAAAAAAAAAAAAAADjAAAAAAAAAAAAAAAA3gAA AAAAAAAAAAAAAN4AAAAAAAAAAAAAAADeAAAAAAAAAAAAAAAA3gAAAAAAAAAAAAAAAM8AAAAA AAAAAAAAAADeAAAAAAAAAAAAAAAA3gAAAAAAAAAAAAAAAMoAAAAAAAAAAAAAAAC9AAAAAAAA AAAAAAAAygAAAAAAAAAAAAAAALAAAAAAAAAAAAAAAACrAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAR+AGdkXAlqAAAMIQAPhDQGEYRz/l6ENAZghHP+Z2RcCWoAAAwhAA+ENAYRhHP+ XoQ0BmCEc/5nZC18eAAABH4AZ2QeLnwAAA4hAA+ENAYRhHP+E6QAAF6ENAZghHP+Z2R9NVwA AAR+AGdkfTVcAAAMIQAPhDQGEYRz/l6ENAZghHP+Z2R9NVwAAAQcAGdkLXx4AAAEHQBnZE0c EAAABBwAZ2RNHBAAABNoQwAAaUMAAIJDAACDQwAAhEMAAIlDAACKQwAAoUMAAKJDAACjQwAA pEMAAKlDAACsQwAAu0MAANZDAADXQwAA8EMAAPFDAADyQwAA90MAAPhDAAD6QwAA/UMAAAxE AABKRAAAS0QAAFJEAABTRAAAaUQAANJEAADTRAAA1kQAANdEAADYRAAA2UQAAPJEAADzRAAA 9EQAAPZEAAD3RAAA+EQAAPlEAADz69zz1PPJwbivya/J6/ProPPU88mVr5XBlcGVyYp/68nz 63Dz1PPJ6wAAAAAAAAAAAAAAAAAAAB0CCIEDamoFAAAGCAEWaNxVLgBVCAFtSAkEc0gJBBQV aNxVLgAWaNxVLgBtSAkEc0gJBAAUFWjcVS4AFmhNHBAAbUgJBHNICQQAFBVoLXx4ABZoTRwQ AG1ICQRzSAkEAB0CCIEDau0EAAAGCAEWaNxVLgBVCAFtSAkEc0gJBBAVaC18eAAWaE0cEAAw Sn0AABAVaC18eAAWaC18eAAwSn0AAA4WaC18eABtSAkEc0gJBAAUFWhNHBAAFmhNHBAAbUgJ BHNICQQADhZoL0bkAG1ICQRzSAkEAB0CCIEDanAEAAAGCAEWaNxVLgBVCAFtSAkEc0gJBA4W aNxVLgBtSAkEc0gJBAAXA2oAAAAAFmjcVS4AVQgBbUgJBHNICQQAKflEAAD6RAAAK0UAADtF AABWRQAAc0UAANdFAADlRQAAIEYAACFGAAAkRgAAJkYAAFhGAABbRgAAg0YAAIRGAACiRgAA FEgAABVIAABbSAAAaUgAAGpIAACcSAAAxEgAAMVIAADxSAAABEkAAPjw5/Da09rTw9O4q6CV jYB8dWhhdWFWS1arAAAAAAAAAAAAAAAAAAAAABQVaB4ufAAWaFwJagBtSAwEc0gMBAAUFWge LnwAFmg8CC8AbUgMBHNIDAQADBVoHi58ABZoPAgvAAAYFWgeLnwAFmg8CC8AbUgABG5IAARz SAkEAAwVaB4ufAAWaFwJagAABhZoXAlqAAAYFWgeLnwAFmhcCWoAbUgABG5IAARzSAkEAA4W aFwJagBtSAwEc0gMBAAUFWjtRTQAFmhNHBAAbUgMBHNIDAQAFBVoHi58ABZoLXx4AG1IDARz SAwEABgVaB4ufAAWaE0cEABtSAAEbkgABHNIDAQAFBVoHi58ABZofTVcAG1IDARzSAwEAB8A CIEVaB4ufAAWaH01XAAXaOkWaQBjSAEAZGjbkkOnDBVoHi58ABZofTVcAAAYFWgeLnwAFmh9 NVwAbUgABG5IAARzSAkEABAVaB4ufAAWaIkhKwAwSn0AAA4WaIkhKwBtSAkEc0gJBAAOFmhN HBAAbUgJBHNICQQa20YAABtHAABeRwAAmUcAANNHAAANSAAAEkgAABVIAABbSAAAZ0gAAJlI AAC/SAAA7EgAAPFIAAA0SQAAZEkAAI5JAACcSQAAqkkAALdJAADESQAA1UkAAOVJAAD6AAAA AAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAA AAAAAAAAAPoAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA7AAAAAAAAAAAAAAAAPUAAAAAAAAA AAAAAAD1AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD1AAAAAAAAAAAA AAAA3wAAAAAAAAAAAAAAAN8AAAAAAAAAAAAAAADSAAAAAAAAAAAAAAAAyQAAAAAAAAAAAAAA AMkAAAAAAAAAAAAAAADJAAAAAAAAAAAAAAAAyQAAAAAAAAAAAAAAAMkAAAAAAAAAAAAAAADJ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAh+AA+EwQdehMEHZ2SAPVUA AAwhAA+ENAYRhHP+XoQ0BmCEc/5nZPIyPwAADCEAD4Q0BhGEc/5ehDQGYIRz/mdkLXx4AAAI gQAPhG4EXoRuBGdkHi58AAAEfgBnZB4ufAAABH4AZ2RcCWoAABYESQAABUkAAC1JAAAuSQAA MUkAADJJAAA0SQAAY0kAAGRJAAB2SQAAd0kAAI1JAACOSQAAtEkAAONJAADkSQAA5UkAAO9J AADwSQAA8UkAAAhKAAAJSgAAHUoAAEhKAABRSgAAUkoAAFNKAABqSgAAa0oAAPPm0ObQ5sa5 rKKsmJSQiX6YcWdxYFlgmHFncU8AAAAAAAAAAAAAAAAAABIWaBErgQBtSAAEbkgABHNICQQA DBVoHi58ABZo8jI/AAAMFWgeLnwAFmgRK4EAABIWaO4P3gBtSAAEbkgABHNICQQAGBVoTRwQ ABZoESuBAG1IAARuSAAEc0gJBAAUFWjyMj8AFmhNHBAAbUgJCHNICQgADBVoLXx4ABZoTRwQ AAAGFmiAPVUAAAYWaPIyPwAAEhZo8jI/AG1IAARuSAAEc0gJBAASFmgtfHgAbUgABG5IAARz SAkEABgVaC18eAAWaE0cEABtSAAEbkgABHNICQQAGBVoLXx4ABZoXAlqAG1IAARuSAAEc0gJ BAASFmhcCWoAbUgABG5IAARzSAkEACsACIEVaB4ufAAWaE0cEAAXaOkWaQBjSAEAZGjbkkOn bUgABG5IAARzSAwEGBVoHi58ABZoTRwQAG1IAARuSAAEc0gMBAAYFWgeLnwAFmgtfHgAbUgA BG5IAARzSAwEHOVJAAAISgAAHkoAAEVKAABISgAAa0oAANxKAADdSgAAAEsAABZLAAA9SwAA QEsAAGNLAACkSwAA1EsAAPdLAAANTAAANEwAADdMAABaTAAAnEwAAMxMAADvTAAABU0AAPIA AAAAAAAAAAAAAADtAAAAAAAAAAAAAAAA7QAAAAAAAAAAAAAAAO0AAAAAAAAAAAAAAADyAAAA AAAAAAAAAAAA5AAAAAAAAAAAAAAAAN8AAAAAAAAAAAAAAADyAAAAAAAAAAAAAAAA2gAAAAAA AAAAAAAAANoAAAAAAAAAAAAAAADaAAAAAAAAAAAAAAAA8gAAAAAAAAAAAAAAAOQAAAAAAAAA AAAAAADkAAAAAAAAAAAAAAAA8gAAAAAAAAAAAAAAANoAAAAAAAAAAAAAAADaAAAAAAAAAAAA AAAA2gAAAAAAAAAAAAAAAPIAAAAAAAAAAAAAAADkAAAAAAAAAAAAAAAA5AAAAAAAAAAAAAAA AM0AAAAAAAAAAAAAAADIAAAAAAAAAAAAAAAAAAAAAAAABH4AZ2SAPVUAAAwhAA+ENAYRhHP+ XoQ0BmCEc/5nZIA9VQAABH4AZ2QRK4EAAAR+AGdk0lGLAAAIfgAPhMEHXoTBB2dkgD1VAAAE fgBnZB4ufAAADCEAD4Q0BhGEc/5ehDQGYIRz/mdkESuBAAAXa0oAANtKAADcSgAA3UoAAOdK AADoSgAA6UoAAABLAAABSwAAFUsAABZLAAAXSwAAPUsAAD5LAABASwAASUsAAEpLAABLSwAA YksAAGNLAACjSwAApEsAAK9LAADRSwAA00sAANRLAADeSwAA30sAAOBLAAD3SwAA+EsAAAxM AAANTAAADkwAADRMAAA1TAAAN0wAAEBMAABBTAAAQkwAAFlMAABaTAAAm0wAAJxMAAC8TAAA yUwAAMtMAADMTAAA1kwAANdMAADYTAAA70wAAARNAAAFTQAABk0AACxNAAAtTQAA+fLu5NfN 1+7Jwu7C7sLk183XuLGtsa2xreTXzdfuycLuwu7C5NfN17ixrbGtsaacj82Praatpq0AABgV aE0cEAAWaIA9VQBtSAAEbkgABHNICQQAEhZogD1VAG1IAARuSAAEc0gJBAAMFWhNHBAAFmiA PVUAAAYWaIA9VQAADBVogD1VABZogD1VAAASFmgRK4EAbUgABG5IAARzSAkEAAwVaE0cEAAW aBErgQAABhZo8jI/AAASFmjuD94AbUgABG5IAARzSAkEABgVaE0cEAAWaBErgQBtSAAEbkgA BHNICQQAEhZo8jI/AG1IAARuSAAEc0gJBAAGFmgRK4EAAAwVaE0cEAAWaPIyPwAADBVo8jI/ ABZo8jI/ADgFTQAALE0AAC9NAABSTQAAk00AAMNNAADETQAA6k0AAAROAAArTgAALk4AAFVO AACWTgAAyk4AAMtOAADyTgAADE8AADNPAAA2TwAAXU8AAJ5PAADSTwAA008AANRPAAD6AAAA AAAAAAAAAAAA+gAAAAAAAAAAAAAAAO0AAAAAAAAAAAAAAADkAAAAAAAAAAAAAAAA5AAAAAAA AAAAAAAAAN8AAAAAAAAAAAAAAADtAAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAA AAAAAAD6AAAAAAAAAAAAAAAA7QAAAAAAAAAAAAAAAOQAAAAAAAAAAAAAAADkAAAAAAAAAAAA AAAA3wAAAAAAAAAAAAAAAO0AAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAA APoAAAAAAAAAAAAAAADtAAAAAAAAAAAAAAAA2gAAAAAAAAAAAAAAANoAAAAAAAAAAAAAAADf AAAAAAAAAAAAAAAA0QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAh+AA+E AABehAAAZ2QRK4EAAAR+AGdkHi58AAAEfgBnZBErgQAACH4AD4TBB16EwQdnZIA9VQAADCEA D4Q0BhGEc/5ehDQGYIRz/mdkgD1VAAAEfgBnZIA9VQAAFy1NAAAvTQAAOE0AADlNAAA6TQAA UU0AAFJNAACSTQAAk00AAJ5NAADATQAAwk0AAMNNAADETQAA0k0AAOpNAAADTgAABE4AAAVO AAArTgAALE4AAC5OAAA7TgAAPE4AAD1OAABUTgAAVU4AAJVOAACWTgAAoU4AAMdOAADJTgAA yk4AAMtOAADZTgAA2k4AANtOAADyTgAAC08AAAxPAAANTwAAM08AADRPAAA2TwAAQ08AAERP AABFTwAAXE8AAF1PAACdTwAAnk8AAMZPAADPTwAA0k8AANNPAADUTwAA108AAOJPAADlTwAA +e/i2OLv0c3RzdH5ze/izfnN+c357+LY4u/RzdHN0fnN7+LY4s35zfnN+cPi2OLvvLW8tbz5 rqOaowAAAAAAAAAAAAAAAAAAEBVo0lGLABZoTRwQADBKfQAAFBVoTRwQABZoTRwQAG1ICQRz SAkEAAwVaE0cEAAWaBErgQAADBVoHi58ABZo9gl5AAAMFWgeLnwAFmiAPVUAABIWaPYJeQBt SAAEbkgABHNICQQABhZogD1VAAAMFWiAPVUAFmiAPVUAABIWaO4P3gBtSAAEbkgABHNICQQA GBVoTRwQABZogD1VAG1IAARuSAAEc0gJBAASFmiAPVUAbUgABG5IAARzSAkEAAwVaE0cEAAW aIA9VQA65U8AAAVQAAA2UAAAQlAAAEZQAABdUAAAYVAAAGhQAACRUAAAnFAAAOFQAADjUAAA 5lAAAPFQAAD2UAAA91AAAPhQAAARUQAAElEAABNRAAAXUQAAGFEAABlRAAAsUQAAOFEAAEJR AABZUQAAW1EAAF5RAABrUQAAbVEAAHBRAABxUQAAclEAAItRAAD47eTt5O3b7eTt1eTMwbmt uZ6tlq3B7eTt5O3kjYJ3b2NvAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFwNqAAAAABZoBUIl AFUIAW1ICQRzSAkEDhZoBUIlAG1ICQRzSAkEABQVaAVCJQAWaAVCJQBtSAkEc0gJBAAUFWgF QiUAFmhNHBAAbUgJBHNICQQAEBVoBUIlABZoTRwQADBKfQAADhZoL0bkAG1ICQRzSAkEAB0C CIEDaucFAAAGCAEWaLY4rwBVCAFtSAkEc0gJBBcDagAAAAAWaLY4rwBVCAFtSAkEc0gJBA4W aLY4rwBtSAkEc0gJBAAUFWj2Lh0AFmhNHBAAbUgJBHNICQQAEBVo9i4dABZoTRwQADBKfQAA ChZo0lGLADBKfQAAEBVoHi58ABZoTRwQADBKfQAAEBVo0lGLABZoTRwQADBKfQAAFBVoTRwQ ABZoTRwQAG1ICQRzSAkEAA4WaKdjdQBtSAkEc0gJBCLUTwAA4VAAAFtRAAC+UQAALVIAAGdS AACtUgAAvlIAAO1SAAATUwAATlMAAH9TAAChUwAA3lMAAD9UAAB0VAAApFQAAAdVAAAnVQAA R1UAAFpVAABuVQAAm1UAAPoAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA7QAAAAAAAAAAAAAA AOgAAAAAAAAAAAAAAADbAAAAAAAAAAAAAAAA2wAAAAAAAAAAAAAAANYAAAAAAAAAAAAAAADb AAAAAAAAAAAAAAAA1gAAAAAAAAAAAAAAANYAAAAAAAAAAAAAAADRAAAAAAAAAAAAAAAA2wAA AAAAAAAAAAAAANYAAAAAAAAAAAAAAADRAAAAAAAAAAAAAAAA2wAAAAAAAAAAAAAAANYAAAAA AAAAAAAAAADRAAAAAAAAAAAAAAAAxAAAAAAAAAAAAAAAAL8AAAAAAAAAAAAAAAC/AAAAAAAA AAAAAAAAvwAAAAAAAAAAAAAAAL8AAAAAAAAAAAAAAAAAAAAAAAR+AGdkfTVcAAAMIQAPhHAC EYQ3Al6EcAJghDcCZ2QeLnwAAAQAAGdkHi58AAAEfgBnZPUvHwAADCEAD4Q0BhGEc/5ehDQG YIRz/mdk9S8fAAAEHABnZPUvHwAIHQAKJgALRgwAZ2RqQWQAAAQdAGdk0lGLAAAEHABnZNJR iwAAFotRAACMUQAAjVEAAJFRAACSUQAAmVEAAPBRAAAsUgAALVIAAE9SAABQUgAAY1IAAGRS AABnUgAAc1IAAHRSAACGUgAAh1IAAIxSAACNUgAArFIAAK9SAACxUgAAslIAALpSAAC7UgAA vVIAAL5SAADw5Nzk0ca+xrGbsZuxjniOeI5rZGBkUGRQZEkAAAAAAAAADBVoHi58ABZoTRwQ AAAfAAiBFWhNHBAAFmhNHBAAF2ijCpgAY0gBAGRo4ZJDpwYWaPUvHwAADBVoTRwQABZoTRwQ AAAYFWj1Lx8AFmj1Lx8AbUgABG5IAARzSAkEACsACIEVaPUvHwAWaE0cEAAXaKMKmABjSAEA ZGjhkkOnbUgABG5IAARzSAkEGBVo9S8fABZoTRwQAG1IAARuSAAEc0gJBAArAAiBFWgeLnwA FmhNHBAAF2ijCpgAY0gBAGRo4ZJDp21IAARuSAAEc0gJBBgVaB4ufAAWaE0cEABtSAAEbkgA BHNICQQADhZoBUIlAG1ICQRzSAkEABQVaE0cEAAWaE0cEABtSAkEc0gJBAAUFWgFQiUAFmhN HBAAbUgJBHNICQQADhZoL0bkAG1ICQRzSAkEABcDagAAAAAWaAVCJQBVCAFtSAkEc0gJBB0C CIEDamQGAAAGCAEWaAVCJQBVCAFtSAkEc0gJBAAbvlIAAMhSAADJUgAA21IAANxSAADeUgAA 7FIAAO1SAADuUgAAE1MAABRTAABNUwAATlMAAFRTAABnUwAAflMAAH9TAAChUwAAolMAAKNT AACkUwAA11MAANhTAADbUwAA3FMAAN5TAADfUwAA4lMAAPRTAAA+VAAAP1QAAHRUAADz3fPd 89Pzz8jPyMTAt8Cw88/IoMiQyJDIiH10ZH1XAAAAAAAAAAAAAAAAAAAAGBVoTRwQABZoTRwQ AG1IAARuSAAEc0gMBAAfFWgeLnwAFmiOBGQAMEp9ADUIgUNKFABPSgAAUUoAABAVaB4ufAAW aI4EZAAwSn0AABQVaB4ufAAWaI4EZABtSAkEc0gJBAAOFmjuD94AbUgJBHNICQQAHwAIgRVo TRwQABZoTRwQABdo6RZpAGNIAQBkaNuSQ6cfAAiBFWhNHBAAFmhNHBAAF2ijCpgAY0gBAGRo 4pJDpwwVaE0cEAAWaO4P3gAAEBVoHi58ABZo7g/eADBKfQAABhZo7g/eAAAGFmhNHBAAAAwV aE0cEAAWaE0cEAAABhZo9S8fAAASFmjfLcsAbUgABG5IAARzSAkEACsACIEVaE0cEAAWaE0c EAAXaKMKmABjSAEAZGjhkkOnbUgABG5IAARzSAkEGBVoTRwQABZoTRwQAG1IAARuSAAEc0gJ BB90VAAAdVQAAKNUAACkVAAAplQAANlUAADtVAAABlUAAAdVAAAnVQAAKFUAAEdVAABIVQAA WlUAAFtVAABuVQAAb1UAAJtVAACcVQAAwVUAAMJVAADlVQAA5lUAAAVWAAAGVgAACVYAABdW AAAYVgAAJ1YAAChWAAAuVgAAMFYAADhWAAA5VgAAY1YAAGRWAABmVgAAZ1YAAHpWAAB7VgAA l1YAAJhWAACwVgAAsVYAALJWAAD16uLaz8bPvrCnm6ebp5unm6ebp5unm6eblKebp5unm6eb fpunm6ebp5unmwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAqAAiBFWj5KZsAFmh9NVwA F2jpFmkAY0gBAGRo25JDp21IAARuSAAEdQgBAAwVaB4ufAAWaH01XAAAFxVo+SmbABZofTVc AG1IAARuSAAEdQgBERZofTVcAG1IAARuSAAEdQgBGxVoHi58ABZofTVcAFwIgW1IAARuSAAE c0gJBA4WaIkhKwBtSAkEc0gJBAAQFWgeLnwAFmiJISsAMEp9AAAUFWgeLnwAFmiJISsAbUgJ BHNICQQADhZoiSErAG1IDARzSAwEAA4WaE0cEABtSAwEc0gMBAAUFWgeLnwAFmhNHBAAbUgM BHNIDAQAFBVoHi58ABZo9S8fAG1IDARzSAwELJtVAADBVQAA5VUAAAVWAAAJVgAAF1YAACdW AAA4VgAAZlYAAHpWAACXVgAAsFYAALNWAAD4VgAAIFcAACdXAAA+VwAAXlcAAG9XAAByVwAA gVcAAJJXAACoVwAAwlcAAOJXAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAA AAAAAAD6AAAAAAAAAAAAAAAA7QAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAA AAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAA AOgAAAAAAAAAAAAAAADtAAAAAAAAAAAAAAAA2wAAAAAAAAAAAAAAANYAAAAAAAAAAAAAAADt AAAAAAAAAAAAAAAA6AAAAAAAAAAAAAAAAOgAAAAAAAAAAAAAAADoAAAAAAAAAAAAAAAA7QAA AAAAAAAAAAAAAOgAAAAAAAAAAAAAAADoAAAAAAAAAAAAAAAA0QAAAAAAAAAAAAAAAOgAAAAA AAAAAAAAAAAAAAAAAAAABCEAZ2S8QY0AAAR+AGdk9S8fAAAMIQAPhDQGEYRz/l6ENAZghHP+ Z2T1Lx8AAAR+AGdkHi58AAAMIQAPhHACEYQ3Al6EcAJghDcCZ2QeLnwAAAR+AGdkfTVcAAAY slYAALNWAADgVgAA4VYAAOJWAADjVgAA8VYAAPJWAAD1VgAA9lYAACBXAAAhVwAAJFcAACVX AAAmVwAAJ1cAAD5XAAA/VwAAXlcAAF9XAABvVwAAcFcAAHJXAAB/VwAAgFcAAIFXAACIVwAA ilcAAKFXAACiVwAApVcAAPPm2ebD5q3mreapopKijoF4bHhseGyBVoFseGx4bAAAAAAAAAAA AAAAAAAAAAAAACsACIEVaB4ufAAWaPkpmwAXaKMKmABjSAEAZGjikkOnbUgABG5IAARzSAkE FxVo+SmbABZo+SmbAG1IAARuSAAEdQgBERZo+SmbAG1IAARuSAAEdQgBGBVoHi58ABZo+Smb AG1IAARuSAAEc0gJBAAGFmhNHBAAAB8ACIEVaE0cEAAWaE0cEAAXaAheggBjSAEAZGjtkkOn DBVoTRwQABZoTRwQAAAGFmj1Lx8AACsACIEVaB4ufAAWaE0cEAAXaOkWaQBjSAEAZGjbkkOn bUgABG5IAARzSAkEKwAIgRVoHi58ABZoTRwQABdoowqYAGNIAQBkaOKSQ6dtSAAEbkgABHNI CQQYFWgeLnwAFmj1Lx8AbUgABG5IAARzSAkEABgVaB4ufAAWaE0cEABtSAAEbkgABHNICQQA FxVoHi58ABZofTVcAG1IAARuSAAEdQgBAB6lVwAAplcAAKhXAACqVwAAq1cAAMJXAADDVwAA 4lcAAONXAAD3VwAA+FcAAAtYAAAMWAAAOFgAADlYAABWWAAAV1gAAGxYAABtWAAAcFgAAHJY AACAWAAAgVgAAIxYAACNWAAAkVgAAJJYAACYWAAAmVgAAKRYAAClWAAArlgAAK9YAADSWAAA 01gAAOJYAADjWAAA7lgAAO9YAAD8WAAA/VgAAApZAAALWQAADVkAAA9ZAAAQWQAAKFkAAClZ AAA8WQAAPVkAAFBZAABRWQAAelkAAHtZAACnWQAAqFkAALhZAAC5WQAAy1kAANxZAADeWQAA 5FkAAPhZAADq3trWz8jByMHIwcjByMHIwcjB2s/IwcjByMHIwcjByMHIwcjByMHIwcjB2tbP vcG9wb3BvcG9wa3BpsG9wQAAAAAAAAAAAAAAAAAAAAAAAAwVaB4ufAAWaEU6PQAAHwAIgRVo Hi58ABZoTRwQABdoowqYAGNIAQBkaOKSQ6cGFmjiCP4AAAwVaB4ufAAWaE0cEAAADBVoHi58 ABZovEGNAAAMFWhNHBAAFmhNHBAAAAYWaO4P3gAABhZovEGNAAAXFWj5KZsAFmj5KZsAbUgA BG5IAAR1CAEqAAiBFWj5KZsAFmj5KZsAF2gIXoIAY0gBAGRo7ZJDp21IAARuSAAEdQgBPuJX AAD3VwAAC1gAADhYAABWWAAAbFgAAHBYAACAWAAAkVgAAKRYAADSWAAA7lgAAApZAAANWQAA KFkAADxZAABQWQAAelkAAKdZAADfWQAA+1kAAP5ZAAAgWgAAX1oAAHxaAACJWgAAlloAAPoA AAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAA AAAAAAAAAAAA+gAAAAAAAAAAAAAAAPEAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAA AAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAA AAAAAADsAAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAA AAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAA AOwAAAAAAAAAAAAAAADnAAAAAAAAAAAAAAAA7AAAAAAAAAAAAAAAAOcAAAAAAAAAAAAAAADn AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEfgBnZLxBjQAABCEAZ2S8QY0AAAh+AA+E AABehAAAZ2SnY3UAAAR+AGdkHi58AAAa+FkAAPlZAAD7WQAA/FkAAP5ZAAAAWgAAAVoAACBa AAAhWgAAXFoAAF1aAABfWgAAYVoAAGJaAAB8WgAAfVoAAIlaAACKWgAAlloAAJdaAACiWgAA o1oAAKVaAACnWgAAqFoAANJaAADTWgAA1FoAANVaAADWWgAA11oAANhaAADhWgAA4loAABFb AADv6OTo4NzV4NXF1eDc1eDV4NXg1eDVu7Gku6CYkIh9d2daAAAAAAAAGRZo5zRgADBKfQA1 CIFDShQAT0oAAFFKAAAfFWinD+UAFmjnNGAAMEp9ADUIgUNKFABPSgAAUUoAAAoWaOc0YAAw Sn0AABQVaKcP5QAWaOc0YABtSAkEc0gJBAAOFmjnNGAAbUgJBHNICQQADhZowX5WAG1ICQRz SAkEAA4WaOII/gBtSAkEc0gJBAAGFmhNHBAAABgVaE0cEAAWaE0cEABtSAAEbkgABHNICQQA EhZo7g/eAG1IAARuSAAEc0gJBAASFmi8QY0AbUgABG5IAARzSAkEAB8ACIEVaE0cEAAWaE0c EAAXaOkWaQBjSAEAZGjckkOnDBVoTRwQABZoTRwQAAAGFmjuD94AAAYWaLxBjQAABhZo4gj+ AAAMFWgeLnwAFmhNHBAAAB8ACIEVaB4ufAAWaE0cEAAXaOkWaQBjSAEAZGjckkOnACKWWgAA oloAAKVaAADUWgAAElsAADVbAABvWwAArVsAAM9bAAAMXAAALFwAAFdcAACcXAAAslwAAEld AABnXQAAll0AAJtdAADTXQAA1V0AAPRdAABXXgAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAA AAD1AAAAAAAAAAAAAAAA8AAAAAAAAAAAAAAAAOsAAAAAAAAAAAAAAADmAAAAAAAAAAAAAAAA 2QAAAAAAAAAAAAAAANkAAAAAAAAAAAAAAADUAAAAAAAAAAAAAAAA2QAAAAAAAAAAAAAAANkA AAAAAAAAAAAAAADPAAAAAAAAAAAAAAAAygAAAAAAAAAAAAAAAMUAAAAAAAAAAAAAAADAAAAA AAAAAAAAAAAAuwAAAAAAAAAAAAAAALsAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAtgAAAAAA AAAAAAAAAMoAAAAAAAAAAAAAAADFAAAAAAAAAAAAAAAAAAAAAAR+AGdkwXiTAAAEfgBnZAxm cQAABCEAZ2QMZnEAAAQAAGdkg0ZiAAAEAwBnZCJXcAAABH4AZ2QeLnwAAAR+AGdk5zRgAAAM IQAPhDQGEYRz/l6ENAZghHP+Z2TnNGAAAAQAAGdk5zRgAAAEIQBnZG03rgAABAAAZ2QeLnwA AAQhAGdkHi58AAAEfgBnZLxBjQAAFRFbAAASWwAAFFsAABVbAAA0WwAANVsAADZbAAA3WwAA OVsAAEZbAABvWwAAkVsAAJJbAACmWwAAp1sAAKpbAACrWwAAz1sAANBbAADRWwAA0lsAAAlc AAAKXAAADFwAAFZcAABXXAAAWFwAAFlcAABaXAAAb1wAAHBcAACZXAAAmlwAAJxcAAD16+HU ysK39a6ekXuRe5F7kXdwYHBgcJFWd3BgcHdwYHAAAAASFmjnNGAAbUgABG5IAARzSAkEAB8A CIEVaE0cEAAWaOc0YAAXaOkWaQBjSAEAZGjckkOnDBVoTRwQABZo5zRgAAAGFmjnNGAAACsA CIEVaE0cEAAWaOc0YAAXaOkWaQBjSAEAZGjckkOnbUgABG5IAARzSAkEGBVoTRwQABZo5zRg AG1IAARuSAAEc0gJBAAfFWgeLnwAFmjnNGAAMEp9ADUIgUNKFABPSgAAUUoAABAVaB4ufAAW aOc0YAAwSn0AABQVaB4ufAAWaMF+VgBtSAkEc0gJBAAOFmjiCP4AbUgJBHNICQQAEhZoTRwQ AG1IAARuSAAEc0gJBAAYFWhNHBAAFmhNHBAAbUgABG5IAARzSAkEABIWaOII/gBtSAAEbkgA BHNICQQAEhZovEGNAG1IAARuSAAEc0gJBAAUFWgeLnwAFmjnNGAAbUgJBHNICQQhnFwAALJc AADUXAAASF0AAEldAABnXQAAfV0AAH9dAAC1XQAAtl0AAM5dAADPXQAA0l0AANNdAADVXQAA 9F0AAC9eAAA1XgAANl4AAE9eAABQXgAAUV4AAFNeAABUXgAAVV4AAFZeAABXXgAA+PDo3dDF t8W3xaPFm8X4j4Nzg2BzVHODj0gAAAAAAAAAAAAAFhZopTIoAG1ICQRuSAwEc0gJBHRIDAQA FhZoL0bkAG1ICQRuSAwEc0gJBHRIDAQAJQIIgQNq4QYAAAYIARZorTnOAFUIAW1ICQRuSAwE c0gJBHRIDAQfA2oAAAAAFmitOc4AVQgBbUgJBG5IDARzSAkEdEgMBBYWaK05zgBtSAkEbkgM BHNICQR0SAwEABYWaINGYgBtSAkEbkgMBHNICQR0SAwEAA4WaBBWtwBuSAwEdEgMBAAnAAiB FWilMigAFmilMigAF2jpFmkAY0gBAGRo3JJDp25IDAR0SAwEGwEIgQRIAQAFaNySQ6cWaOkW aQBuSAwEdEgMBBQVaKUyKAAWaKUyKABuSAwEdEgMBAAYFWilMigAFmilMigAbUgABG5IAAR0 SAwEABQVaINGYgAWaINGYgBtSAkEc0gJBAAOFmiDRmIAbUgJBHNICQQADhZowXiTAG1ICQRz SAkEAA4WaCJXcABtSAkEc0gJBBpXXgAAaV4AAHZeAACCXgAAo14AAK1eAAC7XgAA2F4AANte AADcXgAA3V4AAPZeAAD3XgAA+F4AAPxeAAD9XgAA/l4AABVfAAAYXwAAGV8AABpfAAAzXwAA NF8AADVfAAA5XwAAOl8AADtfAABGXwAAR18AAEhfAACHXwAAiF8AAPTo9Nzo3OjN3L3cqr2e vY/oj9y93Hy9nr2P3Oht6F4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwVaAxmcQAW aDJVlABtSAkEbkgMBHNICQR0SAwEABwVaKUyKAAWaKcOdABtSAkEbkgMBHNICQR0SAwEACUC CIEDatsHAAAGCAEWaK05zgBVCAFtSAkEbkgMBHNICQR0SAwEHBVorTnOABZoMlWUAG1ICQRu SAwEc0gJBHRIDAQAFhZoL0bkAG1ICQRuSAwEc0gJBHRIDAQAJQIIgQNqXgcAAAYIARZorTnO AFUIAW1ICQRuSAwEc0gJBHRIDAQfA2oAAAAAFmitOc4AVQgBbUgJBG5IDARzSAkEdEgMBBwV aK05zgAWaK05zgBtSAkEbkgMBHNICQR0SAwEABYWaK05zgBtSAkEbkgMBHNICQR0SAwEABYW aDJVlABtSAkEbkgMBHNICQR0SAwEABYWaKcOdABtSAkEbkgMBHNICQR0SAwEH1deAABIXwAA iF8AAMZfAADYXwAA+18AAI1gAACeYQAAT2IAAEtjAAB5ZAAAlmQAANtlAAD6ZQAAEGgAAB9o AABHaQAAiGkAAOxpAACOagAA5moAAPoAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA8AAAAAAA AAAAAAAAAOsAAAAAAAAAAAAAAADmAAAAAAAAAAAAAAAA4QAAAAAAAAAAAAAAAOEAAAAAAAAA AAAAAADhAAAAAAAAAAAAAAAA4QAAAAAAAAAAAAAAAOEAAAAAAAAAAAAAAADcAAAAAAAAAAAA AAAA+gAAAAAAAAAAAAAAANwAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA1wAAAAAAAAAAAAAA APoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAAxQAAAAAAAAAAAAAAAMUAAAAAAAAAAAAAAACz AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAASAAAKJgALRgsAD4Q0BhGEc/4TpFYAXoQ0BmCE c/5nZGpBZAASAAAKJgALRg0AD4SnBBGEc/4TpFYAXoSnBGCEc/5nZGpBZAAABAEAZ2QiV3AA AAQDAGdkIldwAAAEAABnZMo9oQAABAMAZ2TKPaEAAAQCAGdkIldwAAAEIQBnZK05zgAABAAA Z2QyVZQAAAQAAGdkg0ZiAAAUiF8AAKpfAACrXwAAv18AAMBfAADDXwAAxF8AAMVfAADGXwAA 2F8AAPpfAAD7XwAA1WAAAN1gAADvYAAA/2AAAA9hAAAXYQAAq2EAALFhAAA3YgAAPWIAAEJi AACwYgAAuGIAAMpiAADaYgAAamMAAHBjAAB1YwAAv2MAAMpjAADLYwAA52MAAPZjAAB4ZAAA eWQAAJZkAAC1ZQAA2WUAANplAADx2fHZ8dnxysK6r7qmup26nbqVuo+duoa6hrqPfbp3nbqd uq/Cb2dvAAAOFmgVdHgAbUgJBHNICQQADhZog0ZiAG1ICQRzSAkEAAoWaCQtOAAwSn0AABAV aKZxhgAWaMo9oQAwSn0AABAVaN1u0gAWaMo9oQAwSn0AAAoWaMo9oQAwSn0AAA4WaCMG2gBt SAkEc0gJBAAQFWhJXEoAFmjKPaEAMEp9AAAQFWh+TMwAFmjKPaEAMEp9AAAUFWjKPaEAFmjK PaEAbUgJBHNICQQADhZoyj2hAG1ICQRzSAkEAA4WaCJXcABtSAkEc0gJBAAcFWitOc4AFmil MigAbUgABG5IAARzSAkEdEgMBAAvAAiBFWgMZnEAFmilMigAF2jpFmkAY0gBAGRo3ZJDp21I AARuSAAEc0gJBHRIDAQcFWgMZnEAFmilMigAbUgABG5IAARzSAkEdEgMBCjaZQAA22UAAPpl AAB2ZwAAgGcAAOdnAADzZwAA92cAAA5oAAAPaAAAEGgAAB9oAAAaaQAAO2kAAIhpAADraQAA 7GkAADlrAACKawAAi2sAAEhsAABJbAAAYmwAANNsAADgbAAA6GwAAOxsAADtbAAABm0AAAdt AAAIbQAAC20AAAxtAAAObQAAu20AAMhtAAAebgAAK24AADNuAAA3bgAAOG4AAFFuAABSbgAA 9e3l3OXc5dzl9e3l1OXM5czEzMS8xLGosZ2R1IKRepGdxKjEqMSdkdRrHQIIgQNq1QgAAAYI ARZoFXR4AFUIAW1ICQRzSAkEDhZoL0bkAG1ICQRzSAkEAB0CCIEDalgIAAAGCAEWaBV0eABV CAFtSAkEc0gJBBcDagAAAAAWaBV0eABVCAFtSAkEc0gJBBQVaBV0eAAWaPRkfABtSAkEc0gJ BAAQFWj0ZHwAFmj0ZHwAMEp9AAAUFWj0ZHwAFmj0ZHwAbUgJBHNICQQADhZo4gj+AG1ICQRz SAkEAA4WaPRkfABtSAkEc0gJBAAOFmiMeNsAbUgJBHNICQQADhZoFXR4AG1ICQRzSAkEABAV aINGYgAWaINGYgAwSn0AAA4WaINGYgBtSAkEc0gJBAAOFmgiV3AAbUgJBHNICQQAFBVog0Zi ABZog0ZiAG1ICQRzSAkEKuZqAACLawAA/2sAAGJsAAAPbQAAt20AAFpuAADvbgAABm8AACNv AAA6bwAAcW8AAJJvAAC+bwAAw28AAPJvAAAdcAAAH3AAAJ5wAAAPcQAA7QAAAAAAAAAAAAAA AO0AAAAAAAAAAAAAAADtAAAAAAAAAAAAAAAA2wAAAAAAAAAAAAAAANsAAAAAAAAAAAAAAADb AAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAAM8AAAAAAAAAAAAAAADKAAAAAAAAAAAAAAAAxQAA AAAAAAAAAAAAAMUAAAAAAAAAAAAAAADFAAAAAAAAAAAAAAAAxQAAAAAAAAAAAAAAAMUAAAAA AAAAAAAAAADFAAAAAAAAAAAAAAAAxQAAAAAAAAAAAAAAAMUAAAAAAAAAAAAAAACzAAAAAAAA AAAAAAAAqQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgAACiYAC0YPABOkVgBnZGpBZAASAAAK JgALRg4AD4SnBBGEc/4TpFYAXoSnBGCEc/5nZGpBZAAABH4AZ2QMZnEAAAQhAGdkDGZxAAAE AgBnZCJXcAAABgAAE6RWAGdk9GR8ABIAAAomAAtGDQAPhKcEEYRz/hOkVgBehKcEYIRz/mdk akFkABIAAAomAAtGCwAPhDQGEYRz/hOkVgBehDQGYIRz/mdkakFkAAATUm4AAFNuAABWbgAA V24AAFhuAABtbgAAem4AANNuAADubgAA724AAAVvAAAGbwAAI28AACtvAAAubwAASW8AAEtv AACAbwAAgm8AAKdvAACobwAAw28AAMRvAADZbwAA2m8AAPJvAAD0bwAA9m8AAPdvAAAMcAAA DXAAABhwAAAZcAAAHHAAAB1wAAAfcAAAJnAAAPPr8+DYz9jHvLSsn5SMlIyUjJSMlISUjJSM lHCUcJRwlGiUXwAAAAAAABAVaPgWNgAWaPgWNgAwSn0AAA4WaBBWtwBuSAwEdEgMBAAnAAiB FWgMZnEAFmgMZnEAF2jpFmkAY0gBAGRo3ZJDp25IDAR0SAwEDhZoDGZxAG5IDAR0SAwEAA4W aNwztABuSAwEdEgMBAAUFWgMZnEAFmgMZnEAbkgMBHRIDAQAGBVoDGZxABZoDGZxAG1IAARu SAAEdEgMBAAOFmgiV3AAbUgJBHNICQQADhZo2zWUAG1ICQRzSAkEABQVaPRkfAAWaPRkfABt SAkEc0gJBAAOFmgeBwEAbUgJBHNICQQAEBVoHgcBABZo9GR8ADBKfQAADhZo9GR8AG1ICQRz SAkEABQVaBV0eAAWaPRkfABtSAkEc0gJBAAOFmgvRuQAbUgJBHNICQQAFwNqAAAAABZoFXR4 AFUIAW1ICQRzSAkEACQmcAAARHAAAFFwAAChcAAAr3AAAONwAADocAAAC3EAAA1xAAAScQAA IHEAAGJxAABncQAAinEAAIxxAACRcQAAn3EAAMhxAAD2cQAA+HEAAPlxAAD6cQAA/XEAAAty AAAocgAANXIAAElyAABNcgAAVXIAAFhyAAB7cgAAfXIAAIJyAACQcgAAn3IAAK9yAADCcgAA z3IAAOdyAADpcgAAAHMAAAJzAAAscwAALnMAADBzAAA+cwAAsnMAALZzAAC3cwAAuHMAANFz AADScwAA03MAANZzAADXcwAA2HMAAAx0AAANdAAA+O/47/jv+O/47/jv+O/47/jn3uf4597n 3ufe597n3ufe597n3ufe597n3ufe59PLv8uwv6i/0+edAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAABQVaAxmcQAWaG9+YgBuSAwEdEgMBAAOFmgvRuQAbkgMBHRIDAQAHQIIgQNqUgkAAAYI ARZoFAntAFUIAW5IDAR0SAwEFwNqAAAAABZoFAntAFUIAW5IDAR0SAwEDhZoFAntAG5IDAR0 SAwEABQVaBQJ7QAWaG9+YgBuSAwEdEgMBAAQFWhvfmIAFmhvfmIAMEp9AAAOFmhvfmIAbkgM BHRIDAQAEBVo+BY2ABZo+BY2ADBKfQAADhZo+BY2AG5IDAR0SAwEOQ9xAACOcQAA+nEAAH9y AAAEcwAAMHMAAA10AAArdAAAUHQAAHh0AACcdAAAy3QAAM10AAArdgAA9XcAAFl4AACPeAAA 53gAAAt5AAA5eQAA9QAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA9QAA AAAAAAAAAAAAAPUAAAAAAAAAAAAAAADjAAAAAAAAAAAAAAAA2gAAAAAAAAAAAAAAANEAAAAA AAAAAAAAAADRAAAAAAAAAAAAAAAA0QAAAAAAAAAAAAAAANEAAAAAAAAAAAAAAADRAAAAAAAA AAAAAAAAwgAAAAAAAAAAAAAAAMIAAAAAAAAAAAAAAADjAAAAAAAAAAAAAAAAtQAAAAAAAAAA AAAAAOMAAAAAAAAAAAAAAACsAAAAAAAAAAAAAAAApwAAAAAAAAAAAAAAAAAAAAAAAAAABH4A Z2QeLnwAAAghAA+EpwRehKcEZ2S0OlMAAAwhAA+EcAIRhDcCXoRwAmCENwJnZLQ6UwAADgAA D4SnBBGEc/4TpFYAXoSnBGCEc/5nZL0BBgAACH4AD4TbCl6E2wpnZG9+YgAACCEAD4SnBF6E pwRnZG9+YgASAAAKJgALRg4AD4SnBBGEc/4TpFYAXoSnBGCEc/5nZGpBZAAKAAAKJgALRg8A E6RWAGdkakFkAAATDXQAACt0AAAxdAAAMnQAADZ0AABedAAAbHQAAG10AAB9dAAAfnQAAIJ0 AACqdAAAv3QAAMB0AADKdAAAy3QAAMx0AADNdAAAznQAANN0AADXdAAAOXUAANl1AADndQAA AXYAAAd2AAAIdgAACXYAACJ2AAAjdgAAJHYAACd2AAAodgAAKnYAACt2AAAsdgAAMHYAAJx3 AACxdwAAy3cAAPPo4OjY6Njo4OjY6Njo0OjIwLfAr6eep5OLf4twf2h/k8CnnqeepwAAAAAA AAAAAA4WaC9G5ABuSAwEdEgMBAAdAgiBA2rPCQAABggBFmjbNMsAVQgBbkgMBHRIDAQXA2oA AAAAFmjbNMsAVQgBbkgMBHRIDAQOFmjbNMsAbkgMBHRIDAQAFBVoFAntABZovQEGAG5IDAR0 SAwEABAVaL0BBgAWaL0BBgAwSn0AAA4WaL0BBgBuSAwEdEgMBAAOFmiDW64AbkgMBHRIDAQA EBVob35iABZob35iADBKfQAADhZob35iAG5IDAR0SAwEAA4WaAxmcQBuSAwEdEgMBAAOFmgQ VrcAbkgMBHRIDAQADhZoo1KdAG5IDAR0SAwEAA4WaNwztABuSAwEdEgMBAAUFWgMZnEAFmgM ZnEAbkgMBHRIDAQAGBVoDGZxABZoDGZxAG1IAARuSAAEdEgMBCfLdwAA0XcAANJ3AADTdwAA 7HcAAO13AADudwAA8XcAAPJ3AAD0dwAA9XcAAPZ3AAADeAAAMXgAADV4AAA2eAAAN3gAAFB4 AABReAAAUngAAFV4AABWeAAAWHgAAFl4AACOeAAAj3gAAJ94AACjeAAA5ngAAOd4AAALeQAA 9e3h7dLhyuHCt7GooJXt4e2G4crhlXtuZLGooFlNFhZoDGZxAG1IAARuSAAEc0gMBHRIDAQA FBVoDGZxABZotDpTAG5IDAR0SAwEABIWaAxmcQBtSAAEbkgABHRIDAQAGBVoDGZxABZoDGZx AG1IAARuSAAEdEgMBAAUFWjbNMsAFmgMZnEAbkgMBHRIDAQAHQIIgQNqyQoAAAYIARZo2zTL AFUIAW5IDAR0SAwEFBVo2zTLABZotDpTAG5IDAR0SAwEAA4WaLQ6UwBuSAwEdEgMBAAQFWi0 OlMAFmi0OlMAMEp9AAAKFmi0OlMAMEp9AAAUFWi9AQYAFmi9AQYAbkgMBHRIDAQADhZovQEG AG5IDAR0SAwEAA4WaC9G5ABuSAwEdEgMBAAdAgiBA2pMCgAABggBFmjbNMsAVQgBbkgMBHRI DAQXA2oAAAAAFmjbNMsAVQgBbkgMBHRIDAQOFmjbNMsAbkgMBHRIDAQAFBVo2zTLABZovQEG AG5IDAR0SAwEHgt5AAAMeQAAF3kAABl5AAA5eQAAOnkAAFR5AABZeQAAf3kAAIB5AACTeQAA lHkAAL55AADDeQAA33kAAOB5AADqeQAA63kAAOx5AADueQAAK3oAACx6AABiegAAjXoAAJV6 AACqegAA4noAABF7AAAjewAAPnsAAF17AABfewAAf3sAAIF7AACUewAAlnsAAPXq4ur16tfq 9erX6vXqzOrB9eq09a2flIuUgHeAcGdbZ1tnAAAAFxVodwd4ABZoHQYEAG1IAARuSAAEdQgB ERZoHQYEAG1IAARuSAAEdQgBDBVodwd4ABZoHQYEAAAQFWgdBgQAFmgdBgQAMEp9AAAVFmgd BgQAbUgABG5IAARzSAkEdQgBEBVoRXcMABZoRXcMADBKfQAAFRZoRXcMAG1IAARuSAAEc0gJ BHUIARsVaEV3DAAWaEV3DABtSAAEbkgABHNICQR1CAEMFWgeLnwAFmhFdwwAABgVaB4ufAAW aEV3DABtSAAEbkgABHNIDAQAFBVoHi58ABZoEFa3AG1IDARzSAwEABQVaB4ufAAWaN8tywBt SAwEc0gMBAAUFWgeLnwAFmiTEagAbUgMBHNIDAQADhZoFw6cAG1IDARzSAwEABQVaB4ufAAW aAxmcQBtSAwEc0gMBAAUFWgeLnwAFmgXDpwAbUgMBHNIDAQjOXkAAFV5AAB/eQAAv3kAAOt5 AADueQAAK3oAAGJ6AADiegAAPnsAAF17AAB/ewAAlHsAAMJ7AADkewAA6HsAAPZ7AAAIfAAA NnwAAFF8AABVfAAAi3wAAKx8AAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAA AAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPEAAAAAAAAAAAAAAAD6AAAAAAAAAAAA AAAA6AAAAAAAAAAAAAAAAOgAAAAAAAAAAAAAAADxAAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAA APoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAADx AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAA AAAAAAAAAAAAAMUAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACMA AAMkAw3GKAQaA6cENAbBBwo3Am4EpQbcCBMLSg2BD7gR7xMmFgAAAAAAAAAAAAAPhDcCE6R4 AF6ENwJhJANnZEV3DAAACAAAD4SnBF6EpwRnZEV3DAAACCEAD4SnBF6EpwRnZB4ufAAABH4A Z2QeLnwAABaWewAAwnsAAMR7AADkewAA5nsAAOh7AAD2ewAA+HsAAAh8AAAKfAAANnwAADh8 AABVfAAAVnwAAIt8AACOfAAAj3wAAKV8AACmfAAAqXwAAKp8AACsfAAArnwAAN18AADwfAAA 83wAAAR9AAAHfQAAK30AAC59AAA/fQAAQn0AAFJ9AABVfQAAWH0AAPPq8+rz4+rz6vPq1b+p m4Obg5uDm3Cpm2KbYptim2KbYpsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGxVoHi58ABZobVdn AG1IAARuSAAEc0gMBHUIASQWaKd1gAA1CIFDShIAT0oEAFFKBABtSAAEbkgABHNIDAR1CAEA LgAIgRVoHi58ABZop3WAABdo6RZpAGNIAQBkaN2SQ6dtSAAEbkgABHNIDAR1CAEAGxVoHi58 ABZop3WAAG1IAARuSAAEc0gMBHUIASoVaKd1gAAWaKd1gAA1CIFDShIAT0oEAFFKBABtSAAE bkgABHNIDAR1CAEAKhVoHi58ABZoRXcMADUIgUNKEgBPSgQAUUoEAG1IAARuSAAEc0gMBHUI AQAbFWgeLnwAFmgdBgQAbUgABG5IAARzSAwEdQgBDBVoHi58ABZoHQYEAAARFmgdBgQAbUgA BG5IAAR1CAEXFWh3B3gAFmgdBgQAbUgABG5IAAR1CAEAIqx8AADdfAAA8XwAAAV9AAAYfQAA LH0AAEB9AABTfQAAW30AAIV9AACgfQAAyX0AAPZ9AAD6fQAAFn4AAFJ+AAB8fgAArH4AANZ+ AADyfgAAHH8AAEp/AABPfwAAgH8AAKp/AADFfwAA4AAAAAAAAAAAAAAAANsAAAAAAAAAAAAA AADbAAAAAAAAAAAAAAAA2wAAAAAAAAAAAAAAANsAAAAAAAAAAAAAAADbAAAAAAAAAAAAAAAA 2wAAAAAAAAAAAAAAANsAAAAAAAAAAAAAAADgAAAAAAAAAAAAAAAA2wAAAAAAAAAAAAAAANsA AAAAAAAAAAAAAADbAAAAAAAAAAAAAAAA2wAAAAAAAAAAAAAAAOAAAAAAAAAAAAAAAADbAAAA AAAAAAAAAAAA2wAAAAAAAAAAAAAAAOAAAAAAAAAAAAAAAADgAAAAAAAAAAAAAAAA2wAAAAAA AAAAAAAAANsAAAAAAAAAAAAAAADbAAAAAAAAAAAAAAAA2wAAAAAAAAAAAAAAAOAAAAAAAAAA AAAAAADgAAAAAAAAAAAAAAAA2wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEfgBnZB4ufAAfAAAD JAMNxigEGgOnBDQGwQcKNwJuBKUG3AgTC0oNgQ+4Ee8TJhYAAAAAAAAAAAAAE6R4AGEkA2dk p3WAAAAZWH0AAFl9AABbfQAAXX0AAIV9AACHfQAAoH0AAKJ9AADJfQAAy30AANd9AADYfQAA 830AAPR9AAD2fQAA+H0AAPp9AAD8fQAAFn4AABh+AAAZfgAA6NrHsaaakZqRmnuaZZqRmlI8 kZoAAAAAAAAAAAAAAAAAAAAAKhVop3WAABZop3WAADUIgUNKEgBPSgQAUUoEAG1IAARuSAAE c0gJBHUIAQAkFmindYAANQiBQ0oSAE9KBABRSgQAbUgABG5IAARzSAkEdQgBACoACIEVaKd1 gAAWaKd1gAAXaAheggBjSAEAZGjtkkOnbUgABG5IAAR1CAEAKgAIgRVop3WAABZop3WAABdo owqYAGNIAQBkaOKSQ6dtSAAEbkgABHUIAQARFmindYAAbUgABG5IAAR1CAEXFWindYAAFmin dYAAbUgABG5IAAR1CAEVFmindYAAbUgABG5IAARzSAwEdQgBKhVop3WAABZop3WAADUIgUNK EgBPSgQAUUoEAG1IAARuSAAEc0gMBHUIAQAkFmindYAANQiBQ0oSAE9KBABRSgQAbUgABG5I AARzSAwEdQgBABsVaB4ufAAWaKd1gABtSAAEbkgABHNIDAR1CAEuAAiBFWgeLnwAFmindYAA F2jpFmkAY0gBAGRo3pJDp21IAARuSAAEc0gMBHUIARQZfgAAGn4AAFF+AABUfgAAeX4AAHp+ AAB8fgAAfn4AAKN+AACkfgAAqX4AAKp+AACsfgAArn4AANZ+AAArfwAALH8AAEd/AABIfwAA T38AAFF/AAB2fwAAd38AAH1/AAB+fwAAgH8AAIJ/AACqfwAArH8AAMV/AADHfwAA7n8AAPB/ AADq3tXe6t7CrI2sjazCd3BgcGBwwqyNrI2swndU3tXe1QAAAAAXFWgeLnwAFmindYAAbUgA BG5IAAR1CAEfAAiBFWgeLnwAFmindYAAF2jpFmkAY0gBAGRo3pJDpwwVaB4ufAAWaKd1gAAA KhVoHi58ABZop3WAADUIgUNKEgBPSgQAUUoEAG1IAARuSAAEc0gJBHUIAQA9AAiBFWindYAA FmindYAAF2jpFmkANQiBQ0oSAE9KBABRSgQAY0gBAGRo3pJDp21IAARuSAAEc0gJBHUIASoV aKd1gAAWaKd1gAA1CIFDShIAT0oEAFFKBABtSAAEbkgABHNICQR1CAEAJBZop3WAADUIgUNK EgBPSgQAUUoEAG1IAARuSAAEc0gJBHUIAQARFmindYAAbUgABG5IAAR1CAEXFWindYAAFmin dYAAbUgABG5IAAR1CAEqAAiBFWindYAAFmindYAAF2jpFmkAY0gBAGRo3pJDp21IAARuSAAE dQgBIMV/AADufwAAG4AAAB+AAABQgAAAeoAAAJWAAAC+gAAA64AAAO+AAAAfgQAASYEAAGSB AACNgQAAuoEAAL6BAADvgQAAGYIAADSCAABdggAAioIAAI6CAAC/ggAA3oIAAA6DAAA+gwAA +gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA2wAAAAAAAAAAAAAAANsA AAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAA AAAAAAAAAAAA2wAAAAAAAAAAAAAAANsAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAA AAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA2wAAAAAAAAAAAAAAANsAAAAAAAAA AAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAA AAAA2wAAAAAAAAAAAAAAANsAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAA AAAAAAAAAAAAAB8AAAMkAw3GKAQaA6cENAbBBwo3Am4EpQbcCBMLSg2BD7gR7xMmFgAAAAAA AAAAAAATpHgAYSQDZ2SndYAAAAR+AGdkHi58AAAZ8H8AAPx/AAD9fwAAGIAAABmAAAAbgAAA HYAAAB+AAAAhgAAARoAAAEeAAABNgAAAToAAAFCAAABSgAAAeoAAAHyAAACVgAAAl4AAAL6A AADAgAAAzIAAAM2AAADogAAA6YAAAOuAAADtgAAA74AAAPGAAAAWgQAAF4EAAByBAAAdgQAA H4EAACGBAABJgQAAS4EAAF2BAABfgQAAZIEAAGaBAACNgQAAj4EAAJuBAACcgQAAt4EAALiB AAC6gQAAvIEAAL6BAADAgQAA5YEAAPPd893z1PPBq4yrjKvBq9Tz1PPU893z3fPU88GrjKuM q8Gr1POD89Tz1PPd893z1PPBqwAAABEWaKNSnQBtSAAEbkgABHUIAT0ACIEVaKd1gAAWaKd1 gAAXaOkWaQA1CIFDShIAT0oEAFFKBABjSAEAZGjekkOnbUgABG5IAARzSAkEdQgBKhVop3WA ABZop3WAADUIgUNKEgBPSgQAUUoEAG1IAARuSAAEc0gJBHUIAQAkFmindYAANQiBQ0oSAE9K BABRSgQAbUgABG5IAARzSAkEdQgBABEWaKd1gABtSAAEbkgABHUIASoACIEVaKd1gAAWaKd1 gAAXaOkWaQBjSAEAZGjekkOnbUgABG5IAAR1CAEAFxVop3WAABZop3WAAG1IAARuSAAEdQgB ADPlgQAA5oEAAOyBAADtgQAA74EAAPGBAAAZggAAG4IAACyCAAAvggAANIIAADaCAABdggAA X4IAAGuCAABsggAAh4IAAIiCAACKggAAjIIAAI6CAACQggAAtYIAALaCAAC8ggAAvYIAAL+C AADBggAA3oIAAOCCAAAOgwAAEIMAADuDAAA8gwAAPoMAAECDAAB7gwAAfYMAAJqDAACcgwAA 4MrgyrfKrqKZoq6irqKDooOirqK3ymTKZMq3yq6irqKDorfKt8quAD0ACIEVaKd1gAAWaKd1 gAAXaKMKmAA1CIFDShIAT0oEAFFKBABjSAEAZGjikkOnbUgABG5IAARzSAkEdQgBKgAIgRVo p3WAABZop3WAABdo6RZpAGNIAQBkaN+SQ6dtSAAEbkgABHUIAQARFmijUp0AbUgABG5IAAR1 CAEXFWindYAAFmindYAAbUgABG5IAAR1CAERFmindYAAbUgABG5IAAR1CAEkFmindYAANQiB Q0oSAE9KBABRSgQAbUgABG5IAARzSAkEdQgBACoVaKd1gAAWaKd1gAA1CIFDShIAT0oEAFFK BABtSAAEbkgABHNICQR1CAEAPQAIgRVop3WAABZop3WAABdo6RZpADUIgUNKEgBPSgQAUUoE AGNIAQBkaN6SQ6dtSAAEbkgABHNICQR1CAEAJz6DAAB7gwAAmoMAANyDAAALhAAAQYQAAH2E AACThAAA2oQAAAeFAAAehQAAGocAADWHAABbhwAAYIcAAImHAACshwAA0ocAAPWHAAD3hwAA FogAAOAAAAAAAAAAAAAAAADgAAAAAAAAAAAAAAAA2wAAAAAAAAAAAAAAANsAAAAAAAAAAAAA AADgAAAAAAAAAAAAAAAA0gAAAAAAAAAAAAAAANsAAAAAAAAAAAAAAADNAAAAAAAAAAAAAAAA xAAAAAAAAAAAAAAAAL8AAAAAAAAAAAAAAAC6AAAAAAAAAAAAAAAAtQAAAAAAAAAAAAAAANsA AAAAAAAAAAAAAADbAAAAAAAAAAAAAAAA2wAAAAAAAAAAAAAAANsAAAAAAAAAAAAAAADbAAAA AAAAAAAAAAAA2wAAAAAAAAAAAAAAANsAAAAAAAAAAAAAAACwAAAAAAAAAAAAAAAAAAAAAAAA AAAABAMAZ2TbNZQAAAQhAGdkHi58AAAEAABnZCkTQwAABAIAZ2TbNZQAAAgAAA+EpwRehKcE Z2QeLnwAAAQAAGdkHi58AAAIIQAPhKcEXoSnBGdkTiGpAAAEfgBnZB4ufAAfAAADJAMNxigE GgOnBDQGwQcKNwJuBKUG3AgTC0oNgQ+4Ee8TJhYAAAAAAAAAAAAAE6R4AGEkA2dkp3WAAAAU nIMAANyDAADegwAACIQAAAmEAAALhAAADYQAAEGEAABthAAAboQAAH2EAAB/hAAAgIQAAIGE AACOhAAAj4QAAJCEAACRhAAAk4QAAJSEAACVhAAAl4QAAKKEAACmhAAAq4QAAKyEAADz6vPU 88GrpJSkioNzg3ODc4NrY1hSSVJJAAAAAAAAAAAAAAAAAAAAAAAQFWinD+UAFmhCTQAAMEp9 AAAKFmhCTQAAMEp9AAAUFWinD+UAFmhCTQAAbUgJBHNICQQADhZoQk0AAG1ICQRzSAkEAA4W aIkhKwBtSAkEc0gJBAAfAAiBFWgeLnwAFmgMZnEAF2jpFmkAY0gBAGRo35JDpwwVaB4ufAAW aAxmcQAAEwEIgQRIAQAFaN+SQ6cWaOkWaQAfAAiBFWi0OlMAFmgMZnEAF2gIXoIAY0gBAGRo 8pJDpwwVaLQ6UwAWaAxmcQAAKhVop3WAABZop3WAADUIgUNKEgBPSgQAUUoEAG1IAARuSAAE c0gJBHUIAQAkFmindYAANQiBQ0oSAE9KBABRSgQAbUgABG5IAARzSAkEdQgBACoACIEVaKd1 gAAWaKd1gAAXaOkWaQBjSAEAZGjfkkOnbUgABG5IAAR1CAEAERZop3WAAG1IAARuSAAEdQgB FxVop3WAABZop3WAAG1IAARuSAAEdQgBABmshAAArYQAAMOEAADXhAAA2YQAANqEAAAAhQAA AYUAAASFAAAFhQAABoUAAAeFAAAehQAAIoUAAC+FAABJhQAASoUAAFyFAAB9hQAAfoUAAJeF AACYhQAAmYUAAO/i78/Ero+uj66EfHRrdGN0W09bQE8AAAAAAAAAAAAAAAAAAB0CCIEDakYL AAAGCAEWaB0GBABVCAFuSAwEdEgMBBcDagAAAAAWaB0GBABVCAFuSAwEdEgMBA4WaB0GBABu SAwEdEgMBAAOFmiJISsAbkgMBHRIDAQAEBVoKRNDABZoKRNDADBKfQAADhZoKRNDAG5IDAR0 SAwEAA4WaNs1lABtSAkEc0gJBAAUFWgMZnEAFmgMZnEAbUgJBHNICQQAPQAIgRVop3WAABZo p3WAABdoowqYADUIgUNKEgBPSgQAUUoEAGNIAQBkaOKSQ6dtSAAEbkgABHNICQR1CAEqFWin dYAAFmindYAANQiBQ0oSAE9KBABRSgQAbUgABG5IAARzSAkEdQgBABQVaB4ufAAWaEJNAABt SAkEc0gJBAAkFmindYAANQiBQ0oSAE9KBABRSgQAbUgABG5IAARzSAkEdQgBABkWaEJNAAAw Sn0ANQiBQ0oUAE9KAABRSgAAHxVopw/lABZoQk0AADBKfQA1CIFDShQAT0oAAFFKAAAAFpmF AACehQAAn4UAAKGFAACihQAAu4UAALyFAAC9hQAAwoUAAMOFAADFhQAAxoUAAN+FAADghQAA 4YUAAOaFAADnhQAA7IUAAO2FAAAGhgAAB4YAAAiGAAANhgAADoYAAEuGAABPhgAAUIYAAFGG AABqhgAAa4YAAGyGAABxhgAAcoYAAHSGAACDhgAAh4YAAIiGAACJhgAAooYAAKOGAACkhgAA qYYAAKqGAADghgAA6YYAAOqGAADrhgAABIcAAPjs5Ozk1ez47OTs5Mbs+Ozk7OS37Pjsr6Tk 7OSV7PjspK+k5Ozkhuz47K+k5OzkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdAgiB A2q3DQAABggBFmgdBgQAVQgBbkgMBHRIDAQdAgiBA2o6DQAABggBFmgdBgQAVQgBbkgMBHRI DAQUFWgdBgQAFmgpE0MAbkgMBHRIDAQADhZoKRNDAG5IDAR0SAwEAB0CCIEDar0MAAAGCAEW aB0GBABVCAFuSAwEdEgMBB0CCIEDakAMAAAGCAEWaB0GBABVCAFuSAwEdEgMBB0CCIEDasML AAAGCAEWaB0GBABVCAFuSAwEdEgMBA4WaB0GBABuSAwEdEgMBAAXA2oAAAAAFmgdBgQAVQgB bkgMBHRIDAQOFmgvRuQAbkgMBHRIDAQvBIcAAAWHAAAGhwAAC4cAAAyHAAAahwAAhIcAAIWH AADShwAA1IcAAPCHAADxhwAA9IcAAPWHAAD2hwAA94cAABaIAAAriAAARogAAIGIAACCiAAA p4gAAK+IAACyiAAA24gAAN+IAAALiQAADIkAACCJAAAiiQAAXIkAAF6JAABriQAAbIkAAG2J AADw5Nzk1M29zbbNvc2vzaSclIyEeWykZKRkpGSkZKRkpFykAAAAAAAAAAAAAA4WaBBWtwBu SAwEdEgMBAAOFmjcM7QAbkgMBHRIDAQAGBVoDGZxABZoDGZxAG1IAARuSAAEdEgMBAAUFWhV Yo0AFmhVYo0AbUgJBHNICQQADhZoolKdAG1ICQRzSAkEAA4WaNwztABtSAkEc0gJBAAOFmhV Yo0AbUgJBHNICQQADhZo2zWUAG1ICQRzSAkEABQVaAxmcQAWaAxmcQBuSAwEdEgMBAAMFWge LnwAFmgQVrcAAAwVaB4ufAAWaNwztAAAHwAIgRVoHi58ABZoDGZxABdo6RZpAGNIAQBkaN+S Q6cMFWgeLnwAFmgMZnEAAA4WaCkTQwBuSAwEdEgMBAAOFmgvRuQAbkgMBHRIDAQAFwNqAAAA ABZoHQYEAFUIAW5IDAR0SAwEHQIIgQNqNA4AAAYIARZoHQYEAFUIAW5IDAR0SAwEACIWiAAA gogAAKeIAADXiAAA9IgAACCJAABPiQAAbIkAAG6JAAC/iQAA2YkAAPqJAAAOigAAO4oAAF+K AACAigAAg4oAAJGKAACgigAAzYoAAOqKAAAEiwAABosAAPoAAAAAAAAAAAAAAAD1AAAAAAAA AAAAAAAA8AAAAAAAAAAAAAAAAPAAAAAAAAAAAAAAAADwAAAAAAAAAAAAAAAA8AAAAAAAAAAA AAAAAPAAAAAAAAAAAAAAAADwAAAAAAAAAAAAAAAA6wAAAAAAAAAAAAAAAOYAAAAAAAAAAAAA AADhAAAAAAAAAAAAAAAA4QAAAAAAAAAAAAAAAOEAAAAAAAAAAAAAAADhAAAAAAAAAAAAAAAA 4QAAAAAAAAAAAAAAAOEAAAAAAAAAAAAAAADCAAAAAAAAAAAAAAAA4QAAAAAAAAAAAAAAAOEA AAAAAAAAAAAAAADhAAAAAAAAAAAAAAAA4QAAAAAAAAAAAAAAAOEAAAAAAAAAAAAAAAAAAAAA AAAAAAAAHwAAAyQDDcYoBBoDpwQ0BsEHCjcCbgSlBtwIEwtKDYEPuBHvEyYWAAAAAAAAAAAA ABOkAABhJANnZH01XAAABH4AZ2QeLnwAAAQhAGdkHi58AAAEAABnZB4ufAAABH4AZ2TZIwkA AAQhAGdk2SMJAAAEAABnZFVijQAAFm2JAABuiQAAl4kAAKSJAAC+iQAAv4kAANmJAACAigAA g4oAAJGKAAAFiwAABosAADKLAAAziwAARIsAAEWLAABIiwAASYsAAEqLAABLiwAAb4sAAHCL AAB3iwAAeIsAAHuLAAB8iwAAfYsAAH6LAAD48Ofw+ODUxrLUpp+Pn4+fj5+Ld1p3Wndad0kA AAAAAAAAIBZodwd4ADUIgUNKEgBPSgQAUUoEAG1IAARuSAAEdQgBADkACIEVaHcHeAAWaHcH eAAXaKMKmAA1CIFDShIAT0oEAFFKBABjSAEAZGjikkOnbUgABG5IAAR1CAEmFWh3B3gAFmh3 B3gANQiBQ0oSAE9KBABRSgQAbUgABG5IAAR1CAEABhZoDGZxAAAfAAiBFWgRC4AAFmgMZnEA F2ijCpgAY0gBAGRo4pJDpwwVaBELgAAWaAxmcQAAFxVoHi58ABZofTVcAG1IAARuSAAEdQgB JhVodwd4ABZofTVcADUIgUNKEgBPSgQAUUoEAG1IAARuSAAEdQgBABoVaHcHeAAWaH01XABc CIFtSAAEbkgABHUIAQAXFWh3B3gAFmh9NVwAbUgABG5IAAR1CAEMFWgeLnwAFmh9NVwAABAV aB4ufAAWaH01XAAwSn0AAA4WaH01XABuSAwEdEgMBAAOFmgMZnEAbkgMBHRIDAQbBosAAEuL AAB+iwAAtYsAANCLAADqiwAACYwAACGMAABLjAAATYwAAHOMAAC2jAAAzowAAOiMAAD7jAAA GI0AAESNAAB5jQAAtY0AALeNAADTjQAA+gAAAAAAAAAAAAAAANsAAAAAAAAAAAAAAADWAAAA AAAAAAAAAAAA2wAAAAAAAAAAAAAAAK8AAAAAAAAAAAAAAACvAAAAAAAAAAAAAAAArwAAAAAA AAAAAAAAAK8AAAAAAAAAAAAAAACvAAAAAAAAAAAAAAAA2wAAAAAAAAAAAAAAAK8AAAAAAAAA AAAAAADbAAAAAAAAAAAAAAAArwAAAAAAAAAAAAAAAK8AAAAAAAAAAAAAAACvAAAAAAAAAAAA AAAArwAAAAAAAAAAAAAAAK8AAAAAAAAAAAAAAACvAAAAAAAAAAAAAAAArwAAAAAAAAAAAAAA ANsAAAAAAAAAAAAAAAAAAAAAAAAnAAADJAMNxh0DGgOnBDQGB3gFNgqUDPMOURGwEw8WAAAA AAAAAA+EeAUTpAAAKiQBNSQBNyQBOCQBOUQEAEgkAV6EeAVhJANnZHcHeAAABAAAZ2QeLnwA HwAAAyQDDcYoBBoDpwQ0BsEHCjcCbgSlBtwIEwtKDYEPuBHvEyYWAAAAAAAAAAAAABOkeABh JANnZHcHeAAABCEAZ2QRC4AAABR+iwAAgosAAJKLAAC0iwAAtYsAANCLAAAXjAAAGIwAAB6M AAAfjAAATYwAAHOMAACzjAAAtIwAALaMAADOjAAAVI0AAHeNAAC3jQAA040AANSNAAAIjgAA 9u324c2zkLOQs82zbbPNs1azzT+zAAAAAAAAAAAAAAAAAAAAAAAsFmghKEAANQiBQIj+/0NK EgBPSgQAUUoEAGFKGABtSAAEbkgABHNICQR1CAEALBZodwd4ADUIgUCI/v9DShIAT0oEAFFK BABhShgAbUgABG5IAARzSAkEdQgBAEUACIEVaHcHeAAWaHcHeAAXaOkWaQA1CIFAiP7/Q0oS AE9KBABRSgQAYUoYAGNIAQBkaN+SQ6dtSAAEbkgABHNICQR1CAFFAAiBFWh3B3gAFmh3B3gA F2jpFmkANQiBQIj+/0NKEgBPSgQAUUoEAGFKGABjSAEAZGjgkkOnbUgABG5IAARzSAkEdQgB MhVodwd4ABZodwd4ADUIgUCI/v9DShIAT0oEAFFKBABhShgAbUgABG5IAARzSAkEdQgBACYV aHcHeAAWaHcHeAA1CIFDShIAT0oEAFFKBABtSAAEbkgABHUIAQAXFWh3B3gAFmh9NVwAbUgA BG5IAAR1CAEQFWgeLnwAFmh9NVwAMEp9AAARFmh9NVwAbUgABG5IAAR1CAEAFdONAADqjQAA Bo4AAAiOAAApjgAAVo4AAFuOAACSjgAAlI4AALKOAACyjwAA5JIAAM+TAAANlAAADpQAAC2U AADnlAAADJUAADeVAABtlQAA2AAAAAAAAAAAAAAAANgAAAAAAAAAAAAAAADYAAAAAAAAAAAA AAAA0wAAAAAAAAAAAAAAAM4AAAAAAAAAAAAAAADOAAAAAAAAAAAAAAAAzgAAAAAAAAAAAAAA AM4AAAAAAAAAAAAAAADJAAAAAAAAAAAAAAAAwQAAAAAAAAAAAAAAAMEAAAAAAAAAAAAAAADB AAAAAAAAAAAAAAAAwQAAAAAAAAAAAAAAALwAAAAAAAAAAAAAAAC3AAAAAAAAAAAAAAAAsgAA AAAAAAAAAAAAAK0AAAAAAAAAAAAAAACkAAAAAAAAAAAAAAAApAAAAAAAAAAAAAAAAAAACH4A D4R4BV6EeAVnZPoUFAAABCEAZ2QDFYYAAAQAAGdkEQuAAAAEAwBnZNs1lAAABAAAZ2QMZnEA CAAACiYAC0YrAGdkHi58AAAEIQBnZBELgAAABH4AZ2TZIwkAAAQhAGdk2SMJACcAAAMkAw3G HQMaA6cENAYHeAU2CpQM8w5REbATDxYAAAAAAAAAD4R4BROkAAAqJAE1JAE3JAE4JAE5RAQA SCQBXoR4BWEkA2dkdwd4AAATCI4AACmOAACNjgAAjo4AAJGOAACSjgAAk44AAJSOAACyjgAA uY4AANiOAADbjgAA744AAASPAAAUjwAAJ48AAD6PAABAjwAASY8AAEyPAABgjwAAdI8AAISP AACXjwAAro8AALCPAACyjwAAtY8AALaPAAC9jwAA0Y8AAKOQAAClkAAArZAAALmQAAC8kAAA 3pAAAOWQAAD0kAAABpEAAAeRAAA2kQAASpEAAPPo1OjM6MS9tKy0rLSstKyirKKsoqyirKKs oqyarJqSiJJ9dZKIkm2SiAAAAAAOFmiiUp0AbkgMBHRIDAQADhZo+hQUAG5IDAR0SAwEABQV aPoUFAAWaPoUFABuSAwEdEgMBAATFWgeLnwAFmh3XxUAMEp9AFwIgQ4WaHdfFQBuSAwEdEgM BAAOFmgmdEkAbkgMBHRIDAQAExVoHi58ABZoLW9PADBKfQBcCIEOFmgtb08AbkgMBHRIDAQA EBVoHi58ABZoLW9PADBKfQAADBVoEQuAABZoEQuAAAAOFmgMZnEAbkgMBHRIDAQADhZoEFa3 AG5IDAR0SAwEACcACIEVaAxmcQAWaAxmcQAXaAheggBjSAEAZGjwkkOnbkgMBHRIDAQUFWgM ZnEAFmgMZnEAbkgMBHRIDAQAGBVoDGZxABZoDGZxAG1IAARuSAAEdEgMBCpKkQAAXJEAAHyR AACLkQAAn5EAAKmRAADokQAADpIAAHGSAACikgAAtZIAAOOSAADkkgAA+pIAAJiTAACckwAA nZMAALaTAAC3kwAAx5MAAMiTAADLkwAAzJMAAM2TAADOkwAAz5MAANuTAAAMlAAADZQAAA6U AAAtlAAAXpQAAPjw+Ob48N7w1szWxMzWuaqfjYWqfaqFudbM1nJnX1cAAAAAAAAAAAAAAAAA AAAOFmgRC4AAbUgJBHNICQQADhZo2zWUAG1ICQRzSAkEABQVaAxmcQAWaAxmcQBtSAkEc0gJ BAAUFWgMZnEAFmgRC4AAbkgMBHRIDAQADhZoL0bkAG5IDAR0SAwEAA4WaPoUFABuSAwEdEgM BAAjAgiBA2qxDgAABggBFWj6FBQAFmj6FBQAVQgBbkgMBHRIDAQUFWj6FBQAFmj6FBQAbkgM BHRIDAQAHQNqAAAAABVo+hQUABZo+hQUAFUIAW5IDAR0SAwEFBVo+hQUABZoEQuAAG5IDAR0 SAwEAA4WaC1vTwBuSAwEdEgMBAATFWgeLnwAFmgRC4AAMEp9AFwIgQ4WaBELgABuSAwEdEgM BAAOFmhJTNEAbkgMBHRIDAQAExVoHi58ABZod18VADBKfQBcCIEOFmiiUp0AbkgMBHRIDAQA DhZod18VAG5IDAR0SAwEH16UAABhlAAAdpQAAOaUAADnlAAADJUAABSVAAAXlQAAQpUAAEWV AABxlQAAdpUAALeVAAC4lQAAzJUAANCVAAAQlgAAEZYAACiWAAAplgAAKpYAACuWAABTlgAA XJYAAHeWAACNlgAAbZcAAHuXAAARmAAAEpgAADqYAAD47/jk19DM0MzQzNDM0MzQzNDF0MHM t8yiiHSIWtcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADIVaB4ufAAWaAVh3AA1CIFAiP7/ Q0oSAE9KBABRSgQAYUoYAG1IAARuSAAEc0gJBHUIAQAmFWi0NR8AFmgFYdwANQiBQ0oSAE9K BABRSgQAbUgABG5IAAR1CAEAMhVotDUfABZoBWHcADUIgUCI/v9DShIAT0oEAFFKBABhShgA bUgABG5IAARzSAkEdQgBACkVaLQ1HwAWaAVh3AA1CIFDShIAT0oEAFFKBABcCIFtSAAEbkgA BHUIARMVaB4ufAAWaAVh3AAwSn0AXAiBBhZoAxWGAAAMFWj6FBQAFmgQVrcAAAYWaAVh3AAA DBVo+hQUABZoAxWGAAAYFWgDFYYAFmgDFYYAbUgABG5IAAR0SAwEABQVaBELgAAWaBELgABt SAkEc0gJBAAQFWinDsEAFminDsEAMEp9AAAOFminDsEAbUgJBHNICQQebZUAAKCVAADMlQAA +ZUAACmWAAArlgAAd5YAAI2WAACtlgAAwJYAAOyWAAAPlwAAIJcAAEqXAABqlwAAbZcAAHuX AAD2AAAAAAAAAAAAAAAA9gAAAAAAAAAAAAAAAPYAAAAAAAAAAAAAAAD2AAAAAAAAAAAAAAAA 9gAAAAAAAAAAAAAAAPEAAAAAAAAAAAAAAADSAAAAAAAAAAAAAAAAqwAAAAAAAAAAAAAAAKsA AAAAAAAAAAAAAACrAAAAAAAAAAAAAAAAqwAAAAAAAAAAAAAAAKsAAAAAAAAAAAAAAACrAAAA AAAAAAAAAAAAqwAAAAAAAAAAAAAAAKsAAAAAAAAAAAAAAACMAAAAAAAAAAAAAAAAAAAAAB8A AAMkAw3GKAQaA6cENAbBBwo3Am4EpQbcCBMLSg2BD7gR7xMmFgAAAAAAAAAAAAATpAAAYSQD Z2QFYdwAJwAAAyQDDcYdAxoDpwQ0Bgd4BTYKlAzzDlERsBMPFgAAAAAAAAAPhHgFE6QAACok ATUkATckATgkATlEBABIJAFehHgFYSQDZ2QFYdwAHwAAAyQDDcYoBBoDpwQ0BsEHCjcCbgSl BtwIEwtKDYEPuBHvEyYWAAAAAAAAAAAAABOkeABhJANnZAVh3AAABAAAZ2QeLnwAAAh+AA+E eAVehHgFZ2T6FBQAABB7lwAAjJcAALmXAADVlwAA+JcAABCYAAASmAAAU5gAAI+YAADKmAAA 5JgAAP2YAADYAAAAAAAAAAAAAAAA2AAAAAAAAAAAAAAAANgAAAAAAAAAAAAAAADYAAAAAAAA AAAAAAAA2AAAAAAAAAAAAAAAALEAAAAAAAAAAAAAAACsAAAAAAAAAAAAAAAApwAAAAAAAAAA AAAAAIgAAAAAAAAAAAAAAACIAAAAAAAAAAAAAAAAYQAAAAAAAAAAAAAAAAAAACcAAAMkAw3G HQMaA6cENAYHeAU2CpQM8w5REbATDxYAAAAAAAAAD4R4BROkAAAqJAE1JAE3JAE4JAE5RAQA SCQBXoR4BWEkA2dktDUfAB8AAAMkAw3GKAQaA6cENAbBBwo3Am4EpQbcCBMLSg2BD7gR7xMm FgAAAAAAAAAAAAATpHgAYSQDZ2S0NR8AAAQAAGdkHi58AAAEIQBnZAMVhgAnAAADJAMNxh0D GgOnBDQGB3gFNgqUDPMOURGwEw8WAAAAAAAAAA+EeAUTpAAAKiQBNSQBNyQBOCQBOUQEAEgk AV6EeAVhJANnZB4ufAAnAAADJAMNxh0DGgOnBDQGB3gFNgqUDPMOURGwEw8WAAAAAAAAAA+E eAUTpAAAKiQBNSQBNyQBOCQBOUQEAEgkAV6EeAVhJANnZAVh3AAACzqYAAA7mAAATJgAAE2Y AABQmAAAUZgAAFKYAABTmAAAeJgAAICYAACFmAAAjpgAAI+YAACvmAAAsJgAAMSYAADFmAAA 5JgAADeZAAA4mQAAPZkAAOnc6dzp3NLKwMrAyqyPrHKsWDVYAABFAAiBFWi0NR8AFmi0NR8A F2ijCpgANQiBQIj+/0NKEgBPSgQAUUoEAGFKGABjSAEAZGjjkkOnbUgABG5IAARzSAkEdQgB MhVotDUfABZotDUfADUIgUCI/v9DShIAT0oEAFFKBABhShgAbUgABG5IAARzSAkEdQgBADkA CIEVaLQ1HwAWaLQ1HwAXaKMKmAA1CIFDShIAT0oEAFFKBABjSAEAZGjjkkOnbUgABG5IAAR1 CAE5AAiBFWi0NR8AFmi0NR8AF2ijCpgANQiBQ0oSAE9KBABRSgQAY0gBAGRo4pJDp21IAARu SAAEdQgBJhVotDUfABZotDUfADUIgUNKEgBPSgQAUUoEAG1IAARuSAAEdQgBABMVaB4ufAAW aGpNhAAwSn0AXAiBDhZoak2EAG5IDAR0SAwEABIWaAMVhgBtSAAEbkgABHRIDAQAGBVoAxWG ABZoAxWGAG1IAARuSAAEdEgMBAArAAiBFWgDFYYAFmgDFYYAF2ijCpgAY0gBAGRo4pJDp21I AARuSAAEdEgMBAAU/ZgAACmZAABAmQAAXJkAAHCZAACvmQAAsZkAAPWZAAAKmgAAKpoAAD2a AABpmgAA2AAAAAAAAAAAAAAAANgAAAAAAAAAAAAAAADYAAAAAAAAAAAAAAAA2AAAAAAAAAAA AAAAANgAAAAAAAAAAAAAAACxAAAAAAAAAAAAAAAArAAAAAAAAAAAAAAAAI0AAAAAAAAAAAAA AABmAAAAAAAAAAAAAAAAZgAAAAAAAAAAAAAAAGYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA JwAAAyQDDcYdAxoDpwQ0Bgd4BTYKlAzzDlERsBMPFgAAAAAAAAAPhHgFE6QAACokATUkATck ATgkATlEBABIJAFehHgFYSQDZ2RuGtMAHwAAAyQDDcYoBBoDpwQ0BsEHCjcCbgSlBtwIEwtK DYEPuBHvEyYWAAAAAAAAAAAAABOkeABhJANnZG4a0wAABCEAZ2RuGtMAJwAAAyQDDcYdAxoD pwQ0Bgd4BTYKlAzzDlERsBMPFgAAAAAAAAAPhHgFE6QAACokATUkATckATgkATlEBABIJAFe hHgFYSQDZ2QeLnwAJwAAAyQDDcYdAxoDpwQ0Bgd4BTYKlAzzDlERsBMPFgAAAAAAAAAPhHgF E6QAACokATUkATckATgkATlEBABIJAFehHgFYSQDZ2S0NR8AAAs9mQAAPpkAALCZAACxmQAA xZkAAMaZAADxmQAA8pkAAPSZAAD1mQAACpoAAIyaAADcwquelIVthWFMMgAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMhVoPSZCABZobhrTADUIgUCI/v9DShIA T0oEAFFKBABhShgAbUgABG5IAARzSAkEdQgBACkVaD0mQgAWaG4a0wA1CIFDShIAT0oEAFFK BABcCIFtSAAEbkgABHUIARYWaG4a0wBtSAAEbkgABHNICQR0SAwEAC8ACIEVaHlM9gAWaG4a 0wAXaAheggBjSAEAZGjtkkOnbUgABG5IAARzSAkEdEgMBBwVaHlM9gAWaG4a0wBtSAAEbkgA BHNICQR0SAwEABIWaG4a0wBtSAAEbkgABHRIDAQAGBVoeUz2ABZobhrTAG1IAARuSAAEdEgM BAAsFmghPAMANQiBQIj+/0NKEgBPSgQAUUoEAGFKGABtSAAEbkgABHNICQR1CAEAMhVotDUf ABZotDUfADUIgUCI/v9DShIAT0oEAFFKBABhShgAbUgABG5IAARzSAkEdQgBAEUACIEVaLQ1 HwAWaLQ1HwAXaKMKmAA1CIFAiP7/Q0oSAE9KBABRSgQAYUoYAGNIAQBkaOOSQ6dtSAAEbkgA BHNICQR1CAEAC2maAACJmgAAjJoAAJqaAACrmgAA2JoAAPGaAADzmgAANZsAAGubAACEmwAA nZsAAMmbAADemwAA2AAAAAAAAAAAAAAAANgAAAAAAAAAAAAAAAC5AAAAAAAAAAAAAAAA2AAA AAAAAAAAAAAAANgAAAAAAAAAAAAAAADYAAAAAAAAAAAAAAAA2AAAAAAAAAAAAAAAAJoAAAAA AAAAAAAAAABzAAAAAAAAAAAAAAAAmgAAAAAAAAAAAAAAAHMAAAAAAAAAAAAAAABzAAAAAAAA AAAAAAAAcwAAAAAAAAAAAAAAAAAAAAAAJwAAAyQDDcYdAxoDpwQ0Bgd4BTYKlAzzDlERsBMP FgAAAAAAAAAPhHgFE6QAACokATUkATckATgkATlEBABIJAFehHgFYSQDZ2S0NR8AHwAAAyQD DcYoBBoDpwQ0BsEHCjcCbgSlBtwIEwtKDYEPuBHvEyYWAAAAAAAAAAAAABOkeABhJANnZLQ1 HwAfAAADJAMNxigEGgOnBDQGwQcKNwJuBKUG3AgTC0oNgQ+4Ee8TJhYAAAAAAAAAAAAAE6QA AGEkA2dkbhrTACcAAAMkAw3GHQMaA6cENAYHeAU2CpQM8w5REbATDxYAAAAAAAAAD4R4BROk AAAqJAE1JAE3JAE4JAE5RAQASCQBXoR4BWEkA2dkbhrTAAANjJoAAJqaAADzmgAAFpsAABeb AAA1mwAAaJsAAGmbAABrmwAAhJsAAE+cAABynAAAc5wAAJGcAADFnAAAxpwAAMicAADvnAAA cZ0AAHKdAAB0nQAAl50AAOydAADtnQAA750AABCeAADs0r6hvodkh76HvqG+h2SHV0xETFdM RExXAAAAAAAAAA4WaBBWtwBuSAwEdEgMBAAUFWgDFYYAFmgDFYYAbkgMBHRIDAQAGBVoAxWG ABZoAxWGAG1IAARuSAAEdEgMBABFAAiBFWi0NR8AFmi0NR8AF2ijCpgANQiBQIj+/0NKEgBP SgQAUUoEAGFKGABjSAEAZGjjkkOnbUgABG5IAARzSAkEdQgBMhVotDUfABZotDUfADUIgUCI /v9DShIAT0oEAFFKBABhShgAbUgABG5IAARzSAkEdQgBADkACIEVaLQ1HwAWaLQ1HwAXaKMK mAA1CIFDShIAT0oEAFFKBABjSAEAZGjjkkOnbUgABG5IAAR1CAEmFWi0NR8AFmi0NR8ANQiB Q0oSAE9KBABRSgQAbUgABG5IAAR1CAEAMhVoPSZCABZobhrTADUIgUCI/v9DShIAT0oEAFFK BABhShgAbUgABG5IAARzSAkEdQgBACYVaD0mQgAWaG4a0wA1CIFDShIAT0oEAFFKBABtSAAE bkgABHUIARnemwAA+psAAA6cAABNnAAAT5wAAJGcAADInAAA75wAABydAABLnQAAcp0AAHSd AACXnQAA150AAO2dAADvnQAAK54AANgAAAAAAAAAAAAAAADYAAAAAAAAAAAAAAAA2AAAAAAA AAAAAAAAANgAAAAAAAAAAAAAAAC5AAAAAAAAAAAAAAAA2AAAAAAAAAAAAAAAALQAAAAAAAAA AAAAAACrAAAAAAAAAAAAAAAAqwAAAAAAAAAAAAAAAKsAAAAAAAAAAAAAAACrAAAAAAAAAAAA AAAAtAAAAAAAAAAAAAAAAKsAAAAAAAAAAAAAAACrAAAAAAAAAAAAAAAAqwAAAAAAAAAAAAAA ALQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH4AD4R4BV6EeAVnZDBDlQAABCEAZ2QDFYYA HwAAAyQDDcYoBBoDpwQ0BsEHCjcCbgSlBtwIEwtKDYEPuBHvEyYWAAAAAAAAAAAAABOkeABh JANnZLQ1HwAnAAADJAMNxh0DGgOnBDQGB3gFNgqUDPMOURGwEw8WAAAAAAAAAA+EeAUTpAAA KiQBNSQBNyQBOCQBOUQEAEgkAV6EeAVhJANnZLQ1HwAAEBCeAAARngAAJJ4AACWeAAAongAA KZ4AACqeAAArngAATp4AAE+eAABVngAAVp4AAFueAAByngAAMZ8AADKfAAA2nwAAXZ8AAOnc 6dzp3NK+ob6hvoFlQGW+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA SQAIgRVoPSZCABZoPSZCABdoCF6CADUIgUCI/v9DShIAT0oEAFFKBABhShgAY0gBAGRo7ZJD p21IAARuSAAEc0gJBHRIDAR1CAE2FWg9JkIAFmg9JkIANQiBQIj+/0NKEgBPSgQAUUoEAGFK GABtSAAEbkgABHNICQR0SAwEdQgBAD4VaD0mQgAWaD0mQgA1CIFCKgFDShIAT0oEAFFKBABc CIFeSgQAbUgABG5IAARwaAAAAABzSAkEdEgMBHUIAQA5AAiBFWg9JkIAFmg9JkIAF2ijCpgA NQiBQ0oSAE9KBABRSgQAY0gBAGRo45JDp21IAARuSAAEdQgBJhVoPSZCABZoPSZCADUIgUNK EgBPSgQAUUoEAG1IAARuSAAEdQgBABIWaAMVhgBtSAAEbkgABHRIDAQAGBVoAxWGABZoAxWG AG1IAARuSAAEdEgMBAArAAiBFWgDFYYAFmgDFYYAF2ijCpgAY0gBAGRo45JDp21IAARuSAAE dEgMBAARK54AAFueAAByngAAjZ4AAJ+eAADNngAA+Z4AADSfAAA2nwAAXZ8AAJ+fAADVnwAA 9Z8AABmgAAA3oAAAVqAAAIagAACxoAAA4AAAAAAAAAAAAAAAAOAAAAAAAAAAAAAAAAC5AAAA AAAAAAAAAAAAuQAAAAAAAAAAAAAAALkAAAAAAAAAAAAAAAC5AAAAAAAAAAAAAAAAuQAAAAAA AAAAAAAAALkAAAAAAAAAAAAAAADgAAAAAAAAAAAAAAAAlgAAAAAAAAAAAAAAAOAAAAAAAAAA AAAAAADgAAAAAAAAAAAAAAAAuQAAAAAAAAAAAAAAALkAAAAAAAAAAAAAAAC5AAAAAAAAAAAA AAAAuQAAAAAAAAAAAAAAALkAAAAAAAAAAAAAAAAAAAAAAAAAIwAAAyQDDcYdAxoDpwQ0Bgd4 BTYKlAzzDlERsBMPFgAAAAAAAAATpAAAKiQBNSQBNyQBOCQBOUQEAEgkAWEkA2dkPSZCACcA AAMkAw3GHQMaA6cENAYHeAU2CpQM8w5REbATDxYAAAAAAAAAD4R4BROkAAAqJAE1JAE3JAE4 JAE5RAQASCQBXoR4BWEkA2dkPSZCAB8AAAMkAw3GKAQaA6cENAbBBwo3Am4EpQbcCBMLSg2B D7gR7xMmFgAAAAAAAAAAAAATpHgAYSQDZ2Q9JkIAABFdnwAAnJ8AAJ2fAACfnwAA1Z8AAPWf AACzoAAA06AAAP2gAAAhoQAAXqEAAF+hAACEoQAAiKEAAIuhAAC1oQAAtqEAAMOhAADEoQAA xqEAANyv3JeDaYNpWk1CTUI6QjpCMkIADhZoEFa3AG5IDAR0SAwEAA4WaKsmnABuSAwEdEgM BAAUFWgDFYYAFmgDFYYAbkgMBHRIDAQAGBVoAxWGABZoAxWGAG1IAARuSAAEdEgMBAAcFWir JpwAFmg6SDMAbUgABG5IAARzSAkEdEgMBAAyFWg9JkIAFmg9JkIANQiBQIj+/0NKEgBPSgQA UUoEAGFKGABtSAAEbkgABHNICQR1CAEAJhVoPSZCABZoPSZCADUIgUNKEgBPSgQAUUoEAG1I AARuSAAEdQgBAC4VaD0mQgAWaD0mQgA1CIFDShIAT0oEAFFKBABtSAAEbkgABHNICQR0SAwE dQgBAFkACIEVaD0mQgAWaD0mQgAXaAheggA1CIFAiP7/QioBQ0oSAE9KBABRSgQAXAiBXkoE AGFKGABjSAEAZGjtkkOnbUgABG5IAARwaAAAAABzSAkEdEgMBHUIAUYVaD0mQgAWaD0mQgA1 CIFAiP7/QioBQ0oSAE9KBABRSgQAXAiBXkoEAGFKGABtSAAEbkgABHBoAAAAAHNICQR0SAwE dQgBE7GgAACzoAAA06AAAOagAAD7oAAA/aAAACGhAABeoQAAX6EAAIShAACooQAAxKEAAMah AADvoQAAHKIAAEiiAABKogAAcKIAAJuiAADYAAAAAAAAAAAAAAAAuQAAAAAAAAAAAAAAANgA AAAAAAAAAAAAAADYAAAAAAAAAAAAAAAA2AAAAAAAAAAAAAAAALQAAAAAAAAAAAAAAACvAAAA AAAAAAAAAAAAqgAAAAAAAAAAAAAAAK8AAAAAAAAAAAAAAAChAAAAAAAAAAAAAAAAoQAAAAAA AAAAAAAAAKEAAAAAAAAAAAAAAACvAAAAAAAAAAAAAAAAoQAAAAAAAAAAAAAAAKEAAAAAAAAA AAAAAAChAAAAAAAAAAAAAAAArwAAAAAAAAAAAAAAAKEAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAACH4AD4R4BV6EeAVnZDBDlQAABH4AZ2QDFYYAAAQhAGdkAxWGAAAEIQBnZDpIMwAfAAAD JAMNxigEGgOnBDQGwQcKNwJuBKUG3AgTC0oNgQ+4Ee8TJhYAAAAAAAAAAAAAE6R4AGEkA2dk PSZCACcAAAMkAw3GHQMaA6cENAYHeAU2CpQM8w5REbATDxYAAAAAAAAAD4R4BROkAAAqJAE1 JAE3JAE4JAE5RAQASCQBXoR4BWEkA2dkPSZCAAASxqEAAO+hAABHogAASKIAAEqiAABwogAA 26IAANyiAADeogAAA6MAAASjAADDowAAxKMAAPCjAADxowAA9KMAAPWjAAD3owAA/qMAABik AAAapAAAHKQAACakAACRpAAApqQAAASlAAAYpQAAVqUAAF2lAABopQAApqUAALqlAADKpQAA jaYAAI6mAACbpgAAAacAAAKnAAAEpwAA8+jg6PPo4Ojz1s3HzbXNtc2spKykrKSbk5uTi5OL gnqLk3GLk2kAAAAAAAAAAAAAAAAAAAAADhZoo0JjAG5IDAR0SAwEABAVaElM0QAWaLknEgAw Sn0AAA4WaL9V8wBuSAwEdEgMBAAQFWhJTNEAFmhJTNEAMEp9AAAOFmhJTNEAbkgMBHRIDAQA DhZouScSAG5IDAR0SAwEABAVaLknEgAWaLknEgAwSn0AAA4WaKcOwQBuSAwEdEgMBAAQFWin DsEAFminDsEAMEp9AAAjAAiBFWjnRp4AFmjnRp4AF2ijCpgAUEoFAGNIAQBkaOOSQ6cKFmgQ VrcAUEoFAAAQFWjnRp4AFmjnRp4AUEoFAAASFmgDFYYAbUgABG5IAAR0SAwEAA4WaBBWtwBu SAwEdEgMBAAUFWgDFYYAFmgDFYYAbkgMBHRIDAQAGBVoAxWGABZoAxWGAG1IAARuSAAEdEgM BCabogAAuqIAANyiAADeogAABKMAACajAABHowAAf6MAAMSjAADGowAA96MAABykAACRpAAA BKUAAI6mAAACpwAAPqcAAECoAADwqAAAz6kAAMKqAABkrQAA9gAAAAAAAAAAAAAAAPYAAAAA AAAAAAAAAAD2AAAAAAAAAAAAAAAA8QAAAAAAAAAAAAAAAOwAAAAAAAAAAAAAAADsAAAAAAAA AAAAAAAA9gAAAAAAAAAAAAAAAPYAAAAAAAAAAAAAAAD2AAAAAAAAAAAAAAAA7AAAAAAAAAAA AAAAANoAAAAAAAAAAAAAAADaAAAAAAAAAAAAAAAA0AAAAAAAAAAAAAAAANAAAAAAAAAAAAAA AADQAAAAAAAAAAAAAAAAywAAAAAAAAAAAAAAANoAAAAAAAAAAAAAAADaAAAAAAAAAAAAAAAA 2gAAAAAAAAAAAAAAAMEAAAAAAAAAAAAAAADBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAoAAAomAAtGFAATpFYAZ2RqQWQAAAQAAGdkSUzRAAoAAAomAAtGEwATpFYA Z2RqQWQAEgAACiYAC0YSAA+EpwQRhHP+E6RWAF6EpwRghHP+Z2RqQWQAAAQhAGdk50aeAAAE IQBnZAMVhgAACH4AD4R4BV6EeAVnZDBDlQAAFQSnAAAjpwAAPacAAD6nAABBpwAAQqcAAP+n AAACqAAAP6gAAECoAABWqAAAV6gAAFuoAACnqAAAzqgAAM+oAADoqAAA6agAAOqoAADtqAAA 7qgAAO+oAADwqAAAB6kAAEGpAABPqQAAUakAAFSpAAB3qQAAg6kAAI6pAADOqQAAz6kAAOSp AAB/qgAAnaoAAKOqAACvqgAAwqoAAMiqAAD48NjP+Me+x7a+rKWhnZWdipWGlZ2hgKF8ob6h vqF8oXN8nXxqfGQAChZoPkRSADBKfQAAEBVojH3VABZoPkRSADBKfQAAEBVoPkRSABZoPkRS ADBKfQAABhZoPkRSAAAKFmirJpwAMEp9AAAGFmgvRuQAABUCCIEDai4PAAAGCAEWaIx91QBV CAEPA2oAAAAAFmiMfdUAVQgBBhZojH3VAAAGFmirJpwAAAwVaKsmnAAWaKsmnAAAEhZoqyac ADBKfQBtSAkIc0gJCAAOFminDsEAbkgMBHRIDAQAEBVoqyacABZoqyacADBKfQAADhZoqyac AG5IDAR0SAwEABAVaKsmnAAWaDpIMwAwSn0AAC8VaKNCYwAWaElM0QAwSn0ANQiBQ0oUAE9K AABRSgAAbUgJCG5IDARzSAkIdEgMBA4WaKNCYwBuSAwEdEgMBAAOFmg6SDMAbkgMBHRIDAQn yKoAAMmqAADKqgAAF6sAACurAAB2qwAAiqsAAJqrAABirAAAZqwAAJqsAAAvrQAANK0AAGOt AABkrQAAfq0AAIKtAACSrQAAWK4AAFmuAAB5rgAACa8AAAqvAAAMrwAAKa8AAIWvAACGrwAA h68AAIivAADBrwAA+fXt5O3b0+3k7cvCy7uzq6Krl4p/d3+Kf3d/b1sAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAmFWg9JkIAFmg9JkIANQiBQ0oSAE9KBABRSgQAbUgABG5I AAR1CAEADhZoAxWGAG5IDAR0SAwEAA4WaBBWtwBuSAwEdEgMBAAUFWgDFYYAFmgDFYYAbkgM BHRIDAQAGBVoAxWGABZoAxWGAG1IAARuSAAEdEgMBAAUFWimHCcAFmimHCcAbUgJBHNICQQA EBVophwnABZophwnADBKfQAADhZophwnAG1ICQRzSAkEAA4WaNs1lABtSAkEc0gJBAAMFWir JpwAFmg+RFIAABAVaOdGngAWaOdGngAwSn0AAA4WaOdGngBuSAwEdEgMBAAOFmiMfdUAbkgM BHRIDAQAEBVoSUzRABZoPkRSADBKfQAAEBVoPkRSABZoPkRSADBKfQAADhZoPkRSAG5IDAR0 SAwEAAYWaD5EUgAADBVoPkRSABZoPkRSAB1krQAAfq0AAFmuAAB5rgAAoa4AALauAADvrgAA Cq8AAAyvAAAprwAARa8AAGSvAACGrwAAiK8AAMGvAADprwAAJbAAAGKwAAB+sAAAnbAAAPoA AAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA8AAAAAAAAAAAAAAAAOsAAAAAAAAAAAAAAADrAAAA AAAAAAAAAAAA6wAAAAAAAAAAAAAAAOsAAAAAAAAAAAAAAADrAAAAAAAAAAAAAAAA8AAAAAAA AAAAAAAAAOsAAAAAAAAAAAAAAADrAAAAAAAAAAAAAAAA6wAAAAAAAAAAAAAAAOsAAAAAAAAA AAAAAADMAAAAAAAAAAAAAAAApQAAAAAAAAAAAAAAAMwAAAAAAAAAAAAAAADMAAAAAAAAAAAA AAAAzAAAAAAAAAAAAAAAAKUAAAAAAAAAAAAAAAAAAAAnAAADJAMNxh0DGgOnBDQGB3gFNgqU DPMOURGwEw8WAAAAAAAAAA+EeAUTpAAAKiQBNSQBNyQBOCQBOUQEAEgkAV6EeAVhJANnZD0m QgAfAAADJAMNxigEGgOnBDQGwQcKNwJuBKUG3AgTC0oNgQ+4Ee8TJhYAAAAAAAAAAAAAE6R4 AGEkA2dkPSZCAAAEfgBnZAMVhgAABCEAZ2QDFYYAAAQAAGdkphwnAAAEAwBnZNs1lAAAE8Gv AADprwAAEbAAABKwAAAesAAAH7AAACKwAAAjsAAAP7AAAECwAABbsAAAXLAAAF+wAABgsAAA frAAAO6wAAAYsQAAGbEAAC+xAABqsQAAa7EAAG2xAACIsQAA4bEAAOKxAAABsgAAArIAAAWy AAAGsgAA5tGy0bLRstGy0bLRstHm0ZPR5nDm0eZw5nDmWQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAsFmg9JkIANQiBQIj+/0NKEgBPSgQAUUoEAGFKGABtSAAEbkgABHNI CQR1CAEARQAIgRVoPSZCABZoPSZCABdoowqYADUIgUCI/v9DShIAT0oEAFFKBABhShgAY0gB AGRo5JJDp21IAARuSAAEc0gJBHUIATwACIEVaD0mQgAWaD0mQgAXaKMKmAA1CIFDShIAT0oE AFFKBABcCIFjSAEAZGjkkkOnbUgABG5IAAR1CAEAPAAIgRVoPSZCABZoPSZCABdoowqYADUI gUNKEgBPSgQAUUoEAFwIgWNIAQBkaOOSQ6dtSAAEbkgABHUIAQApFWg9JkIAFmg9JkIANQiB Q0oSAE9KBABRSgQAXAiBbUgABG5IAAR1CAEyFWg9JkIAFmg9JkIANQiBQIj+/0NKEgBPSgQA UUoEAGFKGABtSAAEbkgABHNICQR1CAEcnbAAAL2wAADssAAA7rAAAC+xAABtsQAAiLEAAKex AADTsQAABLIAAAayAABGsgAAhLIAAK2yAADYAAAAAAAAAAAAAAAA2AAAAAAAAAAAAAAAANgA AAAAAAAAAAAAAAC5AAAAAAAAAAAAAAAA2AAAAAAAAAAAAAAAALkAAAAAAAAAAAAAAADYAAAA AAAAAAAAAAAA2AAAAAAAAAAAAAAAANgAAAAAAAAAAAAAAADYAAAAAAAAAAAAAAAAmgAAAAAA AAAAAAAAAHMAAAAAAAAAAAAAAAC5AAAAAAAAAAAAAAAAAAAAAAAnAAADJAMNxh0DGgOnBDQG B3gFNgqUDPMOURGwEw8WAAAAAAAAAA+EeAUTpAAAKiQBNSQBNyQBOCQBOUQEAEgkAV6EeAVh JANnZB4ufAAfAAADJAMNxigEGgOnBDQGwQcKNwJuBKUG3AgTC0oNgQ+4Ee8TJhYAAAAAAAAA AAAAE6R4AGEkA2dk52uGAB8AAAMkAw3GKAQaA6cENAbBBwo3Am4EpQbcCBMLSg2BD7gR7xMm FgAAAAAAAAAAAAATpHgAYSQDZ2Q9JkIAJwAAAyQDDcYdAxoDpwQ0Bgd4BTYKlAzzDlERsBMP FgAAAAAAAAAPhHgFE6QAACokATUkATckATgkATlEBABIJAFehHgFYSQDZ2Q9JkIAAA0GsgAA L7IAADCyAABGsgAAgbIAAIKyAACEsgAAzLIAAM2yAADUsgAA7rIAAPCyAADxsgAA8rIAAPiy AABuswAAe7MAAOrL6rGOsXlxaGBoWkI4NCsAABAVaMAZRwAWaMAZRwAwSn0AAAYWaMAZRwAA EhZophwnADBKfQBtSAkIc0gJCAAvFWimHCcAFmimHCcAMEp9ADUIgUNKFABPSgAAUUoAAG1I CQhuSAwEc0gJCHRIDAQKFmimHCcAMEp9AAAOFmimHCcAbkgMBHRIDAQAEBVophwnABZophwn ADBKfQAADhZoPSZCAG5IDAR0SAwEACkVaD0mQgAWaD0mQgA1CIFDShIAT0oEAFFKBABcCIFt SAAEbkgABHUIAUUACIEVaD0mQgAWaOdrhgAXaKMKmAA1CIFAiP7/Q0oSAE9KBABRSgQAYUoY AGNIAQBkaOSSQ6dtSAAEbkgABHNICQR1CAEyFWg9JkIAFmjna4YANQiBQIj+/0NKEgBPSgQA UUoEAGFKGABtSAAEbkgABHNICQR1CAEAPAAIgRVoPSZCABZo52uGABdoowqYADUIgUNKEgBP SgQAUUoEAFwIgWNIAQBkaOSSQ6dtSAAEbkgABHUIAQApFWg9JkIAFmjna4YANQiBQ0oSAE9K BABRSgQAXAiBbUgABG5IAAR1CAEAEK2yAADNsgAA8rIAAHu0AACatAAAcrUAAJe1AADAtQAA /LUAAAa2AAA/tgAAWrYAAFy2AACVtgAAwLYAAPm2AADgAAAAAAAAAAAAAAAAzgAAAAAAAAAA AAAAAM4AAAAAAAAAAAAAAADJAAAAAAAAAAAAAAAAxAAAAAAAAAAAAAAAAL8AAAAAAAAAAAAA AAC2AAAAAAAAAAAAAAAAtgAAAAAAAAAAAAAAALYAAAAAAAAAAAAAAAC2AAAAAAAAAAAAAAAA tgAAAAAAAAAAAAAAAK0AAAAAAAAAAAAAAACoAAAAAAAAAAAAAAAAowAAAAAAAAAAAAAAAKgA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAR+AGdkcU6OAAAEIQBnZHFOjgAACH4AD4RWBV6E VgVnZB4ufAAACH4AD4RWBV6EVgVnZIx91QAABCEAZ2QDFYYAAAQAAGdkdBk2AAAEAwBnZNs1 lAASAAAKJgALRhUAD4SnBBGEc/4TpB0AXoSnBGCEc/5nZGpBZAAfAAADJAMNxigEGgOnBDQG wQcKNwJuBKUG3AgTC0oNgQ+4Ee8TJhYAAAAAAAAAAAAAE6R4AGEkA2dkHi58AAAPe7MAAJOz AACgswAAzLMAAM6zAADSswAA97MAAPyzAAB6tAAAe7QAAJq0AACetAAAs7QAANC0AAAPtQAA JLUAAHG1AABytQAAl7UAAFm2AABatgAAW7YAAFy2AACVtgAAubYAALq2AADAtgAA5rYAAPzz /O/m7+bv39fPxs++tb6qnZKKkoJ4gmeCWAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAcFWhxTo4AFmhxTo4AbUgABG5IAARzSAkEdEgMBAAhAAiBFmhxTo4AF2gIXoIA Y0gBAGRo8ZJDp25IDAR0SAwEEhZocU6OAG1IAARuSAAEdEgMBAAOFmhxTo4AbkgMBHRIDAQA DhZoEFa3AG5IDAR0SAwEABQVaAMVhgAWaAMVhgBuSAwEdEgMBAAYFWgDFYYAFmgDFYYAbUgA BG5IAAR0SAwEABQVaHQZNgAWaHQZNgBtSAkEc0gJBAAQFWhKRuQAFmhKRuQAMEp9AAAOFmhK RuQAbUgJBHNICQQAEBVoSkbkABZodBk2ADBKfQAADhZodBk2AG1ICQRzSAkEAA4WaNs1lABt SAkEc0gJBAAMFWimHCcAFmjAGUcAABAVaNoRngAWaNoRngAwSn0AAAYWaNoRngAAEBVowBlH ABZowBlHADBKfQAABhZowBlHABvmtgAA57YAAPK2AADztgAA9rYAAPe2AAD4tgAA+bYAABm3 AABztwAAlLcAAJW3AACztwAA1rcAANe3AADZtwAA9rcAAFS4AADn2OfY59jMuJ6JaomeR564 ngAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA RQAIgRVo1BYUABZo1BYUABdoowqYADUIgUCI/v9DShIAT0oEAFFKBABhShgAY0gBAGRo5JJD p21IAARuSAAEc0gJBHUIATwACIEVaNQWFAAWaNQWFAAXaKMKmAA1CIFDShIAT0oEAFFKBABc CIFjSAEAZGjkkkOnbUgABG5IAAR1CAEAKRVo1BYUABZo1BYUADUIgUNKEgBPSgQAUUoEAFwI gW1IAARuSAAEdQgBMhVo1BYUABZo1BYUADUIgUCI/v9DShIAT0oEAFFKBABhShgAbUgABG5I AARzSAkEdQgBACYVaNQWFAAWaNQWFAA1CIFDShIAT0oEAFFKBABtSAAEbkgABHUIAQAWFmhx To4AbUgABG5IAARzSAkEdEgMBAAcFWhxTo4AFmhxTo4AbUgABG5IAARzSAkEdEgMBAAvAAiB FWhxTo4AFmhxTo4AF2ijCpgAY0gBAGRo5JJDp21IAARuSAAEc0gJBHRIDAQAEfm2AAAZtwAA L7cAAFe3AABxtwAAc7cAALO3AADZtwAA9rcAAAW4AAAguAAAWLgAAHm4AACfuAAA2rgAANy4 AADyuAAAE7kAACa5AABSuQAAcrkAAHW5AADgAAAAAAAAAAAAAAAAuQAAAAAAAAAAAAAAALkA AAAAAAAAAAAAAAC5AAAAAAAAAAAAAAAAuQAAAAAAAAAAAAAAAOAAAAAAAAAAAAAAAAC5AAAA AAAAAAAAAAAA4AAAAAAAAAAAAAAAALkAAAAAAAAAAAAAAAC5AAAAAAAAAAAAAAAAuQAAAAAA AAAAAAAAALkAAAAAAAAAAAAAAAC5AAAAAAAAAAAAAAAAuQAAAAAAAAAAAAAAALkAAAAAAAAA AAAAAADgAAAAAAAAAAAAAAAAuQAAAAAAAAAAAAAAALkAAAAAAAAAAAAAAAC5AAAAAAAAAAAA AAAAuQAAAAAAAAAAAAAAALkAAAAAAAAAAAAAAAAAAAAAAAAAAAAnAAADJAMNxh0DGgOnBDQG B3gFNgqUDPMOURGwEw8WAAAAAAAAAA+EeAUTpAAAKiQBNSQBNyQBOCQBOUQEAEgkAV6EeAVh JANnZNQWFAAfAAADJAMNxigEGgOnBDQGwQcKNwJuBKUG3AgTC0oNgQ+4Ee8TJhYAAAAAAAAA AAAAE6R4AGEkA2dk1BYUAAAVVLgAAFW4AADcuAAA8rgAAHW5AACDuQAA2rkAAAS6AAA6ugAA XLoAAF26AABgugAAYboAAJq6AACbugAAsroAALO6AADTugAA1LoAANa6AADsugAAb7sAAH27 AADUuwAA77sAAHG8AAB/vAAA17wAANi8AADfvAAA3MKtwpnCrcKZfJl8mXyZfJlfma3CmcKt wpnCV04AAAAAAAAAEBVoqjWjABZoqjWjADBKgAAADhZocU6OAG5IDAR0SAwEADkACIEVaNQW FAAWaNQWFAAXaAheggA1CIFDShIAT0oEAFFKBABjSAEAZGjtkkOnbUgABG5IAAR1CAE5AAiB FWjUFhQAFmjUFhQAF2ijCpgANQiBQ0oSAE9KBABRSgQAY0gBAGRo5JJDp21IAARuSAAEdQgB JhVo1BYUABZo1BYUADUIgUNKEgBPSgQAUUoEAG1IAARuSAAEdQgBACkVaNQWFAAWaNQWFAA1 CIFDShIAT0oEAFFKBABcCIFtSAAEbkgABHUIATIVaNQWFAAWaNQWFAA1CIFAiP7/Q0oSAE9K BABRSgQAYUoYAG1IAARuSAAEc0gJBHUIAQBFAAiBFWjUFhQAFmjUFhQAF2gIXoIANQiBQIj+ /0NKEgBPSgQAUUoEAGFKGABjSAEAZGjtkkOnbUgABG5IAARzSAkEdQgBAB11uQAAg7kAAJO5 AAC/uQAA2LkAANq5AAAEugAAOroAAGO6AAC1ugAA1roAAOy6AAANuwAAILsAAEy7AABsuwAA b7sAAH27AADgAAAAAAAAAAAAAAAAuQAAAAAAAAAAAAAAALkAAAAAAAAAAAAAAAC5AAAAAAAA AAAAAAAAuQAAAAAAAAAAAAAAAJoAAAAAAAAAAAAAAAC5AAAAAAAAAAAAAAAAmgAAAAAAAAAA AAAAAJoAAAAAAAAAAAAAAACaAAAAAAAAAAAAAAAAmgAAAAAAAAAAAAAAALkAAAAAAAAAAAAA AAC5AAAAAAAAAAAAAAAAuQAAAAAAAAAAAAAAALkAAAAAAAAAAAAAAAC5AAAAAAAAAAAAAAAA 4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB8AAAMkAw3GKAQaA6cENAbBBwo3Am4EpQbc CBMLSg2BD7gR7xMmFgAAAAAAAAAAAAATpHgAYSQDZ2TUFhQAJwAAAyQDDcYdAxoDpwQ0Bgd4 BTYKlAzzDlERsBMPFgAAAAAAAAAPhHgFE6QAACokATUkATckATgkATlEBABIJAFehHgFYSQD Z2TUFhQAHwAAAyQDDcYoBBoDpwQ0BsEHCjcCbgSlBtwIEwtKDYEPuBHvEyYWAAAAAAAAAAAA ABOkAABhJANnZNQWFAAAEX27AACNuwAAubsAANK7AADUuwAA77sAAA+8AAAivAAATrwAAG68 AABxvAAAf7wAAJC8AAC9vAAA1rwAANgAAAAAAAAAAAAAAADYAAAAAAAAAAAAAAAA2AAAAAAA AAAAAAAAANgAAAAAAAAAAAAAAAC5AAAAAAAAAAAAAAAA2AAAAAAAAAAAAAAAANgAAAAAAAAA AAAAAADYAAAAAAAAAAAAAAAA2AAAAAAAAAAAAAAAANgAAAAAAAAAAAAAAACaAAAAAAAAAAAA AAAA2AAAAAAAAAAAAAAAANgAAAAAAAAAAAAAAADYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA HwAAAyQDDcYoBBoDpwQ0BsEHCjcCbgSlBtwIEwtKDYEPuBHvEyYWAAAAAAAAAAAAABOkAABh JANnZNQWFAAfAAADJAMNxigEGgOnBDQGwQcKNwJuBKUG3AgTC0oNgQ+4Ee8TJhYAAAAAAAAA AAAAE6R4AGEkA2dk1BYUACcAAAMkAw3GHQMaA6cENAYHeAU2CpQM8w5REbATDxYAAAAAAAAA D4R4BROkAAAqJAE1JAE3JAE4JAE5RAQASCQBXoR4BWEkA2dk1BYUAAAO1rwAANi8AAD9vAAA y70AAES+AAB4vgAAlL4AAHi/AACcvwAAvr8AAPm/AAA/wAAAQcAAAHXAAACQwAAAN8MAANgA AAAAAAAAAAAAAADGAAAAAAAAAAAAAAAAxgAAAAAAAAAAAAAAAMYAAAAAAAAAAAAAAAC0AAAA AAAAAAAAAAAArwAAAAAAAAAAAAAAAKoAAAAAAAAAAAAAAAClAAAAAAAAAAAAAAAAoAAAAAAA AAAAAAAAAJsAAAAAAAAAAAAAAACbAAAAAAAAAAAAAAAAlgAAAAAAAAAAAAAAAJEAAAAAAAAA AAAAAACMAAAAAAAAAAAAAAAAhwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAGdkRWp5AAAE AgBnZNs1lAAABCEAZ2RFankAAAR+AGdkHi58AAAEfgBnZEVqeQAABCEAZ2QDFYYAAAQhAGdk Hi58AAAEAABnZKo1owAABAMAZ2TbNZQAEgAACiYAC0YWAA+EpwQRhHP+E6RWAF6EpwRghHP+ Z2QeLnwAEgAACiYAC0YWAA+EpwQRhHP+E6RWAF6EpwRghHP+Z2RqQWQAJwAAAyQDDcYdAxoD pwQ0Bgd4BTYKlAzzDlERsBMPFgAAAAAAAAAPhHgFE6QAACokATUkATckATgkATlEBABIJAFe hHgFYSQDZ2QeLnwAAA/fvAAA+bwAAPu8AAD9vAAAE70AAMu9AADivQAA7L0AAEO+AABEvgAA Ub4AAFm+AAB3vgAAeL4AAJS+AACYvgAAqr4AAOC+AADhvgAA8b4AAAO/AAApvwAAML8AAGO/ AABrvwAAd78AAHi/AAC+vwAAPsAAAD/AAABBwAAAbsAAAG/AAAD47/jv+Oni3vjU4t7Jwbmv uaeflZ+Vn5Wfin1yanJ9VAAAAAArAAiBFWgDFYYAFmgDFYYAF2ijCpgAY0gBAGRo5ZJDp21I AARuSAAEdEgMBA4WaBBWtwBuSAwEdEgMBAAUFWgDFYYAFmgDFYYAbkgMBHRIDAQAGBVoAxWG ABZoAxWGAG1IAARuSAAEdEgMBAAUFWiqNaMAFmiqNaMAbUgJBHNICQQAExVoHi58ABZoRWp5 ADBKfQBcCIEOFmhFankAbUgJBHNICQQADhZowF9HAG1ICQRzSAkEABMVaB4ufAAWaKo1owAw Sn0AXAiBDhZoqjWjAG1ICQRzSAkEAA4WaNs1lABtSAkEc0gJBAAUFWgeLnwAFmgDFYYAbUgJ BHNICQQAEhZoqjWjADBKfQBtSAkIc0gJCAAGFmiqNaMAAAwVaKo1owAWaKo1owAAChZoqjWj ADBKfQAAEBVoqjWjABZoqjWjADBKfQAADhZoqjWjAG5IDAR0SAwEIG/AAABywAAAc8AAAHTA AAB1wAAAkMAAAAvBAADrwgAA+sIAAArDAAAcwwAAMMMAADbDAAA3wwAATsMAAHLDAADWwwAA 68MAAO3DAAACxAAABMQAABTEAAAWxAAAK8QAAGTEAABzxAAAjcQAAI7EAACYxAAAnMQAAN3E AADexAAA9MQAABDFAAAYxQAA893z0MjAuLCnsKewnMiUsKewp7CnsKewp7CJgciBdshsXQAA AAAAAAAAAAAAABwVaOhy6AAWaAMVhgBtSAwEbkgMBHNIDAR0SAwEABIWaAMVhgBtSAAEbkgA BHRIDAQAFBVo6HLoABZo6HLoAG1ICQRzSAkEAA4WaOhy6ABtSAkEc0gJBAAUFWgAO38AFmgA O38AbUgJBHNICQQADhZoADt/AG1ICQRzSAkEABQVaEVqeQAWaEVqeQBtSAkEc0gJBAAQFWgA CL8AFmgACL8AMEp9AAAOFmgACL8AbUgJBHNICQQADhZoDhoWAG1ICQRzSAkEAA4WaEVqeQBt SAkEc0gJBAAOFmjbNZQAbUgJBHNICQQAGBVoRWp5ABZoAxWGAG1IAARuSAAEdEgMBAArAAiB FWgDFYYAFmgDFYYAF2ijCpgAY0gBAGRo5ZJDp21IAARuSAAEdEgMBBgVaAMVhgAWaAMVhgBt SAAEbkgABHRIDAQiN8MAAE7DAACOxAAAnMQAAN7EAAD0xAAAEMUAACbFAABSxQAAfcUAAJPF AACVxQAArcUAACXGAADkxgAATscAAI7HAACdxwAApcgAALzIAADZyAAA8MgAAPoAAAAAAAAA AAAAAAD1AAAAAAAAAAAAAAAA8AAAAAAAAAAAAAAAAOsAAAAAAAAAAAAAAAD6AAAAAAAAAAAA AAAA5gAAAAAAAAAAAAAAAOEAAAAAAAAAAAAAAADhAAAAAAAAAAAAAAAA4QAAAAAAAAAAAAAA AOEAAAAAAAAAAAAAAADcAAAAAAAAAAAAAAAA1wAAAAAAAAAAAAAAAMUAAAAAAAAAAAAAAADF AAAAAAAAAAAAAAAAxQAAAAAAAAAAAAAAAMUAAAAAAAAAAAAAAADwAAAAAAAAAAAAAAAA6wAA AAAAAAAAAAAAAMAAAAAAAAAAAAAAAAC7AAAAAAAAAAAAAAAAtgAAAAAAAAAAAAAAAAAAAAAE fgBnZMMEegAABCEAZ2TDBHoAAAQCAGdkHi58ABIAAAomAAtGFwAPhKcEEYRz/hOkVgBehKcE YIRz/mdkakFkAAAEIQBnZB4ufAAABH4AZ2QeLnwAAAR+AGdkAxWGAAAEIQBnZAMVhgAABAAA Z2TocugAAAQBAGdk2zWUAAAEAABnZAA7fwAABAIAZ2TbNZQAABUYxQAAGsUAADbFAAA3xQAA UsUAAGPFAABkxQAAhMUAAIbFAACNxQAAjsUAAJLFAACTxQAAlcUAAK3FAAC0xQAA48UAAOXF AAAOxgAAEMYAACXGAAA0xgAAqsYAAK3GAAC3xgAAxMYAAMXGAADexgAA8eLW4svAy7jLpMuc y5WLuIK4griLuHdtYlZOAAAAAAAAAAAAAAAAAAAAAAAOFmgPPRQAbkgMBHRIDAQAFwNqAAAA ABZoDz0UAFUIAW5IDAR0SAwEFBVoDz0UABZoDz0UAG5IDAR0SAwEABMVaB4ufAAWaA89FAAw Sn0AXAiBFBVoDz0UABZo6HLoAG5IDAR0SAwEABAVaOhy6AAWaOhy6AAwSn0AABMVaB4ufAAW aOhy6AAwSn0AXAiBDBVoHi58ABZoAxWGAAAOFmgQVrcAbkgMBHRIDAQAJwAIgRVo6HLoABZo AxWGABdoCF6CAGNIAQBkaPGSQ6duSAwEdEgMBA4WaOhy6ABuSAwEdEgMBAAUFWjocugAFmjo cugAbkgMBHRIDAQAFBVo6HLoABZoAxWGAG5IDAR0SAwEABYWaOhy6ABtSAwEbkgMBHNIDAR0 SAwEABwVaOhy6AAWaAMVhgBtSAwEbkgMBHNIDAR0SAwEABwVaOhy6AAWaOhy6ABtSAwEbkgM BHNIDAR0SAwEG97GAADfxgAA4MYAAOHGAADixgAA48YAAOTGAAD0xgAA9cYAAATHAAAPxwAA H8cAACDHAAAkxwAALMcAAC3HAABGxwAAR8cAAEjHAABLxwAATMcAAE3HAABOxwAAVMcAAFXH AACNxwAAjscAAJnHAACcxwAAnccAAEfIAACkyAAA8OTc5NHGvLayqLKknZaOsoOOf46dpLy2 pHhwaGBwWAAAAAAAAAAAAAAAAAAAAAAADhZoZCRUAG1ICQRzSAkEAA4WaNs1lABtSAkEc0gJ BAAOFmjDBHoAbUgJBHNICQQADhZo6HLoAG1ICQRzSAkEAAwVaOhy6AAWaOhy6AAABhZoL0bk AAAVAgiBA2ooEAAABggBFmgPPRQAVQgBDwNqAAAAABZoDz0UAFUIAQwVaA89FAAWaA89FAAA DBVoDz0UABZo6HLoAAAGFmjocugAABMVaB4ufAAWaA89FAAwSn0AXAiBBhZoDz0UAAAKFmjo cugAMEp9AAATFWgeLnwAFmjocugAMEp9AFwIgRQVaA89FAAWaOhy6ABuSAwEdEgMBAAUFWgP PRQAFmgPPRQAbkgMBHRIDAQADhZoL0bkAG5IDAR0SAwEABcDagAAAAAWaA89FABVCAFuSAwE dEgMBB0CCIEDaqsPAAAGCAEWaA89FABVCAFuSAwEdEgMBAAfpMgAAKXIAAC7yAAAvMgAANnI AADhyAAA5MgAAAXJAAAGyQAAN8kAADjJAAByyQAAc8kAAHbJAAB3yQAAeMkAAHnJAACAyQAA gckAAKXJAACvyQAAsckAALnJAADJyQAA4skAAOTJAADoyQAA+MkAAA/KAAAjygAAPcoAAEvK AABYygAAZsoAAGfKAACAygAAgcoAAILKAACDygAAhMoAAPXt4tXKwsrCysLKrsqmyp6Uwo2J lImUiZSJlImUiYV7hXOFaHNkcwAGFmgvRuQAABUCCIEDaqUQAAAGCAEWaA89FABVCAEPA2oA AAAAFmgPPRQAVQgBExVoHi58ABZoDz0UADBKfQBcCIEGFmgPPRQAAAYWaGQkVAAADBVoZCRU ABZoZCRUAAATFWgeLnwAFmhkJFQAMEp9AFwIgQ4WaAMVhgBuSAwEdEgMBAAOFmgQVrcAbkgM BHRIDAQAJwAIgRVoAxWGABZoAxWGABdoCF6CAGNIAQBkaPCSQ6duSAwEdEgMBA4WaGQkVABu SAwEdEgMBAAUFWgDFYYAFmgDFYYAbkgMBHRIDAQAGBVoAxWGABZoAxWGAG1IAARuSAAEdEgM BAAUFWgeLnwAFmjDBHoAbUgJBHNICQQADhZowwR6AG1ICQRzSAkEABQVaOhy6AAWaOhy6ABt SAkEc0gJBCfwyAAAHMkAACHJAABQyQAAd8kAAHnJAAAPygAAh8oAANjKAADrygAAZ8sAAILL AACjywAAucsAAO/LAAAPzAAAQcwAAHrMAAClzAAA18wAAPnMAAAuzQAAMM0AAGLNAAB3zQAA +gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoA AAAAAAAAAAAAAADoAAAAAAAAAAAAAAAA6AAAAAAAAAAAAAAAAOgAAAAAAAAAAAAAAADjAAAA AAAAAAAAAAAA3gAAAAAAAAAAAAAAANkAAAAAAAAAAAAAAADUAAAAAAAAAAAAAAAA+gAAAAAA AAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAA AAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAA AAAAzwAAAAAAAAAAAAAAANQAAAAAAAAAAAAAAADPAAAAAAAAAAAAAAAAAAAABH4AZ2QeLnwA AAQhAGdkwwR6AAAEAgBnZMMEegAABAAAZ2RkJFQAAAQBAGdk2zWUABIAAAomAAtGGAAPhKcE EYRz/hOkVgBehKcEYIRz/mdkakFkAAAEfgBnZMMEegAAGITKAACGygAAh8oAAJfKAADXygAA 2MoAAOvKAABmywAAZ8sAAILLAACjywAAq8sAAK3LAADIywAAycsAAP7LAAD/ywAAHMwAAB3M AABRzAAAUswAAIvMAACMzAAAr8wAALHMAADbzAAA3swAAAXNAAAGzQAALc0AAC7NAAAwzQAA Ys0AAHfNAACXzQAAmM0AALrNAADLzQAAzM0AAPzNAAAwzgAAR84AAG3OAAD8+O7459/XzMS3 rKSspKykrKSspKykrKSspKykrJyst6y3hrescqy3rLcAAAAAAAAAAAAAAAAAACcACIEVaMME egAWaMMEegAXaKMKmABjSAEAZGjlkkOnbkgMBHRIDAQrAAiBFWjDBHoAFmjDBHoAF2ijCpgA Y0gBAGRo5ZJDp21IAARuSAAEdEgMBA4WaBBWtwBuSAwEdEgMBAAOFmhkJFQAbkgMBHRIDAQA FBVowwR6ABZowwR6AG5IDAR0SAwEABgVaMMEegAWaMMEegBtSAAEbkgABHRIDAQADhZowwR6 AG1ICQRzSAkEABQVaGQkVAAWaGQkVABtSAkEc0gJBAAOFmhkJFQAbUgJBHNICQQADhZo2zWU AG1ICQRzSAkEAAwVaGQkVAAWaGQkVAAAExVoHi58ABZoZCRUADBKfQBcCIEGFmhkJFQAAAYW aA89FAAqd80AALrNAADRzQAA/M0AADDOAABHzgAAbs4AAKnOAADlzgAAHc8AADbPAACKzwAA pM8AANLPAADwzwAAIdAAAD7QAABm0AAAadAAAHfQAACG0AAAsdAAAPoAAAAAAAAAAAAAAAD1 AAAAAAAAAAAAAAAA7AAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAADnAAAAAAAAAAAAAAAA+gAA AAAAAAAAAAAAAOIAAAAAAAAAAAAAAADZAAAAAAAAAAAAAAAA4gAAAAAAAAAAAAAAANQAAAAA AAAAAAAAAADPAAAAAAAAAAAAAAAAygAAAAAAAAAAAAAAAMUAAAAAAAAAAAAAAADFAAAAAAAA AAAAAAAAxQAAAAAAAAAAAAAAAMUAAAAAAAAAAAAAAADFAAAAAAAAAAAAAAAAxQAAAAAAAAAA AAAAALwAAAAAAAAAAAAAAADFAAAAAAAAAAAAAAAAxQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAIfgAPhAAAXoQAAGdkbVdnAAAEfgBnZG1XZwAABCEAZ2RtV2cAAAQAAGdk1TViAAAE fgBnZCUIKgAACH4AD4QAAF6EAABnZCUIKgAABCEAZ2QlCCoAAAR+AGdkHi58AAAIfgAPhAAA XoQAAGdkHi58AAAEfgBnZMMEegAABCEAZ2TDBHoAABVtzgAAbs4AAKnOAACszgAA5c4AAB3P AAAezwAAH88AAC/PAAAwzwAAM88AADTPAAA1zwAANs8AAGLPAABvzwAAis8AAKTPAABo0AAA adAAAN3QAADe0AAA39AAAALRAAD26d7Qw7WdtZ21nbWSh36HcWZeZlNIQQAAAAAAAAAAAAAA DBVoJQUuABZoJQUuAAAUFWh8aV8AFmhtV2cAbkgMBHRIDAQAFBVofGlfABZo1TViAG5IDAR0 SAwEAA4WaG1XZwBuSAwEdEgMBAAUFWhxTo4AFmhtV2cAbkgMBHRIDAQAGBVocU6OABZobVdn AG1IAARuSAAEdEgMBAAQFWjVNWIAFmjVNWIAMEp9AAAVFmjVNWIAbUgABG5IAAR0SAwEdQgB FRZoZ3nKAG1IAARuSAAEdEgMBHUIAS4ACIEVaCUIKgAWaGd5ygAXaKMKmABjSAEAZGjlkkOn bUgABG5IAAR0SAwEdQgBABsVaCUIKgAWaGd5ygBtSAAEbkgABHRIDAR1CAEYFWglCCoAFmhn ecoAbUgABG5IAAR0SAwEABsVaGd5ygAWaGd5ygBtSAAEbkgABHRIDAR1CAEVFmglCCoAbUgA BG5IAAR0SAwEdQgBGBVoZ3nKABZoZ3nKAG1IAARuSAAEdEgMBAASFmjDBHoAbUgABG5IAAR0 SAwEF7HQAADF0AAA3dAAAN/QAAAE0QAAF9EAACrRAAA90QAAT9EAAFXRAAB60QAAkdEAALbR AADI0QAA79EAAPHRAAAZ0gAAW9IAAG7SAACU0gAAq9IAANDSAADi0gAACdMAAAvTAAAy0wAA dNMAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPAAAAAAAAAAAAAA AAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA +gAAAAAAAAAAAAAAAOsAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoA AAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAOsAAAAAAAAAAAAAAADmAAAA AAAAAAAAAAAA5gAAAAAAAAAAAAAAAOsAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAA AAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAOsAAAAAAAAA AAAAAADmAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABH4AZ2RWSZUAAAQhAGdkbVdnAAAE IQBnZCUFLgAABH4AZ2TVNWIAAAR+AGdkbVdnAAAaAtEAAAPRAABN0QAATtEAAE/RAABS0QAA U9EAAFTRAABV0QAAZdEAAHrRAACQ0QAAy9EAAO3RAADx0QAA/NEAAP3RAAAA0gAAF9IAABjS AAAZ0gAAWtIAAFvSAABt0gAAbtIAAH7SAAB/0gAAgNIAAJTSAACq0gAA5dIAAAfTAAAL0wAA FtMAABfTAAAa0wAAMdMAADLTAABz0wAAdNMAAHjTAACE0wAAhtMAAIfTAACX0wAAmNMAAK3T AADD0wAA/tMAACDUAAAk1AAAL9QAADDUAAAz1AAAStQAAO/r5Ovk1OTQzMW4qLiozMWkxZSQ iZCJkMzFpMW4qLiozMWkxZCJkImQiZDMpMW4qLiozMWkxQwVaFZJlQAWaFZJlQAABhZoVkmV AAAfAAiBFWglBS4AFmhtV2cAF2ijCpgAY0gBAGRo5ZJDpwYWaA1G3wAAHxVoJQUuABZobVdn AENKFQBhShUAbUgABG5IAAR1CAEZFmhCD5QAQ0oVAGFKFQBtSAAEbkgABHUIAQwVaCUFLgAW aG1XZwAABhZoQg+UAAAGFmglBS4AAB8ACIEVaCUFLgAWaCUFLgAXaAheggBjSAEAZGjukkOn DBVoJQUuABZoJQUuAAAGFmhtV2cAAB8ACIEVaCUFLgAWaCUFLgAXaKMKmABjSAEAZGjlkkOn ADZ00wAAh9MAAK3TAADE0wAA6dMAAPvTAAAi1AAAJNQAAEzUAACN1AAAodQAAMfUAADe1AAA A9UAABXVAAA81QAAPtUAAGXVAACm1QAAutUAAOXVAABb1gAA1NYAAF3XAADk1wAA+gAAAAAA AAAAAAAAAPUAAAAAAAAAAAAAAADwAAAAAAAAAAAAAAAA8AAAAAAAAAAAAAAAAPAAAAAAAAAA AAAAAADwAAAAAAAAAAAAAAAA8AAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD6AAAAAAAAAAAA AAAA+gAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAADwAAAAAAAAAAAAAAAA8AAAAAAAAAAAAAAA APAAAAAAAAAAAAAAAADwAAAAAAAAAAAAAAAA8AAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD6 AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAOsAAAAAAAAAAAAAAADZAAAAAAAAAAAAAAAAzwAA AAAAAAAAAAAAAM8AAAAAAAAAAAAAAADPAAAAAAAAAAAAAAAAAAAKAAAKJgALRhoAE6RWAGdk akFkABIAAAomAAtGGQAPhKcEEYRz/hOkVgBehKcEYIRz/mdkakFkAAAEIQBnZGd5ygAABH4A Z2RtV2cAAAQhAGdkbVdnAAAEfgBnZFZJlQAAGErUAABL1AAATNQAAHvUAACe1AAAoNQAAKHU AACx1AAAstQAALPUAADH1AAA3dQAABjVAAA61QAAPtUAAEnVAABK1QAATdUAAGTVAABl1QAA lNUAALfVAAC51QAAutUAAOXVAADs1QAABtYAABfWAABe1gAAbNYAAKjWAACt1gAA0NYAANLW AADX1gAA5dYAADHXAAA21wAAWdcAAFvXAABg1wAAbtcAAODXAADi1wAADdgAAA/YAAAR2AAA H9gAAPjYAAAG2QAAB9kAAA/ZAADv6+Tr5Ovg2dXZyLjIuODZ1dnr5Ovk67Gnn6efp5+Wn6ef p5+Wn6efp5+nn6efp5+njIUAAAAAAAAADBVoBkP9ABZoBkP9AAASFmgGQ/0AMEp9AG1ICQhz SAkIABAVaAZD/QAWaAZD/QAwSn0AAA4WaAZD/QBuSAwEdEgMBAATFWgeLnwAFmgGQ/0AMEp9 AFwIgQwVaGd5ygAWaGd5ygAAHxVoJQUuABZobVdnAENKFQBhShUAbUgABG5IAAR1CAEZFmhC D5QAQ0oVAGFKFQBtSAAEbkgABHUIAQYWaA1G3wAADBVoJQUuABZobVdnAAAGFmhCD5QAAAwV aFZJlQAWaFZJlQAABhZoVkmVAAAfAAiBFWglBS4AFmhtV2cAF2ijCpgAY0gBAGRo5ZJDpwAz 5NcAABHYAAD42AAAetkAANbZAADR2gAANtsAADrcAABF3QAAc90AALrdAADR3QAAid4AAK7f AABx4AAAdOEAAKDiAACc4wAAteMAAGrlAADL5QAAYeYAAPUAAAAAAAAAAAAAAADjAAAAAAAA AAAAAAAA4wAAAAAAAAAAAAAAAOMAAAAAAAAAAAAAAADjAAAAAAAAAAAAAAAA4wAAAAAAAAAA AAAAAN4AAAAAAAAAAAAAAADjAAAAAAAAAAAAAAAA4wAAAAAAAAAAAAAAAOMAAAAAAAAAAAAA AADZAAAAAAAAAAAAAAAA1AAAAAAAAAAAAAAAANQAAAAAAAAAAAAAAADUAAAAAAAAAAAAAAAA 1AAAAAAAAAAAAAAAANQAAAAAAAAAAAAAAADUAAAAAAAAAAAAAAAAzwAAAAAAAAAAAAAAAMoA AAAAAAAAAAAAAADKAAAAAAAAAAAAAAAAugAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAACiYA C0YbAA+EpwQRhHP+XoSnBGCEc/5nZB4ufAAABAAAZ2TdbtIAAAQCAGdk2zWUAAAEAABnZMh+ vQAABAIAZ2SzT+cAAAQcAGdkcjpPABIAAAomAAtGGQAPhKcEEYRz/hOkVgBehKcEYIRz/mdk akFkAAoAAAomAAtGGgATpFYAZ2RqQWQAABUP2QAAKtkAAC7ZAAA22QAAN9kAAFDZAABR2QAA UtkAAFXZAABW2QAAWNkAAHrZAACG2QAAh9kAAJHZAAC62QAA1dkAANbZAADl2QAA5tkAAPDZ AACx2gAAutoAAL/aAADQ2gAA0doAAOHaAADi2gAA6NoAAA3bAAAU2wAAFdsAAC7bAAAv2wAA MNsAADPbAAA02wAANtsAAD/bAABA2wAAa9sAAKjbAAC/2wAA0NsAAPDbAAD12wAA+tsAAPz1 8enx3una6fX80Ma//Lv8saegu7G7nLuxp6C7mJCYhZDakH6xp6C7sbt6dnoAAAYWaHI6TwAA BhZoyH69AAAMFWh+TMwAFmhbRUUAABUCCIEDap8RAAAGCAEWaH5MzABVCAEPA2oAAAAAFmh+ TMwAVQgBBhZofkzMAAAGFmikE0IAAAwVaFtFRQAWaFtFRQAAEhZoW0VFADBKfQBtSAkIc0gJ CAATFWgeLnwAFmhbRUUAMEp9AFwIgQYWaFtFRQAADBVoBkP9ABZoBkP9AAASFmgGQ/0AMEp9 AG1ICQhzSAkIABMVaB4ufAAWaAZD/QAwSn0AXAiBBhZoL0bkAAAVAgiBA2oiEQAABggBFmgL BKwAVQgBDwNqAAAAABZoCwSsAFUIAQYWaAsErAAADBVoCwSsABZoBkP9AAAGFmgGQ/0ALvrb AAD92wAAOdwAADrcAADG3AAAydwAANHcAADS3AAA69wAAOzcAADt3AAA8dwAAPLcAADz3AAA Ft0AABndAAAh3QAAIt0AADvdAAA83QAAPd0AAEHdAABC3QAAQ90AAETdAABF3QAASN0AAEnd AABR3QAAc90AAH7dAAB/3QAAut0AANHdAADw3QAAC94AACveAAAw3gAA4d4AAOTeAADl3gAA 7d4AAP/eAAD17fXp4t7W3svWx9bi6eLe1t681sfW4um4rqSd6a6knZaOho6Gjn52bHYAABMV aB4ufAAWaElcSgAwSn0AXAiBDhZoSVxKAG1ICQRzSAkEAA4WaH5MzABtSAkEc0gJBAAOFmhn ecoAbUgJBHNICQQADhZoyH69AG1ICQRzSAkEAAwVaLNP5wAWaNs1lAAADBVoyH69ABZoyH69 AAASFmjIfr0AMEp9AG1ICQhzSAkIABMVaB4ufAAWaMh+vQAwSn0AXAiBBhZoW0VFAAAVAgiB A2qZEgAABggBFmh+TMwAVQgBBhZoL0bkAAAVAgiBA2ocEgAABggBFmh+TMwAVQgBDwNqAAAA ABZofkzMAFUIAQYWaH5MzAAADBVofkzMABZoyH69AAAGFmjIfr0AAA4WaHI6TwBtSAkEc0gJ BAAUFWhNHBAAFmhyOk8AbUgJBHNICQQq/94AAA/fAAAf3wAAJ98AAK3fAACu3wAAtd8AALrf AADV3wAA9d8AAA/gAABb4AAAXuAAAF/gAABk4AAAcOAAAK3gAADZ4AAA4eAAAPPgAAAD4QAA c+EAAJPhAACc4QAA4OEAAObhAADy4QAADuIAAB3iAAAq4gAAbOIAAJfiAACf4gAAoOIAAPHi AAD+4gAAWuMAAG7jAABx4wAAg+MAAJTjAACb4wAA9e317eXt3dXt1e31y/Xtw7uyu6i7w8vD 7Z/tn+2Xw5ftj4WPfXR9an0AAAATFWgeLnwAFmglCCoAMEp9AFwIgRAVaCUIKgAWaCUIKgAw Sn0AAA4WaCUIKgBtSAkEc0gJBAATFWgeLnwAFmhnecoAMEp9AFwIgQ4WaGd5ygBtSAkEc0gJ BAAOFmh2CacAbUgJBHNICQQAEBVoSVxKABZoSVxKADBKfQAAExVoHi58ABZo3W7SADBKfQBc CIEQFWjdbtIAFmjdbtIAMEp9AAAOFmjdbtIAbUgJBHNICQQADhZopnGGAG1ICQRzSAkEABMV aB4ufAAWaKZxhgAwSn0AXAiBDhZofkzMAG1ICQRzSAkEAA4WaL9wtwBtSAkEc0gJBAAOFmjI fr0AbUgJBHNICQQADhZoSVxKAG1ICQRzSAkEABMVaB4ufAAWaElcSgAwSn0AXAiBACmb4wAA nOMAALXjAABf5AAAfeQAALXkAADC5AAAPOUAAD/lAABR5QAAYuUAAGnlAABq5QAAeuUAAIPl AABM5gAAVeYAAGXmAABx5gAAeeYAAInmAADY5gAA4eYAAOzmAADt5gAA/uYAAALnAAAN5wAA KucAADPnAAA05wAAPucAAE3nAAAT6AAAFOgAABXoAAAn6AAA9e3l3eXT5crl0+XC5dPl0+W4 sLiwuLCl7bC4sJqP3YR8sHBkAAAAAAAAAAAAAAAAAAAAABcVaDd7rAAWaJRXkQA1CIFtSAkE c0gJBBcVaDd7rAAWaDd7rAA1CIFtSAkEc0gJBA4WaJRXkQBtSAkEc0gJBAAUFWh+TMwAFmiU V5EAbUgJBHNICQQAFBVofkzMABZoo1OuAG1ICQRzSAkEABQVaH5MzAAWaP901ABtSAkEc0gJ BAAUFWjdbtIAFmglCCoAbUgJBHNICQQADhZo/3TUAG1ICQRzSAkEABMVaB4ufAAWaP901AAw Sn0AXAiBDhZo3W7SAG1ICQRzSAkEABAVaCUIKgAWaCUIKgAwSn0AABMVaB4ufAAWaCUIKgAw Sn0AXAiBDhZofkzMAG1ICQRzSAkEAA4WaCUIKgBtSAkEc0gJBAAOFmjbNZQAbUgJBHNICQQA FBVoyH69ABZoZ3nKAG1ICQRzSAkEJGHmAADt5gAA/uYAABToAABK6AAAnugAAEfpAABg6QAA f+kAAJTpAADH6QAA8ekAABzqAABG6gAAa+oAAJzqAAC+6gAAwOoAAPnqAAAv6wAAP+wAAO8A AAAAAAAAAAAAAADqAAAAAAAAAAAAAAAA5QAAAAAAAAAAAAAAANMAAAAAAAAAAAAAAADTAAAA AAAAAAAAAAAA0wAAAAAAAAAAAAAAAM4AAAAAAAAAAAAAAADJAAAAAAAAAAAAAAAAxAAAAAAA AAAAAAAAAMQAAAAAAAAAAAAAAADEAAAAAAAAAAAAAAAAxAAAAAAAAAAAAAAAAMQAAAAAAAAA AAAAAADEAAAAAAAAAAAAAAAAxAAAAAAAAAAAAAAAAMQAAAAAAAAAAAAAAADEAAAAAAAAAAAA AAAAvwAAAAAAAAAAAAAAAK0AAAAAAAAAAAAAAACtAAAAAAAAAAAAAAAAAAASAAAKJgALRhwA D4SnBBGEc/4TpFYAXoSnBGCEc/5nZGpBZAAABCEAZ2TjXpwAAAR+AGdk416cAAAEIQBnZB4u fAAABAIAZ2TbNZQAEgAACiYAC0YeAA+EpwQRhHP+E6RWAF6EpwRghHP+Z2RqQWQAAAQAAGdk /3TUAAAEAQBnZNs1lAAQAAAKJgALRhsAD4SnBBGEc/5ehKcEYIRz/mdkHi58AAAUJ+gAAEno AABK6AAAYOgAAJ3oAACe6AAAs+gAAEbpAABH6QAAT+kAAGDpAABk6QAAfukAAH/pAACU6QAA pekAAMXpAAD+6QAAAuoAACDqAAAs6gAAOuoAADvqAABG6gAAUeoAAF3qAAB76gAAkOoAAJHq AACt6gAAwOoAAPnqAAAA6wAA+PDk+PDk+NnRycW+t7OooKiYkImCib5+enZ+dm+zZVwAAAAA AAAAAAAAAAAAAAAAAAAAABAVaONenAAWaONenAAwSn0AABIWaONenABtSAAEbkgABHNICQQA DBVo416cABZo416cAAAGFmijUp0AAAYWaK8f9gAABhZoD19vAAAMFWgeLnwAFmgPX28AAAwV aB4ufAAWaK8f9gAADhZorx/2AG1IDARzSAwEAA4WaA9fbwBtSAwEc0gMBAAOFmglBS4AbUgM BHNIDAQAFBVo416cABZo416cAG1IDARzSAwEAAYWaONenAAADBVoHi58ABZoo1OuAAAMFWge LnwAFmjjXpwAAAYWaHxpXwAADhZo2zWUAG1ICQRzSAkEAA4WaHxpXwBtSAkEc0gJBAAUFWj/ dNQAFmg3e6wAbUgJBHNICQQAFxVoN3usABZoN3usADUIgW1ICQRzSAkEDhZolFeRAG1ICQRz SAkEAA4WaDd7rABtSAkEc0gJBCAA6wAAEusAACvrAAAt6wAALusAAC/rAABA6wAAQusAAD/s AABQ7AAAUuwAAJDsAACc7AAAnewAAKzsAAC77QAAv+0AAMDtAADE7QAAWe4AAGXuAAB07gAA I+8AACTvAAA17wAAOu8AAG3vAABu7wAAh+8AALvvAACC8AAAlPAAAJ7wAAC08AAAm/EAAJzx AACp8QAAq/EAAMrxAADR8QAAAPIAAALyAAAE8gAACfIAAC7yAAAv8gAA2vIAAPjw5/D44drW zNrWwsza1sLM2tbn1r7WtK2+raWhmpahlqG+oZKOhb6Fvn97d3sAAAAABhZoIhebAAAGFmg3 e6wAAAoWaCIXmwAwSn0AABAVaNomowAWaNomowAwSn0AAAYWaCdjIAAABhZofCQkAAAGFmh5 TPYAAAwVaA9fbwAWaONenAAABhZo416cAAAOFmjbNZQAbUgJBHNICQQADBVo2iajABZo2iaj AAASFmjaJqMAMEp9AG1ICQhzSAkIAAYWaNomowAAExVoHi58ABZoD19vADBKfQBcCIESFmgP X28AMEp9AG1ICQhzSAkIAAYWaA9fbwAADBVoD19vABZoD19vAAAKFmgPX28AMEp9AAAQFWgP X28AFmgPX28AMEp9AAAOFmgPX28AbUgJBHNICQQADhZo416cAG1ICQRzSAkELj/sAACQ7AAA u+0AACTvAABu7wAAh+8AAKbvAAC77wAA0u8AAArwAAA28AAAZ/AAAILwAAC+8AAAwPAAAN7w AAD48AAAFPEAABbxAAA18QAAYvEAAJHxAACp8QAAq/EAAMrxAADtAAAAAAAAAAAAAAAA7QAA AAAAAAAAAAAAAO0AAAAAAAAAAAAAAADtAAAAAAAAAAAAAAAA6AAAAAAAAAAAAAAAAOMAAAAA AAAAAAAAAADeAAAAAAAAAAAAAAAA3gAAAAAAAAAAAAAAAN4AAAAAAAAAAAAAAADeAAAAAAAA AAAAAAAA3gAAAAAAAAAAAAAAAN4AAAAAAAAAAAAAAADeAAAAAAAAAAAAAAAA3gAAAAAAAAAA AAAAAOMAAAAAAAAAAAAAAADeAAAAAAAAAAAAAAAA3gAAAAAAAAAAAAAAAN4AAAAAAAAAAAAA AADjAAAAAAAAAAAAAAAA3gAAAAAAAAAAAAAAAN4AAAAAAAAAAAAAAADeAAAAAAAAAAAAAAAA 3gAAAAAAAAAAAAAAANkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQhAGdk J2MgAAAEfgBnZONenAAABCEAZ2TjXpwAAAQCAGdk2zWUABIAAAomAAtGHAAPhKcEEYRz/hOk VgBehKcEYIRz/mdkakFkAAAYyvEAAATyAAAv8gAAgfIAANPyAAAk8wAAJfQAAGH1AACZ9QAA bvYAAFj4AABa+AAAtPgAAPH4AAAn+QAAQPkAAF35AADK+gAA5/sAAAf8AAAu/gAAZf8AAO0A AAAAAAAAAAAAAADtAAAAAAAAAAAAAAAA4wAAAAAAAAAAAAAAAOMAAAAAAAAAAAAAAADYAAAA AAAAAAAAAAAAzgAAAAAAAAAAAAAAAM4AAAAAAAAAAAAAAADOAAAAAAAAAAAAAAAA7QAAAAAA AAAAAAAAAMkAAAAAAAAAAAAAAADtAAAAAAAAAAAAAAAA7QAAAAAAAAAAAAAAAO0AAAAAAAAA AAAAAADtAAAAAAAAAAAAAAAAxAAAAAAAAAAAAAAAAL8AAAAAAAAAAAAAAAC6AAAAAAAAAAAA AAAAugAAAAAAAAAAAAAAAL8AAAAAAAAAAAAAAAC1AAAAAAAAAAAAAAAAtQAAAAAAAAAAAAAA AAAABAAAZ2SafFEAAAQAAGdkdytPAAAEAwBnZHcrTwAABAIAZ2R3K08AAAQcAGdkcjpPAAoA AAomAAtGIAATpFYAZ2RqQWQAAAoAAA+EpwQTpFYAXoSnBGdkvRS9AAoAAAomAAtGHwATpFYA Z2RqQWQAEgAACiYAC0YdAA+EpwQRhHP+E6RWAF6EpwRghHP+Z2RqQWQAABXa8gAA3vIAAAPz AAAj8wAAJPMAADnzAADd8wAA5fMAAObzAADv8wAA8fMAAAH0AAAG9AAAFvQAACX0AAA59AAA OvQAAFn0AABt9AAAfvQAAJL0AABg9QAAYfUAAGn1AABq9QAAmPUAAJn1AACp9QAAs/UAAG72 AAB69gAAg/YAAM32AADZ9gAA4fYAAPj2AAD89gAAA/cAACb3AAAn9wAAK/cAADj3AAA69wAA S/cAAGr3AABr9wAAb/cAAHf3AAD38+/z5u/d79nv5u/m7+bv1czVw9Xv5u+/77myrqSyrpuu m66brqSUipSG2YZ/2QAAAAAAAAAAAAAAAAAAAAwVaH5MzAAWaDYpQQAABhZoNilBAAASFmg2 KUEAMEp9AG1ICQhzSAkIAAwVaDYpQQAWaDYpQQAAEBVo2iajABZo2iajADBKfQAAEhZo2iaj ADBKfQBtSAkIc0gJCAAGFmjaJqMAAAwVaNomowAWaNomowAAChZo2iajADBKfQAABhZoJ2Mg AAAQFWhASH0AFmhASH0AMEqAAAAQFWhASH0AFmhASH0AMEp9AAAGFmhASH0AAAYWaH5MzAAA EBVofkzMABZovRS9ADBKfQAAEBVovRS9ABZovRS9ADBKfQAABhZovRS9AAAGFmg3e6wAABAV aDd7rAAWaDd7rAAwSn0AL3f3AAB49wAAkfcAAJL3AACT9wAAl/cAAJj3AACZ9wAAsfcAALX3 AAC99wAAvvcAANf3AADY9wAA2fcAAN33AADe9wAA3/cAAA74AAAT+AAAF/gAABj4AAAb+AAA V/gAAFj4AABZ+AAAWvgAAG34AAB3+AAAtPgAAMP4AADw+AAA8fgAAP/4AAAl+QAAJvkAACf5 AAA/+QAAXfkAAHL5AACh+QAAs/kAAMH5AADQ+QAAH/oAAFn6AABi+gAA9/Po9+T33dnd8/fz zvfk993Zytm/tKy02aiel9mel9mel5PZjJOIk3+Tf5OIdgAAEBVomnxRABZomnxRADBKfQAA EBVodytPABZodytPADBKfQAABhZomnxRAAAMFWh3K08AFmh3K08AAAYWaHcrTwAADBVoNilB ABZoNilBAAASFmg2KUEAMEp9AG1ICQhzSAkIAAYWaNomowAADhZocjpPAG1ICQRzSAkEABQV aE0cEAAWaHI6TwBtSAkEc0gJBAAUFWhyOk8AFmhyOk8AbUgJBHNICQQABhZocjpPAAAVAgiB A2qTEwAABggBFmh+TMwAVQgBBhZoNilBAAAMFWh+TMwAFmg2KUEAAAYWaC9G5AAAFQIIgQNq FhMAAAYIARZofkzMAFUIAQYWaH5MzAAADwNqAAAAABZofkzMAFUIAQAuYvoAAHD6AAB/+gAA hfoAAI76AACu+gAAvvoAAMn6AADK+gAA1voAAPX6AAD9+gAAD/sAAB37AAAs+wAASPsAAGj7 AACu+wAAtvsAAL/7AADI+wAA1vsAAOX7AADm+wAA5/sAAO37AADu+wAAB/wAAFD8AABZ/AAA Z/wAAHb8AACd/AAApfwAAMv8AADd/AAA6/wAAPr8AABZ/QAAcP0AAHX9AACO/QAAl/0AAKX9 AAC0/QAA4/0AAPP9AAD8/QAABf4AAB3+AAAs/gAALf4AAC7+AABh/gAAc/4AAIH+AACQ/gAA Pf8AAEb/AABU/wAAY/8AAGT/AABl/wAAhf8AAKb/AACz/wAAAgABAPzz/On86fzl/OH88/zz /OH84fzY/PP80eX85fzz/Nj84c3EzcTN4c3hu+G74bvhu+G74fzhu+G74bvhu+G05bCssAAA AAAAAAAAAAAGFmh8FGoAAAYWaHlzjwAADBVomnxRABZoQRE7AAAQFWhBETsAFmhBETsAMEp9 AAAQFWiCGRoAFmiCGRoAMEp9AAAGFmiCGRoAAAwVaHcrTwAWaJp8UQAAEBVoQRE7ABZomnxR ADBKfQAABhZoQRE7AAAGFmh3K08AABMVaB4ufAAWaJp8UQAwSn0AXAiBEBVomnxRABZomnxR ADBKfQAABhZomnxRAEJl/wAAhf8AAKgCAQDAAgEA3gIBAO4CAQASAwEAQAMBAF8DAQCQAwEA kgMBAL8DAQDaAwEA7QMBAA0EAQAvBAEAewQBAKAEAQDMBAEAEgUBAIQFAQCQBQEAngUBAK8F AQCXBgEA+gAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAADwAAAAAAAAAAAAAAAA6wAAAAAAAAAA AAAAAOsAAAAAAAAAAAAAAADrAAAAAAAAAAAAAAAA8AAAAAAAAAAAAAAAAOsAAAAAAAAAAAAA AADrAAAAAAAAAAAAAAAA6wAAAAAAAAAAAAAAAPAAAAAAAAAAAAAAAADwAAAAAAAAAAAAAAAA 6wAAAAAAAAAAAAAAAPAAAAAAAAAAAAAAAADrAAAAAAAAAAAAAAAA5gAAAAAAAAAAAAAAAOEA AAAAAAAAAAAAAADwAAAAAAAAAAAAAAAA8AAAAAAAAAAAAAAAANwAAAAAAAAAAAAAAADUAAAA AAAAAAAAAAAA1AAAAAAAAAAAAAAAANQAAAAAAAAAAAAAAADPAAAAAAAAAAAAAAAAAAAABAAA Z2SzT+cACAAACiYAC0YiAGdkakFkAAAEAABnZHAi1gAABH4AZ2QlBS4AAAQhAGdkJQUuAAAE fgBnZIJR3QAABCEAZ2SCUd0AAAQAAGdkghkaAAAEAwBnZHcrTwAAGAIAAQASAAEAEwABABwA AQA7AAEASwABAIIAAQCHAAEAjwABAJoAAQDjAAEA5wABAO8AAQD6AAEA+wABAAgBAQAQAQEA IwEBADMBAQBhAQEAbAEBAIYBAQDIAQEA4AEBAO0BAQAAAgEACAIBADkCAQBBAgEAXgIBAGMC AQB1AgEAfwIBAKcCAQCoAgEAwAIBAN4CAQALAwEAEgMBABYDAQBAAwEAWQMBAF0DAQBfAwEA kgMBAPfz7/Pm8/fz9/P38+bz3/Pb0tvS2/Pb0tvS29Lb0tvS287Eua6mnMSUjKZ9AAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAcFWiCUd0AFmiCUd0AbUgMBG5IDARzSAwEdEgMBAAOFmjf LcsAbkgMBHRIDAQADhZoJQUuAG5IDAR0SAwEABIWaHxpXwBtSAAEbkgABHRIDAQADhZoglHd AG5IDAR0SAwEABQVaCIXmwAWaIJR3QBuSAwEdEgMBAAUFWiCUd0AFmiCUd0AbkgMBHRIDAQA EhZoglHdAG1IAARuSAAEdEgMBAAGFmiCGRoAABAVaIJR3QAWaIJR3QAwSn0AAAYWaIJR3QAA DBVoglHdABZofBRqAAAQFWiCUd0AFmh8FGoAMEp9AAAGFmh5c48AAAYWaHwUagAAEBVofBRq ABZofBRqADBKfQAskgMBANoDAQDtAwEADQQBABEEAQAsBAEALQQBAC4EAQAvBAEAewQBAIME AQCVBAEAoAQBAMwEAQASBQEAgwUBAIQFAQCeBQEAogUBAKMFAQCuBQEArwUBAMUFAQDmBQEA 8eLx18y4zLChlo6WgXdvZ15YUl5Mb0QAAAAAAAAAAAAAAAAAAAAAAA4WaOszAwBuSAwEdEgM BAAKFmizT+cAMEp9AAAKFmh8aV8AMEp9AAAKFmh5TPYAMEp9AAAQFWizT+cAFmizT+cAMEp9 AAAOFmhwItYAbkgMBHRIDAQADhZos0/nAG5IDAR0SAwEABIWaIJR3QBtSAAEbkgABHRIDAQA GBVoIhebABZoglHdAG1IAARuSAAEdEgMBAAOFmjrPOgAbkgMBHRIDAQAFBVoJQUuABZoJQUu AG5IDAR0SAwEABwVaCUFLgAWaCUFLgBtSAAEbkgABHNIDAR0SAwEAA4WaIJR3QBuSAwEdEgM BAAnAAiBFWiCUd0AFmiCUd0AF2gIXoIAY0gBAGRo7pJDp25IDAR0SAwEFBVoglHdABZoglHd AG5IDAR0SAwEABQVaCIXmwAWaIJR3QBuSAwEdEgMBAAcFWiCUd0AFmiCUd0AbUgMBG5IDARz SAwEdEgMBAAcFWiCUd0AFmiCUd0AbUgABG5IAARzSAwEdEgMBBfmBQEA6gUBAOsFAQD2BQEA AAYBAAYGAQAHBgEAIAYBACEGAQAiBgEAJgYBACcGAQAoBgEAPwcBAE4HAQCRBwEAnAcBAJ0H AQCyBwEAugcBAL8HAQDKBwEA+wcBAAYIAQAtCAEAOAgBAMEIAQDECAEAxQgBAPUIAQD6CAEA NQkBAEUJAQBNCQEA9/Ho4NjM2L3MtczY4Kzgo+Cb4PGj4KPgk3xyaXxpfGl8AAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQFWgwTAsAFmgwTAsAMEp9AAATFWge LnwAFmgwTAsAMEp9AFwIgSwWaDBMCwA1CIFAiP7/Q0oSAE9KBABRSgQAYUoYAG1IAARuSAAE c0gJBHUIAQAOFmjbNZQAbUgJBHNICQQADhZoMEwLAG5IDAR0SAwEABAVaDBMCwAWaOszAwAw Sn0AABAVaOszAwAWaOszAwAwSn0AAA4WaC9G5ABuSAwEdEgMBAAdAgiBA2oQFAAABggBFmio V58AVQgBbkgMBHRIDAQXA2oAAAAAFmioV58AVQgBbkgMBHRIDAQOFmioV58AbkgMBHRIDAQA DhZo6zMDAG5IDAR0SAwEABAVaKhXnwAWaOszAwAwSn0AAAoWaHxpXwAwSn0AABAVaKhXnwAW aHlM9gAwSn0AIZcGAQBQBwEALQgBADgIAQCeCAEAzQgBAAMJAQCaCQEACQoBAGkKAQB/CgEA +gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA1gAAAAAAAAAAAAAAAKsA AAAAAAAAAAAAAACrAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAKsAAAAAAAAAAAAAAACrAAAA AAAAAAAAAAAA1gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKgAA AyQDCiYAC0YMAA3GKAQaA6cENAbBBwo3Am4EpQbcCBMLSg2BD7gR7xMmFgAAAAAAAAAAAAAP hEgCEYQd/xOkeABehEgCYIQd/2EkA2dkQVLMAAAqAAADJAMKJgALRgwADcYoBBoDpwQ0BsEH CjcCbgSlBtwIEwtKDYEPuBHvEyYWAAAAAAAAAAAAAA+ESAIRhB3/E6R4AF6ESAJghB3/YSQD Z2SEAWgAHwAAAyQDDcYoBBoDpwQ0BsEHCjcCbgSlBtwIEwtKDYEPuBHvEyYWAAAAAAAAAAAA ABOkeABhJANnZOs86AAABAEAZ2TbNZQAAAQAAGdks0/nAAAKTQkBAHIJAQCACQEAmQkBAJoJ AQCeCQEA3wkBAOgJAQAICgEACQoBAFgKAQBhCgEAaQoBABcLAQAYCwEAGgsBACgLAQCZCwEA mgsBALQLAQDp4OnJ6bKpsumyqbKPbI9Wjz80AAAAAAAVFmibKFgAbUgABG5IAARzSAkEdQgB LBZo6zzoADUIgUCI/v9DShIAT0oEAFFKBABhShgAbUgABG5IAARzSAkEdQgBACoVaOs86AAW aOs86AA1CIFDShIAT0oEAFFKBABtSAAEbkgABHNICQR1CAEARQAIgRVo6zzoABZo6zzoABdo CF6CADUIgUCI/v9DShIAT0oEAFFKBABhShgAY0gBAGRo7pJDp21IAARuSAAEc0gJBHUIATIV aOs86AAWaOs86AA1CIFAiP7/Q0oSAE9KBABRSgQAYUoYAG1IAARuSAAEc0gJBHUIAQAQFWib KFgAFmibKFgAMEp9AAAsFmibKFgANQiBQIj+/0NKEgBPSgQAUUoEAGFKGABtSAAEbkgABHNI CQR1CAEALBZoMEwLADUIgUCI/v9DShIAT0oEAFFKBABhShgAbUgABG5IAARzSAkEdQgBABAV aIQBaAAWaIQBaAAwSn0AACwWaIQBaAA1CIFAiP7/Q0oSAE9KBABRSgQAYUoYAG1IAARuSAAE c0gJBHUIARN/CgEAoAoBALMKAQDcCgEA+woBABoLAQAoCwEANQsBAF4LAQCHCwEAmgsBALQL AQCIDAEA8g0BABsOAQDYAAAAAAAAAAAAAAAA2AAAAAAAAAAAAAAAANgAAAAAAAAAAAAAAADY AAAAAAAAAAAAAAAA2AAAAAAAAAAAAAAAALkAAAAAAAAAAAAAAADYAAAAAAAAAAAAAAAA2AAA AAAAAAAAAAAAANgAAAAAAAAAAAAAAADYAAAAAAAAAAAAAAAAtAAAAAAAAAAAAAAAAJ0AAAAA AAAAAAAAAACGAAAAAAAAAAAAAAAAhgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAABYAAAomAAtGJgANxgoEGgOnBDQGwQcAD4RIAhGEHf9ehEgCYIQd/2dkmyhYAAAW AAAKJgALRiYADcYKBBoDpwQ0BsEHAA+ESAIRhB3/XoRIAmCEHf9nZEFSzAAABAAAZ2SbKFgA HwAAAyQDDcYoBBoDpwQ0BsEHCjcCbgSlBtwIEwtKDYEPuBHvEyYWAAAAAAAAAAAAABOkAABh JANnZOs86AAnAAADJAMNxh0DGgOnBDQGB3gFNgqUDPMOURGwEw8WAAAAAAAAAA+EeAUTpAAA KiQBNSQBNyQBOCQBOUQEAEgkAV6EeAVhJANnZOs86AAADrQLAQD4CwEAFAwBACYMAQAyDAEA TgwBAIcMAQCIDAEAlwwBAKUMAQC6DAEAxgwBANcMAQBoDQEAdg0BAMgNAQDWDQEA8Q0BAPIN AQAODgEAEg4BABoOAQAbDgEANQ4BAJ0OAQCrDgEA6A4BAOkOAQD/DgEAAA8BAEcPAQBSDwEA 9O7q5urm9ODu5urm3NPc09zPycDJuaOJo4lvZ1tRwAAAABIWaKILGwBtSAAEbkgABHRIDAQA FhZowwR6AG1IDARuSAwEc0gMBHRIDAQADhZo9i4dAG5IDAR0SAwEADIVaKILGwAWaMMEegA1 CIFAiP7/Q0oSAE9KBABRSgQAYUoYAG1IAARuSAAEc0gJBHUIAQAyFWjrPOgAFmjrPOgANQiB QIj+/0NKEgBPSgQAUUoEAGFKGABtSAAEbkgABHNICQR1CAEAKhVo6zzoABZo6zzoADUIgUNK EgBPSgQAUUoEAG1IAARuSAAEc0gJBHUIAQAMFWgxB1MAFmiiCxsAABAVaKILGwAWaKILGwAw Sn0AAAoWaKILGwAwSnkAAAYWaJsoWAAAEBVoQVLMABZoQVLMADBKfQAABhZoQVLMAAAKFmgN WscAMEp5AAAGFmgNWscAAAYWaDEHUwAAChZoMQdTADBKeQAAFRZoMQdTAG1IAARuSAAEc0gJ BHUIAQAfGw4BADUOAQBiDgEAfA4BAJ0OAQCrDgEAyQ4BAOEOAQDpDgEA/w4BAAAPAQBaDwEA 4AAAAAAAAAAAAAAAALkAAAAAAAAAAAAAAAC5AAAAAAAAAAAAAAAAuQAAAAAAAAAAAAAAAJoA AAAAAAAAAAAAAAC5AAAAAAAAAAAAAAAAuQAAAAAAAAAAAAAAAHMAAAAAAAAAAAAAAABuAAAA AAAAAAAAAAAAaQAAAAAAAAAAAAAAAGQAAAAAAAAAAAAAAAAAAAAAAAAAAAAABCEAZ2TDBHoA AAR+AGdkwwR6AAAEAgBnZPYuHQAnAAADJAMNxh0DGgOnBDQGB3gFNgqUDPMOURGwEw8WAAAA AAAAAA+EeAUTpAAAKiQBNSQBNyQBOCQBOUQEAEgkAV6EeAVhJANnZKILGwAfAAADJAMNxigE GgOnBDQGwQcKNwJuBKUG3AgTC0oNgQ+4Ee8TJhYAAAAAAAAAAAAAE6QAAGEkA2dk6zzoACcA AAMkAw3GHQMaA6cENAYHeAU2CpQM8w5REbATDxYAAAAAAAAAD4R4BROkAAAqJAE1JAE3JAE4 JAE5RAQASCQBXoR4BWEkA2dk6zzoAB8AAAMkAw3GKAQaA6cENAbBBwo3Am4EpQbcCBMLSg2B D7gR7xMmFgAAAAAAAAAAAAATpHgAYSQDZ2TrPOgAAAtSDwEAWg8BAHcPAQB4DwEAeQ8BAKYP AQCnDwEAzw8BANAPAQAPEAEAEBABABIQAQApEAEAKhABAH4QAQCCEAEAjBABAI8QAQCuEAEA CREBABoRAQCiEQEA0REBAN8RAQD0EQEAEBIBADESAQBIEgEAUBIBAGISAQByEgEA4hIBAOMS AQACEwEAAxMBAPbp3srett7K3srerqaelo2WhZaNlp6Fnn11fWx9bH1h6d4AAAAAAAAAAAAA AAAAAAAAAAAAABQVaDE1igAWaL9wtwBuSAwEdEgMBAAQFWjdbtIAFmi/cLcAMEp9AAAOFmgl PUEAbUgJBHNICQQADhZov3C3AG1ICQRzSAkEAA4WaCU9QQBuSAwEdEgMBAAQFWgxNYoAFmgx NYoAMEp9AAAOFmgxNYoAbkgMBHRIDAQADhZoogsbAG5IDAR0SAwEAA4WaMMEegBuSAwEdEgM BAAOFmj2Lh0AbkgMBHRIDAQAJwAIgRVowwR6ABZowwR6ABdoCF6CAGNIAQBkaO6SQ6duSAwE dEgMBCcACIEVaMMEegAWaMMEegAXaKMKmABjSAEAZGjlkkOnbkgMBHRIDAQUFWjDBHoAFmjD BHoAbkgMBHRIDAQAGBVowwR6ABZowwR6AG1IAARuSAAEdEgMBAASFmiiCxsAbUgABG5IAAR0 SAwEIloPAQB3DwEAqQ8BAOYPAQASEAEAKhABAOMSAQACEwEANxMBAFYTAQBXEwEAlhMBAMIT AQDYEwEAehQBALIUAQDeFAEA+xQBAC0VAQBDFQEAVRUBAGYVAQD6AAAAAAAAAAAAAAAA9QAA AAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA8AAAAAAAAAAAAAAAAOsAAAAA AAAAAAAAAAD6AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAOYAAAAAAAAAAAAAAAD1AAAAAAAA AAAAAAAA4QAAAAAAAAAAAAAAANwAAAAAAAAAAAAAAADwAAAAAAAAAAAAAAAA1wAAAAAAAAAA AAAAAMAAAAAAAAAAAAAAAADAAAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPUAAAAAAAAAAAAA AADmAAAAAAAAAAAAAAAA5gAAAAAAAAAAAAAAALsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAR+AGdk9i4dAAAWAAAKJgALRicADcYKBBoDpwQ0BsEHAA+EygIRhJv+XoTKAmCEm/5nZDE1 igAABAAAZ2QxNYoAAAR+AGdk6zzoAAAEIQBnZOs86AAABCEAZ2T2Lh0AAAQAAGdkogsbAAAE AgBnZPYuHQAABH4AZ2TDBHoAAAQhAGdkwwR6AAAVAxMBAAQTAQA2EwEANxMBAFYTAQBXEwEA fxMBAIATAQCWEwEAvxMBAMATAQDBEwEAwhMBANgTAQDcEwEA5xMBACUUAQAsFAEAPBQBAEAU AQDdFAEA3hQBAPsUAQD8FAEA/RQBACoVAQArFQEALBUBAC0VAQBVFQEAgRUBAOvg2Mu8r5mv 4Ovg2JGJgol5iXmJbq/g6+Ba4NjLTwAAAAAUFWjDBHoAFmj2Lh0AbkgMBHRIDAQAJwAIgRVo wwR6ABZowwR6ABdoCF6CAGNIAQBkaO6SQ6duSAwEdEgMBBQVaDE1igAWaDE1igBuSAwEdEgM BAAQFWgxNYoAFmgxNYoAMEp9AAAMFWgxNYoAFmgxNYoAAA4WaDE1igBuSAwEdEgMBAAOFmj2 Lh0AbkgMBHRIDAQAKwAIgRVowwR6ABZowwR6ABdoowqYAGNIAQBkaOaSQ6dtSAAEbkgABHRI DAQYFWjDBHoAFmjDBHoAbUgABG5IAAR0SAwEABwVaPYuHQAWaPYuHQBtSAkIbkgMBHNICQh0 SAwEABgVaMMEegAWaPYuHQBtSAAEbkgABHRIDAQADhZowwR6AG5IDAR0SAwEABQVaMMEegAW aMMEegBuSAwEdEgMBAAnAAiBFWjDBHoAFmjDBHoAF2ijCpgAY0gBAGRo5pJDp25IDAR0SAwE AB6BFQEAghUBAIUVAQCrFQEArBUBAMIVAQDrFQEA7BUBAO0VAQDuFQEACRYBAC8WAQBTFgEA XBYBAGwWAQB2FgEAGhcBABsXAQA9FwEAPhcBAD8XAQB2FwEAdxcBAHgXAQB5FwEAmBcBAOvg 073Tsp6ylo6GfnV+dX5q07JWslaylkkAAAAAAAAAAAAAAAAAAAAAABgVaMMEegAWaPYuHQBt SAAEbkgABHRIDAQAJwAIgRVowwR6ABZowwR6ABdoowqYAGNIAQBkaOaSQ6duSAwEdEgMBBQV aDE1igAWaDE1igBuSAwEdEgMBAAQFWhLbAQAFmhLbAQAMEp9AAAOFmhLbAQAbkgMBHRIDAQA DhZoMTWKAG5IDAR0SAwEAA4WaPYuHQBuSAwEdEgMBAAOFmjDBHoAbkgMBHRIDAQAJwAIgRVo wwR6ABZowwR6ABdoCF6CAGNIAQBkaO6SQ6duSAwEdEgMBBQVaMMEegAWaMMEegBuSAwEdEgM BAArAAiBFWjDBHoAFmjDBHoAF2ijCpgAY0gBAGRo5pJDp21IAARuSAAEdEgMBBgVaMMEegAW aMMEegBtSAAEbkgABHRIDAQAFBVowwR6ABZo9i4dAG5IDAR0SAwEACcACIEVaMMEegAWaPYu HQAXaAheggBjSAEAZGjukkOnbkgMBHRIDAQAGWYVAQCEFQEAhRUBAMIVAQDuFQEACRYBABsX AQA9FwEAeRcBAJkXAQDbFwEABxgBACIYAQCFGAEAqBgBAOMYAQA3GQEAaRkBAGoZAQBrGQEA gRkBAPoAAAAAAAAAAAAAAADxAAAAAAAAAAAAAAAA7AAAAAAAAAAAAAAAAOcAAAAAAAAAAAAA AADiAAAAAAAAAAAAAAAA3QAAAAAAAAAAAAAAANgAAAAAAAAAAAAAAADTAAAAAAAAAAAAAAAA zgAAAAAAAAAAAAAAAOwAAAAAAAAAAAAAAADTAAAAAAAAAAAAAAAA4gAAAAAAAAAAAAAAAMkA AAAAAAAAAAAAAADEAAAAAAAAAAAAAAAAvwAAAAAAAAAAAAAAAOwAAAAAAAAAAAAAAADnAAAA AAAAAAAAAAAAvwAAAAAAAAAAAAAAALoAAAAAAAAAAAAAAAC0AAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAZ7AAckAWdkCiJgAAAEAABnZMMEegAABH4AZ2TEV3wAAAQhAGdkxFd8AAAE AABnZEtsBAAABCEAZ2T2Lh0AAAR+AGdkwwR6AAAEIQBnZMMEegAABAAAZ2QxNYoAAAQCAGdk 9i4dAAAEfgBnZOs86AAABCEAZ2TrPOgAAAh+AA+EAABehAAAZ2T2Lh0AAAR+AGdk9i4dAAAU mBcBAJkXAQDEFwEAxRcBANsXAQAEGAEABRgBAAYYAQAHGAEAIhgBAIQYAQCFGAEAiBgBAKcY AQCoGAEAqRgBAKoYAQDjGAEA9hgBADcZAQA/GQEAZRkBAGkZAQBqGQEA8+bQ5sWxxamhmY6K hoKGdYZpWk9HT0MAAAAAAAAAAAAAAAAAAAAGFmjrPOgAAA4WaOs86ABuSAwEdEgMBAAUFWgl BS4AFmjrPOgAbkgMBHRIDAQAHBVoJQUuABZo6zzoAG1IAARuSAAEc0gMBHRIDAQAFhZo6zzo AG1IAARuSAAEc0gMBHRIDAQAGQAIgRZoIhebABdoowqYAGNIAQBkaOaSQ6cGFmjDBHoAAAYW aCIXmwAABhZoqFefAAAUFWhLbAQAFmhLbAQAbkgMBHRIDAQADhZoS2wEAG5IDAR0SAwEAA4W aPYuHQBuSAwEdEgMBAAOFmjDBHoAbkgMBHRIDAQAJwAIgRVowwR6ABZowwR6ABdoowqYAGNI AQBkaOaSQ6duSAwEdEgMBBQVaMMEegAWaMMEegBuSAwEdEgMBAArAAiBFWjDBHoAFmjDBHoA F2ijCpgAY0gBAGRo5pJDp21IAARuSAAEdEgMBBgVaMMEegAWaMMEegBtSAAEbkgABHRIDAQA GBVo9i4dABZo9i4dAG1IAARuSAAEdEgMBBdqGQEAaxkBAIAZAQC6GQEA0xkBANUZAQDWGQEA 1xkBABoaAQBIGgEAXhoBAKAaAQAbHQEAIx0BACYdAQAoHQEAXR0BAF4dAQCAHQEAjh0BAJAd AQC9HQEA5x0BAPgdAQD5HQEALh4BAFEeAQBhHgEAYh4BAJkeAQC8HgEAzR4BAM4eAQADHwEA Jh8BADUfAQA3HwEAbR8BAKEfAQC0HwEAtR8BAOofAQAMIAEAJyABAPXt5d3l1c3BsqOWi5aB d5Zvi5aBlouWgZaLloGWi5aBlouWgZaLloGWi5YAAAAOFmhecUMAbkgMBHRIDAQAEhZoXnFD AG1IAARuSAAEdEgMBAASFmhtQywAbUgABG5IAAR0SAwEABQVaB4ufAAWaPdFFQBuSAwEdEgM BAAYFWgeLnwAFmj3RRUAbUgABG5IAAR0SAwEABwVaB4ufAAWaPdFFQBtSAAEbkgABHNICQR0 SAwEABwVaB4ufAAWaPdFFQBtSAwEbkgMBHNIDAR0SAwEABYWaPdFFQBtSAAEbkgABHNIDAR0 SAwEAA4WaHVX3QBtSAkEc0gJBAAOFmj3RRUAbUgJBHNICQQADhZoMSoKAG1ICQRzSAkEAA4W aAoiYABtSAkEc0gJBAAOFmjbNZQAbUgJBHNICQQAFBVowwR6ABZoIhebAG1ICQRzSAkEK4EZ AQDWGQEA1xkBABoaAQBIGgEAWBoBAF4aAQCgGgEA9RoBAC4bAQBGGwEAgBsBAMYbAQAIHAEA GRwBAE8cAQBlHAEAlxwBAK0cAQDVHAEA5hwBABsdAQBdHQEAgB0BAL0dAQDnHQEALh4BAPcA AAAAAAAAAAAAAAD3AAAAAAAAAAAAAAAA8gAAAAAAAAAAAAAAAOkAAAAAAAAAAAAAAADyAAAA AAAAAAAAAAAA8gAAAAAAAAAAAAAAAPIAAAAAAAAAAAAAAADkAAAAAAAAAAAAAAAA5AAAAAAA AAAAAAAAAOQAAAAAAAAAAAAAAADkAAAAAAAAAAAAAAAA5AAAAAAAAAAAAAAAAOQAAAAAAAAA AAAAAADkAAAAAAAAAAAAAAAA5AAAAAAAAAAAAAAAAOQAAAAAAAAAAAAAAADkAAAAAAAAAAAA AAAA5AAAAAAAAAAAAAAAAOQAAAAAAAAAAAAAAADkAAAAAAAAAAAAAAAA5AAAAAAAAAAAAAAA APIAAAAAAAAAAAAAAADkAAAAAAAAAAAAAAAA8gAAAAAAAAAAAAAAAOQAAAAAAAAAAAAAAADy AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEfgBnZB4ufAAACH4AD4QAAF6EAABnZB4ufAAABCEA Z2QeLnwAAAcAAAMkAWEkAWdkHi58AAAaLh4BAFEeAQCZHgEAvB4BAAMfAQAmHwEAbR8BAKEf AQDqHwEADCABACcgAQBUIAEAfSABAJ8gAQChIAEAwiABAOMgAQABIQEACyEBABshAQAvIQEA QSEBAFQhAQBrIQEAfyEBAIQhAQDHIQEAEiIBAGMiAQD6AAAAAAAAAAAAAAAA9QAAAAAAAAAA AAAAAPoAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPUAAAAAAAAAAAAA AAD6AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA +gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPUA AAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAA AAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAA AAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPUAAAAAAAAA AAAAAAD1AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEIQBnZB4ufAAABH4AZ2QeLnwAABwnIAEA MyABADQgAQB8IAEAgiABAJ8gAQChIAEAwiABAOMgAQABIQEAhCEBAI0hAQCRIQEAxyEBANYh AQDXIQEA2CEBABIiAQAjIgEAYiIBAGMiAQCxIgEA5CIBAAMjAQA8IwEAWyMBACEkAQDDJAEA xCQBAA8lAQATJQEAFCUBAF0lAQCtJQEA9er139DEuKmckYR6nIRwepyEnHBpnISchJyRYZFW YZGcAAAAFBVoHi58ABZobUMsAG5IDAR0SAwEAA4WaG1DLABuSAwEdEgMBAAMFWgeLnwAFmj3 RRUAABIWaG1DLABtSAAEbkgABHRIDAQAEhZoXnFDAG1IAARuSAAEdEgMBAAYFWgeLnwAFmht QywAbUgABG5IAAR0SAwEABQVaB4ufAAWaPdFFQBuSAwEdEgMBAAYFWgeLnwAFmj3RRUAbUgA BG5IAAR0SAwEABwVaHxpXwAWaPdFFQBtSAAEbkgABHNICQR0SAwEABYWaPdFFQBtSAAEbkgA BHNIDAR0SAwEABYWaPdFFQBtSAwEbkgMBHNIDAR0SAwEABwVaB4ufAAWaPdFFQBtSAwEbkgM BHNIDAR0SAwEABQVaHxpXwAWaG1DLABuSAwEdEgMBAAUFWh8aV8AFmh1V90AbkgMBHRIDAQA FBVofGlfABZo90UVAG5IDAR0SAwEIWMiAQCzIgEABSMBAF0jAQC1IwEABiQBACEkAQA2JAEA aiQBAJQkAQC/JAEA6iQBAA8lAQBBJQEAWyUBAF0lAQCOJQEArSUBAMglAQDNJQEABiYBAD8m AQBBJgEAcSYBAJQmAQC6JgEA9iYBABYnAQBDJwEA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAA AAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA 9QAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPUA AAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD1AAAA AAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA9QAAAAAA AAAAAAAAAPUAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPoAAAAAAAAA AAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD1AAAAAAAAAAAA AAAA9QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABH4AZ2QeLnwAAAQhAGdkHi58AAAcrSUBAEEm AQC6JgEAACcBAAEnAQAWJwEAFycBAEMnAQBsJwEAbScBAHAnAQBxJwEA0CcBANUnAQDXJwEA HygBACAoAQAmKAEAdCgBABApAQA+KQEAPykBAEIpAQBDKQEAbCkBAL0pAQDCKQEA4CkBAOYp AQAQKgEAMioBAEwqAQBhKwEAZisBAHErAQCOKwEADiwBADgsAQD16PXg9eD16Mroyuj14PW2 9ej16Mroyuj1rvWu9eiiloqWopZxAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAADEVaAheggAWaPdFFQBtSAwEbkgMBHNIDAR0SAwEicoHAQEA8JJDp4MqAW1ICQRzSAkE FhZoHFapAG1IDARuSAwEc0gMBHRIDAQAFhZo90UVAG1IDARuSAwEc0gMBHRIDAQAFhZo90UV AG1IAARuSAAEc0gMBHRIDAQADhZocXOSAG5IDAR0SAwEACcACIEVaB4ufAAWaPdFFQAXaAhe ggBjSAEAZGjwkkOnbkgMBHRIDAQrAAiBFWgeLnwAFmj3RRUAF2ijCpgAY0gBAGRo5pJDp21I AARuSAAEdEgMBA4WaG1DLABuSAwEdEgMBAAYFWgeLnwAFmj3RRUAbUgABG5IAAR0SAwEABQV aB4ufAAWaPdFFQBuSAwEdEgMBCVDJwEAcycBAK4nAQDQJwEA6CcBAO0nAQAkKAEAJigBAEso AQB0KAEAuCgBANwoAQAOKQEAECkBAEUpAQBsKQEAmSkBAL0pAQDhKQEADioBABAqAQAyKgEA TCoBAGEqAQB6KgEApSoBANoqAQALKwEAJisBAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA +gAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPUA AAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD1AAAA AAAAAAAAAAAA9QAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAA AAAAAAAAAPUAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPUAAAAAAAAA AAAAAAD1AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD1AAAAAAAAAAAA AAAA9QAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAA APUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAR+AGdkHi58AAAEIQBnZB4ufAAAHCYrAQBiKwEA bysBAHErAQCOKwEArysBAMIrAQDtKwEA8CsBAP4rAQAOLAEAOywBAD0sAQBbLAEAkiwBANEs AQATLQEATC0BAIQtAQC9LQEAwS0BAMMtAQASLgEAQS4BAGQuAQCRLgEAwy4BAOwuAQAvLwEA +gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPoA AAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAA AAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA9QAAAAAA AAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAA AAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAA AAAA9QAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAA APUAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABCEA Z2QeLnwAAAR+AGdkHi58AAAcOCwBADksAQA7LAEAPSwBAFssAQDBLQEAwy0BABIuAQAcLgEA HS4BAEEuAQBMLgEATS4BAGMuAQBpLgEAji4BAI8uAQCRLgEAwy4BAOwuAQAoLwEAKS8BACwv AQDdxLmsuaGSoYehe297b3tae057TjlOKQAIgRZo90UVABdoCF6CAGNIAQBkaO6SQ6dtSAAE bkgABHNIDAR0SAwEFhZo90UVAG1IAARuSAAEc0gMBHRIDAQAKQAIgRZo90UVABdoCF6CAGNI AQBkaO6SQ6dtSAwEbkgMBHNIDAR0SAwEFhZocXOSAG1IDARuSAwEc0gMBHRIDAQAFhZo90UV AG1IDARuSAwEc0gMBHRIDAQAFBVofGlfABZocXOSAG5IDAR0SAwEABwVaHxpXwAWaPdFFQBt SAAEbkgABHNICQR0SAwEABQVaHxpXwAWaPdFFQBuSAwEdEgMBAAYFWgeLnwAFmj3RRUAbUgA BG5IAAR0SAwEABQVaB4ufAAWaPdFFQBuSAwEdEgMBAAxFWgIXoIAFmj3RRUAbUgMBG5IDARz SAwEdEgMBInKBwEBAPCSQ6eDKgFtSAkEc0gJBEQACAEVaAheggAWaPdFFQAXaAheggBjSAEA ZGjwkkOnbUgMBG5IDARzSAwEdEgMBInKBwEBAPCSQ6eDKgFtSAkEc0gJBBYsLwEALS8BAFkv AQCALwEAri8BALkvAQC7LwEA0i8BANUvAQATMAEAHTABAB8wAQAgMAEAODABAKgwAQCzMAEA tDABALUwAQDMMAEACjEBABQxAQAWMQEAFzEBAC8xAQCfMQEAqjEBAKsxAQCsMQEAwzEBANkx AQD/MQEAATIBAAsyAQANMgEADjIBACYyAQCWMgEAoTIBAKIyAQCjMgEAujIBAPgyAQACMwEA BTMBAB0zAQCNMwEAszMBAPUzAQAbNAEAjzQBALU0AQD3NAEAHTUBAJE1AQDq3tLHurC6qMe6 nrC6x7qesLrHup6wuse6nrC6x5LHup6Iuse6noi6x7qIuse6x7rHuse6xwAAABIWaF5xQwBt SAAEbkgABHRIDAQAFxVoHi58ABZo90UVAFwIgW5IDAR0SAwEEhZocXOSAG1IAARuSAAEdEgM BAAOFmgOauQAbkgMBHRIDAQAEhZoDmrkAG1IAARuSAAEdEgMBAAYFWgeLnwAFmj3RRUAbUgA BG5IAAR0SAwEABQVaB4ufAAWaPdFFQBuSAwEdEgMBAAWFmj3RRUAbUgMBG5IDARzSAwEdEgM BAAWFmj3RRUAbUgABG5IAARzSAwEdEgMBAApAAiBFmj3RRUAF2gIXoIAY0gBAGRo7pJDp21I AARuSAAEc0gMBHRIDAQANS8vAQBZLwEAZi8BAHMvAQCALwEAjS8BAJ4vAQCuLwEA0i8BAOsv AQARMAEAEzABADgwAQCoMAEAzDABAOIwAQAIMQEACjEBAC8xAQCfMQEAwzEBANkxAQD/MQEA ATIBACYyAQCWMgEAujIBAPoAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAA APUAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD6 AAAAAAAAAAAAAAAA7AAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA+gAA AAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPUAAAAA AAAAAAAAAAD1AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD6AAAAAAAA AAAAAAAA9QAAAAAAAAAAAAAAAOMAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA+gAAAAAAAAAA AAAAAPUAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAAAAAAAAAAAAAACH4AD4RAC16EQAtnZB4u fAAACH4AD4QAAF6EAABnZB4ufAAABH4AZ2QeLnwAAAQhAGdkHi58AAAaujIBANAyAQD2MgEA +DIBAB0zAQCNMwEAszMBAM0zAQDzMwEA9TMBABs0AQCPNAEAtTQBAM80AQD1NAEA9zQBAB01 AQCRNQEAyzUBAB82AQBONgEAcjYBAK02AQCvNgEA0jYBABE3AQBQNwEAczcBAPoAAAAAAAAA AAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD6AAAAAAAAAAAA AAAA9QAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAA APUAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6 AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA9QAA AAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAA AAAAAAAAAAD6AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAOwAAAAAAAAAAAAAAAD1AAAAAAAA AAAAAAAA9QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIfgAPhAAAXoQAAGdkHi58AAAEIQBnZB4u fAAABH4AZ2QeLnwAABuRNQEAszUBALQ1AQDHNQEAyDUBANc1AQDYNQEA6jUBAOs1AQASNgEA EzYBABs2AQAcNgEAKTYBACo2AQA8NgEAPTYBAE42AQCvNgEAwzYBAMQ2AQDSNgEA1TYBANY2 AQDXNgEACjcBAAs3AQAONwEADzcBABE3AQAkNwEAJTcBADQ3AQA1NwEASTcBAEo3AQBNNwEA TjcBAGQ3AQBlNwEAczcBAHQ3AQB1NwEArDcBAK03AQCvNwEA+jcBAPs3AQD8NwEAOzgBADw4 AQA+OAEAczgBAPPd893z3fPd893z3fPd893z0vPI88DSrNKs0qzS88jz3fPd893zyPPSrNKY 0vPSmNKY0owAAAAAAAAAAAAAAAAAAAAAFhZo90UVAG1IAARuSAAEc0gMBHRIDAQAJwAIgRVo Hi58ABZo90UVABdoowqYAGNIAQBkaOiSQ6duSAwEdEgMBCcACIEVaB4ufAAWaPdFFQAXaKMK mABjSAEAZGjnkkOnbkgMBHRIDAQOFmiTL2wAbkgMBHRIDAQAEhZoky9sAG1IAARuSAAEdEgM BAAUFWgeLnwAFmj3RRUAbkgMBHRIDAQAKwAIgRVoHi58ABZo90UVABdoowqYAGNIAQBkaOeS Q6dtSAAEbkgABHRIDAQYFWgeLnwAFmj3RRUAbUgABG5IAAR0SAwENHM3AQCvNwEAzzcBAPo3 AQA+OAEAczgBAKI4AQDCOAEA4zgBAPU4AQAIOQEANDkBAFk5AQB8OQEAnDkBAJ85AQCtOQEA vjkBAM85AQD9OQEAEToBAC46AQBHOgEASToBAH86AQCWOgEAtjoBAMY6AQD6AAAAAAAAAAAA AAAA9QAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAA APoAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6 AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAA AAAAAAAAAAAAAPoAAAAAAAAAAAAAAADsAAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAA AAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAA AAAAAAAA+gAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA+gAAAAAAAAAA AAAAAPoAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH4AD4QAAF6EAABnZB4ufAAABCEAZ2QeLnwA AAR+AGdkHi58AAAbczgBAKI4AQDCOAEAWTkBAHw5AQD6OQEA+zkBAEg6AQBJOgEAeDoBAHk6 AQB8OgEAfToBAH86AQCWOgEAxjoBAPg6AQAPOwEATjwBAGY8AQDIPAEAyTwBAAI9AQADPQEA Bz0BACY9AQBhPQEAYj0BAGQ9AQB+PQEAoz0BAAw+AQBwPgEAcT4BAPTo9NnOus6yo4uji6N+ 9M5+zn7Oas5qzn7OVs5+zn7OVgAAACcACIEVaB4ufAAWaPdFFQAXaAheggBjSAEAZGjukkOn bkgMBHRIDAQnAAiBFWgeLnwAFmj3RRUAF2ijCpgAY0gBAGRo6JJDp25IDAR0SAwEGBVoHi58 ABZo90UVAG1IAARuSAAEdEgMBAAvAAiBFWh8aV8AFmjxREkAF2ijCpgAY0gBAGRo6JJDp21I AARuSAAEc0gJBHRIDAQcFWh8aV8AFmjxREkAbUgABG5IAARzSAkEdEgMBAAOFmj3RRUAbkgM BHRIDAQAJwAIgRVoHi58ABZo90UVABdoCF6CAGNIAQBkaPCSQ6duSAwEdEgMBBQVaB4ufAAW aPdFFQBuSAwEdEgMBAAcFWh8aV8AFmj3RRUAbUgMBG5IDARzSAwEdEgMBAAWFmj3RRUAbUgA BG5IAARzSAwEdEgMBAAWFmj3RRUAbUgMBG5IDARzSAwEdEgMBCHGOgEAyDoBANY6AQD2OgEA +DoBAA87AQAwOwEARTsBAFg7AQCEOwEAojsBALg7AQC7OwEAyTsBANk7AQDrOwEAFzwBADI8 AQBMPAEATjwBAGY8AQB6PAEAjjwBALc8AQAFPQEABz0BAPoAAAAAAAAAAAAAAADxAAAAAAAA AAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAADsAAAAAAAAAAAAAAAA+gAAAAAAAAAA AAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAA AAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPEAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA +gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoA AAAAAAAAAAAAAADsAAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAA AAAAAAAAAAAA2QAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAAAAAAAABN+AGdkowqYAG/GBwEB AOiSQ6dkJgEPhBAOEYQm+F6EEA5ghCb4AAQhAGdkHi58AAAIfgAPhAAAXoQAAGdkHi58AAAE fgBnZB4ufAAAGQc9AQAmPQEAZD0BAH49AQCKPQEAlj0BAKE9AQCjPQEAzj0BAO49AQAMPgEA OT4BAD4+AQB2PgEAkz4BAKo+AQDhPgEAAj8BAC4/AQAzPwEAYj8BAIs/AQCNPwEAqz8BANE/ AQD6PwEAIEABAFBAAQBSQAEA+gAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD6AAAAAAAAAAAA AAAA9QAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAA APoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD1 AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA9QAA AAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPUAAAAA AAAAAAAAAAD1AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD1AAAAAAAA AAAAAAAA9QAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA9QAAAAAAAAAA AAAAAAAAAAAAAAAAAAAABH4AZ2QeLnwAAAQhAGdkHi58AAAccT4BAHM+AQB0PgEAdj4BAJM+ AQBkPwEAZT8BAHo/AQB7PwEAhj8BAIc/AQCNPwEAqz8BANA/AQDUPwEAH0ABACNAAQBSQAEA iEABAKxAAQCOQQEAy0EBAAFCAQA2QgEAN0IBADhCAQBOQgEAT0IBAFJCAQBTQgEAVUIBAIRC AQDNQgEA6EIBAOlCAQDsQgEA7kIBAP1CAQD14fXU9cD1wPXA9dT1uPW49dSsoKygrKCLoIug i6CsoH9qf6CsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAApAAiBFmjbIC8AF2gIXoIAY0gBAGRo 8ZJDp21IDARuSAwEc0gMBHRIDAQWFmjbIC8AbUgMBG5IDARzSAwEdEgMBAApAAiBFmj3RRUA F2ijCpgAY0gBAGRo6JJDp21IDARuSAwEc0gMBHRIDAQWFmj3RRUAbUgMBG5IDARzSAwEdEgM BAAWFmj3RRUAbUgABG5IAARzSAwEdEgMBAAOFmiTL2wAbkgMBHRIDAQAJwAIgRVoHi58ABZo 90UVABdoowqYAGNIAQBkaOiSQ6duSAwEdEgMBBgVaB4ufAAWaPdFFQBtSAAEbkgABHRIDAQA JwAIgRVoHi58ABZo90UVABdoCF6CAGNIAQBkaO6SQ6duSAwEdEgMBBQVaB4ufAAWaPdFFQBu SAwEdEgMBCVSQAEAiEABAKxAAQDhQAEAIkEBAE9BAQCMQQEAjkEBAMtBAQABQgEANkIBAFVC AQCEQgEAt0IBAO5CAQAXQwEAMkMBAFpDAQCHQwEAiUMBAKlDAQDrQwEAC0QBADtEAQBkRAEA f0QBAKdEAQDURAEA1kQBAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAA APUAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD6 AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA+gAA AAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPUAAAAA AAAAAAAAAAD1AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD6AAAAAAAA AAAAAAAA9QAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAA AAAAAPUAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPUAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAR+AGdkHi58AAAEIQBnZB4ufAAAHP1CAQD+QgEAF0MBAGhDAQBpQwEA hEMBAIVDAQCJQwEAkEMBAJNDAQCpQwEAqkMBAKtDAQAIRAEACUQBAAtEAQAZRAEAGkQBADJE AQAzRAEAOEQBADlEAQA7RAEAZEQBALVEAQC2RAEA0UQBANJEAQDWRAEA5UQBAOZEAQD9RAEA /kQBAARFAQAFRQEAMEUBAIFFAQCCRQEAnUUBAJ5FAQCiRQEAsUUBALJFAQDJRQEAykUBANBF AQDRRQEA/EUBAPTo3cndyd28srzdyd2e3byyvIi8iLx53Z7dnt28sryIvIi83Z7dnt28sryI vIi8AAAAHBVofGlfABZo90UVAG1IAARuSAAEc0gJBHRIDAQAKwAIgRVoHi58ABZo90UVABdo owqYAGNIAQBkaOmSQ6dtSAAEbkgABHRIDAQnAAiBFWgeLnwAFmj3RRUAF2ijCpgAY0gBAGRo 6ZJDp25IDAR0SAwEEhZo2yAvAG1IAARuSAAEdEgMBAAYFWgeLnwAFmj3RRUAbUgABG5IAAR0 SAwEACcACIEVaB4ufAAWaPdFFQAXaKMKmABjSAEAZGjokkOnbkgMBHRIDAQUFWgeLnwAFmj3 RRUAbkgMBHRIDAQAFhZo90UVAG1IAARuSAAEc0gMBHRIDAQAFhZo2yAvAG1IAARuSAAEc0gM BHRIDAQv1kQBAAdFAQAwRQEAS0UBAHNFAQCgRQEAokUBANNFAQD8RQEAF0YBAD9GAQBsRgEA bkYBAJ1GAQDGRgEA4UYBAAlHAQA2RwEAOEcBAGhHAQCRRwEArEcBANRHAQABSAEAA0gBADNI AQBQSAEAd0gBAJ9IAQD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD1 AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAA AAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPUAAAAA AAAAAAAAAAD6AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD1AAAAAAAA AAAAAAAA9QAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA9QAAAAAAAAAA AAAAAPUAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPUAAAAAAAAAAAAA AAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAEfgBnZB4ufAAABCEAZ2QeLnwAABz8RQEATUYBAE5GAQBpRgEAakYBAG5G AQCURgEAlUYBAJpGAQCbRgEAnUYBABdHAQAYRwEAM0cBADRHAQA4RwEAXkcBAF9HAQBlRwEA ZkcBAGhHAQDiRwEA40cBAP5HAQD/RwEAA0gBAClIAQAqSAEAMEgBADFIAQBQSAEAnEgBAJ1I AQDaSAEA90gBAFVJAQBWSQEAjEkBAKtJAQCUSgEAwEoBAPXh9eH12sraytr14fXh9b2nvae9 9eH14fW9p72RvfV99b31ffW99b0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAJwAIgRVoHi58ABZo90UVABdoCF6CAGNIAQBkaO+SQ6duSAwEdEgMBCsA CIEVaB4ufAAWaPdFFQAXaKMKmABjSAEAZGjqkkOnbUgABG5IAAR0SAwEKwAIgRVoHi58ABZo 90UVABdoowqYAGNIAQBkaOmSQ6dtSAAEbkgABHRIDAQYFWgeLnwAFmj3RRUAbUgABG5IAAR0 SAwEAB8ACIEVaB4ufAAWaPdFFQAXaKMKmABjSAEAZGjpkkOnDBVoHi58ABZo90UVAAAnAAiB FWgeLnwAFmj3RRUAF2ijCpgAY0gBAGRo6ZJDp25IDAR0SAwEFBVoHi58ABZo90UVAG5IDAR0 SAwEKJ9IAQDaSAEA90gBADFJAQBYSQEAjEkBAKtJAQDMSQEA30kBAAtKAQArSgEALUoBADtK AQBMSgEAeUoBAJJKAQCUSgEA5EoBABFLAQAsSwEASUsBAE5LAQB4SwEAnEsBAMNLAQDlSwEA 50sBAAxMAQD6AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAA AAAAAAAA+gAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAA AAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAOwAAAAAAAAAAAAA AAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA 9QAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoA AAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAA AAAAAAAAAAAA+gAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH4AD4QAAF6E AABnZB4ufAAABCEAZ2QeLnwAAAR+AGdkHi58AAAbwEoBAMFKAQDRSgEA0koBAN9KAQDgSgEA 4UoBAOJKAQAKSwEAC0sBAA5LAQAPSwEALEsBAHNLAQB0SwEA4EsBAOFLAQDnSwEADEwBANFM AQDSTAEA7EwBABROAQAVTgEAFk4BAEJOAQBDTgEAVE4BAFVOAQBYTgEAWU4BAH9OAQCATgEA h04BAIhOAQCLTgEAjE4BAKpOAQDvTgEA6dzG3Mbc6dzG3Mbcu6e7p7vcu5+Sh3903MbcxtzG 3MbcxtzG3LsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQVaB4ufAAW aPFESQBuSAwEdEgMBAAOFmjxREkAbkgMBHRIDAQAFBVopw/lABZo8URJAG5IDAR0SAwEABgV aKcP5QAWaPFESQBtSAAEbkgABHRIDAQADhZo90UVAG5IDAR0SAwEACcACIEVaB4ufAAWaPdF FQAXaAheggBjSAEAZGjwkkOnbkgMBHRIDAQUFWgeLnwAFmj3RRUAbkgMBHRIDAQAKwAIgRVo Hi58ABZo90UVABdoowqYAGNIAQBkaOqSQ6dtSAAEbkgABHRIDAQYFWgeLnwAFmj3RRUAbUgA BG5IAAR0SAwEACsACIEVaB4ufAAWaPdFFQAXaAheggBjSAEAZGjykkOnbUgABG5IAAR0SAwE ACYMTAEAPEwBAFlMAQCFTAEAs0wBANBMAQDSTAEA7EwBAA1NAQAgTQEATE0BAG9NAQCPTQEA kk0BAKBNAQCxTQEA3k0BAPtNAQAUTgEAFk4BAFtOAQCOTgEAqk4BAMROAQDiTgEA+U4BACNP AQD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA +gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA8AAAAAAAAAAAAAAAAPAA AAAAAAAAAAAAAADwAAAAAAAAAAAAAAAA8AAAAAAAAAAAAAAAAPAAAAAAAAAAAAAAAADwAAAA AAAAAAAAAAAA5wAAAAAAAAAAAAAAAPAAAAAAAAAAAAAAAADwAAAAAAAAAAAAAAAA8AAAAAAA AAAAAAAAAPAAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA4gAAAAAAAAAAAAAAAOIAAAAAAAAA AAAAAADiAAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAA AAAA+gAAAAAAAAAAAAAAAAAAAAAAAAAEIQBnZB4ufAAACH4AD4QAAF6EAABnZPFESQAABH4A Z2TxREkAAAQhAGdk8URJAAAEfgBnZB4ufAAAGu9OAQDwTgEA9k4BAPdOAQAlTwEAS08BAItP AQCMTwEAjk8BAKZPAQCLUAEAp1ABAN1QAQD+UAEAZVEBAGZRAQBsUQEAr1EBAMlSAQDKUgEA 4FIBAItUAQCMVAEAjVQBALVUAQC2VAEAx1QBAMhUAQDLVAEAzFQBAO5UAQDvVAEAA1UBAARV AQAiVQEAdFUBAHVVAQB6VQEAe1UBAOvg6+DT4L/g0+DT4NPgq+DT4KOWi4N402LTYtNi02LT YtPg6+DrAAArAAiBFWgeLnwAFmj3RRUAF2ijCpgAY0gBAGRo6pJDp21IAARuSAAEdEgMBBQV aB4ufAAWaPFESQBuSAwEdEgMBAAOFmjxREkAbkgMBHRIDAQAFBVopw/lABZo8URJAG5IDAR0 SAwEABgVaKcP5QAWaPFESQBtSAAEbkgABHRIDAQADhZo90UVAG5IDAR0SAwEACcACIEVaB4u fAAWaPdFFQAXaAheggBjSAEAZGjxkkOnbkgMBHRIDAQnAAiBFWgeLnwAFmj3RRUAF2gIXoIA Y0gBAGRo75JDp25IDAR0SAwEGBVoHi58ABZo90UVAG1IAARuSAAEdEgMBAAUFWgeLnwAFmj3 RRUAbkgMBHRIDAQAJwAIgRVoHi58ABZo90UVABdoowqYAGNIAQBkaOqSQ6duSAwEdEgMBAAm I08BACVPAQBLTwEAjk8BAKZPAQDATwEA008BAO9PAQAbUAEAUFABAIlQAQCLUAEAp1ABAL5Q AQDbUAEA3VABAP5QAQAtUQEAMlEBAGpRAQBsUQEAilEBAK9RAQDaUQEAEFIBAEJSAQBuUgEA mFIBAMhSAQD6AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD1AAAAAAAA AAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAA AAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPUAAAAAAAAAAAAA AAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA +gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPUA AAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAA AAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAEIQBnZB4ufAAABH4AZ2QeLnwAABzIUgEAylIBAOBSAQAKUwEAJFMBAFFTAQB2UwEA kFMBAL1TAQDhUwEA41MBAPFTAQACVAEAL1QBAExUAQByVAEAi1QBAI1UAQDOVAEACVUBACJV AQA7VQEAZlUBAH1VAQCZVQEAqlUBAOlVAQD6AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPAA AAAAAAAAAAAAAADwAAAAAAAAAAAAAAAA8AAAAAAAAAAAAAAAAPAAAAAAAAAAAAAAAADwAAAA AAAAAAAAAAAA8AAAAAAAAAAAAAAAAPAAAAAAAAAAAAAAAADwAAAAAAAAAAAAAAAA5wAAAAAA AAAAAAAAAPAAAAAAAAAAAAAAAADwAAAAAAAAAAAAAAAA8AAAAAAAAAAAAAAAAPAAAAAAAAAA AAAAAADwAAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAOIAAAAAAAAAAAAAAADiAAAAAAAAAAAA AAAA4gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAA APoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAAAAAAAAAAAEIQBnZB4u fAAACH4AD4QAAF6EAABnZPFESQAABH4AZ2TxREkAAAQhAGdk8URJAAAEfgBnZB4ufAAAGulV AQDrVQEAL1YBAERWAQBxVgEAjlYBAL5WAQDlVgEA51YBAPVWAQAFVwEAMVcBAElXAQBLVwEA jVcBAMNXAQDcVwEA9VcBACBYAQA1WAEAUVgBAGJYAQChWAEAo1gBAOVYAQAcWQEAQ1kBAPoA AAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA8AAAAAAAAAAAAAAAAOsAAAAAAAAAAAAAAADrAAAA AAAAAAAAAAAA6wAAAAAAAAAAAAAAAOsAAAAAAAAAAAAAAADrAAAAAAAAAAAAAAAA4gAAAAAA AAAAAAAAAOsAAAAAAAAAAAAAAADrAAAAAAAAAAAAAAAA6wAAAAAAAAAAAAAAAPoAAAAAAAAA AAAAAAD1AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD6AAAAAAAAAAAA AAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAA APoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD1 AAAAAAAAAAAAAAAAAAAAAAAAAAh+AA+EAABehAAAZ2RmRaoAAAR+AGdkZkWqAAAEIQBnZGZF qgAABCEAZ2QeLnwAAAR+AGdkHi58AAAae1UBAOtVAQArVgEALFYBAC5WAQAvVgEARFYBAEpX AQBLVwEAblcBAG9XAQCNVwEAwFcBAMFXAQDDVwEA3FcBAKNYAQDGWAEAx1gBAOVYAQAZWQEA GlkBABxZAQBDWQEAzFkBAO9ZAQAyWgEAM1oBAEdaAQD16NLoyLuwpeiP6PV79ej16GXo9VH1 6PXo9Un1AAAOFmi9UkcAbkgMBHRIDAQAJwAIgRVoHi58ABZo90UVABdoowqYAGNIAQBkaOuS Q6duSAwEdEgMBCsACIEVaB4ufAAWaPdFFQAXaKMKmABjSAEAZGjrkkOnbUgABG5IAAR0SAwE JwAIgRVoHi58ABZo90UVABdoowqYAGNIAQBkaOqSQ6duSAwEdEgMBCsACIEVaB4ufAAWaPdF FQAXaKMKmABjSAEAZGjqkkOnbUgABG5IAAR0SAwEFBVoHi58ABZoZkWqAG5IDAR0SAwEABQV aKcP5QAWaGZFqgBuSAwEdEgMBAAYFWinD+UAFmhmRaoAbUgABG5IAAR0SAwEABIWaPdFFQBt SAAEbkgABHRIDAQAKwAIgRVoHi58ABZo90UVABdoCF6CAGNIAQBkaO+SQ6dtSAAEbkgABHRI DAQYFWgeLnwAFmj3RRUAbUgABG5IAAR0SAwEABQVaB4ufAAWaPdFFQBuSAwEdEgMBBxDWQEA cVkBAKFZAQDKWQEAzFkBAO9ZAQAQWgEAM1oBAEpaAQCGWgEAtloBAM1aAQDpWgEA/FoBACpb AQBWWwEAklsBAJRbAQC7WwEA/VsBADNcAQBTXAEAeFwBAJdcAQC3XAEA6FwBABRdAQAWXQEA Nl0BAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAA AAD1AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA 9QAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoA AAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAA AAAAAAAAAAAA9QAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA9QAAAAAA AAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAA AAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAQhAGdkHi58AAAEfgBnZB4ufAAAHEdaAQBIWgEASloBAGVaAQBsWgEAbVoBAIBaAQCBWgEA hFoBAKlaAQCqWgEAsFoBALFaAQDNWgEAj1sBAJBbAQCUWwEAu1sBAPpbAQD7WwEA/VsBAFNc AQDoXAEA+lwBABZdAQA2XQEAXl0BAORdAQAlXgEATl4BAK1eAQDTXgEASV8BAJFfAQAxYAEA W2ABAFxgAQBfYAEAYGABAIJgAQAeYQEAO2EBAKBhAQDZYQEAAWIBACliAQAqYgEANmIBAOvg 08awxrDG05rTmtPg6+DT4Ovg0+CP4NPg0+DT4NPg0+DTmtN50+DT4NPg05rTAAAAKwAIgRVo Hi58ABZo90UVABdoCF6CAGNIAQBkaO+SQ6dtSAAEbkgABHRIDAQUFWgeLnwAFmi9UkcAbkgM BHRIDAQAKwAIgRVoHi58ABZo90UVABdoowqYAGNIAQBkaOuSQ6dtSAAEbkgABHRIDAQrAAiB FWgeLnwAFmi9UkcAF2ijCpgAY0gBAGRo65JDp21IAARuSAAEdEgMBBgVaB4ufAAWaL1SRwBt SAAEbkgABHRIDAQAGBVoHi58ABZo90UVAG1IAARuSAAEdEgMBAAUFWgeLnwAFmj3RRUAbkgM BHRIDAQAJwAIgRVoHi58ABZo90UVABdoCF6CAGNIAQBkaO+SQ6duSAwEdEgMBAAvNl0BAEhd AQBcXQEAXl0BAIJdAQC/XQEA5F0BAAheAQAjXgEAJV4BAE5eAQB8XgEAq14BAK1eAQDTXgEA /14BACJfAQBHXwEASV8BAG9fAQCRXwEAsl8BAOpfAQAvYAEAMWABAGJgAQCCYAEArWABAMVg AQD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA 9QAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoA AAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAA AAAAAAAAAAAA9QAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAA AAAAAAAAAPoAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPoAAAAAAAAA AAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD1AAAAAAAAAAAA AAAA9QAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE IQBnZB4ufAAABH4AZ2QeLnwAABzFYAEA/2ABABxhAQAeYQEAO2EBAFhhAQB6YQEAnmEBAKBh AQDZYQEAAWIBAD1iAQB6YgEAlmIBALViAQDUYgEAA2MBAAVjAQBGYwEAhGMBAJ9jAQC9YwEA 6GMBABhkAQAaZAEAWmQBAJhkAQDBZAEA4WQBAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA +gAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoA AAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD1AAAA AAAAAAAAAAAA9QAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAA AAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPoAAAAAAAAA AAAAAAD1AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAA AAAA+gAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAA APUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQhAGdkHi58AAAEfgBnZB4ufAAAHDZiAQA3YgEA OmIBADtiAQBXYgEAWGIBAHNiAQB0YgEAd2IBAHhiAQCWYgEABWMBAC9jAQAwYwEARmMBAIFj AQCCYwEAhGMBAJ9jAQD1YwEA9mMBABVkAQAWZAEAGmQBAENkAQBEZAEAWmQBAJVkAQCWZAEA mGQBAAZlAQDSZQEAC2YBAC9mAQAwZgEANmYBAFxmAQBdZgEAaGYBAGlmAQBsZgEAbWYBAOnc xtyw3Oncxtyl3OncpZGl3KWRpX2l3OncpZGl3KXcpWml3Onc6dzpACcACIEVaB4ufAAWaPdF FQAXaAheggBjSAEAZGjxkkOnbkgMBHRIDAQnAAiBFWgeLnwAFmj3RRUAF2gIXoIAY0gBAGRo 75JDp25IDAR0SAwEJwAIgRVoHi58ABZo90UVABdoCF6CAGNIAQBkaOuSQ6duSAwEdEgMBBQV aB4ufAAWaPdFFQBuSAwEdEgMBAArAAiBFWgeLnwAFmj3RRUAF2ijCpgAY0gBAGRo65JDp21I AARuSAAEdEgMBCsACIEVaB4ufAAWaPdFFQAXaAheggBjSAEAZGjvkkOnbUgABG5IAAR0SAwE GBVoHi58ABZo90UVAG1IAARuSAAEdEgMBAArAAiBFWgeLnwAFmj3RRUAF2gIXoIAY0gBAGRo 65JDp21IAARuSAAEdEgMBAAp4WQBAAZlAQAyZQEAeWUBALNlAQDQZQEA0mUBAAtmAQA2ZgEA b2YBAI9mAQClZgEAzWYBAOdmAQDpZgEAKWcBAE9nAQBsZwEAfGcBAJdnAQDPZwEA8WcBABho AQA/aAEAQWgBAGtoAQChaAEAymgBAOBoAQD6AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPUA AAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD6AAAA AAAAAAAAAAAA9QAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA9QAAAAAA AAAAAAAAAPUAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPoAAAAAAAAA AAAAAAD1AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD1AAAAAAAAAAAA AAAA9QAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAA APUAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEfgBnZB4ufAAABCEAZ2QeLnwAABxtZgEAj2YBAOlm AQAKZwEAC2cBAClnAQBMZwEATWcBAE9nAQBsZwEAy2cBAMxnAQBBaAEAa2gBAKFoAQDDaAEA xGgBAMdoAQDIaAEA4GgBANFpAQBeagEAaGsBAK5rAQAzbAEAYGwBAGFsAQBkbAEAZWwBAGds AQAAbQEAAW0BAAhtAQA9bQEA1W0BANZtAQDcbQEA/W0BAIhvAQDubwEA728BAPPo89Lz6L7o 8+iq6PPo89Lz0vPo8+jz6PPS89LznomefZ6Jnn2efZ4AAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFhZo90UVAG1IAARuSAAEc0gMBHRIDAQAKQAIgRZo 90UVABdoCF6CAGNIAQBkaPGSQ6dtSAwEbkgMBHNIDAR0SAwEFhZo90UVAG1IDARuSAwEc0gM BHRIDAQAJwAIgRVoHi58ABZo90UVABdoCF6CAGNIAQBkaO+SQ6duSAwEdEgMBCcACIEVaB4u fAAWaPdFFQAXaAheggBjSAEAZGjskkOnbkgMBHRIDAQrAAiBFWgeLnwAFmj3RRUAF2gIXoIA Y0gBAGRo7JJDp21IAARuSAAEdEgMBBQVaB4ufAAWaPdFFQBuSAwEdEgMBAAYFWgeLnwAFmj3 RRUAbUgABG5IAAR0SAwEKOBoAQADaQEAG2kBAEhpAQBqaQEAbWkBAHtpAQCLaQEAt2kBAM9p AQDRaQEAI2oBAENqAQBeagEAi2oBAKhqAQDYagEA/2oBAAFrAQAPawEAIGsBAE1rAQBmawEA aGsBAIxrAQCuawEA6msBADFsAQD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAA AAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPEAAAAAAAAAAAAAAAD6AAAAAAAAAAAA AAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA7AAAAAAAAAAAAAAA AOwAAAAAAAAAAAAAAADsAAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6 AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAADxAAAAAAAAAAAAAAAA+gAA AAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAOwAAAAA AAAAAAAAAADsAAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAAAAAAAAAAA AAAABCEAZ2QeLnwAAAh+AA+EAABehAAAZ2QeLnwAAAR+AGdkHi58AAAbMWwBADNsAQBnbAEA g2wBAJlsAQDFbAEA8GwBAAZtAQAIbQEAIG0BAD1tAQBTbQEAf20BAIRtAQCzbQEA2m0BANxt AQD9bQEAE24BAEluAQBpbgEAm24BANNuAQD9bgEAL28BAFFvAQCGbwEAiG8BAM5vAQD6AAAA AAAAAAAAAAAA9QAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAA AAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPUAAAAAAAAA AAAAAAD1AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAA AAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAA APoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6 AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAA AAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEIQBnZB4u fAAABH4AZ2QeLnwAABzObwEA7m8BAClwAQBUcAEAnnABAMVwAQAAcQEAOXEBAIpxAQCucQEA wnEBANZxAQDocQEA/nEBACNyAQA8cgEAY3IBAHZyAQCfcgEAoXIBAMZyAQAZcwEAPnMBAFdz AQB+cwEAkXMBALpzAQC8cwEA4XMBAPoAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA+gAAAAAA AAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPUAAAAAAAAA AAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD1AAAAAAAAAAAA AAAA9QAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAA APUAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD6 AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA9QAA AAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPoAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAR+AGdkHi58AAAEIQBnZB4ufAAAHO9vAQDwbwEAI3ABACRw AQApcAEAAHEBADlxAQBycQEAc3EBAINxAQCEcQEAh3EBAIhxAQCtcQEArnEBAMFxAQDCcQEA 1XEBANZxAQDncQEA6HEBAP5xAQAjcgEAPHIBAKFyAQCtcgEArnIBAMZyAQAZcwEAPnMBALxz AQDHcwEAyHMBAOFzAQA0dAEAWXQBANd0AQDidAEA43QBAOre6t7S3tK90r3SvdKxopOik4uD i3hreGtha3hreGtha3hreGthEhZo3wl0AG1IAARuSAAEdEgMBAAYFWgeLnwAFmj3RRUAbUgA BG5IAAR0SAwEABQVaB4ufAAWaPdFFQBuSAwEdEgMBAAOFmjfCXQAbkgMBHRIDAQADhZo90UV AG5IDAR0SAwEABwVaB4ufAAWaN8JdABtSAwEbkgMBHNIDAR0SAwEABwVaB4ufAAWaPdFFQBt SAwEbkgMBHNIDAR0SAwEABYWaN8JdABtSAAEbkgABHNIDAR0SAwEACkACIEWaPdFFQAXaAhe ggBjSAEAZGjskkOnbUgABG5IAARzSAwEdEgMBBYWaPdFFQBtSAAEbkgABHNIDAR0SAwEABYW aPdFFQBtSAwEbkgMBHNIDAR0SAwEACkACIEWaPdFFQAXaAheggBjSAEAZGjskkOnbUgMBG5I DARzSAwEdEgMBAAm4XMBADR0AQBZdAEAcnQBAJl0AQCsdAEA1XQBANd0AQD8dAEAUHUBAHV1 AQCOdQEAtXUBAMh1AQDxdQEA83UBABh2AQBsdgEAhnYBAKd2AQC6dgEA5nYBAPd2AQAXdwEA GXcBACd3AQA4dwEAZXcBAPoAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAA APoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD1 AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAA AAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPUAAAAA AAAAAAAAAAD6AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAA AAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAA AAAAAOwAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAI fgAPhAAAXoQAAGdkHi58AAAEIQBnZB4ufAAABH4AZ2QeLnwAABvjdAEA/HQBAFB1AQB1dQEA 83UBAP51AQD/dQEAGHYBAGx2AQCGdgEAlXcBALR3AQCfeAEA93gBACN5AQAPegEAEXoBAC96 AQBnegEAhnoBAPx6AQAzewEA13sBAAt8AQCkfAEApXwBAPJ8AQDzfAEAGX0BAKF9AQDAfgEA 2n4BAPZ/AQA9gAEAboABAH2AAQCAgAEAjoABAI+AAQCQgAEAvYABAL6AAQDAgAEAz4ABANKA AQDpgAEA6oABAOuAAQAqgQEAK4EBAC2BAQA+gQEAQIEBAE6BAQBPgQEAUIEBAIOBAQDz6PPo 897z6PPo8+jz6NLo8+jz6PPo0saxxtLo8+jz6PPo897z6J3onejz3vPoneid6PPe8+id6AAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACcACIEVaB4ufAAWaPdFFQAXaAheggBjSAEA ZGjskkOnbkgMBHRIDAQpAAiBFmj3RRUAF2gIXoIAY0gBAGRo75JDp21IAARuSAAEc0gMBHRI DAQWFmj3RRUAbUgABG5IAARzSAwEdEgMBAAWFmj3RRUAbUgMBG5IDARzSAwEdEgMBAASFmjf CXQAbUgABG5IAAR0SAwEABQVaB4ufAAWaPdFFQBuSAwEdEgMBAAYFWgeLnwAFmj3RRUAbUgA BG5IAAR0SAwEOGV3AQB6dwEAk3cBAJV3AQC0dwEAyXcBAPx3AQAmeAEAUHgBAHt4AQCdeAEA n3gBANh4AQD3eAEADHkBACN5AQBbeQEAh3kBALh5AQDTeQEAD3oBABF6AQAvegEASXoBAGV6 AQBnegEAhnoBALN6AQDiegEA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAA AAAA9QAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAA APoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD1 AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAA AAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAA AAAAAAAAAAD6AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAA AAAAAAAA+gAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAA AAAAAAAAAAAAAAAAAAAABCEAZ2QeLnwAAAR+AGdkHi58AAAc4noBAPp6AQD8egEAG3sBADN7 AQBTewEAY3sBAGV7AQCJewEAt3sBANd7AQAJfAEAC3wBADh8AQBmfAEAp3wBAPJ8AQAZfQEA RX0BAIt9AQChfQEAwn0BANR9AQD8fQEAGn4BADd+AQA5fgEAR34BAPoAAAAAAAAAAAAAAAD6 AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAA AAAAAAAAAAAAAPoAAAAAAAAAAAAAAADsAAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAA AAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD1AAAAAAAA AAAAAAAA9QAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA9QAAAAAAAAAA AAAAAPUAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAA AAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA 7AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIfgAPhAAAXoQAAGdkHi58AAAEIQBnZB4ufAAABH4A Z2QeLnwAABtHfgEAV34BAIF+AQCqfgEAvn4BAMB+AQDafgEAB38BACF/AQBLfwEAbH8BAG5/ AQB8fwEAnX8BALh/AQDofwEA9H8BAPZ/AQAVgAEAK4ABAD2AAQBPgAEAbIABAG6AAQCOgAEA wIABAOmAAQAtgQEA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAA AAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAA AAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAADsAAAAAAAA AAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAA AAAAAPoAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPUAAAAAAAAAAAAA AAD6AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA +gAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAh+AA+E AABehAAAZ2QeLnwAAAQhAGdkHi58AAAEfgBnZB4ufAAAGy2BAQBOgQEAg4EBAK2BAQDxgQEA EYIBAEOCAQBsggEAsIIBANOCAQAOgwEAWIMBAJSDAQCYgwEAmYMBAJqDAQCbgwEAnIMBAJ2D AQCegwEAn4MBAPODAQBJhAEA+gAAAAAAAAAAAAAAAPUAAAAAAAAAAAAAAAD6AAAAAAAAAAAA AAAA9QAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD1AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAA APUAAAAAAAAAAAAAAAD6AAAAAAAAAAAAAAAA9QAAAAAAAAAAAAAAAPoAAAAAAAAAAAAAAAD1 AAAAAAAAAAAAAAAA+gAAAAAAAAAAAAAAAOQAAAAAAAAAAAAAAADkAAAAAAAAAAAAAAAA5AAA AAAAAAAAAAAAAOQAAAAAAAAAAAAAAADfAAAAAAAAAAAAAAAA2gAAAAAAAAAAAAAAANIAAAAA AAAAAAAAAADMAAAAAAAAAAAAAAAAxAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcAAAMk AWEkAWdk0XFWAAZ8AAckAWdk0XFWAAAHAAADJAFhJAFnZAoiYAAABH4AZ2R5TPYAAAQAAGdk Hi58AAAQAAANxgoEGgOnBDQGwQcAE6QAADUkATlEBABnZPdFFQAABH4AZ2QeLnwAAAQhAGdk Hi58AAAWg4EBAJSBAQCWgQEArYEBAK6BAQCvgQEA7oEBAO+BAQDxgQEAAIIBAAOCAQARggEA EoIBABOCAQBAggEAQYIBAEOCAQBSggEAVYIBAGyCAQBtggEAboIBAK2CAQCuggEAsIIBANOC AQDUggEA1YIBAA6DAQBYgwEAlIMBAJiDAQCcgwEA8eXx2sbaxtq5r7naxtqb2rmvudqb2pva udqb2o+EdVwAAAAAAAAAAAAAAAAAAAAAAAAAADAVaHxpXwAWaPdFFQBDShYAT0oEAFFKBABe SgQAYUoWAG1ICQRuSAwEc0gJBHRIDAQAHBVofGlfABZo90UVAG1IAARuSAAEc0gJBHRIDAQA FBVofGlfABZo90UVAG5IDAR0SAwEABYWaPdFFQBtSAAEbkgABHNIDAR0SAwEACcACIEVaB4u fAAWaPdFFQAXaAheggBjSAEAZGjtkkOnbkgMBHRIDAQSFmjfCXQAbUgABG5IAAR0SAwEABgV aB4ufAAWaPdFFQBtSAAEbkgABHRIDAQAJwAIgRVoHi58ABZo90UVABdoCF6CAGNIAQBkaOyS Q6duSAwEdEgMBBQVaB4ufAAWaPdFFQBuSAwEdEgMBAAWFmjfCXQAbUgABG5IAARzSAkEdEgM BAAcFWgeLnwAFmj3RRUAbUgABG5IAARzSAkEdEgMBCCcgwEAnYMBAJ6DAQCfgwEAoIMBAKOD AQClgwEApoMBAPKDAQD5gwEA/YMBAP+DAQADhAEABIQBACyEAQBFhAEASYQBAFWEAQBWhAEA V4QBANKEAQDThAEA1IQBANWEAQAUhQEAFoUBAB2FAQBChQEAQ4UBAGeFAQB3hQEAeIUBAHmF AQD47eXd1d3Vzd3Vzd3N3cXdva+evZa9hnZmdmZ2vZa9VgAAAAAAAAAAHxVoHi58ABZoVWHd ADBKfQA1CIFtSAAEbkgABHNICQgfFWh8aV8AFmjwHN0AMEp9ADUIgW1IAARuSAAEc0gMBB8V aHxpXwAWaPBiIgAwSn0ANQiBbUgABG5IAARzSAwEHxVoHi58ABZo8GIiADBKfQA1CIFtSAAE bkgABHNICQgOFmjwYiIAbUgJBHNICQQAIQAIgRZoW2YZABdoiA3vAGNIAQBkaMySQ6dtSAkE c0gJBBsBCIEESAEABWjMkkOnFmiIDe8AbUgJBHNICQQOFmhbZhkAbUgJBHNICQQADhZoMSoK AG1ICQRzSAkEAA4WaNs1lABtSAkEc0gJBAAOFmjRcVYAbUgJBHNICQQADhZoCiJgAG1ICQRz SAkEAA4WaHlM9gBtSAkEc0gJBAAUFWh5TPYAFmh5TPYAbkgMBHRIDAQADhZo90UVAG1ICQRz SAkEIEmEAQBKhAEAooQBANSEAQAUhQEAQ4UBAHiFAQC5hQEA64UBACuGAQByhgEAh4YBANCG AQADhwEAUYcBAIyHAQCNhwEAjocBAJaHAQCjhwEAAIgBAAGIAQBdiAEA9wAAAAAAAAAAAAAA APIAAAAAAAAAAAAAAADqAAAAAAAAAAAAAAAA5QAAAAAAAAAAAAAAAOUAAAAAAAAAAAAAAADq AAAAAAAAAAAAAAAA5QAAAAAAAAAAAAAAAOUAAAAAAAAAAAAAAADqAAAAAAAAAAAAAAAA5QAA AAAAAAAAAAAAAOAAAAAAAAAAAAAAAADlAAAAAAAAAAAAAAAA6gAAAAAAAAAAAAAAAOUAAAAA AAAAAAAAAADlAAAAAAAAAAAAAAAA2wAAAAAAAAAAAAAAANYAAAAAAAAAAAAAAADQAAAAAAAA AAAAAAAAyAAAAAAAAAAAAAAAAMgAAAAAAAAAAAAAAADIAAAAAAAAAAAAAAAAwwAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAEAABnZDEqCgAABwAAAyQBYSQBZ2QeLnwABnwAByQBZ2TeRjkA AAQAAGdk0XFWAAAEfgBnZFtmGQAABH4AZ2QeLnwAAAQhAGdkHi58AAgAAAomAAtGKQBnZPBi IgAABAAAZ2TwYiIAAAcAAAMkAWEkAWdk0XFWAAAWeYUBAMiFAQDJhQEAyoUBAOuFAQArhgEA LIYBAEGGAQBxhgEAcoYBAIeGAQCWhgEAl4YBAJiGAQCqhgEAwYYBAMKGAQDv28Hvua+fj39x 79tXR+8zAAAAAAAAAAAAAAAAAAAAAAAAJgEIgQRIAQAFaM6SQ6cWaIgN7wAwSn0ANQiBbUgA BG5IAARzSAwEAB8VaHxpXwAWaKEZPwAwSn0ANQiBbUgABG5IAARzSAwEMgAIgRVofGlfABZo oRk/ABdoiA3vADBKfQA1CIFjSAEAZGjNkkOnbUgABG5IAARzSAwEABsVaB4ufAAWaFVh3QAw Sn0ANQiBbUgMBHNIDAQfFWgeLnwAFmi2W+0AMEp9ADUIgW1IAARuSAAEc0gMBB8VaB4ufAAW aFVh3QAwSn0ANQiBbUgABG5IAARzSAwEHxVo6yV6ABZoVWHdADBKfQA1CIFtSAAEbkgABHNI DAQTFWh8aV8AFmhVYd0AMEp9ADUIgQ4WaPBiIgBtSAkEc0gJBAAyAAiBFWh8aV8AFmhVYd0A F2iIDe8AMEp9ADUIgWNIAQBkaM2SQ6dtSAAEbkgABHNIDAQAJgEIgQRIAQAFaM2SQ6cWaIgN 7wAwSn0ANQiBbUgABG5IAARzSAwEAB8VaHxpXwAWaFVh3QAwSn0ANQiBbUgABG5IAARzSAwE ABDChgEAw4YBANCGAQADhwEABIcBAFGHAQBfhwEAYIcBAGGHAQCMhwEAjYcBAI6HAQCWhwEA oocBAKOHAQCvhwEA5tbOvq6einCeZVpSRTUqAAAAAAAUFWgxKgoAFmgxKgoAbUgJBHNICQQA HxVoHi58ABZoMSoKADUIgUNKHABhShwAbUgJBHNICQQZFmjBRRwANQiBQ0ocAGFKHABtSAkE c0gJBA4WaN5GOQBtSAkEc0gJBAAUFWhVYd0AFmgKImAAbUgMBHNIDAQAFBVoVWHdABZoW2YZ AG1IDARzSAwEADIACIEVaHxpXwAWaKEZPwAXaIgN7wAwSn0ANQiBY0gBAGRozZJDp21IAARu SAAEc0gMBAAmAQiBBEgBAAVozZJDpxZoiA3vADBKfQA1CIFtSAAEbkgABHNIDAQAHxVofGlf ABZooRk/ADBKfQA1CIFtSAAEbkgABHNIDAQfFWgeLnwAFmhbZhkAMEp9ADUIgW1IAARuSAAE c0gMBB8VaB4ufAAWaKEZPwAwSn0ANQiBbUgABG5IAARzSAkIDhZo8GIiAG1ICQRzSAkEAB8V aHxpXwAWaFVh3QAwSn0ANQiBbUgABG5IAARzSAwEMgAIgRVofGlfABZoVWHdABdoiA3vADBK fQA1CIFjSAEAZGjOkkOnbUgABG5IAARzSAwED6+HAQC8hwEA/4cBAACIAQABiAEAAogBABaI AQAYiAEAXIgBAF2IAQBeiAEAcogBAHSIAQC7iAEAvIgBAL2IAQDRiAEA0ogBAE+JAQBQiQEA Y4kBAGSJAQB6iQEA+O344syzzLOokrPMs8ySecx5Y01CPgAAAAAAAAAAAAAGFmjWOwAAABQV aAoiYAAWaBV3uQBtSAwQc0gMEAAqFmgVd7kAQioBS0gkAFwIgWFKGABtSAkEbkgMBHBoAAAA AHNICQR0SAwEACoWaLg0egBCKgFLSCQAXAiBYUoYAG1ICQRuSAwEcGgAAAAAc0gJBHRIDAQA MBVopw/lABZoMSoKAEIqAUtIJABcCIFhShgAbUgJBG5IDARwaAAAAABzSAkEdEgMBAAqFmjg O48AQioBS0gkAFwIgWFKGABtSAkEbkgMBHBoAAAAAHNICQR0SAwEABQVaKcP5QAWaDEqCgBt SAkEc0gJBAAwFWggaXcAFmgxKgoAQioBS0gkAFwIgWFKGABtSAkEbkgMBHBoAAAAAHNICQR0 SAwEACoWaDEqCgBCKgFLSCQAXAiBYUoYAG1ICQRuSAwEcGgAAAAAc0gJBHRIDAQAFBVoMSoK ABZowUUcAG1ICQRzSAkEABQVaDEqCgAWaDEqCgBtSAkEc0gJBAAOFmgxKgoAbUgJBHNICQQW XYgBALyIAQBQiQEAUYkBAFKJAQBkiQEAeYkBAHqJAQB8iQEAfYkBAH+JAQCAiQEAgokBAIOJ AQCjiQEAyokBAMuJAQDUiQEA5okBAOeJAQD4iQEA+AAAAAAAAAAAAAAAAPMAAAAAAAAAAAAA AADzAAAAAAAAAAAAAAAA8wAAAAAAAAAAAAAAAOsAAAAAAAAAAAAAAADpAAAAAAAAAAAAAAAA 6QAAAAAAAAAAAAAAAOkAAAAAAAAAAAAAAADpAAAAAAAAAAAAAAAA6QAAAAAAAAAAAAAAAOkA AAAAAAAAAAAAAADpAAAAAAAAAAAAAAAA6QAAAAAAAAAAAAAAAOEAAAAAAAAAAAAAAADXAAAA AAAAAAAAAAAA6QAAAAAAAAAAAAAAAMMAAAAAAAAAAAAAAADDAAAAAAAAAAAAAAAArwAAAAAA AAAAAAAAAMMAAAAAAAAAAAAAAAAAAAAAAAAAEwAADcYOAAQaA6cENAbBB8DAwMATpAAAFiQB SWYBAAAAZ2RyYfQAABMAAA3GDgAEGgOnBDQGwQfAwMDAE6R4ABYkAUlmAQAAAGdkcmH0AAAJ GAADJAEUpPAAYSQBZ2RyYfQAAAcYAAMkAWEkAWdkcmH0AAABAAAABwAAAyQBYSQBZ2QVd7kA AAQAAGdkHi58AAAGAAATpFYAZ2QxKgoAABR6iQEAe4kBAH2JAQB+iQEAgIkBAIGJAQCDiQEA hYkBAIaJAQCciQEAnYkBAJ6JAQCfiQEAoIkBAKKJAQCjiQEApIkBALqJAQC7iQEAyIkBAMmJ AQDKiQEAy4kBANSJAQADigEABIoBAAWKAQAYigEAP4oBAEGKAQBCigEAaYoBAGqKAQBrigEA bYoBAHeKAQD38/fz9/Pq3erd0MXd6rzd6t3QreqpnZCGeIaQhnhpeIaQXQAAAAAAAAAWFWiH PvYAFmhyYfQANQiBQ0oSAFwIgQAcFWgeWNYAFmhyYfQAMEp3AENKFgBtSAwEc0gMBAAbA2oA AAAAFmhyYfQAQ0oWAFUIAW1IDARzSAwEEhZocmH0AENKFgBtSAwEc0gMBAAYFWiHPvYAFmhy YfQAQ0oWAG1IDARzSAwEABYVaIc+9gAWaHJh9AA1CIFDShYAXAiBAAYWaLZb7QAAHANqAAAA ABVocmH0ABZocmH0AENKEgBVCAGGKgEAEBVocmH0ABZotlvtAENKEgAAFRZoEQGTAENKEgBt SAAEbkgABHUIARgWaBEBkwBDShIAbUgABG5IAAR1CAGGKgEAGQNqAAAAABVocmH0ABZocmH0 AENKEgBVCAEQFWhyYfQAFmhyYfQAQ0oSAAAGFmjWOwAAAA8DagAAAAAWaNY7AABVCAEAI/iJ AQD9iQEAbIoBAG2KAQDsiwEA6wAAAAAAAAAAAAAAAOsAAAAAAAAAAAAAAACBAAAAAAAAAAAA AAAAdgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAACwAAE6QAABYkAUlmAQAAAGdkcmH0AABpAABrZI0UAAAWJAEX JAFJZgEAAAAAVAEAApY5AAM0AQeUzAAI1kYAA8f/IgbvFMMmAAZbBgwBAAAAAAAAAAAAAAAA AAAABs0ODAEAAAAAAAAAAAAAAAAAAAAG1BEMAQAAAAAAAAAAAAAAAAAAFPYD/CYX9gMAABj2 AwAAGtYMAAAA/wAAAP8AAAD/G9YMAAAA/wAAAP8AAAD/HNYMAAAA/wAAAP8AAAD/HdYMAAAA /wAAAP8AAAD/NNYGAAEKAzkAYfYDAABmNAF5dNRJVACKVAEAABMAAA3GDgAEGgOnBDQGwQfA wMDAE6QAABYkAUlmAQAAAGdkcmH0AAAEd4oBALSKAQDOigEA7IsBAO2LAQDuiwEA74sBAPCL AQDxiwEA9+v35NvX08gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQVaAoiYAAW aBV3uQBtSAwQc0gMEAAGFmjWOwAAAAYWaLZb7QAAEBVocmH0ABZocmH0AENKEgAADBVohz72 ABZocmH0AAAWFWiHPvYAFmhyYfQANQiBQ0oSAFwIgQAQFWiHPvYAFmhyYfQAQ0oSAAjsiwEA 7YsBAO6LAQDviwEA8IsBAPGLAQC0AAAAAAAAAAAAAAAArQAAAAAAAAAAAAAAAKYAAAAAAAAA AAAAAACkAAAAAAAAAAAAAAAAnAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwAAAyQBYSQBZ2QVd7kA AAEAAAAGFwATpAAAZ2RyYfQAAAYAABOkAABnZHJh9AAASgAAa2QVFQAAFiQBFyQBSWYBAAAA AFQBAAKWbAADNAEI1hoAAcf/iiYABsMmBAEAAAQBAAAEAQAABAEAABT2A/wmF/YDAAAY9gM5 ABrWBAAAAP8b1gQAAAD/HNYEAAAA/x3WBAAAAP8y1gYAAQoDOQA01gYAAQUDAAA01gYAAQoD bABh9gMAAGY0AXl01ElUAIpUAQAABTwACTAECjABJlAJADGQRgE6cHJh9AAfsIMuILDCQSGw bgQisG4EI5CJBSSQiQUlsAAAF7DQAhiw0AIMkNACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAATgAWJAEX JAFJZgEAAAABlgAAIXYAAmgBI3YAAfkSI3YBAsoTOlYLAAKWOQADNAEU9gPDJjXWBQABA/kS NdYFAQIDyhM01gYAAQoDOQBmNAFlABYkARckAUlmAQAAAAGWAAAhdgACaAEjdgAB+RIjdgEC yhM6VgsAApY5AAM0AQeUzQEU9gPDJivWAgADNdYFAAED+RI11gUBAgPKEy/WCwACBP////// ////NNYGAAEKAzkAZjQBZQAWJAEXJAFJZgEAAAABlgAAIXYAAmgBI3YAAfkSI3YBAsoTOlYL AAKWOQADNAEHlGMBFPYDwyYr1gIAATXWBQABA/kSNdYFAQIDyhMv1gsAAgQAAAD/DAEAADTW BgABCgM5AGY0AWAAFiQBFyQBSWYBAAAAAZYAACF2AANoASN2AAFRBiN2AQKoDCN2AgPKEzpW CwACljkAAzQBB5RlART2A8MmNdYFAAEDUQY11gUBAgOoDDXWBQIDA8oTNNYGAAEKAzkAZjQB RAAWJAEXJAFJZgEAAAABlgAAIXYAAWgBI3YAAcMmOlYLAAKWOQADNAEHlGUBFPYDwyY11gUA AQPDJjTWBgABCgM5AGY0AVIAFiQBFyQBSWYBAAAAAZYAACF2AAJoASN2AAFRBiN2AQJyIDpW CwACljkAAzQBB5RlART2A8MmNdYFAAEDUQY11gUBAgNyIDTWBgABCgM5AGY0AWAAFiQBFyQB SWYBAAAAAZYAACF2AAJoASN2AAFRBiN2AQJyIDpWCwACljkAAzQBB5RlART2A8MmNdYFAAED UQY11gUBAgNyIC/WCwACBAAAAP8MAQAANNYGAAEKAzkAZjQBfQAAAEQAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAI0Mnq efm6zhGMggCqAEupCwIAAAAIAAAADgAAAF8AUgBlAGYAMwA5ADUANQA5ADMAMQAyADYAAAB9 AAAARAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAjQyep5+brOEYyCAKoAS6kLAgAAAAgAAAAOAAAAXwBSAGUAZgAzADkA NQA1ADkAMwAwADEAOAAAAH0AAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACNDJ6nn5us4RjIIAqgBLqQsCAAAACAAA AA4AAABfAFIAZQBmADMAOQA1ADUAOQA0ADEANQA4AAAAfQAAAEQAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAI0Mnqefm6 zhGMggCqAEupCwIAAAAIAAAADgAAAF8AUgBlAGYAMwA5ADUANQA5ADQANAA3ADgAAAB9AAAA RAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAjQyep5+brOEYyCAKoAS6kLAgAAAAgAAAAOAAAAXwBSAGUAZgAzADkANQA1 ADkANAA0ADcAOAAAAH0AAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACNDJ6nn5us4RjIIAqgBLqQsCAAAACAAAAA4A AABfAFIAZQBmADMAOQA1ADUAOQA0ADQANwA4AAAAfQAAAEQAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAI0Mnqefm6zhGM ggCqAEupCwIAAAAIAAAADgAAAF8AUgBlAGYAMwA5ADUANQA5ADMAMQAyADYAAAB9AAAARAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAjQyep5+brOEYyCAKoAS6kLAgAAAAgAAAAOAAAAXwBSAGUAZgAzADkANQA1ADkA NwAxADcANgAAAH0AAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACNDJ6nn5us4RjIIAqgBLqQsCAAAACAAAAA4AAABf AFIAZQBmADMAOQA1ADUAOQA3ADIANgA0AAAAfQAAAEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAI0Mnqefm6zhGMggCq AEupCwIAAAAIAAAADgAAAF8AUgBlAGYAMwA5ADUANQA5ADMAMQAyADYAAAB9AAAARAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAjQyep5+brOEYyCAKoAS6kLAgAAAAgAAAAOAAAAXwBSAGUAZgAzADkANQA1ADkANwAy ADYANAAAAH0AAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAACNDJ6nn5us4RjIIAqgBLqQsCAAAACAAAAA4AAABfAFIA ZQBmADMAOQA1ADUAOQA3ADEANwA2AAAAfQAAAEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAI0Mnqefm6zhGMggCqAEup CwIAAAAIAAAADgAAAF8AUgBlAGYAMwA5ADUANgAwADYAOQA2ADUAAAB9AAAARAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAjQyep5+brOEYyCAKoAS6kLAgAAAAgAAAAOAAAAXwBSAGUAZgAzADkANQA2ADAANgA5ADYA NQAAAH0AAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAACNDJ6nn5us4RjIIAqgBLqQsCAAAACAAAAA4AAABfAFIAZQBm ADMAOQA1ADYAMAA2ADkANgA1AAAAfQAAAEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAI0Mnqefm6zhGMggCqAEupCwIA AAAIAAAADgAAAF8AUgBlAGYAMwA5ADUANgAwADgANAA1ADEAAAB9AAAARAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAjQ yep5+brOEYyCAKoAS6kLAgAAAAgAAAAOAAAAXwBSAGUAZgAzADkANQA2ADAAOAA0ADUAMQAA AH0AAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAACNDJ6nn5us4RjIIAqgBLqQsCAAAACAAAAA4AAABfAFIAZQBmADMA OQA1ADYAMAA2ADkANgA1AAAAfQAAAEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAI0Mnqefm6zhGMggCqAEupCwIAAAAI AAAADgAAAF8AUgBlAGYAMwA5ADUANgAwADkAOQAwADcAAAB9AAAARAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAjQyep5 +brOEYyCAKoAS6kLAgAAAAgAAAAOAAAAXwBSAGUAZgAzADkANQA2ADAAOQA5ADMAMQAAAH0A AABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAACNDJ6nn5us4RjIIAqgBLqQsCAAAACAAAAA4AAABfAFIAZQBmADMAOQA1 ADYAMAA5ADkANQA2AAAAfQAAAEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAI0Mnqefm6zhGMggCqAEupCwIAAAAIAAAA DgAAAF8AUgBlAGYAMwA5ADUANgAwADkAOQA3ADgAAAB9AAAARAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAjQyep5+brO EYyCAKoAS6kLAgAAAAgAAAAOAAAAXwBSAGUAZgAzADkANQA2ADAAOQA5ADAANwAAAH0AAABE AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAACNDJ6nn5us4RjIIAqgBLqQsCAAAACAAAAA4AAABfAFIAZQBmADMAOQA1ADYA MAA5ADkAMwAxAAAAfQAAAEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAI0Mnqefm6zhGMggCqAEupCwIAAAAIAAAADgAA AF8AUgBlAGYAMwA5ADUANgAwADkAOQA1ADYAAAB9AAAARAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAjQyep5+brOEYyC AKoAS6kLAgAAAAgAAAAOAAAAXwBSAGUAZgAzADkANQA2ADEAMwAyADEAMQAAAH0AAABEAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAACNDJ6nn5us4RjIIAqgBLqQsCAAAACAAAAA4AAABfAFIAZQBmADMAOQA1ADYAMQA1 ADUAMwAxAAAAfQAAAEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAI0Mnqefm6zhGMggCqAEupCwIAAAAIAAAADgAAAF8A UgBlAGYAMwA5ADUANgAxADYAMgAyADkAAAB9AAAARAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAjQyep5+brOEYyCAKoA S6kLAgAAAAgAAAAOAAAAXwBSAGUAZgAzADkANQA1ADkAMwAwADEAOAAAAH0AAABEAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAACNDJ6nn5us4RjIIAqgBLqQsCAAAACAAAAA4AAABfAFIAZQBmADMAOQA1ADYAMQA2ADYA NQA2AAAAfQAAAEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAI0Mnqefm6zhGMggCqAEupCwIAAAAIAAAADgAAAF8AUgBl AGYAMwA5ADUANgAxADkANgAzADQAAAB9AAAARAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAjQyep5+brOEYyCAKoAS6kL AgAAAAgAAAAOAAAAXwBSAGUAZgAzADkANQA1ADkAMwAwADEAOAAAAH0AAABEAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA CNDJ6nn5us4RjIIAqgBLqQsCAAAACAAAAA4AAABfAFIAZQBmADMAOQA1ADUAOQA3ADEANwA2 AAAAfQAAAEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAI0Mnqefm6zhGMggCqAEupCwIAAAAIAAAADgAAAF8AUgBlAGYA MwA5ADUANQA5ADcAMgA2ADQAAAB9AAAARAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAjQyep5+brOEYyCAKoAS6kLAgAA AAgAAAAOAAAAXwBSAGUAZgAzADkANQA1ADkANwAxADcANgAAAH0AAABEAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACNDJ 6nn5us4RjIIAqgBLqQsCAAAACAAAAA4AAABfAFIAZQBmADMAOQA1ADUAOQA3ADIANgA0AAAA fQAAAEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAI0Mnqefm6zhGMggCqAEupCwIAAAAIAAAADgAAAF8AUgBlAGYAMwA5 ADUANgA4ADQAOQAzADUAAACGABYkARckAUlmAQAAAAGWAAAhdgADaAEjdgABWwYjdgECzQ4j dgID1BE6VgsAApY5AAM0AQeUzAAU9gP8Jhj2AwAANdYFAAEDWwY11gUBAgPNDjXWBQIDA9QR L9YLAAMBAAAA/wwBAAA01gYAAQUAAAA01gYAAQoDOQBmNAF5dNRJVACKVAEAXQAWJAEXJAFJ ZgEAAAABljMAIXYAAWgBI3YAAcMmOlYLAAKWbAADNAEU9gP8Jhj2AzkANdYFAAEDwyYv1gsA AQ8AAAD/BAEAADLWBgABCgM5AGY0AXl01ElUAIpUAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAYGjgASAAEAcwEPAAcABgAAAAYAAAAEAAgAAAAIAAAACAAAAAgAAAAIAAAA CAAAAAgAAAAIAAAACAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAgAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAADIGAAAYAAAAwAMAANADAADgAwAA8AMAAAAEAAAQBAAAIAQAADAEAABABAAA UAQAAGAEAABwBAAAgAQAAJAEAADAAwAA0AMAAOADAADwAwAAAAQAABAEAAAyBgAAKAIAANgB AADoAQAAIAQAADAEAABABAAAUAQAAGAEAABwBAAAgAQAAJAEAADAAwAA0AMAAOADAADwAwAA AAQAABAEAAAgBAAAMAQAAEAEAABQBAAAYAQAAHAEAACABAAAkAQAAMADAADQAwAA4AMAAPAD AAAABAAAEAQAACAEAAAwBAAAQAQAAFAEAABgBAAAcAQAAIAEAACQBAAAwAMAANADAADgAwAA 8AMAAAAEAAAQBAAAIAQAADAEAABABAAAUAQAAGAEAABwBAAAgAQAAJAEAADAAwAA0AMAAOAD AADwAwAAAAQAABAEAAAgBAAAMAQAAEAEAABQBAAAYAQAAHAEAACABAAAkAQAAMADAADQAwAA 4AMAAPADAAAABAAAEAQAACAEAAAwBAAAQAQAAFAEAABgBAAAcAQAAIAEAACQBAAAOAEAAFgB AAD4AQAACAIAABgCAABWAgAAfgIAAJACAACgAgAAsAIAAMACAADQAgAAgAIAAOACAADwAgAA AAMAABADAAAgAwAAMAMAAEADAADgAgAA8AIAAAADAAAQAwAAIAMAADADAABAAwAA4AIAAPAC AAAAAwAAEAMAACADAAAwAwAAQAMAAOACAADwAgAAAAMAABADAAAgAwAAMAMAAEADAADgAgAA 8AIAAAADAAAQAwAAIAMAADADAABAAwAA4AIAAPACAAAAAwAAEAMAACADAAAwAwAAQAMAAOAC AADwAgAAAAMAABADAAAgAwAAMAMAAEADAADgAgAA8AIAAAADAAAQAwAAIAMAADADAABAAwAA 4AIAAPACAAAAAwAAEAMAACADAAAwAwAAQAMAAOACAADwAgAAAAMAABADAAAgAwAAMAMAAEAD AADgAgAA8AIAAAADAAAQAwAAIAMAADADAABAAwAA4AIAAPACAAAAAwAAEAMAACADAAAwAwAA QAMAAOACAADwAgAAAAMAABADAAAgAwAAMAMAAEADAADgAgAA8AIAAAADAAAQAwAAIAMAADAD AABAAwAAHAAAAE9KBgBRSgYAX0gBBG1ICQRuSAQIc0gJBHRIBAgAAAAAZgAAYPH/AgBmAAwQ AABEaLsAAAAGAE4AbwByAG0AYQBsAAAAJwAAAA3GDgAEGgOnBDQGwQcAAAAAE6SIADUkADck ADgkADlEAgBIJAAAGABPSgAAUUoAAF9IAQRtSAkIc0gJCHRICQRKAAFAAQACAEoADBAAAAAA AAAAAAkASABlAGEAZABpAG4AZwAgADEAAAAWAAEABSQBBiQBCiYAC0YhABOk4AFAJgAHADUI gUNKGAAASgACQAEAAgBKAAwQAAAAAAAAAAAJAEgAZQBhAGQAaQBuAGcAIAAyAAAAFgACAAUk AQYkAQomAQtGIQATpDkBQCYBBwA1CIFDShYAAEYAA0ABAAIARgAMEAAAAAAAAAAACQBIAGUA YQBkAGkAbgBnACAAMwAAABYAAwAFJAEGJAEKJgILRiEAE6S1AEAmAgMANQiBADgABAAxAAIA OAAMEAAAAAAAAAAACQBIAGUAYQBkAGkAbgBnACAANAAAAAwABAAKJgMLRiEAQCYDAABCAAUA MQACAEIADBAAAAAAAAAAAAkASABlAGEAZABpAG4AZwAgADUAAAAWAAUACiYEC0YhAA3GBwEa AwGLAwBAJgQAADgABgAxAAIAOAAMEAAAAAAAAAAACQBIAGUAYQBkAGkAbgBnACAANgAAAAwA BgAKJgULRiEAQCYFAAA4AAcAMQACADgADBAAAAAAAAAAAAkASABlAGEAZABpAG4AZwAgADcA AAAMAAcACiYGC0YhAEAmBgAAOAAIAJEAAgA4AAwQAAAAAAAAAAAJAEgAZQBhAGQAaQBuAGcA IAA4AAAADAAIAAomBwtGIQBAJgcAAEwACQARAAIATAAMEAAAAAAAAAAACQBIAGUAYQBkAGkA bgBnACAAOQAAAB8ACQADJAEKJggLRiEADcYKBBoDpwQ0BsEHAEAmCGEkAQAAAEQAQSDy/6EA RAAMDAAAAAAAABAAFgBEAGUAZgBhAHUAbAB0ACAAUABhAHIAYQBnAHIAYQBwAGgAIABGAG8A bgB0AAAAAABSAGlA8/+zAFIADA0AAAAAAAAwBgwAVABhAGIAbABlACAATgBvAHIAbQBhAGwA AAAcABf2AwAANNYGAAEKA2wANNYGAAEFAwAAYfYDAAACAAsAAAAoAGsg9P/BACgAAA0AAAAA AAAwBgcATgBvACAATABpAHMAdAAAAAIADAAAAAAAOgAaAAEAAgA6AAwBAAAAAAAAAAAFAFQA TwBDACAAOAAAABUADwATpAAAFcYIAAIfHv0lAApehM4YAAAAOgAWABEBIgE6AAwBAAAAAAAA AAAFAFQATwBDACAANAAAABYAEAAVxgkBMwcZAAGGCgBehIYKYISt/AAAVAAVAAEAAgBUAAwB AAAAAAAAAAAFAFQATwBDACAAMwAAADAAEQATpAAAFcYbBBoDpwQ0BsEHGQAZABkAGQADMwdw I6clAAoCXYQ3Al6EMwdghDv9AAA+ABcAEQEiAT4ADAEAAAAAAAAAAAUAVABPAEMAIAA1AAAA GQASABXGCAACgQ9wIwAIXYSMAl6EgQ9ghAP8AAAAPgAUAEEBEgE+AAwBAAAAAAAAAAAFAFQA TwBDACAAMgAAABoAEwATpB0AFcYJATcCGQABbgQAXoRuBGCEyf0AAFQAEwABADIBVAAMAQAA AAAAAAAABQBUAE8AQwAgADEAAAAwABQAE6RWABXGGwQaA6cENAbBBxkAGQAZABkAAzcCcCOn JQAKAl2ENwJehFMDYISt/AAAPgAZABEBUgE+AAwBAAAAAAAAAAAFAFQATwBDACAANwAAABkA FQAVxggAAs4Y/SUACl2EjAJehM4YYIQh+wAAAD4AGAARAWIBPgAMAQAAAAAAAAAABQBUAE8A QwAgADYAAAAZABYAFcYIAALwE3AjAAhdhIwCXoTvE2CEkvsAAABKACBAAQByAUoADAAAAAAA AAAAAAYARgBvAG8AdABlAHIAAAAgABcAFcYbBBoDpwQ0BsEHGQAZABkAGQADiwNVIv0lAAIC AwA1CIEARgAfQAEAggFGAAwAAAAAAAAAAAAGAEgAZQBhAGQAZQByAAAAIAAYABXGGwQaA6cE NAbBBxkAGQAZABkAA4sD8RL9JQABAgAARAAmIPL/kQFEAAwBAAAAAAAAAAASAEYAbwBvAHQA bgBvAHQAZQAgAFIAZQBmAGUAcgBlAG4AYwBlAAAACABDShAARUgGAEIAHQABAKIBQgAMAQAA AAAAAAAADQBGAG8AbwB0AG4AbwB0AGUAIABUAGUAeAB0AAAACgAaABXGBQABAAEABABDShIA LAD+TwEAsgEsAAwAAAAAAAAAAAAEAE4AbwB0AGUAAAAGABsAE6RQAAQAQ0oWADgA/k8BAMIB OAAMAH8AAAAAAAAACABlAG4AdQBtAGwAZQB2ADEAAAAOABwAE6RWAF6EpwRghHP+AAAwAP5P wQHSATAADAAAAAAAAAAAAAgAZQBuAHUAbQBsAGUAdgAyAAAABgAdAF6ENAYAADAA/g/RAeIB MAAMAAAAAAAAAAAACABlAG4AdQBtAGwAZQB2ADMAAAAGAB4AXoTBBwAATAD+DwEA8gFMAAwA AAAAAAAAAAAIAEUAcQB1AGEAdABpAG8AbgAAAB0AHwATpMEAFKTwABXGEAKnBMEHGQAZAALx EuAlAQIABABDShYASgD+D0EBQgFKAAwAAAAAAAAAAAAFAHQAbwBjACAAMAAAACIAIAATpHgA FcYKAjcCcCMZABkAAF2EAABehAAAYIQAAGEkAgMANgiBAEIA/k/BAxICQgAEAAAAXnFDAAAA BQBBAFMATgAuADEAAAAXACEADcYOAAQaA6cENAbBBwAAAAATpHgAAAYANQiBXAiBJgAbABEB IgImAAwBAAAAAAAAAAAFAFQATwBDACAAOQAAAAIAIgAAAEYA/g8BAEICRgAMAAAAAAAAAAAA CgBDAGgAYQBwAF8AdABpAHQAbABlAAAADwAjAAUkAQYkAROk8ABhJAEABwA1CIFDShwAAEQA /g8BAEICRAAMAAAAAAAAAAAAEgBOAG8AcgBtAGEAbABfAGEAZgB0AGUAcgBfAHQAaQB0AGwA ZQAAAAYAJAATpOABAAAuACkAogBRAi4ADAAAAAAAAAAAAAsAUABhAGcAZQAgAE4AdQBtAGIA ZQByAAAAAAAqAAoAAQACACoADAEAAAAAAAAAAAcASQBuAGQAZQB4ACAAMQAAAAIAJgAAAEwA /g8BAEICTAAMAAAAAAAAAAAADQBBAG4AbgBlAHgAXwBOAG8AVABpAHQAbABlAAAADwAnAAUk AQYkAROk0AJhJAEABwA1CIFDShgAADIA/i/y/4ECMgAMAAAAAAAAAAAABwBBAHAAcABfAGQA ZQBmAAAACwA1CIFPSgAAUUoAAAAmAP4PogCRAiYADAAAAAAAAAAAAAcAQQBwAHAAXwByAGUA ZgAAAAAAPAD+D3ECQgI8AAwAAAAAAAAAAAAQAEEAcABwAGUAbgBkAGkAeABfAE4AbwBUAGkA dABsAGUAAAACACoAAAAyAP4v8v+xAjIADAAAAAAAAAAAAAcAQQByAHQAXwBkAGUAZgAAAAsA NQiBT0oAAFFKAAAAPgAnIPL/wQI+AAwBAAAAAAAAAAARAEMAbwBtAG0AZQBuAHQAIABSAGUA ZgBlAHIAZQBuAGMAZQAAAAQAQ0oQAEIA/g8RAOICQgAMAAAAAAAAAAAACQBSAGUAZgBfAHQA aQB0AGwAZQAAABUALQAPhAAAEYQAAEAmCV6EAABghAAAAAAANAD+TwEA4gI0AAwQAAAAAAAA AAAIAFIAZQBmAF8AdABlAHgAdAAAAAoALgBehBoDYITm/AAAPgD+DwEAAgM+AAwAAAAAAAAA AAAGAEEAcgB0AF8ATgBvAAAADwAvAAUkAQYkAROk4AFhJAEABwA7CIFDShwAAEQA/g8BAEIC RAAMAAAAAAAAAAAACQBBAHIAdABfAHQAaQB0AGwAZQAAAA8AMAAFJAEGJAETpPAAYSQBAAcA NQiBQ0ocAAAmAP4PogARAyYADAAAAAAAAAAAAAcAQQByAHQAXwByAGUAZgAAAAAAQgD+DwEA AgBCAAwAAAAAAAAAAAAEAEMAYQBsAGwAAAAbADIAE6TjABXGDgOnBDQGwQcZABkAGQAAXoQa AwADADYIgQBCAP4PAQAyAkIADAAAAAAAAAAAAAcAQwBoAGEAcABfAE4AbwAAAA8AMwAFJAEG JAETpOABYSQBAAoANQiBOwiBQ0ocAFoA/g8BAEIDWgAMAAAAAAAAAAAADwBFAHEAdQBhAHQA aQBvAG4AXwBsAGUAZwBlAG4AZAAAACIANAATpFAAFcYRAxoDpwQ0BhkAGQAZAAEWBwJehMEH YIQ/+AAANgD+D2EDAgA2AAwAAAAAAAAAAAANAEYAaQBnAHUAcgBlAF8AbABlAGcAZQBuAGQA AAACADUAAABYAP4PAQACAFgADAAAAAAAAAAAAAwAVABhAGIAbABlAF8AbABlAGcAZQBuAGQA AAAhADYABiQBE6RWABXGFQQaA6cENAbBBxkAGQAZABkAAcYBAAAEAENKEgAwAP4PAQACADAA DAAAAAAAAAAAAAYARgBpAGcAdQByAGUAAAAJADcAE6TwAGEkAQAAAEoA/g8BAEICSgAMAAAA AAAAAAAADgBGAGkAZwB1AHIAZQBfAE4AbwBUAGkAdABsAGUAAAAQADgABSQBE6TwABSkeABh JAEDADUIgQBSAP4PAQBCAlIADAAAAAAAAAAAABQARgBpAGcAdQByAGUAXwB3AGkAdABoAG8A dQB0AF8AdABpAHQAbABlAAAAEAA5AAUkAROk8AAUpHgAYSQBAABUAP4PAQCiA1QADAAAAAAA AAAAAAkARgBvAG8AdABlAHIAXwBRAFAAAAAkADoAE6QAABXGGwQaA6cENAbBBxkAGQAZABkA A4sDVSKnJQACAgMANQiBAEoA/g9xAbIDSgAMAAAAAAAAAAAACwBGAGkAcgBzAHQARgBvAG8A dABlAHIAAAAWADsAE6QoADUkATckATgkATlEBABIJAEDADsIgQCCAP5PAQDCA4IABAAAAAAA AAAAAAYARgBvAHIAbQBhAGwAAAA8ADwAE6QAABXGMAQaA6cENAbBBxkAGQAZABkACjcCbgSl BtwIEwtKDYEPuBHvEyYWAAAAAAAAAAAAAEckAB8AQ0oSAE9KBABRSgQAXkoEAGFKEgBtSAAE bkgABHUIAQBGAP5PAQACAEYADAAAAFRJ0AAAAAkASABlAGEAZABpAG4AZwBfAGIAAAAOAD0A E6S1AF6EGgNghOb8CwA1CIFPSgcAUUoHAAA0AP4PMQACADQADAAAAAAAAAAAAAkASABlAGEA ZABpAG4AZwBfAGkAAAACAD4ABgA1CIE2CIEuAAsAAQACAC4ADAEAAAAAAAAAAAcASQBuAGQA ZQB4ACAAMgAAAAYAPwBehBsBAAAuAAwAAQACAC4ADAEAAAAAAAAAAAcASQBuAGQAZQB4ACAA MwAAAAYAQABehDYCAABEAP4PAQAiBEQADAAAAAAAAAAAAAcAUABhAHIAdABfAE4AbwAAABMA QQAFJAEGJAETpOABFKRQAGEkAQAHADsIgUNKHAAAOgD+DwEAMgQ6AAwAAAAAAAAAAAAIAFAA YQByAHQAXwByAGUAZgAAAA8AQgAFJAEGJAETpBgBYSQBAAAASgD+DwEAQgJKAAwAAAAAAAAA AAAKAFAAYQByAHQAXwB0AGkAdABsAGUAAAATAEMABSQBBiQBE6TwABSkGAFhJAEABwA1CIFD ShwAAFIA/g8BAEICUgAMAAAAAAAAAAAACABSAGUAYwBfAGQAYQB0AGUAAAAgAEQABSQBBiQB FcYSBBoDpwQ0BsEHGQAZABkAGQAAYSQCBwA2CIFDShYAADYA/g9BBEICNgAMAAAAAAAAAAAA DQBRAHUAZQBzAHQAaQBvAG4AXwBkAGEAdABlAAAAAgBFAAAAPgD+TwEAcgQ+AAwAAAAAAAAA AAAGAFIAZQBjAF8ATgBvAAAADABGAAUkAQYkAROkAAALADUIgU9KBwBRSgcAADoAPkABAAIA OgAMEAAAAAAAAAAABQBUAGkAdABsAGUAAAANAEcAE6RIAxSk4AFhJAEABwA1CIFDShgAADIA /g9hBJIEMgAMAAAAAAAAAAAACwBRAHUAZQBzAHQAaQBvAG4AXwBOAG8AAAACAEgAAAA4AP4P oQTCBDgADAAAAAAAAAAAAA4AUQB1AGUAcwB0AGkAbwBuAF8AdABpAHQAbABlAAAAAgBJAAAA TAD+TwEAsgRMAAwAAACCNSMAAAAJAFIAZQBjAF8AdABpAHQAbABlAAAADwBKAAUkAQYkAROk 8ABhJAEADwA1CIFDShgAT0oHAFFKBwAARgD+DwEAEgBGAAwAAAAAAAAAAAAHAFIAZQBjAF8A cgBlAGYAAAAaAEsAFcYSBBoDpwQ0BsEHGQAZABkAGQAAYSQBAwA2CIEANAD+D7EEUgQ0AAwA AAAAAAAAAAAMAFEAdQBlAHMAdABpAG8AbgBfAHIAZQBmAAAAAgBMAAAALAD+D0EEQgIsAAwA AAAAAAAAAAAIAFIAZQBwAF8AZABhAHQAZQAAAAIATQAAACgA/g9hBPIEKAAMAAAAAAAAAAAA BgBSAGUAcABfAE4AbwAAAAIATgAAAC4A/g+hBAIFLgAMAAAAAAAAAAAACQBSAGUAcABfAHQA aQB0AGwAZQAAAAIATwAAACoA/g+xBNIEKgAMAAAAAAAAAAAABwBSAGUAcABfAHIAZQBmAAAA AgBQAAAALAD+D0EEQgIsAAwAAAAAAAAAAAAIAFIAZQBzAF8AZABhAHQAZQAAAAIAUQAAADIA /i/y/yEFMgAMAAAAAAAAAAAABwBSAGUAcwBfAGQAZQBmAAAACwA1CIFPSgAAUUoAAAAoAP4P YQRCBSgADAAAAAAAAAAAAAYAUgBlAHMAXwBOAG8AAAACAFMAAAAuAP4PoQRSBS4ADAAAAAAA AAAAAAkAUgBlAHMAXwB0AGkAdABsAGUAAAACAFQAAAAqAP4PsQQSBSoADAAAAAAAAAAAAAcA UgBlAHMAXwByAGUAZgAAAAIAVQAAAE4A/g8BAAIATgAMAAAAAAAAAAAACQBTAGUAYwB0AGkA bwBuAF8AMQAAAB4AVgATpHACFcYSBBoDpwQ0BsEHGQAZABkAGQAAYSQBAwA1CIEATgD+DwEA AgBOAAwAAAAAAAAAAAAJAFMAZQBjAHQAaQBvAG4AXwAyAAAAHgBXABOk8AAVxhIEGgOnBDQG wQcZABkAGQAZAABhJAEDADYIgQBKAP4PAQCSBUoADAAAAAAAAAAAAAoAUwBlAGMAdABpAG8A bgBfAE4AbwAAABMAWAAFJAEGJAETpOABFKRQAGEkAQAHADsIgUNKGAAAZAD+DwEAkgVkAAwA AAAAAAAAAAANAFMAZQBjAHQAaQBvAG4AXwB0AGkAdABsAGUAAAAbAFkAFcYSBBoDpwQ0BsEH GQAZABkAGQAAXoSKBQAUAENKIABPSgIAUUoCAG1ICQRzSAkEPAD+DwEAQgI8AAwAAAAAAAAA AAAGAFMAbwB1AHIAYwBlAAAADQBaABOkSAMUpMgAYSQBAAcANQiBQ0ocAABQAP4PcQGyBVAA DAAAAAAAAAAAAA4AUwBwAGUAYwBpAGEAbAAgAEYAbwBvAHQAZQByAAAAFgBbABXGEQAFNwJu BKUG3AgTCwAAAAAAAwA7CIEAOAD+L/L/wQU4AAwAAAAAAAAAAAAKAFQAYQBiAGwAZQBfAGYA cgBlAHEAAAAMADUIgUIqAHBoAAAA/34A/g/hBeIFfgAEAAAAAAAAAAAACgBUAGEAYgBsAGUA XwBoAGUAYQBkAAAAQgBdAAUkABJk8AABABOkUAAUpFAAFcYpAA0cATcCUwNuBIoFpQbcCPgJ EwsvDEoNZg6BDwAAAAAAAAAAAAAAAABhJAEOADUIgW1IAARuSAAEdQgBTgD+D2ED4gVOAAwA AAAAAAAAAAAKAFQAYQBiAGwAZQBfAHQAZQB4AHQAAAAfAF4ABSQBBiQAEmRC/wAAE6QoABSk KAAVxgYBxgEZAAAAAAA0AB4AAQDyBTQADAGKAAAAAAAAAAwAQwBvAG0AbQBlAG4AdAAgAFQA ZQB4AHQAAAACAF8AAABMAP4PAQDSBUwADAAAAAAAAAAAAA0AVABhAGIAbABlAF8ATgBvAFQA aQB0AGwAZQAAABMAYAAFJAEGJAETpGgBFKR4AGEkAQADADUIgQBcAP4PoQUiBlwADAAAAAAA AAAAAAcAVABpAHQAbABlACAAMQAAAC4AYQATpPAAFKQAABXGIQQaA6cENAbBBxkAGQAZABkA BTcCbgSlBtwIEwsAAAAAAAYANQiBOwiBKgD+DxEGMgYqAAwAAAAAAAAAAAAHAFQAaQB0AGwA ZQAgADIAAAACAGIAAAAuAP4PIQZCBi4ADAAAAAAAAAAAAAcAVABpAHQAbABlACAAMwAAAAIA YwADADsIgQAuAP4PMQYSAC4ADAAAAAAAAAAAAAcAVABpAHQAbABlACAANAAAAAIAZAADADUI gQBCAP4PAQBCAkIADAAAAAAAAAAAAAsAQQByAHQAXwBoAGUAYQBkAGkAbgBnAAAACQBlABOk 4AFhJAEABwA1CIFDShwAADYA/g8BAAIANgAMAAAAAAAAAAAACQBBAG4AbgBlAHgAXwByAGUA ZgAAAAkAZgATpAAAYSQBAAAANAD+D2EGQgI0AAwAAAAAAAAAAAAMAEEAcABwAGUAbgBkAGkA eABfAHIAZQBmAAAAAgBnAAAAOgD+DxECggY6AAQAAAAAAAAAAAAMAEEAUwBOAC4AMQBfAGkA dABhAGwAaQBjAAAAAgBoAAYANQiBNgiBVgD+DwEAkgZWAAwAAAAAAAAAAAAJAEMAbwB1AHYA XwBuAG8AdABlAAAAIQBpABOkyAAVxhgEGgOnBDQGwQcZABkAGQAZAAJuBIoFAAAACABPSgIA UUoCAFwA/g8BAKIGXAAMAAAAAAAAAAAACwBDAG8AdQB2AF8AcgBlAGMAXwBOAG8AAAAfAGoA E6QGABXGEgQaA6cENAbBBxkAGQAZABkAAF6EigUADABDSiAAT0oCAFFKAgBsAP4PAQCyBmwA DAAAAAAAAAAAAA4AQwBvAHUAdgBfAHIAZQBjAF8AdABpAHQAbABlAAAAJQBrAAUkAQYkAROk 8AAVxhIEGgOnBDQGwQcZABkAGQAZAABehIoFAA8ANQiBQ0okAE9KAgBRSgIAACQA/i/y/8EG JAAMAAAAAAAAAAAABABIAGUAYQBkAAAAAwA1CIEAKAD+L/L/0QYoAAwAAAAAAAAAAAAEAGgA cgBlAGYAAAAIAG1IDARzSAwEQgD+DwEA4gZCAAwAAAAAAAAAAAALAEkAbgBkAGUAeABfAHQA aQB0AGwAZQAAAAkAbgAUpEQAYSQBAAcANQiBQ0oYAAAuACgAogDxBi4ADAAAAAAAAAAAAAsA TABpAG4AZQAgAE4AdQBtAGIAZQByAAAAAABUAP5PAQACB1QADAAAAAAAAAAAABIATgBvAHIA bQBhAGwAIABhAGYAdABlAHIAIAB0AGkAdABsAGUAAAAGAHAAE6TgARAAT0oIAFFKCABtSAkE c0gJBDoAHAABABIHOgAMAAAAAAAAAAAADQBOAG8AcgBtAGEAbAAgAEkAbgBkAGUAbgB0AAAA BgBxAF6EWAIAAFAA/g8BACIHUAAMAAAAAAAAAAAABgBOAG8AdABlACAAMQAAACUAcgASZDn/ AAATpDwAFcYSBBoDpwQ0BsEHGQAZABkAGQAAXoQcAQAEAENKEgAsAP4PIQcyBywADACEAAAA AAAAAAYATgBvAHQAZQAgADIAAAAGAHMAXoQ1BAAALAD+DyEHQgcsAAwAAAAAAAAAAAAGAE4A bwB0AGUAIAAzAAAABgB0AF6EwgUAADoA/g8BAFIHOgAMAAAAAAAAAAAAAwBTAEEAUAAAAA0A dQATpMADFKTwAGEkAgAMAENKaABPSgkAUUoJAEwA/g8BAAIATAAMAAAAAAAAAAAACQBUAGEA YgBsAGUAXwBmAGkAbgAAABsAdgATpAAAFcYSBBoDpwQ0BsEHGQAZABkAGQAAAAQAQ0oMAEAA VWDy/3EHQAAMAAAAAAAAAAAADgBIAHkAcABlAHIAbABpAG4AawAsAIWNp37+lKVjAAAMAD4q AUIqAnBoAAD/AJIAmgCzAIMHkgAMAAAAdBUEAAAACgBUAGEAYgBsAGUAIABHAHIAaQBkAAAA NwA6VngAE9YwAAAA/wQBAAAAAAD/BAEAAAAAAP8EAQAAAAAA/wQBAAAAAAD/BAEAAAAAAP8E AQAAACoAeAATpIgAFcYOAAQaA6cENAbBBwAAAAA1JAA3JAA4JAA5RAIASCQAYSQDAABGAP5v 8v+RB0YADAAAAIpg5AAAAA8AQQBTAE4ALgAxACAAYgBvAGwAZAAgAGMAaABhAHIAAAAPADUI gUNKEgBPSgQAUUoEAABMAP4v8v+hB0wADAAAAIpg5AAAABEAQQBTAE4ALgAxACAASQB0AGEA bABpAGMAIABDAGgAYQByAAAAEgA1CIE2CIFDShIAT0oEAFFKBABSAP5PAQACAFIADAAAAAoi YAAAABAAQQBuAG4AZQB4AF8ATgBvACAAJgAgAHQAaQB0AGwAZQAAAA8AewAFJAEGJAETpOAB YSQBAAcANQiBQ0ocAABCAP5PsQcCAEIADAAAAAoiYAAAABMAQQBwAHAAZQBuAGQAaQB4AF8A TgBvACAAJgAgAHQAaQB0AGwAZQAAAAIAfAAAAEQA/m/y/9EHRAAMFAAAEQuAAAAACgBBAFMA TgAuADEAIAB0AGUAeAB0AAAAFwA1CIFDShIAT0oEAFFKBABtSAkEc0gJBABkAP5PwQHiB2QA DBCAAEY/9gAAAA4AQQBTAE4ALgAxACAAQwBvAG4AdABpAG4AdQBlAAAAFgB+AA+ENAYRhAAA E6QAAF6ENAZghAAAFwA1CIFDShIAT0oEAFFKBABtSAkEc0gJBABEAP4v8v/xB0QADAAcAEY/ 9gAAAAwAZQBuAHUAbQBsAGUAdgAxACAAQwBhAHIAAAAUAE9KAABRSgAAbUgJCHNICQh0SAkE WAD+b/L/AQhYAAwAfgBGP/YAAAASAEEAUwBOAC4AMQAgAEMAbwBuAHQAaQBuAHUAZQAgAEMA YQByAAAAGwA1CIFDShIAT0oEAFFKBABtSAkEc0gJBHRICQQAaAD+TxECEghoAAQAAAApFfsA AAAeAFMAdAB5AGwAZQAgAEEAUwBOAC4AMQAgACsAIABHAGEAdQBjAGgAZQCgADoAIAAgADIA NgA3ACAAYwBtAAAACgCBAA+E6gVehOoFCABeSgAAYUoUAGoA/g8RCCIIagAEAAAAKRX7AAAA JwBTAHQAeQBsAGUAIABBAFMATgAuADEAIAArACAATgBvAG4AIABHAHIAYQBzACAARwBhAHUA YwBoAGUAoAA6ACAAIAAyADYANwAgAGMAbQAAAAIAggAAAEIA/i/y/zEIQgAMAAAAMQdTAAAA DQBlAG4AdQBtAGwAZQB2ADEAIABDAGgAYQByAAAAEABPSgAAUEoAAFFKAAB0SAkERgD+L/L/ QQhGAAwAcwAxB1MAAAALAE4AbwB0AGUAIAAyACAAQwBoAGEAcgAAABgAQ0oSAE9KAABRSgAA bUgJCHNICQh0SAkESgD+TwEAUghKAAwAhgBGWh8AAAAJAEQAbwBjAG4AdQBtAGIAZQByAAAA DACFAAMkAhOkeABhJAISADUIgUNKKABcCIFtSAAAc0gAAEoA/i/y/2EISgAMAIUARlofAAAA DgBEAG8AYwBuAHUAbQBiAGUAcgAgAEMAaABhAHIAAAAWADUIgUNKKABPSgAAUUoAAFwIgXRI CQRMAJkAAQByCEwADASIACZpkgAAAAwAQgBhAGwAbABvAG8AbgAgAFQAZQB4AHQAAAAGAIcA E6QAABQAQ0oQAE9KCgBRSgoAXkoKAGFKEABWAP4v8v+BCFYADACHACZpkgAAABEAQgBhAGwA bABvAG8AbgAgAFQAZQB4AHQAIABDAGgAYQByAAAAHABDShAAT0oKAFFKCgBeSgoAYUoQAG1I CQhzSAkIQABqAPEF8gVAAAwEAAA9ASAAAAAPAEMAbwBtAG0AZQBuAHQAIABTAHUAYgBqAGUA YwB0AAAAAgCJAAYANQiBXAiBSgD+L/L/oQhKAAwBXwA9ASAAAAARAEMAbwBtAG0AZQBuAHQA IABUAGUAeAB0ACAAQwBoAGEAcgAAABAAT0oAAFFKAABtSAkIc0gJCEAA/g+iCLEIQAAMAIkA PQEgAAAAFABDAG8AbQBtAGUAbgB0ACAAUwB1AGIAagBlAGMAdAAgAEMAaABhAHIAAAAAAEYA ViDy/8EIRgAMBAAArQdHAAAAEQBGAG8AbABsAG8AdwBlAGQASAB5AHAAZQByAGwAaQBuAGsA AAAMAD4qAUIqAHBolU9yAEQAsiDx/9IIRAAOBQAAHF/CADAGCABSAGUAdgBpAHMAaQBvAG4A AAACAI0AGABPSgAAUUoAAF9IAQRtSAkIc0gJCHRICQRQSwMEFAAGAAgAAAAhAOneD7//AAAA HAIAABMAAABbQ29udGVudF9UeXBlc10ueG1srJHLTsMwEEX3SPyD5S1KnLJACCXpgseOx6J8 wMiZJBbJ2LKnVfv3TNJUQqggFmws2TP3njvjcr0fB7XDmJynSq/yQisk6xtHXaXfN0/ZrVaJ gRoYPGGlD5j0ur68KDeHgEmJmlKle+ZwZ0yyPY6Qch+QpNL6OALLNXYmgP2ADs11UdwY64mR OOPJQ9flA7awHVg97uX5mCTikLS6PzZOrEpDCIOzwJLU7Kj5RskWQi7KuSf1LqQriaHNWcJU +Rmw6F5lNdE1qN4g8guMEsOwDIlfz2cgGS3mvzueiezb1llsvN2Oso58Nl7MTsH/FGD1P+gT 08x/W38CAAD//wMAUEsDBBQABgAIAAAAIQCl1qfnwAAAADYBAAALAAAAX3JlbHMvLnJlbHOE j89qwzAMh++FvYPRfVHSwxgldi+lkEMvo30A4Sh/aCIb2xvr20/HBgq7CISk7/epPf6ui/nh lOcgFpqqBsPiQz/LaOF2Pb9/gsmFpKclCFt4cIaje9u1X7xQ0aM8zTEbpUi2MJUSD4jZT7xS rkJk0ckQ0kpF2zRiJH+nkXFf1x+YnhngNkzT9RZS1zdgro+oyf+zwzDMnk/Bf68s5UUEbjeU TGnkYqGoL+NTvZCoZarUHtC1uPnW/QEAAP//AwBQSwMEFAAGAAgAAAAhAGt5lhaDAAAAigAA ABwAAAB0aGVtZS90aGVtZS90aGVtZU1hbmFnZXIueG1sDMxNCsMgEEDhfaF3kNk3Y7soRWKy y6679gBDnBpBx6DSn9vX5eODN87fFNWbSw1ZLJwHDYplzS6It/B8LKcbqNpIHMUsbOHHFebp eBjJtI0T30nIc1F9I9WQha213SDWtSvVIe8s3V65JGo9i0dX6NP3KeJF6ysmCgI4/QEAAP// AwBQSwMEFAAGAAgAAAAhAKpSJd/GBgAAixoAABYAAAB0aGVtZS90aGVtZS90aGVtZTEueG1s 7Fldi9tGFH0v9D8IvTv+kvyxxBts2c622U1C7KTkcWyPrcmONEYz3o0JgZI8FgqlaelDA33r Q2kbSKAv6a/ZNqVNIX+hd0a2PGOPu5slhaVkDYs0OvfOmXuvzh1Jl6/cj6hzhBNOWNxwi5cK roPjIRuReNJwb/e7uZrrcIHiEaIsxg13jrl7ZffDDy6jHRHiCDtgH/Md1HBDIaY7+TwfwjDi l9gUx3BtzJIICThNJvlRgo7Bb0TzpUKhko8QiV0nRhG4vTEekyF2+tKlu7t03qFwGgsuB4Y0 6UnX2LBQ2NFhUSL4nAc0cY4Qbbgwz4gd9/F94ToUcQEXGm5B/bn53ct5tLMwomKLrWbXVX8L u4XB6LCk5kwmg2xSz/O9SjPzrwBUbOI61U6lU8n8KQAaDmGlKRfdp9+qt9r+AquB0kOL73a1 XS4aeM1/eYNz05c/A69AqX9vA9/tBhBFA69AKd7fwHtetRR4Bl6BUnxlA18tNNte1cArUEhJ fLiBLviVcrBcbQYZM7pnhdd9r1stLZyvUFANWXXJKcYsFttqLUL3WNIFgARSJEjsiPkUj9EQ qjhAlAwS4uyTSQiFN0Ux4zBcKBW6hTL8lz9PHamIoB2MNGvJC5jwjSHJx+HDhExFw/0YvLoa 5M3LH9+8fO6cPHpx8uiXk8ePTx79nDoyrPZQPNGtXn//xd9PP3X+ev7d6ydf2fFcx//+02e/ /fqlHQgrXYXg1dfP/njx7NU3n//5wxMLvJmggQ7vkwhz5zo+dm6xCBamQmAyx4Pk7Sz6ISK6 RTOecBQjOYvFf0eEBvr6HFFkwbWwGcE7CUiMDXh1ds8g3AuTmSAWj9fCyAAeMEZbLLFG4Zqc SwtzfxZP7JMnMx13C6Ej29wBio38dmZT0FZicxmE2KB5k6JYoAmOsXDkNXaIsWV1dwkx4npA hgnjbCycu8RpIWINSZ8MjGpaGe2RCPIytxGEfBuxObjjtBi1rbqNj0wk3BWIWsj3MTXCeBXN BIpsLvsoonrA95EIbSR782So4zpcQKYnmDKnM8Kc22xuJLBeLenXQF7saT+g88hEJoIc2nzu I8Z0ZJsdBiGKpjZsj8Shjv2IH0KJIucmEzb4ATPvEHkOeUDx1nTfIdhI9+lqcBuUVae0KhB5 ZZZYcnkVM6N+e3M6RlhJDQi/oecRiU8V9zVZ9/9bWQchffXtU8uqLqqgNxNivaP21mR8G25d vAOWjMjF1+42msU3Mdwumw3svXS/l273fy/d2+7ndy/YK40G+ZZbxXSrrjbu0dZ9+5hQ2hNz ive52rpz6EyjLgxKO/XMirPnuGkIh/JOhgkM3CRBysZJmPiEiLAXoins74uudDLhC9cT7kwZ h22/Grb6lng6iw7YKH1cLRblo2kqHhyJ1XjBz8bhUUOk6Ep19QiWuVdsJ+pReUlA2r4NCW0y k0TZQqK6HJRBUg/mEDQLCbWyd8KibmFRk+6XqdpgAdSyrMDWyYENV8P1PTABI3iiQhSPZJ7S VC+zq5L5LjO9LZhGBcA+YlkBq0zXJdety5OrS0vtDJk2SGjlZpJQkVE9jIdohBfVKUfPQuNt c11fpdSgJ0Oh5oPSWtGo1v6NxXlzDXbr2kBjXSlo7Bw33ErZh5IZomnDHcNjPxxGU6gdLre8 iE7g3dlQJOkNfx5lmSZctBEP04Ar0UnVICICJw4lUcOVy8/SQGOlIYpbsQSCcGHJ1UFWLho5 SLqZZDwe46HQ066NyEinp6DwqVZYryrz84OlJZtBunvh6NgZ0FlyC0GJ+dWiDOCIcHj7U0yj OSLwOjMTslX9rTWmhezq7xNVDaXjiE5DtOgoupincCXlGR11lsVAO1usGQKqhWTRCAcT2WD1 oBrdNOsaKYetXfd0Ixk5TTRXPdNQFdk17SpmzLBsA2uxPF+T11gtQwyapnf4VLrXJbe+1Lq1 fULWJSDgWfwsXfcMDUGjtprMoCYZb8qw1OzFqNk7lgs8hdpZmoSm+pWl27W4ZT3COh0Mnqvz g9161cLQeLmvVJFW3z30TxNscA/Eow0vgWdUcJVK+PCQINgQ9dSeJJUNuEXui8WtAUfOLCEN 90HBb3pByQ9yhZrfyXllr5Cr+c1yrun75WLHLxbardJDaCwijIp++s2lC6+i6Hzx5UWNb3x9 iZZv2y4NWZRn6utKXhFXX1+Kpe1fXxwCovOgUurWy/VWJVcvN7s5r92q5epBpZVrV4Jqu9sO /Fq9+9B1jhTYa5YDr9Kp5SrFIMh5lYKkX6vnql6p1PSqzVrHaz5cbGNg5al8LGIB4VW8dv8B AAD//wMAUEsDBBQABgAIAAAAIQAN0ZCftgAAABsBAAAnAAAAdGhlbWUvdGhlbWUvX3JlbHMv dGhlbWVNYW5hZ2VyLnhtbC5yZWxzhI9NCsIwFIT3gncIb2/TuhCRJt2I0K3UA4TkNQ02PyRR 7O0NriwILodhvplpu5edyRNjMt4xaKoaCDrplXGawW247I5AUhZOidk7ZLBggo5vN+0VZ5FL KE0mJFIoLjGYcg4nSpOc0IpU+YCuOKOPVuQio6ZByLvQSPd1faDxmwF8xSS9YhB71QAZllCa /7P9OBqJZy8fFl3+UUFz2YUFKKLGzOAjm6pMBMpburrE3wAAAP//AwBQSwECLQAUAAYACAAA ACEA6d4Pv/8AAAAcAgAAEwAAAAAAAAAAAAAAAAAAAAAAW0NvbnRlbnRfVHlwZXNdLnhtbFBL AQItABQABgAIAAAAIQCl1qfnwAAAADYBAAALAAAAAAAAAAAAAAAAADABAABfcmVscy8ucmVs c1BLAQItABQABgAIAAAAIQBreZYWgwAAAIoAAAAcAAAAAAAAAAAAAAAAABkCAAB0aGVtZS90 aGVtZS90aGVtZU1hbmFnZXIueG1sUEsBAi0AFAAGAAgAAAAhAKpSJd/GBgAAixoAABYAAAAA AAAAAAAAAAAA1gIAAHRoZW1lL3RoZW1lL3RoZW1lMS54bWxQSwECLQAUAAYACAAAACEADdGQ n7YAAAAbAQAAJwAAAAAAAAAAAAAAAADQCQAAdGhlbWUvdGhlbWUvX3JlbHMvdGhlbWVNYW5h Z2VyLnhtbC5yZWxzUEsFBgAAAAAFAAUAXQEAAMsKAAAAADw/eG1sIHZlcnNpb249IjEuMCIg ZW5jb2Rpbmc9IlVURi04IiBzdGFuZGFsb25lPSJ5ZXMiPz4NCjxhOmNsck1hcCB4bWxuczph PSJodHRwOi8vc2NoZW1hcy5vcGVueG1sZm9ybWF0cy5vcmcvZHJhd2luZ21sLzIwMDYvbWFp biIgYmcxPSJsdDEiIHR4MT0iZGsxIiBiZzI9Imx0MiIgdHgyPSJkazIiIGFjY2VudDE9ImFj Y2VudDEiIGFjY2VudDI9ImFjY2VudDIiIGFjY2VudDM9ImFjY2VudDMiIGFjY2VudDQ9ImFj Y2VudDQiIGFjY2VudDU9ImFjY2VudDUiIGFjY2VudDY9ImFjY2VudDYiIGhsaW5rPSJobGlu ayIgZm9sSGxpbms9ImZvbEhsaW5rIi8+AAAAAPGDAQAfAAAyAwAAAP////8AAAAAFgAAABkA AAAZAAAAHAAAAB8AAAAfAAAAHwAAAGcAAABnAAAAZwAAAGcAAACLAgAAjgIAAAAIAACbCQAA rRIAAFMXAAARGgAAVCAAAHkjAAAVKAAA0ywAAKAvAADTMwAAdDUAAO03AAASPQAA10AAAGhD AAD5RAAABEkAAGtKAAAtTQAA5U8AAItRAAC+UgAAdFQAALJWAAClVwAA+FkAABFbAACcXAAA V14AAIhfAADaZQAAUm4AACZwAAANdAAAy3cAAAt5AACWewAAWH0AABl+AADwfwAA5YEAAJyD AACshAAAmYUAAASHAABtiQAAfosAAAiOAABKkQAAXpQAADqYAAA9mQAAjJoAABCeAABdnwAA xqEAAASnAADIqgAAwa8AAAayAAB7swAA5rYAAFS4AADfvAAAb8AAABjFAADexgAApMgAAITK AABtzgAAAtEAAErUAAAP2QAA+tsAAP/eAACb4wAAJ+gAAADrAADa8gAAd/cAAGL6AAACAAEA kgMBAOYFAQBNCQEAtAsBAFIPAQADEwEAgRUBAJgXAQBqGQEAJyABAK0lAQA4LAEALC8BAJE1 AQBzOAEAcT4BAP1CAQD8RQEAwEoBAO9OAQB7VQEAR1oBADZiAQBtZgEA728BAON0AQCDgQEA nIMBAHmFAQDChgEAr4cBAHqJAQB3igEA8YsBAMYAAADMAAAAzQAAAM8AAADRAAAA0wAAANUA AADXAAAA2QAAANsAAADcAAAA3QAAAN8AAADgAAAA4gAAAOQAAADlAAAA5wAAAOkAAADrAAAA 7AAAAO4AAADvAAAA8AAAAPIAAADzAAAA9QAAAPcAAAD4AAAA+QAAAPsAAAD8AAAA/gAAAP8A AAABAQAAAgEAAAMBAAAFAQAABwEAAAgBAAAKAQAACwEAAA0BAAAOAQAADwEAABABAAASAQAA FAEAABYBAAAXAQAAGAEAABsBAAAdAQAAHwEAACEBAAAjAQAAJQEAACcBAAAoAQAAKgEAACwB AAAuAQAALwEAADEBAAA1AQAANgEAADgBAAA5AQAAOgEAADwBAAA+AQAAQAEAAEIBAABEAQAA RQEAAEYBAABHAQAASQEAAEoBAABNAQAATgEAAE8BAABRAQAAUgEAAFMBAABVAQAAVwEAAFkB AABbAQAAXAEAAF4BAABfAQAAYgEAAGQBAABnAQAAaAEAAGsBAABtAQAAcAEAAHIBAAB0AQAA dgEAAHgBAAB8AQAAfgEAAIEBAACDAQAAhwEAAIkBAACOAQAAjwEAAJEBAACSAQAAkwEAAJUB AACXAQAAAAgAAIUIAAC6CAAA7ggAAB4JAAB0EgAArxgAAN4cAABrIQAAHCUAAH4pAABKLgAA AzcAAP48AAAWQgAA20YAAOVJAAAFTQAA1E8AAJtVAADiVwAAlloAAFdeAADmagAAD3EAADl5 AACsfAAAxX8AAD6DAAAWiAAABosAANONAABtlQAAe5cAAP2YAABpmgAA3psAACueAACxoAAA m6IAAGStAACdsAAArbIAAPm2AAB1uQAAfbsAANa8AAA3wwAA8MgAAHfNAACx0AAAdNMAAOTX AABh5gAAP+wAAMrxAABl/wAAlwYBAH8KAQAbDgEAWg8BAGYVAQCBGQEALh4BAGMiAQBDJwEA JisBAC8vAQC6MgEAczcBAMY6AQAHPQEAUkABANZEAQCfSAEADEwBACNPAQDIUgEA6VUBAENZ AQA2XQEAxWABAOFkAQDgaAEAMWwBAM5vAQDhcwEAZXcBAOJ6AQBHfgEALYEBAEmEAQBdiAEA +IkBAOyLAQDxiwEAxwAAAMgAAADJAAAAygAAAMsAAADOAAAA0AAAANIAAADUAAAA1gAAANgA AADaAAAA3gAAAOEAAADjAAAA5gAAAOgAAADqAAAA7QAAAPEAAAD0AAAA9gAAAPoAAAD9AAAA AAEAAAQBAAAGAQAACQEAAAwBAAARAQAAEwEAABUBAAAZAQAAGgEAABwBAAAeAQAAIAEAACIB AAAkAQAAJgEAACkBAAArAQAALQEAADABAAAyAQAAMwEAADQBAAA3AQAAOwEAAD0BAAA/AQAA QQEAAEMBAABIAQAASwEAAEwBAABQAQAAVAEAAFYBAABYAQAAWgEAAF0BAABgAQAAYQEAAGMB AABlAQAAZgEAAGkBAABqAQAAbAEAAG4BAABvAQAAcQEAAHMBAAB1AQAAdwEAAHkBAAB6AQAA ewEAAH0BAAB/AQAAgAEAAIIBAACEAQAAhQEAAIYBAACIAQAAigEAAIsBAACMAQAAjQEAAJAB AACUAQAAlgEAAJgBAABWIgAAcSIAAHQiAAD4KQAAEyoAABcqAAASNQAALTUAADE1AADeOgAA +ToAAP86AABoOwAAgzsAAIk7AADWOwAA8TsAAPc7AADYPAAA8zwAAPY8AAD3SAAAEkkAABdJ AABxSQAAjEkAAJFJAAA1VgAAUFYAAFNWAADcVgAA91YAAPxWAAAZVwAANFcAADlXAADsZAAA B2UAAAtlAAA3ZgAAUmYAAFZmAAC3awAA0msAANZrAAAIbgAAI24AACduAADSbwAA7W8AAPFv AAA2cAAAUXAAAFVwAAB9fQAAmH0AAJ59AAChfQAAvH0AAMJ9AADFfQAA4H0AAOZ9AADsfQAA B34AAA1+AABQfgAAa34AAHF+AACIfgAAo34AAKl+AADqfgAABX8AAAt/AACciwAAx4sAAMuL AADOoAAA6aAAAO2gAADEvgAA374AAOG+AAAsvwAAR78AAEu/AABmwgAAgcIAAIPCAAA20QAA UdEAAFXRAAAU0wAAL9MAADPTAADR1AAA7NQAAPHUAAAh1QAAPNUAAEHVAAB37wAAku8AAJfv AAC97wAA2O8AAN3vAAAG/gAAIf4AACb+AADxgwEAEwMU/5WAEwMU/5WAEwMU/5WAEwMU/5WA EwMU/5WAEwMU/5WAEwMU/5WAEwMU/5WAEwMU/5WAEwMU/5WAEwMU/5WAEwMU/5WAEwMU/5WA EwMU/5WAEwMU/5WAEwMU/5WAEwMU/5WAEwMU/5WAEwMU/5WAEwMU/5WAEwMU/5WAEwMU/5WA EwMU/5WAEwMU/5WAEwMU/5WAEwMU/5WEEwMU/5WAEwMU/5WAEwMU/5WAEwMU/5WAEwMU/5WA EwMU/5WAEwMU/5WAEwMU/5WAEwMU/5WAEwMU/5WAEwMU/5WAIQAAADgAAAA7AAAAPwAAAFYA AABkAAAAoAAAAN0AAAAFAQAAjgIAABMhFP+VgBMKFP+VgBNYFP8VhA8AAPBUAAAAAAAG8CAA AAABCAAAAwAAAAIAAAACAAAAAQAAAAIAAAACAAAAAQAAACMAC/AMAAAAhsEAAAAAxcEAAAAA QAAe8RAAAAD//wAAAAD/AICAgAD3AAAQAQ8AAvBIAAAAIAAI8AgAAAABAAAAAAgAAA8AA/Aw AAAADwAE8CgAAAABAAnwEAAAAAAAAAAAAAAAAAAAAAAAAAACAArwCAAAAAAIAAAFAAAAAA8A AvCSAAAAEAAI8AgAAAABAAAAAQQAAA8AA/AwAAAADwAE8CgAAAABAAnwEAAAAAAAAAAAAAAA AAAAAAAAAAACAArwCAAAAAAEAAAFAAAADwAE8EIAAAASAArwCAAAAAEEAAAADgAAUwAL8B4A AAC/AQAAEADLAQAAAAD/AQAACAAEAwkAAAA/AwEAAQAAABHwBAAAAAEAAAD//x4AAAAIAGQA dABhAGIAbABlAGEAdQADAGQAcwBnAAQAZABuAHUAbQAHAGQAbwByAGwAYQBuAGcACQBkAGIA bAB1AGUAcABpAG4AawAIAGQAbQBlAGUAdABpAG4AZwAGAGQAdABpAHQAbABlAAcAZABzAG8A dQByAGMAZQAHAGQAdABpAHQAbABlADEADQBfAFIAZQBmADMAOQA1ADYAMQA2ADIAMgA5AA0A XwBSAGUAZgAzADkANQA2ADAAOAA0ADUAMQANAF8AUgBlAGYAMwA5ADUANQA5ADMAMAAxADgA DQBfAFIAZQBmADMAOQA1ADUAOQA0ADEANQA4AA0AXwBSAGUAZgAzADkANQA1ADkANAA0ADcA OAANAF8AUgBlAGYAMwA5ADUANgAxADYANgA1ADYADQBfAFIAZQBmADMAOQA1ADYAMQA5ADYA MwA0AA0AXwBSAGUAZgAzADkANQA2ADEANgA1ADEANQANAF8AUgBlAGYAMwA5ADUANgAwADYA OQA2ADUADQBfAFIAZQBmADMAOQA1ADYAMAA5ADkAMAA3AA0AXwBSAGUAZgAzADkANQA2ADAA OQA5ADMAMQANAF8AUgBlAGYAMwA5ADUANgAwADkAOQA1ADYADQBfAFIAZQBmADMAOQA1ADYA MAA5ADkANwA4AA0AXwBSAGUAZgAzADkANQA2ADEAMwAyADEAMQANAF8AUgBlAGYAMwA5ADUA NgAxADUANQAzADEADQBfAFIAZQBmADMAOQA1ADUAOQAzADEAMgA2AA0AXwBSAGUAZgAzADkA NQA1ADkANwAxADcANgANAF8AUgBlAGYAMwA5ADUANQA5ADcAMgA2ADQADQBfAFIAZQBmADMA OQA1ADYAOAA0ADkAMwA1AAgAZABjAG8AbgB0AGEAYwB0AAkAZABjAG8AbgB0AGUAbgB0ADEA AAAAAAAAAAA2AAAAhgAAAKcAAACnAAAA1AAAAO4AAAD+AAAAciEAAOojAADjNQAACDcAAJxU AAAQYAAA72YAAI9wAAAHfQAA938AAA6MAABkpQAAe6wAAHW4AAA3uwAALQABAOkGAQASCAEA BxABAMuBAQDLgQEA8oMBAAcAAAAAAAGCAQABggIAAYIDAAGCBAACgwUAAIEGAAGCCAABggkA AAAKAAAACwAAAAwAAAANAAAADgAAAA8AAAAQAAAAEQAAABIAAAATAAAAFAAAABUAAAAWAAAA FwAAABgAAAAZAAAAGgAAABsAAAAcAAAAHQABgjYAAACGAAAApwAAANQAAADUAAAA7gAAAP4A AAAdAQAAHQEAAH0hAAD9IwAAAzYAABw3AACxVAAAHmAAAAVnAADmcAAAHX0AABWAAAAsjAAA faUAAJmsAACPuAAATbsAADcAAQD+BgEAKQgBACEQAQBtggEAbYIBAPKDAQAAAAAABQEAAAoB AAA2AQAAOQEAAFEBAABUAQAAVwEAAGsBAABsAQAAdAEAADsEAABHBAAAAQUAABIFAAAzBQAA PwUAAEEFAABOBQAAUAUAAF0FAABfBQAAbgUAAHAFAAB6BQAA9QUAAAAGAACYDwAApA8AAHAQ AAB5EAAAehAAAIYQAACHEAAAkhAAAJMQAACeEAAAnxAAAKkQAACqEAAArhAAAOUQAADxEAAA yxMAANYTAAAOFAAAGhQAALwUAADCFAAAyhQAAM4UAAAzFQAAORUAAEIVAABGFQAAshUAALgV AADBFQAAxRUAADEWAAA3FgAAQBYAAEQWAACwFgAAthYAAL8WAADDFgAAMhcAADgXAABBFwAA RRcAAFMXAABYFwAAXRcAAF8XAABqFwAAdRcAAMYXAADJFwAAzxcAANsXAABUGAAAXxgAAGAY AABwGAAAchgAAHwYAACVGAAApxgAAKkYAACzGAAAthgAAMEYAAD/GQAAARoAAAkaAAAWGgAA GRoAACkaAAAtGgAAPBoAAD8aAABPGgAAUhoAAGYaAABpGgAAexoAAH8bAACMGwAA5RsAAPEb AABLHAAAWBwAALkcAAC7HAAAvBwAAMQcAAAiHQAAMR0AAHAdAAB6HQAAfB0AAIYdAACIHQAA lR0AAJcdAACsHQAArh0AAMMdAADFHQAA1R0AANcdAADsHQAA7h0AAPodAAD8HQAACR4AAAse AAAcHgAAHh4AAC0eAAAvHgAAPh4AAAkgAAATIAAAhyAAAIkgAABsIQAAbyEAAD0iAAB2IgAA dyIAAIUiAADTIwAA3SMAAO4jAAD4IwAAAiQAAAwkAABUJAAAXiQAAGAkAABwJAAAeiQAAJMk AACVJAAApSQAAKckAAC+JAAA/yQAAA0lAAAZJQAAHSUAAFElAABmJQAAeCUAAIMlAACGJQAA kSUAAPMlAAD9JQAAoiYAALMmAADTJgAA1yYAAC4nAABCJwAAuicAAMsnAAD4JwAAAigAAEQo AABUKAAAZygAAHMoAADTKAAA4ygAAOIpAADyKQAA8ykAABkqAAAaKgAAJyoAAJQrAACiKwAA 1SsAAOMrAAD0KwAABSwAAAYsAAAXLAAAmywAALEsAADILAAA2SwAAJAtAACkLQAALC8AADsv AAA8LwAATi8AAFUvAABpLwAAcC8AAHkvAAB7LwAAjy8AAJYvAACqLwAArS8AALwvAAD3LwAA +y8AAHMxAACIMQAAIjIAACUyAAAoMgAANzIAAFwyAAB1MgAAgDIAAIMyAACfMgAArjIAABw0 AAAuNAAALzQAAEM0AABLNAAAYjQAAGk0AAB1NAAAdzQAAI00AACVNAAArDQAAK80AADBNAAA ATUAAAw1AAANNQAAMzUAADQ1AABKNQAA5zUAAP41AAAINgAAHzYAAGM2AABvNgAAcDYAAIA2 AACCNgAAjDYAAJA2AACYNgAAxDYAANY2AADdNgAA5zYAAOo2AAD2NgAADDcAABc3AAAhNwAA LDcAAIw3AACWNwAAcTgAAIg4AACwOAAAujgAAPo4AAAEOQAABjkAAAk5AAANOQAAHTkAAB85 AAAuOQAALzkAAEg5AABKOQAAVTkAAGQ5AAB0OQAAfzkAAJE5AACSOQAArjkAALs5AADJOQAA yzkAANg5AADmOQAA8DkAAPI5AAAEOgAAOjoAAEQ6AACWOgAAmToAAKM6AAC4OgAAxToAAAE7 AAADOwAAFDsAACE7AAAkOwAALjsAAEI7AABPOwAAizsAAI07AACeOwAAqTsAAKw7AAC8OwAA +TsAAP07AAAMPAAAwDwAAPg8AACVPQAAmz0AAKk9AAC2PQAAtz0AAMM9AAAGPgAADD4AABM+ AAAgPgAAbz4AAIE+AADcPgAA7D4AABw/AAArPwAAdUAAAIdAAACJQAAAlUAAAJxAAACmQAAA uEAAAL5AAADHQAAA00AAANZAAADfQAAABUEAADNBAAA1QgAAREIAAHJCAAB1QgAAdkIAAHlC AACjQgAApkIAAKxCAACwQgAAtEIAAMFCAADFQgAAzUIAAC1DAAA8QwAAakMAAG1DAABuQwAA cUMAAJtDAACeQwAApEMAAKhDAACsQwAAuUMAAL1DAADFQwAAJEQAADNEAABhRAAAZEQAAGVE AABoRAAAkkQAAJVEAACcRAAAoEQAAKREAACxRAAAtUQAAL1EAAAcRQAAK0UAAFlFAABcRQAA XUUAAGBFAACKRQAAjUUAAJNFAACXRQAAm0UAAKhFAACsRQAAtEUAABtGAAAqRgAAXEYAAF9G AABgRgAAY0YAAI1GAACQRgAAlkYAAJpGAACeRgAAq0YAAK9GAAC3RgAAI0cAADJHAABkRwAA Z0cAAGhHAABrRwAAlUcAAJhHAACeRwAAokcAAKZHAACzRwAAt0cAAL9HAADXRwAA4kcAADZI AABCSAAARkgAAF1IAACRSAAAnEgAAONIAAAZSQAAGkkAAChJAAAsSQAAOEkAAEJJAABZSQAA W0kAAJNJAACUSQAApkkAALFKAAC6SgAA7koAAPZKAAD4SgAABUsAAAdLAAAPSwAAFEsAAB5L AAAmSwAANUsAADdLAAA/SwAAQksAAEpLAABUSwAAZ0sAAKdLAACySwAAuEsAAMVLAADLSwAA 1ksAAOJLAAD0SwAAjEwAAKFMAAAgTwAAJk8AAJJPAACnTwAA5E8AAOxPAAD5TwAA/08AAA1Q AAAaUAAAG1AAACdQAAA6UAAAQlAAAENQAABLUAAAWFAAAGJQAACaUAAAolAAALZQAAC8UAAA w1AAANBQAADkUAAA7FAAAP5QAAAIUQAAOFEAADtRAABDUQAAT1EAAGNRAABpUQAAuFEAAMlR AADLUQAA3FEAAORRAADvUQAA8VEAAPhRAAAhUgAAJFIAADlTAABGUwAAWVQAAF1UAAB4VAAA flQAAIdUAACLVAAAZ1UAAHxVAAB/VQAAlFUAAJtVAAC5VQAAulUAANFVAAAoVgAAVVYAAMRW AAD+VgAA/1YAADtXAAA8VwAAR1cAAIhXAADFVwAA8lcAAPpXAADVWAAA3VgAAO9YAAD/WAAA D1kAABdZAAA3WgAAQloAALBaAAC4WgAAyloAANpaAABqWwAAdVsAAHZfAACAXwAA518AAPNf AAD3XwAADmAAANNkAAANZQAAu2UAAMhlAAAeZgAAWGYAAG1mAAB6ZgAA82YAAABnAAAuZwAA OGcAADpnAABIZwAAWGcAAGZnAABxZwAAf2cAAIJnAACQZwAAkmcAAKZnAACoZwAAvGcAAMhn AADYZwAA9GcAABtoAABEaAAAUWgAAKFoAACvaAAAEmkAACBpAACRaQAAn2kAAP1pAAALagAA KGoAADVqAABJagAATWoAAFVqAABYagAAgmoAAJBqAACfagAAr2oAAMJqAADPagAAMGsAAD5r AACdawAA2GsAANlrAADuawAAXmwAAGxsAAB4bAAAfGwAAKpsAAC/bAAA2W0AAOdtAAD2bQAA KG4AACxuAAAwbgAAnG8AALFvAADAbwAA8m8AAPVvAAADcAAAF3AAAFdwAACPcAAAo3AAAAxx AAAXcQAAGXEAAClxAAArcQAANXEAADpxAABUcQAAWXEAAH1xAACAcQAAkHEAAKxxAAC+cQAA xXEAAM9xAADScQAA3XEAAEJyAABfcgAAlXIAAKpyAADLdQAA9XUAAAF3AAAOdwAApXoAAL56 AABffAAAeXwAAHp8AAB8fAAAgHwAAI58AACXfAAArHwAAAt9AAAYfQAAIn0AAC99AABofQAA n30AAL19AAAOfgAAPX4AAHN+AAB1fgAAq34AAKx+AADGfgAA1X4AAA1/AAAOfwAAGX8AADV/ AAA5fwAARH8AAFl/AABlfwAAaX8AAG9/AACEfwAAjn8AAJN/AACYfwAAqH8AALF/AAC1fwAA u38AANB/AADUfwAA138AAN5/AADwfwAA+38AABCAAACygAAAvIAAAN+AAADygAAA9IAAAAqB AAAMgQAAH4EAADOBAABLgQAAT4EAAFuBAABegQAAaoEAAEuDAAB9gwAAgoMAAJKDAAAphgAA PoYAAD+GAABUhgAAYIYAAHSGAAB5hgAAjYYAAO+GAAAEhwAAFIcAACeHAABghwAAdIcAAISH AACXhwAApYgAAK2IAADliAAA9IgAADaJAABKiQAAi4kAAJ+JAACiigAAtYoAAOSKAAD6igAA z4sAANuLAAASjAAAJ4wAAGGMAAB2jAAAF40AACGNAABSjQAAa40AAG2NAABwjQAAg40AAJWN AACgjQAAto0AALiNAADLjQAA3Y0AAPWNAAD5jQAAD44AABGOAAAnjgAAeJAAAICQAACFkAAA jZAAAMaRAAD0kQAA75QAAASVAAAFlQAAGpUAAByVAAAwlQAANZUAAEmVAABLlQAAWJUAAF2V AABwlQAAoZUAALSVAADDlQAA05UAANeVAADglQAAc5cAAJ6XAACLmQAAppkAAKiZAAC0mQAA tpkAAMKZAADvmQAABJoAAAWaAAAamgAAHJoAACKaAAAwmgAARpoAAHCaAACEmgAAhZoAAJma AACgmgAAr5oAAMCaAADRmgAAR5sAAFCbAABSmwAAY5sAAGWbAAB7mwAAf5sAAIabAACKmwAA nZsAAJ+bAAC1mwAAuJsAAMGbAACRnAAAppwAAPacAAACnQAABJ0AABidAACmnQAAup0AAI6e AACbngAAPp8AAEGfAAD/nwAAAqAAAECgAABWoAAAuqAAAO6gAADwoAAABqEAAHehAACDoQAA z6EAAOShAACjogAAr6IAAMKiAADIogAAF6MAACujAAB2owAAiqMAAGilAAB4pQAAgqUAAJKl AACBpgAAi6YAAKGmAACmpgAAp6YAALSmAAC2pgAAzKYAAM2mAADtpgAA76YAAPumAAD8pgAA CKcAACmnAAA2pwAASqcAAFmnAABqpwAAe6cAAOmnAAAQqAAAZaoAAIOqAADyqgAA96oAAG6r AAB7qwAAk6sAAKCrAAB/rAAAlKwAAJ6sAACzrAAAD60AACStAACfrQAAqa0AAMCtAADWrQAA 260AAPutAAAGrgAAHK4AAB2uAAA9rgAAP64AAEuuAABMrgAAWK4AAKeuAAC4rgAAtbIAANWy AAD9tAAAE7UAAMW1AADItQAAy7UAAOG1AABEtgAAULYAAHy2AACOtgAAmLYAAKq2AADxtgAA A7cAACm3AAAwtwAAY7cAAGu3AAC+twAAxbcAAMm3AADctwAA3rcAAPW3AAD5twAAAbgAAAS4 AAAZuAAAG7gAADK4AAA1uAAAPLgAAPq6AAAKuwAAHLsAADC7AADWuwAA67sAAO27AAACvAAA BLwAABS8AAAWvAAAK7wAAOK8AADuvAAAGr0AACS9AAAmvQAANb0AADe9AABQvQAAUr0AAGK9 AABkvQAAe70AAIa9AACMvQAAJb4AADS+AACtvgAAt74AALi+AADjvgAA5L4AAPS+AAAEvwAA D78AABi/AABNvwAAqcAAALbAAADkwAAA7sAAAPDAAAAEwQAABsEAABrBAAAmwQAANsEAAFLB AABnwQAAucEAAMnBAADowQAA+MEAAA/CAAAjwgAAS8IAAFjCAABZwgAAhcIAAIfCAACXwgAA m8IAAJzCAABrwwAAfMMAAKPDAABBxAAAUMQAAFbEAABvxAAAesQAAIrEAACMxAAAo8QAAKXE AACuxAAAvsQAAMzEAADexAAA98QAAPnEAAAExQAAE8UAACPFAABkxQAAdMUAAL/FAADKxQAA 0cUAAOrFAAAyxgAARMYAAB3HAAA1xwAA08cAANnHAADxxwAA/scAAATIAAAQyAAAP8gAAEjI AACVyAAAm8gAAKLIAACvyAAA0sgAANvIAABPyQAAVMkAABrKAAAdygAAOMoAAD7KAABHygAA VsoAADPLAAA2ywAAUcsAAFfLAABgywAAb8sAAErMAABLzAAATcwAAFDMAABrzAAAccwAAHrM AACJzAAAZs0AAGnNAACEzQAAis0AAJPNAACizQAABs4AABfOAABezgAAbM4AANfOAADlzgAA YM8AAG7PAAAR0AAAH9AAANrQAABX0QAAWdEAADTTAAA20wAA89QAAPTUAABD1QAARdUAAMvd AABM3gAAVd4AAGXeAABx3gAAed4AAIneAADY3gAA4d4AAO3eAAD43gAAAt8AAA3fAAAd3wAA Kd8AAFLfAABe3wAA2t8AAObfAAAU4AAAH+AAAD3gAABI4AAASuAAAFXgAACR4AAAnOAAAJ7g AACp4AAAAuEAAAvhAABL4QAAWuEAAGDhAABv4QAAcuEAAH7hAACI4QAAkuEAAJThAACk4QAA rOEAAMXhAADH4QAA1+EAANjhAADv4QAA8eEAAP3hAAAs4gAAOuIAAEbiAABK4gAAe+IAAJDi AACc4gAArOIAAK3iAAC94gAAL+MAAD/jAAAD5AAAD+QAAD/kAABP5AAAEOUAABzlAAC75QAA v+UAAETmAABQ5gAAJOcAADTnAABM5wAAV+cAAHLnAACB5wAAr+cAALnnAAC75wAAv+cAAMLn AADQ5wAA0ucAAOHnAADm5wAA/+cAAAroAAAV6AAAG+gAACvoAAA26AAASOgAAEnoAABl6AAA cugAAIDoAACC6AAAj+gAAKDoAACy6AAA5egAAPboAAAC6QAAE+kAADXpAABK6QAAS+kAAGDp AABi6QAAdukAAHvpAACP6QAAkekAAJnpAACg6QAAqOkAAATqAAAI6gAAIeoAAC3qAADa6gAA 3uoAACTrAAA56wAA3esAAOXrAADx6wAAAewAAAbsAAAW7AAAJewAADnsAABZ7AAAbewAAH7s AACS7AAAYe0AAGntAACZ7QAAqO0AAPrtAAAF7gAAbu4AAHnuAADN7gAA2e4AAOHuAAD47gAA LO8AADfvAABe7wAAme8AAJrvAADf7wAA4O8AAOvvAABa8AAAbPAAALTwAADC8AAA8fAAAP7w AAAr8QAAN/EAAETxAABP8QAAofEAALPxAADB8QAA0PEAAHDyAAB/8gAAhfIAAI7yAACu8gAA vvIAAP3yAAAP8wAAHfMAACzzAADW8wAA5fMAAOvzAAD28wAAUPQAAFn0AABn9AAAdvQAAMv0 AADd9AAA6/QAAPr0AACl9QAAtPUAALr1AADD9QAA4/UAAPP1AAD89QAABfYAAB32AAAs9gAA YfYAAHP2AACB9gAAkPYAAFT3AABj9wAAafcAAHT3AACq9wAAs/cAAAL4AAAS+AAAO/gAAEv4 AABo+AAAcPgAAI/4AACa+AAA7/gAAPr4AAAj+QAAM/kAAOD5AADt+QAAOfoAAEH6AABF+wAA VPsAAFb7AABb+wAAZfsAAHb7AAB4+wAAffsAAID7AACE+wAA2vsAAOf7AAAU/AAAF/wAACT8 AAAs/AAAe/wAAIf8AACX/AAAnPwAACT9AAAt/QAAO/0AAEz9AACE/QAAj/0AAJD9AACd/QAA nv0AAK79AAC6/QAAxP0AAOb9AAD2/QAA9/0AACj+AAAp/gAAN/4AAHD+AAB8/gAAP/8AAE7/ AACR/wAAnP8AALr/AADK/wAA+/8AAAYAAQDgAQEA6AEBAFkCAQBhAgEABwMBABkDAQD5AwEA DAQBAJgEAQClBAEAaQUBAHYFAQDJBQEA1gUBAOkGAQD0BgEAfgcBAIkHAQCbBwEApgcBAKwH AQC3BwEAzwcBANMHAQDuBwEA9AcBAP0HAQABCAEAEggBAB8IAQAuCAEAOwgBAF4IAQBrCAEA gggBAIwIAQAJCQEAGgkBAEgKAQBQCgEAYgoBAHIKAQAJCwEAFgsBACgLAQA1CwEAngsBAKQL AQCtCwEAsQsBAMILAQDNCwEA3AsBAOcLAQASDAEAIAwBACUMAQAsDAEAtQwBALcMAQC4DAEA ugwBAAINAQANDQEAHw0BACoNAQBVDQEAXA0BAF0NAQBkDQEAZg0BAHENAQByDQEAgQ0BAMoN AQDtDQEA7g0BAP4NAQBsDgEAdg4BAOMPAQDpDwEA8g8BAPYPAQAHEAEAFxABACYQAQA2EAEA WRABAGQQAQBwEAEAexABAKgQAQCuEAEArxABAM0QAQDREAEA4RABADcRAQBDEQEAVREBAGUR AQAiEgEAMBIBAKASAQC1EgEAtxIBANwSAQDeEgEA9BIBAPsSAQAMEwEAFBMBABcTAQAYEwEA GxMBAC4TAQA/EwEARhMBAFoTAQBcEwEAcRMBAHMTAQB/EwEAhhMBAKUTAQCmEwEAxRMBANMT AQDiEwEA5BMBAPsTAQAfFAEANhQBADcUAQBOFAEATxQBAGQUAQBrFAEAgBQBAIEUAQCWFAEA lxQBAKwUAQCzFAEAwxQBAMQUAQDUFAEA1RQBAOUUAQDsFAEAAhUBAAMVAQAZFQEAXhUBAGQV AQBsFQEAcBUBAMQVAQDKFQEA0xUBANcVAQAuFgEANBYBAD0WAQBBFgEAmRYBAJ8WAQCoFgEA rBYBAAMXAQAJFwEAEhcBABYXAQBtFwEAcxcBAHwXAQCAFwEAjhcBAJMXAQCYFwEAmhcBAOoX AQDtFwEA8xcBAP8XAQAnGAEAMhgBADQYAQBEGAEARhgBAFAYAQBqGAEAfBgBAIQYAQCOGAEA kRgBAJwYAQABGQEAAxkBAAsZAQAYGQEAGxkBACsZAQAvGQEAPhkBAEEZAQBRGQEAVBkBAGgZ AQBrGQEAfRkBACocAQA0HAEANhwBAEYcAQBPHAEAaBwBAGocAQB6HAEAexwBAJIcAQDQHAEA 3hwBAOocAQDuHAEAIB0BADUdAQBBHQEATB0BAE4dAQBZHQEAux0BAMYdAQAlHgEAOx4BALoe AQDJHgEAyh4BANweAQDeHgEA8h4BAPYeAQD/HgEAAR8BABUfAQAZHwEALR8BADAfAQA/HwEA 0B8BANMfAQDXHwEA5h8BAAYgAQAfIAEAdCABAIYgAQCHIAEAmyABAJ0gAQC0IAEAuCABAMQg AQDFIAEA2yABAN8gAQD2IAEA+SABAAshAQBsIQEAeCEBAHkhAQCJIQEAiyEBAJUhAQCZIQEA oSEBAM4hAQDgIQEA6CEBAPIhAQD1IQEAASIBAFUiAQBfIgEAYSIBAGQiAQBoIgEAeCIBAHoi AQCJIgEAiiIBAKMiAQClIgEAsCIBAL8iAQDPIgEA2iIBAOwiAQDtIgEACSMBABYjAQAkIwEA JiMBADMjAQBBIwEASyMBAE0jAQBfIwEAsCMBALYjAQDDIwEA0CMBANEjAQDdIwEAHiQBACQk AQArJAEAOCQBAJIkAQCiJAEA0SQBAOAkAQAdJgEALyYBADEmAQA9JgEAQSYBAEsmAQBdJgEA YyYBAGsmAQB3JgEAeiYBAIMmAQDXJgEA6SYBAAEoAQAQKAEAPigBAEEoAQBCKAEARSgBAG8o AQByKAEAeCgBAHwoAQCAKAEAjSgBAJEoAQCZKAEA+CgBAAcpAQA1KQEAOCkBADkpAQA8KQEA ZikBAGkpAQBvKQEAcykBAHcpAQCEKQEAiCkBAJApAQDvKQEA/ikBACwqAQAvKgEAMCoBADMq AQBdKgEAYCoBAGYqAQBqKgEAbioBAHsqAQB/KgEAhyoBAOYqAQD1KgEAIysBACYrAQAnKwEA KisBAFQrAQBXKwEAXSsBAGErAQBlKwEAcisBAHYrAQB+KwEA4ysBAPIrAQAhLAEAJCwBACUs AQAoLAEAUiwBAFUsAQBbLAEAXywBAGMsAQBwLAEAdCwBAHwsAQDlLAEA9CwBACMtAQAmLQEA Jy0BACotAQBULQEAVy0BAF0tAQBhLQEAZS0BAHItAQB2LQEAfi0BAE4uAQBWLgEAVy4BAGQu AQBmLgEAbi4BAHIuAQB8LgEAhC4BAJMuAQCVLgEAnS4BAKAuAQCoLgEA2i4BAOUuAQDrLgEA +C4BAP4uAQAJLwEA+y8BAP8vAQAaMAEAPTABAIowAQCfMAEA9jABAPwwAQAJMQEAFjEBABcx AQAjMQEANTEBADwxAQBaMQEAZjEBAH0xAQCGMQEA4DEBAOYxAQDtMQEA+jEBAAgyAQAPMgEA IDIBACwyAQA8MgEARTIBADEzAQA5MwEARjMBAEwzAQBZMwEAZjMBAGczAQBzMwEAhTMBAI0z AQCPMwEAlzMBAKMzAQCtMwEA4TMBAOkzAQD7MwEAATQBAAg0AQAVNAEAKDQBADA0AQBANAEA SjQBAHY0AQB5NAEAgTQBAI00AQCgNAEApjQBAMg0AQDZNAEA2zQBAOw0AQDuNAEA+TQBAPs0 AQACNQEAJjUBACk1AQAMNgEAITYBACI2AQA3NgEAQzYBAHU2AQCeNgEAqDYBAKo2AQC4NgEA yDYBANY2AQDhNgEA7zYBAPI2AQAANwEAAjcBABY3AQAYNwEALDcBADg3AQBINwEAZDcBAHo3 AQDgNwEA7jcBAPo3AQD+NwEALzgBAEQ4AQCsOAEAtzgBAME4AQDROAEA0zgBAN04AQDhOAEA +zgBAPw4AQAgOQEAIjkBADI5AQBSOQEAZDkBAGY5AQBwOQEAczkBAH45AQDhOQEA/jkBADc6 AQBNOgEAPzsBAEw7AQCxOwEAtDsBALU7AQC4OwEA4jsBAOU7AQDsOwEA8DsBAPQ7AQACPAEA jDwBAJk8AQBYPQEAZT0BACQ+AQAxPgEA7j4BAPs+AQC5PwEAxj8BAFBAAQBTQAEAd0ABAIFA AQCLQAEAkUABAKdAAQCtQAEA90ABAPpAAQAxQQEAOkEBAERBAQBKQQEAV0EBAGBBAQBmQQEA zUEBANNBAQDgQQEA7UEBAO5BAQD6QQEADEIBABVCAQBdQgEAY0IBAGpCAQB3QgEAh0IBAJBC AQC4QgEA40IBACxDAQAwQwEAMkMBAEdDAQBTQwEAV0MBAF5DAQBzQwEAfUMBAIJDAQCIQwEA mEMBAKFDAQClQwEArEMBAMFDAQDDQwEAxkMBAM5DAQDgQwEAF0QBACFEAQBERAEAV0QBAFlE AQBvRAEAcUQBAIREAQCXRAEAr0QBALNEAQC/RAEAwkQBAM5EAQAORQEAFEUBACFFAQAuRQEA L0UBADtFAQBNRQEAWUUBAHBFAQB5RQEAwkUBAMhFAQDPRQEA3EUBAO1FAQD5RQEACUYBABJG AQC2RgEAw0YBAO9GAQD2RgEAFEcBACFHAQBLRwEATkcBAGlHAQCNRwEAskcBAL9HAQDGRwEA 0kcBACtIAQA7SAEAPUgBAE5IAQBQSAEAX0gBAGFIAQBxSAEAc0gBAH5IAQCASAEAh0gBAL5I AQDMSAEA/kgBABNJAQAWSQEAK0kBADdJAQBLSQEAUUkBAGVJAQC6SQEAxEkBAPVJAQAOSgEA EEoBABNKAQAlSgEAN0oBAEJKAQBYSgEAWkoBAG1KAQB8SgEAlEoBAJhKAQCuSgEAsEoBAMZK AQALSwEAEUsBACVLAQAySwEANEsBAEBLAQBSSwEAXksBAHdLAQB6SwEAkUsBAJxLAQCgSwEA rEsBAL5LAQDHSwEAE0wBABlMAQAgTAEALUwBAD5MAQBKTAEAW0wBAF5MAQBlTAEAcEwBAIBM AQCJTAEAMk0BADVNAQBITQEAWE0BAHRNAQB3TQEAvU0BAM1NAQDfTQEA4k0BAPxNAQAuTgEA ck4BAHhOAQCPTgEAnE4BAKFOAQCtTgEAv04BAMhOAQAVTwEAG08BACJPAQAvTwEAPk8BAEdP AQCNTwEAk08BAJxPAQCgTwEArk8BALNPAQC4TwEAu08BAOxPAQDvTwEAAlABABJQAQAuUAEA MFABAHVQAQCFUAEAl1ABAJpQAQDlUAEA61ABAPRQAQD4UAEABlEBAAtRAQAQUQEAE1EBAENR AQBYUQEAWlEBAG9RAQBxUQEAhVEBAItRAQCfUQEAoVEBAK5RAQC1UQEAyFEBAPtRAQAOUgEA H1IBAC9SAQAzUgEASVIBANpSAQDoUgEA8FIBAPtSAQAJUwEAGVMBAGdTAQBzUwEAdVMBAIFT AQCDUwEAj1MBALtTAQC+UwEA0VMBAPxTAQByVAEAdFQBAOhUAQD4VAEA+lQBAApVAQBIVQEA U1UBAOtVAQAGVgEACFYBABRWAQAWVgEAIlYBAE5WAQBjVgEAZVYBAHpWAQB8VgEAglYBAJNW AQCpVgEA01YBAOdWAQDpVgEA/VYBAAhXAQAXVwEAK1cBADxXAQCRVwEAolcBALJXAQC7VwEA vVcBAM5XAQDQVwEA5lcBAOpXAQDxVwEA9VcBAAhYAQAKWAEAIFgBACNYAQAsWAEAjVgBAJdY AQCtWAEAslgBALZYAQDDWAEAxVgBANtYAQDdWAEA/VgBAP9YAQALWQEADlkBABpZAQA7WQEA SFkBAGBZAQBvWQEAglkBAJNZAQDlWQEA/lkBAFJaAQB5WgEATlsBAFRbAQBdWwEAYVsBAG9b AQB0WwEAeVsBAHxbAQD0WwEAF1wBAGJcAQBoXAEAcVwBAHVcAQCDXAEAiFwBAI1cAQCQXAEA EV0BABtdAQAyXQEASF0BAE5dAQBuXQEAeV0BAI9dAQCRXQEAsV0BALNdAQC/XQEAwl0BAM5d AQAdXgEALl4BAClfAQAvXwEAOF8BADxfAQCZXwEApF8BAM9fAQDdXwEA8V8BAPpfAQAYYAEA G2ABAGtgAQB+YAEABGEBAAphAQAcYQEAKWEBACthAQA3YQEASWEBAFJhAQBqYQEArmMBALVj AQC6YwEAzWMBAM9jAQDmYwEA6mMBAPJjAQD2YwEAC2QBAA1kAQAkZAEAJ2QBAC5kAQBnZAEA c2QBAI1kAQCXZAEAmWQBAKhkAQCqZAEAw2QBAMVkAQDVZAEA12QBAO5kAQD5ZAEA/2QBAEdl AQBRZQEAU2UBAGdlAQBpZQEAfWUBAIllAQCZZQEAqGUBALJlAQC1ZQEAymUBAAdmAQARZgEA E2YBACFmAQAwZgEAPmYBAElmAQBXZgEAWWYBAGdmAQBpZgEAdWYBAHdmAQCZZgEAm2YBAKpm AQCvZgEAyGYBANNmAQDjZgEA5GYBAPtmAQD9ZgEABmcBABZnAQAkZwEANmcBAE9nAQBRZwEA XGcBAGtnAQB7ZwEA72cBAP5nAQABaAEAEWgBABRoAQAiaAEAEWkBADZpAQBTagEAYmoBAMZq AQDJagEA5GoBAOpqAQDzagEAAmsBAG5rAQB9awEA4WsBAORrAQD/awEABWwBAA5sAQAdbAEA iWwBAJhsAQD8bAEA/2wBABptAQAgbQEAKW0BADhtAQClbQEAtG0BABhuAQAbbgEANm4BADxu AQBFbgEAVG4BAKhuAQCubgEAu24BAMhuAQDJbgEA1W4BAPhuAQABbwEASW8BAE9vAQBWbwEA Y28BAIhvAQCRbwEAvW8BAMdvAQDJbwEA2W8BAOFvAQD6bwEA/G8BAAxwAQANcAEAJHABADdw AQBFcAEAUHABAFRwAQBbcAEAcHABAHtwAQCLcAEAjHABAJxwAQAAcQEACnEBAAxxAQAQcQEA E3EBACFxAQAjcQEAMnEBADdxAQBQcQEAW3EBAGZxAQBscQEAfHEBAIdxAQCZcQEAmnEBALZx AQDDcQEA0XEBANNxAQDgcQEA5XEBAO9xAQDxcQEAA3IBADZyAQBHcgEAU3IBAGRyAQCGcgEA m3IBAJxyAQCxcgEAs3IBAMdyAQDMcgEA4HIBAOJyAQDqcgEA8XIBAPlyAQCJcwEAlHMBAJVz AQCmcwEAvXMBAMxzAQDOcwEA03MBAN5zAQDvcwEA8XMBAPZzAQD5cwEA/XMBAPN0AQD/dAEA D3UBABR1AQD9dQEABXYBABt2AQAjdgEAj3YBAJd2AQCfdgEAp3YBANt2AQDudgEACHcBABV3 AQAidwEANncBAIh3AQCbdwEAqXcBALZ3AQDSdwEA5ncBAD14AQBEeAEARngBAE14AQBPeAEA WngBAFt4AQBqeAEAlXgBAKB4AQCyeAEAvXgBAOp4AQDueAEACXkBAA95AQAYeQEAHHkBAFV5 AQBieQEAdHkBAIF5AQCueQEAsnkBAM15AQDTeQEA3HkBAOB5AQAYegEAI3oBADV6AQBAegEA bXoBAHF6AQCMegEAknoBAJt6AQCfegEA2noBAOp6AQD8egEADHsBAFh7AQBbewEAYXsBAG17 AQB/ewEAj3sBAGd9AQB2fQEAD34BAB9+AQBkgQEAeYEBAHqBAQB8gQEAfYEBAH+BAQCAgQEA goEBAIOBAQCFgQEAoIEBAKOBAQDJgQEAy4EBANKBAQDvgwEA8oMBAAcAHAAHABwABwAcAAcA AwAHAAMABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwADAAcAAwAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAAwAHAAMABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHAAMABwADAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAAwAHAAMABwAcAAcA HAAHAAMABwADAAcAHAAHAAMABwAcAAcAAwAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAAwAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwADAAcAAwAHABwABwAcAAcAAwAHAAMABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHAAMABwADAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwADAAcAAwAHAAMABwADAAcAAwAHAAMA BwADAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwADAAcA HAAHAAMABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAAwAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHAAMABwADAAcA HAAHABwABwAcAAcAHAAHAAMABwAcAAcAHAAHAAMABwAcAAcAAwAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHAAMABwAcAAcAAwAHAAMABwADAAcA HAAHABwABwAcAAcAHAAHAAMABwADAAcAAwAHAAMABwADAAcAAwAHAAMABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwADAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwADAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAAwAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAAwAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwADAAcAAwAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAAwAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwADAAcAHAAHABwABwADAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHAAMABwAcAAcAHQAHABwABwADABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwADAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHAAMABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwADAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwADAAcAAwAHAAMABwADAAcAAwAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwADAAcAAwAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHAAMABwADAAcAAwAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAAwAHAAMABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAAwAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHQAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwADAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwADAAcAAwAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHAAMABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAAwAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAMABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHAAMABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwADAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwADAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHAAMABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA AwAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwADAAcAHAAHABwABwAcAAcAHAAHAAMA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHAAMAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwA BwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcAHAAHABwABwAcAAcA HAAHAAcAAgAHAAIABwACAAcAAgAHAAcABwAHAAcAAwAHAAIAAAAAAHYAAACEAAAA5RAAAPEQ AADLEwAA1hMAALwUAADDFAAALBUAAC8VAACyFQAAuRUAADEWAAA4FgAAsBYAALcWAAAyFwAA ORcAAMYXAADKFwAAbBgAAG4YAACAGAAAhxgAAP8ZAAAGGgAACRoAABYaAAAcGgAALBoAAC0a AAA8GgAAPxoAAE8aAABSGgAAZhoAAGkaAAB7GgAAPx4AAEYeAADNHwAA0h8AAHQjAAB3IwAA SiQAAFEkAABgJAAAcCQAAJUkAAClJAAAwCQAAMwkAAAZJQAAHSUAAHglAACDJQAAziUAANUl AABMJgAATiYAANAmAADSJgAAXycAAGEnAADoJwAA6icAAEEoAABDKAAAoygAAKUoAADTKAAA 4ygAAOIpAADyKQAAXyoAAGsqAADVKwAA5SsAAAYsAAAZLAAAJSwAADAsAAAGLgAACy4AACwv AAA7LwAAcC8AAHkvAAD3LwAA+y8AACIyAAAlMgAAgDIAAIMyAADgMgAA5TIAABw0AAAuNAAA aTQAAHU0AAABNQAADDUAAGM2AABvNgAAkDYAAJg2AADQNgAA0jYAAPE4AAD4OAAABjkAAAk5 AAAfOQAALjkAAEo5AABVOQAAfzkAAJE5AACwOQAAuTkAAOY5AADxOQAAGToAACA6AACTOgAA lToAAB47AAAgOwAAqTsAAKw7AAD9OwAADDwAAKM+AACrPgAA3D4AAOw+AAAcPwAAKz8AAF8/ AABlPwAAmj8AAKU/AADUPwAA3D8AAGpAAABzQAAAtkAAALhAAACOQQAAmEEAAJxBAACmQQAA qkEAALRBAAC3QQAAwUEAAMRBAADSQQAA1UEAAONBAAByQwAAdEMAAKRDAACpQwAAaUQAAGtE AACcRAAAoUQAAGFFAABjRQAAk0UAAJhFAABkRgAAZkYAAJZGAACbRgAAbEcAAG5HAACeRwAA o0cAANdHAADiRwAA40gAAPFIAABbSQAAa0kAAO5KAAD2SgAAFEsAAB5LAACkSwAAsksAAOJL AAD0SwAA5FEAAO9RAAAhUgAAJVIAAH1SAAB+UgAAl1IAAJhSAADYUgAA4VIAADlTAABGUwAA WlQAAF5UAABnVQAAfFUAAOxhAADvYQAA/2MAAAhkAAC3ZQAAumUAACNnAAAqZwAAOmcAAEhn AABxZwAAf2cAAJJnAACmZwAABGsAAAZrAAAwawAAPmsAACtsAAAwbAAAeGwAAHxsAADObAAA 02wAACxuAAAwbgAA9W8AAANwAACPcAAAo3AAACVxAAAncQAAOnEAAFRxAAC4cQAAunEAAJd8 AACsfAAANX8AADl/AABlfwAAbH8AALF/AAC4fwAAp4AAAK6AAADXgAAA2oAAAPSAAAAKgQAA T4EAAFuBAAAphgAAPoYAALKGAAC5hgAAsocAALWHAADkigAA+ooAAM+LAADbiwAADI0AABON AAA3jQAAQY0AAG2NAABwjQAAoI0AALaNAAD5jQAAD44AAO+UAAAElQAAHJUAADCVAABLlQAA WJUAAJeVAACglQAA15UAAOCVAACEmQAAh5kAAKiZAAC0mQAA75kAAASaAAAcmgAAIpoAAHCa AACEmgAAm5oAAJ+aAAC6mgAAv5oAAEebAABVmwAAf5sAAIabAAD3mwAA/psAABycAAAmnAAA BJ0AABidAACOngAAm54AAD6fAABBnwAAQKAAAFagAADwoAAABqEAAM+hAADkoQAAwqIAAMii AAB5pgAAgKYAAKGmAACmpgAAtqYAAMymAADvpgAA+6YAACmnAAA2pwAARacAAEmnAABkpwAA aacAAPKqAAD3qgAAl60AAJ6tAADArQAA1q0AAAauAAAcrgAAP64AAEuuAACnrgAAvq4AAP20 AAATtQAARLYAAFC2AAC+twAAxbcAAPm3AAABuAAAEL0AABe9AAAmvQAANb0AAFK9AABivQAA fb0AAIO9AACtvQAAtL0AACW+AAA0vgAATr8AAFS/AADZwAAA4MAAAPDAAAAEwQAAD8IAACPC AACHwgAAl8IAAKPDAACqwwAAucMAAMfDAADvwwAA/cMAAA/EAAAbxAAAQcQAAFDEAAB6xAAA isQAAKXEAACuxAAA18QAANrEAAD5xAAABMUAAL/FAADQxQAA0cUAAOzFAAAEyQAAFMkAABfJ AAAnyQAAKskAADrJAAA9yQAATckAABrKAAAeygAAW8oAAGrKAAAzywAAN8sAAHTLAACDywAA TcwAAFHMAACNzAAAnMwAAGbNAABqzQAAps0AALXNAADkzwAA5s8AABHQAAAf0AAA+NAAAAbR AAB60QAAhtEAANbRAADl0QAA0dIAAOHSAAA20wAAP9MAADrUAAA+1AAARdUAAEjVAABz1QAA ftUAAMvdAADO3QAAf+EAAIbhAACU4QAApOEAAMfhAADX4QAA8eEAAP3hAABG4gAASuIAAJzi AACs4gAA+eIAAADjAAAv4wAAP+MAAD/kAABP5AAAkOQAAJzkAAC75QAAv+UAACTnAAA05wAA pucAAK3nAAC75wAAv+cAANLnAADh5wAACugAABXoAAA26AAASOgAAGfoAABw6AAAgugAAI/o AADe6AAA5OgAAPjoAAAB6QAANekAAErpAABi6QAAdukAAJHpAACZ6QAAyukAANHpAAAE6gAA COoAAIHqAACE6gAA2uoAAN7qAAAk6wAAOesAACXsAAA57AAAYe0AAGntAACZ7QAAqO0AAG7u AAB57gAAWvAAAGzwAAC08AAAwvAAAPHwAAD+8AAAQPsAAET7AABf+wAAZPsAANr7AADn+wAA e/wAAIj8AACIBAEAigQBAPIFAQD0BQEA6QYBAPQGAQCpBwEAtwcBAOYHAQDpBwEAEggBAB8I AQCWCwEAmQsBAMILAQDNCwEAsgwBALQMAQBVDQEAXA0BAGYNAQBxDQEAwg0BAMUNAQDuDQEA /g0BANsPAQDeDwEABxABABcQAQA3EQEARBEBAHERAQByEQEAoBIBALUSAQAeEwEAIRMBAC4T AQBAEwEACBQBAA8UAQBbFAEAZBQBAF4VAQBlFQEAvRUBAMAVAQAuFgEANRYBAJkWAQCgFgEA AxcBAAoXAQBtFwEAdBcBAOoXAQDuFwEAJxgBADIYAQBUGAEAWxgBAAEZAQAIGQEACxkBABgZ AQAeGQEALhkBAC8ZAQA+GQEAQRkBAFEZAQBUGQEAaBkBAGsZAQB9GQEAIRwBACgcAQA2HAEA RhwBAGocAQB6HAEAlBwBAKAcAQDqHAEA7hwBAEEdAQBMHQEArR0BALgdAQC6HgEAyR4BAPYe AQD/HgEA0B8BANMfAQB0IAEAhiABALggAQDEIAEAbCEBAHghAQCZIQEAoSEBANohAQDcIQEA TCIBAFMiAQBhIgEAZCIBAHoiAQCJIgEApSIBALAiAQDaIgEA7CIBAAsjAQAUIwEAQSMBAEwj AQBbJAEAYyQBAJIkAQCiJAEA0SQBAOAkAQATJQEAGSUBAEwlAQBXJQEAhCUBAIwlAQASJgEA GyYBAFsmAQBdJgEAgCcBAIonAQCNJwEAmycBAJ4nAQCsJwEAKSwBACssAQArLQEALS0BAE4u AQBWLgEAci4BAHwuAQDXLgEA5S4BAPwvAQAAMAEAJjUBACo1AQB+NQEAfzUBAJY1AQCXNQEA DDYBACE2AQCTNgEAmjYBAKo2AQC4NgEA4TYBAO82AQACNwEAFjcBAKs3AQCwNwEA+jcBAP43 AQDNOAEAzzgBAOE4AQD7OAEAIjkBADI5AQC5OwEAuzsBAOw7AQDxOwEAnT4BAKs+AQBoPwEA dj8BAFBAAQBZQAEAd0ABAIFAAQCnQAEAr0ABAPdAAQAAQQEAMUEBADpBAQBgQQEAaEEBACxD AQAwQwEAU0MBAFdDAQAMRAEAE0QBADxEAQA/RAEAWUQBAG9EAQCzRAEAv0QBAEtHAQBPRwEA UEgBAF9IAQCnSAEArkgBAL5IAQDMSAEA/kgBABNJAQCvSQEAtkkBANpJAQDkSQEAEEoBABNK AQBCSgEAWEoBAJhKAQCuSgEAJUsBAEBLAQCNTwEAlE8BAOVQAQDsUAEAQ1EBAFhRAQBxUQEA hVEBAKFRAQCuUQEA71EBAPhRAQAzUgEAPFIBALtTAQC/UwEAU1QBAFRUAQB4VAEAeVQBALdU AQC4VAEA6FQBAPhUAQA2VQEAOlUBAEhVAQBTVQEA5FUBAOdVAQAIVgEAFFYBAE5WAQBjVgEA fFYBAIJWAQDTVgEA51YBAP9WAQADVwEAIlcBACdXAQCRVwEApFcBALJXAQDAVwEA6lcBAPFX AQCCWAEAiVgBAK1YAQCyWAEAxVgBANtYAQD/WAEAC1kBADtZAQBIWQEAWFkBAFxZAQB6WQEA f1kBAEZbAQBJWwEAWlwBAF1cAQAGXQEADV0BADJdAQBIXQEAeV0BAI9dAQCzXQEAv10BAB1e AQA0XgEAKV8BADBfAQBsXwEAcF8BAH5fAQCHXwEAmV8BAKRfAQDPXwEA3V8BAPFfAQD6XwEA GGABABtgAQCuYwEAtWMBAOpjAQDyYwEAdGQBAHdkAQCDZAEAimQBAJlkAQCoZAEAxWQBANVk AQDwZAEA9mQBAD1lAQBEZQEAU2UBAGdlAQCJZQEAmWUBAP1lAQAEZgEAE2YBACFmAQBJZgEA V2YBAGlmAQB1ZgEA02YBAONmAQD9ZgEABmcBAC9nAQAyZwEAUWcBAFxnAQDwZwEA82cBANZp AQDmaQEA6GkBAPhpAQD+aQEADmoBAMZqAQDKagEA4WsBAOVrAQD8bAEAAG0BABhuAQAcbgEA tG8BALtvAQDJbwEA2W8BAPxvAQAMcAEAJnABADJwAQBQcAEAVHABAHtwAQCLcAEA93ABAP5w AQAMcQEAEHEBAIdxAQCZcQEAuHEBAMFxAQDlcQEA8HEBAC9yAQA1cgEASXIBAFJyAQCGcgEA m3IBALNyAQDHcgEA4nIBAOpyAQCJcwEAlXMBALdzAQC7cwEA13MBANxzAQDzdAEAAHUBAD14 AQBEeAEAT3gBAFp4AQDreAEA73gBAK95AQCzeQEAbnoBAHJ6AQBYewEAXHsBAHN+AQCEfgEA F4ABABuAAQBkgQEAeYEBAHqBAQB8gQEAfYEBAH+BAQCAgQEAgoEBAIOBAQDvgwEA8oMBAAcA BQAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMA BwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcA MwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMA BwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcA MwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMA BwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcA MwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMA BwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcA MwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMA BwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcA MwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMA BwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcA MwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMA BwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcA MwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMA BwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcA MwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMA BwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcA MwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMA BwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcA MwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMA BwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcA MwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMA BwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcA MwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMA BwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcA MwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMA BwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcA MwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMA BwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcA MwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMA BwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcA MwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMA BwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcA MwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMA BwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAzAAcAMwAHADMABwAHAAIABwACAAcAAgAHAAIA BwACAAAAAAA2AAAAdgAAAAUBAABXAQAAdQEAAF8FAABwBQAAfAUAAIIFAACnBgAAvAYAAI8J AADDCQAAdAoAAD0MAABTDgAAxw8AAHAQAACvEAAA5RAAAAARAABmEQAA6BEAAHIUAAB9FAAA vBQAAO8UAAAsFQAAahUAALIVAADoFQAAMRYAAGgWAACwFgAA6xYAAGYXAADoFwAAHx0AAD8e AAAVIAAAGiAAAHIhAAB+IQAA3iEAAO8hAADqIwAA/iMAAPMkAAAZJQAAbiUAAHglAADiKQAA WyoAAEAtAABqLQAAuC0AAAYuAADwMwAAHDQAAAE1AABaNQAA4zUAAAQ2AAA8NgAAHTcAAJM6 AAAbOwAAHjsAAKU7AACpOwAA+TsAAP07AAD5PAAA40gAAFpJAACcVAAAslQAAJtVAADTVQAA iFcAAPtXAAB5XAAAllwAANtdAAD6XQAAEGAAAB9gAABlYgAAjmIAAO9mAAAfaAAA1W0AACxu AACYbwAA9W8AAH98AACUfAAA2nwAAB59AAD1fwAAFoAAAFaGAACyhgAAdIsAAM+LAAAOjAAA LYwAAO+VAAArlgAAxJsAAPebAACcoAAA8KAAAGSlAAB+pQAAhKoAAM2qAABIrAAAmqwAAL20 AADYtAAAeLYAAJS2AAB1uAAAkLgAADe7AABOuwAAjrwAAJy8AADevAAArb0AAI6/AACdvwAA pcAAAHnBAADYwgAA68IAAGfDAAAwxQAABMkAABfJAACmzQAA5c0AABzUAAA61AAARdUAAHPV AAC61QAA0dUAAJzbAAC12wAA7d4AAP7eAABH4QAAwOIAAG7nAADK6QAAOvAAAFrwAAAn8QAA XfEAAOfzAAAH9AAAZfcAAIX3AAAS+wAAQPsAAIT9AACv/QAALQABADgAAQCAAAEAngABAGIG AQAABwEA5gcBACoIAQCWCwEA2AsBAN4MAQD7DAEAwg0BAAkOAQDbDwEAIhABAGkmAQCRJgEA tzQBAAU1AQA5aQEAimkBAI5/AQCjfwEAUoEBAGOBAQBkgQEAeIEBAHmBAQB6gQEAfIEBAH2B AQB/gQEAgIEBAIKBAQCDgQEAhYEBAKCBAQCjgQEAy4EBAG2CAQDvgwEA8oMBAAUABwAFAAcA BQAHAAUABwAFAAcABQAHAAUABwAFAAcABQAHAAUABwAFAAcABQAHAAUABwAFAAcABQAHAAUA BwAFAAcABQAHAAUABwAFAAcABQAHAAUABwAFAAcABQAHAAUABwAFAAcAAwAHAAUABwAFAAcA BQAHAAMABwAFAAcABQAHAAMABwADAAcAAwAHAAMABwADAAcABQAHAAUABwAFAAcABQAHAAUA BwAFAAcABQAHAAUABwAFAAcABQAHAAUABwAFAAcABQAHAAUABwAFAAcABQAHAAUABwAFAAcA BQAHAAUABwAFAAcABQAHAAUABwAFAAcABQAHAAUABwAFAAcABQAHAAUABwAFAAcABQAHAAUA BwAFAAcABQAHAAUABwAFAAcABQAHAAUABwAFAAcABQAHAAUABwAFAAcABQAHAAUABwAFAAcA BQAHAAUABwAFAAcABQAHAAUABwAFAAcABQAHAAUABwAFAAcABQAHAAUABwAFAAcABQAHAAUA BwAFAAcABQAHAAIABwACAAcAAgAHAAIABQAHAAUABwAFAAcAAgAAAAAAHQEAAFcBAAB1AQAA YwUAAGQFAACcDwAAnQ8AAFYiAAB1IgAAtCIAALQiAAANJQAADSUAAG4lAABuJQAA+CkAABgq AADtLwAA7i8AAPEvAADyLwAAdTIAAHYyAAAJNAAACTQAAPc0AAD4NAAA+zQAAPw0AAASNQAA MjUAAN46AAAAOwAAaDsAAIo7AADWOwAA+DsAANg8AAD3PAAAID4AACE+AAAtQQAALkEAADFB AAAyQQAA90gAABhJAABxSQAAkkkAAE9KAABQSgAAY0oAAGRKAABzSgAAdEoAAIZKAACHSgAA sUoAALJKAAC6SgAAu0oAAMhKAADJSgAA20oAANxKAACjSwAApEsAANdLAADYSwAA20sAANxL AABjTgAAZE4AAOJOAADjTgAA8U4AAPJOAAD1TgAA9k4AACRPAAAlTwAAf08AAIBPAAClTwAA pk8AALhRAAC5UQAA+FEAAPlRAABcUgAAXVIAAJFTAACSUwAAplMAAKdTAACqUwAAq1MAANFT AADSUwAACVQAAApUAABZVAAAWlQAAJlUAACaVAAAfVUAAH9VAAC1VQAAtlUAAM5VAADPVQAA NVYAAFRWAADcVgAA/VYAABlXAAA6VwAAqlcAAKtXAAC/VwAAwFcAAMNXAADEVwAA7GQAAAxl AAA3ZgAAV2YAAPZnAAD3ZwAADGgAAA1oAAAYaAAAGWgAALdrAADXawAACG4AAChuAADSbwAA 8m8AADZwAABWcAAAjnQAAI90AACldAAApnQAAKl0AACqdAAAWHUAAFl1AADXdQAA2HUAAPN1 AAD0dQAAGXYAABp2AAB5dgAAenYAAKN2AACkdgAAqXYAAKp2AAArdwAALHcAAEd3AABIdwAA dncAAHd3AAB9dwAAfncAAPx3AAD9dwAAGHgAABl4AABGeAAAR3gAAE14AABOeAAAvXgAAL14 AAC+eAAAvngAAMx4AADNeAAA6HgAAOl4AAAWeQAAF3kAABx5AAAdeQAAm3kAAJx5AAC3eQAA uHkAAOV5AADmeQAA7HkAAO15AABregAAbHoAAId6AACIegAAtXoAALZ6AAC8egAAvXoAADt7 AAA8ewAACHwAAAl8AABtfAAAbnwAAH18AAB/fAAAgHwAAIF8AACOfAAAj3wAAJB8AACRfAAA AH0AAAF9AAAEfQAABX0AAH19AACffQAAoX0AAMN9AADFfQAA530AAOx9AAAOfgAAUH4AAHJ+ AACIfgAAqn4AAOp+AAAMfwAAhH8AAIV/AADwfwAA8X8AADKDAAAzgwAARIMAAEWDAABIgwAA SYMAAG+DAABwgwAAd4MAAHiDAAB7gwAAfIMAABeEAAAYhAAAHoQAAB+EAACzhAAAtIQAAI2G AACOhgAAOpAAADuQAABMkAAATZAAAFCQAABRkAAAr5AAALCQAADEkAAAxZAAADeRAAA4kQAA PZEAAD6RAADxkQAA8pEAABaTAAAXkwAAaJMAAGmTAABylAAAc5QAAMWUAADGlAAAEJYAABGW AAASlgAAEpYAACSWAAAllgAAKJYAACmWAABOlgAAT5YAAFWWAABWlgAAMZcAADKXAACclwAA nZcAAPCbAADxmwAA9JsAAPWbAADOoAAA7qAAABGoAAASqAAAHqgAAB+oAAAiqAAAI6gAAD+o AABAqAAAW6gAAFyoAABfqAAAYKgAABipAAAZqQAAaqkAAGupAADhqQAA4qkAAAGqAAACqgAA L6oAADCqAACBqgAAgqoAAIOqAACDqgAAua4AALquAADmrgAA564AAPKuAADzrgAA9q4AAPeu AACUrwAAla8AANavAADXrwAAVLAAAFWwAABcsgAAXbIAAGCyAABhsgAAmrIAAJuyAACysgAA s7IAANOyAADUsgAAbrgAAG+4AAByuAAAc7gAAI29AACOvQAAxL4AAOK+AAAsvwAATL8AAHLB AABzwQAAZsIAAITCAACXxQAAmMUAAMvFAADMxQAAHscAAB/HAAAvxwAAMMcAADPHAAA0xwAA AskAAAPJAABSyQAAU8kAABfKAAAYygAASswAAEvMAAA20QAAVtEAABTTAAA00wAA0dQAAPLU AAAh1QAAQtUAAE/hAABP4QAAZOEAAGThAAB37wAAmO8AAL3vAADe7wAAFvsAABb7AAAs/AAA LfwAAKL9AACj/QAA6v0AAOv9AAAG/gAAJ/4AAL3/AAC//wAAFwMBABgDAQB4BwEAeQcBAKYH AQCnBwEAqAcBAKgHAQDPBwEA0AcBAA8IAQAQCAEAAwsBAAQLAQB/CwEAgAsBAL8LAQDACwEA 7QwBAO0MAQDuDAEA7gwBAPwMAQD9DAEAKg0BACsNAQCBDQEAgg0BAKsNAQCsDQEA6w0BAOwN AQA+DwEAPw8BAHYPAQB3DwEAxA8BAMUPAQAEEAEABRABAKkQAQCqEAEAbB8BAG0fAQBwHwEA cR8BAB8gAQAgIAEAPiEBAD8hAQBCIQEAQyEBADgkAQA5JAEAjiYBAI8mAQCQJgEAkCYBACgn AQApJwEALCcBAC0nAQCzLQEAtC0BAMctAQDILQEA1y0BANgtAQDqLQEA6y0BABIuAQATLgEA Gy4BABwuAQApLgEAKi4BADwuAQA9LgEA1i4BANcuAQAKLwEACy8BAA4vAQAPLwEANC8BADUv AQBJLwEASi8BAE0vAQBOLwEAdC8BAHUvAQCsLwEArS8BAPsvAQD8LwEAOzABADwwAQD6MQEA +zEBAPwxAQD8MQEAeDIBAHkyAQB8MgEAfTIBAMg0AQDJNAEA+zQBAPs0AQACNQEAAzUBAGE1 AQBiNQEAcDYBAHE2AQBzNgEAdDYBAGQ3AQBlNwEAejcBAHs3AQCGNwEAhzcBADc6AQA4OgEA TjoBAE86AQBSOgEAUzoBAOg6AQDpOgEAaDsBAGk7AQCEOwEAhTsBAKo7AQCrOwEACDwBAAk8 AQAyPAEAMzwBADg8AQA5PAEAtTwBALY8AQDRPAEA0jwBAP08AQD+PAEABD0BAAU9AQCBPQEA gj0BAJ09AQCePQEAyT0BAMo9AQDQPQEA0T0BAD4+AQA+PgEAPz4BAD8+AQBNPgEATj4BAGk+ AQBqPgEAlD4BAJU+AQCaPgEAmz4BABc/AQAYPwEAMz8BADQ/AQBePwEAXz8BAGU/AQBmPwEA 4j8BAOM/AQD+PwEA/z8BAClAAQAqQAEAMEABADFAAQCcQAEAnUABAFVBAQBWQQEAwEIBAMFC AQDRQgEA0kIBAN9CAQDgQgEA4UIBAOJCAQAKQwEAC0MBAA5DAQAPQwEAc0MBAHRDAQDgQwEA 4UMBAEJGAQBDRgEAVEYBAFVGAQBYRgEAWUYBAH9GAQCARgEAh0YBAIhGAQCLRgEAjEYBAO9G AQDwRgEA9kYBAPdGAQCLRwEAjEcBAGVJAQBmSQEAtUwBALZMAQDHTAEAyEwBAMtMAQDMTAEA 7kwBAO9MAQDwTAEA8EwBAANNAQAETQEAdE0BAHVNAQB6TQEAe00BACtOAQAsTgEAbk8BAG9P AQDATwEAwU8BAMZQAQDHUAEAGVEBABpRAQBHUgEASFIBAGxSAQBtUgEAgFIBAIFSAQCpUgEA qlIBALBSAQCxUgEAj1MBAJBTAQD6UwEA+1MBAFtYAQBcWAEAX1gBAGBYAQApWgEAKloBADZa AQA3WgEAOloBADtaAQBXWgEAWFoBAHNaAQB0WgEAd1oBAHhaAQAvWwEAMFsBAIFbAQCCWwEA 9VsBAPZbAQAVXAEAFlwBAENcAQBEXAEAlVwBAJZcAQAvXgEAMF4BAFxeAQBdXgEAaF4BAGle AQBsXgEAbV4BAApfAQALXwEATF8BAE1fAQDLXwEAzF8BAMNgAQDEYAEAx2ABAMhgAQBgZAEA YWQBAGRkAQBlZAEAAGUBAAFlAQDVZQEA1mUBAO9nAQDwZwEAI2gBACRoAQByaQEAc2kBAINp AQCEaQEAh2kBAIhpAQCJaQEAiWkBAKR0AQCldAEAj3gBAJB4AQC9eAEAvngBAOp4AQDreAEA KnkBACt5AQBPeQEAUHkBAK55AQCveQEA7nkBAO95AQASegEAE3oBAEB6AQBBegEAbXoBAG56 AQCtegEArnoBANR6AQDVegEAnXsBAJ17AQBVfAEAV3wBAMh9AQDKfQEAQX4BAEF+AQCWfgEA mH4BAMF+AQDDfgEABH8BAAR/AQAZfwEAGX8BAF9/AQBhfwEAT4EBAGOBAQBkgQEAg4EBAIWB AQCggQEAo4EBAMmBAQDLgQEA74MBAPKDAQAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMA BAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQA AwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMA BAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQA AwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMA BAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQA AwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMA BAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQA AwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMA BAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQA AwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMA BAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQA AwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMA BAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQA AwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMA BAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQA AwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMA BAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQA AwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMA BAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQA AwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMA BAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQA AwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMA BAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQA AwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMA BAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQA AwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMA BAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQA AwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMA BAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQAAwAEAAMABAADAAQA AgACAAQABwAEAAcAAgAEAAIAKwCROI8HFO881f8P/w//D/8P/w//D/8P/w//DxAANG0GCSLC Bmz/D/8P/w//D/8P/w//D/8P/w8QAIJxQw2e1STL/w//D/8P/w//D/8P/w//D/8PEACacGoQ dg4Uk/8P/w//D/8P/w//D/8P/w//DxAA3we2EgJO2kX/D/8P/w//D/8P/w//D/8P/w8QACEq rhM8DWTz/w//D/8P/w//D/8P/w//D/8PEAA7Y2cYTokK/v8P/w//D/8P/w//D/8P/w//DxAA tTOOGJbWfrf/D/8P/w//D/8P/w//D/8P/w8QAGYWshhGRUAX/w//D/8P/w//D/8P/w//D/8P EACcR4scVOq2/f8P/w//D/8P/w//D/8P/w//DxAAmxbbHWZL0OD/D/8P/w//D/8P/w//D/8P /w8QAPBjbSJq+4gf/w//D/8P/w//D/8P/w//D/8PEAA/CbAlRr14FP8P/w//D/8P/w//D/8P /w//DxAAwCsSKkRBDFj/D/8P/w//D/8P/w//D/8P/w8QAG0T0i1AzmAG/w//D/8P/w//D/8P /w//D/8PEAC8Rl0zbFoQnv8P/w//D/8P/w//D/8P/w//DxAAQCCnOMKHHOH/D/8P/w//D/8P /w//D/8P/w8QAMQ/zTjQe2jw/w//D/8P/w//D/8P/w//D/8PEAANLSA5GsmGf/8P/w//D/8P /w//D/8P/w//DxAAPEGwPaQZ/tX/D/8P/w//D/8P/w//D/8P/w8QAIhlUT4kkajD/w//D/8P /w//D/8P/w//D/8PEAB/aLBEJOCCYP8P/w//D/8P/w//D/8P/w//DxAAQkouRQAVOCf/D/8P /w//D/8P/w//D/8P/w8QAEgNi0Y+uXSM/w//D/8P/w//D/8P/w//D/8PEAAkLmBJ3Kg6m/8P /w//D/8P/w//D/8P/w//DxAAozrGSwBkIpH/D/8P/w//D/8P/w//D/8P/w8QAPJ8+lIlAAwE AQACAAMABAAFAAYABwAIAAkAAADsL2NUWKGARf8P/w//D/8P/w//D/8P/w//DxAAXGtqVmyL Ntz/D/8P/w//D/8P/w//D/8P/w8QAKhAc11mu9RX/w//D/8P/w//D/8P/w//D/8PEADzfUlh ft32V/8P/w//D/8P/w//D/8P/w//DxAAGBJmaoAfqLz/D/8P/w//D/8P/w//D/8P/w8QALIA TGveGCjN/w//D/8P/w//D/8P/w//D/8PEAAqF5FtxNtAnP8P/w//D/8P/w//D/8P/w//DxAA H3W8buAh0Mr/D/8P/w//D/8P/w//D/8P/w8QAFxK52/uNsLb/w//D/8P/w//D/8P/w//D/8P EAAzDwB3hiugqv8P/w//D/8P/w//D/8P/w//DxAAFRVfeawzWtT/D/8P/w//D/8P/w//D/8P /w8QAP5fEHtYt+Db/w//D/8P/w//D/8P/w//D/8PEAB7LhN8iIE25/8P/w//D/8P/w//D/8P /w//DxAAHA62fYIc/tX/D/8P/w//D/8P/w//D/8P/w8QAMJQwn2+Ew7o/w//D/8P/w//D/8P /w//D/8PEAC3D3J/no26Bv8P/w//D/8P/w//D/8P/w//DxAACAAAABcAAAAAAAAAAAAAAGgB AAAAAAAAExAAAA+EDwYRhJj+XoQPBmCEmP5PSgAAUEoAAFFKAABeSgAAbygAAQATIAEAAAAX gAAAAAAAAAAAAAAAAAAAAAAAABkQAAAPhN8IEYSY/l6E3whghJj+T0oEAFFKBABeSgQAbygA h2gAAAAAiEgAAAEAbwABAAAAF4AAAAAAAAAAAAAAAAAAAAAAAAAVEAAAD4SvCxGEmP5ehK8L YISY/k9KCwBRSgsAbygAh2gAAAAAiEgAAAEAp/ABAAAAF4AAAAAAAAAAAAAAAAAAAAAAAAAV EAAAD4R/DhGEmP5ehH8OYISY/k9KAQBRSgEAbygAh2gAAAAAiEgAAAEAt/ABAAAAF4AAAAAA AAAAAAAAAAAAAAAAAAAZEAAAD4RPERGEmP5ehE8RYISY/k9KBABRSgQAXkoEAG8oAIdoAAAA AIhIAAABAG8AAQAAABeAAAAAAAAAAAAAAAAAAAAAAAAAFRAAAA+EHxQRhJj+XoQfFGCEmP5P SgsAUUoLAG8oAIdoAAAAAIhIAAABAKfwAQAAABeAAAAAAAAAAAAAAAAAAAAAAAAAFRAAAA+E 7xYRhJj+XoTvFmCEmP5PSgEAUUoBAG8oAIdoAAAAAIhIAAABALfwAQAAABeAAAAAAAAAAAAA AAAAAAAAAAAAGRAAAA+EvxkRhJj+XoS/GWCEmP5PSgQAUUoEAF5KBABvKACHaAAAAACISAAA AQBvAAEAAAAXgAAAAAAAAAAAAAAAAAAAAAAAABUQAAAPhI8cEYSY/l6EjxxghJj+T0oLAFFK CwBvKACHaAAAAACISAAAAQCn8AEAAAAXEAAAAAAAAAAAAABoAQAAAAAAABUQAAAPhOoFEYSY /l6E6gVghJj+T0oBAFFKAQBvKACHaAAAAACISAAAAQAt8AEAAAAXkAAAAAAAAAAAAABoAQAA AAAAABkQAAAPhLoIEYSY/l6EughghJj+T0oEAFFKBABeSgQAbygAh2gAAAAAiEgAAAEAbwAB AAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAVEAAAD4SKCxGEmP5ehIoLYISY/k9KCwBRSgsAbygA h2gAAAAAiEgAAAEAp/ABAAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAVEAAAD4RaDhGEmP5ehFoO YISY/k9KAQBRSgEAbygAh2gAAAAAiEgAAAEAt/ABAAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAZ EAAAD4QqERGEmP5ehCoRYISY/k9KBABRSgQAXkoEAG8oAIdoAAAAAIhIAAABAG8AAQAAABeQ AAAAAAAAAAAAAGgBAAAAAAAAFRAAAA+E+hMRhJj+XoT6E2CEmP5PSgsAUUoLAG8oAIdoAAAA AIhIAAABAKfwAQAAABeQAAAAAAAAAAAAAGgBAAAAAAAAFRAAAA+EyhYRhJj+XoTKFmCEmP5P SgEAUUoBAG8oAIdoAAAAAIhIAAABALfwAQAAABeQAAAAAAAAAAAAAGgBAAAAAAAAGRAAAA+E mhkRhJj+XoSaGWCEmP5PSgQAUUoEAF5KBABvKACHaAAAAACISAAAAQBvAAEAAAAXkAAAAAAA AAAAAABoAQAAAAAAABUQAAAPhGocEYSY/l6EahxghJj+T0oLAFFKCwBvKACHaAAAAACISAAA AQCn8AEAAAAXEAAAAAAAAAAAAABoAQAAAAAAABUQAAAPhA8GEYSY/l6EDwZghJj+T0oBAFFK AQBvKACHaAAAAACISAAAAQAt8AEAAAAXkAAAAAAAAAAAAABoAQAAAAAAABkQAAAPhN8IEYSY /l6E3whghJj+T0oEAFFKBABeSgQAbygAh2gAAAAAiEgAAAEAbwABAAAAF5AAAAAAAAAAAAAA aAEAAAAAAAAVEAAAD4SvCxGEmP5ehK8LYISY/k9KCwBRSgsAbygAh2gAAAAAiEgAAAEAp/AB AAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAVEAAAD4R/DhGEmP5ehH8OYISY/k9KAQBRSgEAbygA h2gAAAAAiEgAAAEAt/ABAAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAZEAAAD4RPERGEmP5ehE8R YISY/k9KBABRSgQAXkoEAG8oAIdoAAAAAIhIAAABAG8AAQAAABeQAAAAAAAAAAAAAGgBAAAA AAAAFRAAAA+EHxQRhJj+XoQfFGCEmP5PSgsAUUoLAG8oAIdoAAAAAIhIAAABAKfwAQAAABeQ AAAAAAAAAAAAAGgBAAAAAAAAFRAAAA+E7xYRhJj+XoTvFmCEmP5PSgEAUUoBAG8oAIdoAAAA AIhIAAABALfwAQAAABeQAAAAAAAAAAAAAGgBAAAAAAAAGRAAAA+EvxkRhJj+XoS/GWCEmP5P SgQAUUoEAF5KBABvKACHaAAAAACISAAAAQBvAAEAAAAXkAAAAAAAAAAAAABoAQAAAAAAABUQ AAAPhI8cEYSY/l6EjxxghJj+T0oLAFFKCwBvKACHaAAAAACISAAAAQCn8AEAAAAXEAAAAAAA AAAAAABoAQAAAAAAABUQAAAPhOoFEYSY/l6E6gVghJj+T0oBAFFKAQBvKACHaAAAAACISAAA AQAt8AEAAAAXkAAAAAAAAAAAAABoAQAAAAAAABkQAAAPhLoIEYSY/l6EughghJj+T0oEAFFK BABeSgQAbygAh2gAAAAAiEgAAAEAbwABAAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAVEAAAD4SK CxGEmP5ehIoLYISY/k9KCwBRSgsAbygAh2gAAAAAiEgAAAEAp/ABAAAAF5AAAAAAAAAAAAAA aAEAAAAAAAAVEAAAD4RaDhGEmP5ehFoOYISY/k9KAQBRSgEAbygAh2gAAAAAiEgAAAEAt/AB AAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAZEAAAD4QqERGEmP5ehCoRYISY/k9KBABRSgQAXkoE AG8oAIdoAAAAAIhIAAABAG8AAQAAABeQAAAAAAAAAAAAAGgBAAAAAAAAFRAAAA+E+hMRhJj+ XoT6E2CEmP5PSgsAUUoLAG8oAIdoAAAAAIhIAAABAKfwAQAAABeQAAAAAAAAAAAAAGgBAAAA AAAAFRAAAA+EyhYRhJj+XoTKFmCEmP5PSgEAUUoBAG8oAIdoAAAAAIhIAAABALfwAQAAABeQ AAAAAAAAAAAAAGgBAAAAAAAAGRAAAA+EmhkRhJj+XoSaGWCEmP5PSgQAUUoEAF5KBABvKACH aAAAAACISAAAAQBvAAEAAAAXkAAAAAAAAAAAAABoAQAAAAAAABUQAAAPhGocEYSY/l6Eahxg hJj+T0oLAFFKCwBvKACHaAAAAACISAAAAQCn8AEAAAAEEAEAAAAAAAAAAABoAQAAAAAAAAoQ AAAPhNACEYSY/l6E0AJghJj+h2gAAAAAiEgAAAIAAAApAAEAAAAEkAEAAAAAAAAAAABoAQAA AAAAAAoQAAAPhKAFEYSY/l6EoAVghJj+h2gAAAAAiEgAAAIAAQAuAAEAAAACkgEAAAAAAAAA AABoAQAAAAAAAAoQAAAPhHAIEYRM/16EcAhghEz/h2gAAAAAiEgAAAIAAgAuAAEAAAAAkAEA AAAAAAAAAABoAQAAAAAAAAoQAAAPhEALEYSY/l6EQAtghJj+h2gAAAAAiEgAAAIAAwAuAAEA AAAEkAEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhBAOEYSY/l6EEA5ghJj+h2gAAAAAiEgAAAIA BAAuAAEAAAACkgEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhOAQEYRM/16E4BBghEz/h2gAAAAA iEgAAAIABQAuAAEAAAAAkAEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhLATEYSY/l6EsBNghJj+ h2gAAAAAiEgAAAIABgAuAAEAAAAEkAEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhIAWEYSY/l6E gBZghJj+h2gAAAAAiEgAAAIABwAuAAEAAAACkgEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhFAZ EYRM/16EUBlghEz/h2gAAAAAiEgAAAIACAAuAAEAAAAEEAEAAAAAAAAAAABoAQAAAAAAAAoQ AAAPhNACEYSY/l6E0AJghJj+h2gAAAAAiEgAAAIAAAApAAEAAAAEkAEAAAAAAAAAAABoAQAA AAAAAAoQAAAPhKAFEYSY/l6EoAVghJj+h2gAAAAAiEgAAAIAAQAuAAEAAAACkgEAAAAAAAAA AABoAQAAAAAAAAoQAAAPhHAIEYRM/16EcAhghEz/h2gAAAAAiEgAAAIAAgAuAAEAAAAAkAEA AAAAAAAAAABoAQAAAAAAAAoQAAAPhEALEYSY/l6EQAtghJj+h2gAAAAAiEgAAAIAAwAuAAEA AAAEkAEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhBAOEYSY/l6EEA5ghJj+h2gAAAAAiEgAAAIA BAAuAAEAAAACkgEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhOAQEYRM/16E4BBghEz/h2gAAAAA iEgAAAIABQAuAAEAAAAAkAEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhLATEYSY/l6EsBNghJj+ h2gAAAAAiEgAAAIABgAuAAEAAAAEkAEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhIAWEYSY/l6E gBZghJj+h2gAAAAAiEgAAAIABwAuAAEAAAACkgEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhFAZ EYRM/16EUBlghEz/h2gAAAAAiEgAAAIACAAuAAEAAAAEAAEAAAAAAAAAAAAAAAAAAAAAABIQ AAAPhIIEEYSY/l6EggRghJj+NQgBQ0oSAE9KBABRSgQAbygAAgAAACkAAQAAAASAAQAAAAAA AAAAAAAAAAAAAAAAChAAAA+EUgcRhJj+XoRSB2CEmP6HaAAAAACISAAAAgABAC4AAQAAAAKC AQAAAAAAAAAAAAAAAAAAAAAAChAAAA+EIgoRhEz/XoQiCmCETP+HaAAAAACISAAAAgACAC4A AQAAAACAAQAAAAAAAAAAAAAAAAAAAAAAChAAAA+E8gwRhJj+XoTyDGCEmP6HaAAAAACISAAA AgADAC4AAQAAAASAAQAAAAAAAAAAAAAAAAAAAAAAChAAAA+Ewg8RhJj+XoTCD2CEmP6HaAAA AACISAAAAgAEAC4AAQAAAAKCAQAAAAAAAAAAAAAAAAAAAAAAChAAAA+EkhIRhEz/XoSSEmCE TP+HaAAAAACISAAAAgAFAC4AAQAAAACAAQAAAAAAAAAAAAAAAAAAAAAAChAAAA+EYhURhJj+ XoRiFWCEmP6HaAAAAACISAAAAgAGAC4AAQAAAASAAQAAAAAAAAAAAAAAAAAAAAAAChAAAA+E MhgRhJj+XoQyGGCEmP6HaAAAAACISAAAAgAHAC4AAQAAAAKCAQAAAAAAAAAAAAAAAAAAAAAA ChAAAA+EAhsRhEz/XoQCG2CETP+HaAAAAACISAAAAgAIAC4AAQAAAAQQAQAAAAAAAAAAAGgB AAAAAAAAChAAAA+E0AIRhJj+XoTQAmCEmP6HaAAAAACISAAAAgAAACkAAQAAAASQAQAAAAAA AAAAAGgBAAAAAAAAChAAAA+EoAURhJj+XoSgBWCEmP6HaAAAAACISAAAAgABAC4AAQAAAAKS AQAAAAAAAAAAAGgBAAAAAAAAChAAAA+EcAgRhEz/XoRwCGCETP+HaAAAAACISAAAAgACAC4A AQAAAACQAQAAAAAAAAAAAGgBAAAAAAAAChAAAA+EQAsRhJj+XoRAC2CEmP6HaAAAAACISAAA AgADAC4AAQAAAASQAQAAAAAAAAAAAGgBAAAAAAAAChAAAA+EEA4RhJj+XoQQDmCEmP6HaAAA AACISAAAAgAEAC4AAQAAAAKSAQAAAAAAAAAAAGgBAAAAAAAAChAAAA+E4BARhEz/XoTgEGCE TP+HaAAAAACISAAAAgAFAC4AAQAAAACQAQAAAAAAAAAAAGgBAAAAAAAAChAAAA+EsBMRhJj+ XoSwE2CEmP6HaAAAAACISAAAAgAGAC4AAQAAAASQAQAAAAAAAAAAAGgBAAAAAAAAChAAAA+E gBYRhJj+XoSAFmCEmP6HaAAAAACISAAAAgAHAC4AAQAAAAKSAQAAAAAAAAAAAGgBAAAAAAAA ChAAAA+EUBkRhEz/XoRQGWCETP+HaAAAAACISAAAAgAIAC4AAQAAABcQAAAAAAAAAAAAAGgB AAAAAAAAFRAAAA+EBAkRhJj+XoQECWCEmP5PSgEAUUoBAG8oAIdoAAAAAIhIAAABAC3wAQAA ABeQAAAAAAAAAAAAAGgBAAAAAAAAGRAAAA+E1AsRhJj+XoTUC2CEmP5PSgQAUUoEAF5KBABv KACHaAAAAACISAAAAQBvAAEAAAAXkAAAAAAAAAAAAABoAQAAAAAAABUQAAAPhKQOEYSY/l6E pA5ghJj+T0oLAFFKCwBvKACHaAAAAACISAAAAQCn8AEAAAAXkAAAAAAAAAAAAABoAQAAAAAA ABUQAAAPhHQREYSY/l6EdBFghJj+T0oBAFFKAQBvKACHaAAAAACISAAAAQC38AEAAAAXkAAA AAAAAAAAAABoAQAAAAAAABkQAAAPhEQUEYSY/l6ERBRghJj+T0oEAFFKBABeSgQAbygAh2gA AAAAiEgAAAEAbwABAAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAVEAAAD4QUFxGEmP5ehBQXYISY /k9KCwBRSgsAbygAh2gAAAAAiEgAAAEAp/ABAAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAVEAAA D4TkGRGEmP5ehOQZYISY/k9KAQBRSgEAbygAh2gAAAAAiEgAAAEAt/ABAAAAF5AAAAAAAAAA AAAAaAEAAAAAAAAZEAAAD4S0HBGEmP5ehLQcYISY/k9KBABRSgQAXkoEAG8oAIdoAAAAAIhI AAABAG8AAQAAABeQAAAAAAAAAAAAAGgBAAAAAAAAFRAAAA+EhB8RhJj+XoSEH2CEmP5PSgsA UUoLAG8oAIdoAAAAAIhIAAABAKfwAQAAAAQQAQAAAAAAAAAAAGgBAAAAAAAAChAAAA+E0AIR hJj+XoTQAmCEmP6HaAAAAACISAAAAgAAACkAAQAAAASQAQAAAAAAAAAAAGgBAAAAAAAAChAA AA+EoAURhJj+XoSgBWCEmP6HaAAAAACISAAAAgABAC4AAQAAAAKSAQAAAAAAAAAAAGgBAAAA AAAAChAAAA+EcAgRhEz/XoRwCGCETP+HaAAAAACISAAAAgACAC4AAQAAAACQAQAAAAAAAAAA AGgBAAAAAAAAChAAAA+EQAsRhJj+XoRAC2CEmP6HaAAAAACISAAAAgADAC4AAQAAAASQAQAA AAAAAAAAAGgBAAAAAAAAChAAAA+EEA4RhJj+XoQQDmCEmP6HaAAAAACISAAAAgAEAC4AAQAA AAKSAQAAAAAAAAAAAGgBAAAAAAAAChAAAA+E4BARhEz/XoTgEGCETP+HaAAAAACISAAAAgAF AC4AAQAAAACQAQAAAAAAAAAAAGgBAAAAAAAAChAAAA+EsBMRhJj+XoSwE2CEmP6HaAAAAACI SAAAAgAGAC4AAQAAAASQAQAAAAAAAAAAAGgBAAAAAAAAChAAAA+EgBYRhJj+XoSAFmCEmP6H aAAAAACISAAAAgAHAC4AAQAAAAKSAQAAAAAAAAAAAGgBAAAAAAAAChAAAA+EUBkRhEz/XoRQ GWCETP+HaAAAAACISAAAAgAIAC4AAQAAABcQAAAAAAAAAAAAAGgBAAAAAAAAFRAAAA+E6gUR hJj+XoTqBWCEmP5PSgEAUUoBAG8oAIdoAAAAAIhIAAABAC3wAQAAABeQAAAAAAAAAAAAAGgB AAAAAAAAGRAAAA+EuggRhJj+XoS6CGCEmP5PSgQAUUoEAF5KBABvKACHaAAAAACISAAAAQBv AAEAAAAXkAAAAAAAAAAAAABoAQAAAAAAABUQAAAPhIoLEYSY/l6EigtghJj+T0oLAFFKCwBv KACHaAAAAACISAAAAQCn8AEAAAAXkAAAAAAAAAAAAABoAQAAAAAAABUQAAAPhFoOEYSY/l6E Wg5ghJj+T0oBAFFKAQBvKACHaAAAAACISAAAAQC38AEAAAAXkAAAAAAAAAAAAABoAQAAAAAA ABkQAAAPhCoREYSY/l6EKhFghJj+T0oEAFFKBABeSgQAbygAh2gAAAAAiEgAAAEAbwABAAAA F5AAAAAAAAAAAAAAaAEAAAAAAAAVEAAAD4T6ExGEmP5ehPoTYISY/k9KCwBRSgsAbygAh2gA AAAAiEgAAAEAp/ABAAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAVEAAAD4TKFhGEmP5ehMoWYISY /k9KAQBRSgEAbygAh2gAAAAAiEgAAAEAt/ABAAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAZEAAA D4SaGRGEmP5ehJoZYISY/k9KBABRSgQAXkoEAG8oAIdoAAAAAIhIAAABAG8AAQAAABeQAAAA AAAAAAAAAGgBAAAAAAAAFRAAAA+EahwRhJj+XoRqHGCEmP5PSgsAUUoLAG8oAIdoAAAAAIhI AAABAKfwCAAAABcQAAAAAAAAAAAAAGgBAAAAAAAAExAAAA+E0AIRhJj+XoTQAmCEmP5PSgAA UEoAAFFKAABeSgAAbygAAQATIAEAAAAXkAAAAAAAAAAAAABoAQAAAAAAABkQAAAPhKAFEYSY /l6EoAVghJj+T0oEAFFKBABeSgQAbygAh2gAAAAAiEgAAAEAbwABAAAAF5AAAAAAAAAAAAAA aAEAAAAAAAAVEAAAD4RwCBGEmP5ehHAIYISY/k9KCwBRSgsAbygAh2gAAAAAiEgAAAEAp/AB AAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAVEAAAD4RACxGEmP5ehEALYISY/k9KAQBRSgEAbygA h2gAAAAAiEgAAAEAt/ABAAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAZEAAAD4QQDhGEmP5ehBAO YISY/k9KBABRSgQAXkoEAG8oAIdoAAAAAIhIAAABAG8AAQAAABeQAAAAAAAAAAAAAGgBAAAA AAAAFRAAAA+E4BARhJj+XoTgEGCEmP5PSgsAUUoLAG8oAIdoAAAAAIhIAAABAKfwAQAAABeQ AAAAAAAAAAAAAGgBAAAAAAAAFRAAAA+EsBMRhJj+XoSwE2CEmP5PSgEAUUoBAG8oAIdoAAAA AIhIAAABALfwAQAAABeQAAAAAAAAAAAAAGgBAAAAAAAAGRAAAA+EgBYRhJj+XoSAFmCEmP5P SgQAUUoEAF5KBABvKACHaAAAAACISAAAAQBvAAEAAAAXkAAAAAAAAAAAAABoAQAAAAAAABUQ AAAPhFAZEYSY/l6EUBlghJj+T0oLAFFKCwBvKACHaAAAAACISAAAAQCn8AEAAAAEEAEAAAAA AAAAAABoAQAAAAAAAAoQAAAPhDgEEYSY/l6EOARghJj+h2gAAAAAiEgAAAIAAAApAAEAAAAE kAEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhAgHEYSY/l6ECAdghJj+h2gAAAAAiEgAAAIAAQAu AAEAAAACkgEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhNgJEYRM/16E2AlghEz/h2gAAAAAiEgA AAIAAgAuAAEAAAAAkAEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhKgMEYSY/l6EqAxghJj+h2gA AAAAiEgAAAIAAwAuAAEAAAAEkAEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhHgPEYSY/l6EeA9g hJj+h2gAAAAAiEgAAAIABAAuAAEAAAACkgEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhEgSEYRM /16ESBJghEz/h2gAAAAAiEgAAAIABQAuAAEAAAAAkAEAAAAAAAAAAABoAQAAAAAAAAoQAAAP hBgVEYSY/l6EGBVghJj+h2gAAAAAiEgAAAIABgAuAAEAAAAEkAEAAAAAAAAAAABoAQAAAAAA AAoQAAAPhOgXEYSY/l6E6BdghJj+h2gAAAAAiEgAAAIABwAuAAEAAAACkgEAAAAAAAAAAABo AQAAAAAAAAoQAAAPhLgaEYRM/16EuBpghEz/h2gAAAAAiEgAAAIACAAuAAEAAAAXEAAAAAAA AAAAAABoAQAAAAAAABUQAAAPhOoFEYSY/l6E6gVghJj+T0oBAFFKAQBvKACHaAAAAACISAAA AQAt8AEAAAAXkAAAAAAAAAAAAABoAQAAAAAAABkQAAAPhLoIEYSY/l6EughghJj+T0oEAFFK BABeSgQAbygAh2gAAAAAiEgAAAEAbwABAAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAVEAAAD4SK CxGEmP5ehIoLYISY/k9KCwBRSgsAbygAh2gAAAAAiEgAAAEAp/ABAAAAF5AAAAAAAAAAAAAA aAEAAAAAAAAVEAAAD4RaDhGEmP5ehFoOYISY/k9KAQBRSgEAbygAh2gAAAAAiEgAAAEAt/AB AAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAZEAAAD4QqERGEmP5ehCoRYISY/k9KBABRSgQAXkoE AG8oAIdoAAAAAIhIAAABAG8AAQAAABeQAAAAAAAAAAAAAGgBAAAAAAAAFRAAAA+E+hMRhJj+ XoT6E2CEmP5PSgsAUUoLAG8oAIdoAAAAAIhIAAABAKfwAQAAABeQAAAAAAAAAAAAAGgBAAAA AAAAFRAAAA+EyhYRhJj+XoTKFmCEmP5PSgEAUUoBAG8oAIdoAAAAAIhIAAABALfwAQAAABeQ AAAAAAAAAAAAAGgBAAAAAAAAGRAAAA+EmhkRhJj+XoSaGWCEmP5PSgQAUUoEAF5KBABvKACH aAAAAACISAAAAQBvAAEAAAAXkAAAAAAAAAAAAABoAQAAAAAAABUQAAAPhGocEYSY/l6Eahxg hJj+T0oLAFFKCwBvKACHaAAAAACISAAAAQCn8AEAAAAXEAAAAAAAAAAAAABoAQAAAAAAABUQ AAAPhNACEYSY/l6E0AJghJj+T0oBAFFKAQBvKACHaAAAAACISAAAAQAt8AEAAAAXkAAAAAAA AAAAAABoAQAAAAAAABkQAAAPhKAFEYSY/l6EoAVghJj+T0oEAFFKBABeSgQAbygAh2gAAAAA iEgAAAEAbwABAAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAVEAAAD4RwCBGEmP5ehHAIYISY/k9K CwBRSgsAbygAh2gAAAAAiEgAAAEAp/ABAAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAVEAAAD4RA CxGEmP5ehEALYISY/k9KAQBRSgEAbygAh2gAAAAAiEgAAAEAt/ABAAAAF5AAAAAAAAAAAAAA aAEAAAAAAAAZEAAAD4QQDhGEmP5ehBAOYISY/k9KBABRSgQAXkoEAG8oAIdoAAAAAIhIAAAB AG8AAQAAABeQAAAAAAAAAAAAAGgBAAAAAAAAFRAAAA+E4BARhJj+XoTgEGCEmP5PSgsAUUoL AG8oAIdoAAAAAIhIAAABAKfwAQAAABeQAAAAAAAAAAAAAGgBAAAAAAAAFRAAAA+EsBMRhJj+ XoSwE2CEmP5PSgEAUUoBAG8oAIdoAAAAAIhIAAABALfwAQAAABeQAAAAAAAAAAAAAGgBAAAA AAAAGRAAAA+EgBYRhJj+XoSAFmCEmP5PSgQAUUoEAF5KBABvKACHaAAAAACISAAAAQBvAAEA AAAXkAAAAAAAAAAAAABoAQAAAAAAABUQAAAPhFAZEYSY/l6EUBlghJj+T0oLAFFKCwBvKACH aAAAAACISAAAAQCn8AEAAAAEEAEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhNACEYSY/l6E0AJg hJj+h2gAAAAAiEgAAAIAAAApAAEAAAAEkAEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhKAFEYSY /l6EoAVghJj+h2gAAAAAiEgAAAIAAQAuAAEAAAACkgEAAAAAAAAAAABoAQAAAAAAAAoQAAAP hHAIEYRM/16EcAhghEz/h2gAAAAAiEgAAAIAAgAuAAEAAAAAkAEAAAAAAAAAAABoAQAAAAAA AAoQAAAPhEALEYSY/l6EQAtghJj+h2gAAAAAiEgAAAIAAwAuAAEAAAAEkAEAAAAAAAAAAABo AQAAAAAAAAoQAAAPhBAOEYSY/l6EEA5ghJj+h2gAAAAAiEgAAAIABAAuAAEAAAACkgEAAAAA AAAAAABoAQAAAAAAAAoQAAAPhOAQEYRM/16E4BBghEz/h2gAAAAAiEgAAAIABQAuAAEAAAAA kAEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhLATEYSY/l6EsBNghJj+h2gAAAAAiEgAAAIABgAu AAEAAAAEkAEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhIAWEYSY/l6EgBZghJj+h2gAAAAAiEgA AAIABwAuAAEAAAACkgEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhFAZEYRM/16EUBlghEz/h2gA AAAAiEgAAAIACAAuAAEAAAAXEAAAAAAAAAAAAABoAQAAAAAAABUQAAAPhOoFEYSY/l6E6gVg hJj+T0oBAFFKAQBvKACHaAAAAACISAAAAQAt8AEAAAAXkAAAAAAAAAAAAABoAQAAAAAAABkQ AAAPhLoIEYSY/l6EughghJj+T0oEAFFKBABeSgQAbygAh2gAAAAAiEgAAAEAbwABAAAAF5AA AAAAAAAAAAAAaAEAAAAAAAAVEAAAD4SKCxGEmP5ehIoLYISY/k9KCwBRSgsAbygAh2gAAAAA iEgAAAEAp/ABAAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAVEAAAD4RaDhGEmP5ehFoOYISY/k9K AQBRSgEAbygAh2gAAAAAiEgAAAEAt/ABAAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAZEAAAD4Qq ERGEmP5ehCoRYISY/k9KBABRSgQAXkoEAG8oAIdoAAAAAIhIAAABAG8AAQAAABeQAAAAAAAA AAAAAGgBAAAAAAAAFRAAAA+E+hMRhJj+XoT6E2CEmP5PSgsAUUoLAG8oAIdoAAAAAIhIAAAB AKfwAQAAABeQAAAAAAAAAAAAAGgBAAAAAAAAFRAAAA+EyhYRhJj+XoTKFmCEmP5PSgEAUUoB AG8oAIdoAAAAAIhIAAABALfwAQAAABeQAAAAAAAAAAAAAGgBAAAAAAAAGRAAAA+EmhkRhJj+ XoSaGWCEmP5PSgQAUUoEAF5KBABvKACHaAAAAACISAAAAQBvAAEAAAAXkAAAAAAAAAAAAABo AQAAAAAAABUQAAAPhGocEYSY/l6EahxghJj+T0oLAFFKCwBvKACHaAAAAACISAAAAQCn8AEA AAAEEAEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhNACEYSY/l6E0AJghJj+h2gAAAAAiEgAAAIA AAApAAEAAAAEkAEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhKAFEYSY/l6EoAVghJj+h2gAAAAA iEgAAAIAAQAuAAEAAAACkgEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhHAIEYRM/16EcAhghEz/ h2gAAAAAiEgAAAIAAgAuAAEAAAAAkAEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhEALEYSY/l6E QAtghJj+h2gAAAAAiEgAAAIAAwAuAAEAAAAEkAEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhBAO EYSY/l6EEA5ghJj+h2gAAAAAiEgAAAIABAAuAAEAAAACkgEAAAAAAAAAAABoAQAAAAAAAAoQ AAAPhOAQEYRM/16E4BBghEz/h2gAAAAAiEgAAAIABQAuAAEAAAAAkAEAAAAAAAAAAABoAQAA AAAAAAoQAAAPhLATEYSY/l6EsBNghJj+h2gAAAAAiEgAAAIABgAuAAEAAAAEkAEAAAAAAAAA AABoAQAAAAAAAAoQAAAPhIAWEYSY/l6EgBZghJj+h2gAAAAAiEgAAAIABwAuAAEAAAACkgEA AAAAAAAAAABoAQAAAAAAAAoQAAAPhFAZEYRM/16EUBlghEz/h2gAAAAAiEgAAAIACAAuAAEA AAAEEAEAAAAAAAAAAABoAQAAAAAAAA0QAAAPhNACEYSY/l6E0AJghJj+bygAh2gAAAAAiEgA AAIAAAApAAEAAAAEkAEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhKAFEYSY/l6EoAVghJj+h2gA AAAAiEgAAAIAAQAuAAEAAAACkgEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhHAIEYRM/16EcAhg hEz/h2gAAAAAiEgAAAIAAgAuAAEAAAAAkAEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhEALEYSY /l6EQAtghJj+h2gAAAAAiEgAAAIAAwAuAAEAAAAEkAEAAAAAAAAAAABoAQAAAAAAAAoQAAAP hBAOEYSY/l6EEA5ghJj+h2gAAAAAiEgAAAIABAAuAAEAAAACkgEAAAAAAAAAAABoAQAAAAAA AAoQAAAPhOAQEYRM/16E4BBghEz/h2gAAAAAiEgAAAIABQAuAAEAAAAAkAEAAAAAAAAAAABo AQAAAAAAAAoQAAAPhLATEYSY/l6EsBNghJj+h2gAAAAAiEgAAAIABgAuAAEAAAAEkAEAAAAA AAAAAABoAQAAAAAAAAoQAAAPhIAWEYSY/l6EgBZghJj+h2gAAAAAiEgAAAIABwAuAAEAAAAC kgEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhFAZEYRM/16EUBlghEz/h2gAAAAAiEgAAAIACAAu AAEAAAAXEAAAAAAAAAAAAABoAQAAAAAAABUQAAAPhA8GEYSY/l6EDwZghJj+T0oBAFFKAQBv KACHaAAAAACISAAAAQAt8AEAAAAXkAAAAAAAAAAAAABoAQAAAAAAABkQAAAPhN8IEYSY/l6E 3whghJj+T0oEAFFKBABeSgQAbygAh2gAAAAAiEgAAAEAbwABAAAAF5AAAAAAAAAAAAAAaAEA AAAAAAAVEAAAD4SvCxGEmP5ehK8LYISY/k9KCwBRSgsAbygAh2gAAAAAiEgAAAEAp/ABAAAA F5AAAAAAAAAAAAAAaAEAAAAAAAAVEAAAD4R/DhGEmP5ehH8OYISY/k9KAQBRSgEAbygAh2gA AAAAiEgAAAEAt/ABAAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAZEAAAD4RPERGEmP5ehE8RYISY /k9KBABRSgQAXkoEAG8oAIdoAAAAAIhIAAABAG8AAQAAABeQAAAAAAAAAAAAAGgBAAAAAAAA FRAAAA+EHxQRhJj+XoQfFGCEmP5PSgsAUUoLAG8oAIdoAAAAAIhIAAABAKfwAQAAABeQAAAA AAAAAAAAAGgBAAAAAAAAFRAAAA+E7xYRhJj+XoTvFmCEmP5PSgEAUUoBAG8oAIdoAAAAAIhI AAABALfwAQAAABeQAAAAAAAAAAAAAGgBAAAAAAAAGRAAAA+EvxkRhJj+XoS/GWCEmP5PSgQA UUoEAF5KBABvKACHaAAAAACISAAAAQBvAAEAAAAXkAAAAAAAAAAAAABoAQAAAAAAABUQAAAP hI8cEYSY/l6EjxxghJj+T0oLAFFKCwBvKACHaAAAAACISAAAAQCn8AEAAAAXEAAAAAAAAAAA AABoAQAAAAAAABUQAAAPhNACEYSY/l6E0AJghJj+T0oBAFFKAQBvKACHaAAAAACISAAAAQAt 8AEAAAAXkAAAAAAAAAAAAABoAQAAAAAAABkQAAAPhKAFEYSY/l6EoAVghJj+T0oEAFFKBABe SgQAbygAh2gAAAAAiEgAAAEAbwABAAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAVEAAAD4RwCBGE mP5ehHAIYISY/k9KCwBRSgsAbygAh2gAAAAAiEgAAAEAp/ABAAAAF5AAAAAAAAAAAAAAaAEA AAAAAAAVEAAAD4RACxGEmP5ehEALYISY/k9KAQBRSgEAbygAh2gAAAAAiEgAAAEAt/ABAAAA F5AAAAAAAAAAAAAAaAEAAAAAAAAZEAAAD4QQDhGEmP5ehBAOYISY/k9KBABRSgQAXkoEAG8o AIdoAAAAAIhIAAABAG8AAQAAABeQAAAAAAAAAAAAAGgBAAAAAAAAFRAAAA+E4BARhJj+XoTg EGCEmP5PSgsAUUoLAG8oAIdoAAAAAIhIAAABAKfwAQAAABeQAAAAAAAAAAAAAGgBAAAAAAAA FRAAAA+EsBMRhJj+XoSwE2CEmP5PSgEAUUoBAG8oAIdoAAAAAIhIAAABALfwAQAAABeQAAAA AAAAAAAAAGgBAAAAAAAAGRAAAA+EgBYRhJj+XoSAFmCEmP5PSgQAUUoEAF5KBABvKACHaAAA AACISAAAAQBvAAEAAAAXkAAAAAAAAAAAAABoAQAAAAAAABUQAAAPhFAZEYSY/l6EUBlghJj+ T0oLAFFKCwBvKACHaAAAAACISAAAAQCn8AgAAAAXEAAAAAAAAAAAAABoAQAAAAAAABMQAAAP hNACEYSY/l6E0AJghJj+T0oAAFBKAABRSgAAXkoAAG8oAAEAEyABAAAAF5AAAAAAAAAAAAAA aAEAAAAAAAAZEAAAD4SgBRGEmP5ehKAFYISY/k9KBABRSgQAXkoEAG8oAIdoAAAAAIhIAAAB AG8AAQAAABeQAAAAAAAAAAAAAGgBAAAAAAAAFRAAAA+EcAgRhJj+XoRwCGCEmP5PSgsAUUoL AG8oAIdoAAAAAIhIAAABAKfwAQAAABeQAAAAAAAAAAAAAGgBAAAAAAAAFRAAAA+EQAsRhJj+ XoRAC2CEmP5PSgEAUUoBAG8oAIdoAAAAAIhIAAABALfwAQAAABeQAAAAAAAAAAAAAGgBAAAA AAAAGRAAAA+EEA4RhJj+XoQQDmCEmP5PSgQAUUoEAF5KBABvKACHaAAAAACISAAAAQBvAAEA AAAXkAAAAAAAAAAAAABoAQAAAAAAABUQAAAPhOAQEYSY/l6E4BBghJj+T0oLAFFKCwBvKACH aAAAAACISAAAAQCn8AEAAAAXkAAAAAAAAAAAAABoAQAAAAAAABUQAAAPhLATEYSY/l6EsBNg hJj+T0oBAFFKAQBvKACHaAAAAACISAAAAQC38AEAAAAXkAAAAAAAAAAAAABoAQAAAAAAABkQ AAAPhIAWEYSY/l6EgBZghJj+T0oEAFFKBABeSgQAbygAh2gAAAAAiEgAAAEAbwABAAAAF5AA AAAAAAAAAAAAaAEAAAAAAAAVEAAAD4RQGRGEmP5ehFAZYISY/k9KCwBRSgsAbygAh2gAAAAA iEgAAAEAp/ABAAAAFxAAAAAAAAAAAAAAaAEAAAAAAAAVEAAAD4TQAhGEmP5ehNACYISY/k9K AQBRSgEAbygAh2gAAAAAiEgAAAEALfABAAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAZEAAAD4Sg BRGEmP5ehKAFYISY/k9KBABRSgQAXkoEAG8oAIdoAAAAAIhIAAABAG8AAQAAABeQAAAAAAAA AAAAAGgBAAAAAAAAFRAAAA+EcAgRhJj+XoRwCGCEmP5PSgsAUUoLAG8oAIdoAAAAAIhIAAAB AKfwAQAAABeQAAAAAAAAAAAAAGgBAAAAAAAAFRAAAA+EQAsRhJj+XoRAC2CEmP5PSgEAUUoB AG8oAIdoAAAAAIhIAAABALfwAQAAABeQAAAAAAAAAAAAAGgBAAAAAAAAGRAAAA+EEA4RhJj+ XoQQDmCEmP5PSgQAUUoEAF5KBABvKACHaAAAAACISAAAAQBvAAEAAAAXkAAAAAAAAAAAAABo AQAAAAAAABUQAAAPhOAQEYSY/l6E4BBghJj+T0oLAFFKCwBvKACHaAAAAACISAAAAQCn8AEA AAAXkAAAAAAAAAAAAABoAQAAAAAAABUQAAAPhLATEYSY/l6EsBNghJj+T0oBAFFKAQBvKACH aAAAAACISAAAAQC38AEAAAAXkAAAAAAAAAAAAABoAQAAAAAAABkQAAAPhIAWEYSY/l6EgBZg hJj+T0oEAFFKBABeSgQAbygAh2gAAAAAiEgAAAEAbwABAAAAF5AAAAAAAAAAAAAAaAEAAAAA AAAVEAAAD4RQGRGEmP5ehFAZYISY/k9KCwBRSgsAbygAh2gAAAAAiEgAAAEAp/ABAAAAFxAA AAAAAAAAAAAAaAEAAAAAAAAVEAAAD4QPBhGEmP5ehA8GYISY/k9KAQBRSgEAbygAh2gAAAAA iEgAAAEALfABAAAABJABAAAAAAAAAAAAaAEAAAAAAAAKEAAAD4TfCBGEmP5ehN8IYISY/odo AAAAAIhIAAACAAEALgABAAAAApIBAAAAAAAAAAAAaAEAAAAAAAAKEAAAD4SvCxGETP9ehK8L YIRM/4doAAAAAIhIAAACAAIALgABAAAAAJABAAAAAAAAAAAAaAEAAAAAAAAKEAAAD4R/DhGE mP5ehH8OYISY/odoAAAAAIhIAAACAAMALgABAAAABJABAAAAAAAAAAAAaAEAAAAAAAAKEAAA D4RPERGEmP5ehE8RYISY/odoAAAAAIhIAAACAAQALgABAAAAApIBAAAAAAAAAAAAaAEAAAAA AAAKEAAAD4QfFBGETP9ehB8UYIRM/4doAAAAAIhIAAACAAUALgABAAAAAJABAAAAAAAAAAAA aAEAAAAAAAAKEAAAD4TvFhGEmP5ehO8WYISY/odoAAAAAIhIAAACAAYALgABAAAABJABAAAA AAAAAAAAaAEAAAAAAAAKEAAAD4S/GRGEmP5ehL8ZYISY/odoAAAAAIhIAAACAAcALgABAAAA ApIBAAAAAAAAAAAAaAEAAAAAAAAKEAAAD4SPHBGETP9ehI8cYIRM/4doAAAAAIhIAAACAAgA LgABAAAABBABAAAAAAAAAAAAaAEAAAAAAAAKEAAAD4TQAhGEmP5ehNACYISY/odoAAAAAIhI AAACAAAAKQABAAAABJABAAAAAAAAAAAAaAEAAAAAAAAKEAAAD4SgBRGEmP5ehKAFYISY/odo AAAAAIhIAAACAAEALgABAAAAApIBAAAAAAAAAAAAaAEAAAAAAAAKEAAAD4RwCBGETP9ehHAI YIRM/4doAAAAAIhIAAACAAIALgABAAAAAJABAAAAAAAAAAAAaAEAAAAAAAAKEAAAD4RACxGE mP5ehEALYISY/odoAAAAAIhIAAACAAMALgABAAAABJABAAAAAAAAAAAAaAEAAAAAAAAKEAAA D4QQDhGEmP5ehBAOYISY/odoAAAAAIhIAAACAAQALgABAAAAApIBAAAAAAAAAAAAaAEAAAAA AAAKEAAAD4TgEBGETP9ehOAQYIRM/4doAAAAAIhIAAACAAUALgABAAAAAJABAAAAAAAAAAAA aAEAAAAAAAAKEAAAD4SwExGEmP5ehLATYISY/odoAAAAAIhIAAACAAYALgABAAAABJABAAAA AAAAAAAAaAEAAAAAAAAKEAAAD4SAFhGEmP5ehIAWYISY/odoAAAAAIhIAAACAAcALgABAAAA ApIBAAAAAAAAAAAAaAEAAAAAAAAKEAAAD4RQGRGETP9ehFAZYIRM/4doAAAAAIhIAAACAAgA LgAIAAAAFxAAAAAAAAAAAAAAaAEAAAAAAAATEAAAD4TQAhGEmP5ehNACYISY/k9KAABQSgAA UUoAAF5KAABvKAABABMgAQAAABeQAAAAAAAAAAAAAGgBAAAAAAAAGRAAAA+EoAURhJj+XoSg BWCEmP5PSgQAUUoEAF5KBABvKACHaAAAAACISAAAAQBvAAEAAAAXkAAAAAAAAAAAAABoAQAA AAAAABUQAAAPhHAIEYSY/l6EcAhghJj+T0oLAFFKCwBvKACHaAAAAACISAAAAQCn8AEAAAAX kAAAAAAAAAAAAABoAQAAAAAAABUQAAAPhEALEYSY/l6EQAtghJj+T0oBAFFKAQBvKACHaAAA AACISAAAAQC38AEAAAAXkAAAAAAAAAAAAABoAQAAAAAAABkQAAAPhBAOEYSY/l6EEA5ghJj+ T0oEAFFKBABeSgQAbygAh2gAAAAAiEgAAAEAbwABAAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAV EAAAD4TgEBGEmP5ehOAQYISY/k9KCwBRSgsAbygAh2gAAAAAiEgAAAEAp/ABAAAAF5AAAAAA AAAAAAAAaAEAAAAAAAAVEAAAD4SwExGEmP5ehLATYISY/k9KAQBRSgEAbygAh2gAAAAAiEgA AAEAt/ABAAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAZEAAAD4SAFhGEmP5ehIAWYISY/k9KBABR SgQAXkoEAG8oAIdoAAAAAIhIAAABAG8AAQAAABeQAAAAAAAAAAAAAGgBAAAAAAAAFRAAAA+E UBkRhJj+XoRQGWCEmP5PSgsAUUoLAG8oAIdoAAAAAIhIAAABAKfwAQAAAAAAAQAAAAAAAAAA AAAAAAAAAAAAChAAAA+EsAERhFD+XoSwAWCEUP6HaAAAAACISAAAAQAAAAEAAAAAAAEDAAAA AAAAAAAAAAAAAAAAAAoQAAAPhEACEYTA/V6EQAJghMD9h2gAAAAAiEgAAAMAAAAuAAEAAQAA AAAAAQMFAAAAAAAAAAAAAAAAAAAAChAAAA+E0AIRhDD9XoTQAmCEMP2HaAAAAACISAAABQAA AC4AAQAuAAIAAQAAAAAAAQMFBwAAAAAAAAAAAAAAAAAAChAAAA+EYAMRhKD8XoRgA2CEoPyH aAAAAACISAAABwAAAC4AAQAuAAIALgADAAEAAAAAAAEDBQcJAAAAAAAAAAAAAAAAAAoQAAAP hPADEYQQ/F6E8ANghBD8h2gAAAAAiEgAAAkAAAAuAAEALgACAC4AAwAuAAQAAQAAAAAAAQMF BwkLAAAAAAAAAAAAAAAAChAAAA+EgAQRhID7XoSABGCEgPuHaAAAAACISAAACwAAAC4AAQAu AAIALgADAC4ABAAuAAUAAQAAAAAAAQMFBwkLDQAAAAAAAAAAAAAAChAAAA+EEAURhPD6XoQQ BWCE8PqHaAAAAACISAAADQAAAC4AAQAuAAIALgADAC4ABAAuAAUALgAGAAEAAAAAAAEDBQcJ Cw0PAAAAAAAAAAAAAAoQAAAPhKAFEYRg+l6EoAVghGD6h2gAAAAAiEgAAA8AAAAuAAEALgAC AC4AAwAuAAQALgAFAC4ABgAuAAcAAQAAAAAAAQMFBwkLDQ8RAAAAAAAAAAAAChAAAA+EMAYR hND5XoQwBmCE0PmHaAAAAACISAAAEQAAAC4AAQAuAAIALgADAC4ABAAuAAUALgAGAC4ABwAu AAgAAQAAAAQQAQAAAAAAAAAAAGgBAAAAAAAAChAAAA+E0AIRhJj+XoTQAmCEmP6HaAAAAACI SAAAAgAAACkAAQAAAASQAQAAAAAAAAAAAGgBAAAAAAAAChAAAA+EoAURhJj+XoSgBWCEmP6H aAAAAACISAAAAgABAC4AAQAAAAKSAQAAAAAAAAAAAGgBAAAAAAAAChAAAA+EcAgRhEz/XoRw CGCETP+HaAAAAACISAAAAgACAC4AAQAAAACQAQAAAAAAAAAAAGgBAAAAAAAAChAAAA+EQAsR hJj+XoRAC2CEmP6HaAAAAACISAAAAgADAC4AAQAAAASQAQAAAAAAAAAAAGgBAAAAAAAAChAA AA+EEA4RhJj+XoQQDmCEmP6HaAAAAACISAAAAgAEAC4AAQAAAAKSAQAAAAAAAAAAAGgBAAAA AAAAChAAAA+E4BARhEz/XoTgEGCETP+HaAAAAACISAAAAgAFAC4AAQAAAACQAQAAAAAAAAAA AGgBAAAAAAAAChAAAA+EsBMRhJj+XoSwE2CEmP6HaAAAAACISAAAAgAGAC4AAQAAAASQAQAA AAAAAAAAAGgBAAAAAAAAChAAAA+EgBYRhJj+XoSAFmCEmP6HaAAAAACISAAAAgAHAC4AAQAA AAKSAQAAAAAAAAAAAGgBAAAAAAAAChAAAA+EUBkRhEz/XoRQGWCETP+HaAAAAACISAAAAgAI AC4AAQAAABcQAAAAAAAAAAAAAGgBAAAAAAAAFRAAAA+E6gURhJj+XoTqBWCEmP5PSgEAUUoB AG8oAIdoAAAAAIhIAAABAC3wAQAAABeQAAAAAAAAAAAAAGgBAAAAAAAAGRAAAA+EuggRhJj+ XoS6CGCEmP5PSgQAUUoEAF5KBABvKACHaAAAAACISAAAAQBvAAEAAAAXkAAAAAAAAAAAAABo AQAAAAAAABUQAAAPhIoLEYSY/l6EigtghJj+T0oLAFFKCwBvKACHaAAAAACISAAAAQCn8AEA AAAXkAAAAAAAAAAAAABoAQAAAAAAABUQAAAPhFoOEYSY/l6EWg5ghJj+T0oBAFFKAQBvKACH aAAAAACISAAAAQC38AEAAAAXkAAAAAAAAAAAAABoAQAAAAAAABkQAAAPhCoREYSY/l6EKhFg hJj+T0oEAFFKBABeSgQAbygAh2gAAAAAiEgAAAEAbwABAAAAF5AAAAAAAAAAAAAAaAEAAAAA AAAVEAAAD4T6ExGEmP5ehPoTYISY/k9KCwBRSgsAbygAh2gAAAAAiEgAAAEAp/ABAAAAF5AA AAAAAAAAAAAAaAEAAAAAAAAVEAAAD4TKFhGEmP5ehMoWYISY/k9KAQBRSgEAbygAh2gAAAAA iEgAAAEAt/ABAAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAZEAAAD4SaGRGEmP5ehJoZYISY/k9K BABRSgQAXkoEAG8oAIdoAAAAAIhIAAABAG8AAQAAABeQAAAAAAAAAAAAAGgBAAAAAAAAFRAA AA+EahwRhJj+XoRqHGCEmP5PSgsAUUoLAG8oAIdoAAAAAIhIAAABAKfwAQAAABcQAAAAAAAA AAAAAGgBAAAAAAAAFRAAAA+EDwYRhJj+XoQPBmCEmP5PSgEAUUoBAG8oAIdoAAAAAIhIAAAB AC3wAQAAABeQAAAAAAAAAAAAAGgBAAAAAAAAGRAAAA+E3wgRhJj+XoTfCGCEmP5PSgQAUUoE AF5KBABvKACHaAAAAACISAAAAQBvAAEAAAAXkAAAAAAAAAAAAABoAQAAAAAAABUQAAAPhK8L EYSY/l6ErwtghJj+T0oLAFFKCwBvKACHaAAAAACISAAAAQCn8AEAAAAXkAAAAAAAAAAAAABo AQAAAAAAABUQAAAPhH8OEYSY/l6Efw5ghJj+T0oBAFFKAQBvKACHaAAAAACISAAAAQC38AEA AAAXkAAAAAAAAAAAAABoAQAAAAAAABkQAAAPhE8REYSY/l6ETxFghJj+T0oEAFFKBABeSgQA bygAh2gAAAAAiEgAAAEAbwABAAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAVEAAAD4QfFBGEmP5e hB8UYISY/k9KCwBRSgsAbygAh2gAAAAAiEgAAAEAp/ABAAAAF5AAAAAAAAAAAAAAaAEAAAAA AAAVEAAAD4TvFhGEmP5ehO8WYISY/k9KAQBRSgEAbygAh2gAAAAAiEgAAAEAt/ABAAAAF5AA AAAAAAAAAAAAaAEAAAAAAAAZEAAAD4S/GRGEmP5ehL8ZYISY/k9KBABRSgQAXkoEAG8oAIdo AAAAAIhIAAABAG8AAQAAABeQAAAAAAAAAAAAAGgBAAAAAAAAFRAAAA+EjxwRhJj+XoSPHGCE mP5PSgsAUUoLAG8oAIdoAAAAAIhIAAABAKfwAQAAABcQAAAAAAAAAAAAAGgBAAAAAAAAFRAA AA+E0AIRhJj+XoTQAmCEmP5PSgEAUUoBAG8oAIdoAAAAAIhIAAABAC3wAQAAABeQAAAAAAAA AAAAAGgBAAAAAAAAGRAAAA+EoAURhJj+XoSgBWCEmP5PSgQAUUoEAF5KBABvKACHaAAAAACI SAAAAQBvAAEAAAAXkAAAAAAAAAAAAABoAQAAAAAAABUQAAAPhHAIEYSY/l6EcAhghJj+T0oL AFFKCwBvKACHaAAAAACISAAAAQCn8AEAAAAXkAAAAAAAAAAAAABoAQAAAAAAABUQAAAPhEAL EYSY/l6EQAtghJj+T0oBAFFKAQBvKACHaAAAAACISAAAAQC38AEAAAAXkAAAAAAAAAAAAABo AQAAAAAAABkQAAAPhBAOEYSY/l6EEA5ghJj+T0oEAFFKBABeSgQAbygAh2gAAAAAiEgAAAEA bwABAAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAVEAAAD4TgEBGEmP5ehOAQYISY/k9KCwBRSgsA bygAh2gAAAAAiEgAAAEAp/ABAAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAVEAAAD4SwExGEmP5e hLATYISY/k9KAQBRSgEAbygAh2gAAAAAiEgAAAEAt/ABAAAAF5AAAAAAAAAAAAAAaAEAAAAA AAAZEAAAD4SAFhGEmP5ehIAWYISY/k9KBABRSgQAXkoEAG8oAIdoAAAAAIhIAAABAG8AAQAA ABeQAAAAAAAAAAAAAGgBAAAAAAAAFRAAAA+EUBkRhJj+XoRQGWCEmP5PSgsAUUoLAG8oAIdo AAAAAIhIAAABAKfwAQAAAAQQAQAAAAAAAAAAAGgBAAAAAAAAChAAAA+E0AIRhJj+XoTQAmCE mP6HaAAAAACISAAAAgAAACkAAQAAAASQAQAAAAAAAAAAAGgBAAAAAAAAChAAAA+EoAURhJj+ XoSgBWCEmP6HaAAAAACISAAAAgABAC4AAQAAAAKSAQAAAAAAAAAAAGgBAAAAAAAAChAAAA+E cAgRhEz/XoRwCGCETP+HaAAAAACISAAAAgACAC4AAQAAAACQAQAAAAAAAAAAAGgBAAAAAAAA ChAAAA+EQAsRhJj+XoRAC2CEmP6HaAAAAACISAAAAgADAC4AAQAAAASQAQAAAAAAAAAAAGgB AAAAAAAAChAAAA+EEA4RhJj+XoQQDmCEmP6HaAAAAACISAAAAgAEAC4AAQAAAAKSAQAAAAAA AAAAAGgBAAAAAAAAChAAAA+E4BARhEz/XoTgEGCETP+HaAAAAACISAAAAgAFAC4AAQAAAACQ AQAAAAAAAAAAAGgBAAAAAAAAChAAAA+EsBMRhJj+XoSwE2CEmP6HaAAAAACISAAAAgAGAC4A AQAAAASQAQAAAAAAAAAAAGgBAAAAAAAAChAAAA+EgBYRhJj+XoSAFmCEmP6HaAAAAACISAAA AgAHAC4AAQAAAAKSAQAAAAAAAAAAAGgBAAAAAAAAChAAAA+EUBkRhEz/XoRQGWCETP+HaAAA AACISAAAAgAIAC4AAQAAABcQAAAAAAAAAAAAAGgBAAAAAAAAFRAAAA+E6gURhJj+XoTqBWCE mP5PSgEAUUoBAG8oAIdoAAAAAIhIAAABAC3wAQAAABeQAAAAAAAAAAAAAGgBAAAAAAAAGRAA AA+EuggRhJj+XoS6CGCEmP5PSgQAUUoEAF5KBABvKACHaAAAAACISAAAAQBvAAEAAAAXkAAA AAAAAAAAAABoAQAAAAAAABUQAAAPhIoLEYSY/l6EigtghJj+T0oLAFFKCwBvKACHaAAAAACI SAAAAQCn8AEAAAAXkAAAAAAAAAAAAABoAQAAAAAAABUQAAAPhFoOEYSY/l6EWg5ghJj+T0oB AFFKAQBvKACHaAAAAACISAAAAQC38AEAAAAXkAAAAAAAAAAAAABoAQAAAAAAABkQAAAPhCoR EYSY/l6EKhFghJj+T0oEAFFKBABeSgQAbygAh2gAAAAAiEgAAAEAbwABAAAAF5AAAAAAAAAA AAAAaAEAAAAAAAAVEAAAD4T6ExGEmP5ehPoTYISY/k9KCwBRSgsAbygAh2gAAAAAiEgAAAEA p/ABAAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAVEAAAD4TKFhGEmP5ehMoWYISY/k9KAQBRSgEA bygAh2gAAAAAiEgAAAEAt/ABAAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAZEAAAD4SaGRGEmP5e hJoZYISY/k9KBABRSgQAXkoEAG8oAIdoAAAAAIhIAAABAG8AAQAAABeQAAAAAAAAAAAAAGgB AAAAAAAAFRAAAA+EahwRhJj+XoRqHGCEmP5PSgsAUUoLAG8oAIdoAAAAAIhIAAABAKfwCAAA ABcQAAAAAAAAAAAAAGgBAAAAAAAAExAAAA+EGAURhJj+XoQYBWCEmP5PSgAAUEoAAFFKAABe SgAAbygAAQATIAEAAAAXkAAAAAAAAAAAAABoAQAAAAAAABkQAAAPhOgHEYSY/l6E6AdghJj+ T0oEAFFKBABeSgQAbygAh2gAAAAAiEgAAAEAbwABAAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAV EAAAD4S4ChGEmP5ehLgKYISY/k9KCwBRSgsAbygAh2gAAAAAiEgAAAEAp/ABAAAAF5AAAAAA AAAAAAAAaAEAAAAAAAAVEAAAD4SIDRGEmP5ehIgNYISY/k9KAQBRSgEAbygAh2gAAAAAiEgA AAEAt/ABAAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAZEAAAD4RYEBGEmP5ehFgQYISY/k9KBABR SgQAXkoEAG8oAIdoAAAAAIhIAAABAG8AAQAAABeQAAAAAAAAAAAAAGgBAAAAAAAAFRAAAA+E KBMRhJj+XoQoE2CEmP5PSgsAUUoLAG8oAIdoAAAAAIhIAAABAKfwAQAAABeQAAAAAAAAAAAA AGgBAAAAAAAAFRAAAA+E+BURhJj+XoT4FWCEmP5PSgEAUUoBAG8oAIdoAAAAAIhIAAABALfw AQAAABeQAAAAAAAAAAAAAGgBAAAAAAAAGRAAAA+EyBgRhJj+XoTIGGCEmP5PSgQAUUoEAF5K BABvKACHaAAAAACISAAAAQBvAAEAAAAXkAAAAAAAAAAAAABoAQAAAAAAABUQAAAPhJgbEYSY /l6EmBtghJj+T0oLAFFKCwBvKACHaAAAAACISAAAAQCn8AEAAAAXEAAAAAAAAAAAAABoAQAA AAAAABUQAAAPhHcHEYSY/l6EdwdghJj+T0oBAFFKAQBvKACHaAAAAACISAAAAQAt8AEAAAAX kAAAAAAAAAAAAABoAQAAAAAAABkQAAAPhEcKEYSY/l6ERwpghJj+T0oEAFFKBABeSgQAbygA h2gAAAAAiEgAAAEAbwABAAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAVEAAAD4QXDRGEmP5ehBcN YISY/k9KCwBRSgsAbygAh2gAAAAAiEgAAAEAp/ABAAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAV EAAAD4TnDxGEmP5ehOcPYISY/k9KAQBRSgEAbygAh2gAAAAAiEgAAAEAt/ABAAAAF5AAAAAA AAAAAAAAaAEAAAAAAAAZEAAAD4S3EhGEmP5ehLcSYISY/k9KBABRSgQAXkoEAG8oAIdoAAAA AIhIAAABAG8AAQAAABeQAAAAAAAAAAAAAGgBAAAAAAAAFRAAAA+EhxURhJj+XoSHFWCEmP5P SgsAUUoLAG8oAIdoAAAAAIhIAAABAKfwAQAAABeQAAAAAAAAAAAAAGgBAAAAAAAAFRAAAA+E VxgRhJj+XoRXGGCEmP5PSgEAUUoBAG8oAIdoAAAAAIhIAAABALfwAQAAABeQAAAAAAAAAAAA AGgBAAAAAAAAGRAAAA+EJxsRhJj+XoQnG2CEmP5PSgQAUUoEAF5KBABvKACHaAAAAACISAAA AQBvAAEAAAAXkAAAAAAAAAAAAABoAQAAAAAAABUQAAAPhPcdEYSY/l6E9x1ghJj+T0oLAFFK CwBvKACHaAAAAACISAAAAQCn8AEAAAAEEAEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhNACEYSY /l6E0AJghJj+h2gAAAAAiEgAAAIAAAApAAEAAAAEkAEAAAAAAAAAAABoAQAAAAAAAAoQAAAP hKAFEYSY/l6EoAVghJj+h2gAAAAAiEgAAAIAAQAuAAEAAAACkgEAAAAAAAAAAABoAQAAAAAA AAoQAAAPhHAIEYRM/16EcAhghEz/h2gAAAAAiEgAAAIAAgAuAAEAAAAAkAEAAAAAAAAAAABo AQAAAAAAAAoQAAAPhEALEYSY/l6EQAtghJj+h2gAAAAAiEgAAAIAAwAuAAEAAAAEkAEAAAAA AAAAAABoAQAAAAAAAAoQAAAPhBAOEYSY/l6EEA5ghJj+h2gAAAAAiEgAAAIABAAuAAEAAAAC kgEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhOAQEYRM/16E4BBghEz/h2gAAAAAiEgAAAIABQAu AAEAAAAAkAEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhLATEYSY/l6EsBNghJj+h2gAAAAAiEgA AAIABgAuAAEAAAAEkAEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhIAWEYSY/l6EgBZghJj+h2gA AAAAiEgAAAIABwAuAAEAAAACkgEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhFAZEYRM/16EUBlg hEz/h2gAAAAAiEgAAAIACAAuAAEAAAAEEAEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhNACEYSY /l6E0AJghJj+h2gAAAAAiEgAAAIAAAApAAEAAAAEkAEAAAAAAAAAAABoAQAAAAAAAAoQAAAP hKAFEYSY/l6EoAVghJj+h2gAAAAAiEgAAAIAAQAuAAEAAAACkgEAAAAAAAAAAABoAQAAAAAA AAoQAAAPhHAIEYRM/16EcAhghEz/h2gAAAAAiEgAAAIAAgAuAAEAAAAAkAEAAAAAAAAAAABo AQAAAAAAAAoQAAAPhEALEYSY/l6EQAtghJj+h2gAAAAAiEgAAAIAAwAuAAEAAAAEkAEAAAAA AAAAAABoAQAAAAAAAAoQAAAPhBAOEYSY/l6EEA5ghJj+h2gAAAAAiEgAAAIABAAuAAEAAAAC kgEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhOAQEYRM/16E4BBghEz/h2gAAAAAiEgAAAIABQAu AAEAAAAAkAEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhLATEYSY/l6EsBNghJj+h2gAAAAAiEgA AAIABgAuAAEAAAAEkAEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhIAWEYSY/l6EgBZghJj+h2gA AAAAiEgAAAIABwAuAAEAAAACkgEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhFAZEYRM/16EUBlg hEz/h2gAAAAAiEgAAAIACAAuAAEAAAAEEAEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhNACEYSY /l6E0AJghJj+h2gAAAAAiEgAAAIAAAApAAEAAAAEkAEAAAAAAAAAAABoAQAAAAAAAAoQAAAP hKAFEYSY/l6EoAVghJj+h2gAAAAAiEgAAAIAAQAuAAEAAAACkgEAAAAAAAAAAABoAQAAAAAA AAoQAAAPhHAIEYRM/16EcAhghEz/h2gAAAAAiEgAAAIAAgAuAAEAAAAAkAEAAAAAAAAAAABo AQAAAAAAAAoQAAAPhEALEYSY/l6EQAtghJj+h2gAAAAAiEgAAAIAAwAuAAEAAAAEkAEAAAAA AAAAAABoAQAAAAAAAAoQAAAPhBAOEYSY/l6EEA5ghJj+h2gAAAAAiEgAAAIABAAuAAEAAAAC kgEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhOAQEYRM/16E4BBghEz/h2gAAAAAiEgAAAIABQAu AAEAAAAAkAEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhLATEYSY/l6EsBNghJj+h2gAAAAAiEgA AAIABgAuAAEAAAAEkAEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhIAWEYSY/l6EgBZghJj+h2gA AAAAiEgAAAIABwAuAAEAAAACkgEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhFAZEYRM/16EUBlg hEz/h2gAAAAAiEgAAAIACAAuAAEAAAAEEAEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhNACEYSY /l6E0AJghJj+h2gAAAAAiEgAAAIAAAApAAEAAAAEkAEAAAAAAAAAAABoAQAAAAAAAAoQAAAP hKAFEYSY/l6EoAVghJj+h2gAAAAAiEgAAAIAAQAuAAEAAAACkgEAAAAAAAAAAABoAQAAAAAA AAoQAAAPhHAIEYRM/16EcAhghEz/h2gAAAAAiEgAAAIAAgAuAAEAAAAAkAEAAAAAAAAAAABo AQAAAAAAAAoQAAAPhEALEYSY/l6EQAtghJj+h2gAAAAAiEgAAAIAAwAuAAEAAAAEkAEAAAAA AAAAAABoAQAAAAAAAAoQAAAPhBAOEYSY/l6EEA5ghJj+h2gAAAAAiEgAAAIABAAuAAEAAAAC kgEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhOAQEYRM/16E4BBghEz/h2gAAAAAiEgAAAIABQAu AAEAAAAAkAEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhLATEYSY/l6EsBNghJj+h2gAAAAAiEgA AAIABgAuAAEAAAAEkAEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhIAWEYSY/l6EgBZghJj+h2gA AAAAiEgAAAIABwAuAAEAAAACkgEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhFAZEYRM/16EUBlg hEz/h2gAAAAAiEgAAAIACAAuAAEAAAAEEAEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhNACEYSY /l6E0AJghJj+h2gAAAAAiEgAAAIAAAApAAEAAAAEkAEAAAAAAAAAAABoAQAAAAAAAAoQAAAP hKAFEYSY/l6EoAVghJj+h2gAAAAAiEgAAAIAAQAuAAEAAAACkgEAAAAAAAAAAABoAQAAAAAA AAoQAAAPhHAIEYRM/16EcAhghEz/h2gAAAAAiEgAAAIAAgAuAAEAAAAAkAEAAAAAAAAAAABo AQAAAAAAAAoQAAAPhEALEYSY/l6EQAtghJj+h2gAAAAAiEgAAAIAAwAuAAEAAAAEkAEAAAAA AAAAAABoAQAAAAAAAAoQAAAPhBAOEYSY/l6EEA5ghJj+h2gAAAAAiEgAAAIABAAuAAEAAAAC kgEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhOAQEYRM/16E4BBghEz/h2gAAAAAiEgAAAIABQAu AAEAAAAAkAEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhLATEYSY/l6EsBNghJj+h2gAAAAAiEgA AAIABgAuAAEAAAAEkAEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhIAWEYSY/l6EgBZghJj+h2gA AAAAiEgAAAIABwAuAAEAAAACkgEAAAAAAAAAAABoAQAAAAAAAAoQAAAPhFAZEYRM/16EUBlg hEz/h2gAAAAAiEgAAAIACAAuAAEAAAAXEAAAAAAAAAAAAABoAQAAAAAAABUQAAAPhOoFEYSY /l6E6gVghJj+T0oBAFFKAQBvKACHaAAAAACISAAAAQAt8AEAAAAXkAAAAAAAAAAAAABoAQAA AAAAABkQAAAPhLoIEYSY/l6EughghJj+T0oEAFFKBABeSgQAbygAh2gAAAAAiEgAAAEAbwAB AAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAVEAAAD4SKCxGEmP5ehIoLYISY/k9KCwBRSgsAbygA h2gAAAAAiEgAAAEAp/ABAAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAVEAAAD4RaDhGEmP5ehFoO YISY/k9KAQBRSgEAbygAh2gAAAAAiEgAAAEAt/ABAAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAZ EAAAD4QqERGEmP5ehCoRYISY/k9KBABRSgQAXkoEAG8oAIdoAAAAAIhIAAABAG8AAQAAABeQ AAAAAAAAAAAAAGgBAAAAAAAAFRAAAA+E+hMRhJj+XoT6E2CEmP5PSgsAUUoLAG8oAIdoAAAA AIhIAAABAKfwAQAAABeQAAAAAAAAAAAAAGgBAAAAAAAAFRAAAA+EyhYRhJj+XoTKFmCEmP5P SgEAUUoBAG8oAIdoAAAAAIhIAAABALfwAQAAABeQAAAAAAAAAAAAAGgBAAAAAAAAGRAAAA+E mhkRhJj+XoSaGWCEmP5PSgQAUUoEAF5KBABvKACHaAAAAACISAAAAQBvAAEAAAAXkAAAAAAA AAAAAABoAQAAAAAAABUQAAAPhGocEYSY/l6EahxghJj+T0oLAFFKCwBvKACHaAAAAACISAAA AQCn8AEAAAAXEAAAAAAAAAAAAABoAQAAAAAAABUQAAAPhA8GEYSY/l6EDwZghJj+T0oBAFFK AQBvKACHaAAAAACISAAAAQAt8AEAAAAXkAAAAAAAAAAAAABoAQAAAAAAABkQAAAPhN8IEYSY /l6E3whghJj+T0oEAFFKBABeSgQAbygAh2gAAAAAiEgAAAEAbwABAAAAF5AAAAAAAAAAAAAA aAEAAAAAAAAVEAAAD4SvCxGEmP5ehK8LYISY/k9KCwBRSgsAbygAh2gAAAAAiEgAAAEAp/AB AAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAVEAAAD4R/DhGEmP5ehH8OYISY/k9KAQBRSgEAbygA h2gAAAAAiEgAAAEAt/ABAAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAZEAAAD4RPERGEmP5ehE8R YISY/k9KBABRSgQAXkoEAG8oAIdoAAAAAIhIAAABAG8AAQAAABeQAAAAAAAAAAAAAGgBAAAA AAAAFRAAAA+EHxQRhJj+XoQfFGCEmP5PSgsAUUoLAG8oAIdoAAAAAIhIAAABAKfwAQAAABeQ AAAAAAAAAAAAAGgBAAAAAAAAFRAAAA+E7xYRhJj+XoTvFmCEmP5PSgEAUUoBAG8oAIdoAAAA AIhIAAABALfwAQAAABeQAAAAAAAAAAAAAGgBAAAAAAAAGRAAAA+EvxkRhJj+XoS/GWCEmP5P SgQAUUoEAF5KBABvKACHaAAAAACISAAAAQBvAAEAAAAXkAAAAAAAAAAAAABoAQAAAAAAABUQ AAAPhI8cEYSY/l6EjxxghJj+T0oLAFFKCwBvKACHaAAAAACISAAAAQCn8AEAAAAXEAAAAAAA AAAAAABoAQAAAAAAABUQAAAPhA8GEYSY/l6EDwZghJj+T0oBAFFKAQBvKACHaAAAAACISAAA AQAt8AEAAAAXkAAAAAAAAAAAAABoAQAAAAAAABkQAAAPhN8IEYSY/l6E3whghJj+T0oEAFFK BABeSgQAbygAh2gAAAAAiEgAAAEAbwABAAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAVEAAAD4Sv CxGEmP5ehK8LYISY/k9KCwBRSgsAbygAh2gAAAAAiEgAAAEAp/ABAAAAF5AAAAAAAAAAAAAA aAEAAAAAAAAVEAAAD4R/DhGEmP5ehH8OYISY/k9KAQBRSgEAbygAh2gAAAAAiEgAAAEAt/AB AAAAF5AAAAAAAAAAAAAAaAEAAAAAAAAZEAAAD4RPERGEmP5ehE8RYISY/k9KBABRSgQAXkoE AG8oAIdoAAAAAIhIAAABAG8AAQAAABeQAAAAAAAAAAAAAGgBAAAAAAAAFRAAAA+EHxQRhJj+ XoQfFGCEmP5PSgsAUUoLAG8oAIdoAAAAAIhIAAABAKfwAQAAABeQAAAAAAAAAAAAAGgBAAAA AAAAFRAAAA+E7xYRhJj+XoTvFmCEmP5PSgEAUUoBAG8oAIdoAAAAAIhIAAABALfwAQAAABeQ AAAAAAAAAAAAAGgBAAAAAAAAGRAAAA+EvxkRhJj+XoS/GWCEmP5PSgQAUUoEAF5KBABvKACH aAAAAACISAAAAQBvAAEAAAAXkAAAAAAAAAAAAABoAQAAAAAAABUQAAAPhI8cEYSY/l6Ejxxg hJj+T0oLAFFKCwBvKACHaAAAAACISAAAAQCn8CsAAABAIKc4AAAAAAAAAAAAAAAAbRPSLQAA AAAAAAAAAAAAAPN9SWEAAAAAAAAAAAAAAAA0bQYJAAAAAAAAAAAAAAAAmnBqEAAAAAAAAAAA AAAAALIATGsAAAAAAAAAAAAAAABCSi5FAAAAAAAAAAAAAAAAXGtqVgAAAAAAAAAAAAAAAMAr EioAAAAAAAAAAAAAAAAcDrZ9AAAAAAAAAAAAAAAAmxbbHQAAAAAAAAAAAAAAAJE4jwcAAAAA AAAAAAAAAADfB7YSAAAAAAAAAAAAAAAADS0gOQAAAAAAAAAAAAAAAB91vG4AAAAAAAAAAAAA AADCUMJ9AAAAAAAAAAAAAAAA7C9jVAAAAAAAAAAAAAAAAJxHixwAAAAAAAAAAAAAAABIDYtG AAAAAAAAAAAAAAAAPEGwPQAAAAAAAAAAAAAAACEqrhMAAAAAAAAAAAAAAAC8Rl0zAAAAAAAA AAAAAAAAey4TfAAAAAAAAAAAAAAAAP5fEHsAAAAAAAAAAAAAAABcSudvAAAAAAAAAAAAAAAA qEBzXQAAAAAAAAAAAAAAALUzjhgAAAAAAAAAAAAAAAAkLmBJAAAAAAAAAAAAAAAAGBJmagAA AAAAAAAAAAAAADMPAHcAAAAAAAAAAAAAAAC3D3J/AAAAAAAAAAAAAAAAgnFDDQAAAAAAAAAA AAAAAPJ8+lIAAAAAAAAAAAAAAACIZVE+AAAAAAAAAAAAAAAAZhayGAAAAAAAAAAAAAAAAPBj bSIAAAAAAAAAAAAAAAAqF5FtAAAAAAAAAAAAAAAAf2iwRAAAAAAAAAAAAAAAAKM6xksAAAAA AAAAAAAAAAA/CbAlAAAAAAAAAAAAAAAAFRVfeQAAAAAAAAAAAAAAAMQ/zTgAAAAAAAAAAAAA AAA7Y2cYAAAAAAAAAAAAAAAA//////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////KwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAA//8rAAAAEgCCdegJAwAMBAUADAQBAAwEAwAMBAUADAQBAAwEAwAMBAUA DAQSALqxHvkDAAwEBQAMBAEADAQDAAwEBQAMBAEADAQDAAwEBQAMBBIAurEe+QMADAQFAAwE AQAMBAMADAQFAAwEAQAMBAMADAQFAAwEEgC6sR75AwAMBAUADAQBAAwEAwAMBAUADAQBAAwE AwAMBAUADAQSABcADAQZAAwEGwAMBA8ADAQZAAwEGwAMBA8ADAQZAAwEGwAMBBIAFwAMBBkA DAQbAAwEDwAMBBkADAQbAAwEDwAMBBkADAQbAAwEEgAMwr5NGQAMBBsADAQPAAwEGQAMBBsA DAQPAAwEGQAMBBsADAQSABcADAQZAAwEGwAMBA8ADAQZAAwEGwAMBA8ADAQZAAwEGwAMBBIA urEe+QMADAQFAAwEAQAMBAMADAQFAAwEAQAMBAMADAQFAAwEEgAXAAwEGQAMBBsADAQPAAwE GQAMBBsADAQPAAwEGQAMBBsADAQSALqxHvkDAAwEBQAMBAEADAQDAAwEBQAMBAEADAQDAAwE BQAMBBIAgnXoCQMADAQFAAwEAQAMBAMADAQFAAwEAQAMBAMADAQFAAwEEgAXAAwEGQAMBBsA DAQPAAwEGQAMBBsADAQPAAwEGQAMBBsADAQSALqxHvkDAAwEBQAMBAEADAQDAAwEBQAMBAEA DAQDAAwEBQAMBBIAurEe+QMADAQFAAwEAQAMBAMADAQFAAwEAQAMBAMADAQFAAwEEgAXAAwE GQAMBBsADAQPAAwEGQAMBBsADAQPAAwEGQAMBBsADAQSALqxHvkDAAwEBQAMBAEADAQDAAwE BQAMBAEADAQDAAwEBQAMBBIAFwAMBBkADAQbAAwEDwAMBBkADAQbAAwEDwAMBBkADAQbAAwE EgB+LaacGQAMBBsADAQPAAwEGQAMBBsADAQPAAwEGQAMBBsADAQSALqxHvkDAAwEBQAMBAEA DAQDAAwEBQAMBAEADAQDAAwEBQAMBBIAurEe+QMADAQFAAwEAQAMBAMADAQFAAwEAQAMBAMA DAQFAAwEEgCCdegJAwAMBAUADAQBAAwEAwAMBAUADAQBAAwEAwAMBAUADAQSALqxHvkDAAwE BQAMBAEADAQDAAwEBQAMBAEADAQDAAwEBQAMBBIAurEe+RkADAQbAAwEDwAMBBkADAQbAAwE DwAMBBkADAQbAAwEEgAXAAwEGQAMBBsADAQPAAwEGQAMBBsADAQPAAwEGQAMBBsADAQSAIJ1 6AkDAAwEBQAMBAEADAQDAAwEBQAMBAEADAQDAAwEBQAMBAAAEgAXAAwEGQAMBBsADAQPAAwE GQAMBBsADAQPAAwEGQAMBBsADAQSALqxHvkDAAwEBQAMBAEADAQDAAwEBQAMBAEADAQDAAwE BQAMBBIAurEe+QMADAQFAAwEAQAMBAMADAQFAAwEAQAMBAMADAQFAAwEEgC6sR75AwAMBAUA DAQBAAwEAwAMBAUADAQBAAwEAwAMBAUADAQSABcADAQZAAwEGwAMBA8ADAQZAAwEGwAMBA8A DAQZAAwEGwAMBBIAurEe+QMADAQFAAwEAQAMBAMADAQFAAwEAQAMBAMADAQFAAwEEgCCdegJ AwAMBAUADAQBAAwEAwAMBAUADAQBAAwEAwAMBAUADAQSALqxHvkDAAwEBQAMBAEADAQDAAwE BQAMBAEADAQDAAwEBQAMBBIAFwAMBBkADAQbAAwEDwAMBBkADAQbAAwEDwAMBBkADAQbAAwE EgAXAAwEGQAMBBsADAQPAAwEGQAMBBsADAQPAAwEGQAMBBsADAQSABcADAQZAAwEGwAMBA8A DAQZAAwEGwAMBA8ADAQZAAwEGwAMBBIAFwAMBBkADAQbAAwEDwAMBBkADAQbAAwEDwAMBBkA DAQbAAwEEgAXAAwEGQAMBBsADAQPAAwEGQAMBBsADAQPAAwEGQAMBBsADAQSALqxHvkDAAwE BQAMBAEADAQDAAwEBQAMBAEADAQDAAwEBQAMBBIAurEe+QMADAQFAAwEAQAMBAMADAQFAAwE AQAMBAMADAQFAAwEEgC6sR75AwAMBAUADAQBAAwEAwAMBAUADAQBAAwEAwAMBAUADAQFAAAA AQAJCAUAAgBAAAEACQgGAAIAQAABAAwQBgACAEAAAQAJBAYAAgBAAAEADAQGAAIAQAADALFo +AAAAAAAAAAAAAABAgACAF8oUi8AAAAAAAAAAAABAgACAFB3KXkAAAAAAAAAAAABAgACAHsB AAAEAAAACAAAAOUAAAAAAAAAbwEAANY7AACURgAAQk0AAL9RAADqAQEAHgcBALUkAQD6FgIA mwIDAOszAwAhPAMAHQYEAHQVBAAXHQQAS2wEAL0BBgDZIwkAMSoKADBMCwBjOQwARXcMAJw4 DwBWfw8ATRwQAOk+EAAvJxEAuScSAAJPEgBHERMA+hQUANQWFAAPPRQA5kMUAGccFQD3RRUA d18VAA4aFgAbZRgAW2YZAFByGQBWcxkAghkaAKILGwCKGxwAwUUcANQJHQD2Lh0A9S8fALQ1 HwBGWh8APQEgACdjIADqPSIA8GIiAII1IwB/HiQAfCQkAEEZJQAFQiUASx4mAD1bJgBOECcA phwnAJ4jJwDdPCcAtREoAKUyKAAlCCoAhScqANBkKgCJISsAbUMsACxqLAB+Ti0AJQUuANxV LgA8CC8A2ggvAMEMLwDbIC8A/iIwAA8EMQBlJzMAOkgzAO1FNAAVTzQAF0w1APgWNgB0GTYA VHA2ACQtOADeRjkAXkw5AOQPOgDtSjoAQRE7ADsBPABFOj0AoRk/APIyPwAhKEAAJxlBADYp QQAlPUEASwpCAKQTQgA9JkIA4QhDACkTQwBecUMA/E5EAL4dRQBSOUUAW0VFAB0lRgCtB0cA wBlHAL1SRwDAX0cA8URJACZ0SQBJXEoAdytPAHI6TwAtb08A73JPAHwYUACzdlEAmnxRAD5E UgAxB1MAtDpTABFgUwAXD1QAZCRUANRJVACAPVUA1lZVALImVgDRcVYAwX5WAJsoWAA3IlkA MV1aAAkbWwBsL1sAb2dbAAoZXAB9NVwAA21cAHxpXwAKImAAuCJgAOc0YACnPmAAQmNhANU1 YgCDRmIAb35iAKNCYwCOBGQAakFkAEAIZwBtV2cATGVnAIQBaADpFmkAXAlqAHwUagAcJmoA ky9sAKY9bAAPX28AIldwANABcQAMZnEA0mdxAGpbcwDfCXQApw50AKdjdQA0E3cAujt3AGtU dwAgaXcAdwd4ABV0eAAtfHgA9gl5ANQYeQBFankAwwR6AOslegC4NHoAHi58AMRXfAD0ZHwA QEh9ABAKfgAtGH8Arzh/AAA7fwDtfX8AEQuAADEXgACndYAAESuBAMJIgQBMT4EACF6CAPIp gwCDKIQAak2EAF5yhACsBoYAAxWGAOdrhgCmcYYAK3mGADs8iAAGT4kAMTWKAMpiigDSUYsA 92eLAIdrjAC8QY0AVWKNAHFOjgDgO48AeXOPAJRXkQDcO5IAJmmSAHFzkgARAZMAwXiTAEIP lADbNZQAMlWUAJdilAAwQ5UAVkmVAKMKmAAHHZgA4TyYANhNmABkCJsAIhebAPkpmwAXDpwA qyacAMI0nADjXpwAolKdAKNSnQDaEZ4A50aeAKhXnwDKPaEA2iajAKo1owAoEKUA6zKlAHYJ pwBnYacAkxGoAE4hqQAcVqkAZkWqAAsErAA3e6wAPACuAJYvrgBtN64Ao1OuAINbrgC2OK8A zXqvAExdsQAqarEA7AS0AE0mtADcM7QAXwi1AGUltgAQVrcAv3C3AE1suQAVd7kA7Fe6AERo uwC9FL0AyH69AAAIvwCnDsEAhgjCABxfwgA2VMUAsW7GAA1axwBnecoA3y3LANs0ywB+TMwA QVLMAMx0zQCtOc4AVEnQAEJl0ADVcNAASUzRAN1u0gBuGtMATxXUAP901ACMfdUAcCLWACMG 2gCMeNsAgy/cAAVh3ADwHN0AglHdAHVX3QBVYd0A7g/eALtI3gDWF98ADUbfAFkK4ADYA+IA jWTiABES4wCiMOMAL0bkAEpG5ACKYOQADmrkACst5gCDLecAs0/nAOs86ADocugAgg7pAKwM 6wAUCe0AtlvtAPQX7gDVOe4AUQ3vAIgN7wASHfAAN0DwAJ8K8gAUffIAv1XzAJpc9ABtXvQA cmH0ANwd9QCvH/YAhz72AEY/9gB5TPYAJyP3APM8+QAEY/kA7AD6AINh+gApFfsA9nD7AOUv /ADLTvwAJCn9AAZD/QAUAf4A4gj+ADg6/wAAAAAAZIEBAGaBAQAAAAAAAQAAAP9AA4ABAGOB AQBjgQEAAAAAAAEAAQBjgQEAAAAAAGOBAQAYBoomAhAAAAAAAAAA8YMBAPgAABAAQAAA//8C AAAABwBVAG4AawBuAG8AdwBuABEASgBlAGEAbgAtAFAAYQB1AGwAIABMAGUAbQBhAGkAcgBl AP//AgAIAAAAAAAAAAAAAAAAAAAAAAAAAAEA//8CAAAAAAAAAP//AAACAP//AAAAAP//AAAC AP//AAAAAA0AAABHHpABAAACAgYDBQQFAgME/yoA4EF4AMAJAAAAAAAAAP8BAAAAAAAAVABp AG0AZQBzACAATgBlAHcAIABSAG8AbQBhAG4AAAA1HpABAgAFBQECAQcGAgUHAAAAAAAAABAA AAAAAAAAAAAAAIAAAAAAUwB5AG0AYgBvAGwAAAAzLpABAAACCwYEAgICAgIE/yoA4EN4AMAJ AAAAAAAAAP8BAAAAAAAAQQByAGkAYQBsAAAARz2QAYAKAgIGCQQCBQgDBP8CAOD7/cdqEgAA AAAAAACfAAIAAAAAAE0AUwAgAE0AaQBuAGMAaABvAAAALf8z/yAADmYdZwAAPz2QAQAAAgcD CQICBQIEBP8qAOBDeADACQAAAAAAAAD/AQAAAAAAAEMAbwB1AHIAaQBlAHIAIABOAGUAdwAA ADcukAEAAAIPBQICAgQDAgT/AgDg/6wAQAEAAAAAAAAAnwEAAAAAAABDAGEAbABpAGIAcgBp AAAAWRKQAQAJAAAAAAAAAAAAAAMAAAAAAAAAAAAAAAAAAAABAAAAAAAAAEMARwAgAFQAaQBt AGUAcwAAAFQAaQBtAGUAcwAgAE4AZQB3ACAAUgBvAG0AYQBuAAAAcRa8AgAVAgIIAwcFBQID BIc6AAAAAAAAAAAAAAAAAAD/AAAAAAAAAFQAaQBtAGUAcwAgAE4AZQB3ACAAUgBvAG0AYQBu ACAAQgBvAGwAZAAAAFQAaQBtAGUAcwAgAE4AZQB3ACAAUgBvAG0AYQBuAAAAMx6QAQAAAgIG AwUEBQIDBP8qAOBBeADACQAAAAAAAAD/AQAAAAAAAFQAaQBtAGUAcwAAAEkGkAECCgAAAAAA AAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAgAAAAABDADMAOQBUADMANgBMAGYAegAAAFMAeQBt AGIAbwBsAAAANS6QAQAAAgsGBAMFBAQCBP8uAOFbYADAKQAAAAAAAAD/AQEAAAAAAFQAYQBo AG8AbQBhAAAAOw6QAQIABQAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAACAAAAAAFcAaQBu AGcAZABpAG4AZwBzAAAAQR6QAQAAAgQFAwUEBgMCBP8CAOD/JABCAAAAAAAAAACfAQAAAAAA AEMAYQBtAGIAcgBpAGEAIABNAGEAdABoAAAAIgAEADGAjBgA8NAC5ARoAQAAAACfqkMnn6pD J2SEQ2cDAAEAAAB2LwAA7lEBAC0AwggAAAQAAwAiCQAAdi8AAO5RAQAtAMIIAAAiCQAAAAAA AFEkAPAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAG4EiQV4 AKMAgIASMAAAAAAAAAAAAAAAAAAAongBAKJ4AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAADEKDcQDwEAAI APz9AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAhIWAAAAAAJ8P8PAAkBPwAA5AQAAFcBAAD/ //9/AAAAAP///3////9/////f////390FQQAAAQAADIAAAAAAAAAAAAAAAAAAAAiAAAAAAAh BAAAAAAAAAAAAAAAAAAAAAAAABAcAAAMAAAAAAAAAAAAeAAAAHgAAAAAAAAAAAAAAKAFAAAA AAAACwAAAAAAAADcAAAAAQAAAP//EgAAAAAAYQBDADoAXABEAG8AYwB1AG0AZQBuAHQAcwAg AGEAbgBkACAAUwBlAHQAdABpAG4AZwBzAFwAdAByAGEAYgB1AGwAcwBpAFwAQQBwAHAAbABp AGMAYQB0AGkAbwBuACAARABhAHQAYQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVABlAG0AcABs AGEAdABlAHMAXABRAHUAaQBjAGsAUABpAGEAbgBvAFwAUQBQAFUAQgBfAEkAUwBPAF8ARQAu AGQAbwB0ABYAWAAuAGMAbQBzACAAdABlAHgAdAAgAGYAbwByACAAQwBvAG4AcwBlAG4AdAAA AAUAMQAxAC8AMQA3AAAABgBFAGQAaQB0AG8AcgAMAFMAYwBvAHQAdAAsACAAUwBhAHIAYQBo AAAAAAAAAAAAAAAAAAAAAAAAAAAAuAAAAAYAAAArAAAAAAAMAAEADAACAAwAAwAMAAQADAAF AAwABgAMAAcADAAIAAwACQAMAAoADAALAAwADAAMAA0ADAAOAAwADwAMABAADAARAAwAEgAM ABMADAAUAAwAFQAMABYADAAXAAwAGAAMABkADAAaAAwAGwAMABwADAAdAAwAHgAMAB8ADAAg AAwAIQAMACIADAAjAAwAJAAMACUADAAmAAwAJwAMACgADAApAAwAKgAMAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/v8AAAYBAgAAAAAA AAAAAAAAAAAAAAAAAQAAAOCFn/L5T2gQq5EIACsns9kwAAAADAIAABIAAAABAAAAmAAAAAIA AACgAAAAAwAAAMAAAAAEAAAAzAAAAAUAAADcAAAABgAAAOwAAAAHAAAAYAEAAAgAAAB4AQAA CQAAAJABAAASAAAAnAEAAAoAAAC8AQAACwAAAMgBAAAMAAAA1AEAAA0AAADgAQAADgAAAOwB AAAPAAAA9AEAABAAAAD8AQAAEwAAAAQCAAACAAAA5AQAAB4AAAAYAAAAWC5jbXMgdGV4dCBm b3IgQ29uc2VudAAAHgAAAAQAAAAAAAAAHgAAAAgAAABFZGl0b3IAAB4AAAAIAAAAMTEvMTcA AAAeAAAAbAAAAFREIDI1NTggUmV2LjEgIEZvcjogR2VuZXZhLCAxNC0yMyBNYXJjaCAyMDE2 DURvY3VtZW50IGRhdGU6IA1TYXZlZCBieSBJVFU1MTAxMTU5OSBhdCAxMDozMTowOCBvbiAy MS8wMy8yMDE2AB4AAAAQAAAAUVBVQl9JU09fRS5kb3QAAB4AAAAQAAAAU2NvdHQsIFNhcmFo AAAAAB4AAAAEAAAAMwAAAB4AAAAYAAAATWljcm9zb2Z0IE9mZmljZSBXb3JkAAAAQAAAAABG wyMAAAAAQAAAAADYN+yhf9EBQAAAAABiGWFUg9EBQAAAAABiGWFUg9EBAwAAAC0AAAADAAAA di8AAAMAAADuUQEAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP7/AAAGAQIAAAAAAAAAAAAAAAAA AAAAAAIAAAAC1c3VnC4bEJOXCAArLPmuRAAAAAXVzdWcLhsQk5cIACss+a7EAQAAgAEAAA4A AAABAAAAeAAAAA4AAACAAAAADwAAAJAAAAAEAAAAxAAAAAUAAADMAAAABgAAANQAAAARAAAA 3AAAABcAAADkAAAACwAAAOwAAAAQAAAA9AAAABMAAAD8AAAAFgAAAAQBAAANAAAADAEAAAwA AABKAQAAAgAAAOQEAAAeAAAACAAAAElUVS1UAAAAHgAAACwAAABJbnRlcm5hdGlvbmFsIFRl bGVjb21tdW5pY2F0aW9uIFVuaW9uIChJVFUpAAMAAAAAvAQAAwAAACIJAAADAAAAwggAAAMA AACieAEAAwAAAAAADwALAAAAAAAAAAsAAAAAAAAACwAAAAAAAAALAAAAAAAAAB4QAAACAAAA FwAAAFguY21zIHRleHQgZm9yIENvbnNlbnQAFwAAAFguY21zIHRleHQgZm9yIENvbnNlbnQA DBAAAAQAAAAeAAAABgAAAFRpdGxlAAMAAAABAAAAHgAAAAYAAABUaXRyZQADAAAAAQAAAAAA bAIAAAsAAAAAAAAAYAAAAAEAAAACAQAAAgAAAAoBAAADAAAAqgEAAAQAAADCAQAABQAAAM4B AAAGAAAA5gEAAAcAAAD+AQAACAAAACYCAAAJAAAANgIAAAoAAABaAgAACQAAAAIAAAAMAAAA X1BJRF9ITElOS1MAAwAAAAcAAABkb2NudW0ABAAAAAgAAABkb2NkYXRlAAUAAAAJAAAAZG9j dGl0bGUABgAAAAoAAABkb2N0aXRsZTIABwAAAAoAAABEb2NvcmxhbmcACAAAAAwAAABEb2Ni bHVlcGluawAJAAAACAAAAERvY2Rlc3QACgAAAAoAAABEb2NhdXRob3IAAgAAAOQEAABBAAAA mAAAAAYAAAADAAAAVQBvAAMAAAAGAAAAAwAAAAAAAAADAAAABQAAAB8AAAAvAAAAbQBhAGkA bAB0AG8AOgBqAGUAYQBuAC0AcABhAHUAbAAuAGwAZQBtAGEAaQByAGUAQAB1AG4AaQB2AC0A cABhAHIAaQBzAC0AZABpAGQAZQByAG8AdAAuAGYAcgAAAAAAHwAAAAEAAAAAAAAAHgAAABAA AABURCAyNTU4IFJldi4xAAAAHgAAAAQAAAAAAAAAHgAAABAAAABRUHViTWFjcm9zLmRvdAAA HgAAABAAAABRUHViTWFjcm9zLmRvdAAAHgAAACAAAABFbmdsaXNoIG9ubHkgT3JpZ2luYWw6 IEVuZ2xpc2gAAB4AAAAIAAAAMTEvMTcAAAAeAAAAHAAAAEdlbmV2YSwgMTQtMjMgTWFyY2gg MjAxNgAAAAAeAAAACAAAAEVkaXRvcgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAgAAAAMAAAAEAAAABQAAAAYAAAAHAAAA CAAAAAkAAAAKAAAACwAAAAwAAAANAAAADgAAAA8AAAAQAAAAEQAAABIAAAATAAAAFAAAABUA AAAWAAAAFwAAABgAAAAZAAAAGgAAABsAAAAcAAAAHQAAAB4AAAAfAAAAIAAAACEAAAAiAAAA IwAAACQAAAAlAAAAJgAAACcAAAAoAAAAKQAAACoAAAArAAAALAAAAC0AAAAuAAAALwAAADAA AAAxAAAAMgAAADMAAAA0AAAANQAAADYAAAA3AAAAOAAAADkAAAA6AAAAOwAAADwAAAA9AAAA PgAAAD8AAABAAAAAQQAAAEIAAABDAAAARAAAAEUAAABGAAAARwAAAEgAAABJAAAASgAAAEsA AABMAAAATQAAAE4AAABPAAAAUAAAAFEAAABSAAAAUwAAAFQAAABVAAAAVgAAAFcAAABYAAAA WQAAAFoAAABbAAAAXAAAAF0AAABeAAAAXwAAAGAAAABhAAAAYgAAAGMAAABkAAAAZQAAAGYA AABnAAAAaAAAAGkAAABqAAAAawAAAGwAAABtAAAAbgAAAG8AAABwAAAAcQAAAHIAAABzAAAA dAAAAHUAAAB2AAAAdwAAAHgAAAB5AAAAegAAAHsAAAB8AAAAfQAAAH4AAAB/AAAAgAAAAIEA AACCAAAAgwAAAIQAAACFAAAAhgAAAIcAAACIAAAAiQAAAIoAAACLAAAAjAAAAI0AAACOAAAA jwAAAJAAAACRAAAAkgAAAJMAAACUAAAAlQAAAJYAAACXAAAAmAAAAJkAAACaAAAAmwAAAJwA AACdAAAAngAAAJ8AAACgAAAAoQAAAKIAAACjAAAApAAAAKUAAACmAAAApwAAAKgAAACpAAAA qgAAAKsAAACsAAAArQAAAK4AAACvAAAAsAAAALEAAACyAAAAswAAALQAAAC1AAAAtgAAALcA AAC4AAAAuQAAALoAAAC7AAAAvAAAAL0AAAC+AAAAvwAAAMAAAADBAAAAwgAAAMMAAADEAAAA xQAAAMYAAADHAAAAyAAAAMkAAADKAAAAywAAAMwAAADNAAAAzgAAAM8AAADQAAAA0QAAANIA AADTAAAA1AAAANUAAADWAAAA1wAAANgAAADZAAAA2gAAANsAAADcAAAA3QAAAN4AAADfAAAA 4AAAAOEAAADiAAAA4wAAAOQAAADlAAAA5gAAAOcAAADoAAAA6QAAAOoAAADrAAAA7AAAAO0A AADuAAAA7wAAAPAAAADxAAAA8gAAAPMAAAD0AAAA9QAAAPYAAAD3AAAA+AAAAPkAAAD6AAAA +wAAAPwAAAD9AAAA/gAAAP8AAAAAAQAAAQEAAAIBAAADAQAABAEAAAUBAAAGAQAABwEAAAgB AAAJAQAACgEAAAsBAAAMAQAADQEAAA4BAAAPAQAAEAEAABEBAAASAQAAEwEAABQBAAAVAQAA FgEAABcBAAAYAQAAGQEAABoBAAAbAQAAHAEAAB0BAAAeAQAAHwEAACABAAAhAQAAIgEAACMB AAAkAQAAJQEAACYBAAAnAQAAKAEAACkBAAAqAQAAKwEAACwBAAAtAQAALgEAAC8BAAAwAQAA MQEAADIBAAAzAQAANAEAADUBAAA2AQAANwEAADgBAAA5AQAAOgEAADsBAAA8AQAAPQEAAD4B AAA/AQAAQAEAAEEBAABCAQAAQwEAAEQBAABFAQAARgEAAEcBAABIAQAASQEAAEoBAABLAQAA TAEAAE0BAABOAQAATwEAAFABAABRAQAAUgEAAFMBAABUAQAAVQEAAFYBAABXAQAAWAEAAFkB AABaAQAAWwEAAFwBAABdAQAAXgEAAF8BAABgAQAAYQEAAGIBAABjAQAAZAEAAGUBAABmAQAA ZwEAAGgBAABpAQAAagEAAGsBAABsAQAAbQEAAG4BAABvAQAAcAEAAHEBAAByAQAAcwEAAHQB AAB1AQAAdgEAAHcBAAB4AQAAeQEAAHoBAAB7AQAAfAEAAH0BAAB+AQAAfwEAAIABAACBAQAA ggEAAIMBAACEAQAAhQEAAIYBAACHAQAAiAEAAIkBAACKAQAAiwEAAIwBAACNAQAAjgEAAI8B AACQAQAAkQEAAJIBAACTAQAAlAEAAJUBAACWAQAAlwEAAJgBAACZAQAA/v///5sBAACcAQAA nQEAAJ4BAACfAQAAoAEAAKEBAACiAQAAowEAAKQBAAD+////pgEAAKcBAACoAQAAqQEAAKoB AACrAQAArAEAAK0BAACuAQAArwEAALABAACxAQAAsgEAALMBAAC0AQAAtQEAALYBAAC3AQAA uAEAALkBAAC6AQAAuwEAALwBAAC9AQAAvgEAAL8BAADAAQAAwQEAAMIBAADDAQAAxAEAAMUB AADGAQAAxwEAAMgBAADJAQAAygEAAMsBAADMAQAAzQEAAM4BAADPAQAA0AEAANEBAADSAQAA 0wEAANQBAADVAQAA1gEAANcBAADYAQAA2QEAANoBAADbAQAA3AEAAN0BAADeAQAA3wEAAOAB AADhAQAA4gEAAOMBAADkAQAA5QEAAOYBAADnAQAA6AEAAOkBAADqAQAA6wEAAOwBAADtAQAA 7gEAAO8BAADwAQAA8QEAAPIBAADzAQAA9AEAAPUBAAD2AQAA9wEAAPgBAAD5AQAA+gEAAPsB AAD8AQAA/QEAAP4BAAD/AQAAAAIAAAECAAACAgAAAwIAAAQCAAAFAgAABgIAAAcCAAAIAgAA CQIAAAoCAAALAgAADAIAAA0CAAAOAgAADwIAABACAAARAgAAEgIAABMCAAAUAgAAFQIAABYC AAAXAgAAGAIAABkCAAAaAgAAGwIAABwCAAAdAgAAHgIAAB8CAAAgAgAAIQIAACICAAAjAgAA JAIAACUCAAAmAgAAJwIAACgCAAApAgAAKgIAACsCAAAsAgAALQIAAC4CAAAvAgAAMAIAADEC AAAyAgAAMwIAADQCAAA1AgAANgIAADcCAAA4AgAAOQIAADoCAAA7AgAAPAIAAD0CAAA+AgAA PwIAAEACAABBAgAA/v///0MCAABEAgAARQIAAEYCAABHAgAASAIAAEkCAAD+////SwIAAEwC AABNAgAATgIAAE8CAABQAgAAUQIAAP7////9/////f////3////9/////f///1gCAABZAgAA /v////7///9cAgAA/v////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////UgBvAG8A dAAgAEUAbgB0AHIAeQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAABYABQH//////////wMAAAAGCQIAAAAAAMAAAAAAAABGAAAAAAAAAAAAAAAAsJljZlSD 0QFbAgAAAAMAAAAAAABEAGEAdABhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgACAf///////////////wAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAJoBAAB0FQAAAAAAADEAVABhAGIAbABlAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOAAIAAQAAAP// ////////AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAApQEAABs4AQAAAAAA VwBvAHIAZABEAG8AYwB1AG0AZQBuAHQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAABoAAgEKAAAABQAAAP////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAPjIDAAAAAAAFAFMAdQBtAG0AYQByAHkASQBuAGYAbwByAG0AYQB0AGkA bwBuAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKAACAf///////////////wAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEICAAAAEAAAAAAAAAUARABvAGMAdQBtAGUA bgB0AFMAdQBtAG0AYQByAHkASQBuAGYAbwByAG0AYQB0AGkAbwBuAAAAAAAAAAAAAAA4AAIB BAAAAP//////////AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAASgIAAAAQ AAAAAAAATQBzAG8ARABhAHQAYQBTAHQAbwByAGUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAABoAAQD//////////wcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABDe VWZUg9EB0AVfZlSD0QEAAAAAAAAAAAAAAABSAMsARQBCAFUAVQDLAFgA2gDUADAAVQA0AMoA TQDYAEQASwBMANMA3ABBAD0APQAAAAAAAAAAAAAAAAAAAAAAMgABAf//////////CAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAEN5VZlSD0QHQBV9mVIPRAQAAAAAAAAAAAAAAAEkAdABlAG0A AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAKAAIB/////wkAAAD/////AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAPwAAAAAAAAAUAByAG8AcABlAHIAdABpAGUAcwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAABYAAgD///////////////8AAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAVQEAAAAAAAABAEMAbwBtAHAATwBiAGoAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgACAQIAAAAGAAAA /////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoAAAByAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAA////////////////AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAQAAAAIAAAADAAAA/v///wUAAAAGAAAABwAAAAgAAAAJAAAA /v///wsAAAD+//////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////88YjpTb3VyY2Vz IFNlbGVjdGVkU3R5bGU9IlxhcGFzaXh0aGVkaXRpb25vZmZpY2VvbmxpbmUueHNsIiBTdHls ZU5hbWU9IkFQQSIgVmVyc2lvbj0iNiIgeG1sbnM6Yj0iaHR0cDovL3NjaGVtYXMub3Blbnht bGZvcm1hdHMub3JnL29mZmljZURvY3VtZW50LzIwMDYvYmlibGlvZ3JhcGh5IiB4bWxucz0i aHR0cDovL3NjaGVtYXMub3BlbnhtbGZvcm1hdHMub3JnL29mZmljZURvY3VtZW50LzIwMDYv YmlibGlvZ3JhcGh5Ij48L2I6U291cmNlcz4AAAAAPD94bWwgdmVyc2lvbj0iMS4wIiBlbmNv ZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9Im5vIj8+DQo8ZHM6ZGF0YXN0b3JlSXRlbSBkczpp dGVtSUQ9Ins1MTAxQjE0Ni1ENzRBLTQ2RUItOTQ3QS1BMzM4MENBMkYzRjB9IiB4bWxuczpk cz0iaHR0cDovL3NjaGVtYXMub3BlbnhtbGZvcm1hdHMub3JnL29mZmljZURvY3VtZW50LzIw MDYvY3VzdG9tWG1sIj48ZHM6c2NoZW1hUmVmcz48ZHM6c2NoZW1hUmVmIGRzOnVyaT0iaHR0 cDovL3NjaGVtYXMub3BlbnhtbGZvcm1hdHMub3JnL29mZmljZURvY3VtZW50LzIwMDYvYmli bGlvZ3JhcGh5Ii8+PC9kczpzY2hlbWFSZWZzPjwvZHM6ZGF0YXN0b3JlSXRlbT4AAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQD+/wMKAAD/////BgkCAAAA AADAAAAAAAAARiAAAABNaWNyb3NvZnQgV29yZCA5Ny0yMDAzIERvY3VtZW50AAoAAABNU1dv cmREb2MAEAAAAFdvcmQuRG9jdW1lbnQuOAD0ObJxAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA --------------060401050604000809000205-- From nobody Thu Mar 31 12:06:46 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BEB8312D73A for ; Thu, 31 Mar 2016 12:06:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.987 X-Spam-Level: X-Spam-Status: No, score=-1.987 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, OBFUSCATING_COMMENT=0.723, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P641dbpwG6Hs for ; Thu, 31 Mar 2016 12:06:43 -0700 (PDT) Received: from mail-vk0-x234.google.com (mail-vk0-x234.google.com [IPv6:2607:f8b0:400c:c05::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 193BC12D765 for ; Thu, 31 Mar 2016 11:59:25 -0700 (PDT) Received: by mail-vk0-x234.google.com with SMTP id e185so115081428vkb.1 for ; Thu, 31 Mar 2016 11:59:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:date:message-id:subject:from:to:cc; bh=VCUKmWY2itbXkPkiJU3JsxuCUJJFnkNZ1hCXgtdNGxQ=; b=JGcLFsRdHQ+ksA+Elox6VD9N4iuXVcyqIkaA6uMaY4kmNnKJOzSYZGkfunL61pne2v 0UxCL33r2goRFE1q8fxrGaabueWgV4MF/va2Y2kYZP5NDZkrKgSRaEHdeAo/Y6OykcXF R4OsLF9tYG7kLOC2IVe6faUzN7II6kfYCo5saMGcsOoSat/MFYPMqwaC6dg6M7yhK0Ez l3GkLLcKv5lrVvfRhq/fqlZbjJVnxMkvk9Dh03/CHIdYtOkW0dTBi++jWVbF9Iur6TuF nLxpiqMwJb1zPXiavqYa/sUiweg38cG74iBLxvehi1UiZL96zzGqeK9GoZj4aUgTfBdt vuPA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:date:message-id:subject:from:to:cc; bh=VCUKmWY2itbXkPkiJU3JsxuCUJJFnkNZ1hCXgtdNGxQ=; b=O1G8t8BvNOjPvcBPwMi50IMOaVICGfz2SwHYVBI4eCrPwUfk/YUDg/HWuvrB9dkWsh mT+bJkklQ/eDRTSGA2iyzDqTVsDL+8/pHqy2VG261iRIcqDk8+IMM+TSVDCAvdodG0sb 5dNOc5aXgYLFTth/+EWLKRNlQcd9ZOKxltkII4uT0T6eLwWu+upwJGlUh65zhqTrS52R nKiIXGdb0cqdsuVHduAlVNXmPXtCF4TbVQCv4tW3ezkpMJts1hmZCW9D0CU2eyYEju7d YbowN5NdKAv6DRKLTY2rnBCJMdqY6klXYmmZhBEZIbbzlVVIR2npMD/BbSVuoSD6QKJC kn/g== X-Gm-Message-State: AD7BkJJkIbZKaYfpRQLvowmMwZUfIAUIRUf9vLDzkEzfWBzmpfhxbjLWMutgIkmUbHjAYw5fV+cRiY3tKsOrX1gl MIME-Version: 1.0 X-Received: by 10.176.5.199 with SMTP id e65mr324174uae.45.1459450763906; Thu, 31 Mar 2016 11:59:23 -0700 (PDT) Received: by 10.176.3.211 with HTTP; Thu, 31 Mar 2016 11:59:23 -0700 (PDT) Date: Thu, 31 Mar 2016 11:59:23 -0700 Message-ID: From: Wei Chuang To: PKIX , IETF SMIME Content-Type: multipart/mixed; boundary=94eb2c1233ba5a3d6d052f5cdc37 Archived-At: Cc: John Levine , Stephen Farrell Subject: [smime] Identified Work Items and Discussion Summary (was: possible new pkix and/or smime work) X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 31 Mar 2016 19:06:46 -0000 --94eb2c1233ba5a3d6d052f5cdc37 Content-Type: multipart/alternative; boundary=94eb2c1233ba5a3d68052f5cdc35 --94eb2c1233ba5a3d68052f5cdc35 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Hi all, I've created a Google Docs of the potential work items and discussion summary (associated with my personal email account). This will make it easy to take comments on the document and incorporate them into the document easily. The following link goes to the document: https://goo.gl/xXbBoc (i.e. https://docs.google.com/document/d/1bZ9BHiw1FvTj1HKEWlfUqe4811KroY_Ottzl3fye-eE/edit?usp=sharing which might get split by some email clients) Here's a link to the help center on how to make a comment in the docs: https://support.google.com/docs/answer/65129?co=GENIE. Platform%3DDesktop&hl=en For those who prefer a text document, I've inlined it below. Please use the above Google Doc link, because it automates making changes to document. thanks, -Wei ---------- IETF PKIX / S/MIME Feb-Mar 2016 Work Items Potential work list: Short term: 1. EKU for intermediate CA certificate 2. Manufacturer Usage Description URI certificate extension 3. Certificate i18n email address support 4. Non authoritative key lookup (see bhjl draft) 5. Solving incomplete certificate chains and handing expired certificates cleanly on clients 6. Adding new S/MIME crypto: AEAD: AES-CCB, AES-GCM, AES-CCChaCha20-Poly1305, CRFG ECC Curves 7. Deprecate old ciphers e.g. md5, sha1 8. Support for PGP keys in CMS 9. Update RFC4134 i.e. S/MIME examples 10. drafts 1. draft-lear-ietf-pkix-mud-extension-00 2. draft-lbaudoin-iemax-02 3. draft-ietf-pkix-eai-addresses-00 4. draft-bhjl-x509-srv-00 5. Draft-melnikov-smime-msa-to-mda-04 Long term 1. Certificate discovery and reenrollment 2. Solving email address canonicalization (perhaps via bhjl oracle) 3. Header privacy 4. Prevent signature stripping attack 5. Painless client configuration Even longer term 1. Supporting Webmail 2. Preventing Spam 3. Combining PGP S/MIME 4. Email identity ________________ Opinions PKIX Mailing List Strings in certificates: Want clarifications in 5280 regarding strings * Date: 18 Jan 16 * Issue: Deprecating types; interpretation for DisplayText; Unicode normalization; Control Characters; Unicode for rfc882Name * Discussion: See X.520 and other documentation EKU for intermediate certificates: Allow EKU in intermediate CA cert to allow technical constraints as specified by CABF * Start: 4 Feb 16 * Issue: Worry significant change since EKU wasn’t meant to impact path validation; Implementers haven’t been following path constraints very well; Interoperability challenge due to different standards * Proposal: New extension; New interpretation; Follow policy OID; other answers in archive Is it time for a pkix extensions (or similar) wg? * Start: 5 Feb 16 * Proposals: Manufacturer cert extension (see lear draft); i18n for cert rfc822Name (see lbaudoin, eai-addresses drafts) spawned address discussion noted below; S/MIME name matching selector in SignerInfo: case, normalization? What about S/MIME WG (stephen farrell)? * Issue: S/MIME: “biggest problem… how to tell senders what they should do”; successor to S/MIME and PGP?; Enough work for two working group? Or just one working group? * Drafts: draft-lear-ietf-pkix-mud-extension-00; draft-lbaudoin-iemax-02; draft-ietf-pkix-eai-addresses-00.txt Email address matching rules (was Re: Is it time for a pkix extensions (or similar) wg?) * Start: 6 Feb 16 * Issue: email address local part normalization is against RFC5321; Sec 7 of RFC5280 needs updating; Security model * Proposal: Sender should normalize (see 5750); define rules in DKIM or DNS; define OTHER-NAME in cert SAN/IAN in UTF8String with encoding of matching rules; Regex SAN/IAN; Formalize security model; Sender does cert lookup to find alternate address variant certificate; * Note: large discussion by SMTP folks noted below in: Another attempt to canonicalize local parts * Drafts: draft-bhjl-x509-srv-00 Support for email address internationalization in RFC5280 certificates * Start: 4 Feb 16 * Draft: draft-lbaudoin-iemax-02.txt (see also draft-ietf-pkix-eai-addresses-00) * Counter proposal: Consider instead redefining Rfc822Name as CHOICE including UTF8String key identities * Start: 14 Mar 16 (from tmiller on: why you shouldn't even try to canonicalize local parts) * Proposal: Verify signature and cert path, TOFU the address FROM/SENDER address and remember public key; identify by public key SKID, subsequently only verify the signature from the public key; Key roll over * Issue: signing?; a priori discovery?; human comprehensible notion of identity or name Summary of S/MIME Problems/Issues * Start: 11 Mar 16 (from mrex on: another attempt to canonicalize local parts) * Issues: Incomplete chains; Mail archival problems when certificates expire i.e. revalidating signature or decryption due to MUA certificate and timestamp management, and lack of help from CAs Another attempt to canonicalize local parts: 3rd party interpretation of email address local parts for validation or key discovery is a bad idea * Start: 11 Mar 16 * Issues: RFC5321 stats only MTA may interpret the local part; MUA UI poorly does key management; “key structures” i.e. key discovery is difficult * Proposal: Modernize email address to enable validation; IETF should get into standardizing UI particularly for key management; Key discovery via oracle e2e email security (stephen farrell) * Start: 12 Mar 16 * Issues: No MUA development; email environment is centralized; mail headers not protected; e2e may prevent anti-spam technology * Proposal: allow experimentation Key lookup service via draft-bhjl-x509-srv-00 * Start 22 Mar 16 * Proposal: Use the draft for key lookup; provides means to do initial certificate discovery; authoritative; certificate renewal; oracle for new email name variants; * Issues: Key management is hard; security risk for automated key re-enrollment; security issues with a centralized key directory; handling ownership of multiple mailbox; * Draft: draft-bhjl-x509-srv-00 BCP proposal: regular expressions for Internet Mail identifiers * Start: 22 Mar 16 * Proposal: Standardize regex for email addresses S/MIME Mailing List Message takeover attacks against S/MIME * Start: 27 Jan 16 * Proposal: Adding authenticated encryption to S/MIME; * Issues: S/MIME doesn’t keep headers private; MUA don’t understand message/rfc822; attack via signed-then-encrypted message into encrypted-then-signed using attackers identity and replies will leak the original content Is this enough to re-charter the S/MIME WG? * Start: 8 Mar 16 (from housley on “Message takeover attacks against S/MIME”) * several folks willing to help; AEAD: AES-CCM, AES-GCM, ChaCha20-Poly1305; domain signing; Curve25519 and Curve448, CFRG ECC curves; automated cert enrollment; protect mail headers; standardize on RFC5753 i.e.ECC away from informational; updated RFC documentation e.g. RFC 4134; drop old ciphers e.g. md5, sha1; prevent signature stripping attacks * Draft: draft-melnikov-smime-msa-to-mda-04 General S/MIME issues / solutions * Start: 29 Jan 16 (from phill on: Message takeover attacks against S/MIME) * Proposal: merge PGP and S/MIME; publish consistent modern crypto suit in CURDLE; make it work with WebMail; configuration must be painless ---------- Forwarded message ---------- From: Stephen Farrell Date: Thu, Mar 24, 2016 at 5:28 AM Subject: Re: [pkix] possible new pkix and/or smime work To: pkix I got a couple of volunteers, Wei Chuang and John Levine (thanks both!) who're aiming to produce us a summary of the recent list discussion we can ponder in a few days. Cheers, S. On 23/03/16 20:35, Stephen Farrell wrote: > > Folks, > > I'm finding it hard to evaluate the discussion as to whether > there's new work folks want to do here that'd justify forming > a (coherent) WG and that'd result in likely implementation and > deployment. I expect others may be similarly uncertain. > > Would someone be willing to volunteer to act in a slightly > chair-like manner and try to summarise the discussion in a > way that might help us judge the above? > > I think that might help us to e.g. organise a bit of a bar > BoF or collective chat amongst those interested while a bunch > of us are in B-A and on the list prior to that. > > Thanks, > S. > > PS; If you are willing to do that but shy, feel free to send to > me offlist and I can pretend I did the work:-) > > > > > _______________________________________________ > pkix mailing list > pkix@ietf.org > https://www.ietf.org/mailman/listinfo/pkix > _______________________________________________ pkix mailing list pkix@ietf.org https://www.ietf.org/mailman/listinfo/pkix --94eb2c1233ba5a3d68052f5cdc35 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit
Hi all,

I've created a Google Docs of the potential work items and discussion summary (associated with my personal email account).  This will make it easy to take comments on the document and incorporate them into the document easily.  The following link goes to the document:

Here's a link to the help center on how to make a comment in the docs:

For those who prefer a text document, I've inlined it below.  Please use the above Google Doc link, because it automates making changes to document.

thanks,
-Wei

---------- 

IETF PKIX / S/MIME Feb-Mar 2016
Work Items
Potential work list:


Short term:
1. EKU for intermediate CA certificate
2. Manufacturer Usage Description URI certificate extension
3. Certificate i18n email address support
4. Non authoritative key lookup (see bhjl draft)
5. Solving incomplete certificate chains and handing expired certificates cleanly on clients
6. Adding new S/MIME crypto: AEAD: AES-CCB, AES-GCM, AES-CCChaCha20-Poly1305, CRFG ECC Curves
7. Deprecate old ciphers e.g. md5, sha1
8. Support for PGP keys in CMS
9. Update RFC4134 i.e. S/MIME examples
10. drafts
   1. draft-lear-ietf-pkix-mud-extension-00
   2. draft-lbaudoin-iemax-02
   3. draft-ietf-pkix-eai-addresses-00
   4. draft-bhjl-x509-srv-00
   5. Draft-melnikov-smime-msa-to-mda-04


Long term
1. Certificate discovery and reenrollment
2. Solving email address canonicalization (perhaps via bhjl oracle)
3. Header privacy
4. Prevent signature stripping attack
5. Painless client configuration


Even longer term
1. Supporting Webmail
2. Preventing Spam
3. Combining PGP S/MIME
4. Email identity


________________


Opinions


PKIX Mailing List


Strings in certificates: Want clarifications in 5280 regarding strings
* Date: 18 Jan 16
* Issue: Deprecating types; interpretation for DisplayText; Unicode normalization; Control Characters; Unicode for rfc882Name
* Discussion: See X.520 and other documentation


EKU for intermediate certificates: Allow EKU in intermediate CA cert to allow technical constraints as specified by CABF
* Start: 4 Feb 16
* Issue: Worry significant change since EKU wasn’t meant to impact path validation; Implementers haven’t been following path constraints very well; Interoperability challenge due to different standards
* Proposal: New extension; New interpretation; Follow policy OID; other answers in archive


Is it time for a pkix extensions (or similar) wg?  
* Start: 5 Feb 16
* Proposals: Manufacturer cert extension (see lear draft); i18n for cert rfc822Name (see lbaudoin, eai-addresses drafts) spawned address discussion noted below; S/MIME name matching selector in SignerInfo: case, normalization?  What about S/MIME WG (stephen farrell)?
* Issue: S/MIME: “biggest problem… how to tell senders what they should do”; successor to S/MIME and PGP?; Enough work for two working group? Or just one working group?
* Drafts:  draft-lear-ietf-pkix-mud-extension-00; draft-lbaudoin-iemax-02; draft-ietf-pkix-eai-addresses-00.txt


Email address matching rules (was Re: Is it time for a pkix extensions (or similar) wg?)
* Start: 6 Feb 16
* Issue: email address local part normalization is against RFC5321; Sec 7 of RFC5280 needs updating; Security model
* Proposal: Sender should normalize (see 5750); define rules in DKIM or DNS; define OTHER-NAME in cert SAN/IAN in UTF8String with encoding of matching rules; Regex SAN/IAN; Formalize security model; Sender does cert lookup to find alternate address variant certificate;
* Note: large discussion by SMTP folks noted below in: Another attempt to canonicalize local parts
* Drafts: draft-bhjl-x509-srv-00


Support for email address internationalization in RFC5280 certificates
* Start: 4 Feb 16
* Draft: draft-lbaudoin-iemax-02.txt (see also draft-ietf-pkix-eai-addresses-00)
* Counter proposal: Consider instead redefining Rfc822Name as CHOICE including UTF8String


key identities
* Start: 14 Mar 16 (from tmiller on: why you shouldn't even try to canonicalize local parts)
* Proposal: Verify signature and cert path, TOFU the address FROM/SENDER address and remember public key;  identify by public key SKID, subsequently only verify the signature from the public key; Key roll over
* Issue: signing?; a priori discovery?; human comprehensible notion of identity or name


Summary of S/MIME Problems/Issues
* Start: 11 Mar 16 (from mrex on: another attempt to canonicalize local parts)
* Issues: Incomplete chains; Mail archival problems when certificates expire i.e. revalidating signature or decryption due to MUA certificate and timestamp management, and lack of help from CAs


Another attempt to canonicalize local parts: 3rd party interpretation of email address local parts for validation or key discovery  is a bad idea
* Start: 11 Mar 16
* Issues: RFC5321 stats only MTA may interpret the local part; MUA UI poorly does key management; “key structures” i.e. key discovery is difficult
* Proposal: Modernize email address to enable validation; IETF should get into standardizing UI particularly for key management; Key discovery via oracle


e2e email security (stephen farrell)
* Start: 12 Mar 16
* Issues: No MUA development; email environment is centralized; mail headers not protected; e2e may prevent anti-spam technology
* Proposal: allow experimentation


Key lookup service via draft-bhjl-x509-srv-00
* Start 22 Mar 16
* Proposal: Use the draft for key lookup; provides means to do initial certificate discovery; authoritative; certificate renewal; oracle for new email name variants; 
* Issues: Key management is hard; security risk for automated key re-enrollment; security issues with a centralized key directory; handling ownership of multiple mailbox;
* Draft: draft-bhjl-x509-srv-00


BCP proposal: regular expressions for Internet Mail identifiers
* Start: 22 Mar 16
* Proposal: Standardize regex for email addresses


S/MIME Mailing List


Message takeover attacks against S/MIME
* Start: 27 Jan 16
* Proposal: Adding authenticated encryption to S/MIME; 
* Issues: S/MIME doesn’t keep headers private; MUA don’t understand message/rfc822; attack via signed-then-encrypted message into encrypted-then-signed using attackers identity and replies will leak the original content


Is this enough to re-charter the S/MIME WG?
* Start: 8 Mar 16 (from housley on “Message takeover attacks against S/MIME”)
* several folks willing to help; AEAD: AES-CCM, AES-GCM, ChaCha20-Poly1305; domain signing; Curve25519 and Curve448, CFRG ECC curves;  automated cert enrollment; protect mail headers; standardize on RFC5753  i.e.ECC away from informational; updated RFC documentation e.g. RFC 4134; drop old ciphers e.g. md5, sha1; prevent signature stripping attacks
* Draft: draft-melnikov-smime-msa-to-mda-04


General S/MIME issues / solutions
* Start: 29 Jan 16 (from phill on: Message takeover attacks against S/MIME)
* Proposal: merge PGP and S/MIME; publish consistent modern crypto suit in CURDLE; make it work with WebMail; configuration must be painless


---------- Forwarded message ----------
From: Stephen Farrell <stephen.farrell@cs.tcd.ie>
Date: Thu, Mar 24, 2016 at 5:28 AM
Subject: Re: [pkix] possible new pkix and/or smime work
To: pkix <pkix@ietf.org>



I got a couple of volunteers, Wei Chuang and John Levine
(thanks both!) who're aiming to produce us a summary of
the recent list discussion we can ponder in a few days.

Cheers,
S.

On 23/03/16 20:35, Stephen Farrell wrote:
>
> Folks,
>
> I'm finding it hard to evaluate the discussion as to whether
> there's new work folks want to do here that'd justify forming
> a (coherent) WG and that'd result in likely implementation and
> deployment. I expect others may be similarly uncertain.
>
> Would someone be willing to volunteer to act in a slightly
> chair-like manner and try to summarise the discussion in a
> way that might help us judge the above?
>
> I think that might help us to e.g. organise a bit of a bar
> BoF or collective chat amongst those interested while a bunch
> of us are in B-A and on the list prior to that.
>
> Thanks,
> S.
>
> PS; If you are willing to do that but shy, feel free to send to
> me offlist and I can pretend I did the work:-)
>
>
>
>
> _______________________________________________
> pkix mailing list
> pkix@ietf.org
> https://www.ietf.org/mailman/listinfo/pkix
>


_______________________________________________
pkix mailing list
pkix@ietf.org
https://www.ietf.org/mailman/listinfo/pkix


--94eb2c1233ba5a3d68052f5cdc35-- --94eb2c1233ba5a3d6d052f5cdc37 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Disposition: attachment; filename="smime.p7s" Content-Transfer-Encoding: base64 X-Attachment-Id: 3536d289620966fe_0.0.1 MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCCvIw ggUIMIID8KADAgECAhBPzaE7pzYviUJyhmHTFBdnMA0GCSqGSIb3DQEBCwUAMHUxCzAJBgNVBAYT AklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBDZXJ0aWZpY2F0 aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3RhcnRDb20gQ2xhc3MgMSBDbGllbnQgQ0EwHhcNMTYw MjA5MDkyODE1WhcNMTcwMjA5MDkyODE1WjBOMSIwIAYDVQQDDBlzdGVwaGVuLmZhcnJlbGxAY3Mu dGNkLmllMSgwJgYJKoZIhvcNAQkBFhlzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllMIIBIjANBgkq hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtuC0rYze/2JinSraC9F2RjGdQZjNALLcW9C3WKTwYII3 wBslobmHuPEYE5JaGItmzuKnAW619R1rD/kfoNWC19N3rBZ6UX9Cmb9D9exCwYIwVuSwjrCQWGxg CtNQTrwKzCCpI790GRiMTvxvO7UmzmBrCaBLiZW5R0fBjK5Yn6hUhAzGBkNbkIEL28cLJqH0yVz7 Kl92OlzrQqTPEts5m6cDnNdY/ADfeAX18c1rdxZqcAxhLotrCqgsVA4ilbQDMMXGTLlB5TP35HeW ZuGBU7xu003rLcFLdOkD8xvpJoYZy9Kt3oABXPS5yqtMK+XCNdqmMn+4mOtLwQSMmPCSiQIDAQAB o4IBuTCCAbUwCwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAJBgNV HRMEAjAAMB0GA1UdDgQWBBQJQhvwQ5Fl372Z6xqo6fdn8XejTTAfBgNVHSMEGDAWgBQkgWw5Yb5J D4+3G0YrySi1J0htaDBvBggrBgEFBQcBAQRjMGEwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnN0 YXJ0c3NsLmNvbTA5BggrBgEFBQcwAoYtaHR0cDovL2FpYS5zdGFydHNzbC5jb20vY2VydHMvc2Nh LmNsaWVudDEuY3J0MDgGA1UdHwQxMC8wLaAroCmGJ2h0dHA6Ly9jcmwuc3RhcnRzc2wuY29tL3Nj YS1jbGllbnQxLmNybDAkBgNVHREEHTAbgRlzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllMCMGA1Ud EgQcMBqGGGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tLzBGBgNVHSAEPzA9MDsGCysGAQQBgbU3AQIE MCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeTANBgkqhkiG9w0B AQsFAAOCAQEArzrSv2C8PlBBmGuiGrzm2Wma46/KHtXmZYS0bsd43pM66Pc/MsqPE0HDC1GzMFfw B6BfkJn8ijNSIhlgj898WzjvnpM/SO8KStjlB8719ig/xKISrOl5mX55XbFlQtX9U6MrqRgbDIAT xhD9IDr+ryvovDzChqgQj7mt2jYr4mdlRjsjod3H1VY6XglRmaaNGZfsCARMaE/TU5SXIiqauwt5 KxNGYAY67QkOBs7O1FkSXpTk7+1MmzJMF4nP8QQ5n8vhVNseF+/Wm7ai9mtnrkLbaznMsy/ULo/C 2yuLUWTbZZbf4EKNmVdme6tUDgYkFjAFOblfA7W1fSPiQGagYzCCBeIwggPKoAMCAQICEGunin0K 14jWUQr5WeTntOEwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxKTAn BgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTE1MTIxNjAxMDAwNVoX DTMwMTIxNjAxMDAwNVowdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAn BgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENv bSBDbGFzcyAxIENsaWVudCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL192vfD on2D9luC/dtbX64eG3XAtRmvmCSsu1d52DXsCR58zJQbCtB2/A5uFqNxWacpXGGtTCRk9dEDBlmi xEd8QiLkUfvHpJX/xKnmVkS6Iye8wUbYzMsDzgnpazlPg19dnSqfhM+Cevdfa89VLnUztRr2cgmC fyO9Otrh7LJDPG+4D8ZnAqDtVB8MKYJL6QgKyVhhaBc4y3bGWxKyXEtx7QIZZGxPwSkzK3WIN+VK NdkiwTubW5PIdopmykwvIjLPqbJK7yPwFZYekKE015OsW6FV+s4DIM8UlVS8pkIsoGGJtMuWjLL4 tq2hYQuuN0jhrxK1ljz50hH23gA9cbMCAwEAAaOCAWQwggFgMA4GA1UdDwEB/wQEAwIBBjAdBgNV HSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzAp MCegJaAjhiFodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9zZnNjYS5jcmwwZgYIKwYBBQUHAQEEWjBY MCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5zdGFydHNzbC5jb20wMAYIKwYBBQUHMAKGJGh0dHA6 Ly9haWEuc3RhcnRzc2wuY29tL2NlcnRzL2NhLmNydDAdBgNVHQ4EFgQUJIFsOWG+SQ+PtxtGK8ko tSdIbWgwHwYDVR0jBBgwFoAUTgvvGqRAW6UXaYcwyjRoQ9BBrvIwPwYDVR0gBDgwNjA0BgRVHSAA MCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeTANBgkqhkiG9w0B AQsFAAOCAgEAi+P3h+wBi4StDwECW5zhIycjBL008HACblIf26HY0JdOruKbrWDsXUsiI0j/7Crf t9S5oxvPiDtVqspBOB/y5uzSns1lZwh7sG96bYBZpcGzGxpFNjDmQbcM3yl3WFIRS4WhNrsOY14V 7y2IrUGsvetsD+bjyOngCIVeC/GmsmtbuLOzJ606tEc9uRbhjTu/b0x2Fo+/e7UkQvKzNeo7OMhi jixaULyINBfCBJb+e29bLafgu6JqjOUJ9eXXj20p6q/CW+uVrZiSW57+q5an2P2i7hP85jQJcy5j 4HzA0rSiF3YPhKGAWUxKPMAVGgcYoXzWydOvZ3UDsTDTagXpRDIKQLZo02wrlxY6iMFqvlzsemVf 1odhQJmi7Eh5TbxI40kDGcBOBHhwnaOumZhLP+SWJQnjpLpSlUOj95uf1zo9oz9e0NgIJoz/tdfr Bzez76xtDsK0KfUDHt1/q59BvDI7RX6gVr0fQoCyMczNzCTcRXYHY0tq2J0oT+bsb6sH2b4WVWAi JKnSYaWDjdA70qHX4mq9MIjO/ZskmSY8wtAk24orAc0vwXgYanqNsBX5Yv4sN4Z9VyrwMdLcusP7 HJgRdAGKpkR2I9U4zEsNJQJewM7S4Jalo1DyPrLpL2nTET8ZrSl5Utp1UeGp/2deoprGevfnxWB+ vHNQiu85o6MxggPMMIIDyAIBATCBiTB1MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20g THRkLjEpMCcGA1UECxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMT GlN0YXJ0Q29tIENsYXNzIDEgQ2xpZW50IENBAhBPzaE7pzYviUJyhmHTFBdnMA0GCWCGSAFlAwQC AQUAoIICEzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xNjAzMjQx MjI4MjRaMC8GCSqGSIb3DQEJBDEiBCCdP9mDq35t6GFnvrXUoPilS3Wnu53uJPR84J/AdTLXtDBs BgkqhkiG9w0BCQ8xXzBdMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwDgYI KoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgEoMIGaBgkr BgEEAYI3EAQxgYwwgYkwdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAn BgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENv bSBDbGFzcyAxIENsaWVudCBDQQIQT82hO6c2L4lCcoZh0xQXZzCBnAYLKoZIhvcNAQkQAgsxgYyg gYkwdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0 Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENs aWVudCBDQQIQT82hO6c2L4lCcoZh0xQXZzANBgkqhkiG9w0BAQEFAASCAQA07CbBTRHA7NTMiiCP QrCC+g7E6o4aVG4hnkaopahlOlHLgdWsQKNaZ2XiGzoCEqNJzGee5Rxvf4cq/klzlNGPukIq9ixC IXDTrOmYHHG0aBwj1XEJPf69gCRVScxI0azT+2jAi8tq+Iirl3ckd9BT24xYLJAQbEGXO+zcMUPV 26sXJ5Bbwfc7qKxvP7Pfl5aHdbSOzYN8/+GhQpwydEsc5c5ho6fpYYNP18udELVDsmE9/eyEPoIR sI+WhJxzgId9yNdv3gQuWJFrdKy6T8dcVGGseOf41t8N/y+BwCHwtQdRyAZmryywWrgz5NB0bbsA TBzk9smsuDgX1kgAEqXSAAAAAAAA --94eb2c1233ba5a3d6d052f5cdc37-- From nobody Thu Mar 31 12:08:21 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EFC7C12D777; Thu, 31 Mar 2016 12:08:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.311 X-Spam-Level: X-Spam-Status: No, score=-4.311 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WdoG_UN_ST41; Thu, 31 Mar 2016 12:08:14 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 95C0812D772; Thu, 31 Mar 2016 12:08:14 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id B3AF4BE57; Thu, 31 Mar 2016 20:08:12 +0100 (IST) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FTwnUlsM8_pf; Thu, 31 Mar 2016 20:08:08 +0100 (IST) Received: from [10.87.49.100] (unknown [86.46.30.32]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id EFDA2BDD0; Thu, 31 Mar 2016 20:08:07 +0100 (IST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1459451288; bh=lYL2cy/Nq6K3gqMOhBph9aW0uVAkww2pWMTA6h5mEGQ=; h=Subject:To:References:Cc:From:Date:In-Reply-To:From; b=Q7I3LtxK6Ti7PtldCUwAdOi3Bn6baUARXS6mfPAPIdBGHVH9mZfuSObRt0cHGuyV8 qr+VXl5CEBnP71atLVWiWmrZVDqp/gtg2Xh0RFV5JmXqKOmVXo4o8T0DjvJSJJtUQ/ 3u0TXSKRKEqWgrIFIussEWBXh8KOdmK+z9yPUbv8= To: Wei Chuang , PKIX , IETF SMIME References: From: Stephen Farrell Openpgp: id=D66EA7906F0B897FB2E97D582F3C8736805F8DA2; url= Message-ID: <56FD7597.4020601@cs.tcd.ie> Date: Thu, 31 Mar 2016 20:08:07 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.6.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms060402010204020003060306" Archived-At: Cc: John Levine Subject: Re: [smime] Identified Work Items and Discussion Summary (was: possible new pkix and/or smime work) X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 31 Mar 2016 19:08:18 -0000 This is a cryptographically signed message in MIME format. --------------ms060402010204020003060306 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Thanks for doing that. What I'm most interested in for now is who would implement and/or deploy which bits of possible work. So if you can annotate Wei's document with that kind of information or otherwise make that clear on the list, that'd be very useful. (Please note that I am much much more interested if someone says they'd implement, compared to someone just expressing interest or wishing that someone else would implement.) And separately, I'd like to try get interested folks who'll be at IETF95 together for a chat if we can. At the moment, either Monday lunch or Thursday about 8pm (during bits'n'bytes) seem like they'd work for me. If you'd come along please send a mail to me, Wei and John Levine and we can see what's likely best. (If you really like to be involved in that but are remote, do say so. I'm not sure having many remote folks will work so well for this kind of discussion but we can try if need be.) Cheers, S. PS: I'll be travelling from tomorrow so offline a good bit, but please keep the discussion going on the list. On 31/03/16 19:59, Wei Chuang wrote: > Hi all, >=20 > I've created a Google Docs of the potential work items and discussion > summary (associated with my personal email account). This will make it= > easy to take comments on the document and incorporate them into the > document easily. The following link goes to the document: > https://goo.gl/xXbBoc (i.e. > https://docs.google.com/document/d/1bZ9BHiw1FvTj1HKEWlfUqe4811KroY_Ottz= l3fye-eE/edit?usp=3Dsharing > which might get split by some email clients) >=20 > Here's a link to the help center on how to make a comment in the docs: > https://support.google.com/docs/answer/65129?co=3DGENIE. > Platform%3DDesktop&hl=3Den >=20 > For those who prefer a text document, I've inlined it below. Please us= e > the above Google Doc link, because it automates making changes to docum= ent. >=20 > thanks, > -Wei >=20 > ---------- >=20 > IETF PKIX / S/MIME Feb-Mar 2016 > Work Items > Potential work list: >=20 >=20 > Short term: > 1. EKU for intermediate CA certificate > 2. Manufacturer Usage Description URI certificate extension > 3. Certificate i18n email address support > 4. Non authoritative key lookup (see bhjl draft) > 5. Solving incomplete certificate chains and handing expired certificat= es > cleanly on clients > 6. Adding new S/MIME crypto: AEAD: AES-CCB, AES-GCM, > AES-CCChaCha20-Poly1305, CRFG ECC Curves > 7. Deprecate old ciphers e.g. md5, sha1 > 8. Support for PGP keys in CMS > 9. Update RFC4134 i.e. S/MIME examples > 10. drafts > 1. draft-lear-ietf-pkix-mud-extension-00 > 2. draft-lbaudoin-iemax-02 > 3. draft-ietf-pkix-eai-addresses-00 > 4. draft-bhjl-x509-srv-00 > 5. Draft-melnikov-smime-msa-to-mda-04 >=20 >=20 > Long term > 1. Certificate discovery and reenrollment > 2. Solving email address canonicalization (perhaps via bhjl oracle) > 3. Header privacy > 4. Prevent signature stripping attack > 5. Painless client configuration >=20 >=20 > Even longer term > 1. Supporting Webmail > 2. Preventing Spam > 3. Combining PGP S/MIME > 4. Email identity >=20 >=20 > ________________ >=20 >=20 > Opinions >=20 >=20 > PKIX Mailing List >=20 >=20 > Strings in certificates: Want clarifications in 5280 regarding strings > * Date: 18 Jan 16 > * Issue: Deprecating types; interpretation for DisplayText; Unicode > normalization; Control Characters; Unicode for rfc882Name > * Discussion: See X.520 and other documentation >=20 >=20 > EKU for intermediate certificates: Allow EKU in intermediate CA cert to= > allow technical constraints as specified by CABF > * Start: 4 Feb 16 > * Issue: Worry significant change since EKU wasn=E2=80=99t meant to imp= act path > validation; Implementers haven=E2=80=99t been following path constraint= s very well; > Interoperability challenge due to different standards > * Proposal: New extension; New interpretation; Follow policy OID; other= > answers in archive >=20 >=20 > Is it time for a pkix extensions (or similar) wg? > * Start: 5 Feb 16 > * Proposals: Manufacturer cert extension (see lear draft); i18n for cer= t > rfc822Name (see lbaudoin, eai-addresses drafts) spawned address discuss= ion > noted below; S/MIME name matching selector in SignerInfo: case, > normalization? What about S/MIME WG (stephen farrell)? > * Issue: S/MIME: =E2=80=9Cbiggest problem=E2=80=A6 how to tell senders = what they should > do=E2=80=9D; successor to S/MIME and PGP?; Enough work for two working = group? Or > just one working group? > * Drafts: draft-lear-ietf-pkix-mud-extension-00; draft-lbaudoin-iemax-= 02; > draft-ietf-pkix-eai-addresses-00.txt >=20 >=20 > Email address matching rules (was Re: Is it time for a pkix extensions = (or > similar) wg?) > * Start: 6 Feb 16 > * Issue: email address local part normalization is against RFC5321; Sec= 7 > of RFC5280 needs updating; Security model > * Proposal: Sender should normalize (see 5750); define rules in DKIM or= > DNS; define OTHER-NAME in cert SAN/IAN in UTF8String with encoding of > matching rules; Regex SAN/IAN; Formalize security model; Sender does ce= rt > lookup to find alternate address variant certificate; > * Note: large discussion by SMTP folks noted below in: Another attempt = to > canonicalize local parts > * Drafts: draft-bhjl-x509-srv-00 >=20 >=20 > Support for email address internationalization in RFC5280 certificates > * Start: 4 Feb 16 > * Draft: draft-lbaudoin-iemax-02.txt (see also > draft-ietf-pkix-eai-addresses-00) > * Counter proposal: Consider instead redefining Rfc822Name as CHOICE > including UTF8String >=20 >=20 > key identities > * Start: 14 Mar 16 (from tmiller on: why you shouldn't even try to > canonicalize local parts) > * Proposal: Verify signature and cert path, TOFU the address FROM/SENDE= R > address and remember public key; identify by public key SKID, subseque= ntly > only verify the signature from the public key; Key roll over > * Issue: signing?; a priori discovery?; human comprehensible notion of > identity or name >=20 >=20 > Summary of S/MIME Problems/Issues > * Start: 11 Mar 16 (from mrex on: another attempt to canonicalize local= > parts) > * Issues: Incomplete chains; Mail archival problems when certificates > expire i.e. revalidating signature or decryption due to MUA certificate= and > timestamp management, and lack of help from CAs >=20 >=20 > Another attempt to canonicalize local parts: 3rd party interpretation o= f > email address local parts for validation or key discovery is a bad ide= a > * Start: 11 Mar 16 > * Issues: RFC5321 stats only MTA may interpret the local part; MUA UI > poorly does key management; =E2=80=9Ckey structures=E2=80=9D i.e. key d= iscovery is difficult > * Proposal: Modernize email address to enable validation; IETF should g= et > into standardizing UI particularly for key management; Key discovery vi= a > oracle >=20 >=20 > e2e email security (stephen farrell) > * Start: 12 Mar 16 > * Issues: No MUA development; email environment is centralized; mail > headers not protected; e2e may prevent anti-spam technology > * Proposal: allow experimentation >=20 >=20 > Key lookup service via draft-bhjl-x509-srv-00 > * Start 22 Mar 16 > * Proposal: Use the draft for key lookup; provides means to do initial > certificate discovery; authoritative; certificate renewal; oracle for n= ew > email name variants; > * Issues: Key management is hard; security risk for automated key > re-enrollment; security issues with a centralized key directory; handli= ng > ownership of multiple mailbox; > * Draft: draft-bhjl-x509-srv-00 >=20 >=20 > BCP proposal: regular expressions for Internet Mail identifiers > * Start: 22 Mar 16 > * Proposal: Standardize regex for email addresses >=20 >=20 > S/MIME Mailing List >=20 >=20 > Message takeover attacks against S/MIME > * Start: 27 Jan 16 > * Proposal: Adding authenticated encryption to S/MIME; > * Issues: S/MIME doesn=E2=80=99t keep headers private; MUA don=E2=80=99= t understand > message/rfc822; attack via signed-then-encrypted message into > encrypted-then-signed using attackers identity and replies will leak th= e > original content >=20 >=20 > Is this enough to re-charter the S/MIME WG? > * Start: 8 Mar 16 (from housley on =E2=80=9CMessage takeover attacks ag= ainst > S/MIME=E2=80=9D) > * several folks willing to help; AEAD: AES-CCM, AES-GCM, ChaCha20-Poly1= 305; > domain signing; Curve25519 and Curve448, CFRG ECC curves; automated ce= rt > enrollment; protect mail headers; standardize on RFC5753 i.e.ECC away = from > informational; updated RFC documentation e.g. RFC 4134; drop old cipher= s > e.g. md5, sha1; prevent signature stripping attacks > * Draft: draft-melnikov-smime-msa-to-mda-04 >=20 >=20 > General S/MIME issues / solutions > * Start: 29 Jan 16 (from phill on: Message takeover attacks against S/M= IME) > * Proposal: merge PGP and S/MIME; publish consistent modern crypto suit= in > CURDLE; make it work with WebMail; configuration must be painless >=20 >=20 > ---------- Forwarded message ---------- > From: Stephen Farrell > Date: Thu, Mar 24, 2016 at 5:28 AM > Subject: Re: [pkix] possible new pkix and/or smime work > To: pkix >=20 >=20 >=20 > I got a couple of volunteers, Wei Chuang and John Levine > (thanks both!) who're aiming to produce us a summary of > the recent list discussion we can ponder in a few days. >=20 > Cheers, > S. >=20 > On 23/03/16 20:35, Stephen Farrell wrote: >> >> Folks, >> >> I'm finding it hard to evaluate the discussion as to whether >> there's new work folks want to do here that'd justify forming >> a (coherent) WG and that'd result in likely implementation and >> deployment. I expect others may be similarly uncertain. >> >> Would someone be willing to volunteer to act in a slightly >> chair-like manner and try to summarise the discussion in a >> way that might help us judge the above? >> >> I think that might help us to e.g. organise a bit of a bar >> BoF or collective chat amongst those interested while a bunch >> of us are in B-A and on the list prior to that. >> >> Thanks, >> S. >> >> PS; If you are willing to do that but shy, feel free to send to >> me offlist and I can pretend I did the work:-) >> >> >> >> >> _______________________________________________ >> pkix mailing list >> pkix@ietf.org >> https://www.ietf.org/mailman/listinfo/pkix >> >=20 >=20 > _______________________________________________ > pkix mailing list > pkix@ietf.org > https://www.ietf.org/mailman/listinfo/pkix >=20 --------------ms060402010204020003060306 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC CvIwggUIMIID8KADAgECAhBPzaE7pzYviUJyhmHTFBdnMA0GCSqGSIb3DQEBCwUAMHUxCzAJ BgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBD ZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEjMCEGA1UEAxMaU3RhcnRDb20gQ2xhc3MgMSBDbGll bnQgQ0EwHhcNMTYwMjA5MDkyODE1WhcNMTcwMjA5MDkyODE1WjBOMSIwIAYDVQQDDBlzdGVw aGVuLmZhcnJlbGxAY3MudGNkLmllMSgwJgYJKoZIhvcNAQkBFhlzdGVwaGVuLmZhcnJlbGxA Y3MudGNkLmllMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtuC0rYze/2JinSra C9F2RjGdQZjNALLcW9C3WKTwYII3wBslobmHuPEYE5JaGItmzuKnAW619R1rD/kfoNWC19N3 rBZ6UX9Cmb9D9exCwYIwVuSwjrCQWGxgCtNQTrwKzCCpI790GRiMTvxvO7UmzmBrCaBLiZW5 R0fBjK5Yn6hUhAzGBkNbkIEL28cLJqH0yVz7Kl92OlzrQqTPEts5m6cDnNdY/ADfeAX18c1r dxZqcAxhLotrCqgsVA4ilbQDMMXGTLlB5TP35HeWZuGBU7xu003rLcFLdOkD8xvpJoYZy9Kt 3oABXPS5yqtMK+XCNdqmMn+4mOtLwQSMmPCSiQIDAQABo4IBuTCCAbUwCwYDVR0PBAQDAgSw MB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAJBgNVHRMEAjAAMB0GA1UdDgQWBBQJ QhvwQ5Fl372Z6xqo6fdn8XejTTAfBgNVHSMEGDAWgBQkgWw5Yb5JD4+3G0YrySi1J0htaDBv BggrBgEFBQcBAQRjMGEwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbTA5 BggrBgEFBQcwAoYtaHR0cDovL2FpYS5zdGFydHNzbC5jb20vY2VydHMvc2NhLmNsaWVudDEu Y3J0MDgGA1UdHwQxMC8wLaAroCmGJ2h0dHA6Ly9jcmwuc3RhcnRzc2wuY29tL3NjYS1jbGll bnQxLmNybDAkBgNVHREEHTAbgRlzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllMCMGA1UdEgQc MBqGGGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tLzBGBgNVHSAEPzA9MDsGCysGAQQBgbU3AQIE MCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeTANBgkqhkiG 9w0BAQsFAAOCAQEArzrSv2C8PlBBmGuiGrzm2Wma46/KHtXmZYS0bsd43pM66Pc/MsqPE0HD C1GzMFfwB6BfkJn8ijNSIhlgj898WzjvnpM/SO8KStjlB8719ig/xKISrOl5mX55XbFlQtX9 U6MrqRgbDIATxhD9IDr+ryvovDzChqgQj7mt2jYr4mdlRjsjod3H1VY6XglRmaaNGZfsCARM aE/TU5SXIiqauwt5KxNGYAY67QkOBs7O1FkSXpTk7+1MmzJMF4nP8QQ5n8vhVNseF+/Wm7ai 9mtnrkLbaznMsy/ULo/C2yuLUWTbZZbf4EKNmVdme6tUDgYkFjAFOblfA7W1fSPiQGagYzCC BeIwggPKoAMCAQICEGunin0K14jWUQr5WeTntOEwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5MB4XDTE1MTIxNjAxMDAwNVoXDTMwMTIxNjAxMDAwNVowdTELMAkGA1UEBhMC SUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmlj YXRpb24gQXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQTCC ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL192vfDon2D9luC/dtbX64eG3XAtRmv mCSsu1d52DXsCR58zJQbCtB2/A5uFqNxWacpXGGtTCRk9dEDBlmixEd8QiLkUfvHpJX/xKnm VkS6Iye8wUbYzMsDzgnpazlPg19dnSqfhM+Cevdfa89VLnUztRr2cgmCfyO9Otrh7LJDPG+4 D8ZnAqDtVB8MKYJL6QgKyVhhaBc4y3bGWxKyXEtx7QIZZGxPwSkzK3WIN+VKNdkiwTubW5PI dopmykwvIjLPqbJK7yPwFZYekKE015OsW6FV+s4DIM8UlVS8pkIsoGGJtMuWjLL4tq2hYQuu N0jhrxK1ljz50hH23gA9cbMCAwEAAaOCAWQwggFgMA4GA1UdDwEB/wQEAwIBBjAdBgNVHSUE FjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIBADAyBgNVHR8EKzAp MCegJaAjhiFodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9zZnNjYS5jcmwwZgYIKwYBBQUHAQEE WjBYMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5zdGFydHNzbC5jb20wMAYIKwYBBQUHMAKG JGh0dHA6Ly9haWEuc3RhcnRzc2wuY29tL2NlcnRzL2NhLmNydDAdBgNVHQ4EFgQUJIFsOWG+ SQ+PtxtGK8kotSdIbWgwHwYDVR0jBBgwFoAUTgvvGqRAW6UXaYcwyjRoQ9BBrvIwPwYDVR0g BDgwNjA0BgRVHSAAMCwwKgYIKwYBBQUHAgEWHmh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Bv bGljeTANBgkqhkiG9w0BAQsFAAOCAgEAi+P3h+wBi4StDwECW5zhIycjBL008HACblIf26HY 0JdOruKbrWDsXUsiI0j/7Crft9S5oxvPiDtVqspBOB/y5uzSns1lZwh7sG96bYBZpcGzGxpF NjDmQbcM3yl3WFIRS4WhNrsOY14V7y2IrUGsvetsD+bjyOngCIVeC/GmsmtbuLOzJ606tEc9 uRbhjTu/b0x2Fo+/e7UkQvKzNeo7OMhijixaULyINBfCBJb+e29bLafgu6JqjOUJ9eXXj20p 6q/CW+uVrZiSW57+q5an2P2i7hP85jQJcy5j4HzA0rSiF3YPhKGAWUxKPMAVGgcYoXzWydOv Z3UDsTDTagXpRDIKQLZo02wrlxY6iMFqvlzsemVf1odhQJmi7Eh5TbxI40kDGcBOBHhwnaOu mZhLP+SWJQnjpLpSlUOj95uf1zo9oz9e0NgIJoz/tdfrBzez76xtDsK0KfUDHt1/q59BvDI7 RX6gVr0fQoCyMczNzCTcRXYHY0tq2J0oT+bsb6sH2b4WVWAiJKnSYaWDjdA70qHX4mq9MIjO /ZskmSY8wtAk24orAc0vwXgYanqNsBX5Yv4sN4Z9VyrwMdLcusP7HJgRdAGKpkR2I9U4zEsN JQJewM7S4Jalo1DyPrLpL2nTET8ZrSl5Utp1UeGp/2deoprGevfnxWB+vHNQiu85o6MxggPM MIIDyAIBATCBiTB1MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEpMCcG A1UECxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0 Q29tIENsYXNzIDEgQ2xpZW50IENBAhBPzaE7pzYviUJyhmHTFBdnMA0GCWCGSAFlAwQCAQUA oIICEzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xNjAzMzEx OTA4MDdaMC8GCSqGSIb3DQEJBDEiBCB9K95V5i8DrI1PauuHT0oe80sm8Tk4067l8NFPHvFq 4TBsBgkqhkiG9w0BCQ8xXzBdMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAQIwCgYIKoZIhvcN AwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMC AgEoMIGaBgkrBgEEAYI3EAQxgYwwgYkwdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMw IQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQQIQT82hO6c2L4lCcoZh0xQXZzCB nAYLKoZIhvcNAQkQAgsxgYyggYkwdTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29t IEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSMwIQYD VQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQQIQT82hO6c2L4lCcoZh0xQXZzANBgkq hkiG9w0BAQEFAASCAQAjYIXySfhE/7PDOHf9yb20Ye6cwbX3tCqy8DVG+DnImZAsAJjN+ppc m7FkdBGbx6VRaivczo0jJnSxA3pZk/KUFoZaFHoSFYQqea7zKyKli6XynHszEdyPMbCE/KTf 8c6ukcKU2nyXbcplkxXHASbW+xZu0Z2gJVvMcuBdX7bBLlR+MCaLhYnIeYtdc3jHMUeJzq7S cFsR+dBhm+/i28RUVfs2Zm55OSKPJ4hC848kbF5L7N9wK+eI5a4KB25StWUdDDI/BrNiQdFk ALeouD0GB+qJgtPbQFRqacLQn2TpTiMBkADo//HKqMuvdCYSX9UTITJtH2FJKdxW6VYxmw5k AAAAAAAA --------------ms060402010204020003060306-- From nobody Thu Mar 31 12:21:37 2016 Return-Path: X-Original-To: smime@ietfa.amsl.com Delivered-To: smime@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5A81812D786 for ; Thu, 31 Mar 2016 12:21:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.899 X-Spam-Level: X-Spam-Status: No, score=-101.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uBm4TKnVwGmv for ; Thu, 31 Mar 2016 12:21:33 -0700 (PDT) Received: from odin.smetech.net (x-bolt-wan.smeinc.net [209.135.219.146]) by ietfa.amsl.com (Postfix) with ESMTP id 5552A12D53D for ; Thu, 31 Mar 2016 12:21:33 -0700 (PDT) Received: from localhost (ronin.smetech.net [209.135.209.5]) by odin.smetech.net (Postfix) with ESMTP id C7206F24041; Thu, 31 Mar 2016 15:21:32 -0400 (EDT) X-Virus-Scanned: amavisd-new at smetech.net Received: from odin.smetech.net ([209.135.209.4]) by localhost (ronin.smeinc.net [209.135.209.5]) (amavisd-new, port 10024) with ESMTP id FWiohLlyJidz; Thu, 31 Mar 2016 15:07:11 -0400 (EDT) Received: from [172.26.8.102] (unknown [104.129.194.79]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by odin.smetech.net (Postfix) with ESMTP id 6018CF24013; Thu, 31 Mar 2016 15:21:21 -0400 (EDT) Content-Type: multipart/alternative; boundary="Apple-Mail=_6ADAAD39-56A9-442A-BC56-4973B33C6F30" Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) From: Russ Housley In-Reply-To: <56FD7471.1030208@yaanatech.com> Date: Thu, 31 Mar 2016 15:21:20 -0400 Message-Id: <9ACD485D-0603-4F60-AAC8-493466465D4A@vigilsec.com> References: <9A043F3CF02CD34C8E74AC1594475C73F4BDB8A8@uxcn10-5.UoA.auckland.ac.nz> <56d70399.8d41620a.19ae8.ffffeb3bSMTPIN_ADDED_MISSING@mx.google.com> <020501d18911$ba97b990$2fc72cb0$@augustcellars.com> <000701d18994$923ad7b0$b6b08710$@x500.eu> <56FD7471.1030208@yaanatech.com> To: Tony Rutkowski , Erik Andersen X-Mailer: Apple Mail (2.1878.6) Archived-At: Cc: IETF SMIME Subject: Re: [smime] Message takeover attacks against S/MIME X-BeenThere: smime@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SMIME Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 31 Mar 2016 19:21:36 -0000 --Apple-Mail=_6ADAAD39-56A9-442A-BC56-4973B33C6F30 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=windows-1252 I do not envision the S/MIME work having any dependency on the X.894 = document. Russ On Mar 31, 2016, at 3:03 PM, Tony Rutkowski wrote: > Are we discussing the IETF's CMS or > the ITU-T's just adopted version as > X.894? > --tony >=20 > On 2016-03-29 4:25 AM, Erik Andersen wrote: >> Does any of proposed action for S/MIME affect CMS? >>=20 >> Erik >>=20 >> -----Oprindelig meddelelse----- >> Fra: smime [mailto:smime-bounces@ietf.org] P=E5 vegne af Jim Schaad >> Sendt: 28 March 2016 18:49 >> Til: 'Sean Turner' ; 'Wei Chuang' >> Cc: 'IETF SMIME' >> Emne: Re: [smime] Message takeover attacks against S/MIME >>=20 >> I am open to suggestions, but until somebody gives be a better answer = I do not know how to do the following: >>=20 >>>> * A better mechanism than sign-encrypt-sign to get both=20 >>>> authentication and >>> confidentiality (or at least a non-strippable way of doing it) >> Using and AEAD algorithm only solves part of the problem as one can = do an encrypt-sign but the outer integrity cannot be validated by a = third party. This is also set to be able for third parties to add the = outer signature layer and that has been used in several specifications = so it is not clear to me that this is one issue that needs to be fixed. >>=20 >> I do to totally agree that we need to start moving to AEAD algorithms = however. >>=20 >> jim >>=20 >>> -----Original Message----- >>> From: smime [mailto:smime-bounces@ietf.org] On Behalf Of Sean Turner >>> Sent: Monday, March 28, 2016 6:11 AM >>> To: Wei Chuang >>> Cc: IETF SMIME >>> Subject: Re: [smime] Message takeover attacks against S/MIME >>>=20 >>> If the patient is on the table, then all of these look like items = we=92d=20 >>> need to address. >>>=20 >>> spt >>>=20 >>>> On Mar 26, 2016, at 09:57, Wei Chuang wrote: >>>>=20 >>>> Some more work item suggestions (I'm posting on behalf of someone=20= >>>> who >>> wishes to avoid the rough and tumble of discussion on the mailing = list=20 >>> though reads it): >>>> * Making ECC an official part of S/MIME, RFC5753 is only = informational. >>>> * Authenticated encryption. >>>> * A better mechanism than sign-encrypt-sign to get both=20 >>>> authentication and >>> confidentiality (or at least a non-strippable way of doing it) >>>> * Dropping obsolete ciphers and hashes from the spec: drop SHA-1, = MD5, etc. >>>> * A modernized RFC 4134 (practical examples of S/MIME messages, it=20= >>>> could >>> avoid the fiasco of 3rd party forgetting ASN-1 tags in their = messages). >>>> -Wei >>>>=20 >>>>=20 >>>> On Sun, Mar 13, 2016 at 9:38 AM, Wei Chuang = wrote: >>>> Some interesting usability consideration were raised on the PKIX=20 >>>> list by Martin >>> Rex in the thread "another attempt to canonicalize local parts" that=20= >>> could be addressed by a rechartered WG. He points out problems with >>>> - Incompletely specified cert chains preventing signature = verification i.e. >>> missing CA certs and no ability to fetch them. Fully specifying the=20= >>> chains would resolve this. >>>> - Reverifying old "archived" emails on his MUA not possible as the=20= >>>> certs have >>> expired. Fixing a verification time on delivery or other scheme is = desirable. >>>> -Wei >>>>=20 >>>> On Thu, Mar 10, 2016 at 11:12 AM, Wei Chuang >>> wrote: >>>>=20 >>>> On Mon, Mar 7, 2016 at 10:58 PM, Russ Housley = >>> wrote: >>>> I am hearing interest in these topics (a combination of things on=20= >>>> this list and >>> side conversations). >>>> (1) Specify the way to use authenticated encryption in S/MIME. = Note=20 >>>> that it is >>> already done for CMS. >>>> (2) Specify conventions for AES-CCM, AES-GCM, and ChaCha20 with=20 >>>> Poly1305 >>> authenticated encryption algorithms. >>>> (3) Specify conventions for using Curve25519 and Curve448 for key = agreement. >>>>=20 >>>> (4) Specify conventions for using the CFRG chosen curves for=20 >>>> elliptic curve >>> digital signature. >>>> (5) Specify a way to use PGP public keys in addition to PKIX = certificates. >>>>=20 >>>> Anything else? >>>>=20 >>>> While I'm afraid of scope creep as resolving the above would be = very=20 >>>> useful, >>> could also mail header integrity and privacy be considered? Perhaps=20= >>> the WG scope be split into near and long term work to help = prioritize. =20 >>> The above five items be categorize as near term and the mail header=20= >>> work considered longer term? >>>> -Wei >>>>=20 >>>> (PS yes there is RFC7508 which is experimental, and does not keep=20= >>>> private the >>> sender and recipient. Still it is an improvement...) >>>>=20 >>>> Is this enough to re-charter the S/MIME WG? >>>>=20 >>>> Russ >>>> _______________________________________________ >>>> smime mailing list >>>> smime@ietf.org >>>> https://www.ietf.org/mailman/listinfo/smime >>>>=20 >>>>=20 >>>>=20 >>>> _______________________________________________ >>>> smime mailing list >>>> smime@ietf.org >>>> https://www.ietf.org/mailman/listinfo/smime >>> _______________________________________________ >>> smime mailing list >>> smime@ietf.org >>> https://www.ietf.org/mailman/listinfo/smime >> _______________________________________________ >> smime mailing list >> smime@ietf.org >> https://www.ietf.org/mailman/listinfo/smime >>=20 >> _______________________________________________ >> smime mailing list >> smime@ietf.org >> https://www.ietf.org/mailman/listinfo/smime >=20 > --=20 > ________________________________ >=20 > Anthony Michael Rutkowski >=20 > EVP, Industry Standards & Regulatory Affairs >=20 > tony@yaanatech.com >=20 > +1 703 999 8270 >=20 > ________________________________ >=20 > Yaana Technologies LLC >=20 >=20 > 542 Gibraltar Drive >=20 > Milpitas CA 95035 USA >=20 > = _______________________________= ________________ > smime mailing list > smime@ietf.org > https://www.ietf.org/mailman/listinfo/smime --Apple-Mail=_6ADAAD39-56A9-442A-BC56-4973B33C6F30 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=windows-1252 I do = not envision the S/MIME work having any dependency on the X.894 = document.

Russ


O= n Mar 31, 2016, at 3:03 PM, Tony Rutkowski <tony@yaanatech.com> = wrote:

=20 =20
Are we discussing the IETF's CMS or
the ITU-T's just adopted version as
X.894?
--tony

On 2016-03-29 4:25 AM, Erik Andersen wrote:
Does any of proposed action for S/MIME affect CMS?

Erik

-----Oprindelig meddelelse-----
Fra: smime [mailto:smime-bounces@ietf.org] =
P=E5 vegne af Jim Schaad
Sendt: 28 March 2016 18:49
Til: 'Sean Turner' <sean@sn3rd.com>; 'Wei Chuang' =
<weihaw@google.com>
Cc: 'IETF SMIME' <smime@ietf.org>
Emne: Re: [smime] Message takeover attacks against S/MIME

I am open to suggestions, but until somebody gives be a better answer I =
do not know how to do the following:


* A better mechanism than sign-encrypt-sign to =
get both=20
authentication and

confidentiality (or at least a non-strippable way =
of doing it)

Using and AEAD algorithm only solves part of the =
problem as one can do an encrypt-sign but the outer integrity cannot be =
validated by a third party.  This is also set to be able for third =
parties to add the outer signature layer and that has been used in =
several specifications so it is not clear to me that this is one issue =
that needs to be fixed.

I do to totally agree that we need to start moving to AEAD algorithms =
however.

jim


-----Original Message-----
From: smime [mailto:smime-bounces@ietf.org] =
On Behalf Of Sean Turner
Sent: Monday, March 28, 2016 6:11 AM
To: Wei Chuang <weihaw@google.com>
Cc: IETF SMIME <smime@ietf.org>
Subject: Re: [smime] Message takeover attacks against S/MIME

If the patient is on the table, then all of these look like items we=92d=20=

need to address.

spt


On Mar 26, 2016, at 09:57, Wei Chuang <weihaw@google.com> wrote:

Some more work item suggestions (I'm posting on behalf of someone=20
who

wishes to avoid the rough and tumble of =
discussion on the mailing list=20
though reads it):

* Making ECC an official part of S/MIME, =
RFC5753 is only informational.
* Authenticated encryption.
* A better mechanism than sign-encrypt-sign to get both=20
authentication and

confidentiality (or at least a non-strippable way =
of doing it)

* Dropping obsolete ciphers and hashes from the =
spec: drop SHA-1, MD5, etc.
* A modernized RFC 4134 (practical examples of S/MIME messages, it=20
could

avoid the fiasco of 3rd party forgetting ASN-1 =
tags in their messages).

-Wei


On Sun, Mar 13, 2016 at 9:38 AM, Wei Chuang <weihaw@google.com> wrote:
Some interesting usability consideration were raised on the PKIX=20
list by Martin

Rex in the thread "another attempt to =
canonicalize local parts" that=20
could be addressed by a rechartered WG.  He points out problems with

- Incompletely specified cert chains preventing =
signature verification i.e.

missing CA certs and no ability to fetch them.  =
Fully specifying the=20
chains would resolve this.

- Reverifying old "archived" emails on his MUA =
not possible as the=20
certs have

expired.  Fixing a verification time on delivery =
or other scheme is desirable.

-Wei

On Thu, Mar 10, 2016 at 11:12 AM, Wei Chuang <weihaw@google.com>

wrote:

On Mon, Mar 7, 2016 at 10:58 PM, Russ Housley <housley@vigilsec.com>

wrote:

I am hearing interest in these topics (a =
combination of things on=20
this list and

side conversations).

(1) Specify the way to use authenticated =
encryption in S/MIME.  Note=20
that it is

already done for CMS.

(2) Specify conventions for AES-CCM, AES-GCM, =
and ChaCha20 with=20
Poly1305

authenticated encryption algorithms.

(3) Specify conventions for using Curve25519 =
and Curve448 for key agreement.

(4) Specify conventions for using the CFRG chosen curves for=20
elliptic curve

digital signature.

(5) Specify a way to use PGP public keys in =
addition to PKIX certificates.

Anything else?

While I'm afraid of scope creep as resolving the above would be very=20
useful,

could also mail header integrity and privacy be =
considered?  Perhaps=20
the WG scope be split into near and long term work to help prioritize. =20=

The above five items be categorize as near term and the mail header=20
work considered longer term?

-Wei

(PS yes there is RFC7508 which is experimental, and does not keep=20
private the

sender and recipient.  Still it is an =
improvement...)

Is this enough to re-charter the S/MIME WG?

Russ
_______________________________________________
smime mailing list
smime@ietf.org
https://www.ietf.org/=
mailman/listinfo/smime



_______________________________________________
smime mailing list
smime@ietf.org
https://www.ietf.org/=
mailman/listinfo/smime

_______________________________________________
smime mailing list
smime@ietf.org
https://www.ietf.org/=
mailman/listinfo/smime

_______________________________________________
smime mailing list
smime@ietf.org
https://www.ietf.org/=
mailman/listinfo/smime

_______________________________________________
smime mailing list
smime@ietf.org
https://www.ietf.org/=
mailman/listinfo/smime

--

_______________________= _________

Anthony Michael Rutkowski

EVP, Industry Standards & Regulatory Affairs

tony@yaanatech.com=20

+1 703 999 8270

_______________________= _________

Yaana Technologies LLC


542 Gibraltar Drive

Milpitas CA 95035 USA

= <T13-SG17-160314-TD-PLEN-2558!R1!MSW-E.doc>____________= ___________________________________
smime mailing list
smime@ietf.org
https://www.ietf.org/= mailman/listinfo/smime

= --Apple-Mail=_6ADAAD39-56A9-442A-BC56-4973B33C6F30--